<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/4.6.6">
</HEAD>
<BODY>
On Sat, 2015-04-25 at 14:25 +1200, Amos Jeffries wrote:
<BLOCKQUOTE TYPE=CITE>
<PRE>
On 25/04/2015 12:50 a.m., James Lay wrote:
<FONT COLOR="#737373">> Hey all.</FONT>
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> Topic says it....I'm running squid-3.5.3-20150420-r13802 and wanted to</FONT>
<FONT COLOR="#737373">> see if there's anything glaring that I'm missing/have misconfigured. My</FONT>
<FONT COLOR="#737373">> setup is squid is running on a router, one nic external, one nic</FONT>
<FONT COLOR="#737373">> internal. This is running as a transparent proxy with iptables doing a</FONT>
<FONT COLOR="#737373">> redirect to ports 3128 and 3129. Config below:</FONT>
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> #############################################################</FONT>
<FONT COLOR="#737373">> acl localnet src 192.168.1.0/24</FONT>
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> acl SSL_ports port 443</FONT>
<FONT COLOR="#737373">> acl Safe_ports port 80 # http</FONT>
<FONT COLOR="#737373">> acl Safe_ports port 443 # https</FONT>
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> acl CONNECT method CONNECT</FONT>
<FONT COLOR="#737373">> acl broken_sites dst 96.16.0.0/15</FONT>
<FONT COLOR="#737373">> <others redacted></FONT>
<FONT COLOR="#737373">> acl broken_sites dst 54.160.0.0/12</FONT>
<FONT COLOR="#737373">> acl allowed_sites url_regex "/opt/etc/squid/url.txt"</FONT>
<FONT COLOR="#737373">> acl all_others dst all</FONT>
Using "dst all" is very inefficient. It requires Squid to perform DNS
lookups just to answer "yes". Unless there is some unusual reason
requiring that you might as well use the provided "all" ACL for faster
operation.
<FONT COLOR="#737373">> acl SSL method CONNECT</FONT>
This is a bit dangerous. CONNECT does not necessarily mean SSL - even
with the port 443 restriction. CONNECT could as easily contain a tunnel
to email server and be pumping spam, or literally any other type of
traffic to any other server. Spam emails, FTP, BitTorrent, and Skype are
pretty popular protocols seen with CONNECT.
So you can easily mistake security rules about SSL and create allow
policies that make you vulnerable to some nasty attacks.
Its also a redundant ACL definition with the default CONNECT ACL earlier.
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> http_access deny !Safe_ports</FONT>
<FONT COLOR="#737373">> http_access deny CONNECT !SSL_ports</FONT>
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> http_access allow manager localhost</FONT>
<FONT COLOR="#737373">> http_access deny manager</FONT>
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> http_access allow allowed_sites</FONT>
<FONT COLOR="#737373">> http_access allow broken_sites</FONT>
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> http_access deny all_others </FONT>
The above being equivalent to "deny all" makes the below rules not do
anything. I dont know yoru policy, maybe you did.
Consider whether that is what you expected/wanted to happen.
<FONT COLOR="#737373">> http_access allow localnet</FONT>
<FONT COLOR="#737373">> http_access allow localhost</FONT>
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> http_access deny all</FONT>
<FONT COLOR="#737373">> icp_access deny all</FONT>
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> sslproxy_cert_error allow broken_sites</FONT>
<FONT COLOR="#737373">> sslproxy_cert_error deny all</FONT>
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> sslproxy_options ALL</FONT>
<FONT COLOR="#737373">> acl p3129 myportname 3129</FONT>
This name "3129" does not match any listening port name. See below...
<FONT COLOR="#737373">> acl step1 at_step SslBump1</FONT>
<FONT COLOR="#737373">> ssl_bump peek step1</FONT>
<FONT COLOR="#737373">> #ssl_bump splice broken_sites</FONT>
<FONT COLOR="#737373">> ssl_bump bump p3129</FONT>
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> http_port 192.168.1.253:3128 intercept </FONT>
... in the absence of a name= parameter the default name for tis port is
"192.168.1.253:3128".
<FONT COLOR="#737373">> https_port 192.168.1.253:3129 intercept ssl-bump</FONT>
<FONT COLOR="#737373">> cert=/opt/sslsplit/sslsplit.crt key=/opt/sslsplit/sslsplitca.key</FONT>
<FONT COLOR="#737373">> cafile=/opt/sslsplit/sslsplitca.pem generate-host-certificates=on</FONT>
<FONT COLOR="#737373">> dynamic_cert_mem_cache_size=4MB sslflags=NO_SESSION_REUSE</FONT>
... in the absence of a name= parameter the default name for tis port is
"192.168.1.253:3129".
Do you see the pattern?
set the name= parameter eplicitly or it becomes teh *string* value of
the host:port field.
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> always_direct allow all</FONT>
Has no use in your config.
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> logformat common %>a %[ui %[un [%tl] "%rm %ru HTTP/%rv" %>Hs %<st %Ss:%</FONT>
<FONT COLOR="#737373">> Sh %ssl::>cert_subject</FONT>
Bad: do not re-define built in format definitions please.
Either use the provided format, or use a different name if you need the
custom one.
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> access_log syslog:daemon.info common</FONT>
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> refresh_pattern ^ftp: 1440 20% 10080</FONT>
<FONT COLOR="#737373">> refresh_pattern ^gopher: 1440 0% 1440</FONT>
<FONT COLOR="#737373">> refresh_pattern -i (cgi-bin|\?) 0 0% 0</FONT>
<FONT COLOR="#737373">> refresh_pattern . 0 20% 4320</FONT>
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> icp_port 3130</FONT>
You are initializing ICP port, but also configured "icp_access deny all".
To disble ICP leave remove the icp_* directives from your config.
To enable ICP, configure the icp_access to allow some sources to make
queries.
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> coredump_dir /opt/var</FONT>
<FONT COLOR="#737373">> #############################################################</FONT>
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> My goal has been to at least get the domain logged on any https access,</FONT>
<FONT COLOR="#737373">> but alas some sites show:</FONT>
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> Apr 24 06:39:32 gateway (squid-1): 192.168.1.101 - -</FONT>
<FONT COLOR="#737373">> [24/Apr/2015:06:39:32 -0600] "CONNECT 216.58.216.162:443 HTTP/1.1" 200</FONT>
<FONT COLOR="#737373">> 401 TCP_TUNNEL:ORIGINAL_DST -</FONT>
<FONT COLOR="#737373">> </FONT>
With interception + your custom rule using %ru you should always see
raw-IP:port. If you see a TLS SNI domain in there *that* is a bug. "%ru"
is explicitly asking for the client-presented CONNECT *URL*, not the
server details.
That "TCP_TUNNEL" will always happen whenever the protocol found on port
443 is not HTTPS.
Amos
_______________________________________________
squid-users mailing list
<A HREF="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</A>
<A HREF="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</A>
</PRE>
</BLOCKQUOTE>
<BR>
Thank you Amos...that's extremely helpful.<BR>
<BR>
James
</BODY>
</HTML>