<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p><br>
</p>
<span style="white-space: pre-wrap">
</span>
<blockquote type="cite"
cite="mid:mailman.984.1712206107.1200.squid-users@lists.squid-cache.org">
<pre class="moz-quote-pre" wrap="">Date: Wed, 3 Apr 2024 11:05:02 -0400
From: Alex Rousskov <a class="moz-txt-link-rfc2396E" href="mailto:rousskov@measurement-factory.com"><rousskov@measurement-factory.com></a>
To: <a class="moz-txt-link-abbreviated" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a>
Subject: Re: [squid-users] Chrome auto-HTTPS-upgrade - not falling to
http
Message-ID:
<a class="moz-txt-link-rfc2396E" href="mailto:e8845677-fe34-439a-9bfe-4a0b2aa3461a@measurement-factory.com"><e8845677-fe34-439a-9bfe-4a0b2aa3461a@measurement-factory.com></a>
Content-Type: text/plain; charset=UTF-8; format=flowed
On 2024-04-03 02:14, Lou?ansk? Luk?? wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">this has recently started me up more then let it go. For a while
chrome is upgrading in-page links to https.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">Just to add two more pieces of related information to this thread:
Some Squid admins report that their v6-based code does not suffer from
this issue while their v5-based code does. I have not verified those
reports, but there may be more to the story here. What Squid version are
_you_ using?
One way to track progress with this annoying and complex issue is to
follow the following pull request. The current code cannot be officially
merged as is, and I would not recommend using it in production (because
of low-level bugs that will probably crash Squid in some cases), but
testing it in the lab and providing feedback to authors may be useful:
<a class="moz-txt-link-freetext" href="https://github.com/squid-cache/squid/pull/1668">https://github.com/squid-cache/squid/pull/1668</a>
HTH,
Alex.
</pre>
<br>
</blockquote>
<p><br>
</p>
<p>Hello,</p>
<p>fortunately, I do not observe this problem accessing sites
running only on port 80 (no 443 at all), but my configuration is
simple:</p>
<p>squid 6.6 as FreeBSD binary package<br>
<br>
not much about ssl in the config file though, just passing it
through, no ssl juggling<br>
</p>
<p>acl SSL_ports port<br>
acl Safe_ports port 80<br>
acl Safe_ports port 443<br>
acl CONNECT method CONNECT<br>
http_access deny !Safe_ports<br>
http_access deny CONNECT !SSL_ports<br>
http_access deny to_localhost<br>
http_access allow ....<br>
http_access allow ....<br>
http_access allow ....<br>
http_access allow ....<br>
http_access allow ....<br>
http_access deny all<br>
</p>
<p>I don't think it was different with squid 5.9, which I used till
November 2023.<br>
</p>
<p>Occasionally, I see another problem, which may or may not be
related to squid ssl handling configuration: PR_END_OF_FILE_ERROR
(Firefox) / ERR_CONNECTION_CLOSED (Chrome), typically accessing
samba.org. But they use permanent redirect from http to https, so
it another situation than http-only site.<br>
</p>
<p>David</p>
<p><br>
</p>
</body>
</html>