Skip to content

Commit 4ea7199

Browse files
committed
2026-03-05
1 parent 4d47858 commit 4ea7199

27 files changed

Lines changed: 1130 additions & 46 deletions

squid-dev/2026-March.txt

Lines changed: 284 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,3 +91,287 @@ Alex.
9191
>
9292

9393

94+
From squid3 at treenet.co.nz Thu Mar 5 07:55:03 2026
95+
From: squid3 at treenet.co.nz (Amos Jeffries)
96+
Date: Thu, 5 Mar 2026 20:55:03 +1300
97+
Subject: [squid-dev] forward bumped traffic to parent in plain form
98+
In-Reply-To: <1985119311.20260304190328@yahoo.com>
99+
References: <1985119311.20260304190328.ref@yahoo.com>
100+
<1985119311.20260304190328@yahoo.com>
101+
Message-ID: <767023df-7896-4385-a9dc-1f6dfdd6bdd7@treenet.co.nz>
102+
103+
On 05/03/2026 05:03, Anthony Pankov wrote:
104+
> Hello,
105+
>
106+
> I still want to modify squid in such a way that it can forward
107+
> clients http traffic to a parent cache in plain form. I mean after
108+
> bumping ssl (forntend-squid establish tls connection with a client)
109+
> requests from client should goes to parent cache as a plain http
110+
> ( GET etc.) That is, using parent cache as in good old days without
111+
> https.
112+
>
113+
> Connection between squids servers is already encrypted so I don't
114+
> need any additional tls(security) layer.
115+
116+
That is a fallacy.
117+
118+
1) The connection between Squid and the TLS endpoint re-encryptor is a
119+
new vulnerability point.
120+
121+
122+
2) TLS is a pointA-to-pointB encryption method.
123+
124+
What you have is a A->B->C network setup. With B->C encryption provided
125+
by yourself.
126+
127+
The client software is relying on A->C encryption (security keys etc,
128+
negotiated between A and C). Not separate A->B then B->C encryption,
129+
where A has no knowledge about C recipient security regarding A's data.
130+
131+
132+
> Connection between squids servers is already encrypted so I don't
133+
> need any additional tls(security) layer.
134+
135+
The reverse can also be said. Squid keeps things encrypted so you do not
136+
need the extra layer. Due to the above, this is **more** secure than
137+
just TLS or even what double-TLS implies.
138+
139+
140+
HTH
141+
Amos
142+
143+
144+
From anthony.pankov at yahoo.com Thu Mar 5 09:00:02 2026
145+
From: anthony.pankov at yahoo.com (Anthony Pankov)
146+
Date: Thu, 5 Mar 2026 12:00:02 +0300
147+
Subject: [squid-dev] forward bumped traffic to parent in plain form
148+
In-Reply-To: <767023df-7896-4385-a9dc-1f6dfdd6bdd7@treenet.co.nz>
149+
References: <1985119311.20260304190328.ref@yahoo.com>
150+
<1985119311.20260304190328@yahoo.com>
151+
<767023df-7896-4385-a9dc-1f6dfdd6bdd7@treenet.co.nz>
152+
Message-ID: <38634748.20260305120002@yahoo.com>
153+
154+
155+
Thursday, March 5, 2026, 10:55:03 AM, you wrote:
156+
157+
> On 05/03/2026 05:03, Anthony Pankov wrote:
158+
>> Hello,
159+
>> > I still want to modify squid in such a way that it can forward
160+
>> clients http traffic to a parent cache in plain form. I mean after
161+
>> bumping ssl (forntend-squid establish tls connection with a client)
162+
>> requests from client should goes to parent cache as a plain http
163+
>> ( GET etc.) That is, using parent cache as in good old days without
164+
>> https.
165+
>> > Connection between squids servers is already encrypted so I don't
166+
>> need any additional tls(security) layer.
167+
168+
> That is a fallacy.
169+
170+
> 1) The connection between Squid and the TLS endpoint re-encryptor is a new vulnerability point.
171+
172+
173+
> 2) TLS is a pointA-to-pointB encryption method.
174+
175+
> What you have is a A->B->C network setup. With B->C encryption provided by yourself.
176+
177+
> The client software is relying on A->C encryption (security keys etc, negotiated between A and C). Not separate A->B then B->C encryption, where A has no knowledge about C recipient security regarding A's data.
178+
179+
180+
>> Connection between squids servers is already encrypted so I don't
181+
>> need any additional tls(security) layer.
182+
183+
> The reverse can also be said. Squid keeps things encrypted so you do not need the extra layer. Due to the above, this is **more** secure than just TLS or even what double-TLS implies.
184+
185+
When underlying routing/encryption is rather complex maintaining encryption on app layer seems overwork.
186+
A TLS to be something about security and not just about encryption need certificates on both side. Which implies PKI. Which implies certificates management for squid. All this seems overwork when there is a security on underlying network.
187+
188+
189+
--
190+
Best regards,
191+
Anthony
192+
193+
194+
From anthony.pankov at yahoo.com Thu Mar 5 09:26:59 2026
195+
From: anthony.pankov at yahoo.com (Anthony Pankov)
196+
Date: Thu, 5 Mar 2026 12:26:59 +0300
197+
Subject: [squid-dev] forward bumped traffic to parent in plain form
198+
In-Reply-To: <70faedf9-2e5d-4934-b837-874940f81a4b@measurement-factory.com>
199+
References: <1985119311.20260304190328.ref@yahoo.com>
200+
<1985119311.20260304190328@yahoo.com>
201+
<70faedf9-2e5d-4934-b837-874940f81a4b@measurement-factory.com>
202+
Message-ID: <1478043664.20260305122659@yahoo.com>
203+
204+
205+
Wednesday, March 4, 2026, 9:43:45 PM, you wrote:
206+
207+
> On 2026-03-04 11:03, Anthony Pankov wrote:
208+
209+
>> I still want to modify squid in such a way that it can forward
210+
>> clients http traffic to a parent cache in plain form. I mean after
211+
>> bumping ssl (forntend-squid establish tls connection with a client)
212+
>> requests from client should goes to parent cache as a plain http (
213+
>> GET etc.)
214+
215+
> Let's split this problem into two parts:
216+
217+
> Part 1: Bumping the client.
218+
219+
> Do you want your Squid to bump the TLS client connection without talking to the TLS origin server?
220+
Yes, for simplicity.
221+
222+
> Bugs notwithstanding, that should already be possible using unsupported "ssl_bump client-first all" or,
223+
224+
common conf :
225+
226+
http_port 100.100.100.100:8080 ssl-bump generate-host-certificates=on \
227+
options=CIPHER_SERVER_PREFERENCE,NO_TLSv1,NO_SSLv3,NO_TLSv1_1 \
228+
tls-dh=prime256v1:/usr/local/etc/squid/sq-dhparams.pem \
229+
tls-cert=/usr/local/etc/squid/imc+.ots101.crt \
230+
tls-key=/usr/local/etc/squid/key.ots101-imc.pem \
231+
dynamic_cert_mem_cache_size=10MB
232+
233+
acl ssl_bump_step_1 at_step SslBump1
234+
acl ssl_bump_step_2 at_step SslBump2
235+
acl ssl_bump_step_3 at_step SslBump3
236+
237+
with this conf:
238+
239+
ssl_bump client-first all
240+
241+
There is an error on the client (NO_CIPHER_OVERLAP) and error on squid:
242+
243+
2026/03/05 11:33:45 kid1| ERROR: Cannot accept a TLS connection
244+
problem: failure
245+
error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A0000C1+TLS_IO_ERR=1
246+
247+
> after defining step1,
248+
249+
> ssl_bump stare step1
250+
> ssl_bump bump all
251+
252+
with this conf:
253+
254+
ssl_bump stare ssl_bump_step_1
255+
ssl_bump bump all
256+
257+
I've got in squid-fronted:
258+
259+
2026/03/05 12:14:38 kid1| Squid plugin modules loaded: 0
260+
2026/03/05 12:14:38 kid1| Accepting SSL bumped HTTP Socket connections at conn6 local=100.100.100.100:8080 remote=[::] FD 16 flags=9
261+
listening port: 100.100.100.100:8080
262+
2026/03/05 12:15:18.505 kid1| 44,3| peer_select.cc(305) peerSelect: e:=IV/0x1a717e19d520*3 www.freshports.org:443
263+
2026/03/05 12:15:18.505 kid1| 44,3| peer_select.cc(609) selectMore: CONNECT www.freshports.org
264+
2026/03/05 12:15:18.505 kid1| 44,3| peer_select.cc(622) selectMore: direct = DIRECT_UNKNOWN (never_direct to be checked)
265+
2026/03/05 12:15:18.505 kid1| 44,3| peer_select.cc(340) checkNeverDirectDone: ALLOWED
266+
2026/03/05 12:15:18.505 kid1| 44,3| peer_select.cc(346) checkNeverDirectDone: direct = DIRECT_NO (never_direct allow)
267+
2026/03/05 12:15:18.506 kid1| 44,3| peer_select.cc(609) selectMore: CONNECT www.freshports.org
268+
2026/03/05 12:15:18.506 kid1| 44,3| peer_select.cc(282) peerSelectIcpPing: www.freshports.org:443
269+
2026/03/05 12:15:18.506 kid1| 44,3| peer_select.cc(293) peerSelectIcpPing: counted 0 neighbors
270+
2026/03/05 12:15:18.506 kid1| 44,3| peer_select.cc(828) selectSomeParent: CONNECT www.freshports.org
271+
2026/03/05 12:15:18.507 kid1| 44,3| peer_select.cc(1097) addSelection: adding FIRSTUP_PARENT/fd05:562e:5a23::e25:3101
272+
2026/03/05 12:15:18.507 kid1| 44,3| peer_select.cc(1091) addSelection: skipping ANY_OLD_PARENT/fd05:562e:5a23::e25:3101; have FIRSTUP_PARENT/fd05:562e:5a23::e25:3101
273+
2026/03/05 12:15:18.507 kid1| 44,2| peer_select.cc(454) resolveSelected: Find IP destination for: www.freshports.org:443' via fd05:562e:5a23::e25:3101
274+
2026/03/05 12:15:18.507 kid1| 44,2| peer_select.cc(1168) handlePath: PeerSelector1 found conn13 local=[fd05:562e:5a23::212:2e01] remote=[fd05:562e:5a23::e25:3101]:54321 FIRSTUP_PARENT flags=1, destination #1 for www.freshports.org:443
275+
2026/03/05 12:15:18.507 kid1| 44,2| peer_select.cc(1174) handlePath: always_direct = DENIED
276+
2026/03/05 12:15:18.508 kid1| 44,2| peer_select.cc(1175) handlePath: never_direct = ALLOWED
277+
2026/03/05 12:15:19.106 kid1| 44,3| peer_select.cc(609) selectMore: GET www.freshports.org
278+
2026/03/05 12:15:19.106 kid1| 44,3| peer_select.cc(1097) addSelection: adding PINNED/fd05:562e:5a23::e25:3101
279+
2026/03/05 12:15:19.107 kid1| 44,3| peer_select.cc(828) selectSomeParent: GET www.freshports.org
280+
2026/03/05 12:15:19.107 kid1| 44,3| peer_select.cc(1097) addSelection: adding FIRSTUP_PARENT/fd05:562e:5a23::e25:3101
281+
282+
...
283+
284+
2026/03/05 12:15:19.315 kid1| 44,2| peer_select.cc(476) resolveSelected: timedout =
285+
0
286+
2026/03/05 12:15:19.315 kid1| 44,3| peer_select.cc(242) ~PeerSelector: www.freshports.org:
287+
443
288+
2026/03/05 12:15:19 kid1| ERROR: Cannot accept a TLS connection
289+
problem: failure
290+
error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
291+
2026/03/05 12:15:19.794 kid1| 44,3| peer_select.cc(305) peerSelect: e:=IV/0x1a7180adf360*3 https://www.freshports.org/css/freshports.css?v=e1590210
292+
2026/03/05 12:15:19.794 kid1| 44,3| peer_select.cc(609) selectMore: GET www.freshports.org
293+
2026/03/05 12:15:19.794 kid1| 44,3| peer_select.cc(622) selectMore: direct = DIRECT_UNKNOWN (never_direct to be checked)
294+
295+
...
296+
297+
2026/03/05 12:15:19.797 kid1| 44,2| peer_select.cc(1168) handlePath: PeerSelector5 found c
298+
onn28 local=[fd05:562e:5a23::212:2e01] remote=[fd05:562e:5a23::e25:3101]:54321 FIRSTUP_PAR
299+
ENT flags=1, destination #2 for https://www.freshports.org/css/freshports.css?v=e1590210
300+
2026/03/05 12:15:19.797 kid1| 44,2| peer_select.cc(1174) handlePath: always_direct = DEN
301+
IED
302+
2026/03/05 12:15:19.797 kid1| 44,2| peer_select.cc(1175) handlePath: never_direct = ALL
303+
OWED
304+
2026/03/05 12:15:19.797 kid1| 44,2| peer_select.cc(1176) handlePath: timedout = 0
305+
2026/03/05 12:15:19.798 kid1| 44,2| peer_select.cc(473) resolveSelected: PeerSelector5 fou
306+
nd all 2 destinations for https://www.freshports.org/css/freshports.css?v=e1590210
307+
2026/03/05 12:15:19.798 kid1| 44,2| peer_select.cc(474) resolveSelected: always_direct =
308+
DENIED
309+
2026/03/05 12:15:19.798 kid1| 44,2| peer_select.cc(475) resolveSelected: never_direct =
310+
ALLOWED
311+
2026/03/05 12:15:19.798 kid1| 44,2| peer_select.cc(476) resolveSelected: timedout =
312+
0
313+
2026/03/05 12:15:19.798 kid1| 44,3| peer_select.cc(242) ~PeerSelector: https://www.freshpo
314+
rts.org/css/freshports.css?v=e1590210
315+
2026/03/05 12:15:19.953 kid1| 44,3| peer_select.cc(305) peerSelect: e:=IV/0x1a7180adf360*3
316+
https://www.freshports.org/javascript/freshports.js
317+
2026/03/05 12:15:19.953 kid1| 44,3| peer_select.cc(609) selectMore: GET www.freshports.org
318+
2026/03/05 12:15:19.954 kid1| 44,3| peer_select.cc(622) selectMore: direct = DIRECT_UNKNOW
319+
N (never_direct to be checked)
320+
2026/03/05 12:15:19.954 kid1| 44,3| peer_select.cc(340) checkNeverDirectDone: ALLOWED
321+
2026/03/05 12:15:19.954 kid1| 44,3| peer_select.cc(346) checkNeverDirectDone: direct = DIR
322+
ECT_NO (never_direct allow)
323+
2026/03/05 12:15:19.955 kid1| 44,3| peer_select.cc(609) selectMore: GET www.freshports.org
324+
2026/03/05 12:15:19.955 kid1| 44,3| peer_select.cc(1097) addSelection: adding PINNED/fd05:
325+
562e:5a23::e25:3101
326+
2026/03/05 12:15:19.955 kid1| 44,3| peer_select.cc(828) selectSomeParent: GET www.freshpor
327+
ts.org
328+
...
329+
330+
On the peer-cache I've got:
331+
332+
1772699911.111 30800 fd05:562e:5a23::212:2e01 TCP_MISS/200 4121 CONNECT www.freshports.org:443/ - DIRECT/www.freshports.org -
333+
1772699911.133 31111 fd05:562e:5a23::212:2e01 TCP_MISS/200 4121 CONNECT www.freshports.org:443/ - DIRECT/www.freshports.org -
334+
1772699911.133 31282 fd05:562e:5a23::212:2e01 TCP_MISS/200 4047 CONNECT www.freshports.org:443/ - DIRECT/www.freshports.org -
335+
1772699909.281 33135 fd05:562e:5a23::212:2e01 TCP_MISS/200 249625 CONNECT www.freshports.org:443/ - DIRECT/www.freshports.org -
336+
1772699911.133 31510 fd05:562e:5a23::212:2e01 TCP_MISS/200 4120 CONNECT www.freshports.org:443/ - DIRECT/www.freshports.org -
337+
1772699910.418 32225 fd05:562e:5a23::212:2e01 TCP_MISS/200 6160 CONNECT www.freshports.org:443/ - DIRECT/www.freshports.org -
338+
1772701843.186 255 fd05:562e:5a23::212:2e01 TCP_MISS/200 3611 CONNECT www.googletagmanager.com:443/ - DIRECT/www.googletagmanager.com -
339+
1772701843.192 12188 fd05:562e:5a23::212:2e01 TCP_MISS/200 5214 CONNECT www.freshports.org:443/ - DIRECT/www.freshports.org -
340+
1772701842.385 12995 fd05:562e:5a23::212:2e01 TCP_MISS/200 251669 CONNECT www.freshports.org:443/ - DIRECT/www.freshports.org -
341+
1772701843.856 11524 fd05:562e:5a23::212:2e01 TCP_MISS/200 5100 CONNECT www.freshports.org:443/ - DIRECT/www.freshports.org -
342+
1772701869.957 178 fd05:562e:5a23::212:2e01 TCP_MISS/200 3611 CONNECT www.googletagmanager.com:443/ - DIRECT/www.googletagmanager.com -
343+
1772701869.963 31903 fd05:562e:5a23::212:2e01 TCP_MISS/200 5360 CONNECT www.freshports.org:443/ - DIRECT/www.freshports.org -
344+
1772701869.280 33510 fd05:562e:5a23::212:2e01 TCP_MISS/200 251916 CONNECT www.freshports.org:443/ - DIRECT/www.freshports.org -
345+
346+
Not worked, unfortunately.
347+
348+
> Or does the client need to see something from the TLS origin server certificate to work correctly?
349+
No. I mean split policy for now: client<->squid-fronted, peer_cache<->origin
350+
351+
> In that case, you have to use something like "ssl_bump stare all" but it will complicate Part 2 changes.
352+
353+
> Part 2: Forwarding bumped GET requests to cache_peers "as is", without a second layer of encryption.
354+
355+
> This part depends on Part 1. Let's come back to this after Part 1 is working.
356+
357+
358+
> HTH,
359+
360+
> Alex.
361+
362+
363+
>> Connection between squids servers is already encrypted so I don't need any additional tls(security) layer.
364+
>> > Also, for simplification, I assume never_direct directive for this traffic on a front-end.
365+
>> I understand that it will preclude any checks for origin server certificate but this is not a problem because policy for origin may be applied in a parent cache.
366+
>> > I tried to modify FwdState::noteConnection to avoid establishTunnelThruProxy() and FwdState::secureConnectionToPeerIfNeeded to avoid secureConnectionToPeer() but has no lack.
367+
>> > They use request.flags sslBumped and sslPeek that I do not fully understand. sslPeek described as "internal ssl-bump request to get server cert" but it always True when I'm in noteConnection.
368+
>> > Also I noted async SslBumpEstablish which call switchToHttps. Because of asyncs I can't fully understand where I can preclude switching connections to parent cache to "CONNECT" mode rather than using it plain.
369+
>> > Any help would be appreciated.
370+
>> >
371+
372+
373+
--
374+
Best regards,
375+
Anthony
376+
377+

squid-dev/2026-March/009980.html

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
</style>
1414
<META http-equiv="Content-Type" content="text/html; charset=us-ascii">
1515
<LINK REL="Previous" HREF="009979.html">
16-
16+
<LINK REL="Next" HREF="009983.html">
1717
</HEAD>
1818
<BODY BGCOLOR="#ffffff">
1919
<H1>[squid-dev] forward bumped traffic to parent in plain form</H1>
@@ -25,7 +25,8 @@ <H1>[squid-dev] forward bumped traffic to parent in plain form</H1>
2525
<P><UL>
2626
<LI>Previous message (by thread): <A HREF="009979.html">[squid-dev] forward bumped traffic to parent in plain form
2727
</A></li>
28-
28+
<LI>Next message (by thread): <A HREF="009983.html">[squid-dev] forward bumped traffic to parent in plain form
29+
</A></li>
2930
<LI> <B>Messages sorted by:</B>
3031
<a href="date.html#9980">[ date ]</a>
3132
<a href="thread.html#9980">[ thread ]</a>
@@ -89,13 +90,16 @@ <H1>[squid-dev] forward bumped traffic to parent in plain form</H1>
8990
</I>
9091
</PRE>
9192

93+
94+
9295
<!--endarticle-->
9396
<HR>
9497
<P><UL>
9598
<!--threads-->
9699
<LI>Previous message (by thread): <A HREF="009979.html">[squid-dev] forward bumped traffic to parent in plain form
97100
</A></li>
98-
101+
<LI>Next message (by thread): <A HREF="009983.html">[squid-dev] forward bumped traffic to parent in plain form
102+
</A></li>
99103
<LI> <B>Messages sorted by:</B>
100104
<a href="date.html#9980">[ date ]</a>
101105
<a href="thread.html#9980">[ thread ]</a>

0 commit comments

Comments
 (0)