Re: filtering HTTPS

On 03/14/2012 04:22 PM, Marcus Kool wrote:
> Tsantilas Christos wrote:
>> There is the ICAP preview transaction. The proxy send headers and a part
>> of the data (eg the first 1024 bytes) and the ICAP server can respond
>> with "100 Continue" to tell to the proxy "continue with data stream", or
>> "204 Allow" to tell to the proxy that "I am not interested any more".
>>
>>> On 03/14/2012 01:33 AM, Amos Jeffries wrote:
>>>> It does. http://www.squid-cache.org/Doc/config/icap_206_enable/
>>
>> The 206 responses are similar to 204 responses (inside or outside
>> preview) but also allow modifying the headers or the head of the data.
>
> Data streams come in parts.
> Maybe a filter wants to see the first data chunk of the client, followed
> by the first data chunk from the server and followed by the second data
> chunk
> of the client to finally decide: block (close sockets) or say "I am not
> interested anymore". So the filter receives all data chunks of the data
> stream
> until it signals the proxy about its decision. For all chunks, when there
> is not yet a decision, the filter needs to respond with something like
> "Continue".

The ICAP protocol is not able to handle such cases. Just extending the
ICAP protocol is not enough.
Also my opinion is an HTTP proxy is not the correct tool to handle this
type of filtering...
Maybe can be implemented in squid but requires completely new
interface/module to handle this. You can not just extend the ICAP/ECAP
filtering subsystems....
Received on Wed Mar 14 2012 - 14:59:46 MDT