[squid-users] Logformat tag for a specific ACL
Hello,
There is a way to tag an ACL in access.log ?
acl test url_regex /tmp/myfile
logformat fred %a %[ui %[un [%tl] %rm %ru HTTP/%rv %Hs %st %Ss:%Sh
%{User-Agent}h
access_log daemon:/var/log/squid/access.log fred
If I put something at the end
logformat fred %a %[ui %[un [%tl] %rm %ru HTTP/%rv %Hs %st %Ss:%Sh
%{User-Agent}h test
The end of line contain test, can I do this for an Acl only ? And let the usual
logformat without test at the end ?
Regards
Fred
Something like:
10.1.1.1 - fred [27/May/2015:12:00:19 +0200] CONNECT zimbra.free.fr:443
HTTP/1.0 200 4724 TCP_TUNNEL:HIER_DIRECT Mozilla/5.0 (Windows NT 6.1; WOW64;
rv:38.0) Gecko/20100101 Firefox/38.0
10.1.1.1 - fred [27/May/2015:12:00:21 +0200] CONNECT testsite.fr:443 HTTP/1.0
200 4724 TCP_TUNNEL:HIER_DIRECT Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0)
Gecko/20100101 Firefox/38.0 test
___
squid-users mailing list
squid-users@lists.squid-cache.org
http://lists.squid-cache.org/listinfo/squid-users
Re: [squid-users] Logformat tag for a specific ACL
On 27/05/2015 10:04 p.m., FredB wrote:
Hello,
There is a way to tag an ACL in access.log ?
acl test url_regex /tmp/myfile
logformat fred %a %[ui %[un [%tl] %rm %ru HTTP/%rv %Hs %st %Ss:%Sh
%{User-Agent}h
access_log daemon:/var/log/squid/access.log fred
If I put something at the end
logformat fred %a %[ui %[un [%tl] %rm %ru HTTP/%rv %Hs %st %Ss:%Sh
%{User-Agent}h test
The end of line contain test, can I do this for an Acl only ? And let the
usual logformat without test at the end ?
Yes, but not to the same log file. Like this:
access_log daemon:/var/log/squid/access.log squid !test
access_log daemon:/var/log/squid/access_test.log fred test
Amos
___
squid-users mailing list
squid-users@lists.squid-cache.org
http://lists.squid-cache.org/listinfo/squid-users
Re: [squid-users] Squid, Gmail.com and HSTS.
Yeah I don't know what I am doing wrong but I don't have these ACL types..Or I am somehow not copy pasting properly: FATAL: Invalid ACL type 'ssl::server_name' FATAL: Bungled /etc/squid/squid.conf line 54: acl nobumpsites ssl::server_name .google.com Squid Cache (Version 3.5.4): Terminated abnormally. CPU Usage: 0.005 seconds = 0.003 user + 0.002 sys Maximum Resident Size: 24096 KB Page faults with physical i/o: 0 Squid restarted [root@ottt-corp-paz-squid-1 squid-3.5.4]# squid -v Squid Cache: Version 3.5.4 Service Name: squid configure options: '--prefix=/usr' '--includedir=/usr/include' '--datadir=/usr/share' '--bindir=/usr/sbin' '--libexecdir=/usr/lib/squid' '--localstatedir=/var' '--sysconfdir=/etc/squid' '--with-included-ltdl' --enable-ltdl-convenience There are also issues with at_step now: 2015/05/27 14:32:17| FATAL: Invalid ACL type 'at_step' FATAL: Bungled /etc/squid/squid.conf line 52: acl step1 at_step SslBump1 Squid Cache (Version 3.5.4): Terminated abnormally. CPU Usage: 0.005 seconds = 0.003 user + 0.002 sys Maximum Resident Size: 24080 KB Page faults with physical i/o: 0 Did I miss something when compiling? I just followed what was on the Squid wiki. I am all out of ideas.. Thanks, Mike - Original Message - From: Amos Jeffries squ...@treenet.co.nz To: squid-users squid-users@lists.squid-cache.org Sent: Wednesday, May 27, 2015 1:20:33 PM Subject: Re: [squid-users] Squid, Gmail.com and HSTS. On 28/05/2015 4:15 a.m., Michael Monette wrote: Has anyone been able to configure Squid in a way so that if you type https://gmail.com in your browser, you are NOT presented with the OMG HSTS I refuse to load anything page? When I go to https://gmail.com, I get an invalid certificate because the cert is for mail.google.com, issued by my CA. If I go to https://mail.google.com, the cert is beautifully green. Why can't squid detect that gmail.com is redirecting my browser to mail.google.com and generate the cert accordingly? That is *actually* what their server certificate contains. Ironic isn't it that their own certs do not comply with the restrictions they require of all others. Squid actually does obey HSTS requirements for secure handling of the reqeust. Its just the browser is incapable of detecting that, notices the custom CA and assumes the worst. Even configuring an acl for gmail.com doesn't work. It seems like even though I am punching https://gmail.com in my browser, Squid detects it as though I am typing https://mail.google.com; in my browser and is ignoring any ACLs I have setup specifically for gmail.com. I can't be the only one with this issue? I've also attempted to do: acl bl1 gmail.com moz.com always_direct allow bl1 - from what I understand this bypasses squid and tells my browser to get the cert right from the site. Maybe I am wrong. You are. squid.conf has nothing to do with your browser. That line tells Squid not to use any cache_peer connections when serving a request that matches ACL bl1. In the very first implementation way, way back in 3.1 decrypted requests could leak out over insecure cache_peer. So people were advised to use always_direct allow all to force it to work correctly. That bug was fixed long ago but the config still persists in the web. But certificates still come from Squid, so I don't see any effect from that line. Here's my config, lots of garbage in there since I have been trying everything i can think of to get this working. I want to add that for my acl called BL1, the only one that works is moz.com . They are part of the same ACL line, so if one works, they should all work. Except they do not. Thanks in advance. cat /etc/squid/squid.conf ~~ debug_options ALL,9 acl localnet src 10.0.0.0/8 # RFC1918 possible internal network acl localnet src 172.16.0.0/12# RFC1918 possible internal network acl localnet src 192.168.0.0/16 # RFC1918 possible internal network acl localnet src fc00::/7 # RFC 4193 local private network range acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines acl SSL_ports port 443 acl Safe_ports port 80# http acl Safe_ports port 21# ftp acl Safe_ports port 443 # https acl Safe_ports port 70# gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535# unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow localhost manager http_access deny manager acl step1 at_step SslBump1 acl step2 at_step SslBump2 acl step3 at_step SslBump3 ssl_bump peek step1 all ssl_bump bump step2 all ssl_bump bump step3 all all at the end
Re: [squid-users] New server_name acl causes fatal error starting Squid 3.5.4
Stanford Prescott stan.prescott at gmail.com writes: Never mind. I figured the acl out. I was using someone else's instructions who accidentally left out the double :: ssl::server_name using just a single :. I am getting the same thing as you except I don't have the mistake you did. I literally copied your line into my config and it's still bombing out. 2015/05/27 14:38:25| FATAL: Invalid ACL type 'ssl::server_name' FATAL: Bungled /etc/squid/squid.conf line 52: acl nobumpSites ssl::server_name .wellsfargo.com Squid Cache (Version 3.5.4): Terminated abnormally. CPU Usage: 0.006 seconds = 0.002 user + 0.004 sys Maximum Resident Size: 24112 KB Page faults with physical i/o: 0 I'm about to just give up on squid..losing my mind. Any ideas? On Wed, May 20, 2015 at 12:36 PM, Stanford Prescott stan.prescott at gmail.com wrote: After a diversion getting SquidClamAV working, i am back to trying to get peek and splice working. I am trying to put together information from previous recommendations I have received. Right now, I can't get the server_name acl working. When I put this in my squid.confacl nobumpSites ssl:server_name .example.com I get a fatal error starting squid using that acl saying the acl is Bungled. Is the form of the acl incorrect? ___ squid-users mailing list squid-users at lists.squid-cache.org http://lists.squid-cache.org/listinfo/squid-users ___ squid-users mailing list squid-users@lists.squid-cache.org http://lists.squid-cache.org/listinfo/squid-users
Re: [squid-users] ipf transparent enabled, but squid says not supported
On 2015-05-27 09:45 AM, Stephen Borrill wrote: I have: Squid Cache: Version 3.5.4 Service Name: squid configure options: '--sysconfdir=/usr/pkg/etc/squid' '--localstatedir=/var/squid' '--datarootdir=/usr/pkg/share/squid' '--disable-strict-error-checking' '--enable-auth' '--enable-cachemgr-hostname=localhost' '--enable-delay-pools' '--enable-icap-client' '--enable-icmp' '--enable-poll' '--enable-removal-policies=lru,heap' '--enable-storeio=ufs diskd' '--with-aio' '--with-default-user=squid' '--with-pidfile=/var/run/squid.pid' '--disable-arch-native' '--enable-ipf-transparent' '--enable-arp-acl' '--enable-carp' '--disable-ipv6' '--without-mit-krb5' '--without-heimdal-krb5' '--disable-snmp' '--enable-ssl' '--with-openssl=/usr/pkg' '--enable-auth-basic=NCSA getpwnam PAM' '--enable-auth-digest=file' '--disable-auth-negotiate' '--enable-auth-ntlm=fake smb_lm' '--enable-external-acl-helpers=file_userip unix_group' '--prefix=/usr/pkg' '--build=i486--netbsdelf' '--host=i486--netbsdelf' '--mandir=/usr/pkg/man' 'build_alias=i486--netbsdelf' 'host_alias=i486--netbsdelf' 'CC=cc' 'CFLAGS=-O2 -I/usr/include -I/usr/pkg/include' 'LDFLAGS=-L/usr/lib -Wl,-R/usr/lib -L/usr/pkg/lib -Wl,-R/usr/pkg/lib' 'LIBS=' 'CPPFLAGS=-I/usr/include -I/usr/pkg/include' 'CXX=c++' 'CXXFLAGS=-O2 -I/usr/include -I/usr/pkg/include' squid.conf contains: http_port 127.0.0.1:8006 intercept name=port_8006 Yet I see the following ev: 2015/05/27 16:02:46 kid1| WARNING: transparent proxying not supported Same config works with earlier version of squid (3.4 and earlier). What's changed? Look through your config.log...I experienced a similar thing and, upon running my ./configure line and watching it I saw I was missing a library. James ___ squid-users mailing list squid-users@lists.squid-cache.org http://lists.squid-cache.org/listinfo/squid-users
[squid-users] Squid, Gmail.com and HSTS.
Has anyone been able to configure Squid in a way so that if you type https://gmail.com in your browser, you are NOT presented with the OMG HSTS I refuse to load anything page? When I go to https://gmail.com, I get an invalid certificate because the cert is for mail.google.com, issued by my CA. If I go to https://mail.google.com, the cert is beautifully green. Why can't squid detect that gmail.com is redirecting my browser to mail.google.com and generate the cert accordingly? Even configuring an acl for gmail.com doesn't work. It seems like even though I am punching https://gmail.com in my browser, Squid detects it as though I am typing https://mail.google.com; in my browser and is ignoring any ACLs I have setup specifically for gmail.com. I can't be the only one with this issue? I've also attempted to do: acl bl1 gmail.com moz.com always_direct allow bl1 - from what I understand this bypasses squid and tells my browser to get the cert right from the site. Maybe I am wrong. But certificates still come from Squid, so I don't see any effect from that line. Here's my config, lots of garbage in there since I have been trying everything i can think of to get this working. I want to add that for my acl called BL1, the only one that works is moz.com . They are part of the same ACL line, so if one works, they should all work. Except they do not. Thanks in advance. cat /etc/squid/squid.conf ~~ debug_options ALL,9 acl localnet src 10.0.0.0/8 # RFC1918 possible internal network acl localnet src 172.16.0.0/12 # RFC1918 possible internal network acl localnet src 192.168.0.0/16 # RFC1918 possible internal network acl localnet src fc00::/7 # RFC 4193 local private network range acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow localhost manager http_access deny manager acl step1 at_step SslBump1 acl step2 at_step SslBump2 acl step3 at_step SslBump3 ssl_bump peek step1 all ssl_bump bump step2 all ssl_bump bump step3 all acl bl1 dstdomain gmail.com mail.google.com accounts.google.com moz.com #acl bl1 url_regex -i ^http(s)?://gmail.com #acl bl2 url_regex -i ^http(s)?://([a-zA-Z]+).gmail.com.* #acl bl3 url_regex -i ^http(s)?://moz.com.* #acl bl4 url_regex -i moz.com deny_info http://ask.com bl1 # I was testing redirecting stuff, but since the acl is not even picked up, this stuff is useless. http_reply_access deny bl1 # useless #http_access deny bl1 #http_access deny bl1 CONNECT http_access allow localnet http_access allow localhost http_access allow all http_port 3128 accel vhost allow-direct #https_port 3129 transparent ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/etc/squid/ssl_cert/myca.pem key=/etc/squid/ssl_cert/myca.pem options=NO_SSLv3 https_port 3129 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/etc/squid/ssl_cert/myca.pem key=/etc/squid/ssl_cert/myca.pem options=NO_SSLv3 sslproxy_cert_error allow all sslproxy_flags DONT_VERIFY_PEER sslproxy_options NO_SSLv2 sslproxy_options NO_SSLv3 sslcrtd_program /usr/lib/squid/ssl_crtd -s /var/lib/ssl_db -M 4MB sslcrtd_children 8 startup=1 idle=1 #cache_dir ufs /var/spool/squid 100 16 256 coredump_dir /var/spool/squid refresh_pattern ^ftp: 144020% 10080 refresh_pattern ^gopher:14400% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320 Mike ___ squid-users mailing list squid-users@lists.squid-cache.org http://lists.squid-cache.org/listinfo/squid-users
[squid-users] ipf transparent enabled, but squid says not supported
I have: Squid Cache: Version 3.5.4 Service Name: squid configure options: '--sysconfdir=/usr/pkg/etc/squid' '--localstatedir=/var/squid' '--datarootdir=/usr/pkg/share/squid' '--disable-strict-error-checking' '--enable-auth' '--enable-cachemgr-hostname=localhost' '--enable-delay-pools' '--enable-icap-client' '--enable-icmp' '--enable-poll' '--enable-removal-policies=lru,heap' '--enable-storeio=ufs diskd' '--with-aio' '--with-default-user=squid' '--with-pidfile=/var/run/squid.pid' '--disable-arch-native' '--enable-ipf-transparent' '--enable-arp-acl' '--enable-carp' '--disable-ipv6' '--without-mit-krb5' '--without-heimdal-krb5' '--disable-snmp' '--enable-ssl' '--with-openssl=/usr/pkg' '--enable-auth-basic=NCSA getpwnam PAM' '--enable-auth-digest=file' '--disable-auth-negotiate' '--enable-auth-ntlm=fake smb_lm' '--enable-external-acl-helpers=file_userip unix_group' '--prefix=/usr/pkg' '--build=i486--netbsdelf' '--host=i486--netbsdelf' '--mandir=/usr/pkg/man' 'build_alias=i486--netbsdelf' 'host_alias=i486--netbsdelf' 'CC=cc' 'CFLAGS=-O2 -I/usr/include -I/usr/pkg/include' 'LDFLAGS=-L/usr/lib -Wl,-R/usr/lib -L/usr/pkg/lib -Wl,-R/usr/pkg/lib' 'LIBS=' 'CPPFLAGS=-I/usr/include -I/usr/pkg/include' 'CXX=c++' 'CXXFLAGS=-O2 -I/usr/include -I/usr/pkg/include' squid.conf contains: http_port 127.0.0.1:8006 intercept name=port_8006 Yet I see the following ev: 2015/05/27 16:02:46 kid1| WARNING: transparent proxying not supported Same config works with earlier version of squid (3.4 and earlier). What's changed? -- Stephen ___ squid-users mailing list squid-users@lists.squid-cache.org http://lists.squid-cache.org/listinfo/squid-users
Re: [squid-users] Squid, Gmail.com and HSTS.
I just thought of something else. First of all I'm new to squid and I am not aware of 10% of the things its capable of yet so I will ask. Is squid capable of adding custom SNIs? Like could I have it so gmail.com is added to the certificate as a subject alternate name EVEN though the original certificate doesn't contain it? If such a thing is possible I would love to know the term for it so I can do some searches. Appreciate it! On May 27, 2015 12:15:37 PM EDT, Michael Monette mmone...@2keys.ca wrote: Has anyone been able to configure Squid in a way so that if you type https://gmail.com in your browser, you are NOT presented with the OMG HSTS I refuse to load anything page? When I go to https://gmail.com, I get an invalid certificate because the cert is for mail.google.com, issued by my CA. If I go to https://mail.google.com, the cert is beautifully green. Why can't squid detect that gmail.com is redirecting my browser to mail.google.com and generate the cert accordingly? Even configuring an acl for gmail.com doesn't work. It seems like even though I am punching https://gmail.com in my browser, Squid detects it as though I am typing https://mail.google.com; in my browser and is ignoring any ACLs I have setup specifically for gmail.com. I can't be the only one with this issue? I've also attempted to do: acl bl1 gmail.com moz.com always_direct allow bl1 - from what I understand this bypasses squid and tells my browser to get the cert right from the site. Maybe I am wrong. But certificates still come from Squid, so I don't see any effect from that line. Here's my config, lots of garbage in there since I have been trying everything i can think of to get this working. I want to add that for my acl called BL1, the only one that works is moz.com . They are part of the same ACL line, so if one works, they should all work. Except they do not. Thanks in advance. cat /etc/squid/squid.conf ~~ debug_options ALL,9 acl localnet src 10.0.0.0/8# RFC1918 possible internal network acl localnet src 172.16.0.0/12 # RFC1918 possible internal network acl localnet src 192.168.0.0/16# RFC1918 possible internal network acl localnet src fc00::/7 # RFC 4193 local private network range acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443# https acl Safe_ports port 70 # gopher acl Safe_ports port 210# wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280# http-mgmt acl Safe_ports port 488# gss-http acl Safe_ports port 591# filemaker acl Safe_ports port 777# multiling http acl CONNECT method CONNECT http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow localhost manager http_access deny manager acl step1 at_step SslBump1 acl step2 at_step SslBump2 acl step3 at_step SslBump3 ssl_bump peek step1 all ssl_bump bump step2 all ssl_bump bump step3 all acl bl1 dstdomain gmail.com mail.google.com accounts.google.com moz.com #acl bl1 url_regex -i ^http(s)?://gmail.com #acl bl2 url_regex -i ^http(s)?://([a-zA-Z]+).gmail.com.* #acl bl3 url_regex -i ^http(s)?://moz.com.* #acl bl4 url_regex -i moz.com deny_info http://ask.com bl1 # I was testing redirecting stuff, but since the acl is not even picked up, this stuff is useless. http_reply_access deny bl1 # useless #http_access deny bl1 #http_access deny bl1 CONNECT http_access allow localnet http_access allow localhost http_access allow all http_port 3128 accel vhost allow-direct #https_port 3129 transparent ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/etc/squid/ssl_cert/myca.pem key=/etc/squid/ssl_cert/myca.pem options=NO_SSLv3 https_port 3129 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/etc/squid/ssl_cert/myca.pem key=/etc/squid/ssl_cert/myca.pem options=NO_SSLv3 sslproxy_cert_error allow all sslproxy_flags DONT_VERIFY_PEER sslproxy_options NO_SSLv2 sslproxy_options NO_SSLv3 sslcrtd_program /usr/lib/squid/ssl_crtd -s /var/lib/ssl_db -M 4MB sslcrtd_children 8 startup=1 idle=1 #cache_dir ufs /var/spool/squid 100 16 256 coredump_dir /var/spool/squid refresh_pattern ^ftp: 144020% 10080 refresh_pattern ^gopher: 14400% 1440 refresh_pattern -i (/cgi-bin/|\?) 00% 0 refresh_pattern . 0 20% 4320 Mike ___ squid-users mailing list squid-users@lists.squid-cache.org http://lists.squid-cache.org/listinfo/squid-users -- Sent from my Android device with K-9 Mail. Please excuse my brevity.___ squid-users mailing list squid-users@lists.squid-cache.org http://lists.squid-cache.org/listinfo/squid-users
Re: [squid-users] Squid, Gmail.com and HSTS.
On 28/05/2015 4:15 a.m., Michael Monette wrote: Has anyone been able to configure Squid in a way so that if you type https://gmail.com in your browser, you are NOT presented with the OMG HSTS I refuse to load anything page? When I go to https://gmail.com, I get an invalid certificate because the cert is for mail.google.com, issued by my CA. If I go to https://mail.google.com, the cert is beautifully green. Why can't squid detect that gmail.com is redirecting my browser to mail.google.com and generate the cert accordingly? That is *actually* what their server certificate contains. Ironic isn't it that their own certs do not comply with the restrictions they require of all others. Squid actually does obey HSTS requirements for secure handling of the reqeust. Its just the browser is incapable of detecting that, notices the custom CA and assumes the worst. Even configuring an acl for gmail.com doesn't work. It seems like even though I am punching https://gmail.com in my browser, Squid detects it as though I am typing https://mail.google.com; in my browser and is ignoring any ACLs I have setup specifically for gmail.com. I can't be the only one with this issue? I've also attempted to do: acl bl1 gmail.com moz.com always_direct allow bl1 - from what I understand this bypasses squid and tells my browser to get the cert right from the site. Maybe I am wrong. You are. squid.conf has nothing to do with your browser. That line tells Squid not to use any cache_peer connections when serving a request that matches ACL bl1. In the very first implementation way, way back in 3.1 decrypted requests could leak out over insecure cache_peer. So people were advised to use always_direct allow all to force it to work correctly. That bug was fixed long ago but the config still persists in the web. But certificates still come from Squid, so I don't see any effect from that line. Here's my config, lots of garbage in there since I have been trying everything i can think of to get this working. I want to add that for my acl called BL1, the only one that works is moz.com . They are part of the same ACL line, so if one works, they should all work. Except they do not. Thanks in advance. cat /etc/squid/squid.conf ~~ debug_options ALL,9 acl localnet src 10.0.0.0/8 # RFC1918 possible internal network acl localnet src 172.16.0.0/12# RFC1918 possible internal network acl localnet src 192.168.0.0/16 # RFC1918 possible internal network acl localnet src fc00::/7 # RFC 4193 local private network range acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines acl SSL_ports port 443 acl Safe_ports port 80# http acl Safe_ports port 21# ftp acl Safe_ports port 443 # https acl Safe_ports port 70# gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535# unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow localhost manager http_access deny manager acl step1 at_step SslBump1 acl step2 at_step SslBump2 acl step3 at_step SslBump3 ssl_bump peek step1 all ssl_bump bump step2 all ssl_bump bump step3 all all at the end of ACL lines has no meaning unless there is an authentication ACL that would otherwise be on the end and you dont want to trigger auth popups. acl bl1 dstdomain gmail.com mail.google.com accounts.google.com moz.com #acl bl1 url_regex -i ^http(s)?://gmail.com #acl bl2 url_regex -i ^http(s)?://([a-zA-Z]+).gmail.com.* #acl bl3 url_regex -i ^http(s)?://moz.com.* #acl bl4 url_regex -i moz.com deny_info http://ask.com bl1 # I was testing redirecting stuff, but since the acl is not even picked up, this stuff is useless. http_reply_access deny bl1 # useless Yes, why bother testing for request *URL* domain and blocking on the *reply*. #http_access deny bl1 #http_access deny bl1 CONNECT http_access allow localnet http_access allow localhost http_access allow all http_port 3128 accel vhost allow-direct #https_port 3129 transparent ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/etc/squid/ssl_cert/myca.pem key=/etc/squid/ssl_cert/myca.pem options=NO_SSLv3 https_port 3129 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/etc/squid/ssl_cert/myca.pem key=/etc/squid/ssl_cert/myca.pem options=NO_SSLv3 sslproxy_cert_error allow all sslproxy_flags DONT_VERIFY_PEER sslproxy_options NO_SSLv2 sslproxy_options NO_SSLv3 NOTE: Only the latest sslproxy_options line has any effect. So the NO_SSLv2 line is not obeyed. Use this instead:
Re: [squid-users] Correct Syntax for ACL?
Hi, how does squid distinquish between a file containing rules e.g. acl acl-file url_regex -i /etc/url-acl.squid or the rule itself e.g. acl acl-rule url_regex -i \.exe$ with the same acl-type? From http://www.squid-cache.org/Doc/config/acl/ Every access list definition must begin with an aclname and acltype, followed by either type-specific arguments or a quoted filename that they are read from. Seems to suggest that using s means the argument is a file. HTH Kind regards/met vriendelijke groet, Serge Fonville http://www.sergefonville.nl 2015-05-27 22:11 GMT+02:00 Hussam Al-Tayeb hus...@visp.net.lb: On Wednesday 27 May 2015 22:03:14 Walter H. wrote: Hello, would this be the correct syntax: acl crl-file url_regex -i \.crl$ or need it to be acl crl-file url_regex -i \.crl$ how does squid distinquish between a file containing rules e.g. acl acl-file url_regex -i /etc/url-acl.squid or the rule itself e.g. acl acl-rule url_regex -i \.exe$ with the same acl-type? Thanks, Walter This is what I am using right now. acl crlfiletype rep_mime_type application/x-pkcs7-crl store_miss deny crlfiletype acl crl url_regex .crl$ cache deny crl ___ squid-users mailing list squid-users@lists.squid-cache.org http://lists.squid-cache.org/listinfo/squid-users ___ squid-users mailing list squid-users@lists.squid-cache.org http://lists.squid-cache.org/listinfo/squid-users
[squid-users] Correct Syntax for ACL?
Hello, would this be the correct syntax: acl crl-file url_regex -i \.crl$ or need it to be acl crl-file url_regex -i \.crl$ how does squid distinquish between a file containing rules e.g. acl acl-file url_regex -i /etc/url-acl.squid or the rule itself e.g. acl acl-rule url_regex -i \.exe$ with the same acl-type? Thanks, Walter smime.p7s Description: S/MIME Cryptographic Signature ___ squid-users mailing list squid-users@lists.squid-cache.org http://lists.squid-cache.org/listinfo/squid-users
Re: [squid-users] Squid, Gmail.com and HSTS.
On 28/05/2015 5:51 a.m., Michael Monette wrote: Thanks for the reply. I am compiling the latest squid now and going to give that a shot using ssl::server_name. The precompiled binary for CentOS was only at 3.5.04 and didn't have ssl::server_name support I guess. While I have you here, I was thinking of something else I could do. Tell me if you think it would work. You seem like an expert. I'm the Squid maintainer. On this feature I'm just an interested party, the real expert is Christos Tsantilas who authored it. Can I not make it so www.gmail.com resolves to (for example) 1.2.3.4 using DNS or a hosts file, then setup an acl like this: acl gml dst 1.2.3.4 # Redirect request for 1.2.3.4 to https://mail.google.com deny_info https://mail.google.com gml # Not even sure what this does, found it on a website, didn't really question it since things were working as they were supposed to. http_reply_access deny bl1 This acts on the HTTP messages inside the TLS wrapper after SSL-Bump has decrypted the connection and the request has been sent through to the server. By replacing whatever reply the server actually sent with a 302 status diverting the client to that URL. It has no effect on the bumping process itself or any of the TLS layer details. It may have an effect on HSTS since any headers the server might send are dropped by the 302 replacement. This way it doesn't have to monitor for a dstdomain, it watches for an IP. It wastes bandwidth sending a request to the server and fetching the reply. Given that the dst-IP address is what you have from the very first TCP packet onwards. About the only utility it has over http_access is that its positioning naturally restricts it to the decrypted traffic where the 302 will always work. But by that time you have the domain name from the encrypted HTTP message anyway. Amos ___ squid-users mailing list squid-users@lists.squid-cache.org http://lists.squid-cache.org/listinfo/squid-users
Re: [squid-users] Correct Syntax for ACL?
On 28/05/2015 8:18 a.m., Serge Fonville wrote: Hi, how does squid distinquish between a file containing rules e.g. acl acl-file url_regex -i /etc/url-acl.squid or the rule itself e.g. acl acl-rule url_regex -i \.exe$ with the same acl-type? From http://www.squid-cache.org/Doc/config/acl/ Every access list definition must begin with an aclname and acltype, followed by either type-specific arguments or a quoted filename that they are read from. Seems to suggest that using s means the argument is a file. Correct. Amos ___ squid-users mailing list squid-users@lists.squid-cache.org http://lists.squid-cache.org/listinfo/squid-users
