Search squid archive

Re: sslBump and intercept

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 




-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
 
More probably this is bug http://bugs.squid-cache.org/show_bug.cgi?id=4188.

12.11.15 18:04, Steve Hill пишет:
> On 12/11/15 09:04, Eugene M. Zheganin wrote:
>
>> I decided to intercept the HTTPS traffic on my production squids from
>> proxy-unware clients to be able to tell them there's a proxy and they
>> should configure one.
>> So I'm doing it like (the process of forwarding using FreeBSD pf is not
>> shown here):
>>
>> ===Cut===
>> acl unauthorized proxy_auth stringthatwillnevermatch
>> acl step1 at_step sslBump1
>>
>> https_port 127.0.0.1:3131 intercept ssl-bump
>> cert=/usr/local/etc/squid/certs/squid.cert.pem
>> generate-host-certificates=on dynamic_cert_mem_cache_size=4MB
>> dhparams=/usr/local/etc/squid/certs/dhparam.pem
>> https_port [::1]:3131 intercept ssl-bump
>> cert=/usr/local/etc/squid/certs/squid.cert.pem
>> generate-host-certificates=on dynamic_cert_mem_cache_size=4MB
>> dhparams=/usr/local/etc/squid/certs/dhparam.pem
>>
>> ssl_bump peek step1
>> ssl_bump bump unauthorized
>> ssl_bump splice all
>> ===Cut===
>>
>> Almost everything works, except that squid for some reason is generating
>> certificates in this case for IP addresses, not names, so the browser
>> shows a warning abount certificate being valid only for IP, and not name.
>
> proxy_auth won't work on intercepted traffic and will therefore always return false, so as far as I can see you're always going to peek and then splice.  i.e. you're never going to bump, so squid should never be generating a forged certificate.
>
> You say that Squid _is_ generating a forged certificate, so something else is going on to cause it to do that.  My first guess is that Squid is generating some kind of error page due to some http_access rules which you haven't listed, and is therefore bumping.
>
> Two possibilities spring to mind for the certificate being for the IP address rather than for the name:
> 1. The browser isn't bothering to include an SNI in the SSL handshake (use wireshark to confirm).  In this case, Squid has no way to know what name to stick in the cert, so will just use the IP instead.
> 2. The bumping is happening in step 1 instead of step 2 for some reason.  See:  http://bugs.squid-cache.org/show_bug.cgi?id=4327
>
>
>
> _______________________________________________
> squid-users mailing list
> squid-users@xxxxxxxxxxxxxxxxxxxxx
> http://lists.squid-cache.org/listinfo/squid-users


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
 
iQEcBAEBCAAGBQJWRIqmAAoJENNXIZxhPexGNGYIAIjJEGvbSa5WovjyrdzsBM+/
f3ucdM4x8e4CZtNxOhOoLlLOZdsG0vr6aiHDDOcKhPGL9wg0goQnvToaZguqtcDG
JcSLA3iwR/GI8RmTmmODsqDOyxLAVQx6JjWQKQIkYE5nvCOh7orSnh2oaUHqkG2P
0bxMI2NR6RB977rQPiZlN89yp1wdd0C99iBvEs6chifoTMrSQzKstEs31k8zt1Ae
ZTM/aEMnqXf0GiDbayXcPMYoQ6w9/fEpQ5wA/mCQSE4ZH71zPsChPqCcA2jp8gU5
VR4+ZQeLklSEiGweun8Yk1LAupTf7APRV+H2yX/m6ElXXkMMDFu5OM9plMQHFKo=
=LXF6
-----END PGP SIGNATURE-----

_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users

[Index of Archives]     [Linux Audio Users]     [Samba]     [Big List of Linux Books]     [Linux USB]     [Yosemite News]

  Powered by Linux