Re: [squid-users] SSL Tunnelling Exploit allowed through Squid?

On Fri, 2002-10-11 at 06:30, Sheahan, John (PCLN-NW) wrote:
> There is a hackers tool out there called "Bouncer" that uses SSL Tunnelling
> to get past all rules of a proxy server. You can check out the details at:
>
> http://www.r00t3d.org.uk/docs/bug.html
>
>
> My question is, does Squid support SSL Tunnelling? If so, is it on by
> default?

Squid supports the CONNECT method which is used for SSL Tunnelling. It
is on by default, but limited to certain ports. Also, the squid ACL's
dealing with domains and ip address's are always applied regardless of
method, so still apply to the CONNECT method.

Cheers,
Rob