I have just set up Squid Server 3.5.26 on Ubuntu 16.04.2 LTS configured with SSL-bump. Http and Https is working fine but any web service that requires Web Sockets fails, for example, a speed test.

I have added the following lines to my squid configuration in an attempt to force a direct connection and prevent SSL caching for web socket connections.

#Temporarily allow all connections for debugging
http_access allow all

acl bump-bypass dstdomain .speedtest.net
# URL's contains ws (most web socket urls do)
acl ssl-web-sockets SSL::server_name_regex \/ws

acl step1 at_step SslBump1
ssl_bump peek step1
ssl_bump splice bump-bypass ssl-web-sockets tcp-web-sockets

#I Read that there was a bug in bump that required !explicity 
#for splice to work for web sockets
ssl_bump bump !ssl-web-sockets all

#just bump all doesn't work either
#ssl_bump bump all

If I disable ssl-bump and don't decrypt encrypted traffic everything works fine.

How can I configure squid to allow direct web socket connection?


Updated to Squid Server 4.0.21 and added to config

on_unsupported_protocol tunnel all 

The documentation says this should allow TCP tunnel connections

Sadly this did not fix the issue either, still getting Web socket error

Connection closed before receiving a handshake response

This is not an acl in your squid.conf?

I think you must write acl step1 at_step SslBump1 instead of ssl_bump step1 at_step SslBump1

Regards, József

  • Ah that was I typo good spot though, I do apologize. I have updaed the question. Any other ideas?
    – maxhap
    Jul 17 '17 at 9:48

Fortunately, in my configuration the speedtes.net working fine. My config is here:

acl step1 at_step SslBump1
acl step2 at_step SslBump2
acl step3 at_step SslBump3

ssl_bump peek step1 all
ssl_bump peek step2 all
ssl_bump bump all

Now, the step3 acl is unneccessary, but in this configuration is not "whitelist" (not bumped url's list).

I thing, that is not big different, but I use this on Debian 8.7.

  • speedtest.net or beta.speedtest.net? speedtest.net uses flash which works fine for me. Where as bings seedtest and beta.speedtest.net don't as they use websockets.
    – maxhap
    Jul 18 '17 at 13:07
  • Tried your suggestion, still didn't work for me. If you could try beta.speedtest.net and let me know if it works that would be amazing :)
    – maxhap
    Jul 18 '17 at 15:04
  • Hi, I am on holiday, but I remembered something. I can't try it now, but be the first line the ssl_bump splice bump-bypass ssl-web-sockets tcp-web-sockets! Let's before ssl_bump peek step1! Do I wonder how this works? Jul 27 '17 at 20:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.