<div dir="ltr"><div>Just got it solved. Was caused because of checking default access.log. Using a new file solves all the problems. <br></div><div><br></div><div>However, in this context, what means TCP_TUNNEL/500? is it because the TLS handshake? I would like to know if it is tunneling correctly or is having some trouble (not easy to test right now).</div><div><br></div><div>Thanks!<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">El mar, 29 nov 2022 a las 13:16, Gabriel Vilariño (<<a href="mailto:gvilarino6@gmail.com">gvilarino6@gmail.com</a>>) escribió:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>Hi there,</div><div><br></div><div>I am setting up an HTTP/HTTPS transparent proxy, meaning the clients not need any certificates for using the proxy. This works fine on version 3.5 of Squid, however after upgrading to 5.7 the behavior of the logs change:</div><div><br></div><div>1669723133.174 8037 10.184.19.220 TCP_TUNNEL/500 6207 CONNECT <a href="http://54.240.253.128:443" target="_blank">54.240.253.128:443</a> - ORIGINAL_DST/<a href="http://54.240.253.128" target="_blank">54.240.253.128</a> -</div><div><br></div><div>Directive: logformat squid %ts.%03tu %>a %Ss/%03>Hs %ssl::>sni %ssl::bump_mode ssl::>cert_subject %<ru</div><div><br></div><div>On version 3.5 we were obtaining the domain name (an aws service) in the place of ORIGINAL_DST. Also now we are not seeing any information about the bump_mode in no one of the connections while before we were seeing it. One could trough that it could be because of the /500 message, however on a 200 one to <a href="http://docs.ansble.com" target="_blank">docs.ansble.com</a> it also don´t show any data on the sni field:</div><div><br></div><div>1669723513.363 332 10.184.19.220 TCP_TUNNEL/200 38192 CONNECT <a href="http://104.26.0.234:443" target="_blank">104.26.0.234:443</a> - ORIGINAL_DST/<a href="http://104.26.0.234" target="_blank">104.26.0.234</a> -</div><div><br></div><div>Also the 500 looks to come from the squid not understanding something on the SSL negotiation:<br></div><div><br></div><span><span><span><code style="white-space:pre-wrap"><span>2022/11/29 10:32:38.943 kid1| 83,4| support.cc(248) check_domain: Verifying server domain <a href="http://arsenal.us-west-2.amazonaws.com" target="_blank">arsenal.us-west-2.amazonaws.com</a> to certificate name/subjectAltName <a href="http://arsenal.us-west-2.amazonaws.com" target="_blank">arsenal.us-west-2.amazonaws.com</a>
</span></code></span></span></span><span><span><span><code style="white-space:pre-wrap">2022/11/29 10:32:38.943 kid1| 83,5| bio.cc(136) read: FD 28 read 347 <= 65535
</code></span></span></span><span><span><span><code style="white-space:pre-wrap">2022/11/29 10:32:38.943 kid1| 83,5| Io.cc(91) Handshake: -1/0 for TLS connection 0x558453168970 over conn99 local=SQUID-INTERNAL-IP:44264 remote=<a href="http://54.240.251.223:443" target="_blank">54.240.251.223:443</a> ORIGINAL_DST FD 28 flags=1
</code></span></span></span><span><span><span><code style="white-space:pre-wrap">2022/11/29 10:32:38.943 kid1| 83,2| PeerConnector.cc(256) handleNegotiationResult: ERROR: failure while establishing TLS connection on FD: 280x558452b68980*1
</code></span></span></span><span><span><span><code style="white-space:pre-wrap">2022/11/29 10:32:38.943 kid1| 83,5| NegotiationHistory.cc(85) retrieveNegotiatedInfo: SSL connection info on FD 28 SSL version NONE/0.0 negotiated cipher
</code></span></span></span><span><span><span><code style="white-space:pre-wrap">2022/11/29 10:32:38.943 kid1| 83,5| PeekingPeerConnector.cc(84) checkForPeekAndSpliceMatched: Will check for peek and splice on FD 28
</code></span></span></span><span><span><span><code style="white-space:pre-wrap">2022/11/29 10:32:38.943 kid1| 83,5| PeekingPeerConnector.cc(395) serverCertificateVerified: HTTPS server CN: <a href="http://arsenal.us-west-2.amazonaws.com" target="_blank">arsenal.us-west-2.amazonaws.com</a> bumped: conn99 local=SQUID-INTERNAL-IP:44264 remote=<a href="http://54.240.251.223:443" target="_blank">54.240.251.223:443</a> ORIGINAL_DST FD 28 flags=1
</code></span></span></span><div><span><span><span><code style="white-space:pre-wrap">2022/11/29 10:32:38.943 kid1| 83,5| PeekingPeerConnector.cc(273) startTunneling: will tunnel instead of negotiating TLS</code></span></span></span></div><div><br></div><div>It is clear that in creates the tunnel so the 500 probably is that error? Why the bump/sni messages never log anything (according to <a href="https://wiki.squid-cache.org/Features/SslPeekAndSplice" target="_blank">https://wiki.squid-cache.org/Features/SslPeekAndSplice</a> they should log splice not -). This is the config for bumping:</div><div><br></div><div><br></div><div><br></div><div>acl step1 at_step SslBump1<br>acl step2 at_step SslBump2<br>acl step3 at_step SslBump3<br>ssl_bump peek step1 all</div><div><br></div><div>.... http rules ...<br></div><div><br></div><div>acl allowed_https_sites ssl::server_name_regex "/etc/squid/whitelist.txt"<br>ssl_bump peek step2 allowed_https_sites<br>ssl_bump splice step3 allowed_https_sites<br>ssl_bump terminate step2 all</div><div><br></div><div><br></div><div><br></div><div><br></div><div>Ip tables simply redirect:</div><div><br></div><div>iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 3129</div><div>iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 3130 # https port on squid: https_port 3130 intercept ssl-bump cert=/etc/squid/ssl/dummy.pem</div><div><br></div><div>Thanks in advance, i have been trying this for a week now reading a lot of posts but not luck...<br></div></div>
</blockquote></div>