<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi,
<div><br>
</div>
<div>I'm currently trying to configure transparent SSL proxying and running into a strange error that has me scratching my head for hours. I'm using Squid 4.11 (I also tried this with 4.12) with SSL support from here - http://squid411.diladele.com/ubuntu/ on
Ubuntu 18.04.</div>
<div><br>
</div>
<div>I set up the necessary iptables forwarding ports and SSL certificates and it sometimes works (as you will see below).</div>
<div><br>
</div>
<div>My current configuration adds just the following to the default squid.conf file:</div>
<div><br>
</div>
<div># INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS</div>
<div>#</div>
<div>include /etc/squid/conf.d/*</div>
<div><br>
</div>
<div># Example rule allowing access from your local networks.</div>
<div># Adapt localnet in the ACL section to list your (internal) IP networks</div>
<div># from where browsing should be allowed</div>
<div>#http_access allow localnet</div>
<div>debug_options ALL,1, 33,2 2 28,9</div>
<div><br>
</div>
<div>http_port 3129 intercept</div>
<div>https_port 3130 intercept ssl-bump cert=/etc/squid/ssl_cert/squid-ca.pem generate-host-certificates=on dynamic_cert_mem_cache_size=4MB</div>
<div>sslcrtd_program /usr/lib/squid/security_file_certgen -s /var/lib/ssl_db -M 4MB</div>
<div><br>
</div>
<div>acl whitelist ssl::server_name .httpbin.org</div>
<div>acl whitelist_http ssl::server_name .httpbin.org</div>
<div><br>
</div>
<div>acl step1 at_step SslBump1</div>
<div>acl step2 at_step SslBump2</div>
<div>acl step3 at_step SslBump3</div>
<div>ssl_bump peek step1</div>
<div>ssl_bump splice all</div>
<div><br>
</div>
<div>http_access allow whitelist</div>
<div>http_access allow whitelist_http</div>
<div><br>
</div>
<div># And finally deny all other access to this proxy</div>
<div>http_access deny all</div>
<div><br>
</div>
<div>so the above configuration should allow anyone with access to the Squid proxy access to httpbin.org over both HTTP and HTTPS</div>
<div><br>
</div>
<div>when I try to access:</div>
<div><br>
</div>
<div>http://httpbin.org (not SSL)</div>
<div><br>
</div>
<div>it works</div>
<div><br>
</div>
<div>when I try to access:</div>
<div><br>
</div>
<div>https://httpbin.org</div>
<div><br>
</div>
<div>it fails as shown below (I'm running this on the Squid proxy machine itself):</div>
<div><br>
</div>
<div>$ wget https://httpbin.org</div>
<div>--2020-08-24 17:48:34-- https://httpbin.org/</div>
<div>Resolving httpbin.org (httpbin.org)... 54.236.246.173, 3.220.112.94</div>
<div>Connecting to httpbin.org (httpbin.org)|54.236.246.173|:443... connected.</div>
<div>ERROR: cannot verify httpbin.org's certificate, issued by ‘O=Internet Widgits Pty Ltd,ST=Some-State,C=AU’:</div>
<div> Self-signed certificate encountered.</div>
<div>To connect to httpbin.org insecurely, use `--no-check-certificate'.</div>
<div><br>
</div>
<div>$ wget https://httpbin.org --no-check-certificate</div>
<div>--2020-08-24 17:48:40-- https://httpbin.org/</div>
<div>Resolving httpbin.org (httpbin.org)... 3.220.112.94, 54.236.246.173</div>
<div>Connecting to httpbin.org (httpbin.org)|3.220.112.94|:443... connected.</div>
<div>WARNING: cannot verify httpbin.org's certificate, issued by ‘O=Internet Widgits Pty Ltd,ST=Some-State,C=AU’:</div>
<div> Self-signed certificate encountered.</div>
<div>HTTP request sent, awaiting response... 403 Forbidden</div>
<div>2020-08-24 17:48:40 ERROR 403: Forbidden.</div>
<div><br>
</div>
<div>looking at access.log shows:</div>
<div><br>
</div>
<div>1598305800.974 2 192.168.123.214 TCP_DENIED/200 0 CONNECT 54.236.246.173:443 - HIER_NONE/- -</div>
<div><br>
</div>
<div>for the first request (without the --no-check-certificate) and the following for the 2nd request (with the --no-check-certificate):</div>
<div><br>
</div>
<div>1598305812.292 3 192.168.123.214 TCP_DENIED/200 0 CONNECT 54.236.246.173:443 - HIER_NONE/- -</div>
<div>1598305812.300 2 192.168.123.214 NONE/403 3795 GET https://httpbin.org/ - HIER_NONE/- text/html</div>
<div><br>
</div>
<div>looking at cache.log shows:</div>
<div><br>
</div>
<div># cat /var/log/squid/cache.log | grep -i "28" | grep -i httpbin</div>
<div>2020/08/24 17:50:00.972 kid1| 28,7| ServerName.cc(32) aclHostDomainCompare: Match:54.236.246.173 <> .httpbin.org</div>
<div>2020/08/24 17:50:00.972 kid1| 28,7| ServerName.cc(32) aclHostDomainCompare: Match:54.236.246.173 <> .httpbin.org</div>
<div>2020/08/24 17:50:12.290 kid1| 28,7| ServerName.cc(32) aclHostDomainCompare: Match:54.236.246.173 <> .httpbin.org</div>
<div>2020/08/24 17:50:12.290 kid1| 28,7| ServerName.cc(32) aclHostDomainCompare: Match:54.236.246.173 <> .httpbin.org</div>
<div><br>
</div>
<div>so it never matches on the httpbin.org</div>
<div><br>
</div>
<div>now, if I add the following line to my configuration:</div>
<div><br>
</div>
<div>http_access allow localnet</div>
<div><br>
</div>
<div>right before the:</div>
<div><br>
</div>
<div>http_access deny all</div>
<div><br>
</div>
<div>line it works and I see the following in access.log:</div>
<div><br>
</div>
<div>1598305979.004 4 192.168.123.214 NONE/200 0 CONNECT 54.236.246.173:443 - HIER_NONE/- -</div>
<div>1598305980.016 1012 192.168.123.214 TCP_TUNNEL/200 15370 CONNECT httpbin.org:443 - ORIGINAL_DST/54.236.246.173 -</div>
<div><br>
</div>
<div>and I see the following in cache.log:</div>
<div><br>
</div>
<div># cat /var/log/squid/cache.log | grep -i "28" | grep -i httpbin</div>
<div>2020/08/24 17:52:59.000 kid1| 28,7| ServerName.cc(32) aclHostDomainCompare: Match:54.236.246.173 <> .httpbin.org</div>
<div>2020/08/24 17:52:59.000 kid1| 28,7| ServerName.cc(32) aclHostDomainCompare: Match:54.236.246.173 <> .httpbin.org</div>
<div>2020/08/24 17:52:59.005 kid1| 28,3| RegexData.cc(43) match: checking 'httpbin.org:443'</div>
<div>2020/08/24 17:52:59.005 kid1| 28,3| ServerName.cc(42) match: checking 'httpbin.org'</div>
<div>2020/08/24 17:52:59.005 kid1| 28,7| ServerName.cc(32) aclHostDomainCompare: Match:httpbin.org <> .httpbin.org</div>
<div>2020/08/24 17:52:59.005 kid1| 28,3| ServerName.cc(47) match: 'httpbin.org' found</div>
<div><br>
</div>
<div>What's puzzling is why adding the 'allow localnet' line changes the ACL logic for .httpbin.org and why the original configuration does not work. Any ideas? Thanks</div>
<div><br>
</div>
<div>PS. I reproduced the exact same scenario on Ubuntu 20.04 with Squid 4.12</div>
<br>
<br>
</div>
</body>
</html>