<!DOCTYPE html>
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hi,</p>
<p>I'm configuring squid as a transparent proxy where local outbound
traffic is redirect to a local squid process using tproxy.</p>
<p>I would like to limit the domains the host can contact by having
an allow list. I have the following config file:</p>
<p><span style="font-family:monospace"><span
style="color:#000000;background-color:#ffffff;">------<br>
</span></span></p>
<p><span style="font-family:monospace"><span
style="color:#000000;background-color:#ffffff;">acl
allowed_clients src "/etc/squid/allowed_clients"
</span></span></p>
<p><span style="font-family:monospace"></span></p>
<span style="font-family:monospace">acl allowed_domains dstdomain
"/etc/squid/allowed_domains"
<br>
<br>
acl SSL_ports port 443
<br>
acl Safe_ports port 80
<br>
acl Safe_ports port 443
<br>
acl CONNECT method CONNECT
<br>
<br>
acl step1 at_step SslBump1
<br>
acl step2 at_step SslBump2
<br>
acl step3 at_step SslBump3
<br>
<br>
# Additional access control lists
<br>
acl https_domains ssl::server_name "/etc/squid/allowed_domains"
<br>
<br>
# Deny requests to certain unsafe ports
<br>
http_access deny !Safe_ports
<br>
<br>
# Deny CONNECT to other than secure SSL ports
<br>
http_access deny CONNECT !SSL_ports
<br>
<br>
# Only allow cachemgr access from localhost
<br>
http_access allow localhost manager
<br>
http_access deny manager
<br>
<br>
# We strongly recommend the following be uncommented to protect
innocent
<br>
# web applications running on the proxy server who think the only
<br>
# one who can access services on "localhost" is a local user
<br>
http_access deny to_localhost
<br>
<br>
#
<br>
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
<br>
#
<br>
http_access allow allowed_clients allowed_domains
<br>
http_access allow allowed_clients CONNECT
<br>
<br>
# Example rule allowing access from your local networks.
<br>
# Adapt localnet in the ACL section to list your (internal) IP
networks
<br>
# from where browsing should be allowed
<br>
#http_access allow localnet
<br>
#http_access allow localhost
<br>
<br>
# And finally deny all other access to this proxy
<br>
http_access deny all
<br>
<br>
# Squid normally listens to port 3128
<br>
http_port 3128
<br>
http_port 3129 tproxy
<br>
https_port 3130 tproxy ssl-bump cert=/etc/squid/cert/local_ca.pem
<br>
<br>
# SSL bump configuration
<br>
ssl_bump peek step1
<br>
ssl_bump peek step2 https_domains
<br>
ssl_bump splice step3 https_domains
<br>
ssl_bump terminate all<br>
<br>
</span>
<p><span style="font-family:monospace"><span
style="color:#000000;background-color:#ffffff;">------</span></span></p>
<p><span style="color:#000000;background-color:#ffffff;">When the
Host header in an intercepted request matches a domain on the
allowed_domains list, the request is allowed. Otherwise it's
denied as expected.</span></p>
<p><span style="color:#000000;background-color:#ffffff;">But squid
doesn't seem to validate that the IP address we're connecting to
is valid for the specified name in the SNI header?</span></p>
<p><span style="color:#000000;background-color:#ffffff;">For
example, if I add "wordpress.org" to my allowed_domains list,
the following request is allowed:</span></p>
<p><span style="font-family:monospace"><span
style="color:#000000;background-color:#ffffff;">curl -v
<a class="moz-txt-link-freetext" href="https://wordpress.org">https://wordpress.org</a> --connect-to
wordpress.org:443:8.8.8.8:443</span><br>
</span></p>
<p><span style="color:#000000;background-color:#ffffff;">8.8.8.8 is
not a valid IP address for wordpress.org. This could be used to
bypass the restrictions.</span></p>
<p><span style="color:#000000;background-color:#ffffff;">Is there an
option in squid to make it perform a forward DNS lookup for the
domain from the SNI information from step1 to validate that the
IP address we're trying to connect to is actually valid for that
host? In the example above, a DNS lookup for wordpress.org would
return 198.143.164.252 as the IP address. This is not the IP
address we're trying to connect to, so squid should block the
request.</span></p>
<p><span style="color:#000000;background-color:#ffffff;">Similar
question for the server certificate: I've configured the
'ssl_bump peek step2 https_domains' line so squid can peek at
the server certificate. Is there a way to configure squid to
validate that the server certificate is valid for the host
specified in the SNI header?<br>
</span></p>
<p><span style="color:#000000;background-color:#ffffff;"><br>
</span></p>
<p><span style="color:#000000;background-color:#ffffff;">Regards,</span></p>
<p><span style="color:#000000;background-color:#ffffff;">Rik<br>
</span></p>
</body>
</html>