I'm testing SSL BUMP in 5.0.4 and it's working pretty well despite some
hiccups.
I am trying to think about the right solution for the next issue:
SECURITY ALERT: Host header forgery detected on conn18767
local=52.114.32.24:443 remote=192.168.189.52:65107 FD 15 flags=33 (local IP
does not match any domain IP)
current master
transaction: master12927
The main issue is that the DNS service changes address every 10 ~ seconds.
An example:
### DRILL START
# drill mobile.pipe.aria.microsoft.com
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 23399
;; flags: qr rd ra ; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;; mobile.pipe.aria.microsoft.com. IN A
;; ANSWER SECTION:
mobile.pipe.aria.microsoft.com. 3066 IN CNAME
mobile.events.data.trafficmanager.net.
mobile.events.data.trafficmanager.net. 43 IN CNAME
skypedataprdcolcus06.cloudapp.net.
skypedataprdcolcus06.cloudapp.net. 1 IN A
52.114.128.69
;; AUTHORITY SECTION:
;; ADDITIONAL SECTION:
;; Query time: 3 msec
;; SERVER: 192.168.200.1
;; WHEN: Wed Jan 6 20:22:28 2021
;; MSG SIZE rcvd: 159
### DRILL END
### DRILL START
# drill mobile.pipe.aria.microsoft.com
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 15462
;; flags: qr rd ra ; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;; mobile.pipe.aria.microsoft.com. IN A
;; ANSWER SECTION:
mobile.pipe.aria.microsoft.com. 3065 IN CNAME
mobile.events.data.trafficmanager.net.
mobile.events.data.trafficmanager.net. 42 IN CNAME
skypedataprdcolcus06.cloudapp.net.
skypedataprdcolcus06.cloudapp.net. 0 IN A
52.114.128.69
;; AUTHORITY SECTION:
;; ADDITIONAL SECTION:
;; Query time: 23 msec
;; SERVER: 192.168.200.1
;; WHEN: Wed Jan 6 20:22:29 2021
;; MSG SIZE rcvd: 159
[root@px1 bin]# drill mobile.pipe.aria.microsoft.com
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 31545
;; flags: qr rd ra ; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;; mobile.pipe.aria.microsoft.com. IN A
;; ANSWER SECTION:
mobile.pipe.aria.microsoft.com. 2993 IN CNAME
mobile.events.data.trafficmanager.net.
mobile.events.data.trafficmanager.net. 22 IN CNAME
skypedataprdcoleus14.cloudapp.net.
skypedataprdcoleus14.cloudapp.net. 4 IN A 52.170.57.27
;; AUTHORITY SECTION:
;; ADDITIONAL SECTION:
;; Query time: 13 msec
;; SERVER: 192.168.200.1
;; WHEN: Wed Jan 6 20:22:30 2021
;; MSG SIZE rcvd: 159
### DRILL END
All of the hosts use the same DNS service in the LAN however for some reason
both squid and the client are resolving different addresses
in a period of 10 Seconds.
The solution I am thinking is to force a minimum of 60 seconds caching using
dnsmasq or another caching service.
* https://unix.stackexchange.com/a/287908
Can we teach (theoretically) squid a way to look at these short TTLs as
something to decide by an ACL?
Thanks,
Eliezer
----
Eliezer Croitoru
Tech Support
Mobile: +972-5-28704261
Email: ngtech1ltd@xxxxxxxxx
Zoom: Coming soon
_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users
