Adds the StripClientHello option to prevent logging of the initial ClientHello message during a connection upgrade in autossl mode.

- feat(opts): Add `StripClientHello` connection option
- feat(autossl): Add function to check if searching for ClientHello
- feat(log): Skip logging ClientHello when `StripClientHello` is enabled
- test(opts): Add test coverage for `StripClientHello` option
- docs: Add `StripClientHello` to documentation and examples
- chore: Add new contributor to AUTHORS.md

Author: Drewsif

AUTHORS.md

@@ -27,6 +27,7 @@ patches or pull requests, in chronological order of their first contribution:
 -   Levente Polyak ([anthraxx](https://github.com/anthraxx))
 -   Nick French ([naf419](https://github.com/naf419))
 -   Cihan Kömeçoğlu ([cihankom](https://github.com/cihankom))
+-   Drew Bonasera ([Drewsif](https://github.com/Drewsif))
 
 Many more individuals have contributed by reporting bugs or feature requests.
 See [issue tracker on Github][1], `NEWS.md` and `git log` for details.

README.md

@@ -134,6 +134,7 @@ connection options too:
 
 	    RemoveHTTPAcceptEncoding (yes|no)
 	    RemoveHTTPReferer (yes|no)
+	    StripClientHello (yes|no)
 	    MaxHTTPHeaderSize 8192
 	    ValidateProto (yes|no)
 
@@ -461,6 +462,7 @@ connection options too:
 
 	    RemoveHTTPAcceptEncoding (yes|no)
 	    RemoveHTTPReferer (yes|no)
+	    StripClientHello (yes|no)
 	    MaxHTTPHeaderSize 8192
 	    ValidateProto (yes|no)
 

src/opts.c

@@ -613,6 +613,7 @@ conn_opts_copy(conn_opts_t *conn_opts, const char *argv0, tmp_opts_t *tmp_opts)
 	cops->validate_proto = conn_opts->validate_proto;
 	cops->reconnect_ssl = conn_opts->reconnect_ssl;
 	cops->max_http_header_size = conn_opts->max_http_header_size;
+	cops->stripclienthello = conn_opts->stripclienthello;
 
 	// Pass NULL as tmp_opts param, so we don't reassign the var to itself
 	// That would be harmless but incorrect
@@ -1129,7 +1130,7 @@ conn_opts_str(conn_opts_t *conn_opts)
 #ifndef WITHOUT_USERAUTH
 				 "%s|%s|%d"
 #endif /* !WITHOUT_USERAUTH */
-				 "%s%s|%d",
+				 "%s%s%s|%d",
 #if (OPENSSL_VERSION_NUMBER < 0x10100000L) || (defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x20702000L)
 #ifdef HAVE_SSLV2
 	               (conn_opts->sslmethod == SSLv2_method) ? "ssl2" :
@@ -1264,6 +1265,7 @@ conn_opts_str(conn_opts_t *conn_opts)
 #endif /* !WITHOUT_USERAUTH */
 	             (conn_opts->validate_proto ? "|validate_proto" : ""),
 	             (conn_opts->reconnect_ssl ? "|reconnect_ssl" : ""),
+	             (conn_opts->stripclienthello ? "|stripclienthello" : ""),
 	             conn_opts->max_http_header_size
 	               ) < 0) {
 		return oom_return_na_null();
@@ -1605,6 +1607,18 @@ opts_unset_passthrough(conn_opts_t *conn_opts)
 	conn_opts->passthrough = 0;
 }
 
+void
+opts_set_stripclienthello(conn_opts_t *conn_opts)
+{
+	conn_opts->stripclienthello = 1;
+}
+
+void
+opts_unset_stripclienthello(conn_opts_t *conn_opts)
+{
+	conn_opts->stripclienthello = 0;
+}
+
 int
 opts_set_clientcrt(conn_opts_t *conn_opts, const char *argv0, const char *optarg, tmp_opts_t *tmp_opts)
 {
@@ -2784,6 +2798,14 @@ set_conn_opts_option(conn_opts_t *conn_opts, const char *argv0,
 		yes ? opts_set_remove_http_referer(conn_opts) : opts_unset_remove_http_referer(conn_opts);
 #ifdef DEBUG_OPTS
 		log_dbg_printf("RemoveHTTPReferer: %u\n", conn_opts->remove_http_referer);
+#endif /* DEBUG_OPTS */
+	} else if (equal(name, "StripClientHello")) {
+		yes = check_value_yesno(value, "StripClientHello", line_num);
+		if (yes == -1)
+			return -1;
+		yes ? opts_set_stripclienthello(conn_opts) : opts_unset_stripclienthello(conn_opts);
+#ifdef DEBUG_OPTS
+		log_dbg_printf("StripClientHello: %u\n", conn_opts->stripclienthello);
 #endif /* DEBUG_OPTS */
 	}
 	else {

src/opts.h

@@ -146,6 +146,7 @@ typedef struct conn_opts {
 	// Used with struct filtering rules only
 	unsigned int reconnect_ssl : 1;
 	unsigned int max_http_header_size;
+	unsigned int stripclienthello : 1;
 } conn_opts_t;
 
 typedef struct opts {
@@ -313,6 +314,8 @@ int opts_set_chain(conn_opts_t *, const char *, const char *, tmp_opts_t *) NONN
 int opts_set_leafcrlurl(conn_opts_t *, const char *, const char *, tmp_opts_t *) NONNULL(1,2,3) WUNRES;
 void opts_set_deny_ocsp(conn_opts_t *) NONNULL(1);
 void opts_set_passthrough(conn_opts_t *) NONNULL(1);
+void opts_set_stripclienthello(conn_opts_t *) NONNULL(1);
+void opts_unset_stripclienthello(conn_opts_t *) NONNULL(1);
 int opts_set_clientcrt(conn_opts_t *, const char *, const char *, tmp_opts_t *) NONNULL(1,2,3) WUNRES;
 int opts_set_clientkey(conn_opts_t *, const char *, const char *, tmp_opts_t *) NONNULL(1,2,3) WUNRES;
 #ifndef OPENSSL_NO_DH

src/protoautossl.c

@@ -42,6 +42,17 @@ struct protoautossl_ctx {
 	unsigned int clienthello_found : 1;      /* 1 if conn upgrade to SSL */
 };
 
+int
+protoautossl_is_searching(pxy_conn_ctx_t *ctx)
+{
+       protoautossl_ctx_t *autossl_ctx;
+       if (!ctx->protoctx) {
+               return 0;
+       }
+       autossl_ctx = ctx->protoctx->arg;
+       return autossl_ctx && autossl_ctx->clienthello_search;
+}
+
 #ifdef DEBUG_PROXY
 static void NONNULL(1,2,3)
 protoautossl_log_dbg_evbuf_info(pxy_conn_ctx_t *ctx, pxy_conn_desc_t *this, pxy_conn_desc_t *other)

src/protoautossl.h

@@ -35,4 +35,6 @@
 protocol_t protoautossl_setup(pxy_conn_ctx_t *) NONNULL(1);
 protocol_t protoautossl_setup_child(pxy_conn_child_ctx_t *) NONNULL(1);
 
+int protoautossl_is_searching(pxy_conn_ctx_t *) NONNULL(1);
+
 #endif /* PROTOAUTOSSL_H */

src/pxyconn.c

@@ -1323,6 +1323,20 @@ pxy_bev_readcb_preexec_logging_and_stats(struct bufferevent *bev, pxy_conn_ctx_t
 		}
 
 		if (WANT_CONTENT_LOG(ctx->conn)) {
+                        if (ctx->conn_opts->stripclienthello && ctx->proto == PROTO_AUTOSSL && bev == ctx->src.bev) {
+                                if (protoautossl_is_searching(ctx)) {
+                                        size_t inbuf_len = evbuffer_get_length(inbuf);
+                                        size_t pullup_len = inbuf_len > 4096 ? 4096 : inbuf_len;
+                                        unsigned char *data = evbuffer_pullup(inbuf, pullup_len);
+                                        if (data) {
+                                                const unsigned char *chello = NULL;
+                                                int rv = ssl_tls_clienthello_parse(data, pullup_len, 0, &chello, NULL);
+                                                if (rv == 0 || (rv == 1 && chello != NULL)) {
+                                                        return 0;
+                                                }
+                                        }
+                                }
+                        }
 			// HTTP content logging at this point may record certain header lines twice, if we have not seen all headers yet
 			return pxy_log_content_inbuf(ctx, inbuf, (bev == ctx->src.bev));
 		}
@@ -1371,6 +1385,20 @@ pxy_bev_readcb_preexec_logging_and_stats_child(struct bufferevent *bev, pxy_conn
 	}
 
 	if (WANT_CONTENT_LOG(ctx->conn)) {
+                if (ctx->conn->conn_opts->stripclienthello && ctx->conn->proto == PROTO_AUTOSSL && bev == ctx->src.bev) {
+                        if (protoautossl_is_searching(ctx->conn)) {
+                                size_t inbuf_len = evbuffer_get_length(inbuf);
+                                size_t pullup_len = inbuf_len > 4096 ? 4096 : inbuf_len;
+                                unsigned char *data = evbuffer_pullup(inbuf, pullup_len);
+                                if (data) {
+                                        const unsigned char *chello = NULL;
+                                        int rv = ssl_tls_clienthello_parse(data, pullup_len, 0, &chello, NULL);
+                                        if (rv == 0 || (rv == 1 && chello != NULL)) {
+                                                return 0;
+                                        }
+                                }
+                        }
+                }
 		return pxy_log_content_inbuf(ctx->conn, inbuf, (bev == ctx->src.bev));
 	}
 	return 0;

src/sslproxy.1

@@ -168,6 +168,7 @@ ProxySpec {
 
     RemoveHTTPAcceptEncoding (yes|no)
     RemoveHTTPReferer (yes|no)
+    StripClientHello (yes|no)
     MaxHTTPHeaderSize 8192
     ValidateProto (yes|no)
 
@@ -475,6 +476,7 @@ FilterRule {
 
     RemoveHTTPAcceptEncoding (yes|no)
     RemoveHTTPReferer (yes|no)
+    StripClientHello (yes|no)
     MaxHTTPHeaderSize 8192
     ValidateProto (yes|no)
 

src/sslproxy.conf

@@ -221,6 +221,9 @@ RemoveHTTPAcceptEncoding no
 # Remove HTTP header line for Referer
 RemoveHTTPReferer yes
 
+# Strip ClientHello messages from content, PCAP, and mirror logs during autossl mode
+#StripClientHello no
+
 # Verify peer using default certificates
 VerifyPeer yes
 
@@ -366,6 +369,7 @@ PassUsers admin
 #    RemoveHTTPReferer (yes|no)
 #    VerifyPeer (yes|no)
 #    AllowWrongHost (yes|no)
+#    StripClientHello (yes|no)
 #    UserAuth (yes|no)
 #    UserTimeout 300
 #    UserAuthURL https://192.168.0.1/userdblogin.php
@@ -435,6 +439,7 @@ ProxySpec {
 	RemoveHTTPAcceptEncoding no
 	RemoveHTTPReferer yes
 	VerifyPeer yes
+	#StripClientHello no
 
 	UserAuth yes
 	UserTimeout 300

src/sslproxy.conf.5

@@ -281,6 +281,14 @@ Remove HTTP header line for Referer.
 .br
 Default: yes
 .TP
+\fBStripClientHello BOOL\fR
+Strip ClientHello messages from content, PCAP, and mirror logs during autossl mode.
+When a connection is upgraded from plain TCP to SSL/TLS in autossl mode,
+the initial cleartext ClientHello message sent by the client is stripped
+from the logs to prevent polluting them with the SSL handshake.
+.br
+Default: no
+.TP
 \fBVerifyPeer BOOL\fR
 Verify peer using default certificates.
 .br
@@ -485,6 +493,8 @@ RemoveHTTPAcceptEncoding
 .br
 RemoveHTTPReferer
 .br
+StripClientHello
+.br
 MaxHTTPHeaderSize
 .br
 ValidateProto
@@ -576,6 +586,8 @@ RemoveHTTPAcceptEncoding
 .br
 RemoveHTTPReferer
 .br
+StripClientHello
+.br
 MaxHTTPHeaderSize
 .br
 ValidateProto