Re: [squid-dev] [PATCH] initial GnuTLS support for encrypted server connections

2017-02-04 Thread Alex Rousskov
On 02/04/2017 12:31 PM, Amos Jeffries wrote: > On 3/02/2017 4:05 a.m., Alex Rousskov wrote: >> On 02/01/2017 11:51 PM, Amos Jeffries wrote: >> >>> Can we agree on this being a fundamental design in Squid: >>> >>> * all connections have an associated socket ID. >> >> That assumption would be too

Re: [squid-dev] [PATCH] initial GnuTLS support for encrypted server connections

2017-02-04 Thread Amos Jeffries
On 3/02/2017 4:05 a.m., Alex Rousskov wrote: > On 02/01/2017 11:51 PM, Amos Jeffries wrote: > >> Can we agree on this being a fundamental design in Squid: >> >> * all connections have an associated socket ID. > > That assumption would be too limiting (and, AFAICT, unnecessary). For > example,

Re: [squid-dev] [PATCH] Bump SSL client on [more] errors encountered before ssl_bump evaluation

2017-02-04 Thread Amos Jeffries
On 4/02/2017 8:27 a.m., Christos Tsantilas wrote: > ... such as ERR_ACCESS_DENIED with HTTP/403 Forbidden triggered by an > http_access deny rule match. > > The old code allowed ssl_bump step1 rules to be evaluated in the > presence of an error. An ssl_bump splicing decision would then trigger >