]> git.ipfire.org Git - thirdparty/squid.git/commit - src/client_side_request.cc
transaction_initiator ACL for detecting various unusual transactions
authorChristos Tsantilas <chtsanti@users.sourceforge.net>
Mon, 12 Jun 2017 20:26:41 +0000 (23:26 +0300)
committerChristos Tsantilas <chtsanti@users.sourceforge.net>
Mon, 12 Jun 2017 20:26:41 +0000 (23:26 +0300)
commit5ceaee752b4a01c8a4fd8ab3071ce369a552d04e
tree52240bccaf8080adbe82f275088a1d67d5c35873
parenta0924f71b189a7070b618d59ff11b51aac7da3a6
transaction_initiator ACL for detecting various unusual transactions

This ACL is essential in several use cases, including:

* After fetching a missing intermediate certificate, Squid uses the
  regular cache (and regular caching rules) to store the response. Squid
  deployments that do not want to cache regular traffic need to cache
  fetched certificates and only them.

  acl fetched_certificate transaction_initiator certificate-fetching
  cache allow fetched_certificate
  cache deny all

* Many traffic policies and tools assume the existence of an HTTP client
  behind every transaction. Internal Squid requests violate that
  assumption. Identifying internal requests protects external ACLs, log
  analyzers, and other mechanisms from the transactions they mishandle.

  acl skip_logging transaction_initiator internal
  access_log ... !skip_logging

The new transaction_initiator ACL classifies transactions based on their
initiator. Currently supported initiators are esi, certificate-fetching,
cache-digest, internal, client, and all. In the future, the same ACL
will be able to identify HTTP/2 push transactions using the "server"
initiator. See src/cf.data.pre for details.

This is a Measurement Factory project.
43 files changed:
src/AclRegs.cc
src/Downloader.cc
src/Downloader.h
src/HttpRequest.cc
src/HttpRequest.h
src/Makefile.am
src/MasterXaction.h
src/PeerPoolMgr.cc
src/RequestFlags.h
src/XactionInitiator.cc [new file with mode: 0644]
src/XactionInitiator.h [new file with mode: 0644]
src/acl/Asn.cc
src/acl/Makefile.am
src/acl/TransactionInitiator.cc [new file with mode: 0644]
src/acl/TransactionInitiator.h [new file with mode: 0644]
src/adaptation/ecap/Host.cc
src/adaptation/ecap/XactionRep.cc
src/adaptation/icap/ModXact.cc
src/adaptation/icap/Xaction.cc
src/cf.data.pre
src/client_side.cc
src/client_side.h
src/client_side_reply.cc
src/client_side_request.cc
src/client_side_request.h
src/comm/TcpAcceptor.cc
src/esi/Include.cc
src/forward.h [new file with mode: 0644]
src/htcp.cc
src/icmp/net_db.cc
src/icp_v2.cc
src/mgr/Inquirer.cc
src/mime.cc
src/neighbors.cc
src/peer_digest.cc
src/security/PeerConnector.cc
src/servers/FtpServer.cc
src/servers/Http1Server.cc
src/servers/Server.h
src/store_digest.cc
src/tests/stub_HttpRequest.cc
src/tests/testHttpRequest.cc
src/urn.cc