Re: Squid url redirector and DoH

[Jonathan Lee <jonathanlee571@xxxxxxxxx>]

Thanks I am doing intercept with certificates on devices I own. Thanks for the reply I will test this. 

Sent from my iPhone

On Jan 12, 2025, at 23:47, Francesco Chemolli <gkinkie@xxxxxxxxx> wrote:



Hi Jonathan,

  the problem is: can you even see the HTTP being exchanged?

This requires TLS interception.

If you can, then it's relatively easy: you can to filter on (untested)

acl doh_post_ct Content-Type -i application/dns-message

acl doh_path_rfc8484 urlpath_regex ^/dns-query

acl doh_query_rfc8484 urlpath_regex dns=

acl doh_path_json urlpath_regex ^/resolve

http_access deny doh_post_ct doh_path_json

http_access deny doh_path_rfc8484 doh_query_rfc8484

If, however, you cannot inspect the HTTP payload in TLS, your only option is to blacklist all DOH providers by DNS name

On Sat, Jan 11, 2025 at 1:32 AM <jonathanlee571@xxxxxxxxx> wrote:

acl deny_rep_mime_doh rep_mime_type application/dns-message

for example would this work? I could get rid of a huge list and save memory if this solves my wackamole problem. I do not see anything on the Squid website but in theory that could resolve it right?

-----Original Message-----
From: jonathanlee571@xxxxxxxxx <jonathanlee571@xxxxxxxxx>
Sent: Friday, January 10, 2025 2:54 PM
To: 'squid-users' <squid-users@xxxxxxxxxxxxxxxxxxxxx>
Subject: RE: Squid url redirector and DoH

I have this hair brained idea to use the media type and get rid of the endless list.

Could this work?

https://www.iana.org/assignments/media-types/media-types.xhtml

This lists mime types for doh with rfc 8484 and 8427 so technically could I just create a mime block for DoH and stop creating endless lists?

https://www.iana.org/assignments/media-types/application/dns-message
https://www.iana.org/assignments/media-types/application/dns+json

https://wiki.squid-cache.org/ConfigExamples/BlockingMimeTypes



-----Original Message-----
From: Jonathan Lee <jonathanlee571@xxxxxxxxx>
Sent: Friday, January 10, 2025 2:38 PM
To: squid-users <squid-users@xxxxxxxxxxxxxxxxxxxxx>
Subject: Squid url redirector and DoH

Hello fellow Squid users, can you please help? I was wondering about this for years, I have a massive block list with DoH servers. Do you really need to block DoH if you want Squid to use a specific dns? Let’s say you are using a dns over tls, to Google or cloudflare and your system sometimes wants the DoH one.one.one.one is blocking that url really needed? My list is so big it is like playing wackamole with DoH. If I block it I see all the url requests if not I see IP addresses sometimes in the get requests. I must have a ACL with thousands and thousands of DoH servers in it.

What is recommended with sites that want DoH however clients must use Squid per firewall ACLs?
Sent from my iPhone


_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
https://lists.squid-cache.org/listinfo/squid-users

--

    Francesco

_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
https://lists.squid-cache.org/listinfo/squid-users

_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
https://lists.squid-cache.org/listinfo/squid-users