<div dir="ltr">Wasn't somebody saying that you'd need write an External ACL to evaluate the SNI host because dstdomain isn't hooked into that code (yet? ever?)?</div><div class="gmail_extra"><br><div class="gmail_quote">On 27 January 2015 at 08:33, Jason Haar <span dir="ltr"><<a href="mailto:Jason_Haar@trimble.com" target="_blank">Jason_Haar@trimble.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF">
<span style="white-space:pre-wrap"> </span><br>
Well the documentation says<br>
<br>
# SslBump1: After getting TCP-level and HTTP CONNECT info.<br>
# SslBump2: After getting SSL Client Hello info.<br>
# SslBump3: After getting SSL Server Hello info.<br>
<br>
<br>
So that means SslBump1 only works for direct proxy (ie CONNECT)
sessions, it's SslBump2 that peeks into the traffic to discover the
client SNI hostname. So I think you actually need (I'll use more
descriptive acl names and comment out those that I think don't add
any value)<br>
<br>
acl domains_nobump dstdomain "/etc/squid/domains_nobump.acl"<br>
#no added value: acl DiscoverCONNECTHost at_step SslBump1<br>
acl DiscoverSNIHost at_step SslBump2<br>
#don't use - breaks bump: acl DiscoverServerHost at_step SslBump3<br>
#no added value - in fact forces peek for some reason: ssl_bump peek
DiscoverCONNECTHost all<br>
ssl_bump peek DiscoverSNIHost all<br>
<br>
ssl_bump splice domains_nobump<br>
#DiscoverSNIHost should now mean Squid knows about all the SNI
details<br>
ssl_bump bump all<br>
<br>
Sadly, this doesn't work for me *in transparent mode*. Works fine
when using squid as a formal proxy, but when used via https_port
intercept, we end up with IP address certs instead of SNI certs.<br>
<br>
We really need someone who knows more to tell us how to make this
work :-(<span class="HOEnZb"><font color="#888888"><br>
<br>
<br>
-- <br>
Cheers<br>
<br>
Jason Haar<br>
Corporate Information Security Manager, Trimble Navigation Ltd.<br>
Phone: <a href="tel:%2B1%20408%20481%208171" value="+14084818171" target="_blank">+1 408 481 8171</a><br>
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1<br>
<br>
</font></span></div>
<br>_______________________________________________<br>
squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br>
<br></blockquote></div><br></div>