rpm strip out debug symbol

When I build the rpm, it always extract out the debug symbols by running:
rpm --eval %__spec_install_post
/usr/lib/rpm/brp-compress
/usr/lib/rpm/brp-strip
/usr/lib/rpm/brp-strip-static-archive
/usr/lib/rpm/brp-strip-comment-note

which is very frustrating. You can disable it by using:

%define __spec_install_port /usr/lib/rpm/brp-compress

%define debug_package %{nil} 

However, I already have a version installed in the production.

I got core file, but cannot get useful backtrace. So this time, 

I have all these debug options enabled:

-ggdb -g3 -O0 

send https request via a proxy which is chain to another proxy using ssl

I am trying to send a https request via a proxy which is chain to another proxy by setting the cache_peer ssl in the first proxy and https_port in the second proxy. The upstream proxy gives me this error:

2010/02/05 16:31:39| clientNegotiateSSL: Error negotiating SSL connection on FD 21: error:1407609B:SSL routines:SSL23_GET_CLIENT_HELLO:http
s proxy request (1/-1)

This is the error defined in the openssl Library: SSL_R_HTTP_PROXY_REQUEST.

Let me have a background how the https via proxy works:
(1) The browser send a CONNECT request to the proxy
(2) The proxy open the 443 on the https web server
(3) Then the proxy sends the HTTP/1.0 200 connect established to the browser
(4) At this point, all the message will be relayed from this connection.

In our case, as the upstream is also a proxy, so it will forward "CONNECT xxx:443 HTTP/1.0 ...." to the upstream proxy directly, which is not SSL traffic and rejected by the upstream.

Configure polygraph to test https reverse proxy

You can configure the polygraph to test https reverse proxy:
(1) Set up the https_port for the reverse proxy (You have to disable the client certificate authentication as the polygraph does not support it.)
(2) In the workload file, add these tags:

SslWrap wrap = {
    protocols = [ "SSLv2":40%, "SSLv3", "TLSv1" ];
    root_certificate = "/opt/exampleca/cacert.pem";   

   ciphers = [ "ALL:HIGH": 100% ];
    rsa_key_sizes = [ 1024bit ];

    session_resumption = 40%;
    session_cache = 100;
};

Proxy pxySsl = {
    addresses = [ '10.191.237.4:8888' ];
    server.ssl_wraps = [ wrap ];
};
use(pxySsl);

Also add this to  Robot:
    ssl_wraps = [ wrap ];

ssl vpn

Yesterday I got a chance to take a look at a SSL VPN. The endpoint can download an ActiveX contorl from a secure web site after logon it. This ActiveX control will create a virtual adaptor, assign a user a virtual private IP. The traffic to the intranet will be intercepted and forward to this virtual adaptor (by chaning routing table?), and then a SSL tunnel is used to establish connections to the web servers.

The main advanatages of the SSL VPN are:

• Do not have to install VPN client. You only need a browser
• Provides granularity for access control.
• Use port 443 opened by most firewalls.

Squid ssl cache_peer

The Squid supports cache_peer using ssl:
In downstream squid:

cache_peer parentip parent  parentport 0000 default no-query no-digest ssl  sslcert=/opt/exampleca/certs/client2.pem sslkey=/opt/exampleca/client2private.pem sslcafile=/opt/exampleca/cacert.pem name=https-local

In upstream squid:

https_port parentport cert=/opt/exampleca/certs/server.pem key=/opt/exampleca/serverprivate.pem clientca=/opt/exampleca/cacert.pem capath=/opt/exampleca crlfile=/opt/exampleca/my_crl.pem sslflags=VERIFY_CRL  sslcontext=mlroaming

Coroutine in C

The Coroutine provides more points of entry and exit than routine. The Duff's Device provide a way to simulate it in C Code. Boost C++ also have an experimental implementation.

Wt: A C++ web toolkit

Wt (Pronounced as Witty) is a goolkit to build a web sites using C++. You can use the it to create high performace web application. It uses the C++ libary to generate the javascript code. Potentially, it can help to avoid XSS security problem as it have full control to generated javascript.