<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi Alex,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
In addition to using an external acl to annotate connections and decide whether splice/bump, I would like to try using an ecap service to achieve this.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I would like to create an acl using info from the ecap service, and bump/splice using the following configuration:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="margin:0px;font-size:12pt"><span style="margin:0px;background-color:rgb(255, 255, 255);display:inline !important">acl classifyRequest note splice yes</span></span><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<div style="margin:0px;font-size:12pt;color:black;background-color:rgb(255, 255, 255)">
<div style="margin:0px">acl step1 at_step SslBump1<br>
</div>
<div style="margin:0px">acl step2 at_step SslBump2</div>
<div style="margin:0px"><br>
</div>
<div style="margin:0px">ssl_bump peek step1</div>
<div style="margin:0px">ssl_bump splice step2 classifyRequest</div>
<div style="margin:0px">ssl_bump stare all</div>
<span style="margin:0px">ssl_bump bump all</span><br>
</div>
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
If I set a custom option from within the ecap service, can i use that via the above note acl? Can i set a custom option without setting it in 'adaptation_masterx_shared_names', as I already have another one there already, and it only supports one name?</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Or, should I instead use:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
acl classifyRequest note %adapt::<last_h{splice} yes<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
In this case should I set a custom header from within the ecap via: <span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">adapted->header().add</span><span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">,
or use the visitEachOption() method?</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Frida</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Alex Rousskov <rousskov@measurement-factory.com><br>
<b>Sent:</b> Monday, June 14, 2021 16:24<br>
<b>To:</b> squid-users@lists.squid-cache.org <squid-users@lists.squid-cache.org><br>
<b>Cc:</b> Frida Safran <fsafran@proofpoint.com><br>
<b>Subject:</b> Re: [squid-users] Passing Proxy Protocol Headers to external ACL</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">On 6/14/21 2:29 AM, Frida Safran wrote:<br>
<br>
> Regarding proxy_protocol - is there a known patch for v4 I could use by<br>
> any chance?<br>
<br>
I am not aware of any such patches. The changes were significant, fixing<br>
many PROXY protocol handling bugs. Virtually anything can be backported,<br>
but it would be a large effort with noticeable stability risks and<br>
long-term maintenance overheads. Preparing for a v5 upgrade may be a<br>
better strategy in this particular case.<br>
<br>
<br>
> Regarding icap, I suppose the acl is getting evaluated before the icap<br>
> and that is why they aren't available:<br>
<br>
> acl classifyRequest external TransactionClassificator<br>
> ssl_bump peek step1<br>
> ssl_bump splice step2 classifyRequest<br>
> ssl_bump stare all<br>
> ssl_bump bump all<br>
<br>
According to [1], the above configuration should result in two ICAP<br>
REQMOD requests (if configured) before classifyRequest is consulted<br>
during step2. I am aware of SslBump bugs in that area, but I would<br>
expect at least one ICAP REQMOD request anyway. The requests<br>
existence/timing should be easy to confirm using cache.log with<br>
debug_options set to at least "ALL,3 82,9 93,9" and/or a logging or<br>
pausing external ACL script in combination with an icap_log (to compare<br>
logged timestamps).<br>
<br>
[1] <a href="https://urldefense.com/v3/__https://wiki.squid-cache.org/Features/SslPeekAndSplice__;!!ORgEfCBsr282Fw!6SDlCpq2n2kV1WuiNQ7focWt2YMDj-Xs9aEp29dC32pwZUHSLIkrD7dnojPghFBhQQ$">
https://urldefense.com/v3/__https://wiki.squid-cache.org/Features/SslPeekAndSplice__;!!ORgEfCBsr282Fw!6SDlCpq2n2kV1WuiNQ7focWt2YMDj-Xs9aEp29dC32pwZUHSLIkrD7dnojPghFBhQQ$</a>
<br>
<br>
<br>
HTH,<br>
<br>
Alex.<br>
<br>
<br>
> ------------------------------------------------------------------------<br>
> *From:* Alex Rousskov <rousskov@measurement-factory.com><br>
> *Sent:* Sunday, June 13, 2021 17:46<br>
> *To:* squid-users@lists.squid-cache.org <squid-users@lists.squid-cache.org><br>
> *Cc:* Frida Safran <fsafran@proofpoint.com><br>
> *Subject:* Re: [squid-users] Passing Proxy Protocol Headers to external ACL<br>
> <br>
> On 6/13/21 7:31 AM, Frida Safran wrote:<br>
> <br>
>> 1. Is it possible to pass proxy protocol headers to an external acl as<br>
>> part of the format?<br>
> <br>
> It should be possible. Use %proxy_protocol::>h logformat %code in your<br>
> external_acl_type FORMAT configuration. We added that support to Squid<br>
> v5. Not available in the official v4.<br>
> <br>
> <br>
>> 2. Is it possible to pass all/specific icap headers to an external acl?<br>
>> I have been trying to use %icap::>h to pass all the icap headers to<br>
>> an external acl, but it resolves to "-"<br>
> <br>
> It should be possible if your external ACL is evaluated _after_ the<br>
> corresponding ICAP headers are received, but I would not be surprised if<br>
> there are bugs in this area -- the ICAP headers may be available but not<br>
> provided to the ACL evaluation code. Which squid.conf directive is<br>
> triggering your external ACL evaluation in this use case?<br>
> <br>
> <br>
> HTH,<br>
> <br>
> Alex.<br>
<br>
</div>
</span></font></div>
</body>
</html>