<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/4.6.6">
</HEAD>
<BODY>
On Sat, 2015-05-30 at 16:24 -0600, James Lay wrote:<BR>
<BLOCKQUOTE TYPE=CITE>
On Sun, 2015-05-31 at 08:45 +1200, Amos Jeffries wrote:
<BLOCKQUOTE TYPE=CITE>
<PRE>
On 31/05/2015 4:48 a.m., James Lay wrote:
<FONT COLOR="#737373">> Per the docs:</FONT>
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> # Conditional configuration</FONT>
<FONT COLOR="#737373">> #</FONT>
<FONT COLOR="#737373">> # If-statements can be used to make configuration directives</FONT>
<FONT COLOR="#737373">> # depend on conditions:</FONT>
<FONT COLOR="#737373">> #</FONT>
<FONT COLOR="#737373">> # if <CONDITION></FONT>
<FONT COLOR="#737373">> # ... regular configuration directives ...</FONT>
<FONT COLOR="#737373">> # [else</FONT>
<FONT COLOR="#737373">> # ... regular configuration directives ...]</FONT>
<FONT COLOR="#737373">> # endif</FONT>
<FONT COLOR="#737373">> #</FONT>
<FONT COLOR="#737373">> # The else part is optional. The keywords "if", "else", and</FONT>
<FONT COLOR="#737373">> "endif"</FONT>
<FONT COLOR="#737373">> # must be typed on their own lines, as if they were regular</FONT>
<FONT COLOR="#737373">> # configuration directives.</FONT>
<FONT COLOR="#737373">> #</FONT>
<FONT COLOR="#737373">> # NOTE: An else-if condition is not supported.</FONT>
<FONT COLOR="#737373">> #</FONT>
<FONT COLOR="#737373">> # These individual conditions types are supported:</FONT>
<FONT COLOR="#737373">> #</FONT>
<FONT COLOR="#737373">> # true</FONT>
<FONT COLOR="#737373">> # Always evaluates to true.</FONT>
<FONT COLOR="#737373">> # false</FONT>
<FONT COLOR="#737373">> # Always evaluates to false.</FONT>
<FONT COLOR="#737373">> # <integer> = <integer></FONT>
<FONT COLOR="#737373">> # Equality comparison of two integer numbers.</FONT>
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> Anyone have any examples, documentation, heck ANYTHING that can show how</FONT>
<FONT COLOR="#737373">> this works? I can't seem to find a thing besides the above.</FONT>
Those are for process controls (SMP, named services, etc).
<FONT COLOR="#737373">> My goal is</FONT>
<FONT COLOR="#737373">> something like the below:</FONT>
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> if port = 80</FONT>
<FONT COLOR="#737373">> http_access deny all</FONT>
<FONT COLOR="#737373">> else</FONT>
<FONT COLOR="#737373">> http_access allow all</FONT>
<FONT COLOR="#737373">> endif</FONT>
<FONT COLOR="#737373">> </FONT>
<FONT COLOR="#737373">> But nothing I'm trying as the condition expression is working. Thank</FONT>
<FONT COLOR="#737373">> you.</FONT>
The default Squid configuration should "just work"...
http_access deny !Safe_ports
http_access deny CONNECT !SSL_Ports
...
# this one permits the CONNECT *:443 requests to get bumped
http_access allow localnet
..
http_access deny all
If you are using any other access controls on your client traffic you
need to keep in mind that Squid is dealing with "CONNECT raw-IP:443 ..."
requests in http_access / adapted_http_access / url_rewrite_access /
adaptation_access / ssl_bump prior to bumping them.
Amos
_______________________________________________
squid-users mailing list
<A HREF="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</A>
<A HREF="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</A>
</PRE>
</BLOCKQUOTE>
<BR>
Hi again Amos,<BR>
<BR>
So...my method of access control might be weird. I have a regex list of sites that work fine via http (say \.acer\.com). So, I allow access to this list via:<BR>
<BR>
acl allowed_http_sites url_regex "/opt/etc/squid/http_url.txt<BR>
http_access allow allowed_http_sites<BR>
http_access deny !allowed_http_sites<BR>
<BR>
This works well for allowing access to the list of sites....the lack of http_access allow localnet makes this happen. With the above however, ssl_bumping stops working as I get:<BR>
<BR>
<TT>[16:18:22 jlay@powerbook:~/test$ wget --ca-certificate=/etc/ssl/certs/sslsplit_ca_cert.pem -d <A HREF="https://www.msn.com">https://www.msn.com</A></TT><BR>
<TT>DEBUG output created by Wget 1.16 on linux-gnu.</TT><BR>
<BR>
<TT>URI encoding = ‘UTF-8’</TT><BR>
<TT>--2015-05-30 16:19:46-- <A HREF="https://www.msn.com/">https://www.msn.com/</A></TT><BR>
<TT>Certificates loaded: 173</TT><BR>
<TT>Resolving <A HREF="http://www.msn.com">www.msn.com</A> (<A HREF="http://www.msn.com">www.msn.com</A>)... 204.79.197.203</TT><BR>
<TT>Caching <A HREF="http://www.msn.com">www.msn.com</A> => 204.79.197.203</TT><BR>
<TT>Connecting to <A HREF="http://www.msn.com">www.msn.com</A> (<A HREF="http://www.msn.com">www.msn.com</A>)|204.79.197.203|:443... connected.</TT><BR>
<TT>Created socket 4.</TT><BR>
<TT>Releasing 0x10c3ef98 (new refcount 1).</TT><BR>
<TT>The certificate's owner does not match hostname ‘<A HREF="http://www.msn.com">www.msn.com</A>’</TT><BR>
<BR>
<TT>May 30 16:19:46 analysis squid: 192.168.1.73 - - [30/May/2015:16:19:46 -0600] "CONNECT 204.79.197.203:443 HTTP/1.1" - 200 0 TCP_DENIED:HIER_NONE peek</TT><BR>
<BR>
Adding http_access alllow localnet makes ssl_bumping work correctly, but then the http_access deny !allowed_http_sites does not work. I'm having a hard time getting both http and https filtering to play well together with one instance of squid. I'd like to try and just go with one, but if I have to I'll go with two. Anyway thanks again for looking...I hope I'm explaining this well.<BR>
<BR>
James<BR>
<BR>
<PRE>
_______________________________________________
squid-users mailing list
<A HREF="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</A>
<A HREF="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</A>
</PRE>
</BLOCKQUOTE>
<BR>
Ok I think I got it...added:<BR>
<BR>
acl allow_https port 443<BR>
...<BR>
http_access allow allow_https<BR>
<BR>
Now my clients are allowed full port 443 access, which gets a decision of allow or block later on, and this also allows my "usual" http access list....woo hoo! I'll post the full info later. Thanks so much.<BR>
<BR>
James
</BODY>
</HTML>