From owner-freebsd-security Fri Nov 22 10: 5: 2 2002 Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 5720837B401 for ; Fri, 22 Nov 2002 10:04:59 -0800 (PST) Received: from webmail.sub.ru (webmail.sub.ru [213.247.139.22]) by mx1.FreeBSD.org (Postfix) with SMTP id 2685043E4A for ; Fri, 22 Nov 2002 10:04:58 -0800 (PST) (envelope-from tarkhil@webmail.sub.ru) Received: (qmail 62785 invoked by uid 0); 22 Nov 2002 18:05:34 -0000 Received: from unknown (HELO shuttle.svib.ru) (195.54.219.242) by webmail.sub.ru with SMTP; 22 Nov 2002 18:05:34 -0000 Date: Fri, 22 Nov 2002 21:04:09 +0300 From: Alex Povolotsky To: Adrian Filipi-Martin , freebsd-security@FreeBSD.ORG Subject: Re: jailed virtual https, anyone? Message-Id: <20021122210409.0061b0c7.tarkhil@webmail.sub.ru> In-Reply-To: <20021122113328.M48082-100000@lorax.ubergeeks.com> References: <20021122155027.7f694357.tarkhil@webmail.sub.ru> <20021122113328.M48082-100000@lorax.ubergeeks.com> Organization: sub.ru X-Mailer: Sylpheed version 0.8.2claws (GTK+ 1.2.10; i386-portbld-freebsd4.4) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org On Fri, 22 Nov 2002 11:38:51 -0500 (EST) Adrian Filipi-Martin wrote: AFM> You still have to do IP-based hosting for https. It doesn't matter AFM> that they have their IP's in the jails. AFM> AFM> The problem is that the SSL channel has already been negotiated and AFM> established before apache gets to consider the "Host:" header which is AFM> mostly what the virtual hosting is based upon. This means that it's too AFM> late to select a different virtual host without generating an SSL hostname AFM> mistmatch warning. YES!!! YES!!! YES!!! I do understand it for quite some time!!! But, for instance, transproxy extracts real IP information from /dev/ipl, which seems to be unavailable from inside the jail. I need either proxy with some method of SSL environment variables passing, or some apache module retrieving information from /dev/ipl or something else, or some way to transfer packets keeping original destination address. That is what I'm seeking here. -- Alex. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message