<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<div class=""><br class="">
</div>
<div class="">Hi,</div>
<div class=""><br class="">
</div>
<div class="">I’m new to this group. I just setup a squid ver 4.5 on my ubuntu machine. I configured this proxy to receive</div>
<div class="">https packets from another device on the same LAN, and modified the iptables to redirect the port 443 packets</div>
<div class="">to the squid proxy port 3130. </div>
<div class=""><br class="">
</div>
<div class="">I can see the client https packet has been received and the proxy is ready to do the ‘bump’, the fd to the client</div>
<div class="">connection is 13:</div>
<div class=""><br class="">
</div>
<div class="">**</div>
<span class="">2019/12/07 20:48:59.586 kid1| 85,4| <a href="http://client_side_request.cc" class="">
client_side_request.cc</a>(1510) processRequest: CONNECT x.y.43.31:443<br class="">
2019/12/07 20:48:59.586 kid1| 85,5| <a href="http://client_side_request.cc" class="">
client_side_request.cc</a>(1597) sslBumpStart: Confirming peek-bumped CONNECT tunnel on FD local=x.y..31:443 remote=192.168.1.25:39273 FD 13 flags=33</span>
<div class=""><span class="">**</span></div>
<div class=""><span class=""><br class="">
</span><span class=""><br class="">
</span>
<div class="">From the debug I can also see the proxy connects towards the remote</div>
<div class="">server, and proxy has negotiated fine with the server. the proxy receives 3 certificates from the server,</div>
<div class="">and verification was fine to the server. But when the proxy trying to proceed with client negotiation, I got this error:</div>
<div class=""><br class="">
</div>
<div class="">***</div>
<div class="">2019/12/07 20:48:59.760 kid1| 33,5| <a href="http://client_side.cc" class="">
client_side.cc</a>(2859) sslCrtdHandleReply: Certificate for x.y.43.31 was successfully recieved from ssl_crtd<br class="">
2019/12/07 20:48:59.760 kid1| 33,5| <a href="http://client_side.cc" class="">client_side.cc</a>(3335) doPeekAndSpliceStep: PeekAndSplice mode, proceed with client negotiation. Currrent state:SSLv2/v3 read client hello A<br class="">
2019/12/07 20:48:59.760 kid1| 5,5| <a href="http://ModEpoll.cc" class="">ModEpoll.cc</a>(117) SetSelect: FD 13, type=2, handler=1, client_data=0x15beef8, timeout=0<br class="">
2019/12/07 20:48:59.760 kid1| 84,5| <a href="http://helper.cc" class="">helper.cc</a>(1247) GetFirstAvailable: GetFirstAvailable: Running servers 5<br class="">
2019/12/07 20:48:59.760 kid1| 5,4| <a href="http://AsyncCall.cc" class="">AsyncCall.cc</a>(26) AsyncCall: The AsyncCall helperHandleRead constructed, this=0x1a37c50 [call827]<br class="">
2019/12/07 20:48:59.760 kid1| 5,5| <a href="http://Read.cc" class="">Read.cc</a>(57) comm_read_base: comm_read, queueing read for local=[::] remote=[::] FD 10 flags=1; asynCall 0x1a37c50*1<br class="">
2019/12/07 20:48:59.760 kid1| 5,5| <a href="http://ModEpoll.cc" class="">ModEpoll.cc</a>(117) SetSelect: FD 10, type=1, handler=1, client_data=0x155cce8, timeout=0<br class="">
2019/12/07 20:48:59.760 kid1| 5,4| <a href="http://AsyncCallQueue.cc" class="">AsyncCallQueue.cc</a>(57) fireNext: leaving helperHandleRead(local=[::] remote=[::] FD 10 flags=1, data=0x157f9a8, size=3384, buf=0x157fbd0)<br class="">
2019/12/07 20:48:59.760 kid1| 83,5| <a href="http://bio.cc" class="">bio.cc</a>(612) squid_bio_ctrl: 0x1a5e140 6(0, 0x1a76c00)<br class="">
2019/12/07 20:48:59.761 kid1| 83,5| <a href="http://Session.cc" class="">Session.cc</a>(347) get_session_cb: Request to search for SSL_SESSION of len: 321019023443:419801955<br class="">
2019/12/07 20:48:59.761 kid1| 54,5| <a href="http://MemMap.cc" class="">MemMap.cc</a>(156) openForReading: trying to open slot for key 5310BD3C63AB0519C4F984A35A8DC1AE for reading in map [tls_session_cache]<br class="">
2019/12/07 20:48:59.761 kid1| 54,5| <a href="http://MemMap.cc" class="">MemMap.cc</a>(177) openForReadingAt: trying to open slot at 18 for reading in map [tls_session_cache]<br class="">
2019/12/07 20:48:59.761 kid1| 54,5| <a href="http://MemMap.cc" class="">MemMap.cc</a>(169) openForReading: failed to open slot for key 5310BD3C63AB0519C4F984A35A8DC1AE for reading in map [tls_session_cache]<br class="">
2019/12/07 20:48:59.761 kid1| 83,5| <a href="http://Session.cc" class="">Session.cc</a>(362) get_session_cb:
<font color="#ff000a" class="">Failed to retrieve SSL_SESSION </font>from cache</div>
<div class="">***</div>
<div class=""><br class="">
</div>
<div class="">Here is my squid.conf:</div>
<div class=""><br class="">
</div>
<div class="">#<br class="">
acl localnet src 192.168.1.0/24<br class="">
acl step1 at_step SslBump1<br class="">
acl step2 at_step SslBump2<br class="">
acl step3 at_step SslBump3<br class="">
<br class="">
ssl_bump peek step1<br class="">
ssl_bump stare step2<br class="">
ssl_bump bump all<br class="">
<br class="">
acl SSL_ports port 443<br class="">
acl Safe_ports port 80 # http<br class="">
acl Safe_ports port 21 # ftp<br class="">
acl Safe_ports port 443 # https<br class="">
acl Safe_ports port 70 # gopher<br class="">
acl Safe_ports port 210 # wais<br class="">
acl Safe_ports port 1025-65535 # unregistered ports<br class="">
acl Safe_ports port 280 # http-mgmt<br class="">
acl Safe_ports port 488 # gss-http<br class="">
acl Safe_ports port 591 # filemaker<br class="">
acl Safe_ports port 777 # multiling http<br class="">
acl CONNECT method CONNECT<br class="">
http_access deny !Safe_ports<br class="">
http_access deny CONNECT !SSL_ports<br class="">
http_access allow localhost manager<br class="">
http_access deny manager<br class="">
http_access allow localnet<br class="">
http_access allow localhost<br class="">
http_access deny all<br class="">
http_port 3128<br class="">
http_port 3129 intercept<br class="">
https_port 3130 intercept ssl-bump cert=/usr/local/squid/etc/ssl_cert/myCA.pem generate-host-certificates=on dynamic_cert_mem_cache_size=4MB key=/usr/local/<br class="">
squid/etc/ssl_cert/myCA.pem<br class="">
<br class="">
sslcrtd_program /usr/local/squid/libexec/security_file_certgen -s /usr/local/squid/var/logs/ssl_db -M 4MB<br class="">
coredump_dir /usr/local/squid/var/cache/squid<br class="">
cache_dir ufs /usr/local/squid/var/cache/squid 1000 16 256 # 1GB as Cache<br class="">
</div>
<div class=""><br class="">
</div>
<div class="">##</div>
<div class=""><br class="">
</div>
<div class="">I’m wondering if this problem is a bug, my proxy config issue, or the client does not send the correct TLS parameters.</div>
<div class="">thanks for your help in advance.</div>
<div class=""><br class="">
</div>
<div class="">Cheers,</div>
<div class="">- George</div>
<div class=""><br class="">
</div>
</div>
</body>
</html>