<div id="__MailbirdStyleContent" style="font-size: 10pt;font-family: Arial;color: #000000">
<br><div class="mb_sig"></div>
<blockquote class="history_container" type="cite" style="border-left-style: solid;border-width: 1px;margin-top: 20px;margin-left: 0px;padding-left: 10px;min-width: 500px">
<p style="color: #AAAAAA; margin-top: 10px;">On 05-Jun-20 00:11:44, Alex Rousskov <rousskov@measurement-factory.com> wrote:</p><div style="font-family:Arial,Helvetica,sans-serif">On 6/4/20 4:21 PM, J. Dierkse wrote:
<br>
<br>> I use it to intercept HTTP and HTTPS traffic in my network, and based on
<br>> several ACLs forward it to different peer proxies.
<br>> This is where the DNS load balancing trickery becomes a hassle for HTTPS
<br>> connections;
<br>
<br>> What I would like to do is if the request hostname matches an ACL
<br>> (dstdomain or ssl::server_name), only do a splice for all ssl_bump
<br>> steps.
<br>
<br>That goal needs polishing or rephrasing -- one cannot splice more than
<br>once -- but I think I know what you mean.
<br>
</div></blockquote><div><span style="font-size: 10pt;font-family: Arial;color: #000000"><span style="color: #3B5998"><br></span></span><div style="font-size: 13.3333px">Correct, of course splice is the end of the chain, my bad.</div><div style="font-size: 13.3333px">The main thing I want to achieve is to setup the connection through different types of privacy proxies, depending on the target domain.</div><div style="font-size: 13.3333px">For this I don't really need bumping, if I understand the protocol correctly, I just need to peek to check what the target domain is.</div><div style="font-size: 13.3333px">Unfortunately, peeking has the side effect of detecting false-positive host forgery errors, due to Microsoft's DNS load balancing strategy.</div></div><blockquote class="history_container" type="cite" style="border-left-style: solid;border-width: 1px;margin-top: 20px;margin-left: 0px;padding-left: 10px;min-width: 500px"><div style="font-family:Arial,Helvetica,sans-serif"><br>
<br>> Otherwise do a peek for step1 and a splice afterwards.
<br>
<br>
<br>Here is a sketch for v5. Sorry, I do not remember if v4 is equally
<br>capable (but it very well may be):
<br>
<br> # splice as soon as we detect specialHost
<br> ssl_bump splice specialHost
<br> # peek to get more info if needed
<br> ssl_bump peek all
<br> # optional: splice if we never detect specialHost
<br> ssl_bump splice all
<br>
<br>... where specialHost is an ssl::server_name ACL.
<br>
</div></blockquote><div><span style="font-size: 10pt;font-family: Arial;color: #000000"><span style="color: #3B5998"><br></span></span><div style="font-size: 13.3333px"><span style="font-size: 10pt">I tried this configuration, but it doesn't give the desired effect.</span></div><div style="font-size: 13.3333px">In 4.11 it doesn't seem to splice at all, but bump for some reason (is it correct not to refer to any bump steps?)</div></div><blockquote class="history_container" type="cite" style="border-left-style: solid;border-width: 1px;margin-top: 20px;margin-left: 0px;padding-left: 10px;min-width: 500px"><div style="font-family:Arial,Helvetica,sans-serif"><br>
<br>> without having to build a version of squid with the host forgery detection turned
<br>> off...? :))
<br>
<br>Those errors are a separate issue. Even the best possible ssl_bump
<br>configuration can trigger them. They have been discussed many times on
<br>this list before but if you have some new questions about them, please ask.
<br>
</div></blockquote><div><span style="font-size: 10pt;font-family: Arial;color: #000000"><span style="color: #3B5998"><br></span></span><div style="font-size: 13.3333px"><span style="font-size: 10pt">I know these errors have been a hot topic, and from what I can find (also in this mailing list) is that it should not block the connection.</span></div><div style="font-size: 13.3333px"><span style="font-size: 10pt">Frankly, I couldn't care less about the errors themselves, as long as the connection is still allowed.</span></div><div style="font-size: 13.3333px"><span style="font-size: 10pt">However, this is not what I'm experiencing. What I'm seeing is that when the error occurs, my outlook apps can no longer connect to the server.</span></div><div style="font-size: 13.3333px">What am I doing wrong...?</div><div style="font-size: 13.3333px"><br></div><div style="font-size: 13.3333px"><br></div><div style="font-size: 13.3333px">Thanks!</div><div style="font-size: 13.3333px"><br></div><div style="font-size: 13.3333px"><br></div><div style="font-size: 13.3333px">J. Dierkse</div></div><blockquote class="history_container" type="cite" style="border-left-style: solid;border-width: 1px;margin-top: 20px;margin-left: 0px;padding-left: 10px;min-width: 500px"><div style="font-family:Arial,Helvetica,sans-serif"><br>
<br>HTH,
<br>
<br>Alex.
<br>
<br>
<br>
<br>
<br>>
<br>> The relevant portion of my configuration is as follows.
<br>>
<br>> -snip-
<br>>
<br>> acl local dst 192.168.0.0/16
<br>>
<br>> acl microsoft dstdomain .microsoft.com
<br>> acl microsoft dstdomain .teams.microsoft.com
<br>> acl microsoft dstdomain .office365.com
<br>> acl microsoft dstdomain .office.com
<br>> acl microsoft dstdomain .office.net
<br>> acl microsoft dstdomain .outlook.com
<br>>
<br>> http_port 3128
<br>> http_port 3129 intercept
<br>> https_port 3130 intercept ssl-bump cert=/etc/certificates/SquidCA.pem
<br>> key=/etc/certificates/SquidCA.pem
<br>>
<br>> sslcrtd_program /usr/lib/squid/security_file_certgen -s /var/lib/ssl_db
<br>> -M 16MB
<br>> sslcrtd_children 8 startup=1 idle=1
<br>>
<br>> acl step1 at_step SslBump1
<br>> acl step2 at_step SslBump2
<br>> acl step3 at_step SslBump3
<br>>
<br>> ssl_bump peek step1 !microsoft !local
<br>> ssl_bump splice step2 !microsoft !local
<br>> ssl_bump splice step3 !microsoft !local
<br>>
<br>> -snip-
<br>>
<br>> Thanks!
<br>>
<br>>
<br>> Best Regards,
<br>>
<br>>
<br>> J. Dierkse
<br>>
<br>> _______________________________________________
<br>> squid-users mailing list
<br>> squid-users@lists.squid-cache.org
<br>> http://lists.squid-cache.org/listinfo/squid-users
<br>>
<br>
<br></div></blockquote></div>