> I tried to use application without Squid, bypassing it, and It works fine.
> How can I find out where Squid could create problems to this application?
> I tried to enable "debug_options ALL,2" feature but it's very hard to
> understand, suggestions please?
Upgrade Squid? Current release is 4.4, soon to be 4.5.
The old 3.5.* series lacks a lot of TLS feature support and polishing of
the Squid behaviours.
If the Squid logs do not contain the desired info you can always look at
a packet trace of the traffic.
On 2/01/19 10:30 pm, Sampei wrote:
> About way to use https protocol I think I use connect tunnel, here
When a CONNECT tunnel is being used and not SSL-Bump'ed then all TLS
related issues are problems with one of the endpoint software. Not
related to the proxy at all. Squid is just blindly relaying the TLS
bytes as-is between the endpoints.
That said, some specific configs may encounter issues due to explicitly
telling Squid to do certain things which cannot be done to CONNECT
tunnels (eg. URL-rewrite, ACL checks of path strings), or to deny the
CONNECT which obviously would make the TLS not "work" at all.
I suspect that in your case some other port is involved which you do not
know about and are thus not letting through Squid. The access.log should
show what Squid is dealing with there.
> parttial of my squid.conf
> acl SSL_ports port 443 # https
> acl SSL_ports port 563 # snews
> acl Safe_ports port 80 # http
> acl Safe_ports port 21 # ftp
> acl Safe_ports port 443 # https
> http_access deny CONNECT !SSL_ports
Okay, but should be following the Safe_ports check. The default config
orders these checks by how common it is to encounter the attack types
they exist to prevent.
> http_access deny CONNECT !Safe_ports
The default config uses this instead:
http_access deny !Safe_ports
The purpose of this Safe_ports ACL is to prevent the proxy handling
*any* traffic for protocols whose traffic syntax directly conflicts with
HTTP traffic syntax.
By limiting this check to only CONNECT messages, you are opening your
proxy to most of the attacks the Safe_port ACL was designed to prevent.
> acl test dstdomain example.com
> http_access allow test
> http_access allow CONNECT test
This latter is pointless. "test" was already allowed, so this line is
never reached by any traffic which it can match.
> I think to upgrade 4.x Squid but I'm looking for valid repository for
> Centos 7 which contains this pkg.