skiptomyliu

#!/usr/bin/python

# This is a quick dirty python3 translation of https://code.activestate.com/recipes/577643-transparent-http-tunnel-for-python-sockets-to-be-u/
import socket

# Class that wraps a real socket and changes it to a HTTP tunnel whenever a connection is asked via the "CONNECT" method
class ProxySock :

    def __init__(self, socket, proxy_host, proxy_port) :

skiptomyliu

# Corresponding iptables rules:
##!/bin/bash
#sudo iptables -t nat -F
#sudo iptables --table nat --new-chain INTERNAL_TRAFFIC

## dont forward root traffic and envoyuser traffic
#sudo iptables --table nat --append INTERNAL_TRAFFIC -m owner --uid-owner root -j RETURN
#sudo iptables --table nat --append INTERNAL_TRAFFIC -m owner --uid-owner envoyuser -j RETURN

## trap ubuntu user traffic

skiptomyliu

admin:
  access_log_path: /tmp/admin_access.log
  address:
    socket_address:
      protocol: TCP
      address: 127.0.0.1
      port_value: 9901
static_resources:
  listeners:
  - name: listener_2

skiptomyliu

# Transparent Envoy Proxy that forwards http/https 
# Create iptables to route 80 + 443 to 10000:
# $ iptables -t nat -A OUTPUT -p tcp -m owner ! --uid-owner envoyuser --dport 443 -j REDIRECT --to-port 10000
# $ iptables -t nat -A OUTPUT -p tcp -m owner ! --uid-owner envoyuser --dport 80 -j REDIRECT --to-port 10000
# Run envoy
# $ envoy -c dynamic_fwd_http_sni.yaml -l debug

admin:
  access_log_path: /home/envoyuser/admin/admin_access.log
  address:

skiptomyliu

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: echoserver
  namespace: echoserver
  annotations:
    kubernetes.io/ingress.class: nginx
spec:
  tls:
  - hosts:

skiptomyliu

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: echoserver
  namespace: echoserver
spec:
  replicas: 1
  template:
    metadata:
      labels:

skiptomyliu

apiVersion: certmanager.k8s.io/v1alpha1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    # The ACME server URL
    server: https://acme-v02.api.letsencrypt.org/directory
    # Email address used for ACME registration
    email: [your_email address]

skiptomyliu

apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
  name: webserver-tls-prod
spec:
  secretName: webserver-tls-prod
  dnsNames:
  - mosaic.skiptomyliu.com
  acme:
    config:

skiptomyliu

apiVersion: v1
kind: Service
metadata:
  name: webserver
  namespace: webserver
spec:
  ports:
  - port: 80
    targetPort: 3000
    protocol: TCP

skiptomyliu

2 easy steps:

1) echo -n | openssl s_client -connect AD_SERVER:AD_SERVER_PORT | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > ldapserver.pem

2) keytool -import -trustcacerts -file ldapserver.pem -alias ALIAS_GOES_HERE -keystore /Users/.../Apps/jxplorer-3.3.1-osx/jxplorer-3.3.1.app/Contents/Resources/security/cacerts

OR

Via JXPlorer UI, go to menu Security -> Trusted Servers and CAs.  Import the new ldapserver.pem file.  Default password "changeit"