<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class=""><br class=""></div><div class="">I would try ATS before resorting to Squid:</div><div class=""><a href="https://trafficserver.apache.org/" class="">https://trafficserver.apache.org/</a></div><div class=""><br class=""></div><div class="">While I don't know if it actually works for your use case, I always found that codebase to be much cleaner than Squid. </div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Rubens</div><div class=""><br class=""></div><div class=""><br class=""></div><div><br class=""><blockquote type="cite" class=""><div class="">On 12 May 2019, at 14:10, Paul Vixie <<a href="mailto:paul@redbarn.org" class="">paul@redbarn.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">i see that squid is not the only forward proxy available for HTTPS now. for <br class="">example:<br class=""><br class=""><a href="https://superuser.com/questions/604352/nginx-as-forward-proxy-for-https" class="">https://superuser.com/questions/604352/nginx-as-forward-proxy-for-https</a><br class=""><br class="">is this the state of the art? to prevent DoH bypasses to the DNS monitoring <br class="">and policy controls (see https://dnstap.info/ and https://dnsrpz.info/) i use <br class="">on my private networks, i'm going to have to strip-search all outbound HTTPS <br class="">that goes toward any wide-area IP address known or suspected to offer DoH, and <br class="">i'm going to have to return 404 for any URI that matches a known DoH endpoint.<br class=""><br class="">under TLS 1.3, with excrypted SID, none of the old transparent MiTM methods <br class="">will work any more. it's going to have to be an explicit proxy, which every <br class="">HTTPS speaker inside my network will have to import and trust a certificate <br class="">for.<br class=""><br class="">while i'd be happy to learn of commercial/proprietary solutions, which i'd use <br class="">on $dayjob's corporate network, and would blog about, i also need to know how <br class="">the F/L/OSS community is solving this kind of problem today. hopefully it's <br class="">not squid, but does it really require that i run a patched version of nginx?<br class=""><br class="">-- <br class="">Paul<br class=""><br class=""><br class="">_______________________________________________<br class="">dns-operations mailing list<br class="">dns-operations@lists.dns-oarc.net<br class="">https://lists.dns-oarc.net/mailman/listinfo/dns-operations<br class="">dns-operations mailing list<br class="">https://lists.dns-oarc.net/mailman/listinfo/dns-operations<br class=""></div></div></blockquote></div><br class=""></body></html>