1

We have access to a remote web API that requires a client cert to access (it's a PKI). I want to allow access to this API for specific servers / IPs in our network without them having to import the client cert into the keystore and also enable them to use http and not https. We cannot use a reverse proxy approach for a couple of reasons I would rather not get into.

Is there any way to talk http from client to proxy and from there use https (with the client-cert) to the server? I have seen ways to achieve this in squid using SslBump but only when https is being used from the client. I have seen a few questions like this for Apache but they all use ProxyPass which according to here Apache Module mod_proxy | apache.org is only for reverse-proxying.

To illustrate:

I am open to using squid, apache or any web server that provides real forward proxy capabilities.

  • This sounds like it would be best done with a reverse proxy. Perhaps you should get into those reasons you do not want to solve the problem with a reverse proxy. – Michael Hampton Apr 13 '18 at 16:21
  • My understanding is that if I use a reverse proxy I have to change the target of a call to the reverse proxy server and I do not have to do this with a forward proxy. Classically reverse proxies are used to handle incoming calls to backends that the reverse proxy is 'managing'. Regarding the API we want to proxy to: it is basically a suite of apis that (http) redirects me from one server to another and also sometimes returns URLs within payloads. So the set of URLs I need to proxy to is not well-defined. They do share a common domain. – dashambles Apr 13 '18 at 22:22
  • Hmm. Even if the number of URLs is large, if the hostnames are known in advance then a reverse proxy would still be the best approach. (And they should be known in advance if they're consumable API endpoints.) If the hostnames are generated somehow, or entirely arbitrary, then you might have to write something custom. But your question text gives only one hostname. If there is only one hostname then it would be trivial to do this with a reverse proxy. – Michael Hampton Apr 13 '18 at 23:00
  • Hostnames can be dynamic and we do not know the complete set. I don't agree that they should be known in advance to be consumable API endpoints. In a widest sense of rest we are just talking about resource identifiers / paths to resources. I have seen many apis where you call one API to get the URL of anotger or of a particular resource. Hateoas is built similar to this. But like I said is it not the case that with a reverse proxy I have to change the target of the call to the host of the reverse proxy itself? – dashambles Apr 14 '18 at 13:57
1

A Squid server configured as a forward proxy is able to receive plain HTTP requests from clients and forward HTTPS requests to upstream servers transparently. However, an external URL rewrite program is needed.

Write the following URL rewriting program into /etc/squid/urlrewrite.pl:

#!/usr/bin/perl
select(STDOUT);
$| = 1;
while (<>) {
    if (/^(|\d+\s+)((\w+):\/+)([^\/:]+)(|:(\d+))(|\/\S*)(|\s.*)$/) {
        my $channel = $1;
        my $protocolClean = $3;
        my $domain = $4;
        my $port = $5;
        my $portClean = $6;
        my $urlPath = $7;
        if ($protocolClean eq 'http' && ($port eq '' || $portClean eq '80')) {
            print STDOUT "${channel}OK rewrite-url=\"https://${domain}${urlPath}\"\n";
        } else {
            print STDOUT "${channel}ERR\n";
        }
    }
}

Then, add these configuration parameters into /etc/squid/squid.conf:

acl pkiRestDomain dstdomain -n pki.globalpki123.com
acl pkiRestUrlPath urlpath_regex ^/rest(|\/.*)$
url_rewrite_program /etc/squid/urlrewrite.pl
url_rewrite_access allow pkiRestDomain pkiRestUrlPath
sslproxy_client_certificate /etc/pki/squid/certs/mylocalproxy.crt
sslproxy_client_key /etc/pki/squid/private/mylocalproxy.key

Adjust sslproxy_client_certificate and sslproxy_client_key according to the actual path of the client certificate that Squid will use.

  • 1
    SELinux-enabled systems may need file context adjustment: semanage fcontext -a -t squid_exec_t /etc/squid/urlrewrite.pl – Anderson Medeiros Gomes Apr 14 '18 at 23:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.