Transparent HTTP Proxy + HTTPS/SSL Interception = No HTTPS traffic
-
When I Check to Enable SSL Filtering no HTTPS traffic works. It doesn't matter if I choose "Splice Whitelist, Bump Otherwise" or "Splice All" all HTTPS sites just time out. No warnings, no errors, nothing. Just timeouts. If I disable that option, all sites immediately start working.
/var squid/logs is giving a bunch of errors:CPU Usage: 2.640 seconds = 1.597 user + 1.043 sys Maximum Resident Size: 137136 KB Page faults with physical i/o: 1 2017/03/20 16:50:01 kid1| Starting Squid Cache version 3.5.23 for amd64-portbld-freebsd10.3... 2017/03/20 16:50:01 kid1| Service Name: squid 2017/03/20 16:50:02| pinger: Initialising ICMP pinger ... 2017/03/20 16:50:12| pinger: Initialising ICMP pinger ... 2017/03/20 17:11:56 kid1| UPGRADE WARNING: URL rewriter reponded with garbage ' ldapprotover 3# No Blockssrc Celestial { ip 192.168.1.10}# dest blk_BL_adv { domainlist blk_BL_adv/domains urllist blk_BL_adv/urls redirect http://192.168.1.1:80/sgerror.php?ERR'. Future Squid will treat this as part of the URL. 2017/03/20 17:21:26| pinger: Initialising ICMP pinger ... 2017/03/20 17:21:37| pinger: Initialising ICMP pinger ... 2017/03/20 17:23:55 kid1| Shutdown: NTLM authentication. 2017/03/20 17:23:55 kid1| Shutdown: Negotiate authentication. 2017/03/20 17:23:55 kid1| Shutdown: Digest authentication. 2017/03/20 17:23:55 kid1| Shutdown: Basic authentication. 2017/03/20 17:24:01 kid1| Starting Squid Cache version 3.5.23 for amd64-portbld-freebsd10.3... 2017/03/20 17:24:01 kid1| Service Name: squid 2017/03/20 17:24:01| pinger: Initialising ICMP pinger ... 2017/03/20 17:24:12 kid1| WARNING: redirector #Hlpr7 exited FATAL: The redirector helpers are crashing too rapidly, need help! Squid Cache (Version 3.5.23): Terminated abnormally. CPU Usage: 0.283 seconds = 0.150 user + 0.133 sys Maximum Resident Size: 137264 KB Page faults with physical i/o: 1 2017/03/20 17:26:01 kid1| Starting Squid Cache version 3.5.23 for amd64-portbld-freebsd10.3... 2017/03/20 17:26:01 kid1| Service Name: squid 2017/03/20 17:26:02 kid1| /var/run/squid/squid.pid: (2) No such file or directory 2017/03/20 17:26:02 kid1| WARNING: Could not write pid file 2017/03/20 17:26:02| pinger: Initialising ICMP pinger ... 2017/03/20 17:26:28 kid1| UPGRADE WARNING: URL rewriter reponded with garbage ' ldapprotover 3# No Blockssrc Celestial { ip 192.168.1.10}# dest blk_BL_adv { domainlist blk_BL_adv/domains urllist blk_BL_adv/urls redirect http://192.168.1.1:80/sgerror.php?ERR'. Future Squid will treat this as part of the URL. 2017/03/20 17:41:37 kid1| Starting new redirector helpers... 2017/03/20 20:38:00 kid1| WARNING: redirector #Hlpr12 exited 2017/03/20 20:38:00 kid1| WARNING: redirector #Hlpr11 exited 2017/03/20 20:38:00 kid1| WARNING: redirector #Hlpr10 exited 2017/03/20 20:38:00 kid1| WARNING: redirector #Hlpr9 exited 2017/03/20 20:38:00 kid1| WARNING: redirector #Hlpr8 exited 2017/03/20 20:38:00 kid1| WARNING: redirector #Hlpr7 exited 2017/03/20 20:38:00 kid1| WARNING: redirector #Hlpr6 exited 2017/03/20 20:38:00 kid1| WARNING: redirector #Hlpr5 exited 2017/03/20 20:38:00 kid1| WARNING: redirector #Hlpr4 exited 2017/03/20 20:38:00 kid1| WARNING: redirector #Hlpr3 exited 2017/03/20 20:38:00 kid1| WARNING: redirector #Hlpr2 exited 2017/03/20 20:38:00 kid1| WARNING: redirector #Hlpr1 exitedI'll look at this again tomorrow but can anyone give me pointers as to why HTTP traffic works but HTTPS traffic just times out?
-
Get rid of the crashing SquidGuard thing and it will work…
-
An update. The issue was that ldap was selected but not configured. We aren't looking to use that so I've unchecked it and it's working now, almost.
When squidGuard block an HTTP page, I get the expected block page.
When SquidGuard blocks an HTTPS page, I get an error code: SSL_ERROR_RX_RECORD_TOO_LONG. I believe this is because there is an issue with sending HTTPS over HTTP or something like that. Any idea how to fix this? -
The only idea about SquidGuard is that it's FUBARed and should be removed from pfSense unless someone rewrites it from scratch.
-
The only idea about SquidGuard is that it's FUBARed and should be removed from pfSense unless someone rewrites it from scratch.
We've been using SquidGuard for a while now at various locations. It works well on HTTP traffic as long as the databases are good. It also seems to be blocking HTTPS properly but something about the way HTTPS and redirects doesn't allow me to display the block page. Other than that I haven't had a problem with SquidGuard loading or blocking in a while. What problems are you referring to?
-
There are numerous problems unfixed for years that you can find here and at Redmine. Not exactly sure what's the question here. The package is a piece of shit.
-
But what is the alternative if you want to do transparent https web filtering for free/cheap?
-
Shrug. Maybe get someone to revive the E2Guarding package effort: https://forum.pfsense.org/index.php?topic=87526.0
-
An update. The issue was that ldap was selected but not configured. We aren't looking to use that so I've unchecked it and it's working now, almost.
When squidGuard block an HTTP page, I get the expected block page.
When SquidGuard blocks an HTTPS page, I get an error code: SSL_ERROR_RX_RECORD_TOO_LONG. I believe this is because there is an issue with sending HTTPS over HTTP or something like that. Any idea how to fix this?I got the same error with 2.3.3-RELEASE-p1 (amd64) and after some plenty of trials and errors in experimenting several settings in Squid Proxy Server and SquidGuard Proxy Filter I finally found the solution and what the cause this error. I checked the "Enable LDAP Filter" under LDAP Options leaving other options of it to default and no more SSL_ERROR_RX_RECORD_TOO_LONG but the problem it doesn't block HTTPS traffic even it was setup to block in SquidGuard.
-
I do not know if I would downplay this package heh.
Does anyone have anyidea why SSL_RECORD_TOO_LONG happens with blocked sites?