How to redirect Https CONNECT Request with Squid Explicit Proxy

Question

I want to block certain urls for some users of my internal network. I am using a squid based explicit proxy for this purpose with a redirect_program. The clients are configured to use a pac file for https urls which makes them route their https requests to the explicit proxy.

The problem is, the redirection of any CONNECT request for an https url to a blocked page url fails. I tried both http and https based blocked page urls but could not find any luck. For some reasons, I do not want to use a transparent proxy with ssl bumping.

1. Safari gives the error 'Safari cannot open the page. The error was "There was a problem establishing a secure tunnel through the web proxy server"'

2. Chrome gives the error 'This web page is not available. ERR_TUNNEL_CONNECTION_FAILED'.

Here is a line from access.log for https://www.yahoo.com.

07/Oct/2015:01:41:29 -0500 74 172.0.0.9 TCP_REDIRECT/302 253 CONNECT www.yahoo.com:443 - HIER_NONE/- -

I read somewhere that the browser is expecting to start an SSL/TLS handshake after the connect request and that is why it is failing. Here is a qoute from the documentation of squid redirector.

"URL alterations and particularly redirection are only possible on certain methods, and some such as POST and CONNECT require special care."

It does not say redirection is not possible for CONNECT method. However, no where is it mentioned that how can we redirect POST and CONNECT (I am particularly interested in CONNECT) or any example is given.

Please guide me on how to redirect https connect requests to a blocked page. If this is not possible, is there a work around for this with explicit proxy? Thank you.

I am using squid 3.5.4 on ubuntu.

Answer 1

Unfortunately this is not possible without bumping (decrypting) SSL connection first. The browsers by design deny any additional payload/redirection from failed CONNECT requests. For more formal description see - http://docs.diladele.com/faq/squid/cannot_connect_to_site_using_https.html.

If you do decide to perform SSL decryption then it is possible to first let the CONNECT request succeed and later block/redirect next HTTP request coming through this established connection tunnel - please take into account that if might not even be HTTP as some applications use CONNECT proxy tunneling for their own protocols (like Skype for example).

Also something to have in mind - if the application used "SSL pinning" technique while making CONNECT requests to proxy - it will refuse to work with decrypted connections.