On 01/03/2017 03:41 PM, Eliezer Croitoru wrote: > Squid in intercept or tproxy mode will know one thing about the tunnel\connection: IP+port. ... and SSL handshake information when peeking or staring at client/server. > Since you are using: >> ssl_bump peek all >> ssl_bump splice all > The connections will always be spliced and you will never see any > url.(are you expecting only the SNI or also the url?) AFAICT, Mark is expecting Squid to log one of the server names, not the HTTP request URL. > I do not know but there might be a code that can report the SNI if exists in the logs. According to squid.conf.documented, the following logformat %code is supported in modern Squids: > ssl::>sni SSL client SNI sent to Squid. Available only > after the peek, stare, or splice SSL bumping > actions. This %code is not in the default access.log line format, naturally. Squid can also analyze CN and other server certificate fields, but there is no code to log them IIRC. Please note that the intercepted server IP address, the client-supplied SNI name, the server-supplied common name (CN), the server-supplied alternative names, and the host info in the encrypted client HTTP request, may all be different. Given the variety of information sources that might supply different information, it is not clear to me whether %ru should be based on SNI information when both TCP-level and SNI information is available. Or should it be based on CN? Or perhaps on CN _unless_ SNI matches one of the alternative names?? This is a complicated issue; even the smart server_name ACL needs parameters to clarify what "server name(s)" the admin really wants to use/trust... According to Mark's email, %ru uses TCP-level info. We could either change %ru to use the "latest" info (like the server_name ACL does) or add a new logformat code that does that while leaving the old %ru and friends alone. Given the complexity of the issue, the latter may be a better approach. HTH, Alex. > -----Original Message----- > From: squid-users [mailto:squid-users-bounces@xxxxxxxxxxxxxxxxxxxxx] On Behalf Of Mark Hoare > Sent: Saturday, December 31, 2016 4:38 PM > To: squid-users@xxxxxxxxxxxxxxxxxxxxx > Subject: ssl_bump - peek & splice logging IP rather than server name > Extract from access log: >> 1483193882.790 870 <local ip removed> TCP_TUNNEL/200 5620 CONNECT 64.41.200.100:443 - ORIGINAL_DST/64.41.200.100 - > From the output above I would have expected some of the server name info to get into the access log. >> http_port 3128 >> >> https_port 3130 intercept ssl-bump cert=/etc/squid/ssl_cert/squidCA.pem generate-host-certificates=on dynamic_cert_mem_cache_size=4MB >> >> http_port 3131 intercept ssl-bump cert=/etc/squid/ssl_cert/squidCA.pem generate-host-certificates=on dynamic_cert_mem_cache_size=4MB >> ssl_bump peek all >> ssl_bump splice all _______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users
