On 2023-09-28 11:31, Fernando Giorgetti wrote:
And what should I do to let Squid use the SNI defined by the TLS client?
What do you want Squid to use that SNI for? Alex.
On Thu, Sep 28, 2023 at 11:51 AM Alex Rousskov wrote: On 2023-09-28 09:06, Fernando Giorgetti wrote: > Hi Matus, do you mean something like a DNAT (iptables) rule? > If so, I would say, it should work as well. > > But this is an environment I do not control, and I have been told to try > using an existing squid installation to proxy non-http/TLS data through. > > I appreciate any guidance or recommendation. Bugs notwithstanding, Squid can blindly tunnel intercepted (at TCP port X) TCP traffic to its intended destination: https_port X intercept ssl-bump ... ssl_bump splice all Without interception, then Squid can only tunnel stuff inside HTTP CONNECT tunnels (for HTTP CONNECT requests received at TCP port Y): http_port Y ssl-bump ... ssl_bump splice all In both cases, Squid does not care about the protocols that tunneled traffic is using. It could be HTTP, HTTPS, TLS, or anything else on top of TCP. Your ACLs may differ from "all" in the above sketches, of course, but if traffic is not TLS, then you want an "ssl_bump splice" rule that matches during SslBump step1. A rule with an "all" ACLs is the simplest example of that. HTH, Alex. P.S. I am getting an "Internal Server Error" when following the haproxy link in the original question, so I cannot map what that page says to the configurations above. > On Thu, Sep 28, 2023 at 3:41 AM Matus UHLAR - fantomas wrote: > > On 27.09.23 16:48, Fernando Giorgetti wrote: > >I would like to know if it is possible to set up Squid to perform > >TLS passthrough to a given backend, relaying TLS encrypted > >traffic to the backend, similarly to what HAProxy does below? > >> >https://www.haproxy.com/documentation/aloha/latest/security/tls/encryption-strategies/#tls-passthrough <https://www.haproxy.com/documentation/aloha/latest/security/tls/encryption-strategies/#tls-passthrough> <https://www.haproxy.com/documentation/aloha/latest/security/tls/encryption-strategies/#tls-passthrough <https://www.haproxy.com/documentation/aloha/latest/security/tls/encryption-strategies/#tls-passthrough>>> > > >I have tried a few different configurations using reverse proxy, > >or peek and splice, but I could not make it work without providing > >a valid HTTP request or a CONNECT request. > > what's the difference between TCP redirect and this? > > -- > Matus UHLAR - fantomas, uhlar@xxxxxxxxxxx <mailto:uhlar@xxxxxxxxxxx> <mailto:uhlar@xxxxxxxxxxx <mailto:uhlar@xxxxxxxxxxx>> > ; http://www.fantomas.sk/ <http://www.fantomas.sk/> <http://www.fantomas.sk/ <http://www.fantomas.sk/>> > Warning: I wish NOT to receive e-mail advertising to this address. > Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. > Depression is merely anger without enthusiasm. > _______________________________________________ > squid-users mailing list > squid-users@xxxxxxxxxxxxxxxxxxxxx <mailto:squid-users@xxxxxxxxxxxxxxxxxxxxx> > <mailto:squid-users@xxxxxxxxxxxxxxxxxxxxx <mailto:squid-users@xxxxxxxxxxxxxxxxxxxxx>> > https://lists.squid-cache.org/listinfo/squid-users <https://lists.squid-cache.org/listinfo/squid-users> > <https://lists.squid-cache.org/listinfo/squid-users <https://lists.squid-cache.org/listinfo/squid-users>> > > > _______________________________________________ > squid-users mailing list > squid-users@xxxxxxxxxxxxxxxxxxxxx <mailto:squid-users@xxxxxxxxxxxxxxxxxxxxx> > https://lists.squid-cache.org/listinfo/squid-users <https://lists.squid-cache.org/listinfo/squid-users> _______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx <mailto:squid-users@xxxxxxxxxxxxxxxxxxxxx> https://lists.squid-cache.org/listinfo/squid-users <https://lists.squid-cache.org/listinfo/squid-users>
_______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx https://lists.squid-cache.org/listinfo/squid-users
