<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">Hi Squid Community,</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">I am relatively new to Squid and I am facing the following issue, would truly appreciate if you could help.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Squid4.6 is used as a forward proxy to convert all traffic to secure traffic.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">The configuration of squid is very simple, it allows all traffic and uses urlrewrite.pl to replace "http" to "https".(SSL-BUMP is NOT used) Squid proxy has tls_outgoing_options set, so the following works:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> client(http) -----> Squid ------> Server(https)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Now, I am trying to replicate the same with websockets.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">There are 3 test cases,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">1. <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> client(ws)------> Squid -----> Server(ws)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2. <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> client(wss) ------> Squid -----> Server(wss)
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">3 <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> client(ws) ------> Squid -----> Server(wss)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">The first two cases work with squid, but the third one does not work. And I only need the third option.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">I have given debug logs for urlrewrite.pl to show the exact request received for a websocket connection, and the following is the log:
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Here port 8080: is server and port 3128: is squid<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">DEBUG:root:localhost:8080 127.0.0.1/localhost - CONNECT myip=127.0.0.1 myport=3128<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Even wireshark shows the same,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">1. CONNECT HTTP 1.1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2. GET<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">3. upgrade protocol. <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Question: <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">1.Is there any way to upgrade a websocket connection to secure websocket using squid4.6?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2.Or say I use wss-client (without certificate) and a wss-server(with certificates), is there a way to inform squid to use its own certificates even mentioned in "tls_outgoing_options" to establish the connection?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">REQUIRED: <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Client will always send a unsecure traffic HTTP/WS
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">and Squid should upgrade it to HTTPS/WSS.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">In our application setup, we use our own openssl libraries to create certificates - which cannot be included in the (client.go) go-tls package, so we use squid proxy to use the certificates generated by our
own openssl libraries. <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Client and Forward-Proxy (Squid) are both in our specific environment, so squid.conf is very simple and allows all traffic.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">And we need mutual cert authentication.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">SQUID CONF CODE<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> #<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> # Recommended minimum configuration:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> #<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> # Example rule allowing access from your local networks.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> # Adapt to list your (internal) IP networks from where browsing<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> # should be allowed<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> acl localhost src 127.0.0.1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> acl SSL_ports port 443<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> acl Safe_ports port 443 # https<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> acl Safe_ports port 80 # http<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> acl CONNECT method CONNECT<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> http_access deny !Safe_ports<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> http_access deny CONNECT !SSL_ports<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> http_access allow localhost<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> http_access deny all<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> # Squid normally listens to port 3128<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> http_port 3128<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> url_rewrite_program /etc/squid/urlrewrite.pl<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> url_rewrite_access allow all<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> tls_outgoing_options cert=/etc/squid/proxy.crt<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> tls_outgoing_options key=/etc/squid/proxy.key<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> tls_outgoing_options cafile=/etc/squid/serverauth.crt<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">urlrewrite CODE<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> #!/usr/bin/perl<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> select(STDOUT);<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> $| = 1;<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> while (<>) {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> #print STDOUT "OK rewrite-url=\"https://google.com\"\n";<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> if (/^(|\d+\s+)((\w+):\/+)([^\/:]+)(|:(\d+))(|\/\S*)(|\s.*)$/) {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> my $channel = $1;<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> my $protocolClean = $3;<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> my $domain = $4;<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> my $port = $5;<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> my $portClean = $6;<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> my $urlPath = $7;<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> if ($protocolClean eq 'http' ){#&& ($port eq '' || $portClean eq '80')) {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> print STDOUT "${channel}OK rewrite-url=\"https://${domain}${port}${urlPath}\"\n";<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> #print STDOUT "${channel}OK rewrite-url=\"https://google.com\"\n";<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> } else {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> print STDOUT "${channel}ERR\n";<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> }<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> }<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> }<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Thank you, <br>
Shekhar</span><o:p></o:p></p>
</div>
</body>
</html>