<div>This was pretty interesting and informative —despite the egregious typos 😁 — thanks Amos!</div>
<div class="mailbox_signature">
<br> </div>
<br><br><div class="gmail_quote"><p>On Sat, Apr 25, 2015 at 12:25 PM, Amos Jeffries <span dir="ltr"><<a href="mailto:squid3@treenet.co.nz" target="_blank">squid3@treenet.co.nz</a>></span> wrote:<br></p><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><p>On 25/04/2015 12:50 a.m., James Lay wrote:<br>> Hey all.<br>> <br>> Topic says it....I'm running squid-3.5.3-20150420-r13802 and wanted to<br>> see if there's anything glaring that I'm missing/have misconfigured. My<br>> setup is squid is running on a router, one nic external, one nic<br>> internal. This is running as a transparent proxy with iptables doing a<br>> redirect to ports 3128 and 3129. Config below:<br>> <br>> #############################################################<br>> acl localnet src 192.168.1.0/24<br>> <br>> acl SSL_ports port 443<br>> acl Safe_ports port 80 # http<br>> acl Safe_ports port 443 # https<br>> <br>> acl CONNECT method CONNECT<br>> acl broken_sites dst 96.16.0.0/15<br>> <others redacted><br>> acl broken_sites dst 54.160.0.0/12<br>> acl allowed_sites url_regex "/opt/etc/squid/url.txt"<br>> acl all_others dst all<br><br>Using "dst all" is very inefficient. It requires Squid to perform DNS<br>lookups just to answer "yes". Unless there is some unusual reason<br>requiring that you might as well use the provided "all" ACL for faster<br>operation.<br><br><br>> acl SSL method CONNECT<br><br>This is a bit dangerous. CONNECT does not necessarily mean SSL - even<br>with the port 443 restriction. CONNECT could as easily contain a tunnel<br>to email server and be pumping spam, or literally any other type of<br>traffic to any other server. Spam emails, FTP, BitTorrent, and Skype are<br>pretty popular protocols seen with CONNECT.<br><br>So you can easily mistake security rules about SSL and create allow<br>policies that make you vulnerable to some nasty attacks.<br><br>Its also a redundant ACL definition with the default CONNECT ACL earlier.<br><br>> <br>> http_access deny !Safe_ports<br>> http_access deny CONNECT !SSL_ports<br>> <br>> http_access allow manager localhost<br>> http_access deny manager<br>> <br>> http_access allow allowed_sites<br>> http_access allow broken_sites<br>> <br>> http_access deny all_others <br><br>The above being equivalent to "deny all" makes the below rules not do<br>anything. I dont know yoru policy, maybe you did.<br><br>Consider whether that is what you expected/wanted to happen.<br><br><br>> http_access allow localnet<br>> http_access allow localhost<br>> <br>> http_access deny all<br>> icp_access deny all<br>> <br>> <br>> sslproxy_cert_error allow broken_sites<br>> sslproxy_cert_error deny all<br>> <br>> sslproxy_options ALL<br>> acl p3129 myportname 3129<br><br>This name "3129" does not match any listening port name. See below...<br><br><br>> acl step1 at_step SslBump1<br>> ssl_bump peek step1<br>> #ssl_bump splice broken_sites<br>> ssl_bump bump p3129<br>> <br>> <br>> http_port 192.168.1.253:3128 intercept <br><br>... in the absence of a name= parameter the default name for tis port is<br>"192.168.1.253:3128".<br><br>> https_port 192.168.1.253:3129 intercept ssl-bump<br>> cert=/opt/sslsplit/sslsplit.crt key=/opt/sslsplit/sslsplitca.key<br>> cafile=/opt/sslsplit/sslsplitca.pem generate-host-certificates=on<br>> dynamic_cert_mem_cache_size=4MB sslflags=NO_SESSION_REUSE<br><br>... in the absence of a name= parameter the default name for tis port is<br>"192.168.1.253:3129".<br><br>Do you see the pattern?<br> set the name= parameter eplicitly or it becomes teh *string* value of<br>the host:port field.<br><br><br>> <br>> always_direct allow all<br><br>Has no use in your config.<br><br>> <br>> logformat common %>a %[ui %[un [%tl] "%rm %ru HTTP/%rv" %>Hs %<st %Ss:%<br>> Sh %ssl::>cert_subject<br><br>Bad: do not re-define built in format definitions please.<br><br>Either use the provided format, or use a different name if you need the<br>custom one.<br><br>> <br>> access_log syslog:daemon.info common<br>> <br>> refresh_pattern ^ftp: 1440 20% 10080<br>> refresh_pattern ^gopher: 1440 0% 1440<br>> refresh_pattern -i (cgi-bin|\?) 0 0% 0<br>> refresh_pattern . 0 20% 4320<br>> <br>> icp_port 3130<br><br>You are initializing ICP port, but also configured "icp_access deny all".<br><br>To disble ICP leave remove the icp_* directives from your config.<br><br>To enable ICP, configure the icp_access to allow some sources to make<br>queries.<br><br>> <br>> coredump_dir /opt/var<br>> #############################################################<br>> <br>> My goal has been to at least get the domain logged on any https access,<br>> but alas some sites show:<br>> <br>> Apr 24 06:39:32 gateway (squid-1): 192.168.1.101 - -<br>> [24/Apr/2015:06:39:32 -0600] "CONNECT 216.58.216.162:443 HTTP/1.1" 200<br>> 401 TCP_TUNNEL:ORIGINAL_DST -<br>> <br><br>With interception + your custom rule using %ru you should always see<br>raw-IP:port. If you see a TLS SNI domain in there *that* is a bug. "%ru"<br>is explicitly asking for the client-presented CONNECT *URL*, not the<br>server details.<br><br><br>That "TCP_TUNNEL" will always happen whenever the protocol found on port<br>443 is not HTTPS.<br><br>Amos<br>_______________________________________________<br>squid-users mailing list<br>squid-users@lists.squid-cache.org<br>http://lists.squid-cache.org/listinfo/squid-users<br></p></blockquote></div><br>