Package: squid
Version: 4.9-2~bpo10+1
Severity: important

Delay pools do not work when using https. Http the restriction works. Https without sslbump does not work.
The problem is present in buster and sid.

I check as follows:
export http_proxy=""
export https_proxy=""

wget -O /dev/null

-- System Information:
Debian Release: 10.2
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.19.0-6-amd64 (SMP w/4 CPU cores)
Locale: LANG=ru_RU.UTF-8, LC_CTYPE=ru_RU.UTF-8 (charmap=UTF-8), LANGUAGE=ru_RU.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages squid depends on:
ii  adduser                  3.118
ii  libc6                    2.28-10
ii  libcap2                  1:2.25-2
ii  libcom-err2              1.44.5-1+deb10u2
ii  libdb5.3                 5.3.28+dfsg1-0.5
ii  libdbi-perl              1.642-1+b1
ii  libecap3                 1.0.1-3.2
ii  libexpat1                2.2.6-2+deb10u1
ii  libgcc1                  1:8.3.0-6
ii  libgssapi-krb5-2         1.17-3
ii  libkrb5-3                1.17-3
ii  libldap-2.4-2            2.4.47+dfsg-3+deb10u1
ii  libltdl7                 2.4.6-9
ii  libnetfilter-conntrack3  1.0.7-1
ii  libnettle6               3.4.1-1
ii  libpam0g                 1.3.1-5
ii  libsasl2-2               2.1.27+dfsg-1
ii  libssl1.1                1.1.1d-0+deb10u2
ii  libstdc++6               8.3.0-6
ii  libxml2                  2.9.4+dfsg1-7+b3
ii  logrotate                3.14.0-4
ii  lsb-base                 10.2019051400
ii  netbase                  5.6
ii  squid-common             4.9-2~bpo10+1

Versions of packages squid recommends:
ii  ca-certificates  20190110
ii  libcap2-bin      1:2.25-2

Versions of packages squid suggests:
ii  apparmor     2.13.2-10
pn  resolvconf   <none>
pn  smbclient    <none>
pn  squid-cgi    <none>
pn  squid-purge  <none>
pn  squidclient  <none>
pn  ufw          <none>
pn  winbind      <none>

-- Configuration Files:
/etc/squid/squid.conf changed
acl localnet src  # RFC 1122 "this" network (LAN)
acl localnet src             # RFC 1918 local private network (LAN)
acl localnet src          # RFC 6598 shared address space (CGN)
acl localnet src # RFC 3927 link-local (directly plugged) machines
acl localnet src          # RFC 1918 local private network (LAN)
acl localnet src         # RFC 1918 local private network (LAN)
acl localnet src fc00::/7               # RFC 4193 local private network range
acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines
acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl yandex dstdomain
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access allow localnet
http_access deny manager
include /etc/squid/conf.d/*
http_access allow localhost
http_access deny all
http_port 3128
strip_query_terms off
coredump_dir /var/spool/squid
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern .               0       20%     4320
delay_pools 1
delay_class 1 2
delay_access 1 allow yandex
delay_access 1 deny all
delay_parameters 1 32000/32000 16000/32000
always_direct allow all

-- no debconf information

Reply via email to