On 12/9/21 8:18 AM, Mateusz Łoś wrote: > While connecting to https site through parent proxy we can see 407 > response with Content-Length header but with empty body content which > causes applications to fail as they are trying to read that body Squid does not yet have the code to support multi-step HTTP CONNECT authentication with parent proxies. Your options for going forward may include: A1) Adjust the parent proxy configuration so that it does not respond with HTTP 407 Proxy Authentication Required responses to the child CONNECT requests. A2) Adjust the child proxy configuration so that the parent proxy does not respond with HTTP 407 Proxy Authentication Required responses to the child. B) Adjust the child proxy configuration so that it goes direct (rather than through the parent proxy) when tunneling TLS connections. C) Add proper support for multi-step HTTP CONNECT authentication to Squid. It is a difficult/serious project that would require significant code refactoring, but it can (and should) be done: https://wiki.squid-cache.org/SquidFaq/AboutSquid#How_to_add_a_new_Squid_feature.2C_enhance.2C_of_fix_something.3F Options A1 and A2 may need to be combined for the desired effect. I do not know enough about your environment to say which of the above options are viable/applicable, and cannot recommend specific configuration adjustments (but others on this list may be able to help with that). HTH, Alex. P.S. Squid also does not have the code to read (large) CONNECT error response bodies, but that is not the root cause of your problems. Even if Squid could read the entire HTTP 407 response body in this case, it would not help. > lHttpAsyncClient [exchange: 71] connection aborted||The problematic lines are:|...|Consume content|-1 bytes read > > with squid 5 I can see missing body in logs > > 2021/10/26 07:17:32.684 kid1| 11,2| src/clients/HttpTunneler.cc(324) handleResponse: Tunnel Server RESPONSE: > --------- > <HTML><HEAD> > > <TITLE>Access Denied</TITLE> > > <STYLE TYPE="text/css"> > > TABLE.DETAILS TD{ > > font-family: Helvetica; > > font-size: 9pt; > > } > > </STYLE> > > </HEAD> > > <BODY> > > <FONT face="Helvetica"> > > <big><strong></strong></big><BR> > > </FON---------- > 2021/10/26 07:17:32.684 kid1| TCP connection to <parent_proxy_ip>/8080 > failed > current master transaction: master95 > 2021/10/26 07:17:32.684 kid1| Detected DEAD Parent: <parent_proxy_ip> > current master transaction: master95 > > Parent proxy configuration: > cache_peer myparentproxy_ipaddress parent 8080 0 no-query no-digest > no-netdb-exchange login=PASSTHRU > > While connecting through parent proxy directly there is no issue and > response can be parsed properly. > > I was unable to find configuration options to change this, while > connecting to http site there is no such issue and body is being send > properly with 407 answer. > > root@testvm:~# curl -x 192.168.3.19:3128 https://webhook.site > <https://webhook.site> -Lv > * Trying 192.168.3.19:3128... > * TCP_NODELAY set > * Connected to 192.168.3.19 (192.168.3.19) port 3128 (#0) > * allocate connect buffer! > * Establish HTTP proxy tunnel to webhook.site:443 <http://webhook.site:443> >> CONNECT webhook.site:443 <http://webhook.site:443> HTTP/1.1 >> Host: webhook.site:443 <http://webhook.site:443> >> User-Agent: curl/7.68.0 >> Proxy-Connection: Keep-Alive >> > < HTTP/1.1 407 Proxy Authentication Required > < Proxy-Authenticate: BASIC realm="LDAP" > < Cache-Control: no-cache > < Pragma: no-cache > < X-XSS-Protection: 1 > < Content-Type: text/html; charset=utf-8 > < Proxy-Connection: close > < Connection: close > < Content-Length: 1590 > < > * Ignore 1590 bytes of response-body > * Proxy CONNECT connection closed > * Closing connection 9 > * Hostname 192.168.3.19 was found in DNS cache > * Trying 192.168.3.19:3128... > * TCP_NODELAY set > * Connected to 192.168.3.19 (192.168.3.19) port 3128 (#10) > * allocate connect buffer! > * Establish HTTP proxy tunnel to webhook.site:443 <http://webhook.site:443> >> CONNECT webhook.site:443 <http://webhook.site:443> HTTP/1.1 >> Host: webhook.site:443 <http://webhook.site:443> >> User-Agent: curl/7.68.0 >> Proxy-Connection: Keep-Alive >> > < HTTP/1.1 500 Internal Server Error > < Server: squid/5.2-VCS > < Mime-Version: 1.0 > < Date: Tue, 26 Oct 2021 07:17:32 GMT > < Content-Type: text/html;charset=utf-8 > < Content-Length: 3814 > < X-Squid-Error: ERR_CANNOT_FORWARD 0 > < Content-Language: en > < > * Received HTTP code 500 from proxy after CONNECT > * CONNECT phase completed! > * Closing connection 10 > curl: (56) Received HTTP code 500 from proxy after CONNECT > > root@testvm:~# curl -x 192.168.3.19:3128 http://webhook.site > <http://webhook.site> -Lv > * Trying 192.168.3.19:3128... > * TCP_NODELAY set > * Connected to 192.168.3.19 (192.168.3.19) port 3128 (#0) >> GET http://webhook.site/ <http://webhook.site/> HTTP/1.1 >> Host: webhook.site <http://webhook.site> >> User-Agent: curl/7.68.0 >> Accept: */* >> Proxy-Connection: Keep-Alive >> > * Mark bundle as not supporting multiuse > < HTTP/1.1 407 Proxy Authentication Required > < Proxy-Authenticate: BASIC realm="LDAP" > < Cache-Control: no-cache > < Pragma: no-cache > < X-XSS-Protection: 1 > < Content-Type: text/html; charset=utf-8 > < Set-Cookie: BCSI-CS-53409a6e5b6816df=2; Path=/ > < Content-Length: 1582 > < Date: Tue, 26 Oct 2021 07:17:01 GMT > < X-Cache: MISS from testvm > < Via: 1.1 testvm (squid/5.2-VCS) > < Connection: keep-alive > < > <HTML><HEAD> > > <TITLE>Access Denied</TITLE> > > <STYLE TYPE="text/css"> > > > > > Is there anything that can be done on configuration level to make it work? > > > Regards, > Mateusz > > _______________________________________________ > squid-users mailing list > squid-users@xxxxxxxxxxxxxxxxxxxxx > http://lists.squid-cache.org/listinfo/squid-users > _______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users
