<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<div>Hi, <br></div><div>I've noticed one more difference between the CONNECT packets (it appears in the HTTP layer):<br></div><div><br></div><div>--> client's firefox configured with the ip and port of the parent proxy (172.16.103.254:3128), surf on the Net ok:<br></div><div><br></div><div>Frame 58: 255 bytes on wire (2040 bits), 255 bytes captured (2040 bits) on interface eth1, id 0<br></div><div>Ethernet II, Src: D-LinkIn_79:24:ed (ac:f1:df:79:24:ed), Dst: VMware_92:8a:f2 (00:0c:29:92:8a:f2)<br></div><div>Internet Protocol Version 4, Src: 172.16.103.101, Dst: 172.16.103.254<br></div><div>Transmission Control Protocol, Src Port: 35604, Dst Port: 3128, Seq: 1, Ack: 1, Len: 201<br></div><div>Hypertext Transfer Protocol<br></div><div> CONNECT <a href="http://www.google.com:443" rel="noopener noreferrer" target="_blank">www.google.com:443</a> HTTP/1.1\r\n<br></div><div> User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0\r\n<br></div><div> Proxy-Connection: keep-alive\r\n<br></div><div> Connection: keep-alive\r\n<br></div><div> Host: <a href="http://www.google.com:443\r\n" rel="noopener noreferrer" target="_blank">www.google.com:443\r\n</a><br></div><div> \r\n<br></div><div> [Full request URI: <a href="http://www.google.com:443" rel="noopener noreferrer" target="_blank">www.google.com:443</a>]<br></div><div> [HTTP request 1/1]<br></div><div> [Response in frame: 62]<br></div><div><br></div><div><br></div><div>--> client's firefox configured to use system proxy settings (can't surf on the Net):<br></div><div><br></div><div>Frame 620: 295 bytes on wire (2360 bits), 295 bytes captured (2360 bits) on interface eth1, id 0<br></div><div>Ethernet II, Src: D-LinkIn_79:24:ed (ac:f1:df:79:24:ed), Dst: VMware_92:8a:f2 (00:0c:29:92:8a:f2)<br></div><div>Internet Protocol Version 4, Src: 172.16.103.101, Dst: 172.16.103.254<br></div><div>Transmission Control Protocol, Src Port: 35528, Dst Port: 3128, Seq: 1, Ack: 1, Len: 241<br></div><div>Hypertext Transfer Protocol<br></div><div> CONNECT <a href="http://www.google.com:443" rel="noopener noreferrer" target="_blank">www.google.com:443</a> HTTP/1.1\r\n<br></div><div> User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0\r\n<br></div><div> Host: <a href="http://www.google.com:443\r\n" rel="noopener noreferrer" target="_blank">www.google.com:443\r\n</a><br></div><div> Via: 1.1 tjener.intern (squid/4.6)\r\n<br></div><div> X-Forwarded-For: 10.0.2.2\r\n -> request field introduit par squid<br></div><div> Cache-Control: max-age=259200\r\n -> si on vire le cache dans la config, tjs là ?<br></div><div> \r\n<br></div><div> [Full request URI: <a href="http://www.google.com:443" rel="noopener noreferrer" target="_blank">www.google.com:443</a>]<br></div><div> [HTTP request 1/1]<br></div><div> [Response in frame: 624]<br></div><div><br></div><div><br></div><div>Remarks: tjener.inter is my server with squid (172.16.103.101) and 172.16.103.254:3128 is the parent.<br></div><div> 10.0.2.2 is the IP of the client.<br></div><div><br></div><div>If you have any idea to help me to fix this ....<br></div><div><br></div><div>Thanks for your answer.<br></div><div><br></div><div>Yannick<br></div><div>-- <br></div><div>Securely sent with Tutanota. Get your own encrypted, ad-free mailbox: <br></div><div>https://tutanota.com<br></div><div><br></div><div><br></div><div>Jun 26, 2020, 07:11 by squid3@treenet.co.nz:<br></div><blockquote class="tutanota_quote" style="border-left: 1px solid #93A3B8; padding-left: 10px; margin-left: 5px;"><div>On 24/06/20 7:27 am, yannick.rousseau@tutanota.com wrote:<br></div><blockquote><div>Hi, <br></div><div><br></div><div>I'm using squid (4.6) on my server (debianedu buster LTSP), and I'm<br></div><div>trying to configure a parent proxy.<br></div><div><br></div><div>At first, when I configure the client's firefox (manual proxy<br></div><div>configuration) with the ip and port of the parent proxy, it's ok, I can<br></div><div>surf on the internet. <br></div><div><br></div><div>But I would like to configure my server's Squid Proxy to forward to a<br></div><div>parent proxy (172.16.103.254:3128)<br></div><div>-> So I add these two lines at the end of squid.conf:<br></div><div>cache_peer 172.16.103.254 parent 3128 0 no-query no-digest<br></div><div>never_direct allow all<br></div><div><br></div><div>-> And restart squid. It seems to be ok:<br></div><div># cat /var/log/squid/cache.log<br></div><div>(.....)<br></div><div>2020/06/23 09:51:12 kid1| Configuring Parent 172.16.103.254/3128/0<br></div><div>(....)<br></div><div><br></div><div>-> Then I configure firefox to use system proxy settings, but when I try<br></div><div>to google something or visit debian-fr.org, it doesn't work (no reponse<br></div><div>from the proxy).<br></div></blockquote><div><br></div><div>That is odd. The log shows a 403 response being delivered by the parent<br></div><div>proxy and delivered to Firefox.<br></div><div><br></div><div>Browsers refuse to display proxy responses on CONNECT requests. So the<br></div><div>first is expected. But the second one using http:// should be shown.<br></div><div><br></div><blockquote><div>But my squid's configuration seems to be ok:<br></div><div># cat /var/log/squid/access.log<br></div><div>(....)<br></div><div>1592921221.753 138 10.0.2.2 TCP_TUNNEL/403 361<br></div><div>CONNECT www.google.com:443 <http://www.google.com:443/> -<br></div><div>FIRSTUP_PARENT/172.16.103.254 -<br></div><div>1592921275.641 521 10.0.2.2 TCP_MISS/403 4289<br></div><div>GET http://www.debian-fr.org/ - FIRSTUP_PARENT/172.16.103.254 text/html<br></div><div>1592921275.692 0 10.0.2.2 TCP_HIT/200 13072 GET<br></div><div>(...)<br></div><div><br></div><div>Is it possible that the squid parent refuse to have "a child" ?<br></div></blockquote><div><br></div><div>Maybe. You will need to know the parent proxy configuration to tell<br></div><div>that. All that is visible from the detail you have shown is that parent<br></div><div>proxy has forbidden the requests it is receiving.<br></div><div><br></div><div><br></div><div>Amos<br></div><div>_______________________________________________<br></div><div>squid-users mailing list<br></div><div>squid-users@lists.squid-cache.org<br></div><div>http://lists.squid-cache.org/listinfo/squid-users<br></div></blockquote><div><br></div> </body>
</html>