1

The client (C) pass through a proxy (P) to contact a server (S):

A --http--> P --https--> S

I need the proxy to be able to investigate the request content, for this I see two options:

  1. SSL tunnel interception: C sends a CONNECT request to create an SSL tunnel between C and S, however the proxy intercepts and breaks the SSL tunnel generating a certificate on-the-fly signed by an internal CA trusted by C to fulfil the handshake.
  2. The client uses a https:// scheme: C does not create a tunnel, it simply pass the HTTPS URL to the proxy (as it would do with HTTP URL's), then the proxy takes care of retrieving the data from S using HTTPS and to forward it to C in clear HTTP.

I consider the communication between C and P to be already secure, so I see no point in setting up SSL interception: time-consuming to setup, need to inject a homebrew CA in client's root CA, waste of computing resources to handle useless handshakes and encryption. At the opposite the second option is leightweight and allows to completely ban the use of CONNECT at the proxy.

A manual test using telnet easily shows that my squid installation works fine and support correctly this second option: I can successfully retrieve a document by passing an https:// scheme to the proxy.

However, the client C being on FreeBSD, I do not find a way to tell any client software to act the same way.

I did not find any relevant option in fetch. Same thing with wget.

I also tried curl, it seems to explain that all operations are made through HTTP unless -p/--proxytunnel is used, however it still tries to create a tunnel for HTTPS connection even without this option. I also tried to play with this option, including trying a --no-proxytunnel since according to the same manpage some boolean option accept this syntax but with no luck. Proxy tunnel seems indeed to be enforced on line 5635 of lib/url.c (commit):

/*************************************************************
 * If the protocol is using SSL and HTTP proxy is used, we set
 * the tunnel_proxy bit.
 *************************************************************/
if((conn->given->flags&PROTOPT_SSL) && conn->bits.httpproxy)
  conn->bits.tunnel_proxy = TRUE;

Any solution, either using tools from the FreeBSD base system or some well-known client available in the repository would be welcome!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.