<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">I am trying to permit access to something like the following, https://www.example.com/world, without providing access to the whole site.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">I have a basic configuration with the pertinent items as follows:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">http_port 3128 ssl-bump \<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> cert=/etc/squid/ssl_certs.d/myCA.pem \<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> generate-host-certificates=on \<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> dynamic_cert_mem_cache_size=16MB \<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> options=SINGLE_DH_USE,SINGLE_ECDH_USE,NO_SSLv3,CIPHER_SERVER_PREFERENCE cipher=ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:!ECDHE-RSA-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!AES256-GCM-SHA384:!AES128-GCM-SHA256:!AES256-SHA256:!AES128-SHA256:!AES256-SHA:!AES128-SHA:!DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4
sslflags=NO_SESSION_REUSE \<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> tls-dh=prime256v1:/etc/squid/dhparams.d/dhparam.pem<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">sslcrtd_program /usr/lib64/squid/security_file_certgen -s /var/cache/squid/ssl_db -M 16MB<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">acl step1 at_step SslBump1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">acl step2 at_step SslBump2<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">acl step3 at_step SslBump3<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">ssl_bump peek step1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">ssl_bump bump all<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <o:p>
</o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">acl DSTDOMAIN_ALLOW dstdomain www.example.com<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">acl URLPATH_ALLOW urlpath_regex -i ^/world/*<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">http_access allow SrcSubnet DSTDOMAIN_ALLOW URLPATH_ALLOW<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">note ruleid Rule-10-GCP.conf SrcSubnet DSTDOMAIN_ALLOW URLPATH_ALLOW<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">note ruletype ALLOW SrcSubnet DSTDOMAIN_ALLOW URLPATH_ALLOW<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Dumping the log into debug mode I see that what appears that it can obtain the path but then fails the connection. If I am reading it properly, it seems to fail the SSL connection after decrypting it without
passing thru any ACLs. I've tried researching the delated error message from the log. It there a better way to troubleshoot this error or should I not expect to filter a full URL via HTTPS ?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2019/08/12 10:40:29.053 kid1| 23,3| Uri.cc(371) parse: Split URL 'www.example.com:443' into proto='', host='www.example.com', port='443', path=''<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">…<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2019/08/12 10:40:29.055 kid1| 28,5| Acl.cc(124) matches: checking DSTDOMAIN_ALLOW<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2019/08/12 10:40:29.055 kid1| 28,3| DomainData.cc(110) match: aclMatchDomainList: checking 'www.example.com'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2019/08/12 10:40:29.055 kid1| 28,3| DomainData.cc(115) match: aclMatchDomainList: 'www.example.com' found<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2019/08/12 10:40:29.055 kid1| 28,3| Acl.cc(151) matches: checked: DSTDOMAIN_ALLOW_1 = 1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2019/08/12 10:40:29.055 kid1| 28,5| Acl.cc(124) matches: checking URLPATH_ALLOW<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2019/08/12 10:40:29.055 kid1| 28,3| Acl.cc(151) matches: checked: URLPATH_ALLOW = -1
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">…<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2019/08/12 10:40:29.055 kid1| 33,4| ServerBump.cc(26) ServerBump: will peek at www.example.com:443<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">…<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2019/08/12 10:40:29.062 kid1| 83,3| Handshake.cc(497) parseSniExtension: host_name=www.example.com<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">….<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2019/08/12 10:40:29.062 kid1| 28,3| DomainData.cc(115) match: aclMatchDomainList: 'www.example.com' found<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2019/08/12 10:40:29.062 kid1| 28,3| Acl.cc(151) matches: checked: DSTDOMAIN_ALLOW = 1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2019/08/12 10:40:29.062 kid1| 28,5| Acl.cc(124) matches: checking URLPATH_ALLOW<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2019/08/12 10:40:29.062 kid1| 28,3| Acl.cc(151) matches: checked: URLPATH_ALLOW = -1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">…<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2019/08/12 10:40:29.064 kid1| 33,5| client_side.cc(3023) getSslContextStart: SSL crtd request: new_certificate 2999 host=www.example.com<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">…<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2019/08/12 10:40:29.065 kid1| 33,5| client_side.cc(2860) sslCrtdHandleReply: Certificate for www.example.com was successfully recieved from ssl_crtd<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">…<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2019/08/12 10:40:29.081 kid1| 11,2| client_side.cc(1323) parseHttpRequest: HTTP Client REQUEST:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">---------<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">GET /world HTTP/1.1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Host: www.example.com<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:68.0) Gecko/20100101 Firefox/68.0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Accept-Language: en-US,en;q=0.5<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Accept-Encoding: gzip, deflate, br<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">DNT: 1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Connection: keep-alive<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">…<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2019/08/12 10:40:29.081 kid1| 23,3| Uri.cc(371) parse: Split URL 'https://www.example.com/world' into proto='https', host='www.example.com', port='443', path='/world'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2019/08/12 10:40:29.081 kid1| 33,5| Http1Server.cc(188) buildHttpRequest: normalize 1 Host header using www.example.com<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2019/08/12 10:40:29.081 kid1| 33,3| client_side.cc(641) clientSetKeepaliveFlag: http_ver = HTTP/1.1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2019/08/12 10:40:29.081 kid1| 33,3| client_side.cc(642) clientSetKeepaliveFlag: method = GET<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2019/08/12 10:40:29.081 kid1| 33,4| client_side.cc(1471) quitAfterError: Will close after error: local=10. 200. 200. 200:3128 remote=10.1.2.3:64913 FD 13 flags=1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2019/08/12 10:40:29.081 kid1| 33,5| client_side.cc(1492) serveDelayedError: Responding with delated error for https://www.example.com/world<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2019/08/12 10:40:29.081 kid1| 11,5| HttpRequest.cc(459) detailError: current error details: 1/0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2019/08/12 10:40:29.081 kid1| 33,5| Stream.cc(109) pullData: 0 written 0 into local=10.200. 200. 200:3128 remote=10.1.2.3:64913 FD 13 flags=1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2019/08/12 10:40:29.081 kid1| 33,5| Stream.cc(133) getNextRangeOffset: range: 0; http offset 0; reply 0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2019/08/12 10:40:29.081 kid1| 33,5| store_client.cc(319) doCopy: store_client::doCopy: co: 0, hi: 3760<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2019/08/12 10:40:29.081 kid1| 33,3| Pipeline.cc(35) front: Pipeline 0x2c6cb40 front 0x2c71fc0*4<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2019/08/12 10:40:29.081 kid1| 33,3| Pipeline.cc(35) front: Pipeline 0x2c6cb40 front 0x2c71fc0*4<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2019/08/12 10:40:29.081 kid1| 11,2| Stream.cc(266) sendStartOfMessage: HTTP Client local=10.193.161.197:3128 remote=10.63.200.153:64913 FD 13 flags=1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2019/08/12 10:40:29.081 kid1| 11,2| Stream.cc(267) sendStartOfMessage: HTTP Client REPLY:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">---------<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">HTTP/1.1 403 Forbidden<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
</div>
</body>
</html>