« Lighttpd, virtual hosts, alternative ports | Main | Elastifox & FirefoxPortable »
Squid handling http –> https redirects
By Matt | May 29, 2009
In configuring Squid to handle both our port 80 and 443 traffic, we have the issue that we can use redirects at the webserver level to redirect certain pages to https:// .
So this is handled in Squid.
First, make a simple script. There’s a possibility another redirector like Squirm might do a better job, but I haven’t played with them.
!/usr/bin/perl
$|=1;
while (<>) {
s@http://www7.getmiro.(com|net|org)/adopt(.*)$@301:https://www7.getmiro.com/adopt$2@;
print;
}
Saved at /etc/squid3/squid_redirector.pl and chown/chmod so the user “proxy” that squid runs under can run it. Your path, of course, may vary.
The key part for what we need is that we pre-pend “301″ before https: in the rewrite. When this is returned to the user’s browser it redirects them to the secure page. This script also takes anything at com, net, or org and forces them to a tld of .com as well.
It’s easy to test this perl script. Simply type ./squid_redirector.pl which launches it interactively.
# ./squid_redirector.pl
http://www7.getmiro.com/foohttp://www7.getmiro.com/foo
http://www7.getmiro.com/adopt/test
301:https://www7.getmiro.com/adopt/test
http://www7.getmiro.net/adopt/matt/is/an/evil/genius
301:https://www7.getmiro.com/adopt/matt/is/an/evil/genius
Next, tell Squid to use it. We need to enable these lines in the squid.conf file:
url_rewrite_program /etc/squid3/squid_redirector.pl
url_rewrite_children 10
url_rewrite_host_header off
url_rewrite_bypass on
The first line tells Squid what to use to rewrite URLs, the second tells it to spawn 10 instances on startup. I’m not sure, in the end, if host_header needs to be off. url_rewrite_bypass on allows Squid to skip the re-writing step if all the redirectors are busy. That’s a decision knowing our security risks, users, and needs — and I’m going with more reliability over absolute security. We’ll should see skips showing up in the logs and adjust settings from there if necessary.
Restart Squid, give it a test. Famous last words — it should work now.
References:
http://wiki.squid-cache.org/Features/Redirectors
http://brainextender.blogspot.com/2009/01/simple-squid-redirector-perl-script.html
Topics: Linux, Squid, Sysadmin Tools | No Comments »
Comments
You must be logged in to post a comment.