1

My goal is to transparently filter HTTP and HTTPS URLs based on a user name that is obtained via an external acl type.

I am running Squid 3.5.23 in intercept mode, after researching, it seems that you can use external_acl_type with intercept mode (I could be wrong), and then return OK user=testuser as part of the OK/ERR response and SQUID will use that username as the authenticated user.

I wrote a simple python script that reads stdin, and then immediately writes OK user=testuser back to stdout for SQUID.

SSL peek, splice and bump are working and for http_access,if the request is not an SSL port, it uses the plain external auth which uses the %DST instead of SNI. Next, If the port is SSL it allows it, but then using ssl-bump it consults the SSL external auth which passes SNI.

Both of these external acl's just respond with OK user=testuser, and I can see this working in the logs I create.

The problem comes in when the ICAP server is contacted.

In some of the logged requests I can see the client IP and user name do get appear in the ICAP headers, and in some it does not get sent at all.

I have not been able to determine a pattern as to why some ICAP requests have the headers, and others don't and am not sure if this is a misconfiguration, bug, or unsupported in general.

When does the ICAP request get sent, before or after the external auth?

Am I doing something wrong, or just trying to do something that doesn't actually work?

Here is what I believe the relevant parts of my config are.

    external_acl_type ssl_external negative_ttl=0 %SRC %PORT %METHOD %ssl::>sni %PATH /etc/webscreen/auth/webscreen.py
    external_acl_type plain_external negative_ttl=0 %SRC %PORT %METHOD %DST %PATH /etc/webscreen/auth/webscreen.py

    acl ssl_webscreen external ssl_external
    acl plain_webscreen external plain_external

    acl SSL_ports port 443

    acl step1 at_step SslBump1
    acl step2 at_step SslBump2
    acl step3 at_step SslBump3

    http_access allow !SSL_ports plain_webscreen
    http_access allow SSL_ports localnet
    http_access deny all

    ssl_bump peek step1 all
    ssl_bump splice step2 ssl_webscreen
    ssl_bump bump all

    icap_enable on
    icap_service_failure_limit -1
    icap_preview_enable on
    icap_preview_size 1024
    icap_persistent_connections on
    adaptation_send_client_ip on
    adaptation_send_username on
    icap_service webscreen1 reqmod_precache icap://127.0.0.1:1344/reqmod bypass=0
    icap_service webscreen2 respmod_precache icap://127.0.0.1:1344/respmod bypass=0
    adaptation_access webscreen1 allow all
    adaptation_access webscreen2 allow all

as request in comments, here is webscreen.py

#!/usr/bin/env python
import sys, time, datetime, os

log_file = "/etc/squid/webscreen/webscreen.log"

def main ():

        while (1):
                inline = sys.stdin.readline()
                logEntry (10, "New proxy request "+inline)
                sys.stdout.write("OK user=webscreen\n")
                sys.stdout.flush()


def logEntry(logmessagelevel, logmessage):

        global log_file
        # Get timestamp as human readable format
        now = datetime.datetime.now()
        timestamp = now.strftime("%Y-%m-%d %H:%M:%s")

        # open file to apptend
        logfile = open(log_file, 'a')
        logfile.write(timestamp+" "+str(logmessagelevel)+" "+logmessage+"\n")
        logfile.close()
        return



if __name__ == '__main__':
        main()
  • Have you found an answer for this, Steve? – ivanleoncz Aug 28 '17 at 5:42
  • No I never did, and gave up for now. I imagine I'll need to dig into the source or join the mailing list to solve this one. By that time a new version might be released that just works! – Steve Aug 28 '17 at 13:40
  • I'm working on a solution here, Steve, and I'll let you know about my results. It's not so easy, but I can see a "light" :). Thank you! – ivanleoncz Aug 28 '17 at 15:24
  • Thanks Ivan! I hope it works out and am curious to see what you find! – Steve Sep 16 '17 at 17:19
  • Can you share webscreen.py file? – Ravinder Singh Nov 12 '18 at 7:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.