Hi Everyone, we’ve just updated one of our machines to squid 4.6 with openssl 1.1.1 and ran in some strange errors when accessing *.google.com and apple app/itunes store domains. Has anyone else encountered the follow errors and nows how to solve them? Right now clients are unable to browse the apple app store and do get a squid error page when accessing google.com. Apr 16 12:17:05 squid[2201]: ERROR: negotiating TLS on FD 202: error:1425F175:SSL routines:ssl_choose_client_version:inappropriate fallback (1/-1/0) Apr 16 12:17:05 squid[2201]: 1555409825.478 327 172.20.233.28 NONE/200 0 CONNECT 104.31.75.217:443 - ORIGINAL_DST/104.31.75.217 - Apr 16 12:17:05 squid[2203]: 1555409825.184 10099 172.20.228.187 NONE_ABORTED/200 0 CONNECT 213.180.141.156:443 - HIER_NONE/- - Apr 16 12:17:05 squid[2201]: ERROR: negotiating TLS on FD 873: error:1423406E:SSL routines:tls_parse_stoc_sct:bad extension (1/-1/0) We are running squid with the following config: sslproxy_cert_error allow all https_port 3129 ssl-bump intercept connection-auth=off tls-cert=/etc/squid/myCA.pem generate-host-certificates=on dynamic_cert_mem_cache_size=12MB options=ALL tls_outgoing_options options=ALL tls_outgoing_options flags=DONT_VERIFY_PEER tls_outgoing_options default-ca=off tls_outgoing_options min-version=1.0 follow_x_forwarded_for allow all logfile_rotate 2 access_log syslog:LOG_LOCAL0:EMERGENCY squid max_filedescriptors 65535 http_port 3131 acl localnet src 10.0.0.0/8 # RFC1918 possible internal network acl localnet src 172.16.0.0/12 # RFC1918 possible internal network acl localnet src 192.168.0.0/16 # RFC1918 possible internal network acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow localhost manager http_access deny manager http_access allow localnet http_access allow localhost http_access deny all http_port 3128 transparent #debug_options ALL,9 coredump_dir /var/spool/squid url_rewrite_program /usr/bin/cf_plugin url_rewrite_extras "%ssl::>sni %>a %et" refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern (Release|Packages(.gz)*)$ 0 20% 2880 refresh_pattern . 0 20% 4320 cache deny all cache_log /dev/null logfile_rotate 0 sslproxy_session_cache_size 0 MB acl ssl_step1 at_step SslBump1 acl ssl_step2 at_step SslBump2 acl ssl_step3 at_step SslBump3 external_acl_type bump_check children-max=10 %URI %ssl::>sni %>a %et /usr/bin/cf_plugin -b acl cf_allows external bump_check ssl_bump peek ssl_step1 all always_direct allow all ssl_bump peek ssl_step2 cf_allows ssl_bump bump ssl_step3 all ssl_bump stare ssl_step2 !cf_allows ssl_bump splice ssl_step3 cf_allows ssl_bump bump ssl_step3 !cf_allows on_unsupported_protocol tunnel all url_rewrite_children 10 shutdown_lifetime 5 seconds memory_pools off cache_mem 2 MB workers 5 ipcache_size 10240 fqdncache_size 10240 httpd_suppress_version_string on Our main usage is to extract the SNI or IP from the SSL Request, forward it to cf_plugin and do some magic to decide wether this request should be blocked or not. Squid has been build with the follow options: Squid Cache: Version 4.6 Service Name: squid Ubuntu linux This binary uses OpenSSL 1.1.1b 26 Feb 2019. For legal restrictions on distribution see https://www.openssl.org/source/license.html configure options: '--build=x86_64-linux-gnu' '--prefix=/usr' '--includedir=${prefix}/include' '--mandir=${prefix}/share/man' '--infodir=${prefix}/share/info' '--sysconfdir=/etc' '--localstatedir=/var' '--libexecdir=${prefix}/lib/squid' '--srcdir=.' '--disable-maintainer-mode' '--disable-dependency-tracking' '--disable-silent-rules' 'BUILDCXXFLAGS=-g -O2 -fPIE -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2 -Wl,-Bsymbolic-functions -fPIE -pie -Wl,-z,relro -Wl,-z,now -Wl,--as-needed' '--enable-build-info=Ubuntu linux' '--datadir=/usr/share/squid' '--sysconfdir=/etc/squid' '--libexecdir=/usr/lib/squid' '--mandir=/usr/share/man' '--enable-inline' '--disable-arch-native' '--enable-async-io=8' '--enable-storeio=ufs,aufs,diskd,rock' '--enable-removal-policies=lru,heap' '--enable-delay-pools' '--enable-cache-digests' '--enable-icap-client' '--enable-follow-x-forwarded-for' '--enable-auth-basic=DB,fake,getpwnam,LDAP,NCSA,NIS,PAM,POP3,RADIUS,SASL,SMB' '--enable-auth-digest=file,LDAP' '--enable-auth-negotiate=kerberos,wrapper' '--enable-auth-ntlm=fake,SMB_LM' '--enable-external-acl-helpers=file_userip,kerberos_ldap_group,LDAP_group,session,SQL_session,time_quota,unix_group,wbinfo_group' '--enable-security-cert-validators=fake' '--enable-storeid-rewrite-helpers=file' '--enable-url-rewrite-helpers=fake' '--enable-eui' '--enable-esi' '--enable-icmp' '--enable-zph-qos' '--enable-ecap' '--disable-translation' '--with-swapdir=/var/spool/squid' '--with-logdir=/var/log/squid' '--with-pidfile=/var/run/squid.pid' '--with-filedescriptors=65536' '--with-large-files' '--with-default-user=proxy' '--with-gnutls' '--with-openssl' '--enable-linux-netfilter' 'build_alias=x86_64-linux-gnu' 'CFLAGS=-g -O2 -fPIE -fstack-protector-strong -Wformat -Werror=format-security -Wall' 'LDFLAGS=-Wl,-Bsymbolic-functions -fPIE -pie -Wl,-z,relro -Wl,-z,now -Wl,--as-needed' 'CPPFLAGS=-Wdate-time -D_FORTIFY_SOURCE=2' 'CXXFLAGS=-g -O2 -fPIE -fstack-protector-strong -Wformat -Werror=format-security' Some more Logoutput (not sure if that’s useful to debug this issue) squidclient -p 3131 mgr:info HTTP/1.1 200 OK Server: squid Mime-Version: 1.0 Date: Tue, 16 Apr 2019 10:29:09 GMT Content-Type: text/plain Expires: Tue, 16 Apr 2019 10:29:09 GMT Last-Modified: Tue, 16 Apr 2019 10:29:09 GMT Connection: close Squid Object Cache: Version 4.6 Build Info: Ubuntu linux Service Name: squid Start Time: Mon, 15 Apr 2019 20:18:12 GMT Current Time: Tue, 16 Apr 2019 10:29:09 GMT Connection information for squid: Number of clients accessing cache: 21581 Number of HTTP requests received: 754759 Number of ICP messages received: 0 Number of ICP messages sent: 0 Number of queued ICP replies: 0 Number of HTCP messages received: 0 Number of HTCP messages sent: 0 Request failure ratio: 0.00 Average HTTP requests per minute since start: 887.0 Average ICP messages per minute since start: 0.0 Select loop called: 110154975 times, 2.369 ms avg Cache information for squid: Hits as % of all requests: 5min: 0.0%, 60min: 0.0% Hits as % of bytes sent: 5min: 3.7%, 60min: 2.0% Memory hits as % of hit requests: 5min: 0.0%, 60min: 0.0% Disk hits as % of hit requests: 5min: 0.0%, 60min: 0.0% Storage Swap size: 0 KB Storage Swap capacity: 0.0% used, 0.0% free Storage Mem size: 0 KB Storage Mem capacity: 0.0% used, 100.0% free Mean Object Size: 0.00 KB Requests given to unlinkd: 0 Median Service Times (seconds) 5 min 60 min: HTTP Requests (All): 0.72598 0.66412 Cache Misses: 0.01207 0.01340 Cache Hits: 0.00000 0.00000 Near Hits: 0.00000 0.00000 Not-Modified Replies: 0.00000 0.00000 DNS Lookups: 0.00094 0.00094 ICP Queries: 0.00000 0.00000 Resource usage for squid: UP Time: 51057.266 seconds CPU Time: 4205.240 seconds CPU Usage: 8.24% CPU Usage, 5 minute avg: 17.61% CPU Usage, 60 minute avg: 20.58% Maximum Resident Size: 4742208 KB Page faults with physical i/o: 4 Memory accounted for: Total accounted: 151043 KB memPoolAlloc calls: 6205 memPoolFree calls: 155540361 File descriptor usage for squid: Maximum number of file descriptors: 5120 Largest file desc currently in use: 957 Number of file desc currently in use: 4631 Files queued for open: 0 Available number of file descriptors: 489 Reserved number of file descriptors: 500 Store Disk files open: 0 Internal Data Structures: 2540 StoreEntries 2540 StoreEntries with MemObjects 0 Hot Object Cache Items 0 on-disk objects Best Regards and thanks for your help, Chris _______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users
