Detect HTTP header ACL issues

rep_header and req_header ACL types cannot match multiple different
headers in one test (unlike Squid-2 appears to have done). Produce
an ERROR and ignore the extra line(s) instead of silently changing
all the previous regex to match the second header name.

Also detect and ERROR when header name is missing entirely. Ignore
these lines instead of asserting.

diff --git a/src/acl/HttpHeaderData.cc b/src/acl/HttpHeaderData.cc
index 52dbf162bf27b7cbb205a103c3372f0b0892bcad..ff9275c49c6d3015324ddd285c679e4ffc9a2a36 100644 (file)
--- a/src/acl/HttpHeaderData.cc
+++ b/src/acl/HttpHeaderData.cc
@@ -75,9 +75,21 @@ void
 ACLHTTPHeaderData::parse()
 {
     char* t = ConfigParser::strtokFile();
-    assert (t != NULL);
-    hdrName = t;
-    hdrId = Http::HeaderLookupTable.lookup(hdrName).id;
+    if (!t) {
+        debugs(28, DBG_CRITICAL, "ERROR: " << cfg_filename << " line " << config_lineno << ": " << config_input_line);
+        debugs(28, DBG_CRITICAL, "ERROR: Missing header name in ACL");
+        return;
+    }
+
+    if (hdrName.isEmpty()) {
+        hdrName = t;
+        hdrId = Http::HeaderLookupTable.lookup(hdrName).id;
+    } else if (hdrName.caseCmp(t) != 0) {
+        debugs(28, DBG_CRITICAL, "ERROR: " << cfg_filename << " line " << config_lineno << ": " << config_input_line);
+        debugs(28, DBG_CRITICAL, "ERROR: ACL cannot match both " << hdrName << " and " << t << " headers. Use 'anyof' ACL instead.");
+        return;
+    }
+
     regex_rule->parse();
 }