Hi CheckMates,
A lot of you are the Check Point's trainer.
So it is possible that you could have some doubts regarding cptls_server_cn_cache table... like me.
In CCTE book (CCTE R81.10 - page 241) we can see this:
HTTPS Filtering HTTPS Filtering allows categorization of HTTPS sites without HTTPS inspection (passive HTTPS). It uses a cache table, cptls_ server_ cn_ cache . The cache saves mapping between IP+Port to CN (certificate's Canonical Name) and a flag, if the CN is valid. This table is searched with the IP+Port of a connection to look for a CN.
So I decided to check this out .. and it looks like that's not exactly true.
In this page of CCTE book there is also image that shows how this table looks like.
In this image we can see that first two columns describe Table Key which is IP + Port, then next two describe CN, then 5th column describe "Is CN Valid?", and finally 6th coulm describes ttl (I attach this image in this case - name: ccte_page_241.png).
However I noticed that I don't have such a table without enabling full HTTPS Inspection.
Remember that regarding what we can read from CCTE book this table is used when we want to categorize HTTPS sites without using HTTPS Inspection....
Here, take a look what tables are present in my R81.20 gateway without HTTPS Inspection enabled:
[Expert@CP-GW:0]# fw tab | grep tls
-------- tls_services --------
-------- fwtls_state_map --------
-------- cptls_params_id_map --------
-------- cptls_host_name_cache --------
-------- tls_main --------
[Expert@CP-GW:0]#
As you can see there is no "cptls_server_cn_cache" table.
Now ... if I enable HTTPS Inspection I can see this table:
[Expert@CP-GW:0]# fw tab | grep tls
-------- tls_services --------
-------- fwtls_state_map --------
-------- cptls_params_id_map --------
-------- cptls_server_cn_cache --------
-------- cptls_host_name_cache --------
-------- tls_main --------
[Expert@CP-GW:0]#
In case you wonder - yes I have enabled option to categorize HTTPS sites without HTTPS Inspection in: Manage & Settings > Blades > Application Control & URL Filtering > Advanced Settings > Categorize HTTPS websites
There is more ... table cptls_server_cn_cache looks different as in CCTE book - as you can see on another image that I attach to (my_cptls_server_cn_cache.png).
If we will take a look at "mine" cptls_server_cn_cache table it looks like this:
[Expert@CP-GW:0]# fw tab -t cptls_server_cn_cache
localhost:
-------- cptls_server_cn_cache --------
dynamic, id 7994, num ents 1, load factor 0.0, attributes: keep, sync, kbuf 2, local sync, expires 86400, , hashsize 16384, limit 45714
<12f4663e, 000001bb, d9817b43, 11be16f0; 0000001f, ab813004, 00000002, 00000000, ffffffff; 86301/86400>
How to read this ?
As you can see here we have 4 (not 2) columns before ";": 12f4663e, 000001bb, d9817b43, 11be16f0;
First one probably is IP, 2nd for sure is port 443, ... what about 3rd and 4th ?
And what about another columns: 0000001f, ab813004, 00000002, 00000000, ffffffff; Is this CN ? How to read this CN ?
Where is "Is CN valid?" ?
Last one is ttl - no doubts.
Have any of you thought about this too?
--
BR
Marcin
