<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/4.6.6">
</HEAD>
<BODY>
On Tue, 2015-06-09 at 21:39 +0200, Klavs Klavsen wrote:
<BLOCKQUOTE TYPE=CITE>
<PRE>
Amos Jeffries wrote on 2015-06-09 17:10:
[CUT]
<FONT COLOR="#737373">> You have to first configure ssl_bump in a way that lets Squid receive</FONT>
<FONT COLOR="#737373">> the clientHello message (step1 -> peek) AND the serverHello message</FONT>
<FONT COLOR="#737373">> (step2 -> peek). Then you can use those cert details to bump (step3 -></FONT>
<FONT COLOR="#737373">> bump).</FONT>
<FONT COLOR="#737373">> The config is quite simple:</FONT>
<FONT COLOR="#737373">> ssl_bump peek all</FONT>
<FONT COLOR="#737373">> ssl_bump bump all</FONT>
<FONT COLOR="#737373">> </FONT>
I have this:
ssl_bump peek step1 broken
ssl_bump peek step2 broken
ssl_bump splice broken
ssl_bump peek step1 all
ssl_bump peek step2 all
ssl_bump bump all
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> But there are cases like the client is resuming a previous TLS session</FONT>
<FONT COLOR="#737373">> where there is no certificates involved. Squid cannot do anything, so it</FONT>
<FONT COLOR="#737373">> automatically splices (3.5.4+ at least do). Or if you have configured</FONT>
<FONT COLOR="#737373">> your Squid in a way that there are no mutually supported ciphers.</FONT>
<FONT COLOR="#737373">> </FONT>
My client is curl.. I don't think that its caching any TLS sessions.
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> It may just be your ssl_bump rules. But given that this is a google</FONT>
<FONT COLOR="#737373">> domain there is a strong chance that you are encountering one of those</FONT>
<FONT COLOR="#737373">> special case.</FONT>
<FONT COLOR="#737373">></FONT>
I'd like squid to disallow queries where it cannot see what domain name
/ url is going to be accessed.
I'd like all GET/POST etc. requests to go through squid - so they are
controlled by the normal http_access rules as http (intercepted) is
currently.
This worked with 3.4.12 :( (but only for 30 minutes or less)
You saw my full config.. how is it supposed to look with 3.5.5, for this
to work as it did with 3.4.12 ?
sorry I'm a bit frustrated.. I can't seem to grasp what changed from
3.4.12 to 3.5.5, which means I suddenly can't filter https traffic
anymore :(
</PRE>
</BLOCKQUOTE>
<BR>
Gents,<BR>
<BR>
I'm going to spin this off into a new thread..."Filtering http and https traffic" sometime later today. I have some questions, and maybe solutions.<BR>
<BR>
James
</BODY>
</HTML>