SSL DND(Donot Decrypt)

In SSL-DND mode, the proxy operates as a transparent Layer 4 tunnel. It utilizes the standard HTTP CONNECT method to establish a bi-directional byte-stream between the client and the destination without terminating the TLS session.

Key Characteristics

* Zero Visibility: The proxy does not possess the destination's private keys and cannot inspect the encrypted payload.
* End-to-End Integrity: The TLS handshake occurs directly between the client and the remote server, ensuring that certificate validation and encryption remains unbroken.
* SNI-Based Routing: While the payload is opaque, the proxy uses the Host header from the CONNECT request (and optionally the SNI in the Client Hello) to perform DNS resolution and routing.

Flow

There are 2 distinct TCP legs.
1. Inbound Leg: Proxy accepts a TCP connection on the listener port and parses the initial HTTP CONNECT header.
2. Resolution: Proxy performs an asynchronous DNS lookup for the requested target.
3. Outbound Leg: Proxy initiates a secondary TCP handshake with the target IP on the external interface (eth0).
4. Promotion: Upon successful upstream connection, the proxy returns 200 Connection Established and promotes the sockets to a bi-directional "pipe."

@startuml
participant "Client\n127.0.0.1:9000" as client
participant "Proxy Server" as server
participant "InternalGW\n10.255.255.254" as gw
participant "google.com\n142.253.192.14:443" as google

==(tcp.stream eq 6) || (tcp.stream eq 7)  || (udp.stream eq 0)  || (udp.stream eq 1)==

alt #Bisque TCP 3 way handshake, HTTP, TLS \n\n (tcp.stream eq 6)
note over client
127.0.0.1:9000(random)
end note
note over server
127.0.0.1:8080
end note
alt TCP
client -> server : SYN
client <- server : SYN, ACK
client -> server : ACK
end

alt HTTP
client -> server: CONNECT google.com:443
server -> client: ACK
server -> client: 200 Conn Established
end

alt TLS
client -> server : Client Hello (sni=google.com)
server -> client: Server Hello
end
end

alt #Cyan DNS over UDP (udp.stream eq 1)
server -> gw: DNS Query \n A google.com
gw -> server: DNS Query resp \n 142.253.192.14
end

alt #Azure 3 way handshake, TLS \n\n Server Connects to Upstream & get data \n\n (tcp.stream eq 7)
note over server
172.22.11.40:9120(random)
end note
note over google
142.253.192.14:443
end note

alt TCP
server -> google: SYN
server <- google: SYN,ACK
server -> google: ACK
end

alt TLS
server -> google: Client Hello (sni=google.com)
server <- google: ACK
google -> server: Server Hello
google <- server: ACK
google -> server: Application Data
end
end

alt #Bisque ProxyServer sends data to client \n\n (tcp.stream eq 6)
note over server
127.0.0.1:8080
end note
note over client
127.0.0.1:9000
end note

server -> client: Application Data
server <- client: ACK
server <- client: FIN
server -> client: ACK
end

@enduml