Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Squid in transparent mode with splice_all generates lot of error:transaction-end-before-headers

    Scheduled Pinned Locked Moved Cache/Proxy
    4 Posts 2 Posters 2.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      bole5
      last edited by

      Hello,

      I have a separate network for my children. Squid is set up on that interface and Transparent mode is enabled. SSL filtering is also enabled with option Splice All. Children have android and apple devices (iPhones, iPads, Kindle, etc)

      When running in transparent mode we are noticing intermittent problems with various services:

      • Spotify sometimes stops working and reports connection problems
      • WhatsApp and other social networking apps stop connecting
      • Netflix on my LGTV stops displaying thumbnails when fast forwarding a movie
      • icloud services stop/resume working
      • various websites don't work ie. espn.com can't stream videos, but content is visible and working

      The services would sometimes resume working after restarting the app.
      The problems completely go away when I stop using transparent mode and set up proxy in each device's wifi settings.

      When looking at the realtime logs I see following pattern emerging:

      • a request for a resource with http code 409
      • error:transaction-end-before-headers
      • a connection to ip address of the resource with http code 200
      29.09.2020 18:31:18	192.168.30.22	NONE/200	95.101.184.27:443	-	-
29.09.2020 18:31:18	192.168.30.22	NONE/000	error:transaction-end-before-headers	-	-
29.09.2020 18:31:18	192.168.30.22	NONE/409	bag.itunes.apple.com:443	-	-

      Additional information along with my squid.conf is provided below.

      Does anyone have ideas? I saw this message being reported in various squid forums. Interesting thing is that it only happens in transparent mode - so maybe it has something to do with the NAT rules?

      Kind regards,
      Boris

      Other examples from realtime logs are below. Needless to say I am seeing a lot of the entries repeating below:

      28.09.2020 13:21:14	192.168.30.154	NONE/200	142.250.68.174:443	-	-
28.09.2020 13:21:14	192.168.30.154	NONE/000	error:transaction-end-before-headers	-	-
28.09.2020 13:21:14	192.168.30.154	NONE/409	encrypted-tbn0.gstatic.com:443	-	-
...
28.09.2020 13:21:03	192.168.30.154	NONE/200	23.47.49.15:443	-	-
28.09.2020 13:21:03	192.168.30.154	NONE/000	error:transaction-end-before-headers	-	-
28.09.2020 13:21:03	192.168.30.154	NONE/409	a2.espncdn.com:443	-	-
...
28.09.2020 22:56:07	192.168.30.50	NONE/200	2.18.70.54:443	-	-
28.09.2020 22:56:07	192.168.30.50	NONE/000	error:transaction-end-before-headers	-	-
28.09.2020 22:56:07	192.168.30.50	NONE/409	tp-s.nflximg.net:443	-	-

      My squid.conf is below.
      cat /usr/local/etc/squid/squid.conf

      # This file is automatically generated by pfSense
# Do not edit manually !

http_port 192.168.30.1:3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=16MB cert=/usr/local/etc/squid/serverkey.pem capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE

http_port 127.0.0.1:3128
icp_port 0
digest_generation off
dns_v4_first on
pid_filename /var/run/squid/squid.pid
cache_effective_user squid
cache_effective_group proxy
error_default_language en
icon_directory /usr/local/etc/squid/icons
visible_hostname hostname.lan
cache_mgr admin@localhost
access_log /var/squid/logs/access.log
cache_log /var/squid/logs/cache.log
cache_store_log none
netdb_filename /var/squid/logs/netdb.state
pinger_enable off
pinger_program /usr/local/libexec/squid/pinger
sslcrtd_program /usr/local/libexec/squid/security_file_certgen -s /var/squid/lib/ssl_db -M 4MB -b 2048
tls_outgoing_options capath=/usr/local/share/certs/
tls_outgoing_options options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE
tls_outgoing_options cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS
sslcrtd_children 8

logfile_rotate 7
debug_options rotate=7
shutdown_lifetime 3 seconds
# Allow local network(s) on interface(s)
acl localnet src  192.168.30.0/24 127.0.0.0/8
forwarded_for delete
via off
httpd_suppress_version_string on
uri_whitespace encode
dns_nameservers 127.0.0.1 
acl dynamic urlpath_regex cgi-bin \?
cache deny dynamic

cache_mem 1024 MB
maximum_object_size_in_memory 256 KB
memory_replacement_policy heap GDSF
cache_replacement_policy heap LFUDA
minimum_object_size 0 KB
maximum_object_size 4 MB
cache_dir ufs /var/squid/cache 10240 16 256
offline_mode off
cache_swap_low 90
cache_swap_high 95
cache allow all
# Add any of your own refresh_pattern entries above these.
refresh_pattern ^ftp:    1440  20%  10080
refresh_pattern ^gopher:  1440  0%  1440
refresh_pattern -i (/cgi-bin/|\?) 0  0%  0
refresh_pattern .    0  20%  4320


#Remote proxies


# Setup some default acls
# ACLs all, manager, localhost, and to_localhost are predefined.
acl allsrc src all
acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901  3128 3129 1025-65535 
acl sslports port 443 563  

acl purge method PURGE
acl connect method CONNECT

# Define protocols used for redirects
acl HTTP proto HTTP
acl HTTPS proto HTTPS

# SslBump Peek and Splice
# http://wiki.squid-cache.org/Features/SslPeekAndSplice
# http://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit
# Match against the current step during ssl_bump evaluation [fast]
# Never matches and should not be used outside the ssl_bump context.
#
# At each SslBump step, Squid evaluates ssl_bump directives to find
# the next bumping action (e.g., peek or splice). Valid SslBump step
# values and the corresponding ssl_bump evaluation moments are:
#   SslBump1: After getting TCP-level and HTTP CONNECT info.
#   SslBump2: After getting TLS Client Hello info.
#   SslBump3: After getting TLS Server Hello info.
# These ACLs exist even when 'SSL/MITM Mode' is set to 'Custom' so that
# they can be used there for custom configuration.
acl step1 at_step SslBump1
acl step2 at_step SslBump2
acl step3 at_step SslBump3
acl allowed_subnets src 192.168.0.0/16 10.0.8.0/24
acl whitelist dstdom_regex -i "/var/squid/acl/whitelist.acl"
http_access allow manager localhost

http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !safeports
http_access deny CONNECT !sslports

# Always allow localhost connections
http_access allow localhost

request_body_max_size 0 KB
delay_pools 1
delay_class 1 2
delay_parameters 1 -1/-1 -1/-1
delay_initial_bucket_level 100
delay_access 1 allow allsrc

# Reverse Proxy settings


# Package Integration


# Custom options before auth


# Always allow access to whitelist domains
http_access allow whitelist
ssl_bump peek step1
ssl_bump splice all
# Setup allowed ACLs
# Allow local network(s) on interface(s)
http_access allow allowed_subnets
http_access allow localnet
# Default block all to be sure
http_access deny allsrc
      1 Reply Last reply Reply Quote 0
      • L
        letarch
        last edited by

        Any solution found?

        1 Reply Last reply Reply Quote 0
        • B
          bole5
          last edited by

          @letarch No. The issue is still there unfortunately.

          L 1 Reply Last reply Reply Quote 1
          • L
            letarch @bole5
            last edited by

            @bole5
            may be it

            1 Reply Last reply Reply Quote 0
            • First post
              Last post
            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.