Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: Tim Watts Newsgroups: uk.d-i-y,uk.comp.os.linux,comp.os.linux.misc Subject: Re: Parental guardian - internet (WEB) filtering Date: Sat, 04 Apr 2015 19:25:23 +0100 Lines: 30 Message-ID: References: <8ri4vb-ele.ln1@squidward.dionic.net> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-Trace: individual.net WbaBiZrYtmpgatmakbzByQR4kueO3J675ijp12H+Bn0eJxaBpm X-Orig-Path: squidward.dionic.net!not-for-mail Cancel-Lock: sha1:7LoKSFH96xEMGw7wD5xpN+OXbAU= User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.5.0 In-Reply-To: Xref: csiph.com comp.os.linux.misc:14330 On 04/04/15 13:24, Martin Gregorie wrote: > On Sat, 04 Apr 2015 09:09:44 +0100, Tim Watts wrote: > >> On 04/04/15 01:52, Bobbie Sellers wrote: >>> This Linux Journal article might be of help. >>> proxy> >>> >>> bliss >> >> That's very interesting - but he seems to have glossed over the SSL >> problem... > > I think its been dealt with by the Squid developers. See: > http://wiki.squid-cache.org/Features/HTTPS > > but working out exactly how an SSL connection is handled would need more > than the quick scan I gave it. Squid documentation seems to be a bit > fragmented and its website's internal search seems to be borked, but > hopefully that link will give you enough clues to find the relevant > entries. > > I can skip the read - because it is fundamentally impossible to proxy an SSL connection at anything above the TCP datastream as you'd need copies of the target SSL certs to be able to fake a session that was valid to the client. No amount of squid clever-trickery can help with that.