|
| 1 | +<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> |
| 2 | +<HTML> |
| 3 | + <HEAD> |
| 4 | + <TITLE> [squid-dev] forward bumped traffic to parent in plain form |
| 5 | + </TITLE> |
| 6 | + <LINK REL="Index" HREF="index.html" > |
| 7 | + <LINK REL="made" HREF="mailto:squid-dev%40lists.squid-cache.org?Subject=Re%3A%20%5Bsquid-dev%5D%20forward%20bumped%20traffic%20to%20parent%20in%20plain%20form&In-Reply-To=%3C1985119311.20260304190328%40yahoo.com%3E"> |
| 8 | + <META NAME="robots" CONTENT="index,nofollow"> |
| 9 | + <style type="text/css"> |
| 10 | + pre { |
| 11 | + white-space: pre-wrap; /* css-2.1, curent FF, Opera, Safari */ |
| 12 | + } |
| 13 | + </style> |
| 14 | + <META http-equiv="Content-Type" content="text/html; charset=us-ascii"> |
| 15 | + |
| 16 | + |
| 17 | + </HEAD> |
| 18 | + <BODY BGCOLOR="#ffffff"> |
| 19 | + <H1>[squid-dev] forward bumped traffic to parent in plain form</H1> |
| 20 | + <B>Anthony Pankov</B> |
| 21 | + <A HREF="mailto:squid-dev%40lists.squid-cache.org?Subject=Re%3A%20%5Bsquid-dev%5D%20forward%20bumped%20traffic%20to%20parent%20in%20plain%20form&In-Reply-To=%3C1985119311.20260304190328%40yahoo.com%3E" |
| 22 | + TITLE="[squid-dev] forward bumped traffic to parent in plain form">anthony.pankov at yahoo.com |
| 23 | + </A><BR> |
| 24 | + <I>Wed Mar 4 16:03:28 UTC 2026</I> |
| 25 | + <P><UL> |
| 26 | + |
| 27 | + |
| 28 | + <LI> <B>Messages sorted by:</B> |
| 29 | + <a href="date.html#9979">[ date ]</a> |
| 30 | + <a href="thread.html#9979">[ thread ]</a> |
| 31 | + <a href="subject.html#9979">[ subject ]</a> |
| 32 | + <a href="author.html#9979">[ author ]</a> |
| 33 | + </LI> |
| 34 | + </UL> |
| 35 | + <HR> |
| 36 | +<!--beginarticle--> |
| 37 | +<PRE>Hello, |
| 38 | + |
| 39 | +I still want to modify squid in such a way that it can forward clients http traffic to a parent cache in plain form. |
| 40 | +I mean after bumping ssl (forntend-squid establish tls connection with a client) requests from client should goes to parent cache as a plain http ( GET etc.) That is, using parent cache as in good old days without https. |
| 41 | + |
| 42 | +Connection between squids servers is already encrypted so I don't need any additional tls(security) layer. |
| 43 | + |
| 44 | +Also, for simplification, I assume never_direct directive for this traffic on a front-end. |
| 45 | +I understand that it will preclude any checks for origin server certificate but this is not a problem because policy for origin may be applied in a parent cache. |
| 46 | + |
| 47 | +I tried to modify FwdState::noteConnection to avoid establishTunnelThruProxy() and FwdState::secureConnectionToPeerIfNeeded to avoid secureConnectionToPeer() but has no lack. |
| 48 | + |
| 49 | +They use request.flags sslBumped and sslPeek that I do not fully understand. sslPeek described as "internal ssl-bump request to get server cert" but it always True when I'm in noteConnection. |
| 50 | + |
| 51 | +Also I noted async SslBumpEstablish which call switchToHttps. Because of asyncs I can't fully understand where I can preclude switching connections to parent cache to "CONNECT" mode rather than using it plain. |
| 52 | + |
| 53 | +Any help would be appreciated. |
| 54 | + |
| 55 | + |
| 56 | +-- |
| 57 | +Best regards, |
| 58 | + Anthony mailto:<A HREF="https://lists.squid-cache.org/listinfo/squid-dev">anthony.pankov at yahoo.com</A> |
| 59 | + |
| 60 | +</PRE> |
| 61 | + |
| 62 | +<!--endarticle--> |
| 63 | + <HR> |
| 64 | + <P><UL> |
| 65 | + <!--threads--> |
| 66 | + |
| 67 | + |
| 68 | + <LI> <B>Messages sorted by:</B> |
| 69 | + <a href="date.html#9979">[ date ]</a> |
| 70 | + <a href="thread.html#9979">[ thread ]</a> |
| 71 | + <a href="subject.html#9979">[ subject ]</a> |
| 72 | + <a href="author.html#9979">[ author ]</a> |
| 73 | + </LI> |
| 74 | + </UL> |
| 75 | + |
| 76 | +<hr> |
| 77 | +<a href="https://lists.squid-cache.org/listinfo/squid-dev">More information about the squid-dev |
| 78 | +mailing list</a><br> |
| 79 | +</body></html> |
0 commit comments