<div dir="ltr">Hi Alex,<div><br></div><div>Thanks for confirming this, it saved me lot of time :)</div><div><br></div><div>The reason why I wanted to try build squid5 with BoringSSL is - </div><div>1) Current squid build with OpenSSL is not showing transactional ciphers while browsing via chrome eg: (TLS_GREASE_DA), (TLS_GREASE_IS_THE_WORD_BA) --> is there any way to add these?</div><div>2) I am unable to supress Named group '<span style="color:rgb(33,47,62)">secp521r1' while going via this squid build on chrome browser. --> Is there any way to supress this?</span></div><div><span style="color:rgb(33,47,62)"><br></span></div><div>I am using - <a href="https://browserleaks.com/ssl">https://browserleaks.com/ssl</a> and <a href="https://www.howsmyssl.com">https://www.howsmyssl.com</a> to check above parameters.</div><div><br></div><div><span style="color:rgb(33,47,62)">I am using below configs with OpenSSL and it works fine except for above mentioned issues.</span></div><div><br></div><div>acl manager proto cache_object<br>acl localnet src <a href="http://10.0.0.0/8">10.0.0.0/8</a> # RFC1918 possible internal network<br>acl localnet src <a href="http://172.16.0.0/12">172.16.0.0/12</a> # RFC1918 possible internal network<br>acl localnet src <a href="http://192.168.0.0/16">192.168.0.0/16</a> # RFC1918 possible internal network<br>acl SSL_ports port 443<br>acl SSL_ports port 8443<br>acl Safe_ports port 80 # http<br>acl Safe_ports port 21 # ftp<br>acl Safe_ports port 443 # https<br>acl Safe_ports port 70 # gopher<br>acl Safe_ports port 210 # wais<br>acl Safe_ports port 1025-65535 # unregistered ports<br>acl Safe_ports port 280 # http-mgmt<br>acl Safe_ports port 488 # gss-http<br>acl Safe_ports port 591 # filemaker<br>acl Safe_ports port 777 # multiling http<br>acl Safe_ports port 8443 # multiling http<br>acl CONNECT method CONNECT<br>acl intermediate_fetching transaction_initiator certificate-fetching<br>http_access allow intermediate_fetching<br>http_access allow manager localhost<br>http_access deny manager<br>http_access deny !Safe_ports<br>http_access deny CONNECT !SSL_ports<br>acl blocked_sites ssl::server_name .<a href="http://apple.com">apple.com</a><br>acl amazon_deny dstdomain "/opt/squid/squid5/etc/blockdomains"<br>http_access allow localnet<br>http_access allow localhost<br>http_access deny blocked_sites<br>http_access deny amazon_deny<br>http_access allow all<br>http_port 443 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=512MB tls-cert=/opt/squid/squid5/etc/certs/ProxyBump.crt tls-key=/opt/squid/squid5/etc/certs/ProxyBump.key tls-dh=prime256v1:/opt/squid/squid5/etc/certs/ProxyBump.pem<br>sslcrtd_program /opt/squid/squid5/libexec/security_file_certgen -s /var/lib/squid/ssl_db -M 512MB<br>sslproxy_cert_error allow all<br>acl step1 at_step SslBump1<br>ssl_bump peek step1<br>ssl_bump bump all<br>ssl_bump splice all<br>tls_outgoing_options cipher=HIGH:!MEDIUM:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE<br>cache_mem 1024 MB<br>cache deny all<br>cache_dir aufs /opt/squid/squid5/var/cache/squid 1024 16 256<br>shutdown_lifetime 2 seconds<br>coredump_dir /opt/squid/squid5/var/cache/squid<br>refresh_pattern ^ftp: 1440 20% 10080<br>refresh_pattern ^gopher: 1440 0% 1440<br>refresh_pattern -i (/cgi-bin/|\?) 0 0% 0<br>refresh_pattern . 0 20% 4320<br>cache_peer 10.12.11.2 parent 8080 0 no-query default login=abc:abc@123<br>never_direct allow all</div><div>server_persistent_connections off<br>logfile_rotate 30<br>via off<br>forwarded_for delete<br>visible_hostname localhost</div><div>logformat squid %ts.%03tu %6tr %>a %Ss/%03>Hs %<st %rm %ru %[un %Sh/%<A %mt %>h %Se %>sh<br>logformat extended %tl %6tr %>a %Ss/%03Hs %<st %rm %ru %un %Sh/%<A %mt %Hs %<st "%{Referer}>h" "%{User-agent}>h"<br>cache_log /opt/squid/squid5/var/logs/cache.log<br>acl hasRequest has request</div><div>access_log none !hasRequest<br>access_log stdio:/opt/squid/squid5/var/logs/access.log<br>access_log stdio:/opt/squid/squid5/var/logs/access.log.mitm extended<br>pid_filename /opt/squid/squid5/var/run/squid.pid<br>max_filedescriptors 5000<span style="color:rgb(33,47,62)"><br></span></div><div><br></div><div>Any help is appreciated. Thanks in advance!</div><div><br></div><div>Thanks,</div><div>Vinod</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, May 4, 2021 at 2:12 AM Alex Rousskov <<a href="mailto:rousskov@measurement-factory.com">rousskov@measurement-factory.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hello Vinod,<br>
<br>
Squid does not support BoringSSL, and we will not add such support<br>
in the foreseeable future. We have more than enough troubles with GnuTLS<br>
support and not enough resources to support a yet another TLS library,<br>
especially the one that is not meant for general use[1]!<br>
<br>
[1] <a href="https://boringssl.googlesource.com/boringssl/" rel="noreferrer" target="_blank">https://boringssl.googlesource.com/boringssl/</a><br>
Although BoringSSL is an open source project, it is not intended for<br>
general use, as OpenSSL is. We don't recommend that third parties depend<br>
upon it. Doing so is likely to be frustrating because there are no<br>
guarantees of API or ABI stability.<br>
<br>
<br>
HTH,<br>
<br>
Alex.<br>
<br>
<br>
On 5/3/21 4:10 PM, vinod mg wrote:<br>
> Hi Team,<br>
> <br>
> I have followed<br>
> - <a href="https://www.interserver.net/tips/kb/openssl-vs-boringssl-boringssl-install-boringssl/" rel="noreferrer" target="_blank">https://www.interserver.net/tips/kb/openssl-vs-boringssl-boringssl-install-boringssl/</a><br>
> <<a href="https://www.interserver.net/tips/kb/openssl-vs-boringssl-boringssl-install-boringssl/" rel="noreferrer" target="_blank">https://www.interserver.net/tips/kb/openssl-vs-boringssl-boringssl-install-boringssl/</a>><br>
> and was able to install in server's /home/src/boringssl<br>
> <br>
> while configuring squid I am using below options - <br>
> <br>
> ./configure '--prefix=/opt/boring/squid5'<br>
> '--with-openssl=/home/src/boringssl' '--enable-ssl-crtd'<br>
> '--with-filedescriptors=3276800' '--enable-storeio=diskd,aufs,ufs'<br>
> '--with-large-files' '--enable-useragent-log'<br>
> '--enable-ltdl-convenience' '--with-tls' '--enable-http-violations'<br>
> <br>
> <br>
> while running 'make' I am getting below error, and I am not able to find<br>
> solution for this.<br>
> <br>
> In file included from ../../src/ssl/support.h:21,<br>
> <br>
> from ../../src/SquidConfig.h:29,<br>
> <br>
> from old_api.cc:24:<br>
> <br>
> ../../src/ssl/gadgets.h:56:25: error: ‘TXT_DB’ was not declared in this<br>
> scope<br>
> <br>
> typedef std::unique_ptr<TXT_DB, HardFun<void, TXT_DB*, &TXT_DB_free>><br>
> TXT_DB_Pointer;<br>
> <br>
> ../../src/ssl/gadgets.h:56:47: error: ‘TXT_DB’ was not declared in this<br>
> scope<br>
> <br>
> typedef std::unique_ptr<TXT_DB, HardFun<void, TXT_DB*, &TXT_DB_free>><br>
> TXT_DB_Pointer;<br>
> <br>
> ../../src/ssl/gadgets.h:56:68: error: template argument 2 is invalid<br>
> <br>
> typedef std::unique_ptr<TXT_DB, HardFun<void, TXT_DB*, &TXT_DB_free>><br>
> TXT_DB_Pointer;<br>
> <br>
> ../../src/ssl/gadgets.h:56:68: error: template argument 3 is invalid<br>
> <br>
> ../../src/ssl/gadgets.h:56:71: error: template argument 1 is invalid<br>
> <br>
> typedef std::unique_ptr<TXT_DB, HardFun<void, TXT_DB*, &TXT_DB_free>><br>
> TXT_DB_Pointer;<br>
> <br>
> ../../src/ssl/gadgets.h:56:71: error: template argument 2 is invalid<br>
> <br>
> ../../src/ssl/gadgets.h:56:1: error: ‘typedef’ was ignored in this<br>
> declaration [-Werror]<br>
> <br>
> typedef std::unique_ptr<TXT_DB, HardFun<void, TXT_DB*, &TXT_DB_free>><br>
> TXT_DB_Pointer;<br>
> <br>
> cc1plus: all warnings being treated as errors<br>
> <br>
> make[3]: *** [Makefile:840: old_api.lo] Error 1<br>
> <br>
> make[3]: Leaving directory '/tmp/squid-5.0.5/src/mem'<br>
> <br>
> make[2]: *** [Makefile:6851: all-recursive] Error 1<br>
> <br>
> make[2]: Leaving directory '/tmp/squid-5.0.5/src'<br>
> <br>
> make[1]: *** [Makefile:5840: all] Error 2<br>
> <br>
> make[1]: Leaving directory '/tmp/squid-5.0.5/src'<br>
> <br>
> make: *** [Makefile:593: all-recursive] Error 1<br>
> <br>
> <br>
> My node is running on - CentOS Linux release 8.3.2011<br>
> Squid version - 5.0.4<br>
> Installed Openssl version - OpenSSL 1.1.1g FIPS 21 Apr 2020<br>
> <br>
> Thanks,<br>
> Vinod<br>
> <br>
> _______________________________________________<br>
> squid-users mailing list<br>
> <a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br>
> <a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br>
> <br>
<br>
</blockquote></div>