<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<br>
-----BEGIN PGP SIGNED MESSAGE----- <br>
Hash: SHA256 <br>
<br>
You can write it easy ;)<br>
<br>
Please note:<br>
<br>
1. AFAIK, splice rule must be preceded by bump rule in your config.<br>
2. You can use ssl::server_name_regex or ssl::server_name for a
decision<br>
3. In most cases your users must have your cache CA's when cache
cannot splice<br>
<br>
Config snippet, for example, will looks like this:<br>
<br>
# SSL bump rules 1<br>
acl step1 at_step SslBump1<br>
acl Splice_Only ssl::server_name_regex -i
"/usr/local/squid/etc/google_sites"<br>
ssl_bump splice Splice_Only<br>
ssl_bump peek step1<br>
ssl_bump bump all<br>
<br>
Note: This snippet will bump all others, and tunnel Splice_Only acl
sites.<br>
<br>
# SSL bump rules 2<br>
acl step1 at_step SslBump1<br>
ssl_bump peek step1<br>
acl Splice_Only ssl::server_name_regex -i
"/usr/local/squid/etc/google_sites"<br>
ssl_bump splice Splice_Only<br>
ssl_bump bump all<br>
<br>
Note: This snippet will peek all, splice Splice_Only acl, and bump
all others.<br>
<br>
Amos, Alex,<br>
<br>
correct me if I somewhere wrong.<br>
<br>
WBR, Yuri<br>
<br>
PS. Also note: you must adjust https_port and/or other SSL options
for harden your cache's TLS connections to avoid other Chrome
security warnings. For example, avoid using SHA1 in your cache's CA,
configure EDH ciphers for outgoing _and_ client-to-cache
connections, suppress using SSLv2/SSLv3 (but keep in mind: you have
_much_ old clients, like IM, which is hardcoded to use SSLv2/SSLv3
and you will got warnings/errors in your cache.log about it).<br>
<br>
05.01.16 18:51, Alejandro Martinez пишет:<br>
<span style="white-space: pre;">> I all<br>
> I'm still lost, can I ask for a minimal working config
splicing google.com<br>
> sites ?<br>
><br>
> I have made some additional checks (blocking QUIC), but with
no lunk.<br>
><br>
> I'm thinking creating an external helper that receives via
ssl::server_name<br>
> and make a decision there, but if there is a chance with a
simple text file<br>
> would appreciate that.<br>
><br>
> Thanks.<br>
><br>
><br>
> 2016-01-04 9:52 GMT-03:00 Alejandro Martinez
<a class="moz-txt-link-rfc2396E" href="mailto:ajm.martinez@gmail.com"><ajm.martinez@gmail.com></a>:<br>
><br>
>> Thanks all for your help.<br>
>><br>
>> Is there a minimal config example to see splicing
correctly Google sites?<br>
>><br>
>> It would be very helpful.<br>
>> El 04/01/2016 09:28, "Amos Jeffries"
<a class="moz-txt-link-rfc2396E" href="mailto:squid3@treenet.co.nz"><squid3@treenet.co.nz></a> escribió:<br>
>><br>
>>> On 4/01/2016 1:16 p.m., Alejandro Martinez wrote:<br>
>>>> Thanks again Yuri.<br>
>>>><br>
>>>> I have tried blocking udp protocol on port 80 and
443 but without luck.<br>
>>><br>
>>> That does not help resolve the errors Chrome is
displaying when using<br>
>>> the proxy. It does help resolve the errors that
happen by Chrome trying<br>
>>> to bypass the proxy by using the proprietary QUIC
protocol.<br>
>>><br>
>>>><br>
>>>> Is it possible to make google sites work in
transparent mode without<br>
>>>> bumping ? only splicing ?<br>
>>>><br>
>>><br>
>>> Of course. That is the purpose of splice. Bumping is
optional.<br>
>>><br>
>>> Amos<br>
>>> _______________________________________________<br>
>>> squid-users mailing list<br>
>>> <a class="moz-txt-link-abbreviated" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
>>> <a class="moz-txt-link-freetext" href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a><br>
>>><br>
>><br>
><br>
><br>
><br>
> _______________________________________________<br>
> squid-users mailing list<br>
> <a class="moz-txt-link-abbreviated" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
> <a class="moz-txt-link-freetext" href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a></span><br>
<br>
-----BEGIN PGP SIGNATURE-----
<br>
Version: GnuPG v2
<br>
<br>
iQEcBAEBCAAGBQJWi9nXAAoJENNXIZxhPexG/FsH/21aB4HVW1VEBlHBpebgDllX
<br>
qNrMndyVNohyne9vloFOafl5Vs0IqhVQVMU1AJrLvXXNhTzRa2vSrud/xgi62AZ4
<br>
3C7V6OI+m+qfPXyjMjuyVZm2hkofUXBKn518ZzyjiV89Qzlr24FQv41v8j7ebYZo
<br>
Jn3YLk7FsSnZ/2q8zSERsXARr9OxBW6JJqlHDBF4FbUrDSRs67UAvJyrcDccNB1i
<br>
b539GdUHGGljftY2O1xpgSHBUelylWTWtfgE1qYKfTYoXqb3yhI3VkBx3+0AgCNY
<br>
3VJIwn5TU+j98rz3r7sd7re8KPtssY5jukVo1drLkSm9w1HOxL5kiLJ/MP+MnEg=
<br>
=S2qK
<br>
-----END PGP SIGNATURE-----
<br>
<br>
</body>
</html>