Пытаюсь сделать proxy с просмотром содержимого https. Использую squid 3.1.6, пересобранный с поддержкой ssl, разумеется не прозрачный.
acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1
acl my_net src 10.0.0.0/16
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
#http_access deny CONNECT !SSL_ports
http_access allow localhost
http_access allow my_net
http_access deny all
http_port 3128
hierarchy_stoplist cgi-bin ?
coredump_dir /var/spool/squid3
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
always_direct allow all
ssl_bump allow all
https_port 3129 cert=/root/server.crt key=/root/server.key intercept sslBumphttp работает без проблем, при обращении по https нет, вот что в таком случае появляется в логах:
IpIntercept.cc(137) NetfilterInterception: NF getsockopt(SO_ORIGINAL_DST) failed on FD 11: (92) Protocol not available
clientNegotiateSSL: Error negotiating SSL connection on FD 11: error:1407609B:SSL routines:SSL23_GET_CLIENT_HELLO:https proxy request (1/-1)
Вроде бы нужно использовать ssl-bump, а не sslBump. Но при таком синтаксисе squid не запускается вовсе
Restarting Squid HTTP Proxy 3.x: squid3 Waiting.....................done.
Creating Squid HTTP Proxy 3.x cache structure ... (warning).
FATAL: Bungled squid.conf line 37: https_port 3129 cert=/root/server.crt key=/root/server.key intercept ssl_bump
Squid Cache (Version 3.1.6): Terminated abnormally.
CPU Usage: 0.040 seconds = 0.020 user + 0.020 sys
Maximum Resident Size: 17888 KB
Page faults with physical i/o: 0
FATAL: Bungled squid.conf line 37: https_port 3129 cert=/root/server.crt key=/root/server.key intercept ssl_bump
Squid Cache (Version 3.1.6): Terminated abnormally.
CPU Usage: 0.044 seconds = 0.012 user + 0.032 sys
Maximum Resident Size: 17904 KB
Page faults with physical i/o: 0
failed!
Может кто-нибудь подскажет, что я делаю не так?
Тема: https в squid (Прочитано 7869 раз)
