Need support on HTTPs port forward

Raghu nathan <raghu.vdm@xxxxxxxxx> · Wed, 1 Apr 2020 19:04:26 +0530

Hello Team,

I’m new to Squid and need some support on advance topic, request you to advice on this requirement.

I’m trying to achieve below scenario for HTTPs traffic.

Client———>VPN———>SQUID—————>Internet

Condition:
VPN and SQUID on same machine
I didn’t want end-user (client) to know about proxy, so no configuration allowed on client end.
I’m ok to restrict/allow traffic based on SNI, so no need to decrypt the SSL packet

I was following this article to achieve this
https://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit

I have success fully rerouted the traffic on CentOS7 machine towards SQUID
HTTP traffic is working as expected, I’m able to apply policy based on custom build Helper (Python)
SQUID not able to decode the HTTPs URL even I used ssl-bump with intercept after going over resources on internet.
Notably I got  below errors, 

X-Squid-Error: ERR_INVALID_REQ 0
ERROR: No forward-proxy ports configured.

Below is the Firewalld config

  services: http https ipsec
  ports: 500/udp 4500/udp 3127/tcp 3126/tcp
  protocols:

  masquerade: yes
  forward-ports: port=80:proto=tcp:toport=3127:toaddr=10.128.0.4
port=443:proto=tcp:toport=3126:toaddr=10.128.0.4

Below is the Squid.conf

debug_options ALL,1 11,3 20,3
#
# Recommended minimum configuration:
#

# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl localnet src fc00::/7       # RFC 4193 local private network range
acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) machines

acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT

#
# Recommended minimum Access Permission configuration:
#
# Deny requests to certain unsafe ports
#http_access deny !Safe_ports

# Deny CONNECT to other than secure SSL ports
#http_access deny CONNECT !SSL_ports

# Only allow cachemgr access from localhost
http_access allow localhost manager
http_access deny manager

# do not cache anything
cache deny all

# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
#http_access deny to_localhost

#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#

# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
http_access allow localnet
http_access allow localhost

# And finally deny all other access to this proxy
http_access allow all

# Squid normally listens to port 3128
http_port 3127 intercept
#http_port 3126
http_port 3126 ssl-bump intercept \
  cert=/etc/squid/cert/myCA.pem \
  generate-host-certificates=on dynamic_cert_mem_cache_size=4MB

sslcrtd_program /usr/lib64/squid/ssl_crtd -s /var/spool/squid/ssl_db -M 4MB

# Uncomment and adjust the following to add a disk cache directory.
#cache_dir ufs /var/spool/squid 100 16 256

# Leave coredumps in the first cache dir
coredump_dir /var/spool/squid

#
# Add any of your own refresh_pattern entries above these.
#
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320

sslproxy_cert_error allow all

#ssl bump
#ssl_bump peek all
ssl_bump stare all
ssl_bump bump all

Error log:
2020/04/01 12:55:13.459 kid1| 20,3| store.cc(521) unlock: store_client::copy unlocking key 67A641E2D51E4D78DC31FD1B1792BE59 e:=sXINV/0x5560eb4c70a0*3
2020/04/01 12:55:13.459 kid1| 20,2| store.cc(949) checkCachable: StoreEntry::checkCachable: NO: not cachable
2020/04/01 12:55:13.459 kid1| 20,3| store.cc(483) lock: storeUnregister locked key 67A641E2D51E4D78DC31FD1B1792BE59 e:=sXINV/0x5560eb4c70a0*3
2020/04/01 12:55:13.459 kid1| 20,3| store.cc(521) unlock: storeUnregister unlocking key 67A641E2D51E4D78DC31FD1B1792BE59 e:=sXINV/0x5560eb4c70a0*3
2020/04/01 12:55:13.459 kid1| 20,3| store.cc(521) unlock: clientReplyContext::removeStoreReference unlocking key 67A641E2D51E4D78DC31FD1B1792BE59 e:=sXINV/0x5560eb4c70a0*2
2020/04/01 12:55:13.459 kid1| 20,3| store.cc(521) unlock: ClientHttpRequest::loggingEntry unlocking key 67A641E2D51E4D78DC31FD1B1792BE59 e:=sXINV/0x5560eb4c70a0*1
2020/04/01 12:55:13.459 kid1| 20,3| store.cc(1239) release: releasing e:=sXINV/0x5560eb4c70a0*0 67A641E2D51E4D78DC31FD1B1792BE59
2020/04/01 12:55:13.459 kid1| 20,3| store.cc(402) destroyMemObject: destroyMemObject 0x5560eb4d0f40
2020/04/01 12:55:13.459 kid1| 20,3| MemObject.cc(110) ~MemObject: del MemObject 0x5560eb4d0f40
2020/04/01 12:55:13.459 kid1| 20,3| store.cc(420) destroyStoreEntry: destroyStoreEntry: destroying 0x5560eb4c70a8
2020/04/01 12:55:13.459 kid1| 20,3| store.cc(402) destroyMemObject: destroyMemObject 0
2020/04/01 12:55:14.008 kid1| 20,3| store.cc(774) storeCreatePureEntry: storeCreateEntry: 'error:invalid-request'
2020/04/01 12:55:14.008 kid1| 20,3| MemObject.cc(97) MemObject: new MemObject 0x5560eb4d0f40
2020/04/01 12:55:14.008 kid1| 20,3| store.cc(499) setReleaseFlag: StoreEntry::setReleaseFlag: '[null_store_key]'
2020/04/01 12:55:14.008 kid1| 20,3| store_key_md5.cc(89) storeKeyPrivate: storeKeyPrivate: NONE error:invalid-request
2020/04/01 12:55:14.008 kid1| 20,3| store.cc(447) hashInsert: StoreEntry::hashInsert: Inserting Entry e:=XI/0x5560eb4c70a0*0 key '0255EA5E5890358FC3F4287C4CA0E49F'
2020/04/01 12:55:14.008 kid1| 20,3| store.cc(483) lock: storeCreateEntry locked key 0255EA5E5890358FC3F4287C4CA0E49F e:=XIV/0x5560eb4c70a0*1
2020/04/01 12:55:14.008 kid1| 20,3| store.cc(483) lock: StoreEntry::storeErrorResponse locked key 0255EA5E5890358FC3F4287C4CA0E49F e:=XIV/0x5560eb4c70a0*2
2020/04/01 12:55:14.008 kid1| 20,3| store.cc(1862) replaceHttpReply: StoreEntry::replaceHttpReply: error:invalid-request
2020/04/01 12:55:14.008 kid1| 20,2| store.cc(949) checkCachable: StoreEntry::checkCachable: NO: not cachable
2020/04/01 12:55:14.008 kid1| 20,3| store.cc(1048) complete: storeComplete: '0255EA5E5890358FC3F4287C4CA0E49F'
2020/04/01 12:55:14.008 kid1| 20,3| store.cc(1337) validLength: storeEntryValidLength: Checking '0255EA5E5890358FC3F4287C4CA0E49F'
2020/04/01 12:55:14.008 kid1| 20,2| store.cc(949) checkCachable: StoreEntry::checkCachable: NO: not cachable
2020/04/01 12:55:14.008 kid1| 20,3| store.cc(521) unlock: StoreEntry::storeErrorResponse unlocking key 0255EA5E5890358FC3F4287C4CA0E49F e:=sXINV/0x5560eb4c70a0*2
2020/04/01 12:55:14.008 kid1| 20,3| store.cc(483) lock: store_client::copy locked key 0255EA5E5890358FC3F4287C4CA0E49F e:=sXINV/0x5560eb4c70a0*2
2020/04/01 12:55:14.008 kid1| ERROR: No forward-proxy ports configured.
2020/04/01 12:55:14.008 kid1| 20,3| store.cc(483) lock: ClientHttpRequest::loggingEntry locked key 0255EA5E5890358FC3F4287C4CA0E49F e:=sXINV/0x5560eb4c70a0*3
2020/04/01 12:55:14.008 kid1| 11,2| client_side.cc(1393) sendStartOfMessage: HTTP Client local=172.217.4.46:443 remote=10.15.1.100:53362 FD 10 flags=33
2020/04/01 12:55:14.008 kid1| 11,2| client_side.cc(1394) sendStartOfMessage: HTTP Client REPLY:
---------
HTTP/1.1 400 Bad Request
Server: squid/3.5.20
Mime-Version: 1.0
Date: Wed, 01 Apr 2020 12:55:14 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 4033
X-Squid-Error: ERR_INVALID_REQ 0
Vary: Accept-Language
Content-Language: en
X-Cache: MISS from proto-vpn
X-Cache-Lookup: NONE from proto-vpn:0
Via: 1.1 proto-vpn (squid/3.5.20)
Connection: close
_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users