<div dir="rtl"><div>ב"ה</div><div><br></div><div dir="ltr">I managed to get the ssl splice configurations to work but when I'm splicing for example: <a href="http://play.google.com">play.google.com</a></div><div dir="ltr"><br></div><div dir="ltr">I see in cache log the following:</div><div dir="ltr"><br></div><div dir="ltr">2023/08/29 22:54:53.688 kid1| 33,2| client_side.cc(3214) fakeAConnectRequest: fake a CONNECT request to force connState to tunnel for ssl-bump<br>2023/08/29 22:54:53.700 kid1| 33,2| client_side.cc(3214) fakeAConnectRequest: fake a CONNECT request to force connState to tunnel for splice<br>2023/08/29 22:54:53 kid1| SECURITY ALERT: Host header forgery detected on conn3362 local=<a href="http://172.217.22.110:443">172.217.22.110:443</a> remote=<a href="http://192.168.26.100:55331">192.168.26.100:55331</a> FD 540 flags=17 (local IP does not match any domain IP)<br> current master transaction: master2737<br>2023/08/29 22:54:53 kid1| SECURITY ALERT: on URL: <a href="http://play.google.com:443">play.google.com:443</a><br></div><div dir="ltr"><br></div><div dir="ltr">The host header forgery issue for <a href="http://play.google.com">play.google.com</a> is observed only for spliced connections, but when this url is bumped I don't see this error.</div><div dir="ltr">Why is splicing making this error?</div><div dir="ltr"><br></div><div dir="ltr"><br></div><div dir="ltr"> <br></div></div><br><div class="gmail_quote"><div dir="rtl" class="gmail_attr">בתאריך יום ב׳, 28 באוג׳ 2023 ב-13:54 מאת Ben Goz <<a href="mailto:ben.goz87@gmail.com">ben.goz87@gmail.com</a>>:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="rtl">ב"ה<div><br></div><div dir="ltr">I'm using squid version:</div><div dir="ltr">nativ@arachimprodsrv3:/usr/local/squid/etc$ /usr/local/squid/sbin/squid -v<br>Squid Cache: Version 6.1-VCS<br>Service Name: squid<br><br>This binary uses OpenSSL 3.0.2 15 Mar 2022. configure options: '--with-large-files' '--with-openssl' '--enable-ssl' '--enable-ssl-crtd' '--enable-icap-client' '--enable-linux-netfilter' '--disable-ident-lookups'<br></div><div dir="ltr"><br></div><div dir="ltr">Configured with ssl_bump and tproxy:</div><div dir="ltr">http_port <a href="http://0.0.0.0:3128" target="_blank">0.0.0.0:3128</a><br>http_port <a href="http://0.0.0.0:3129" target="_blank">0.0.0.0:3129</a> tproxy<br>https_port <a href="http://0.0.0.0:3130" target="_blank">0.0.0.0:3130</a> tproxy ssl-bump \<br> cert=/usr/local/squid/etc/ssl_cert/myCA.pem \<br> generate-host-certificates=on dynamic_cert_mem_cache_size=4MB options=ALL,NO_SSLv3 sslflags=NO_DEFAULT_CA<br></div><div dir="ltr"><br></div><div dir="ltr">And the following configurations:</div><div dir="ltr">acl NoSSLInterceptRegexp_always ssl::server_name "splice.list"<br>always_direct allow all<br>on_unsupported_protocol tunnel<br>acl DiscoverSNIHost at_step SslBump1<br>ssl_bump splice NoSSLInterceptRegexp_always<br>ssl_bump peek DiscoverSNIHost<br>ssl_bump bump all<br></div><div dir="ltr"><br></div><div dir="ltr">the content of the file splice.list:</div><div dir="ltr">.<a href="http://prog.co.il" target="_blank">prog.co.il</a></div><div dir="ltr"><a href="http://prog.co.il" target="_blank">prog.co.il</a><br><a href="http://www.prog.co.il" target="_blank">www.prog.co.il</a><br>.<a href="http://shipuzim.info" target="_blank">shipuzim.info</a><br></div><div dir="ltr"><br></div><div dir="ltr">The tproxy redirections works fine with squid server but unfortunately the urls in splice.list bumped although they should be spliced as seen in the access log:</div><div dir="ltr"><br></div><div dir="ltr">1693219853.255 626 192.168.28.254 TCP_MISS/200 64439 GET <a href="https://www.prog.co.il/" target="_blank">https://www.prog.co.il/</a> - HIER_DIRECT/<a href="http://172.67.196.36" target="_blank">172.67.196.36</a> text/html</div><div dir="ltr"><br></div><div dir="ltr">And I see in the browser's certificate viewer my squid self signed certificate.</div><div dir="ltr"><br></div><div dir="ltr">What am I missing here?</div><div dir="ltr"><br></div><div dir="ltr">Thanks,</div><div dir="ltr">Ben</div><div dir="ltr"><br></div><div dir="ltr"> </div><div dir="ltr"><br></div><div dir="ltr"><br></div><div dir="ltr"><br></div><div dir="ltr"><br></div></div>
</blockquote></div>