<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Hello,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We are attempting to leverage headers to isolate access to external sites with squid 4.14. The Loadbalencer is injecting headers and squid is simply verifying them:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">acl ACL_HDR_1 req_header Repo_Svr_VerifiedHdr True<o:p></o:p></p>
<p class="MsoNormal">acl REPO_DST_ALLOW dstdomain "/etc/squid/acls.d/hosts.acl"<o:p></o:p></p>
<p class="MsoNormal">http_access allow PROXY-SRC REPO_DST_ALLOW ACL_HDR_1<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We are currently decrypting this traffic and it’s working well.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Now we have a requirement to skip ssl decrypt for only certain destinations. My thought was to simply create a separate ACL where skipping ssl decrypt is required and add the header ACL to the end of the ssl_bump directive like so:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">acl Repo_Skip_HDR req_header Repo_Svr_VerifiedHdr True<o:p></o:p></p>
<p class="MsoNormal">acl Repo_SkipSslDecrypt dstdomain "/etc/squid/acls.d/hosts.acl"<o:p></o:p></p>
<p class="MsoNormal">ssl_bump none Repo_SkipSslDecrypt Repo_Skip_HDR<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">This parsed successfully but did not have the desired effect. The squid is still inspecting the traffic even with the header present as we can see in the logs. Making things a little more complex, the ssl_bump directive seems to have a
global effect and also imply “http_access allow” making it difficult isolate access. To get around this I thought to simply skip ssl decrypt for the traffic with verified headers:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">acl Repo_Skip_HDR req_header Repo_Svr_VerifiedHdr True<o:p></o:p></p>
<p class="MsoNormal">ssl_bump none Repo_Skip_HDR<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Unfortunately even this isn’t working, again the config checks out and runs happily, we see the header in the logs, but squid still tries to inspect the traffic.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Any thoughts on why ssl_bump would ignore the header ACL or other suggestions to isolate traffic when being required to skip ssl decrypt would be greatly appreciated.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks in advance.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Regards,<o:p></o:p></p>
<p class="MsoNormal">Matt Toler<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>