Lo,

At work, we have a perfectly functioning proxy server, which I don't trust. :-/ So I wanted to use my home infrastructure in a transparent way (e.g., no SSH port forwarding) to allow me just to use my browser to get http pages via https. Sort of a chained proxy.

I came up with the following, working, configuration:

server {
listen 999 ssl;
server_name ~^(?<mangled>.+)\.ubergurus\.eu$;

set $website $mangled;
if ($website ~* (.*)_(.*)) { set $website $1.$2; }
if ($website ~* (.*)_(.*)) { set $website $1.$2; }
if ($website ~* (.*)_(.*)) { set $website $1.$2; }
if ($website ~* (.*)_(.*)) { set $website $1.$2; }
if ($website ~* (.*)_(.*)) { set $website $1.$2; }
if ($website ~* (.*)_(.*)) { set $website $1.$2; }
if ($website ~* (.*)_(.*)) { set $website $1.$2; }
if ($website ~* (.*)_(.*)) { set $website $1.$2; }
if ($website ~* (.*)_(.*)) { set $website $1.$2; }
if ($website ~* (.*)_(.*)) { set $website $1.$2; }

ssl_certificate /opt/etc/nginx/ssl_ubergurus.eu/wildcard.ubergurus.eu.crt;
ssl_certificate_key /opt/etc/nginx/ssl_ubergurus.eu/wildcard.ubergurus.eu.key;
ssl_crl /opt/etc/nginx/ssl_ubergurus.eu/crl.pem;
ssl_client_certificate /opt/etc/nginx/ssl_ubergurus.eu/ca.crt;
ssl_verify_client on;

location / {
proxy_set_header Host $website;
rewrite ^(.*)$ $website$request_uri break;
proxy_pass http://$website;
}
}

At home, 443 forwards to 999.

At work, I'm now able to get e.g. https://www_ns_nl.ubergurus.eu/ which results, after two-sided SSL being setup, in a http//www.ns.nl get at home, and tunneling the result back to work. Of course still the URL shows up in the work's proxy log, put no content. The server certificate is a self-signed wildcard certificate for *.ubergurus.eu, so any mangled site would work, as long as it doesn't contain the 'dot'-char.

A few questions came up during this invention:
- Repeating the if line 10 times allows 10 levels of _-chars, meaning 10 subdomains. Is there a better way to accomplish this?
- Some sites contain absolute URL's within the content (e.g. the <A HREF=""> tag and <IMG > tag), which aren't rewritten back to https://*.ubergurus.eu. This causes leakage at the work site. Is there a quick way to add that?
- Any ideas about a better mangling scheme to further obfuscate the destination website from the proxy log?

Or am I just being crazy here... ;-)

Tnx,
Marc.

PS: Great piece of software, nginx!
_______________________________________________
nginx mailing list
nginx@nginx.org
http://nginx.org/mailman/listinfo/nginx