如何阻止Quarkus/Vert.x对Squid代理发起SSL连接？

环境：

• Quarkus 3.2.4
• Keycloak 22.0.1（作为授权服务）
• 使用quarkus.oidc组件集成OIDC认证

配置Squid代理后，通过javax.net.ssl日志发现vert.x-eventloop线程尝试与Squid建立SSL连接，关闭Vert.x HTTP2功能后问题仍未解决。日志显示服务先正常连接Keycloak的OIDC发现端点与/certs端点，随后向Squid发送ClientHello请求。

关键日志片段 #

2023-08-23 13:14:18.798,"javax.net.ssl|DEBUG|71|vert.x-eventloop-thread-1|2023-08-23 13:14:18.798 GMT|SSLEngineInputRecord.java:213|READ: TLSv1.2 application_data, length = 2272"
2023-08-23 13:14:18.801,javax.net.ssl|DEBUG|71|vert.x-eventloop-thread-1|2023-08-23 13:14:18.801 GMT|SSLCipher.java:1675|Plaintext after DECRYPTION (
...
2023-08-23 13:14:20.523,javax.net.ssl|ALL|10|main|2023-08-23 13:14:20.523 GMT|SignatureScheme.java:412|Ignore disabled signature scheme: rsa_md5
2023-08-23 13:14:20.524,"javax.net.ssl|DEBUG|10|main|2023-08-23 13:14:20.523 GMT|SSLExtensions.java:272|Ignore, context unavailable extension: cookie"
2023-08-23 13:14:20.533,"javax.net.ssl|DEBUG|10|main|2023-08-23 13:14:20.533 GMT|SSLExtensions.java:272|Ignore, context unavailable extension: renegotiation_info"
2023-08-23 13:14:20.534,javax.net.ssl|DEBUG|10|main|2023-08-23 13:14:20.533 GMT|PreSharedKeyExtension.java:661|No session to resume.
2023-08-23 13:14:20.534,"javax.net.ssl|DEBUG|10|main|2023-08-23 13:14:20.534 GMT|SSLExtensions.java:272|Ignore, context unavailable extension: pre_shared_key"
2023-08-23 13:14:20.542,javax.net.ssl|DEBUG|10|main|2023-08-23 13:14:20.541 GMT|ClientHello.java:641|Produced ClientHello handshake message (
2023-08-23 13:14:20.542,"""ClientHello"": {"
2023-08-23 13:14:20.542,"  ""client version""      : ""TLSv1.2"","
2023-08-23 13:14:20.542,"  ""random""              : ""5343023433CFCA8CAB3D6C3551F79C03817BD0BEBB11679D1587FF1BEC8C1B00"","
2023-08-23 13:14:20.542,"  ""session id""          : ""7092A57911F65CC5D96FF148FDFEE5BAFA63ACDE2A65AA27B504C6A3294D02E6"","
2023-08-23 13:14:20.542,"  ""cipher suites""       : ""[TLS_AES_256_GCM_SHA384(0x1302), TLS_AES_128_GCM_SHA256(0x1301), TLS_CHACHA20_POLY1305_SHA256(0x1303), TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384(0xC02C), TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256(0xC02B), TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256(0xCCA9), TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384(0xC030), TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256(0xCCA8), TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256(0xC02F), TLS_DHE_RSA_WITH_AES_256_GCM_SHA384(0x009F), TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256(0xCCAA), TLS_DHE_DSS_WITH_AES_256_GCM_SHA384(0x00A3), TLS_DHE_RSA_WITH_AES_128_GCM_SHA256(0x009E), TLS_DHE_DSS_WITH_AES_128_GCM_SHA256(0x00A2), TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384(0xC024), TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384(0xC028), TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256(0xC023), TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256(0xC027), TLS_DHE_RSA_WITH_AES_256_CBC_SHA256(0x006B), TLS_DHE_DSS_WITH_AES_256_CBC_SHA256(0x006A), TLS_DHE_RSA_WITH_AES_128_CBC_SHA256(0x0067), TLS_DHE_DSS_WITH_AES_128_CBC_SHA256(0x0040), TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384(0xC02E), TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384(0xC032), TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256(0xC02D), TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256(0xC031), TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384(0xC026), TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384(0xC02A), TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256(0xC025), TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256(0xC029), TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA(0xC00A), TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA(0xC014), TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA(0xC009), TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA(0xC013), TLS_DHE_RSA_WITH_AES_256_CBC_SHA(0x0039), TLS_DHE_DSS_WITH_AES_256_CBC_SHA(0x0038), TLS_DHE_RSA_WITH_AES_128_CBC_SHA(0x0033), TLS_DHE_DSS_WITH_AES_128_CBC_SHA(0x0032), TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA(0xC005), TLS_ECDH_RSA_WITH_AES_256_CBC_SHA(0xC00F), TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA(0xC004), TLS_ECDH_RSA_WITH_AES_128_CBC_SHA(0xC00E), TLS_RSA_WITH_AES_256_GCM_SHA384(0x009D), TLS_RSA_WITH_AES_128_GCM_SHA256(0x009C), TLS_RSA_WITH_AES_256_CBC_SHA256(0x003D), TLS_RSA_WITH_AES_128_CBC_SHA256(0x003C), TLS_RSA_WITH_AES_256_CBC_SHA(0x0035), TLS_RSA_WITH_AES_128_CBC_SHA(0x002F), TLS_EMPTY_RENEGOTIATION_INFO_SCSV(0x00FF)]"","
2023-08-23 13:14:20.542,"  ""compression methods"" : ""00"","
2023-08-23 13:14:20.542,"  ""extensions""          : ["
2023-08-23 13:14:20.542,"    ""server_name (0)"": {"
2023-08-23 13:14:20.542,"      type=host_name (0), value=outboundproxy.example.domain"
2023-08-23 13:14:20.542,"    },"
2023-08-23 13:14:20.542,"    ""status_request (5)"": {"
2023-08-23 13:14:20.542,"      ""certificate status type"": ocsp"
2023-08-23 13:14:20.542,"      ""OCSP status request"": {"
2023-08-23 13:14:20.542,"        ""responder_id"": <empty>"
2023-08-23 13:14:20.542,"        ""request extensions"": {"
2023-08-23 13:14:20.542,          <empty>
2023-08-23 13:14:20.542,        }
2023-08-23 13:14:20.542,      }
2023-08-23 13:14:20.542,"    }
...

原配置信息 #

quarkus.http.http2=false
quarkus.http.proxy.proxy-address-forwarding=true
quarkus.oidc.enabled=true
quarkus.oidc.auth-server-url=${keycloakAuthServerUrl}/realms/${keycloakRealm}
quarkus.oidc.discovery-enabled=true
quarkus.oidc.client-id=${keycloakResource}
quarkus.oidc.credentials.secret=${keycloakCredentialsSecret}
quarkus.oidc.tls.verification=none
quarkus.oidc.proxy.host=${squidProxyHost}
quarkus.oidc.proxy.port=${squidProxyPort}

解决方案 #

问题根源在于Keycloak授权组件会将协议与主机分离，原配置中${squidProxyHost}仅包含代理域名（如outboundproxy.example.domain），缺少协议前缀导致组件误将代理连接视为SSL连接。

修改OIDC代理主机配置，添加http://前缀：

quarkus.oidc.proxy.host=http://${squidProxyHost}

内容的提问来源于stack exchange，提问作者Anthony Heaney