trAvis - MANAGER
Edit File: ssl_again.html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>SSL revisited — Varnish version 5.2.1 documentation</title> <link rel="stylesheet" href="../_static/classic.css" type="text/css" /> <link rel="stylesheet" href="../_static/pygments.css" type="text/css" /> <script type="text/javascript"> var DOCUMENTATION_OPTIONS = { URL_ROOT: '../', VERSION: '5.2.1', COLLAPSE_INDEX: false, FILE_SUFFIX: '.html', HAS_SOURCE: true }; </script> <script type="text/javascript" src="../_static/jquery.js"></script> <script type="text/javascript" src="../_static/underscore.js"></script> <script type="text/javascript" src="../_static/doctools.js"></script> <link rel="index" title="Index" href="../genindex.html" /> <link rel="search" title="Search" href="../search.html" /> <link rel="top" title="Varnish version 5.2.1 documentation" href="../index.html" /> <link rel="up" title="Poul-Hennings random outbursts" href="index.html" /> <link rel="next" title="A persistent message" href="persistent.html" /> <link rel="prev" title="Brinch-Hansens Arrows" href="brinch-hansens-arrows.html" /> </head> <body role="document"> <div class="related" role="navigation" aria-label="related navigation"> <h3>Navigation</h3> <ul> <li class="right" style="margin-right: 10px"> <a href="../genindex.html" title="General Index" accesskey="I">index</a></li> <li class="right" > <a href="persistent.html" title="A persistent message" accesskey="N">next</a> |</li> <li class="right" > <a href="brinch-hansens-arrows.html" title="Brinch-Hansens Arrows" accesskey="P">previous</a> |</li> <li class="nav-item nav-item-0"><a href="../index.html">Varnish version 5.2.1 documentation</a> »</li> <li class="nav-item nav-item-1"><a href="index.html" accesskey="U">Poul-Hennings random outbursts</a> »</li> </ul> </div> <div class="document"> <div class="documentwrapper"> <div class="bodywrapper"> <div class="body" role="main"> <div class="section" id="ssl-revisited"> <span id="phk-ssl-again"></span><h1>SSL revisited<a class="headerlink" href="#ssl-revisited" title="Permalink to this headline">¶</a></h1> <p>Four years ago, I wrote a rant about why Varnish has no SSL support (<a class="reference internal" href="ssl.html#phk-ssl"><span class="std std-ref">Why no SSL ?</span></a>) and the upcoming 4.1 release is good excuse to revisit that issue.</p> <div class="section" id="a-ssl-tls-library"> <h2>A SSL/TLS library<a class="headerlink" href="#a-ssl-tls-library" title="Permalink to this headline">¶</a></h2> <p>In 2011 I criticized OpenSSL's source-code as being a nightmare, and as much as I Hate To Say I Told You So, I Told You So: See also "HeartBleed".</p> <p>The good news is that HeartBleed made people realize that FOSS maintainers also have mortgages and hungry kids.</p> <p>Various initiatives have been launched to make prevent critical infrastructure software from being maintained Sunday evening between 11 and 12PM by a sleep-deprived and overworked parent, worried about about being able to pay the bills come the next month.</p> <p>We're not there yet, but it's certainly getting better.</p> <p>However, implementing TLS and SSL is still insanely complex, and thanks to Edward Snowdens whistle-blowing, we have very good reasons to believe that didn't happen by accident.</p> <p>The issue of finding a good TLS/SSL implementation is still the same and I still don't see one I would want my name associated with.</p> <p>OpenBSD's LibreSSL is certainly a step in a right direction, but time will show if it is viable in the long run -- they do have a tendency to be -- "SQUIRREL!!" -- distracted.</p> </div> <div class="section" id="handling-certificates"> <h2>Handling Certificates<a class="headerlink" href="#handling-certificates" title="Permalink to this headline">¶</a></h2> <p>I still don't see a way to do that. The Varnish worker-process is not built to compartmentalize bits at a cryptographic level and making it do that would be a non-trivial undertaking.</p> <p>But there is new loop-hole here. One night, waiting for my flight home in Oslo airport, I went though the entire TLS/SSL handshake process to see if there were anything one could do, and I realized that you can actually terminate TLS/SSL without holding the certificate, provided you can ask some process which does to do a tiny bit of work.</p> <p>The next morning <a class="reference external" href="https://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-technical-details/">CloudFlare announced the very same thing</a>:</p> <p>This could conceivably be a way to terminate TLS/SSL in the Varnish-worker process, while keeping the most valuable crypto-bits away from it.</p> </div> <div class="section" id="but-it-s-still-a-bad-idea"> <h2>But it's still a bad idea<a class="headerlink" href="#but-it-s-still-a-bad-idea" title="Permalink to this headline">¶</a></h2> <p>As I write this, the news that <a class="reference external" href="http://arstechnica.com/security/2015/04/27/android-apps-still-suffer-game-over-https-defects-7-months-later/">apps with 350 million downloads</a> in total are (still) vulnerable to some SSL/TLS Man-In-The-Middle attack is doing the rounds.</p> <p>Code is hard, crypto code is double-plus-hard, if not double-squared-hard, and the world really don't need another piece of code that does an half-assed job at cryptography.</p> <p>If I, or somebody else, were to implement SSL/TLS in Varnish, it would talk at least half a year to bring the code to a point where I would be willing to show it to the world.</p> <p>Until I get my time-machine working, that half year would be taken away of other Varnish development, so the result had better be worth it: If it isn't, we have just increased the total attack-surface and bug-probability for no better reason than "me too!".</p> <p>When I look at something like Willy Tarreau's <a class="reference external" href="http://www.haproxy.org/">HAProxy</a> I have a hard time to see any significant opportunity for improvement.</p> </div> <div class="section" id="conclusion"> <h2>Conclusion<a class="headerlink" href="#conclusion" title="Permalink to this headline">¶</a></h2> <p>No, Varnish still won't add SSL/TLS support.</p> <p>Instead in Varnish 4.1 we have added support for Willys <a class="reference external" href="http://www.haproxy.org/download/1.5/doc/proxy-protocol.txt">PROXY</a> protocol which makes it possible to communicate the extra details from a SSL-terminating proxy, such as <a class="reference external" href="http://www.haproxy.org/">HAProxy</a>, to Varnish.</p> <p>From a security point of view, this is also much better solution than having SSL/TLS integrated in Varnish.</p> <p>When (not if!) the SSL/TLS proxy you picked is compromised by a possibly planted software bug, you can pick another one to replace it, without loosing all the benefits of Varnish.</p> <p>That idea is called the "Software Tools Principle", it's a very old idea, but it is still one of the best we have.</p> </div> <div class="section" id="political-postscript"> <h2>Political PostScript<a class="headerlink" href="#political-postscript" title="Permalink to this headline">¶</a></h2> <p>I realize that the above is a pretty strange stance to take in the current "SSL Everywhere" political climate.</p> <p>I'm not too thrilled about the "SSL Everywhere" idea, for a large number of reasons.</p> <p>The most obvious example is that you don't want to bog down your country's civil defence agency with SSL/TLS protocol negotiations, if their website is being deluged by people trying to survive a natural disaster.</p> <p>The next big issue is that there are people who do not have a right to privacy. In many countries this includes children, prisoners, stock-traders, flight-controllers, first responders and so on.</p> <p>SSL Everywhere will force institutions to either block any internet connectivity or impose Man-in-The-Middle proxies to comply with legal requirements of logging and inspection. A clear step in the wrong direction in my view.</p> <p>But one of the biggest problem I have with SSL Everywhere is that it gives privacy to the actors I think deserve it the least.</p> <p>Again and again shady behaviour of big transnational, and therefore law-less, companies have been exposed by security researchers (or just interested lay-people) who ran tcpdump. snort or similar traffic capture programs and saw what went on.</p> <p>Remember all the different kind of "magic cookies" used to track users across the web, against their wish and against laws and regulations ?</p> <p>Pretty much all of those were exposed with trivial packet traces.</p> <p>With SSL Everywhere, these actors get much more privacy to invade the privacy of every human being with an internet connection, because it takes a lot more skill to look into a SSL connection than a plaintext HTTP connection.</p> <p>"Sunshine is said to be the best of disinfectants" wrote supreme court justice Brandeis, SSL Everywhere puts all traffic in the shade.</p> <p>Poul-Henning, 2015-04-28</p> </div> </div> </div> </div> </div> <div class="sphinxsidebar" role="navigation" aria-label="main navigation"> <div class="sphinxsidebarwrapper"> <h3><a href="../index.html">Table Of Contents</a></h3> <ul> <li><a class="reference internal" href="#">SSL revisited</a><ul> <li><a class="reference internal" href="#a-ssl-tls-library">A SSL/TLS library</a></li> <li><a class="reference internal" href="#handling-certificates">Handling Certificates</a></li> <li><a class="reference internal" href="#but-it-s-still-a-bad-idea">But it's still a bad idea</a></li> <li><a class="reference internal" href="#conclusion">Conclusion</a></li> <li><a class="reference internal" href="#political-postscript">Political PostScript</a></li> </ul> </li> </ul> <h4>Previous topic</h4> <p class="topless"><a href="brinch-hansens-arrows.html" title="previous chapter">Brinch-Hansens Arrows</a></p> <h4>Next topic</h4> <p class="topless"><a href="persistent.html" title="next chapter">A persistent message</a></p> <div role="note" aria-label="source link"> <h3>This Page</h3> <ul class="this-page-menu"> <li><a href="../_sources/phk/ssl_again.txt" rel="nofollow">Show Source</a></li> </ul> </div> <div id="searchbox" style="display: none" role="search"> <h3>Quick search</h3> <form class="search" action="../search.html" method="get"> <div><input type="text" name="q" /></div> <div><input type="submit" value="Go" /></div> <input type="hidden" name="check_keywords" value="yes" /> <input type="hidden" name="area" value="default" /> </form> </div> <script type="text/javascript">$('#searchbox').show(0);</script> </div> </div> <div class="clearer"></div> </div> <div class="related" role="navigation" aria-label="related navigation"> <h3>Navigation</h3> <ul> <li class="right" style="margin-right: 10px"> <a href="../genindex.html" title="General Index" >index</a></li> <li class="right" > <a href="persistent.html" title="A persistent message" >next</a> |</li> <li class="right" > <a href="brinch-hansens-arrows.html" title="Brinch-Hansens Arrows" >previous</a> |</li> <li class="nav-item nav-item-0"><a href="../index.html">Varnish version 5.2.1 documentation</a> »</li> <li class="nav-item nav-item-1"><a href="index.html" >Poul-Hennings random outbursts</a> »</li> </ul> </div> <div class="footer" role="contentinfo"> © Copyright 2010-2014, Varnish Software AS. Created using <a href="http://sphinx-doc.org/">Sphinx</a> 1.4.9. </div> </body> </html>