<html><head></head><body bgcolor="#ffffff" text="#4c4c4c" link="#8793c1" vlink="#8793c1"><div>On Mon, 2017-01-23 at 19:54 -0700, Alex Rousskov wrote:</div><blockquote type="cite"><pre>On 01/23/2017 04:28 PM, David Touzeau wrote:
<blockquote type="cite">
ssl_bump peek ssl_step1
ssl_bump splice all
sslproxy_flags DONT_VERIFY_PEER
sslproxy_cert_error allow all
</blockquote>
<blockquote type="cite">
When connecting to mozilla.org using transparent, we receive this error:
* About to connect() to <a href="http://www.mozilla.org">www.mozilla.org</a> port 443 (#0)
* Trying 104.16.41.2...
* connected
* Connected to <a href="http://www.mozilla.org">www.mozilla.org</a> (104.16.41.2) port 443 (#0)
* successfully set certificate verify locations:
* CAfile: none
CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol
* Closing connection #0
curl: (35) error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown
protocol
And squid access.log
1485110919.564 3 192.168.1.236 TAG_NONE/403 6263 CONNECT
104.16.41.2:443 - HIER_NONE/- text/html
</blockquote>
Amos, please note that the above failing test is done using curl, not
some fancy/non-HTTP/websocket traffic from a "browser".
David, you need to figure out why Squid is denying the intercepted
connection attempt (the /403 part in your access.log). Check your
http_access rules to start with. They were applied to the denied fake
CONNECT request shown above.
AFAICT, Squid denies the [fake] CONNECT without bumping the client
connection to serve a secure error message. That is _not_ what I would
expect because usually Squid bumps to serve errors, even when dealing
with non-bumping ssl_bump rules. However, I may be misinterpreting the
"unknown protocol" part; perhaps OpenSSL can use that phrase for an
unsupported TLS version as well? Or perhaps Squid failed to bump the
client for some reason?
Capture packets to see what Squid is sending to curl.
HTH,
Alex.
</pre></blockquote><div><br></div><div>Seems like pretty standard stuff:</div><div><br></div><div>Jan 23 20:09:04 (squid): 192.168.1.109 - - [23/Jan/2017:20:09:04 -0700] "CONNECT 104.16.40.2:443 HTTP/1.1" <a href="www.mozilla.org">www.mozilla.org</a> - 200 916167 TCP_TUNNEL:ORIGINAL_DST</div><div><br></div><div>TLSv12<span class="Apple-tab-span" style="white-space:pre"> </span>TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256<span class="Apple-tab-span" style="white-space:pre"> </span>secp256r1</div><div><br></div><div>James</div></body></html>