Re: [squid-users] How Bad is CONNECT and Should I Prevent It?

On 19.06.07 19:18, Vadim Pushkin wrote:
> I am only looking to inspect each SSL connection for the purposes of
> determining if the traffic should be allowed, i.e. non-malicious (not chat,
> file-transfer, etc).

If anyone was able to see content under SSL protocol, this would mean that
SSL protocol is unsafe and doesn't fullfill it's main requirement that noone
will see what's transferred in it, unless the proxy does MITM attack and
client does not recognize that it's not really talking to the destination
server. (which can be checked by verifying SSL certificates).

There is probably one possibility to avoid this bu the proxy generating SSL
certificate for each destination server and signing it by authority that
client trusts. Oh.

However, proxy server can do inspection of the data flowing via CONNECT,
because CONNECT does NOT mean SSL. You can issue CONNECT and talk through
using HTTP, FTP, NNTP, IRC, SSH protocol etc. So it is possible to inspect
if client/server do not use this protocol and optionally deny it. However,
when client imediately issues SSL negotiation, we can not do wnything with
it.

> Can anyone recommend such a product? Also, I should mention, I am not
> looking to spend alot of money.

I'm afraid that such content inspectors won't be very cheap

> Are their any plans on the roadmap to do this sort of traffic analysis
> within Squid?

You still may submit a wishlist bugreport, but I guess that inspection
should be done outside of squid, maybe by some CONNECT helper or what...

-- 
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
I intend to live forever - so far so good.