transaction_initiator ACL for detecting various unusual transactions

[thirdparty/squid.git] / src / security / PeerConnector.cc

diff --git a/src/security/PeerConnector.cc b/src/security/PeerConnector.cc
index bfc3f323ca31059f6af917aaadc0f879b464dc3c..4b3b6ceaca519989246bc765f35cdba232174a62 100644 (file)
--- a/src/security/PeerConnector.cc
+++ b/src/security/PeerConnector.cc
@@ -199,6 +199,11 @@ Security::PeerConnector::negotiate()
     }
 
     if (result != GNUTLS_E_SUCCESS) {
+        // debug the TLS session state so far
+        auto descIn = gnutls_handshake_get_last_in(session);
+        debugs(83, 2, "handshake IN: " << gnutls_handshake_description_get_name(descIn));
+        auto descOut = gnutls_handshake_get_last_out(session);
+        debugs(83, 2, "handshake OUT: " << gnutls_handshake_description_get_name(descOut));
 #else
     if (const int result = -1) {
 #endif
@@ -410,20 +415,13 @@ Security::PeerConnector::handleNegotiateError(const int ret)
 
     switch (ret) {
     case GNUTLS_E_WARNING_ALERT_RECEIVED: {
-            auto alert = gnutls_alert_get(session.get());
-            debugs(83, DBG_IMPORTANT, "TLS ALERT: " << gnutls_alert_get_name(alert));
-        }
-        // drop through to next case
+        auto alert = gnutls_alert_get(session.get());
+        debugs(83, DBG_IMPORTANT, "TLS ALERT: " << gnutls_alert_get_name(alert));
+    }
+    // drop through to next case
 
     case GNUTLS_E_AGAIN:
     case GNUTLS_E_INTERRUPTED:
-        {
-            auto descIn = gnutls_handshake_get_last_in(session.get());
-            debugs(83, 2, "handshake IN: " << gnutls_handshake_description_get_name(descIn));
-            auto descOut = gnutls_handshake_get_last_out(session.get());
-            debugs(83, 2, "handshake OUT: " << gnutls_handshake_description_get_name(descOut));
-        }
-
         if (gnutls_record_get_direction(session.get()) == 0)
             noteWantRead();
         else
@@ -450,7 +448,7 @@ void
 Security::PeerConnector::noteWantRead()
 {
     const int fd = serverConnection()->fd;
-    debugs(83, 5, "FD " << fd);
+    debugs(83, 5, serverConnection());
 #if USE_OPENSSL
     Security::SessionPointer session(fd_table[fd].ssl);
     BIO *b = SSL_get_rbio(session.get());
@@ -481,7 +479,7 @@ void
 Security::PeerConnector::noteWantWrite()
 {
     const int fd = serverConnection()->fd;
-    debugs(83, 5, "FD " << fd);
+    debugs(83, 5, serverConnection());
     Comm::SetSelect(fd, COMM_SELECT_WRITE, &NegotiateSsl, this, 0);
     return;
 }
@@ -507,11 +505,7 @@ Security::PeerConnector::noteNegotiationError(const int ret, const int ssl_error
            ": " << Security::ErrorString(ssl_lib_error) << " (" <<
            ssl_error << "/" << ret << "/" << xerr << ")");
 
-    ErrorState *anErr = NULL;
-    if (request != NULL)
-        anErr = ErrorState::NewForwarding(ERR_SECURE_CONNECT_FAIL, request.getRaw());
-    else
-        anErr = new ErrorState(ERR_SECURE_CONNECT_FAIL, Http::scServiceUnavailable, NULL);
+    ErrorState *anErr = ErrorState::NewForwarding(ERR_SECURE_CONNECT_FAIL, request);
     anErr->xerrno = sysErrNo;
 
 #if USE_OPENSSL
@@ -553,13 +547,6 @@ Security::PeerConnector::bail(ErrorState *error)
     // the recepient before the fd-closure notification), but we would rather
     // minimize the number of fd-closure notifications and let the recepient
     // manage the TCP state of the connection.
-
-#if USE_GNUTLS
-    // but we do need to release the bad TLS related details in fd_table
-    // ... or GnuTLS will SEGFAULT.
-    const int fd = serverConnection()->fd;
-    Security::SessionClose(fd_table[fd].ssl, fd);
-#endif
 }
 
 void
@@ -642,7 +629,7 @@ Security::PeerConnector::startCertDownloading(SBuf &url)
                                       PeerConnectorCertDownloaderDialer(&Security::PeerConnector::certDownloadingDone, this));
 
     const Downloader *csd = (request ? dynamic_cast<const Downloader*>(request->downloader.valid()) : nullptr);
-    Downloader *dl = new Downloader(url, certCallback, csd ? csd->nestedLevel() + 1 : 1);
+    Downloader *dl = new Downloader(url, certCallback, XactionInitiator::initCertFetcher, csd ? csd->nestedLevel() + 1 : 1);
     AsyncJob::Start(dl);
 }