Skip to content

Commit 87614ab

Browse files
squidadmsquidadm
committed
2026-03-03
1 parent c09fdcd commit 87614ab

9 files changed

Lines changed: 409 additions & 19 deletions

File tree

‎squid-users/2026-March.txt‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,3 +63,87 @@ Ankor.
6363
An HTML attachment was scrubbed...
6464
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20260303/783ffa48/attachment.htm>
6565

66+
From squid3 at treenet.co.nz Tue Mar 3 13:02:08 2026
67+
From: squid3 at treenet.co.nz (Amos Jeffries)
68+
Date: Wed, 4 Mar 2026 02:02:08 +1300
69+
Subject: [squid-users] Using AD groups from negotiate_kerberos_auth in
70+
ssl-bumped connections.
71+
In-Reply-To: <CADJd0Y0U=9XsygAn0kjkt5OLnAozabqtAfd_nVr-RxXUqVee7g@mail.gmail.com>
72+
References: <CADJd0Y0U=9XsygAn0kjkt5OLnAozabqtAfd_nVr-RxXUqVee7g@mail.gmail.com>
73+
Message-ID: <755a6fef-5ca4-495a-a947-e0a2cc085197@treenet.co.nz>
74+
75+
On 04/03/2026 01:06, Andrey K wrote:
76+
> Hello,
77+
>
78+
> I use?negotiate_kerberos_auth helper and it sets the AD groups list in a
79+
> group annotation attribute.
80+
> It works well, but thisattributeis not availableinthe
81+
> subsequentrequestsinan ssl-bumpedconnection (it is available only in the
82+
> first CONNECT request).
83+
> Is it possible to make this attribute persistent in the current SSL
84+
> connection? I would like to use groups from this attribute to authorize
85+
> users using only "note"-type ACLs, no external helpers involved.
86+
87+
Unfortunately Squid does not yet support ACLs using details directly
88+
from the tunnel's "parent" CONNECT transaction.
89+
90+
You can use the annotate_client ACL type to mark the from-client TCP
91+
connection instead of the HTTP request. Just be aware these need to be
92+
manually configured and thus does not scale to large number of groups.
93+
94+
HTH
95+
Amos
96+
97+
98+
From anthony.pankov at yahoo.com Tue Mar 3 13:56:34 2026
99+
From: anthony.pankov at yahoo.com (Anthony Pankov)
100+
Date: Tue, 3 Mar 2026 16:56:34 +0300
101+
Subject: [squid-users] peek vs stare on step1
102+
References: <1286220651.20260303165634.ref@yahoo.com>
103+
Message-ID: <1286220651.20260303165634@yahoo.com>
104+
105+
Hello,
106+
107+
I wander what action to choose for sslbump on step1.
108+
109+
A documentation (https://wiki.squid-cache.org/Features/SslPeekAndSplice) said the same for both:
110+
111+
"When a stare/peek rule matches during step1, Squid proceeds to step2 where it parses the TLS Client Hello and extracts SNI (if any)."
112+
113+
114+
115+
116+
--
117+
Best regards,
118+
Anthony Pankov mailto:anthony.pankov at yahoo.com
119+
120+
121+
From uhlar at fantomas.sk Tue Mar 3 14:02:30 2026
122+
From: uhlar at fantomas.sk (Matus UHLAR - fantomas)
123+
Date: Tue, 3 Mar 2026 15:02:30 +0100
124+
Subject: [squid-users] peek vs stare on step1
125+
In-Reply-To: <1286220651.20260303165634@yahoo.com>
126+
References: <1286220651.20260303165634.ref@yahoo.com>
127+
<1286220651.20260303165634@yahoo.com>
128+
Message-ID: <aabp9k27Z2gGJxnY@fantomas.sk>
129+
130+
On 03.03.26 16:56, Anthony Pankov wrote:
131+
>I wander what action to choose for sslbump on step1.
132+
>
133+
>A documentation (https://wiki.squid-cache.org/Features/SslPeekAndSplice) said the same for both:
134+
>
135+
>"When a stare/peek rule matches during step1, Squid proceeds to step2 where it parses the TLS Client Hello and extracts SNI (if any)."
136+
137+
Alex answered my questions about peek/splice 4 years ago, here's link:
138+
https://ml-archives.squid-cache.org/squid-users/2022-February/024589.html
139+
140+
I hope it helps you at least a bit.
141+
142+
143+
--
144+
Matus UHLAR - fantomas, uhlar at fantomas.sk ; http://www.fantomas.sk/
145+
Warning: I wish NOT to receive e-mail advertising to this address.
146+
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
147+
There's a long-standing bug relating to the x86 architecture that
148+
allows you to install Windows. -- Matthew D. Fuller
149+

‎squid-users/2026-March/027824.html‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
</style>
1414
<META http-equiv="Content-Type" content="text/html; charset=us-ascii">
1515
<LINK REL="Previous" HREF="027823.html">
16-
16+
<LINK REL="Next" HREF="027825.html">
1717
</HEAD>
1818
<BODY BGCOLOR="#ffffff">
1919
<H1>[squid-users] Using AD groups from negotiate_kerberos_auth in ssl-bumped connections.</H1>
@@ -25,7 +25,8 @@ <H1>[squid-users] Using AD groups from negotiate_kerberos_auth in ssl-bumped con
2525
<P><UL>
2626
<LI>Previous message (by thread): <A HREF="027823.html">[squid-users] passing request body in GET requests
2727
</A></li>
28-
28+
<LI>Next message (by thread): <A HREF="027825.html">[squid-users] Using AD groups from negotiate_kerberos_auth in ssl-bumped connections.
29+
</A></li>
2930
<LI> <B>Messages sorted by:</B>
3031
<a href="date.html#27824">[ date ]</a>
3132
<a href="thread.html#27824">[ thread ]</a>
@@ -52,13 +53,15 @@ <H1>[squid-users] Using AD groups from negotiate_kerberos_auth in ssl-bumped con
5253
URL: &lt;<A HREF="http://lists.squid-cache.org/pipermail/squid-users/attachments/20260303/783ffa48/attachment.htm">http://lists.squid-cache.org/pipermail/squid-users/attachments/20260303/783ffa48/attachment.htm</A>&gt;
5354
</PRE>
5455

56+
5557
<!--endarticle-->
5658
<HR>
5759
<P><UL>
5860
<!--threads-->
5961
<LI>Previous message (by thread): <A HREF="027823.html">[squid-users] passing request body in GET requests
6062
</A></li>
61-
63+
<LI>Next message (by thread): <A HREF="027825.html">[squid-users] Using AD groups from negotiate_kerberos_auth in ssl-bumped connections.
64+
</A></li>
6265
<LI> <B>Messages sorted by:</B>
6366
<a href="date.html#27824">[ date ]</a>
6467
<a href="thread.html#27824">[ thread ]</a>

‎squid-users/2026-March/027825.html‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
2+
<HTML>
3+
<HEAD>
4+
<TITLE> [squid-users] Using AD groups from negotiate_kerberos_auth in ssl-bumped connections.
5+
</TITLE>
6+
<LINK REL="Index" HREF="index.html" >
7+
<LINK REL="made" HREF="mailto:squid-users%40lists.squid-cache.org?Subject=Re%3A%20%5Bsquid-users%5D%20Using%20AD%20groups%20from%20negotiate_kerberos_auth%20in%0A%20ssl-bumped%20connections.&In-Reply-To=%3C755a6fef-5ca4-495a-a947-e0a2cc085197%40treenet.co.nz%3E">
8+
<META NAME="robots" CONTENT="index,nofollow">
9+
<style type="text/css">
10+
pre {
11+
white-space: pre-wrap; /* css-2.1, curent FF, Opera, Safari */
12+
}
13+
</style>
14+
<META http-equiv="Content-Type" content="text/html; charset=us-ascii">
15+
<LINK REL="Previous" HREF="027824.html">
16+
<LINK REL="Next" HREF="027826.html">
17+
</HEAD>
18+
<BODY BGCOLOR="#ffffff">
19+
<H1>[squid-users] Using AD groups from negotiate_kerberos_auth in ssl-bumped connections.</H1>
20+
<B>Amos Jeffries</B>
21+
<A HREF="mailto:squid-users%40lists.squid-cache.org?Subject=Re%3A%20%5Bsquid-users%5D%20Using%20AD%20groups%20from%20negotiate_kerberos_auth%20in%0A%20ssl-bumped%20connections.&In-Reply-To=%3C755a6fef-5ca4-495a-a947-e0a2cc085197%40treenet.co.nz%3E"
22+
TITLE="[squid-users] Using AD groups from negotiate_kerberos_auth in ssl-bumped connections.">squid3 at treenet.co.nz
23+
</A><BR>
24+
<I>Tue Mar 3 13:02:08 UTC 2026</I>
25+
<P><UL>
26+
<LI>Previous message (by thread): <A HREF="027824.html">[squid-users] Using AD groups from negotiate_kerberos_auth in ssl-bumped connections.
27+
</A></li>
28+
<LI>Next message (by thread): <A HREF="027826.html">[squid-users] peek vs stare on step1
29+
</A></li>
30+
<LI> <B>Messages sorted by:</B>
31+
<a href="date.html#27825">[ date ]</a>
32+
<a href="thread.html#27825">[ thread ]</a>
33+
<a href="subject.html#27825">[ subject ]</a>
34+
<a href="author.html#27825">[ author ]</a>
35+
</LI>
36+
</UL>
37+
<HR>
38+
<!--beginarticle-->
39+
<PRE>On 04/03/2026 01:06, Andrey K wrote:
40+
&gt;<i> Hello,
41+
</I>&gt;<i>
42+
</I>&gt;<i> I use&#160;negotiate_kerberos_auth helper and it sets the AD groups list in a
43+
</I>&gt;<i> group annotation attribute.
44+
</I>&gt;<i> It works well, but thisattributeis not availableinthe
45+
</I>&gt;<i> subsequentrequestsinan ssl-bumpedconnection (it is available only in the
46+
</I>&gt;<i> first CONNECT request).
47+
</I>&gt;<i> Is it possible to make this attribute persistent in the current SSL
48+
</I>&gt;<i> connection? I would like to use groups from this attribute to authorize
49+
</I>&gt;<i> users using only &quot;note&quot;-type ACLs, no external helpers involved.
50+
</I>
51+
Unfortunately Squid does not yet support ACLs using details directly
52+
from the tunnel's &quot;parent&quot; CONNECT transaction.
53+
54+
You can use the annotate_client ACL type to mark the from-client TCP
55+
connection instead of the HTTP request. Just be aware these need to be
56+
manually configured and thus does not scale to large number of groups.
57+
58+
HTH
59+
Amos
60+
61+
</PRE>
62+
63+
64+
<!--endarticle-->
65+
<HR>
66+
<P><UL>
67+
<!--threads-->
68+
<LI>Previous message (by thread): <A HREF="027824.html">[squid-users] Using AD groups from negotiate_kerberos_auth in ssl-bumped connections.
69+
</A></li>
70+
<LI>Next message (by thread): <A HREF="027826.html">[squid-users] peek vs stare on step1
71+
</A></li>
72+
<LI> <B>Messages sorted by:</B>
73+
<a href="date.html#27825">[ date ]</a>
74+
<a href="thread.html#27825">[ thread ]</a>
75+
<a href="subject.html#27825">[ subject ]</a>
76+
<a href="author.html#27825">[ author ]</a>
77+
</LI>
78+
</UL>
79+
80+
<hr>
81+
<a href="https://lists.squid-cache.org/listinfo/squid-users">More information about the squid-users
82+
mailing list</a><br>
83+
</body></html>

‎squid-users/2026-March/027826.html‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
2+
<HTML>
3+
<HEAD>
4+
<TITLE> [squid-users] peek vs stare on step1
5+
</TITLE>
6+
<LINK REL="Index" HREF="index.html" >
7+
<LINK REL="made" HREF="mailto:squid-users%40lists.squid-cache.org?Subject=Re%3A%20%5Bsquid-users%5D%20peek%20vs%20stare%20on%20step1&In-Reply-To=%3C1286220651.20260303165634%40yahoo.com%3E">
8+
<META NAME="robots" CONTENT="index,nofollow">
9+
<style type="text/css">
10+
pre {
11+
white-space: pre-wrap; /* css-2.1, curent FF, Opera, Safari */
12+
}
13+
</style>
14+
<META http-equiv="Content-Type" content="text/html; charset=us-ascii">
15+
<LINK REL="Previous" HREF="027825.html">
16+
<LINK REL="Next" HREF="027827.html">
17+
</HEAD>
18+
<BODY BGCOLOR="#ffffff">
19+
<H1>[squid-users] peek vs stare on step1</H1>
20+
<B>Anthony Pankov</B>
21+
<A HREF="mailto:squid-users%40lists.squid-cache.org?Subject=Re%3A%20%5Bsquid-users%5D%20peek%20vs%20stare%20on%20step1&In-Reply-To=%3C1286220651.20260303165634%40yahoo.com%3E"
22+
TITLE="[squid-users] peek vs stare on step1">anthony.pankov at yahoo.com
23+
</A><BR>
24+
<I>Tue Mar 3 13:56:34 UTC 2026</I>
25+
<P><UL>
26+
<LI>Previous message (by thread): <A HREF="027825.html">[squid-users] Using AD groups from negotiate_kerberos_auth in ssl-bumped connections.
27+
</A></li>
28+
<LI>Next message (by thread): <A HREF="027827.html">[squid-users] peek vs stare on step1
29+
</A></li>
30+
<LI> <B>Messages sorted by:</B>
31+
<a href="date.html#27826">[ date ]</a>
32+
<a href="thread.html#27826">[ thread ]</a>
33+
<a href="subject.html#27826">[ subject ]</a>
34+
<a href="author.html#27826">[ author ]</a>
35+
</LI>
36+
</UL>
37+
<HR>
38+
<!--beginarticle-->
39+
<PRE>Hello,
40+
41+
I wander what action to choose for sslbump on step1.
42+
43+
A documentation (<A HREF="https://wiki.squid-cache.org/Features/SslPeekAndSplice">https://wiki.squid-cache.org/Features/SslPeekAndSplice</A>) said the same for both:
44+
45+
&quot;When a stare/peek rule matches during step1, Squid proceeds to step2 where it parses the TLS Client Hello and extracts SNI (if any).&quot;
46+
47+
48+
49+
50+
--
51+
Best regards,
52+
Anthony Pankov mailto:<A HREF="https://lists.squid-cache.org/listinfo/squid-users">anthony.pankov at yahoo.com</A>
53+
54+
</PRE>
55+
56+
57+
<!--endarticle-->
58+
<HR>
59+
<P><UL>
60+
<!--threads-->
61+
<LI>Previous message (by thread): <A HREF="027825.html">[squid-users] Using AD groups from negotiate_kerberos_auth in ssl-bumped connections.
62+
</A></li>
63+
<LI>Next message (by thread): <A HREF="027827.html">[squid-users] peek vs stare on step1
64+
</A></li>
65+
<LI> <B>Messages sorted by:</B>
66+
<a href="date.html#27826">[ date ]</a>
67+
<a href="thread.html#27826">[ thread ]</a>
68+
<a href="subject.html#27826">[ subject ]</a>
69+
<a href="author.html#27826">[ author ]</a>
70+
</LI>
71+
</UL>
72+
73+
<hr>
74+
<a href="https://lists.squid-cache.org/listinfo/squid-users">More information about the squid-users
75+
mailing list</a><br>
76+
</body></html>

‎squid-users/2026-March/027827.html‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
2+
<HTML>
3+
<HEAD>
4+
<TITLE> [squid-users] peek vs stare on step1
5+
</TITLE>
6+
<LINK REL="Index" HREF="index.html" >
7+
<LINK REL="made" HREF="mailto:squid-users%40lists.squid-cache.org?Subject=Re%3A%20%5Bsquid-users%5D%20peek%20vs%20stare%20on%20step1&In-Reply-To=%3Caabp9k27Z2gGJxnY%40fantomas.sk%3E">
8+
<META NAME="robots" CONTENT="index,nofollow">
9+
<style type="text/css">
10+
pre {
11+
white-space: pre-wrap; /* css-2.1, curent FF, Opera, Safari */
12+
}
13+
</style>
14+
<META http-equiv="Content-Type" content="text/html; charset=us-ascii">
15+
<LINK REL="Previous" HREF="027826.html">
16+
17+
</HEAD>
18+
<BODY BGCOLOR="#ffffff">
19+
<H1>[squid-users] peek vs stare on step1</H1>
20+
<B>Matus UHLAR - fantomas</B>
21+
<A HREF="mailto:squid-users%40lists.squid-cache.org?Subject=Re%3A%20%5Bsquid-users%5D%20peek%20vs%20stare%20on%20step1&In-Reply-To=%3Caabp9k27Z2gGJxnY%40fantomas.sk%3E"
22+
TITLE="[squid-users] peek vs stare on step1">uhlar at fantomas.sk
23+
</A><BR>
24+
<I>Tue Mar 3 14:02:30 UTC 2026</I>
25+
<P><UL>
26+
<LI>Previous message (by thread): <A HREF="027826.html">[squid-users] peek vs stare on step1
27+
</A></li>
28+
29+
<LI> <B>Messages sorted by:</B>
30+
<a href="date.html#27827">[ date ]</a>
31+
<a href="thread.html#27827">[ thread ]</a>
32+
<a href="subject.html#27827">[ subject ]</a>
33+
<a href="author.html#27827">[ author ]</a>
34+
</LI>
35+
</UL>
36+
<HR>
37+
<!--beginarticle-->
38+
<PRE>On 03.03.26 16:56, Anthony Pankov wrote:
39+
&gt;<i>I wander what action to choose for sslbump on step1.
40+
</I>&gt;<i>
41+
</I>&gt;<i>A documentation (<A HREF="https://wiki.squid-cache.org/Features/SslPeekAndSplice">https://wiki.squid-cache.org/Features/SslPeekAndSplice</A>) said the same for both:
42+
</I>&gt;<i>
43+
</I>&gt;<i>&quot;When a stare/peek rule matches during step1, Squid proceeds to step2 where it parses the TLS Client Hello and extracts SNI (if any).&quot;
44+
</I>
45+
Alex answered my questions about peek/splice 4 years ago, here's link:
46+
<A HREF="https://ml-archives.squid-cache.org/squid-users/2022-February/024589.html">https://ml-archives.squid-cache.org/squid-users/2022-February/024589.html</A>
47+
48+
I hope it helps you at least a bit.
49+
50+
51+
--
52+
Matus UHLAR - fantomas, <A HREF="https://lists.squid-cache.org/listinfo/squid-users">uhlar at fantomas.sk</A> ; <A HREF="http://www.fantomas.sk/">http://www.fantomas.sk/</A>
53+
Warning: I wish NOT to receive e-mail advertising to this address.
54+
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
55+
There's a long-standing bug relating to the x86 architecture that
56+
allows you to install Windows. -- Matthew D. Fuller
57+
</PRE>
58+
59+
<!--endarticle-->
60+
<HR>
61+
<P><UL>
62+
<!--threads-->
63+
<LI>Previous message (by thread): <A HREF="027826.html">[squid-users] peek vs stare on step1
64+
</A></li>
65+
66+
<LI> <B>Messages sorted by:</B>
67+
<a href="date.html#27827">[ date ]</a>
68+
<a href="thread.html#27827">[ thread ]</a>
69+
<a href="subject.html#27827">[ subject ]</a>
70+
<a href="author.html#27827">[ author ]</a>
71+
</LI>
72+
</UL>
73+
74+
<hr>
75+
<a href="https://lists.squid-cache.org/listinfo/squid-users">More information about the squid-users
76+
mailing list</a><br>
77+
</body></html>

0 commit comments

Comments
 (0)