3

Important: I have this question on stackoverflow but somebody told me this is more relevant place for this question. Thanks

I have configured squid(3.4.2) as ssl bumped proxy. I am setting proxy in firefox(29) to use squid for https/http. Now it works for most sites, but some sites which support old SSL proto(sslv3) break, and I see squid not employing any workarounds for those like browsers do.

Sites which should work: https://usc-excel.officeapps.live.com/ , https://www.mahaconnect.in

As a workaround I have set sslproxy_version=3 , which enforces SSLv3 and above sites work.

My question: is there a better way to do this which does not involve enforcing SSLv3 for servers supporting TLS1 or better.

Now I know openssl doesn't automatically handle that. But I imagined squid would.

My squid conf snipper:

http_port 3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/usr/local/squid/certs/SquidCA.pem

always_direct allow all ssl_bump server-first all sslcrtd_program /usr/local/squid/libexec/ssl_crtd -s /usr/local/squid/var/lib/ssl_db -M 4MB

client_persistent_connections on server_persistent_connections on

sslproxy_version 3

sslproxy_options ALL

cache_dir aufs /usr/local/squid/var/cache/squid 100 16 256

coredump_dir /usr/local/squid/var/cache/squid

strip_query_terms off

httpd_suppress_version_string on

via off

forwarded_for transparent

vary_ignore_expire on

refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320

UPDATE: I have tried compiling squid 3.4.5 with openssl 1.0.1h . No improvements

Improve this question
1

3 Answers 3

Reset to default
3

I don't think squid implements any logic to automatically retry and SSL downgrade if the connection failed. So you have only the following options:

  • Downgrade everything to SSLv3 like you propose. This is bad for security and will probably cause other problems, when servers refuse to connect with SSLv3 for security reasons.
  • Don't use servers which cannot deal with modern TLS. If they cannot even update their servers to recent TLS versions they have probably a lot more security problems.
  • Make explicit exceptions for these servers, so that they don't get SSL bumped.
Improve this answer
7
  • #2 - Squid would be acting as backbone proxy for the network so I have to provide support for as many sites as possible. One of the sites which doesnt work is Microsoft Office 365 ! :) . #3 - Can you please elaborate on exceptions that I can make. Thanks for you help
    – Shrey
    Jun 13, 2014 at 7:30
  • @Shrey: The office site should work, it works for me with TLSv1, e.g. no downgrade needed. The rest is SSLv3 only and will croak if you try better. Settings exceptions is done the usual squid way, see "Access Controls" in wiki.squid-cache.org/Features/SslBump
    – Steffen Ullrich
    Jun 13, 2014 at 8:31
  • I cant find ACLs for the SSL error squid is throwing. I am getting error page with "Failed to establish a secure connection to 134.170.48.16 . The system returned: (104) Connection reset by peer (TLS code: SQUID_ERR_SSL_HANDSHAKE)" with usc-excel.officeapps.live.com with sslproxy_version 1 (above mentioned Squid conf). If your setup is working for this url, do you mind sending me your squid.conf.
    – Shrey
    Jun 13, 2014 at 11:44
  • 1
    @Shrey: There are no ACLs for exceptions, there are ACLs for hosts. So you have to find out which hosts cause problems, setup an acl "brokensites" and do "ssl_bump none brokensites" as described in the documentation. And I don't use squid myself, so I cannot send you the config. As for usc-excel.officeapps.live.com: it looks like there is a broken load balancer in front which cannot deal with larger client hellos (known problem with older F5). So it works with TLSv1 if you don't include all ciphers openssl has :(
    – Steffen Ullrich
    Jun 13, 2014 at 12:10
  • We turned off SSLv3 on our web sites the very same day XP support ended, as that was the only reason to keep it. So far nobody has noticed. Cutting down the cipher list to work around Microsoft's broken F5 seems much more promising.
    – Michael Hampton
    Jun 13, 2014 at 12:18
1

Here is now my ssl-bump rules are setup and it works without a problem:

http_port 3128
http_port 3129 intercept
https_port 3130 intercept ssl-bump connection-auth=off generate-host-certificates=on dynamic_cert_mem_cache_size=8MB cert=/etc/squid/ssl/squid.pem key=/etc/squid/ssl/squid.key cipher=ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:DHE-RSA-CAMELLIA128-SHA:AES128-SHA:RC4-SHA:HIGH:!aNULL:!MD5:!ADH
sslcrtd_program /usr/lib64/squid/ssl_crtd -s /var/lib/squid_ssl_db -M 8MB
sslcrtd_children 50 startup=5 idle=1

This way you ignore the SSL/TLS situation and it is told to only use those ciphers (in progression down the list until It finds one it is compatible with, regardless of SSL/TLS in use). I loaded both websites you mentioned without a problem through my server.

Improve this answer
1
-1

If you change pFSense / Services / Squid Proxy Server / GEneral tab Then check the SSL Man In The Middle Filtering area and change the SSL/MITM Mode from Splice WhiteList, Bumb OtherWise to the Splice ALL

the problem can be solve with a this shape.

OR

With a default value of the SSL/MITM Mode with Splice WhiteList, Bumb OtherWise you can goto ACLs atb and add desıred web site url to the WhiteList area ie: online.kktcmaliye.com

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .