SSLBUMP without MITM
-
i am the person who did this change to opnsense, if you want and the maintaner of package accepts, i could do a pull request with this change.
note: it works only with domain and not with complete urls, because dont do the intercept -
i am the person who did this change to opnsense, if you want and the maintaner of package accepts, i could do a pull request with this change.
So, this could be pretty much rewritten to:
setup ssl bump acl's
acl bump_step1 at_step SslBump1
acl bump_step2 at_step SslBump2
acl bump_step3 at_step SslBump3
acl bump_nobumpsites ssl::server_name "/usr/local/etc/squid/nobumpsites.acl"configure bump
ssl_bump peek bump_step1 all
ssl_bump splice all
ssl_bump peek bump_step2 all
ssl_bump splice bump_step3 all
ssl_bump bumpsslproxy_cert_error deny all
note: it works only with domain and not with complete urls, because dont do the intercept
Yes, that is the problem. It does not intercept. Most of the code does nothing, as indicated above. It splices everything, you are finished with the stuff after the red line marked above [1].
What the code in pfSense Squid attempts to do is: do NOT intercept 'Whitelist' ACL (that's what your no-op bump_nobumpsites ACL attempts to do but the code is just not used anywhere) and intercept the rest [2]
[1] https://github.com/pfsense/FreeBSD-ports/blob/devel/www/pfSense-pkg-squid/files/usr/local/pkg/squid.inc#L1539
[2]
https://github.com/pfsense/FreeBSD-ports/blob/devel/www/pfSense-pkg-squid/files/usr/local/pkg/squid.inc#L1826
https://github.com/pfsense/FreeBSD-ports/blob/devel/www/pfSense-pkg-squid/files/usr/local/pkg/squid.inc#L1887I must be missing something here.
-
doktornotor:
You patch does getting the full https URL only and wonderfully, it we put ".*" at the whitelist, so that squidguard can do its job of denying or allowing it according its rules, exactly as it does with http.
So, to summarize, putting in the whitelist field:
.*
and squidGuard does its jobs with http and https URLs!!!
-
OK, so I guess there are no changes really required for the SquidGuard + SSL usecase. Thanks for feedback.
-
To summarize, this does work with transparent interception without installing a CA on clients, but I can only get it to see the domain name, not the full URL as some in the thread have stated.
- Squid General tab, Show Advanced Options, Custom ACLs (before auth)
acl bump_step1 at_step SslBump1 ssl_bump peek bump_step1 all ssl_bump splice all sslproxy_cert_error deny all- ACLs tab, whitelist:```
.*
When squidGuard blocks it kills the connection, it doesn't redirect or do anything nice. And naturally this doesn't let you see the body so no chance for AV or similar to check the contents. -
@jimp: As I understand the previous post, there's really no need to put anything into Custom ACLs; the code is equivalent to what we have in the package already when you whitelist everything (.*) - there's
ssl_bump splice whitelist
ssl_bump bump all(and the second line won't have anything to match left when you've whitelisted everything)
-
Ah, so all you need is the whitelist ".*" and the rest happens automatically? Cool. That does seem to work.
-
Yeah, it's basically "supertransparent", as in - no certificates forged/no need to install certs on clients. (And yeah, obviously it's limited in sense that you just get enough info about the connection for SquidGuard to do its job, but nothing else, i.e., no content filtering/AV/etc.)
Perhaps could use some hints in the GUI…
-
Would be nice to kick that in somehow when CA = "None" when using SSL Interception, or at least allow CA = None to be set in that case. It doesn't seem like that should be necessary since it isn't going to be using the CA when acting in that role. I haven't tried it though, maybe squid is dumb and still needs it set.
-
Yeah, afraid that's a no go, the certs are really required - plus, the ACL (whitelist) can be anything there and be changed at any time, or have lines prepended/appended, really no way for Squid to figure out it's not going to need to fake any certs.
(But you could generate a temporary one for the CA in the background on each config resync; would need additional logic/code though in squid.inc. If you want something like this, I'd prefer having a separate checkbox for this, with some JS logic that'd gray out/disable unneeded MITM stuff in the GUI, and use a different ACL than the current whitelist for that, basically just use the built-in "all" one - like ssl_bump splice all)
-
I'm running a variation of this config in transparent mode with squidguard and shallalist quite successfully.
I'm not sure why exactly, but this configuration improves over basic step 1 peek and splice all by allowing logging of the server certificate (instead of just IP address), domain blocking of SSL sites via squidguard list, and provides an alternate splice operation for certain sites that for some reason cannot connect after the certificate name is captured.
# peek at client TLS-request to get SNI # peek at server cert (for logging) # splice earlySplice at step 3 only acl earlySplice ssl::server_name "*.crashplan.com" ssl_bump peek step1 ssl_bump peek step2 earlySplice ssl_bump splice step3 earlySplice ssl_bump splice all sslproxy_cert_error deny all -
Well yes, that will no doubt improve splice since you get whole lot more information available at steps 2/3, as explained here:
https://github.com/pfsense/FreeBSD-ports/blob/devel/www/pfSense-pkg-squid/files/usr/local/pkg/squid.inc#L1539The above makes bumping impossible, however.
It's not possible to do zillion variants in the GUI. Use Advanced Options, Custom ACLs (before auth).
-
The above makes bumping impossible, however.
This is understood. For my use case, I don't need full blown MiTM - logging the site name and simple domain blocking are sufficient.
Right now I'm using custom ACLs for this. It's a hack (because it supersedes the auto-generated ssl_bump directives that follow), but it works.
It would be nice if it were available as a simple toggle in the config or if the various ssl config options were exposed for customization under 'advanced', but it works reasonably well as-is.
Thank you for your work making this tool available!
-
I'll see if something reasonable can be added for
- splice everything without bump (i.e., splice all)
- custom splice ACLs/settings (some advanced textarea burried somewhere, if you break it, your problem)
without overcomplicating the GUI and confusing everyone.
-
OK, how's this?
https://github.com/pfsense/FreeBSD-ports/pull/269
-
Looks great, we're getting that PR merged in right now, thanks!
-
Thanks for testing/feedback. Any volunteers to
fixrewrite SquidGuard now? (No, I cannot do it. Tried many times, unable to work with that code for more than a couple of minutes.) -
e2guardian its more active…
if you want to replace squidGuard with e2guardian i could do this!what you think?
https://github.com/e2guardian/e2guardian
-
e2guardian its more active…
if you want to replace squidGuard with e2guardian i could do this!what you think?
https://github.com/e2guardian/e2guardian
Hmmm… good luck.
- https://forum.pfsense.org/index.php?topic=87526.0
- https://github.com/pfsense/pfsense-packages/pull/866
-
From the history there it looks like it had a similar problem to squidGuard. Whatever happens, it needs a ground-up rewrite with up-to-date style and practices all-around.
