<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">Hi!</div><div class=""><br class=""></div><div class="">Currently, I am using the version squid-3.5.12. I have configure the SSL bump this way:</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><div class=""><font face="Courier New" class="">http_port 8080 ssl-bump \</font></div><font face="Courier New" class="">
</font><div class=""><font face="Courier New" class=""> cert=/usr/local/squid/etc/ssl_cert/myCA.pem \</font></div><font face="Courier New" class="">
</font><div class=""><font face="Courier New" class=""> generate-host-certificates=on dynamic_cert_mem_cache_size=4MB</font></div></div><div class=""><font face="Courier New" class=""><br class=""></font></div><div class=""><div class=""><font face="Courier New" class="">acl step1 at_step SslBump1</font></div>
<div class=""><font face="Courier New" class=""><br class=""></font></div>
<div class=""><font face="Courier New" class="">#sslproxy_options NO_SSLv2,NO_SSLv3,SINGLE_DH_USE</font></div>
<div class=""><font face="Courier New" class=""><br class=""></font></div>
<div class=""><font face="Courier New" class="">ssl_bump peek step1</font></div>
<div class=""><font face="Courier New" class="">ssl_bump bump all</font></div><div style="font-size: 14px;" class=""><font face="Courier New" class=""><br class=""></font></div><div class=""><font class="">I am able to do HTTP filtering, however, using doing an HTTPS url filter does not work. A specific example is whitelisting the following URL <a href="https://www.facebook.com/login" class="">https://www.facebook.com/login</a>, but I do not want to allow all of facebook’s traffic to be whitelisted, thus the url <a href="https://www.facebook.com" class="">https://www.facebook.com</a> should not be allowed.</font></div></div><div class=""><font class=""><br class=""></font></div><div class="">Trying to do a url_regex to <a href="http://www.facebook.com/login" class="">www.facebook.com/login</a> will give me the default error page from squid. I am using firefox to use the proxy. And in the logs I am given a 403 error:</div><div class=""><br class=""></div><div class=""><font face="Courier New" class="">"GET <a href="https://www.facebook.com/login" class="">https://www.facebook.com/login</a> HTTP/1.1" 403 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:42.0) Gecko/20100101 Firefox/42.0” TAG_NONE:HIER_NONE</font></div><div class=""><font face="Courier New" class=""><br class=""></font></div><div class="">I do not want to whitelist the whole Facebook domain. I simply want to whitelist <a href="http://facebook.com/login" class="">facebook.com/login</a>, so that we can allow websites that uses Facebook login to use it.</div><div class=""><br class=""></div><div class="">Hope this helps.</div><div class=""><br class=""></div><div class="">Thanks!</div><div class=""><br class=""></div><div class="">Joru</div><div class=""><br class=""></div><br class=""><div><blockquote type="cite" class=""><div class="">On 28 Dec 2015, at 11:32 PM, Antony Stone <<a href="mailto:Antony.Stone@squid.open.source.it" class="">Antony.Stone@squid.open.source.it</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">On Monday 28 December 2015 at 16:22:58, joru.pacs wrote:<br class=""><br class=""><blockquote type="cite" class="">Hi!<br class=""><br class="">I am trying to set up squid to be a whitelist proxy which should be able to<br class="">filter both HTTP and HTTPS URLs.<br class=""></blockquote><br class=""><blockquote type="cite" class="">I have already tried using SSL Bump<br class=""></blockquote><br class="">How? What squid.conf did you use? What results did you get? What didn't <br class="">work?<br class=""><br class=""><blockquote type="cite" class="">I haven’t found anything or any good documentation that would help me to do<br class="">what I have just enumerated.<br class=""></blockquote><br class=""><a href="http://wiki.squid-cache.org/Features/SslPeekAndSplice" class="">http://wiki.squid-cache.org/Features/SslPeekAndSplice</a> should point you in the <br class="">right direction.<br class=""><br class="">Please try that, and if you run into problems, let us know:<br class=""><br class=""> - what you have in squid.conf (without comments or blank lines)<br class=""> - which exact version of Squid you are using<br class=""> - which browser/s you are using<br class=""> - which URL/s you are trying to access and having problems with<br class=""> - what shows up in Squid's access log when you connect to those URLs<br class=""><br class="">Good luck,<br class=""><br class=""><br class="">Antony.<br class=""><br class="">-- <br class="">Late in 1972 President Richard Nixon announced that the rate of increase of <br class="">inflation was decreasing. This was the first time a sitting president used a <br class="">third derivative to advance his case for re-election.<br class=""><br class=""> - Hugo Rossi, Notices of the American Mathematical Society<br class=""><br class=""> Please reply to the list;<br class=""> please *don't* CC me.<br class="">_______________________________________________<br class="">squid-users mailing list<br class=""><a href="mailto:squid-users@lists.squid-cache.org" class="">squid-users@lists.squid-cache.org</a><br class="">http://lists.squid-cache.org/listinfo/squid-users<br class=""></div></div></blockquote></div><br class=""></body></html>