Re: [squid-users] Working peek/splice no longer functioning on some sites

2019-10-10 Thread Amos Jeffries
On 9/10/19 8:36 pm, torson wrote: > @Amos thank you for your detailed reply. It took me a while to get back to > this task, sorry. > I did some changes, added your suggestions, tested some more and here are my > results using Squid 4.8 with a couple of questions: > > A short summary of my setup: S

Re: [squid-users] Working peek/splice no longer functioning on some sites

2019-10-09 Thread torson
@Amos thank you for your detailed reply. It took me a while to get back to this task, sorry. I did some changes, added your suggestions, tested some more and here are my results using Squid 4.8 with a couple of questions: A short summary of my setup: Squid that does only intercept for all servers

Re: [squid-users] Working peek/splice no longer functioning on some sites

2019-09-01 Thread Amos Jeffries
On 2/09/19 8:44 am, torson wrote: > For me it works with "ssl_bump peek step1", not with "ssl_bump peek all". > That tells me that your clients are lying to your proxy. "peek step1" means only the client-provided detail is available. eg the client says it is going to example.net (a domain which

Re: [squid-users] Working peek/splice no longer functioning on some sites

2019-09-01 Thread torson
For me it works with "ssl_bump peek step1", not with "ssl_bump peek all". My working config using Squid 4.8: --- visible_hostname squid debug_options ALL,1 positive_dns_ttl 0 negative_dns_ttl 0 client_persistent_connections off http_port 3128 http_port 3129 intercept acl allowed_http_sites dstdom_

Re: [squid-users] Working peek/splice no longer functioning on some sites

2017-12-03 Thread Amos Jeffries
On 02/12/17 07:05, James Lay wrote: On 2017-11-29 07:29, Amos Jeffries wrote: On 28/11/17 03:50, James Lay wrote: On Sun, 2017-11-26 at 09:50 +0200, Alex K wrote: Perhaps an alternative is to peek only on step1: acl step1 at_step SslBump1 ssl_bump peek step1 acl allowed_https_sites ssl::serv

Re: [squid-users] Working peek/splice no longer functioning on some sites

2017-12-03 Thread James Lay
On 2017-11-29 07:29, Amos Jeffries wrote: On 28/11/17 03:50, James Lay wrote: On Sun, 2017-11-26 at 09:50 +0200, Alex K wrote: Perhaps an alternative is to peek only on step1: acl step1 at_step SslBump1 ssl_bump peek step1 acl allowed_https_sites ssl::server_name_regex "/opt/etc/squid/http_u

Re: [squid-users] Working peek/splice no longer functioning on some sites

2017-11-29 Thread Amos Jeffries
On 28/11/17 03:50, James Lay wrote: On Sun, 2017-11-26 at 09:50 +0200, Alex K wrote: Perhaps an alternative is to peek only on step1: acl step1 at_step SslBump1 ssl_bump peek step1 acl allowed_https_sites ssl::server_name_regex "/opt/etc/squid/http_url.txt" ssl_bump splice allowed_https_site

Re: [squid-users] Working peek/splice no longer functioning on some sites

2017-11-27 Thread James Lay
On Sun, 2017-11-26 at 09:50 +0200, Alex K wrote: > Perhaps an alternative is to peek only on step1: > > acl step1 at_step SslBump1 > > ssl_bump peek step1 > acl allowed_https_sites ssl::server_name_regex > "/opt/etc/squid/http_url.txt" > ssl_bump splice allowed_https_sites > ssl_bump terminate al

Re: [squid-users] Working peek/splice no longer functioning on some sites

2017-11-25 Thread Alex K
Perhaps an alternative is to peek only on step1: acl step1 at_step SslBump1 ssl_bump peek step1 acl allowed_https_sites ssl::server_name_regex "/opt/etc/squid/http_url.txt" ssl_bump splice allowed_https_sites ssl_bump terminate all On Nov 25, 2017 14:46, "James Lay" wrote: > On Sun, 2017-11-26

Re: [squid-users] Working peek/splice no longer functioning on some sites

2017-11-25 Thread James Lay
On Sun, 2017-11-26 at 01:33 +1300, Amos Jeffries wrote: > On 26/11/17 00:52, James Lay wrote: > > > > On Sat, 2017-11-25 at 23:48 +1300, Amos Jeffries wrote: > > > > > > On 25/11/17 08:30, James Lay wrote: > > > > > > > > Topic says it...this setup has been working well for a long > > > > time,

Re: [squid-users] Working peek/splice no longer functioning on some sites

2017-11-25 Thread Amos Jeffries
On 26/11/17 00:52, James Lay wrote: On Sat, 2017-11-25 at 23:48 +1300, Amos Jeffries wrote: On 25/11/17 08:30, James Lay wrote: Topic says it...this setup has been working well for a long time, but now there are some sites that are failing the TLS handshake.  Here's my setup: acl localnet src

Re: [squid-users] Working peek/splice no longer functioning on some sites

2017-11-25 Thread James Lay
On Sat, 2017-11-25 at 23:48 +1300, Amos Jeffries wrote: > On 25/11/17 08:30, James Lay wrote: > > > > Topic says it...this setup has been working well for a long time, > > but  > > now there are some sites that are failing the TLS handshake. > >  Here's my  > > setup: > > > > acl localnet src 192

Re: [squid-users] Working peek/splice no longer functioning on some sites

2017-11-25 Thread Amos Jeffries
On 25/11/17 08:30, James Lay wrote: Topic says it...this setup has been working well for a long time, but now there are some sites that are failing the TLS handshake.  Here's my setup: acl localnet src 192.168.1.0/24 acl SSL_ports port 443 acl Safe_ports port 80 acl Safe_ports port 443 acl CON

Re: [squid-users] Working peek/splice no longer functioning on some sites

2017-11-24 Thread James Lay
I should add this is squid-3.5.27.  Thank you. On Fri, 2017-11-24 at 12:30 -0700, James wrote: > Topic says it...this setup has been working well for a long time, but > now there are some sites that are failing the TLS handshake.  Here's > my setup: > > acl localnet src 192.168.1.0/24 > acl SSL_po

[squid-users] Working peek/splice no longer functioning on some sites

2017-11-24 Thread James Lay
Topic says it...this setup has been working well for a long time, but now there are some sites that are failing the TLS handshake.  Here's my setup: acl localnet src 192.168.1.0/24 acl SSL_ports port 443 acl Safe_ports port 80 acl Safe_ports port 443 acl CONNECT method CONNECT acl allowed_http_sit