<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Hello<br>
<br>
I have this simplified ACL in squid.conf<br>
<br>
acl denyit src all<br>
deny_info <a class="moz-txt-link-freetext" href="http://192.168.1.1/blocked.html">http://192.168.1.1/blocked.html</a> denyit<br>
http_access deny denyit<br>
<br>
The purpose is to block everything and redirect to
<a class="moz-txt-link-freetext" href="http://192.168.1.1/blocked.html">http://192.168.1.1/blocked.html</a><br>
<br>
It works fine with http (non-secure) CONNECT request ...<br>
<br>
> curl -ix 192.168.1.1:8080 <a class="moz-txt-link-freetext" href="http://google.com">http://google.com</a><br>
HTTP/1.1 302 Found<br>
Server: squid/4.3<br>
Mime-Version: 1.0<br>
Date: Tue, 16 Oct 2018 11:02:05 GMT<br>
Content-Type: text/html;charset=utf-8<br>
Content-Length: 0<br>
Location: <a class="moz-txt-link-freetext" href="http://192.168.1.1/blocked.html">http://192.168.1.1/blocked.html</a><br>
X-Squid-Error: 403 Access Denied<br>
X-Cache: MISS from somehost<br>
X-Cache-Lookup: NONE from somehost:8080<br>
Connection: keep-alive<br>
<br>
... but gives certificate error with https CONNECT request.<br>
<br>
> curl -ix 192.168.1.1:8080 <a class="moz-txt-link-freetext" href="https://google.com">https://google.com</a><br>
HTTP/1.1 200 Connection established<br>
<br>
curl: (60) SSL certificate problem: self signed certificate in
certificate chain<br>
More details here: <a class="moz-txt-link-freetext" href="https://curl.haxx.se/docs/sslcerts.html">https://curl.haxx.se/docs/sslcerts.html</a><br>
<br>
curl failed to verify the legitimacy of the server and therefore
could not<br>
establish a secure connection to it. To learn more about this
situation and<br>
how to fix it, please visit the web page mentioned above.<br>
<br>
<br>
I believe this is because squid first gives 200 status and hence
browser thinks connection is established expects Google's
certificate.<br>
<br>
Can squid not return with 302/307 on CONNECT HTTPs requests for
deny_info?<br>
<br>
Like instead of HTTP/1.1 200 Connection established - it returns:<br>
<br>
HTTP/1.1 307 Redirect<br>
Location: <a class="moz-txt-link-freetext" href="http://192.168.1.1/blocked.html">http://192.168.1.1/blocked.html</a><br>
(...)<br>
<br>
RFC 7231 <a class="moz-txt-link-freetext" href="https://tools.ietf.org/html/rfc7231#section-4.3.6">https://tools.ietf.org/html/rfc7231#section-4.3.6</a> states
that:<br>
<pre class="newpage">
Any response other than a successful response
indicates that the tunnel has not yet been formed and that the
connection remains governed by HTTP.</pre>
<br>
which means HTTP/1.1 307 Redirect should make browser treat
connection as HTTP and hopefully also follow Location.<br>
<br>
Any idea? Or any other workaround (except importing squid
certificate)<br>
<br>
Thanks and regards,<br>
<br>
Amish<br>
</body>
</html>