2 * DEBUG: section 11 Hypertext Transfer Protocol (HTTP)
3 * AUTHOR: Harvest Derived
5 * SQUID Web Proxy Cache http://www.squid-cache.org/
6 * ----------------------------------------------------------
8 * Squid is the result of efforts by numerous individuals from
9 * the Internet community; see the CONTRIBUTORS file for full
10 * details. Many organizations have provided support for Squid's
11 * development; see the SPONSORS file for full details. Squid is
12 * Copyrighted (C) 2001 by the Regents of the University of
13 * California; see the COPYRIGHT file for full details. Squid
14 * incorporates software developed and/or copyrighted by other
15 * sources; see the CREDITS file for full details.
17 * This program is free software; you can redistribute it and/or modify
18 * it under the terms of the GNU General Public License as published by
19 * the Free Software Foundation; either version 2 of the License, or
20 * (at your option) any later version.
22 * This program is distributed in the hope that it will be useful,
23 * but WITHOUT ANY WARRANTY; without even the implied warranty of
24 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25 * GNU General Public License for more details.
27 * You should have received a copy of the GNU General Public License
28 * along with this program; if not, write to the Free Software
29 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA.
33 * Anonymizing patch by lutz@as-node.jena.thur.de
34 * have a look into http-anon.c to get more informations.
38 #include "acl/FilledChecklist.h"
39 #include "base/AsyncJobCalls.h"
40 #include "base/TextException.h"
42 #include "CachePeer.h"
43 #include "ChunkedCodingParser.h"
44 #include "client_side.h"
45 #include "comm/Connection.h"
46 #include "comm/Write.h"
47 #include "err_detail_type.h"
48 #include "errorpage.h"
53 #include "HttpControlMsg.h"
54 #include "HttpHdrCc.h"
55 #include "HttpHdrContRange.h"
56 #include "HttpHdrSc.h"
57 #include "HttpHdrScTarget.h"
58 #include "HttpHeaderTools.h"
59 #include "HttpReply.h"
60 #include "HttpRequest.h"
61 #include "HttpStateFlags.h"
62 #include "log/access_log.h"
64 #include "MemObject.h"
65 #include "mime_header.h"
66 #include "neighbors.h"
67 #include "peer_proxy_negotiate_auth.h"
68 #include "profiler/Profiler.h"
70 #include "RefreshPattern.h"
72 #include "SquidConfig.h"
73 #include "SquidTime.h"
74 #include "StatCounters.h"
81 #include "auth/UserRequest.h"
84 #include "DelayPools.h"
87 #define SQUID_ENTER_THROWING_CODE() try {
88 #define SQUID_EXIT_THROWING_CODE(status) \
91 catch (const std::exception &e) { \
92 debugs (11, 1, "Exception error:" << e.what()); \
96 CBDATA_CLASS_INIT(HttpStateData
);
98 static const char *const crlf
= "\r\n";
100 static void httpMaybeRemovePublic(StoreEntry
*, Http::StatusCode
);
101 static void copyOneHeaderFromClientsideRequestToUpstreamRequest(const HttpHeaderEntry
*e
, const String strConnection
, const HttpRequest
* request
,
102 HttpHeader
* hdr_out
, const int we_do_ranges
, const HttpStateFlags
&);
103 //Declared in HttpHeaderTools.cc
104 void httpHdrAdd(HttpHeader
*heads
, HttpRequest
*request
, const AccessLogEntryPointer
&al
, HeaderWithAclList
&headers_add
);
106 HttpStateData::HttpStateData(FwdState
*theFwdState
) : AsyncJob("HttpStateData"), ServerStateData(theFwdState
),
107 lastChunk(0), header_bytes_read(0), reply_bytes_read(0),
108 body_bytes_truncated(0), httpChunkDecoder(NULL
)
110 debugs(11,5,HERE
<< "HttpStateData " << this << " created");
111 ignoreCacheControl
= false;
112 surrogateNoStore
= false;
113 serverConnection
= fwd
->serverConnection();
114 readBuf
= new MemBuf
;
115 readBuf
->init(16*1024, 256*1024);
117 // reset peer response time stats for %<pt
118 request
->hier
.peer_http_request_sent
.tv_sec
= 0;
119 request
->hier
.peer_http_request_sent
.tv_usec
= 0;
121 if (fwd
->serverConnection() != NULL
)
122 _peer
= cbdataReference(fwd
->serverConnection()->getPeer()); /* might be NULL */
125 request
->flags
.proxying
= true;
127 * This NEIGHBOR_PROXY_ONLY check probably shouldn't be here.
128 * We might end up getting the object from somewhere else if,
129 * for example, the request to this neighbor fails.
131 if (_peer
->options
.proxy_only
)
132 entry
->releaseRequest();
135 entry
->setNoDelay(_peer
->options
.no_delay
);
140 * register the handler to free HTTP state data when the FD closes
142 typedef CommCbMemFunT
<HttpStateData
, CommCloseCbParams
> Dialer
;
143 closeHandler
= JobCallback(9, 5, Dialer
, this, HttpStateData::httpStateConnClosed
);
144 comm_add_close_handler(serverConnection
->fd
, closeHandler
);
147 HttpStateData::~HttpStateData()
150 * don't forget that ~ServerStateData() gets called automatically
153 if (!readBuf
->isNull())
158 if (httpChunkDecoder
)
159 delete httpChunkDecoder
;
161 cbdataReferenceDone(_peer
);
163 debugs(11,5, HERE
<< "HttpStateData " << this << " destroyed; " << serverConnection
);
166 const Comm::ConnectionPointer
&
167 HttpStateData::dataConnection() const
169 return serverConnection
;
173 HttpStateData::httpStateConnClosed(const CommCloseCbParams
¶ms
)
175 debugs(11, 5, "httpStateFree: FD " << params
.fd
<< ", httpState=" << params
.data
);
176 mustStop("HttpStateData::httpStateConnClosed");
180 HttpStateData::httpTimeout(const CommTimeoutCbParams
¶ms
)
182 debugs(11, 4, HERE
<< serverConnection
<< ": '" << entry
->url() << "'" );
184 if (entry
->store_status
== STORE_PENDING
) {
185 fwd
->fail(new ErrorState(ERR_READ_TIMEOUT
, Http::scGatewayTimeout
, fwd
->request
));
188 serverConnection
->close();
191 /// Remove an existing public store entry if the incoming response (to be
192 /// stored in a currently private entry) is going to invalidate it.
194 httpMaybeRemovePublic(StoreEntry
* e
, Http::StatusCode status
)
200 // If the incoming response already goes into a public entry, then there is
201 // nothing to remove. This protects ready-for-collapsing entries as well.
202 if (!EBIT_TEST(e
->flags
, KEY_PRIVATE
))
209 case Http::scNonAuthoritativeInformation
:
211 case Http::scMultipleChoices
:
213 case Http::scMovedPermanently
:
219 case Http::scNotFound
:
224 case Http::scForbidden
:
226 case Http::scMethodNotAllowed
:
233 case Http::scUnauthorized
:
243 * Any 2xx response should eject previously cached entities...
246 if (status
>= 200 && status
< 300)
254 if (!remove
&& !forbidden
)
259 if (e
->mem_obj
->request
)
260 pe
= storeGetPublicByRequest(e
->mem_obj
->request
);
262 pe
= storeGetPublic(e
->mem_obj
->storeId(), e
->mem_obj
->method
);
267 neighborsHtcpClear(e
, NULL
, e
->mem_obj
->request
, e
->mem_obj
->method
, HTCP_CLR_INVALIDATION
);
273 * Also remove any cached HEAD response in case the object has
276 if (e
->mem_obj
->request
)
277 pe
= storeGetPublicByRequestMethod(e
->mem_obj
->request
, Http::METHOD_HEAD
);
279 pe
= storeGetPublic(e
->mem_obj
->storeId(), Http::METHOD_HEAD
);
284 neighborsHtcpClear(e
, NULL
, e
->mem_obj
->request
, HttpRequestMethod(Http::METHOD_HEAD
), HTCP_CLR_INVALIDATION
);
291 HttpStateData::processSurrogateControl(HttpReply
*reply
)
293 if (request
->flags
.accelerated
&& reply
->surrogate_control
) {
294 HttpHdrScTarget
*sctusable
= reply
->surrogate_control
->getMergedTarget(Config
.Accel
.surrogate_id
);
297 if (sctusable
->noStore() ||
298 (Config
.onoff
.surrogate_is_remote
299 && sctusable
->noStoreRemote())) {
300 surrogateNoStore
= true;
301 entry
->makePrivate();
304 /* The HttpHeader logic cannot tell if the header it's parsing is a reply to an
305 * accelerated request or not...
306 * Still, this is an abstraction breach. - RC
308 if (sctusable
->hasMaxAge()) {
309 if (sctusable
->maxAge() < sctusable
->maxStale())
310 reply
->expires
= reply
->date
+ sctusable
->maxAge();
312 reply
->expires
= reply
->date
+ sctusable
->maxStale();
314 /* And update the timestamps */
315 entry
->timestampsSet();
318 /* We ignore cache-control directives as per the Surrogate specification */
319 ignoreCacheControl
= true;
327 HttpStateData::cacheableReply()
329 HttpReply
const *rep
= finalReply();
330 HttpHeader
const *hdr
= &rep
->header
;
332 #if USE_HTTP_VIOLATIONS
334 const RefreshPattern
*R
= NULL
;
336 /* This strange looking define first looks up the refresh pattern
337 * and then checks if the specified flag is set. The main purpose
338 * of this is to simplify the refresh pattern lookup and USE_HTTP_VIOLATIONS
341 #define REFRESH_OVERRIDE(flag) \
342 ((R = (R ? R : refreshLimits(entry->mem_obj->storeId()))) , \
343 (R && R->flags.flag))
345 #define REFRESH_OVERRIDE(flag) 0
348 if (EBIT_TEST(entry
->flags
, RELEASE_REQUEST
)) {
349 debugs(22, 3, "NO because " << *entry
<< " has been released.");
353 // Check for Surrogate/1.0 protocol conditions
354 // NP: reverse-proxy traffic our parent server has instructed us never to cache
355 if (surrogateNoStore
) {
356 debugs(22, 3, HERE
<< "NO because Surrogate-Control:no-store");
360 // RFC 2616: HTTP/1.1 Cache-Control conditions
361 if (!ignoreCacheControl
) {
362 // XXX: check to see if the request headers alone were enough to prevent caching earlier
363 // (ie no-store request header) no need to check those all again here if so.
364 // for now we are not reliably doing that so we waste CPU re-checking request CC
366 // RFC 2616 section 14.9.2 - MUST NOT cache any response with request CC:no-store
367 if (request
&& request
->cache_control
&& request
->cache_control
->noStore() &&
368 !REFRESH_OVERRIDE(ignore_no_store
)) {
369 debugs(22, 3, HERE
<< "NO because client request Cache-Control:no-store");
373 // NP: request CC:no-cache only means cache READ is forbidden. STORE is permitted.
374 if (rep
->cache_control
&& rep
->cache_control
->hasNoCache() && rep
->cache_control
->noCache().size() > 0) {
375 /* TODO: we are allowed to cache when no-cache= has parameters.
376 * Provided we strip away any of the listed headers unless they are revalidated
377 * successfully (ie, must revalidate AND these headers are prohibited on stale replies).
378 * That is a bit tricky for squid right now so we avoid caching entirely.
380 debugs(22, 3, HERE
<< "NO because server reply Cache-Control:no-cache has parameters");
384 // NP: request CC:private is undefined. We ignore.
385 // NP: other request CC flags are limiters on HIT/MISS. We don't care about here.
387 // RFC 2616 section 14.9.2 - MUST NOT cache any response with CC:no-store
388 if (rep
->cache_control
&& rep
->cache_control
->noStore() &&
389 !REFRESH_OVERRIDE(ignore_no_store
)) {
390 debugs(22, 3, HERE
<< "NO because server reply Cache-Control:no-store");
394 // RFC 2616 section 14.9.1 - MUST NOT cache any response with CC:private in a shared cache like Squid.
395 // CC:private overrides CC:public when both are present in a response.
396 // TODO: add a shared/private cache configuration possibility.
397 if (rep
->cache_control
&&
398 rep
->cache_control
->hasPrivate() &&
399 !REFRESH_OVERRIDE(ignore_private
)) {
400 /* TODO: we are allowed to cache when private= has parameters.
401 * Provided we strip away any of the listed headers unless they are revalidated
402 * successfully (ie, must revalidate AND these headers are prohibited on stale replies).
403 * That is a bit tricky for squid right now so we avoid caching entirely.
405 debugs(22, 3, HERE
<< "NO because server reply Cache-Control:private");
410 // RFC 2068, sec 14.9.4 - MUST NOT cache any response with Authentication UNLESS certain CC controls are present
411 // allow HTTP violations to IGNORE those controls (ie re-block caching Auth)
412 if (request
&& (request
->flags
.auth
|| request
->flags
.authSent
) && !REFRESH_OVERRIDE(ignore_auth
)) {
413 if (!rep
->cache_control
) {
414 debugs(22, 3, HERE
<< "NO because Authenticated and server reply missing Cache-Control");
418 if (ignoreCacheControl
) {
419 debugs(22, 3, HERE
<< "NO because Authenticated and ignoring Cache-Control");
423 bool mayStore
= false;
424 // HTTPbis pt6 section 3.2: a response CC:public is present
425 if (rep
->cache_control
->Public()) {
426 debugs(22, 3, HERE
<< "Authenticated but server reply Cache-Control:public");
429 // HTTPbis pt6 section 3.2: a response CC:must-revalidate is present
430 } else if (rep
->cache_control
->mustRevalidate() && !REFRESH_OVERRIDE(ignore_must_revalidate
)) {
431 debugs(22, 3, HERE
<< "Authenticated but server reply Cache-Control:public");
434 #if USE_HTTP_VIOLATIONS
435 // NP: given the must-revalidate exception we should also be able to exempt no-cache.
436 // HTTPbis WG verdict on this is that it is omitted from the spec due to being 'unexpected' by
437 // some. The caching+revalidate is not exactly unsafe though with Squids interpretation of no-cache
438 // (without parameters) as equivalent to must-revalidate in the reply.
439 } else if (rep
->cache_control
->hasNoCache() && rep
->cache_control
->noCache().size() == 0 && !REFRESH_OVERRIDE(ignore_must_revalidate
)) {
440 debugs(22, 3, HERE
<< "Authenticated but server reply Cache-Control:no-cache (equivalent to must-revalidate)");
444 // HTTPbis pt6 section 3.2: a response CC:s-maxage is present
445 } else if (rep
->cache_control
->sMaxAge()) {
446 debugs(22, 3, HERE
<< "Authenticated but server reply Cache-Control:s-maxage");
451 debugs(22, 3, HERE
<< "NO because Authenticated transaction");
455 // NP: response CC:no-cache is equivalent to CC:must-revalidate,max-age=0. We MAY cache, and do so.
456 // NP: other request CC flags are limiters on HIT/MISS/REFRESH. We don't care about here.
459 /* HACK: The "multipart/x-mixed-replace" content type is used for
460 * continuous push replies. These are generally dynamic and
461 * probably should not be cachable
463 if ((v
= hdr
->getStr(HDR_CONTENT_TYPE
)))
464 if (!strncasecmp(v
, "multipart/x-mixed-replace", 25)) {
465 debugs(22, 3, HERE
<< "NO because Content-Type:multipart/x-mixed-replace");
469 switch (rep
->sline
.status()) {
470 /* Responses that are cacheable */
474 case Http::scNonAuthoritativeInformation
:
476 case Http::scMultipleChoices
:
478 case Http::scMovedPermanently
:
479 case Http::scPermanentRedirect
:
483 * Don't cache objects that need to be refreshed on next request,
484 * unless we know how to refresh it.
487 if (!refreshIsCachable(entry
) && !REFRESH_OVERRIDE(store_stale
)) {
488 debugs(22, 3, "NO because refreshIsCachable() returned non-cacheable..");
491 debugs(22, 3, HERE
<< "YES because HTTP status " << rep
->sline
.status());
497 /* Responses that only are cacheable if the server says so */
500 case Http::scTemporaryRedirect
:
501 if (rep
->date
<= 0) {
502 debugs(22, 3, HERE
<< "NO because HTTP status " << rep
->sline
.status() << " and Date missing/invalid");
505 if (rep
->expires
> rep
->date
) {
506 debugs(22, 3, HERE
<< "YES because HTTP status " << rep
->sline
.status() << " and Expires > Date");
509 debugs(22, 3, HERE
<< "NO because HTTP status " << rep
->sline
.status() << " and Expires <= Date");
515 /* Errors can be negatively cached */
517 case Http::scNoContent
:
519 case Http::scUseProxy
:
521 case Http::scBadRequest
:
523 case Http::scForbidden
:
525 case Http::scNotFound
:
527 case Http::scMethodNotAllowed
:
529 case Http::scUriTooLong
:
531 case Http::scInternalServerError
:
533 case Http::scNotImplemented
:
535 case Http::scBadGateway
:
537 case Http::scServiceUnavailable
:
539 case Http::scGatewayTimeout
:
540 debugs(22, 3, "MAYBE because HTTP status " << rep
->sline
.status());
546 /* Some responses can never be cached */
548 case Http::scPartialContent
: /* Not yet supported */
550 case Http::scSeeOther
:
552 case Http::scNotModified
:
554 case Http::scUnauthorized
:
556 case Http::scProxyAuthenticationRequired
:
558 case Http::scInvalidHeader
: /* Squid header parsing error */
560 case Http::scHeaderTooLarge
:
562 case Http::scPaymentRequired
:
563 case Http::scNotAcceptable
:
564 case Http::scRequestTimeout
:
565 case Http::scConflict
:
566 case Http::scLengthRequired
:
567 case Http::scPreconditionFailed
:
568 case Http::scPayloadTooLarge
:
569 case Http::scUnsupportedMediaType
:
570 case Http::scUnprocessableEntity
:
572 case Http::scFailedDependency
:
573 case Http::scInsufficientStorage
:
574 case Http::scRequestedRangeNotSatisfied
:
575 case Http::scExpectationFailed
:
577 debugs(22, 3, HERE
<< "NO because HTTP status " << rep
->sline
.status());
581 /* RFC 2616 section 6.1.1: an unrecognized response MUST NOT be cached. */
582 debugs (11, 3, HERE
<< "NO because unknown HTTP status code " << rep
->sline
.status());
593 * For Vary, store the relevant request headers as
594 * virtual headers in the reply
595 * Returns false if the variance cannot be stored
598 httpMakeVaryMark(HttpRequest
* request
, HttpReply
const * reply
)
601 const char *pos
= NULL
;
608 vary
= reply
->header
.getList(HDR_VARY
);
610 while (strListGetItem(&vary
, ',', &item
, &ilen
, &pos
)) {
611 char *name
= (char *)xmalloc(ilen
+ 1);
612 xstrncpy(name
, item
, ilen
+ 1);
615 if (strcmp(name
, "*") == 0) {
616 /* Can not handle "Vary: *" withtout ETag support */
622 strListAdd(&vstr
, name
, ',');
623 hdr
= request
->header
.getByName(name
);
625 value
= hdr
.termedBuf();
628 value
= rfc1738_escape_part(value
);
629 vstr
.append("=\"", 2);
631 vstr
.append("\"", 1);
638 #if X_ACCELERATOR_VARY
641 vary
= reply
->header
.getList(HDR_X_ACCELERATOR_VARY
);
643 while (strListGetItem(&vary
, ',', &item
, &ilen
, &pos
)) {
644 char *name
= (char *)xmalloc(ilen
+ 1);
645 xstrncpy(name
, item
, ilen
+ 1);
647 strListAdd(&vstr
, name
, ',');
648 hdr
= request
->header
.getByName(name
);
650 value
= hdr
.termedBuf();
653 value
= rfc1738_escape_part(value
);
654 vstr
.append("=\"", 2);
656 vstr
.append("\"", 1);
665 debugs(11, 3, "httpMakeVaryMark: " << vstr
);
666 return vstr
.termedBuf();
670 HttpStateData::keepaliveAccounting(HttpReply
*reply
)
674 ++ _peer
->stats
.n_keepalives_sent
;
676 if (reply
->keep_alive
) {
678 ++ _peer
->stats
.n_keepalives_recv
;
680 if (Config
.onoff
.detect_broken_server_pconns
681 && reply
->bodySize(request
->method
) == -1 && !flags
.chunked
) {
682 debugs(11, DBG_IMPORTANT
, "keepaliveAccounting: Impossible keep-alive header from '" << entry
->url() << "'" );
683 // debugs(11, 2, "GOT HTTP REPLY HDR:\n---------\n" << readBuf->content() << "\n----------" );
684 flags
.keepalive_broken
= true;
690 HttpStateData::checkDateSkew(HttpReply
*reply
)
692 if (reply
->date
> -1 && !_peer
) {
693 int skew
= abs((int)(reply
->date
- squid_curtime
));
696 debugs(11, 3, "" << request
->GetHost() << "'s clock is skewed by " << skew
<< " seconds!");
701 * This creates the error page itself.. its likely
702 * that the forward ported reply header max size patch
703 * generates non http conformant error pages - in which
704 * case the errors where should be 'BAD_GATEWAY' etc
707 HttpStateData::processReplyHeader()
709 /** Creates a blank header. If this routine is made incremental, this will not do */
711 /* NP: all exit points to this function MUST call ctx_exit(ctx) */
712 Ctx ctx
= ctx_enter(entry
->mem_obj
->urlXXX());
714 debugs(11, 3, "processReplyHeader: key '" << entry
->getMD5Text() << "'");
716 assert(!flags
.headers_parsed
);
718 if (!readBuf
->hasContent()) {
723 Http::StatusCode error
= Http::scNone
;
725 HttpReply
*newrep
= new HttpReply
;
726 const bool parsed
= newrep
->parse(readBuf
, eof
, &error
);
728 if (!parsed
&& readBuf
->contentSize() > 5 && strncmp(readBuf
->content(), "HTTP/", 5) != 0 && strncmp(readBuf
->content(), "ICY", 3) != 0) {
730 HttpReply
*tmprep
= new HttpReply
;
731 tmprep
->setHeaders(Http::scOkay
, "Gatewaying", NULL
, -1, -1, -1);
732 tmprep
->header
.putExt("X-Transformed-From", "HTTP/0.9");
734 newrep
->parse(mb
, eof
, &error
);
738 if (!parsed
&& error
> 0) { // unrecoverable parsing error
739 debugs(11, 3, "processReplyHeader: Non-HTTP-compliant header: '" << readBuf
->content() << "'");
740 flags
.headers_parsed
= true;
741 // XXX: when sanityCheck is gone and Http::StatusLine is used to parse,
742 // the sline should be already set the appropriate values during that parser stage
743 newrep
->sline
.set(Http::ProtocolVersion(1,1), error
);
744 HttpReply
*vrep
= setVirginReply(newrep
);
745 entry
->replaceHttpReply(vrep
);
750 if (!parsed
) { // need more data
758 debugs(11, 2, "HTTP Server " << serverConnection
);
759 debugs(11, 2, "HTTP Server REPLY:\n---------\n" << readBuf
->content() << "\n----------");
761 header_bytes_read
= headersEnd(readBuf
->content(), readBuf
->contentSize());
762 readBuf
->consume(header_bytes_read
);
765 newrep
->removeStaleWarnings();
767 if (newrep
->sline
.protocol
== AnyP::PROTO_HTTP
&& newrep
->sline
.status() >= 100 && newrep
->sline
.status() < 200) {
773 flags
.chunked
= false;
774 if (newrep
->sline
.protocol
== AnyP::PROTO_HTTP
&& newrep
->header
.chunked()) {
775 flags
.chunked
= true;
776 httpChunkDecoder
= new ChunkedCodingParser
;
779 if (!peerSupportsConnectionPinning())
780 request
->flags
.connectionAuthDisabled
= true;
782 HttpReply
*vrep
= setVirginReply(newrep
);
783 flags
.headers_parsed
= true;
785 keepaliveAccounting(vrep
);
789 processSurrogateControl (vrep
);
791 request
->hier
.peer_reply_status
= newrep
->sline
.status();
796 /// ignore or start forwarding the 1xx response (a.k.a., control message)
798 HttpStateData::handle1xx(HttpReply
*reply
)
800 HttpReply::Pointer
msg(reply
); // will destroy reply if unused
802 // one 1xx at a time: we must not be called while waiting for previous 1xx
803 Must(!flags
.handling1xx
);
804 flags
.handling1xx
= true;
806 if (!request
->canHandle1xx()) {
807 debugs(11, 2, HERE
<< "ignoring client-unsupported 1xx");
812 #if USE_HTTP_VIOLATIONS
813 // check whether the 1xx response forwarding is allowed by squid.conf
814 if (Config
.accessList
.reply
) {
815 ACLFilledChecklist
ch(Config
.accessList
.reply
, originalRequest(), NULL
);
817 HTTPMSGLOCK(ch
.reply
);
818 if (ch
.fastCheck() != ACCESS_ALLOWED
) { // TODO: support slow lookups?
819 debugs(11, 3, HERE
<< "ignoring denied 1xx");
824 #endif // USE_HTTP_VIOLATIONS
826 debugs(11, 2, HERE
<< "forwarding 1xx to client");
828 // the Sink will use this to call us back after writing 1xx to the client
829 typedef NullaryMemFunT
<HttpStateData
> CbDialer
;
830 const AsyncCall::Pointer cb
= JobCallback(11, 3, CbDialer
, this,
831 HttpStateData::proceedAfter1xx
);
832 CallJobHere1(11, 4, request
->clientConnectionManager
, ConnStateData
,
833 ConnStateData::sendControlMsg
, HttpControlMsg(msg
, cb
));
834 // If the call is not fired, then the Sink is gone, and HttpStateData
835 // will terminate due to an aborted store entry or another similar error.
836 // If we get stuck, it is not handle1xx fault if we could get stuck
837 // for similar reasons without a 1xx response.
840 /// restores state and resumes processing after 1xx is ignored or forwarded
842 HttpStateData::proceedAfter1xx()
844 Must(flags
.handling1xx
);
846 debugs(11, 2, HERE
<< "consuming " << header_bytes_read
<<
847 " header and " << reply_bytes_read
<< " body bytes read after 1xx");
848 header_bytes_read
= 0;
849 reply_bytes_read
= 0;
851 CallJobHere(11, 3, this, HttpStateData
, HttpStateData::processReply
);
855 * returns true if the peer can support connection pinning
857 bool HttpStateData::peerSupportsConnectionPinning() const
859 const HttpReply
*rep
= entry
->mem_obj
->getReply();
860 const HttpHeader
*hdr
= &rep
->header
;
867 /*If this peer does not support connection pinning (authenticated
868 connections) return false
870 if (!_peer
->connection_auth
)
873 /*The peer supports connection pinning and the http reply status
874 is not unauthorized, so the related connection can be pinned
876 if (rep
->sline
.status() != Http::scUnauthorized
)
879 /*The server respond with Http::scUnauthorized and the peer configured
880 with "connection-auth=on" we know that the peer supports pinned
883 if (_peer
->connection_auth
== 1)
886 /*At this point peer has configured with "connection-auth=auto"
887 parameter so we need some extra checks to decide if we are going
888 to allow pinned connections or not
891 /*if the peer configured with originserver just allow connection
892 pinning (squid 2.6 behaviour)
894 if (_peer
->options
.originserver
)
897 /*if the connections it is already pinned it is OK*/
898 if (request
->flags
.pinned
)
901 /*Allow pinned connections only if the Proxy-support header exists in
902 reply and has in its list the "Session-Based-Authentication"
903 which means that the peer supports connection pinning.
905 if (!hdr
->has(HDR_PROXY_SUPPORT
))
908 header
= hdr
->getStrOrList(HDR_PROXY_SUPPORT
);
909 /* XXX This ought to be done in a case-insensitive manner */
910 rc
= (strstr(header
.termedBuf(), "Session-Based-Authentication") != NULL
);
915 // Called when we parsed (and possibly adapted) the headers but
916 // had not starting storing (a.k.a., sending) the body yet.
918 HttpStateData::haveParsedReplyHeaders()
920 ServerStateData::haveParsedReplyHeaders();
922 Ctx ctx
= ctx_enter(entry
->mem_obj
->urlXXX());
923 HttpReply
*rep
= finalReply();
925 entry
->timestampsSet();
927 /* Check if object is cacheable or not based on reply code */
928 debugs(11, 3, "HTTP CODE: " << rep
->sline
.status());
930 if (neighbors_do_private_keys
)
931 httpMaybeRemovePublic(entry
, rep
->sline
.status());
933 if (rep
->header
.has(HDR_VARY
)
934 #if X_ACCELERATOR_VARY
935 || rep
->header
.has(HDR_X_ACCELERATOR_VARY
)
938 const char *vary
= httpMakeVaryMark(request
, rep
);
941 entry
->makePrivate();
942 if (!fwd
->reforwardableStatus(rep
->sline
.status()))
943 EBIT_CLR(entry
->flags
, ENTRY_FWD_HDR_WAIT
);
947 entry
->mem_obj
->vary_headers
= xstrdup(vary
);
951 * If its not a reply that we will re-forward, then
952 * allow the client to get it.
954 if (!fwd
->reforwardableStatus(rep
->sline
.status()))
955 EBIT_CLR(entry
->flags
, ENTRY_FWD_HDR_WAIT
);
957 switch (cacheableReply()) {
964 entry
->makePrivate();
969 #if USE_HTTP_VIOLATIONS
970 if (Config
.negativeTtl
> 0)
971 entry
->cacheNegatively();
974 entry
->makePrivate();
986 if (!ignoreCacheControl
) {
987 if (rep
->cache_control
) {
988 // We are required to revalidate on many conditions.
989 // For security reasons we do so even if storage was caused by refresh_pattern ignore-* option
991 // CC:must-revalidate or CC:proxy-revalidate
992 const bool ccMustRevalidate
= (rep
->cache_control
->proxyRevalidate() || rep
->cache_control
->mustRevalidate());
994 // CC:no-cache (only if there are no parameters)
995 const bool ccNoCacheNoParams
= (rep
->cache_control
->hasNoCache() && rep
->cache_control
->noCache().size()==0);
998 const bool ccSMaxAge
= rep
->cache_control
->hasSMaxAge();
1000 // CC:private (yes, these can sometimes be stored)
1001 const bool ccPrivate
= rep
->cache_control
->hasPrivate();
1003 if (ccMustRevalidate
|| ccNoCacheNoParams
|| ccSMaxAge
|| ccPrivate
)
1004 EBIT_SET(entry
->flags
, ENTRY_REVALIDATE
);
1006 #if USE_HTTP_VIOLATIONS // response header Pragma::no-cache is undefined in HTTP
1008 // Expensive calculation. So only do it IF the CC: header is not present.
1010 /* HACK: Pragma: no-cache in _replies_ is not documented in HTTP,
1011 * but servers like "Active Imaging Webcast/2.0" sure do use it */
1012 if (rep
->header
.has(HDR_PRAGMA
) &&
1013 rep
->header
.hasListMember(HDR_PRAGMA
,"no-cache",','))
1014 EBIT_SET(entry
->flags
, ENTRY_REVALIDATE
);
1020 headersLog(1, 0, request
->method
, rep
);
1027 HttpStateData::ConnectionStatus
1028 HttpStateData::statusIfComplete() const
1030 const HttpReply
*rep
= virginReply();
1032 * If the reply wants to close the connection, it takes precedence */
1034 if (httpHeaderHasConnDir(&rep
->header
, "close"))
1035 return COMPLETE_NONPERSISTENT_MSG
;
1038 * If we didn't send a keep-alive request header, then this
1039 * can not be a persistent connection.
1041 if (!flags
.keepalive
)
1042 return COMPLETE_NONPERSISTENT_MSG
;
1045 * If we haven't sent the whole request then this can not be a persistent
1048 if (!flags
.request_sent
) {
1049 debugs(11, 2, "Request not yet fully sent " << request
->method
<< ' ' << entry
->url());
1050 return COMPLETE_NONPERSISTENT_MSG
;
1054 * What does the reply have to say about keep-alive?
1058 * If the origin server (HTTP/1.0) does not send a keep-alive
1059 * header, but keeps the connection open anyway, what happens?
1060 * We'll return here and http.c waits for an EOF before changing
1061 * store_status to STORE_OK. Combine this with ENTRY_FWD_HDR_WAIT
1062 * and an error status code, and we might have to wait until
1063 * the server times out the socket.
1065 if (!rep
->keep_alive
)
1066 return COMPLETE_NONPERSISTENT_MSG
;
1068 return COMPLETE_PERSISTENT_MSG
;
1071 HttpStateData::ConnectionStatus
1072 HttpStateData::persistentConnStatus() const
1074 debugs(11, 3, HERE
<< serverConnection
<< " eof=" << eof
);
1075 if (eof
) // already reached EOF
1076 return COMPLETE_NONPERSISTENT_MSG
;
1078 /* If server fd is closing (but we have not been notified yet), stop Comm
1079 I/O to avoid assertions. TODO: Change Comm API to handle callers that
1080 want more I/O after async closing (usually initiated by others). */
1081 // XXX: add canReceive or s/canSend/canTalkToServer/
1082 if (!Comm::IsConnOpen(serverConnection
))
1083 return COMPLETE_NONPERSISTENT_MSG
;
1086 * In chunked response we do not know the content length but we are absolutely
1087 * sure about the end of response, so we are calling the statusIfComplete to
1088 * decide if we can be persistant
1090 if (lastChunk
&& flags
.chunked
)
1091 return statusIfComplete();
1093 const HttpReply
*vrep
= virginReply();
1094 debugs(11, 5, "persistentConnStatus: content_length=" << vrep
->content_length
);
1096 const int64_t clen
= vrep
->bodySize(request
->method
);
1098 debugs(11, 5, "persistentConnStatus: clen=" << clen
);
1100 /* If the body size is unknown we must wait for EOF */
1102 return INCOMPLETE_MSG
;
1105 * If the body size is known, we must wait until we've gotten all of it. */
1108 // if (entry->mem_obj->endOffset() < vrep->content_length + vrep->hdr_sz)
1109 const int64_t body_bytes_read
= reply_bytes_read
- header_bytes_read
;
1110 debugs(11,5, "persistentConnStatus: body_bytes_read=" <<
1111 body_bytes_read
<< " content_length=" << vrep
->content_length
);
1113 if (body_bytes_read
< vrep
->content_length
)
1114 return INCOMPLETE_MSG
;
1116 if (body_bytes_truncated
> 0) // already read more than needed
1117 return COMPLETE_NONPERSISTENT_MSG
; // disable pconns
1121 * If there is no message body or we got it all, we can be persistent */
1122 return statusIfComplete();
1126 * This is the callback after some data has been read from the network
1130 HttpStateData::ReadReplyWrapper(int fd, char *buf, size_t len, Comm::Flag flag, int xerrno, void *data)
1132 HttpStateData *httpState = static_cast<HttpStateData *>(data);
1133 assert (fd == httpState->serverConnection->fd);
1134 // assert(buf == readBuf->content());
1135 PROF_start(HttpStateData_readReply);
1136 httpState->readReply(len, flag, xerrno);
1137 PROF_stop(HttpStateData_readReply);
1141 /* XXX this function is too long! */
1143 HttpStateData::readReply(const CommIoCbParams
&io
)
1149 flags
.do_next_read
= false;
1151 debugs(11, 5, HERE
<< io
.conn
<< ": len " << len
<< ".");
1153 // Bail out early on Comm::ERR_CLOSING - close handlers will tidy up for us
1154 if (io
.flag
== Comm::ERR_CLOSING
) {
1155 debugs(11, 3, "http socket closing");
1159 if (EBIT_TEST(entry
->flags
, ENTRY_ABORTED
)) {
1160 abortTransaction("store entry aborted while reading reply");
1164 // handle I/O errors
1165 if (io
.flag
!= Comm::OK
|| len
< 0) {
1166 debugs(11, 2, HERE
<< io
.conn
<< ": read failure: " << xstrerror() << ".");
1168 if (ignoreErrno(io
.xerrno
)) {
1169 flags
.do_next_read
= true;
1171 ErrorState
*err
= new ErrorState(ERR_READ_ERROR
, Http::scBadGateway
, fwd
->request
);
1172 err
->xerrno
= io
.xerrno
;
1174 flags
.do_next_read
= false;
1175 serverConnection
->close();
1183 readBuf
->appended(len
);
1184 reply_bytes_read
+= len
;
1186 DelayId delayId
= entry
->mem_obj
->mostBytesAllowed();
1187 delayId
.bytesIn(len
);
1190 kb_incr(&(statCounter
.server
.all
.kbytes_in
), len
);
1191 kb_incr(&(statCounter
.server
.http
.kbytes_in
), len
);
1192 ++ IOStats
.Http
.reads
;
1194 for (clen
= len
- 1, bin
= 0; clen
; ++bin
)
1197 ++ IOStats
.Http
.read_hist
[bin
];
1199 // update peer response time stats (%<pt)
1200 const timeval
&sent
= request
->hier
.peer_http_request_sent
;
1201 request
->hier
.peer_response_time
=
1202 sent
.tv_sec
? tvSubMsec(sent
, current_time
) : -1;
1206 * Here the RFC says we should ignore whitespace between replies, but we can't as
1207 * doing so breaks HTTP/0.9 replies beginning with witespace, and in addition
1208 * the response splitting countermeasures is extremely likely to trigger on this,
1209 * not allowing connection reuse in the first place.
1211 * 2012-02-10: which RFC? not 2068 or 2616,
1212 * tolerance there is all about whitespace between requests and header tokens.
1215 if (len
== 0) { // reached EOF?
1217 flags
.do_next_read
= false;
1219 /* Bug 2879: Replies may terminate with \r\n then EOF instead of \r\n\r\n
1220 * Ensure here that we have at minimum two \r\n when EOF is seen.
1221 * TODO: Add eof parameter to headersEnd() and move this hack there.
1223 if (readBuf
->contentSize() && !flags
.headers_parsed
) {
1225 * Yes Henrik, there is a point to doing this. When we
1226 * called httpProcessReplyHeader() before, we didn't find
1227 * the end of headers, but now we are definately at EOF, so
1228 * we want to process the reply headers.
1230 /* Fake an "end-of-headers" to work around such broken servers */
1231 readBuf
->append("\r\n", 2);
1238 /// processes the already read and buffered response data, possibly after
1239 /// waiting for asynchronous 1xx control message processing
1241 HttpStateData::processReply()
1244 if (flags
.handling1xx
) { // we came back after handling a 1xx response
1245 debugs(11, 5, HERE
<< "done with 1xx handling");
1246 flags
.handling1xx
= false;
1247 Must(!flags
.headers_parsed
);
1250 if (!flags
.headers_parsed
) { // have not parsed headers yet?
1251 PROF_start(HttpStateData_processReplyHeader
);
1252 processReplyHeader();
1253 PROF_stop(HttpStateData_processReplyHeader
);
1255 if (!continueAfterParsingHeader()) // parsing error or need more data
1256 return; // TODO: send errors to ICAP
1258 adaptOrFinalizeReply(); // may write to, abort, or "close" the entry
1261 // kick more reads if needed and/or process the response body, if any
1262 PROF_start(HttpStateData_processReplyBody
);
1263 processReplyBody(); // may call serverComplete()
1264 PROF_stop(HttpStateData_processReplyBody
);
1268 \retval true if we can continue with processing the body or doing ICAP.
1271 HttpStateData::continueAfterParsingHeader()
1273 if (flags
.handling1xx
) {
1274 debugs(11, 5, HERE
<< "wait for 1xx handling");
1275 Must(!flags
.headers_parsed
);
1279 if (!flags
.headers_parsed
&& !eof
) {
1280 debugs(11, 9, HERE
<< "needs more at " << readBuf
->contentSize());
1281 flags
.do_next_read
= true;
1282 /** \retval false If we have not finished parsing the headers and may get more data.
1283 * Schedules more reads to retrieve the missing data.
1285 maybeReadVirginBody(); // schedules all kinds of reads; TODO: rename
1289 /** If we are done with parsing, check for errors */
1291 err_type error
= ERR_NONE
;
1293 if (flags
.headers_parsed
) { // parsed headers, possibly with errors
1294 // check for header parsing errors
1295 if (HttpReply
*vrep
= virginReply()) {
1296 const Http::StatusCode s
= vrep
->sline
.status();
1297 const Http::ProtocolVersion
&v
= vrep
->sline
.version
;
1298 if (s
== Http::scInvalidHeader
&& v
!= Http::ProtocolVersion(0,9)) {
1299 debugs(11, DBG_IMPORTANT
, "WARNING: HTTP: Invalid Response: Bad header encountered from " << entry
->url() << " AKA " << request
->GetHost() << request
->urlpath
.termedBuf() );
1300 error
= ERR_INVALID_RESP
;
1301 } else if (s
== Http::scHeaderTooLarge
) {
1302 fwd
->dontRetry(true);
1303 error
= ERR_TOO_BIG
;
1305 return true; // done parsing, got reply, and no error
1308 // parsed headers but got no reply
1309 debugs(11, DBG_IMPORTANT
, "WARNING: HTTP: Invalid Response: No reply at all for " << entry
->url() << " AKA " << request
->GetHost() << request
->urlpath
.termedBuf() );
1310 error
= ERR_INVALID_RESP
;
1314 if (readBuf
->hasContent()) {
1315 error
= ERR_INVALID_RESP
;
1316 debugs(11, DBG_IMPORTANT
, "WARNING: HTTP: Invalid Response: Headers did not parse at all for " << entry
->url() << " AKA " << request
->GetHost() << request
->urlpath
.termedBuf() );
1318 error
= ERR_ZERO_SIZE_OBJECT
;
1319 debugs(11, (request
->flags
.accelerated
?DBG_IMPORTANT
:2), "WARNING: HTTP: Invalid Response: No object data received for " <<
1320 entry
->url() << " AKA " << request
->GetHost() << request
->urlpath
.termedBuf() );
1324 assert(error
!= ERR_NONE
);
1326 fwd
->fail(new ErrorState(error
, Http::scBadGateway
, fwd
->request
));
1327 flags
.do_next_read
= false;
1328 serverConnection
->close();
1329 return false; // quit on error
1332 /** truncate what we read if we read too much so that writeReplyBody()
1333 writes no more than what we should have read */
1335 HttpStateData::truncateVirginBody()
1337 assert(flags
.headers_parsed
);
1339 HttpReply
*vrep
= virginReply();
1341 if (!vrep
->expectingBody(request
->method
, clen
) || clen
< 0)
1342 return; // no body or a body of unknown size, including chunked
1344 const int64_t body_bytes_read
= reply_bytes_read
- header_bytes_read
;
1345 if (body_bytes_read
- body_bytes_truncated
<= clen
)
1346 return; // we did not read too much or already took care of the extras
1348 if (const int64_t extras
= body_bytes_read
- body_bytes_truncated
- clen
) {
1349 // server sent more that the advertised content length
1350 debugs(11,5, HERE
<< "body_bytes_read=" << body_bytes_read
<<
1351 " clen=" << clen
<< '/' << vrep
->content_length
<<
1352 " body_bytes_truncated=" << body_bytes_truncated
<< '+' << extras
);
1354 readBuf
->truncate(extras
);
1355 body_bytes_truncated
+= extras
;
1360 * Call this when there is data from the origin server
1361 * which should be sent to either StoreEntry, or to ICAP...
1364 HttpStateData::writeReplyBody()
1366 truncateVirginBody(); // if needed
1367 const char *data
= readBuf
->content();
1368 int len
= readBuf
->contentSize();
1369 addVirginReplyBody(data
, len
);
1370 readBuf
->consume(len
);
1374 HttpStateData::decodeAndWriteReplyBody()
1376 const char *data
= NULL
;
1378 bool wasThereAnException
= false;
1379 assert(flags
.chunked
);
1380 assert(httpChunkDecoder
);
1381 SQUID_ENTER_THROWING_CODE();
1384 const bool doneParsing
= httpChunkDecoder
->parse(readBuf
,&decodedData
);
1385 len
= decodedData
.contentSize();
1386 data
=decodedData
.content();
1387 addVirginReplyBody(data
, len
);
1390 flags
.do_next_read
= false;
1392 SQUID_EXIT_THROWING_CODE(wasThereAnException
);
1393 return wasThereAnException
;
1397 * processReplyBody has two purposes:
1398 * 1 - take the reply body data, if any, and put it into either
1399 * the StoreEntry, or give it over to ICAP.
1400 * 2 - see if we made it to the end of the response (persistent
1401 * connections and such)
1404 HttpStateData::processReplyBody()
1406 Ip::Address client_addr
;
1407 bool ispinned
= false;
1409 if (!flags
.headers_parsed
) {
1410 flags
.do_next_read
= true;
1411 maybeReadVirginBody();
1416 debugs(11,5, HERE
<< "adaptationAccessCheckPending=" << adaptationAccessCheckPending
);
1417 if (adaptationAccessCheckPending
)
1423 * At this point the reply headers have been parsed and consumed.
1424 * That means header content has been removed from readBuf and
1425 * it contains only body data.
1427 if (entry
->isAccepting()) {
1428 if (flags
.chunked
) {
1429 if (!decodeAndWriteReplyBody()) {
1430 flags
.do_next_read
= false;
1438 if (EBIT_TEST(entry
->flags
, ENTRY_ABORTED
)) {
1439 // The above writeReplyBody() call may have aborted the store entry.
1440 abortTransaction("store entry aborted while storing reply");
1443 switch (persistentConnStatus()) {
1444 case INCOMPLETE_MSG
: {
1445 debugs(11, 5, "processReplyBody: INCOMPLETE_MSG from " << serverConnection
);
1446 /* Wait for more data or EOF condition */
1447 AsyncCall::Pointer nil
;
1448 if (flags
.keepalive_broken
) {
1449 commSetConnTimeout(serverConnection
, 10, nil
);
1451 commSetConnTimeout(serverConnection
, Config
.Timeout
.read
, nil
);
1454 flags
.do_next_read
= true;
1458 case COMPLETE_PERSISTENT_MSG
:
1459 debugs(11, 5, "processReplyBody: COMPLETE_PERSISTENT_MSG from " << serverConnection
);
1460 /* yes we have to clear all these! */
1461 commUnsetConnTimeout(serverConnection
);
1462 flags
.do_next_read
= false;
1464 comm_remove_close_handler(serverConnection
->fd
, closeHandler
);
1465 closeHandler
= NULL
;
1466 fwd
->unregister(serverConnection
);
1468 if (request
->flags
.spoofClientIp
)
1469 client_addr
= request
->client_addr
;
1471 if (request
->flags
.pinned
) {
1473 } else if (request
->flags
.connectionAuth
&& request
->flags
.authSent
) {
1477 if (ispinned
&& request
->clientConnectionManager
.valid()) {
1478 request
->clientConnectionManager
->pinConnection(serverConnection
, request
, _peer
,
1479 (request
->flags
.connectionAuth
));
1481 fwd
->pconnPush(serverConnection
, request
->GetHost());
1484 serverConnection
= NULL
;
1488 case COMPLETE_NONPERSISTENT_MSG
:
1489 debugs(11, 5, "processReplyBody: COMPLETE_NONPERSISTENT_MSG from " << serverConnection
);
1494 maybeReadVirginBody();
1498 HttpStateData::mayReadVirginReplyBody() const
1500 // TODO: Be more precise here. For example, if/when reading trailer, we may
1501 // not be doneWithServer() yet, but we should return false. Similarly, we
1502 // could still be writing the request body after receiving the whole reply.
1503 return !doneWithServer();
1507 HttpStateData::maybeReadVirginBody()
1510 if (!Comm::IsConnOpen(serverConnection
) || fd_table
[serverConnection
->fd
].closing())
1513 // we may need to grow the buffer if headers do not fit
1514 const int minRead
= flags
.headers_parsed
? 0 :1024;
1515 const int read_size
= replyBodySpace(*readBuf
, minRead
);
1517 debugs(11,9, HERE
<< (flags
.do_next_read
? "may" : "wont") <<
1518 " read up to " << read_size
<< " bytes from " << serverConnection
);
1521 * why <2? Because delayAwareRead() won't actually read if
1522 * you ask it to read 1 byte. The delayed read request
1523 * just gets re-queued until the client side drains, then
1524 * the I/O thread hangs. Better to not register any read
1525 * handler until we get a notification from someone that
1526 * its okay to read again.
1531 if (flags
.do_next_read
) {
1532 flags
.do_next_read
= false;
1533 typedef CommCbMemFunT
<HttpStateData
, CommIoCbParams
> Dialer
;
1534 entry
->delayAwareRead(serverConnection
, readBuf
->space(read_size
), read_size
,
1535 JobCallback(11, 5, Dialer
, this, HttpStateData::readReply
));
1539 /// called after writing the very last request byte (body, last-chunk, etc)
1541 HttpStateData::wroteLast(const CommIoCbParams
&io
)
1543 debugs(11, 5, HERE
<< serverConnection
<< ": size " << io
.size
<< ": errflag " << io
.flag
<< ".");
1544 #if URL_CHECKSUM_DEBUG
1546 entry
->mem_obj
->checkUrlChecksum();
1550 fd_bytes(io
.fd
, io
.size
, FD_WRITE
);
1551 kb_incr(&(statCounter
.server
.all
.kbytes_out
), io
.size
);
1552 kb_incr(&(statCounter
.server
.http
.kbytes_out
), io
.size
);
1555 if (io
.flag
== Comm::ERR_CLOSING
)
1559 ErrorState
*err
= new ErrorState(ERR_WRITE_ERROR
, Http::scBadGateway
, fwd
->request
);
1560 err
->xerrno
= io
.xerrno
;
1562 serverConnection
->close();
1569 /// successfully wrote the entire request (including body, last-chunk, etc.)
1571 HttpStateData::sendComplete()
1574 * Set the read timeout here because it hasn't been set yet.
1575 * We only set the read timeout after the request has been
1576 * fully written to the server-side. If we start the timeout
1577 * after connection establishment, then we are likely to hit
1578 * the timeout for POST/PUT requests that have very large
1581 typedef CommCbMemFunT
<HttpStateData
, CommTimeoutCbParams
> TimeoutDialer
;
1582 AsyncCall::Pointer timeoutCall
= JobCallback(11, 5,
1583 TimeoutDialer
, this, HttpStateData::httpTimeout
);
1585 commSetConnTimeout(serverConnection
, Config
.Timeout
.read
, timeoutCall
);
1586 flags
.request_sent
= true;
1587 request
->hier
.peer_http_request_sent
= current_time
;
1590 // Close the HTTP server connection. Used by serverComplete().
1592 HttpStateData::closeServer()
1594 debugs(11,5, HERE
<< "closing HTTP server " << serverConnection
<< " this " << this);
1596 if (Comm::IsConnOpen(serverConnection
)) {
1597 fwd
->unregister(serverConnection
);
1598 comm_remove_close_handler(serverConnection
->fd
, closeHandler
);
1599 closeHandler
= NULL
;
1600 serverConnection
->close();
1605 HttpStateData::doneWithServer() const
1607 return !Comm::IsConnOpen(serverConnection
);
1611 * Fixup authentication request headers for special cases
1614 httpFixupAuthentication(HttpRequest
* request
, const HttpHeader
* hdr_in
, HttpHeader
* hdr_out
, const HttpStateFlags
&flags
)
1616 http_hdr_type header
= flags
.originpeer
? HDR_AUTHORIZATION
: HDR_PROXY_AUTHORIZATION
;
1618 /* Nothing to do unless we are forwarding to a peer */
1619 if (!request
->flags
.proxying
)
1622 /* Needs to be explicitly enabled */
1623 if (!request
->peer_login
)
1626 /* Maybe already dealt with? */
1627 if (hdr_out
->has(header
))
1630 /* Nothing to do here for PASSTHRU */
1631 if (strcmp(request
->peer_login
, "PASSTHRU") == 0)
1634 /* PROXYPASS is a special case, single-signon to servers with the proxy password (basic only) */
1635 if (flags
.originpeer
&& strcmp(request
->peer_login
, "PROXYPASS") == 0 && hdr_in
->has(HDR_PROXY_AUTHORIZATION
)) {
1636 const char *auth
= hdr_in
->getStr(HDR_PROXY_AUTHORIZATION
);
1638 if (auth
&& strncasecmp(auth
, "basic ", 6) == 0) {
1639 hdr_out
->putStr(header
, auth
);
1644 /* Special mode to pass the username to the upstream cache */
1645 if (*request
->peer_login
== '*') {
1647 const char *username
= "-";
1649 if (request
->extacl_user
.size())
1650 username
= request
->extacl_user
.termedBuf();
1652 else if (request
->auth_user_request
!= NULL
)
1653 username
= request
->auth_user_request
->username();
1656 snprintf(loginbuf
, sizeof(loginbuf
), "%s%s", username
, request
->peer_login
+ 1);
1658 httpHeaderPutStrf(hdr_out
, header
, "Basic %s",
1659 old_base64_encode(loginbuf
));
1663 /* external_acl provided credentials */
1664 if (request
->extacl_user
.size() && request
->extacl_passwd
.size() &&
1665 (strcmp(request
->peer_login
, "PASS") == 0 ||
1666 strcmp(request
->peer_login
, "PROXYPASS") == 0)) {
1668 snprintf(loginbuf
, sizeof(loginbuf
), SQUIDSTRINGPH
":" SQUIDSTRINGPH
,
1669 SQUIDSTRINGPRINT(request
->extacl_user
),
1670 SQUIDSTRINGPRINT(request
->extacl_passwd
));
1671 httpHeaderPutStrf(hdr_out
, header
, "Basic %s",
1672 old_base64_encode(loginbuf
));
1675 // if no external user credentials are available to fake authentication with PASS acts like PASSTHRU
1676 if (strcmp(request
->peer_login
, "PASS") == 0)
1679 /* Kerberos login to peer */
1680 #if HAVE_AUTH_MODULE_NEGOTIATE && HAVE_KRB5 && HAVE_GSSAPI
1681 if (strncmp(request
->peer_login
, "NEGOTIATE",strlen("NEGOTIATE")) == 0) {
1683 char *PrincipalName
=NULL
,*p
;
1684 if ((p
=strchr(request
->peer_login
,':')) != NULL
) {
1687 Token
= peer_proxy_negotiate_auth(PrincipalName
, request
->peer_host
);
1689 httpHeaderPutStrf(hdr_out
, header
, "Negotiate %s",Token
);
1693 #endif /* HAVE_KRB5 && HAVE_GSSAPI */
1695 httpHeaderPutStrf(hdr_out
, header
, "Basic %s",
1696 old_base64_encode(request
->peer_login
));
1701 * build request headers and append them to a given MemBuf
1702 * used by buildRequestPrefix()
1703 * note: initialised the HttpHeader, the caller is responsible for Clean()-ing
1706 HttpStateData::httpBuildRequestHeader(HttpRequest
* request
,
1708 const AccessLogEntryPointer
&al
,
1709 HttpHeader
* hdr_out
,
1710 const HttpStateFlags
&flags
)
1712 /* building buffer for complex strings */
1713 #define BBUF_SZ (MAX_URL+32)
1714 LOCAL_ARRAY(char, bbuf
, BBUF_SZ
);
1715 LOCAL_ARRAY(char, ntoabuf
, MAX_IPSTRLEN
);
1716 const HttpHeader
*hdr_in
= &request
->header
;
1717 const HttpHeaderEntry
*e
= NULL
;
1718 HttpHeaderPos pos
= HttpHeaderInitPos
;
1719 assert (hdr_out
->owner
== hoRequest
);
1721 /* use our IMS header if the cached entry has Last-Modified time */
1722 if (request
->lastmod
> -1)
1723 hdr_out
->putTime(HDR_IF_MODIFIED_SINCE
, request
->lastmod
);
1725 // Add our own If-None-Match field if the cached entry has a strong ETag.
1726 // copyOneHeaderFromClientsideRequestToUpstreamRequest() adds client ones.
1727 if (request
->etag
.size() > 0) {
1728 hdr_out
->addEntry(new HttpHeaderEntry(HDR_IF_NONE_MATCH
, NULL
,
1729 request
->etag
.termedBuf()));
1732 bool we_do_ranges
= decideIfWeDoRanges (request
);
1734 String
strConnection (hdr_in
->getList(HDR_CONNECTION
));
1736 while ((e
= hdr_in
->getEntry(&pos
)))
1737 copyOneHeaderFromClientsideRequestToUpstreamRequest(e
, strConnection
, request
, hdr_out
, we_do_ranges
, flags
);
1739 /* Abstraction break: We should interpret multipart/byterange responses
1740 * into offset-length data, and this works around our inability to do so.
1742 if (!we_do_ranges
&& request
->multipartRangeRequest()) {
1743 /* don't cache the result */
1744 request
->flags
.cachable
= false;
1745 /* pretend it's not a range request */
1746 request
->ignoreRange("want to request the whole object");
1747 request
->flags
.isRanged
= false;
1751 if (Config
.onoff
.via
) {
1753 strVia
= hdr_in
->getList(HDR_VIA
);
1754 snprintf(bbuf
, BBUF_SZ
, "%d.%d %s",
1755 request
->http_ver
.major
,
1756 request
->http_ver
.minor
, ThisCache
);
1757 strListAdd(&strVia
, bbuf
, ',');
1758 hdr_out
->putStr(HDR_VIA
, strVia
.termedBuf());
1762 if (request
->flags
.accelerated
) {
1763 /* Append Surrogate-Capabilities */
1764 String
strSurrogate(hdr_in
->getList(HDR_SURROGATE_CAPABILITY
));
1766 snprintf(bbuf
, BBUF_SZ
, "%s=\"Surrogate/1.0 ESI/1.0\"", Config
.Accel
.surrogate_id
);
1768 snprintf(bbuf
, BBUF_SZ
, "%s=\"Surrogate/1.0\"", Config
.Accel
.surrogate_id
);
1770 strListAdd(&strSurrogate
, bbuf
, ',');
1771 hdr_out
->putStr(HDR_SURROGATE_CAPABILITY
, strSurrogate
.termedBuf());
1774 /** \pre Handle X-Forwarded-For */
1775 if (strcmp(opt_forwarded_for
, "delete") != 0) {
1777 String strFwd
= hdr_in
->getList(HDR_X_FORWARDED_FOR
);
1779 if (strFwd
.size() > 65536/2) {
1780 // There is probably a forwarding loop with Via detection disabled.
1781 // If we do nothing, String will assert on overflow soon.
1782 // TODO: Terminate all transactions with huge XFF?
1785 static int warnedCount
= 0;
1786 if (warnedCount
++ < 100) {
1787 const char *url
= entry
? entry
->url() : urlCanonical(request
);
1788 debugs(11, DBG_IMPORTANT
, "Warning: likely forwarding loop with " << url
);
1792 if (strcmp(opt_forwarded_for
, "on") == 0) {
1793 /** If set to ON - append client IP or 'unknown'. */
1794 if ( request
->client_addr
.isNoAddr() )
1795 strListAdd(&strFwd
, "unknown", ',');
1797 strListAdd(&strFwd
, request
->client_addr
.toStr(ntoabuf
, MAX_IPSTRLEN
), ',');
1798 } else if (strcmp(opt_forwarded_for
, "off") == 0) {
1799 /** If set to OFF - append 'unknown'. */
1800 strListAdd(&strFwd
, "unknown", ',');
1801 } else if (strcmp(opt_forwarded_for
, "transparent") == 0) {
1802 /** If set to TRANSPARENT - pass through unchanged. */
1803 } else if (strcmp(opt_forwarded_for
, "truncate") == 0) {
1804 /** If set to TRUNCATE - drop existing list and replace with client IP or 'unknown'. */
1805 if ( request
->client_addr
.isNoAddr() )
1808 strFwd
= request
->client_addr
.toStr(ntoabuf
, MAX_IPSTRLEN
);
1810 if (strFwd
.size() > 0)
1811 hdr_out
->putStr(HDR_X_FORWARDED_FOR
, strFwd
.termedBuf());
1813 /** If set to DELETE - do not copy through. */
1815 /* append Host if not there already */
1816 if (!hdr_out
->has(HDR_HOST
)) {
1817 if (request
->peer_domain
) {
1818 hdr_out
->putStr(HDR_HOST
, request
->peer_domain
);
1819 } else if (request
->port
== urlDefaultPort(request
->url
.getScheme())) {
1820 /* use port# only if not default */
1821 hdr_out
->putStr(HDR_HOST
, request
->GetHost());
1823 httpHeaderPutStrf(hdr_out
, HDR_HOST
, "%s:%d",
1825 (int) request
->port
);
1829 /* append Authorization if known in URL, not in header and going direct */
1830 if (!hdr_out
->has(HDR_AUTHORIZATION
)) {
1831 if (!request
->flags
.proxying
&& request
->login
[0] != '\0') {
1832 httpHeaderPutStrf(hdr_out
, HDR_AUTHORIZATION
, "Basic %s",
1833 old_base64_encode(request
->login
));
1837 /* Fixup (Proxy-)Authorization special cases. Plain relaying dealt with above */
1838 httpFixupAuthentication(request
, hdr_in
, hdr_out
, flags
);
1840 /* append Cache-Control, add max-age if not there already */
1842 HttpHdrCc
*cc
= hdr_in
->getCc();
1845 cc
= new HttpHdrCc();
1847 #if 0 /* see bug 2330 */
1848 /* Set no-cache if determined needed but not found */
1849 if (request
->flags
.nocache
)
1850 EBIT_SET(cc
->mask
, CC_NO_CACHE
);
1853 /* Add max-age only without no-cache */
1854 if (!cc
->hasMaxAge() && !cc
->hasNoCache()) {
1856 entry
? entry
->url() : urlCanonical(request
);
1857 cc
->maxAge(getMaxAge(url
));
1861 /* Enforce sibling relations */
1862 if (flags
.only_if_cached
)
1863 cc
->onlyIfCached(true);
1870 /* maybe append Connection: keep-alive */
1871 if (flags
.keepalive
) {
1872 hdr_out
->putStr(HDR_CONNECTION
, "keep-alive");
1875 /* append Front-End-Https */
1876 if (flags
.front_end_https
) {
1877 if (flags
.front_end_https
== 1 || request
->url
.getScheme() == AnyP::PROTO_HTTPS
)
1878 hdr_out
->putStr(HDR_FRONT_END_HTTPS
, "On");
1881 if (flags
.chunked_request
) {
1882 // Do not just copy the original value so that if the client-side
1883 // starts decode other encodings, this code may remain valid.
1884 hdr_out
->putStr(HDR_TRANSFER_ENCODING
, "chunked");
1887 /* Now mangle the headers. */
1888 if (Config2
.onoff
.mangle_request_headers
)
1889 httpHdrMangleList(hdr_out
, request
, ROR_REQUEST
);
1891 if (Config
.request_header_add
&& !Config
.request_header_add
->empty())
1892 httpHdrAdd(hdr_out
, request
, al
, *Config
.request_header_add
);
1894 strConnection
.clean();
1898 * Decides whether a particular header may be cloned from the received Clients request
1899 * to our outgoing fetch request.
1902 copyOneHeaderFromClientsideRequestToUpstreamRequest(const HttpHeaderEntry
*e
, const String strConnection
, const HttpRequest
* request
, HttpHeader
* hdr_out
, const int we_do_ranges
, const HttpStateFlags
&flags
)
1904 debugs(11, 5, "httpBuildRequestHeader: " << e
->name
<< ": " << e
->value
);
1908 /** \par RFC 2616 sect 13.5.1 - Hop-by-Hop headers which Squid should not pass on. */
1910 case HDR_PROXY_AUTHORIZATION
:
1911 /** \par Proxy-Authorization:
1912 * Only pass on proxy authentication to peers for which
1913 * authentication forwarding is explicitly enabled
1915 if (!flags
.originpeer
&& flags
.proxying
&& request
->peer_login
&&
1916 (strcmp(request
->peer_login
, "PASS") == 0 ||
1917 strcmp(request
->peer_login
, "PROXYPASS") == 0 ||
1918 strcmp(request
->peer_login
, "PASSTHRU") == 0)) {
1919 hdr_out
->addEntry(e
->clone());
1923 /** \par RFC 2616 sect 13.5.1 - Hop-by-Hop headers which Squid does not pass on. */
1925 case HDR_CONNECTION
: /** \par Connection: */
1926 case HDR_TE
: /** \par TE: */
1927 case HDR_KEEP_ALIVE
: /** \par Keep-Alive: */
1928 case HDR_PROXY_AUTHENTICATE
: /** \par Proxy-Authenticate: */
1929 case HDR_TRAILER
: /** \par Trailer: */
1930 case HDR_UPGRADE
: /** \par Upgrade: */
1931 case HDR_TRANSFER_ENCODING
: /** \par Transfer-Encoding: */
1934 /** \par OTHER headers I haven't bothered to track down yet. */
1936 case HDR_AUTHORIZATION
:
1937 /** \par WWW-Authorization:
1938 * Pass on WWW authentication */
1940 if (!flags
.originpeer
) {
1941 hdr_out
->addEntry(e
->clone());
1943 /** \note In accelerators, only forward authentication if enabled
1944 * (see also httpFixupAuthentication for special cases)
1946 if (request
->peer_login
&&
1947 (strcmp(request
->peer_login
, "PASS") == 0 ||
1948 strcmp(request
->peer_login
, "PASSTHRU") == 0 ||
1949 strcmp(request
->peer_login
, "PROXYPASS") == 0)) {
1950 hdr_out
->addEntry(e
->clone());
1958 * Normally Squid rewrites the Host: header.
1959 * However, there is one case when we don't: If the URL
1960 * went through our redirector and the admin configured
1961 * 'redir_rewrites_host' to be off.
1963 if (request
->peer_domain
)
1964 hdr_out
->putStr(HDR_HOST
, request
->peer_domain
);
1965 else if (request
->flags
.redirected
&& !Config
.onoff
.redir_rewrites_host
)
1966 hdr_out
->addEntry(e
->clone());
1968 /* use port# only if not default */
1970 if (request
->port
== urlDefaultPort(request
->url
.getScheme())) {
1971 hdr_out
->putStr(HDR_HOST
, request
->GetHost());
1973 httpHeaderPutStrf(hdr_out
, HDR_HOST
, "%s:%d",
1975 (int) request
->port
);
1981 case HDR_IF_MODIFIED_SINCE
:
1982 /** \par If-Modified-Since:
1983 * append unless we added our own,
1984 * but only if cache_miss_revalidate is enabled, or
1985 * the request is not cacheable, or
1986 * the request contains authentication credentials.
1987 * \note at most one client's If-Modified-Since header can pass through
1989 // XXX: need to check and cleanup the auth case so cacheable auth requests get cached.
1990 if (hdr_out
->has(HDR_IF_MODIFIED_SINCE
))
1992 else if (Config
.onoff
.cache_miss_revalidate
|| !request
->flags
.cachable
|| request
->flags
.auth
)
1993 hdr_out
->addEntry(e
->clone());
1996 case HDR_IF_NONE_MATCH
:
1997 /** \par If-None-Match:
1998 * append if the wildcard '*' special case value is present, or
1999 * cache_miss_revalidate is disabled, or
2000 * the request is not cacheable in this proxy, or
2001 * the request contains authentication credentials.
2002 * \note this header lists a set of responses for the server to elide sending. Squid added values are extending that set.
2004 // XXX: need to check and cleanup the auth case so cacheable auth requests get cached.
2005 if (hdr_out
->hasListMember(HDR_IF_MATCH
, "*", ',') || Config
.onoff
.cache_miss_revalidate
|| !request
->flags
.cachable
|| request
->flags
.auth
)
2006 hdr_out
->addEntry(e
->clone());
2009 case HDR_MAX_FORWARDS
:
2010 /** \par Max-Forwards:
2011 * pass only on TRACE or OPTIONS requests */
2012 if (request
->method
== Http::METHOD_TRACE
|| request
->method
== Http::METHOD_OPTIONS
) {
2013 const int64_t hops
= e
->getInt64();
2016 hdr_out
->putInt64(HDR_MAX_FORWARDS
, hops
- 1);
2023 * If Via is disabled then forward any received header as-is.
2024 * Otherwise leave for explicit updated addition later. */
2026 if (!Config
.onoff
.via
)
2027 hdr_out
->addEntry(e
->clone());
2035 case HDR_REQUEST_RANGE
:
2036 /** \par Range:, If-Range:, Request-Range:
2037 * Only pass if we accept ranges */
2039 hdr_out
->addEntry(e
->clone());
2043 case HDR_PROXY_CONNECTION
: // SHOULD ignore. But doing so breaks things.
2046 case HDR_CONTENT_LENGTH
:
2047 // pass through unless we chunk; also, keeping this away from default
2048 // prevents request smuggling via Connection: Content-Length tricks
2049 if (!flags
.chunked_request
)
2050 hdr_out
->addEntry(e
->clone());
2053 case HDR_X_FORWARDED_FOR
:
2055 case HDR_CACHE_CONTROL
:
2056 /** \par X-Forwarded-For:, Cache-Control:
2057 * handled specially by Squid, so leave off for now.
2058 * append these after the loop if needed */
2061 case HDR_FRONT_END_HTTPS
:
2062 /** \par Front-End-Https:
2063 * Pass thru only if peer is configured with front-end-https */
2064 if (!flags
.front_end_https
)
2065 hdr_out
->addEntry(e
->clone());
2071 * pass on all other header fields
2072 * which are NOT listed by the special Connection: header. */
2074 if (strConnection
.size()>0 && strListIsMember(&strConnection
, e
->name
.termedBuf(), ',')) {
2075 debugs(11, 2, "'" << e
->name
<< "' header cropped by Connection: definition");
2079 hdr_out
->addEntry(e
->clone());
2084 HttpStateData::decideIfWeDoRanges (HttpRequest
* request
)
2087 /* decide if we want to do Ranges ourselves
2088 * and fetch the whole object now)
2089 * We want to handle Ranges ourselves iff
2090 * - we can actually parse client Range specs
2091 * - the specs are expected to be simple enough (e.g. no out-of-order ranges)
2092 * - reply will be cachable
2093 * (If the reply will be uncachable we have to throw it away after
2094 * serving this request, so it is better to forward ranges to
2095 * the server and fetch only the requested content)
2098 int64_t roffLimit
= request
->getRangeOffsetLimit();
2100 if (NULL
== request
->range
|| !request
->flags
.cachable
2101 || request
->range
->offsetLimitExceeded(roffLimit
) || request
->flags
.connectionAuth
)
2104 debugs(11, 8, "decideIfWeDoRanges: range specs: " <<
2105 request
->range
<< ", cachable: " <<
2106 request
->flags
.cachable
<< "; we_do_ranges: " << result
);
2111 /* build request prefix and append it to a given MemBuf;
2112 * return the length of the prefix */
2114 HttpStateData::buildRequestPrefix(MemBuf
* mb
)
2116 const int offset
= mb
->size
;
2117 /* Uses a local httpver variable to print the HTTP/1.1 label
2118 * since the HttpRequest may have an older version label.
2119 * XXX: This could create protocol bugs as the headers sent and
2120 * flow control should all be based on the HttpRequest version
2121 * not the one we are sending. Needs checking.
2123 Http::ProtocolVersion
httpver(1,1);
2125 if (_peer
&& !_peer
->options
.originserver
)
2126 url
= urlCanonical(request
);
2128 url
= request
->urlpath
.termedBuf();
2129 mb
->Printf(SQUIDSBUFPH
" %s %s/%d.%d\r\n",
2130 SQUIDSBUFPRINT(request
->method
.image()),
2131 url
&& *url
? url
: "/",
2132 AnyP::ProtocolType_str
[httpver
.protocol
],
2133 httpver
.major
,httpver
.minor
);
2134 /* build and pack headers */
2136 HttpHeader
hdr(hoRequest
);
2138 httpBuildRequestHeader(request
, entry
, fwd
->al
, &hdr
, flags
);
2140 if (request
->flags
.pinned
&& request
->flags
.connectionAuth
)
2141 request
->flags
.authSent
= true;
2142 else if (hdr
.has(HDR_AUTHORIZATION
))
2143 request
->flags
.authSent
= true;
2145 packerToMemInit(&p
, mb
);
2150 /* append header terminator */
2151 mb
->append(crlf
, 2);
2152 return mb
->size
- offset
;
2155 /* This will be called when connect completes. Write request. */
2157 HttpStateData::sendRequest()
2161 debugs(11, 5, HERE
<< serverConnection
<< ", request " << request
<< ", this " << this << ".");
2163 if (!Comm::IsConnOpen(serverConnection
)) {
2164 debugs(11,3, HERE
<< "cannot send request to closing " << serverConnection
);
2165 assert(closeHandler
!= NULL
);
2169 typedef CommCbMemFunT
<HttpStateData
, CommTimeoutCbParams
> TimeoutDialer
;
2170 AsyncCall::Pointer timeoutCall
= JobCallback(11, 5,
2171 TimeoutDialer
, this, HttpStateData::httpTimeout
);
2172 commSetConnTimeout(serverConnection
, Config
.Timeout
.lifetime
, timeoutCall
);
2173 flags
.do_next_read
= true;
2174 maybeReadVirginBody();
2176 if (request
->body_pipe
!= NULL
) {
2177 if (!startRequestBodyFlow()) // register to receive body data
2179 typedef CommCbMemFunT
<HttpStateData
, CommIoCbParams
> Dialer
;
2180 requestSender
= JobCallback(11,5,
2181 Dialer
, this, HttpStateData::sentRequestBody
);
2183 Must(!flags
.chunked_request
);
2184 // use chunked encoding if we do not know the length
2185 if (request
->content_length
< 0)
2186 flags
.chunked_request
= true;
2188 assert(!requestBodySource
);
2189 typedef CommCbMemFunT
<HttpStateData
, CommIoCbParams
> Dialer
;
2190 requestSender
= JobCallback(11,5,
2191 Dialer
, this, HttpStateData::wroteLast
);
2194 flags
.originpeer
= (_peer
!= NULL
&& _peer
->options
.originserver
);
2195 flags
.proxying
= (_peer
!= NULL
&& !flags
.originpeer
);
2198 * Is keep-alive okay for all request methods?
2200 if (request
->flags
.mustKeepalive
)
2201 flags
.keepalive
= true;
2202 else if (request
->flags
.pinned
)
2203 flags
.keepalive
= request
->persistent();
2204 else if (!Config
.onoff
.server_pconns
)
2205 flags
.keepalive
= false;
2206 else if (_peer
== NULL
)
2207 flags
.keepalive
= true;
2208 else if (_peer
->stats
.n_keepalives_sent
< 10)
2209 flags
.keepalive
= true;
2210 else if ((double) _peer
->stats
.n_keepalives_recv
/
2211 (double) _peer
->stats
.n_keepalives_sent
> 0.50)
2212 flags
.keepalive
= true;
2215 /*The old code here was
2216 if (neighborType(_peer, request) == PEER_SIBLING && ...
2217 which is equivalent to:
2218 if (neighborType(_peer, NULL) == PEER_SIBLING && ...
2220 if (((_peer->type == PEER_MULTICAST && p->options.mcast_siblings) ||
2221 _peer->type == PEER_SIBLINGS ) && _peer->options.allow_miss)
2222 flags.only_if_cached = 1;
2224 But I suppose it was a bug
2226 if (neighborType(_peer
, request
) == PEER_SIBLING
&&
2227 !_peer
->options
.allow_miss
)
2228 flags
.only_if_cached
= true;
2230 flags
.front_end_https
= _peer
->front_end_https
;
2234 request
->peer_host
=_peer
?_peer
->host
:NULL
;
2235 buildRequestPrefix(&mb
);
2237 debugs(11, 2, "HTTP Server " << serverConnection
);
2238 debugs(11, 2, "HTTP Server REQUEST:\n---------\n" << mb
.buf
<< "\n----------");
2240 Comm::Write(serverConnection
, &mb
, requestSender
);
2245 HttpStateData::getMoreRequestBody(MemBuf
&buf
)
2247 // parent's implementation can handle the no-encoding case
2248 if (!flags
.chunked_request
)
2249 return ServerStateData::getMoreRequestBody(buf
);
2253 Must(requestBodySource
!= NULL
);
2254 if (!requestBodySource
->getMoreData(raw
))
2255 return false; // no request body bytes to chunk yet
2257 // optimization: pre-allocate buffer size that should be enough
2258 const mb_size_t rawDataSize
= raw
.contentSize();
2259 // we may need to send: hex-chunk-size CRLF raw-data CRLF last-chunk
2260 buf
.init(16 + 2 + rawDataSize
+ 2 + 5, raw
.max_capacity
);
2262 buf
.Printf("%x\r\n", static_cast<unsigned int>(rawDataSize
));
2263 buf
.append(raw
.content(), rawDataSize
);
2266 Must(rawDataSize
> 0); // we did not accidently created last-chunk above
2268 // Do not send last-chunk unless we successfully received everything
2269 if (receivedWholeRequestBody
) {
2270 Must(!flags
.sentLastChunk
);
2271 flags
.sentLastChunk
= true;
2272 buf
.append("0\r\n\r\n", 5);
2279 httpStart(FwdState
*fwd
)
2281 debugs(11, 3, fwd
->request
->method
<< ' ' << fwd
->entry
->url());
2282 AsyncJob::Start(new HttpStateData(fwd
));
2286 HttpStateData::start()
2288 if (!sendRequest()) {
2289 debugs(11, 3, "httpStart: aborted");
2290 mustStop("HttpStateData::start failed");
2294 ++ statCounter
.server
.all
.requests
;
2295 ++ statCounter
.server
.http
.requests
;
2298 * We used to set the read timeout here, but not any more.
2299 * Now its set in httpSendComplete() after the full request,
2300 * including request body, has been written to the server.
2304 /// if broken posts are enabled for the request, try to fix and return true
2306 HttpStateData::finishingBrokenPost()
2308 #if USE_HTTP_VIOLATIONS
2309 if (!Config
.accessList
.brokenPosts
) {
2310 debugs(11, 5, HERE
<< "No brokenPosts list");
2314 ACLFilledChecklist
ch(Config
.accessList
.brokenPosts
, originalRequest(), NULL
);
2315 if (ch
.fastCheck() != ACCESS_ALLOWED
) {
2316 debugs(11, 5, HERE
<< "didn't match brokenPosts");
2320 if (!Comm::IsConnOpen(serverConnection
)) {
2321 debugs(11, 3, HERE
<< "ignoring broken POST for closed " << serverConnection
);
2322 assert(closeHandler
!= NULL
);
2323 return true; // prevent caller from proceeding as if nothing happened
2326 debugs(11, 3, "finishingBrokenPost: fixing broken POST");
2327 typedef CommCbMemFunT
<HttpStateData
, CommIoCbParams
> Dialer
;
2328 requestSender
= JobCallback(11,5,
2329 Dialer
, this, HttpStateData::wroteLast
);
2330 Comm::Write(serverConnection
, "\r\n", 2, requestSender
, NULL
);
2334 #endif /* USE_HTTP_VIOLATIONS */
2337 /// if needed, write last-chunk to end the request body and return true
2339 HttpStateData::finishingChunkedRequest()
2341 if (flags
.sentLastChunk
) {
2342 debugs(11, 5, HERE
<< "already sent last-chunk");
2346 Must(receivedWholeRequestBody
); // or we should not be sending last-chunk
2347 flags
.sentLastChunk
= true;
2349 typedef CommCbMemFunT
<HttpStateData
, CommIoCbParams
> Dialer
;
2350 requestSender
= JobCallback(11,5, Dialer
, this, HttpStateData::wroteLast
);
2351 Comm::Write(serverConnection
, "0\r\n\r\n", 5, requestSender
, NULL
);
2356 HttpStateData::doneSendingRequestBody()
2358 ServerStateData::doneSendingRequestBody();
2359 debugs(11,5, HERE
<< serverConnection
);
2361 // do we need to write something after the last body byte?
2362 if (flags
.chunked_request
&& finishingChunkedRequest())
2364 if (!flags
.chunked_request
&& finishingBrokenPost())
2370 // more origin request body data is available
2372 HttpStateData::handleMoreRequestBodyAvailable()
2374 if (eof
|| !Comm::IsConnOpen(serverConnection
)) {
2375 // XXX: we should check this condition in other callbacks then!
2376 // TODO: Check whether this can actually happen: We should unsubscribe
2377 // as a body consumer when the above condition(s) are detected.
2378 debugs(11, DBG_IMPORTANT
, HERE
<< "Transaction aborted while reading HTTP body");
2382 assert(requestBodySource
!= NULL
);
2384 if (requestBodySource
->buf().hasContent()) {
2385 // XXX: why does not this trigger a debug message on every request?
2387 if (flags
.headers_parsed
&& !flags
.abuse_detected
) {
2388 flags
.abuse_detected
= true;
2389 debugs(11, DBG_IMPORTANT
, "http handleMoreRequestBodyAvailable: Likely proxy abuse detected '" << request
->client_addr
<< "' -> '" << entry
->url() << "'" );
2391 if (virginReply()->sline
.status() == Http::scInvalidHeader
) {
2392 serverConnection
->close();
2398 HttpStateData::handleMoreRequestBodyAvailable();
2401 // premature end of the request body
2403 HttpStateData::handleRequestBodyProducerAborted()
2405 ServerStateData::handleRequestBodyProducerAborted();
2406 if (entry
->isEmpty()) {
2407 debugs(11, 3, "request body aborted: " << serverConnection
);
2408 // We usually get here when ICAP REQMOD aborts during body processing.
2409 // We might also get here if client-side aborts, but then our response
2410 // should not matter because either client-side will provide its own or
2411 // there will be no response at all (e.g., if the the client has left).
2412 ErrorState
*err
= new ErrorState(ERR_ICAP_FAILURE
, Http::scInternalServerError
, fwd
->request
);
2413 err
->detailError(ERR_DETAIL_SRV_REQMOD_REQ_BODY
);
2417 abortTransaction("request body producer aborted");
2420 // called when we wrote request headers(!) or a part of the body
2422 HttpStateData::sentRequestBody(const CommIoCbParams
&io
)
2425 kb_incr(&statCounter
.server
.http
.kbytes_out
, io
.size
);
2427 ServerStateData::sentRequestBody(io
);
2430 // Quickly abort the transaction
2431 // TODO: destruction should be sufficient as the destructor should cleanup,
2432 // including canceling close handlers
2434 HttpStateData::abortTransaction(const char *reason
)
2436 debugs(11,5, HERE
<< "aborting transaction for " << reason
<<
2437 "; " << serverConnection
<< ", this " << this);
2439 if (Comm::IsConnOpen(serverConnection
)) {
2440 serverConnection
->close();
2444 fwd
->handleUnregisteredServerEnd();
2445 mustStop("HttpStateData::abortTransaction");