Re: [squid-users] Validation of IP address for SSL spliced connections

2024-05-30 Thread Alex Rousskov
On 2024-05-30 02:30, Rik Theys wrote: On 5/29/24 11:31 PM, Alex Rousskov wrote: On 2024-05-29 17:06, Rik Theys wrote: On 5/29/24 5:29 PM, Alex Rousskov wrote: On 2024-05-29 05:01, Rik Theys wrote: squid doesn't seem to validate that the IP address we're connecting to is valid for the specifie

Re: [squid-users] Validation of IP address for SSL spliced connections

2024-05-30 Thread Amos Jeffries
On 30/05/24 18:30, Rik Theys wrote: Hi, On 5/29/24 11:31 PM, Alex Rousskov wrote: On 2024-05-29 17:06, Rik Theys wrote: On 5/29/24 5:29 PM, Alex Rousskov wrote: On 2024-05-29 05:01, Rik Theys wrote: squid doesn't seem to validate that the IP address we're connecting to is valid for the sp

Re: [squid-users] Validation of IP address for SSL spliced connections

2024-05-29 Thread Rik Theys
Hi, On 5/29/24 11:31 PM, Alex Rousskov wrote: On 2024-05-29 17:06, Rik Theys wrote: On 5/29/24 5:29 PM, Alex Rousskov wrote: On 2024-05-29 05:01, Rik Theys wrote: squid doesn't seem to validate that the IP address we're connecting to is valid for the specified name in the SNI header? Tha

Re: [squid-users] Validation of IP address for SSL spliced connections

2024-05-29 Thread Alex Rousskov
On 2024-05-29 17:06, Rik Theys wrote: On 5/29/24 5:29 PM, Alex Rousskov wrote: On 2024-05-29 05:01, Rik Theys wrote: acl allowed_clients src "/etc/squid/allowed_clients" acl allowed_domains dstdomain "/etc/squid/allowed_domains" http_access allow allowed_clients allowed_domains http_access a

Re: [squid-users] Validation of IP address for SSL spliced connections

2024-05-29 Thread Rik Theys
Hi, On 5/29/24 5:29 PM, Alex Rousskov wrote: On 2024-05-29 05:01, Rik Theys wrote: acl allowed_clients src "/etc/squid/allowed_clients" acl allowed_domains dstdomain "/etc/squid/allowed_domains" http_access allow allowed_clients allowed_domains http_access allow allowed_clients CONNECT http_

Re: [squid-users] Validation of IP address for SSL spliced connections

2024-05-29 Thread Alex Rousskov
On 2024-05-29 05:01, Rik Theys wrote: acl allowed_clients src "/etc/squid/allowed_clients" acl allowed_domains dstdomain "/etc/squid/allowed_domains" http_access allow allowed_clients allowed_domains http_access allow allowed_clients CONNECT http_access deny all Please note that the second h

[squid-users] Validation of IP address for SSL spliced connections

2024-05-29 Thread Rik Theys
Hi, I'm configuring squid as a transparent proxy where local outbound traffic is redirect to a local squid process using tproxy. I would like to limit the domains the host can contact by having an allow list. I have the following config file: -- acl allowed_clients src "/etc/squid/allo