|
| 1 | +<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> |
| 2 | +<HTML> |
| 3 | + <HEAD> |
| 4 | + <TITLE> [squid-dev] forward bumped traffic to parent in plain form |
| 5 | + </TITLE> |
| 6 | + <LINK REL="Index" HREF="index.html" > |
| 7 | + <LINK REL="made" HREF="mailto:squid-dev%40lists.squid-cache.org?Subject=Re%3A%20%5Bsquid-dev%5D%20forward%20bumped%20traffic%20to%20parent%20in%20plain%20form&In-Reply-To=%3C30a55c20-f80b-4a5f-be94-352a6a567a9c%40measurement-factory.com%3E"> |
| 8 | + <META NAME="robots" CONTENT="index,nofollow"> |
| 9 | + <style type="text/css"> |
| 10 | + pre { |
| 11 | + white-space: pre-wrap; /* css-2.1, curent FF, Opera, Safari */ |
| 12 | + } |
| 13 | + </style> |
| 14 | + <META http-equiv="Content-Type" content="text/html; charset=us-ascii"> |
| 15 | + <LINK REL="Previous" HREF="009983.html"> |
| 16 | + <LINK REL="Next" HREF="009981.html"> |
| 17 | + </HEAD> |
| 18 | + <BODY BGCOLOR="#ffffff"> |
| 19 | + <H1>[squid-dev] forward bumped traffic to parent in plain form</H1> |
| 20 | + <B>Alex Rousskov</B> |
| 21 | + <A HREF="mailto:squid-dev%40lists.squid-cache.org?Subject=Re%3A%20%5Bsquid-dev%5D%20forward%20bumped%20traffic%20to%20parent%20in%20plain%20form&In-Reply-To=%3C30a55c20-f80b-4a5f-be94-352a6a567a9c%40measurement-factory.com%3E" |
| 22 | + TITLE="[squid-dev] forward bumped traffic to parent in plain form">rousskov at measurement-factory.com |
| 23 | + </A><BR> |
| 24 | + <I>Thu Mar 5 17:13:26 UTC 2026</I> |
| 25 | + <P><UL> |
| 26 | + <LI>Previous message (by thread): <A HREF="009983.html">[squid-dev] forward bumped traffic to parent in plain form |
| 27 | +</A></li> |
| 28 | + <LI>Next message (by thread): <A HREF="009981.html">[squid-dev] forward bumped traffic to parent in plain form |
| 29 | +</A></li> |
| 30 | + <LI> <B>Messages sorted by:</B> |
| 31 | + <a href="date.html#9984">[ date ]</a> |
| 32 | + <a href="thread.html#9984">[ thread ]</a> |
| 33 | + <a href="subject.html#9984">[ subject ]</a> |
| 34 | + <a href="author.html#9984">[ author ]</a> |
| 35 | + </LI> |
| 36 | + </UL> |
| 37 | + <HR> |
| 38 | +<!--beginarticle--> |
| 39 | +<PRE>On 2026-03-05 04:26, Anthony Pankov wrote: |
| 40 | +><i> Wednesday, March 4, 2026, 9:43:45 PM, Alex wrote: |
| 41 | +</I>>><i> On 2026-03-04 11:03, Anthony Pankov wrote: |
| 42 | +</I>>>><i> I still want to modify squid in such a way that it can forward |
| 43 | +</I>>>><i> clients http traffic to a parent cache in plain form. I mean after |
| 44 | +</I>>>><i> bumping ssl (forntend-squid establish tls connection with a client) |
| 45 | +</I>>>><i> requests from client should goes to parent cache as a plain http ( |
| 46 | +</I>>>><i> GET etc.) |
| 47 | +</I>><i> |
| 48 | +</I>>><i> Let's split this problem into two parts: |
| 49 | +</I>><i> |
| 50 | +</I>>><i> Part 1: Bumping the client. |
| 51 | +</I>><i> |
| 52 | +</I>>><i> Do you want your Squid to bump the TLS client connection without talking to the TLS origin server? |
| 53 | +</I>><i> Yes, for simplicity. |
| 54 | +</I>><i> |
| 55 | +</I>>><i> Bugs notwithstanding, that should already be possible using unsupported "ssl_bump client-first all" or, |
| 56 | +</I>><i> |
| 57 | +</I>><i> common conf : |
| 58 | +</I>><i> |
| 59 | +</I>><i> http_port 100.100.100.100:8080 ssl-bump generate-host-certificates=on \ |
| 60 | +</I>><i> options=CIPHER_SERVER_PREFERENCE,NO_TLSv1,NO_SSLv3,NO_TLSv1_1 \ |
| 61 | +</I>><i> tls-dh=prime256v1:/usr/local/etc/squid/sq-dhparams.pem \ |
| 62 | +</I>><i> tls-cert=/usr/local/etc/squid/imc+.ots101.crt \ |
| 63 | +</I>><i> tls-key=/usr/local/etc/squid/key.ots101-imc.pem \ |
| 64 | +</I>><i> dynamic_cert_mem_cache_size=10MB |
| 65 | +</I>><i> |
| 66 | +</I>><i> ssl_bump client-first all |
| 67 | +</I>><i> |
| 68 | +</I>><i> There is an error on the client (NO_CIPHER_OVERLAP) and error on squid |
| 69 | +</I> |
| 70 | +OK. It sounds like the TLS client is unhappy with the unsupported |
| 71 | +client-first mode. Let's forget about that mode and focus on supported ones: |
| 72 | + |
| 73 | + |
| 74 | +><i> ssl_bump stare ssl_bump_step_1 |
| 75 | +</I>><i> ssl_bump bump all |
| 76 | +</I>><i> |
| 77 | +</I>><i> I've got in squid-fronted: |
| 78 | +</I>><i> |
| 79 | +</I> |
| 80 | +><i> 2026/03/05 12:15:18.505 kid1| 44,3| peer_select.cc(305) ... |
| 81 | +</I> |
| 82 | +Peer selection is Part 2. Before we get into that, we need to make sure |
| 83 | +that your Squid can bump the client _without_ getting into FwdState.cc, |
| 84 | +peer_select.cc, etc. Squid-to-peer logic. |
| 85 | + |
| 86 | +It is not clear to me yet whether bumping the client was successful in |
| 87 | +the above test. To confirm, please test using an HTTPS client that sends |
| 88 | +something that does not require Squid-to-peer communication from HTTP |
| 89 | +point of view. Squid should generate the response internally. The client |
| 90 | +should successfully get that Squid-generated response. |
| 91 | + |
| 92 | +Here are some suggestions: |
| 93 | + |
| 94 | +1. GET request with an "unsupported-<A HREF="scheme://a.test/">scheme://a.test/</A>" URL. |
| 95 | +2. TRACE request with a "Max-Forwards: 0" header. |
| 96 | +3. Non-HTTP (i.e. unparseable as HTTP) garbage with enough new lines |
| 97 | + to let Squid find the "end" of "headers". |
| 98 | + |
| 99 | +For Part 1, your goal is to prove that your HTTPS client successfully |
| 100 | +communicates with your Squid with zero packets going to peers or origin |
| 101 | +servers. You can even add a temporary "assert(false)" to |
| 102 | +FwdState::FwdState() to be reasonably sure. |
| 103 | + |
| 104 | +I hope this goal can be accomplished without Squid source code changes, |
| 105 | +but I cannot promise that. |
| 106 | + |
| 107 | + |
| 108 | +HTH, |
| 109 | + |
| 110 | +Alex. |
| 111 | + |
| 112 | + |
| 113 | + |
| 114 | +>><i> Part 2: Forwarding bumped GET requests to cache_peers "as is", without a second layer of encryption. |
| 115 | +</I>><i> |
| 116 | +</I>>><i> This part depends on Part 1. Let's come back to this after Part 1 is working. |
| 117 | +</I> |
| 118 | + |
| 119 | +</PRE> |
| 120 | + |
| 121 | +<!--endarticle--> |
| 122 | + <HR> |
| 123 | + <P><UL> |
| 124 | + <!--threads--> |
| 125 | + <LI>Previous message (by thread): <A HREF="009983.html">[squid-dev] forward bumped traffic to parent in plain form |
| 126 | +</A></li> |
| 127 | + <LI>Next message (by thread): <A HREF="009981.html">[squid-dev] forward bumped traffic to parent in plain form |
| 128 | +</A></li> |
| 129 | + <LI> <B>Messages sorted by:</B> |
| 130 | + <a href="date.html#9984">[ date ]</a> |
| 131 | + <a href="thread.html#9984">[ thread ]</a> |
| 132 | + <a href="subject.html#9984">[ subject ]</a> |
| 133 | + <a href="author.html#9984">[ author ]</a> |
| 134 | + </LI> |
| 135 | + </UL> |
| 136 | + |
| 137 | +<hr> |
| 138 | +<a href="https://lists.squid-cache.org/listinfo/squid-dev">More information about the squid-dev |
| 139 | +mailing list</a><br> |
| 140 | +</body></html> |
0 commit comments