-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
Does anyone know - is it possible to send the connection, starting with
the CONNECT, to cache-peer?
I'll try to explain.
I need to send some sites, defined by ACL, connections with starts with
CONNECT (443 port), to the cache_peer first? Rather t
On 15.09.15 22:45, Yuri Voinov wrote:
Does anyone know - is it possible to send the connection, starting with
the CONNECT, to cache-peer?
cache_peer_access with proper ACLs should do that.
note that always_direct can avoid it.
I need to send some sites, defined by ACL, connections with starts
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
Is it possible to specifically - how exactly it is necessary to write
the configuration? The fact is that any variations on a similar theme
cause assertion.
15.09.15 23:17, Matus UHLAR - fantomas пишет:
> On 15.09.15 22:45, Yuri Voinov wrote:
>> D
On 15.09.15 23:27, Yuri Voinov wrote:
Is it possible to specifically - how exactly it is necessary to write
the configuration? The fact is that any variations on a similar theme
cause assertion.
just combine it with proper acl of type dst or dstdomain...
15.09.15 23:17, Matus UHLAR - fantomas
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
Squid working in transparent SSL Bump mode.
AFAIK, here is SSL decrypts. AFAIK, decrypted tunnel denied to be
forwarded to parent.
I need to forward some URLs without decryption to peer. Whole session
starting with CONNECT.
Problem: Peer must ac
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
There is no answer.
15.09.15 23:31, Matus UHLAR - fantomas пишет:
> On 15.09.15 23:27, Yuri Voinov wrote:
>> Is it possible to specifically - how exactly it is necessary to write
>> the configuration? The fact is that any variations on a similar t
On 15.09.15 22:45, Yuri Voinov wrote:
Does anyone know - is it possible to send the connection, starting with
the CONNECT, to cache-peer?
15.09.15 23:17, Matus UHLAR - fantomas пишет:
cache_peer_access with proper ACLs should do that.
note that always_direct can avoid it.
On 15.09.15 23:27
On 15.09.15 22:45, Yuri Voinov wrote:
Does anyone know - is it possible to send the connection, starting with
the CONNECT, to cache-peer?
15.09.15 23:17, Matus UHLAR - fantomas пишет:
cache_peer_access with proper ACLs should do that.
note that always_direct can avoid it.
On 15.09.15 23:33,
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
I asked a specific question. How does Squid as a whole - I am well
aware. Before asking a question - I tried everything I seemed right. And
I asked, hoping to get a specific answer or intelligible explanation,
not the common words and sentences to
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
I want to get the answer the people who did it. And not those that
suggest that they could do it.
15.09.15 23:42, Matus UHLAR - fantomas пишет:
>>> On 15.09.15 22:45, Yuri Voinov wrote:
Does anyone know - is it possible to send the connection
On Tuesday 15 September 2015 at 19:45:05, Yuri Voinov wrote:
> I want to get the answer the people who did it. And not those that
> suggest that they could do it.
I have a suggestion which I hope may help - show us a configuration you have
tried, following the documentation, and tell us in what
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
Hi Antony,
thank your for answer.
My problem is a bit specific.
I have some permanently ISP-banned sites. I need to pass-through it from
transparent interception Squid to cache_peer - both plain HTTP and HTTPS
tunnels without decryption. Sites d
On 15.09.15 23:42, Yuri Voinov wrote:
I asked a specific question. How does Squid as a whole - I am well
aware. Before asking a question - I tried everything I seemed right. And
I asked, hoping to get a specific answer or intelligible explanation,
not the common words and sentences to read the ma
Here is my testing config from test system. This is original
configuration, which is works well with HTTP but not with HTTPS.
I've tried to permit CONNECT access to cache_peer, config cache_peer as
ssl, splice forwarded URL's... without any result.
When I've turned URL into cache_peer -
access.lo
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
This:
http://osdir.com/ml/web.squid.general/2003-04/msg00800.html
does not work.
16.09.15 0:15, Matus UHLAR - fantomas пишет:
> On 15.09.15 23:42, Yuri Voinov wrote:
>> I asked a specific question. How does Squid as a whole - I am well
>> aware.
On 17/09/2015 3:18 a.m., Yuri Voinov wrote:
>
> This:
>
> http://osdir.com/ml/web.squid.general/2003-04/msg00800.html
>
> does not work.
Do you have always_direct rules that match the request(s)?
or "nonhierarchical_direct on" ?
The order of invocation is:
nonhierarchical_direct (on means d
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
Sure.
I've tried all possible combinations.
Including this:
# SSL bump rules
sslproxy_cert_error allow all
acl DiscoverSNIHost at_step SslBump1
ssl_bump peek DiscoverSNIHost
acl NoSSLIntercept ssl::server_name_regex -i localhost \.icq\.*
ssl_bump
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
16.09.15 21:34, Amos Jeffries пишет:
> On 17/09/2015 3:18 a.m., Yuri Voinov wrote:
>>
>> This:
>>
>> http://osdir.com/ml/web.squid.general/2003-04/msg00800.html
>>
>> does not work.
>
> Do you have always_direct rules that match the request(s)?
I
On 17/09/2015 3:42 a.m., Yuri Voinov wrote:
>
> Sure.
>
> I've tried all possible combinations.
> Including this:
>
> # SSL bump rules
> sslproxy_cert_error allow all
> acl DiscoverSNIHost at_step SslBump1
> ssl_bump peek DiscoverSNIHost
> acl NoSSLIntercept ssl::server_name_regex -i localhost \
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
Hm.
If I understand correctly, the right configuration must be:
# Privoxy+Tor access rules
never_direct allow CONNECT
never_direct allow tor_url
# Local Privoxy is cache parent
cache_peer 127.0.0.1 parent 8118 0 no-query no-digest default
cache
On 17/09/2015 4:36 a.m., Yuri Voinov wrote:
>
> Hm.
>
> If I understand correctly, the right configuration must be:
>
> # Privoxy+Tor access rules
> never_direct allow CONNECT
> never_direct allow tor_url
>
> # Local Privoxy is cache parent
> cache_peer 127.0.0.1 parent 8118 0 no-query no-diges
17.09.15 10:50, Amos Jeffries пишет:
On 17/09/2015 4:36 a.m., Yuri Voinov wrote:
Hm.
If I understand correctly, the right configuration must be:
# Privoxy+Tor access rules
never_direct allow CONNECT
never_direct allow tor_url
# Local Privoxy is cache parent
cache_peer 127.0.0.1 parent 8118
If I disable SSL bump for tunneled sites, I've got an error SSL:
ssl_error_rx_record_too_long
17.09.15 10:50, Amos Jeffries пишет:
On 17/09/2015 4:36 a.m., Yuri Voinov wrote:
Hm.
If I understand correctly, the right configuration must be:
# Privoxy+Tor access rules
never_direct allow CONNECT
On 17/09/2015 7:57 p.m., Yuri Voinov wrote:
>
>
> 17.09.15 10:50, Amos Jeffries пишет:
>> On 17/09/2015 4:36 a.m., Yuri Voinov wrote:
>>> Hm.
>>>
>>> If I understand correctly, the right configuration must be:
>>>
>>> # Privoxy+Tor access rules
>>> never_direct allow CONNECT
>>> never_direct allo
17.09.15 16:18, Amos Jeffries пишет:
On 17/09/2015 7:57 p.m., Yuri Voinov wrote:
17.09.15 10:50, Amos Jeffries пишет:
On 17/09/2015 4:36 a.m., Yuri Voinov wrote:
Hm.
If I understand correctly, the right configuration must be:
# Privoxy+Tor access rules
never_direct allow CONNECT
never_dir
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
On Squid 3.5.7 the same result:
1442420915.874 207879 127.0.0.1 TAG_NONE/200 0 CONNECT
torproject.org:443 - HIER_DIRECT/2001:41b8:202:deb:213:21ff:fe20:1426 -
1442493956.863 168528 127.0.0.1 TAG_NONE/200 0 CONNECT
torproject.org:443 - HIER_DIRECT/
from earlier e-mail:
acl tor_url url_regex "C:/Squid/etc/squid/url.tor"
On 17.09.15 18:47, Yuri Voinov wrote:
acl NoSSLIntercept ssl::server_name_regex -i localhost \.icq\.* kaspi\.kz
ssl_bump splice NoSSLIntercept
# Privoxy+Tor access rules
never_direct allow tor_url
cache_peer_access
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
18.09.15 21:22, Matus UHLAR - fantomas пишет:
> from earlier e-mail:
>
>> acl tor_url url_regex "C:/Squid/etc/squid/url.tor"
>
> On 17.09.15 18:47, Yuri Voinov wrote:
>> acl NoSSLIntercept ssl::server_name_regex -i localhost \.icq\.* kaspi\.kz
>>
On 19/09/2015 4:48 a.m., Yuri Voinov wrote:
>
> 18.09.15 21:22, Matus UHLAR - fantomas пишет:
>> from earlier e-mail:
>
>>> acl tor_url url_regex "C:/Squid/etc/squid/url.tor"
>
>> On 17.09.15 18:47, Yuri Voinov wrote:
>>> acl NoSSLIntercept ssl::server_name_regex -i localhost \.icq\.* kaspi\.kz
On 17/09/2015 10:07 p.m., Yuri Voinov wrote:
> If I disable SSL bump for tunneled sites, I've got an error SSL:
>
> ssl_error_rx_record_too_long
>
If you "disabled" ssl_bump by removing its config, or using "ssl_bump
none" for that traffic then the error is strictly a problem between the
client
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
Can't understand, why it is not work.
Tor Browser works ok itself.
The similar config via Squid 3.5.7+Privoxy - don't.
CONNECT to torproject.org:443 goes directly, whenever config changes.
21.09.15 23:56, Amos Jeffries пишет:
> On 17/09/2015 10
On 22/09/2015 6:00 a.m., Yuri Voinov wrote:
>
> Can't understand, why it is not work.
>
> Tor Browser works ok itself.
>
> The similar config via Squid 3.5.7+Privoxy - don't.
>
> CONNECT to torproject.org:443 goes directly, whenever config changes.
I suspect some detail is being removed during
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
This is dig result:
;; ANSWER SECTION:
torproject.org. 3600IN A 93.95.227.222
torproject.org. 3600IN A 154.35.132.70
torproject.org. 3600IN A 86.59.30.40
torproject.org.
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
The torproject.org is just an example.
This is not so important like, for example, google docs, google mail,
google drive (all web interface at minimum), archive.org.
All of this uses HSTS now and, if banned by IP by ISP (note: dns is not
spoofed
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
I'm in a coffin seen all purulent politics.
But when suddenly my customers lose access to their documents on Google
documents - I pick up instruments. And I want them to work. At the same
time, I can not put everything and everyone Tor Browser.
A
On 22/09/2015 6:25 a.m., Yuri Voinov wrote:
>
> This is dig result:
>
> ;; ANSWER SECTION:
> torproject.org. 3600IN A 93.95.227.222
> torproject.org. 3600IN A 154.35.132.70
> torproject.org. 3600IN A 86.59.30.40
> torproject.org
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
22.09.15 1:15, Amos Jeffries пишет:
> On 22/09/2015 6:25 a.m., Yuri Voinov wrote:
>>
>> This is dig result:
>>
>> ;; ANSWER SECTION:
>> torproject.org. 3600IN A 93.95.227.222
>> torproject.org. 3600IN A
On Monday 21 September 2015 at 21:20:19, Yuri Voinov wrote:
> 22.09.15 1:15, Amos Jeffries пишет:
>
> > HSTS is opt-out. Strip the *response* header on the first contact and it
> > disappears.
>
> I can't. Because first connection can't occur during ISP ban by IP.
> First contact is never occurs.
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
22.09.15 1:23, Antony Stone пишет:
> On Monday 21 September 2015 at 21:20:19, Yuri Voinov wrote:
>
>> 22.09.15 1:15, Amos Jeffries пишет:
>>
>>> HSTS is opt-out. Strip the *response* header on the first contact and it
>>> disappears.
>>
>> I can'
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
Here is access log when using IE:
1442863815.068785 127.0.0.1 TCP_MISS/302 506 GET
http://torproject.org/ - FIRSTUP_PARENT/127.0.0.1 text/html
1442863816.542 105231 127.0.0.1 TAG_NONE/200 0 CONNECT
www.torproject.org:443 - HIER_DIRECT/2001:41b
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
Finally it ends up by this one:
http://i.imgur.com/izWY1cc.png
Antony, how it can be explained? ;)
22.09.15 1:23, Antony Stone пишет:
> On Monday 21 September 2015 at 21:20:19, Yuri Voinov wrote:
>
>> 22.09.15 1:15, Amos Jeffries пишет:
>>
>>> H
On 22/09/2015 7:33 a.m., Yuri Voinov wrote:
>
> Here is access log when using IE:
>
> 1442863815.068785 127.0.0.1 TCP_MISS/302 506 GET
> http://torproject.org/ - FIRSTUP_PARENT/127.0.0.1 text/html
> 1442863816.542 105231 127.0.0.1 TAG_NONE/200 0 CONNECT
> www.torproject.org:443 - HIER_DIRECT/
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
- -
CONNECT www.torproject.org:443 HTTP/1.1
Host: www.torproject.org
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/45.0.2454.93 Safari/537.36
- --
2
On 23/09/2015 3:56 a.m., Yuri Voinov wrote:
>
> -
> CONNECT www.torproject.org:443 HTTP/1.1
> Host: www.torproject.org
> Proxy-Connection: keep-alive
> User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36
> (KHTML, like Gecko) Chrome/45.0.2454.93 Safari/537.36
>
>
> --
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
- -
CONNECT torproject.org:443 HTTP/1.1
Host: torproject.org
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/45.0.2454.93 Safari/537.36
- --
2015/09/2
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
Ooops. After timed out:
- -
CONNECT torproject.org:443 HTTP/1.1
Host: torproject.org
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/45.0.2454.93 Safari/537.3
On 23/09/2015 4:39 a.m., Yuri Voinov wrote:
>
> Ooops. After timed out:
>
> -
> CONNECT torproject.org:443 HTTP/1.1
> Host: torproject.org
> Proxy-Connection: keep-alive
> User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36
> (KHTML, like Gecko) Chrome/45.0.2454.93 Sa
Look:
# Tor acl
acl tor_url url_regex -i "/usr/local/squid/etc/url.tor"
url.tor contains:
^https?.*torproject.*
May be, I'm an idiot, but where is the error?
All other url.tor entries works perfectly. WIth HTTP only.
23.09.15 7:44, Amos Jeffries пишет:
On 23/09/2015 4:39 a.m., Yuri Voinov wr
Hello,
On 17.09.15 18:47, Yuri Voinov wrote:
acl NoSSLIntercept ssl::server_name_regex -i localhost \.icq\.* kaspi\.kz
ssl_bump splice NoSSLIntercept
# Privoxy+Tor access rules
never_direct allow tor_url
cache_peer_access 127.0.0.1 allow tor_url
18.09.15 21:22, Matus UHLAR - fantomas п
23.09.15 17:07, Matus UHLAR - fantomas пишет:
Hello,
On 17.09.15 18:47, Yuri Voinov wrote:
acl NoSSLIntercept ssl::server_name_regex -i localhost \.icq\.*
kaspi\.kz
ssl_bump splice NoSSLIntercept
# Privoxy+Tor access rules
never_direct allow tor_url
cache_peer_access 127.0.0.1 allow t
On 23/09/2015 11:01 p.m., Yuri Voinov wrote:
> Look:
>
> # Tor acl
> acl tor_url url_regex -i "/usr/local/squid/etc/url.tor"
>
> url.tor contains:
> ^https?.*torproject.*
>
> May be, I'm an idiot, but where is the error?
The URL on the CONNECT requests ("torproject.om:443") are not starting
wit
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
Through assertion and then restarts squid:
2015/09/23 20:03:25 kid1| Validated 35899 Entries
2015/09/23 20:03:25 kid1| store_swap_size = 1730768.00 KB
2015/09/23 20:03:26 kid1| storeLateRelease: released 0 objects
2015/09/23 20:03:26 kid1| ass
On 24/09/2015 2:04 a.m., Yuri Voinov wrote:
>
> Through assertion and then restarts squid:
>
> 2015/09/23 20:03:25 kid1| Validated 35899 Entries
> 2015/09/23 20:03:25 kid1| store_swap_size = 1730768.00 KB
> 2015/09/23 20:03:26 kid1| storeLateRelease: released 0 objects
> 2015/09/23 20:03:26 k
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
24.09.15 7:12, Amos Jeffries пишет:
> On 24/09/2015 2:04 a.m., Yuri Voinov wrote:
>>
>> Through assertion and then restarts squid:
>>
>> 2015/09/23 20:03:25 kid1| Validated 35899 Entries
>> 2015/09/23 20:03:25 kid1| store_swap_size = 1730768.
On 25/09/2015 2:13 a.m., Yuri Voinov wrote:
>
> 24.09.15 7:12, Amos Jeffries пишет:
>> On 24/09/2015 2:04 a.m., Yuri Voinov wrote:
>>>
>>> Through assertion and then restarts squid:
>>>
>>> 2015/09/23 20:03:25 kid1| Validated 35899 Entries
>>> 2015/09/23 20:03:25 kid1| store_swap_size = 173076
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
Aha. Good news. This is something already.
25.09.15 1:57, Amos Jeffries пишет:
> On 25/09/2015 2:13 a.m., Yuri Voinov wrote:
>>
>> 24.09.15 7:12, Amos Jeffries пишет:
>>> On 24/09/2015 2:04 a.m., Yuri Voinov wrote:
Through assertion and
56 matches
Mail list logo
