Weirdness with/without domain name

[bizaff]

I have two hosts, issues.example.com and docs.example.com. Normally I connect to these sites as shown to the left with https. When I'm connected through VPN, I can refer to them as just issues and docs. I sometimes get links to these in gmail, and they can show up as https://issues/ or https://issues.example.com

In the ABE system rulesets, I have:

Site LOCAL ^https://.*\example\.com
Accept from LOCAL
Accept from ^https://.*\example\.com
Accept from https://talkgadget.google.com
Accept from https://mail.google.com
Accept from https://www.google.com
Deny

The last three represent the various sites ABE reports as blocked. Often, I'll have two sites comma separated after the <<< , one representing the google redirect.

When I click on a link I received through gmail to https://issues.example.com/blahblahblah, I get the following ABE warning:

Request { GET https://issues.example.com/blahblahblah <<< https://issues.example.com/partofthepreviousURL, https://mail.google.com/_/scs/sometrackinglink} filtered by ABE: <LOCAL ^https://.*\.example\.com> Deny

If I change the last three lines from Accept to Anonymize, I have to login each time, but the links go through. I don't understand why.

Is my approach right? Is there something I'm not understanding about handling both inside/outside the VPN? Does LOCAL sometimes match these and sometimes not if I'm inside the VPN? Should I enumerate these sites individually before a LOCAL rule? Sometimes I get email linking to an internal only site that's not available outside the VPN.

I'm assuming I'm a bit lax by combining LOCAL with the example.com rule.

I'm on version 2.6.9.32.

[barbaz]

Yeah, you've made a bit of a mess of the ABE rules, I'd suggest you go to about:config and reset the noscript.ABE.ruleset.* prefs

Try this one, put it *above* the default SYSTEM rule:

Code: Select all

Site issues.example.com docs.example.com https://issues/* https://docs/*
Accept from issues.example.com docs.example.com https://issues/* https://docs/* https://talkgadget.google.com/* https://mail.google.com/* https://www.google.com/*
Deny

(hey, that Accept should be all one line, the forum is breaking it up instead of giving horizontal scrollbars. oh well)

[bizaff]

That makes it go for those sites, but now I run into other links breaking. From https://docs.example.com there's a link to http://mysvnserver, which I can only see from the VPN. Any link from docs.example.com is now blocked because of the LOCAL rule. If I access https://docs from within the VPN, it works fine.

If I

Code: Select all

Site issues.example.com docs.example.com https://issues/* https://docs/* http://mysvnserver
Accept from issues.example.com docs.example.com https://issues/* https://docs/* http://mysvnserver https://talkgadget.google.com/* https://mail.google.com/* https://www.google.com/*
Deny

, that works.

I'm assuming this is most secure but this seems like a rabbit hole for each and every local site I have that people might email a link to. I have faith in my ability to not click on stupid things, and I'm willing to forego a bit of security to make this not suck, along the lines of my previous LOCAL "mess"

Any other ideas?

Is there any way to tell ABE to treat a site as if it's LOCAL? The sites in .example.com are fully under our control, just allowed to be forward facing.

[barbaz]

I'm assuming this is most secure but this seems like a rabbit hole for each and every local site I have that people might email a link to. I have faith in my ability to not click on stupid things,

So what's the problem? Seems fine to me...

Any other ideas?

I don't have any, sorry.
Maybe someone else will?

Is there any way to tell ABE to treat a site as if it's LOCAL?

Theoretically, there's noscript.ABE.localExtras; but in practice (at least last time I checked) that is completely broken.

[Thrawn]

I think that LOCAL needs to be included in the Accept line of the extra rule:

Code: Select all

Site issues.example.com docs.example.com https://issues/* https://docs/* http://mysvnserver
Accept from LOCAL issues.example.com docs.example.com https://issues/* https://docs/* http://mysvnserver https://talkgadget.google.com/* https://mail.google.com/* https://www.google.com/*
Deny