1

I have the following configuration under squid.conf. However, when my Blackberry email client attempts to fetch new emails, etc. Squid access log show the following error:

imap.gmail.com "CONNECT imap.gmail.com:993 HTTP/1.1" 403 3465 "-" "-" TCP_DENIED:NONE
smtp.gmail.com "CONNECT smtp.gmail.com:465 HTTP/1.1" 403 3465 "-" "-" TCP_DENIED:NONE

Consequently, no emails are fetched. 

acl manager proto cache_object                                                                                                                                                                                                                                                                                               
acl localhost src 127.0.0.1/32 ::1                                                                                                                                                                                                                                                                                           
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1                                                                                                                                                                                                                                                                              
acl SSL_ports port 443                                                                                                                                                                                                                                                                                                       
acl Safe_ports port 80    # http                                                                                                                                                                                                                                                                                             
acl Safe_ports port 21    # ftp                                                                                                                                                                                                                                                                                              
acl Safe_ports port 443   # https                                                                                                                                                                                                                                                                                            
acl CONNECT method CONNECT                                                                                                                                                                                                                                                                                                   
http_access allow manager localhost                                                                                                                                                                                                                                                                                          
http_access deny manager                                                                                                                                                                                                                                                                                                     
http_access deny !Safe_ports                                                                                                                                                                                                                                                                                                 
http_access deny CONNECT !SSL_ports                                                                                                                                                                                                                                                                                          
http_access allow localhost

What could be the issue? Anyway to bypass this?

masegaloeh
  • 18,236
  • 10
  • 57
  • 106
Sijia Din
  • 111
  • 1
  • 3

1 Answers1

1

acl SSL_ports port 443

http_access deny CONNECT !SSL_ports

The CONNECT command is used to build a tunnel through the proxy to some other host. It is usually used by the browser to connect to a remote server via https, i.e. built the tunnel and then upgrade the connection inside the tunnel to SSL and then speak HTTP inside this SSL tunnel. Since there is a risk that somebody might use this tunnel to connect to arbitrary ports (like port 25 to send spam via SMTP) it is by default restricted to the standard port for https, e.g. 443.

What you are trying to do is to use this tunnel not for https, but for imaps (port 993). This is denied because of these security settings. If you want to allow it you need to add port 993 to the SSL_ports ACL and restart the proxy.

Community
  • 1
Steffen Ullrich
  • 13,227
  • 27
  • 39
  • Looks like CONNECT method in HTTPS was a bit different with IMAPS, so perhaps [it ain't gonna work](http://marc.info/?l=squid-users&m=118711843512479&w=2) – masegaloeh Mar 27 '15 at 06:18
  • 1
    The CONNECT method just opens a tunnel through the proxy. It does not restrict by itself what protocol is spoken inside the tunnel, so you could in theory use imaps if the proxy allows to create a tunnel for the relevant port and the mail client is able to use this method to establish the tunnel (which is not typically the case). But it might be, that the proxy uses SSL interception to look at the traffic and restrict it. In this case it will detect that HTTP is not used inside a tunnel and block the traffic. – Steffen Ullrich Mar 27 '15 at 06:24