<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Greetings from Beijing. When it comes to the location, you know our security concerns.<div class="">I managed to implement the following bluemaps:</div><div class=""><br class=""></div><div class="">* <span class="Apple-tab-span" style="white-space:pre"> </span>acl <span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class="">extranet</span><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class=""> <span class="Apple-tab-span" style="white-space:pre"> </span></span>dstdomain “domain list A”</div><div class="">*<span class="Apple-tab-span" style="white-space:pre"> </span>acl <span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class="">extranet_whitelist</span><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class=""> <span class="Apple-tab-span" style="white-space:pre"> </span></span>dstdomain “domain list B”</div><div class="">*<span class="Apple-tab-span" style="white-space:pre"> </span>cache_peer<span class="Apple-tab-span" style="white-space:pre"> </span>a.b.c.d<span class="Apple-tab-span" style="white-space:pre"> </span>parent …. name=NodeNG</div><div class="">* <span class="Apple-tab-span" style="white-space:pre"> </span>always_direct <span class="Apple-tab-span" style="white-space:pre"> </span>extranet_whitelist</div><div class="">* <span class="Apple-tab-span" style="white-space:pre"> </span>never_direct<span class="Apple-tab-span" style="white-space:pre"> </span>extranet</div><div class="">*<span class="Apple-tab-span" style="white-space:pre"> </span>( NO IP based acl at all , except pre-defined localhost,localnet,acl etc)</div><div class="">It seems peer-selection is functional as expected.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class="">I’ve dig into lots of history mails on DNS queries, cache_peers. Anyhow I observed </span><font color="#000000" class=""><span style="caret-color: rgb(0, 0, 0);" class=""><a href="http://peer-select.cc" class="">peer-select.cc</a> still conducting DNS lookups on an extranet domain , which is a purely domain-based ACL. e.g.</span></font></div><div class=""><font color="#000000" class=""><br class=""></font></div><div class=""><font color="#000000" class="">“<span class="Apple-tab-span" style="white-space:pre"> </span><span style="caret-color: rgb(0, 0, 0);" class=""><a href="http://peer_select.cc" class="">peer_select.cc</a>(833) selectSomeParent: CONNECT <a href="http://www.example.com" class="">www.example.com</a></span></font></div><div class=""><font color="#000000" class=""><span class="Apple-tab-span" style="caret-color: rgb(0, 0, 0); white-space: pre;"> </span>… ...</font></div><div class=""><font color="#000000" class=""><span class="Apple-tab-span" style="white-space:pre"> </span><span style="caret-color: rgb(0, 0, 0);" class=""><a href="http://peer_select.cc" class="">peer_select.cc</a>(460) resolveSelected: Find IP destination for: <a href="http://www.example.com:443" class="">www.example.com:443</a>' via a.b.c.d</span></font></div><div class=""></div><div class=""><span style="color: rgb(0, 0, 0); caret-color: rgb(0, 0, 0);" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>…</span><span style="color: rgb(0, 0, 0);" class=""> </span><span style="color: rgb(0, 0, 0); caret-color: rgb(0, 0, 0);" class="">…</span></div><div class=""><font color="#000000" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>ipcacheParse: 1 answers for <a href="http://www.example.com" class="">www.example.com</a></font></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span>… …</div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span> <a href="http://ipcache.cc" class="">ipcache.cc</a>(532) addGood: <a href="http://www.example.com" class="">www.example.com</a> #1 q.w.e.r</div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span><a href="http://ipcache.cc" class="">ipcache.cc</a>(576) ipcacheHandleReply: done with <a href="http://www.example.com" class="">www.example.com</a> </div><div class="">“</div><div class="">In other words, Squid conducts DNS lookups after peer-selection is finished. Anyhow, a parent proxy can typically handle DNS queries themselves, whether the child proxy do it or not. </div><div class=""><br class=""></div><div class="">DNS is not reliable, especially the way Squid uses (UDP 53). For the following concerns, ISP might manipulate DNS replies</div><div class=""><br class=""></div><div class="">+ redirect clients to faster local CDNs, which might help them to reduce expenses caused by traffic.</div><div class="">+ redirect clients to another connection pool during peak hours, for ISP-side load-balancing or Qos purposes. </div><div class="">+ block some sites with demand of authorized agencies</div><div class=""><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class="">+ as a further step, for DPI, package analyse , site cataloge ( to assign different IP flags for the above 3 purposes) etc.</span></div><div class=""><font color="#000000" class=""><span style="caret-color: rgb(0, 0, 0);" class="">+ others</span></font></div><div class=""><br class=""></div><div class="">As a result, <span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class="">incorrect </span>DNS replies cause remarkable issues, including No such domains, http 4xx, http 5xx, SSL handshake failures. It brings up DNS leak and privacy issues that a child cache conducts DNS queries.</div><div class=""><br class=""></div><div class="">So, what can I do to have extranet DNS handled by the parent proxy, while leaving the remainder to the child proxy, with a domain list ? </div><div class=""><br class=""></div><div class="">Thank you</div><div class=""><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class=""><br class=""></span></div><div class="">—</div><div class=""><div class="">Squid Cache: Version 5.7</div><div class="">Service Name: squid</div><div class="">Debian linux</div></div></body></html>