IETF Logo Mail Archive

Re: MITM and proxy messages [was: Call for Adoption: draft-song-dns-wireformat-http]

"Walter H." <Walter.H@mathemainzel.info> Sun, 07 August 2016 19:01 UTC

Return-Path: <ietf-http-wg-request+bounce-httpbisa-archive-bis2juki=lists.ie@listhub.w3.org>
X-Original-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Delivered-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F0BBE12D0B4 for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Sun, 7 Aug 2016 12:01:09 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -8.268
X-Spam-Level:
X-Spam-Status: No, score=-8.268 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-1.247, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mathemainzel.info
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AoeKGX6MGbB5 for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Sun, 7 Aug 2016 12:01:08 -0700 (PDT)
Received: from frink.w3.org (frink.w3.org [128.30.52.56]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 43B6D12D0AA for <httpbisa-archive-bis2Juki@lists.ietf.org>; Sun, 7 Aug 2016 12:01:08 -0700 (PDT)
Received: from lists by frink.w3.org with local (Exim 4.80) (envelope-from <ietf-http-wg-request@listhub.w3.org>) id 1bWTG5-0008BM-R3 for ietf-http-wg-dist@listhub.w3.org; Sun, 07 Aug 2016 18:57:13 +0000
Resent-Date: Sun, 07 Aug 2016 18:57:13 +0000
Resent-Message-Id: <E1bWTG5-0008BM-R3@frink.w3.org>
Received: from maggie.w3.org ([128.30.52.39]) by frink.w3.org with esmtps (TLS1.2:DHE_RSA_AES_128_CBC_SHA1:128) (Exim 4.80) (envelope-from <Walter.H@mathemainzel.info>) id 1bWTG0-0008A0-8x for ietf-http-wg@listhub.w3.org; Sun, 07 Aug 2016 18:57:08 +0000
Received: from mx11lb.world4you.com ([81.19.149.121]) by maggie.w3.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.80) (envelope-from <Walter.H@mathemainzel.info>) id 1bWTFv-0004au-1b for ietf-http-wg@w3.org; Sun, 07 Aug 2016 18:57:07 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=mathemainzel.info; s=dkim11; h=Content-Type:In-Reply-To:References:Subject:CC:To:MIME-Version:From:Date:Message-ID; bh=d8kY/ZQWdROcNULXcHVCIbP9/3Lpj7HlRQGh3IJAxX0=; b=N2GlX31sDvsS+u6a7msOstPnr7J+cs9kyUAjv9tfMIAxlCm1I+omDGjX4LEbxpkpDkFEqwE3ZeroPJTeZxEaoiSHjEIfvYabwYx9Z9onBK+AqdgneBIacfBf0jutmwkzP27Sj1sx4oRpNTptiFYcJ9uo9rzVaWrBI2Xus2FJk9U=;
Received: from [86.56.159.41] (helo=home.mail) by mx11lb.world4you.com with esmtpsa (TLSv1:AES256-SHA:256) (Exim 4.77) (envelope-from <Walter.H@mathemainzel.info>) id 1bWTDL-000078-HS; Sun, 07 Aug 2016 20:54:23 +0200
Message-ID: <57A783DE.2050304@mathemainzel.info>
Date: Sun, 07 Aug 2016 20:54:22 +0200
From: "Walter H." <Walter.H@mathemainzel.info>
Organization: Home
User-Agent: Mozilla/5.0 (UNIX; U; Cray X-MP/48; en-US; rv:2.70) Gecko/20110929 Communicator/7.20
MIME-Version: 1.0
To: Kari hurtta <hurtta-ietf@elmme-mailer.org>
CC: "ietf-http-wg@w3.org" <ietf-http-wg@w3.org>
References: <57A76F02.4020708@mathemainzel.info> <20160807175029.8D8B213E9B@welho-filter4.welho.com>
In-Reply-To: <20160807175029.8D8B213E9B@welho-filter4.welho.com>
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg="sha1"; boundary="------------ms050106090008040200090303"
X-SA-Do-Not-Run: Yes
X-AV-Do-Run: Yes
X-SA-Exim-Connect-IP: 86.56.159.41
X-SA-Exim-Mail-From: Walter.H@mathemainzel.info
X-SA-Exim-Scanned: No (on mx11lb.world4you.com); SAEximRunCond expanded to false
Received-SPF: pass client-ip=81.19.149.121; envelope-from=Walter.H@mathemainzel.info; helo=mx11lb.world4you.com
X-W3C-Hub-Spam-Status: No, score=-2.2
X-W3C-Hub-Spam-Report: BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, W3C_NW=0.5
X-W3C-Scan-Sig: maggie.w3.org 1bWTFv-0004au-1b 5a289a92928dade8a558bd6b2c696316
X-Original-To: ietf-http-wg@w3.org
Subject: Re: MITM and proxy messages [was: Call for Adoption: draft-song-dns-wireformat-http]
Archived-At: <http://www.w3.org/mid/57A783DE.2050304@mathemainzel.info>
Resent-From: ietf-http-wg@w3.org
X-Mailing-List: <ietf-http-wg@w3.org> archive/latest/32209
X-Loop: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list
List-Id: <ietf-http-wg.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Post: <mailto:ietf-http-wg@w3.org>
List-Unsubscribe: <mailto:ietf-http-wg-request@w3.org?subject=unsubscribe>

On 07.08.2016 19:50, Kari hurtta wrote:
> https://lists.w3.org/Archives/Public/ietf-http-wg/2016JulSep/0390.html
>
>> configured proxies are not the bug; why not just simpy use plain HTML?
>>
>> your sample chould then just be this simple:
>>
>> HTTP/1.1 403 Forbidden
>> Content-Type: text/html
>> Cache-Control: no-cache
>>
>> <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
>> <HTML>
> Major browsers do not show this when they get
> that on response of CONNECT -request.
which in fact is caused by something different - my MITM proxy generates 
errors that are shown by my browser;
and these errors are simple HTML

a MITM proxy uses a certificate for signing sites ...

e.g. the proxy uses a certificate called  Proxy-CA, then for every site 
you want to go to there will be a created a SSL certificate which is 
signed by Proxy-CA;
if the Proxy-CA was signed by a CA that is a built in token in the 
certstore of your browser or you have installed the Proxy-CA certificate 
in the certstore yourself, then your browser will show this simple HTML 
error page the proxy is sending;


> Bug 637619 - Display better error messages when HTTPS proxy servers return non-200 error codes
> https://bugzilla.mozilla.org/show_bug.cgi?id=637619
this is not really bug - it was filed at the times the browser (firefox) 
starts warning for invalid or self signed certificates ...
with mnot's "solution" ths would be same;

so where is the advantage of this?

v2.23.0 | Report a Bug | By Email