<div dir="ltr">Hi<div><br>Replying to the list</div><div><br></div><div>Yes i get that error on many different sites same exact error about host headers.</div><div>Also if you watch the TTL on the amazonaws url i provided it changes from 3 to 5 to 10 seconds to 60 to 10 back and forth.<br>If you go online to an dns lookup site like kloth i see via kloth 5 seconds TTL</div><div><br></div><div>i get a different TTL value at different times, it appears they dont have a set TTL but they change it often and it varies.</div><div>Right now it appears to be a ttl of 60 seconds as you found but earlier and over the weekend it has shown 5 seconds and even AWS support verified it can vary as low as 5 seconds.</div><div>That being said , when it is changing every 3-5 seconds which comes and goes , squid gives the header forgery errors as shown before.</div><div><br></div><div><br></div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Oct 18, 2016 at 12:30 PM, <span dir="ltr"><<a href="mailto:garryd@comnet.uz" target="_blank">garryd@comnet.uz</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On 2016-10-18 18:32, John Wright wrote:<br>
</span><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">
Hi,<br>
<br>
I have a constant problem with Host header forgery detection on squid<br>
doing peek and splice.<br>
<br>
I see this most commonly with CDN, Amazon and microsoft due to the<br>
fact there TTL is only 5 seconds on certain dns entries im connecting<br>
to. So when my client connects through my squid i get host header<br>
issues due to the contstant dns changes at these destinations.<br>
<br>
I have ready many things online but how do i get around this. I<br>
basically want to allow certain domains or ip subnets to not hit the<br>
host header error (as things break at this point for me ).<br>
<br>
Any ideas ?<br>
<br>
One example is<br>
<br>
</span><a href="http://sls.update.microsoft.com" rel="noreferrer" target="_blank">sls.update.microsoft.com</a> [1]<span class=""><br>
<br>
Yes my client and Squid use same DNS server, i have even setup my<br>
squid as a bind server and tried that just for fun same issue. Fact<br>
is the DNS at these places changes so fast (5 seconds) the dns<br>
response keeps changing/<br>
<br>
I just need these approved destinations to make it through<br>
<br>
<br>
<br></span>
Links:<br>
------<br>
[1] <a href="http://sls.update.microsoft.com/" rel="noreferrer" target="_blank">http://sls.update.microsoft.co<wbr>m/</a><br>
</blockquote>
<br>
Hi,<br>
<br>
Are you sure, that Squid and all your clients use same _caching_ DNS server? For example, here results from my server for name <a href="http://sls.update.microsoft.com" rel="noreferrer" target="_blank">sls.update.microsoft.com</a>:<br>
<br>
$ dig <a href="http://sls.update.microsoft.com" rel="noreferrer" target="_blank">sls.update.microsoft.com</a><br>
...<br>
<a href="http://sls.update.microsoft.com" rel="noreferrer" target="_blank">sls.update.microsoft.com</a>. 3345 IN CNAME <a href="http://sls.update.microsoft.com.nsatc.net" rel="noreferrer" target="_blank">sls.update.microsoft.com.nsat<wbr>c.net</a>.<br>
<a href="http://sls.update.microsoft.com.nsatc.net" rel="noreferrer" target="_blank">sls.update.microsoft.com.nsatc<wbr>.net</a>. 215 IN A 157.56.77.141<br>
...<br>
<br>
<br>
Second request after 3 seconds:<br>
<br>
$ dig <a href="http://sls.update.microsoft.com" rel="noreferrer" target="_blank">sls.update.microsoft.com</a><br>
...<br>
<a href="http://sls.update.microsoft.com" rel="noreferrer" target="_blank">sls.update.microsoft.com</a>. 3342 IN CNAME <a href="http://sls.update.microsoft.com.nsatc.net" rel="noreferrer" target="_blank">sls.update.microsoft.com.nsat<wbr>c.net</a>.<br>
<a href="http://sls.update.microsoft.com.nsatc.net" rel="noreferrer" target="_blank">sls.update.microsoft.com.nsatc<wbr>.net</a>. 212 IN A 157.56.77.141<br>
...<br>
<br>
<br>
Here I see that the TTL for the target A record is 300 seconds (not 5 seconds), and _caching_ DNS server will serve same A record for all clients at least 5 minutes. That behaviour will not introduce false positives for host forgery detection.<br>
<br>
<br>
<br>
On other hand, if the DNS server is not _caching_, you would get different A records for each request. For example, below are results from authoritative DNS server for zone <a href="http://nsatc.net" rel="noreferrer" target="_blank">nsatc.net</a>:<br>
<br>
<br>
$ dig @<a href="http://e.ns.nsatc.net" rel="noreferrer" target="_blank">e.ns.nsatc.net</a> <a href="http://sls.update.microsoft.com.nsatc.net" rel="noreferrer" target="_blank">sls.update.microsoft.com.nsatc<wbr>.net</a><br>
...<br>
<a href="http://sls.update.microsoft.com.nsatc.net" rel="noreferrer" target="_blank">sls.update.microsoft.com.nsatc<wbr>.net</a>. 300 IN A <a href="tel:157.55.240.220" value="+15755240220" target="_blank">157.55.240.220</a><br>
...<br>
<br>
<br>
Second request after 5 seconds:<br>
<br>
$ dig @<a href="http://e.ns.nsatc.net" rel="noreferrer" target="_blank">e.ns.nsatc.net</a> <a href="http://sls.update.microsoft.com.nsatc.net" rel="noreferrer" target="_blank">sls.update.microsoft.com.nsatc<wbr>.net</a><br>
...<br>
<a href="http://sls.update.microsoft.com.nsatc.net" rel="noreferrer" target="_blank">sls.update.microsoft.com.nsatc<wbr>.net</a>. 300 IN A 157.56.96.54<br>
...<br>
<br>
<br>
Here I see, that the DNS server serves exactly one A record in round-robin fashion. Same true for Google public DNS services. That behavior could cause troubles for host forgery detection.<br>
<br>
HTH<br>
<br>
Garri<br>
______________________________<wbr>_________________<br>
squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.<wbr>org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">http://lists.squid-cache.org/l<wbr>istinfo/squid-users</a><br>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature">Thank you for your time,<br><br>John Wright<br><br></div>
</div>