<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="font-family: Monospace;">
<div>
<div style="color: rgb(0, 0, 0);"><font face="monospace">Hi Alex,</font></div>
<div style="color: rgb(0, 0, 0);"><font face="monospace"><br>
</font></div>
<div style="color: rgb(0, 0, 0);"><font face="monospace">okay, I think I understand a little more.</font></div>
<div style="color: rgb(0, 0, 0);"><font face="monospace"><br>
</font></div>
<div style="color: rgb(0, 0, 0);"><font face="monospace">I am trying to get the old server-first method working with new peek and splice but without success.</font></div>
<div style="color: rgb(0, 0, 0);"><font face="monospace"><br>
</font></div>
<div style="color: rgb(0, 0, 0);"><font face="monospace">I have built a RPM package with latest 3.5.11 source based on </font><a href="http://www1.ngtech.co.il/repo/centos/6/SRPMS/squid-3.5.9-1.el6.src.rpm">http://www1.ngtech.co.il/repo/centos/6/SRPMS/squid-3.5.9-1.el6.src.rpm</a></div>
<div style="color: rgb(0, 0, 0);">Squid is configured with SSL bump similar to the configuration suggested by Sebastian.</div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);">In my view it's a good idea to give a detailed description of my setup with real IPs and hostnames:</div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);">1. Client machine</div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);">OS: CentOS 6.6 x86_64</div>
<div style="color: rgb(0, 0, 0);">IP: 10.0.0.2/24 (internal network)</div>
<div style="color: rgb(0, 0, 0);">Default Gateway: 10.0.0.1 (= Squid machine)</div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);">2. Squid machine</div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);">OS: CentOS 6.6 x86_64</div>
<div style="color: rgb(0, 0, 0);">IP 1: 10.0.0.1/24 (internal network)</div>
<div style="color: rgb(0, 0, 0);">IP 2: 172.31.1.15/24 (outgoing interface, behind a router)</div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);"># iptables -L -n -t nat</div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">Chain PREROUTING (policy ACCEPT)</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">target prot opt source destination </font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">DNAT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 to:10.0.0.1:3129</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">DNAT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 to:10.0.0.1:3443</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"><br>
</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">Chain POSTROUTING (policy ACCEPT)</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">target prot opt source destination </font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">MASQUERADE all -- 0.0.0.0/0 0.0.0.0/0 </font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"><br>
</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">Chain OUTPUT (policy ACCEPT)</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">target prot opt source destination </font> </div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);"># squid -v</div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">Squid Cache: Version 3.5.11</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">Service Name: squid</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">configure options: '--build=x86_64-redhat-linux-gnu' '--host=x86_64-redhat-linux-gnu' '--target=x86_64-redhat-linux-gnu' '--program-prefix=' '--prefix=/usr' '--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin'
'--sysconfdir=/etc' '--datadir=/usr/share' '--includedir=/usr/include' '--libdir=/usr/lib64' '--libexecdir=/usr/libexec' '--sharedstatedir=/var/lib' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--exec_prefix=/usr' '--libexecdir=/usr/lib64/squid'
'--localstatedir=/var' '--datadir=/usr/share/squid' '--sysconfdir=/etc/squid' '--with-logdir=$(localstatedir)/log/squid' '--with-pidfile=$(localstatedir)/run/squid.pid' '--disable-dependency-tracking' '--enable-follow-x-forwarded-for' '--enable-auth' '--enable-auth-basic=DB,LDAP,NCSA,NIS,PAM,POP3,RADIUS,SASL,SMB,getpwnam'
'--enable-auth-ntlm=smb_lm,fake' '--enable-auth-digest=file,LDAP' '--enable-auth-negotiate=kerberos,wrapper' '--enable-external-acl-helpers=wbinfo_group,kerberos_ldap_group' '--enable-cache-digests' '--enable-cachemgr-hostname=localhost' '--enable-delay-pools'
'--enable-epoll' '--enable-icap-client' '--enable-ident-lookups' '--enable-linux-netfilter' '--enable-removal-policies=heap,lru' '--enable-snmp' '--enable-storeio=aufs,diskd,ufs,rock' '--enable-wccpv2' '--enable-esi' '--enable-ssl-crtd' '--enable-icmp' '--with-aio'
'--with-default-user=squid' '--with-filedescriptors=16384' '--with-dl' '--with-openssl' '--with-pthreads' '--with-included-ltdl' '--disable-arch-native' '--without-nettle' 'build_alias=x86_64-redhat-linux-gnu' 'host_alias=x86_64-redhat-linux-gnu' 'target_alias=x86_64-redhat-linux-gnu'
'CFLAGS=-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic' 'CXXFLAGS=-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic
-fPIC' 'PKG_CONFIG_PATH=/usr/lib64/pkgconfig:/usr/share/pkgconfig' --enable-ltdl-convenience</font></div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);"># Squid configruation file</div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"># Rules allowing access from your local networks</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">acl localnet src 10.0.0.0/8<span class="Apple-tab-span" style="white-space: pre;">
</span># RFC1918 possible internal network</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">acl localnet src 172.16.0.0/12<span class="Apple-tab-span" style="white-space: pre;">
</span># RFC1918 possible internal network</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">acl localnet src 192.168.0.0/16<span class="Apple-tab-span" style="white-space: pre;">
</span># RFC1918 possible internal network</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">acl localnet src fc00::/7 # RFC 4193 local private network range</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">acl SSL_ports port 443</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">acl Safe_ports port 80<span class="Apple-tab-span" style="white-space: pre;">
</span><span class="Apple-tab-span" style="white-space: pre;"></span># http</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">acl Safe_ports port 21<span class="Apple-tab-span" style="white-space: pre;">
</span><span class="Apple-tab-span" style="white-space: pre;"></span># ftp</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">acl Safe_ports port 443<span class="Apple-tab-span" style="white-space: pre;">
</span><span class="Apple-tab-span" style="white-space: pre;"></span># https</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">acl Safe_ports port 70<span class="Apple-tab-span" style="white-space: pre;">
</span><span class="Apple-tab-span" style="white-space: pre;"></span># gopher</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">acl Safe_ports port 210<span class="Apple-tab-span" style="white-space: pre;">
</span><span class="Apple-tab-span" style="white-space: pre;"></span># wais</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">acl Safe_ports port 1025-65535<span class="Apple-tab-span" style="white-space: pre;">
</span># unregistered ports</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">acl Safe_ports port 280<span class="Apple-tab-span" style="white-space: pre;">
</span><span class="Apple-tab-span" style="white-space: pre;"></span># http-mgmt</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">acl Safe_ports port 488<span class="Apple-tab-span" style="white-space: pre;">
</span><span class="Apple-tab-span" style="white-space: pre;"></span># gss-http</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">acl Safe_ports port 591<span class="Apple-tab-span" style="white-space: pre;">
</span><span class="Apple-tab-span" style="white-space: pre;"></span># filemaker</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">acl Safe_ports port 777<span class="Apple-tab-span" style="white-space: pre;">
</span><span class="Apple-tab-span" style="white-space: pre;"></span># multiling http</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">acl CONNECT method CONNECT</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"># SSL Bump</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">acl step1 at_step SslBump1</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">acl MYSITE ssl::server_name school.bettermarks.com</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">ssl_bump peek step1</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">ssl_bump bump MYSITE</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">ssl_bump splice all</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"># Deny requests to certain unsafe ports</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">http_access deny !Safe_ports</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"># Deny CONNECT to other than secure SSL ports</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">http_access deny CONNECT !SSL_ports</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"># Only allow cachemgr access from localhost</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">http_access allow localhost manager</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">http_access deny manager</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"># Only allow purge from localhast (squidclient -m PURGE <object-url></font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">acl Purge method PURGE</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">http_access allow localhost Purge</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">http_access deny Purge</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"># Allow access from your local networks</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">http_access allow localnet</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">http_access allow localhost</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"># And finally deny all other access to this proxy</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">http_access deny all</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"># Squid normally listens to port 3128</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">http_port 3128</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">http_port 10.0.0.1:3129 intercept</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">https_port 10.0.0.1:3443 intercept ssl-bump cert=/etc/squid/certs/bettermarks.com-chain.crt key=/etc/squid/certs/bettermarks.com-unsecure.key</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">## Memory only caching</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"># Cache memory size (default: 256 MB)</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">cache_mem 512 MB</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"># Max object size in memory (default: 512 KB)</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">maximum_object_size_in_memory 2 MB</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"># Uncomment and adjust the following to add a disk cache directory.</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">#cache_dir ufs /var/spool/squid 100 16 256</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"># Leave coredumps in the first cache dir</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">coredump_dir /var/spool/squid</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">## Refresh patterns</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"># BM static</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">refresh_pattern -i ^https:\/\/(school|cdn)\.bettermarks\.com\/static\/.*? 1440 100% 1440</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"># BM dynamic</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">refresh_pattern -i ^https:\/\/school\.bettermarks\.com\/.*? 0 0% 0</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"># default</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">refresh_pattern ^ftp:<span class="Apple-tab-span" style="white-space: pre;">
</span><span class="Apple-tab-span" style="white-space: pre;"></span>1440<span class="Apple-tab-span" style="white-space: pre;">
</span>20%<span class="Apple-tab-span" style="white-space: pre;"> </span>10080</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">refresh_pattern ^gopher:<span class="Apple-tab-span" style="white-space: pre;">
</span>1440<span class="Apple-tab-span" style="white-space: pre;"> </span>0%<span class="Apple-tab-span" style="white-space: pre;">
</span>1440</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">refresh_pattern -i (/cgi-bin/|\?) 0<span class="Apple-tab-span" style="white-space: pre;">
</span>0%<span class="Apple-tab-span" style="white-space: pre;"> </span>0</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">refresh_pattern .<span class="Apple-tab-span" style="white-space: pre;">
</span><span class="Apple-tab-span" style="white-space: pre;"></span>0<span class="Apple-tab-span" style="white-space: pre;">
</span>20%<span class="Apple-tab-span" style="white-space: pre;"> </span>4320</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"># Cache log</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">debug_options ALL,1 33,5 83,5 89,5</font></div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);">My first goal is to replace the old working server-first bumping method:</div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"># SSL Bump</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">acl MYSITE dst 212.45.105.89</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">ssl_bump server-first MYSITE</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">ssl_bump none all</font></div>
<div style="color: rgb(0, 0, 0);">with the new peek and splice method:</div>
<div style="color: rgb(0, 0, 0);">
<div><font color="#0000ff"># SSL Bump</font></div>
<div><font color="#0000ff">acl step1 at_step SslBump1</font></div>
<div><font color="#0000ff">acl MYSITE ssl::server_name school.bettermarks.com</font></div>
<div><font color="#0000ff">ssl_bump peek step1</font></div>
<div><font color="#0000ff">ssl_bump bump MYSITE</font></div>
<div><font color="#0000ff">ssl_bump splice all</font></div>
</div>
<div style="color: rgb(0, 0, 0);"><font face="monospace"></font><br>
</div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);">The hostname school.bettermarks.com has the dedicated IP address 212.45.105.89 and points to a F5 loadbalancer</div>
<div style="color: rgb(0, 0, 0);">that terminates SSL for *.bettermarks.com using the same certificate as Squid.</div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);">I have called the following command on the client machine:</div>
<div style="color: rgb(0, 0, 0);"><font color="#ff0000"># curl -v <a href="https://school.bettermarks.com/static/flexclient4/bm_exerciseseries.swf">https://school.bettermarks.com/</a><path-to-file> -o /dev/null</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">* About to connect() to school.bettermarks.com port 443 (#0)</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">* Trying 212.45.105.89... connected</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">* Connected to school.bettermarks.com (212.45.105.89) port 443 (#0)</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">* Initializing NSS with certpath: sql:/etc/pki/nssdb</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">* CAfile: /etc/pki/tls/certs/ca-bundle.crt</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff"> CApath: none</font></div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);">The command have failed after a while with:</div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">* NSS error -5938</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">* Closing connection #0</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">* SSL connect error</font></div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);">Squid's access.log:</div>
<div style="color: rgb(0, 0, 0);"><font color="#0000ff">1447179870.180 172 10.0.0.2 TAG_NONE/200 0 CONNECT 212.45.105.89:443 - ORIGINAL_DST/212.45.105.89 -</font></div>
<div><font color="#0000ff"><br>
</font></div>
<div><font color="#0000ff"><br>
</font></div>
<div><font color="#000000"><font face="monospace">More information follows in my next post (to </font></font><font face="monospace"><span class="b5">not exceed</span><span class="b4"> th</span><span class="b5">e maximum post size).</span></font></div>
<span class="b5"><font face="monospace">
<div><span class="b5"><font face="monospace"><br>
</font></span></div>
Stefan<br>
</font></span>
<div><font face="monospace"><font color="#0000ff"><br>
</font></font></div>
</div>
<div class="-x-evo-signature-wrapper"><span>
<pre><br></pre>
</span></div>
<div>Am Dienstag, den 10.11.2015, 08:49 -0700 schrieb Alex Rousskov:</div>
<blockquote type="cite">
<div>On 11/10/2015 07:05 AM, Stefan Kutzke wrote:</div>
<div><br>
</div>
<blockquote type="cite">
<div>My assumption is that I have to use in Squid's config:</div>
</blockquote>
<div><br>
</div>
<blockquote type="cite">
<div>acl MYSITE ssl:server_name .mydomain.com</div>
<div>ssl_bump bump MYSITE</div>
<div>ssl_bump splice all</div>
</blockquote>
<div><br>
</div>
<blockquote type="cite">
<div>This results in tunneling all https traffic, nothing will be bumped and</div>
<div>cached. </div>
</blockquote>
<div><br>
</div>
<div>Yes, probably because MYSITE (ssl::server_name) often needs SNI and SNI</div>
<div>is not available during step1 when MYSITE is evaluated in your config.</div>
<div>In other words, your config is equivalent to</div>
<div><br>
</div>
<div> ssl_bump splice all</div>
<div><br>
</div>
<div>unless reverse DNS works perfectly well.</div>
<div><br>
</div>
<div><br>
</div>
<blockquote type="cite">
<div>I'm a little bit confused about the documentation:</div>
</blockquote>
<div><br>
</div>
<blockquote type="cite">
<div>Under the headline "Processing steps":</div>
<div>*Step 2:*</div>
<div> 1. Get TLS clientHello info, including *SNI* where available. </div>
</blockquote>
<div><br>
</div>
<div><br>
</div>
<blockquote type="cite">
<div>Under the headline "Actions":</div>
<div>peek/stare Receive client *SNI (step1)*, ...</div>
</blockquote>
<div><br>
</div>
<div><br>
</div>
<div>I know it is confusing, but I cannot find a better way to explain this</div>
<div>in brief documentation without pictures. Improvements are welcomed. The</div>
<div>key here is that ssl_bump rules are evaluated at the end of a step and</div>
<div>usually allow Squid to do something at the beginning of the next step.</div>
<div><br>
</div>
<div>For example, during step1, Squid does not have SNI. If a peek rule</div>
<div>matches during step1, then Squid proceeds to step2. At the beginning of</div>
<div>step2, Squid gets SNI. Thus, a step1 peek rule controls whether Squid</div>
<div>will get SNI (during step2).</div>
<div><br>
</div>
<div><br>
</div>
<blockquote type="cite">
<div>Is it possible to achieve my goal with Squid in transparent mode?</div>
</blockquote>
<div><br>
</div>
<div>I should be possible, but I do not know whether anybody has done exactly</div>
<div>that so there could be some minor bugs along the way. You need</div>
<div>configuration suggested by Sebastian and the latest Squid you can build.</div>
<div><br>
</div>
<div><br>
</div>
<div>HTH,</div>
<div><br>
</div>
<div>Alex.</div>
<div><br>
</div>
</blockquote>
</body>
</html>