Thanks Amos for details. Working like a charm now. Instead of sending https://192.168.1.122:443/myguard.php?rule-id=0&;.... Helper sends 192.168.1.122:443 " url_rewrite_access deny CONNECT" is not a solution because, everything using SSL today ( thanks to Google that wants to encrypt all the Net and make proxies/Firewall/ICAP unusable ) and many Porn/Malwares/Hacking/Hacked websites using SSL. -----Message d'origine----- De : squid-users <squid-users-bounces@xxxxxxxxxxxxxxxxxxxxx> De la part de Amos Jeffries Envoyé : jeudi 16 août 2018 03:51 À : squid-users@xxxxxxxxxxxxxxxxxxxxx Objet : Re: v4.2 url_rewrite Uri.cc line 371 bad URL parsing on SSL On 16/08/18 11:58, David Touzeau wrote: > Hi, > > > > I have written my own url_rewrite helper > > > > On SSL sites, the helper answering a redirect to a remote denied php page. > No your helper *rewrite* the URL without changing any other properties of the request message. This can be seen clearly in the use of "rewrite-url=" instead of "url=". The difference is important when it comes to the type of message being processed. > > With HTTP, no issue but on SSL there is a different behavior > > My helper return > > rewrite-url= https://192.168.1.122:443/myguard.php?rule-id=0&;.... > > but according to debug, the Uri.cc understand : host='https', > port='443', path='' > > In this case, squid try to connect to an https machine name and return > bad 503 > > ... > > Did i miss something ??? > Look at the input received by the helper. HTTPS uses CONNECT requests. Those messages have authority-form URI not URLs. The above behaviour is what happens when your helpers response is interpreted according to authority-form syntax. <https://tools.ietf.org/html/rfc7230#section-5.3.3> You can prevent the SSL-Bump CONNECT messages being sent to the re-writer with: url_rewrite_access deny CONNECT OR, you can try to do a proper redirect by having the helper send: OK status=302 url=... The latter *might* work. Depending on whether the client handles redirection on CONNECT requests. Browsers don't support anything other than 200 status. Other clients have a mix of behaviours so its somewhat unreliable. Amos _______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users _______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users
