Skip to content
Proxies incoming HTTP and TLS connections based on the hostname contained in the initial request of the TCP session.
C Perl M4 Shell Makefile C++
Branch: master
Clone or download

Latest commit

dlundquist Merge pull request #349 from nemunaire/fix-gcc10
Fix compilation issue with gcc >= 10
Latest commit 822bb80 Mar 3, 2020


Type Name Latest commit message Commit time
Failed to load latest commit information.
debian 0.6.0 release Dec 6, 2018
m4 Use pkg-config where available or detect the library using AC_LIB_HAV… Feb 6, 2014
man man: logger priorities Mar 15, 2018
redhat 0.6.0 release Dec 6, 2018
src Don't define http_protocol and tls_protocol variables multiple times. Mar 3, 2020
tests build: add Wextra and Wpedantic and disable strict-aliasing Jan 24, 2019
.gitignore Keep git ignores from 1133ad9 Apr 21, 2014
.travis.yml build: add Wextra and Wpedantic and disable strict-aliasing Jan 24, 2019 Rename name pattern in table backends Jun 12, 2014
AUTHORS Adding AUTHORS and symlinking README to Feb 17, 2013
COPYING Autotools Feb 17, 2013
ChangeLog 0.6.0 release Dec 6, 2018 Add manpage Sep 23, 2014
NEWS Autotools Feb 17, 2013
README Switch back to so github will process markdown, and symlink… Feb 20, 2013 proxy header: docs Mar 3, 2018
TODO Update TODO: nameserver config implemented Nov 5, 2014 Automatically update version based on git tags Aug 14, 2014
config.rpath autoconf weirdnesses: include config.rpath Mar 29, 2014 0.6.0 release Dec 6, 2018 0.6.0 release Dec 6, 2018
sniproxy.conf While porting sniproxy to FreeBSD, I've notice wrong location of PID Apr 23, 2018
test-coverage Fix test-coverage Jul 16, 2014

SNI Proxy

Proxies incoming HTTP and TLS connections based on the hostname contained in the initial request of the TCP session. This enables HTTPS name-based virtual hosting to separate backend servers without installing the private key on the proxy machine.


  • Name-based proxying of HTTPS without decrypting traffic. No keys or certificates required.
  • Supports both TLS and HTTP protocols.
  • Supports IPv4, IPv6 and Unix domain sockets for both back end servers and listeners.
  • Supports multiple listening sockets per instance.
  • Supports HAProxy proxy protocol to propagate original source address to backend servers.


Usage: sniproxy [-c <config>] [-f] [-n <max file descriptor limit>] [-V]
    -c  configuration file, defaults to /etc/sniproxy.conf
    -f  run in foreground, do not drop privileges
    -n  specify file descriptor limit
    -V  print the version of SNIProxy and exit


For Debian or Fedora based Linux distributions see building packages below.


  • Autotools (autoconf, automake, gettext and libtool)
  • libev4, libpcre and libudns development headers
  • Perl and cURL for test suite


./ && ./configure && make check && sudo make install

Building Debian/Ubuntu package

This is the preferred installation method on recent Debian based distributions:

  1. Install required packages

     sudo apt-get install autotools-dev cdbs debhelper dh-autoreconf dpkg-dev gettext libev-dev libpcre3-dev libudns-dev pkg-config fakeroot devscripts
  2. Build a Debian package

     ./ && dpkg-buildpackage
  3. Install the resulting package

     sudo dpkg -i ../sniproxy_<version>_<arch>.deb

Building Fedora/RedHat package

This is the preferred installation method for modern Fedora based distributions.

  1. Install required packages

     sudo yum install autoconf automake curl gettext-devel libev-devel pcre-devel perl pkgconfig rpm-build udns-devel
  2. Build a distribution tarball:

     ./ && ./configure && make dist
  3. Build a RPM package

     rpmbuild --define "_sourcedir `pwd`" -ba redhat/sniproxy.spec
  4. Install resulting RPM

     sudo yum install ../sniproxy-<version>.<arch>.rpm

I've used Scientific Linux 6 a fair amount, but I prefer Debian based distributions. RPM builds are tested in Travis-CI on Ubuntu, but not natively. This build process may not follow the current Fedora packaging standards, and may not even work.

Building on OS X with Homebrew

  1. install dependencies.

     brew install libev pcre udns autoconf automake gettext libtool
  2. Read the warning about gettext and force link it so works. We need the GNU gettext for the macro AC_LIB_HAVE_LINKFLAGS which isn't present in the default OS X package.

     brew link --force gettext
  3. Make it so

     ./ && ./configure && make

OS X support is a best effort, and isn't a primary target platform.

Configuration Syntax

user daemon

pidfile /tmp/

error_log {
    syslog daemon
    priority notice

listener {
    protocol tls
    table TableName

    # Specify a server to use if the initial client request doesn't contain
    # a hostname

table TableName {
    # Match exact request hostnames
    # If port is not specified the listener port will be used [2001:DB8::1:10]
    # Or use regular expression to match
    .*\\.com    [2001:DB8::1:11]:443
    # Combining regular expression and wildcard will resolve the hostname
    # client requested and proxy to it
    .*\\.edu    *:443

DNS Resolution

Using hostnames or wildcard entries in the configuration requires sniproxy to be built with UDNS. SNIProxy will still build without UDNS, but these features will be unavailable.

UDNS uses a single UDP socket for all queries, so it is recommended you use a local caching DNS resolver (with a single socket each DNS query is protected by spoofing by a single 16 bit query ID, which makes it relatively easy to spoof).

You can’t perform that action at this time.