<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>
<div>
<div>
<div>
<div>Hi,</div>
<div><br>
</div>
<div>I’ve finally found time to join the dev mailing list, I work with squid on a daily basis and we’re always needing the latest features which often causes to use beta’s and nightlies rather than final releases. At the moment I’m having an issue with SSL
peek and splice with external ACLs.</div>
<div><br>
</div>
<div>I'm using Squid 4.0.2 compiled for CentOS 7 and i'm having issues with the SSL peek and splice configuration that previously worked in 3.5.11 with no problems. (The reason to update is to get eliptic curve cipher support).</div>
<div><br>
</div>
<div>Relavent config</div>
<div><br>
</div>
<div>external_acl_type extallowedSslUsers children-startup=1 children-max=40 ttl=0 negative_ttl=0 %MYPORT %SRC %{X-Proxy-Port}>h %{User-Agent}>h %DST %ssl::>sni /etc/squid/acl/aclSSLInterceptUsers.php</div>
<div>acl allowedSslUsers external extallowedSslUsers</div>
<div><br>
</div>
<div>acl DiscoverSNIHost at_step SslBump1</div>
<div><br>
</div>
<div>ssl_bump stare DiscoverSNIHost all</div>
<div>ssl_bump bump allowedSslUsers </div>
<div>ssl_bump splice all</div>
<div><br>
</div>
<div>In this configuration when using a normal proxy port or transparent port, the external ACL is never evaluated - it logs</div>
<div><br>
</div>
<div>WARNING: allowedSslUsers ACL is used in context without an ALE state. Assuming mismatch.</div>
<div><br>
</div>
<div>Changing DiscoverSNIHost to be SslBump2 causes the external acl to be evaluated for normal proxy port (but SNI is not populated) but still not for transparent proxy.</div>
<div><br>
</div>
<div>The aim is to retrieve the SNI sent by the client to use in both logging and the external ACL.</div>
<div><br>
</div>
<div>Swapping stare for peek gives the same behaviour. As far as I can tell, if the system hits this point (without an ALE state) it will skip the ACL check and return false – obviously that’s a problem – I’ve also tried stripping out parameters from the external
acl to no avail.</div>
<div><br>
</div>
<div>Is this a bug or a mis-configuration?</div>
<div><br>
</div>
<div>I can supply debug logs, traces etc if required.</div>
<div><br>
</div>
<div>Thanks</div>
</div>
</div>
<div><br>
</div>
<div><br>
</div>
<div>
<div id="MAC_OUTLOOK_SIGNATURE">
<div apple-content-edited="true" class="" style="font-family: Calibri;"><span class="Apple-style-span" style="font-family: Arial, sans-serif; font-size: x-large;">
<div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 14px; font-family: 'Times New Roman', serif;">
<b class=""><span class="" style="font-family: Arial, sans-serif;"><font class="Apple-style-span" color="#009193" size="4">Dave Lewthwaite</font></span></b></div>
</span><span class="Apple-style-span" style="orphans: 2; widows: 2; font-family: Arial, sans-serif; font-size: x-large;">
<div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span class="apple-style-span"><span class="" style="font-family: Arial, sans-serif; font-size: 13px; text-align: -webkit-auto;">Infrastructure Systems Architect</span><span class="" style="font-size: 10pt; font-family: Arial, sans-serif;">, RealityMine</span></span></div>
<br class="Apple-interchange-newline">
<img height="71" width="125" apple-inline="yes" id="0AA90333-B8FC-4F2B-AC16-BED7E48AC8A3" apple-width="yes" apple-height="yes" src="cid:2A866CD1-FB22-42AF-8EC3-AE86345E4557" class="" type="image/png"><font class="Apple-style-span" color="#008080" style="font-family: 'Times New Roman', serif; font-size: 16px;"><b class=""><span class="" style="font-size: 10pt; font-family: Arial, sans-serif;"><br class="Apple-interchange-newline">
E:</span></b></font><span class="apple-style-span" style="font-family: 'Times New Roman', serif; font-size: 16px;"><span class="" style="font-size: 10pt; font-family: Arial, sans-serif;"> <a href="mailto:davel@realitymine.com" class="" style="color: blue;">davel@realitymine.com</a> </span></span><span class="apple-style-span" style="font-family: 'Times New Roman', serif; font-size: 16px;"><b class=""><span class="" style="font-size: 10pt; font-family: Arial, sans-serif;"><font class="Apple-style-span" color="#008080">| </font></span></b></span><font class="Apple-style-span" color="#009695" style="font-family: 'Times New Roman', serif; font-size: 16px;"><span class="apple-style-span"><b class=""><span class="" style="font-size: 10pt; font-family: Arial, sans-serif;">M</span></b></span><b class=""><span class="" style="font-size: 10pt; font-family: Arial, sans-serif;">:</span></b></font><span class="apple-style-span" style="font-family: 'Times New Roman', serif; font-size: 16px;"><span class="" style="font-size: 10pt; font-family: Arial, sans-serif;"><font class="Apple-style-span" color="#008080"> </font>+44
(</span><span class="" style="font-size: 10pt; font-family: Arial, sans-serif;">0) 7919 100 358</span><span class="" style="font-size: 10pt; font-family: Arial, sans-serif;"><font class="Apple-style-span" color="#008080"> </font></span></span><span class="apple-style-span" style="font-family: 'Times New Roman', serif; font-size: 16px;"><b class=""><span class="" style="font-size: 10pt; font-family: Arial, sans-serif;"><font class="Apple-style-span" color="#008080">|
W:</font></span></b></span><span class="apple-style-span" style="font-family: 'Times New Roman', serif; font-size: 16px;"><span class="" style="font-size: 10pt; font-family: Arial, sans-serif;"> <a href="http://www.realitymine.com/" class="" style="color: blue;">www.realitymine.com</a> </span></span><span class="apple-style-span" style="font-family: 'Times New Roman', serif; font-size: 16px;"><b class=""><span class="" style="font-size: 10pt; font-family: Arial, sans-serif;"><font class="Apple-style-span" color="#008080">|
T</font></span></b></span><font class="Apple-style-span" color="#009695" style="font-family: 'Times New Roman', serif; font-size: 16px;"><b class=""><span class="" style="font-size: 10pt; font-family: Arial, sans-serif;">: </span></b></font><span class="apple-style-span" style="font-family: 'Times New Roman', serif; font-size: 16px;"><span class="" style="font-size: 10pt; font-family: Arial, sans-serif;"><font class="Apple-style-span" color="#008080"> </font></span></span><span class="Apple-style-span" style="font-size: 13px;">+44
(0) 161 414 0707</span></span></div>
<div><span class="Apple-style-span" style="orphans: 2; widows: 2; font-family: Arial, sans-serif; font-size: x-large;"><span class="Apple-style-span" style="font-size: 13px;"><br>
</span></span></div>
</div>
</div>
</div>
</div>
</body>
</html>