<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
-----BEGIN PGP SIGNED MESSAGE----- <br>
Hash: SHA1 <br>
<br>
Sounds good,<br>
<br>
but server world is not end on Linux. ;)<br>
<br>
Now exists another *NIX systems. And will exists further.<br>
<br>
Also. I have an idea, gents.<br>
<br>
Do we can easy and quickly detect SSL Pinned destinations? And
remember it, for example, in database?<br>
<br>
In another words - both problems is similar. Either non-HTTPS
traffic over 443 port, or pinned certs.<br>
<br>
Can we detect both of them automatically and add to exclude list?<br>
<br>
WBR, Yuri<br>
<br>
05.01.2015 8:44, Eliezer Croitoru пишет:<br>
<span style="white-space: pre;">> Hey
Thread(Jason,Yuri,Douglas...),<br>
><br>
> There are couple aspects about the ssl and connections in
general and<br>
> as we talk about ssl port I first would like to put couple
things on<br>
> the table.<br>
><br>
> * Squid is a http caching proxy and there for every feature
which is<br>
> out of the http related scope should not be handled by squid
at all.<br>
> * Any squid operation is an application level and there for
is limited<br>
> by the software(kernel + squid).<br>
> * There is a difference between servers taking a load of 1k
requests<br>
> per second to a SMB which handles about 50 requests per
second.<br>
><br>
> In general it's better to not intercept a connection which is
not<br>
> bump-able.<br>
> The decision about if to DROP\REJECT or ACCEPT the connection
should<br>
> better not involve squid in general if possible.<br>
> Squid offers a very nice interface but if you compare the
Linux kernel<br>
> forwarding capabilities compared to squid you would see that
squid is<br>
> very limited in the userspace.<br>
><br>
> So in a case the helper only needs to "know" if the
connection is<br>
> bump-able there are other alternatives in the Linux kernel!!<br>
> And if you need logs.. you can use the *helper*(which one you
ever<br>
> choose to work with) to log...<br>
><br>
> So now for the real thing:<br>
> My opinion about external_acl vs other solutions is that if
squid with<br>
> an external_acl works for you and you understand what it
means from<br>
> performance and security aspects try it, test it and then use
it.<br>
><br>
> But if your squid load is high and in the case squid slows
down the<br>
> bumped connections too much(compared to linux forwarding) I
would try<br>
> to use something like NFQUEUE to just test if the connection
is<br>
> bump-able or not by IP and DST PORT.<br>
><br>
> * some information about NFQUEUE<br>
>
<a class="moz-txt-link-freetext" href="https://home.regit.org/netfilter-en/using-nfqueue-and-libnetfilter_queue/">https://home.regit.org/netfilter-en/using-nfqueue-and-libnetfilter_queue/</a><br>
> <a class="moz-txt-link-freetext" href="http://suricata-ids.org/">http://suricata-ids.org/</a><br>
><br>
> * Some examples:<br>
>
<a class="moz-txt-link-freetext" href="https://www.wzdftpd.net/redmine/projects/nfqueue-bindings/repository/entry/examples/rewrite.py">https://www.wzdftpd.net/redmine/projects/nfqueue-bindings/repository/entry/examples/rewrite.py</a><br>
>
<a class="moz-txt-link-freetext" href="http://danmcinerney.org/reliable-dns-spoofing-with-python-scapy-nfqueue/">http://danmcinerney.org/reliable-dns-spoofing-with-python-scapy-nfqueue/</a><br>
>
<a class="moz-txt-link-freetext" href="http://5d4a.wordpress.com/2011/08/25/having-fun-with-nfqueue-and-scapy/">http://5d4a.wordpress.com/2011/08/25/having-fun-with-nfqueue-and-scapy/</a><br>
><br>
> A squid helper is nice but... a NFQUEUE helper that can
verify if to<br>
> FORWARD or BUMP the connection would be a better suited
solution to my<br>
> opinion.<br>
><br>
> All The Bests,<br>
> Eliezer Croitoru<br>
><br>
> On 01/05/2015 03:07 AM, Douglas Davenport wrote:<br>
> > Seems to me it would be more useful as an external ACL
so that a<br>
> > decision could be made based on other factors eg src or
dstdomain<br>
> > whether to deny or allow the un-bumpable connection.<br>
><br>
> _______________________________________________<br>
> squid-users mailing list<br>
> <a class="moz-txt-link-abbreviated" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
> <a class="moz-txt-link-freetext" href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a></span><br>
<br>
-----BEGIN PGP SIGNATURE-----
<br>
Version: GnuPG v2
<br>
<br>
iQEcBAEBAgAGBQJUqk4WAAoJENNXIZxhPexGWNoH/Ak2w0TZ+fU2Jy1bIOgWP82V
<br>
P5UJmB3DDSRwrqi4Y/bfUDGT1V3Cbjn8/RRTqTl7lSbBwGpSd8wSLGSTua6mqMY6
<br>
OIedOB7oBrJ9p8d1F7//ZsBrvGHequnD7Zp1DvBXVcptcVvFi56oAeFNjhRk1tcN
<br>
8EX2mkvgrDye7o7RRXPw1ukxbAJ0883A+gO3XpSARMUQEhsXJFFoygHUo7OIjdr+
<br>
oBrv/aypN8VOFvkHj50vDwtt4Rq7PPDYJRtHms2cIGsjK4+P1Rt1lxhr0GC/qbtZ
<br>
rfqIvP5LRmkID/lvHFhWC38APdjsgCcTICuJoPgKGDPX9YMAWtKdznu2XYpHNfw=
<br>
=LZkA
<br>
-----END PGP SIGNATURE-----
<br>
<br>
</body>
</html>