Re: Issue 142748 in chromium: Barracuda proxies fail to handle TLS 1.1 connections

[chro...@googlecode.com]

Updates:
Summary: Barracuda proxies fail to handle TLS 1.1 connections

Comment #13 on issue 142748 by a...@chromium.org: Barracuda proxies fail to
handle TLS 1.1 connections
http://code.google.com/p/chromium/issues/detail?id=142748

Ah, 142946 is also reporting that there's a Barracuda filter involved so
I'm tentatively going to suggest that's the problem. I'll merge the two
bugs and see about contacting Barracuda.

[chro...@googlecode.com]

Comment #14 on issue 142748 by a...@chromium.org: Barracuda proxies fail to

handle TLS 1.1 connections
http://code.google.com/p/chromium/issues/detail?id=142748

Issue 142946 has been merged into this issue.

[chro...@googlecode.com]

Comment #15 on issue 142748 by ian.robi...@gmail.com: Barracuda proxies

fail to handle TLS 1.1 connections
http://code.google.com/p/chromium/issues/detail?id=142748

Ours is a 310 model Barracuda.

[chro...@googlecode.com]

Comment #16 on issue 142748 by ian.robi...@gmail.com: Barracuda proxies

fail to handle TLS 1.1 connections
http://code.google.com/p/chromium/issues/detail?id=142748

What firmware is your Barracuda device on?

[chro...@googlecode.com]

Comment #17 on issue 142748 by a...@chromium.org: Barracuda proxies fail to

handle TLS 1.1 connections
http://code.google.com/p/chromium/issues/detail?id=142748

I phoned Barracuda on Friday afternoon and they asserted that it can't be
their fault because they don't inspect the contents of packets, rather they
just do DNS filtering and classification at the IP/port level. However,
that's completely incongruous with their marketing[1] and feature set
(i.e. "Blocks downloads based on file type")[2].

Perhaps they were just talking about port 443, but that's also questionable
since they claim to filter specific applications (i.e. Skype) that will run
over port 443. Can anyone actually do a test to confirm that it's the
Barracuda device that's the clearly the problem here?

[1]
https://www.barracudanetworks.com/docs/Datasheets/Barracuda_Web_Filter_TDS_US.pdf
[2] https://www.barracudanetworks.com/ns/products/web-filter-overview.php

[chro...@googlecode.com]

Comment #18 on issue 142748 by ian.robi...@gmail.com: Barracuda proxies

fail to handle TLS 1.1 connections
http://code.google.com/p/chromium/issues/detail?id=142748

I spoke with Barracuda on Friday as well, and they suggested that it could
be somehow tied to the firmware of the device. Our device is on version 5
firmware, which had known issues with HTTP 1.1. When we bypassed the
device, the sites loaded up properly. I will be upgrading our web filter
to version 6, in order to test this out.

[chro...@googlecode.com]

Comment #19 on issue 142748 by a...@chromium.org: Barracuda proxies fail to

handle TLS 1.1 connections
http://code.google.com/p/chromium/issues/detail?id=142748

Barracuda have confirmed that there's a problem with some version 6
firmwares when the device is configured as an explicit proxy. (Neither of
the net-internals logs suggested that it was being used in that fashion
however.) They suggest that the latest version 6 firmware fixes this.

They haven't yet tested any version 5 firmwares, but I've asked them to.

[chro...@googlecode.com]

Updates:
Owner: a...@chromium.org

Comment #20 on issue 142748 by a...@chromium.org: Barracuda proxies fail to

handle TLS 1.1 connections
http://code.google.com/p/chromium/issues/detail?id=142748

ian.robinett: did you ever get anywhere? Barracuda say that they are unable
to reproduce the problem with version 5 of the firmware, but it certainly
seems that there's a real issue here.

[chro...@googlecode.com]

Comment #21 on issue 142748 by ian.robi...@gmail.com: Barracuda proxies

fail to handle TLS 1.1 connections
http://code.google.com/p/chromium/issues/detail?id=142748

Since upgrading to Firmware 6 on our 310 device, the one HTTPS site that
was unable to load in any browser, is loading. Everything on Chrome is
functioning as well (currently on 22.0.1229.26 beta-m). The technician I
spoke with thought this would resolve the known issue with HTTP 1.1, and
assumed the issue with HTTPS 1.1 and TLS 1.1 would be resolved as well.

One sidenote that I found as well, IE and Firefox were both having issues
loading the page, initially, after the Barracuda FW upgrade, but in the
Internet Settings, it was still trying to force TLS 1.0 and SSL 2.0. I
modified the settings to SSL 3.0 and TLS 1.2, which could have helped as
well with those two browsers. Chrome did load the page without the
settings modified.

[chro...@googlecode.com]

Comment #22 on issue 142748 by oneto...@gmail.com: Barracuda proxies fail

to handle TLS 1.1 connections
http://code.google.com/p/chromium/issues/detail?id=142748

hi..............that "microsoft malware" link you sent me did a nasty
number on my desktop............it stopped my internet access
completely............uninstalling did nothing to correct this
issue..........and no seems to be able to help me