SNIPROXY(8)

NAME
SNIProxy - transparent session based TLS, HTTP, DTLS, XMPP, and Minecraft proxy

SYNOPSIS
sniproxy [ -c config ] [ -f ] [ -g ] [ -t ] [ -n file-descriptor-limit ] [ -V ] [ -T min-tls-version ] [ -d ]

DESCRIPTION
Proxies incoming HTTP, TLS, DTLS, XMPP, and Minecraft Java Edition connections, including HTTP/2 requests, based on the hostname contained in the initial request. For TCP protocols (TLS, HTTP, XMPP, Minecraft) the hostname is extracted from the initial TCP stream. For DTLS the hostname is extracted from the SNI extension in the UDP ClientHello datagram, enabling proxying of WebRTC, OpenConnect VPN, and other UDP/DTLS protocols by hostname without decryption. This enables HTTPS name-based virtual hosting to separate backend servers without installing the private key on the proxy machine. By default TLS 1.2 (and newer) client hellos are accepted. For security reasons the configuration file must not be readable or executable by group/other users. sniproxy verifies the permissions after opening the file and aborts startup if it detects broader access.

OPTIONS

-c config
    Specify configuration file to use. The default is /etc/sniproxy.conf.

-f  Do not daemonize, and run in foreground.

-g  Allow group-read (0640) permissions on the configuration file. By default sniproxy requires mode 0600. This flag relaxes the check to 0640 so the unprivileged process can re-read the config on SIGHUP reload. The config file should be owned by root with its group set to the sniproxy user group (e.g. root:_sniproxy). A security warning is logged at startup when this flag is used.

-t  Test configuration and exit. Parses the configuration file and reports whether it is valid without starting the proxy.

-n file-descriptor-limit
    Specify the maximum file descriptor resource limit. SNIProxy will attempt to set the maximum file descriptor limit to the value specified.

-V  Print the version of SNIProxy and exit.

-T min-tls-version
    Set the minimum TLS ClientHello version that will be accepted. The value must be one of 1.0, 1.1, 1.2, or 1.3, and controls both the legacy version field and the supported_versions extension. The default is 1.2.

-d  Enable verbose resolver debug logging to stderr and the error log to aid DNS troubleshooting.

SIGNALS

SIGHUP
    Reopen log files and reload the configuration file. Existing connections continue using their original routing; new connections use the updated configuration.

SIGUSR1
    Dump all active TCP connections and UDP sessions to a temporary file for debugging. The file is created in $XDG_RUNTIME_DIR/sniproxy, /var/run/sniproxy, or /tmp/sniproxy-<uid> (tried in that order).

SIGINT, SIGTERM
    Shut down gracefully.

SANDBOXING
On OpenBSD, sniproxy uses pledge(2) and unveil(2) to restrict each process to the minimum set of system calls and filesystem paths required.

On FreeBSD, sniproxy uses Capsicum capability mode (cap_enter(2)) and per-fd rights (cap_rights_limit(2)) to confine each process after initialization. Directories needed for config reload and log rotation are pre-opened so that openat(2) works inside capability mode. Set SNIPROXY_DISABLE_CAPSICUM in the environment to disable Capsicum sandboxing.

On Linux, sniproxy uses seccomp-bpf to restrict available system calls per process.

FILES

/etc/sniproxy.conf
    Default configuration file (Linux).

/usr/local/etc/sniproxy.conf
    Default configuration file (FreeBSD).

/usr/local/etc/rc.d/sniproxy
    FreeBSD rc.d startup script. Enable with sysrc sniproxy_enable=YES and control with service sniproxy start|stop|reload.

SEE ALSO

sniproxy.conf(5), rc.subr(8)