2

Does SSL bumping work with parent proxy? squid and pf are set up like this:

squid.conf:

http_port 3128 intercept
https_port 3129 intercept ssl-bump generate-host-certificates=on key=/usr/local/etc/squid/ssl/squid.key cert=/usr/local/etc/squid/ssl/squid.pem

sslproxy_flags DONT_VERIFY_PEER
sslproxy_cert_error allow all
ssl_bump client-first none
ssl_bump server-first all


cache_peer proxy.office.com parent 8080 0 login=user:password

pf.conf

rdr pass on lo0 proto tcp from any to any port 80 -> 127.0.0.1 port 3128
rdr pass on lo0 proto tcp from any to any port 443 -> 127.0.0.1 port 3129

pass out on en0 route-to lo0 inet proto tcp from any to any port 80 keep state
pass out on en0 route-to lo0 inet proto tcp from any to any port 443 keep state

squid version:

Squid Cache: Version 3.2.9
configure options:  '--disable-debug' '--disable-dependency-tracking' '--prefix=/usr/local/Cellar/squid/3.2.9' '--localstatedir=/usr/local/var' '--enable-ssl' '--enable-ssl-crtd' '--disable-eui' '--enable-ipfw-transparent' 'CC=cc' 'CXX=c++' 'PKG_CONFIG_LIBDIR=/usr/lib/pkgconfig:/usr/local/Library/ENV/pkgconfig/10.8'

Everything works fine for HTTP but HTTPS connections raise 1372080519.323 0 172.17.244.135 NONE/400 3998 NONE error:invalid-request - HIER_NONE/- text/html in cache.log. Parent proxy works if set as HTTPS proxy in browsers.

Improve this question
2
  • Does your parent speak http or https on port 8080? Would you mind showing all config?
    – 3molo
    Aug 6, 2013 at 10:53
  • Parent is HTTP. After digging into Squid source code I've found out it can't terminate HTTPS connections and send plain HTTP to parent so I have to find some other way.
    – synapse
    Aug 6, 2013 at 11:51

1 Answer 1

Reset to default
1

Need 3 lines in there:

http_port 3128
http_port 3129 intercept
https_port 3130 intercept ssl-bump...

Point your browser HTTP and SSL proxy to 3128 and it should work. Anytime it gets a secure CONNECT request, it goes down the line to 3130 for https. No other firewall entries needed since it is all internal with squid.

Improve this answer
1
  • can you please elaborate? if that is a transparent proxy, the iptables rule would only redirect traffic to a single port 3128? not two rules, 80 to 3128, and 443 to 3129? and as of 3130 no rules should be defined, is that what you are saying?
    – Walid
    Feb 2, 2019 at 9:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .