Squid in transparent mode with splice_all generates lot of error:transaction-end-before-headers

  • Hello,

    I have a separate network for my children. Squid is set up on that interface and Transparent mode is enabled. SSL filtering is also enabled with option Splice All. Children have android and apple devices (iPhones, iPads, Kindle, etc)

    When running in transparent mode we are noticing intermittent problems with various services:

    • Spotify sometimes stops working and reports connection problems
    • WhatsApp and other social networking apps stop connecting
    • Netflix on my LGTV stops displaying thumbnails when fast forwarding a movie
    • icloud services stop/resume working
    • various websites don't work ie. espn.com can't stream videos, but content is visible and working

    The services would sometimes resume working after restarting the app.
    The problems completely go away when I stop using transparent mode and set up proxy in each device's wifi settings.

    When looking at the realtime logs I see following pattern emerging:

    • a request for a resource with http code 409
    • error:transaction-end-before-headers
    • a connection to ip address of the resource with http code 200
    29.09.2020 18:31:18	NONE/200	-	-
    29.09.2020 18:31:18	NONE/000	error:transaction-end-before-headers	-	-
    29.09.2020 18:31:18	NONE/409	bag.itunes.apple.com:443	-	-

    Additional information along with my squid.conf is provided below.

    Does anyone have ideas? I saw this message being reported in various squid forums. Interesting thing is that it only happens in transparent mode - so maybe it has something to do with the NAT rules?

    Kind regards,

    Other examples from realtime logs are below. Needless to say I am seeing a lot of the entries repeating below:

    28.09.2020 13:21:14	NONE/200	-	-
    28.09.2020 13:21:14	NONE/000	error:transaction-end-before-headers	-	-
    28.09.2020 13:21:14	NONE/409	encrypted-tbn0.gstatic.com:443	-	-
    28.09.2020 13:21:03	NONE/200	-	-
    28.09.2020 13:21:03	NONE/000	error:transaction-end-before-headers	-	-
    28.09.2020 13:21:03	NONE/409	a2.espncdn.com:443	-	-
    28.09.2020 22:56:07	NONE/200	-	-
    28.09.2020 22:56:07	NONE/000	error:transaction-end-before-headers	-	-
    28.09.2020 22:56:07	NONE/409	tp-s.nflximg.net:443	-	-

    My squid.conf is below.
    cat /usr/local/etc/squid/squid.conf

    # This file is automatically generated by pfSense
    # Do not edit manually !
    http_port ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=16MB cert=/usr/local/etc/squid/serverkey.pem capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE
    icp_port 0
    digest_generation off
    dns_v4_first on
    pid_filename /var/run/squid/squid.pid
    cache_effective_user squid
    cache_effective_group proxy
    error_default_language en
    icon_directory /usr/local/etc/squid/icons
    visible_hostname hostname.lan
    cache_mgr admin@localhost
    access_log /var/squid/logs/access.log
    cache_log /var/squid/logs/cache.log
    cache_store_log none
    netdb_filename /var/squid/logs/netdb.state
    pinger_enable off
    pinger_program /usr/local/libexec/squid/pinger
    sslcrtd_program /usr/local/libexec/squid/security_file_certgen -s /var/squid/lib/ssl_db -M 4MB -b 2048
    tls_outgoing_options capath=/usr/local/share/certs/
    tls_outgoing_options options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE
    sslcrtd_children 8
    logfile_rotate 7
    debug_options rotate=7
    shutdown_lifetime 3 seconds
    # Allow local network(s) on interface(s)
    acl localnet src
    forwarded_for delete
    via off
    httpd_suppress_version_string on
    uri_whitespace encode
    acl dynamic urlpath_regex cgi-bin \?
    cache deny dynamic
    cache_mem 1024 MB
    maximum_object_size_in_memory 256 KB
    memory_replacement_policy heap GDSF
    cache_replacement_policy heap LFUDA
    minimum_object_size 0 KB
    maximum_object_size 4 MB
    cache_dir ufs /var/squid/cache 10240 16 256
    offline_mode off
    cache_swap_low 90
    cache_swap_high 95
    cache allow all
    # Add any of your own refresh_pattern entries above these.
    refresh_pattern ^ftp:    1440  20%  10080
    refresh_pattern ^gopher:  1440  0%  1440
    refresh_pattern -i (/cgi-bin/|\?) 0  0%  0
    refresh_pattern .    0  20%  4320
    #Remote proxies
    # Setup some default acls
    # ACLs all, manager, localhost, and to_localhost are predefined.
    acl allsrc src all
    acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901  3128 3129 1025-65535 
    acl sslports port 443 563  
    acl purge method PURGE
    acl connect method CONNECT
    # Define protocols used for redirects
    acl HTTP proto HTTP
    acl HTTPS proto HTTPS
    # SslBump Peek and Splice
    # http://wiki.squid-cache.org/Features/SslPeekAndSplice
    # http://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit
    # Match against the current step during ssl_bump evaluation [fast]
    # Never matches and should not be used outside the ssl_bump context.
    # At each SslBump step, Squid evaluates ssl_bump directives to find
    # the next bumping action (e.g., peek or splice). Valid SslBump step
    # values and the corresponding ssl_bump evaluation moments are:
    #   SslBump1: After getting TCP-level and HTTP CONNECT info.
    #   SslBump2: After getting TLS Client Hello info.
    #   SslBump3: After getting TLS Server Hello info.
    # These ACLs exist even when 'SSL/MITM Mode' is set to 'Custom' so that
    # they can be used there for custom configuration.
    acl step1 at_step SslBump1
    acl step2 at_step SslBump2
    acl step3 at_step SslBump3
    acl allowed_subnets src
    acl whitelist dstdom_regex -i "/var/squid/acl/whitelist.acl"
    http_access allow manager localhost
    http_access deny manager
    http_access allow purge localhost
    http_access deny purge
    http_access deny !safeports
    http_access deny CONNECT !sslports
    # Always allow localhost connections
    http_access allow localhost
    request_body_max_size 0 KB
    delay_pools 1
    delay_class 1 2
    delay_parameters 1 -1/-1 -1/-1
    delay_initial_bucket_level 100
    delay_access 1 allow allsrc
    # Reverse Proxy settings
    # Package Integration
    # Custom options before auth
    # Always allow access to whitelist domains
    http_access allow whitelist
    ssl_bump peek step1
    ssl_bump splice all
    # Setup allowed ACLs
    # Allow local network(s) on interface(s)
    http_access allow allowed_subnets
    http_access allow localnet
    # Default block all to be sure
    http_access deny allsrc

Log in to reply