[squid-users] Ubuntu 20.04 "apt update" issues behind a VPN and Squid proxy

[David Mills]

Hi Amos,

Upgrading to Squid 4.1 resolved the issue. I had to run

> /usr/lib64/squid/security_file_certgen -c -s /var/spool/squid/ssl_db -M 4MB
>

to get squid to start. But after that all worked well. We'll do a bit more
testing before we roll out to our production servers.

Thanks very much for your help.

Regards,

David Mills

Senior DevOps Engineer

 E: david.mills at acusensus.com

 M: +61 411 513 404

 W: acusensus.com





On Sun, 18 Jul 2021 at 16:45, Amos Jeffries <squid3 at treenet.co.nz> wrote:

> On 16/07/21 4:38 pm, David Mills wrote:
> > Hi Amos,
> >
> > sorry for the big delay here - I've had lots of other things to attend
> > to. It turned on the logging you suggested. For a failed "apt update"
> > attempt on the client I get the following attached access.log and
> cache.log.
> >
> > Are any of the lines
> >
> >     2021/07/16 04:28:01.423 kid1| 83,5| bio.cc(396) adjustSSL: Extension
> >     13 does not supported!
> >
> >     ...
> >
> >     20212021/07/16 04:28:32.465 kid1| 83,2| client_side.cc(3749)
> >     Squid_SSL_accept: Error negotiating SSL connection on FD 11: Aborted
> >     by client: 5
> >     ...
> >
> >     2021/07/16 04:28:02.452 kid1| Error negotiating SSL on FD 17:
> >     error:140920F8:SSL routines:ssl3_get_server_hello:unknown cipher
> >     returned (1/-1/0)
> >
> >     ...
> >
> >     2021/07/16 04:28:01.413 kid1| 83,2| client_side.cc(4293)
> >     clientPeekAndSpliceSSL: SSL_accept failed.
> >
> >
> > important?
> >
>
> Very. It means the libssl Squid is built with and using is not able to
> understand the TLS the server is sending.
>
> Squid-4 should be more tolerant of this particular issue, or at least
> able to follow the on_unsupported_protocol directive when it is
> encountered.
>
> Older Squid depend more directly on the library TLS parsing - which
> cannot handle unknown values well.
>
> Amos
> _______________________________________________
> squid-users mailing list
> squid-users at lists.squid-cache.org
> http://lists.squid-cache.org/listinfo/squid-users
>

-- 
DISCLAIMER: Acusensus puts the privacy and security of its clients, its 
data and information at the core of everything we do. The information 
contained in this email (including attachments) is intended only for the 
use of the person(s) to whom it is addressed to, as it may be confidential 
and contain legally privileged information. If you have received this email 
in error, please delete all copies and notify the sender immediately. Any 
views or opinions presented are
solely those of the author and do not 
necessarily represent the views of Acusensus
Pty Ltd. Please consider the 
environment
before printing this email.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20210722/4aa51e24/attachment.htm>