<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<br>
-----BEGIN PGP SIGNED MESSAGE----- <br>
Hash: SHA256 <br>
<br>
I use 3.4 version. Yes, this is old directives.<br>
<br>
3.5.x, on my opinion, don't do SSL Bump in NAT transparent
interception environment.<br>
<br>
06.07.15 20:21, adam900710 пишет:<br>
<span style="white-space: pre;">> 2015-07-06 22:05 GMT+08:00 Yuri
Voinov <a class="moz-txt-link-rfc2396E" href="mailto:yvoinov@gmail.com"><yvoinov@gmail.com></a>:<br>
>><br>
> My own solution in conjunction with Tor + Privoxy looks like
this (Note:<br>
> for Squid 3.4.13):<br>
><br>
> # Tor acl<br>
> acl tor_url url_regex -i "/usr/local/squid/etc/url.tor"<br>
><br>
> # SSL bump rules<br>
> sslproxy_cert_error allow all<br>
> ssl_bump none localhost<br>
> ssl_bump none url_nobump<br>
> ssl_bump none dst_nobump<br>
> ssl_bump server-first net_bump<br>
> > This seems to be old config directive.<br>
> > New corresponding one shoud be "ssl_bump bump net_bump"<br>
><br>
> > And, no "peek" one? Or that's the problem?<br>
><br>
> > Thanks.<br>
><br>
> # Privoxy+Tor access rules<br>
> never_direct allow tor_url<br>
> always_direct deny tor_url<br>
> always_direct allow all<br>
><br>
> # And finally deny all other access to this proxy<br>
> http_access deny all<br>
><br>
> # Local Privoxy is cache parent<br>
> cache_peer 127.0.0.1 parent 8118 0 no-query no-digest default<br>
><br>
> cache_peer_access 127.0.0.1 allow tor_url<br>
> cache_peer_access 127.0.0.1 deny all<br>
><br>
> http_port 3127<br>
> http_port 3128 intercept<br>
> https_port 3129 intercept ssl-bump
generate-host-certificates=on<br>
> dynamic_cert_mem_cache_size=4MB
cert=/usr/local/squid/etc/rootCA.crt<br>
> key=/usr/local/squid/etc/rootCA.key<br>
> > I also tried such config.<br>
> > With such "http_port" and "http_port intercept" with
ssl-bump at last.<br>
> > Although curl works under test, the certificate is not
the fake one.<br>
> > (Issuer is not my fake one)<br>
> > So I consider the ssl-bump not working in that case.<br>
><br>
> > I'd like to reply when I set it up later to test.<br>
><br>
> > Thanks<br>
><br>
> sslproxy_capath /etc/opt/csw/ssl/certs<br>
> sslproxy_options NO_SSLv2 NO_SSLv3<br>
> sslcrtd_program /usr/local/squid/libexec/ssl_crtd -s
/var/lib/ssl_db -M 4MB<br>
><br>
> Generally,<br>
><br>
> works like charm.<br>
><br>
> 06.07.15 15:22, adam900710 пишет:<br>
> >>> Hi all,<br>
> >>><br>
> >>> I tried to build a ssl bumping proxy with up
level proxy, but client<br>
> >>> failed to connect like the following.<br>
> >>><br>
> >>> The error:<br>
> >>> ---<br>
> >>> $ curl <a class="moz-txt-link-freetext" href="https://www.google.co.jp">https://www.google.co.jp</a> -vvvv -k<br>
> >>> * Rebuilt URL to: <a class="moz-txt-link-freetext" href="https://www.google.co.jp/">https://www.google.co.jp/</a><br>
> >>> * Trying ::1...<br>
> >>> * Connected to localhost (::1) port 3128 (#0)<br>
> >>> * Establish HTTP proxy tunnel to
<a class="moz-txt-link-abbreviated" href="http://www.google.co.jp:443">www.google.co.jp:443</a><br>
> >>>> CONNECT <a class="moz-txt-link-abbreviated" href="http://www.google.co.jp:443">www.google.co.jp:443</a> HTTP/1.1<br>
> >>>> Host: <a class="moz-txt-link-abbreviated" href="http://www.google.co.jp:443">www.google.co.jp:443</a><br>
> >>>> User-Agent: curl/7.43.0<br>
> >>>> Proxy-Connection: Keep-Alive<br>
> >>>><br>
> >>> < HTTP/1.1 200 Connection established<br>
> >>> <<br>
> >>> * Proxy replied OK to CONNECT request<br>
> >>> * ALPN, offering http/1.1<br>
> >>> * Cipher selection:<br>
> ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH<br>
> >>> * successfully set certificate verify locations:<br>
> >>> * CAfile: /etc/ssl/certs/ca-certificates.crt<br>
> >>> CApath: none<br>
> >>> * TLSv1.2 (OUT), TLS header, Certificate Status
(22):<br>
> >>> * TLSv1.2 (OUT), TLS handshake, Client hello
(1):<br>
> >>> * Unknown SSL protocol error in connection to
<a class="moz-txt-link-abbreviated" href="http://www.google.co.jp:443">www.google.co.jp:443</a><br>
> >>> * Closing connection 0<br>
> >>> curl: (35) Unknown SSL protocol error in
connection to<br>
> <a class="moz-txt-link-abbreviated" href="http://www.google.co.jp:443">www.google.co.jp:443</a><br>
> >>> ---<br>
> >>><br>
> >>> My squid.conf:<br>
> >>> ---<br>
> >>> # default acls/configs are ignored<br>
> >>> cache_peer 127.0.0.1 parent 8118 0 default
no-digest proxy-only<br>
> >>> never_direct allow all<br>
> >>> ssl_bump peek all<br>
> >>> ssl_bump bump all<br>
> >>> http_port 3128 ssl-bump \<br>
> >>> cert=/etc/squid/ssl/ca.crt \<br>
> >>> key=/etc/squid/ssl/ca.key \<br>
> >>> generate-host-certificates=on \<br>
> >>> dynamic_cert_mem_cache_size=4MB<br>
> >>> ---<br>
> >>><br>
> >>> From the cache_peer port, someone may notice
that I'm using privoxy.<br>
> >>> That's right, as I need to redirect the ssl
traffic to SOCKS5 proxy,<br>
> >>> or I can't ever access some sites.<br>
> >>><br>
> >>> Here is some of my experiments:<br>
> >>> 1) Remove "never_direct"<br>
> >>> Then ssl_bump works as expected, but all traffic
doesn't goes through<br>
> >>> the SOCKS5 proxy. So a lot of sites I can't
access.<br>
> >>><br>
> >>> 2) Use local 8118 proxy<br>
> >>> That works fine without any problem, but
SSL_dump is needed...<br>
> >>> So just prove privoxy are working.<br>
> >>><br>
> >>> Any clue?<br>
> >>><br>
> >>> Thanks<br>
> >>> _______________________________________________<br>
> >>> squid-users mailing list<br>
> >>> <a class="moz-txt-link-abbreviated" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
> >>>
<a class="moz-txt-link-freetext" href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a><br>
><br>
>></span><br>
<br>
-----BEGIN PGP SIGNATURE-----
<br>
Version: GnuPG v2
<br>
<br>
iQEcBAEBCAAGBQJVmo9ZAAoJENNXIZxhPexGjzsIALCunLEQOJGKkcm0V0wr3QTQ
<br>
xdfkLvJTh9i5sJNaMGbfuE2SCYIERf7HOTu9vNFpFwZBZoQTiMqud1v8KQkzGXTC
<br>
xXCjlLAu937DJ+cJoeWNw+wacCB5wBFp4GoonoF3zf2HdIu76u5BQn2WeFZEfnN0
<br>
G1WNMh2j7BlCOgRzI7cPnFZPzomcwlCRm7VqfgmadBMU9NpP3w+iVlngGTbt0WOu
<br>
Apf6ktZpumfvu68hu0I1Vtn746Dz/U+mmU8Ue+FBga5wyYW6JSMMAQOdsZTeXLnh
<br>
Iyu56A47ouNkugcueeuLOXbVlE9N44KpBc96QkXdOvKyx+VemRzaCrMYlvaFO1U=
<br>
=Mt1T
<br>
-----END PGP SIGNATURE-----
<br>
<br>
</body>
</html>