My goal is to transparently filter HTTP and HTTPS URLs based on a user name that is obtained via an external acl type.
I am running Squid 3.5.23 in intercept mode, after researching, it seems that you can use external_acl_type with intercept mode (I could be wrong), and then return OK user=testuser as part of the OK/ERR response and SQUID will use that username as the authenticated user.
I wrote a simple python script that reads stdin, and then immediately writes OK user=testuser back to stdout for SQUID.
SSL peek, splice and bump are working and for http_access,if the request is not an SSL port, it uses the plain external auth which uses the %DST instead of SNI. Next, If the port is SSL it allows it, but then using ssl-bump it consults the SSL external auth which passes SNI.
Both of these external acl's just respond with OK user=testuser, and I can see this working in the logs I create.
The problem comes in when the ICAP server is contacted.
In some of the logged requests I can see the client IP and user name do get appear in the ICAP headers, and in some it does not get sent at all.
I have not been able to determine a pattern as to why some ICAP requests have the headers, and others don't and am not sure if this is a misconfiguration, bug, or unsupported in general.
When does the ICAP request get sent, before or after the external auth?
Am I doing something wrong, or just trying to do something that doesn't actually work?
Here is what I believe the relevant parts of my config are.
external_acl_type ssl_external negative_ttl=0 %SRC %PORT %METHOD %ssl::>sni %PATH /etc/webscreen/auth/webscreen.py external_acl_type plain_external negative_ttl=0 %SRC %PORT %METHOD %DST %PATH /etc/webscreen/auth/webscreen.py acl ssl_webscreen external ssl_external acl plain_webscreen external plain_external acl SSL_ports port 443 acl step1 at_step SslBump1 acl step2 at_step SslBump2 acl step3 at_step SslBump3 http_access allow !SSL_ports plain_webscreen http_access allow SSL_ports localnet http_access deny all ssl_bump peek step1 all ssl_bump splice step2 ssl_webscreen ssl_bump bump all icap_enable on icap_service_failure_limit -1 icap_preview_enable on icap_preview_size 1024 icap_persistent_connections on adaptation_send_client_ip on adaptation_send_username on icap_service webscreen1 reqmod_precache icap://127.0.0.1:1344/reqmod bypass=0 icap_service webscreen2 respmod_precache icap://127.0.0.1:1344/respmod bypass=0 adaptation_access webscreen1 allow all adaptation_access webscreen2 allow all
as request in comments, here is webscreen.py
#!/usr/bin/env python import sys, time, datetime, os log_file = "/etc/squid/webscreen/webscreen.log" def main (): while (1): inline = sys.stdin.readline() logEntry (10, "New proxy request "+inline) sys.stdout.write("OK user=webscreen\n") sys.stdout.flush() def logEntry(logmessagelevel, logmessage): global log_file # Get timestamp as human readable format now = datetime.datetime.now() timestamp = now.strftime("%Y-%m-%d %H:%M:%s") # open file to apptend logfile = open(log_file, 'a') logfile.write(timestamp+" "+str(logmessagelevel)+" "+logmessage+"\n") logfile.close() return if __name__ == '__main__': main()