src/tlsproxy.h: Prepend global_ to tls_priority_cache and tls_dh_params.

[tlsproxy/tlsproxy.git] / README

diff --git a/README b/README
index ebcb53fb201f0c111e20a2dc249d272e441f1f76..0178e5c8f97a7caff3f3041cb50e4751ac10bc52 100644 (file)
--- a/README
+++ b/README
@@ -56,3 +56,35 @@ also easy to spot in the browser because it uses an invalid hostname
 
 If an internal error occurs before the TLS connection can be established a 503
 Forwarding failure is sent to the client (unencrypted).
+
+
+-u option
+~~~~~~~~~
+
+The '-u' option passes through connections for hostnames with no stored
+certificate (i.e. `certificate-*-server.pem` is missing or unreadable). In
+this case the normal CA chain in your browser lets you validate the server
+certificate. If the server certificate changes you're _not_ informed!
+
+This option is useful if you often visit websites using HTTPS but you don't
+use critical information (e.g. no passwords, etc.) on this website.
+
+For hostnames with a stored server certificate everything works as usual and a
+certificate change is detected.
+
+WARNING: The option might cause security problems if you're not careful:
+
+For example you normally visit https://example.org/ and store the server
+certificate in `certificate-example.org.server.pem`. Without '-u' everything
+is fine.
+
+But if you use '-u' and an attacker redirects you to e.g.
+https://www.example.org/ (or https://whatever.org/) (for example through a
+link on a different site) then the proxy just forwards the TLS connection
+(because it doesn't know the fingerprint for https://www.example.org/, that's
+how '-u' works) and you won't be aware that a different server certificate
+might be used!
+
+If you always verify the authentication of the connection this isn't a
+problem, but if you only check if it's a HTTPS connection then this attack is
+possible.