Linux server.kiran-academy.com 3.10.0-1160.108.1.el7.x86_64 #1 SMP Thu Jan 25 16:17:31 UTC 2024 x86_64
Apache/2.4.57 (Unix) OpenSSL/1.0.2k-fips
: 194.233.91.196 | : 216.73.216.172
Cant Read [ /etc/named.conf ]
7.4.32
finalho
www.github.com/MadExploits
Terminal
AUTO ROOT
Adminer
Backdoor Destroyer
Linux Exploit
Lock Shell
Lock File
Create User
CREATE RDP
PHP Mailer
BACKCONNECT
UNLOCK SHELL
HASH IDENTIFIER
CPANEL RESET
CREATE WP USER
README
+ Create Folder
+ Create File
/
usr /
share /
doc /
varnish-5.2.1 /
html /
phk /
[ HOME SHELL ]
Name
Size
Permission
Action
10goingon50.html
18.14
KB
-rw-r--r--
VSV00001.html
13.99
KB
-rw-r--r--
autocrap.html
8.21
KB
-rw-r--r--
backends.html
11.31
KB
-rw-r--r--
barriers.html
15.07
KB
-rw-r--r--
brinch-hansens-arrows.html
7.15
KB
-rw-r--r--
dough.html
17.47
KB
-rw-r--r--
farfaraway.html
9.54
KB
-rw-r--r--
firstdesign.html
68.29
KB
-rw-r--r--
gzip.html
13.73
KB
-rw-r--r--
http20.html
20.99
KB
-rw-r--r--
index.html
7.73
KB
-rw-r--r--
ipv6suckage.html
7.34
KB
-rw-r--r--
notes.html
16.4
KB
-rw-r--r--
persistent.html
8.71
KB
-rw-r--r--
platforms.html
9.68
KB
-rw-r--r--
somethinghappened.html
10.02
KB
-rw-r--r--
spdy.html
14.55
KB
-rw-r--r--
sphinx.html
8.22
KB
-rw-r--r--
ssl.html
8.91
KB
-rw-r--r--
ssl_again.html
12.14
KB
-rw-r--r--
thatslow.html
17.6
KB
-rw-r--r--
thetoolsweworkwith.html
16.65
KB
-rw-r--r--
thoughts.html
6.14
KB
-rw-r--r--
three-zero.html
7.45
KB
-rw-r--r--
trialerror.html
9.58
KB
-rw-r--r--
varnish_does_not_hash.html
12.02
KB
-rw-r--r--
vcl_expr.html
6.86
KB
-rw-r--r--
wanton_destruction.html
8.1
KB
-rw-r--r--
Delete
Unzip
Zip
${this.title}
Close
Code Editor : ssl.html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>Why no SSL ? — Varnish version 5.2.1 documentation</title> <link rel="stylesheet" href="../_static/classic.css" type="text/css" /> <link rel="stylesheet" href="../_static/pygments.css" type="text/css" /> <script type="text/javascript"> var DOCUMENTATION_OPTIONS = { URL_ROOT: '../', VERSION: '5.2.1', COLLAPSE_INDEX: false, FILE_SUFFIX: '.html', HAS_SOURCE: true }; </script> <script type="text/javascript" src="../_static/jquery.js"></script> <script type="text/javascript" src="../_static/underscore.js"></script> <script type="text/javascript" src="../_static/doctools.js"></script> <link rel="index" title="Index" href="../genindex.html" /> <link rel="search" title="Search" href="../search.html" /> <link rel="top" title="Varnish version 5.2.1 documentation" href="../index.html" /> <link rel="up" title="Poul-Hennings random outbursts" href="index.html" /> <link rel="next" title="How GZIP, and GZIP+ESI works in Varnish" href="gzip.html" /> <link rel="prev" title="Thoughts on the eve of Varnish 3.0" href="three-zero.html" /> </head> <body role="document"> <div class="related" role="navigation" aria-label="related navigation"> <h3>Navigation</h3> <ul> <li class="right" style="margin-right: 10px"> <a href="../genindex.html" title="General Index" accesskey="I">index</a></li> <li class="right" > <a href="gzip.html" title="How GZIP, and GZIP+ESI works in Varnish" accesskey="N">next</a> |</li> <li class="right" > <a href="three-zero.html" title="Thoughts on the eve of Varnish 3.0" accesskey="P">previous</a> |</li> <li class="nav-item nav-item-0"><a href="../index.html">Varnish version 5.2.1 documentation</a> »</li> <li class="nav-item nav-item-1"><a href="index.html" accesskey="U">Poul-Hennings random outbursts</a> »</li> </ul> </div> <div class="document"> <div class="documentwrapper"> <div class="bodywrapper"> <div class="body" role="main"> <div class="section" id="why-no-ssl"> <span id="phk-ssl"></span><h1>Why no SSL ?<a class="headerlink" href="#why-no-ssl" title="Permalink to this headline">ΒΆ</a></h1> <p>This is turning into a bit of a FAQ, but the answer is too big to fit in the margin we use for those.</p> <p>There are a number of reasons why there are no plans in sight that will grow SSL support in Varnish.</p> <p>First, I have yet to see a SSL library where the source code is not a nightmare.</p> <p>As I am writing this, the varnish source-code tree contains 82.595 lines of .c and .h files, including JEmalloc (12.236 lines) and Zlib (12.344 lines).</p> <p>OpenSSL, as imported into FreeBSD, is 340.722 lines of code, nine times larger than the Varnish source code, 27 times larger than each of Zlib or JEmalloc.</p> <p>This should give you some indication of how insanely complex the canonical implementation of SSL is.</p> <p>Second, it is not exactly the best source-code in the world. Even if I have no idea what it does, there are many aspect of it that scares me.</p> <p>Take this example in a comment, randomly found in s3-srvr.c:</p> <div class="highlight-default"><div class="highlight"><pre><span></span><span class="o">/*</span> <span class="n">Throw</span> <span class="n">away</span> <span class="n">what</span> <span class="n">we</span> <span class="n">have</span> <span class="n">done</span> <span class="n">so</span> <span class="n">far</span> <span class="ow">in</span> <span class="n">the</span> <span class="n">current</span> <span class="n">handshake</span><span class="p">,</span> <span class="o">*</span> <span class="n">which</span> <span class="n">will</span> <span class="n">now</span> <span class="n">be</span> <span class="n">aborted</span><span class="o">.</span> <span class="p">(</span><span class="n">A</span> <span class="n">full</span> <span class="n">SSL_clear</span> <span class="n">would</span> <span class="n">be</span> <span class="n">too</span> <span class="n">much</span><span class="o">.</span><span class="p">)</span> <span class="o">*</span> <span class="n">I</span> <span class="n">hope</span> <span class="n">that</span> <span class="n">tmp</span><span class="o">.</span><span class="n">dh</span> <span class="ow">is</span> <span class="n">the</span> <span class="n">only</span> <span class="n">thing</span> <span class="n">that</span> <span class="n">may</span> <span class="n">need</span> <span class="n">to</span> <span class="n">be</span> <span class="n">cleared</span> <span class="o">*</span> <span class="n">when</span> <span class="n">a</span> <span class="n">handshake</span> <span class="ow">is</span> <span class="ow">not</span> <span class="n">completed</span> <span class="o">...</span> <span class="o">*/</span> </pre></div> </div> <p>I hope they know what they are doing, but this comment doesn't exactly carry that point home, does it ?</p> <p>But let us assume that a good SSL library can be found, what would Varnish do with it ?</p> <p>We would terminate SSL sessions, and we would burn CPU cycles doing that. You can kiss the highly optimized delivery path in Varnish goodbye for SSL, we cannot simply tell the kernel to put the bytes on the socket, rather, we have to corkscrew the data through the SSL library and then write it to the socket.</p> <p>Will that be significantly different, performance wise, from running a SSL proxy in separate process ?</p> <p>No, it will not, because the way varnish would have to do it would be to ... start a separate process to do the SSL handling.</p> <p>There is no other way we can guarantee that secret krypto-bits do not leak anywhere they should not, than by fencing in the code that deals with them in a child process, so the bulk of varnish never gets anywhere near the certificates, not even during a core-dump.</p> <p>Would I be able to write a better stand-alone SSL proxy process than the many which already exists ?</p> <p>Probably not, unless I also write my own SSL implementation library, including support for hardware crypto engines and the works.</p> <p>That is not one of the things I dreamt about doing as a kid and if I dream about it now I call it a nightmare.</p> <p>So the balance sheet, as far as I can see it, lists "It would be a bit easier to configure" on the plus side, and everything else piles up on the minus side, making it a huge waste of time and effort to even think about it..</p> <p>Poul-Henning, 2011-02-15</p> </div> </div> </div> </div> <div class="sphinxsidebar" role="navigation" aria-label="main navigation"> <div class="sphinxsidebarwrapper"> <h4>Previous topic</h4> <p class="topless"><a href="three-zero.html" title="previous chapter">Thoughts on the eve of Varnish 3.0</a></p> <h4>Next topic</h4> <p class="topless"><a href="gzip.html" title="next chapter">How GZIP, and GZIP+ESI works in Varnish</a></p> <div role="note" aria-label="source link"> <h3>This Page</h3> <ul class="this-page-menu"> <li><a href="../_sources/phk/ssl.txt" rel="nofollow">Show Source</a></li> </ul> </div> <div id="searchbox" style="display: none" role="search"> <h3>Quick search</h3> <form class="search" action="../search.html" method="get"> <div><input type="text" name="q" /></div> <div><input type="submit" value="Go" /></div> <input type="hidden" name="check_keywords" value="yes" /> <input type="hidden" name="area" value="default" /> </form> </div> <script type="text/javascript">$('#searchbox').show(0);</script> </div> </div> <div class="clearer"></div> </div> <div class="related" role="navigation" aria-label="related navigation"> <h3>Navigation</h3> <ul> <li class="right" style="margin-right: 10px"> <a href="../genindex.html" title="General Index" >index</a></li> <li class="right" > <a href="gzip.html" title="How GZIP, and GZIP+ESI works in Varnish" >next</a> |</li> <li class="right" > <a href="three-zero.html" title="Thoughts on the eve of Varnish 3.0" >previous</a> |</li> <li class="nav-item nav-item-0"><a href="../index.html">Varnish version 5.2.1 documentation</a> »</li> <li class="nav-item nav-item-1"><a href="index.html" >Poul-Hennings random outbursts</a> »</li> </ul> </div> <div class="footer" role="contentinfo"> © Copyright 2010-2014, Varnish Software AS. Created using <a href="http://sphinx-doc.org/">Sphinx</a> 1.4.9. </div> </body> </html>
Close