You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@trafficserver.apache.org by Shaun mcginnity <sh...@gmail.com> on 2014/01/20 11:42:46 UTC
Support for HTTP Upgrade in transparent proxy
Hi,
are any intentions to support HTTP Upgrade in a transparent proxy
deployment?
For example when a client requests an upgrade to web-sockets we see ATS
remove the Connection: upgrade and Upgrade: websocket headers (because they
are hop-by-hop) but this breaks the upgrade end-to-end. Ideally it would
leave the headers intact and then switch to tunneling mode when the 101
Switching Protocols response is received.
Regards,
Shaun McGinnity
Re: Support for HTTP Upgrade in transparent proxy
Posted by Bahram Akhundov <de...@hotmail.de>.
its ok James :)
Von meinem iPhone 5 gesendet
> Am 23 yan, 2014 um 21:08 schrieb "James Peach" <jp...@apache.org>:
>
>> On Jan 23, 2014, at 1:11 AM, Bahram Akhundov <de...@hotmail.de> wrote:
>>
>> Hi Marcelo.
>> I have found bug :)
>> If traffic server the latest version installed (4.1.2) , i can XSS and SQL injection make :)
>> The latest version have vuln :)
>> I will ddos onw eb site, then the traffic server will caching the web site, in this time i will read from SQL injection the mysql admin pass :)
>> I says the latest version have bug :)
>> This bug is the traffic server geve me allow to run XSS or SQL injection :)
>> I wait from you reply...
>
> If you believe you have found a security issue, please read http://apache.org/security/, and report it to the Apache Security Team, security@apache.org.
>
> thanks,
> James
Re: Support for HTTP Upgrade in transparent proxy
Posted by James Peach <jp...@apache.org>.
On Jan 23, 2014, at 1:11 AM, Bahram Akhundov <de...@hotmail.de> wrote:
> Hi Marcelo.
> I have found bug :)
> If traffic server the latest version installed (4.1.2) , i can XSS and SQL injection make :)
> The latest version have vuln :)
> I will ddos onw eb site, then the traffic server will caching the web site, in this time i will read from SQL injection the mysql admin pass :)
> I says the latest version have bug :)
> This bug is the traffic server geve me allow to run XSS or SQL injection :)
> I wait from you reply...
>
If you believe you have found a security issue, please read http://apache.org/security/, and report it to the Apache Security Team, security@apache.org.
thanks,
James
Re: Support for HTTP Upgrade in transparent proxy
Posted by Bahram Akhundov <de...@hotmail.de>.
The web site have no XSS or SQJ injection :) I'm security man =) i know
what are what not are ...
The web server traffic have back door and geve me acces to SQL injection :)
RE: Support for HTTP Upgrade in transparent proxy
Posted by Luca Rea <lu...@contactlab.com>.
@Bahram:
That sounds me like a normal behavior (ATS caches http traffic), if a website is vulnerable to XSS it remains so also if you put it beyond ATS, why it shouldn't?
Re: Support for HTTP Upgrade in transparent proxy
Posted by Bahram Akhundov <de...@hotmail.de>.
Hi Marcelo.
I have found bug :)
If traffic server the latest version installed (4.1.2) , i can XSS and
SQL injection make :)
The latest version have vuln :)
I will ddos onw eb site, then the traffic server will caching the web
site, in this time i will read from SQL injection the mysql admin pass :)
I says the latest version have bug :)
This bug is the traffic server geve me allow to run XSS or SQL injection :)
I wait from you reply...
Am 23.01.2014 13:02, schrieb Marcelo Gotesdiner:
> Thanks Shaun/Alan,
>
> I just need a guide on what to do now :)
> The fix is working in our system so I guess we need to integrate it into ATS.
>
> As I never did it before, I do not know the procedure.
>
> Thanks,
> Marcelo
> -----Original Message-----
> From: Shaun McGinnity [mailto:Shaun.McGinnity@owmobility.com]
> Sent: Wednesday, January 22, 2014 11:29 PM
> To: dev@trafficserver.apache.org
> Subject: RE: Support for HTTP Upgrade in transparent proxy
>
> I will be happy to help as well.
>
> Regards,
>
> Shaun
>
> -----Original Message-----
> From: Alan M. Carroll [mailto:amc@network-geographics.com]
> Sent: Tuesday, January 21, 2014 3:41 PM
> To: dev@trafficserver.apache.org
> Subject: Re: Support for HTTP Upgrade in transparent proxy
>
> Tuesday, January 21, 2014, 6:01:17 AM, you wrote:
>
>> Hi,
>> I implemented a solution for HTTP Upgrade in ATS under Seamless Access SW (a Mobixell product).
>> We'll be happy to contribute with the solution but I don't know what the procedure is.
> I can take point on that. Do you have access to github, or could you file a JIRA and attach a patch for review?
>
>
>
RE: Support for HTTP Upgrade in transparent proxy
Posted by Marcelo Gotesdiner <ma...@mobixell.com>.
Thanks Shaun/Alan,
I just need a guide on what to do now :)
The fix is working in our system so I guess we need to integrate it into ATS.
As I never did it before, I do not know the procedure.
Thanks,
Marcelo
-----Original Message-----
From: Shaun McGinnity [mailto:Shaun.McGinnity@owmobility.com]
Sent: Wednesday, January 22, 2014 11:29 PM
To: dev@trafficserver.apache.org
Subject: RE: Support for HTTP Upgrade in transparent proxy
I will be happy to help as well.
Regards,
Shaun
-----Original Message-----
From: Alan M. Carroll [mailto:amc@network-geographics.com]
Sent: Tuesday, January 21, 2014 3:41 PM
To: dev@trafficserver.apache.org
Subject: Re: Support for HTTP Upgrade in transparent proxy
Tuesday, January 21, 2014, 6:01:17 AM, you wrote:
> Hi,
> I implemented a solution for HTTP Upgrade in ATS under Seamless Access SW (a Mobixell product).
> We'll be happy to contribute with the solution but I don't know what the procedure is.
I can take point on that. Do you have access to github, or could you file a JIRA and attach a patch for review?
RE: Support for HTTP Upgrade in transparent proxy
Posted by Shaun McGinnity <Sh...@owmobility.com>.
I will be happy to help as well.
Regards,
Shaun
-----Original Message-----
From: Alan M. Carroll [mailto:amc@network-geographics.com]
Sent: Tuesday, January 21, 2014 3:41 PM
To: dev@trafficserver.apache.org
Subject: Re: Support for HTTP Upgrade in transparent proxy
Tuesday, January 21, 2014, 6:01:17 AM, you wrote:
> Hi,
> I implemented a solution for HTTP Upgrade in ATS under Seamless Access SW (a Mobixell product).
> We'll be happy to contribute with the solution but I don't know what the procedure is.
I can take point on that. Do you have access to github, or could you file a JIRA and attach a patch for review?
Re: Support for HTTP Upgrade in transparent proxy
Posted by "Alan M. Carroll" <am...@network-geographics.com>.
Tuesday, January 21, 2014, 6:01:17 AM, you wrote:
> Hi,
> I implemented a solution for HTTP Upgrade in ATS under Seamless Access SW (a Mobixell product).
> We'll be happy to contribute with the solution but I don't know what the procedure is.
I can take point on that. Do you have access to github, or could you file a JIRA and attach a patch for review?
RE: Support for HTTP Upgrade in transparent proxy
Posted by Marcelo Gotesdiner <ma...@mobixell.com>.
Hi,
I implemented a solution for HTTP Upgrade in ATS under Seamless Access SW (a Mobixell product).
We'll be happy to contribute with the solution but I don't know what the procedure is.
Who can help me?
Thanks,
Marcelo
-----Original Message-----
From: Shaun mcginnity [mailto:shaun.mcginnity@gmail.com]
Sent: Monday, January 20, 2014 12:43 PM
To: dev@trafficserver.apache.org
Subject: Support for HTTP Upgrade in transparent proxy
Hi,
are any intentions to support HTTP Upgrade in a transparent proxy deployment?
For example when a client requests an upgrade to web-sockets we see ATS remove the Connection: upgrade and Upgrade: websocket headers (because they are hop-by-hop) but this breaks the upgrade end-to-end. Ideally it would leave the headers intact and then switch to tunneling mode when the 101 Switching Protocols response is received.
Regards,
Shaun McGinnity