February 2008 - zorp - lists.balabit.hu

problem with apt-get update on debian sarge
by Tom Carbert-Allen 22 Feb '08

22 Feb '08

Sorry for double post but only just got accepted to list so if you have replied to list only already please re-send This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, discussion or disclosure by others is strictly prohibited. If you are not the intended recipient of this email, please contact the sender by return email and delete all copies of this email and its attachments, if any.

2 3

missing constants and methods in pssl.py
by David Yerger 20 Feb '08

20 Feb '08

Now trying to create an https proxy for Outlook Web Access with Zorp GPL 3.1.12. 1. It looks like some of the constants are named differently than the Zorp GPL tutorial at http://www.balabit.hu/network-security/zorp-gateway/gpl/tutorial/, for example it mentions PSSL_VERIFY_NONE and PSSL_VERIFY_REQUIRED_TRUSTED in the example in section 5.6, but the code for the included Pssl.py v. 1.28 says SSL_VERIFY_NONE = 0 SSL_VERIFY_OPTIONAL = 1 SSL_VERIFY_REQUIRED_UNTRUSTED = 2 SSL_VERIFY_REQUIRED_TRUSTED = 3 (without the "P") 2. Looks like some methods and constants mentioned in the Zorp Gateway v3.1 SSL tutorial PDF aren't there, for example Methods: server_ssl_method server_disable_proto server_ssl_cipher Constants: PSSL_METHOD_SSLV23 Permit the use of SSLv2 and v3. PSSL_METHOD_SSLV2 Permit the use of SSLv2 exclusively. PSSL_METHOD_SSLV3 Permit the use of SSLv3 exclusively. PSSL_METHOD_TLSV1 Permit the use of TLSv1 exclusively. PSSL_METHOD_ALL Permit the use of all the supported (SSLv2, SSLv3, and TLSv1) protocols. Is this because these are only defined in the Pssl module for Zorp Pro? 3. Using a policy.py containing from Zorp.Core import * from Zorp.Http import * from Zorp.Plug import * from Zorp.Pssl import * def Zhttps(): Service("INhttps", INhttps, router=DirectedRouter(SockAddrInet("10.0.0.9", 80))) Listener(SockAddrInet("aaa.bbb.ccc.ddd", 50443), "INhttps") class StrongPsslProxy(PsslProxy): def config(self): PsslProxy.config(self) #docs say PSSL_VERIFY_NONE self.client_verify_type = SSL_VERIFY_NONE self.server_ca_directory = "/etc/ssl/certs/" #PDF docs want more here - #self.server_ssl_method = PSSL_METHOD_TLSV1 #self.server_disable_proto = TRUE #self.server_ssl_cipher = PSSL_CIPHERS_HIGH class INhttps(StrongPsslProxy): def config(self): StrongPsslProxy.config(self) self.server_need_ssl=FALSE self.server_keypair_files = ("/etc/ssl/certs/owa.crt", "/etc/ssl/private/owa.key") self.stack_proxy=(Z_STACK_PROXY, OWAHttpProxy) #wild guess on my part, maybe this will help self.client_need_ssl=TRUE class OWAHttpProxy(HttpProxy): def config(self): HttpProxy.config(self) self.request_header["Front-End-Https"]=(HTTP_HDR_INSERT, "on") I'm seeing in my logs stuff like Feb 17 16:09:49 localhost zorp/Zhttps[5552]: (svc/INhttps:0): Starting proxy instance; client_fd='15', client_address='AF_INET(aaa.bbb.ccc.def:3139)', client_zone='Zone(inter, 0.0.0.0/0)', client_local='AF_INET(aaa.bbb.ccc.ddd:443)', client_protocol='TCP' Feb 17 16:09:49 localhost zorp/Zhttps[5552]: (svc/INhttps:0/pssl): Server connection established; server_fd='18', server_address='AF_INET(10.0.0.9:80)', server_zone='Zone(intra, 10.0.0.0/24)', server_local='AF_INET(10.0.0.69:55718)', server_protocol='TCP' Feb 17 16:09:49 localhost zorp/Zhttps[5552]: (svc/INhttps:0/pssl): SSL handshake failed on the client side; error='error:1408A0C1:SSL routines:lib(20):SSL3_GET_CLIENT_HELLO:func(138):no shared cipher:reason(193)' Where 10.0.0.0 is the local network, aaa.bbb.ccc.ddd is my public IP, and aaa.bbb.ccc.def is the gateway address of my Snapgear (which my internal test client demaquerades as.) Looks like the protocol is defaulting to TCP instead of something sane like TLSV1, but I can't set it anywhere I can see. Is this disabled on purpose or is there something I can do to fix it? Thanks in advance! David Yerger

2 4

Problem parsing request with Zorp GPL reverse http proxy
by David Yerger 14 Feb '08

14 Feb '08

Seems that it's looking for "http://" in the "GET " part: Feb 14 14:37:24 localhost zorp/Zhttp[4028]: (svc/INhttp:3/http/client): data line 0x0000: 47 45 54 20 2F 20 48 54 54 50 2F 31 2E 31 GET / HTTP/1.1 Feb 14 14:37:24 localhost zorp/Zhttp[4028]: (svc/INhttp:3/http): Request details; command='GET', url='/', version='HTTP/1.1' <snip> Feb 14 14:37:24 localhost zorp/Zhttp[4028]: (svc/INhttp:3/http): processing request and headers; Feb 14 14:37:24 localhost zorp/Zhttp[4028]: (svc/INhttp:3/http): Error parsing URL; url='/', reason='URL has no scheme, colon missing' I'm using Zorp GPL 3.1.12. Thanks in advance David Yerger

1 1