Combine the https_port list internal state with http_port state.

These two lists have been near identical for some time now and we can
easily reduce code by simply merging the two and using either the
secure.encryptTransport flag or the transport.protocol type to select
the remaining non-identical code paths.

diff --git a/src/anyp/PortCfg.cc b/src/anyp/PortCfg.cc
index 1377d489d95fb3ccc1ab0759df55a7cc6eedd471..5209244b7d69bbfe465a8279330eee83a6fa3ac5 100644 (file)
--- a/src/anyp/PortCfg.cc
+++ b/src/anyp/PortCfg.cc
@@ -19,9 +19,6 @@
 #include <limits>
 
 AnyP::PortCfgPointer HttpPortList;
-#if USE_OPENSSL
-AnyP::PortCfgPointer HttpsPortList;
-#endif
 AnyP::PortCfgPointer FtpPortList;
 
 int NHttpSockets = 0;

diff --git a/src/anyp/PortCfg.h b/src/anyp/PortCfg.h
index 7c77e506eb6243496856a1f38a7227528fd5939c..38483b9cf105e22ddacefcd293c0f462dd84314a 100644 (file)
--- a/src/anyp/PortCfg.h
+++ b/src/anyp/PortCfg.h
@@ -91,14 +91,9 @@ public:
 
 } // namespace AnyP
 
-/// list of Squid http_port configured
+/// list of Squid http(s)_port configured
 extern AnyP::PortCfgPointer HttpPortList;
 
-#if USE_OPENSSL
-/// list of Squid https_port configured
-extern AnyP::PortCfgPointer HttpsPortList;
-#endif
-
 /// list of Squid ftp_port configured
 extern AnyP::PortCfgPointer FtpPortList;
 

diff --git a/src/cache_cf.cc b/src/cache_cf.cc
index fdcbdac59d914b6c0a40fbcaca8d312272c35b7a..1bce018cb59d6aa5f6652b71ee64e0609ebfb6fd 100644 (file)
--- a/src/cache_cf.cc
+++ b/src/cache_cf.cc
@@ -895,18 +895,11 @@ configDoConfigure(void)
 
 #if USE_OPENSSL
     for (AnyP::PortCfgPointer s = HttpPortList; s != NULL; s = s->next) {
-        if (!s->flags.tunnelSslBumping)
+        if (!s->secure.encryptTransport)
             continue;
-
-        debugs(3, DBG_IMPORTANT, "Initializing http_port " << s->s << " SSL context");
+        debugs(3, DBG_IMPORTANT, "Initializing " << AnyP::UriScheme(s->transport.protocol) << "_port " << s->s << " TLS context");
         s->configureSslServerContext();
     }
-
-    for (AnyP::PortCfgPointer s = HttpsPortList; s != NULL; s = s->next) {
-        debugs(3, DBG_IMPORTANT, "Initializing https_port " << s->s << " SSL context");
-        s->configureSslServerContext();
-    }
-
 #endif
 
     // prevent infinite fetch loops in the request parser

diff --git a/src/cf.data.pre b/src/cf.data.pre
index e78da378a1e58eed48b4467300f73755b7cf0bff..09a1f03b27de09144a2c4a5346722070e2838d0c 100644 (file)
--- a/src/cf.data.pre
+++ b/src/cf.data.pre
@@ -2027,10 +2027,10 @@ NOCOMMENT_END
 DOC_END
 
 NAME: https_port
-IFDEF: USE_OPENSSL
+IFDEF: USE_GNUTLS||USE_OPENSSL
 TYPE: PortCfg
 DEFAULT: none
-LOC: HttpsPortList
+LOC: HttpPortList
 DOC_START
        Usage:  [ip:]port [mode] cert=certificate.pem [options]
 

diff --git a/src/client_side.cc b/src/client_side.cc
index 29908e2f2f21e4e89f8a30157adfe3bb10c6d573..6972eac4bc9c0412f4c5f9f4d939b1da1b947a3c 100644 (file)
--- a/src/client_side.cc
+++ b/src/client_side.cc
@@ -4264,103 +4264,74 @@ static void
 clientHttpConnectionsOpen(void)
 {
     for (AnyP::PortCfgPointer s = HttpPortList; s != NULL; s = s->next) {
+        const char *scheme = AnyP::UriScheme(s->transport.protocol).c_str();
+
         if (MAXTCPLISTENPORTS == NHttpSockets) {
-            debugs(1, DBG_IMPORTANT, "WARNING: You have too many 'http_port' lines.");
+            debugs(1, DBG_IMPORTANT, "WARNING: You have too many '" << scheme << "_port' lines.");
             debugs(1, DBG_IMPORTANT, "         The limit is " << MAXTCPLISTENPORTS << " HTTP ports.");
             continue;
         }
 
 #if USE_OPENSSL
-        if (s->flags.tunnelSslBumping && !Config.accessList.ssl_bump) {
-            debugs(33, DBG_IMPORTANT, "WARNING: No ssl_bump configured. Disabling ssl-bump on " << AnyP::UriScheme(s->transport.protocol) << "_port " << s->s);
-            s->flags.tunnelSslBumping = false;
-        }
-
-        if (s->flags.tunnelSslBumping &&
-                !s->staticSslContext &&
-                !s->generateHostCertificates) {
-            debugs(1, DBG_IMPORTANT, "Will not bump SSL at http_port " << s->s << " due to SSL initialization failure.");
-            s->flags.tunnelSslBumping = false;
-        }
         if (s->flags.tunnelSslBumping) {
-            // Create ssl_ctx cache for this port.
-            Ssl::TheGlobalContextStorage.addLocalStorage(s->s, s->dynamicCertMemCacheSize == std::numeric_limits<size_t>::max() ? 4194304 : s->dynamicCertMemCacheSize);
+            if (!Config.accessList.ssl_bump) {
+                debugs(33, DBG_IMPORTANT, "WARNING: No ssl_bump configured. Disabling ssl-bump on " << scheme << "_port " << s->s);
+                s->flags.tunnelSslBumping = false;
+            }
+            if (!s->staticSslContext && !s->generateHostCertificates) {
+                debugs(1, DBG_IMPORTANT, "Will not bump SSL at " << scheme << "_port " << s->s << " due to TLS initialization failure.");
+                s->flags.tunnelSslBumping = false;
+                if (s->transport.protocol == AnyP::PROTO_HTTP)
+                    s->secure.encryptTransport = false;
+            }
+            if (s->flags.tunnelSslBumping) {
+                // Create ssl_ctx cache for this port.
+                auto sz = s->dynamicCertMemCacheSize == std::numeric_limits<size_t>::max() ? 4194304 : s->dynamicCertMemCacheSize;
+                Ssl::TheGlobalContextStorage.addLocalStorage(s->s, sz);
+            }
         }
 #endif
 
+        if (s->secure.encryptTransport && !s->staticSslContext) {
+            debugs(1, DBG_CRITICAL, "ERROR: Ignoring " << scheme << "_port " << s->s << " due to TLS context initialization failure.");
+            continue;
+        }
+
         // Fill out a Comm::Connection which IPC will open as a listener for us
         //  then pass back when active so we can start a TcpAcceptor subscription.
         s->listenConn = new Comm::Connection;
         s->listenConn->local = s->s;
-        s->listenConn->flags = COMM_NONBLOCKING | (s->flags.tproxyIntercept ? COMM_TRANSPARENT : 0) | (s->flags.natIntercept ? COMM_INTERCEPTION : 0);
 
-        // setup the subscriptions such that new connections accepted by listenConn are handled by HTTP
-        typedef CommCbFunPtrCallT<CommAcceptCbPtrFun> AcceptCall;
-        RefCount<AcceptCall> subCall = commCbCall(5, 5, "httpAccept", CommAcceptCbPtrFun(httpAccept, CommAcceptCbParams(NULL)));
-        Subscription::Pointer sub = new CallSubscription<AcceptCall>(subCall);
+        s->listenConn->flags = COMM_NONBLOCKING | (s->flags.tproxyIntercept ? COMM_TRANSPARENT : 0) |
+                               (s->flags.natIntercept ? COMM_INTERCEPTION : 0);
 
-        AsyncCall::Pointer listenCall = asyncCall(33,2, "clientListenerConnectionOpened",
-                                        ListeningStartedDialer(&clientListenerConnectionOpened, s, Ipc::fdnHttpSocket, sub));
-        Ipc::StartListening(SOCK_STREAM, IPPROTO_TCP, s->listenConn, Ipc::fdnHttpSocket, listenCall);
+        typedef CommCbFunPtrCallT<CommAcceptCbPtrFun> AcceptCall;
+        if (s->transport.protocol == AnyP::PROTO_HTTP) {
+            // setup the subscriptions such that new connections accepted by listenConn are handled by HTTP
+            RefCount<AcceptCall> subCall = commCbCall(5, 5, "httpAccept", CommAcceptCbPtrFun(httpAccept, CommAcceptCbParams(NULL)));
+            Subscription::Pointer sub = new CallSubscription<AcceptCall>(subCall);
 
-        HttpSockets[NHttpSockets] = -1; // set in clientListenerConnectionOpened
-        ++NHttpSockets;
-    }
-}
+            AsyncCall::Pointer listenCall = asyncCall(33,2, "clientListenerConnectionOpened",
+                                            ListeningStartedDialer(&clientListenerConnectionOpened, s, Ipc::fdnHttpSocket, sub));
+            Ipc::StartListening(SOCK_STREAM, IPPROTO_TCP, s->listenConn, Ipc::fdnHttpSocket, listenCall);
 
 #if USE_OPENSSL
-static void
-clientHttpsConnectionsOpen(void)
-{
-    for (AnyP::PortCfgPointer s = HttpsPortList; s != NULL; s = s->next) {
-        if (MAXTCPLISTENPORTS == NHttpSockets) {
-            debugs(1, DBG_IMPORTANT, "Ignoring 'https_port' lines exceeding the limit.");
-            debugs(1, DBG_IMPORTANT, "The limit is " << MAXTCPLISTENPORTS << " HTTPS ports.");
-            continue;
-        }
-
-        if (!s->staticSslContext) {
-            debugs(1, DBG_IMPORTANT, "Ignoring https_port " << s->s <<
-                   " due to SSL initialization failure.");
-            continue;
-        }
-
-        // TODO: merge with similar code in clientHttpConnectionsOpen()
-        if (s->flags.tunnelSslBumping && !Config.accessList.ssl_bump) {
-            debugs(33, DBG_IMPORTANT, "WARNING: No ssl_bump configured. Disabling ssl-bump on " << AnyP::UriScheme(s->transport.protocol) << "_port " << s->s);
-            s->flags.tunnelSslBumping = false;
-        }
-
-        if (s->flags.tunnelSslBumping && !s->staticSslContext && !s->generateHostCertificates) {
-            debugs(1, DBG_IMPORTANT, "Will not bump SSL at https_port " << s->s << " due to SSL initialization failure.");
-            s->flags.tunnelSslBumping = false;
-        }
-
-        if (s->flags.tunnelSslBumping) {
-            // Create ssl_ctx cache for this port.
-            Ssl::TheGlobalContextStorage.addLocalStorage(s->s, s->dynamicCertMemCacheSize == std::numeric_limits<size_t>::max() ? 4194304 : s->dynamicCertMemCacheSize);
+        } else if (s->transport.protocol == AnyP::PROTO_HTTPS) {
+            // setup the subscriptions such that new connections accepted by listenConn are handled by HTTPS
+            RefCount<AcceptCall> subCall = commCbCall(5, 5, "httpsAccept", CommAcceptCbPtrFun(httpsAccept, CommAcceptCbParams(NULL)));
+            Subscription::Pointer sub = new CallSubscription<AcceptCall>(subCall);
+
+            AsyncCall::Pointer listenCall = asyncCall(33, 2, "clientListenerConnectionOpened",
+                                            ListeningStartedDialer(&clientListenerConnectionOpened,
+                                                    s, Ipc::fdnHttpsSocket, sub));
+            Ipc::StartListening(SOCK_STREAM, IPPROTO_TCP, s->listenConn, Ipc::fdnHttpsSocket, listenCall);
+#endif
         }
 
-        // Fill out a Comm::Connection which IPC will open as a listener for us
-        s->listenConn = new Comm::Connection;
-        s->listenConn->local = s->s;
-        s->listenConn->flags = COMM_NONBLOCKING | (s->flags.tproxyIntercept ? COMM_TRANSPARENT : 0) |
-                               (s->flags.natIntercept ? COMM_INTERCEPTION : 0);
-
-        // setup the subscriptions such that new connections accepted by listenConn are handled by HTTPS
-        typedef CommCbFunPtrCallT<CommAcceptCbPtrFun> AcceptCall;
-        RefCount<AcceptCall> subCall = commCbCall(5, 5, "httpsAccept", CommAcceptCbPtrFun(httpsAccept, CommAcceptCbParams(NULL)));
-        Subscription::Pointer sub = new CallSubscription<AcceptCall>(subCall);
-
-        AsyncCall::Pointer listenCall = asyncCall(33, 2, "clientListenerConnectionOpened",
-                                        ListeningStartedDialer(&clientListenerConnectionOpened,
-                                                s, Ipc::fdnHttpsSocket, sub));
-        Ipc::StartListening(SOCK_STREAM, IPPROTO_TCP, s->listenConn, Ipc::fdnHttpsSocket, listenCall);
-        HttpSockets[NHttpSockets] = -1;
+        HttpSockets[NHttpSockets] = -1; // set in clientListenerConnectionOpened
         ++NHttpSockets;
     }
 }
-#endif
 
 void
 clientStartListeningOn(AnyP::PortCfgPointer &port, const RefCount< CommCbFunPtrCallT<CommAcceptCbPtrFun> > &subCall, const Ipc::FdNoteId fdNote)
@@ -4416,9 +4387,6 @@ void
 clientOpenListenSockets(void)
 {
     clientHttpConnectionsOpen();
-#if USE_OPENSSL
-    clientHttpsConnectionsOpen();
-#endif
     Ftp::StartListening();
 
     if (NHttpSockets < 1)
@@ -4430,22 +4398,12 @@ clientConnectionsClose()
 {
     for (AnyP::PortCfgPointer s = HttpPortList; s != NULL; s = s->next) {
         if (s->listenConn != NULL) {
-            debugs(1, DBG_IMPORTANT, "Closing HTTP port " << s->listenConn->local);
+            debugs(1, DBG_IMPORTANT, "Closing HTTP(S) port " << s->listenConn->local);
             s->listenConn->close();
             s->listenConn = NULL;
         }
     }
 
-#if USE_OPENSSL
-    for (AnyP::PortCfgPointer s = HttpsPortList; s != NULL; s = s->next) {
-        if (s->listenConn != NULL) {
-            debugs(1, DBG_IMPORTANT, "Closing HTTPS port " << s->listenConn->local);
-            s->listenConn->close();
-            s->listenConn = NULL;
-        }
-    }
-#endif
-
     Ftp::StopListening();
 
     // TODO see if we can drop HttpSockets array entirely */

diff --git a/src/ssl/helper.cc b/src/ssl/helper.cc
index 1331f70b56f3cde41b1fcb00bf1b341acf3e7d5f..a88a855b17ad8a97208ae7b527234721d7e2287e 100644 (file)
--- a/src/ssl/helper.cc
+++ b/src/ssl/helper.cc
@@ -46,8 +46,6 @@ void Ssl::Helper::Init()
     bool found = false;
     for (AnyP::PortCfgPointer s = HttpPortList; !found && s != NULL; s = s->next)
         found = s->flags.tunnelSslBumping && s->generateHostCertificates;
-    for (AnyP::PortCfgPointer s = HttpsPortList; !found && s != NULL; s = s->next)
-        found = s->flags.tunnelSslBumping && s->generateHostCertificates;
     if (!found)
         return;
 
@@ -138,8 +136,6 @@ void Ssl::CertValidationHelper::Init()
     bool found = false;
     for (AnyP::PortCfgPointer s = HttpPortList; !found && s != NULL; s = s->next)
         found = s->flags.tunnelSslBumping;
-    for (AnyP::PortCfgPointer s = HttpsPortList; !found && s != NULL; s = s->next)
-        found = s->flags.tunnelSslBumping;
     if (!found)
         return;
 

diff --git a/src/ssl/support.cc b/src/ssl/support.cc
index 2ee7e21c80e11e82e432ef79ba93afca20b263e6..e82d02c86fc4664a92d2a764be44c71a4ae387ab 100644 (file)
--- a/src/ssl/support.cc
+++ b/src/ssl/support.cc
@@ -1377,10 +1377,9 @@ setSessionCallbacks(SSL_CTX *ctx)
 static bool
 isSslServer()
 {
-    if (HttpsPortList != NULL)
-        return true;
-
     for (AnyP::PortCfgPointer s = HttpPortList; s != NULL; s = s->next) {
+        if (s->secure.encryptTransport)
+            return true;
         if (s->flags.tunnelSslBumping)
             return true;
     }
@@ -1411,11 +1410,6 @@ Ssl::initialize_session_cache()
         return;
     }
 
-    for (AnyP::PortCfgPointer s = HttpsPortList; s != NULL; s = s->next) {
-        if (s->staticSslContext.get() != NULL)
-            setSessionCallbacks(s->staticSslContext.get());
-    }
-
     for (AnyP::PortCfgPointer s = HttpPortList; s != NULL; s = s->next) {
         if (s->staticSslContext.get() != NULL)
             setSessionCallbacks(s->staticSslContext.get());

diff --git a/src/tools.cc b/src/tools.cc
index 3176bab2a931260f4d0c3c050961998858a67cfb..f8dc5412e07ddfdaa7eb541f38292c30f0c76808 100644 (file)
--- a/src/tools.cc
+++ b/src/tools.cc
@@ -421,13 +421,6 @@ getMyHostname(void)
     if (HttpPortList != NULL && sa.isAnyAddr())
         sa = HttpPortList->s;
 
-#if USE_OPENSSL
-
-    if (HttpsPortList != NULL && sa.isAnyAddr())
-        sa = HttpsPortList->s;
-
-#endif
-
     /*
      * If the first http_port address has a specific address, try a
      * reverse DNS lookup on it.
@@ -1078,16 +1071,6 @@ getMyPort(void)
             return p->s.port();
     }
 
-#if USE_OPENSSL
-    if ((p = HttpsPortList) != NULL) {
-        // skip any special interception ports
-        while (p != NULL && p->flags.isIntercepted())
-            p = p->next;
-        if (p != NULL)
-            return p->s.port();
-    }
-#endif
-
     if ((p = FtpPortList) != NULL) {
         // skip any special interception ports
         while (p != NULL && p->flags.isIntercepted())