<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /></head><body style='font-size: 10pt; font-family: Verdana,Geneva,sans-serif'>
<p>Hi!,</p>
<p><br /></p>
<p>I have Squid configured with the virus scanning software using ICAP and working. But, when I do : </p>
<p>acl matchear_todo url_regex [-i] ^.*$<br />http_reply_access deny matchear_todo<br />deny_info http://172.16.8.61/redirigir.php?url=%s matchear_todo</p>
<p>it's always redirecting me without passing the own ICAP system... I wanted the redirection to be done only when content is clean... this is doing it always... have I missed something?</p>
<p><br /></p>
<p>Cheers!</p>
<p><br /></p>
<div>---<br />
<div class="firmasarenet" style="clear: both; text-align: left;">
<div class="imgsarenet" style="margin: 0 0 10px 0;"><img src="https://www.sarenet.es/estaticos/LogoSarenetEmails.png?newlogo" alt="sarenet" /></div>
<div class="titulosarenet" style="font-family: Helvetica, Arial, sans-serif; font-weight: bold; font-size: 14px; color: #333333;"><strong>Egoitz Aurrekoetxea</strong></div>
<div class="dptosarenet" style="font-family: Helvetica, Arial, sans-serif; font-weight: normal; font-size: 12px; color: #333333;">Dpto. de sistemas</div>
<div class="textosarenet" style="font-family: Helvetica, Arial, sans-serif; font-weight: normal; font-size: 12px; color: #333333;">944 209 470<br />Parque Tecnológico. Edificio 103<br />48170 Zamudio (Bizkaia)</div>
<div class="lnksarenet" style="font-family: Helvetica, Arial, sans-serif; font-weight: normal; font-size: 12px; color: #007ac4; line-height: 1.2;"><a id="mailto" style="font-size: 12px; color: #007ac4; text-decoration: underline;" href="mailto:egoitz@sarenet.es"><label id="label_email">egoitz@sarenet.es</label></a></div>
<div class="lnksarenet" style="font-family: Helvetica, Arial, sans-serif; font-weight: normal; font-size: 12px; color: #007ac4; line-height: 1.2;"><a style="font-size: 12px; color: #007ac4; text-decoration: underline;" href="http://www.sarenet.es">www.sarenet.es</a></div>
<br />
<div class="imprimirsarenet" style="font-family: Helvetica, Arial, sans-serif; font-weight: normal; font-size: 10px; color: #a0c361;">Antes de imprimir este correo electrónico piense si es necesario hacerlo.</div>
</div>
</div>
<p><br /></p>
<p>El 2019-03-05 08:13, Alex Rousskov escribió:</p>
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0"><!-- html ignored --><!-- head ignored --><!-- meta ignored -->
<div class="pre" style="margin: 0; padding: 0; font-family: monospace">On 3/4/19 11:20 AM, Egoitz Aurrekoetxea wrote:<br /> <br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">Clients, will ask :<br /> <br /> <a href="https://oooeeee.eeee.ttt.thesquidserver.org/" target="_blank" rel="noopener noreferrer">https://oooeeee.eeee.ttt.thesquidserver.org/</a></blockquote>
<br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">So the answer [to the second question] I assume should be yes.</blockquote>
<br /> If I am interpreting your answers correctly, then your setup looks like<br /> a reverse proxy to me. In that case, you do not need SslBump and<br /> interception. You do need an web server certificate for the<br /> oooeeee.eeee.ttt.thesquidserver.org domain, issued by a well-trusted CA.<br /> Do you already have that?<br /> <br /> <br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">I have DNAT rules, for being able to<br /> redirect tcp/80 and tcp/443 to squid's port silently.</blockquote>
<br /> Please note that your current Squid configuration is not a reverse proxy<br /> configuration. It is an interception configuration. It also lacks<br /> https_port for handling port 443 traffic. There are probably some<br /> documents on Squid wiki (and/or elsewhere) explaining how to configure<br /> Squid to become a reverse proxy. Follow them.<br /> <br /> <br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">I wanted to setup a proxy machine which I wanted to be able to receive<br /> url like :<br /> <br /> - <a href="http://www.iou.net.theproxy.com/hj.php?ui=9" target="_blank" rel="noopener noreferrer">www.iou.net.theproxy.com/hj.php?ui=9</a><br /> <br /> If this site returns clean content (scanned by Icap server) the url<br /> redirector should return :<br /> <br /> - <a href="http://www.iou.net/hj.php?ui=9" target="_blank" rel="noopener noreferrer">www.iou.net/hj.php?ui=9</a> <<a href="http://www.iou.net/hj.php?ui=9" target="_blank" rel="noopener noreferrer">http://www.iou.net/hj.php?ui=9</a>> (the real<br /> url) as URL.</blockquote>
<br /> OK.<br /> <br /> <br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">- Is it possible with Squid to achieve my goal?. With Squid, a<br /> redirector, and a Icap daemon which performs virus scanning...</blockquote>
<br /> A redirector seems out of scope here -- it works on requests while you<br /> want to rewrite (scanned by ICAP) responses.<br /> <br /> It is probably possible to use deny_info to respond with a redirect<br /> message. To trigger a deny_info action, you would have to configure your<br /> Squid to block virus-free responses, which is rather strange!<br /> <br /> <br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">- For plain http the config and the URL seem to be working BUT the virus<br /> are not being scanned. Could the config be adjusted for that?.</blockquote>
<br /> <br /> I would start by removing the redirector, "intercept", SslBump, and<br /> disabling ICAP. Configure your Squid as a reverse proxy without any<br /> virus scanning. Then add ICAP. Get the virus scanning working without<br /> any URL manipulation. Once that is done, you can adjust Squid to block<br /> virus-free responses (via http_reply_access) and trigger a deny_info<br /> response containing an HTTP redirect.<br /> <br /> <br /> Please note that once the browser gets a redirect to another site, that<br /> browser is not going to revisit your reverse proxy for any content<br /> related to that other site -- all requests for that other site will go<br /> from the browser to that other site. Your proxy will not be in the loop<br /> anymore. If that is not what you want, then you cannot use redirects at<br /> all -- you would have to accelerate that other site for all requests<br /> instead and make sure that other site does not contain absolute URLs<br /> pointing the browser away from your reverse proxy.<br /> <br /> <br /> Disclaimer: I have not tested the above ideas and, again, I may be<br /> misinterpreting what you really want to achieve.<br /> <br /> Alex.<br /> _______________________________________________<br /> squid-users mailing list<br /> <a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br /> <a href="http://lists.squid-cache.org/listinfo/squid-users" target="_blank" rel="noopener noreferrer">http://lists.squid-cache.org/listinfo/squid-users</a></div>
</blockquote>
</body></html>