2 * Copyright (C) 1996-2023 The Squid Software Foundation and contributors
4 * Squid software is distributed under GPLv2+ license and includes
5 * contributions from numerous individuals and organizations.
6 * Please see the COPYING and CONTRIBUTORS files for details.
9 /* DEBUG: section 85 Client-side Request Routines */
12 * General logic of request processing:
14 * We run a series of tests to determine if access will be permitted, and to do
15 * any redirection. Then we call into the result clientStream to retrieve data.
16 * From that point on it's up to reply management.
20 #include "acl/FilledChecklist.h"
21 #include "acl/Gadgets.h"
22 #include "anyp/PortCfg.h"
23 #include "base/AsyncJobCalls.h"
24 #include "client_side.h"
25 #include "client_side_reply.h"
26 #include "client_side_request.h"
27 #include "ClientRequestContext.h"
28 #include "clientStream.h"
29 #include "comm/Connection.h"
30 #include "comm/Write.h"
31 #include "debug/Messages.h"
32 #include "error/Detail.h"
33 #include "errorpage.h"
36 #include "format/Token.h"
39 #include "helper/Reply.h"
41 #include "http/Stream.h"
42 #include "HttpHdrCc.h"
43 #include "HttpReply.h"
44 #include "HttpRequest.h"
46 #include "ip/NfMarkConfig.h"
47 #include "ip/QosConfig.h"
49 #include "log/access_log.h"
50 #include "MemObject.h"
52 #include "proxyp/Header.h"
55 #include "sbuf/StringConvert.h"
56 #include "SquidConfig.h"
62 #include "auth/UserRequest.h"
65 #include "adaptation/AccessCheck.h"
66 #include "adaptation/Answer.h"
67 #include "adaptation/Iterator.h"
68 #include "adaptation/Service.h"
70 #include "adaptation/icap/History.h"
74 #include "ssl/ServerBump.h"
75 #include "ssl/support.h"
78 #if FOLLOW_X_FORWARDED_FOR
80 #if !defined(SQUID_X_FORWARDED_FOR_HOP_MAX)
81 #define SQUID_X_FORWARDED_FOR_HOP_MAX 64
84 static void clientFollowXForwardedForCheck(Acl::Answer answer
, void *data
);
85 #endif /* FOLLOW_X_FORWARDED_FOR */
87 ErrorState
*clientBuildError(err_type
, Http::StatusCode
, char const *url
, const ConnStateData
*, HttpRequest
*, const AccessLogEntry::Pointer
&);
89 CBDATA_CLASS_INIT(ClientRequestContext
);
93 static void clientAccessCheckDoneWrapper(Acl::Answer
, void *);
95 static void sslBumpAccessCheckDoneWrapper(Acl::Answer
, void *);
97 static int clientHierarchical(ClientHttpRequest
* http
);
98 static void clientInterpretRequestHeaders(ClientHttpRequest
* http
);
99 static HLPCB clientRedirectDoneWrapper
;
100 static HLPCB clientStoreIdDoneWrapper
;
101 static void checkNoCacheDoneWrapper(Acl::Answer
, void *);
102 CSR clientGetMoreData
;
103 CSS clientReplyStatus
;
104 CSD clientReplyDetach
;
105 static void checkFailureRatio(err_type
, hier_code
);
107 ClientRequestContext::~ClientRequestContext()
110 * Release our "lock" on our parent, ClientHttpRequest, if we
114 cbdataReferenceDone(http
);
117 debugs(85,3, "ClientRequestContext destructed, this=" << this);
120 ClientRequestContext::ClientRequestContext(ClientHttpRequest
*anHttp
) :
121 http(cbdataReference(anHttp
))
123 debugs(85, 3, "ClientRequestContext constructed, this=" << this);
126 CBDATA_CLASS_INIT(ClientHttpRequest
);
128 ClientHttpRequest::ClientHttpRequest(ConnStateData
* aConn
) :
130 AsyncJob("ClientHttpRequest"),
132 al(new AccessLogEntry()),
133 conn_(cbdataReference(aConn
))
135 CodeContext::Reset(al
);
136 al
->cache
.start_time
= current_time
;
138 al
->tcpClient
= aConn
->clientConnection
;
139 al
->cache
.port
= aConn
->port
;
140 al
->cache
.caddr
= aConn
->log_addr
;
141 al
->proxyProtocolHeader
= aConn
->proxyProtocolHeader();
142 al
->updateError(aConn
->bareError
);
145 if (aConn
->clientConnection
!= nullptr && aConn
->clientConnection
->isOpen()) {
146 if (auto ssl
= fd_table
[aConn
->clientConnection
->fd
].ssl
.get())
147 al
->cache
.sslClientCert
.resetWithoutLocking(SSL_get_peer_certificate(ssl
));
151 dlinkAdd(this, &active
, &ClientActiveRequests
);
155 * returns true if client specified that the object must come from the cache
156 * without contacting origin server
159 ClientHttpRequest::onlyIfCached()const
162 return request
->cache_control
&&
163 request
->cache_control
->hasOnlyIfCached();
167 * This function is designed to serve a fairly specific purpose.
168 * Occasionally our vBNS-connected caches can talk to each other, but not
169 * the rest of the world. Here we try to detect frequent failures which
170 * make the cache unusable (e.g. DNS lookup and connect() failures). If
171 * the failure:success ratio goes above 1.0 then we go into "hit only"
172 * mode where we only return UDP_HIT or UDP_MISS_NOFETCH. Neighbors
173 * will only fetch HITs from us if they are using the ICP protocol. We
174 * stay in this mode for 5 minutes.
176 * Duane W., Sept 16, 1996
179 checkFailureRatio(err_type etype
, hier_code hcode
)
181 // Can be set at compile time with -D compiler flag
182 #ifndef FAILURE_MODE_TIME
183 #define FAILURE_MODE_TIME 300
186 if (hcode
== HIER_NONE
)
189 // don't bother when ICP is disabled.
190 if (Config
.Port
.icp
<= 0)
193 static double magic_factor
= 100.0;
197 n_good
= magic_factor
/ (1.0 + request_failure_ratio
);
199 n_bad
= magic_factor
- n_good
;
205 case ERR_CONNECT_FAIL
:
206 case ERR_SECURE_CONNECT_FAIL
:
216 request_failure_ratio
= n_bad
/ n_good
;
218 if (hit_only_mode_until
> squid_curtime
)
221 if (request_failure_ratio
< 1.0)
224 debugs(33, DBG_CRITICAL
, "WARNING: Failure Ratio at "<< std::setw(4)<<
225 std::setprecision(3) << request_failure_ratio
);
227 debugs(33, DBG_CRITICAL
, "WARNING: ICP going into HIT-only mode for " <<
228 FAILURE_MODE_TIME
/ 60 << " minutes...");
230 hit_only_mode_until
= squid_curtime
+ FAILURE_MODE_TIME
;
232 request_failure_ratio
= 0.8; /* reset to something less than 1.0 */
235 ClientHttpRequest::~ClientHttpRequest()
237 debugs(33, 3, "httpRequestFree: " << uri
);
239 // Even though freeResources() below may destroy the request,
240 // we no longer set request->body_pipe to NULL here
241 // because we did not initiate that pipe (ConnStateData did)
243 /* the ICP check here was erroneous
244 * - StoreEntry::releaseRequest was always called if entry was valid
249 loggingEntry(nullptr);
252 checkFailureRatio(request
->error
.category
, al
->hier
.code
);
257 announceInitiatorAbort(virginHeadSource
);
259 if (adaptedBodySource
!= nullptr)
260 stopConsumingFrom(adaptedBodySource
);
263 delete calloutContext
;
265 cbdataReferenceDone(conn_
);
267 /* moving to the next connection is handled by the context free */
268 dlinkDelete(&active
, &ClientActiveRequests
);
272 * Create a request and kick it off
277 * TODO: Pass in the buffers to be used in the initial Read request, as they are
278 * determined by the user
281 clientBeginRequest(const HttpRequestMethod
& method
, char const *url
, CSCB
* streamcallback
,
282 CSD
* streamdetach
, ClientStreamData streamdata
, HttpHeader
const *header
,
283 char *tailbuf
, size_t taillen
, const MasterXaction::Pointer
&mx
)
286 ClientHttpRequest
*http
= new ClientHttpRequest(nullptr);
287 HttpRequest
*request
;
288 StoreIOBuffer tempBuffer
;
289 if (http
->al
!= nullptr)
290 http
->al
->cache
.start_time
= current_time
;
291 /* this is only used to adjust the connection offset in client_side.c */
293 tempBuffer
.length
= taillen
;
294 tempBuffer
.data
= tailbuf
;
295 /* client stream setup */
296 clientStreamInit(&http
->client_stream
, clientGetMoreData
, clientReplyDetach
,
297 clientReplyStatus
, new clientReplyContext(http
), streamcallback
,
298 streamdetach
, streamdata
, tempBuffer
);
299 /* make it visible in the 'current acctive requests list' */
301 /* internal requests only makes sense in an
302 * accelerator today. TODO: accept flags ? */
303 http
->flags
.accel
= true;
304 /* allow size for url rewriting */
305 url_sz
= strlen(url
) + Config
.appendDomainLen
+ 5;
306 http
->uri
= (char *)xcalloc(url_sz
, 1);
307 strcpy(http
->uri
, url
); // XXX: polluting http->uri before parser validation
309 request
= HttpRequest::FromUrlXXX(http
->uri
, mx
, method
);
311 debugs(85, 5, "Invalid URL: " << http
->uri
);
316 * now update the headers in request with our supplied headers.
317 * HttpRequest::FromUrl() should return a blank header set, but
318 * we use Update to be sure of correctness.
321 request
->header
.update(header
);
323 /* http struct now ready */
326 * build new header list *? TODO
328 request
->flags
.accelerated
= http
->flags
.accel
;
330 /* this is an internally created
331 * request, not subject to acceleration
332 * target overrides */
333 // TODO: detect and handle internal requests of internal objects?
335 /* Internally created requests cannot have bodies today */
336 request
->content_length
= 0;
338 request
->client_addr
.setNoAddr();
340 #if FOLLOW_X_FORWARDED_FOR
341 request
->indirect_client_addr
.setNoAddr();
342 #endif /* FOLLOW_X_FORWARDED_FOR */
344 request
->my_addr
.setNoAddr(); /* undefined for internal requests */
346 request
->my_addr
.port(0);
348 request
->http_ver
= Http::ProtocolVersion();
350 http
->initRequest(request
);
352 /* optional - skip the access check ? */
353 http
->calloutContext
= new ClientRequestContext(http
);
355 http
->calloutContext
->http_access_done
= false;
357 http
->calloutContext
->redirect_done
= true;
359 http
->calloutContext
->no_cache_done
= true;
367 ClientRequestContext::httpStateIsValid()
369 ClientHttpRequest
*http_
= http
;
371 if (cbdataReferenceValid(http_
))
376 cbdataReferenceDone(http_
);
381 #if FOLLOW_X_FORWARDED_FOR
383 * clientFollowXForwardedForCheck() checks the content of X-Forwarded-For:
384 * against the followXFF ACL, or cleans up and passes control to
385 * clientAccessCheck().
387 * The trust model here is a little ambiguous. So to clarify the logic:
388 * - we may always use the direct client address as the client IP.
389 * - these trust tests merey tell whether we trust given IP enough to believe the
390 * IP string which it appended to the X-Forwarded-For: header.
391 * - if at any point we don't trust what an IP adds we stop looking.
392 * - at that point the current contents of indirect_client_addr are the value set
393 * by the last previously trusted IP.
394 * ++ indirect_client_addr contains the remote direct client from the trusted peers viewpoint.
397 clientFollowXForwardedForCheck(Acl::Answer answer
, void *data
)
399 ClientRequestContext
*calloutContext
= (ClientRequestContext
*) data
;
401 if (!calloutContext
->httpStateIsValid())
404 ClientHttpRequest
*http
= calloutContext
->http
;
405 HttpRequest
*request
= http
->request
;
407 if (answer
.allowed() && request
->x_forwarded_for_iterator
.size() != 0) {
410 * Remove the last comma-delimited element from the
411 * x_forwarded_for_iterator and use it to repeat the cycle.
414 const char *asciiaddr
;
417 p
= request
->x_forwarded_for_iterator
.termedBuf();
418 l
= request
->x_forwarded_for_iterator
.size();
421 * XXX x_forwarded_for_iterator should really be a list of
422 * IP addresses, but it's a String instead. We have to
423 * walk backwards through the String, biting off the last
424 * comma-delimited part each time. As long as the data is in
425 * a String, we should probably implement and use a variant of
426 * strListGetItem() that walks backwards instead of forwards
427 * through a comma-separated list. But we don't even do that;
428 * we just do the work in-line here.
430 /* skip trailing space and commas */
431 while (l
> 0 && (p
[l
-1] == ',' || xisspace(p
[l
-1])))
433 request
->x_forwarded_for_iterator
.cut(l
);
434 /* look for start of last item in list */
435 while (l
> 0 && ! (p
[l
-1] == ',' || xisspace(p
[l
-1])))
438 if ((addr
= asciiaddr
)) {
439 request
->indirect_client_addr
= addr
;
440 request
->x_forwarded_for_iterator
.cut(l
);
441 calloutContext
->acl_checklist
= clientAclChecklistCreate(Config
.accessList
.followXFF
, http
);
442 if (!Config
.onoff
.acl_uses_indirect_client
) {
443 /* override the default src_addr tested if we have to go deeper than one level into XFF */
444 Filled(calloutContext
->acl_checklist
)->src_addr
= request
->indirect_client_addr
;
446 if (++calloutContext
->currentXffHopNumber
< SQUID_X_FORWARDED_FOR_HOP_MAX
) {
447 calloutContext
->acl_checklist
->nonBlockingCheck(clientFollowXForwardedForCheck
, data
);
450 const auto headerName
= Http::HeaderLookupTable
.lookup(Http::HdrType::X_FORWARDED_FOR
).name
;
451 debugs(28, DBG_CRITICAL
, "ERROR: Ignoring trailing " << headerName
<< " addresses" <<
452 Debug::Extra
<< "addresses allowed by follow_x_forwarded_for: " << calloutContext
->currentXffHopNumber
<<
453 Debug::Extra
<< "last/accepted address: " << request
->indirect_client_addr
<<
454 Debug::Extra
<< "ignored trailing addresses: " << request
->x_forwarded_for_iterator
);
455 // fall through to resume clientAccessCheck() processing
459 /* clean up, and pass control to clientAccessCheck */
460 if (Config
.onoff
.log_uses_indirect_client
) {
462 * Ensure that the access log shows the indirect client
463 * instead of the direct client.
465 http
->al
->cache
.caddr
= request
->indirect_client_addr
;
466 if (ConnStateData
*conn
= http
->getConn())
467 conn
->log_addr
= request
->indirect_client_addr
;
469 request
->x_forwarded_for_iterator
.clean();
470 request
->flags
.done_follow_x_forwarded_for
= true;
472 if (answer
.conflicted()) {
473 debugs(28, DBG_CRITICAL
, "ERROR: Processing X-Forwarded-For. Stopping at IP address: " << request
->indirect_client_addr
);
476 /* process actual access ACL as normal. */
477 calloutContext
->clientAccessCheck();
479 #endif /* FOLLOW_X_FORWARDED_FOR */
482 hostHeaderIpVerifyWrapper(const ipcache_addrs
* ia
, const Dns::LookupDetails
&dns
, void *data
)
484 ClientRequestContext
*c
= static_cast<ClientRequestContext
*>(data
);
485 c
->hostHeaderIpVerify(ia
, dns
);
489 ClientRequestContext::hostHeaderIpVerify(const ipcache_addrs
* ia
, const Dns::LookupDetails
&dns
)
491 Comm::ConnectionPointer clientConn
= http
->getConn()->clientConnection
;
493 // note the DNS details for the transaction stats.
494 http
->request
->recordLookup(dns
);
496 // Is the NAT destination IP in DNS?
497 if (ia
&& ia
->have(clientConn
->local
)) {
498 debugs(85, 3, "validate IP " << clientConn
->local
<< " possible from Host:");
499 http
->request
->flags
.hostVerified
= true;
503 debugs(85, 3, "FAIL: validate IP " << clientConn
->local
<< " possible from Host:");
504 hostHeaderVerifyFailed("local IP", "any domain IP");
508 ClientRequestContext::hostHeaderVerifyFailed(const char *A
, const char *B
)
510 // IP address validation for Host: failed. Admin wants to ignore them.
511 // NP: we do not yet handle CONNECT tunnels well, so ignore for them
512 if (!Config
.onoff
.hostStrictVerify
&& http
->request
->method
!= Http::METHOD_CONNECT
) {
513 debugs(85, 3, "SECURITY ALERT: Host header forgery detected on " << http
->getConn()->clientConnection
<<
514 " (" << A
<< " does not match " << B
<< ") on URL: " << http
->request
->effectiveRequestUri());
516 // MUST NOT cache (for now). It is tempting to set flags.noCache, but
517 // that flag is about satisfying _this_ request. We are actually OK with
518 // satisfying this request from the cache, but want to prevent _other_
519 // requests from being satisfied using this response.
520 http
->request
->flags
.cachable
.veto();
522 // XXX: when we have updated the cache key to base on raw-IP + URI this cacheable limit can go.
523 http
->request
->flags
.hierarchical
= false; // MUST NOT pass to peers (for now)
524 // XXX: when we have sorted out the best way to relay requests properly to peers this hierarchical limit can go.
529 debugs(85, DBG_IMPORTANT
, "SECURITY ALERT: Host header forgery detected on " <<
530 http
->getConn()->clientConnection
<< " (" << A
<< " does not match " << B
<< ")");
531 if (const char *ua
= http
->request
->header
.getStr(Http::HdrType::USER_AGENT
))
532 debugs(85, DBG_IMPORTANT
, "SECURITY ALERT: By user agent: " << ua
);
533 debugs(85, DBG_IMPORTANT
, "SECURITY ALERT: on URL: " << http
->request
->effectiveRequestUri());
535 // IP address validation for Host: failed. reject the connection.
536 clientStreamNode
*node
= (clientStreamNode
*)http
->client_stream
.tail
->prev
->data
;
537 clientReplyContext
*repContext
= dynamic_cast<clientReplyContext
*>(node
->data
.getRaw());
539 repContext
->setReplyToError(ERR_CONFLICT_HOST
, Http::scConflict
,
545 http
->getConn() != nullptr && http
->getConn()->getAuth() != nullptr ?
546 http
->getConn()->getAuth() : http
->request
->auth_user_request
);
550 node
= (clientStreamNode
*)http
->client_stream
.tail
->data
;
551 clientStreamRead(node
, http
, node
->readBuffer
);
555 ClientRequestContext::hostHeaderVerify()
557 // Require a Host: header.
558 const char *host
= http
->request
->header
.getStr(Http::HdrType::HOST
);
561 // TODO: dump out the HTTP/1.1 error about missing host header.
562 // otherwise this is fine, can't forge a header value when its not even set.
563 debugs(85, 3, "validate skipped with no Host: header present.");
568 if (http
->request
->flags
.internal
) {
569 // TODO: kill this when URL handling allows partial URLs out of accel mode
570 // and we no longer screw with the URL just to add our internal host there
571 debugs(85, 6, "validate skipped due to internal composite URL.");
576 // TODO: Unify Host value parsing below with AnyP::Uri authority parsing
577 // Locate if there is a port attached, strip ready for IP lookup
578 char *portStr
= nullptr;
579 char *hostB
= xstrdup(host
);
581 if (host
[0] == '[') {
583 portStr
= strchr(hostB
, ']');
584 if (portStr
&& *(++portStr
) != ':') {
588 // Domain or IPv4 literal with port
589 portStr
= strrchr(hostB
, ':');
594 *portStr
= '\0'; // strip the ':'
595 if (*(++portStr
) != '\0') {
597 int64_t ret
= strtoll(portStr
, &end
, 10);
598 if (end
== portStr
|| *end
!= '\0' || ret
< 1 || ret
> 0xFFFF) {
599 // invalid port details. Replace the ':'
603 port
= (ret
& 0xFFFF);
607 debugs(85, 3, "validate host=" << host
<< ", port=" << port
<< ", portStr=" << (portStr
?portStr
:"NULL"));
608 if (http
->request
->flags
.intercepted
|| http
->request
->flags
.interceptTproxy
) {
609 // verify the Host: port (if any) matches the apparent destination
610 if (portStr
&& port
!= http
->getConn()->clientConnection
->local
.port()) {
611 debugs(85, 3, "FAIL on validate port " << http
->getConn()->clientConnection
->local
.port() <<
612 " matches Host: port " << port
<< " (" << portStr
<< ")");
613 hostHeaderVerifyFailed("intercepted port", portStr
);
615 // XXX: match the scheme default port against the apparent destination
617 // verify the destination DNS is one of the Host: headers IPs
618 ipcache_nbgethostbyname(host
, hostHeaderIpVerifyWrapper
, this);
620 } else if (!Config
.onoff
.hostStrictVerify
) {
621 debugs(85, 3, "validate skipped.");
623 } else if (strlen(host
) != strlen(http
->request
->url
.host())) {
624 // Verify forward-proxy requested URL domain matches the Host: header
625 debugs(85, 3, "FAIL on validate URL domain length " << http
->request
->url
.host() << " matches Host: " << host
);
626 hostHeaderVerifyFailed(host
, http
->request
->url
.host());
627 } else if (matchDomainName(host
, http
->request
->url
.host()) != 0) {
628 // Verify forward-proxy requested URL domain matches the Host: header
629 debugs(85, 3, "FAIL on validate URL domain " << http
->request
->url
.host() << " matches Host: " << host
);
630 hostHeaderVerifyFailed(host
, http
->request
->url
.host());
631 } else if (portStr
&& !http
->request
->url
.port()) {
632 debugs(85, 3, "FAIL on validate portless URI matches Host: " << portStr
);
633 hostHeaderVerifyFailed("portless URI", portStr
);
634 } else if (portStr
&& port
!= *http
->request
->url
.port()) {
635 // Verify forward-proxy requested URL domain matches the Host: header
636 debugs(85, 3, "FAIL on validate URL port " << *http
->request
->url
.port() << " matches Host: port " << portStr
);
637 hostHeaderVerifyFailed("URL port", portStr
);
638 } else if (!portStr
&& http
->request
->method
!= Http::METHOD_CONNECT
&& http
->request
->url
.port() != http
->request
->url
.getScheme().defaultPort()) {
639 // Verify forward-proxy requested URL domain matches the Host: header
640 // Special case: we don't have a default-port to check for CONNECT. Assume URL is correct.
641 debugs(85, 3, "FAIL on validate URL port " << http
->request
->url
.port().value_or(0) << " matches Host: default port " << http
->request
->url
.getScheme().defaultPort().value_or(0));
642 hostHeaderVerifyFailed("URL port", "default port");
645 debugs(85, 3, "validate passed.");
646 http
->request
->flags
.hostVerified
= true;
652 /* This is the entry point for external users of the client_side routines */
654 ClientRequestContext::clientAccessCheck()
656 #if FOLLOW_X_FORWARDED_FOR
657 if (!http
->request
->flags
.doneFollowXff() &&
658 Config
.accessList
.followXFF
&&
659 http
->request
->header
.has(Http::HdrType::X_FORWARDED_FOR
)) {
661 /* we always trust the direct client address for actual use */
662 http
->request
->indirect_client_addr
= http
->request
->client_addr
;
663 http
->request
->indirect_client_addr
.port(0);
665 /* setup the XFF iterator for processing */
666 http
->request
->x_forwarded_for_iterator
= http
->request
->header
.getList(Http::HdrType::X_FORWARDED_FOR
);
668 /* begin by checking to see if we trust direct client enough to walk XFF */
669 acl_checklist
= clientAclChecklistCreate(Config
.accessList
.followXFF
, http
);
670 acl_checklist
->nonBlockingCheck(clientFollowXForwardedForCheck
, this);
675 if (Config
.accessList
.http
) {
676 acl_checklist
= clientAclChecklistCreate(Config
.accessList
.http
, http
);
677 acl_checklist
->nonBlockingCheck(clientAccessCheckDoneWrapper
, this);
679 debugs(0, DBG_CRITICAL
, "No http_access configuration found. This will block ALL traffic");
680 clientAccessCheckDone(ACCESS_DENIED
);
685 * Identical in operation to clientAccessCheck() but performed later using different configured ACL list.
686 * The default here is to allow all. Since the earlier http_access should do a default deny all.
687 * This check is just for a last-minute denial based on adapted request headers.
690 ClientRequestContext::clientAccessCheck2()
692 if (Config
.accessList
.adapted_http
) {
693 acl_checklist
= clientAclChecklistCreate(Config
.accessList
.adapted_http
, http
);
694 acl_checklist
->nonBlockingCheck(clientAccessCheckDoneWrapper
, this);
696 debugs(85, 2, "No adapted_http_access configuration. default: ALLOW");
697 clientAccessCheckDone(ACCESS_ALLOWED
);
702 clientAccessCheckDoneWrapper(Acl::Answer answer
, void *data
)
704 ClientRequestContext
*calloutContext
= (ClientRequestContext
*) data
;
706 if (!calloutContext
->httpStateIsValid())
709 calloutContext
->clientAccessCheckDone(answer
);
713 ClientRequestContext::clientAccessCheckDone(const Acl::Answer
&answer
)
715 acl_checklist
= nullptr;
717 Http::StatusCode status
;
718 debugs(85, 2, "The request " << http
->request
->method
<< ' ' <<
719 http
->uri
<< " is " << answer
<<
720 "; last ACL checked: " << (AclMatchedName
? AclMatchedName
: "[none]"));
723 char const *proxy_auth_msg
= "<null>";
724 if (http
->getConn() != nullptr && http
->getConn()->getAuth() != nullptr)
725 proxy_auth_msg
= http
->getConn()->getAuth()->denyMessage("<null>");
726 else if (http
->request
->auth_user_request
!= nullptr)
727 proxy_auth_msg
= http
->request
->auth_user_request
->denyMessage("<null>");
730 if (!answer
.allowed()) {
731 // auth has a grace period where credentials can be expired but okay not to challenge.
733 /* Send an auth challenge or error */
734 // XXX: do we still need aclIsProxyAuth() ?
735 bool auth_challenge
= (answer
== ACCESS_AUTH_REQUIRED
|| aclIsProxyAuth(AclMatchedName
));
736 debugs(85, 5, "Access Denied: " << http
->uri
);
737 debugs(85, 5, "AclMatchedName = " << (AclMatchedName
? AclMatchedName
: "<null>"));
740 debugs(33, 5, "Proxy Auth Message = " << (proxy_auth_msg
? proxy_auth_msg
: "<null>"));
744 * NOTE: get page_id here, based on AclMatchedName because if
745 * USE_DELAY_POOLS is enabled, then AclMatchedName gets clobbered in
746 * the clientCreateStoreEntry() call just below. Pedro Ribeiro
749 page_id
= aclGetDenyInfoPage(&Config
.denyInfoList
, AclMatchedName
, answer
!= ACCESS_AUTH_REQUIRED
);
751 http
->updateLoggingTags(LOG_TCP_DENIED
);
753 if (auth_challenge
) {
755 if (http
->request
->flags
.sslBumped
) {
756 /*SSL Bumped request, authentication is not possible*/
757 status
= Http::scForbidden
;
758 } else if (!http
->flags
.accel
) {
759 /* Proxy authorisation needed */
760 status
= Http::scProxyAuthenticationRequired
;
762 /* WWW authorisation needed */
763 status
= Http::scUnauthorized
;
766 // need auth, but not possible to do.
767 status
= Http::scForbidden
;
769 if (page_id
== ERR_NONE
)
770 page_id
= ERR_CACHE_ACCESS_DENIED
;
772 status
= Http::scForbidden
;
774 if (page_id
== ERR_NONE
)
775 page_id
= ERR_ACCESS_DENIED
;
778 error
= clientBuildError(page_id
, status
, nullptr, http
->getConn(), http
->request
, http
->al
);
781 error
->auth_user_request
=
782 http
->getConn() != nullptr && http
->getConn()->getAuth() != nullptr ?
783 http
->getConn()->getAuth() : http
->request
->auth_user_request
;
786 readNextRequest
= true;
789 /* ACCESS_ALLOWED continues here ... */
791 http
->uri
= SBufToCstring(http
->request
->effectiveRequestUri());
797 ClientHttpRequest::noteAdaptationAclCheckDone(Adaptation::ServiceGroupPointer g
)
799 debugs(93,3, this << " adaptationAclCheckDone called");
802 Adaptation::Icap::History::Pointer ih
= request
->icapHistory();
804 if (getConn() != nullptr && getConn()->clientConnection
!= nullptr) {
805 ih
->rfc931
= getConn()->clientConnection
->rfc931
;
807 if (getConn()->clientConnection
->isOpen()) {
808 ih
->ssluser
= sslGetUserEmail(fd_table
[getConn()->clientConnection
->fd
].ssl
.get());
812 ih
->log_uri
= log_uri
;
818 debugs(85,3, "no adaptation needed");
829 clientRedirectAccessCheckDone(Acl::Answer answer
, void *data
)
831 ClientRequestContext
*context
= (ClientRequestContext
*)data
;
832 ClientHttpRequest
*http
= context
->http
;
833 context
->acl_checklist
= nullptr;
835 if (answer
.allowed())
836 redirectStart(http
, clientRedirectDoneWrapper
, context
);
838 Helper::Reply
const nilReply(Helper::Error
);
839 context
->clientRedirectDone(nilReply
);
844 ClientRequestContext::clientRedirectStart()
846 debugs(33, 5, "'" << http
->uri
<< "'");
847 http
->al
->syncNotes(http
->request
);
848 if (Config
.accessList
.redirector
) {
849 acl_checklist
= clientAclChecklistCreate(Config
.accessList
.redirector
, http
);
850 acl_checklist
->nonBlockingCheck(clientRedirectAccessCheckDone
, this);
852 redirectStart(http
, clientRedirectDoneWrapper
, this);
856 * This methods handles Access checks result of StoreId access list.
857 * Will handle as "ERR" (no change) in a case Access is not allowed.
860 clientStoreIdAccessCheckDone(Acl::Answer answer
, void *data
)
862 ClientRequestContext
*context
= static_cast<ClientRequestContext
*>(data
);
863 ClientHttpRequest
*http
= context
->http
;
864 context
->acl_checklist
= nullptr;
866 if (answer
.allowed())
867 storeIdStart(http
, clientStoreIdDoneWrapper
, context
);
869 debugs(85, 3, "access denied expected ERR reply handling: " << answer
);
870 Helper::Reply
const nilReply(Helper::Error
);
871 context
->clientStoreIdDone(nilReply
);
876 * Start locating an alternative storage ID string (if any) from admin
877 * configured helper program. This is an asynchronous operation terminating in
878 * ClientRequestContext::clientStoreIdDone() when completed.
881 ClientRequestContext::clientStoreIdStart()
883 debugs(33, 5,"'" << http
->uri
<< "'");
885 if (Config
.accessList
.store_id
) {
886 acl_checklist
= clientAclChecklistCreate(Config
.accessList
.store_id
, http
);
887 acl_checklist
->nonBlockingCheck(clientStoreIdAccessCheckDone
, this);
889 storeIdStart(http
, clientStoreIdDoneWrapper
, this);
893 clientHierarchical(ClientHttpRequest
* http
)
895 HttpRequest
*request
= http
->request
;
896 HttpRequestMethod method
= request
->method
;
898 // intercepted requests MUST NOT (yet) be sent to peers unless verified
899 if (!request
->flags
.hostVerified
&& (request
->flags
.intercepted
|| request
->flags
.interceptTproxy
))
903 * IMS needs a private key, so we can use the hierarchy for IMS only if our
904 * neighbors support private keys
907 if (request
->flags
.ims
&& !neighbors_do_private_keys
)
911 * This is incorrect: authenticating requests can be sent via a hierarchy
912 * (they can even be cached if the correct headers are set on the reply)
914 if (request
->flags
.auth
)
917 if (method
== Http::METHOD_TRACE
)
920 if (method
!= Http::METHOD_GET
)
923 if (request
->flags
.loopDetected
)
926 if (request
->url
.getScheme() == AnyP::PROTO_HTTP
)
927 return method
.respMaybeCacheable();
933 clientCheckPinning(ClientHttpRequest
* http
)
935 HttpRequest
*request
= http
->request
;
936 HttpHeader
*req_hdr
= &request
->header
;
937 ConnStateData
*http_conn
= http
->getConn();
939 /* Internal requests such as those from ESI includes may be without
940 * a client connection
945 request
->flags
.connectionAuthDisabled
= http_conn
->port
->connection_auth_disabled
;
946 if (!request
->flags
.connectionAuthDisabled
) {
947 if (Comm::IsConnOpen(http_conn
->pinning
.serverConnection
)) {
948 if (http_conn
->pinning
.auth
) {
949 request
->flags
.connectionAuth
= true;
950 request
->flags
.auth
= true;
952 request
->flags
.connectionProxyAuth
= true;
954 // These should already be linked correctly.
955 assert(request
->clientConnectionManager
== http_conn
);
959 /* check if connection auth is used, and flag as candidate for pinning
961 * Note: we may need to set flags.connectionAuth even if the connection
962 * is already pinned if it was pinned earlier due to proxy auth
964 if (!request
->flags
.connectionAuth
) {
965 if (req_hdr
->has(Http::HdrType::AUTHORIZATION
) || req_hdr
->has(Http::HdrType::PROXY_AUTHORIZATION
)) {
966 HttpHeaderPos pos
= HttpHeaderInitPos
;
969 while ((e
= req_hdr
->getEntry(&pos
))) {
970 if (e
->id
== Http::HdrType::AUTHORIZATION
|| e
->id
== Http::HdrType::PROXY_AUTHORIZATION
) {
971 const char *value
= e
->value
.rawBuf();
972 if (strncasecmp(value
, "NTLM ", 5) == 0
974 strncasecmp(value
, "Negotiate ", 10) == 0
976 strncasecmp(value
, "Kerberos ", 9) == 0) {
977 if (e
->id
== Http::HdrType::AUTHORIZATION
) {
978 request
->flags
.connectionAuth
= true;
981 request
->flags
.connectionProxyAuth
= true;
987 if (may_pin
&& !request
->pinnedConnection()) {
988 // These should already be linked correctly. Just need the ServerConnection to pinn.
989 assert(request
->clientConnectionManager
== http_conn
);
996 clientInterpretRequestHeaders(ClientHttpRequest
* http
)
998 HttpRequest
*request
= http
->request
;
999 HttpHeader
*req_hdr
= &request
->header
;
1000 bool no_cache
= false;
1002 request
->imslen
= -1;
1003 request
->ims
= req_hdr
->getTime(Http::HdrType::IF_MODIFIED_SINCE
);
1005 if (request
->ims
> 0)
1006 request
->flags
.ims
= true;
1008 if (!request
->flags
.ignoreCc
) {
1009 if (request
->cache_control
) {
1010 if (request
->cache_control
->hasNoCache())
1013 // RFC 2616: treat Pragma:no-cache as if it was Cache-Control:no-cache when Cache-Control is missing
1014 } else if (req_hdr
->has(Http::HdrType::PRAGMA
))
1015 no_cache
= req_hdr
->hasListMember(Http::HdrType::PRAGMA
,"no-cache",',');
1018 if (request
->method
== Http::METHOD_OTHER
) {
1023 #if USE_HTTP_VIOLATIONS
1025 if (Config
.onoff
.reload_into_ims
)
1026 request
->flags
.nocacheHack
= true;
1027 else if (refresh_nocache_hack
)
1028 request
->flags
.nocacheHack
= true;
1032 request
->flags
.noCache
= true;
1035 /* ignore range header in non-GETs or non-HEADs */
1036 if (request
->method
== Http::METHOD_GET
|| request
->method
== Http::METHOD_HEAD
) {
1037 // XXX: initialize if we got here without HttpRequest::parseHeader()
1038 if (!request
->range
)
1039 request
->range
= req_hdr
->getRange();
1041 if (request
->range
) {
1042 request
->flags
.isRanged
= true;
1043 clientStreamNode
*node
= (clientStreamNode
*)http
->client_stream
.tail
->data
;
1044 /* XXX: This is suboptimal. We should give the stream the range set,
1045 * and thereby let the top of the stream set the offset when the
1046 * size becomes known. As it is, we will end up requesting from 0
1047 * for evey -X range specification.
1048 * RBC - this may be somewhat wrong. We should probably set the range
1049 * iter up at this point.
1051 node
->readBuffer
.offset
= request
->range
->lowestOffset(0);
1055 /* Only HEAD and GET requests permit a Range or Request-Range header.
1056 * If these headers appear on any other type of request, delete them now.
1059 req_hdr
->delById(Http::HdrType::RANGE
);
1060 req_hdr
->delById(Http::HdrType::REQUEST_RANGE
);
1061 request
->ignoreRange("neither HEAD nor GET");
1064 if (req_hdr
->has(Http::HdrType::AUTHORIZATION
))
1065 request
->flags
.auth
= true;
1067 clientCheckPinning(http
);
1069 if (!request
->url
.userInfo().isEmpty())
1070 request
->flags
.auth
= true;
1072 if (req_hdr
->has(Http::HdrType::VIA
)) {
1073 String s
= req_hdr
->getList(Http::HdrType::VIA
);
1075 * ThisCache cannot be a member of Via header, "1.1 ThisCache" can.
1076 * Note ThisCache2 has a space prepended to the hostname so we don't
1077 * accidentally match super-domains.
1080 if (strListIsSubstr(&s
, ThisCache2
, ',')) {
1081 request
->flags
.loopDetected
= true;
1085 fvdbCountVia(StringToSBuf(s
));
1092 // headers only relevant to reverse-proxy
1093 if (request
->flags
.accelerated
) {
1094 // check for a cdn-info member with a cdn-id matching surrogate_id
1095 // XXX: HttpHeader::hasListMember() does not handle OWS around ";" yet
1096 if (req_hdr
->hasListMember(Http::HdrType::CDN_LOOP
, Config
.Accel
.surrogate_id
, ','))
1097 request
->flags
.loopDetected
= true;
1100 if (request
->flags
.loopDetected
) {
1101 debugObj(33, DBG_IMPORTANT
, "WARNING: Forwarding loop detected for:\n",
1102 request
, (ObjPackMethod
) & httpRequestPack
);
1107 if (req_hdr
->has(Http::HdrType::X_FORWARDED_FOR
)) {
1108 String s
= req_hdr
->getList(Http::HdrType::X_FORWARDED_FOR
);
1109 fvdbCountForwarded(StringToSBuf(s
));
1115 if (http
->request
->maybeCacheable())
1116 request
->flags
.cachable
.support();
1118 request
->flags
.cachable
.veto();
1120 if (clientHierarchical(http
))
1121 request
->flags
.hierarchical
= true;
1123 debugs(85, 5, "clientInterpretRequestHeaders: REQ_NOCACHE = " <<
1124 (request
->flags
.noCache
? "SET" : "NOT SET"));
1125 debugs(85, 5, "clientInterpretRequestHeaders: REQ_CACHABLE = " <<
1126 (request
->flags
.cachable
? "SET" : "NOT SET"));
1127 debugs(85, 5, "clientInterpretRequestHeaders: REQ_HIERARCHICAL = " <<
1128 (request
->flags
.hierarchical
? "SET" : "NOT SET"));
1133 clientRedirectDoneWrapper(void *data
, const Helper::Reply
&result
)
1135 ClientRequestContext
*calloutContext
= (ClientRequestContext
*)data
;
1137 if (!calloutContext
->httpStateIsValid())
1140 calloutContext
->clientRedirectDone(result
);
1144 clientStoreIdDoneWrapper(void *data
, const Helper::Reply
&result
)
1146 ClientRequestContext
*calloutContext
= (ClientRequestContext
*)data
;
1148 if (!calloutContext
->httpStateIsValid())
1151 calloutContext
->clientStoreIdDone(result
);
1155 ClientRequestContext::clientRedirectDone(const Helper::Reply
&reply
)
1157 HttpRequest
*old_request
= http
->request
;
1158 debugs(85, 5, "'" << http
->uri
<< "' result=" << reply
);
1159 assert(redirect_state
== REDIRECT_PENDING
);
1160 redirect_state
= REDIRECT_DONE
;
1162 // Put helper response Notes into the transaction state record (ALE) eventually
1163 // do it early to ensure that no matter what the outcome the notes are present.
1165 http
->al
->syncNotes(old_request
);
1167 UpdateRequestNotes(http
->getConn(), *old_request
, reply
.notes
);
1169 switch (reply
.result
) {
1170 case Helper::TimedOut
:
1171 if (Config
.onUrlRewriteTimeout
.action
!= toutActBypass
) {
1172 static const auto d
= MakeNamedErrorDetail("REDIRECTOR_TIMEDOUT");
1173 http
->calloutsError(ERR_GATEWAY_FAILURE
, d
);
1174 debugs(85, DBG_IMPORTANT
, "ERROR: URL rewrite helper: Timedout");
1178 case Helper::Unknown
:
1180 // Handler in redirect.cc should have already mapped Unknown
1181 // IF it contained valid entry for the old URL-rewrite helper protocol
1182 debugs(85, DBG_IMPORTANT
, "ERROR: URL rewrite helper returned invalid result code. Wrong helper? " << reply
);
1185 case Helper::BrokenHelper
:
1186 debugs(85, DBG_IMPORTANT
, "ERROR: URL rewrite helper: " << reply
);
1190 // no change to be done.
1193 case Helper::Okay
: {
1194 // #1: redirect with a specific status code OK status=NNN url="..."
1195 // #2: redirect with a default status code OK url="..."
1196 // #3: re-write the URL OK rewrite-url="..."
1198 const char *statusNote
= reply
.notes
.findFirst("status");
1199 const char *urlNote
= reply
.notes
.findFirst("url");
1201 if (urlNote
!= nullptr) {
1202 // HTTP protocol redirect to be done.
1204 // TODO: change default redirect status for appropriate requests
1205 // Squid defaults to 302 status for now for better compatibility with old clients.
1206 // HTTP/1.0 client should get 302 (Http::scFound)
1207 // HTTP/1.1 client contacting reverse-proxy should get 307 (Http::scTemporaryRedirect)
1208 // HTTP/1.1 client being diverted by forward-proxy should get 303 (Http::scSeeOther)
1209 Http::StatusCode status
= Http::scFound
;
1210 if (statusNote
!= nullptr) {
1211 const char * result
= statusNote
;
1212 status
= static_cast<Http::StatusCode
>(atoi(result
));
1215 if (status
== Http::scMovedPermanently
1216 || status
== Http::scFound
1217 || status
== Http::scSeeOther
1218 || status
== Http::scPermanentRedirect
1219 || status
== Http::scTemporaryRedirect
) {
1220 http
->redirect
.status
= status
;
1221 http
->redirect
.location
= xstrdup(urlNote
);
1222 // TODO: validate the URL produced here is RFC 2616 compliant absolute URI
1224 debugs(85, DBG_CRITICAL
, "ERROR: URL-rewrite produces invalid " << status
<< " redirect Location: " << urlNote
);
1227 // URL-rewrite wanted. Ew.
1228 urlNote
= reply
.notes
.findFirst("rewrite-url");
1230 // prevent broken helpers causing too much damage. If old URL == new URL skip the re-write.
1231 if (urlNote
!= nullptr && strcmp(urlNote
, http
->uri
)) {
1233 if (tmpUrl
.parse(old_request
->method
, SBuf(urlNote
))) {
1234 HttpRequest
*new_request
= old_request
->clone();
1235 new_request
->url
= tmpUrl
;
1236 debugs(61, 2, "URL-rewriter diverts URL from " << old_request
->effectiveRequestUri() << " to " << new_request
->effectiveRequestUri());
1238 // unlink bodypipe from the old request. Not needed there any longer.
1239 if (old_request
->body_pipe
!= nullptr) {
1240 old_request
->body_pipe
= nullptr;
1241 debugs(61,2, "URL-rewriter diverts body_pipe " << new_request
->body_pipe
<<
1242 " from request " << old_request
<< " to " << new_request
);
1245 http
->resetRequestXXX(new_request
, true);
1246 old_request
= nullptr;
1248 debugs(85, DBG_CRITICAL
, "ERROR: URL-rewrite produces invalid request: " <<
1249 old_request
->method
<< " " << urlNote
<< " " << old_request
->http_ver
);
1257 /* XXX PIPELINE: This is inaccurate during pipelining */
1259 if (http
->getConn() != nullptr && Comm::IsConnOpen(http
->getConn()->clientConnection
))
1260 fd_note(http
->getConn()->clientConnection
->fd
, http
->uri
);
1268 * This method handles the different replies from StoreID helper.
1271 ClientRequestContext::clientStoreIdDone(const Helper::Reply
&reply
)
1273 HttpRequest
*old_request
= http
->request
;
1274 debugs(85, 5, "'" << http
->uri
<< "' result=" << reply
);
1275 assert(store_id_state
== REDIRECT_PENDING
);
1276 store_id_state
= REDIRECT_DONE
;
1278 // Put helper response Notes into the transaction state record (ALE) eventually
1279 // do it early to ensure that no matter what the outcome the notes are present.
1281 http
->al
->syncNotes(old_request
);
1283 UpdateRequestNotes(http
->getConn(), *old_request
, reply
.notes
);
1285 switch (reply
.result
) {
1286 case Helper::Unknown
:
1288 // Handler in redirect.cc should have already mapped Unknown
1289 // IF it contained valid entry for the old helper protocol
1290 debugs(85, DBG_IMPORTANT
, "ERROR: storeID helper returned invalid result code. Wrong helper? " << reply
);
1293 case Helper::TimedOut
:
1294 // Timeouts for storeID are not implemented
1295 case Helper::BrokenHelper
:
1296 debugs(85, DBG_IMPORTANT
, "ERROR: storeID helper: " << reply
);
1300 // no change to be done.
1303 case Helper::Okay
: {
1304 const char *urlNote
= reply
.notes
.findFirst("store-id");
1306 // prevent broken helpers causing too much damage. If old URL == new URL skip the re-write.
1307 if (urlNote
!= nullptr && strcmp(urlNote
, http
->uri
) ) {
1308 // Debug section required for some very specific cases.
1309 debugs(85, 9, "Setting storeID with: " << urlNote
);
1310 http
->request
->store_id
= urlNote
;
1311 http
->store_id
= urlNote
;
1320 /// applies "cache allow/deny" rules, asynchronously if needed
1322 ClientRequestContext::checkNoCache()
1324 if (Config
.accessList
.noCache
) {
1325 acl_checklist
= clientAclChecklistCreate(Config
.accessList
.noCache
, http
);
1326 acl_checklist
->nonBlockingCheck(checkNoCacheDoneWrapper
, this);
1328 /* unless otherwise specified, we try to cache. */
1329 checkNoCacheDone(ACCESS_ALLOWED
);
1334 checkNoCacheDoneWrapper(Acl::Answer answer
, void *data
)
1336 ClientRequestContext
*calloutContext
= (ClientRequestContext
*) data
;
1338 if (!calloutContext
->httpStateIsValid())
1341 calloutContext
->checkNoCacheDone(answer
);
1345 ClientRequestContext::checkNoCacheDone(const Acl::Answer
&answer
)
1347 acl_checklist
= nullptr;
1348 if (answer
.denied()) {
1349 http
->request
->flags
.disableCacheUse("a cache deny rule matched");
1356 ClientRequestContext::sslBumpAccessCheck()
1358 if (!http
->getConn()) {
1359 http
->al
->ssl
.bumpMode
= Ssl::bumpEnd
; // SslBump does not apply; log -
1363 const Ssl::BumpMode bumpMode
= http
->getConn()->sslBumpMode
;
1364 if (http
->request
->flags
.forceTunnel
) {
1365 debugs(85, 5, "not needed; already decided to tunnel " << http
->getConn());
1366 if (bumpMode
!= Ssl::bumpEnd
)
1367 http
->al
->ssl
.bumpMode
= bumpMode
; // inherited from bumped connection
1371 // If SSL connection tunneling or bumping decision has been made, obey it.
1372 if (bumpMode
!= Ssl::bumpEnd
) {
1373 debugs(85, 5, "SslBump already decided (" << bumpMode
<<
1374 "), " << "ignoring ssl_bump for " << http
->getConn());
1376 // We need the following "if" for transparently bumped TLS connection,
1377 // because in this case we are running ssl_bump access list before
1378 // the doCallouts runs. It can be removed after the bug #4340 fixed.
1379 // We do not want to proceed to bumping steps:
1380 // - if the TLS connection with the client is already established
1381 // because we are accepting normal HTTP requests on TLS port,
1382 // or because of the client-first bumping mode
1383 // - When the bumping is already started
1384 if (!http
->getConn()->switchedToHttps() &&
1385 !http
->getConn()->serverBump())
1386 http
->sslBumpNeed(bumpMode
); // for processRequest() to bump if needed and not already bumped
1387 http
->al
->ssl
.bumpMode
= bumpMode
; // inherited from bumped connection
1391 // If we have not decided yet, decide whether to bump now.
1393 // Bumping here can only start with a CONNECT request on a bumping port
1394 // (bumping of intercepted SSL conns is decided before we get 1st request).
1395 // We also do not bump redirected CONNECT requests.
1396 if (http
->request
->method
!= Http::METHOD_CONNECT
|| http
->redirect
.status
||
1397 !Config
.accessList
.ssl_bump
||
1398 !http
->getConn()->port
->flags
.tunnelSslBumping
) {
1399 http
->al
->ssl
.bumpMode
= Ssl::bumpEnd
; // SslBump does not apply; log -
1400 debugs(85, 5, "cannot SslBump this request");
1404 // Do not bump during authentication: clients would not proxy-authenticate
1405 // if we delay a 407 response and respond with 200 OK to CONNECT.
1406 if (error
&& error
->httpStatus
== Http::scProxyAuthenticationRequired
) {
1407 http
->al
->ssl
.bumpMode
= Ssl::bumpEnd
; // SslBump does not apply; log -
1408 debugs(85, 5, "no SslBump during proxy authentication");
1413 debugs(85, 5, "SslBump applies. Force bump action on error " << errorTypeName(error
->type
));
1414 http
->sslBumpNeed(Ssl::bumpBump
);
1415 http
->al
->ssl
.bumpMode
= Ssl::bumpBump
;
1419 debugs(85, 5, "SslBump possible, checking ACL");
1421 ACLFilledChecklist
*aclChecklist
= clientAclChecklistCreate(Config
.accessList
.ssl_bump
, http
);
1422 aclChecklist
->nonBlockingCheck(sslBumpAccessCheckDoneWrapper
, this);
1427 * A wrapper function to use the ClientRequestContext::sslBumpAccessCheckDone method
1428 * as ACLFilledChecklist callback
1431 sslBumpAccessCheckDoneWrapper(Acl::Answer answer
, void *data
)
1433 ClientRequestContext
*calloutContext
= static_cast<ClientRequestContext
*>(data
);
1435 if (!calloutContext
->httpStateIsValid())
1437 calloutContext
->sslBumpAccessCheckDone(answer
);
1441 ClientRequestContext::sslBumpAccessCheckDone(const Acl::Answer
&answer
)
1443 if (!httpStateIsValid())
1446 const Ssl::BumpMode bumpMode
= answer
.allowed() ?
1447 static_cast<Ssl::BumpMode
>(answer
.kind
) : Ssl::bumpSplice
;
1448 http
->sslBumpNeed(bumpMode
); // for processRequest() to bump if needed
1449 http
->al
->ssl
.bumpMode
= bumpMode
; // for logging
1451 if (bumpMode
== Ssl::bumpTerminate
) {
1452 const Comm::ConnectionPointer clientConn
= http
->getConn() ? http
->getConn()->clientConnection
: nullptr;
1453 if (Comm::IsConnOpen(clientConn
)) {
1454 debugs(85, 3, "closing after Ssl::bumpTerminate ");
1455 clientConn
->close();
1465 * Identify requests that do not go through the store and client side stream
1466 * and forward them to the appropriate location. All other requests, request
1470 ClientHttpRequest::processRequest()
1472 debugs(85, 4, request
->method
<< ' ' << uri
);
1474 const bool untouchedConnect
= request
->method
== Http::METHOD_CONNECT
&& !redirect
.status
;
1477 if (untouchedConnect
&& sslBumpNeeded()) {
1478 assert(!request
->flags
.forceTunnel
);
1484 if (untouchedConnect
|| request
->flags
.forceTunnel
) {
1485 getConn()->stopReading(); // tunnels read for themselves
1494 ClientHttpRequest::httpStart()
1496 // XXX: Re-initializes rather than updates. Should not be needed at all.
1497 updateLoggingTags(LOG_TAG_NONE
);
1498 debugs(85, 4, loggingTags().c_str() << " for '" << uri
<< "'");
1500 /* no one should have touched this */
1501 assert(out
.offset
== 0);
1502 /* Use the Stream Luke */
1503 clientStreamNode
*node
= (clientStreamNode
*)client_stream
.tail
->data
;
1504 clientStreamRead(node
, this, node
->readBuffer
);
1510 ClientHttpRequest::sslBumpNeed(Ssl::BumpMode mode
)
1512 debugs(83, 3, "sslBump required: "<< Ssl::bumpMode(mode
));
1513 sslBumpNeed_
= mode
;
1516 // called when comm_write has completed
1518 SslBumpEstablish(const Comm::ConnectionPointer
&, char *, size_t, Comm::Flag errflag
, int, void *data
)
1520 ClientHttpRequest
*r
= static_cast<ClientHttpRequest
*>(data
);
1521 debugs(85, 5, "responded to CONNECT: " << r
<< " ? " << errflag
);
1523 assert(r
&& cbdataReferenceValid(r
));
1524 r
->sslBumpEstablish(errflag
);
1528 ClientHttpRequest::sslBumpEstablish(Comm::Flag errflag
)
1530 // Bail out quickly on Comm::ERR_CLOSING - close handlers will tidy up
1531 if (errflag
== Comm::ERR_CLOSING
)
1535 debugs(85, 3, "CONNECT response failure in SslBump: " << errflag
);
1536 getConn()->clientConnection
->close();
1541 // Preserve authentication info for the ssl-bumped request
1542 if (request
->auth_user_request
!= nullptr)
1543 getConn()->setAuth(request
->auth_user_request
, "SSL-bumped CONNECT");
1546 assert(sslBumpNeeded());
1547 getConn()->switchToHttps(this, sslBumpNeed_
);
1551 ClientHttpRequest::sslBumpStart()
1553 debugs(85, 5, "Confirming " << Ssl::bumpMode(sslBumpNeed_
) <<
1554 "-bumped CONNECT tunnel on FD " << getConn()->clientConnection
);
1555 getConn()->sslBumpMode
= sslBumpNeed_
;
1557 AsyncCall::Pointer bumpCall
= commCbCall(85, 5, "ClientSocketContext::sslBumpEstablish",
1558 CommIoCbPtrFun(&SslBumpEstablish
, this));
1560 if (request
->flags
.interceptTproxy
|| request
->flags
.intercepted
) {
1561 CommIoCbParams
¶ms
= GetCommParams
<CommIoCbParams
>(bumpCall
);
1562 params
.flag
= Comm::OK
;
1563 params
.conn
= getConn()->clientConnection
;
1564 ScheduleCallHere(bumpCall
);
1568 al
->reply
= HttpReply::MakeConnectionEstablished();
1570 const auto mb
= al
->reply
->pack();
1571 // send an HTTP 200 response to kick client SSL negotiation
1572 // TODO: Unify with tunnel.cc and add a Server(?) header
1573 Comm::Write(getConn()->clientConnection
, mb
, bumpCall
);
1580 ClientHttpRequest::updateError(const Error
&error
)
1583 request
->error
.update(error
);
1585 al
->updateError(error
);
1589 ClientHttpRequest::gotEnough() const
1591 // TODO: See also (and unify with) clientReplyContext::storeNotOKTransferDone()
1592 int64_t contentLength
=
1593 memObject()->baseReply().bodySize(request
->method
);
1594 assert(contentLength
>= 0);
1596 if (out
.offset
< contentLength
)
1603 ClientHttpRequest::storeEntry(StoreEntry
*newEntry
)
1609 ClientHttpRequest::loggingEntry(StoreEntry
*newEntry
)
1612 loggingEntry_
->unlock("ClientHttpRequest::loggingEntry");
1614 loggingEntry_
= newEntry
;
1617 loggingEntry_
->lock("ClientHttpRequest::loggingEntry");
1621 ClientHttpRequest::initRequest(HttpRequest
*aRequest
)
1623 assignRequest(aRequest
);
1624 if (const auto csd
= getConn()) {
1625 if (!csd
->notes()->empty())
1626 request
->notes()->appendNewOnly(csd
->notes().getRaw());
1628 // al is created in the constructor
1631 al
->request
= request
;
1632 HTTPMSGLOCK(al
->request
);
1633 al
->syncNotes(request
);
1638 ClientHttpRequest::resetRequest(HttpRequest
*newRequest
)
1640 const auto uriChanged
= request
->effectiveRequestUri() != newRequest
->effectiveRequestUri();
1641 resetRequestXXX(newRequest
, uriChanged
);
1645 ClientHttpRequest::resetRequestXXX(HttpRequest
*newRequest
, const bool uriChanged
)
1647 assert(request
!= newRequest
);
1649 assignRequest(newRequest
);
1651 uri
= SBufToCstring(request
->effectiveRequestUri());
1654 request
->flags
.redirected
= true;
1655 checkForInternalAccess();
1660 ClientHttpRequest::checkForInternalAccess()
1662 if (!internalCheck(request
->url
.path()))
1665 if (internalHostnameIs(request
->url
.host()) && request
->url
.port() == getMyPort()) {
1666 debugs(33, 3, "internal URL found: " << request
->url
.getScheme() << "://" << request
->url
.authority(true));
1667 request
->flags
.internal
= true;
1668 } else if (Config
.onoff
.global_internal_static
&& internalStaticCheck(request
->url
.path())) {
1669 debugs(33, 3, "internal URL found: " << request
->url
.getScheme() << "://" << request
->url
.authority(true) << " (global_internal_static on)");
1670 request
->url
.setScheme(AnyP::PROTO_HTTP
, "http");
1671 request
->url
.host(internalHostname());
1672 request
->url
.port(getMyPort());
1673 request
->flags
.internal
= true;
1674 setLogUriToRequestUri();
1676 debugs(33, 3, "internal URL found: " << request
->url
.getScheme() << "://" << request
->url
.authority(true) << " (not this proxy)");
1679 if (ForSomeCacheManager(request
->url
.path()))
1680 request
->flags
.disableCacheUse("cache manager URL");
1684 ClientHttpRequest::assignRequest(HttpRequest
*newRequest
)
1688 const_cast<HttpRequest
*&>(request
) = newRequest
;
1689 HTTPMSGLOCK(request
);
1690 setLogUriToRequestUri();
1694 ClientHttpRequest::clearRequest()
1696 HttpRequest
*oldRequest
= request
;
1697 HTTPMSGUNLOCK(oldRequest
);
1698 const_cast<HttpRequest
*&>(request
) = nullptr;
1699 absorbLogUri(nullptr);
1703 * doCallouts() - This function controls the order of "callout"
1704 * executions, including non-blocking access control checks, the
1705 * redirector, and ICAP. Previously, these callouts were chained
1706 * together such that "clientAccessCheckDone()" would call
1707 * "clientRedirectStart()" and so on.
1709 * The ClientRequestContext (aka calloutContext) class holds certain
1710 * state data for the callout/callback operations. Previously
1711 * ClientHttpRequest would sort of hand off control to ClientRequestContext
1712 * for a short time. ClientRequestContext would then delete itself
1713 * and pass control back to ClientHttpRequest when all callouts
1716 * This caused some problems for ICAP because we want to make the
1717 * ICAP callout after checking ACLs, but before checking the no_cache
1718 * list. We can't stuff the ICAP state into the ClientRequestContext
1719 * class because we still need the ICAP state after ClientRequestContext
1722 * Note that ClientRequestContext is created before the first call
1725 * If one of the callouts notices that ClientHttpRequest is no
1726 * longer valid, it should call cbdataReferenceDone() so that
1727 * ClientHttpRequest's reference count goes to zero and it will get
1728 * deleted. ClientHttpRequest will then delete ClientRequestContext.
1730 * Note that we set the _done flags here before actually starting
1731 * the callout. This is strictly for convenience.
1735 ClientHttpRequest::doCallouts()
1737 assert(calloutContext
);
1739 if (!calloutContext
->error
) {
1740 // CVE-2009-0801: verify the Host: header is consistent with other known details.
1741 if (!calloutContext
->host_header_verify_done
) {
1742 debugs(83, 3, "Doing calloutContext->hostHeaderVerify()");
1743 calloutContext
->host_header_verify_done
= true;
1744 calloutContext
->hostHeaderVerify();
1748 if (!calloutContext
->http_access_done
) {
1749 debugs(83, 3, "Doing calloutContext->clientAccessCheck()");
1750 calloutContext
->http_access_done
= true;
1751 calloutContext
->clientAccessCheck();
1756 if (!calloutContext
->adaptation_acl_check_done
) {
1757 calloutContext
->adaptation_acl_check_done
= true;
1758 if (Adaptation::AccessCheck::Start(
1759 Adaptation::methodReqmod
, Adaptation::pointPreCache
,
1760 request
, nullptr, calloutContext
->http
->al
, this))
1761 return; // will call callback
1765 if (!calloutContext
->redirect_done
) {
1766 calloutContext
->redirect_done
= true;
1768 if (Config
.Program
.redirect
) {
1769 debugs(83, 3, "Doing calloutContext->clientRedirectStart()");
1770 calloutContext
->redirect_state
= REDIRECT_PENDING
;
1771 calloutContext
->clientRedirectStart();
1776 if (!calloutContext
->adapted_http_access_done
) {
1777 debugs(83, 3, "Doing calloutContext->clientAccessCheck2()");
1778 calloutContext
->adapted_http_access_done
= true;
1779 calloutContext
->clientAccessCheck2();
1783 if (!calloutContext
->store_id_done
) {
1784 calloutContext
->store_id_done
= true;
1786 if (Config
.Program
.store_id
) {
1787 debugs(83, 3,"Doing calloutContext->clientStoreIdStart()");
1788 calloutContext
->store_id_state
= REDIRECT_PENDING
;
1789 calloutContext
->clientStoreIdStart();
1794 if (!calloutContext
->interpreted_req_hdrs
) {
1795 debugs(83, 3, "Doing clientInterpretRequestHeaders()");
1796 calloutContext
->interpreted_req_hdrs
= 1;
1797 clientInterpretRequestHeaders(this);
1800 if (!calloutContext
->no_cache_done
) {
1801 calloutContext
->no_cache_done
= true;
1803 if (Config
.accessList
.noCache
&& request
->flags
.cachable
) {
1804 debugs(83, 3, "Doing calloutContext->checkNoCache()");
1805 calloutContext
->checkNoCache();
1809 } // if !calloutContext->error
1811 // Set appropriate MARKs and CONNMARKs if needed.
1812 if (getConn() && Comm::IsConnOpen(getConn()->clientConnection
)) {
1813 ACLFilledChecklist
ch(nullptr, request
, nullptr);
1814 ch
.al
= calloutContext
->http
->al
;
1815 ch
.src_addr
= request
->client_addr
;
1816 ch
.my_addr
= request
->my_addr
;
1817 ch
.syncAle(request
, log_uri
);
1819 if (!calloutContext
->toClientMarkingDone
) {
1820 calloutContext
->toClientMarkingDone
= true;
1821 tos_t tos
= aclMapTOS(Ip::Qos::TheConfig
.tosToClient
, &ch
);
1823 Ip::Qos::setSockTos(getConn()->clientConnection
, tos
);
1825 const auto packetMark
= aclFindNfMarkConfig(Ip::Qos::TheConfig
.nfmarkToClient
, &ch
);
1826 if (!packetMark
.isEmpty())
1827 Ip::Qos::setSockNfmark(getConn()->clientConnection
, packetMark
.mark
);
1829 const auto connmark
= aclFindNfMarkConfig(Ip::Qos::TheConfig
.nfConnmarkToClient
, &ch
);
1830 if (!connmark
.isEmpty())
1831 Ip::Qos::setNfConnmark(getConn()->clientConnection
, Ip::Qos::dirAccepted
, connmark
);
1836 // Even with calloutContext->error, we call sslBumpAccessCheck() to decide
1837 // whether SslBump applies to this transaction. If it applies, we will
1838 // attempt to bump the client to serve the error.
1839 if (!calloutContext
->sslBumpCheckDone
) {
1840 calloutContext
->sslBumpCheckDone
= true;
1841 if (calloutContext
->sslBumpAccessCheck())
1843 /* else no ssl bump required*/
1847 if (calloutContext
->error
) {
1848 // XXX: prformance regression. c_str() reallocates
1849 SBuf
storeUriBuf(request
->storeId());
1850 const char *storeUri
= storeUriBuf
.c_str();
1851 StoreEntry
*e
= storeCreateEntry(storeUri
, storeUri
, request
->flags
, request
->method
);
1853 if (sslBumpNeeded()) {
1854 // We have to serve an error, so bump the client first.
1855 sslBumpNeed(Ssl::bumpClientFirst
);
1856 // set final error but delay sending until we bump
1857 Ssl::ServerBump
*srvBump
= new Ssl::ServerBump(this, e
, Ssl::bumpClientFirst
);
1858 errorAppendEntry(e
, calloutContext
->error
);
1859 calloutContext
->error
= nullptr;
1860 getConn()->setServerBump(srvBump
);
1861 e
->unlock("ClientHttpRequest::doCallouts+sslBumpNeeded");
1865 // send the error to the client now
1866 clientStreamNode
*node
= (clientStreamNode
*)client_stream
.tail
->prev
->data
;
1867 clientReplyContext
*repContext
= dynamic_cast<clientReplyContext
*>(node
->data
.getRaw());
1868 assert (repContext
);
1869 repContext
->setReplyToStoreEntry(e
, "immediate SslBump error");
1870 errorAppendEntry(e
, calloutContext
->error
);
1871 calloutContext
->error
= nullptr;
1872 if (calloutContext
->readNextRequest
&& getConn())
1873 getConn()->flags
.readMore
= true; // resume any pipeline reads.
1874 node
= (clientStreamNode
*)client_stream
.tail
->data
;
1875 clientStreamRead(node
, this, node
->readBuffer
);
1876 e
->unlock("ClientHttpRequest::doCallouts-sslBumpNeeded");
1881 cbdataReferenceDone(calloutContext
->http
);
1882 delete calloutContext
;
1883 calloutContext
= nullptr;
1885 debugs(83, 3, "calling processRequest()");
1889 Adaptation::Icap::History::Pointer ih
= request
->icapHistory();
1891 ih
->logType
= loggingTags();
1896 ClientHttpRequest::setLogUriToRequestUri()
1899 const auto canonicalUri
= request
->canonicalCleanUrl();
1900 absorbLogUri(xstrndup(canonicalUri
, MAX_URL
));
1904 ClientHttpRequest::setLogUriToRawUri(const char *rawUri
, const HttpRequestMethod
&method
)
1907 // Should(!request);
1909 // TODO: SBuf() performance regression, fix by converting rawUri to SBuf
1910 char *canonicalUri
= urlCanonicalCleanWithoutRequest(SBuf(rawUri
), method
, AnyP::UriScheme());
1912 absorbLogUri(AnyP::Uri::cleanup(canonicalUri
));
1914 char *cleanedRawUri
= AnyP::Uri::cleanup(rawUri
);
1915 al
->setVirginUrlForMissingRequest(SBuf(cleanedRawUri
));
1916 xfree(cleanedRawUri
);
1920 ClientHttpRequest::absorbLogUri(char *aUri
)
1923 const_cast<char *&>(log_uri
) = aUri
;
1927 ClientHttpRequest::setErrorUri(const char *aUri
)
1931 // Should(!request);
1933 uri
= xstrdup(aUri
);
1934 // TODO: SBuf() performance regression, fix by converting setErrorUri() parameter to SBuf
1935 const SBuf
errorUri(aUri
);
1936 const auto canonicalUri
= urlCanonicalCleanWithoutRequest(errorUri
, HttpRequestMethod(), AnyP::UriScheme());
1937 absorbLogUri(xstrndup(canonicalUri
, MAX_URL
));
1939 al
->setVirginUrlForMissingRequest(errorUri
);
1942 // XXX: This should not be a _request_ method. Move range_iter elsewhere.
1944 ClientHttpRequest::prepPartialResponseGeneration()
1947 assert(request
->range
);
1949 range_iter
.pos
= request
->range
->begin();
1950 range_iter
.end
= request
->range
->end();
1951 range_iter
.debt_size
= 0;
1952 const auto multipart
= request
->range
->specs
.size() > 1;
1954 range_iter
.boundary
= rangeBoundaryStr();
1955 range_iter
.valid
= true; // TODO: Remove.
1956 range_iter
.updateSpec(); // TODO: Refactor to initialize rather than update.
1958 assert(range_iter
.pos
!= range_iter
.end
);
1959 const auto &firstRange
= *range_iter
.pos
;
1961 out
.offset
= firstRange
->offset
;
1963 return multipart
? mRangeCLen() : firstRange
->length
;
1967 /// Initiate an asynchronous adaptation transaction which will call us back.
1969 ClientHttpRequest::startAdaptation(const Adaptation::ServiceGroupPointer
&g
)
1971 debugs(85, 3, "adaptation needed for " << this);
1972 assert(!virginHeadSource
);
1973 assert(!adaptedBodySource
);
1974 virginHeadSource
= initiateAdaptation(
1975 new Adaptation::Iterator(request
, nullptr, al
, g
));
1977 // we could try to guess whether we can bypass this adaptation
1978 // initiation failure, but it should not really happen
1979 Must(initiated(virginHeadSource
));
1983 ClientHttpRequest::noteAdaptationAnswer(const Adaptation::Answer
&answer
)
1985 assert(cbdataReferenceValid(this)); // indicates bug
1986 clearAdaptation(virginHeadSource
);
1987 assert(!adaptedBodySource
);
1989 switch (answer
.kind
) {
1990 case Adaptation::Answer::akForward
:
1991 handleAdaptedHeader(const_cast<Http::Message
*>(answer
.message
.getRaw()));
1994 case Adaptation::Answer::akBlock
:
1995 handleAdaptationBlock(answer
);
1998 case Adaptation::Answer::akError
: {
1999 static const auto d
= MakeNamedErrorDetail("CLT_REQMOD_ABORT");
2000 handleAdaptationFailure(d
, !answer
.final
);
2007 ClientHttpRequest::handleAdaptedHeader(Http::Message
*msg
)
2011 if (HttpRequest
*new_req
= dynamic_cast<HttpRequest
*>(msg
)) {
2012 resetRequest(new_req
);
2013 assert(request
->method
.id());
2014 } else if (HttpReply
*new_rep
= dynamic_cast<HttpReply
*>(msg
)) {
2015 debugs(85,3, "REQMOD reply is HTTP reply");
2017 // subscribe to receive reply body
2018 if (new_rep
->body_pipe
!= nullptr) {
2019 adaptedBodySource
= new_rep
->body_pipe
;
2020 int consumer_ok
= adaptedBodySource
->setConsumerIfNotLate(this);
2021 assert(consumer_ok
);
2024 clientStreamNode
*node
= (clientStreamNode
*)client_stream
.tail
->prev
->data
;
2025 clientReplyContext
*repContext
= dynamic_cast<clientReplyContext
*>(node
->data
.getRaw());
2027 repContext
->createStoreEntry(request
->method
, request
->flags
);
2029 request_satisfaction_mode
= true;
2030 request_satisfaction_offset
= 0;
2031 storeEntry()->replaceHttpReply(new_rep
);
2032 storeEntry()->timestampsSet();
2034 al
->reply
= new_rep
;
2036 if (!adaptedBodySource
) // no body
2037 storeEntry()->complete();
2038 clientGetMoreData(node
, this);
2041 // we are done with getting headers (but may be receiving body)
2042 clearAdaptation(virginHeadSource
);
2044 if (!request_satisfaction_mode
)
2049 ClientHttpRequest::handleAdaptationBlock(const Adaptation::Answer
&answer
)
2051 static const auto d
= MakeNamedErrorDetail("REQMOD_BLOCK");
2052 request
->detailError(ERR_ACCESS_DENIED
, d
);
2053 AclMatchedName
= answer
.ruleId
.termedBuf();
2054 assert(calloutContext
);
2055 calloutContext
->clientAccessCheckDone(ACCESS_DENIED
);
2056 AclMatchedName
= nullptr;
2060 ClientHttpRequest::resumeBodyStorage()
2062 if (!adaptedBodySource
)
2065 noteMoreBodyDataAvailable(adaptedBodySource
);
2069 ClientHttpRequest::noteMoreBodyDataAvailable(BodyPipe::Pointer
)
2071 assert(request_satisfaction_mode
);
2072 assert(adaptedBodySource
!= nullptr);
2074 if (size_t contentSize
= adaptedBodySource
->buf().contentSize()) {
2075 const size_t spaceAvailable
= storeEntry()->bytesWanted(Range
<size_t>(0,contentSize
));
2077 if (spaceAvailable
< contentSize
) {
2078 // No or partial body data consuming
2079 typedef NullaryMemFunT
<ClientHttpRequest
> Dialer
;
2080 AsyncCall::Pointer call
= asyncCall(93, 5, "ClientHttpRequest::resumeBodyStorage",
2081 Dialer(this, &ClientHttpRequest::resumeBodyStorage
));
2082 storeEntry()->deferProducer(call
);
2085 if (!spaceAvailable
)
2088 if (spaceAvailable
< contentSize
)
2089 contentSize
= spaceAvailable
;
2091 BodyPipeCheckout
bpc(*adaptedBodySource
);
2092 const StoreIOBuffer
ioBuf(&bpc
.buf
, request_satisfaction_offset
, contentSize
);
2093 storeEntry()->write(ioBuf
);
2094 // assume StoreEntry::write() writes the entire ioBuf
2095 request_satisfaction_offset
+= ioBuf
.length
;
2096 bpc
.buf
.consume(contentSize
);
2100 if (adaptedBodySource
->exhausted()) {
2101 // XXX: Setting receivedWholeAdaptedReply here is a workaround for a
2102 // regression, as described in https://bugs.squid-cache.org/show_bug.cgi?id=5187#c6
2103 receivedWholeAdaptedReply
= true;
2104 debugs(85, Important(72), "WARNING: Squid bug 5187 workaround triggered");
2105 endRequestSatisfaction();
2107 // else wait for more body data
2111 ClientHttpRequest::noteBodyProductionEnded(BodyPipe::Pointer
)
2113 assert(!virginHeadSource
);
2115 // distinguish this code path from future noteBodyProducerAborted() that
2116 // would continue storing/delivering (truncated) reply if necessary (TODO)
2117 receivedWholeAdaptedReply
= true;
2119 // should we end request satisfaction now?
2120 if (adaptedBodySource
!= nullptr && adaptedBodySource
->exhausted())
2121 endRequestSatisfaction();
2125 ClientHttpRequest::endRequestSatisfaction()
2127 debugs(85,4, this << " ends request satisfaction");
2128 assert(request_satisfaction_mode
);
2129 stopConsumingFrom(adaptedBodySource
);
2131 // TODO: anything else needed to end store entry formation correctly?
2132 if (receivedWholeAdaptedReply
) {
2133 // We received the entire reply per receivedWholeAdaptedReply.
2134 // We are called when we consumed everything received (per our callers).
2135 // We consume only what we store per noteMoreBodyDataAvailable().
2136 storeEntry()->completeSuccessfully("received, consumed, and, hence, stored the entire REQMOD reply");
2138 storeEntry()->completeTruncated("REQMOD request satisfaction default");
2143 ClientHttpRequest::noteBodyProducerAborted(BodyPipe::Pointer
)
2145 assert(!virginHeadSource
);
2146 stopConsumingFrom(adaptedBodySource
);
2148 debugs(85,3, "REQMOD body production failed");
2149 if (request_satisfaction_mode
) { // too late to recover or serve an error
2150 static const auto d
= MakeNamedErrorDetail("CLT_REQMOD_RESP_BODY");
2151 request
->detailError(ERR_ICAP_FAILURE
, d
);
2152 const Comm::ConnectionPointer c
= getConn()->clientConnection
;
2153 Must(Comm::IsConnOpen(c
));
2154 c
->close(); // drastic, but we may be writing a response already
2156 static const auto d
= MakeNamedErrorDetail("CLT_REQMOD_REQ_BODY");
2157 handleAdaptationFailure(d
);
2162 ClientHttpRequest::handleAdaptationFailure(const ErrorDetail::Pointer
&errDetail
, bool bypassable
)
2164 debugs(85,3, "handleAdaptationFailure(" << bypassable
<< ")");
2166 const bool usedStore
= storeEntry() && !storeEntry()->isEmpty();
2167 const bool usedPipe
= request
->body_pipe
!= nullptr &&
2168 request
->body_pipe
->consumedSize() > 0;
2170 if (bypassable
&& !usedStore
&& !usedPipe
) {
2171 debugs(85,3, "ICAP REQMOD callout failed, bypassing: " << calloutContext
);
2177 debugs(85,3, "ICAP REQMOD callout failed, responding with error");
2179 clientStreamNode
*node
= (clientStreamNode
*)client_stream
.tail
->prev
->data
;
2180 clientReplyContext
*repContext
= dynamic_cast<clientReplyContext
*>(node
->data
.getRaw());
2183 calloutsError(ERR_ICAP_FAILURE
, errDetail
);
2190 ClientHttpRequest::callException(const std::exception
&ex
)
2192 if (const auto clientConn
= getConn() ? getConn()->clientConnection
: nullptr) {
2193 if (Comm::IsConnOpen(clientConn
)) {
2194 debugs(85, 3, "closing after exception: " << ex
.what());
2195 clientConn
->close(); // initiate orderly top-to-bottom cleanup
2199 debugs(85, DBG_IMPORTANT
, "ClientHttpRequest exception without connection. Ignoring " << ex
.what());
2200 // XXX: Normally, we mustStop() but we cannot do that here because it is
2201 // likely to leave Http::Stream and ConnStateData with a dangling http
2202 // pointer. See r13480 or XXX in Http::Stream class description.
2206 // XXX: modify and use with ClientRequestContext::clientAccessCheckDone too.
2208 ClientHttpRequest::calloutsError(const err_type error
, const ErrorDetail::Pointer
&errDetail
)
2210 // The original author of the code also wanted to pass an errno to
2211 // setReplyToError, but it seems unlikely that the errno reflects the
2212 // true cause of the error at this point, so I did not pass it.
2213 if (calloutContext
) {
2214 ConnStateData
* c
= getConn();
2215 calloutContext
->error
= clientBuildError(error
, Http::scInternalServerError
,
2216 nullptr, c
, request
, al
);
2218 calloutContext
->error
->auth_user_request
=
2219 c
!= nullptr && c
->getAuth() != nullptr ? c
->getAuth() : request
->auth_user_request
;
2221 calloutContext
->error
->detailError(errDetail
);
2222 calloutContext
->readNextRequest
= true;
2224 c
->expectNoForwarding();
2226 //else if(calloutContext == NULL) is it possible?