[squid-users] Server-first SSL bump in Squid 3.5.x
squid3 at treenet.co.nz
Thu Mar 19 06:18:55 UTC 2015
On 19/03/2015 6:36 p.m., Dan Charlesworth wrote:
> Hey y’all
> Finally got 3.5.2 running. I was under the impression that using server-first SSL bump would still be compatible, despite all the Peek & Splice changes, but apparently not. Hopefully someone can explain what might be going wrong here ...
Sadly "being compatible" with an broken design does not mean "working".
server-first only works nicely if the client, Squid, and server are
operating with the same TLS features - which is uncommon.
> Using the same SSL Bump config that we used for 3.4, we now seeing this happen:
> 19/Mar/2015-16:21:32 22 d4:f4:6f:71:90:e6 10.0.1.71 TCP_DENIED 200 0 CONNECT 220.127.116.11:443 - server-first - HIER_NONE/- - -
The CONNECT request in the clear-text HTTP layer is now subject to
access controls before any bumping takes place. Earlier Squid would let
the CONNECT through if you were bumping, even if it would have been
blocked by your access controls normally.
This is unrelated to server-first or any other ssl_bump action.
> Instead of this:
That is a different HTTP message from inside the encryption.
More information about the squid-users