<html>
<head>
<meta http-equiv="content-type" content: text/html; charset=UTF-8>
</head>
<body>
<span style="color: gray;"></span>Hi<br>
<blockquote style="border-left: 1px solid rgb(204, 204, 204);margin: 0 0 0
0.8ex;padding: 1ex 0 0 1ex;">I installed Squid 3.5.25 at debian with
libecap3 too.<br>
<br>
Now my old squid.conf file for v3.48 not work anymore for redirected https
websites.<br>
I get SSL_ERROR_RX_RECORD_TOO_LONG in Firefox. <br>
I redirected them before by Shorewall and it worked with v3.48<br>
#SQUID-PORTS<br>
REDIRECT loc 3140
tcp https -
!192.168.1.254<br>
REDIRECT loc 3139
tcp www -
!192.168.1.254<br>
<br>
<br>
If I change https_port to http_port and remove the intercept option for
ssl_bump it works with expicit configured clients for that port even for
gmail website too.<br>
What I need to change to make squid 3.5 work transparently ?<br>
<br>
squid -v<br>
Squid Cache: Version 3.5.25<br>
Service Name: squid<br>
configure options: '--build=x86_64-linux-gnu' '--prefix=/usr'
'--localstatedir=/var/squid' '--libexecdir=/lib/squid' '--srcdir=.'
'--datadir=/share/squid' '--sysconfdir=/etc/squid' '--disable-ipv6'
'--with-default-user=proxy' '--with-logdir=/var/log/squid35'
'--with-pidfile=/var/run/squid35.pid' '--with-openssl' '--enable-ssl-crtd'
'--infodir=/share/info' '--includedir=/include' '--mandir=/usr/share/man'
'--enable-inline' '--disable-arch-native' '--disable-maintainer-mode'
'--disable-dependency-tracking' '--disable-silent-rules'
'--enable-async-io=8' '--enable-storeio=ufs,aufs,diskd,rock'
'--enable-removal-policies=lru,heap' '--enable-delay-pools'
'--enable-cache-digests' '--enable-icap-client'
'--enable-follow-x-forwarded-for'
'--enable-auth-basic=DB,fake,getpwnam,LDAP,NCSA,NIS,PAM,POP3,RADIUS,SASL,SMB' '--enable-auth-digest=file,LDAP' '--enable-auth-negotiate=kerberos,wrapper' '--enable-auth-ntlm=fake,smb_lm' '--enable-external-acl-helpers=file_userip,kerberos_ldap_group,LDAP_group,session,SQL_session,unix_group,wbinfo_group' '--enable-url-rewrite-helpers=fake' '--enable-eui' '--enable-esi' '--enable-icmp' '--enable-zph-qos' '--enable-ecap' '--disable-translation' '--with-filedescriptors=65536' '--with-large-files' '--enable-linux-netfilter' 'CFLAGS=-g -O2 -fPIE -fstack-protector-strong -Wformat -Werror=format-security -Wall' 'LDFLAGS=-fPIE -pie -Wl,-z,relro -Wl,-z,now' 'CPPFLAGS=-D_FORTIFY_SOURCE=2' 'CXXFLAGS=-g -O2 -fPIE -fstack-protector-strong -Wformat -Werror=format-security' 'build_alias=x86_64-linux-gnu'<br>
<br>
cat /etc/squid/squid.conf:<br>
debug_options ALL,6<br>
#0 26,2 83,2 33,2 17,2 44,2<br>
logformat datetime %tl %6tr CLIENT:%>a = = %Ss %<Hs %rm=%>ru
--%[un %Sh/%<a %mt<br>
access_log /var/log/squid35/access.log datetime<br>
forwarded_for on<br>
error_directory /usr/share/squid/errors/de-de/<br>
acl localnet src 192.168.1.0/24<br>
acl SSL_ports port 443<br>
acl Safe_ports port
80 # http<br>
acl Safe_ports port
21 # ftp<br>
acl Safe_ports port 443 #
https<br>
acl Safe_ports port
70 # gopher<br>
acl Safe_ports port 210 #
wais<br>
acl Safe_ports port 1025-65535 # unregistered ports<br>
acl Safe_ports port 280 #
http-mgmt<br>
acl Safe_ports port 488 #
gss-http<br>
acl Safe_ports port 591 #
filemaker<br>
acl Safe_ports port 777 #
multiling http<br>
acl CONNECT method CONNECT<br>
http_access deny !Safe_ports<br>
http_access deny CONNECT !SSL_ports<br>
http_access allow localhost manager<br>
http_access deny manager<br>
http_access deny to_localhost<br>
http_access allow localnet<br>
http_access allow localhost<br>
http_reply_access allow all<br>
http_access deny all<br>
icp_access allow localnet<br>
icp_access deny all<br>
### NEW for v3.5x SSL-Bump ###<br>
always_direct allow all<br>
acl step1 at_step SslBump1<br>
acl step2 at_step SslBump2<br>
acl step3 at_step SslBump3<br>
ssl_bump splice localhost<br>
#acl exclude_sites ssl::server_name_regex -i
"/var/lib/squidguard/db/BL/whitelist-ssl/whitelist.destdomainlist"<br>
ssl_bump peek step1 all<br>
#ssl_bump splice exclude_sites<br>
ssl_bump stare step2 all<br>
ssl_bump bump all <br>
#############################<br>
http_port 0.0.0.0:3138<br>
http_port 0.0.0.0:3139 intercept<br>
sslproxy_cert_adapt setCommonName ssl::certDomainMismatch<br>
https_port 0.0.0.0:3140 intercept ssl-bump generate-host-certificates=on
dynamic_cert_mem_cache_size=16MB cert=/etc/squid/myca.pem<br>
sslproxy_options NO_SSLv2,NO_SSLv3,SINGLE_DH_USE<br>
sslproxy_capath /etc/ssl/certs<br>
##sslproxy_cafile /etc/ssl/certs/ca-certificates.crt<br>
sslcrtd_program /bin/ssl_crtd -s /var/spool/squid_ssldb -M 16MB<br>
sslcrtd_children 10<br>
cache_dir ufs /etc/squid/ssl_db 100 16 256<br>
cache_mgr admin@mainrouter<br>
visible_hostname xxx<br>
httpd_suppress_version_string on <br>
coredump_dir /var/spool/squid<br>
refresh_pattern
^ftp:
1440 20% 10080<br>
refresh_pattern ^gopher:
1440 0% 1440<br>
refresh_pattern -i (/cgi-bin/|\?) 0
0% 0<br>
refresh_pattern
0 20% 4320<br>
cache_effective_user proxy<br>
icap_enable on<br>
icap_send_client_ip on<br>
icap_send_client_username on<br>
icap_client_username_encode off<br>
icap_client_username_header X-Authenticated-User<br>
icap_preview_enable on<br>
icap_preview_size 1024<br>
icap_service service_req reqmod_precache bypass=0
icap://127.0.0.1:1344/squidclamav<br>
icap_service service_resp respmod_precache bypass=0
icap://127.0.0.1:1344/squidclamav<br>
adaptation_access service_req allow all<br>
adaptation_access service_resp allow all<br>
redirect_program /usr/bin/squidGuard -c /etc/squidguard/squidGuard.conf<br>
cache_effective_group proxy<br>
dns_nameservers 8.8.8.8<br>
########## END of squid.conf#######################<br>
<br>
If I run "squid -NYCd1" with root I get :<br>
<br>
root@Router:/# squid -NYCd1<br>
2017/05/28 16:07:54| WARNING: BCP 177 violation. IPv6 transport forced OFF
by build parameters.<br>
2017/05/28 16:07:54.922| Set Current Directory to /var/spool/squid<br>
2017/05/28 16:07:54.922| Starting Squid Cache version 3.5.25 for
x86_64-pc-linux-gnu...<br>
2017/05/28 16:07:54.922| Service Name: squid<br>
2017/05/28 16:07:54.922| Process ID 25773<br>
2017/05/28 16:07:54.922| Process Roles: master worker<br>
2017/05/28 16:07:54.922| With 65536 file descriptors available<br>
2017/05/28 16:07:54.922| Initializing IP Cache...<br>
2017/05/28 16:07:54.924| DNS Socket created at 0.0.0.0, FD 9<br>
2017/05/28 16:07:54.924| Adding nameserver 8.8.8.8 from squid.conf<br>
2017/05/28 16:07:54.924| helperOpenServers: Starting 5/5 'ssl_crtd'
processes<br>
2017/05/28 16:07:54.949| helperOpenServers: Starting 0/20 'squidGuard'
processes<br>
2017/05/28 16:07:54.949| helperOpenServers: No 'squidGuard' processes
needed.<br>
2017/05/28 16:07:55.007| Logfile: opening log
/var/log/squid35/access.log<br>
2017/05/28 16:07:55.007| WARNING: log name now starts with a module name.
Use 'stdio:/var/log/squid35/access.log'<br>
2017/05/28 16:07:55.270| Unlinkd pipe opened on FD 25<br>
2017/05/28 16:07:55.274| Local cache digest enabled; rebuild/rewrite every
3600/3600 sec<br>
2017/05/28 16:07:55.275| Store logging disabled<br>
2017/05/28 16:07:55.275| Swap maxSize 102400 + 262144 KB, estimated 28041
objects<br>
2017/05/28 16:07:55.275| Target number of buckets: 1402<br>
2017/05/28 16:07:55.275| Using 8192 Store buckets<br>
2017/05/28 16:07:55.275| Max Mem size: 262144 KB<br>
2017/05/28 16:07:55.275| Max Swap size: 102400 KB<br>
2017/05/28 16:07:55.277| Rebuilding storage in /etc/squid/ssl_db (clean
log)<br>
2017/05/28 16:07:55.277| Using Least Load store dir selection<br>
2017/05/28 16:07:55.277| Set Current Directory to /var/spool/squid<br>
2017/05/28 16:07:55.691| Finished loading MIME types and icons.<br>
2017/05/28 16:07:55.693| HTCP Disabled.<br>
2017/05/28 16:07:55.696| Pinger socket opened on FD 32<br>
2017/05/28 16:07:55.698| Squid plugin modules loaded: 0<br>
2017/05/28 16:07:55.698| Adaptation support is on<br>
2017/05/28 16:07:55.701| Accepting HTTP Socket connections at
local=0.0.0.0:3138 remote=[::] FD 28 flags=9<br>
2017/05/28 16:07:55.702| Accepting NAT intercepted HTTP Socket connections
at local=0.0.0.0:3139 remote=[::] FD 29 flags=41<br>
2017/05/28 16:07:55.702| Accepting NAT intercepted SSL bumped HTTPS Socket
connections at local=0.0.0.0:3140 remote=[::] FD 30 flags=41<br>
2017/05/28 16:07:57.157| Store rebuilding is 84.50% complete<br>
2017/05/28 16:07:57.432| Done reading /etc/squid/ssl_db swaplog (4733
entries)<br>
2017/05/28 16:07:57.432| Finished rebuilding storage from disk.<br>
2017/05/28 16:07:57.432| 4733 Entries
scanned<br>
2017/05/28 16:07:57.432| 0
Invalid entries.<br>
2017/05/28 16:07:57.432| 0
With invalid flags.<br>
2017/05/28 16:07:57.432| 4733 Objects
loaded.<br>
2017/05/28 16:07:57.432| 0
Objects expired.<br>
2017/05/28 16:07:57.432| 0
Objects cancelled.<br>
2017/05/28 16:07:57.432| 0
Duplicate URLs purged.<br>
2017/05/28 16:07:57.432| 0
Swapfile clashes avoided.<br>
2017/05/28 16:07:57.432| Took 2.16 seconds (2196.06
objects/sec).<br>
2017/05/28 16:07:57.432| Beginning Validation Procedure<br>
2017/05/28 16:07:57.801| Completed Validation Procedure<br>
2017/05/28 16:07:57.801| Validated 4732 Entries<br>
2017/05/28 16:07:57.801| store_swap_size = 92108.00 KB<br>
2017/05/28 16:07:59.557| storeLateRelease: released 0 objects<br>
2017/05/28 16:07:59.706| Starting new redirector helpers...<br>
2017/05/28 16:07:59.706| helperOpenServers: Starting 1/20 'squidGuard'
processes<br>
2017/05/28 16:07:59.739| Starting new redirector helpers...<br>
2017/05/28 16:07:59.739| helperOpenServers: Starting 1/20 'squidGuard'
processes<br>
2017/05/28 16:07:59.756| abandoning local=104.86.49.182:443
remote=192.168.1.8:41991 FD 19 flags=33<br>
.....<br>
2017/05/28 16:08:11.844| abandoning local=104.86.40.45:443
remote=192.168.1.8:42080 FD 80 flags=33<br>
^C << stopped manually here<br>
2017/05/28 16:08:14| Preparing for shutdown after 50 requests<br>
2017/05/28 16:08:14| Waiting 0 seconds for active connections to finish<br>
2017/05/28 16:08:14| Closing HTTP port 0.0.0.0:3138<br>
2017/05/28 16:08:14.101| Closing HTTP port 0.0.0.0:3139<br>
2017/05/28 16:08:14.101| Closing HTTPS port 0.0.0.0:3140<br>
2017/05/28 16:08:14.101| Closing Pinger socket on FD 32<br>
2017/05/28 16:08:15.114| Shutdown: NTLM authentication.<br>
2017/05/28 16:08:15.114| Shutdown: Negotiate authentication.<br>
2017/05/28 16:08:15.114| Shutdown: Digest authentication.<br>
2017/05/28 16:08:15.114| Shutdown: Basic authentication.<br>
2017/05/28 16:08:15.115| Shutting down...<br>
2017/05/28 16:08:15.597| Closing unlinkd pipe on FD 25<br>
2017/05/28 16:08:15.597| storeDirWriteCleanLogs: Starting...<br>
2017/05/28 16:08:15.600| Finished. Wrote 4733
entries.<br>
2017/05/28 16:08:15.600| Took 0.00 seconds (1619226.82
entries/sec).<br>
2017/05/28 16:08:15.600| Logfile: closing log
stdio:/var/log/squid35/access.log<br>
2017/05/28 16:08:15.600| Open FD UNSTARTED 0
stdin<br>
2017/05/28 16:08:15.600| Open FD UNSTARTED 1
stdout<br>
2017/05/28 16:08:15.600| Open FD UNSTARTED 2
stderr<br>
2017/05/28 16:08:15.600| Open FD READ/WRITE 9 DNS Socket
IPv4<br>
2017/05/28 16:08:15.600| Open FD UNSTARTED 10 ssl_crtd
#1<br>
2017/05/28 16:08:15.600| Open FD UNSTARTED 12 ssl_crtd
#2<br>
2017/05/28 16:08:15.600| Open FD UNSTARTED 14 ssl_crtd
#3<br>
2017/05/28 16:08:15.600| Open FD READ/WRITE 15 127.0.0.1<br>
2017/05/28 16:08:15.600| Open FD UNSTARTED 16 ssl_crtd
#4<br>
2017/05/28 16:08:15.600| Open FD UNSTARTED 18 ssl_crtd
#5<br>
2017/05/28 16:08:15.600| Open FD READ/WRITE 24 127.0.0.1<br>
2017/05/28 16:08:15.600| Open FD READ/WRITE 26 127.0.0.1<br>
2017/05/28 16:08:15.600| Open FD READ/WRITE 27 127.0.0.1<br>
2017/05/28 16:08:15.600| Open FD READ/WRITE 31 squidGuard
#1<br>
2017/05/28 16:08:15.600| Open FD READ/WRITE 33 squidGuard
#1<br>
2017/05/28 16:08:15.600| Open FD READ/WRITE 53 127.0.0.1<br>
2017/05/28 16:08:15.608| Squid Cache (Version 3.5.25): Exiting
normally.<br>
<br>
<br>
<div id="Signature"><div id="Text"></div></div></blockquote>
</body>
</html>