]> git.ipfire.org Git - thirdparty/squid.git/commit
Support tunneling of bumped non-HTTP traffic. Other SslBump fixes.
authorChristos Tsantilas <chtsanti@users.sourceforge.net>
Fri, 4 Nov 2016 16:47:34 +0000 (18:47 +0200)
committerChristos Tsantilas <chtsanti@users.sourceforge.net>
Fri, 4 Nov 2016 16:47:34 +0000 (18:47 +0200)
commit6b2b6cfe1e9e1f1fbf2b310f9c28532f1c70e00c
treeffe7031613e7e4ec8784652398a568bf441dea19
parenta7378e715141a56527221d8212901c35c8360a95
Support tunneling of bumped non-HTTP traffic. Other SslBump fixes.

Use case: Skype groups appear to use TLS-encrypted MSNP protocol instead
of HTTPS. This change allows Squid admins using SslBump to tunnel Skype
groups and similar non-HTTP traffic bytes via "on_unsupported_protocol
tunnel all". Previously, the combination resulted in encrypted HTTP 400
(Bad Request) messages sent to the client (that does not speak HTTP).

Also this patch:
 * fixes bug 4529: !EBIT_TEST(entry->flags, ENTRY_FWD_HDR_WAIT)
   assertion in FwdState.cc.

 * when splicing transparent connections during SslBump step1, avoid
   access-logging an extra record and log %ssl::bump_mode as the expected
   "splice" not "none".

 * handles an XXX comment inside clientTunnelOnError for possible memory
   leak of client streams related objects

 * fixes TunnelStateData logging in the case of splicing after peek.

This is a Measurement Factory project.
14 files changed:
src/HttpRequest.cc
src/RequestFlags.h
src/anyp/ProtocolType.h
src/client_side.cc
src/client_side.h
src/client_side_request.cc
src/http/Stream.h
src/http/one/RequestParser.cc
src/http/one/RequestParser.h
src/servers/FtpServer.cc
src/servers/FtpServer.h
src/servers/Http1Server.cc
src/servers/Http1Server.h
src/tunnel.cc