<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<div id="divtagdefaultwrapper" style="font-size: 12pt; color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, "EmojiFont", "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols;" dir="ltr">
<p>Solution:</p>
<p><br>
</p>
<p>It is the error message <span>'TCP_DENIED/200 0 CONNECT</span>' wich showed me the way.</p>
<p><br>
</p>
<p>Directive is too restrictive:</p>
<p><span>http_access deny CONNECT !SSL_ports</span></p>
</div>
<div style="font-size: 12pt; color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, "EmojiFont", "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols;" dir="ltr">
<br>
</div>
<div style="font-size: 12pt; color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, "EmojiFont", "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols;" dir="ltr">
It works now with:<br>
<span>http_access allow CONNECT safe_ports</span></div>
<div style="font-size: 12pt; color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, "EmojiFont", "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols;" dir="ltr">
<br>
</div>
<div style="font-size: 12pt; color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, "EmojiFont", "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols;" dir="ltr">
where safe ports are:</div>
<div style="font-size: 12pt; color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, "EmojiFont", "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols;" dir="ltr">
80, 443, 1025-65535 (maybe too large)<br>
<br>
<div style="color: rgb(0, 0, 0);">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>De :</b> squid-users <squid-users-bounces@lists.squid-cache.org> de la part de BOISIAUD Jean-Yves <jyboisiaud-ext@ecritel.net><br>
<b>Envoyé :</b> lundi 24 février 2025 16:38<br>
<b>À :</b> squid-users@lists.squid-cache.org<br>
<b>Objet :</b> [squid-users] ssl-bump with url_regex</font>
<div> </div>
</div>
<div>
<div id="divtagdefaultwrapper" dir="ltr" style="font-size: 12pt; color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, "EmojiFont", "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols;">
<div id="divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:rgb(0,0,0); font-family:Calibri,Helvetica,sans-serif,"EmojiFont","Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols">
<p>Hello,</p>
<p><br>
</p>
<p>I am using Squid 5.7 on a Debian 12 system.</p>
<p><br>
</p>
<p>I would like to grant only some given URL path for a site using HTTPS.</p>
<p><br>
</p>
<p>For example, in the following configuration:</p>
<p>...</p>
<div>http_port 3128 ssl-bump tcpkeepalive=60,30,3 \<br>
cert=/etc/squid/certs/signingCA.crt \<br>
key=/etc/squid/certs/signingCA.key \<br>
tls-cafile=/etc/squid/certs/chain.pem \<br>
generate-host-certificates=on \<br>
dynamic_cert_mem_cache_size=20MB \<br>
cipher=HIGH:MEDIUM:!LOW:!RC4:!SEED:!IDEA:!3DES:!MD5:!EXP:!PSK:!DSS \<br>
options=NO_TLSv1,NO_SSLv3 \<br>
tls-dh=prime256v1:/etc/squid/certs/dhparam.pem</div>
<br>
<p><span>acl intermediate_fetching transaction_initiator certificate-fetching</span><br>
</p>
<p><span>acl SSLBumpSites ssl::server_name <a href="http://www.example.com" class="OWAAutoLink" id="LPlnk41316" previewremoved="true">
www.example.com</a><br>
</span></p>
<p>acl server src 192.168.1.1</p>
<p>acl path urlpath_regex ^/valid_path/$</p>
<p>...</p>
<p>http_access allow src path</p>
<p>...</p>
<div>ssl_bump peek all<br>
ssl_bump bump SSLBumpSites<br>
ssl_bump slice all<br>
<br>
http_access deny all<br>
<br>
cache deny all</div>
<div><br>
</div>
<div>Works with http (curl <a href="http://www.example.com" class="OWAAutoLink" id="LPlnk94300" previewremoved="true">
http://www.example.com</a>/valid_path/):</div>
<div>- <span>TCP_MISS/200 467686 GET http://www.example.com/valid_path/ - HIER_DIRECT/151.101.122.132</span></div>
<div><br>
</div>
<div>Does not work with HTTPS (curl <a href="https://www.example.com/valid_path/" class="OWAAutoLink" id="LPlnk326313" previewremoved="true">
https://www.example.com/valid_path/</a>):<br>
</div>
<div>- TCP_DENIED/200 0 CONNECT www.example.com:443 - HIER_NONE/- - bump
<div>- NONE_NONE/403 3894 GET https://www.example.com/valid_path/ - HIER_NONE/- text/html -</div>
</div>
<br>
</div>
<div dir="ltr" style="font-size:12pt; color:rgb(0,0,0); font-family:Calibri,Helvetica,sans-serif,"EmojiFont","Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols">
Other https requests work fine:
<p>- <span>TCP_TUNNEL/200</span> - splice</p>
<p><br>
</p>
<p>What is wrong in my configuration ?</p>
<p><br>
</p>
<p>Thank you for your help.</p>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>