Docs: Clarified http_access scope w.r.t. X.509 AIA - #2490
Conversation
A security researcher has incorrectly claimed that Squid AIA fetching feature comes with "zero protections". This additional documentation may help avoid creating that false impression: Our `http_access` directive does apply to internally-generated requests for missing certificates. For example, if a Squid instance is correctly configured to deny access to some local resource, that configuration will prohibit such access via specially crafted AIA extensions as well. Also detailed `certificate-fetching` option of the `transaction_initiator` ACL to assist admins that need to customize access policies for internally-generated X.509 AIA requests.
yadij
left a comment
yadij
left a comment
There was a problem hiding this comment.
LGTM. One small nit, but not insisting on it for merge.
| DEFAULT_DOC: Deny, unless rules exist in squid.conf. | ||
| DOC_START | ||
| Allowing or Denying access based on defined access lists | ||
| Controls HTTP and FTP requests access to this Squid instance. |
There was a problem hiding this comment.
I would phrase that more like:
| Controls HTTP and FTP requests access to this Squid instance. | |
| Controls whether Squid is allowed to process an HTTP(S) or FTP request message. |
There was a problem hiding this comment.
I do not like my "controls access" version1, but I dislike proposed "allowed to process" variation even more because parsing the request, denying access to that request, and responding to that denied request while obeying deny_info settings (among many other actions!) is all request "processing". We need a more specific word.
Footnotes
-
Because my version repeats the same "access" word that is already present in the directive name instead of helping a reader unfamiliar with access controls (or a reader with weak English skills) by using a different word that the reader may recognize. ↩
3 participants
A security researcher has incorrectly claimed that Squid AIA fetching
feature comes with "zero protections". This additional documentation may
help avoid creating that false impression: Our
http_accessdirectivedoes apply to internally-generated requests for missing certificates.
For example, if a Squid instance is correctly configured to deny access
to some local resource, that configuration will prohibit such access via
specially crafted AIA extensions as well.
Also detailed
certificate-fetchingoption of thetransaction_initiatorACL to assist admins that need to customizeaccess policies for internally-generated X.509 AIA requests.