Patch general description:
- Adds the peek-and-splice SSL bumping mode.
- The squid client side read the ssl client hello message. At this time just
buffer the hello message and does not pass it to openSSL subsytem.
The SSL-client-to-squid connection pauses here.
- Squid extracts the ssl client hello message features and configure the
squid-to-SSL-server SSL context to have the same features
- Squid sents the SSL hello message to SSL server and gets the response.
At this time just buffer the SSL server hello response and does not pass it
to openSSL subsystem. The squid-to-SSL-server connection pauses here.
- Squids decides (at this time always) to bump the connection, so it starts
the squid-to-SSL-server connection. The connection to SSL server
established.
- Squids gets the server certificates, builds new based on these certificates
and configure the SSL-client-to-squid SSL context with the generated
certificates, and allow the client hello message to enter openSSL subsystem
and establish the SSL connection with the client.
Technical details:
- client_side.cc:
The clientNegotiateSSL split in to two functions the clientNegotiateSSL and
Squid_SSL_accept, to support the new "pause SSL connection" feature.
Add three new ConnStateData methods (startPeekAndSplice, startPeekAndSpliceDone
and doPeekAndSpliceStep) to control SSL-client-to-squid connection pause/start.
- forward.cc:
Add code to the FwdState::initiateSSL method to retrieve SSL features from
client SSL hello message and configure the SSL connectio with the SSL
server.
A new method added, the FwdState::checkForPeekAndSplice which called for
peek-and-splice SSL bumping mode to decide if we need to splice or bump
the SSL connection.
- ssl/bio.cc, features added:
Ssl::ClientBio: Read and buffer the hello message
Ssl::ServerBio: Hacks the openSSL hello message while the message sent to
the server.
Buffer the SSL server hello message response
Ssl::Bio:sslFeatures: A new class which is able to extract and store SSL
features from SSL openSSL objects, or from raw SSL hello
messages.