Search code examples
sslpacket-sniffers

sslsplit: Received privsep req type 02

Hopefully this is an easy enough question, please forgive my ignorance.

I'm running sslsplit to read from certain IP's and I keep receiving:

Received privsep req type 02 sz 62 on srvsock 9

Can anyone tell me what privsep req type 2 is? In my searches, I've only seen logging for type 0, 1 and 3.

Solution

  • From the code source, the error message comes from https://github.com/droe/sslsplit/blob/887215504a7324d4ce49327618934e66eeed8c27/privsep.c#L355 :

        log_dbg_printf("Received privsep req type %02x sz %zd on srvsock %i\n",
req[0], n, srvsock);

    The switch just belows shows that req[0] is matched against variables whose prefix is PRIVSEP_REQ_.

    If you go back at start of same file you have the following definitions:

    /* command byte */
#define PRIVSEP_REQ_CLOSE   0   /* closing command socket */
#define PRIVSEP_REQ_OPENFILE    1   /* open content log file */
#define PRIVSEP_REQ_OPENFILE_P  2   /* open content log file w/mkpath */
#define PRIVSEP_REQ_OPENSOCK    3   /* open socket and pass fd */
#define PRIVSEP_REQ_CERTFILE    4   /* open cert file in certgendir */

    So case 2 is "open content log file w/mkpath". It does the same as case 1 "open content log file", except that it enables mkpath feature in privsep_server_openfile_verify and privsep_server_openfile.

    The first function does not use that parameter in fact. The second one, if it is enabled, creates the directory for the log file, if it does not exist already.

    See https://github.com/droe/sslsplit/blob/887215504a7324d4ce49327618934e66eeed8c27/privsep.c#L188 for details on what is happening.