Bud – A TLS terminating proxy

by indutny • 11 years ago

42 16 11 years ago

nailer• 11 years ago

Love bud! Fedor does a massive amount of the work on node's TLS implementation. I recently remarked to him that that bud's OCSP code would be better as a separate module - merely as a suggestion - and the next thing I knew https://www.npmjs.com/package/ocsp was released.

bud is one of the few node based TLS terminators and easily the best maintained. Modulus (the hosting company) use a Go based implementation. I think Nodejitsu had a node TLS terminator too but I'm not sure what happened to it post-GoDaddy.

eropple3• 11 years ago

Is there a feature-based reason to use this over HAProxy or nginx, or is this a "it's written in Node" thing?

stephenr• 11 years ago

I think it would almost certainly be the latter. I can't imagine it's more performant or more secure than the likes of HAProxy or Pound

mburns• 11 years ago

is this a "it's written in Node" thing?

Bud is written in C, not Node. It uses NPM for cross-platform packaging, but that is optional.

Is there a feature-based reason to use this over HAProxy or nginx,

It can be useful to have SSL termination be in its own process to isolate OpenSSL from other parts of your internal system like HTTP routing/request handling. For instance, in cases where you have explicit security requirements like FIPS 140-2.

eropple3• 11 years ago

Bud is written in C, not Node. It uses NPM for cross-platform packaging, but that is optional.

Got it, thanks.

It can be useful to have SSL termination be in its own process to isolate OpenSSL from other parts of your internal system like HTTP routing/request handling. For instance, in cases where you have explicit security requirements like FIPS 140-2.

Sure. I run two HAProxy instances for that, though.

indutny4• 11 years ago

There are lots of features:

* Asynchronous SNI - you may load cert/key pairs on the fly and let bud know which backend do you want it to connect the incoming client to

* Asynchronous OCSP stapling

* TLS ticket rotation, with possibility to scale to the big cluster

* x-forward frame for SPDY, and soon for HTTP/2 too

* Lots of other features, but nothing bud-specific

eropple3• 11 years ago

On-the-fly key pairs is a really nice thing (HAProxy does require a short period of downtime while restarting)--I'll have to check this out. Thanks.

sanxiyn• 11 years ago

Name clash with https://github.com/bloom-lang/bud is unfortunate.

_urga• 11 years ago

The author of Bud is Fedor Indutny who won the CloudFlare Heartbleed Challenge (https://blog.cloudflare.com/the-results-of-the-cloudflare-ch...).

Animats• 11 years ago

If you're running a release build with asserts turned off, and the connection uses SPDY, and the length of the domain name of the host is in the valid range of 245-253 bytes, then it looks like you can overwrite the stack at line 158 of xforward.c, at

    memcpy(frame + 12, client->remote.host, client->remote.host_len);

It's 2015. One should not be hand-coding string manipulation at the pointer level.

indutny4• 11 years ago

Wow, thank you very much for this! Doing a release right now.

indutny4• 11 years ago

Wait a second, this is not domain name. This is an IP address, it is 46 bytes maximum. Thanks for posting this, but I don't see any issue with this.

vardump3• 11 years ago

It's 2015. One should not be hand-coding string manipulation at the pointer level.

True, although that was building a binary message, not exactly a string.

"frame" should have probably been a (packed) struct instead of "unsigned char frame[256];".

Bud – A TLS terminating proxy

Related Stories