<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Hello All.<br>
<br>
My goal is to do ssl bumping in transparent proxy mode with domain
exclude possibility. <br>
Let me tell you about squid's strange behaviour when I'm trying to
do it.<br>
<br>
In browsers it says something like this:<br>
<span style="font-family: 'Segoe UI',Tahoma,sans-serif; font-size:
15px; font-style: normal; font-variant: normal; font-weight:
normal; letter-spacing: normal; line-height: 24px; text-align:
start; text-indent: 0px; text-transform: none; white-space:
normal; word-spacing: 0px; display: inline ! important; float:
none; background-color: rgb(247, 247, 247);"><i>This server could
not prove that it is <a class="moz-txt-link-abbreviated" href="http://www.ukr.net">www.ukr.net</a>; its security certificate is
from212.42.76.253. This may be caused by a misconfiguration or
an attacker intercepting your connection.</i><i><br>
</i><i>NET::ERR_CERT_COMMON_NAME_INVALID</i><i><br>
</i><i>Subject: 212.42.76.253</i><i><br>
</i></span><br>
Looks like squid takes the CN from the certificate as IP address of
the destination domain.<br>
But, everything works smoothly when I use proxy in non transparent
mode and put it to the browser directly . I can successfully bypass
bad sites and do ssl bumping on others. There are no certificate
errors except of some of them, you know)<br>
<br>
My OS is <i>Centos 6.5 </i><i>2.6.32-358.6.2.el6.x86_64</i><br>
My squid's version:<br>
<i>/opt/squid/sbin/squid -v</i><i><br>
</i><i>Squid Cache: Version 3.5.0.2</i><i><br>
</i><i>Service Name: squid</i><i><br>
</i><i>configure options: '--with-openssl'
'--enable-linux-netfilter' '--disable-ipv6' '--enable-icap-client'
'--enable-ssl-crtd' '--prefix=/opt/squid'
'--enable-external-acl-helpers=none'
'--enable-auth-negotiate=none' '--enable-follow-x-forwarded-for'
'--disable-auth-ntlm' '--disable-arch-native' '--enable-wccpv2'
'--enable-snmp'
'PKG_CONFIG_PATH=/usr/lib64/pkgconfig:/usr/share/pkgconfig'
--enable-ltdl-convenience</i><i><br>
</i><br>
My iptables which is doing redirecting to internal squid ports: <i><br>
</i><i>Table: nat</i><i><br>
</i><i>Chain PREROUTING (policy ACCEPT)</i><i><br>
</i><i>num target prot opt source destination</i><i><br>
</i><i>1 ACCEPT tcp -- 0.0.0.0/0
192.168.0.121 tcp dpt:443 /* accept connection */</i><i><br>
</i><i>2 REDIRECT tcp -- 192.168.0.0/24
0.0.0.0/0 tcp dpt:443 /* redirect */ redir ports 3132</i><i><br>
</i><i>3 ACCEPT tcp -- 0.0.0.0/0
192.168.0.121 tcp dpt:80 /* accept connection */</i><i><br>
</i><i>4 REDIRECT tcp -- 192.168.0.0/24
0.0.0.0/0 tcp dpt:80 /* redirect */ redir ports 3131</i><br>
<br>
Here is my squid configuration file:<br>
___________________________<br>
visible_hostname local.local<br>
always_direct allow all<br>
dns_nameservers 8.8.8.8<br>
<br>
acl step2 at_step SslBump2<br>
ssl_bump stare step2 all<br>
acl sslBumpDeniedDstDomain dstdomain ukr.net <a class="moz-txt-link-abbreviated" href="http://www.ukr.net">www.ukr.net</a><br>
ssl_bump splice sslBumpDeniedDstDomain<br>
ssl_bump bump all<br>
<br>
http_port 3128 ssl-bump generate-host-certificates=on
dynamic_cert_mem_cache_size=4MB
cert=/opt/squid/var/ssl_cert/cert.pem<br>
<br>
http_port 3131 transparent<br>
https_port 3132 transparent ssl-bump generate-host-certificates=on
dynamic_cert_mem_cache_size=4MB
cert=/opt/squid/var/ssl_cert/cert.pem<br>
<br>
http_access allow all<br>
<br>
sslcrtd_program /opt/squid/libexec/ssl_crtd -s /opt/squid/var/ssl_db
-M 4MB<br>
sslcrtd_children 15<br>
<br>
logformat logaccess [%{%d/%b/%Y %H:%M:%S}tl] %>a %Ss/%03>Hs
%<st %rm %ru %un %Sh/%<A %mt<br>
access_log daemon:/opt/squid/var/logs/access.log logaccess<br>
______________________________________________________<br>
<br>
Also, I've run squid like this <b><i>/opt/squid/sbin/squid -N -X -d
2</i></b> and got interesting strings like:<br>
<i>2014/11/26 04:28:08.622| client_side.cc(3849)
httpsSslBumpAccessCheckDone: sslBump needed for</i><i><b>
local=212.42.76.246:443</b></i><i> </i><i><b>remote=192.168.0.122:63719</b></i><i>
FD 40 flags=33 method 5</i><br>
<br>
Here, the local and remote IP addresses are switched (I checked such
lines when went through the squid directly).<br>
<br>
Please, tell me what can be wrong in configuration or squid. I can
provide you with any logs which you may need.<br>
BTW, cache.log is clean.<br>
________________<br>
Best regards<br>
</body>
</html>