July 2008 - zorp - lists.balabit.hu

Connection limit in SSL?
by thomas.wenz＠gmx-topmail.de 29 Jul '08

29 Jul '08

Hi, Is there some kind of connection limit in the SSL-proxy? I tried apachebenchmark with a plain Zorp HTTPS instance. It works until a limit of 2 connections ("ab -n 5 -c 2 http://192.168.1.5/index.html") but any higher value (3 sometimes works) produces errors with failing SSL handshakes. "ab -n 5 -c 2 http://192.168.1.5/index.html" for example results in 5 (=all) broken connections. I couldn't find the real reason but I found some "broken pipe" , "Bad file descriptor" and "(nosession): Connection denied by policy; conn='NULL' "-messages indicating that the connection somehow gets lost. Raising the thread limits in the instances.conf or using the threadpool-option doesn't help - and if I raise it too high I get an "Too many open files" even though I thought I raised the ulimit value for zorp and root to a very high value. Specifying "THREADED=TRUE" in the Listener/Dispatcher doesn't change anything else...is there any solution for this concurrency problem or is this a known limitation? Thanks for your help! Thoms Wenz -- GMX startet ShortView.de. Hier findest Du Leute mit Deinen Interessen! Jetzt dabei sein: http://www.shortview.de/wasistshortview.php?mc=sv_ext_mf@gmx

2 6

Re: [zorp] Stacking programs doesn’t work and how to modify POST parameters?
by thomas.wenz＠gmx-topmail.de 20 Jul '08

20 Jul '08

Hi, Thanks a lot for your quick reply! I thought that Zorp 3.3 already exists because I saw press releases for the commercial version and some files in the download section named with 3.3. But ok, then it's clear why it would not install ;) I would be glad for any code or tutorial that could help me in checking POST data and controlling the response. Performance is not the problem because it's just for a very small amount of users and running on a dedicated server. I saw you've written something about AnyPy-proxy here (seems to be also a scenario with POST data) https://lists.balabit.hu/pipermail/zorp-hu/2007-May/002248.html but unfortunately I don't understand a word and online translator programs make it even less understandable ;) Generally, I would prefer the program stacking for checking POST data and responses through an external program instead of using custom python code. Do you know how long it will approximately take until the program stacking feature is released under GPL? I don't want to rush you and I'm very glad and thankful that Zorp is released in a GPL version and you're investing your valuable time in adding features to the GPL version. Unfortunately I've only a limited time frame until end of July to get this running and so I would need to look for a different temporary solution (either through AnyPy or through Squid, Snort_inline or so...) if it's released later and come back to Zorp when this feature is available... Thomas Wenz -- Psssst! Schon vom neuen GMX MultiMessenger gehört? Der kann`s mit allen: http://www.gmx.net/de/go/multimessenger

3 19

tadaam! http form proxy implemented in anypy
by Árpád Magosányi 15 Jul '08

15 Jul '08

Hi! Here is the pre-release of the anypy tutorials and FormProxy. I am proud of it beyond measure, so any criticism is welcome;) http://magwas.rulez.org/FormProxy This is the pre-release of the anypy howto series and related code. The related code contains such sweeties as a fully functional http form proxy. Yes, you can do input validation and normalisation for each and every control in the form in Zorp! AnyPy tutorial, part 1: How to create a zorp proxy for anything? (anything which is too simple to be useful, actually)<http://mag.webhome.hu/magwas/anypy-howto-1.html> xml source of te previous <http://mag.webhome.hu/magwas/anypy-howto-1.xml> AnyPy tutorial, part 2: How to create a zorp proxy for line-oriented protocols? <http://mag.webhome.hu/magwas/anypy-howto-2.html> Xml source of the previous <http://mag.webhome.hu/magwas/anypy-howto-2.xml> FormProxy.py <http://mag.webhome.hu/magwas/FormProxy.py> Test cases <http://mag.webhome.hu/magwas/test.tar.gz> patch against zorp/gpl 3.1.14<http://mag.webhome.hu/magwas/zorp--anypy--3.1.14--patch-11.diff> patch against libzorpll 3.1.8.2<http://mag.webhome.hu/magwas/libzorpll--anypy--3.1.8.2--patch-5.diff> Soon to come: part 3 of the tutorial about proxying asynchronous protocols, and hopefully an X11 (gosh, if you like space horror porno, read the protocol specification of the core X11 protocol) proxy.

2 2