]> git.ipfire.org Git - thirdparty/squid.git/blame - src/tunnel.cc
Source Format Enforcement (#1234)
[thirdparty/squid.git] / src / tunnel.cc
CommitLineData
983061ed 1/*
b8ae064d 2 * Copyright (C) 1996-2023 The Squid Software Foundation and contributors
e25c139f 3 *
bbc27441
AJ
4 * Squid software is distributed under GPLv2+ license and includes
5 * contributions from numerous individuals and organizations.
6 * Please see the COPYING and CONTRIBUTORS files for details.
983061ed 7 */
983061ed 8
bbc27441
AJ
9/* DEBUG: section 26 Secure Sockets Layer Proxy */
10
582c2af2 11#include "squid.h"
a011edee 12#include "acl/FilledChecklist.h"
e5ddd4ce 13#include "base/AsyncCallbacks.h"
6c420975 14#include "base/CbcPointer.h"
2b6b1bcb 15#include "base/JobWait.h"
675b8408 16#include "base/Raw.h"
a011edee 17#include "CachePeer.h"
9fe3d316 18#include "cbdata.h"
a011edee 19#include "client_side.h"
602d9612 20#include "client_side_request.h"
f5e17947 21#include "clients/HttpTunneler.h"
9f518b4a 22#include "comm.h"
cfd66529 23#include "comm/Connection.h"
aed188fd 24#include "comm/ConnOpener.h"
7e66d5e2 25#include "comm/Read.h"
ec41b64c 26#include "comm/Write.h"
a011edee 27#include "errorpage.h"
6821c276 28#include "fd.h"
a011edee 29#include "fde.h"
4f3c27a1 30#include "FwdState.h"
40f1e76d 31#include "globals.h"
55622953 32#include "HappyConnOpener.h"
e5ee81f0 33#include "http.h"
a98270b0 34#include "http/StatusCode.h"
d3dddfb5 35#include "http/Stream.h"
a011edee 36#include "HttpRequest.h"
9710965e 37#include "icmp/net_db.h"
6dc6127b 38#include "ip/QosConfig.h"
8a713747 39#include "LogTags.h"
a011edee 40#include "MemBuf.h"
0ce8e93b 41#include "neighbors.h"
cfd66529 42#include "PeerSelectState.h"
55622953 43#include "ResolvedPeers.h"
65e41a45 44#include "sbuf/SBuf.h"
a72b6e88 45#include "security/BlindPeerConnector.h"
4d5904f7 46#include "SquidConfig.h"
765afa31 47#include "StatCounters.h"
a23223bf 48#if USE_OPENSSL
93ead3fd 49#include "ssl/bio.h"
5d65362c 50#include "ssl/ServerBump.h"
a23223bf 51#endif
4e540555 52#include "tools.h"
8b082ed9 53#include "tunnel.h"
582c2af2
FC
54#if USE_DELAY_POOLS
55#include "DelayId.h"
56#endif
57
074d6a40
AJ
58#include <climits>
59#include <cerrno>
582c2af2 60
8ca1d33d
AJ
61/**
62 * TunnelStateData is the state engine performing the tasks for
63 * setup of a TCP tunnel from an existing open client FD to a server
64 * then shuffling binary data between the resulting FD pair.
65 */
66/*
67 * TODO 1: implement a read/write API on ConnStateData to send/receive blocks
68 * of pre-formatted data. Then we can use that as the client side of the tunnel
69 * instead of re-implementing it here and occasionally getting the ConnStateData
70 * read/write state wrong.
71 *
72 * TODO 2: then convert this into a AsyncJob, possibly a child of 'Server'
73 */
6043e368 74class TunnelStateData: public PeerSelectionInitiator
62e76326 75{
6043e368 76 CBDATA_CHILD(TunnelStateData);
a46d2c0e 77
78public:
6b2b6cfe 79 TunnelStateData(ClientHttpRequest *);
337b9aa4 80 ~TunnelStateData() override;
8ca1d33d
AJ
81 TunnelStateData(const TunnelStateData &); // do not implement
82 TunnelStateData &operator =(const TunnelStateData &); // do not implement
a46d2c0e 83
84 class Connection;
c8407295
AJ
85 static void ReadClient(const Comm::ConnectionPointer &, char *buf, size_t len, Comm::Flag errcode, int xerrno, void *data);
86 static void ReadServer(const Comm::ConnectionPointer &, char *buf, size_t len, Comm::Flag errcode, int xerrno, void *data);
87 static void WriteClientDone(const Comm::ConnectionPointer &, char *buf, size_t len, Comm::Flag flag, int xerrno, void *data);
88 static void WriteServerDone(const Comm::ConnectionPointer &, char *buf, size_t len, Comm::Flag flag, int xerrno, void *data);
a46d2c0e 89
90 bool noConnections() const;
25d2603f
EB
91 /// closes both client and server connections
92 void closeConnections();
93
983061ed 94 char *url;
6c420975 95 CbcPointer<ClientHttpRequest> http;
8a70cdbb 96 HttpRequest::Pointer request;
06521a10 97 AccessLogEntryPointer al;
62e76326 98
fb046c1b 99 const char * getHost() const {
aee3523a 100 return (server.conn != nullptr && server.conn->getPeer() ? server.conn->getPeer()->host : request->url.host());
fb046c1b
AJ
101 };
102
e2bbd3b3
AR
103 /// store the given to-server connection; prohibit retries and do not look
104 /// for any other destinations
105 void commitToServer(const Comm::ConnectionPointer &);
106
3ed5793b 107 /// Whether the client sent a CONNECT request to us.
1c8fc082 108 bool clientExpectsConnectResponse() const {
aff439e0 109 // If we are forcing a tunnel after receiving a client CONNECT, then we
6b2b6cfe
CT
110 // have already responded to that CONNECT before tunnel.cc started.
111 if (request && request->flags.forceTunnel)
112 return false;
5d65362c
CT
113#if USE_OPENSSL
114 // We are bumping and we had already send "OK CONNECTED"
090f1d3c 115 if (http.valid() && http->getConn() && http->getConn()->serverBump() && http->getConn()->serverBump()->at(XactionStep::tlsBump2, XactionStep::tlsBump3))
5d65362c
CT
116 return false;
117#endif
aee3523a 118 return !(request != nullptr &&
1c8fc082
A
119 (request->flags.interceptTproxy || request->flags.intercepted));
120 }
3ed5793b 121
0ce8e93b
EB
122 /// starts connecting to the next hop, either for the first time or while
123 /// recovering from the previous connect failure
124 void startConnecting();
25b0ce45
CT
125 void closePendingConnection(const Comm::ConnectionPointer &conn, const char *reason);
126
f5e17947 127 /// called when negotiations with the peer have been successfully completed
25b0ce45 128 void notePeerReadyToShovel(const Comm::ConnectionPointer &);
f5e17947 129
a46d2c0e 130 class Connection
62e76326 131 {
a46d2c0e 132
133 public:
aee3523a 134 Connection() : len (0), buf ((char *)xmalloc(SQUID_TCP_SO_RCVBUF)), size_ptr(nullptr), delayedLoops(0),
25d2603f 135 dirty(false),
aee3523a 136 readPending(nullptr), readPendingFunc(nullptr) {}
a46d2c0e 137
8a467c4b
AJ
138 ~Connection();
139
25d2603f
EB
140 /// initiates Comm::Connection ownership, including closure monitoring
141 template <typename Method>
142 void initConnection(const Comm::ConnectionPointer &aConn, Method method, const char *name, TunnelStateData *tunnelState);
143
144 /// reacts to the external closure of our connection
145 void noteClosure();
146
8a467c4b 147 int bytesWanted(int lower=0, int upper = INT_MAX) const;
a46d2c0e 148 void bytesIn(int const &);
9a0a18de 149#if USE_DELAY_POOLS
a46d2c0e 150
151 void setDelayId(DelayId const &);
152#endif
153
154 void error(int const xerrno);
5c926411 155 int debugLevelForError(int const xerrno) const;
25d2603f 156
8a467c4b 157 void dataSent (size_t amount);
74f35ca8
AR
158 /// writes 'b' buffer, setting the 'writer' member to 'callback'.
159 void write(const char *b, int size, AsyncCall::Pointer &callback, FREE * free_func);
62e76326 160 int len;
8a467c4b 161 char *buf;
74f35ca8 162 AsyncCall::Pointer writer; ///< pending Comm::Write callback
ac9f46af 163 uint64_t *size_ptr; /* pointer to size in an ConnStateData for logging */
62e76326 164
fb046c1b 165 Comm::ConnectionPointer conn; ///< The currently connected connection.
9fe3d316 166 uint8_t delayedLoops; ///< how many times a read on this connection has been postponed.
fb046c1b 167
25d2603f
EB
168 bool dirty; ///< whether write() has been called (at least once)
169
215c41fa
AJ
170 // XXX: make these an AsyncCall when event API can handle them
171 TunnelStateData *readPending;
172 EVH *readPendingFunc;
f5e17947 173
9a0a18de 174#if USE_DELAY_POOLS
62e76326 175
a46d2c0e 176 DelayId delayId;
59715b38 177#endif
62e76326 178
25d2603f
EB
179 private:
180 /// the registered close handler for the connection
181 AsyncCall::Pointer closer;
a46d2c0e 182 };
183
184 Connection client, server;
8a713747 185 int *status_ptr; ///< pointer for logging HTTP status
f5e17947 186
3248e962 187 SBuf preReadClientData;
6821c276 188 SBuf preReadServerData;
0ce8e93b 189 time_t startTime; ///< object creation time, before any peer selection/connection attempts
55622953
CT
190 ResolvedPeersPointer destinations; ///< paths for forwarding the request
191 bool destinationsFound; ///< At least one candidate path found
e2bbd3b3
AR
192
193 /// whether the decision to tunnel to a particular destination was final
194 bool committedToServer;
195
a98270b0
EB
196 int n_tries; ///< the number of forwarding attempts so far
197
198 /// a reason to ban reforwarding attempts (or nil)
199 const char *banRetries;
200
5106d639
EB
201 // TODO: remove after fixing deferred reads in TunnelStateData::copyRead()
202 CodeContext::Pointer codeContext; ///< our creator context
55622953 203
2b6b1bcb
AR
204 /// waits for a transport connection to the peer to be established/opened
205 JobWait<HappyConnOpener> transportWait;
206
207 /// waits for the established transport connection to be secured/encrypted
208 JobWait<Security::PeerConnector> encryptionWait;
209
210 /// waits for an HTTP CONNECT tunnel through a cache_peer to be negotiated
211 /// over the (encrypted, if needed) transport connection to that cache_peer
212 JobWait<Http::Tunneler> peerWait;
3ed5793b 213
a46d2c0e 214 void copyRead(Connection &from, IOCB *completion);
215
a23223bf 216 /// continue to set up connection to a peer, going async for SSL peers
25b0ce45
CT
217 void connectToPeer(const Comm::ConnectionPointer &);
218 void secureConnectionToPeer(const Comm::ConnectionPointer &);
a23223bf 219
6043e368 220 /* PeerSelectionInitiator API */
337b9aa4
AR
221 void noteDestination(Comm::ConnectionPointer conn) override;
222 void noteDestinationsEnd(ErrorState *selectionError) override;
6043e368 223
55622953
CT
224 void syncHierNote(const Comm::ConnectionPointer &server, const char *origin);
225
226 /// called when a connection has been successfully established or
227 /// when all candidate destinations have been tried and all have failed
228 void noteConnection(HappyConnOpenerAnswer &);
229
55622953
CT
230 /// Start using an established connection
231 void connectDone(const Comm::ConnectionPointer &conn, const char *origin, const bool reused);
232
233 void notifyConnOpener();
234
6043e368
AR
235 void saveError(ErrorState *finalError);
236 void sendError(ErrorState *finalError, const char *reason);
237
a46d2c0e 238private:
3dde9e52
CT
239 void usePinned();
240
25b0ce45
CT
241 /// callback handler for the Security::PeerConnector encryptor
242 void noteSecurityPeerConnectorAnswer(Security::EncryptorAnswer &);
243
244 /// called after connection setup (including any encryption)
245 void connectedToPeer(const Comm::ConnectionPointer &);
246 void establishTunnelThruProxy(const Comm::ConnectionPointer &);
247
248 template <typename StepStart>
249 void advanceDestination(const char *stepDescription, const Comm::ConnectionPointer &conn, const StepStart &startStep);
fcfdf7f9 250
25d2603f
EB
251 /// \returns whether the request should be retried (nil) or the description why it should not
252 const char *checkRetry();
e2bbd3b3
AR
253
254 bool transporting() const;
25d2603f 255
a98270b0 256 // TODO: convert to unique_ptr
6043e368
AR
257 /// details of the "last tunneling attempt" failure (if it failed)
258 ErrorState *savedError = nullptr;
259
f5e17947
CT
260 /// resumes operations after the (possibly failed) HTTP CONNECT exchange
261 void tunnelEstablishmentDone(Http::TunnelerAnswer &answer);
262
25d2603f
EB
263 void deleteThis();
264
2b6b1bcb
AR
265 void cancelStep(const char *reason);
266
a98270b0 267 bool exhaustedTries() const;
e7a9b7a8 268 void updateAttempts(int);
a98270b0 269
5c2f68b7 270public:
c8407295 271 bool keepGoingAfterRead(size_t len, Comm::Flag errcode, int xerrno, Connection &from, Connection &to);
3ed5793b 272 void copy(size_t len, Connection &from, Connection &to, IOCB *);
c8407295
AJ
273 void readServer(char *buf, size_t len, Comm::Flag errcode, int xerrno);
274 void readClient(char *buf, size_t len, Comm::Flag errcode, int xerrno);
275 void writeClientDone(char *buf, size_t len, Comm::Flag flag, int xerrno);
276 void writeServerDone(char *buf, size_t len, Comm::Flag flag, int xerrno);
3ed5793b 277
3248e962 278 void copyClientBytes();
6821c276 279 void copyServerBytes();
25d2603f
EB
280
281 /// handles client-to-Squid connection closure; may destroy us
282 void clientClosed();
283
284 /// handles Squid-to-server connection closure; may destroy us
285 void serverClosed();
286
287 /// tries connecting to another destination, if available,
288 /// otherwise, initiates the transaction termination
289 void retryOrBail(const char *context);
a46d2c0e 290};
983061ed 291
11007d4b 292static ERCB tunnelErrorComplete;
575d05c4
AJ
293static CLCB tunnelServerClosed;
294static CLCB tunnelClientClosed;
8d77a37c 295static CTCB tunnelTimeout;
215c41fa
AJ
296static EVH tunnelDelayedClientRead;
297static EVH tunnelDelayedServerRead;
30a4f2a8 298
25d2603f 299/// TunnelStateData::serverClosed() wrapper
b8d8561b 300static void
575d05c4 301tunnelServerClosed(const CommCloseCbParams &params)
30a4f2a8 302{
25d2603f
EB
303 const auto tunnelState = reinterpret_cast<TunnelStateData *>(params.data);
304 tunnelState->serverClosed();
305}
26ac0430 306
25d2603f
EB
307void
308TunnelStateData::serverClosed()
309{
310 server.noteClosure();
752fa208
AR
311
312 retryOrBail(__FUNCTION__);
30a4f2a8 313}
314
25d2603f 315/// TunnelStateData::clientClosed() wrapper
b177367b 316static void
575d05c4 317tunnelClientClosed(const CommCloseCbParams &params)
30a4f2a8 318{
25d2603f
EB
319 const auto tunnelState = reinterpret_cast<TunnelStateData *>(params.data);
320 tunnelState->clientClosed();
321}
62e76326 322
25d2603f
EB
323void
324TunnelStateData::clientClosed()
325{
326 client.noteClosure();
26ac0430 327
25d2603f
EB
328 if (noConnections())
329 return deleteThis();
330
331 if (!server.writer)
332 server.conn->close();
333}
334
335/// destroys the tunnel (after performing potentially-throwing cleanup)
336void
337TunnelStateData::deleteThis()
338{
339 assert(noConnections());
340 // ConnStateData pipeline should contain the CONNECT we are performing
341 // but it may be invalid already (bug 4392)
342 if (const auto h = http.valid()) {
343 if (const auto c = h->getConn())
344 if (const auto ctx = c->pipeline.front())
345 ctx->finished();
71a2ced6 346 }
25d2603f 347 delete this;
30a4f2a8 348}
983061ed 349
6b2b6cfe 350TunnelStateData::TunnelStateData(ClientHttpRequest *clientRequest) :
f5e17947 351 startTime(squid_curtime),
55622953 352 destinations(new ResolvedPeers()),
5106d639 353 destinationsFound(false),
e2bbd3b3 354 committedToServer(false),
a98270b0
EB
355 n_tries(0),
356 banRetries(nullptr),
5106d639 357 codeContext(CodeContext::Current())
8ca1d33d
AJ
358{
359 debugs(26, 3, "TunnelStateData constructed this=" << this);
215c41fa
AJ
360 client.readPendingFunc = &tunnelDelayedClientRead;
361 server.readPendingFunc = &tunnelDelayedServerRead;
6b2b6cfe
CT
362
363 assert(clientRequest);
364 url = xstrdup(clientRequest->uri);
365 request = clientRequest->request;
55622953 366 Must(request);
6b2b6cfe
CT
367 server.size_ptr = &clientRequest->out.size;
368 client.size_ptr = &clientRequest->al->http.clientRequestSz.payloadData;
369 status_ptr = &clientRequest->al->http.code;
6b2b6cfe
CT
370 al = clientRequest->al;
371 http = clientRequest;
372
25d2603f 373 client.initConnection(clientRequest->getConn()->clientConnection, tunnelClientClosed, "tunnelClientClosed", this);
6b2b6cfe
CT
374
375 AsyncCall::Pointer timeoutCall = commCbCall(5, 4, "tunnelTimeout",
376 CommTimeoutCbPtrFun(tunnelTimeout, this));
377 commSetConnTimeout(client.conn, Config.Timeout.lifetime, timeoutCall);
8ca1d33d
AJ
378}
379
380TunnelStateData::~TunnelStateData()
983061ed 381{
8ca1d33d
AJ
382 debugs(26, 3, "TunnelStateData destructed this=" << this);
383 assert(noConnections());
384 xfree(url);
2b6b1bcb 385 cancelStep("~TunnelStateData");
6043e368 386 delete savedError;
983061ed 387}
388
8a467c4b
AJ
389TunnelStateData::Connection::~Connection()
390{
215c41fa
AJ
391 if (readPending)
392 eventDelete(readPendingFunc, readPending);
393
8a467c4b
AJ
394 safe_free(buf);
395}
396
25d2603f
EB
397const char *
398TunnelStateData::checkRetry()
399{
400 if (shutting_down)
401 return "shutting down";
a98270b0
EB
402 if (exhaustedTries())
403 return "exhausted tries";
25d2603f
EB
404 if (!FwdState::EnoughTimeToReForward(startTime))
405 return "forwarding timeout";
a98270b0
EB
406 if (banRetries)
407 return banRetries;
25d2603f
EB
408 if (noConnections())
409 return "no connections";
a98270b0 410
09835feb 411 // TODO: Use std::optional for peer_reply_status to avoid treating zero value specially.
a98270b0
EB
412 if (request->hier.peer_reply_status != Http::scNone && !Http::IsReforwardableStatus(request->hier.peer_reply_status))
413 return "received HTTP status code is not reforwardable";
414
415 // TODO: check pinned connections; see FwdState::pinnedCanRetry()
25d2603f
EB
416 return nullptr;
417}
418
419void
420TunnelStateData::retryOrBail(const char *context)
421{
25d2603f
EB
422 assert(!server.conn);
423
424 const auto *bailDescription = checkRetry();
425 if (!bailDescription) {
426 if (!destinations->empty())
427 return startConnecting(); // try connecting to another destination
428
429 if (subscribed) {
430 debugs(26, 4, "wait for more destinations to try");
431 return; // expect a noteDestination*() call
432 }
433
434 // fall through to bail
435 }
436
437 /* bail */
438
439 if (request)
440 request->hier.stopPeerClock(false);
441
442 // TODO: Add sendSavedErrorOr(err_type type, Http::StatusCode, context).
443 // Then, the remaining method code (below) should become the common part of
444 // sendNewError() and sendSavedErrorOr(), used in "error detected" cases.
445 if (!savedError)
446 saveError(new ErrorState(ERR_CANNOT_FORWARD, Http::scInternalServerError, request.getRaw(), al));
447 const auto canSendError = Comm::IsConnOpen(client.conn) && !client.dirty &&
448 clientExpectsConnectResponse();
449 if (canSendError)
450 return sendError(savedError, bailDescription ? bailDescription : context);
451 *status_ptr = savedError->httpStatus;
452
453 if (noConnections())
454 return deleteThis();
455
456 // This is a "Comm::IsConnOpen(client.conn) but !canSendError" case.
457 // Closing the connection (after finishing writing) is the best we can do.
458 if (!client.writer)
459 client.conn->close();
460 // else writeClientDone() must notice a closed server and close the client
461}
462
a46d2c0e 463int
8a467c4b 464TunnelStateData::Connection::bytesWanted(int lowerbound, int upperbound) const
447e176b 465{
9a0a18de 466#if USE_DELAY_POOLS
8a467c4b 467 return delayId.bytesWanted(lowerbound, upperbound);
a46d2c0e 468#else
8b082ed9 469 (void)lowerbound;
8a467c4b 470 return upperbound;
a46d2c0e 471#endif
472}
62e76326 473
a46d2c0e 474void
fa34dd97 475TunnelStateData::Connection::bytesIn(int const &count)
a46d2c0e 476{
bf95c10a 477 debugs(26, 3, "len=" << len << " + count=" << count);
9a0a18de 478#if USE_DELAY_POOLS
a46d2c0e 479 delayId.bytesIn(count);
480#endif
62e76326 481
a46d2c0e 482 len += count;
447e176b 483}
62e76326 484
55622953
CT
485/// update "hierarchy" annotations with a new (possibly failed) destination
486/// \param origin the name of the origin server we were trying to reach
487void
488TunnelStateData::syncHierNote(const Comm::ConnectionPointer &conn, const char *origin)
489{
490 request->hier.resetPeerNotes(conn, origin);
12f5a662 491 al->hier.resetPeerNotes(conn, origin);
55622953
CT
492}
493
e7a9b7a8
EB
494/// sets n_tries to the given value (while keeping ALE in sync)
495void
496TunnelStateData::updateAttempts(const int newValue)
497{
498 Assure(n_tries <= newValue); // n_tries cannot decrease
499
500 // Squid probably creates at most one FwdState/TunnelStateData object per
501 // ALE, but, unlike an assignment would, this increment logic works even if
502 // Squid uses multiple such objects for a given ALE in some esoteric cases.
503 al->requestAttempts += (newValue - n_tries);
504
505 n_tries = newValue;
506 debugs(26, 5, n_tries);
507}
508
a46d2c0e 509int
fa34dd97 510TunnelStateData::Connection::debugLevelForError(int const xerrno) const
a46d2c0e 511{
512#ifdef ECONNRESET
513
514 if (xerrno == ECONNRESET)
515 return 2;
516
447e176b 517#endif
518
a46d2c0e 519 if (ignoreErrno(xerrno))
520 return 3;
521
522 return 1;
523}
adb78bd4 524
983061ed 525/* Read from server side and queue it for writing to the client */
a46d2c0e 526void
c8407295 527TunnelStateData::ReadServer(const Comm::ConnectionPointer &c, char *buf, size_t len, Comm::Flag errcode, int xerrno, void *data)
983061ed 528{
fa34dd97 529 TunnelStateData *tunnelState = (TunnelStateData *)data;
e0d28505 530 assert(cbdataReferenceValid(tunnelState));
bf95c10a 531 debugs(26, 3, c);
c4b7a5a9 532
11007d4b 533 tunnelState->readServer(buf, len, errcode, xerrno);
a46d2c0e 534}
62e76326 535
a46d2c0e 536void
ced8def3 537TunnelStateData::readServer(char *, size_t len, Comm::Flag errcode, int xerrno)
a46d2c0e 538{
bf95c10a 539 debugs(26, 3, server.conn << ", read " << len << " bytes, err=" << errcode);
9fe3d316 540 server.delayedLoops=0;
d01053a2 541
a46d2c0e 542 /*
c8407295 543 * Bail out early on Comm::ERR_CLOSING
26ac0430 544 * - close handlers will tidy up for us
a46d2c0e 545 */
a55f4cea 546
c8407295 547 if (errcode == Comm::ERR_CLOSING)
a46d2c0e 548 return;
62e76326 549
ee1679df 550 if (len > 0) {
a46d2c0e 551 server.bytesIn(len);
a0864754
AJ
552 statCounter.server.all.kbytes_in += len;
553 statCounter.server.other.kbytes_in += len;
d8165775 554 request->hier.notePeerRead();
ee1679df 555 }
62e76326 556
3ed5793b
AR
557 if (keepGoingAfterRead(len, errcode, xerrno, server, client))
558 copy(len, server, client, WriteClientDone);
559}
560
a46d2c0e 561void
fa34dd97 562TunnelStateData::Connection::error(int const xerrno)
a46d2c0e 563{
bf95c10a 564 debugs(50, debugLevelForError(xerrno), conn << ": read/write failure: " << xstrerr(xerrno));
62e76326 565
a46d2c0e 566 if (!ignoreErrno(xerrno))
fb046c1b 567 conn->close();
983061ed 568}
569
570/* Read from client side and queue it for writing to the server */
a46d2c0e 571void
c8407295 572TunnelStateData::ReadClient(const Comm::ConnectionPointer &, char *buf, size_t len, Comm::Flag errcode, int xerrno, void *data)
983061ed 573{
fa34dd97 574 TunnelStateData *tunnelState = (TunnelStateData *)data;
11007d4b 575 assert (cbdataReferenceValid (tunnelState));
62e76326 576
11007d4b 577 tunnelState->readClient(buf, len, errcode, xerrno);
a46d2c0e 578}
62e76326 579
a46d2c0e 580void
ced8def3 581TunnelStateData::readClient(char *, size_t len, Comm::Flag errcode, int xerrno)
a46d2c0e 582{
bf95c10a 583 debugs(26, 3, client.conn << ", read " << len << " bytes, err=" << errcode);
9fe3d316 584 client.delayedLoops=0;
d01053a2 585
a46d2c0e 586 /*
c8407295 587 * Bail out early on Comm::ERR_CLOSING
26ac0430 588 * - close handlers will tidy up for us
a46d2c0e 589 */
a55f4cea 590
c8407295 591 if (errcode == Comm::ERR_CLOSING)
a46d2c0e 592 return;
a55f4cea 593
a46d2c0e 594 if (len > 0) {
595 client.bytesIn(len);
a0864754 596 statCounter.client_http.kbytes_in += len;
a46d2c0e 597 }
62e76326 598
3ed5793b
AR
599 if (keepGoingAfterRead(len, errcode, xerrno, client, server))
600 copy(len, client, server, WriteServerDone);
a46d2c0e 601}
62e76326 602
3ed5793b
AR
603/// Updates state after reading from client or server.
604/// Returns whether the caller should use the data just read.
605bool
c8407295 606TunnelStateData::keepGoingAfterRead(size_t len, Comm::Flag errcode, int xerrno, Connection &from, Connection &to)
a46d2c0e 607{
bf95c10a 608 debugs(26, 3, "from={" << from.conn << "}, to={" << to.conn << "}");
fd54d9b2 609
a46d2c0e 610 /* I think this is to prevent free-while-in-a-callback behaviour
26ac0430 611 * - RBC 20030229
fb046c1b 612 * from.conn->close() / to.conn->close() done here trigger close callbacks which may free TunnelStateData
a46d2c0e 613 */
83564ee7 614 const CbcPointer<TunnelStateData> safetyLock(this);
62e76326 615
60dafd5e 616 /* Bump the source connection read timeout on any activity */
8d77a37c
AJ
617 if (Comm::IsConnOpen(from.conn)) {
618 AsyncCall::Pointer timeoutCall = commCbCall(5, 4, "tunnelTimeout",
dc49061a 619 CommTimeoutCbPtrFun(tunnelTimeout, this));
8d77a37c
AJ
620 commSetConnTimeout(from.conn, Config.Timeout.read, timeoutCall);
621 }
99c02c10 622
2677c3b1
JPM
623 /* Bump the dest connection read timeout on any activity */
624 /* see Bug 3659: tunnels can be weird, with very long one-way transfers */
625 if (Comm::IsConnOpen(to.conn)) {
626 AsyncCall::Pointer timeoutCall = commCbCall(5, 4, "tunnelTimeout",
627 CommTimeoutCbPtrFun(tunnelTimeout, this));
628 commSetConnTimeout(to.conn, Config.Timeout.read, timeoutCall);
629 }
630
58c0b17d 631 if (errcode)
a46d2c0e 632 from.error (xerrno);
60dafd5e 633 else if (len == 0 || !Comm::IsConnOpen(to.conn)) {
bf95c10a 634 debugs(26, 3, "Nothing to write or client gone. Terminate the tunnel.");
fb046c1b 635 from.conn->close();
62e76326 636
60dafd5e 637 /* Only close the remote end if we've finished queueing data to it */
97c81191 638 if (from.len == 0 && Comm::IsConnOpen(to.conn) ) {
fb046c1b 639 to.conn->close();
c4b7a5a9 640 }
ec41b64c 641 } else if (cbdataReferenceValid(this)) {
3ed5793b
AR
642 return true;
643 }
644
645 return false;
646}
647
648void
649TunnelStateData::copy(size_t len, Connection &from, Connection &to, IOCB *completion)
650{
bf95c10a 651 debugs(26, 3, "Schedule Write");
1c8fc082
A
652 AsyncCall::Pointer call = commCbCall(5,5, "TunnelBlindCopyWriteHandler",
653 CommIoCbPtrFun(completion, this));
aee3523a 654 to.write(from.buf, len, call, nullptr);
983061ed 655}
656
657/* Writes data from the client buffer to the server side */
a46d2c0e 658void
c8407295 659TunnelStateData::WriteServerDone(const Comm::ConnectionPointer &, char *buf, size_t len, Comm::Flag flag, int xerrno, void *data)
983061ed 660{
fa34dd97 661 TunnelStateData *tunnelState = (TunnelStateData *)data;
11007d4b 662 assert (cbdataReferenceValid (tunnelState));
aee3523a 663 tunnelState->server.writer = nullptr;
a46d2c0e 664
11007d4b 665 tunnelState->writeServerDone(buf, len, flag, xerrno);
a46d2c0e 666}
a55f4cea 667
a46d2c0e 668void
ced8def3 669TunnelStateData::writeServerDone(char *, size_t len, Comm::Flag flag, int xerrno)
a46d2c0e 670{
bf95c10a 671 debugs(26, 3, server.conn << ", " << len << " bytes written, flag=" << flag);
62e76326 672
d8165775
AR
673 if (flag == Comm::ERR_CLOSING)
674 return;
675
676 request->hier.notePeerWrite();
677
5dacdf3f 678 /* Error? */
c8407295 679 if (flag != Comm::OK) {
d8165775
AR
680 debugs(26, 4, "to-server write failed: " << xerrno);
681 server.error(xerrno); // may call comm_close
5dacdf3f 682 return;
c4b7a5a9 683 }
62e76326 684
5dacdf3f 685 /* EOF? */
a46d2c0e 686 if (len == 0) {
bf95c10a 687 debugs(26, 4, "No read input. Closing server connection.");
fb046c1b 688 server.conn->close();
a46d2c0e 689 return;
690 }
62e76326 691
5dacdf3f 692 /* Valid data */
a0864754
AJ
693 statCounter.server.all.kbytes_out += len;
694 statCounter.server.other.kbytes_out += len;
5dacdf3f 695 client.dataSent(len);
696
a46d2c0e 697 /* If the other end has closed, so should we */
97c81191 698 if (!Comm::IsConnOpen(client.conn)) {
bf95c10a 699 debugs(26, 4, "Client gone away. Shutting down server connection.");
fb046c1b 700 server.conn->close();
a55f4cea 701 return;
c4b7a5a9 702 }
62e76326 703
f53969cc 704 const CbcPointer<TunnelStateData> safetyLock(this); /* ??? should be locked by the caller... */
a46d2c0e 705
5dacdf3f 706 if (cbdataReferenceValid(this))
3248e962 707 copyClientBytes();
983061ed 708}
709
710/* Writes data from the server buffer to the client side */
a46d2c0e 711void
c8407295 712TunnelStateData::WriteClientDone(const Comm::ConnectionPointer &, char *buf, size_t len, Comm::Flag flag, int xerrno, void *data)
983061ed 713{
fa34dd97 714 TunnelStateData *tunnelState = (TunnelStateData *)data;
11007d4b 715 assert (cbdataReferenceValid (tunnelState));
aee3523a 716 tunnelState->client.writer = nullptr;
a46d2c0e 717
11007d4b 718 tunnelState->writeClientDone(buf, len, flag, xerrno);
a46d2c0e 719}
720
721void
e0d28505 722TunnelStateData::Connection::dataSent(size_t amount)
a46d2c0e 723{
bf95c10a 724 debugs(26, 3, "len=" << len << " - amount=" << amount);
a46d2c0e 725 assert(amount == (size_t)len);
726 len =0;
727 /* increment total object size */
728
729 if (size_ptr)
730 *size_ptr += amount;
d8165775 731
a46d2c0e 732}
733
74f35ca8
AR
734void
735TunnelStateData::Connection::write(const char *b, int size, AsyncCall::Pointer &callback, FREE * free_func)
736{
737 writer = callback;
25d2603f 738 dirty = true;
74f35ca8
AR
739 Comm::Write(conn, b, size, callback, free_func);
740}
741
25d2603f
EB
742template <typename Method>
743void
744TunnelStateData::Connection::initConnection(const Comm::ConnectionPointer &aConn, Method method, const char *name, TunnelStateData *tunnelState)
745{
746 Must(!Comm::IsConnOpen(conn));
747 Must(!closer);
748 Must(Comm::IsConnOpen(aConn));
749 conn = aConn;
750 closer = commCbCall(5, 4, name, CommCloseCbPtrFun(method, tunnelState));
751 comm_add_close_handler(conn->fd, closer);
752}
753
754void
755TunnelStateData::Connection::noteClosure()
756{
757 debugs(26, 3, conn);
758 conn = nullptr;
759 closer = nullptr;
760 writer = nullptr; // may already be nil
761}
762
a46d2c0e 763void
ced8def3 764TunnelStateData::writeClientDone(char *, size_t len, Comm::Flag flag, int xerrno)
a46d2c0e 765{
bf95c10a 766 debugs(26, 3, client.conn << ", " << len << " bytes written, flag=" << flag);
62e76326 767
d8165775
AR
768 if (flag == Comm::ERR_CLOSING)
769 return;
770
5dacdf3f 771 /* Error? */
c8407295 772 if (flag != Comm::OK) {
d8165775
AR
773 debugs(26, 4, "from-client read failed: " << xerrno);
774 client.error(xerrno); // may call comm_close
5dacdf3f 775 return;
c4b7a5a9 776 }
62e76326 777
5dacdf3f 778 /* EOF? */
a46d2c0e 779 if (len == 0) {
bf95c10a 780 debugs(26, 4, "Closing client connection due to 0 byte read.");
fb046c1b 781 client.conn->close();
62e76326 782 return;
983061ed 783 }
62e76326 784
5dacdf3f 785 /* Valid data */
a0864754 786 statCounter.client_http.kbytes_out += len;
5dacdf3f 787 server.dataSent(len);
788
a46d2c0e 789 /* If the other end has closed, so should we */
97c81191 790 if (!Comm::IsConnOpen(server.conn)) {
bf95c10a 791 debugs(26, 4, "Server has gone away. Terminating client connection.");
fb046c1b 792 client.conn->close();
a55f4cea 793 return;
983061ed 794 }
62e76326 795
f53969cc 796 CbcPointer<TunnelStateData> safetyLock(this); /* ??? should be locked by the caller... */
a55f4cea 797
5dacdf3f 798 if (cbdataReferenceValid(this))
6821c276 799 copyServerBytes();
983061ed 800}
801
b8d8561b 802static void
8d77a37c 803tunnelTimeout(const CommTimeoutCbParams &io)
983061ed 804{
8d77a37c 805 TunnelStateData *tunnelState = static_cast<TunnelStateData *>(io.data);
bf95c10a 806 debugs(26, 3, io.conn);
11007d4b 807 /* Temporary lock to protect our own feets (comm_close -> tunnelClientClosed -> Free) */
83564ee7 808 CbcPointer<TunnelStateData> safetyLock(tunnelState);
a55f4cea 809
25d2603f 810 tunnelState->closeConnections();
a46d2c0e 811}
62e76326 812
25b0ce45
CT
813void
814TunnelStateData::closePendingConnection(const Comm::ConnectionPointer &conn, const char *reason)
815{
816 debugs(26, 3, "because " << reason << "; " << conn);
817 assert(!server.conn);
818 if (IsConnOpen(conn))
819 conn->close();
820}
821
a46d2c0e 822void
25d2603f 823TunnelStateData::closeConnections()
a46d2c0e 824{
25d2603f
EB
825 if (Comm::IsConnOpen(server.conn))
826 server.conn->close();
827 if (Comm::IsConnOpen(client.conn))
828 client.conn->close();
a46d2c0e 829}
830
9fe3d316
AJ
831static void
832tunnelDelayedClientRead(void *data)
833{
834 if (!data)
835 return;
4846303f 836
215c41fa 837 TunnelStateData *tunnel = static_cast<TunnelStateData*>(data);
5106d639
EB
838 const auto savedContext = CodeContext::Current();
839 CodeContext::Reset(tunnel->codeContext);
aee3523a 840 tunnel->client.readPending = nullptr;
9fe3d316 841 static uint64_t counter=0;
215c41fa 842 debugs(26, 7, "Client read(2) delayed " << ++counter << " times");
9fe3d316 843 tunnel->copyRead(tunnel->client, TunnelStateData::ReadClient);
5106d639 844 CodeContext::Reset(savedContext);
9fe3d316
AJ
845}
846
847static void
848tunnelDelayedServerRead(void *data)
849{
850 if (!data)
851 return;
4846303f 852
215c41fa 853 TunnelStateData *tunnel = static_cast<TunnelStateData*>(data);
5106d639
EB
854 const auto savedContext = CodeContext::Current();
855 CodeContext::Reset(tunnel->codeContext);
aee3523a 856 tunnel->server.readPending = nullptr;
9fe3d316 857 static uint64_t counter=0;
215c41fa 858 debugs(26, 7, "Server read(2) delayed " << ++counter << " times");
9fe3d316 859 tunnel->copyRead(tunnel->server, TunnelStateData::ReadServer);
5106d639 860 CodeContext::Reset(savedContext);
9fe3d316
AJ
861}
862
a46d2c0e 863void
fa34dd97 864TunnelStateData::copyRead(Connection &from, IOCB *completion)
a46d2c0e 865{
866 assert(from.len == 0);
9fe3d316
AJ
867 // If only the minimum permitted read size is going to be attempted
868 // then we schedule an event to try again in a few I/O cycles.
869 // Allow at least 1 byte to be read every (0.3*10) seconds.
870 int bw = from.bytesWanted(1, SQUID_TCP_SO_RCVBUF);
5106d639
EB
871 // XXX: Delay pools must not delay client-to-Squid traffic (i.e. when
872 // from.readPendingFunc is tunnelDelayedClientRead()).
a928fdfd 873 // XXX: Bug #4913: For delay pools, use delayRead() API instead.
9fe3d316 874 if (bw == 1 && ++from.delayedLoops < 10) {
215c41fa
AJ
875 from.readPending = this;
876 eventAdd("tunnelDelayedServerRead", from.readPendingFunc, from.readPending, 0.3, true);
9fe3d316
AJ
877 return;
878 }
879
fd54d9b2 880 AsyncCall::Pointer call = commCbCall(5,4, "TunnelBlindCopyReadHandler",
abd8f140 881 CommIoCbPtrFun(completion, this));
9fe3d316 882 comm_read(from.conn, from.buf, bw, call);
983061ed 883}
884
3248e962
CT
885void
886TunnelStateData::copyClientBytes()
887{
888 if (preReadClientData.length()) {
889 size_t copyBytes = preReadClientData.length() > SQUID_TCP_SO_RCVBUF ? SQUID_TCP_SO_RCVBUF : preReadClientData.length();
890 memcpy(client.buf, preReadClientData.rawContent(), copyBytes);
891 preReadClientData.consume(copyBytes);
892 client.bytesIn(copyBytes);
893 if (keepGoingAfterRead(copyBytes, Comm::OK, 0, client, server))
894 copy(copyBytes, client, server, TunnelStateData::WriteServerDone);
895 } else
896 copyRead(client, ReadClient);
897}
898
6821c276
CT
899void
900TunnelStateData::copyServerBytes()
901{
902 if (preReadServerData.length()) {
903 size_t copyBytes = preReadServerData.length() > SQUID_TCP_SO_RCVBUF ? SQUID_TCP_SO_RCVBUF : preReadServerData.length();
904 memcpy(server.buf, preReadServerData.rawContent(), copyBytes);
905 preReadServerData.consume(copyBytes);
906 server.bytesIn(copyBytes);
907 if (keepGoingAfterRead(copyBytes, Comm::OK, 0, server, client))
908 copy(copyBytes, server, client, TunnelStateData::WriteClientDone);
909 } else
910 copyRead(server, ReadServer);
911}
912
379e8c1c 913/**
87f237a9 914 * Set the HTTP status for this request and sets the read handlers for client
379e8c1c
AR
915 * and server side connections.
916 */
917static void
918tunnelStartShoveling(TunnelStateData *tunnelState)
919{
2b6b1bcb
AR
920 assert(!tunnelState->transportWait);
921 assert(!tunnelState->encryptionWait);
922 assert(!tunnelState->peerWait);
923
25b0ce45
CT
924 assert(tunnelState->server.conn);
925 AsyncCall::Pointer timeoutCall = commCbCall(5, 4, "tunnelTimeout",
926 CommTimeoutCbPtrFun(tunnelTimeout, tunnelState));
927 commSetConnTimeout(tunnelState->server.conn, Config.Timeout.read, timeoutCall);
928
955394ce 929 *tunnelState->status_ptr = Http::scOkay;
12f5a662 930 tunnelState->al->cache.code.update(LOG_TCP_TUNNEL);
379e8c1c 931 if (cbdataReferenceValid(tunnelState)) {
6c420975 932
5eedd56a 933 // Shovel any payload already pushed into reply buffer by the server response
3ed5793b 934 if (!tunnelState->server.len)
6821c276 935 tunnelState->copyServerBytes();
6c420975
AJ
936 else {
937 debugs(26, DBG_DATA, "Tunnel server PUSH Payload: \n" << Raw("", tunnelState->server.buf, tunnelState->server.len) << "\n----------");
3ed5793b 938 tunnelState->copy(tunnelState->server.len, tunnelState->server, tunnelState->client, TunnelStateData::WriteClientDone);
6c420975
AJ
939 }
940
fcc444e3
AJ
941 if (tunnelState->http.valid() && tunnelState->http->getConn() && !tunnelState->http->getConn()->inBuf.isEmpty()) {
942 SBuf * const in = &tunnelState->http->getConn()->inBuf;
943 debugs(26, DBG_DATA, "Tunnel client PUSH Payload: \n" << *in << "\n----------");
944 tunnelState->preReadClientData.append(*in);
945 in->consume(); // ConnStateData buffer accounting after the shuffle.
3248e962
CT
946 }
947 tunnelState->copyClientBytes();
379e8c1c
AR
948 }
949}
950
b0388924
AJ
951/**
952 * All the pieces we need to write to client and/or server connection
1b76e6c1 953 * have been written.
379e8c1c 954 * Call the tunnelStartShoveling to start the blind pump.
b0388924 955 */
c4b7a5a9 956static void
c6f9a0ff 957tunnelConnectedWriteDone(const Comm::ConnectionPointer &conn, char *, size_t len, Comm::Flag flag, int, void *data)
c4b7a5a9 958{
fa34dd97 959 TunnelStateData *tunnelState = (TunnelStateData *)data;
bf95c10a 960 debugs(26, 3, conn << ", flag=" << flag);
aee3523a 961 tunnelState->client.writer = nullptr;
62e76326 962
c8407295 963 if (flag != Comm::OK) {
955394ce 964 *tunnelState->status_ptr = Http::scInternalServerError;
e0d28505 965 tunnelErrorComplete(conn->fd, data, 0);
62e76326 966 return;
967 }
968
c6f9a0ff
CT
969 if (auto http = tunnelState->http.get()) {
970 http->out.headers_sz += len;
971 http->out.size += len;
972 }
973
379e8c1c 974 tunnelStartShoveling(tunnelState);
c4b7a5a9 975}
976
f5e17947
CT
977void
978TunnelStateData::tunnelEstablishmentDone(Http::TunnelerAnswer &answer)
3ed5793b 979{
2b6b1bcb 980 peerWait.finish();
f5e17947 981 server.len = 0;
3ed5793b 982
12f5a662 983 al->cache.code.update(LOG_TCP_TUNNEL);
d8165775 984
a98270b0
EB
985 // XXX: al->http.code (i.e. *status_ptr) should not be (re)set
986 // until we actually start responding to the client. Right here/now, we only
987 // know how this cache_peer has responded to us.
f5e17947
CT
988 if (answer.peerResponseStatus != Http::scNone)
989 *status_ptr = answer.peerResponseStatus;
990
25b0ce45
CT
991 auto sawProblem = false;
992
993 if (!answer.positive()) {
994 sawProblem = true;
2b6b1bcb 995 assert(!answer.conn);
25b0ce45
CT
996 } else if (!Comm::IsConnOpen(answer.conn) || fd_table[answer.conn->fd].closing()) {
997 sawProblem = true;
998 closePendingConnection(answer.conn, "conn was closed while waiting for tunnelEstablishmentDone");
999 }
1000
1001 if (!sawProblem) {
1002 assert(answer.positive()); // paranoid
f5e17947
CT
1003 // copy any post-200 OK bytes to our buffer
1004 preReadServerData = answer.leftovers;
25b0ce45 1005 notePeerReadyToShovel(answer.conn);
3ed5793b
AR
1006 return;
1007 }
1008
25b0ce45
CT
1009 ErrorState *error = nullptr;
1010 if (answer.positive()) {
1011 error = new ErrorState(ERR_CANNOT_FORWARD, Http::scServiceUnavailable, request.getRaw(), al);
1012 } else {
1013 error = answer.squidError.get();
1014 Must(error);
1015 answer.squidError.clear(); // preserve error for errorSendComplete()
1016 }
1017 assert(error);
1018 saveError(error);
25d2603f 1019 retryOrBail("tunneler error");
3ed5793b
AR
1020}
1021
f5e17947 1022void
25b0ce45 1023TunnelStateData::notePeerReadyToShovel(const Comm::ConnectionPointer &conn)
983061ed 1024{
25d2603f 1025 assert(!client.dirty);
e2bbd3b3 1026 commitToServer(conn);
25b0ce45 1027
f5e17947
CT
1028 if (!clientExpectsConnectResponse())
1029 tunnelStartShoveling(this); // ssl-bumped connection, be quiet
379e8c1c 1030 else {
f5e17947 1031 *status_ptr = Http::scOkay;
379e8c1c 1032 AsyncCall::Pointer call = commCbCall(5,5, "tunnelConnectedWriteDone",
f5e17947 1033 CommIoCbPtrFun(tunnelConnectedWriteDone, this));
ea55799d
EB
1034 al->reply = HttpReply::MakeConnectionEstablished();
1035 const auto mb = al->reply->pack();
1036 client.write(mb->content(), mb->contentSize(), call, mb->freeFunc());
1037 delete mb;
379e8c1c 1038 }
983061ed 1039}
1040
e2bbd3b3
AR
1041void
1042TunnelStateData::commitToServer(const Comm::ConnectionPointer &conn)
1043{
1044 committedToServer = true;
a98270b0 1045 banRetries = "committed to server";
e2bbd3b3
AR
1046 PeerSelectionInitiator::subscribed = false; // may already be false
1047 server.initConnection(conn, tunnelServerClosed, "tunnelServerClosed", this);
1048}
1049
b8d8561b 1050static void
fd54d9b2 1051tunnelErrorComplete(int fd/*const Comm::ConnectionPointer &*/, void *data, size_t)
30a4f2a8 1052{
fa34dd97 1053 TunnelStateData *tunnelState = (TunnelStateData *)data;
bf95c10a 1054 debugs(26, 3, "FD " << fd);
aee3523a 1055 assert(tunnelState != nullptr);
11007d4b 1056 /* temporary lock to save our own feets (comm_close -> tunnelClientClosed -> Free) */
83564ee7 1057 CbcPointer<TunnelStateData> safetyLock(tunnelState);
62e76326 1058
97c81191 1059 if (Comm::IsConnOpen(tunnelState->client.conn))
fb046c1b 1060 tunnelState->client.conn->close();
62e76326 1061
97c81191 1062 if (Comm::IsConnOpen(tunnelState->server.conn))
fb046c1b 1063 tunnelState->server.conn->close();
30a4f2a8 1064}
1065
6043e368 1066void
55622953 1067TunnelStateData::noteConnection(HappyConnOpener::Answer &answer)
6043e368 1068{
2b6b1bcb 1069 transportWait.finish();
55622953 1070
e7a9b7a8 1071 updateAttempts(answer.n_tries);
a98270b0 1072
25b0ce45
CT
1073 ErrorState *error = nullptr;
1074 if ((error = answer.error.get())) {
a98270b0 1075 banRetries = "HappyConnOpener gave up";
25b0ce45 1076 Must(!Comm::IsConnOpen(answer.conn));
55622953 1077 syncHierNote(answer.conn, request->url.host());
25b0ce45
CT
1078 answer.error.clear();
1079 } else if (!Comm::IsConnOpen(answer.conn) || fd_table[answer.conn->fd].closing()) {
1080 error = new ErrorState(ERR_CANNOT_FORWARD, Http::scServiceUnavailable, request.getRaw(), al);
1081 closePendingConnection(answer.conn, "conn was closed while waiting for noteConnection");
1082 }
1083
1084 if (error) {
55622953 1085 saveError(error);
25d2603f 1086 retryOrBail("tried all destinations");
55622953
CT
1087 return;
1088 }
6043e368 1089
55622953 1090 connectDone(answer.conn, request->url.host(), answer.reused);
6043e368
AR
1091}
1092
55622953
CT
1093void
1094TunnelStateData::connectDone(const Comm::ConnectionPointer &conn, const char *origin, const bool reused)
983061ed 1095{
55622953 1096 Must(Comm::IsConnOpen(conn));
cfd66529 1097
55622953
CT
1098 if (reused)
1099 ResetMarkingsToServer(request.getRaw(), *conn);
1100 // else Comm::ConnOpener already applied proper/current markings
1101
a98270b0
EB
1102 // TODO: add pconn race state tracking
1103
25b0ce45 1104 syncHierNote(conn, origin);
cfd66529 1105
4beb4bab
AJ
1106#if USE_DELAY_POOLS
1107 /* no point using the delayIsNoDelay stuff since tunnel is nice and simple */
1108 if (conn->getPeer() && conn->getPeer()->options.no_delay)
55622953 1109 server.setDelayId(DelayId());
4beb4bab
AJ
1110#endif
1111
55622953 1112 netdbPingSite(request->url.host());
4beb4bab 1113
55622953 1114 request->peer_host = conn->getPeer() ? conn->getPeer()->host : nullptr;
cfd66529 1115
f5e17947
CT
1116 bool toOrigin = false; // same semantics as StateFlags::toOrigin
1117 if (const auto * const peer = conn->getPeer()) {
55622953 1118 request->prepForPeering(*peer);
f5e17947 1119 toOrigin = peer->options.originserver;
fe40a877 1120 } else {
55622953 1121 request->prepForDirect();
f5e17947 1122 toOrigin = true;
cfd66529 1123 }
62e76326 1124
f5e17947 1125 if (!toOrigin)
25b0ce45 1126 connectToPeer(conn);
cfd66529 1127 else {
25b0ce45 1128 notePeerReadyToShovel(conn);
983061ed 1129 }
983061ed 1130}
30a4f2a8 1131
a98270b0
EB
1132/// whether we have used up all permitted forwarding attempts
1133bool
1134TunnelStateData::exhaustedTries() const
1135{
1136 return n_tries >= Config.forward_max_tries;
1137}
1138
770f051d 1139void
ac9f46af 1140tunnelStart(ClientHttpRequest * http)
30a4f2a8 1141{
bf95c10a 1142 debugs(26, 3, MYNAME);
30a4f2a8 1143 /* Create state structure. */
aee3523a
AR
1144 TunnelStateData *tunnelState = nullptr;
1145 ErrorState *err = nullptr;
190154cf 1146 HttpRequest *request = http->request;
d5964d58 1147 char *url = http->uri;
fb046c1b 1148
f1003989 1149 /*
4dd643d5 1150 * client_addr.isNoAddr() indicates this is an "internal" request
a4b8110e 1151 * from peer_digest.c, asn.c, netdb.c, etc and should always
1152 * be allowed. yuck, I know.
1153 */
62e76326 1154
4dd643d5 1155 if (Config.accessList.miss && !request->client_addr.isNoAddr()) {
62e76326 1156 /*
1157 * Check if this host is allowed to fetch MISSES from us (miss_access)
b50e327b 1158 * default is to allow.
62e76326 1159 */
aee3523a 1160 ACLFilledChecklist ch(Config.accessList.miss, request, nullptr);
cb365059 1161 ch.al = http->al;
62e76326 1162 ch.src_addr = request->client_addr;
1163 ch.my_addr = request->my_addr;
cb365059 1164 ch.syncAle(request, http->log_uri);
06bf5384 1165 if (ch.fastCheck().denied()) {
bf95c10a 1166 debugs(26, 4, "MISS access forbidden.");
7e6eabbc 1167 err = new ErrorState(ERR_FORWARDING_DENIED, Http::scForbidden, request, http->al);
ac9f46af 1168 http->al->http.code = Http::scForbidden;
73c36fd9 1169 errorSend(http->getConn()->clientConnection, err);
62e76326 1170 return;
1171 }
f1003989 1172 }
62e76326 1173
7f06a3d8 1174 debugs(26, 3, request->method << ' ' << url << ' ' << request->http_ver);
5db6bf73
FC
1175 ++statCounter.server.all.requests;
1176 ++statCounter.server.other.requests;
62e76326 1177
6b2b6cfe 1178 tunnelState = new TunnelStateData(http);
9a0a18de 1179#if USE_DELAY_POOLS
f5e17947 1180 tunnelState->server.setDelayId(DelayId::DelayClient(http));
59715b38 1181#endif
6043e368 1182 tunnelState->startSelectingDestinations(request, http->al, nullptr);
30a4f2a8 1183}
98ffb7e4 1184
a23223bf 1185void
25b0ce45 1186TunnelStateData::connectToPeer(const Comm::ConnectionPointer &conn)
e2849af8 1187{
25b0ce45
CT
1188 if (const auto p = conn->getPeer()) {
1189 if (p->secure.encryptTransport)
1190 return advanceDestination("secure connection to peer", conn, [this,&conn] {
1c2b4465
CT
1191 secureConnectionToPeer(conn);
1192 });
a23223bf 1193 }
a23223bf 1194
25b0ce45 1195 connectedToPeer(conn);
a23223bf
CT
1196}
1197
25b0ce45 1198/// encrypts an established TCP connection to peer
a23223bf 1199void
25b0ce45
CT
1200TunnelStateData::secureConnectionToPeer(const Comm::ConnectionPointer &conn)
1201{
e5ddd4ce 1202 const auto callback = asyncCallback(5, 4, TunnelStateData::noteSecurityPeerConnectorAnswer, this);
25b0ce45 1203 const auto connector = new Security::BlindPeerConnector(request, conn, callback, al);
2b6b1bcb 1204 encryptionWait.start(connector, callback);
25b0ce45
CT
1205}
1206
1207/// starts a preparation step for an established connection; retries on failures
1208template <typename StepStart>
1209void
1210TunnelStateData::advanceDestination(const char *stepDescription, const Comm::ConnectionPointer &conn, const StepStart &startStep)
1211{
1212 // TODO: Extract destination-specific handling from TunnelStateData so that
1213 // all the awkward, limited-scope advanceDestination() calls can be replaced
1214 // with a single simple try/catch,retry block.
1215 try {
1216 startStep();
1217 // now wait for the step callback
1218 } catch (...) {
1219 debugs (26, 2, "exception while trying to " << stepDescription << ": " << CurrentException);
1220 closePendingConnection(conn, "connection preparation exception");
1221 if (!savedError)
1222 saveError(new ErrorState(ERR_CANNOT_FORWARD, Http::scInternalServerError, request.getRaw(), al));
25d2603f 1223 retryOrBail(stepDescription);
25b0ce45
CT
1224 }
1225}
1226
1227/// callback handler for the connection encryptor
1228void
1229TunnelStateData::noteSecurityPeerConnectorAnswer(Security::EncryptorAnswer &answer)
a23223bf 1230{
2b6b1bcb
AR
1231 encryptionWait.finish();
1232
25d2603f 1233 ErrorState *error = nullptr;
2b6b1bcb 1234 assert(!answer.tunneled);
25d2603f 1235 if ((error = answer.error.get())) {
2b6b1bcb 1236 assert(!answer.conn);
25d2603f
EB
1237 answer.error.clear();
1238 } else if (!Comm::IsConnOpen(answer.conn) || fd_table[answer.conn->fd].closing()) {
1239 error = new ErrorState(ERR_CANNOT_FORWARD, Http::scServiceUnavailable, request.getRaw(), al);
1240 closePendingConnection(answer.conn, "conn was closed while waiting for noteSecurityPeerConnectorAnswer");
a23223bf
CT
1241 }
1242
25d2603f
EB
1243 if (error) {
1244 saveError(error);
1245 retryOrBail("TLS peer connection error");
25b0ce45
CT
1246 return;
1247 }
1248
1249 connectedToPeer(answer.conn);
1250}
1251
1252void
1253TunnelStateData::connectedToPeer(const Comm::ConnectionPointer &conn)
1254{
1255 advanceDestination("establish tunnel through proxy", conn, [this,&conn] {
1256 establishTunnelThruProxy(conn);
1257 });
1258}
1259
1260void
1261TunnelStateData::establishTunnelThruProxy(const Comm::ConnectionPointer &conn)
1262{
e5ddd4ce 1263 const auto callback = asyncCallback(5, 4, TunnelStateData::tunnelEstablishmentDone, this);
25b0ce45 1264 const auto tunneler = new Http::Tunneler(conn, request, callback, Config.Timeout.lifetime, al);
f5e17947
CT
1265#if USE_DELAY_POOLS
1266 tunneler->setDelayId(server.delayId);
1267#endif
2b6b1bcb 1268 peerWait.start(tunneler, callback);
98ffb7e4 1269}
33ea9fff 1270
6043e368
AR
1271void
1272TunnelStateData::noteDestination(Comm::ConnectionPointer path)
33ea9fff 1273{
55622953 1274 destinationsFound = true;
3dde9e52
CT
1275
1276 if (!path) { // decided to use a pinned connection
1277 // We can call usePinned() without fear of clashing with an earlier
1278 // forwarding attempt because PINNED must be the first destination.
55622953 1279 assert(destinations->empty());
3dde9e52
CT
1280 usePinned();
1281 return;
1282 }
1283
55622953
CT
1284 destinations->addPath(path);
1285
2b6b1bcb 1286 if (transportWait) {
e2bbd3b3 1287 assert(!transporting());
55622953
CT
1288 notifyConnOpener();
1289 return; // and continue to wait for tunnelConnectDone() callback
1290 }
1291
e2bbd3b3
AR
1292 if (transporting())
1293 return; // and continue to receive destinations for backup
1294
55622953 1295 startConnecting();
6043e368 1296}
62e76326 1297
6043e368
AR
1298void
1299TunnelStateData::noteDestinationsEnd(ErrorState *selectionError)
1300{
1301 PeerSelectionInitiator::subscribed = false;
55622953
CT
1302 destinations->destinationsFinalized = true;
1303 if (!destinationsFound) {
6b2b6cfe 1304
25d2603f
EB
1305 // XXX: Honor clientExpectsConnectResponse() before replying.
1306
6043e368
AR
1307 if (selectionError)
1308 return sendError(selectionError, "path selection has failed");
6b2b6cfe 1309
e2bbd3b3 1310 // TODO: Merge with FwdState and remove this likely unnecessary check.
6043e368 1311 if (savedError)
e2bbd3b3 1312 return sendError(savedError, "path selection found no paths (with an impossible early error)");
6043e368 1313
0d55f01c 1314 return sendError(new ErrorState(ERR_CANNOT_FORWARD, Http::scInternalServerError, request.getRaw(), al),
6043e368 1315 "path selection found no paths");
db1cd23c 1316 }
6043e368
AR
1317 // else continue to use one of the previously noted destinations;
1318 // if all of them fail, tunneling as whole will fail
1319 Must(!selectionError); // finding at least one path means selection succeeded
55622953 1320
e2bbd3b3
AR
1321 if (transportWait) {
1322 assert(!transporting());
1323 notifyConnOpener();
1324 return; // and continue to wait for the noteConnection() callback
1325 }
1326
1327 if (transporting()) {
1328 // We are already using a previously opened connection (but were also
1329 // receiving more destinations in case we need to re-forward).
1330 debugs(17, 7, "keep transporting");
55622953
CT
1331 return;
1332 }
1333
e2bbd3b3
AR
1334 // destinationsFound, but none of them worked, and we were waiting for more
1335 assert(savedError);
1336 // XXX: Honor clientExpectsConnectResponse() before replying.
1337 sendError(savedError, "all found paths have failed");
6043e368 1338}
a37fdd8a 1339
e2bbd3b3
AR
1340/// Whether a tunneling attempt to some selected destination X is in progress
1341/// (after successfully opening/reusing a transport connection to X).
1342/// \sa transportWait
2b6b1bcb 1343bool
e2bbd3b3 1344TunnelStateData::transporting() const
2b6b1bcb 1345{
e2bbd3b3 1346 return encryptionWait || peerWait || committedToServer;
2b6b1bcb
AR
1347}
1348
6043e368
AR
1349/// remembers an error to be used if there will be no more connection attempts
1350void
1351TunnelStateData::saveError(ErrorState *error)
1352{
1353 debugs(26, 4, savedError << " ? " << error);
1354 assert(error);
1355 delete savedError; // may be nil
1356 savedError = error;
1357}
1358
1359/// Starts sending the given error message to the client, leading to the
1360/// eventual transaction termination. Call with savedError to send savedError.
1361void
1362TunnelStateData::sendError(ErrorState *finalError, const char *reason)
1363{
1364 debugs(26, 3, "aborting transaction for " << reason);
1365
1366 if (request)
1367 request->hier.stopPeerClock(false);
1368
2b6b1bcb 1369 cancelStep(reason);
55622953 1370
6043e368 1371 assert(finalError);
16b70e2a 1372
6043e368
AR
1373 // get rid of any cached error unless that is what the caller is sending
1374 if (savedError != finalError)
1375 delete savedError; // may be nil
1376 savedError = nullptr;
62e76326 1377
6043e368
AR
1378 // we cannot try other destinations after responding with an error
1379 PeerSelectionInitiator::subscribed = false; // may already be false
1380
1381 *status_ptr = finalError->httpStatus;
1382 finalError->callback = tunnelErrorComplete;
1383 finalError->callback_data = this;
1384 errorSend(client.conn, finalError);
0ce8e93b
EB
1385}
1386
2b6b1bcb
AR
1387/// Notify a pending subtask, if any, that we no longer need its help. We do not
1388/// have to do this -- the subtask job will eventually end -- but ending it
1389/// earlier reduces waste and may reduce DoS attack surface.
55622953 1390void
2b6b1bcb 1391TunnelStateData::cancelStep(const char *reason)
55622953 1392{
2b6b1bcb
AR
1393 transportWait.cancel(reason);
1394 encryptionWait.cancel(reason);
1395 peerWait.cancel(reason);
55622953
CT
1396}
1397
0ce8e93b
EB
1398void
1399TunnelStateData::startConnecting()
1400{
6043e368
AR
1401 if (request)
1402 request->hier.startPeerClock();
1403
55622953 1404 assert(!destinations->empty());
e2bbd3b3 1405 assert(!transporting());
a98270b0
EB
1406
1407 delete savedError; // may still be nil
1408 savedError = nullptr;
1409 request->hier.peer_reply_status = Http::scNone; // TODO: Move to startPeerClock()?
1410
e5ddd4ce 1411 const auto callback = asyncCallback(17, 5, TunnelStateData::noteConnection, this);
a98270b0 1412 const auto cs = new HappyConnOpener(destinations, callback, request, startTime, n_tries, al);
55622953
CT
1413 cs->setHost(request->url.host());
1414 cs->setRetriable(false);
1415 cs->allowPersistent(false);
1416 destinations->notificationPending = true; // start() is async
2b6b1bcb 1417 transportWait.start(cs, callback);
33ea9fff 1418}
a46d2c0e 1419
3dde9e52
CT
1420/// send request on an existing connection dedicated to the requesting client
1421void
1422TunnelStateData::usePinned()
1423{
55622953
CT
1424 Must(request);
1425 const auto connManager = request->pinnedConnection();
daf80700
CT
1426 try {
1427 const auto serverConn = ConnStateData::BorrowPinnedConnection(request.getRaw(), al);
1428 debugs(26, 7, "pinned peer connection: " << serverConn);
1429
e7a9b7a8 1430 updateAttempts(n_tries + 1);
a98270b0 1431
daf80700
CT
1432 // Set HttpRequest pinned related flags for consistency even if
1433 // they are not really used by tunnel.cc code.
1434 request->flags.pinned = true;
1435 if (connManager->pinnedAuth())
1436 request->flags.auth = true;
1437
1438 // the server may close the pinned connection before this request
1439 const auto reused = true;
1440 connectDone(serverConn, connManager->pinning.host, reused);
1441 } catch (ErrorState * const error) {
1442 syncHierNote(nullptr, connManager ? connManager->pinning.host : request->url.host());
25d2603f 1443 // XXX: Honor clientExpectsConnectResponse() before replying.
3dde9e52 1444 // a PINNED path failure is fatal; do not wait for more paths
daf80700 1445 sendError(error, "pinned path failure");
3dde9e52
CT
1446 return;
1447 }
1448
3dde9e52
CT
1449}
1450
fa34dd97 1451CBDATA_CLASS_INIT(TunnelStateData);
a46d2c0e 1452
a46d2c0e 1453bool
fa34dd97 1454TunnelStateData::noConnections() const
a46d2c0e 1455{
97c81191 1456 return !Comm::IsConnOpen(server.conn) && !Comm::IsConnOpen(client.conn);
a46d2c0e 1457}
1458
9a0a18de 1459#if USE_DELAY_POOLS
a46d2c0e 1460void
fa34dd97 1461TunnelStateData::Connection::setDelayId(DelayId const &newDelay)
a46d2c0e 1462{
1463 delayId = newDelay;
1464}
1465
1466#endif
93ead3fd 1467
2b6b1bcb 1468/// makes sure connection opener knows that the destinations have changed
55622953
CT
1469void
1470TunnelStateData::notifyConnOpener()
1471{
1472 if (destinations->notificationPending) {
1473 debugs(17, 7, "reusing pending notification");
1474 } else {
1475 destinations->notificationPending = true;
2b6b1bcb 1476 CallJobHere(17, 5, transportWait.job(), HappyConnOpener, noteCandidatesChange);
55622953
CT
1477 }
1478}
1479
1c2b4465
CT
1480/**
1481 * Sets up a TCP tunnel through Squid and starts shoveling traffic.
1482 * \param request the request that initiated/caused this tunnel
1483 * \param clientConn the already accepted client-to-Squid TCP connection
1484 * \param srvConn the already established Squid-to-server TCP connection
1485 * \param preReadServerData server-sent bytes to be forwarded to the client
1486 */
93ead3fd 1487void
1c2b4465 1488switchToTunnel(HttpRequest *request, const Comm::ConnectionPointer &clientConn, const Comm::ConnectionPointer &srvConn, const SBuf &preReadServerData)
93ead3fd 1489{
25b0ce45
CT
1490 Must(Comm::IsConnOpen(clientConn));
1491 Must(Comm::IsConnOpen(srvConn));
1492
c91d4d4e 1493 debugs(26,5, "Revert to tunnel FD " << clientConn->fd << " with FD " << srvConn->fd);
93ead3fd 1494
6b2b6cfe 1495 /* Create state structure. */
93ead3fd
CT
1496 ++statCounter.server.all.requests;
1497 ++statCounter.server.other.requests;
1498
6b2b6cfe
CT
1499 auto conn = request->clientConnectionManager.get();
1500 Must(conn);
1501 Http::StreamPointer context = conn->pipeline.front();
1502 Must(context && context->http);
a95989ed 1503
6b2b6cfe 1504 debugs(26, 3, request->method << " " << context->http->uri << " " << request->http_ver);
a95989ed 1505
6b2b6cfe 1506 TunnelStateData *tunnelState = new TunnelStateData(context->http);
e2bbd3b3 1507 tunnelState->commitToServer(srvConn);
93ead3fd 1508
d8165775 1509 request->hier.resetPeerNotes(srvConn, tunnelState->getHost());
93ead3fd 1510
6b2b6cfe
CT
1511#if USE_DELAY_POOLS
1512 /* no point using the delayIsNoDelay stuff since tunnel is nice and simple */
f5e17947 1513 if (!srvConn->getPeer() || !srvConn->getPeer()->options.no_delay)
6b2b6cfe
CT
1514 tunnelState->server.setDelayId(DelayId::DelayClient(context->http));
1515#endif
1516
f53e6e84 1517 request->peer_host = srvConn->getPeer() ? srvConn->getPeer()->host : nullptr;
93ead3fd 1518
e4f14091 1519 debugs(26, 4, "determine post-connect handling pathway.");
f5e17947
CT
1520 if (const auto peer = srvConn->getPeer())
1521 request->prepForPeering(*peer);
1522 else
1523 request->prepForDirect();
93ead3fd 1524
1c2b4465 1525 tunnelState->preReadServerData = preReadServerData;
93ead3fd 1526
6821c276 1527 tunnelStartShoveling(tunnelState);
93ead3fd 1528}
f53969cc 1529