<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/4.6.6">
</HEAD>
<BODY>
On Sun, 2016-04-03 at 21:18 -0700, Jok Thuau wrote:
<BLOCKQUOTE TYPE=CITE>
I'm attempting to build a transparent proxy (policy based routing on firewall to squid proxy) with the following behavior:
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
1) proxies http traffic for a given set of domains, provide an message otherwise such "domain not allowed" or similar
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
2) proxies https traffic for a given set of domains (ideally, splicing those, so as not to break HSTS, if enabled), otherwise provide an error message (bumping and providing "domain not allowed")
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
I'm attempting this with a 3.5.15 compiled with icap (not yet used) and ssl-bumping.
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
Part 1 seems easy enough (and is well documented)...
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
acl whitelist dstdomain .domain1.tld<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
acl whitelist dstdomain .domain2.tld
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
acl http_ok all-of whitelist !SSL_ports
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
http_access allow http_ok
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
http_access deny all
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
Moving onto Part 2 (the peek and splice setup) appears to be the topic of a few discussions out there...
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
acl sni_whitelist ssl::server_name .domain1.tld
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
acl sni_whitelist ssl::server_name .domain2.tld
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
ssl_bump peek step1
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
ssl_bump splice sni_whitelist
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
ssl_bump bump all
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
It appears however that when combining the two, the generated certificate(s), instead of mimic'ing the original server's certificate comes out with the CN=<IP> where <IP> is the ip used by the "connect" part of the connection. In addition, it appears that only the first entry ever matches (at this point, i've tried so many combinations, i'm no longer certain of anything).
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
If i remove *all* the http_access lines, then the behavior appears correct (from a "splicing/bumping" standpoint).
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
Can anyone confirm that this is indeed possible to achieve?
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
I believe, based on experimentation that any http_access i have, because of the "deny all" cause the bumping to "short circuit" and effectively send an early "access denied" based on the only information it has (the ip address from the "connect", rather than the SNI that would come later).
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
Would a setup where "deny http+!whitelist" so have the allow be the default allow for the bumping to work and get to step2 and match the sni* acls somehow? (with a "deny step2 !sni_whitelist").
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
Is 3.5.15 capable of doing this? If this requires some feature/effort, what would be the procedure to sponsor that work?
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
Thanks,
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
Jok
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<PRE>
_______________________________________________
squid-users mailing list
<A HREF="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</A>
<A HREF="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</A>
</PRE>
</BLOCKQUOTE>
<BR>
This may assist:<BR>
<BR>
<A HREF="http://article.gmane.org/gmane.comp.web.squid.general/114389">http://article.gmane.org/gmane.comp.web.squid.general/114389</A><BR>
<BR>
James
</BODY>
</HTML>