Enhanced PHP File Manager

⬆️ Go Up (..)

📊 Server Information

Server:

nginx/1.28.0

System:

Linux 6.8.0-90-generic

PHP Version:

8.4.15

User:

alqudsvolunteers

Directory:

/home/alqudsvolunteers/rootlink/usr/share/doc/varnish/html/phk

Free Space:

81.6 GB

🔧 Quick Actions

✏️ Editing: ssl_again.html

<!DOCTYPE html>

<title>SSL revisited &#8212; Varnish version 7.5.0 documentation</title>
    <link rel="stylesheet" type="text/css" href="../_static/pygments.css?v=fa44fd50" />
    <link rel="stylesheet" type="text/css" href="../_static/classic.css?v=e2714048" />
    
    <script src="../_static/documentation_options.js?v=8214db13"></script>
    <script src="../_static/doctools.js?v=888ff710"></script>
    <script src="../_static/sphinx_highlight.js?v=dc90522c"></script>
    
    <link rel="index" title="Index" href="../genindex.html" />
    <link rel="search" title="Search" href="../search.html" />
    <link rel="next" title="A persistent message" href="persistent.html" />
    <link rel="prev" title="Brinch-Hansens Arrows" href="brinch-hansens-arrows.html" /> 
  </head><body>
    <div class="related" role="navigation" aria-label="related navigation">
      <h3>Navigation</h3>
      <ul>
        <li class="right" style="margin-right: 10px">
          <a href="../genindex.html" title="General Index"
             accesskey="I">index</a></li>
        <li class="right" >
          <a href="persistent.html" title="A persistent message"
             accesskey="N">next</a> |</li>
        <li class="right" >
          <a href="brinch-hansens-arrows.html" title="Brinch-Hansens Arrows"
             accesskey="P">previous</a> |</li>
        <li class="nav-item nav-item-0"><a href="../index.html">Varnish version 7.5.0 documentation</a> &#187;</li>
          <li class="nav-item nav-item-1"><a href="index.html" accesskey="U">Poul-Hennings random outbursts</a> &#187;</li>
        <li class="nav-item nav-item-this"><a href="">SSL revisited</a></li> 
      </ul>
    </div>

<div class="document">
      <div class="documentwrapper">
        <div class="bodywrapper">
          <div class="body" role="main">
            
  <section id="ssl-revisited">
<span id="phk-ssl-again"></span><h1>SSL revisited<a class="headerlink" href="#ssl-revisited" title="Link to this heading">¶</a></h1>
<p>Four years ago, I wrote a rant about why Varnish has no SSL support
(<a class="reference internal" href="ssl.html#phk-ssl"><span class="std std-ref">Why no SSL ?</span></a>) and the upcoming 4.1 release is good excuse to
revisit that issue.</p>
<section id="a-ssl-tls-library">
<h2>A SSL/TLS library<a class="headerlink" href="#a-ssl-tls-library" title="Link to this heading">¶</a></h2>
<p>In 2011 I criticized OpenSSL’s source-code as being a nightmare,
and as much as I Hate To Say I Told You So, I Told You So:  See also
“HeartBleed”.</p>
<p>The good news is that HeartBleed made people realize that FOSS
maintainers also have mortgages and hungry kids.</p>
<p>Various initiatives have been launched to make prevent critical
infrastructure software from being maintained Sunday evening between
11 and 12PM by a sleep-deprived and overworked parent, worried about
about being able to pay the bills come the next month.</p>
<p>We’re not there yet, but it’s certainly getting better.</p>
<p>However, implementing TLS and SSL is still insanely complex, and
thanks to Edward Snowdens whistle-blowing, we have very good reasons
to believe that didn’t happen by accident.</p>
<p>The issue of finding a good TLS/SSL implementation is still the
same and I still don’t see one I would want my name associated with.</p>
<p>OpenBSD’s LibreSSL is certainly a step in a right direction, but
time will show if it is viable in the long run – they do have
a tendency to be – “SQUIRREL!!” – distracted.</p>
</section>
<section id="handling-certificates">
<h2>Handling Certificates<a class="headerlink" href="#handling-certificates" title="Link to this heading">¶</a></h2>
<p>I still don’t see a way to do that.  The Varnish worker-process is not
built to compartmentalize bits at a cryptographic level and making it
do that would be a non-trivial undertaking.</p>
<p>But there is new loop-hole here.
One night, waiting for my flight home in Oslo airport, I went though
the entire TLS/SSL handshake process to see if there were anything
one could do, and I realized that you can actually terminate TLS/SSL
without holding the certificate, provided you can ask some process
which does to do a tiny bit of work.</p>
<p>The next morning <a class="reference external" href="https://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-technical-details/">CloudFlare announced the very same thing</a>:</p>
<p>This could conceivably be a way to terminate TLS/SSL in the Varnish-worker
process, while keeping the most valuable crypto-bits away from it.</p>
</section>
<section id="but-it-s-still-a-bad-idea">
<h2>But it’s still a bad idea<a class="headerlink" href="#but-it-s-still-a-bad-idea" title="Link to this heading">¶</a></h2>
<p>As I write this, the news that <a class="reference external" href="http://arstechnica.com/security/2015/04/27/android-apps-still-suffer-game-over-https-defects-7-months-later/">apps with 350 million downloads</a> in total
are (still) vulnerable to some SSL/TLS Man-In-The-Middle attack is doing the
rounds.</p>
<p>Code is hard, crypto code is double-plus-hard, if not double-squared-hard,
and the world really don’t need another piece of code that does an
half-assed job at cryptography.</p>
<p>If I, or somebody else, were to implement SSL/TLS in Varnish, it would
talk at least half a year to bring the code to a point where I would be
willing to show it to the world.</p>
<p>Until I get my time-machine working, that half year would be taken
away of other Varnish development, so the result had better be worth
it: If it isn’t, we have just increased the total attack-surface
and bug-probability for no better reason than “me too!”.</p>
<p>When I look at something like Willy Tarreau’s <a class="reference external" href="http://www.haproxy.org/">HAProxy</a> I have a
hard time to see any significant opportunity for improvement.</p>
</section>
<section id="conclusion">
<h2>Conclusion<a class="headerlink" href="#conclusion" title="Link to this heading">¶</a></h2>
<p>No, Varnish still won’t add SSL/TLS support.</p>
<p>Instead in Varnish 4.1 we have added support for Willys <a class="reference external" href="http://www.haproxy.org/download/1.5/doc/proxy-protocol.txt">PROXY</a>
protocol which makes it possible to communicate the extra details
from a SSL-terminating proxy, such as <a class="reference external" href="http://www.haproxy.org/">HAProxy</a>, to Varnish.</p>
<p>From a security point of view, this is also much better solution
than having SSL/TLS integrated in Varnish.</p>
<p>When (not if!) the SSL/TLS proxy you picked is compromised by a
possibly planted software bug, you can pick another one to replace
it, without loosing all the benefits of Varnish.</p>
<p>That idea is called the “Software Tools Principle”, it’s a very old
idea, but it is still one of the best we have.</p>
</section>
<section id="political-postscript">
<h2>Political PostScript<a class="headerlink" href="#political-postscript" title="Link to this heading">¶</a></h2>
<p>I realize that the above is a pretty strange stance to take in the
current “SSL Everywhere” political climate.</p>
<p>I’m not too thrilled about the “SSL Everywhere” idea, for a large
number of reasons.</p>
<p>The most obvious example is that you don’t want to bog down your
country’s civil defence agency with SSL/TLS protocol negotiations,
if their website is being deluged by people trying to survive a
natural disaster.</p>
<p>The next big issue is that there are people who do not have a right
to privacy.  In many countries this includes children, prisoners,
stock-traders, flight-controllers, first responders and so on.</p>
<p>SSL Everywhere will force institutions to either block any internet
connectivity or impose Man-in-The-Middle proxies to comply with
legal requirements of logging and inspection.  A clear step in
the wrong direction in my view.</p>
<p>But one of the biggest problem I have with SSL Everywhere is that
it gives privacy to the actors I think deserve it the least.</p>
<p>Again and again shady behaviour of big transnational, and therefore
law-less, companies have been exposed by security researchers (or
just interested lay-people) who ran tcpdump. snort or similar traffic
capture programs and saw what went on.</p>
<p>Remember all the different kind of “magic cookies” used to track
users across the web, against their wish and against laws and regulations ?</p>
<p>Pretty much all of those were exposed with trivial packet traces.</p>
<p>With SSL Everywhere, these actors get much more privacy to invade
the privacy of every human being with an internet connection, because
it takes a lot more skill to look into a SSL connection than a
plaintext HTTP connection.</p>
<p>“Sunshine is said to be the best of disinfectants” wrote supreme
court justice Brandeis, SSL Everywhere puts all traffic in the shade.</p>
<p>Poul-Henning, 2015-04-28</p>
</section>
</section>

<div class="clearer"></div>
          </div>
        </div>
      </div>
      <div class="sphinxsidebar" role="navigation" aria-label="main navigation">
        <div class="sphinxsidebarwrapper">
  <div>
    <h3><a href="../index.html">Table of Contents</a></h3>
    <ul>
<li><a class="reference internal" href="#">SSL revisited</a><ul>
<li><a class="reference internal" href="#a-ssl-tls-library">A SSL/TLS library</a></li>
<li><a class="reference internal" href="#handling-certificates">Handling Certificates</a></li>
<li><a class="reference internal" href="#but-it-s-still-a-bad-idea">But it’s still a bad idea</a></li>
<li><a class="reference internal" href="#conclusion">Conclusion</a></li>
<li><a class="reference internal" href="#political-postscript">Political PostScript</a></li>
</ul>
</li>
</ul>

</div>
  <div>
    <h4>Previous topic</h4>
    <p class="topless"><a href="brinch-hansens-arrows.html"
                          title="previous chapter">Brinch-Hansens Arrows</a></p>
  </div>
  <div>
    <h4>Next topic</h4>
    <p class="topless"><a href="persistent.html"
                          title="next chapter">A persistent message</a></p>
  </div>
  <div role="note" aria-label="source link">
    <h3>This Page</h3>
    <ul class="this-page-menu">
      <li><a href="../_sources/phk/ssl_again.rst.txt"
            rel="nofollow">Show Source</a></li>
    </ul>
   </div>
<div id="searchbox" style="display: none" role="search">
  <h3 id="searchlabel">Quick search</h3>
    <div class="searchformwrapper">
    <form class="search" action="../search.html" method="get">
      <input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false"/>
      <input type="submit" value="Go" />
    </form>
    </div>
</div>
<script>document.getElementById('searchbox').style.display = "block"</script>
        </div>
      </div>
      <div class="clearer"></div>
    </div>
    <div class="related" role="navigation" aria-label="related navigation">
      <h3>Navigation</h3>
      <ul>
        <li class="right" style="margin-right: 10px">
          <a href="../genindex.html" title="General Index"
             >index</a></li>
        <li class="right" >
          <a href="persistent.html" title="A persistent message"
             >next</a> |</li>
        <li class="right" >
          <a href="brinch-hansens-arrows.html" title="Brinch-Hansens Arrows"
             >previous</a> |</li>
        <li class="nav-item nav-item-0"><a href="../index.html">Varnish version 7.5.0 documentation</a> &#187;</li>
          <li class="nav-item nav-item-1"><a href="index.html" >Poul-Hennings random outbursts</a> &#187;</li>
        <li class="nav-item nav-item-this"><a href="">SSL revisited</a></li> 
      </ul>
    </div>
    <div class="footer" role="contentinfo">
    &#169; Copyright 2010-2014, Varnish Software AS.
      Created using <a href="https://www.sphinx-doc.org/">Sphinx</a> 7.2.6.
    </div>
  </body>
</html>

❌ Cancel

🗂️ Enhanced PHP File Manager

📊 Server Information

🔧 Quick Actions

✏️ Editing: ssl_again.html

📤 Upload File

📁 Create Folder

📄 Create File

✏️ Rename Item

🗑️ Delete Confirmation