在 Debian 10 上使用 SSL 碰撞设置鱿鱼透明代理

Question 1

这不是对您问题的直接答案，因为我只是使用鱿鱼作为本地缓存代理。无论如何，我已经在这里发布了，因为你的问题最接近我需要的，现在我已经解决了，我想分享。

在 Debian 11/Bullseye 中，您要安装的软件包是鱿鱼openssl（Squid v4.x 编译--with-openssl）。

apt install -y squid-openssl

然后设置（自签名）可信 CA 证书：

CERT_D=/etc/squid/cert
CERT=$CERT_D/squid_proxyCA.pem
rm -rf $CERT
mkdir -p $CERT_D
# Generate local self-signed CA certificate/key (in the same file)
openssl req -new -newkey rsa:4096 -sha256 -days 365 -nodes -x509 -keyout $CERT -out $CERT
chown -R proxy:proxy $CERT_D
chmod 0400 $CERT

# add squid_proxyCA cert to system so it's trusted by default
CA_CERT_D=/usr/local/share/ca-certificates
rm -rf $CA_CERT_D/*
mkdir -p $CA_CERT_D
openssl x509 -inform PEM -in $CERT -out $CA_CERT_D/squid_proxyCA.crt
update-ca-certificates

配置鱿鱼以动态生成证书：

/usr/lib/squid/security_file_certgen -c -s /var/spool/squid/ssl_db -M 4MB
chown -R proxy:proxy /var/spool/squid

然后这是我的/etc/squid/squid.conf（注意它非常简约，只接受来自本地主机的连接并且只侦听 IPv4）：

acl SSL_ports port 443

acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 1025-65535  # unregistered ports

acl purge method PURGE
acl CONNECT method CONNECT

http_access allow manager localhost
http_access deny manager

http_access allow purge localhost
http_access deny purge

http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports

http_access allow localhost
http_access deny all

http_port 127.0.0.1:3128 ssl-bump cert=/etc/squid/cert/squid_proxyCA.pem generate-host-certificates=on options=NO_SSLv3,NO_TLSv1,NO_TLSv1_1,SINGLE_DH_USE,SINGLE_ECDH_USE
ssl_bump bump all

coredump_dir /var/spool/squid
logfile_rotate 0

refresh_pattern -i (/cgi-bin/|\?) 0 0%  0
refresh_pattern .       0   20% 4320

cache_dir ufs /var/spool/squid 200 16 256

最后，重新启动鱿鱼：

systemctl reload squid

另一件值得一提的事情是代理 URLhttp://127.0.0.1:3028应该用于两个都这http_proxy，和（https_proxy注意http-不;即使用作 https 代理）。如果/当与 https 一起使用时，Squid 将升级连接以使用 TLS/SSL。

Answer

这不是对您问题的直接答案，因为我只是使用鱿鱼作为本地缓存代理。无论如何，我已经在这里发布了，因为你的问题最接近我需要的，现在我已经解决了，我想分享。

在 Debian 11/Bullseye 中，您要安装的软件包是鱿鱼openssl（Squid v4.x 编译--with-openssl）。

apt install -y squid-openssl

然后设置（自签名）可信 CA 证书：

CERT_D=/etc/squid/cert
CERT=$CERT_D/squid_proxyCA.pem
rm -rf $CERT
mkdir -p $CERT_D
# Generate local self-signed CA certificate/key (in the same file)
openssl req -new -newkey rsa:4096 -sha256 -days 365 -nodes -x509 -keyout $CERT -out $CERT
chown -R proxy:proxy $CERT_D
chmod 0400 $CERT

# add squid_proxyCA cert to system so it's trusted by default
CA_CERT_D=/usr/local/share/ca-certificates
rm -rf $CA_CERT_D/*
mkdir -p $CA_CERT_D
openssl x509 -inform PEM -in $CERT -out $CA_CERT_D/squid_proxyCA.crt
update-ca-certificates

配置鱿鱼以动态生成证书：

/usr/lib/squid/security_file_certgen -c -s /var/spool/squid/ssl_db -M 4MB
chown -R proxy:proxy /var/spool/squid

然后这是我的/etc/squid/squid.conf（注意它非常简约，只接受来自本地主机的连接并且只侦听 IPv4）：

acl SSL_ports port 443

acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 1025-65535  # unregistered ports

acl purge method PURGE
acl CONNECT method CONNECT

http_access allow manager localhost
http_access deny manager

http_access allow purge localhost
http_access deny purge

http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports

http_access allow localhost
http_access deny all

http_port 127.0.0.1:3128 ssl-bump cert=/etc/squid/cert/squid_proxyCA.pem generate-host-certificates=on options=NO_SSLv3,NO_TLSv1,NO_TLSv1_1,SINGLE_DH_USE,SINGLE_ECDH_USE
ssl_bump bump all

coredump_dir /var/spool/squid
logfile_rotate 0

refresh_pattern -i (/cgi-bin/|\?) 0 0%  0
refresh_pattern .       0   20% 4320

cache_dir ufs /var/spool/squid 200 16 256

最后，重新启动鱿鱼：

systemctl reload squid

另一件值得一提的事情是代理 URLhttp://127.0.0.1:3028应该用于两个都这http_proxy，和（https_proxy注意http-不;即使用作 https 代理）。如果/当与 https 一起使用时，Squid 将升级连接以使用 TLS/SSL。

Question 2

# apt-get install openssl
# mkdir -p /etc/squid/cert
# cd /etc/squid/cert
# openssl req -new -newkey rsa:4096 -sha256 -days 365 -nodes -x509 -keyout myCA.pem -out myCA.pem
# openssl x509 -in myCA.pem -outform DER -out myCA.der
# chown -R proxy:proxy /etc/squid/cert
# chmod 700 /etc/squid/cert

# /usr/lib/squid/security_file_certgen -c -s /var/spool/squid/ssl_db -M 4MB
# chown -R proxy:proxy /var/spool/squid/ssl_db/

并在squid.conf：

https_port 3129 intercept ssl-bump cert=/etc/squid/cert/myCA.pem generate-host-certificates=on dynamic_cert_mem_cache_si
ze=4MB
ssl_bump peek all
ssl_bump splice all

对于拦截：

iptables -t nat -A PREROUTING -i br0 -p tcp --dport 443 -j DNAT --to 192.168.1.51:3129
iptables -t nat -A PREROUTING -i br0 -p tcp --dport 443 -j REDIRECT --to-port 3129

（这br0是我的内部网络。）

这是查看最常缓存的域的命令。 SSL 显示为空白。

awk 'BEGIN {FS="[ ]+"}; {print $7}' < /var/log/squid/access.log | awk 'BEGIN {FS="/"}; {print $3}' | sort | uniq -c |sort -k1,1nr -k2,2 | head

Answer

# apt-get install openssl
# mkdir -p /etc/squid/cert
# cd /etc/squid/cert
# openssl req -new -newkey rsa:4096 -sha256 -days 365 -nodes -x509 -keyout myCA.pem -out myCA.pem
# openssl x509 -in myCA.pem -outform DER -out myCA.der
# chown -R proxy:proxy /etc/squid/cert
# chmod 700 /etc/squid/cert

# /usr/lib/squid/security_file_certgen -c -s /var/spool/squid/ssl_db -M 4MB
# chown -R proxy:proxy /var/spool/squid/ssl_db/