<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Further to this:<br>
<br>
I have ssl-bump setup on port 8080.<br>
<br>
If I remove ssl-bump squid works just like I mentioned in my earlier
e-mail.<br>
<br>
> curl -ix 192.168.1.1:8080 <a class="moz-txt-link-freetext" href="https://google.com">https://google.com</a><br>
HTTP/1.1 307 Temporary Redirect<br>
Server: squid/4.3<br>
Mime-Version: 1.0<br>
Date: Tue, 16 Oct 2018 12:01:41 GMT<br>
Content-Type: text/html;charset=utf-8<br>
Content-Length: 0<br>
Location: <a class="moz-txt-link-freetext" href="http://192.168.1.1/blocked.html">http://192.168.1.1/blocked.html</a><br>
X-Squid-Error: 403 Access Denied<br>
X-Cache: MISS from somehost<br>
X-Cache-Lookup: NONE from somehost:8080<br>
Connection: keep-alive<br>
<br>
curl: (56) Received HTTP code 307 from proxy after CONNECT<br>
<br>
<br>
So then I reactivated ssl-bump and added this at top of squid.conf:<br>
<br>
http_port 8080 ssl-bump ...<br>
ssl_bump splice all<br>
<br>
i.e. http_port has ssl-bump but squid is not really supposed to bump
at all.<br>
<br>
But squid still goes ahead and replies with 200 Connection
established.<br>
<br>
So it means that this is a bug in ssl-bump implementation.<br>
<br>
It seems that current algorithm for ssl-bump is:<br>
<br>
1) Browser sends CONNECT request<br>
2) Squid sends status 200 Connection Established<br>
3) Check ACL<br>
4) If denied, bump the connection with squid certificate<br>
5) If allowed, go ahead with tunneling / bumping as applicable<br>
<br>
<br>
In my opinion correct flow should be like this:<br>
<br>
1) Browser sends CONNECT request<br>
2) Check ACL<br>
3) If denied, return with 307 (or 302)<br>
4) If allowed, go ahead with tunneling / bumping as applicable<br>
<br>
<br>
Please test / check,<br>
<br>
Thank you,<br>
<br>
Amish.<br>
<br>
<br>
<div class="moz-cite-prefix">On 16/10/18 5:05 PM, Amish wrote:<br>
</div>
<blockquote type="cite"
cite="mid:7f39ba71-493d-1b36-e238-191942e78435@gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
Hello<br>
<br>
I have this simplified ACL in squid.conf<br>
<br>
acl denyit src all<br>
deny_info <a class="moz-txt-link-freetext"
href="http://192.168.1.1/blocked.html" moz-do-not-send="true">http://192.168.1.1/blocked.html</a>
denyit<br>
http_access deny denyit<br>
<br>
The purpose is to block everything and redirect to <a
class="moz-txt-link-freetext"
href="http://192.168.1.1/blocked.html" moz-do-not-send="true">http://192.168.1.1/blocked.html</a><br>
<br>
It works fine with http (non-secure) CONNECT request ...<br>
<br>
> curl -ix 192.168.1.1:8080 <a class="moz-txt-link-freetext"
href="http://google.com" moz-do-not-send="true">http://google.com</a><br>
HTTP/1.1 302 Found<br>
Server: squid/4.3<br>
Mime-Version: 1.0<br>
Date: Tue, 16 Oct 2018 11:02:05 GMT<br>
Content-Type: text/html;charset=utf-8<br>
Content-Length: 0<br>
Location: <a class="moz-txt-link-freetext"
href="http://192.168.1.1/blocked.html" moz-do-not-send="true">http://192.168.1.1/blocked.html</a><br>
X-Squid-Error: 403 Access Denied<br>
X-Cache: MISS from somehost<br>
X-Cache-Lookup: NONE from somehost:8080<br>
Connection: keep-alive<br>
<br>
... but gives certificate error with https CONNECT request.<br>
<br>
> curl -ix 192.168.1.1:8080 <a class="moz-txt-link-freetext"
href="https://google.com" moz-do-not-send="true">https://google.com</a><br>
HTTP/1.1 200 Connection established<br>
<br>
curl: (60) SSL certificate problem: self signed certificate in
certificate chain<br>
More details here: <a class="moz-txt-link-freetext"
href="https://curl.haxx.se/docs/sslcerts.html"
moz-do-not-send="true">https://curl.haxx.se/docs/sslcerts.html</a><br>
<br>
curl failed to verify the legitimacy of the server and therefore
could not<br>
establish a secure connection to it. To learn more about this
situation and<br>
how to fix it, please visit the web page mentioned above.<br>
<br>
<br>
I believe this is because squid first gives 200 status and hence
browser thinks connection is established expects Google's
certificate.<br>
<br>
Can squid not return with 302/307 on CONNECT HTTPs requests for
deny_info?<br>
<br>
Like instead of HTTP/1.1 200 Connection established - it returns:<br>
<br>
HTTP/1.1 307 Redirect<br>
Location: <a class="moz-txt-link-freetext"
href="http://192.168.1.1/blocked.html" moz-do-not-send="true">http://192.168.1.1/blocked.html</a><br>
(...)<br>
<br>
RFC 7231 <a class="moz-txt-link-freetext"
href="https://tools.ietf.org/html/rfc7231#section-4.3.6"
moz-do-not-send="true">https://tools.ietf.org/html/rfc7231#section-4.3.6</a>
states that:<br>
<pre class="newpage">Any response other than a successful response
indicates that the tunnel has not yet been formed and that the
connection remains governed by HTTP.</pre>
<br>
which means HTTP/1.1 307 Redirect should make browser treat
connection as HTTP and hopefully also follow Location.<br>
<br>
Any idea? Or any other workaround (except importing squid
certificate)<br>
<br>
Thanks and regards,<br>
<br>
Amish<br>
</blockquote>
<br>
</body>
</html>