Search squid archive

Squid 4.6 "SSL routines:tls_parse_stoc_sct:bad extension"

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi Everyone,

we’ve just updated one of our machines to squid 4.6 with openssl 1.1.1 and ran in some strange errors when accessing *.google.com and apple app/itunes store domains. 
Has anyone else encountered the follow errors and nows how to solve them? Right now clients are unable to browse the apple app store and do get a squid error page when accessing google.com.

Apr 16 12:17:05 squid[2201]: ERROR: negotiating TLS on FD 202: error:1425F175:SSL routines:ssl_choose_client_version:inappropriate fallback (1/-1/0)
Apr 16 12:17:05 squid[2201]: 1555409825.478    327 172.20.233.28 NONE/200 0 CONNECT 104.31.75.217:443 - ORIGINAL_DST/104.31.75.217 -

Apr 16 12:17:05 squid[2203]: 1555409825.184  10099 172.20.228.187 NONE_ABORTED/200 0 CONNECT 213.180.141.156:443 - HIER_NONE/- -
Apr 16 12:17:05 squid[2201]: ERROR: negotiating TLS on FD 873: error:1423406E:SSL routines:tls_parse_stoc_sct:bad extension (1/-1/0)


We are running squid with the following config:

sslproxy_cert_error allow all
https_port 3129 ssl-bump intercept connection-auth=off tls-cert=/etc/squid/myCA.pem generate-host-certificates=on dynamic_cert_mem_cache_size=12MB options=ALL
tls_outgoing_options options=ALL
tls_outgoing_options flags=DONT_VERIFY_PEER
tls_outgoing_options default-ca=off
tls_outgoing_options min-version=1.0

follow_x_forwarded_for allow all
logfile_rotate 2
access_log syslog:LOG_LOCAL0:EMERGENCY squid
max_filedescriptors 65535

http_port 3131
acl localnet src 10.0.0.0/8	# RFC1918 possible internal network
acl localnet src 172.16.0.0/12	# RFC1918 possible internal network
acl localnet src 192.168.0.0/16	# RFC1918 possible internal network

acl SSL_ports port 443
acl Safe_ports port 80		# http
acl Safe_ports port 21		# ftp
acl Safe_ports port 443		# https
acl Safe_ports port 70		# gopher
acl Safe_ports port 210		# wais
acl Safe_ports port 1025-65535	# unregistered ports
acl Safe_ports port 280		# http-mgmt
acl Safe_ports port 488		# gss-http
acl Safe_ports port 591		# filemaker
acl Safe_ports port 777		# multiling http
acl CONNECT method CONNECT

http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
http_access allow localnet
http_access allow localhost
http_access deny all
http_port 3128 transparent
#debug_options ALL,9
coredump_dir /var/spool/squid
url_rewrite_program /usr/bin/cf_plugin
url_rewrite_extras "%ssl::>sni %>a %et"

refresh_pattern ^ftp:		1440	20%	10080
refresh_pattern ^gopher:	1440	0%	1440
refresh_pattern -i (/cgi-bin/|\?) 0	0%	0
refresh_pattern (Release|Packages(.gz)*)$      0       20%     2880
refresh_pattern .		0	20%	4320

cache deny all
cache_log /dev/null
logfile_rotate 0

sslproxy_session_cache_size 0 MB

acl ssl_step1 at_step SslBump1
acl ssl_step2 at_step SslBump2
acl ssl_step3 at_step SslBump3

external_acl_type bump_check children-max=10 %URI %ssl::>sni %>a %et /usr/bin/cf_plugin -b
acl cf_allows external bump_check

ssl_bump peek ssl_step1 all
always_direct allow all
ssl_bump peek ssl_step2 cf_allows
ssl_bump bump ssl_step3 all
ssl_bump stare ssl_step2 !cf_allows
ssl_bump splice ssl_step3 cf_allows
ssl_bump bump ssl_step3 !cf_allows

on_unsupported_protocol tunnel all
url_rewrite_children 10
shutdown_lifetime 5 seconds
memory_pools off
cache_mem 2 MB
workers 5
ipcache_size 10240
fqdncache_size 10240
httpd_suppress_version_string on


Our main usage is to extract the SNI or IP from the SSL Request, forward it to cf_plugin and do some magic to decide wether this request should be blocked or not.

Squid has been build with the follow options:

Squid Cache: Version 4.6
Service Name: squid
Ubuntu linux

This binary uses OpenSSL 1.1.1b  26 Feb 2019. For legal restrictions on distribution see https://www.openssl.org/source/license.html

configure options:  '--build=x86_64-linux-gnu' '--prefix=/usr' '--includedir=${prefix}/include' '--mandir=${prefix}/share/man' '--infodir=${prefix}/share/info' '--sysconfdir=/etc' '--localstatedir=/var' '--libexecdir=${prefix}/lib/squid' '--srcdir=.' '--disable-maintainer-mode' '--disable-dependency-tracking' '--disable-silent-rules' 'BUILDCXXFLAGS=-g -O2 -fPIE -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2 -Wl,-Bsymbolic-functions -fPIE -pie -Wl,-z,relro -Wl,-z,now -Wl,--as-needed' '--enable-build-info=Ubuntu linux' '--datadir=/usr/share/squid' '--sysconfdir=/etc/squid' '--libexecdir=/usr/lib/squid' '--mandir=/usr/share/man' '--enable-inline' '--disable-arch-native' '--enable-async-io=8' '--enable-storeio=ufs,aufs,diskd,rock' '--enable-removal-policies=lru,heap' '--enable-delay-pools' '--enable-cache-digests' '--enable-icap-client' '--enable-follow-x-forwarded-for' '--enable-auth-basic=DB,fake,getpwnam,LDAP,NCSA,NIS,PAM,POP3,RADIUS,SASL,SMB' '--enable-auth-digest=file,LDAP' '--enable-auth-negotiate=kerberos,wrapper' '--enable-auth-ntlm=fake,SMB_LM' '--enable-external-acl-helpers=file_userip,kerberos_ldap_group,LDAP_group,session,SQL_session,time_quota,unix_group,wbinfo_group' '--enable-security-cert-validators=fake' '--enable-storeid-rewrite-helpers=file' '--enable-url-rewrite-helpers=fake' '--enable-eui' '--enable-esi' '--enable-icmp' '--enable-zph-qos' '--enable-ecap' '--disable-translation' '--with-swapdir=/var/spool/squid' '--with-logdir=/var/log/squid' '--with-pidfile=/var/run/squid.pid' '--with-filedescriptors=65536' '--with-large-files' '--with-default-user=proxy' '--with-gnutls' '--with-openssl' '--enable-linux-netfilter' 'build_alias=x86_64-linux-gnu' 'CFLAGS=-g -O2 -fPIE -fstack-protector-strong -Wformat -Werror=format-security -Wall' 'LDFLAGS=-Wl,-Bsymbolic-functions -fPIE -pie -Wl,-z,relro -Wl,-z,now -Wl,--as-needed' 'CPPFLAGS=-Wdate-time -D_FORTIFY_SOURCE=2' 'CXXFLAGS=-g -O2 -fPIE -fstack-protector-strong -Wformat -Werror=format-security'


Some more Logoutput (not sure if that’s useful to debug this issue)

squidclient -p 3131 mgr:info
HTTP/1.1 200 OK
Server: squid
Mime-Version: 1.0
Date: Tue, 16 Apr 2019 10:29:09 GMT
Content-Type: text/plain
Expires: Tue, 16 Apr 2019 10:29:09 GMT
Last-Modified: Tue, 16 Apr 2019 10:29:09 GMT
Connection: close

Squid Object Cache: Version 4.6
Build Info: Ubuntu linux
Service Name: squid
Start Time:	Mon, 15 Apr 2019 20:18:12 GMT
Current Time:	Tue, 16 Apr 2019 10:29:09 GMT
Connection information for squid:
	Number of clients accessing cache:	21581
	Number of HTTP requests received:	754759
	Number of ICP messages received:	0
	Number of ICP messages sent:	0
	Number of queued ICP replies:	0
	Number of HTCP messages received:	0
	Number of HTCP messages sent:	0
	Request failure ratio:	 0.00
	Average HTTP requests per minute since start:	887.0
	Average ICP messages per minute since start:	0.0
	Select loop called: 110154975 times, 2.369 ms avg
Cache information for squid:
	Hits as % of all requests:	5min: 0.0%, 60min: 0.0%
	Hits as % of bytes sent:	5min: 3.7%, 60min: 2.0%
	Memory hits as % of hit requests:	5min: 0.0%, 60min: 0.0%
	Disk hits as % of hit requests:	5min: 0.0%, 60min: 0.0%
	Storage Swap size:	0 KB
	Storage Swap capacity:	 0.0% used,  0.0% free
	Storage Mem size:	0 KB
	Storage Mem capacity:	 0.0% used, 100.0% free
	Mean Object Size:	0.00 KB
	Requests given to unlinkd:	0
Median Service Times (seconds)  5 min    60 min:
	HTTP Requests (All):   0.72598  0.66412
	Cache Misses:          0.01207  0.01340
	Cache Hits:            0.00000  0.00000
	Near Hits:             0.00000  0.00000
	Not-Modified Replies:  0.00000  0.00000
	DNS Lookups:           0.00094  0.00094
	ICP Queries:           0.00000  0.00000
Resource usage for squid:
	UP Time:	51057.266 seconds
	CPU Time:	4205.240 seconds
	CPU Usage:	8.24%
	CPU Usage, 5 minute avg:	17.61%
	CPU Usage, 60 minute avg:	20.58%
	Maximum Resident Size: 4742208 KB
	Page faults with physical i/o: 4
Memory accounted for:
	Total accounted:       151043 KB
	memPoolAlloc calls:      6205
	memPoolFree calls:  155540361
File descriptor usage for squid:
	Maximum number of file descriptors:   5120
	Largest file desc currently in use:    957
	Number of file desc currently in use: 4631
	Files queued for open:                   0
	Available number of file descriptors:  489
	Reserved number of file descriptors:   500
	Store Disk files open:                   0
Internal Data Structures:
	  2540 StoreEntries
	  2540 StoreEntries with MemObjects
	     0 Hot Object Cache Items
	     0 on-disk objects


Best Regards and thanks for your help,
Chris

_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users




[Index of Archives]     [Linux Audio Users]     [Samba]     [Big List of Linux Books]     [Linux USB]     [Yosemite News]

  Powered by Linux