<div dir="ltr">Hi Alex,<div><br></div><div>Thank you for the reply, we update our patch with provided changes.</div><div><br></div><div>One more thing, with TLSv1.3.</div><div><br></div><div>There is site <a href="https://3frontoffice.tre.se/login" target="_blank" style="font-family:Arial,sans-serif">https://3frontoffice.<span class="gmail-il">tre</span>.<span class="gmail-il">se</span>/login</a> with specific behavior in the Chrome browser OS X El Capitan.</div><div><span style="color:rgb(1,91,167);font-family:Arial,sans-serif;font-size:12px"><br></span></div><div><span style="font-family:Arial,sans-serif"><font color="#000000">During establishing TLSv1.3 handshake after </font></span>successfully<span style="color:rgb(0,0,0);font-family:Arial,sans-serif"> send our Client Hello, the server answers us with Hello Retry Request.</span></div><div><span style="font-family:Arial,sans-serif"><font color="#000000"><br></font></span></div><div><span style="font-family:Arial,sans-serif"><font color="#000000">In Squid this behavior interprets next Client Hello peek successfully and Hello Retry Request peeks as Server Hello.<br>After that, we splice it and send to OpenSSL and fail handshake establishing.</font></span></div><div><span style="font-family:Arial,sans-serif"><font color="#000000"><br></font></span></div><div><span style="font-family:Arial,sans-serif"><font color="#000000">Did you already notice such behavior? <br>Did you have some investigation on this issue, </font></span>any advice will be pleasant?</div><div><span style="font-family:Arial,sans-serif"><font color="#000000"><br></font></span></div><div><span style="font-family:Arial,sans-serif"><font color="#000000">Best regards,</font></span></div><div><span style="font-family:Arial,sans-serif"><font color="#000000">Yaroslav.</font></span></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Dec 17, 2019 at 4:39 PM Alex Rousskov <<a href="mailto:rousskov@measurement-factory.com">rousskov@measurement-factory.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On 12/17/19 9:00 AM, Yaroslav Pushko wrote:<br>
> Hi All<br>
> <br>
> We use Squid 4.8 with OpenSSL 1.1.1d in a transparent mode for peek and<br>
> splice interception.<br>
> <br>
> With this version, we lost the possibility to connect to any HTTPS site.<br>
> <br>
> There are a few issues: <br>
> <br>
>   * support TLSv1.2 sites (already discussed in<br>
>     thread <a href="http://squid-web-proxy-cache.1019090.n4.nabble.com/Problem-with-ssl-choose-client-version-inappropriate-fallback-on-some-sites-when-using-TLS1-2-td4688258.html" rel="noreferrer" target="_blank">http://squid-web-proxy-cache.1019090.n4.nabble.com/Problem-with-ssl-choose-client-version-inappropriate-fallback-on-some-sites-when-using-TLS1-2-td4688258.html</a> )<br>
>   * support TLSv1.3 sites.<br>
<br>
Please see<br>
<a href="http://lists.squid-cache.org/pipermail/squid-users/2019-December/021435.html" rel="noreferrer" target="_blank">http://lists.squid-cache.org/pipermail/squid-users/2019-December/021435.html</a><br>
for several alternative fixes. AFAICT, those fixes are more flexible<br>
and, after polishing, appropriate for the official inclusion because<br>
they make fewer assumptions about the values sent via the supported<br>
versions extension.<br>
<br>
It is possible that your SSL_MODE_SEND_FALLBACK_SCSV change needs to be<br>
integrated with the other fixes. Thank you for sharing that idea!<br>
<br>
Alex.<br>
<br>
<br>
> Support TLSv1.2.<br>
> <br>
>     OpenSSL 1.1.1d adds support of TLSv1.3. These changes added some<br>
>     kind of guard if we perform a handshake with a lower version of the<br>
>     TLS protocol than we support. In this scenario, we receive downgrade<br>
>     fallback error.<br>
>     Handshake version TLSv1.2 vs. max support TLSv1.3.<br>
> <br>
>     In such case, we have the next error:<br>
> <br>
>         ERROR: negotiating TLS on FD 19: error:1425F175:SSL<br>
>         routines:ssl_choose_client_version:inappropriate fallback (1/-1/0)<br>
> <br>
> <br>
>     OpenSSL already provided a fix for it. You can configure SSL session<br>
>     to use option SSL_MODE_SEND_FALLBACK_SCSV and setting SSL max proto<br>
>     version for current SSL session, but squid not yet supported these<br>
>     features.<br>
> <br>
>     You can find a patch in the attachments, will be grateful for the<br>
>     review.<br>
> <br>
> <br>
> The issue with TLS 1.3 support, we are still investigating, any advice<br>
> will be pleasant.<br>
> <br>
> Best regards,<br>
> Yaroslav Pushko.<br>
> -- <br>
> Best Regards,<br>
> Yaroslav Pushko | Senior *Software Engineer*<br>
> GlobalLogic<br>
> P +380971842774  M +380634232226 S dithard<br>
> <a href="http://www.globallogic.com" rel="noreferrer" target="_blank">www.globallogic.com</a> <<a href="http://www.globallogic.com/" rel="noreferrer" target="_blank">http://www.globallogic.com/</a>><br>
> <a href="http://www.globallogic.com/email_disclaimer.txt" rel="noreferrer" target="_blank">http://www.globallogic.com/email_disclaimer.txt</a><br>
> <br>
> _______________________________________________<br>
> squid-users mailing list<br>
> <a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br>
> <a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br>
> <br>
<br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><font size="-1">Best Regards,<br><span style="vertical-align:baseline;font-variant:normal;font-style:normal;font-size:12px;background-color:transparent;text-decoration:none;font-family:Arial;font-weight:bold">Yaroslav Pushko | Senior </span></font><b style="font-family:arial,helvetica,sans-serif;font-size:12.8px"><span style="font-size:9.5pt;font-family:Arial,sans-serif;color:rgb(51,51,51)">Software Engineer</span></b><font size="-1"><br><span style="vertical-align:baseline;font-variant:normal;font-style:normal;font-size:12px;background-color:transparent;text-decoration:none;font-family:Arial;font-weight:normal">GlobalLogic</span><br><span style="vertical-align:baseline;font-variant:normal;font-style:normal;font-size:12px;background-color:transparent;text-decoration:none;font-family:Arial;font-weight:normal">P +380971842774  M +380634232226 S dithard</span><br><a href="http://www.globallogic.com/" target="_blank"><span style="font-size:12px;font-family:Arial;color:rgb(17,85,204);background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:underline;vertical-align:baseline">www.globallogic.com</span></a><span style="vertical-align:baseline;font-variant:normal;font-style:normal;font-size:12px;background-color:transparent;text-decoration:none;font-family:Arial;font-weight:normal"></span><br><a href="http://www.globallogic.com/" target="_blank"><span style="font-size:12px;font-family:Arial;color:rgb(17,85,204);background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:underline;vertical-align:baseline"></span></a><br><a href="http://www.globallogic.com/email_disclaimer.txt" target="_blank"><span style="font-size:11px;font-family:Arial;color:rgb(17,85,204);background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:underline;vertical-align:baseline">http://www.globallogic.com/email_disclaimer.txt</span></a><span style="vertical-align:baseline;font-variant:normal;font-style:normal;font-size:11px;background-color:transparent;text-decoration:none;font-family:Arial;font-weight:normal"></span></font></div></div></div></div></div></div></div></div></div></div></div></div></div>