I propose adding a new hook TS_HTTP_TUNNEL_START_HOOK. It triggers when a blind tunnel starts. A plugin using this hook has the opportunity to use some other information (e.g., policy, time of day, cat entrails) to determine whether the blind tunnel should be allowed.
I also propose a new API TSTxnType TSHttpTxnTypeGet(TSHttpTxn txnp) It returns an enumerated value based on the type of the translation. One of TS_TXN_TYPE_HTTP, TS_TXN_TYPE_EXPLICIT_TUNNEL, TS_TXN_TYPE_TR_PASS_TUNNEL. A plugin can use this information in the Start Hook to make decisions about whether to allow the tunnel. PR https://github.com/apache/trafficserver/pull/10308