# Handling mangled server names

**URL:** <https://www.ruby-forum.com/t/handling-mangled-server-names/199094>\
**Category:** NGINX\
**Created:** [November 14, 2010, 8:56pm UTC](https://www.ruby-forum.com/t/handling-mangled-server-names/199094 "2010-11-14T20:56:09Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![okkezSS](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/o/85f322/32.png) [@okkezSS](https://www.ruby-forum.com/u/okkezSS)\
**Post date:** [November 14, 2010, 8:56pm UTC](https://www.ruby-forum.com/t/handling-mangled-server-names/199094/1 "2010-11-14T20:56:09Z")

</div>

Lo,

At work, we have a perfectly functioning proxy server, which I don’t  
trust. :-/ So I wanted to use my home infrastructure in a transparent  
way (e.g., no SSH port forwarding) to allow me just to use my browser to  
get http pages via https. Sort of a chained proxy.

I came up with the following, working, configuration:

server {  
listen 999 ssl;  
server\_name ~^(?.+).ubergurus.eu$;

```
set $website $mangled;
if ($website ~* (.*)_(.*)) { set $website $1.$2; }
if ($website ~* (.*)_(.*)) { set $website $1.$2; }
if ($website ~* (.*)_(.*)) { set $website $1.$2; }
if ($website ~* (.*)_(.*)) { set $website $1.$2; }
if ($website ~* (.*)_(.*)) { set $website $1.$2; }
if ($website ~* (.*)_(.*)) { set $website $1.$2; }
if ($website ~* (.*)_(.*)) { set $website $1.$2; }
if ($website ~* (.*)_(.*)) { set $website $1.$2; }
if ($website ~* (.*)_(.*)) { set $website $1.$2; }
if ($website ~* (.*)_(.*)) { set $website $1.$2; }

ssl_certificate 

```

/opt/etc/nginx/ssl\_ubergurus.eu/wildcard.ubergurus.eu.crt;  
ssl\_certificate\_key  
/opt/etc/nginx/ssl\_ubergurus.eu/wildcard.ubergurus.eu.key;  
ssl\_crl /opt/etc/nginx/ssl\_ubergurus.eu/crl.pem;  
ssl\_client\_certificate /opt/etc/nginx/ssl\_ubergurus.eu/ca.crt;  
ssl\_verify\_client on;

```
location / {
  proxy_set_header Host $website;
  rewrite ^(.*)$ $website$request_uri break;
  proxy_pass http://$website;
}

```

}

At home, 443 forwards to 999.

At work, I’m now able to get e.g. https://www\_ns\_nl.ubergurus.eu/ which  
results, after two-sided SSL being setup, in a http//www.ns.nl get at  
home, and tunneling the result back to work. Of course still the URL  
shows up in the work’s proxy log, put no content. The server certificate  
is a self-signed wildcard certificate for \*.ubergurus.eu, so any mangled  
site would work, as long as it doesn’t contain the ‘dot’-char.

A few questions came up during this invention:

- Repeating the if line 10 times allows 10 levels of \_-chars, meaning 10  
subdomains. Is there a better way to accomplish this?
- Some sites contain absolute URL’s within the content (e.g. the tag and ![]() tag), which aren’t rewritten back to  
https://\*.ubergurus.eu. This causes leakage at the work site. Is there a  
quick way to add that?
- Any ideas about a better mangling scheme to further obfuscate the  
destination website from the proxy log?

Or am I just being crazy here… 😉

Tnx,  
Marc.

PS: Great piece of software, nginx!

---

<div class="post-metadata">

**Author:** ![Marc\_de\_Bruin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/b4bc9f/32.png) [@Marc\_de\_Bruin](https://www.ruby-forum.com/u/Marc_de_Bruin)\
**Post date:** [November 15, 2010, 3:03am UTC](https://www.ruby-forum.com/t/handling-mangled-server-names/199094/2 "2010-11-15T03:03:16Z")

</div>

you could use nginx substutions module maybe, else forward to php and  
dom  
parse and replace all script src, a href etc