Re: [squid-users] Squid Block by file extension is not working.

On tis, 2008-06-24 at 13:09 +0600, Tuhin Black wrote:
> I have check and found this sites user different kind of link to download like,
> http://dw.com.com/redir?siteid=31&edid=3&ptid=&ontid=11735&ctype=RF;Song;ATN;PTNR&cval=3;21460710;2;&desturl=http%3A%2F%2Fdownload.mp3.com%2Findex.php%3Fsect%3Dforce_download%26type%3D3%26track_id%3D21460710%26time%3D1214201264%26auth%3Db286519c195e3dc51e7c0fee7fdda182

That looks like an intermediary URL, with the actual download url being
on download.mp3.com.. but neither uses the file name as part of the URL.

> if i check my squid access log, i have only found this log,
> http://dw.com.com/redir?
> http://download.mp3.com/index.php?

If you disable strip_query_terms then you'll see the crap after the ? as
well, but it won't help much in this case.

If you are lucky you can look for the Content-Disposition header. This
is often used for indicating the intended filename for downloads.

Another option is to look for the returned mime type, but many of these
kinds of servers advertise false content types to bypass such filters or
other reasons.... The link you gave results in a mime type of
application/force_download

> i am afraid maybe there is more site user can download mp3 or mpg
> files without any restriction.

Yes there is. There is quite many .mp3 file archives with all the files
named .doc or .xls instead of .mp3 for these reasons...

> Did i mis configure my squid?

No, you just didn't configure it for matching these "odd" downloads...

Regards
Henrik