Re: [squid-users] HTTPS CONNECT issue

Robert Collins wrote:

> ----- Original Message -----
<snip>
> See the Squid FAQ, look for "I'm behind a firewall". (hint: never_direct
> is your friend.
>

Thanks. I looked at that and got confused.

Note that I already have the setup corretc for HTTP. That is to say HTTP
requests are correctly transparently cached/proxied by squid and then
forwarded to the upstream firwall/proxy if necessary.

My config looks like (parts ommitted)
---------------------------------------
acl all src 0.0.0.0/0.0.0.0
acl localhost src 127.0.0.1/255.255.255.255
acl localnet src 10.1.1.0/255.255.255.0
acl SSL_ports port 443 563
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT

http_access allow localhost
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localnet
http_access deny all

cache_peer a.b.c.d parent 8080 3130 default no-query

httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_with_proxy on
httpd_accel_uses_host_header on
------------------------------------

Bear with me please while I try and understand this.

What I think my
config is doing is transparently caching and próxying port 80 only. So
therefore port 443 is passed though untouched.

If I want port 443 to be proxied transparently I have to add another
httpd_accel_port line as well? [I tried this and it breaks the
transparent proxy completely even for regular http]

Then as well as that I also need to add a couple of lines like
never_direct deny localnet localhost
never_direct allow all

which should be placed below the "http_access deny all" line?
I have also tried this with and without the above httpd_accel_port
change and https doesn't work.

Francis

-- 
Francis Turner, CIO Juelich Enzyme Products GmbH
http://www.juelich-enzyme.com/ +49-173-291-7278
If you're not part of the solution, you're part of the precipitate.
              -- Henry J. Tillman