Re: [Alteon] problem with sslid and sticky session
Ali Abbas <[email protected]> Thu, 11 Feb 2010 19:35:03 +0100
| Newsgroups | gmane.comp.programming.load-balancing.general |
|---|---|
| Message-ID | <[email protected]> |
--===============2106859798== Content-Type: multipart/alternative; boundary=00151747857cf10aa8047f5769de --00151747857cf10aa8047f5769de Content-Type: text/plain; charset=ISO-8859-1 Hi, *When you offload to SSL engines, it will encrypt the whole TCP payload. But, client application can still see the cookie.* Re-read what I wrote to Travis once more *Best bet, use pbind cookie and use an ssl offloader since the stream will be encrypted, thus the application will not be able to see the cookie.* The whole reason to use an offloader beside avoiding load issues is to have the ADC send the cookie to the client's browser and see it. If You do not offload to the ADC, the ADC can't see the cookie, thus does not know to which application server to forward. Do not offload to the ADC and the ADC can't see the cookie... If both the client and the application server can only see the cookie, then how would cookie persistancy work in an SSL environment? Sure the 32 bits SSL ID in SSLv3 is moved out of the encryption to be in clear text but this is not enough, since some browsers resets the SSL ID every X minutes... reason why you offload to the ADC... again back to what I said to Travis and why this whole thread was started in the first place. *Extra note too:* unless TCP/IP encapsulation has been re-invented in the last 2 day, a cookie is part of the TCP payload... encrypt the payload, you encrypt the cookie... Cheers, -- Ali Abbas Blog: http://alouche.net On Thu, Feb 11, 2010 at 9:23 AM, ADC expert <[email protected]> wrote: > Hi Abbas, > When you offload to SSL engines, it will encrypt the whole TCP payload. > But, client application can still see the cookie. > > It should be this way, ADC should encrypt the cookie and give to SSL > engine. By this client application does not understand the cookie. > I also think, whats the big fuss about cookie..it is just for > persistency..if the user modifies it -he would loose persistency and that is > his problem.. > > What do you say? would any one want encrypted cookies? > > > > On Sat, Feb 6, 2010 at 3:29 AM, Ali Abbas <[email protected]> wrote: > >> Hi Travis >> >> On Fri, Feb 5, 2010 at 10:17 PM, Gamble, Travis < >> [email protected]> wrote: >> >>> I know in some versions of IE, it regenerates the SSL ID every 2 >>> minutes which would effectively break this functionality. >>> >>> Without looking at a bunch of sniffs, I'm not sure if that functionality >>> is still true on recent versions, but if so, you may be stuck with source IP >>> as your session persistence method. >>> >>> >> >> Don't forget, ISPs often proxies http and https through different proxies, >> so you are going hit a wall here with pbind clientip >> >> Best bet, use pbind cookie and use an ssl offloader since the stream will >> be encrypted, thus the application will not be able to see the cookie. >> >> Regards >> >> -- >> Ali Abbas >> Blog: http://alouche.net >> >> _______________________________________________ >> lb-l mailing list >> [email protected] >> http://vegan.net/mailman/listinfo/lb-l >> Searchable Archive: http://vegan.net/lb/archive >> http://lbdigest.com Load Balancing Digest >> http://lbwiki.com Load Balancing Wiki >> >> > > _______________________________________________ > lb-l mailing list > [email protected] > http://vegan.net/mailman/listinfo/lb-l > Searchable Archive: http://vegan.net/lb/archive > http://lbdigest.com Load Balancing Digest > http://lbwiki.com Load Balancing Wiki > > --00151747857cf10aa8047f5769de Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable <div>Hi,</div> <div>=A0</div> <div><em>When you offload to SSL engines, it will encrypt the whole TCP pay= load. But, client application can still see the cookie.</em></div> <div>=A0</div> <div>Re-read what I wrote to Travis once more</div> <div>=A0</div> <div><em><u>Best bet, use pbind cookie=A0 and use an ssl offloader since th= e stream will be encrypted, thus the application will not be able to see th= e cookie.</u></em></div> <div>=A0</div> <div>The whole reason to use an offloader beside avoiding load issues is to= have the ADC send the cookie to the client's browser and see it.</div> <div>=A0</div> <div>If You do not offload to the ADC, the ADC can't see the cookie, th= us does not know to which application server to forward.=A0Do not offload t= o the ADC and the ADC can't see the cookie... If both the client and th= e application server can only see the cookie, then how would cookie persist= ancy work in an SSL environment?</div> <div>Sure the 32 bits SSL ID in SSLv3 is moved out of the encryption to be = in clear text but this is not enough, since some browsers resets the SSL ID= every X minutes... reason why you offload to the ADC... again back to what= I said to Travis and why this whole thread was started in the first place.= </div> <div>=A0</div> <div><strong>Extra note too:</strong> unless TCP/IP encapsulation=A0has bee= n=A0re-invented in the last 2 day, a cookie is part of the TCP payload... e= ncrypt the payload, you encrypt the cookie... </div> <div>=A0</div> <div>Cheers,</div> <div><br clear=3D"all">--<br>Ali Abbas<br>Blog: <a href=3D"http://alouche.n= et">http://alouche.net</a><br><br><br></div> <div class=3D"gmail_quote">On Thu, Feb 11, 2010 at 9:23 AM, ADC expert <spa= n dir=3D"ltr"><<a href=3D"mailto:[email protected]">[email protected]</a= >></span> wrote:<br> <blockquote class=3D"gmail_quote" style=3D"PADDING-LEFT: 1ex; MARGIN: 0px 0= px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">Hi Abbas,<br>=A0 When you offloa= d to SSL engines, it will encrypt the whole TCP payload. But, client applic= ation can still see the cookie.<br> <br>It should be this way, ADC should encrypt the cookie and give to SSL en= gine. By this client application does not understand the cookie. <br>I also= think, whats the big fuss about cookie..it is just for persistency..if the= user modifies it -he would loose persistency and that is his problem..<br> <br>What do you say? would any one want encrypted cookies?<br><br><br><br> <div class=3D"gmail_quote"> <div> <div></div> <div class=3D"h5">On Sat, Feb 6, 2010 at 3:29 AM, Ali Abbas <span dir=3D"lt= r"><<a href=3D"mailto:[email protected]" target=3D"_blank">alouche07@g= mail.com</a>></span> wrote:<br></div></div> <blockquote class=3D"gmail_quote" style=3D"PADDING-LEFT: 1ex; MARGIN: 0pt 0= pt 0pt 0.8ex; BORDER-LEFT: rgb(204,204,204) 1px solid"> <div> <div></div> <div class=3D"h5">Hi Travis<br><br> <div class=3D"gmail_quote"> <div>On Fri, Feb 5, 2010 at 10:17 PM, Gamble, Travis <span dir=3D"ltr"><= <a href=3D"mailto:[email protected]" target=3D"_blank">Travis.G= [email protected]</a>></span> wrote:<br> <blockquote class=3D"gmail_quote" style=3D"PADDING-LEFT: 1ex; MARGIN: 0pt 0= pt 0pt 0.8ex; BORDER-LEFT: rgb(204,204,204) 1px solid"> <div> <div dir=3D"ltr" align=3D"left"><span><font face=3D"Arial" color=3D"#0000ff= " size=3D"2">I know in some versions of IE, it regenerates the SSL ID every= 2 minutes which would effectively break this functionality.</font></span><= /div> <div dir=3D"ltr" align=3D"left"><span><font face=3D"Arial" color=3D"#0000ff= " size=3D"2"></font></span>=A0</div> <div dir=3D"ltr" align=3D"left"><span><font face=3D"Arial" color=3D"#0000ff= " size=3D"2">Without looking at a bunch of sniffs, I'm not sure if that= functionality is still true on recent versions, but if so, you may be stuc= k with source IP as your session persistence method.</font></span></div> <div dir=3D"ltr" align=3D"left"><span><font face=3D"Arial" color=3D"#0000ff= " size=3D"2"></font></span>=A0</div></div></blockquote></div> <div><br>Don't forget, ISPs often proxies http and https through differ= ent proxies, so you are going hit a wall here with pbind clientip<br><br>Be= st bet, use pbind cookie=A0 and use an ssl offloader since the stream will = be encrypted, thus the application will not be able to see the cookie.<br> <br>Regards<br><br clear=3D"all">--<br>Ali Abbas<br>Blog: <a href=3D"http:/= /alouche.net/" target=3D"_blank">http://alouche.net</a>=A0 <br></div></div>= <br></div></div> <div class=3D"im">_______________________________________________<br>lb-l m= ailing list<br><a href=3D"mailto:[email protected]" target=3D"_blank">lb-l@veg= an.net</a><br><a href=3D"http://vegan.net/mailman/listinfo/lb-l" target=3D"= _blank">http://vegan.net/mailman/listinfo/lb-l</a><br> Searchable Archive: <a href=3D"http://vegan.net/lb/archive" target=3D"_blan= k">http://vegan.net/lb/archive</a><br><a href=3D"http://lbdigest.com/" targ= et=3D"_blank">http://lbdigest.com</a> Load Balancing Digest<br><a href=3D"h= ttp://lbwiki.com/" target=3D"_blank">http://lbwiki.com</a> Load Balancing W= iki<br> <br></div></blockquote></div><br><input type=3D"hidden"><input type=3D"hidd= en">=20 <div></div><br>_______________________________________________<br>lb-l mail= ing list<br><a href=3D"mailto:[email protected]">[email protected]</a><br><a href= =3D"http://vegan.net/mailman/listinfo/lb-l" target=3D"_blank">http://vegan.= net/mailman/listinfo/lb-l</a><br> Searchable Archive: <a href=3D"http://vegan.net/lb/archive" target=3D"_blan= k">http://vegan.net/lb/archive</a><br><a href=3D"http://lbdigest.com/" targ= et=3D"_blank">http://lbdigest.com</a> Load Balancing Digest<br><a href=3D"h= ttp://lbwiki.com/" target=3D"_blank">http://lbwiki.com</a> Load Balancing W= iki<br> <br></blockquote></div><br> --00151747857cf10aa8047f5769de-- --===============2106859798== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ lb-l mailing list [email protected] http://vegan.net/mailman/listinfo/lb-l Searchable Archive: http://vegan.net/lb/archive http://lbdigest.com Load Balancing Digest http://lbwiki.com Load Balancing Wiki --===============2106859798==--