eCAP

SSL Bump control from eCAP

Asked by Daryl Radivojevic

Is there are way to control which sites can be bypassed SSL decryption from eCAP during CONNECT stage?

Question information

Language:
English Edit question
Status:
Solved
For:
eCAP Edit question
Assignee:
No assignee Edit question
Solved by:
Alex Rousskov
Solved:
Last query:
Last reply:
Revision history for this message
Best Alex Rousskov (rousskov) said : 		#1

Please ask Squid-specific questions on Squid forums -- eCAP is not specific to Squid.

Yes, I believe you can control SslBump decisions from an eCAP REQMOD adapter by adding custom headers to the CONNECT request and then looking for those headers during ssl_bump ACL checks. I have not tested it though. This should work for forwarded SSL connections, but not for intercepted ones. In the latter case, the ssl_bump check is performed before a [fake] CONNECT request can be adapted (something that can be improved if needed but it will not be trivial).

Revision history for this message
Daryl Radivojevic (daryl-rad) said : 		#2

Thanks Alex Rousskov, that solved my question.