Error certificates for reverse proxy since upgrade to squid 0.4.44_19

ic_attila

I've installed _21. The strange thing is that I can’t do a clean install. I’ve unchecked the “Keep Settings/Data” but after package reinstall all my settings are in place. Even if I deleted the entire /usr/local/etc/squid directory. No matter if I click reinstall or remove package and install it from the “Available Packages”. There is one thing to mention. I haven’t restarted the whole system after I noticed this error. Would it be desirable?
And yes, you are right. Those two files are not empty now. It seems working with other HTTPS reversing. Only the OWA part isn’t working.

viktor_g

@ic_attila said in Error certificates for reverse proxy since upgrade to squid 0.4.44_19:

@viktor_g Dear Viktor,

I've installed _21. The strange thing is that I can’t do a clean install. I’ve unchecked the “Keep Settings/Data” but after package reinstall all my settings are in place.

I'll check it.
You can also create redmine issue:
https://docs.netgate.com/pfsense/en/latest/development/bug-reporting.html

Even if I deleted the entire /usr/local/etc/squid directory. No matter if I click reinstall or remove package and install it from the “Available Packages”. There is one thing to mention. I haven’t restarted the whole system after I noticed this error. Would it be desirable?

Actually your squid.conf looks fine,
but you can try to restart the system if it possible

And yes, you are right. Those two files are not empty now. It seems working with other HTTPS reversing. Only the OWA part isn’t working.

Can you post squid error log to check OWA?

There is no changes in OWA code from 0.4.44_18-21,
list of changes:

IPv6 transparent mode support
IPv6 addresses in localnet ACL ('Allow Users on Interface')
IPv6 addresses ACL support
extra WebGUI input validations
whitelist/blacklist IDN hostnames support

ic_attila

@viktor_g I'll reboot it in 3 hours. I'll report back after that.

ic_attila

@viktor_g Rebooted, nothing changed.
And because the Event 36887 Schannel errors on the Exchange side say TLS handshake error, I just turned on “Ignore Internal Certificate Validation” under “Intermediate CA Certificate”. I’m not sure if this is OK from a security standpoint, but it is working now.

emeric

@viktor_g , Thanks for or 0.4.44_21

I made myself a test platform identical to my prod then I tested an update to 0.4.44_21. It's OK for my reverse proxy.

I will test the update on my prod tonight

aDCoCa

After update my DEV QA y PRD Server to 0.4.44_21 squid reverse proxy works fine. Many thanks!

emeric

@viktor_g, finally

I check the logs after the upgrade to 0.4.44_21.
The reverse proxy works well.
But for each request arriving on the reverse proxy I have this error which follows :

NONE/000	error:transaction-end-before-headers

I didn't have this before.

Do you have any idea ?

Thanks

viktor_g

@emeric

*Unused connections received in http_port or https_port or transactions terminated before reading[parsing] request headers logged with URI error:transaction-end-before-headers.

These errors are meant to be logged for clients that open and close connections without sending any HTTP headers (or without sending complete HTTP headers — you can log HTTP request size to distinguish these two cases).*

What is your pfSense version? 2.4.4-p3 or 2.4.5?

Please give us more information about your squid setup

Do you use squid for your clients? In transparent mode?

emeric

Thanks for the time you take for my problem

On my test platform I am in 2.4.5 and the version of squid is 0.4.44_22.

Clients (internet) access my websites by the reverse proxy (squid).

I have activated the proxy but not in transparent mode and only for my users on the lan to the internet (so internet clients are not affected by this proxy)

I check my Headers Handling configuration on Squid :

Do you need more information?

viktor_g

@emeric what if you disable squid for LAN users?
or disable reverse squid?
Will you see the same errors?