You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@trafficserver.apache.org by stipa <gi...@git.apache.org> on 2015/01/14 10:04:09 UTC
[GitHub] trafficserver pull request: Allow transparent pass through for SSL...
GitHub user stipa opened a pull request:
https://github.com/apache/trafficserver/pull/162
Allow transparent pass through for SSL port
If the parsing of ClientHello fails and first byte does not indicate SSL
packet, start a blind tunnel if tr-pass is set.
This feature allows to blind-tunnel non-SSL traffic and use SNI hook for
SSL traffic.
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/stipa/trafficserver feature/tr-pass-ssl
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/trafficserver/pull/162.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #162
----
commit 692e6d38fed9d1207face63a52fb1b51bf7bc398
Author: Stipakov, Lev <le...@f-secure.com>
Date: 2015-01-13T13:42:00Z
Allow transparent pass through for SSL port
If the parsing of ClientHello fails and first byte does not indicate SSL
packet, start a blind tunnel if tr-pass is set.
This feature allows to blind-tunnel non-SSL traffic and use SNI hook for
SSL traffic.
----
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] trafficserver pull request: Allow transparent pass through for SSL...
Posted by sudheerv <gi...@git.apache.org>.
Github user sudheerv commented on the pull request:
https://github.com/apache/trafficserver/pull/162#issuecomment-69951456
hmm, can it not be used as a bit-map for other kinds of transparency?
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] trafficserver pull request: Allow transparent pass through for SSL...
Posted by shinrich <gi...@git.apache.org>.
Github user shinrich commented on the pull request:
https://github.com/apache/trafficserver/pull/162#issuecomment-69966381
As it turns, out the records.config processing already checks that tr-in is set if you are trying to set tr-pass.
I filled TS-3293 to track the issue of cleaning up the propagation for flags through various accept and netvc. Will pull Lev's latest patch, and get it merged up.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] trafficserver pull request: Allow transparent pass through for SSL...
Posted by sudheerv <gi...@git.apache.org>.
Github user sudheerv commented on the pull request:
https://github.com/apache/trafficserver/pull/162#issuecomment-69947824
Isn't there a "NetVConnection::is_transparent" already in the netvc?
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
Re: [GitHub] trafficserver pull request: Allow transparent pass through
for SSL...
Posted by Susan Hinrichs <sh...@network-geographics.com>.
Associated with TS-3292. I'll review and merge later this morning.
On 1/14/2015 3:04 AM, stipa wrote:
> GitHub user stipa opened a pull request:
>
> https://github.com/apache/trafficserver/pull/162
>
> Allow transparent pass through for SSL port
>
> If the parsing of ClientHello fails and first byte does not indicate SSL
> packet, start a blind tunnel if tr-pass is set.
>
> This feature allows to blind-tunnel non-SSL traffic and use SNI hook for
> SSL traffic.
>
> You can merge this pull request into a Git repository by running:
>
> $ git pull https://github.com/stipa/trafficserver feature/tr-pass-ssl
>
> Alternatively you can review and apply these changes as the patch at:
>
> https://github.com/apache/trafficserver/pull/162.patch
>
> To close this pull request, make a commit to your master/trunk branch
> with (at least) the following in the commit message:
>
> This closes #162
>
> ----
> commit 692e6d38fed9d1207face63a52fb1b51bf7bc398
> Author: Stipakov, Lev <le...@f-secure.com>
> Date: 2015-01-13T13:42:00Z
>
> Allow transparent pass through for SSL port
>
> If the parsing of ClientHello fails and first byte does not indicate SSL
> packet, start a blind tunnel if tr-pass is set.
>
> This feature allows to blind-tunnel non-SSL traffic and use SNI hook for
> SSL traffic.
>
> ----
>
>
> ---
> If your project is set up for it, you can reply to this email and have your
> reply appear on GitHub as well. If your project does not have this feature
> enabled and wishes so, or if the feature is enabled but not working, please
> contact infrastructure at infrastructure@apache.org or file a JIRA ticket
> with INFRA.
> ---
[GitHub] trafficserver pull request: Allow transparent pass through for SSL...
Posted by stipa <gi...@git.apache.org>.
Github user stipa commented on the pull request:
https://github.com/apache/trafficserver/pull/162#issuecomment-69949310
shinrich: added check you've mentioned
sudheerv: right, but that one is about inbound transparency:
https://github.com/apache/trafficserver/blob/master/iocore/net/UnixNetAccept.cc#L124
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] trafficserver pull request: Allow transparent pass through for SSL...
Posted by asfgit <gi...@git.apache.org>.
Github user asfgit closed the pull request at:
https://github.com/apache/trafficserver/pull/162
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] trafficserver pull request: Allow transparent pass through for SSL...
Posted by shinrich <gi...@git.apache.org>.
Github user shinrich commented on the pull request:
https://github.com/apache/trafficserver/pull/162#issuecomment-69942861
Looks good to me. Originally concerned that the transparent_passthrough state was being needlessly duplicated, but the HttpSM is not here yet at this point. And you are following the pattern of the HttpSessionAccept. One minor nit, is that I would "and" in port.m_inbound_transparent_p when setting the transparent allowed flag in SSLNextProtocolAccept. It is just a bit of extra error checking. If the connection is not at least inbound transparent, transparent passthrough makes no sense. This is checked via the HttpSM method is_transparent_passthrough_allowed on the Http path.
The check for the CLIENT_HELLO handshake operator in the SSL error case seems fine. You may get unlucky and have non SSL traffic with a first byte of 0x16, and not blind tunnel it. But checking for more bytes gets complicated (e.g. checking that the next byte is not any valid SSL version). In practice the simple check is likely fine, and it is highly unlikely that you will suck in legitimate SSL handshake exchanges into the blind tunnel.
I'm going to take it for a spin on my dev box, and then merge it up.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---