<html><body><div style="font-family: times new roman, new york, times, serif; font-size: 14pt; color: #000000"><div><br>>> Hi everyone,<br>>> I have a transparent proxy squid 3.5.26 with C-ICAP and here are the <br>>> important lines:<br>>> "<br>>> icap_enable on<br>>> icap_send_client_ip on<br>>> icap_send_client_username on<br>>> icap_client_username_header X-Authenticated-User<br>>> icap_preview_enable on<br>>> icap_preview_size 1024<br>>> icap_service service_avi_req reqmod_precache icap://localhost:1344/echo <br>>> bypass=off<br>>> adaptation_access service_avi_req allow all<br>>> icap_service service_avi_resp respmod_precache <br>>> icap://localhost:1344/echo bypass=off<br>>> adaptation_access service_avi_resp allow all<br>>> <br>>> #url_rewrite_program /usr/bin/squidGuard -c /etc/squidguard/squidGuard.conf<br>>> <br>>> <br>>> http_port 3128<br>>> http_port 3129 intercept<br>>> https_port 3130 intercept ssl-bump \<br>>> cert=/etc/squid/ssl_cert/myCA.pem \<br>>> generate-host-certificates=on dynamic_cert_mem_cache_size=4MB<br>>> sslcrtd_program /usr/local/squid/libexec/ssl_crtd -s /var/lib/ssl_db -M 4MB<br>>> <br>>> #acl step1 at_step SslBump1<br>>> #acl step2 at_step SslBump2<br>>> #acl step3 at_step SslBump3<br>>> <br>>> ssl_bump peek all<br>>> ssl_bump bump all<br></div><div>></div><div>>NP: Peeking at step 2 precludes bumping.<br></div><div>></div><div>>> logformat squid %ssl::>sni<br></div><div>></div><div>>Please do not redefine the built-in format name "squid". Use a custom <br>>name for custom formats.<br></div><div>></div><div><br></div><div>Ok it will be done</div><div><br></div><div>><br>>> adaptation_meta X-SNI "%ssl::>sni" all #or connect<br>>> #request_header_add X-SNI "%ssl::>sni" all<br>>> "<br>>> <br>>><br>>> So i want to create an icap service like squidclamav but it must check <br>>> SNI not URLs.<br></div><div>></div><div>>Any particular reason why?<br>> SNI has almost nothing to do with the HTTP messages (plural). It is <br>> simply the name of the next-hop server (or proxy) they should be <br>> delivered to on their way around the web.<br></div><div>></div><div>>I thought squidclamav was an antivirus, not a URL blocklist checker.<br></div><div>></div><div>You're right: squidclamav is an antivirus but there are much more services, actually he can check url and match them to blacklist or whitelist.</div><div>I don't want to decrypt https trafic but i want to know where the client is trying to connect. I thought SNI was the only way to know the server name and the domain without decrypting anything. </div><div><br></div><div>Final goal is to blacklist for exemple google and when sni indicates www.google.com, c-icap denies the access.</div><div><br>> <br>>> I peek all the steps to get sni and in the squid access log, sni is <br>>> printed .<br>>></div><div>>> I read that adaptation_meta can send anything from squid to icap but <br>>> clearly i use it incorretly: i can't see sni on icap access log or in <br>>> icap headers.<br></div><div>></div><div>> Your usage appears to be correct. I think there is no SNI being received <br>> by Squid.<br></div><div><br></div><div>That's problematic because in my squid access log there are "www.youtube.com" "www.google.com", that's exactly what i'm tryng to pass to c-icap. Seems like squid receives the sni.</div><div><br>>> Does adaptation_meta create a icap headers ?<br></div><div>></div><div>>It does.<br></div><div>></div><div>>> Or should i use <br>>> add_request_headers?<br></div><div>></div><div>>No, that would add HTTP headers to the outgoing messages (to server or <br>>to client).</div><div>>> <br>>> I know that squid can create a 2nd fake connect with sni but here again <br>>> icap just print the same connect 2 times<br>>><br></div><div>></div><div>>That is correct, however SNI is not always sent by clients. Squid can <br>>only use what it is given.<br></div><div>></div><div>>If there is an SNI in that particular clientHello you have hit a bug in <br>>Squid.</div><div>></div><div>>Amos</div><div><br></div><div>Thanks Amos for the reply.</div><div><br>>________<span style="font-size: 14pt;">______________________________________</span></div><div><br></div></div></body></html>