________________________________ From: Amos Jeffries <squid3@xxxxxxxxxxxxx> > > http_access allow goodAgents !baddomains (AND) > > If the first line matches the allow happens. > otherwise deny happens > > ie. goodAgents are only allowed to non-baddomains. All non-goodAgents > are denied to everything. >From this I deduce that in my case I cannot use "http_access allow goodAgents", but I need to go for "http_access deny !goodAgents" so I can continue on evaluating the rest of my http_access rules. > Allowing them all the way through Squid is bad. But that is not what is > needed here. ssl_bump rules get applied after the CONNECT is accepted > *in* for proxy processing and they decide what happens to the tunneled > data based on what is found there. > If bumping is decided the TLS gets removed and the messages inside > individually go through the http_access process. You lost me there. Here's what I did today. I took your advice (and Alex's), and renamed my ACL labels. Unfortunately, I'm still a little confused :-(. Here's part of the new Squid config (I took away the "allow all connect messages"): # grep -v ^# /etc/squid/squid.test.include.rules | grep -v ^$ external_acl_type nt_group ttl=0 children-max=50 %LOGIN /usr/libexec/squid/ext_wbinfo_group_acl -K auth_param negotiate program /usr/libexec/squid/negotiate_kerberos_auth -s HTTP/proxy-server1.mydomain.org@xxxxxxxxxxxx auth_param negotiate children 60 auth_param negotiate keep_alive on acl localnet src 10.0.0.0/8 acl localnet src 192.168.0.0/16 acl ORG_all proxy_auth REQUIRED external_acl_type bllookup ttl=86400 negative_ttl=86400 children-max=80 children-startup=10 children-idle=3 concurrency=8 %PROTO %DST %PORT %PATH /opt/custom/scripts/run/scripts/firewall/ext_sql_blwl_acl.pl --table=shallalist_bl --categories=adv,aggressive,alcohol,anonvpn,automobile_bikes,automobile_boats,automobile_cars,automobile_planes,chat,costtraps,dating,drugs,dynamic,finance_insurance,finance_moneylending,finance_other,finance_realestate,finance_trading,fortunetelling,forum,gamble,hacking,hobby_cooking,hobby_games-misc,hobby_games-online,hobby_gardening,hobby_pets,homestyle,imagehosting,isp,jobsearch,military,models,movies,music,podcasts,politics,porn,radiotv,recreation_humor,recreation_martialarts,recreation_restaurants,recreation_sports,recreation_travel,recreation_wellness,redirector,religion,remotecontrol,ringtones,science_astronomy,science_chemistry,sex_education,sex_lingerie,shopping,socialnet,spyware,tracker,updatesites,urlshortener,violence,warez,weapons,webphone,webradio,webtv acl privileged_src_ips src "/opt/custom/proxy-settings/allowed.ips" acl privileged_extra1_src_ips src "/opt/custom/proxy-settings/allowed.extra1.ips" acl privileged_user_groups external nt_group "/opt/custom/proxy-settings/allowed.groups" acl good_dst_domains dstdomain "/opt/custom/proxy-settings/allowed.domains" acl good_dst_domains_with_any_filetype dstdomain "/opt/custom/proxy-settings/allowed.domains.filetypes" acl good_dst_domains_with_any_mimetype dstdomain "/opt/custom/proxy-settings/allowed.domains.mimetypes" acl bad_dst_domains dstdomain -i "/opt/custom/proxy-settings/denied.domains" acl limited_dst_domains_1 dstdomain -i "/opt/custom/proxy-settings/denied.extra1.domains" acl bad_ads url_regex "/opt/custom/proxy-settings/denied.ads" acl bad_filetypes urlpath_regex -i "/opt/custom/proxy-settings/denied.filetypes" acl bad_requested_mimetypes req_mime_type -i "/opt/custom/proxy-settings/denied.mimetypes" acl limited_requested_mimetypes_1 req_mime_type -i "/opt/custom/proxy-settings/denied.extra1.mimetypes" acl bad_replied_mimetypes rep_mime_type -i "/opt/custom/proxy-settings/denied.mimetypes" acl limited_replied_mimetypes_1 rep_mime_type -i "/opt/custom/proxy-settings/denied.extra1.mimetypes" acl restricted_requested_mimetypes_1 req_mime_type -i "/opt/custom/proxy-settings/denied.restricted1.mimetypes" acl restricted_replied_mimetypes_1 rep_mime_type -i "/opt/custom/proxy-settings/denied.restricted1.mimetypes" acl restricted_good_dst_domains_1 dstdomain -i "/opt/custom/proxy-settings/allowed.restricted1.domains" acl restricted_src_ips_1 dst "/opt/custom/proxy-settings/allowed.restricted1.ips" acl explicit_only_src_ips src "/opt/custom/proxy-settings/restricted.ips" acl explicit_only_user_groups external nt_group "/opt/custom/proxy-settings/restricted.groups" acl explicit_only_dst_domains dstdomain "/opt/custom/proxy-settings/restricted.domains" acl bl_lookup external bllookup acl bad_urlshorteners dstdomain -i "/etc/squidGuard/db/HMANshallalist/urlshortener/domains" acl redirected_domain_1 dstdomain .somedomain.com acl good_useragents browser Firefox/ acl good_useragents browser Edge/ acl src_ips_with_any_useragent src "/opt/custom/proxy-settings/allowed.useragents.ips" http_access deny explicit !ORG_all http_access deny explicit SSL_ports http_access deny intercepted !localnet http_access deny interceptedssl !localnet http_access deny !good_useragents !src_ips_with_any_useragent deny_info http://proxy-server1/proxy-error/?a=%a&B=%B&e=%e&E=%E&H=%H&i=%i&M=%M&o=%o&R=%R&T=%T&U=%U&u=%u&w=%w&x=%x&acl=bad_useragents good_useragents deny_info http://proxy-server1/proxy-error/?a=%a&B=%B&e=%e&E=%E&H=%H&i=%i&M=%M&o=%o&R=%R&T=%T&U=%U&u=%u&w=%w&x=%x&acl=bad_useragents src_ips_with_any_useragent http_access allow localnet !explicit_only_src_ips good_dst_domains http_access allow localnet !explicit_only_src_ips privileged_src_ips http_reply_access allow localnet !explicit_only_src_ips privileged_src_ips http_reply_access allow localnet !explicit_only_src_ips good_dst_domains http_access allow explicit_only_src_ips explicit_only_dst_domains http_access deny explicit_only_src_ips http_access deny redirected_domain_1 deny_info 302:http://www.google.es redirected_domain_1 http_access deny !privileged_src_ips bad_urlshorteners deny_info http://proxy-server1/proxy-error/?a=%a&B=%B&e=%e&E=%E&H=%H&i=%i&M=%M&o=%o&R=%R&T=%T&U=%U&u=%u&w=%w&x=%x&acl=bad_urlshorteners bad_urlshorteners http_access allow restricted_requested_mimetypes_1 restricted_good_dst_domains_1 http_access allow restricted_requested_mimetypes_1 restricted_src_ips_1 http_reply_access allow restricted_replied_mimetypes_1 restricted_good_dst_domains_1 http_reply_access allow restricted_replied_mimetypes_1 restricted_src_ips_1 http_access allow limited_requested_mimetypes_1 privileged_extra1_src_ips limited_dst_domains_1 http_reply_access allow limited_replied_mimetypes_1 privileged_extra1_src_ips limited_dst_domains_1 http_access deny restricted_requested_mimetypes_1 http_reply_access deny restricted_replied_mimetypes_1 deny_info http://proxy-server1/proxy-error/?a=%a&B=%B&e=%e&E=%E&H=%H&i=%i&M=%M&o=%o&R=%R&T=%T&U=%U&u=%u&w=%w&x=%x&acl=bad_mimetypes restricted_replied_mimetypes_1 deny_info http://proxy-server1/proxy-error/?a=%a&B=%B&e=%e&E=%E&H=%H&i=%i&M=%M&o=%o&R=%R&T=%T&U=%U&u=%u&w=%w&x=%x&acl=bad_mimetypes restricted_requested_mimetypes_1 http_access deny limited_requested_mimetypes_1 http_reply_access deny limited_replied_mimetypes_1 deny_info http://proxy-server1/proxy-error/?a=%a&B=%B&e=%e&E=%E&H=%H&i=%i&M=%M&o=%o&R=%R&T=%T&U=%U&u=%u&w=%w&x=%x&acl=bad_mimetypes limited_requested_mimetypes_1 deny_info http://proxy-server1/proxy-error/?a=%a&B=%B&e=%e&E=%E&H=%H&i=%i&M=%M&o=%o&R=%R&T=%T&U=%U&u=%u&w=%w&x=%x&acl=bad_mimetypes limited_replied_mimetypes_1 http_access deny !privileged_src_ips bad_dst_domains deny_info http://proxy-server1/proxy-error/?a=%a&B=%B&e=%e&E=%E&H=%H&i=%i&M=%M&o=%o&R=%R&T=%T&U=%U&u=%u&w=%w&x=%x&acl=bad_dst_domains bad_dst_domains http_access allow privileged_extra1_src_ips limited_dst_domains_1 http_access deny limited_dst_domains_1 deny_info http://proxy-server1/proxy-error/?a=%a&B=%B&e=%e&E=%E&H=%H&i=%i&M=%M&o=%o&R=%R&T=%T&U=%U&u=%u&w=%w&x=%x&acl=limited_dst_domains_1 limited_dst_domains_1 http_access deny bad_filetypes !good_dst_domains_with_any_filetype http_reply_access deny bad_filetypes !good_dst_domains_with_any_filetype deny_info http://proxy-server1/proxy-error/?a=%a&B=%B&e=%e&E=%E&H=%H&i=%i&M=%M&o=%o&R=%R&T=%T&U=%U&u=%u&w=%w&x=%x&acl=bad_filetypes bad_filetypes http_access deny bad_requested_mimetypes !good_dst_domains_with_any_mimetype http_reply_access deny bad_replied_mimetypes !good_dst_domains_with_any_mimetype deny_info http://proxy-server1/proxy-error/?a=%a&B=%B&e=%e&E=%E&H=%H&i=%i&M=%M&o=%o&R=%R&T=%T&U=%U&u=%u&w=%w&x=%x&acl=bad_mimetypes bad_requested_mimetypes deny_info http://proxy-server1/proxy-error/?a=%a&B=%B&e=%e&E=%E&H=%H&i=%i&M=%M&o=%o&R=%R&T=%T&U=%U&u=%u&w=%w&x=%x&acl=bad_mimetypes bad_replied_mimetypes http_access allow localnet bl_lookup #debug_options rotate=1 28,3 debug_options rotate=1 ALL,2 append_domain .mydomain.org reply_header_access Alternate-Protocol deny all ssl_bump stare all ssl_bump bump all icap_enable on icap_send_client_ip on icap_send_client_username on icap_client_username_encode off icap_client_username_header X-Authenticated-User icap_preview_enable on icap_preview_size 1024 icap_service squidclamav respmod_precache bypass=0 icap://127.0.0.1:1344/clamav adaptation_access squidclamav allow all include /etc/squid/squid.include.common include /etc/squid/squid.include.hide cache_mem 32 MB max_filedescriptors 65536 icap_service_failure_limit -1 Here's what I do from a client: curl --insecure --user-agent Firefox/57 https://www.gentoo.org/ Here's what I get with 28,3 debug options: 2017/11/21 10:02:24.278 kid1| 28,3| Checklist.cc(70) preCheck: 0xeb47c8 checking slow rules 2017/11/21 10:02:24.278 kid1| 28,3| Ip.cc(539) match: aclIpMatchIp: '10.215.144.48' found 2017/11/21 10:02:24.278 kid1| 28,3| Acl.cc(158) matches: checked: all = 1 2017/11/21 10:02:24.278 kid1| 28,3| Acl.cc(158) matches: checked: (ssl_bump rule) = 1 2017/11/21 10:02:24.278 kid1| 28,3| Acl.cc(158) matches: checked: (ssl_bump rules) = 1 2017/11/21 10:02:24.278 kid1| 28,3| Checklist.cc(63) markFinished: 0xeb47c8 answer ALLOWED for match 2017/11/21 10:02:24.278 kid1| 28,3| Checklist.cc(163) checkCallback: ACLChecklist::checkCallback: 0xeb47c8 answer=ALLOWED 2017/11/21 10:02:24.278 kid1| 28,3| Checklist.cc(70) preCheck: 0x13450c8 checking slow rules 2017/11/21 10:02:24.278 kid1| 28,3| Acl.cc(158) matches: checked: Safe_ports = 1 2017/11/21 10:02:24.278 kid1| 28,3| Acl.cc(158) matches: checked: !Safe_ports = 0 2017/11/21 10:02:24.278 kid1| 28,3| Acl.cc(158) matches: checked: http_access#1 = 0 2017/11/21 10:02:24.278 kid1| 28,3| Acl.cc(158) matches: checked: CONNECT = 1 2017/11/21 10:02:24.278 kid1| 28,3| Acl.cc(158) matches: checked: SSL_ports = 1 2017/11/21 10:02:24.278 kid1| 28,3| Acl.cc(158) matches: checked: !SSL_ports = 0 2017/11/21 10:02:24.278 kid1| 28,3| Acl.cc(158) matches: checked: http_access#2 = 0 2017/11/21 10:02:24.278 kid1| 28,3| Ip.cc(539) match: aclIpMatchIp: '10.215.144.48' NOT found 2017/11/21 10:02:24.278 kid1| 28,3| Acl.cc(158) matches: checked: localhost = 0 2017/11/21 10:02:24.278 kid1| 28,3| Acl.cc(158) matches: checked: http_access#3 = 0 2017/11/21 10:02:24.278 kid1| 28,3| RegexData.cc(51) match: aclRegexData::match: checking '89.16.167.134:443' 2017/11/21 10:02:24.278 kid1| 28,3| RegexData.cc(62) match: aclRegexData::match: looking for '(^cache_object://)' 2017/11/21 10:02:24.278 kid1| 28,3| RegexData.cc(62) match: aclRegexData::match: looking for '(^https?://[^/]+/squid-internal-mgr/)' 2017/11/21 10:02:24.278 kid1| 28,3| Acl.cc(158) matches: checked: manager = 0 2017/11/21 10:02:24.278 kid1| 28,3| Acl.cc(158) matches: checked: http_access#4 = 0 2017/11/21 10:02:24.278 kid1| 28,3| StringData.cc(34) match: aclMatchStringList: checking '3229' 2017/11/21 10:02:24.278 kid1| 28,3| StringData.cc(37) match: aclMatchStringList: '3229' NOT found 2017/11/21 10:02:24.278 kid1| 28,3| Acl.cc(158) matches: checked: explicit = 0 2017/11/21 10:02:24.278 kid1| 28,3| Acl.cc(158) matches: checked: http_access#5 = 0 2017/11/21 10:02:24.278 kid1| 28,3| StringData.cc(34) match: aclMatchStringList: checking '3229' 2017/11/21 10:02:24.278 kid1| 28,3| StringData.cc(37) match: aclMatchStringList: '3229' NOT found 2017/11/21 10:02:24.278 kid1| 28,3| Acl.cc(158) matches: checked: explicit = 0 2017/11/21 10:02:24.278 kid1| 28,3| Acl.cc(158) matches: checked: http_access#6 = 0 2017/11/21 10:02:24.278 kid1| 28,3| StringData.cc(34) match: aclMatchStringList: checking '3229' 2017/11/21 10:02:24.278 kid1| 28,3| StringData.cc(37) match: aclMatchStringList: '3229' NOT found 2017/11/21 10:02:24.278 kid1| 28,3| Acl.cc(158) matches: checked: intercepted = 0 2017/11/21 10:02:24.278 kid1| 28,3| Acl.cc(158) matches: checked: http_access#7 = 0 2017/11/21 10:02:24.278 kid1| 28,3| StringData.cc(34) match: aclMatchStringList: checking '3229' 2017/11/21 10:02:24.278 kid1| 28,3| StringData.cc(37) match: aclMatchStringList: '3229' found 2017/11/21 10:02:24.278 kid1| 28,3| Acl.cc(158) matches: checked: interceptedssl = 1 2017/11/21 10:02:24.278 kid1| 28,3| Ip.cc(539) match: aclIpMatchIp: '10.215.144.48' found 2017/11/21 10:02:24.278 kid1| 28,3| Acl.cc(158) matches: checked: localnet = 1 2017/11/21 10:02:24.278 kid1| 28,3| Acl.cc(158) matches: checked: !localnet = 0 2017/11/21 10:02:24.278 kid1| 28,3| Acl.cc(158) matches: checked: http_access#8 = 0 2017/11/21 10:02:24.278 kid1| 28,3| Acl.cc(158) matches: checked: good_useragents = 0 2017/11/21 10:02:24.278 kid1| 28,3| Acl.cc(158) matches: checked: !good_useragents = 1 2017/11/21 10:02:24.278 kid1| 28,3| Ip.cc(539) match: aclIpMatchIp: '10.215.144.48' NOT found 2017/11/21 10:02:24.278 kid1| 28,3| Acl.cc(158) matches: checked: src_ips_with_any_useragent = 0 2017/11/21 10:02:24.278 kid1| 28,3| Acl.cc(158) matches: checked: !src_ips_with_any_useragent = 1 2017/11/21 10:02:24.278 kid1| 28,3| Acl.cc(158) matches: checked: http_access#9 = 1 2017/11/21 10:02:24.278 kid1| 28,3| Acl.cc(158) matches: checked: http_access = 1 2017/11/21 10:02:24.278 kid1| 28,3| Checklist.cc(63) markFinished: 0x13450c8 answer DENIED for match 2017/11/21 10:02:24.278 kid1| 28,3| Checklist.cc(163) checkCallback: ACLChecklist::checkCallback: 0x13450c8 answer=DENIED 2017/11/21 10:02:24.278 kid1| 28,3| Checklist.cc(70) preCheck: 0x7ffd4e3e2530 checking fast ACLs 2017/11/21 10:02:24.278 kid1| 28,3| Acl.cc(158) matches: checked: (access_log daemon:/var/log/squid/access.test.log line) = 1 2017/11/21 10:02:24.278 kid1| 28,3| Acl.cc(158) matches: checked: access_log daemon:/var/log/squid/access.test.log = 1 2017/11/21 10:02:24.278 kid1| 28,3| Checklist.cc(63) markFinished: 0x7ffd4e3e2530 answer ALLOWED for match 2017/11/21 10:02:24.288 kid1| 28,3| Checklist.cc(70) preCheck: 0xeb47c8 checking slow rules 2017/11/21 10:02:24.288 kid1| 28,3| Ip.cc(539) match: aclIpMatchIp: '10.215.144.48' found 2017/11/21 10:02:24.288 kid1| 28,3| Acl.cc(158) matches: checked: localnet = 1 2017/11/21 10:02:24.288 kid1| 28,3| Ip.cc(539) match: aclIpMatchIp: '10.215.144.48' NOT found 2017/11/21 10:02:24.288 kid1| 28,3| Acl.cc(158) matches: checked: explicit_only_src_ips = 0 2017/11/21 10:02:24.288 kid1| 28,3| Acl.cc(158) matches: checked: !explicit_only_src_ips = 1 2017/11/21 10:02:24.288 kid1| 28,3| Ip.cc(539) match: aclIpMatchIp: '10.215.144.48' NOT found 2017/11/21 10:02:24.288 kid1| 28,3| Acl.cc(158) matches: checked: privileged_src_ips = 0 2017/11/21 10:02:24.288 kid1| 28,3| Acl.cc(158) matches: checked: http_reply_access#1 = 0 2017/11/21 10:02:24.288 kid1| 28,3| Ip.cc(539) match: aclIpMatchIp: '10.215.144.48' found 2017/11/21 10:02:24.288 kid1| 28,3| Acl.cc(158) matches: checked: localnet = 1 2017/11/21 10:02:24.288 kid1| 28,3| Ip.cc(539) match: aclIpMatchIp: '10.215.144.48' NOT found 2017/11/21 10:02:24.288 kid1| 28,3| Acl.cc(158) matches: checked: explicit_only_src_ips = 0 2017/11/21 10:02:24.288 kid1| 28,3| Acl.cc(158) matches: checked: !explicit_only_src_ips = 1 2017/11/21 10:02:24.288 kid1| 28,3| DomainData.cc(108) match: aclMatchDomainList: checking 'www.gentoo.org' 2017/11/21 10:02:24.288 kid1| 28,3| DomainData.cc(113) match: aclMatchDomainList: 'www.gentoo.org' NOT found 2017/11/21 10:02:24.288 kid1| 28,3| Acl.cc(158) matches: checked: good_dst_domains = 0 2017/11/21 10:02:24.288 kid1| 28,3| Acl.cc(158) matches: checked: http_reply_access#2 = 0 2017/11/21 10:02:24.288 kid1| 28,3| RegexData.cc(51) match: aclRegexData::match: checking 'text/html;charset=utf-8' 2017/11/21 10:02:24.288 kid1| 28,3| RegexData.cc(62) match: aclRegexData::match: looking for '(^application/octet-stream$)' 2017/11/21 10:02:24.288 kid1| 28,3| Acl.cc(158) matches: checked: restricted_replied_mimetypes_1 = 0 2017/11/21 10:02:24.288 kid1| 28,3| Acl.cc(158) matches: checked: http_reply_access#3 = 0 2017/11/21 10:02:24.288 kid1| 28,3| RegexData.cc(51) match: aclRegexData::match: checking 'text/html;charset=utf-8' 2017/11/21 10:02:24.288 kid1| 28,3| RegexData.cc(62) match: aclRegexData::match: looking for '(^application/octet-stream$)' 2017/11/21 10:02:24.288 kid1| 28,3| Acl.cc(158) matches: checked: restricted_replied_mimetypes_1 = 0 2017/11/21 10:02:24.288 kid1| 28,3| Acl.cc(158) matches: checked: http_reply_access#4 = 0 2017/11/21 10:02:24.288 kid1| 28,3| RegexData.cc(51) match: aclRegexData::match: checking 'text/html;charset=utf-8' 2017/11/21 10:02:24.289 kid1| 28,3| RegexData.cc(62) match: aclRegexData::match: looking for '(^application/mp21$)|(^application/mp4$)|(^application/vnd.rn-realmedia$)|(^application/vnd.tmobile-livetv$)|(^audio/)|(^video/)' 2017/11/21 10:02:24.289 kid1| 28,3| Acl.cc(158) matches: checked: limited_replied_mimetypes_1 = 0 2017/11/21 10:02:24.289 kid1| 28,3| Acl.cc(158) matches: checked: http_reply_access#5 = 0 2017/11/21 10:02:24.289 kid1| 28,3| RegexData.cc(51) match: aclRegexData::match: checking 'text/html;charset=utf-8' 2017/11/21 10:02:24.289 kid1| 28,3| RegexData.cc(62) match: aclRegexData::match: looking for '(^application/octet-stream$)' 2017/11/21 10:02:24.289 kid1| 28,3| Acl.cc(158) matches: checked: restricted_replied_mimetypes_1 = 0 2017/11/21 10:02:24.289 kid1| 28,3| Acl.cc(158) matches: checked: http_reply_access#6 = 0 2017/11/21 10:02:24.289 kid1| 28,3| RegexData.cc(51) match: aclRegexData::match: checking 'text/html;charset=utf-8' 2017/11/21 10:02:24.289 kid1| 28,3| RegexData.cc(62) match: aclRegexData::match: looking for '(^application/mp21$)|(^application/mp4$)|(^application/vnd.rn-realmedia$)|(^application/vnd.tmobile-livetv$)|(^audio/)|(^video/)' 2017/11/21 10:02:24.289 kid1| 28,3| Acl.cc(158) matches: checked: limited_replied_mimetypes_1 = 0 2017/11/21 10:02:24.289 kid1| 28,3| Acl.cc(158) matches: checked: http_reply_access#7 = 0 2017/11/21 10:02:24.289 kid1| 28,3| RegexData.cc(51) match: aclRegexData::match: checking '/' 2017/11/21 10:02:24.289 kid1| 28,3| RegexData.cc(62) match: aclRegexData::match: looking for '(\.ade(\?.*)?$)|(\.adp(\?.*)?$)|(\.app(\?.*)?$)|(\.asd(\?.*)?$)|(\.asf(\?.*)?$)|(\.asx(\?.*)?$)|(\.avi(\?.*)?$)|(\.bas(\?.*)?$)|(\.bat(\?.*)?$)|(\.cab(\?.*)?$)|(\.chm(\?.*)?$)|(\.cmd(\?.*)?$)|(\.cpl(\?.*)?$)|(\.dll$)|(\.exe(\?.*)?$)|(\.fxp(\?.*)?$)|(\.hlp(\?.*)?$)|(\.hta(\?.*)?$)|(\.hto(\?.*)?$)|(\.inf(\?.*)?$)|(\.ini(\?.*)?$)|(\.ins(\?.*)?$)|(\.iso(\?.*)?$)|(\.isp(\?.*)?$)|(\.jse(.?)(\?.*)?$)|(\.jse(\?.*)?$)|(\.lib(\?.*)?$)|(\.lnk(\?.*)?$)|(\.mar(\?.*)?$)|(\.mdb(\?.*)?$)|(\.mde(\?.*)?$)|(\.mp3(\?.*)?$)|(\.mpeg(\?.*)?$)|(\.mpg(\?.*)?$)|(\.msc(\?.*)?$)|(\.msi(\?.*)?$)|(\.msp(\?.*)?$)|(\.mst(\?.*)?$)|(\.ocx(\?.*)?$)|(\.pcd(\?.*)?$)|(\.pif(\?.*)?$)|(\.prg(\?.*)?$)|(\.reg(\?.*)?$)|(\.scr(\?.*)?$)|(\.sct(\?.*)?$)|(\.sh(\?.*)?$)|(\.shb(\?.*)?$)|(\.shs(\?.*)?$)|(\.sys(\?.*)?$)|(\.url(\?.*)?$)|(\.vb(\?.*)?$)|(\.vbe(\?.*)?$)|(\.vbs(\?.*)?$)|(\.vcs(\?.*)?$)|(\.vxd(\?.*)?$)|(\.wmd(\?.*)?$)|(\.wms(\?.*)?$)|(\.wmv(\?.*)?$)|(\.wmz(\?.*)?$)|(\.wsc(\?.*)?$)|(\.wsf(\?.*)?$)|(\.wsh(\?.*)?$)' 2017/11/21 10:02:24.289 kid1| 28,3| Acl.cc(158) matches: checked: bad_filetypes = 0 2017/11/21 10:02:24.289 kid1| 28,3| Acl.cc(158) matches: checked: http_reply_access#8 = 0 2017/11/21 10:02:24.289 kid1| 28,3| RegexData.cc(51) match: aclRegexData::match: checking 'text/html;charset=utf-8' 2017/11/21 10:02:24.289 kid1| 28,3| RegexData.cc(62) match: aclRegexData::match: looking for '(^application/ecmascript$)|(^application/mp21$)|(^application/mp4$)|(^application/oebps-package+xml$)|(^application/vnd.amazon.ebook$)|(^application/vnd.android.package-archive$)|(^application/vnd.gmx$)|(^application/vnd.google-earth.kml+xml$)|(^application/vnd.google-earth.kmz$)|(^application/vnd.ms-cab-compressed$)|(^application/vnd.ms-excel.addin.macroenabled.12$)|(^application/vnd.ms-excel.sheet.binary.macroenabled.12$)|(^application/vnd.ms-excel.sheet.macroenabled.12$)|(^application/vnd.ms-excel.template.macroenabled.12$)|(^application/vnd.ms-powerpoint.addin.macroenabled.12$)|(^application/vnd.ms-powerpoint.presentation.macroenabled.12$)|(^application/vnd.ms-powerpoint.slide.macroenabled.12$)|(^application/vnd.ms-powerpoint.slideshow.macroenabled.12$)|(^application/vnd.ms-powerpoint.template.macroenabled.12$)|(^application/vnd.ms-wpl$)|(^application/vnd.ms.wms-hdr.asfv1$)|(^application/vnd.realvnc.bed$)|(^application/vnd.rn-realmedia$)|(^application/vnd.tmobile-livetv$)|(^application/x-authorware-bin$)|(^application/x-cab$)|(^application/x-iso9660-image$)|(^application/x-mms-framed$)|(^application/x-ms-wm$)|(^application/x-msdos-program$)|(^application/x-msdownload$)|(^application/x-shar$)|(^application/x-vbs$)|(^audio/)|(^text/vbs$)|(^text/vbscript$)|(^video/)' 2017/11/21 10:02:24.289 kid1| 28,3| Acl.cc(158) matches: checked: bad_replied_mimetypes = 0 2017/11/21 10:02:24.289 kid1| 28,3| Acl.cc(158) matches: checked: http_reply_access#9 = 0 2017/11/21 10:02:24.289 kid1| 28,3| Acl.cc(158) matches: checked: http_reply_access = 0 2017/11/21 10:02:24.289 kid1| 28,3| Checklist.cc(386) calcImplicitAnswer: 0xeb47c8 NO match found, last action DENIED so returning ALLOWED 2017/11/21 10:02:24.289 kid1| 28,3| Checklist.cc(63) markFinished: 0xeb47c8 answer ALLOWED for implicit rule won 2017/11/21 10:02:24.289 kid1| 28,3| Checklist.cc(163) checkCallback: ACLChecklist::checkCallback: 0xeb47c8 answer=ALLOWED 2017/11/21 10:02:24.289 kid1| 28,3| Checklist.cc(70) preCheck: 0x7ffd4e3e2660 checking fast ACLs 2017/11/21 10:02:24.289 kid1| 28,3| Acl.cc(158) matches: checked: (access_log daemon:/var/log/squid/access.test.log line) = 1 2017/11/21 10:02:24.289 kid1| 28,3| Acl.cc(158) matches: checked: access_log daemon:/var/log/squid/access.test.log = 1 2017/11/21 10:02:24.289 kid1| 28,3| Checklist.cc(63) markFinished: 0x7ffd4e3e2660 answer ALLOWED for match It seems that Squid decides to ALLOW, right? Now, here's the log with ALL,2: 2017/11/21 10:07:01.079 kid1| 5,2| TcpAcceptor.cc(220) doAccept: New connection on FD 93 2017/11/21 10:07:01.079 kid1| 5,2| TcpAcceptor.cc(295) acceptNext: connection on local=[::]:3229 remote=[::] FD 93 flags=25 2017/11/21 10:07:01.079 kid1| 33,2| client_side.cc(3943) httpsSslBumpAccessCheckDone: sslBump needed for local=89.16.167.134:443 remote=10.215.144.48 FD 13 flags=17 method 4 2017/11/21 10:07:01.079 kid1| 11,2| client_side.cc(2372) parseHttpRequest: HTTP Client local=89.16.167.134:443 remote=10.215.144.48 FD 13 flags=17 2017/11/21 10:07:01.079 kid1| 11,2| client_side.cc(2373) parseHttpRequest: HTTP Client REQUEST: --------- CONNECT 89.16.167.134:443 HTTP/1.1 Host: 89.16.167.134:443 ---------- 2017/11/21 10:07:01.079 kid1| 85,2| client_side_request.cc(745) clientAccessCheckDone: The request CONNECT 89.16.167.134:443 is DENIED; last ACL checked: src_ips_with_any_useragent 2017/11/21 10:07:01.079 kid1| 20,2| store.cc(996) checkCachable: StoreEntry::checkCachable: NO: not cachable 2017/11/21 10:07:01.079 kid1| 20,2| store.cc(996) checkCachable: StoreEntry::checkCachable: NO: not cachable 2017/11/21 10:07:01.079 kid1| 20,2| store.cc(996) checkCachable: StoreEntry::checkCachable: NO: not cachable 2017/11/21 10:07:01.089 kid1| 83,2| client_side.cc(3843) clientNegotiateSSL: clientNegotiateSSL: New session 0x13c6250 on FD 13 (10.215.144.48:42279) 2017/11/21 10:07:01.090 kid1| 11,2| client_side.cc(2372) parseHttpRequest: HTTP Client local=89.16.167.134:443 remote=10.215.144.48 FD 13 flags=17 2017/11/21 10:07:01.090 kid1| 11,2| client_side.cc(2373) parseHttpRequest: HTTP Client REQUEST: --------- GET / HTTP/1.1 Host: www.gentoo.org User-Agent: Firefox/57 Accept: */* ---------- 2017/11/21 10:07:01.090 kid1| 88,2| client_side_reply.cc(2073) processReplyAccessResult: The reply for GET https://www.gentoo.org/ is ALLOWED, because it matched bad_replied_mimetypes 2017/11/21 10:07:01.090 kid1| 11,2| client_side.cc(1409) sendStartOfMessage: HTTP Client local=89.16.167.134:443 remote=10.215.144.48 FD 13 flags=17 2017/11/21 10:07:01.090 kid1| 11,2| client_side.cc(1410) sendStartOfMessage: HTTP Client REPLY: --------- HTTP/1.1 307 Temporary Redirect Server: squid Mime-Version: 1.0 Date: Tue, 21 Nov 2017 09:07:01 GMT Content-Type: text/html;charset=utf-8 Content-Length: 0 Location: http://proxy-server1/proxy-error/?a=-&B=&e=0&E=%5BNo%20Error%5D&H=89.16.167.134&i=10.215.144.48&M=CONNECT&o=&R=/&T=Tue,%2021%20Nov%202017%2009%3A07%3A01%20GMT&U=https%3A%2F%2F89.16.167.134%2F*&u=89.16.167.134%3A443&w=IT%40mydomain.org&x=&acl=bad_useragents X-Squid-Error: 403 Access Denied X-Cache: MISS from proxy-server1 X-Cache-Lookup: NONE from proxy-server1:3227 Connection: close ---------- 2017/11/21 10:07:01.090 kid1| 33,2| client_side.cc(832) swanSong: local=89.16.167.134:443 remote=10.215.144.48 flags=17 2017/11/21 10:07:01.090 kid1| 20,2| store.cc(996) checkCachable: StoreEntry::checkCachable: NO: not cachable 2017/11/21 10:07:01.090 kid1| 20,2| store.cc(996) checkCachable: StoreEntry::checkCachable: NO: not cachable Isn't the message "The request CONNECT 89.16.167.134:443 is DENIED" what I should be concentrating on? Isn't that the root cause? In another message, you mentioned that I should notice that Squid reports another ACL name (in this case, after the name change, it's "bad_replied_mimetypes"). In any case, the message "The reply for GET https://www.gentoo.org/ is ALLOWED" means that Squid should ALLOW, right? However, why do I get a 307 redirect to a deny_info page (where incidentally the URL refers to bad_useragents, not bad_replied_mimetypes)? I can't seem to clear this out and make it work without adding "http_access allow CONNECT SSL_ports" right before checking for the useragent. Help greatly appreciated. Vieri _______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users
