<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /></head><body style='font-size: 10pt; font-family: Verdana,Geneva,sans-serif'>
<p>Hi Alex!!</p>
<p><br /></p>
<p>I do answer below!! Many many thanks in advance...</p>
<div>---<br />
<div class="firmasarenet" style="clear: both; text-align: left;">
<div class="imgsarenet" style="margin: 0 0 10px 0;"><img src="https://www.sarenet.es/estaticos/LogoSarenetEmails.png?newlogo" alt="sarenet" /></div>
<div class="titulosarenet" style="font-family: Helvetica, Arial, sans-serif; font-weight: bold; font-size: 14px; color: #333333;"><strong>Egoitz Aurrekoetxea</strong></div>
<div class="dptosarenet" style="font-family: Helvetica, Arial, sans-serif; font-weight: normal; font-size: 12px; color: #333333;">Dpto. de sistemas</div>
<div class="textosarenet" style="font-family: Helvetica, Arial, sans-serif; font-weight: normal; font-size: 12px; color: #333333;">944 209 470<br />Parque Tecnológico. Edificio 103<br />48170 Zamudio (Bizkaia)</div>
<div class="lnksarenet" style="font-family: Helvetica, Arial, sans-serif; font-weight: normal; font-size: 12px; color: #007ac4; line-height: 1.2;"><a id="mailto" style="font-size: 12px; color: #007ac4; text-decoration: underline;" href="mailto:egoitz@sarenet.es"><label id="label_email">egoitz@sarenet.es</label></a></div>
<div class="lnksarenet" style="font-family: Helvetica, Arial, sans-serif; font-weight: normal; font-size: 12px; color: #007ac4; line-height: 1.2;"><a style="font-size: 12px; color: #007ac4; text-decoration: underline;" href="http://www.sarenet.es">www.sarenet.es</a></div>
<br />
<div class="imprimirsarenet" style="font-family: Helvetica, Arial, sans-serif; font-weight: normal; font-size: 10px; color: #a0c361;">Antes de imprimir este correo electrónico piense si es necesario hacerlo.</div>
</div>
</div>
<p><br /></p>
<p>El 2019-03-05 17:45, Alex Rousskov escribió:</p>
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0"><!-- html ignored --><!-- head ignored --><!-- meta ignored -->
<div class="pre" style="margin: 0; padding: 0; font-family: monospace">On 3/5/19 1:57 AM, Egoitz Aurrekoetxea wrote:<br /> <br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">I have Squid configured with the virus scanning software using ICAP and<br /> working. But, when I do :<br /> <br /> acl matchear_todo url_regex [-i] ^.*$</blockquote>
<br /> FYI: "[-i]" is documentation syntax that means an optional flag called<br /> "-i". If you want to use that "-i" flag, then type<br /> <br /> acl matchear_todo url_regex -i ^.*$<br /> <br /> ... but keep in mind that "-i" makes no sense when you regular<br /> expression does not contain small or capital characters. Adding "-i"<br /> would not change what URLs such a regular expression would match.</div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"><strong><span style="color: #339966;">I see... I though it was for matching case insensitively... some sort of i/______/</span></strong></div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"><br /> <br /> <br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">http_reply_access deny matchear_todo<br /> deny_info <a href="http://172.16.8.61/redirigir.php?url=%s" target="_blank" rel="noopener noreferrer">http://172.16.8.61/redirigir.php?url=%s</a> matchear_todo</blockquote>
<br /> Why are you blocking based on URL instead of blocking based on the ICAP<br /> scan result? In your earlier specifications, you wanted to<br /> block/redirect only those transactions that were certified virus-free by<br /> your ICAP client. The above matchear_todo ACL does not do that.</div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"><strong><span style="color: #339966;">That was an attempt of achieving my goal. Redirect requests to a php which does the request to a "next Squid" and then return one thing or another....</span></strong></div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"><strong><span style="color: #339966;">Sorry, that's wrong. I have done tons of tests... At present... I don't really know how to do that... I would be very thankful if you could guide me on how could I do it... Is it possible to be done from Squid side?. Or does the own ICAP implementation directly return a 3xx answer?.</span></strong></div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"><br /> <br /> <br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">it's always redirecting me without passing the own ICAP system...</blockquote>
<br /> Looking at the Squid code, what you describe overall seems impossible --<br /> Squid checks http_reply_access _after_ the RESPMOD transaction, not<br /> before it. Adding http_reply_access cannot disable ICAP scans AFAICT!<br /> Are you sure it has that effect in your use case?</div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"><strong><span style="color: #339966;">It seemed to do so yes.... I'll try it again....</span></strong></div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"><br /> <br /> <br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">I<br /> wanted the redirection to be done only when content is clean... this is<br /> doing it always... have I missed something?</blockquote>
<br /> Your ACL says nothing about "clean". It says "always". How does your<br /> ICAP service mark "clean" (or "dirty") HTTP responses? Your ACL needs to<br /> match that marking (or the absence of that marking).</div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"><strong><span style="color: #339966;">Could you give me a clue of how could I do it?.</span></strong></div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"><br /> <br /> Alex.</div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"><strong><span style="color: #339966;">Thanks Alex!!!!</span></strong></div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"><br /> <br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">El 2019-03-05 08:13, Alex Rousskov escribió:<br /> <br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">On 3/4/19 11:20 AM, Egoitz Aurrekoetxea wrote:<br /> <br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">Clients, will ask :<br /> <br /> <a href="https://oooeeee.eeee.ttt.thesquidserver.org/" target="_blank" rel="noopener noreferrer">https://oooeeee.eeee.ttt.thesquidserver.org/</a></blockquote>
<br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">So the answer [to the second question] I assume should be yes.</blockquote>
<br /> If I am interpreting your answers correctly, then your setup looks like<br /> a reverse proxy to me. In that case, you do not need SslBump and<br /> interception. You do need an web server certificate for the<br /> oooeeee.eeee.ttt.thesquidserver.org domain, issued by a well-trusted CA.<br /> Do you already have that?<br /> <br /> <br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">I have DNAT rules, for being able to<br /> redirect tcp/80 and tcp/443 to squid's port silently.</blockquote>
<br /> Please note that your current Squid configuration is not a reverse proxy<br /> configuration. It is an interception configuration. It also lacks<br /> https_port for handling port 443 traffic. There are probably some<br /> documents on Squid wiki (and/or elsewhere) explaining how to configure<br /> Squid to become a reverse proxy. Follow them.<br /> <br /> <br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">I wanted to setup a proxy machine which I wanted to be able to receive<br /> url like :<br /> <br /> - <a href="http://www.iou.net.theproxy.com/hj.php?ui=9" target="_blank" rel="noopener noreferrer">www.iou.net.theproxy.com/hj.php?ui=9</a><br /> <<a href="http://www.iou.net.theproxy.com/hj.php?ui=9" target="_blank" rel="noopener noreferrer">http://www.iou.net.theproxy.com/hj.php?ui=9</a>><br /> <br /> If this site returns clean content (scanned by Icap server) the url<br /> redirector should return :<br /> <br /> - <a href="http://www.iou.net/hj.php?ui=9" target="_blank" rel="noopener noreferrer">www.iou.net/hj.php?ui=9</a> <<a href="http://www.iou.net/hj.php?ui=9" target="_blank" rel="noopener noreferrer">http://www.iou.net/hj.php?ui=9</a>><br /> <<a href="http://www.iou.net/hj.php?ui=9" target="_blank" rel="noopener noreferrer">http://www.iou.net/hj.php?ui=9</a>> (the real<br /> url) as URL.</blockquote>
<br /> OK.<br /> <br /> <br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">- Is it possible with Squid to achieve my goal?. With Squid, a<br /> redirector, and a Icap daemon which performs virus scanning...</blockquote>
<br /> A redirector seems out of scope here -- it works on requests while you<br /> want to rewrite (scanned by ICAP) responses.<br /> <br /> It is probably possible to use deny_info to respond with a redirect<br /> message. To trigger a deny_info action, you would have to configure your<br /> Squid to block virus-free responses, which is rather strange!<br /> <br /> <br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">- For plain http the config and the URL seem to be working BUT the virus<br /> are not being scanned. Could the config be adjusted for that?.</blockquote>
<br /> <br /> I would start by removing the redirector, "intercept", SslBump, and<br /> disabling ICAP. Configure your Squid as a reverse proxy without any<br /> virus scanning. Then add ICAP. Get the virus scanning working without<br /> any URL manipulation. Once that is done, you can adjust Squid to block<br /> virus-free responses (via http_reply_access) and trigger a deny_info<br /> response containing an HTTP redirect.<br /> <br /> <br /> Please note that once the browser gets a redirect to another site, that<br /> browser is not going to revisit your reverse proxy for any content<br /> related to that other site -- all requests for that other site will go<br /> from the browser to that other site. Your proxy will not be in the loop<br /> anymore. If that is not what you want, then you cannot use redirects at<br /> all -- you would have to accelerate that other site for all requests<br /> instead and make sure that other site does not contain absolute URLs<br /> pointing the browser away from your reverse proxy.<br /> <br /> <br /> Disclaimer: I have not tested the above ideas and, again, I may be<br /> misinterpreting what you really want to achieve.<br /> <br /> Alex.<br /> _______________________________________________<br /> squid-users mailing list<br /> <a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br /> <mailto:<a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a>><br /> <a href="http://lists.squid-cache.org/listinfo/squid-users" target="_blank" rel="noopener noreferrer">http://lists.squid-cache.org/listinfo/squid-users</a></blockquote>
<br /> _______________________________________________<br /> squid-users mailing list<br /> <a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br /> <a href="http://lists.squid-cache.org/listinfo/squid-users" target="_blank" rel="noopener noreferrer">http://lists.squid-cache.org/listinfo/squid-users</a><br /> </blockquote>
<br /> _______________________________________________<br /> squid-users mailing list<br /> <a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br /> <a href="http://lists.squid-cache.org/listinfo/squid-users" target="_blank" rel="noopener noreferrer">http://lists.squid-cache.org/listinfo/squid-users</a></div>
</blockquote>
</body></html>