[squid-users] cache object with vary

2016-08-27 Thread joe
is this bug or its made to work like that lets say we have object in cache name 00A5 url.com/some.js vary=accept-encoding="gzip" if some browser get the same object url.com/some.js vary=accept-encoding="deflate" the md5 key wont match and it delete the old cached object with

Re: [squid-users] TCP_RESET non http requests on port 80

2016-08-27 Thread Alex Rousskov
On 08/27/2016 05:44 AM, Omid Kosari wrote: > Alex Rousskov wrote >> I recommend starting with something like this: >> >> http_reply_access deny all >> deny_info TCP_RESET all >> >> Does that reset all connections to Squid (after Squid fetches the reply)? > > Thanks for reply . > > As i

Re: [squid-users] Skype+intercept+ssl_bump

2016-08-27 Thread Marcus Kool
On 07/30/2016 04:21 PM, Alex Rousskov wrote: *snip* Update: The question still stands, but we now know more about what happens if the on_unsupported_protocol bug (in code and/or documentation, depending on how you look at it) discussed above is fixed: Squid then starts tunneling traffic as it

[squid-users] Trouble negotiate_kerberos_auth

2016-08-27 Thread Marcio Demetrio Bacci
I have trouble to authenticate Squid3 with kerberos in Samba4 domain. I'm using CentOS 7 and Squid 3.3.8 (yum install squid) When I type the bellow command in terminal: /usr/lib64/squid/negotiate_kerberos_auth -d -i -s HTTP/ proxy.cms.ensino...@cms.ensino.br john xyz@12345 I have the following

Re: [squid-users] ext_kerberos_ldap_group_acl problem ( 2 minorbugsmaybe )

2016-08-27 Thread Markus Moeller
Hi, I would say they are bugs. The first “issue” is as you say more about understanding the difference between UPN and SPN and how the tools use them. The helper tries to “authenticate” squid to AD as a user with the found SPN name, so the UPN must be the same as the SPN. There is no easy

Re: [squid-users] ext_kerberos_ldap_group_acl problem

2016-08-27 Thread Markus Moeller
Hi Louis, I made lately a change in how the SSL certifcate verification is done. Did you use the latest version from trunk ? Also set the variable TLS_CACERTFILE in your startup script (e.g. export TLS_CACERTFILE=/etc/mydir/cas.pem ). I do not read any ldap.conf file for this yet.

Re: [squid-users] TCP_RESET non http requests on port 80

2016-08-27 Thread Omid Kosari
Alex Rousskov wrote > I recommend starting with something like this: > > http_reply_access deny all > deny_info TCP_RESET all > > Does that reset all connections to Squid (after Squid fetches the reply)? Thanks for reply . As i mention before the deny_info works in other configs for