[squid-users] allow request to cloudfront after 302 redirection.
rousskov at measurement-factory.com
Wed Apr 21 17:48:37 UTC 2021
On 4/21/21 12:48 PM, Miroslaw Malinowski wrote:
> Is it possible to create a whitelist that allows cloudfront 302
> redirections, e.g. gitlab is using cloudfront as CDN and when we
> whitelist package.gitlab.com the URL is redirected (302) to
Yes, it is possible to allow future requests to Location-listed URLs,
but since we are talking about two (or more) independent HTTP
transactions, on two (or more) TCP connections, you will need to store
the allowed Location values (at least) somewhere, maintain that storage
(e.g., remove stale entries), and (optionally) determine whether the
request for an allowed cloudfront URL came from the same user agent as
the gitlab request that was redirected to that URL.
Storing, maintenance, and checking of allowed Locations/etc. can be done
using external ACLs and/or eCAP/ICAP adaptation services. It cannot be
reliably done using built-in ACLs alone AFAICT.
> I could whitelist a whole .cloudfront.net <http://cloudfront.net> domain
> or url_regex, but what I would like to achieve, I don't know if
> possible, is a chain of events like:
> If packages.gitlab.com <http://packages.gitlab.com> return 302 Location
> .cloudfront, then allow
> I've been playing around with http_reply_access and rep_headers, but I
> can only go as far as allow replay of the first request to
> package.gitlab.com <http://package.gitlab.com>, but then a GET to
> cloudfront is blocked anyway as it's not on our whitelist.
> 1619022938.916 423 172.16.230.237 NONE/200 0 CONNECT 184.108.40.206:443
> <http://220.127.116.11:443> - ORIGINAL_DST/18.104.22.168
> <http://22.214.171.124> -
> 1619022939.074 153 172.16.230.237 TCP_MISS/302 758 GET
> - ORIGINAL_DST/126.96.36.199 <http://188.8.131.52> text/html
> 1619022939.108 20 172.16.230.237 NONE/200 0 CONNECT 184.108.40.206:443
> <http://220.127.116.11:443> - ORIGINAL_DST/18.104.22.168 <http://22.214.171.124> -
> 1619022939.114 2 172.16.230.237 TCP_DENIED/403 19053 GET
> https://d20rj4el6vkp4c.cloudfront.net/7/11/ubuntu/package_files/35938.deb <https://d20rj4el6vkp4c.cloudfront.net/7/11/ubuntu/package_files/35938.deb>?
> - HIER_NONE/- text/html
More information about the squid-users