Compatible with transparent bridge mode?

[mrbluecoat]

Is privaxy compatible with Layer 2 transparent bridge mode setups (aka stealth bump-in-the-wire firewall)? If yes, any guidance on a Linux setup?

[adriangalera]

I tried to make it work just by using iptables on the router however, I have failed miserably.
My use case is that I have a Samsung Smart TV where I cannot set any proxy, so my idea was to redirect the traffic comming from the ip to the host where the proxy is enabled:

iptables -t nat -A PREROUTING -p tcp -s 192.168.8.105 --dport 80 -j DNAT --to-destination 192.168.8.231:8100

However, privaxy expects some "Authority" header to be set:

gal@gal-MS-7816:~/workspace/gal/privaxy$ ./target/debug/privaxy
[2022-12-30T14:16:18Z INFO  privaxy] Proxy available at http://0.0.0.0:8100
[2022-12-30T14:16:20Z INFO  privaxy::configuration] Applied new configuration
[2022-12-30T14:17:41Z WARN  privaxy::proxy::mitm] Received a request without proper authority, sending bad request
[2022-12-30T14:20:33Z WARN  privaxy::proxy::mitm] Received a request without proper authority, sending bad request
[2022-12-30T14:20:45Z WARN  privaxy::proxy::mitm] Received a request without proper authority, sending bad request
[2022-12-30T14:20:59Z WARN  privaxy::proxy::mitm] Received a request without proper authority, sending bad request

I guess right now it's not possible to use privaxy without explictly configure the proxy :(

@Barre let us know if we can help you somehow to make this possible :)

[Barre]

If Http1, Authority is not a pseudo-header but part of URIs, in https://www.example.com/example, authority would be "www.example.com".

When using secured connections, I guess the issue is that your TV is sending requests such as:

GET /example HTTP/1.1
Host: www.example.com

Instead of something like:

CONNECT www.example.com HTTP/1.1
GET /example HTTP/1.1

Or, when issuing plain text requests :

GET /example HTTP/1.1
Host: www.example.com

Instead of something like:

GET http://www.example.com/example HTTP/1.1

It would be possible to write a patch that handles such a setting but I'm not sure we want that included in main codebase as it's pretty hacky especially as privaxy's https interception codepath is based on the CONNECT method

https://github.com/Barre/privaxy/blob/main/privaxy/src/server/proxy/mitm.rs#L37

[adriangalera]

👍 I've been checking https://developer.mozilla.org/es/docs/Web/HTTP/Methods/CONNECT and indeed the fact that relies on the CONNECT method forces the user to configure the proxy in the browser.

From the documentation loos like this method is only used by the browsers when they have a proxy configured. I'll need to find another way since I cannot configure the proxy in my TV :(

Any idea?

[adriangalera]

If you are interested in bringing this, I managed to get it working with mitmproxy: https://mitmproxy.org/

The redirection done with iptables works fine

[mrbluecoat]

@adriangalera feel free to share your solution in case some aspects can be leveraged with privaxy

[vadegdadeg]

Did you manage to somehow solve this problem?