<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /></head><body style='font-size: 10pt; font-family: Verdana,Geneva,sans-serif'>
<p>Hi!,</p>
<p><br /></p>
<p>Thank you so much for all your effort. We have finally got it done by using a mixed solution. A script plus the Squid actual configured mode :)</p>
<p><br /></p>
<p>I wanted to thank really all your time because it has been like gold for me :) :)</p>
<p><br /></p>
<p>Bye mates!</p>
<p><br /></p>
<p>El 2019-03-05 18:48, Alex Rousskov escribió:</p>
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0"><!-- html ignored --><!-- head ignored --><!-- meta ignored -->
<div class="pre" style="margin: 0; padding: 0; font-family: monospace">On 3/5/19 9:59 AM, Egoitz Aurrekoetxea wrote:<br /> <br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">El 2019-03-05 17:45, Alex Rousskov escribió:
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">On 3/5/19 1:57 AM, Egoitz Aurrekoetxea wrote:<br /> <br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">I have Squid configured with the virus scanning software using ICAP and<br /> working. But, when I do :<br /> <br /> acl matchear_todo url_regex [-i] ^.*$</blockquote>
</blockquote>
</blockquote>
<br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">FYI: "[-i]" is documentation syntax that means an optional flag called<br /> "-i". If you want to use that "-i" flag, then type<br /> <br /> acl matchear_todo url_regex -i ^.*$<br /> <br /> ... but keep in mind that "-i" makes no sense when you regular<br /> expression does not contain small or capital characters. Adding "-i"<br /> would not change what URLs such a regular expression would match.</blockquote>
</blockquote>
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">I see... I though it was for matching case insensitively...</blockquote>
<br /> You thought correctly. The -i flag enables case insensitive matches<br /> indeed, but you are specifying that flag incorrectly (extra square<br /> brackets), and it makes no sense to specify it at all for your specific<br /> regular expression!<br /> <br /> <br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">http_reply_access deny matchear_todo<br /> deny_info <a href="http://172.16.8.61/redirigir.php?url=%s" target="_blank" rel="noopener noreferrer">http://172.16.8.61/redirigir.php?url=%s</a> matchear_todo</blockquote>
</blockquote>
</blockquote>
<br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">Why are you blocking based on URL instead of blocking based on the ICAP<br /> scan result? In your earlier specifications, you wanted to<br /> block/redirect only those transactions that were certified virus-free by<br /> your ICAP client. The above matchear_todo ACL does not do that.</blockquote>
</blockquote>
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">*That was an attempt of achieving my goal. Redirect requests to a php<br /> which does the request to a "next Squid" and then return one thing or<br /> another....*</blockquote>
</blockquote>
<br /> Sounds like you are asking about one thing and then testing/discussing<br /> another. Doing so makes helping you more difficult. Focus on making the<br /> simplest use case working first.<br /> <br /> <br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">Is it possible to be done from Squid side?</blockquote>
</blockquote>
<br /> Probably (as long as your ICAP service can signal clean/dirty status in<br /> a way Squid ACLs can detect). Since you appear to change the<br /> problem/goal, I am not sure what the answer to this question is.<br /> <br /> <br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">Or does the own ICAP implementation directly return a 3xx answer?</blockquote>
<br /> That works as well. In that case, you do not need deny_info tricks.<br /> <br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">Your ACL says nothing about "clean". It says "always". How does your<br /> ICAP service mark "clean" (or "dirty") HTTP responses? Your ACL needs to<br /> match that marking (or the absence of that marking).</blockquote>
</blockquote>
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">Could you give me a clue of how could I do it?</blockquote>
<br /> I cannot because I do not know what your ICAP service is capable of (and<br /> do not have the time to research that). For example, if your ICAP<br /> service can add an HTTP header to dirty HTTP responses, then you can use<br /> the corresponding Squid ACL to detect the presence of that header in the<br /> adapted response.<br /> <br /> Alex.<br /> <br /> <br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">El 2019-03-05 08:13, Alex Rousskov escribió:<br /> <br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">On 3/4/19 11:20 AM, Egoitz Aurrekoetxea wrote:<br /> <br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">Clients, will ask :<br /> <br /> <a href="https://oooeeee.eeee.ttt.thesquidserver.org/" target="_blank" rel="noopener noreferrer">https://oooeeee.eeee.ttt.thesquidserver.org/</a></blockquote>
<br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">So the answer [to the second question] I assume should be yes.</blockquote>
<br /> If I am interpreting your answers correctly, then your setup looks like<br /> a reverse proxy to me. In that case, you do not need SslBump and<br /> interception. You do need an web server certificate for the<br /> oooeeee.eeee.ttt.thesquidserver.org domain, issued by a well-trusted CA.<br /> Do you already have that?<br /> <br /> <br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">I have DNAT rules, for being able to<br /> redirect tcp/80 and tcp/443 to squid's port silently.</blockquote>
<br /> Please note that your current Squid configuration is not a reverse proxy<br /> configuration. It is an interception configuration. It also lacks<br /> https_port for handling port 443 traffic. There are probably some<br /> documents on Squid wiki (and/or elsewhere) explaining how to configure<br /> Squid to become a reverse proxy. Follow them.<br /> <br /> <br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">I wanted to setup a proxy machine which I wanted to be able to receive<br /> url like :<br /> <br /> - <a href="http://www.iou.net.theproxy.com/hj.php?ui=9" target="_blank" rel="noopener noreferrer">www.iou.net.theproxy.com/hj.php?ui=9</a><br /> <<a href="http://www.iou.net.theproxy.com/hj.php?ui=9" target="_blank" rel="noopener noreferrer">http://www.iou.net.theproxy.com/hj.php?ui=9</a>><br /> <<a href="http://www.iou.net.theproxy.com/hj.php?ui=9" target="_blank" rel="noopener noreferrer">http://www.iou.net.theproxy.com/hj.php?ui=9</a>><br /> <br /> If this site returns clean content (scanned by Icap server) the url<br /> redirector should return :<br /> <br /> - <a href="http://www.iou.net/hj.php?ui=9" target="_blank" rel="noopener noreferrer">www.iou.net/hj.php?ui=9</a> <<a href="http://www.iou.net/hj.php?ui=9" target="_blank" rel="noopener noreferrer">http://www.iou.net/hj.php?ui=9</a>><br /> <<a href="http://www.iou.net/hj.php?ui=9" target="_blank" rel="noopener noreferrer">http://www.iou.net/hj.php?ui=9</a>><br /> <<a href="http://www.iou.net/hj.php?ui=9" target="_blank" rel="noopener noreferrer">http://www.iou.net/hj.php?ui=9</a>> (the real<br /> url) as URL.</blockquote>
<br /> OK.<br /> <br /> <br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">- Is it possible with Squid to achieve my goal?. With Squid, a<br /> redirector, and a Icap daemon which performs virus scanning...</blockquote>
<br /> A redirector seems out of scope here -- it works on requests while you<br /> want to rewrite (scanned by ICAP) responses.<br /> <br /> It is probably possible to use deny_info to respond with a redirect<br /> message. To trigger a deny_info action, you would have to configure your<br /> Squid to block virus-free responses, which is rather strange!<br /> <br /> <br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">- For plain http the config and the URL seem to be working BUT the<br /> virus<br /> are not being scanned. Could the config be adjusted for that?.</blockquote>
<br /> <br /> I would start by removing the redirector, "intercept", SslBump, and<br /> disabling ICAP. Configure your Squid as a reverse proxy without any<br /> virus scanning. Then add ICAP. Get the virus scanning working without<br /> any URL manipulation. Once that is done, you can adjust Squid to block<br /> virus-free responses (via http_reply_access) and trigger a deny_info<br /> response containing an HTTP redirect.<br /> <br /> <br /> Please note that once the browser gets a redirect to another site, that<br /> browser is not going to revisit your reverse proxy for any content<br /> related to that other site -- all requests for that other site will go<br /> from the browser to that other site. Your proxy will not be in the loop<br /> anymore. If that is not what you want, then you cannot use redirects at<br /> all -- you would have to accelerate that other site for all requests<br /> instead and make sure that other site does not contain absolute URLs<br /> pointing the browser away from your reverse proxy.<br /> <br /> <br /> Disclaimer: I have not tested the above ideas and, again, I may be<br /> misinterpreting what you really want to achieve.<br /> <br /> Alex.<br /> _______________________________________________<br /> squid-users mailing list<br /> <a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br /> <mailto:<a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a>><br /> <mailto:<a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br /> <mailto:<a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a>>><br /> <a href="http://lists.squid-cache.org/listinfo/squid-users" target="_blank" rel="noopener noreferrer">http://lists.squid-cache.org/listinfo/squid-users</a></blockquote>
<br /> _______________________________________________<br /> squid-users mailing list<br /> <a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br /> <mailto:<a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a>><br /> <a href="http://lists.squid-cache.org/listinfo/squid-users" target="_blank" rel="noopener noreferrer">http://lists.squid-cache.org/listinfo/squid-users</a></blockquote>
<br /> _______________________________________________<br /> squid-users mailing list<br /> <a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br /> <mailto:<a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a>><br /> <a href="http://lists.squid-cache.org/listinfo/squid-users" target="_blank" rel="noopener noreferrer">http://lists.squid-cache.org/listinfo/squid-users</a></blockquote>
</blockquote>
</div>
</blockquote>
</body></html>