[squid-users] Need support on HTTPs port forward

Wed Apr 1 13:34:26 UTC 2020

*Hello Team,*

I’m new to Squid and need some support on advance topic, request you to
advice on this requirement.

I’m trying to achieve below scenario for HTTPs traffic.

Client———>VPN———>SQUID—————>Internet

*Condition:*

   - VPN and SQUID on same machine
   - I didn’t want end-user (client) to know about proxy, so no
   configuration allowed on client end.
   - I’m ok to restrict/allow traffic based on SNI, so no need to decrypt
   the SSL packet

I was following this article to achieve this

https://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit

I have success fully rerouted the traffic on CentOS7 machine towards SQUID

HTTP traffic is working as expected, I’m able to apply policy based on
custom build Helper (Python)

SQUID not able to decode the HTTPs URL even I used ssl-bump with intercept
after going over resources on internet.

Notably I got  below errors,

X-Squid-Error: ERR_INVALID_REQ 0

ERROR: No forward-proxy ports configured.

*Below is the Firewalld config*

  services: http https ipsec

  ports: 500/udp 4500/udp 3127/tcp 3126/tcp

  protocols:

>   masquerade: yes

  forward-ports: port=80:proto=tcp:toport=3127:toaddr=10.128.0.4

port=443:proto=tcp:toport=3126:toaddr=10.128.0.4

*Below is the Squid.conf*

debug_options ALL,1 11,3 20,3

#

# Recommended minimum configuration:

#

> # Example rule allowing access from your local networks.

# Adapt to list your (internal) IP networks from where browsing

# should be allowed

acl localnet src 10.0.0.0/8 # RFC1918 possible internal network

acl localnet src 172.16.0.0/12 # RFC1918 possible internal network

acl localnet src 192.168.0.0/16 # RFC1918 possible internal network

acl localnet src fc00::/7       # RFC 4193 local private network range

acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged)
> machines

> acl SSL_ports port 443

acl Safe_ports port 80 # http

acl Safe_ports port 21 # ftp

acl Safe_ports port 443 # https

acl Safe_ports port 70 # gopher

acl Safe_ports port 210 # wais

acl Safe_ports port 1025-65535 # unregistered ports

acl Safe_ports port 280 # http-mgmt

acl Safe_ports port 488 # gss-http

acl Safe_ports port 591 # filemaker

acl Safe_ports port 777 # multiling http

acl CONNECT method CONNECT

> #

# Recommended minimum Access Permission configuration:

#

# Deny requests to certain unsafe ports

#http_access deny !Safe_ports

> # Deny CONNECT to other than secure SSL ports

#http_access deny CONNECT !SSL_ports

> # Only allow cachemgr access from localhost

http_access allow localhost manager

http_access deny manager

> # do not cache anything

cache deny all

> # We strongly recommend the following be uncommented to protect innocent

# web applications running on the proxy server who think the only

# one who can access services on "localhost" is a local user

#http_access deny to_localhost

> #

# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS

#

> # Example rule allowing access from your local networks.

# Adapt localnet in the ACL section to list your (internal) IP networks

# from where browsing should be allowed

http_access allow localnet

http_access allow localhost

> # And finally deny all other access to this proxy

http_access allow all

> # Squid normally listens to port 3128

http_port 3127 intercept

#http_port 3126

http_port 3126 ssl-bump intercept \

  cert=/etc/squid/cert/myCA.pem \

  generate-host-certificates=on dynamic_cert_mem_cache_size=4MB

>
> sslcrtd_program /usr/lib64/squid/ssl_crtd -s /var/spool/squid/ssl_db -M 4MB

> # Uncomment and adjust the following to add a disk cache directory.

#cache_dir ufs /var/spool/squid 100 16 256

> # Leave coredumps in the first cache dir

coredump_dir /var/spool/squid

> #

# Add any of your own refresh_pattern entries above these.

#

refresh_pattern ^ftp: 1440 20% 10080

refresh_pattern ^gopher: 1440 0% 1440

refresh_pattern -i (/cgi-bin/|\?) 0 0% 0

refresh_pattern . 0 20% 4320

>
> sslproxy_cert_error allow all

> #ssl bump

#ssl_bump peek all

ssl_bump stare all

ssl_bump bump all

*Error log:*

2020/04/01 12:55:13.459 kid1| 20,3| store.cc(521) unlock:
> store_client::copy unlocking key 67A641E2D51E4D78DC31FD1B1792BE59
> e:=sXINV/0x5560eb4c70a0*3

2020/04/01 12:55:13.459 kid1| 20,2| store.cc(949) checkCachable:
> StoreEntry::checkCachable: NO: not cachable

2020/04/01 12:55:13.459 kid1| 20,3| store.cc(483) lock: storeUnregister
> locked key 67A641E2D51E4D78DC31FD1B1792BE59 e:=sXINV/0x5560eb4c70a0*3

2020/04/01 12:55:13.459 kid1| 20,3| store.cc(521) unlock: storeUnregister
> unlocking key 67A641E2D51E4D78DC31FD1B1792BE59 e:=sXINV/0x5560eb4c70a0*3

2020/04/01 12:55:13.459 kid1| 20,3| store.cc(521) unlock:
> clientReplyContext::removeStoreReference unlocking key
> 67A641E2D51E4D78DC31FD1B1792BE59 e:=sXINV/0x5560eb4c70a0*2

2020/04/01 12:55:13.459 kid1| 20,3| store.cc(521) unlock:
> ClientHttpRequest::loggingEntry unlocking key
> 67A641E2D51E4D78DC31FD1B1792BE59 e:=sXINV/0x5560eb4c70a0*1

2020/04/01 12:55:13.459 kid1| 20,3| store.cc(1239) release: releasing
> e:=sXINV/0x5560eb4c70a0*0 67A641E2D51E4D78DC31FD1B1792BE59

2020/04/01 12:55:13.459 kid1| 20,3| store.cc(402) destroyMemObject:
> destroyMemObject 0x5560eb4d0f40

2020/04/01 12:55:13.459 kid1| 20,3| MemObject.cc(110) ~MemObject: del
> MemObject 0x5560eb4d0f40

2020/04/01 12:55:13.459 kid1| 20,3| store.cc(420) destroyStoreEntry:
> destroyStoreEntry: destroying 0x5560eb4c70a8

2020/04/01 12:55:13.459 kid1| 20,3| store.cc(402) destroyMemObject:
> destroyMemObject 0

2020/04/01 12:55:14.008 kid1| 20,3| store.cc(774) storeCreatePureEntry:
> storeCreateEntry: 'error:invalid-request'

2020/04/01 12:55:14.008 kid1| 20,3| MemObject.cc(97) MemObject: new
> MemObject 0x5560eb4d0f40

2020/04/01 12:55:14.008 kid1| 20,3| store.cc(499) setReleaseFlag:
> StoreEntry::setReleaseFlag: '[null_store_key]'

2020/04/01 12:55:14.008 kid1| 20,3| store_key_md5.cc(89) storeKeyPrivate:
> storeKeyPrivate: NONE error:invalid-request

2020/04/01 12:55:14.008 kid1| 20,3| store.cc(447) hashInsert:
> StoreEntry::hashInsert: Inserting Entry e:=XI/0x5560eb4c70a0*0 key
> '0255EA5E5890358FC3F4287C4CA0E49F'

2020/04/01 12:55:14.008 kid1| 20,3| store.cc(483) lock: storeCreateEntry
> locked key 0255EA5E5890358FC3F4287C4CA0E49F e:=XIV/0x5560eb4c70a0*1

2020/04/01 12:55:14.008 kid1| 20,3| store.cc(483) lock:
> StoreEntry::storeErrorResponse locked key 0255EA5E5890358FC3F4287C4CA0E49F
> e:=XIV/0x5560eb4c70a0*2

2020/04/01 12:55:14.008 kid1| 20,3| store.cc(1862) replaceHttpReply:
> StoreEntry::replaceHttpReply: error:invalid-request

2020/04/01 12:55:14.008 kid1| 20,2| store.cc(949) checkCachable:
> StoreEntry::checkCachable: NO: not cachable

2020/04/01 12:55:14.008 kid1| 20,3| store.cc(1048) complete: storeComplete:
> '0255EA5E5890358FC3F4287C4CA0E49F'

2020/04/01 12:55:14.008 kid1| 20,3| store.cc(1337) validLength:
> storeEntryValidLength: Checking '0255EA5E5890358FC3F4287C4CA0E49F'

2020/04/01 12:55:14.008 kid1| 20,2| store.cc(949) checkCachable:
> StoreEntry::checkCachable: NO: not cachable

2020/04/01 12:55:14.008 kid1| 20,3| store.cc(521) unlock:
> StoreEntry::storeErrorResponse unlocking key
> 0255EA5E5890358FC3F4287C4CA0E49F e:=sXINV/0x5560eb4c70a0*2

2020/04/01 12:55:14.008 kid1| 20,3| store.cc(483) lock: store_client::copy
> locked key 0255EA5E5890358FC3F4287C4CA0E49F e:=sXINV/0x5560eb4c70a0*2

2020/04/01 12:55:14.008 kid1| ERROR: No forward-proxy ports configured.

2020/04/01 12:55:14.008 kid1| 20,3| store.cc(483) lock:
> ClientHttpRequest::loggingEntry locked key 0255EA5E5890358FC3F4287C4CA0E49F
> e:=sXINV/0x5560eb4c70a0*3

2020/04/01 12:55:14.008 kid1| 11,2| client_side.cc(1393)
> sendStartOfMessage: HTTP Client local=172.217.4.46:443 remote=
> 10.15.1.100:53362 FD 10 flags=33

2020/04/01 12:55:14.008 kid1| 11,2| client_side.cc(1394)
> sendStartOfMessage: HTTP Client REPLY:

---------

HTTP/1.1 400 Bad Request

Server: squid/3.5.20

Mime-Version: 1.0

Date: Wed, 01 Apr 2020 12:55:14 GMT

Content-Type: text/html;charset=utf-8

Content-Length: 4033

X-Squid-Error: ERR_INVALID_REQ 0

Vary: Accept-Language

Content-Language: en

X-Cache: MISS from proto-vpn

X-Cache-Lookup: NONE from proto-vpn:0

Via: 1.1 proto-vpn (squid/3.5.20)

Connection: close
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20200401/5f136665/attachment-0001.html>