Blocking SSL requests.

I do not see anything wrong with your eCAP adapter code snippet.

eCAP does not deal with the SSL encryption layer. If the block message is not encrypted on its way from Squid to the Squid client, this is a Squid bug. Please file a bug report with Squid bugzilla instead. Thank you.

I worked out how to get the correct response. It seems that I need to check that the URI starts with the protocol scheme, before I can use blockVirgin().

Modified example from above:

void Adapter::Xaction::start() {
 Must(hostx);

 if (libecap::RequestLine *requestLine = dynamic_cast<libecap::RequestLine *>(&hostx->virgin().firstLine())) {
  const libecap::Area &uri = requestLine->uri();
  if (strnstr(uri.start, "playboy", uri.size) != NULL) {
   if (strncmp(uri.start, "http", 4) != 0)
    goto useV;
   // make this adapter non-callable
   libecap::host::Xaction *x = hostx;
   hostx = 0;
   x->blockVirgin();
   return;
  }
 }

 useV:
 // make this adapter non-callable
 libecap::host::Xaction *x = hostx;
 hostx = 0;

 // tell the host to use the virgin message
 x->useVirgin();
}

Is there something that I need to configure in squid.conf to avoid getting SSL level eCAP calls?

It sounds like I do not understand the problem you are trying to solve, but, in general, both encrypted and plain requests may have Request-URIs that start (or do not start) with "http" if you look at raw headers.

Also, since Squid trunk r11270 (dated 2011-03-09), Squid should give always full URI to eCAP adapters (i.e., URI with scheme and host name followed by path). Thus, most URIs your adapter gets should start with http (both http://... and https://... URIs do). I believe that revision is in recent Squid v3.2 releases as well, but I have not checked that. URIs that do not start with "http" are ftp://... URIs and such.

If you need further help, please give specific examples of uri variable values (e.g., add debugging to your adapter) and explain how the beginning of a URI is related to SSL.

Thank you.

The problem is that squid calls void Adapter::Xaction::start() twice for each HTTPS request, whereas I expect it to be called only once. If I use blockVirgin() on the first Adapter::Xaction::start() call which does not contain URI with scheme, than that request is not processed by the browser.

If I add:
cout << __PRETTY_FUNCTION__ << ": " << uri << endl;
after "const libecap::Area &uri = requestLine->uri();" in my code above, this is the output from my
eCAP adapter when I browse to "https://www.playboy.com":

virtual void Adapter::Xaction::start(): www.playboy.com:443
virtual void Adapter::Xaction::start(): https://www.playboy.com/
virtual void Adapter::Xaction::start(): http://www.squid-cache.org/Artwork/SN.png

This is with ssl-bump enabled. Squid version:
# squid -v
Squid Cache: Version 3.2.0.9
configure options: '--prefix=/usr' '--includedir=/usr/include' '--datadir=/usr/share' '--bindir=/usr/sbin' '--libexecdir=/usr/lib/squid' '--localstatedir=/var' '--sysconfdir=/etc/squid' '--enable-async-io=64' '--with-pthreads' '--enable-storeio=diskd,ufs,aufs' '--enable-epoll' '--enable-removal-policies=heap,lru' '--with-large-files' '--enable-auth' '--enable-ntlm-auth-helpers=smb_lm' '--enable-basic-auth-helpers=MSNT,NCSA,LDAP,squid_radius_auth' '--enable-icap-client' '--with-filedescriptors=16384' '--enable-linux-netfilter' '--enable-ecap' '--enable-ssl' '--enable-ssl-crtd' 'PKG_CONFIG_PATH=/usr/local/lib/pkgconfig'

Squid does not send the same HTTPS request to the same REQMOD service twice. Based on your logs, the first request you got in your environment was an HTTP CONNECT request. The second was an HTTPS GET request.

IMO, you should detect CONNECT requests by their method, not URI pattern. Moreover, if you want to block based on a domain name, then blocking CONNECT request would be sufficient to prevent all subsequent HTTPS communication with that domain (there will be no HTTPS requests at all if all CONNECTs are blocked correctly).

O.K. That mostly answers my question. So if I use:

  if (requestLine->method() == libecap::methodConnect)
   goto useV;

I get the same result.

What should I use to block CONNECT requests, if not blockVirgin() ? Is this a bug with squid eCAP implementation that I should report?

Thanks Alex Rousskov, that solved my question.