Re: [squid-users] Change cipher suite ordering

2021-01-18 Thread vinod mg
I have been trying to make this work but still no luck, Any help is appreciated. Thanks, Vinod On Tue, Jan 12, 2021 at 4:34 PM vinod mg wrote: > Hi Amos, > > Thanks for responding, really appreciate the quick response. > > So yes if squid can mimic exactly what client is sending that all I am

Re: [squid-users] Peer selection based on IP with multiple ports?

2021-01-18 Thread Alex Rousskov
On 1/16/21 7:52 AM, roee klinger wrote: > I am using Squid to route users to different peers based on their > usernames, I was asked to add support for IP whitelisting recently but I > ran into an issue.  > > If one IP wants to access to different peers, I will have to do it based > on on the

Re: [squid-users] sslcrtvalidator_program

2021-01-18 Thread Amos Jeffries
On 19/01/21 5:53 am, Eliezer Croitoru wrote: Hey Alex, I have tried to read the documentation and to compose a single certificate validation "call" or "request". The issue with this is that I am unable to do that. It would help a lot if a single verification request would be public and

Re: [squid-users] Trying to verify couple tls issues

2021-01-18 Thread Amos Jeffries
On 19/01/21 6:04 am, Eliezer Croitoru wrote: I wrote the next "helping/helper/testing scripts": https://github.com/elico/tls-check-script/blob/master/tls-check.rb https://github.com/elico/tls-check-script/blob/master/check-dns-san.sh Now I am trying to verify what issues exists that causes

Re: [squid-users] What is this access.log line?

2021-01-18 Thread Alex Rousskov
On 1/18/21 12:45 PM, Eliezer Croitoru wrote: > While testing 5.0.4 I am seeing this line: > > 1610991736.039  0 192.168.189.48 NONE_NONE/400 3798 CNT > error:invalid-request - HIER_NONE/- text/html – > > What is the CNT means? If you see CNT where the request method usually is, then these

Re: [squid-users] sslcrtvalidator_program

2021-01-18 Thread Alex Rousskov
On 1/18/21 11:53 AM, Eliezer Croitoru wrote: > I have tried to read the documentation and to compose a single certificate > validation "call" or "request". > It would help a lot if a single verification request would be public and > available to me and maybe others. As I said, please feel

[squid-users] What is this access.log line?

2021-01-18 Thread Eliezer Croitoru
While testing 5.0.4 I am seeing this line: 1610991736.039 0 192.168.189.48 NONE_NONE/400 3798 CNT error:invalid-request - HIER_NONE/- text/html - I was thinking about adding to the log line the incoming port ie either intercept plain http port 80 or the ssl-bump port. What is the CNT

[squid-users] Trying to verify couple tls issues

2021-01-18 Thread Eliezer Croitoru
I wrote the next "helping/helper/testing scripts": https://github.com/elico/tls-check-script/blob/master/tls-check.rb https://github.com/elico/tls-check-script/blob/master/check-dns-san.sh Now I am trying to verify what issues exists that causes squid to this result: 2021/01/18 18:54:47 kid1|

Re: [squid-users] Making destination IP available in ICAP REQMOD request

2021-01-18 Thread Alex Rousskov
On 1/17/21 5:28 PM, Moti Berger wrote: > I couldn't figure out a way to start the DNS resolving just before > the startAdaptation starts as it requires all sorts of objects that seem > to be unavailable there. Please ask development questions on squid-dev:

Re: [squid-users] sslcrtvalidator_program

2021-01-18 Thread Eliezer Croitoru
Hey Alex, I have tried to read the documentation and to compose a single certificate validation "call" or "request". The issue with this is that I am unable to do that. It would help a lot if a single verification request would be public and available to me and maybe others. The example shows:

Re: [squid-users] Adding headers in ICAP server with no preview

2021-01-18 Thread Alex Rousskov
On 1/18/21 6:45 AM, Moti Berger wrote: > If the ICAP server sets 'Preview: 0' in the OPTIONS it means that when > the ICAP client sends a request, it should not contain the body. The above summary may mislead many readers. I would describe the protocol operation differently: * Preview in an

Re: [squid-users] Adding headers in ICAP server with no preview

2021-01-18 Thread NgTech LTD
I assume that a null body is based on the logic that the icap client knows the progress and the icap details enough to only modify the headers. it should be tested. I tried to test it but im busy to test it right now. Eliezer On Mon, Jan 18, 2021, 13:46 Moti Berger wrote: > Hi > > If the ICAP

Re: [squid-users] Adding headers in ICAP server with no preview

2021-01-18 Thread Moti Berger
Hi If the ICAP server sets 'Preview: 0' in the OPTIONS it means that when the ICAP client sends a request, it should not contain the body. This is the REQMOD request: > F..n...DREQMOD icap://censor-req.proxy:14590/request ICAP/1.0 > Host: censor-req.proxy:14590 > Date: Mon, 18 Jan 2021 11:34:54

Re: [squid-users] Adding headers in ICAP server with no preview

2021-01-18 Thread Eliezer Croitoru
Hey Moti, I had an example on my local git which also works with gzip and other stuff for BGU however I cannot find it now. >From what I remember this worked with POST but only like an external acl >helper. Ie blocking or allowing OK/ERR: https://github.com/elico/drbl-icap-service Any