<div dir="ltr"><div class="gmail_quote"><pre class="" id="comment_text_2" style="white-space:pre-wrap;width:50em;color:rgb(0,0,0)">Also this issue is no more appearing if I peek step 1 alone and splice the remaining ones.
acl step1 at_step SslBump1
acl step2 at_step SslBump2
acl step3 at_step SslBump3
ssl_bump peek step1 all
ssl_bump splice all
So I guess the issue is with the PeerConnector module where SSL_connect method is being used to connect and parse the server certificate.</pre><pre class="" id="comment_text_2" style="white-space:pre-wrap;width:50em;color:rgb(0,0,0)"><br></pre><pre class="" id="comment_text_2" style="white-space:pre-wrap;width:50em;color:rgb(0,0,0)">I had added this as a bug as well.</pre><pre class="" id="comment_text_2" style="white-space:pre-wrap;width:50em;color:rgb(0,0,0)"><a href="http://bugs.squid-cache.org/show_bug.cgi?id=4202">http://bugs.squid-cache.org/show_bug.cgi?id=4202</a></pre><pre class="" id="comment_text_2" style="white-space:pre-wrap;width:50em;color:rgb(0,0,0)">Regards,
John</pre>
<div lang="EN-US" link="#0563C1" vlink="#954F72">
<div>
<p class="MsoNormal"><span style="color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125)"><u></u> <u></u></span></p>
<div>
<div style="border-style:solid none none;border-top-color:rgb(225,225,225);border-top-width:1pt;padding:3pt 0in 0in">
<p class="MsoNormal"><b>From:</b> John Killimangalam Jacob <br>
<b>Sent:</b> Monday, February 16, 2015 11:25 AM<br>
<b>To:</b> '<a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a>'<br>
<b>Subject:</b> Error when using peek/splice/terminate with Squid 3.5.1<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125)">Hi All,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125)">I am trying to configure an intercept proxy with peek/splice/terminate features in Squid 3.5.1 on CentOS 7 - 64 bit. I wanted to peak at steps 1 and step 2 and to decide on terminate on step 3 based on the SNI
and server certificate values. It is working only for <a href="https://www.google.com" target="_blank">
https://www.google.com</a>, but lot of other ssl sites (likes of <a href="https://www.yahoo.com" target="_blank">
https://www.yahoo.com</a> etc) are not getting loaded logging an “ <i>Error negotiating SSL on FD 36: error:140920E3:SSL routines:SSL3_GET_SERVER_HELLO:parse tlsext </i>“
<i> </i>in the cache.log (trying the same sites using openssl s_client command works). I was wondering if it has to do anything with my config or open ssl (version 1.0.1e) or anything else. The web sites are being accessed from a windows 7 workstation with
IE 8 and Firefox 35.0.1 . Below is the squid.config section for peek and splice I am using.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><i><span style="color:rgb(31,73,125)">acl step1 at_step SslBump1<u></u><u></u></span></i></p>
<p class="MsoNormal"><i><span style="color:rgb(31,73,125)">acl step2 at_step SslBump2<u></u><u></u></span></i></p>
<p class="MsoNormal"><i><span style="color:rgb(31,73,125)">acl step3 at_step SslBump3<u></u><u></u></span></i></p>
<p class="MsoNormal"><i><span style="color:rgb(31,73,125)"><u></u> <u></u></span></i></p>
<p style="margin:0in 0in 0.0001pt"><i><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">external_acl_type SSL_URL_Filter %SRC %ssl::>sni %ssl::<cert_subject </path/to/urlfilterscript><u></u><u></u></span></i></p>
<p style="margin:0in 0in 0.0001pt"><i><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">acl URL_Allowed external SSL_URL_Filter<u></u><u></u></span></i></p>
<p class="MsoNormal"><i><span style="color:rgb(31,73,125)"><u></u> <u></u></span></i></p>
<p style="margin:0in 0in 0.0001pt"><i><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">ssl_bump peek step1 all<u></u><u></u></span></i></p>
<p style="margin:0in 0in 0.0001pt"><i><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">ssl_bump peek step2 all <u></u><u></u></span></i></p>
<p style="margin:0in 0in 0.0001pt"><i><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">ssl_bump terminate step3 !URL_Allowed<u></u><u></u></span></i></p>
<p style="margin:0in 0in 0.0001pt"><i><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">ssl_bump splice step3 all<u></u><u></u></span></i></p>
<p class="MsoNormal"><i><span style="color:rgb(31,73,125)"><u></u> <u></u></span></i></p>
<p class="MsoNormal"><i><span style="color:rgb(31,73,125)"># Squid normally listens to port 3128<u></u><u></u></span></i></p>
<p class="MsoNormal"><i><span style="color:rgb(31,73,125)">http_port 3128<u></u><u></u></span></i></p>
<p class="MsoNormal"><i><span style="color:rgb(31,73,125)">http_port 3129 intercept<u></u><u></u></span></i></p>
<p class="MsoNormal"><i><span style="color:rgb(31,73,125)">https_port 3130 intercept ssl-bump cert=/tmp/sslcertificates/server.cert.pem key=/tmp/sslcertificates/server.key.pem<u></u><u></u></span></i></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125)">Thanks in Advance,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125)">John</span></p></div></div></div></div>