[squid-users] Squid 4.6 "SSL routines:tls_parse_stoc_sct:bad extension"
Christian Schnatz
cschnatz at me.com
Tue Apr 16 10:34:12 UTC 2019
Hi Everyone,
we’ve just updated one of our machines to squid 4.6 with openssl 1.1.1 and ran in some strange errors when accessing *.google.com and apple app/itunes store domains.
Has anyone else encountered the follow errors and nows how to solve them? Right now clients are unable to browse the apple app store and do get a squid error page when accessing google.com.
Apr 16 12:17:05 squid[2201]: ERROR: negotiating TLS on FD 202: error:1425F175:SSL routines:ssl_choose_client_version:inappropriate fallback (1/-1/0)
Apr 16 12:17:05 squid[2201]: 1555409825.478 327 172.20.233.28 NONE/200 0 CONNECT 104.31.75.217:443 - ORIGINAL_DST/104.31.75.217 -
Apr 16 12:17:05 squid[2203]: 1555409825.184 10099 172.20.228.187 NONE_ABORTED/200 0 CONNECT 213.180.141.156:443 - HIER_NONE/- -
Apr 16 12:17:05 squid[2201]: ERROR: negotiating TLS on FD 873: error:1423406E:SSL routines:tls_parse_stoc_sct:bad extension (1/-1/0)
We are running squid with the following config:
sslproxy_cert_error allow all
https_port 3129 ssl-bump intercept connection-auth=off tls-cert=/etc/squid/myCA.pem generate-host-certificates=on dynamic_cert_mem_cache_size=12MB options=ALL
tls_outgoing_options options=ALL
tls_outgoing_options flags=DONT_VERIFY_PEER
tls_outgoing_options default-ca=off
tls_outgoing_options min-version=1.0
follow_x_forwarded_for allow all
logfile_rotate 2
access_log syslog:LOG_LOCAL0:EMERGENCY squid
max_filedescriptors 65535
http_port 3131
acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
http_access allow localnet
http_access allow localhost
http_access deny all
http_port 3128 transparent
#debug_options ALL,9
coredump_dir /var/spool/squid
url_rewrite_program /usr/bin/cf_plugin
url_rewrite_extras "%ssl::>sni %>a %et"
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern (Release|Packages(.gz)*)$ 0 20% 2880
refresh_pattern . 0 20% 4320
cache deny all
cache_log /dev/null
logfile_rotate 0
sslproxy_session_cache_size 0 MB
acl ssl_step1 at_step SslBump1
acl ssl_step2 at_step SslBump2
acl ssl_step3 at_step SslBump3
external_acl_type bump_check children-max=10 %URI %ssl::>sni %>a %et /usr/bin/cf_plugin -b
acl cf_allows external bump_check
ssl_bump peek ssl_step1 all
always_direct allow all
ssl_bump peek ssl_step2 cf_allows
ssl_bump bump ssl_step3 all
ssl_bump stare ssl_step2 !cf_allows
ssl_bump splice ssl_step3 cf_allows
ssl_bump bump ssl_step3 !cf_allows
on_unsupported_protocol tunnel all
url_rewrite_children 10
shutdown_lifetime 5 seconds
memory_pools off
cache_mem 2 MB
workers 5
ipcache_size 10240
fqdncache_size 10240
httpd_suppress_version_string on
Our main usage is to extract the SNI or IP from the SSL Request, forward it to cf_plugin and do some magic to decide wether this request should be blocked or not.
Squid has been build with the follow options:
Squid Cache: Version 4.6
Service Name: squid
Ubuntu linux
This binary uses OpenSSL 1.1.1b 26 Feb 2019. For legal restrictions on distribution see https://www.openssl.org/source/license.html
configure options: '--build=x86_64-linux-gnu' '--prefix=/usr' '--includedir=${prefix}/include' '--mandir=${prefix}/share/man' '--infodir=${prefix}/share/info' '--sysconfdir=/etc' '--localstatedir=/var' '--libexecdir=${prefix}/lib/squid' '--srcdir=.' '--disable-maintainer-mode' '--disable-dependency-tracking' '--disable-silent-rules' 'BUILDCXXFLAGS=-g -O2 -fPIE -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2 -Wl,-Bsymbolic-functions -fPIE -pie -Wl,-z,relro -Wl,-z,now -Wl,--as-needed' '--enable-build-info=Ubuntu linux' '--datadir=/usr/share/squid' '--sysconfdir=/etc/squid' '--libexecdir=/usr/lib/squid' '--mandir=/usr/share/man' '--enable-inline' '--disable-arch-native' '--enable-async-io=8' '--enable-storeio=ufs,aufs,diskd,rock' '--enable-removal-policies=lru,heap' '--enable-delay-pools' '--enable-cache-digests' '--enable-icap-client' '--enable-follow-x-forwarded-for' '--enable-auth-basic=DB,fake,getpwnam,LDAP,NCSA,NIS,PAM,POP3,RADIUS,SASL,SMB' '--enable-auth-digest=file,LDAP' '--enable-auth-negotiate=kerberos,wrapper' '--enable-auth-ntlm=fake,SMB_LM' '--enable-external-acl-helpers=file_userip,kerberos_ldap_group,LDAP_group,session,SQL_session,time_quota,unix_group,wbinfo_group' '--enable-security-cert-validators=fake' '--enable-storeid-rewrite-helpers=file' '--enable-url-rewrite-helpers=fake' '--enable-eui' '--enable-esi' '--enable-icmp' '--enable-zph-qos' '--enable-ecap' '--disable-translation' '--with-swapdir=/var/spool/squid' '--with-logdir=/var/log/squid' '--with-pidfile=/var/run/squid.pid' '--with-filedescriptors=65536' '--with-large-files' '--with-default-user=proxy' '--with-gnutls' '--with-openssl' '--enable-linux-netfilter' 'build_alias=x86_64-linux-gnu' 'CFLAGS=-g -O2 -fPIE -fstack-protector-strong -Wformat -Werror=format-security -Wall' 'LDFLAGS=-Wl,-Bsymbolic-functions -fPIE -pie -Wl,-z,relro -Wl,-z,now -Wl,--as-needed' 'CPPFLAGS=-Wdate-time -D_FORTIFY_SOURCE=2' 'CXXFLAGS=-g -O2 -fPIE -fstack-protector-strong -Wformat -Werror=format-security'
Some more Logoutput (not sure if that’s useful to debug this issue)
squidclient -p 3131 mgr:info
HTTP/1.1 200 OK
Server: squid
Mime-Version: 1.0
Date: Tue, 16 Apr 2019 10:29:09 GMT
Content-Type: text/plain
Expires: Tue, 16 Apr 2019 10:29:09 GMT
Last-Modified: Tue, 16 Apr 2019 10:29:09 GMT
Connection: close
Squid Object Cache: Version 4.6
Build Info: Ubuntu linux
Service Name: squid
Start Time: Mon, 15 Apr 2019 20:18:12 GMT
Current Time: Tue, 16 Apr 2019 10:29:09 GMT
Connection information for squid:
Number of clients accessing cache: 21581
Number of HTTP requests received: 754759
Number of ICP messages received: 0
Number of ICP messages sent: 0
Number of queued ICP replies: 0
Number of HTCP messages received: 0
Number of HTCP messages sent: 0
Request failure ratio: 0.00
Average HTTP requests per minute since start: 887.0
Average ICP messages per minute since start: 0.0
Select loop called: 110154975 times, 2.369 ms avg
Cache information for squid:
Hits as % of all requests: 5min: 0.0%, 60min: 0.0%
Hits as % of bytes sent: 5min: 3.7%, 60min: 2.0%
Memory hits as % of hit requests: 5min: 0.0%, 60min: 0.0%
Disk hits as % of hit requests: 5min: 0.0%, 60min: 0.0%
Storage Swap size: 0 KB
Storage Swap capacity: 0.0% used, 0.0% free
Storage Mem size: 0 KB
Storage Mem capacity: 0.0% used, 100.0% free
Mean Object Size: 0.00 KB
Requests given to unlinkd: 0
Median Service Times (seconds) 5 min 60 min:
HTTP Requests (All): 0.72598 0.66412
Cache Misses: 0.01207 0.01340
Cache Hits: 0.00000 0.00000
Near Hits: 0.00000 0.00000
Not-Modified Replies: 0.00000 0.00000
DNS Lookups: 0.00094 0.00094
ICP Queries: 0.00000 0.00000
Resource usage for squid:
UP Time: 51057.266 seconds
CPU Time: 4205.240 seconds
CPU Usage: 8.24%
CPU Usage, 5 minute avg: 17.61%
CPU Usage, 60 minute avg: 20.58%
Maximum Resident Size: 4742208 KB
Page faults with physical i/o: 4
Memory accounted for:
Total accounted: 151043 KB
memPoolAlloc calls: 6205
memPoolFree calls: 155540361
File descriptor usage for squid:
Maximum number of file descriptors: 5120
Largest file desc currently in use: 957
Number of file desc currently in use: 4631
Files queued for open: 0
Available number of file descriptors: 489
Reserved number of file descriptors: 500
Store Disk files open: 0
Internal Data Structures:
2540 StoreEntries
2540 StoreEntries with MemObjects
0 Hot Object Cache Items
0 on-disk objects
Best Regards and thanks for your help,
Chris
More information about the squid-users
mailing list