Re: [squid-users] sslBump and intercept

2015-11-12 Thread Amos Jeffries
On 13/11/2015 1:04 a.m., Steve Hill wrote: > On 12/11/15 09:04, Eugene M. Zheganin wrote: > >> I decided to intercept the HTTPS traffic on my production squids from >> proxy-unware clients to be able to tell them there's a proxy and they >> should configure one. >> So I'm doing it like (the proces

Re: [squid-users] sslBump and intercept

2015-11-12 Thread Amos Jeffries
On 13/11/2015 3:00 a.m., Yuri Voinov wrote: > > Read carefully - this is not complete fix. Just dirty hack. And will not > guarantee fixed on _all_ platforms. That bug is only relevant to Solaris. It is a hack, but a hack that all non-Solaris OS have been using for several decades without issues

Re: [squid-users] sslBump and intercept

2015-11-12 Thread Yuri Voinov
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Read carefully - this is not complete fix. Just dirty hack. And will not guarantee fixed on _all_ platforms. 12.11.15 19:44, Eugene M. Zheganin пишет: > Hi, > > On 12.11.2015 17:48, Yuri Voinov wrote: > >> More probably this is bug >> http://bugs.

Re: [squid-users] sslBump and intercept

2015-11-12 Thread Eugene M. Zheganin
Hi, On 12.11.2015 17:48, Yuri Voinov wrote: > More probably this is bug > http://bugs.squid-cache.org/show_bug.cgi?id=4188. > Page said it's fixed, and applied to 3.5. If it's already in 3.5.11, then it's not it - I just tested 3.5.11, and the behavior is the same. Thanks. Eugene. __

Re: [squid-users] sslBump and intercept

2015-11-12 Thread Eugene M. Zheganin
Hi. On 12.11.2015 17:04, Steve Hill wrote: > > proxy_auth won't work on intercepted traffic and will therefore always > return false, so as far as I can see you're always going to peek and > then splice. i.e. you're never going to bump, so squid should never > be generating a forged certificate.

Re: [squid-users] sslBump and intercept

2015-11-12 Thread Yuri Voinov
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 More probably this is bug http://bugs.squid-cache.org/show_bug.cgi?id=4188. 12.11.15 18:04, Steve Hill пишет: > On 12/11/15 09:04, Eugene M. Zheganin wrote: > >> I decided to intercept the HTTPS traffic on my production squids from >> proxy-unware

Re: [squid-users] sslBump and intercept

2015-11-12 Thread Steve Hill
On 12/11/15 09:04, Eugene M. Zheganin wrote: I decided to intercept the HTTPS traffic on my production squids from proxy-unware clients to be able to tell them there's a proxy and they should configure one. So I'm doing it like (the process of forwarding using FreeBSD pf is not shown here): ===

[squid-users] sslBump and intercept

2015-11-12 Thread Eugene M. Zheganin
Hi. This question is unrelated directly to my yesterday's one. I decided to intercept the HTTPS traffic on my production squids from proxy-unware clients to be able to tell them there's a proxy and they should configure one. So I'm doing it like (the process of forwarding using FreeBSD pf is not