<div dir="ltr"><div><div>Yuri thanks again.<br><br></div>I'm going to give it a try and post my results.<br><br></div>Alejandro<br></div><div class="gmail_extra"><br><div class="gmail_quote">2016-01-05 11:57 GMT-03:00 Yuri Voinov <span dir="ltr"><<a href="mailto:yvoinov@gmail.com" target="_blank">yvoinov@gmail.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF"><span class="">
<br>
-----BEGIN PGP SIGNED MESSAGE----- <br>
Hash: SHA256 <br>
<br></span>
You can write it easy ;)<br>
<br>
Please note:<br>
<br>
1. AFAIK, splice rule must be preceded by bump rule in your config.<br>
2. You can use ssl::server_name_regex or ssl::server_name for a
decision<br>
3. In most cases your users must have your cache CA's when cache
cannot splice<br>
<br>
Config snippet, for example, will looks like this:<br>
<br>
# SSL bump rules 1<br>
acl step1 at_step SslBump1<br>
acl Splice_Only ssl::server_name_regex -i
"/usr/local/squid/etc/google_sites"<br>
ssl_bump splice Splice_Only<br>
ssl_bump peek step1<br>
ssl_bump bump all<br>
<br>
Note: This snippet will bump all others, and tunnel Splice_Only acl
sites.<br>
<br>
# SSL bump rules 2<br>
acl step1 at_step SslBump1<br>
ssl_bump peek step1<br>
acl Splice_Only ssl::server_name_regex -i
"/usr/local/squid/etc/google_sites"<br>
ssl_bump splice Splice_Only<br>
ssl_bump bump all<br>
<br>
Note: This snippet will peek all, splice Splice_Only acl, and bump
all others.<br>
<br>
Amos, Alex,<br>
<br>
correct me if I somewhere wrong.<br>
<br>
WBR, Yuri<br>
<br>
PS. Also note: you must adjust https_port and/or other SSL options
for harden your cache's TLS connections to avoid other Chrome
security warnings. For example, avoid using SHA1 in your cache's CA,
configure EDH ciphers for outgoing _and_ client-to-cache
connections, suppress using SSLv2/SSLv3 (but keep in mind: you have
_much_ old clients, like IM, which is hardcoded to use SSLv2/SSLv3
and you will got warnings/errors in your cache.log about it).<br>
<br>
05.01.16 18:51, Alejandro Martinez пишет:<div><div class="h5"><br>
<span style="white-space:pre-wrap">> I all<br>
> I'm still lost, can I ask for a minimal working config
splicing <a href="http://google.com" target="_blank">google.com</a><br>
> sites ?<br>
><br>
> I have made some additional checks (blocking QUIC), but with
no lunk.<br>
><br>
> I'm thinking creating an external helper that receives via
ssl::server_name<br>
> and make a decision there, but if there is a chance with a
simple text file<br>
> would appreciate that.<br>
><br>
> Thanks.<br>
><br>
><br>
> 2016-01-04 9:52 GMT-03:00 Alejandro Martinez
<a href="mailto:ajm.martinez@gmail.com" target="_blank"><ajm.martinez@gmail.com></a>:<br>
><br>
>> Thanks all for your help.<br>
>><br>
>> Is there a minimal config example to see splicing
correctly Google sites?<br>
>><br>
>> It would be very helpful.<br>
>> El 04/01/2016 09:28, "Amos Jeffries"
<a href="mailto:squid3@treenet.co.nz" target="_blank"><squid3@treenet.co.nz></a> escribió:<br>
>><br>
>>> On 4/01/2016 1:16 p.m., Alejandro Martinez wrote:<br>
>>>> Thanks again Yuri.<br>
>>>><br>
>>>> I have tried blocking udp protocol on port 80 and
443 but without luck.<br>
>>><br>
>>> That does not help resolve the errors Chrome is
displaying when using<br>
>>> the proxy. It does help resolve the errors that
happen by Chrome trying<br>
>>> to bypass the proxy by using the proprietary QUIC
protocol.<br>
>>><br>
>>>><br>
>>>> Is it possible to make google sites work in
transparent mode without<br>
>>>> bumping ? only splicing ?<br>
>>>><br>
>>><br>
>>> Of course. That is the purpose of splice. Bumping is
optional.<br>
>>><br>
>>> Amos<br>
>>> _______________________________________________<br>
>>> squid-users mailing list<br>
>>> <a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br>
>>> <a href="http://lists.squid-cache.org/listinfo/squid-users" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br>
>>><br>
>><br>
><br>
><br>
><br>
> _______________________________________________<br>
> squid-users mailing list<br>
> <a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br>
> <a href="http://lists.squid-cache.org/listinfo/squid-users" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a></span><br>
<br></div></div><span class="">
-----BEGIN PGP SIGNATURE-----
<br>
Version: GnuPG v2
<br>
<br></span>
iQEcBAEBCAAGBQJWi9nXAAoJENNXIZxhPexG/FsH/21aB4HVW1VEBlHBpebgDllX
<br>
qNrMndyVNohyne9vloFOafl5Vs0IqhVQVMU1AJrLvXXNhTzRa2vSrud/xgi62AZ4
<br>
3C7V6OI+m+qfPXyjMjuyVZm2hkofUXBKn518ZzyjiV89Qzlr24FQv41v8j7ebYZo
<br>
Jn3YLk7FsSnZ/2q8zSERsXARr9OxBW6JJqlHDBF4FbUrDSRs67UAvJyrcDccNB1i
<br>
b539GdUHGGljftY2O1xpgSHBUelylWTWtfgE1qYKfTYoXqb3yhI3VkBx3+0AgCNY
<br>
3VJIwn5TU+j98rz3r7sd7re8KPtssY5jukVo1drLkSm9w1HOxL5kiLJ/MP+MnEg=
<br>
=S2qK
<br>
-----END PGP SIGNATURE-----
<br>
<br>
</div>
<br>_______________________________________________<br>
squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br>
<br></blockquote></div><br></div>