{"action":"created","issue":{"url":"https://api.github.com/repos/apache/trafficserver/issues/162","labels_url":"https://api.github.com/repos/apache/trafficserver/issues/162/labels{/name}","comments_url":"https://api.github.com/repos/apache/trafficserver/issues/162/comments","events_url":"https://api.github.com/repos/apache/trafficserver/issues/162/events","html_url":"https://github.com/apache/trafficserver/pull/162","id":54298494,"number":162,"title":"Allow transparent pass through for SSL port","user":{"login":"stipa","id":643110,"avatar_url":"https://avatars.githubusercontent.com/u/643110?v=3","gravatar_id":"","url":"https://api.github.com/users/stipa","html_url":"https://github.com/stipa","followers_url":"https://api.github.com/users/stipa/followers","following_url":"https://api.github.com/users/stipa/following{/other_user}","gists_url":"https://api.github.com/users/stipa/gists{/gist_id}","starred_url":"https://api.github.com/users/stipa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stipa/subscriptions","organizations_url":"https://api.github.com/users/stipa/orgs","repos_url":"https://api.github.com/users/stipa/repos","events_url":"https://api.github.com/users/stipa/events{/privacy}","received_events_url":"https://api.github.com/users/stipa/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-01-14T09:04:07Z","updated_at":"2015-01-14T16:22:43Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/apache/trafficserver/pulls/162","html_url":"https://github.com/apache/trafficserver/pull/162","diff_url":"https://github.com/apache/trafficserver/pull/162.diff","patch_url":"https://github.com/apache/trafficserver/pull/162.patch"},"body":"If the parsing of ClientHello fails and first byte does not indicate SSL\r\npacket, start a blind tunnel if tr-pass is set.\r\n\r\nThis feature allows to blind-tunnel non-SSL traffic and use SNI hook for\r\nSSL traffic."},"comment":{"url":"https://api.github.com/repos/apache/trafficserver/issues/comments/69942861","html_url":"https://github.com/apache/trafficserver/pull/162#issuecomment-69942861","issue_url":"https://api.github.com/repos/apache/trafficserver/issues/162","id":69942861,"user":{"login":"shinrich","id":334488,"avatar_url":"https://avatars.githubusercontent.com/u/334488?v=3","gravatar_id":"","url":"https://api.github.com/users/shinrich","html_url":"https://github.com/shinrich","followers_url":"https://api.github.com/users/shinrich/followers","following_url":"https://api.github.com/users/shinrich/following{/other_user}","gists_url":"https://api.github.com/users/shinrich/gists{/gist_id}","starred_url":"https://api.github.com/users/shinrich/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shinrich/subscriptions","organizations_url":"https://api.github.com/users/shinrich/orgs","repos_url":"https://api.github.com/users/shinrich/repos","events_url":"https://api.github.com/users/shinrich/events{/privacy}","received_events_url":"https://api.github.com/users/shinrich/received_events","type":"User","site_admin":false},"created_at":"2015-01-14T16:22:43Z","updated_at":"2015-01-14T16:22:43Z","body":"Looks good to me. Originally concerned that the transparent_passthrough state was being needlessly duplicated, but the HttpSM is not here yet at this point.  And you are following the pattern of the HttpSessionAccept.  One minor nit, is that I would \"and\" in port.m_inbound_transparent_p when setting the transparent allowed flag in SSLNextProtocolAccept.  It is just a bit of extra error checking.  If the connection is not at least inbound transparent, transparent passthrough makes no sense.  This is checked via the HttpSM method is_transparent_passthrough_allowed on the Http path.\r\n\r\nThe check for the CLIENT_HELLO handshake operator in the SSL error case seems fine.  You may get unlucky and have non SSL traffic with a first byte of 0x16, and not blind tunnel it.  But checking for more bytes gets complicated (e.g. checking that the next byte is not any valid SSL version).  In practice the simple check is likely fine, and it is highly unlikely that you will suck in legitimate SSL handshake exchanges into the blind tunnel.\r\n\r\nI'm going to take it for a spin on my dev box, and then merge it up."}}