[squid-users] Why 3.5.0.4 generates mimicked certs with server IP only when bumping?

Mon Jan 26 14:02:22 UTC 2015

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Raf,

wil be better to take a look on Squid source. My config similar
Daniel's, excluding bump options - I have 3.4.11 in production yet.

26.01.2015 19:37, Daniel Greenwald пишет:
> See below. Nothing else too interesting. Those four lines were the key.
>
> http_port 3128
> http_port 3180 intercept
> https_port 3443 intercept ssl-bump generate-host-certificates=on
dynamic_cert_mem_cache_size=16MB  cert=/usr/local/squid/ssl_cert/myCA.pem
> sslcrtd_program /usr/lib64/squid/ssl_crtd -s
/usr/local/squid/var/lib/ssl_db -M 16MB
> sslcrtd_children 10
> logformat dig %{%Y-%m-%d %H:%M:%S}tl  %6tr %>a %Ss/%03>Hs %<st %rm %ru
%un %Sh/%<A "%{User-Agent}>h"
> logfile_rotate 10
> access_log /var/log/squid/access.log dig
> pinger_enable off
>
> acl step1 at_step SslBump1
> acl step2 at_step SslBump2
> ssl_bump peek step1 all
> ssl_bump server-first step2 all
>
> acl SSL_ports port 443
> acl Safe_ports port 80 443 
> acl CONNECT method CONNECT
> http_access deny !Safe_ports
> http_access deny CONNECT !SSL_ports
>
> http_access allow localhost manager
> http_access deny manager
> http_access deny to_localhost
>
> http_access allow all
> http_access deny all
>
> # Uncomment and adjust the following to add a disk cache directory.
> #cache_dir ufs /var/spool/squid 100 16 256
>
> # Leave coredumps in the first cache dir
> coredump_dir /var/spool/squid
>
> #
> # Add any of your own refresh_pattern entries above these.
> #
> refresh_pattern ^ftp:        1440    20%    10080
> refresh_pattern ^gopher:    1440    0%    1440
> refresh_pattern -i (/cgi-bin/|\?) 0    0%    0
> refresh_pattern .        0    20%    4320
>
>
>
>
>
> -----------
> Daniel I Greenwald
>
>
>
> On Mon, Jan 26, 2015 at 3:28 AM, Rafael Akchurin
<rafael.akchurin at diladele.com <mailto:rafael.akchurin at diladele.com>> wrote:
>
>     Hello Daniel, Yuri
>
>
>     May be you could dump your whole squid.conf here (please remove
any sensitive details).
>
>     I still cannot understand once Squid has the target server
hostname from SNI - where is the acl/rule in squid.conf that can be used
with this info present?
>
>
>     Best regards,
>
>     Rafael
>
>
>     -------------------------
>     *From:* squid-users <squid-users-bounces at lists.squid-cache.org
<mailto:squid-users-bounces at lists.squid-cache.org>> on behalf of Daniel
Greenwald <dig at digcorp.net <mailto:dig at digcorp.net>>
>     *Sent:* Monday, January 26, 2015 5:39 AM
>     *To:* Yuri Voinov
>     *Cc:* squid-users at lists.squid-cache.org
<mailto:squid-users at lists.squid-cache.org>
>     *Subject:* Re: [squid-users] Why 3.5.0.4 generates mimicked certs
with server IP only when bumping?
>     
>     Thank you Amos,
>     Based on your explanation I was able to make bumping work for
transparent with no browser errors in 3.5.1 by using the following. If I
understand correctly, this is actually whats required to mimic the
behavior of pre 3.5 (sslbump server-first all) :
>
>     acl step1 at_step SslBump1
>     acl step2 at_step SslBump2
>     ssl_bump peek step1 all
>     ssl_bump server-first step2 all
>
>     Hope that helps Yuri or any one else with this issue.
>
>     PS So far this is working great for eg gmail.com
<http://gmail.com> which in previous version would throw browser errors!
>
>     -----------
>     Daniel I Greenwald
>
>
>
>     On Fri, Jan 9, 2015 at 2:51 PM, Yuri Voinov <yvoinov at gmail.com
<mailto:yvoinov at gmail.com>> wrote:
>
>
> How can that be?
>
> All HSTS sites cry with 3.5 bump option - they don't like host IP as CN,
> other sites behaviour depending they (and browsers) settings.
>
> Is it possible to keep server-first behaviour in 3.5.x ?
>
> WBR, Yuri
>
> 09.01.2015 16:57, Amos Jeffries пишет:
> > On 9/01/2015 11:45 p.m., Yuri Voinov wrote:
>
> > > I have working production 3.4.10 with working ssl bumping.
>
> > > Config was the same as working 3.4.10. I've just want to take a
> > > look on new release.
>
> > > in squid.documented said, than backward compatibility server-first
> > > and none options for ssl_bump are kept.
>
> > > But:
>
> > > Neither works with old syntax, nor new.
>
> > > Looks like target https hosts not resolved and bump got only IP.
>
> > The config values are still accepted, but there is an extra bumping
> > stage now before the SNI is available.
>
> > You are wanting to peek at stage 1 (to get the client SNI details) and
> > server-first/splice at stage 2 (using the domain). Otherwise All Squid
> > works with when intercepting are the TCP IPs.
>
> > Amos
>
>         _______________________________________________
>         squid-users mailing list
>         squid-users at lists.squid-cache.org
<mailto:squid-users at lists.squid-cache.org>
>         http://lists.squid-cache.org/listinfo/squid-users
>
>
>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBAgAGBQJUxkjtAAoJENNXIZxhPexGMv0IAKRe+oFmx+gpwwVQLja5iV0p
y0R/G6umiDx8P+frRn6TBZUmhFv9U0yBwjMFyl7NjFfQ4Oef6U4S+A90CdnPYbBO
rNSc9IfBh58ggBBVNJmZQR7jeb7/dJT8WAqTMW2481+Wh99TZIxEW8v8nfio2klP
HGdZpmpOVl7+4TQpG3Z+ssPXU+zFAWZ2QhUFmCyD29hey4Y0vcmxXUmJMapiz2Fh
CkRE0XA3TPtOwddbtPSShnBUsoo0GgBL/Pt2FD6s3DhZIltXl253b5YjK89TJkOR
fE/EYkVFxRvBr7ILyYR+kBtKyQUmnZHQJE9cGtkJ1/R2jWpj2v5Cs/4iWQx3mLg=
=6WHJ
-----END PGP SIGNATURE-----

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20150126/77fd321d/attachment-0001.html>