1

From abuse.ch one can get a plain text file with malware distributing URIs. I want to use this as a blacklist for squid proxy (not yet sure about runtime behavior). It should not be to hard to convert the URI file into a regex file for acl aclname url_regex ... using sed, but I struggle to find the squid regex syntax description to identify all special characters, that I have to escape.

Improve this question
4
  • the dquid page has a nice wiki, wiki.squid-cache.org/SquidFaq/SquidAcl
    – djdomi
    Mar 1, 2022 at 17:46
  • I know this wiki page, but it describes the acl syntax, not the regex syntax.
    – Thomas P
    Mar 2, 2022 at 7:06
  • You must be more specific and produce at least one example clearly stating what you intend to do. Anyway, assuming you just need to parse a hosts file https://urlhaus.abuse.ch/downloads/hostfile/, you may try this: search for ^(#.*$(\n|\r\n)?|127.*\t) and replace with ""
    – mjoao
    Jun 22, 2022 at 10:11
  • I'm looking for a description of the regex syntax itself. Which metacharacters, quantifiers, modifiers, ... are allowed, This differs slightly from perl to php to java to ...
    – Thomas P
    Jun 24, 2022 at 9:24

1 Answer 1

Reset to default
2

Squid understands GNUregex (Extended Regular Expressions, AKA: ERE REGEXP).
It does not fully understand Perl Regular Expressions, AKA: PCRE.
E.x: \w, \d, \W, \D, lookahead, negative lookahead, shy grouping, atomic groups, etc...)

Working examples:

^(outlook-[1-9]\.cdn|attachments|res\.cdn)\.office\.net$
^c[0-9]+.*(powerpoint|word|excel|visio).*[0-9]{2}\.cdn\.office\.net$
^trello-[a-zA-Z0-9]+\.s3\.amazonaws\.com$

NON WORKING examples but PCRE valid:
^(outlook-\d\.cdn|attachments|res\.cdn)\.office\.net$
^c\d+.*(powerpoint|word|excel|visio).*\d{2}\.cdn\.office\.net$
^trello-\w+\.s3\.amazonaws\.com$
^rr?[1-9]-{2,4}sn-(?!.*-apn[a-z]).*\.googlevideo\.com)$

More info: https://www.gnu.org/software/gnulib/manual/html_node/Regular-expressions.html https://www.gnu.org/software/grep/manual/html_node/Regular-Expressions.html

Improve this answer
1
  • While I think @mjoao is right, I would prefer him/her to add a link to the relevant SQUID configuration supporting such an answer.
    – EnzoR
    Sep 21 at 13:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .