I'm having an issue that i've only just noticed as my iOS devices are upgraded to 6.1.3.
SSL Scanning has been working great, valid, signed certificates reside on all devices and I've been successful in breaking down SSL traffic.
However, I'm now noticing that on iOS 6.1.3 devices, the AppStore and iTunes applications are starting to throw errors. When browsing the AppStore i'm greeted with missing icons, and clicking on applications to buy results in a "failed to contact AppStore" message on the iDevice.
Looking at the logs, at the time of these attempted transactions i'm seeing these errors:
2013:05:01-09:18:49 ASG-SopVic httpproxy[592]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0x16ccac58" function="ssl_log_errors" file="ssl.c" line="79" message="S 17.149.32.59: 2977196912:error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c:1256:SSL alert number 48"
2013:05:01-09:18:49 ASG-SopVic httpproxy[592]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0x16ccac58" function="ssl_connect" file="ssl.c" line="1300" message="ssl_handshake: Input/output error"
2013:05:01-09:18:49 ASG-SopVic httpproxy[592]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="" srcip="192.168.50.166" dstip="" user="" statuscode="000" cached="0" profile="REF_HttProIosSslTest (iOS SSL Test)" filteraction=" ()" size="0" request="0x16ccac58" url="17.149.32.59" exceptions="" error=""
Browsing to the offending URL, in this instance it's:
https://66.235.135.144
Throws a certificate validation error - this is even displayed when NOT going through the Sophos UTM's WebFilter and directly using FF or Chrome.
The reason, I suspect is due to the requested hardcoded URL in the AppStore app is https://66.235.135.144.
Where the DNS name (of which SSL certs need to be bound to) is reported as:
securemetrics.apple.com
This is only ONE EXAMPLE.
Normally the SSL validation, date check and SSL checking exclusions for DNS requested URLs works around most of the Apple issues - which is a default exclusion.
However, with iOS 6.1.3 making requests directly to IP addresses - these exemptions don't apply.
As a result, i'm trying to build a regular expression in an attempt to mitigate this 'undocumented feature' Apple has worked into its latest iOS.
So far I have this...
^https://(?[:(]?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)
Has been put together from a few online examples - however it encompasses every legitimate IPv4 address! Only legal dotted decimal notation IPv4 addresses are applied.
However, I think I have errors with the RegEx.
As I now cannot see ANY SSL traffic being intercepted and filtered by the UTM.
I'd like some help with the iOS issue - is any one else who has SSL scanning enabled seeing these errors within the UTM and iOS 6.1.3?
Also, if anyone has a better RegEx to match Apple only (and associated IPv4 addresses) that would be awesome too!
Cheers
Azz
This thread was automatically locked due to age.