Squid in transparent mode on sites with sni



  • hello all,

    i configured squid as transparent reverse proxy and everything works well, except some sites that ues sni. for example going to https://fcku.it/ squid returns a certificate with a common name 31337.it - that is the certificate of the first site on that same ip.

    is this an error in my configuration or should i file a bug?

    thanks for reading.

     This file is automatically generated by pfSense
    # Do not edit manually !
    
    http_port 192.168.0.1:3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=10MB cert=/usr/local/etc/squid/serverkey.
    pem capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:
    EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS dhparams=/etc/dh-parameters
    .2048 options=NO_SSLv2,NO_SSLv3,SINGLE_DH_USE
    
    http_port 127.0.0.1:3128 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=10MB cert=/usr/local/etc/squid/se
    rverkey.pem capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA
    +SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS dhparams=/etc/dh-pa
    rameters.2048 options=NO_SSLv2,NO_SSLv3,SINGLE_DH_USE
    
    https_port 127.0.0.1:3129 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=10MB cert=/usr/local/etc/squid/s
    erverkey.pem capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRS
    A+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS dhparams=/etc/dh-p
    arameters.2048 options=NO_SSLv2,NO_SSLv3,SINGLE_DH_USE
    
    icp_port 0
    dns_v4_first off
    pid_filename /var/run/squid/squid.pid
    cache_effective_user squid
    cache_effective_group proxy
    error_default_language en
    icon_directory /usr/local/etc/squid/icons
    visible_hostname localhost
    cache_mgr admin@localhost
    access_log /squid/logs/access.log
    cache_log /squid/logs/cache.log
    cache_store_log none
    netdb_filename /squid/logs/netdb.state
    pinger_enable on
    pinger_program /usr/local/libexec/squid/pinger
    sslcrtd_program /usr/local/libexec/squid/ssl_crtd -s /var/squid/lib/ssl_db -M 4MB -b 2048
    sslcrtd_children 5
    sslproxy_capath /usr/local/share/certs/
    sslproxy_options NO_SSLv2,NO_SSLv3,SINGLE_DH_USE
    sslproxy_cipher EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aR
    SA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS
    
    logfile_rotate 5
    debug_options rotate=5
    shutdown_lifetime 3 seconds
    # Allow local network(s) on interface(s)
    acl localnet src  192.168.0.0/24
    forwarded_for delete
    via off
    httpd_suppress_version_string on
    uri_whitespace strip
    
    acl dynamic urlpath_regex cgi-bin \?
    cache deny dynamic
    
    cache_mem 64 MB
    maximum_object_size_in_memory 256 KB
    memory_replacement_policy heap GDSF
    cache_replacement_policy heap LFUDA
    minimum_object_size 0 KB
    maximum_object_size 4 MB
    cache_dir ufs /squid/cache 100 16 256
    offline_mode off
    cache_swap_low 90
    cache_swap_high 95
    cache allow all
    # Add any of your own refresh_pattern entries above these.
    refresh_pattern ^ftp:    1440  20%  10080
    refresh_pattern ^gopher:  1440  0%  1440
    refresh_pattern -i (/cgi-bin/|\?) 0  0%  0
    refresh_pattern .    0  20%  4320
    
    #Remote proxies
    
    # Setup some default acls
    # From 3.2 further configuration cleanups have been done to make things easier and safer. The manager, localhost, and to_localhost ACL
    definitions are now built-in.
    # acl localhost src 127.0.0.1/32
    acl allsrc src all
    acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901  3128 3129 1025-65535
    acl sslports port 443 563
    
    # From 3.2 further configuration cleanups have been done to make things easier and safer. The manager, localhost, and to_localhost ACL
    definitions are now built-in.
    #acl manager proto cache_object
    
    acl purge method PURGE
    acl connect method CONNECT
    
    # Define protocols used for redirects
    acl HTTP proto HTTP
    acl HTTPS proto HTTPS
    http_access allow manager localhost
    
    http_access deny manager
    http_access allow purge localhost
    http_access deny purge
    http_access deny !safeports
    http_access deny CONNECT !sslports
    
    # Always allow localhost connections
    # From 3.2 further configuration cleanups have been done to make things easier and safer.
    # The manager, localhost, and to_localhost ACL definitions are now built-in.
    # http_access allow localhost
    
    request_body_max_size 0 KB
    delay_pools 1
    delay_class 1 2
    delay_parameters 1 -1/-1 -1/-1
    delay_initial_bucket_level 100
    delay_access 1 allow allsrc
    
    # Reverse Proxy settings
    
    # Custom options before auth
    
    always_direct allow all
    ssl_bump server-first all
    # Setup allowed ACLs
    # Allow local network(s) on interface(s)
    http_access allow localnet
    # Default block all to be sure
    http_access deny allsrc
    
    

    reading the docs¹ i seem to understand that ssl_bump server-first all should maybe be set to ssl_bump peek|stare all in squid 3.5?

    ¹http://wiki.squid-cache.org/Features/SslPeekAndSplice



  • just a quick question: has someone here squid working in transparent mode with ssl? does it work for you on sites with sni?
    just to know if this CAN work.



  • Hi,
    In Squid 3.5, ssl_bump server-first all is deprecated and can't be used (at last in transparent mode) for sni sites. This must be fixed by the pfsense developments.

    Insert the following code in Custom ACLS (Before Auth) and test navigating to this site: https://sni.velox.ch/

    acl step1 at_step SslBump1
    
    ssl_bump peek step1
    ssl_bump bump all
    

    For me, this is working very well with gmail.com and other sites using sni.



  • @mepstein:

    Hi,
    In Squid 3.5, ssl_bump server-first all is deprecated and can't be used (at last in transparent mode) for sni sites. This must be fixed by the pfsense developments.

    Insert the following code in Custom ACLS (Before Auth) and test navigating to this site: https://sni.velox.ch/

    acl step1 at_step SslBump1
    
    ssl_bump peek step1
    ssl_bump bump all
    

    For me, this is working very well with gmail.com and other sites using sni.

    thank you so much mepstein. this solved it nicely.


Log in to reply