Re: [squid-users] Squid, Kerberos and FireFox (Was: Re: leaking memory in squid 3.4.8 and 3.4.7.)

2014-10-18 Thread Eugene M. Zheganin
Hi. On 18.10.2014 16:11, Victor Sudakov wrote: I thought as much. This error seems suspicious. But why does a second request not cause the same error? No idea. We have tried both ways (enabling all ciphers and enabling only arcfour-hmac-md5), but it made no difference. Currently we are using t

[squid-users] Negotiate bug in squidclient ?

2014-10-18 Thread Victor Sudakov
This time I tried squidclient to check Kerberos authentication. I am afraid there is a bug in squidclient where the "Proxy-Authorization:" header (the Negotiate token) is being sent truncated, and the server reacts with the 'gss_accept_sec_context() failed: A token was invalid.' error. Here is wh

Re: [squid-users] Squid, Kerberos and FireFox (Was: Re: leaking memory in squid 3.4.8 and 3.4.7.)

2014-10-18 Thread Victor Sudakov
Eugene M. Zheganin wrote: > > > > I am attaching a traffic dump. > > > > Please look at Frame No. 36, where a ticket is requested for > > "HTTP/proxy.sibptus.transneft.ru", and then at Frame No. 39, where > > the ticket is granted, but for the wrong principal name. > > > The thing is, valid exchang

[squid-users] windowsupdate and ssl_bump

2014-10-18 Thread Josep Borrell
Hi, We are using a 3.4.8 squid Proxy in intercept mode via wccp. Squid intercepts HTTP and HTTPS via ssl_bump. All is working fine except that Windows Machines can't do a Windows Update. It is not working at all giving an error 80072F8F with HTTPS redirection disabled all work fine. Someone know

Re: [squid-users] website search broken

2014-10-18 Thread Visolve Squid
Hi, Now the URL "/cgi-bin/swish-query.cgi " was able to reach. Please, check it "_http://www.squid-cache.org/cgi-bin/swish-query.cgi_"; Regards, ViSolve Squid On 10/17/2014 8:12 AM, James Harper wrote: Doing a search on the main squid page gives me this: The requested URL /cgi-bin/swish-quer

Re: [squid-users] HTTPS Filtering by Certificate Subject Name

2014-10-18 Thread James Harper
> > It looks like this question has come up before, but I'm hoping to get some > further details on it. > > I've used a couple of firewalls (Watchguard & Fortigate) that allow me to do a > level of HTTPS site filtering without decryption. I believe that it works by > requesting and examining the