Add adapted_http_access option. Port of http_access2 from Squid-2

diff --git a/doc/release-notes/release-3.1.sgml b/doc/release-notes/release-3.1.sgml
index 7e81337def829281544c9a22519059bf142735cf..bafa824ef9c069ed009331070a5539b718c174df 100644 (file)
--- a/doc/release-notes/release-3.1.sgml
+++ b/doc/release-notes/release-3.1.sgml
@@ -475,6 +475,10 @@ This section gives a thorough account of those changes in three categories:
        matters.
        </verb>
 
+       <tag>adapted_http_access</tag>
+       <p>New name for <em>http_access2</em>. This form includes access control
+       of ICAP and eCAP adaptations as well as the URL-rewriter alterations.
+
        <tag>chunked_request_body_max_size</tag>
        <p>New option to enable handing of broken HTTP/1.1 clients sending chunk requests.
        <verb>
@@ -1425,6 +1429,9 @@ This section gives an account of those changes in three categories:
        <tag>header_access</tag>
        <p>Replaced by <em>request_header_access</em> and <em>reply_header_access</em>
 
+       <tag>http_access2</tag>
+       <p>Replaced by <em>adapted_http_access</em>
+
        <tag>http_port</tag>
        <p><em>no-connection-auth</em> replaced by <em>connection-auth=[on|off]</em>. Default is ON.
        <p><em>transparent</em> option replaced by <em>intercept</em>
@@ -1577,9 +1584,6 @@ This section gives an account of those changes in three categories:
        <tag>external_refresh_check</tag>
        <p>Not yet ported from 2.7
 
-       <tag>http_access2</tag>
-       <p>Not yet ported from 2.6
-
        <tag>http_port</tag>
        <p><em>act-as-origin</em> not yet ported from 2.7
        <p><em>http11</em> not yet ported from 2.7

diff --git a/doc/release-notes/release-3.2.sgml b/doc/release-notes/release-3.2.sgml
index 666fcee0e7ba0517e26f4ac5d9e7714f68678006..508639a0ea2ab3984fbb4e82a650407d4b74c7ea 100644 (file)
--- a/doc/release-notes/release-3.2.sgml
+++ b/doc/release-notes/release-3.2.sgml
@@ -307,6 +307,9 @@ This section gives an account of those changes in three categories:
        <p><em>no-connection-auth</em> replaced by <em>connection-auth=[on|off]</em>. Default is ON.
        <p><em>transparent</em> option replaced by <em>intercept</em>
 
+       <tag>http_access2</tag>
+       <p>Repalced by <em>adapted_http_access</em>
+
        <tag>httpd_accel_no_pmtu_disc</tag>
        <p>Replaced by <em>http_port disable-pmtu-discovery=</em> option
 
@@ -452,9 +455,6 @@ This section gives an account of those changes in three categories:
        <tag>external_refresh_check</tag>
        <p>Not yet ported from 2.7
 
-       <tag>http_access2</tag>
-       <p>Not yet ported from 2.6
-
        <tag>http_port</tag>
        <p><em>act-as-origin</em> not yet ported from 2.7
        <p><em>http11</em> not yet ported from 2.7

diff --git a/src/ClientRequestContext.h b/src/ClientRequestContext.h
index 430ac8319df25d83be9f1b56356b786828944185..0b4dad40a19d26e888474ffec88e4a128e5f3799 100644 (file)
--- a/src/ClientRequestContext.h
+++ b/src/ClientRequestContext.h
@@ -26,6 +26,7 @@ public:
 
     bool httpStateIsValid();
     void clientAccessCheck();
+    void clientAccessCheck2();
     void clientAccessCheckDone(int answer);
     void clientRedirectStart();
     void clientRedirectDone(char *result);
@@ -42,11 +43,10 @@ public:
     int redirect_state;
 
     bool http_access_done;
+    bool adapted_http_access_done;
 #if USE_ADAPTATION
-
     bool adaptation_acl_check_done;
 #endif
-
     bool redirect_done;
     bool no_cache_done;
     bool interpreted_req_hdrs;

diff --git a/src/cf.data.depend b/src/cf.data.depend
index 8215ce395135879d088aded6d2f8d0f187b72231..75fe5ec502614b38dde298a10912d39c4d3928c3 100644 (file)
--- a/src/cf.data.depend
+++ b/src/cf.data.depend
@@ -22,7 +22,7 @@ externalAclHelper     auth_param
 HelperChildConfig
 hostdomain             cache_peer
 hostdomaintype         cache_peer
-http_header_access
+http_header_access     acl
 http_header_replace
 http_port_list
 https_port_list

diff --git a/src/cf.data.pre b/src/cf.data.pre
index 0b44064635218bec19ba337cc81ed0233b0e13b7..91f1f41f80ebdf76c036aba79589bab79b3892bf 100644 (file)
--- a/src/cf.data.pre
+++ b/src/cf.data.pre
@@ -922,6 +922,20 @@ http_access deny all
 NOCOMMENT_END
 DOC_END
 
+NAME: adapted_http_access http_access2
+TYPE: acl_access
+LOC: Config.accessList.adapted_http
+DEFAULT: none
+DOC_START
+       Allowing or Denying access based on defined access lists
+
+       Essentially identical to http_access, but runs after redirectors
+       and ICAP/eCAP adaptation. Allowing access control based on their
+       output.
+
+       If not set then only http_access is used.
+DOC_END
+
 NAME: http_reply_access
 TYPE: acl_access
 LOC: Config.accessList.reply

diff --git a/src/client_side_request.cc b/src/client_side_request.cc
index 82c52557bd14a1bd212ae5ef8d61ca9063cec95f..980b66d062fddeb1731234e5979f49176fc8e721 100644 (file)
--- a/src/client_side_request.cc
+++ b/src/client_side_request.cc
@@ -532,6 +532,23 @@ ClientRequestContext::clientAccessCheck()
     }
 }
 
+/**
+ * Identical in operation to clientAccessCheck() but performed later using different configured ACL list.
+ * The default here is to allow all. Since the earlier http_access should do a default deny all.
+ * This check is just for a last-minute denial based on adapted request headers.
+ */
+void
+ClientRequestContext::clientAccessCheck2()
+{
+    if (Config.accessList.adapted_http) {
+        acl_checklist = clientAclChecklistCreate(Config.accessList.adapted_http, http);
+        acl_checklist->nonBlockingCheck(clientAccessCheckDoneWrapper, this);
+    } else {
+        debugs(85, 2, HERE << "No adapted_http_access configuration.");
+        clientAccessCheckDone(ACCESS_ALLOWED);
+    }
+}
+
 void
 clientAccessCheckDoneWrapper(int answer, void *data)
 {
@@ -1294,6 +1311,13 @@ ClientHttpRequest::doCallouts()
         }
     }
 
+    if (!calloutContext->adapted_http_access_done) {
+        debugs(83, 3, HERE << "Doing calloutContext->clientAccessCheck2()");
+        calloutContext->adapted_http_access_done = true;
+        calloutContext->clientAccessCheck2();
+        return;
+    }
+
     if (!calloutContext->interpreted_req_hdrs) {
         debugs(83, 3, HERE << "Doing clientInterpretRequestHeaders()");
         calloutContext->interpreted_req_hdrs = 1;

diff --git a/src/structs.h b/src/structs.h
index 416799b45dbcdbb9f8307b700a40c5e1951eaf50..10005ccbadf6e45230134f05fc6a839456b5c9f1 100644 (file)
--- a/src/structs.h
+++ b/src/structs.h
@@ -461,6 +461,7 @@ struct SquidConfig {
 
     struct {
         acl_access *http;
+        acl_access *adapted_http;
         acl_access *icp;
         acl_access *miss;
         acl_access *NeverDirect;