0

I want all my traffic to a specific domain to be sent through a parent proxy, here is my squid conf:

acl localnet src 10.0.0.0/8     # RFC1918 possible internal network
acl localnet src 172.16.0.0/12  # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl localnet src fc00::/7       # RFC 4193 local private network range
acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) machines

acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT

http_access allow manager localhost
http_access allow localhost
http_access allow localnet
http_access deny manager
http_access deny !Safe_ports
http_access deny all
http_access allow localnet
http_access allow localhost
http_access deny all

http_port 3128

hierarchy_stoplist cgi-bin ?

coredump_dir /var/spool/squid

refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern .               0       20%     4320

cache_peer XXX.XXX.XXX.XXX  parent 3128 0 no-digest
cache_peer_domain XXX.XXX.XXX.XXX .srv-get-my-ip.com

So http://ip.srv-get-my-ip.com is well sent through the proxy as it returns Current Address: XXX.XXX.XXX.XXX:

1444889588.794    599 192.168.0.12 TCP_MISS/200 522 GET http://ip.srv-get-my-ip.com/ - FIRSTUP_PARENT/XXX.XXX.XXX.XXX text/html

But https://ip.srv-get-my-ip.com is not sent through the proxy as it returns my ip Current Address: YYY.YYY.YYY.YYY:

1444889762.199    154 192.168.0.12 TCP_MISS/200 6654 CONNECT ip.srv-get-my-ip.com:443 - HIER_DIRECT/AAA.AAA.AAA.AAA -

How can I get squid to process the second query the same way as the first one?

The result matters here, so if anyone can achieve the same goal using another proxy than squid (apache, haproxy or whatever), I'd give it a try!

Thanks!

1 Answer 1

0

Proxying SSL in the way you're describing can be done, but it requires[1] that you have the SSL certificates in your possession.

This is a feature, not a bug, because it prevents man-in-the-middle attacks against SSL.

If you are in possession of the certs, then most reverse proxies will work for you. You can, for example, configure squid to terminate the SSL connection, then re-establish it onwards toward the parent proxy. See the Squid https documentation

Note also from that page:

HTTPS was designed to give users an expectation of privacy and security. Decrypting HTTPS tunnels without user consent or knowledge may violate ethical norms and may be illegal in your jurisdiction.

Nginx, Apache Traffic Server, HAProxy, Apache httpd with mod_proxy, and several other reverse-proxies are all capable of performing SSL termination for you.

[1] There are exceptions this if you can tolerate insecure HTTPS, or (perhaps more interestingly) if you are able to control the trusted certs in clients. But... on that path lies danger.

2
  • Thanks for the detailed explanation! I know about most of you're talking about... So if the remote client is checking the certificate, verification will fail in raw SSL. But I think it might be possible to achieve this goal using TLS SNI extension... What do you think?
    – Syffys
    Oct 19, 2015 at 16:16
  • @Syffys the thing is, if the client is asking for www.example.com, the terminating server in the middle must be deemed by the client to have a valid certificate for www.example.com - SNI won't help here because the client will not ask for the other names, and the proxy will be unable to generate a trustworthy response. Unless!.. the proxy either a) has a valid cert, or - perhaps interestingly for your use case - b) if you create a local Certificate Authority and issue CA Certs to the clients, so they do trust the proxy
    – tomr
    Oct 20, 2015 at 16:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .