<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi Alex,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks for the quick response.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Regarding proxy_protocol - is there a known patch for v4 I could use by any chance?</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Regarding icap, I suppose the acl is getting evaluated before the icap and that is why they aren't available<span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">:</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
external_acl_type TransactionClassificator \
<div> concurrency=0 \</div>
<div> children-max=2 \</div>
<div> ttl=60 \</div>
<div> %ssl::>sni \</div>
<div> /usr/local/squid/bin/classify-transaction.sh</div>
<div><br>
</div>
<div>acl classifyRequest external TransactionClassificator<br>
</div>
<div><br>
</div>
<div>acl step1 at_step SslBump1<br>
</div>
<div>acl step2 at_step SslBump2</div>
<div><br>
</div>
<div>ssl_bump peek step1</div>
<div>ssl_bump splice step2 classifyRequest</div>
<div>ssl_bump stare all</div>
<span>ssl_bump bump all</span><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Frida</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Alex Rousskov <rousskov@measurement-factory.com><br>
<b>Sent:</b> Sunday, June 13, 2021 17:46<br>
<b>To:</b> squid-users@lists.squid-cache.org <squid-users@lists.squid-cache.org><br>
<b>Cc:</b> Frida Safran <fsafran@proofpoint.com><br>
<b>Subject:</b> Re: [squid-users] Passing Proxy Protocol Headers to external ACL</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">On 6/13/21 7:31 AM, Frida Safran wrote:<br>
<br>
> 1. Is it possible to pass proxy protocol headers to an external acl as<br>
> part of the format?<br>
<br>
It should be possible. Use %proxy_protocol::>h logformat %code in your<br>
external_acl_type FORMAT configuration. We added that support to Squid<br>
v5. Not available in the official v4.<br>
<br>
<br>
> 2. Is it possible to pass all/specific icap headers to an external acl?<br>
> I have been trying to use %icap::>h to pass all the icap headers to<br>
> an external acl, but it resolves to "-"<br>
<br>
It should be possible if your external ACL is evaluated _after_ the<br>
corresponding ICAP headers are received, but I would not be surprised if<br>
there are bugs in this area -- the ICAP headers may be available but not<br>
provided to the ACL evaluation code. Which squid.conf directive is<br>
triggering your external ACL evaluation in this use case?<br>
<br>
<br>
HTH,<br>
<br>
Alex.<br>
</div>
</span></font></div>
</body>
</html>