diagrams/explicit-proxy.svg

<?xml version="1.0" encoding="UTF-8" standalone="no"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" contentScriptType="application/ecmascript" contentStyleType="text/css" height="564px" preserveAspectRatio="none" style="width:1322px;height:564px;" version="1.1" viewBox="0 0 1322 564" width="1322px" zoomAndPan="magnify"><defs><filter height="300%" id="f1m0s306q6kje8" width="300%" x="-1" y="-1"><feGaussianBlur result="blurOut" stdDeviation="2.0"/><feColorMatrix in="blurOut" result="blurOut2" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 .4 0"/><feOffset dx="4.0" dy="4.0" in="blurOut2" result="blurOut3"/><feBlend in="SourceGraphic" in2="blurOut3" mode="normal"/></filter></defs><g><!--MD5=[adb6ea0bf6618071f7193faf96b8bc6c]
cluster tls-proxy - Explicit-Proxy--><rect fill="#FFFFFF" filter="url(#f1m0s306q6kje8)" height="217" style="stroke: #000000; stroke-width: 1.5;" width="1080" x="6" y="6"/><text fill="#000000" font-family="sans-serif" font-size="14" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="200" x="446" y="20.9951">tls-proxy - Explicit-Proxy</text><!--MD5=[1738b10290744196459ddcf1d3ddb48e]
entity it--><rect fill="#FEFECE" filter="url(#f1m0s306q6kje8)" height="36.2969" style="stroke: #A80036; stroke-width: 1.5;" width="79" x="53" y="63"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="59" x="63" y="85.9951">iptables</text><!--MD5=[72f941736658486a9447ee9af01ffec8]
entity ss--><ellipse cx="505" cy="104" fill="#FEFECE" filter="url(#f1m0s306q6kje8)" rx="12" ry="12" style="stroke: #A80036; stroke-width: 2.0;"/><polygon fill="#A80036" points="501,92,507,87,505,92,507,97,501,92" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="67" x="471.5" y="132.9951">SslServer</text><ellipse cx="984.728" cy="115.0456" fill="#FEFECE" filter="url(#f1m0s306q6kje8)" rx="85.728" ry="19.5456" style="stroke: #A80036; stroke-width: 1.5;"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="144" x="912.728" y="119.694">HandleHttpConnect</text><ellipse cx="92.6456" cy="172.0291" fill="#FEFECE" filter="url(#f1m0s306q6kje8)" rx="70.6456" ry="16.5291" style="stroke: #A80036; stroke-width: 1.5;"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="108" x="38.6456" y="176.6776">ServerNameCb</text><ellipse cx="505.1122" cy="188.9224" fill="#FEFECE" filter="url(#f1m0s306q6kje8)" rx="75.1122" ry="17.4224" style="stroke: #A80036; stroke-width: 1.5;"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="119" x="445.6122" y="193.5709">FetchCertificate</text><!--MD5=[7d46d6cd919e02e6168a09ad91eae8b4]
entity u--><ellipse cx="1231.5" cy="280" fill="#FEFECE" filter="url(#f1m0s306q6kje8)" rx="8" ry="8" style="stroke: #A80036; stroke-width: 1.5;"/><path d="M1231.5,288 L1231.5,315 M1218.5,296 L1244.5,296 M1231.5,315 L1218.5,330 M1231.5,315 L1244.5,330 " fill="none" filter="url(#f1m0s306q6kje8)" style="stroke: #A80036; stroke-width: 1.5;"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="31" x="1216" y="348.4951">User</text><!--MD5=[8e565b71783df14e1b944b97098c1584]
entity hs--><polygon fill="#FEFECE" filter="url(#f1m0s306q6kje8)" points="1163,437.0004,1173,427.0004,1300,427.0004,1300,463.2973,1290,473.2973,1163,473.2973,1163,437.0004" style="stroke: #000000; stroke-width: 1.5;"/><line style="stroke: #000000; stroke-width: 1.5;" x1="1290" x2="1299" y1="437.0004" y2="428.0004"/><line style="stroke: #000000; stroke-width: 1.5;" x1="1163" x2="1290" y1="437.0004" y2="437.0004"/><line style="stroke: #000000; stroke-width: 1.5;" x1="1290" x2="1290" y1="437.0004" y2="473.2973"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="97" x="1178" y="459.9955">HTTPS Server</text><!--MD5=[cf7214cedfade17e1c951247ed11cbda]
link u to ss--><path d="M1215.59,315.19 C1140.13,335.422 796.472,415.6762 610,256 C574.108,225.266 609.355,191.03 580,154 C570.519,142.041 556.639,132.894 543.454,126.237 " fill="none" id="u-&gt;ss" style="stroke: #A80036; stroke-width: 1.0;"/><polygon fill="#A80036" points="538.637,123.897,544.9831,131.4288,543.134,126.0826,548.4801,124.2336,538.637,123.897" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="115" x="927" y="335.0669">1. HTTP CONNECT</text><!--MD5=[726ee5258f7fccadb765496f86f97ef9]
link ss to u--><path d="M538.793,128.299 C552.059,135.474 567.226,144.443 580,154 C594.849,165.11 593.602,174.339 610,183 C719.655,240.919 1117.54,296.113 1210.83,308.447 " fill="none" id="ss-&gt;u" style="stroke: #A80036; stroke-width: 1.0;"/><polygon fill="#A80036" points="1215.79,309.1,1207.3937,303.952,1210.8334,308.4429,1206.3424,311.8826,1215.79,309.1" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="225" x="872" y="249.0669">5. ServerHello, ServerCertificate, ...</text><!--MD5=[70a47e82848b9ab28bcc542c685a25e5]
link ss to ss--><path d="M471.484,89.602 C458.078,71.592 469.25,53 505,53 C537.957,53 550.026,68.8 541.208,85.379 " fill="none" id="ss-&gt;ss" style="stroke: #A80036; stroke-width: 1.0;"/><polygon fill="#A80036" points="538.516,89.602,546.7266,84.1627,541.2035,85.3857,539.9805,79.8626,538.516,89.602" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="146" x="432" y="44.0669">2. new TCP connection</text><!--MD5=[4d499f4de59868d92fc9c101691289a1]
link ss to hc--><path d="M538.767,114.376 C559.232,115.739 586.137,117.313 610,118 C707.165,120.801 818.603,119.293 894.283,117.562 " fill="none" id="ss-&gt;hc" style="stroke: #A80036; stroke-width: 1.0;"/><polygon fill="#A80036" points="899.67,117.437,890.5798,113.6464,894.6713,117.5527,890.765,121.6442,899.67,117.437" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="125" x="661" y="114.0669">3. is HTTP connect?</text><!--MD5=[1cb124cf95ba11b3a91de49604a7672d]
link hc to ss--><path d="M912.128,104.457 C888.294,101.41 861.554,98.503 837,97 C736.3,90.837 710.63,89.781 610,97 C587.952,98.582 563.476,102.027 543.81,105.217 " fill="none" id="hc-&gt;ss" style="stroke: #A80036; stroke-width: 1.0;"/><polygon fill="#A80036" points="538.658,106.065,548.1885,108.5489,543.5915,105.2523,546.8881,100.6553,538.658,106.065" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="138" x="654.5" y="88.0669">4. yes, use certificate</text><!--MD5=[eda512d1395929f72d562cedd5dbcb5a]
link snc to fc--><path d="M162.208,174.846 C234.871,177.855 349.318,182.595 425.493,185.749 " fill="none" id="snc-&gt;fc" style="stroke: #A80036; stroke-width: 1.0;"/><polygon fill="#A80036" points="430.91,185.974,422.0834,181.6046,425.9143,185.7669,421.752,189.5977,430.91,185.974" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="205" x="194" y="172.0669">3.1 fetch certificate from server</text><!--MD5=[7d76c334c0177dd41b13456db5324dc4]
link fc to hs--><path d="M507.783,206.51 C513.41,251.83 535.125,373.379 610,430.0004 C771.954,552.4728 1031.57,505.5228 1157.41,472.1804 " fill="none" id="fc-&gt;hs" style="stroke: #A80036; stroke-width: 1.0;"/><polygon fill="#A80036" points="1162.56,470.8022,1152.834,469.2517,1157.7282,472.0883,1154.8917,476.9825,1162.56,470.8022" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="91" x="939" y="481.0673">3.2 ClientHello</text><!--MD5=[eae3112bbf6de62d68ef5c17489da3e3]
link hs to fc--><path d="M1163,446.6918 C1021.63,438.6531 700.1,414.2269 610,355 C557.182,320.281 526.239,248.477 513.248,211.737 " fill="none" id="hs-&gt;fc" style="stroke: #A80036; stroke-width: 1.0;"/><polygon fill="#A80036" points="511.461,206.579,510.6284,216.3926,513.0982,211.3034,518.1874,213.7731,511.461,206.579" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="233" x="868" y="416.0669">3.3 ServerHello, ServerCertificate, ...</text><!--MD5=[1984aa905d13bd66ef2e64c30aceed52]
link fc to hc--><path d="M572.432,181.164 C639.391,172.985 745.617,159.243 837,144 C863.014,139.661 891.484,134.192 916.352,129.176 " fill="none" id="fc-&gt;hc" style="stroke: #A80036; stroke-width: 1.0;"/><polygon fill="#A80036" points="921.276,128.179,911.6615,126.0433,916.3753,129.1706,913.248,133.8844,921.276,128.179" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="225" x="611" y="140.0669">3.4 clone of https server certificate</text><!--MD5=[29215ce1c8bf53032be1af7ba00d07f4]
@startuml
left to right direction
actor "User" as u
rectangle "tls-proxy - Explicit-Proxy" {
  agent "iptables" as it
  control "SslServer" as ss
  usecase "HandleHttpConnect" as hc
  usecase "ServerNameCb" as snc
  usecase "FetchCertificate" as fc
}

node "HTTPS Server" as hs

u - - -> ss : 1. HTTP CONNECT
ss -> ss : 2. new TCP connection
ss - -> hc : 3. is HTTP connect?
snc - -> fc : 3.1 fetch certificate from server
fc - - -> hs : 3.2 ClientHello
hs - - -> fc : 3.3 ServerHello, ServerCertificate, ...
fc - -> hc : 3.4 clone of https server certificate
hc - -> ss : 4. yes, use certificate
ss - - -> u : 5. ServerHello, ServerCertificate, ...
@enduml

PlantUML version 1.2020.12(Sat Jun 06 10:54:15 UTC 2020)
(GPL source distribution)
Java Runtime: Java(TM) SE Runtime Environment
JVM: Java HotSpot(TM) 64-Bit Server VM
Default Encoding: UTF-8
Language: en
Country: US
--></g></svg>