[squid-users] Ssl-bump deep dive (intercept last post and final thoughts)

Sun May 31 23:56:12 UTC 2015

So this has been REALLY good!  The tl;dr:  ssl-bumping is pretty easy
even with intercept, ssl-bumping with access control is a little more
difficult...jump to the config to skip the chit chat.

My goal has always been to a content filter based on url regex.  This
works just fine for http traffic, but is much more difficult for https
traffic just for the case of you may or may not know the host you're
going to, depending on the site/app.  I'll be real honest here....I'm
only doing this to protect/filter the traffic of two kids, on laptops,
iPhone, and Android phone, so it's a mixed bag of content and, since
it's just the two of them in a home environment, I get to play around
and see what works and what doesn't.

Below is a close as I can get transparent intercept ssl-bump with
content filtering with using a list of domains/urls with both http and
https.  I still have to use a list of broken sites, which are large
netblocks (17.0.0.0/8..Apple anyone?) because some of these I just can't
seem to get host/domain information during the ssl handshake.  As I
discovered after attempting to put this into "production", I have not
been able to emulate using wget or curl an https session that doesn't
have any SNI information, so that threw me for a loop.  TextNow is a
great example (I'm including a packet capture of this in this post).
There's no host information in the client hello....there's no host
information in the server hello.....buried deep in the certificate ONLY
is the "commonName=.*textnow.me"...that's it.  This dashed my hopes of
using an url_regex for access control with all https sessions.  I have
"%ssl::>cert_subject" in my logging, and I never did see this log in any
of my tests...and I tested a BUNCH of different peek/stare/splice/bump
cominations..so I don't think squid is actually seeing this from the
certificate.

Another challenge is getting http url_regex filtering to work with https
filtering.  My method of filtering means not having an "http_access
allow localnet", which directly conflicted with also trying to filter
https.  The solution was to add an acl for port 443, then http_access to
just allow it, as our filtering was going to happen for https further
down.

I know there's a fair amount of people who just want to plop in some
config files, run a few commands, and be up and running.  The below
configuration has two additional files it references, http_url.txt,
which is an a list of domains/urls (\.apple\.com for example), and the
aptly named broken, which is a IP list (17.0.0.0/8).  The broken list
should be (semi) trusted and are sites that we just can't get SNI or
hostname information from.  If you've created a single cert/key pair
from the Squid documentation, you won't need the key= line in your
https_port directive.  If you've followed along in my posts, you already
have the configure line from my previous posts.  Change the
commands/config to fir where your squid config and ssl_db are.  So after
configuring, make sure you:

sudo /opt/libexec/ssl_crtd -c -s /opt/var/ssl_db
sudo chown -R nobody /opt/var/ssl_db/

As I believe in a lot of logging, and actually looking at said logging,
below is what you can expect to see in your logs (mine logs to syslog,
again, change this if you log to a different file):

Allowed http to .apple.com in http_url.txt:
May 31 17:03:48 gateway (squid-1): 192.168.1.100 - -
[31/May/2015:17:03:48 -0600] "GET
http://init.ess.apple.com/WebObjects/VCInit.woa/wa/getBag? HTTP/1.1" - -
200 5243 TCP_MISS:ORIGINAL_DST -
Denied http to symcb.com not in http_url.txt
May 31 17:03:48 gateway (squid-1): 192.168.1.100 - -
[31/May/2015:17:03:48 -0600] "GET http://sd.symcb.com/sd.crt HTTP/1.1" -
- 403 3618 TCP_DENIED:HIER_NONE -
Spliced https IP in broken.txt (google block 216.58.192.0/19)
May 31 17:04:34 gateway (squid-1): 192.168.1.101 - -
[31/May/2015:17:04:34 -0600] "CONNECT 216.58.216.138:443 HTTP/1.1" - -
200 568 TCP_TUNNEL:ORIGINAL_DST peek
Spliced https IP in broken.txt that we got SNI or bumped site in
http_url.txt look exactly the same
May 31 17:09:45 gateway (squid-1): 192.168.1.100 - -
[31/May/2015:17:09:45 -0600] "CONNECT 23.222.157.21:443 HTTP/1.1"
init.itunes.apple.com - 200 30314 TCP_TUNNEL:ORIGINAL_DST peek

The only drag with the configuration is you won't see when an https
session is terminated when the IP/url is not in the broken.txt, or the
http_url.txt:

[17:20:53 jlay at analysis:~$] wget -d
--ca-certificate=/etc/ssl/certs/sslsplit.crt https://www.yahoo.com
Setting --ca-certificate (cacertificate) to /etc/ssl/certs/sslsplit.crt
DEBUG output created by Wget 1.16.1 on linux-gnu.

URI encoding = ‘UTF-8’
--2015-05-31 17:20:59--  https://www.yahoo.com/
Resolving www.yahoo.com (www.yahoo.com)... 206.190.36.45,
206.190.36.105, 2001:4998:c:a06::2:4008
Caching www.yahoo.com => 206.190.36.45 206.190.36.105
2001:4998:c:a06::2:4008
Connecting to www.yahoo.com (www.yahoo.com)|206.190.36.45|:443...
connected.
Created socket 3.
Releasing 0x00007fdf67eecdd0 (new refcount 1).
Initiating SSL handshake.
SSL handshake failed.
Closed fd 3
Unable to establish SSL connection.

May 31 17:20:59 gateway (squid-1): 192.168.1.6 - - [31/May/2015:17:20:59
-0600] "CONNECT 206.190.36.45:443 HTTP/1.1" www.yahoo.com - 200 0
TAG_NONE:ORIGINAL_DST peek 

Full config below:
####################################
acl localnet src 192.168.1.0/24

acl SSL_ports port 443
acl Safe_ports port 80
acl Safe_ports port 443

acl CONNECT method CONNECT

acl allowed_http_sites url_regex "/opt/etc/squid/http_url.txt"
acl allow_https port 443
acl broken dst "/opt/etc/squid/broken.txt"

http_access deny !Safe_ports
http_access deny CONNECT !SSL_Ports

http_access allow allow_https
http_access allow allowed_http_sites
http_access deny !allowed_http_sites

http_access deny all

acl step1 at_step SslBump1
acl step2 at_step SslBump2
acl step3 at_step SslBump3

ssl_bump peek step1 broken
ssl_bump peek step2 broken
ssl_bump splice broken
ssl_bump peek step1 all
ssl_bump peek step2 all
acl allowed_https_sites ssl::server_name_regex
"/opt/etc/squid/http_url.txt"
ssl_bump bump allowed_https_sites
ssl_bump terminate !allowed_https_sites

sslproxy_cert_error allow all
sslproxy_capath /etc/ssl/certs
sslproxy_flags DONT_VERIFY_PEER 
sslproxy_options ALL

sslcrtd_program /opt/libexec/ssl_crtd -s /opt/var/ssl_db -M 4MB
sslcrtd_children 5

http_port 3128 intercept
https_port 3129 intercept ssl-bump
cert=/opt/etc/squid/certs/sslsplit_ca_cert.pem
cafile=/opt/etc/squid/certs/sslsplit_ca_cert.pem
key=/opt/etc/squid/certs/sslsplit_ca_key.pem
generate-host-certificates=on dynamic_cert_mem_cache_size=4MB
sslflags=NO_SESSION_REUSE

logformat mine %>a %[ui %[un [%tl] "%rm %ru HTTP/%rv" %ssl::>sni %
ssl::>cert_subject %>Hs %<st %Ss:%Sh %ssl::bump_mode 

access_log syslog:daemon.info mine

refresh_pattern -i (cgi-bin|\?)	0	0%	0
refresh_pattern .		0	20%	4320

coredump_dir /opt/var
##############################

Thanks all for being patient while I continued to post my learning and
all my mistakes.  If there's anything that I've missed, or if there's
another method for trying to accomplish what I've tried to do I'm all
eyes.

James

P.S. Things I'd love to see in Squid some day:

acl's being AND'd (http_access allow allowed_sites AND localnet)
Full on separate http_access, https_access directives

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20150531/6abddb21/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: textnow.pcapng
Type: application/octet-stream
Size: 7736 bytes
Desc: not available
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20150531/6abddb21/attachment-0001.obj>