4 ms·

Zorp – Open source proxy firewall with deep protocol analysis

98 points by dedalus 8y ago

sgt 8y ago
First sentence mentions deep packet analysis for protocols like HTTP. But that's not really relevant anymore is it? Most modern websites will automatically redirect HTTP to HTTPS and then you can't apply deep packet analysis anymore. I can see some other fairly nice features here but not really enough to make me switch.
- amanzi 8y ago
  I guess it's terminating the HTTPS traffic and then proxying on to the respective server.
  - tgragnato 8y ago
    Yes, TLS offloading is there https://github.com/Balasys/zorp/blob/master/lib/proxyssl.cc https://github.com/Balasys/zorp/blob/master/lib/proxyssl.cc https://github.com/Balasys/zorp/blob/master/lib/pyx509.cc https://github.com/Balasys/zorp/blob/master/lib/pyx509.cc It's able to inspect and relay the connection as well as passing it to another proxy https://github.com/Balasys/zorp/blob/master/lib/proxystack.cc https://github.com/Balasys/zorp/blob/master/lib/proxystack.c...
- c0r0n3r 8y ago
  3.2. Configuring TLS and SSL encrypted connections https://www.balasys.hu/content/documents/zorp-gpl-guide-reference.pdf https://www.balasys.hu/content/documents/zorp-gpl-guide-refe...
Havoc 8y ago
Anyone running something like this in a home scenario? I kinda thought about it but the 50-100 bucks expenditure just for curiosity seems a bit heavy
- Operyl 8y ago
  Zorp GPL is free/opensource, so unless you're looking for some of the closed source features in Zorp Professional you should be able to tinker pretty heavily.
- ComputerGuru 8y ago
  Why would you need it on a home network? Best case scenario you just add latency to all your requests.
frankzander 8y ago
In short: It's censorship software.
- unethical_ban 8y ago
  If I agree with you: Yep it sure is, and that's perfectly ethical for personal and corporate use. To businesses, they have a responsibility to filter what goes in and out of their network, in the interest of their customers and themselves. If I don't agree with you: Do you think IP/port based firewalls are censorship? That any kind of cyber-border security is an affront to rights? If not, then how do you govern access as a private organization when everything is tcp/443 on AWS? Gotta know what it's going to.
- kajmagnusmobile 8y ago
  Censoring the viruses and malware and credit card thieves from making their voices heard
- raintrees 8y ago
  Just like a kitchen knife, purpose and intent set the tone. I am considering it as a tool to provide another layer of protection for my small business network. That would make your summary a positive for me.
- heroprotagonist 8y ago
  It has that potential, and I'm sure that's part of the business case for it (along with the more likely concern about exfiltration of data from secure networks). Or it could be privacy software that lets you look at data you're sending to the cloud, modify it, or prevent it altogether. It just depends who is in control of the software.
ausjke 8y ago
how is this different from squid proxy?
- tgragnato 8y ago
  Squid is mainly a web caching proxy. Zorp is a next generation firewall. The architecture is modular, and you can write plug-ins that analyse the structure of communications beyond packet headers: the content is inspected. The open source version includes out of the box support for inspecting HTTP, FTP, SMTP, POP3, Finger, Whois, Telnet (+TLS). But you can write plugins that couple the engine with anything, from an IDS such as Snort, Bro or Suricata, to something like nDPI or AssemblyLine. https://www.ntop.org/products/deep-packet-inspection/ndpi/ https://www.ntop.org/products/deep-packet-inspection/ndpi/ https://bitbucket.org/cse-assemblyline/assemblyline https://bitbucket.org/cse-assemblyline/assemblyline Based on the results of the analysis, you can choose to apply firewall rules.
  - ausjke 8y ago
    squid also has redirectors and c-icap filters etc, firewall wise it uses the OS(e.g. iptables), so it's more than a proxy but it does not do packet-level-firewall as it depends on iptables. looks like zorp is a all-in-one solution, hope i have time to play with it soon
nwmcsween 8y ago
So why not sample via netfilter and EBPF to filter?
deleted 8y ago
[deleted]

98 points by dedalus 8y ago

sgt 8y ago

First sentence mentions deep packet analysis for protocols like HTTP. But that's not really relevant anymore is it? Most modern websites will automatically redirect HTTP to HTTPS and then you can't apply deep packet analysis anymore. I can see some other fairly nice features here but not really enough to make me switch.

amanzi 8y ago
I guess it's terminating the HTTPS traffic and then proxying on to the respective server.
- tgragnato 8y ago
  Yes, TLS offloading is there https://github.com/Balasys/zorp/blob/master/lib/proxyssl.cc https://github.com/Balasys/zorp/blob/master/lib/proxyssl.cc https://github.com/Balasys/zorp/blob/master/lib/pyx509.cc https://github.com/Balasys/zorp/blob/master/lib/pyx509.cc It's able to inspect and relay the connection as well as passing it to another proxy https://github.com/Balasys/zorp/blob/master/lib/proxystack.cc https://github.com/Balasys/zorp/blob/master/lib/proxystack.c...
c0r0n3r 8y ago
3.2. Configuring TLS and SSL encrypted connections https://www.balasys.hu/content/documents/zorp-gpl-guide-reference.pdf https://www.balasys.hu/content/documents/zorp-gpl-guide-refe...

Havoc 8y ago

Anyone running something like this in a home scenario? I kinda thought about it but the 50-100 bucks expenditure just for curiosity seems a bit heavy

Operyl 8y ago
Zorp GPL is free/opensource, so unless you're looking for some of the closed source features in Zorp Professional you should be able to tinker pretty heavily.
ComputerGuru 8y ago
Why would you need it on a home network? Best case scenario you just add latency to all your requests.

frankzander 8y ago

In short: It's censorship software.

unethical_ban 8y ago
If I agree with you: Yep it sure is, and that's perfectly ethical for personal and corporate use. To businesses, they have a responsibility to filter what goes in and out of their network, in the interest of their customers and themselves. If I don't agree with you: Do you think IP/port based firewalls are censorship? That any kind of cyber-border security is an affront to rights? If not, then how do you govern access as a private organization when everything is tcp/443 on AWS? Gotta know what it's going to.
kajmagnusmobile 8y ago
Censoring the viruses and malware and credit card thieves from making their voices heard
raintrees 8y ago
Just like a kitchen knife, purpose and intent set the tone. I am considering it as a tool to provide another layer of protection for my small business network. That would make your summary a positive for me.
heroprotagonist 8y ago
It has that potential, and I'm sure that's part of the business case for it (along with the more likely concern about exfiltration of data from secure networks). Or it could be privacy software that lets you look at data you're sending to the cloud, modify it, or prevent it altogether. It just depends who is in control of the software.

ausjke 8y ago

how is this different from squid proxy?

tgragnato 8y ago
Squid is mainly a web caching proxy. Zorp is a next generation firewall. The architecture is modular, and you can write plug-ins that analyse the structure of communications beyond packet headers: the content is inspected. The open source version includes out of the box support for inspecting HTTP, FTP, SMTP, POP3, Finger, Whois, Telnet (+TLS). But you can write plugins that couple the engine with anything, from an IDS such as Snort, Bro or Suricata, to something like nDPI or AssemblyLine. https://www.ntop.org/products/deep-packet-inspection/ndpi/ https://www.ntop.org/products/deep-packet-inspection/ndpi/ https://bitbucket.org/cse-assemblyline/assemblyline https://bitbucket.org/cse-assemblyline/assemblyline Based on the results of the analysis, you can choose to apply firewall rules.
- ausjke 8y ago
  squid also has redirectors and c-icap filters etc, firewall wise it uses the OS(e.g. iptables), so it's more than a proxy but it does not do packet-level-firewall as it depends on iptables. looks like zorp is a all-in-one solution, hope i have time to play with it soon

nwmcsween 8y ago

So why not sample via netfilter and EBPF to filter?

deleted 8y ago

[deleted]