[squid-users] SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000417+TLS_IO_ERR
Jonathan Lee
jonathanlee571 at gmail.com
Wed Apr 10 21:48:22 UTC 2024
It works in 5.8 with no errors however in 6.6 I can see indexing and other information that I have never seen before realted to my cache and this new TLS error that follows your thought process you listed before with OpenSSL
ERROR: failure while accepting a TLS connection on conn367 local=192.168.1.1:3128 remote=192.168.1.5:55067 FD 46 flags=1: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000417+TLS_IO_ERR=1
And
Squid - Cache Logs
Date-Time Message
10.04.2024 14:46:31 ERROR: failure while accepting a TLS connection on conn2404 local=192.168.1.1:3128 remote=192.168.1.5:55534 FD 20 flags=1: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000417+TLS_IO_ERR=1
10.04.2024 14:45:20 ERROR: failure while accepting a TLS connection on conn2355 local=192.168.1.1:3128 remote=192.168.1.5:55527 FD 16 flags=1: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000417+TLS_IO_ERR=1
10.04.2024 14:44:23 ERROR: failure while accepting a TLS connection on conn2011 local=192.168.1.1:3128 remote=192.168.1.5:55496 FD 81 flags=1: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000417+TLS_IO_ERR=1
10.04.2024 14:43:33 ERROR: failure while accepting a TLS connection on conn1824 local=192.168.1.1:3128 remote=192.168.1.5:55465 FD 33 flags=1: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000417+TLS_IO_ERR=1
10.04.2024 14:43:17 ERROR: failure while accepting a TLS connection on conn1813 local=192.168.1.1:3128 remote=192.168.1.5:55461 FD 33 flags=1: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000417+TLS_IO_ERR=1
31.12.1969 16:00:00
10.04.2024 14:43:03 kick abandoning conn1780 local=192.168.1.1:3128 remote=192.168.1.5:55457 FD 26 flags=1
10.04.2024 14:42:36 storeLateRelease: released 110 objects
I would love to learn more I am a Computer science student with a AA in cyber security I have worked in the IT field for the past 15 years, I have some open pull requests in for Squid here
This proxy technology fascinates me so much. It is amazing code.
https://github.com/pfsense/FreeBSD-ports/pull/1365
And
https://github.com/pfsense/FreeBSD-ports/pull/1366
Fix for non support
2024/04/05 07:58:24| ERROR: Unsupported TLS option SINGLE_DH_USE
2024/04/05 07:58:24| ERROR: Unsupported TLS option SINGLE_ECDH_USE
Again I do not think many development team members review any of the GitHub pulls for Squid or I am working on something else
if anyone wants to let me know what part of the cipher should be removed please let me know so I can fix the RC4 issue.
https://github.com/pfsense/FreeBSD-ports/pull/1365
Working on this also Per Squid support Amos Jeffries
"Also there are a few weird things in your TLS cipher settings, such as this sequence " EECDH+aRSA+RC4:...:!RC4 "
Which as I understand, enables the EECDH with RC4 hash, but also forbids all uses of RC4."
Are we to disable RC4 because of the security issues? Or are we leaving it it has both listed.
if (empty($settings['sslproxy_compatibility_mode']) || ($settings['sslproxy_compatibility_mode'] == 'modern')) {
// Modern cipher suites
$sslproxy_cipher = "EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!SHA1:!MD5:!EXP:!PSK:!SRP:!DSS";
$sslproxy_options .= ",NO_TLSv1";
} else {
$sslproxy_cipher = "EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS";
}
Anything else you need I think you requested a pcap file I will create one with 2000 entries of facebook or something also
> On Apr 10, 2024, at 14:27, Jonathan Lee <jonathanlee571 at gmail.com> wrote:
>
> Copy of config I am using
>
> # This file is automatically generated by pfSense
> # Do not edit manually !
>
> http_port 192.168.1.1:3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=20MB cert=/usr/local/etc/squid/serverkey.pem cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE
>
> http_port 127.0.0.1:3128 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=20MB cert=/usr/local/etc/squid/serverkey.pem cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE
>
> https_port 127.0.0.1:3129 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=20MB cert=/usr/local/etc/squid/serverkey.pem cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE
>
> icp_port 0
> digest_generation off
> dns_v4_first on
> pid_filename /var/run/squid/squid.pid
> cache_effective_user squid
> cache_effective_group proxy
> error_default_language en
> icon_directory /usr/local/etc/squid/icons
> visible_hostname Lee_Family.home.arpa
> cache_mgr jonathanlee571 at gmail.com
> access_log /var/squid/logs/access.log
> cache_log /var/squid/logs/cache.log
> cache_store_log none
> netdb_filename /var/squid/logs/netdb.state
> pinger_enable on
> pinger_program /usr/local/libexec/squid/pinger
> sslcrtd_program /usr/local/libexec/squid/security_file_certgen -s /var/squid/lib/ssl_db -M 4MB -b 2048
> tls_outgoing_options cafile=/usr/local/share/certs/ca-root-nss.crt
> tls_outgoing_options capath=/usr/local/share/certs/
> tls_outgoing_options options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE
> tls_outgoing_options cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS
> sslcrtd_children 10
>
> logfile_rotate 0
> debug_options rotate=0
> shutdown_lifetime 3 seconds
> # Allow local network(s) on interface(s)
> acl localnet src 192.168.1.0/27
> forwarded_for transparent
> httpd_suppress_version_string on
> uri_whitespace strip
>
> acl getmethod method GET
>
> tls_outgoing_options cipher=HIGH:MEDIUM:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS
>
> acl windowsupdate dstdomain windowsupdate.microsoft.com
> acl windowsupdate dstdomain .update.microsoft.com
> acl windowsupdate dstdomain download.windowsupdate.com
> acl windowsupdate dstdomain redir.metaservices.microsoft.com
> acl windowsupdate dstdomain images.metaservices.microsoft.com
> acl windowsupdate dstdomain c.microsoft.com
> acl windowsupdate dstdomain www.download.windowsupdate.com
> acl windowsupdate dstdomain wustat.windows.com
> acl windowsupdate dstdomain crl.microsoft.com
> acl windowsupdate dstdomain sls.microsoft.com
> acl windowsupdate dstdomain productactivation.one.microsoft.com
> acl windowsupdate dstdomain ntservicepack.microsoft.com
> acl windowsupdate dstdomain dc1-st.ksn.kaspersky-labs.com
> acl windowsupdate dstdomain dc1-file.ksn.kaspersky-labs.com
> acl windowsupdate dstdomain dc1.ksn.kaspersky-labs.com
>
> acl rewritedoms dstdomain .facebook.com .akamaihd.net .fbcdn.net .google.com .static.com .apple.com .oracle.com .sun.com .java.com .adobe.com .steamstatic.com .steampowered.com .steamcontent.com .google.com
>
> store_id_program /usr/local/libexec/squid/storeid_file_rewrite /var/squid/storeid/storeid_rewrite.txt
> store_id_children 10 startup=5 idle=1 concurrency=0
> always_direct allow !getmethod
> store_id_access deny connect
> store_id_access deny !getmethod
> store_id_access allow rewritedoms
> reload_into_ims on
> max_stale 20 years
> minimum_expiry_time 0
>
>
> refresh_pattern -i squid.internal 10080 80% 79900 override-lastmod override-expire ignore-reload ignore-no-store ignore-private
>
> #APPLE STUFF
> refresh_pattern -i apple.com/..(cab|exe|msi|msu|msf|asf|wmv|wma|dat|zip|dist)$ 0 80% 43200 refresh-ims
>
> #apple update
> refresh_pattern -i (download|adcdownload).apple.com/.*.(pkg|dmg) 4320 100% 43200
> refresh_pattern -i appldnld.apple.com 129600 100% 129600
> refresh_pattern -i phobos.apple.com 129600 100% 129600
> refresh_pattern -i iosapps.itunes.apple.com 129600 100% 129600
>
> # Updates: Windows
> refresh_pattern -i microsoft.com/..(cab|exe|msi|msu|msf|asf|wma|dat|zip)$ 4320 80% 43200 refresh-ims
> refresh_pattern -i windowsupdate.com/..(cab|exe|msi|msu|msf|asf|wma|wmv)|dat|zip)$ 4320 80% 43200 refresh-ims
> refresh_pattern -i windows.com/..(cab|exe|msi|msu|msf|asf|wmv|wma|dat|zip)$ 4320 80% 43200 refresh-ims
> refresh_pattern -i microsoft.com/.*.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 4320 80% 43200
> refresh_pattern -i windowsupdate.com/.*.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 4320 80% 43200
> refresh_pattern -i windows.com/.*.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 4320 80% 43200
> refresh_pattern -i .*windowsupdate.com/.*.(cab|exe) 259200 100% 259200
> refresh_pattern -i .*update.microsoft.com/.*.(cab|exe|dll|msi|psf) 259200 100% 259200
> refresh_pattern windowsupdate.com/.*.(cab|exe|dll|msi|psf) 10080 100% 43200
> refresh_pattern download.microsoft.com/.*.(cab|exe|dll|msi|psf) 10080 100% 43200
> refresh_pattern www.microsoft.com/.*.(cab|exe|dll|msi|psf) 10080 100% 43200
> refresh_pattern au.download.windowsupdate.com/.*.(cab|exe|dll|msi|psf) 4320 100% 43200
> refresh_pattern bg.v4.pr.dl.ws.microsoft.com/.*.(cab|exe|dll|msi|psf) 4320 100% 43200
> #windows update NEW UPDATE 0.04
> refresh_pattern update.microsoft.com/.*.(cab|exe) 43200 100% 129600
> refresh_pattern ([^.]+.)?(download|(windows)?update).(microsoft.)?com/.*.(cab|exe|msi|msp|psf) 4320 100% 43200
> refresh_pattern update.microsoft.com/.*.(cab|exe|dll|msi|psf) 10080 100% 43200
> refresh_pattern -i .update.microsoft.com/.*.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 525600 100% 525600
> refresh_pattern -i .windowsupdate.com/.*.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 525600 100% 525600
> refresh_pattern -i .download.microsoft.com/.*.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 525600 100% 525600
> refresh_pattern -i .ws.microsoft.com/.*.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 525600 100% 525600
>
> refresh_pattern ([^.]+.)?(cs|content[1-9]|hsar|content-origin|client-download).[steampowered|steamcontent].com/.*.* 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod
> refresh_pattern ([^.]+.)?.akamai.steamstatic.com/.*.* 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod
>
> refresh_pattern -i ([^.]+.)?.adobe.com/.*.(zip|exe) 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod
> refresh_pattern -i ([^.]+.)?.java.com/.*.(zip|exe) 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod
> refresh_pattern -i ([^.]+.)?.sun.com/.*.(zip|exe) 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod
> refresh_pattern -i ([^.]+.)?.oracle.com/.*.(zip|exe|tar.gz) 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod
>
> refresh_pattern -i appldnld.apple.com 43200 100% 43200 ignore-reload ignore-no-store override-expire override-lastmod
> refresh_pattern -i ([^.]+.)?apple.com/.*.(ipa) 43200 100% 43200 ignore-reload ignore-no-store override-expire override-lastmod
>
> refresh_pattern -i ([^.]+.)?.google.com/.*.(exe|crx) 10080 80% 43200 override-expire override-lastmod ignore-reload reload-into-ims ignore-private
> refresh_pattern -i ([^.]+.)?g.static.com/.*.(exe|crx) 10080 80% 43200 override-expire override-lastmod ignore-reload reload-into-ims ignore-private
>
> #FACEBOOK
> refresh_pattern ^http?://*.facebook.com/* 10080 80% 43200 override-expire override-lastmod ignore-reload reload-into-ims ignore-private
>
> #FACEBOOK IMAGES
> refresh_pattern -i pixel.facebook.com..(jpg|png|gif|ico|css|js) 10080 80% 43200 override-expire override-lastmod ignore-reload reload-into-ims ignore-private
> refresh_pattern -i .akamaihd.net..(jpg|png|gif|ico|css|js) 10080 80% 43200 override-expire override-lastmod ignore-reload reload-into-ims ignore-private
> refresh_pattern -i (facebook.com).(jpg|png|gif) 10080 80% 43200 store-stale override-expire override-lastmod ignore-reload reload-into-ims ignore-private
> refresh_pattern static.(xx|ak).fbcdn.net.(jpg|gif|png) 10080 80% 43200 override-expire override-lastmod ignore-reload reload-into-ims ignore-private
> refresh_pattern (scontent-lax[0-9]-[0-9].xx|.ak).fbcdn.net.*(jpg|gif|png) 10080 80% 43200 override-expire override-lastmod ignore-reload reload-into-ims ignore-private
>
> refresh_pattern ^https?://profile.ak.fbcdn.net*.(jpg|gif|png) 10080 80% 43200 override-expire override-lastmod ignore-reload reload-into-ims ignore-private
>
> #FACEBOOK VIDEO
> refresh_pattern -i .(video-lax[0-9]-[0-9].xx|video.ak).fbcdn.net.*.(mp4|flv|mp3|amf) 10080 80% 43200 override-expire override-lastmod ignore-reload reload-into-ims ignore-private
> refresh_pattern (audio|video)/(webm|mp4) 10080 80% 43200 override-expire override-lastmod ignore-reload reload-into-ims ignore-private
> acl https_login url_regex -i ^https.*(login|Login).*
> cache deny https_login
>
> range_offset_limit 512 MB windowsupdate
> range_offset_limit 4 MB
> range_offset_limit 0
> quick_abort_min -1 KB
>
> cache_mem 64 MB
> maximum_object_size_in_memory 256 KB
> memory_replacement_policy heap LFUDA
> cache_replacement_policy heap LFUDA
> minimum_object_size 0 KB
> maximum_object_size 512 MB
> cache_dir diskd /var/squid/cache 64000 256 256
> offline_mode off
> cache_swap_low 90
> cache_swap_high 95
> acl donotcache dstdomain '/var/squid/acl/donotcache.acl'
> cache deny donotcache
> cache allow all
> # Add any of your own refresh_pattern entries above these.
> refresh_pattern ^ftp: 1440 20% 10080
> refresh_pattern ^gopher: 1440 0% 1440
> refresh_pattern -i (/cgi-bin/|?) 0 0% 0
> refresh_pattern . 0 20% 4320
>
>
> #Remote proxies
>
>
> # Setup some default acls
> # ACLs all, manager, localhost, and to_localhost are predefined.
> acl allsrc src all
> acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901 8080 3128 3129 1025-65535
> acl sslports port 443 563 8080 5223 2197
>
> acl purge method PURGE
> acl connect method CONNECT
>
> # Define protocols used for redirects
> acl HTTP proto HTTP
> acl HTTPS proto HTTPS
>
> # SslBump Peek and Splice
> # http://wiki.squid-cache.org/Features/SslPeekAndSplice
> # http://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit
> # Match against the current step during ssl_bump evaluation [fast]
> # Never matches and should not be used outside the ssl_bump context.
> #
> # At each SslBump step, Squid evaluates ssl_bump directives to find
> # the next bumping action (e.g., peek or splice). Valid SslBump step
> # values and the corresponding ssl_bump evaluation moments are:
> # SslBump1: After getting TCP-level and HTTP CONNECT info.
> # SslBump2: After getting TLS Client Hello info.
> # SslBump3: After getting TLS Server Hello info.
> # These ACLs exist even when 'SSL/MITM Mode' is set to 'Custom' so that
> # they can be used there for custom configuration.
> acl step1 at_step SslBump1
> acl step2 at_step SslBump2
> acl step3 at_step SslBump3
> acl banned_hosts src '/var/squid/acl/banned_hosts.acl'
> acl whitelist dstdom_regex -i '/var/squid/acl/whitelist.acl'
> acl blacklist dstdom_regex -i '/var/squid/acl/blacklist.acl'
> http_access allow manager localhost
>
> # Allow external cache managers
> acl ext_manager src 192.168.1.1
> acl ext_manager src 127.0.0.1
> http_access allow manager ext_manager
>
> http_access deny manager
> http_access allow purge localhost
> http_access deny purge
> http_access deny !safeports
> http_access deny CONNECT !sslports
>
> # Always allow localhost connections
> http_access allow localhost
>
> quick_abort_min 0 KB
> quick_abort_max 0 KB
> quick_abort_pct 95
> request_body_max_size 0 KB
> delay_pools 1
> delay_class 1 2
> delay_parameters 1 -1/-1 -1/-1
> delay_initial_bucket_level 100
> delay_access 1 allow allsrc
>
> # Reverse Proxy settings
>
> deny_info TCP_RESET allsrc
>
> # Package Integration
> url_rewrite_program /usr/local/bin/squidGuard -c /usr/local/etc/squidGuard/squidGuard.conf
> url_rewrite_bypass off
> url_rewrite_children 32 startup=8 idle=4 concurrency=0
>
> # Custom options before auth
> #host_verify_strict on
>
> # These hosts are banned
> http_access deny banned_hosts
> # Always allow access to whitelist domains
> http_access allow whitelist
> # Block access to blacklist domains
> http_access deny blacklist
> # List of domains allowed to logging in to Google services
> request_header_access X-GoogApps-Allowed-Domains deny all
> request_header_add X-GoogApps-Allowed-Domains consumer_accounts
> # Set YouTube safesearch restriction
> acl youtubedst dstdomain -n www.youtube.com m.youtube.com youtubei.googleapis.com youtube.googleapis.com www.youtube-nocookie.com
> request_header_access YouTube-Restrict deny all
> request_header_add YouTube-Restrict none youtubedst
> acl sglog url_regex -i sgr=ACCESSDENIED
> http_access deny sglog
> # Custom SSL/MITM options before auth
> acl localhost src 192.168.1.1/32
> #cachemgr_passwd disable offline_toggle reconfigure shutdown
> #cachemgr_passwd REDACTED123! all
> acl no_miss url_regex -i gateway.facebook.com/ws/realtime?
> acl no_miss url_regex -i web-chat-e2ee.facebook.com/ws/chat
> acl CONNECT method CONNECT
> acl wuCONNECT dstdomain www.update.microsoft.com
> acl wuCONNECT dstdomain sls.microsoft.com
> http_access allow CONNECT wuCONNECT localnet
> http_access allow CONNECT wuCONNECT localhost
> http_access allow windowsupdate localnet
> http_access allow windowsupdate localhost
> http_access deny manager
>
> acl BrokenButTrustedServers dstdomain '/usr/local/pkg/dstdom.broken'
> acl DomainMismatch ssl_error SQUID_X509_V_ERR_DOMAIN_MISMATCH
> sslproxy_cert_error allow BrokenButTrustedServers DomainMismatch
> sslproxy_cert_error deny all
>
> acl splice_only src 192.168.1.8 #Tasha iPhone
> acl splice_only src 192.168.1.10 #Jon iPhone
> acl splice_only src 192.168.1.11 #Amazon Fire
> acl splice_only src 192.168.1.15 #Tasha HP
> acl splice_only src 192.168.1.16 #iPad
>
> acl NoSSLIntercept ssl::server_name_regex -i '/usr/local/pkg/reg.url.nobump'
> acl NoBumpDNS dstdomain '/usr/local/pkg/dns.nobump'
>
> acl markBumped annotate_client bumped=true
> acl bump_only src 192.168.1.3 #webtv
> acl bump_only src 192.168.1.4 #toshiba
> acl bump_only src 192.168.1.5 #imac
> acl bump_only src 192.168.1.9 #macbook
> acl bump_only src 192.168.1.13 #dell
>
> ssl_bump peek step1
> miss_access deny no_miss
> ssl_bump splice https_login
> ssl_bump splice splice_only
> ssl_bump splice NoBumpDNS
> ssl_bump splice NoSSLIntercept
> ssl_bump bump bump_only markBumped
> ssl_bump stare all
>
> acl markedBumped note bumped true
> url_rewrite_access deny markedBumped
>
> read_ahead_gap 64 KB
> negative_ttl 1 second
> connect_timeout 30 seconds
> request_timeout 60 seconds
> half_closed_clients off
> shutdown_lifetime 10 seconds
> negative_dns_ttl 1 seconds
> ignore_unknown_nameservers on
> pipeline_prefetch 100
>
> #acl SSLIntercept ssl::server_name_regex -i '/usr/local/pkg/url.bump'
> #ssl_bump bump SSLIntercept
>
> # Setup allowed ACLs
> # Allow local network(s) on interface(s)
> http_access allow localnet
> # Default block all to be sure
> http_access deny allsrc
>
>> On Apr 10, 2024, at 14:13, Alex Rousskov <rousskov at measurement-factory.com> wrote:
>>
>> On 2024-04-10 16:22, Jonathan Lee wrote:
>>> Could it be related to this ??
>>> "WARNING: Failed to decode EC parameters '/etc/dh-parameters.2048'. error:1E08010C:DECODER routines::unsupported”
>>
>> I do not know the answer to your question. I speculate that it could be related: Depending on various factors, without those DH parameters, Squid may not be able to communicate with clients. See WARNING in tls-dh description in squid.conf.documented.
>>
>> I know that others are reporting similar WARNINGs during v6 upgrades and dislike the letters "EC" those messages use. I am not going to debate the best choice of letters for this message, but I can tell you that, in the cases I investigated, the message was caused by a mismatch between squid.conf tls-dh=... option value and DH parameter file contents:
>>
>> * To Squid, tls-dh=curve:filename format implies that the keytype is "EC". These two letters are then fed to an OpenSSL function that configures related TLS state. OpenSSL then fails if tls-dh filename contains DH parameters produced with "openssl dhparam" command. I have seen these failures in tests.
>>
>> * To Squid, tls-dh=filename format (i.e. format without the curve name prefix) implies that the keytype is "DC". These two letters are then fed to an OpenSSL function that configured related TLS state. OpenSSL then probably fails if tls-dh filename contains DH parameters produced with "openssl ecparam" command. I have not tested this use case.
>>
>> * The failing checks and their messages are specific to Squids built with OpenSSL v3. It is possible that Squids built with OpenSSL v1 just silently fail (at runtime), but I have not checked that theory.
>>
>>
>> FWIW, this poorly categorized message indicates a configuration _error_. AFAICT, Squid code should be adjusted to _quit_ (i.e. reject bad configuration) after discovering this error instead of continuing as if nothing bad happened.
>>
>> I recommend addressing the underlying cause, even if this message is unrelated to SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000417.
>>
>>
>> HTH,
>>
>> Alex.
>>
>>
>>>> On Apr 10, 2024, at 08:38, Alex Rousskov <rousskov at measurement-factory.com> wrote:
>>>>
>>>> On 2024-04-10 10:50, Jonathan Lee wrote:
>>>>
>>>>> I am getting the following error in 6.6 after a upgrade from 5.8 does anyone know what this is caused by?
>>>>> SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000417+TLS_IO_ERR
>>>>
>>>> $ openssl errstr A000417
>>>> error:0A000417:SSL routines::sslv3 alert illegal parameter
>>>>
>>>> I think I have seen that error code before, but I do not recall the exact circumstances. Sorry! The error happens when Squid tries to accept (or peek at) a TLS connection from the client. Might be prohibited TLS version/feature, TLS greasing, or non-TLS traffic? Try examining client TLS Hello packet(s) in Wireshark.
>>>>
>>>> Alex.
>>>>
>>>> _______________________________________________
>>>> squid-users mailing list
>>>> squid-users at lists.squid-cache.org
>>>> https://lists.squid-cache.org/listinfo/squid-users
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20240410/376cff3b/attachment-0001.htm>
More information about the squid-users
mailing list