<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Apr 4, 2016 at 6:23 PM, Amos Jeffries <span dir="ltr"><<a href="mailto:squid3@treenet.co.nz" target="_blank">squid3@treenet.co.nz</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div class=""><div class="h5">>>><br>
>>> If i remove *all* the http_access lines, then the behavior appears<br>
>> correct<br>
>>> (from a "splicing/bumping" standpoint).<br>
>>><br>
>><br>
>> Strange. Squid without any http_access lines should be denying traffic<br>
>> 100%.<br>
>><br>
>><br>
> I do not see this behavior. Traffic appears to be allowed, and bumped<br>
> (though with the wrong certificate, depending on the config, as explained<br>
> before).<br>
><br>
><br></div></div></blockquote><div><br></div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div class=""><div class="h5">><br>
> my apologies for trying to show only the relevant parts. Find below the<br>
> current config.<br>
> It appears to be bumping everything rather than splicing any of the config<br>
> (which may be due to the limitations documented on the wiki)<br>
><br>
> acl Safe_ports port 80 # http<br>
> acl Safe_ports port 443 # https<br>
> acl SSL_ports port 443<br>
> acl CONNECT method CONNECT<br>
> http_port 3129 intercept<br>
> https_port 8443 intercept ssl-bump generate-host-certificates=on<br>
> dynamic_cert_mem_cache_size=64MB \<br>
> cert=/etc/squid/ssl/proxy.pem \<br>
> key=/etc/squid/ssl/proxy.key \<br>
> cafile=/etc/squid/ssl/proxy.pem<br>
> always_direct allow all<br>
<br>
</div></div>always_direct has not been necessary with SSL-Bump sice 3.1 series. You<br>
should remove it.<br>
<span class=""><br>
> acl step1 at_step SslBump1<br>
> acl step2 at_step SslBump2<br>
> acl step3 at_step SslBump3<br>
> acl SniBypass ssl::server_name_regex \.slashdot\.org<br>
> acl SniBypass ssl::server_name_regex \.fsdn\.com<br></span></blockquote><div><br></div><div>I have moved those "SniBypass" acl into a separate files and replaced this with an include, as that list will end up growing. </div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><span class="">
> acl http_bypass dstdomain .<a href="http://slashdot.org" rel="noreferrer" target="_blank">slashdot.org</a><br>
> acl http_bypass dstdomain .<a href="http://fsdn.com" rel="noreferrer" target="_blank">fsdn.com</a></span></blockquote><div><br></div><div>and similarly here, replaced by an include...</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><span class=""><br>
> acl https_bypass all-of CONNECT SniBypass<br>
<br>
</span>This https_bypass ACL definition is a bit weird. It requires a single<br>
message to match both TLS and HTTP properties simultaneously.</blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<br>
As you might imagine it is difficult for a TLS messages to match HTTP<br>
properties, and vice versa. So it wont ever match.<br>
<br></blockquote><div><br></div><div><div>I don't understand. SniBypass is based on ssl::server_name_regex which shouldn't apply to http at all... </div><div>Would that not be coming from the (client|server)Hello?</div></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
Note: SNI is *not* equivalent to Host or URL domain name. They can<br>
contain very different values. The only thing they have in common is<br>
that they both are supposed to point at the IP of the server being<br>
contacted.<br>
<span class=""><br>
<br>
> acl http_ok all-of http_bypass Safe_ports<br>
> ssl_bump peek step1<br>
> ssl_bump splice SniBypass step2<br>
<br>
</span>This splice will work if (and only if) the client sends TLS SNI values<br>
to Squid. It will ignore the server cert details.<br>
<br>
For clients which do not send SNI or for all connections where the SNI<br>
does not match your ACL the bump rule below will do client-first bumping<br>
(without the server cert).<br>
<br>
> ssl_bump bump all<br>
<br>
I suggets you try these ssl_bump rules instead:<br>[snip]</blockquote><div> OK</div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">[snip]<br>
Okay. That sort of matches your policy. Except that you are missing the<br>
security defaults. Those lines are carefully tuned for the specific<br>
behaviour to protect against security attacks:<br>
<br>
http_access deny !Safe_ports<br>
http_access deny CONNECT !SSL_ports<br>
<br>
.. and should be above your custom rules.<br></blockquote><div><br></div><div>I added those at the top as requested...</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><span class="">
cache allow all<br>
cache deny all<br>
<br>
</span>... pick one.<br>
<br></blockquote><div><br></div><div>done - the deny one is the one left in there now. </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<br>
> shutdown_lifetime 3 seconds<br></blockquote><div><br></div><div>for clarification, I also moved the two sets of ACLs into separate files, as those will eventually be maintained externally (SniBypass and http_bypass).</div><div><br></div><div>The config file is now:</div><div><br></div><div><div>acl SSL_ports port 443</div><div>acl Safe_ports port 80<span class="" style="white-space:pre"> </span># http</div><div>acl Safe_ports port 21<span class="" style="white-space:pre"> </span># ftp</div><div>acl Safe_ports port 443<span class="" style="white-space:pre"> </span># https</div><div>acl Safe_ports port 70<span class="" style="white-space:pre"> </span># gopher</div><div>acl Safe_ports port 210<span class="" style="white-space:pre"> </span># wais</div><div>acl Safe_ports port 1025-65535<span class="" style="white-space:pre"> </span># unregistered ports</div><div>acl Safe_ports port 280<span class="" style="white-space:pre"> </span># http-mgmt</div><div>acl Safe_ports port 488<span class="" style="white-space:pre"> </span># gss-http</div><div>acl Safe_ports port 591<span class="" style="white-space:pre"> </span># filemaker</div><div>acl Safe_ports port 777<span class="" style="white-space:pre"> </span># multiling http</div><div>acl CONNECT method CONNECT</div><div>http_access deny !Safe_ports</div><div>http_access deny CONNECT !SSL_ports</div><div>http_port 3128</div><div>http_port 3129 intercept</div><div>https_port 8443 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=64MB \</div><div> cert=/etc/squid/ssl/proxy.pem \</div><div> key=/etc/squid/ssl/proxy.key \</div><div> cafile=/etc/squid/ssl/proxy.pem</div><div>workers 6</div><div>always_direct allow all</div><div>acl step1 at_step SslBump1</div><div>acl step2 at_step SslBump2</div><div>acl step3 at_step SslBump3</div><div>include "/etc/squid/snibypass.acl"</div><div>include "/etc/squid/dstbypass.acl"</div><div>acl https_ok all-of CONNECT SniBypass</div><div>acl http_ok all-of http_bypass Safe_ports</div><div>ssl_bump splice SniBypass</div><div>ssl_bump peek step1</div><div>ssl_bump stare step2</div><div>ssl_bump bump all</div><div>sslproxy_options NO_SSLv2,NO_SSLv3,SINGLE_ECDH_USE</div><div>sslproxy_cert_sign_hash sha256</div><div>sslcrtd_program /usr/lib/squid/ssl_crtd -s /var/lib/ssl_db -M 4MB</div><div>sslcrtd_children 8 startup=1 idle=1</div><div>http_access allow http_ok</div><div>http_access allow https_ok</div><div>http_access deny all</div><div>cache deny all</div><div>shutdown_lifetime 3 seconds</div></div><div><br></div><div>Note that with that config, the http_access deny all (couple lines before the end) appears to deny the TLS/SSL connection before the ssl_bump steps have a chance to match, so i get certs that are not mimic'ed (they have CN=<ip>). If i remove all 3 http_access at the end, then the splicing/bumping behavior appears to work as expected, but then i'm not denying anything...</div><div><br></div><div>that seems to confirm my suspicion that the access control (http_access) apply too early for me to match anything related to the ssl::server_name or ssl::server_name_regex.</div><div><br></div><div>I keep thinking that what i'm missing is that the http_access applies too early. I played with "terminate" instead of "bump" at the last ssl_bump command, but i really need the error message. I keep wanting to have something like this:</div><div><br></div><div><div>ssl_bump splice SniBypass</div><div>ssl_bump peek step1</div><div>ssl_bump stare step2</div><div>ssl_bump deny all</div></div><div><br></div><div>where the last one would effectively bump the connection, and provide the ERR_ACCESS_DENIED page.</div><div><br></div><div>Thank you so much for your help.</div><div>Jok</div></div></div></div>