<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
-----BEGIN PGP SIGNED MESSAGE----- <br>
Hash: SHA1 <br>
<br>
Agreed.<br>
<br>
I'm expert on shell, not Perl/Python. :)<br>
<br>
But will try to make some useful with it.<br>
<br>
05.01.2015 22:28, Eliezer Croitoru пишет:<br>
<span style="white-space: pre;">> On 01/05/2015 05:18 PM, Yuri
Voinov wrote:<br>
> > We haven't filtering non_HTTP over port-443. Just
recognize and<br>
> > pass.<br>
><br>
> So let's separate security which is one of the goals of squid
and<br>
> which some like and other don't.<br>
><br>
> For now squid 3.4 is stable and 3.5 is in beta and trunk is
not for<br>
> the public use.<br>
> In 3.5 there will be present a new feature which called peek
and<br>
> splice that can give an interface to squid and the admin
which will<br>
> allow the admin to know couple things about the connection
from squid<br>
> and specifically first the client TLS request.<br>
> Once squid bumped a connection there are couple steps until
the<br>
> connection is fully established between the client and the
server:<br>
> - receive the TCP connection from client<br>
> - BUMP server or client FIRST<br>
> - determine what certificate to send to the client based on
the server<br>
> initial ssl response<br>
> - fake it<br>
> - send to the client<br>
> - MITM between two tls connections on the proxy while
inspecting the<br>
> content in the software layer.<br>
><br>
> Peek and splice will add another step between the first part
to the<br>
> second and which will allow SNI usage.<br>
> All the above is to allow better BUMPING.<br>
> There might be or will be probably an interface that will
identify or<br>
> will try to identify inside the current stages of the
connection<br>
> bumping if the connection is indeed a TLS or another one.<br>
> The first step of peek and splice can identify if the
connection from<br>
> the client side has started using a valid TLS\SSL headers.<br>
><br>
> Leaving all the BUMPING yes or no You(Yuri) need a very
specific tool<br>
> or want a very specific tool.<br>
> The basic interface of the external_acl can provide enough
data on the<br>
> connection in order to enforce some rules.<br>
> You can either use the client IP address or just the
destination IP<br>
> and PORT.<br>
><br>
> I cannot speak for the squid project but I am almost sure
that the<br>
> squid project will not provide you with an official helper
and will<br>
> not support it.<br>
> However squid external_acl is there especially to help others
achieve<br>
> what they want using a variety of parameters from squid
internals.<br>
> The external_acl interface provides internal caching which
supports<br>
> caching ttl with different values for the two options either
allow(OK)<br>
> or DENY(ERR).<br>
><br>
> My suggestions stays, don't use sqlite if possible.<br>
> There is a sketch for a helper like you seems to want.<br>
> Take the glove and write a pesudo code for the helper idea
based on<br>
> the assumptions:<br>
> - There is a DB which can store timestamps, ip, port, result
of test, etc<br>
> - There is a way to check if the certificate is valid and the
server<br>
> works with TLS\SSL<br>
> - There is no way for the helper to know that a certificate
is pined<br>
> - There is a way to add static records to the DB(web
interface, cli)<br>
> - All the requests will come from the proxy IP address and
can by some<br>
> be identified as an attack.<br>
> - ufdbguard does not provide your needs since it uses
url_rewrite<br>
> interface and doesn't have the needed functionalities for
you.<br>
><br>
> The best I have seen until now was the python helper.<br>
> If in couple(4-5) month nobody will do something with this I
will see<br>
> then what can be done with this if at all.<br>
><br>
> Elizer<br>
> _______________________________________________<br>
> squid-users mailing list<br>
> <a class="moz-txt-link-abbreviated" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
> <a class="moz-txt-link-freetext" href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a></span><br>
<br>
-----BEGIN PGP SIGNATURE-----
<br>
Version: GnuPG v2
<br>
<br>
iQEcBAEBAgAGBQJUqr3NAAoJENNXIZxhPexG5UoIAKxANAcs77iuSQlNOmbO9D4B
<br>
xip3QbFhug2/LayR+Wa1Vd3UBUfkSUUdvvqedXRc6KKfCqxa5BECTYSpM0qT/L+h
<br>
WasstLpV/Mm2seYRK/CUJbmAJDps6mAgB8MdU1Kq9XWUVYGuGHXnWa220sU/TuhW
<br>
wD55VRDScX7cELOQyv4kCr/3mqobLD0KLAMwpDwtxel88eE9NYFW1OcIyM2XHtJd
<br>
ouY/hM6sAlYusXITrQrbOy7Sw5yT6DjY+sm6NYx7NCpDyKZTZemU0QVN9hEG6H0s
<br>
AmPi0m3OedUAmh83rXMS47+GyzIq3yxIqe52qOsFSsA5PoK/l93zqRivvUUTxyQ=
<br>
=sq3n
<br>
-----END PGP SIGNATURE-----
<br>
<br>
</body>
</html>