Implemented TrafficMode::isIntercepted()

diff --git a/src/anyp/TrafficMode.h b/src/anyp/TrafficMode.h
index a57855d38649a386d086b29d001924ca3a4e974c..e843541fe6911968f7959028272fa96582fae9a8 100644 (file)
--- a/src/anyp/TrafficMode.h
+++ b/src/anyp/TrafficMode.h
@@ -58,6 +58,11 @@ public:
      *  - peer relay prohibited. TODO: re-encrypt and re-wrap with CONNECT
      */
     bool tunnelSslBumping;
+
+    /** true if the traffic is in any way intercepted
+     *
+     */
+    bool isIntercepted() { return natIntercept||tproxyIntercept ;}
 };
 
 } // namespace AnyP

diff --git a/src/cache_cf.cc b/src/cache_cf.cc
index 242bf1061f76272fd5a333844eab8332cdc56777..931145f42bed551eac23be68550c1b729d5405cb 100644 (file)
--- a/src/cache_cf.cc
+++ b/src/cache_cf.cc
@@ -3556,7 +3556,7 @@ parse_port_option(AnyP::PortCfg * s, char *token)
     /* modes first */
 
     if (strcmp(token, "accel") == 0) {
-        if (s->flags.natIntercept || s->flags.tproxyIntercept) {
+        if (s->flags.isIntercepted()) {
             debugs(3, DBG_CRITICAL, "FATAL: http(s)_port: Accelerator mode requires its own port. It cannot be shared with other modes.");
             self_destruct();
         }
@@ -3646,7 +3646,7 @@ parse_port_option(AnyP::PortCfg * s, char *token)
     } else if (strcmp(token, "ignore-cc") == 0) {
 #if !USE_HTTP_VIOLATIONS
         if (!s->flags.accelSurrogate) {
-            debugs(3, DBG_CRITICAL, "FATAL: http(s)_port: ignore-cc option requires Scceleration mode flag.");
+            debugs(3, DBG_CRITICAL, "FATAL: http(s)_port: ignore-cc option requires Acceleration mode flag.");
             self_destruct();
         }
 #endif
@@ -3697,9 +3697,9 @@ parse_port_option(AnyP::PortCfg * s, char *token)
     } else if (strcasecmp(token, "sslBump") == 0) {
         debugs(3, DBG_CRITICAL, "WARNING: '" << token << "' is deprecated " <<
                "in http_port. Use 'ssl-bump' instead.");
-        s->flags.tunnelSslBumping = true; // accelerated when bumped, otherwise not
+        s->flags.tunnelSslBumping = true;
     } else if (strcmp(token, "ssl-bump") == 0) {
-        s->flags.tunnelSslBumping = true; // accelerated when bumped, otherwise not
+        s->flags.tunnelSslBumping = true;
     } else if (strncmp(token, "cert=", 5) == 0) {
         safe_free(s->cert);
         s->cert = xstrdup(token + 5);
@@ -3796,7 +3796,7 @@ parsePortCfg(AnyP::PortCfg ** head, const char *optionName)
 #if USE_SSL
     if (strcasecmp(protocol, "https") == 0) {
         /* ssl-bump on https_port configuration requires either tproxy or intercept, and vice versa */
-        const bool hijacked = s->flags.tproxyIntercept || s->flags.natIntercept;
+        const bool hijacked = s->flags.isIntercepted();
         if (s->flags.tunnelSslBumping && !hijacked) {
             debugs(3, DBG_CRITICAL, "FATAL: ssl-bump on https_port requires tproxy/intercept which is missing.");
             self_destruct();

diff --git a/src/client_side.cc b/src/client_side.cc
index 587294468985e688b16217b0eaf75a525d04e7bf..93d0143253473254fc008834f15516ad6710a8f1 100644 (file)
--- a/src/client_side.cc
+++ b/src/client_side.cc
@@ -3965,7 +3965,7 @@ ConnStateData::httpsPeeked(Comm::ConnectionPointer serverConnection)
         debugs(33, 5, HERE << "Error while bumping: " << sslConnectHostOrIp);
         Ip::Address intendedDest;
         intendedDest = sslConnectHostOrIp.termedBuf();
-        const bool isConnectRequest = !port->flags.tproxyIntercept && !port->flags.natIntercept;
+        const bool isConnectRequest = !port->flags.isIntercepted();
 
         // Squid serves its own error page and closes, so we want
         // a CN that causes no additional browser errors. Possible

diff --git a/src/forward.cc b/src/forward.cc
index e7ddba8b4510d506c6e2ba10a9d6ceb328ec533f..caf14dbbac177f7aec3623d6cd10245308cb39a9 100644 (file)
--- a/src/forward.cc
+++ b/src/forward.cc
@@ -716,8 +716,7 @@ FwdState::negotiateSSL(int fd)
             // For intercepted connections, set the host name to the server
             // certificate CN. Otherwise, we just hope that CONNECT is using
             // a user-entered address (a host name or a user-entered IP).
-            const bool isConnectRequest = !request->clientConnectionManager->port->flags.tproxyIntercept &&
-                                          !request->clientConnectionManager->port->flags.natIntercept;
+            const bool isConnectRequest = !request->clientConnectionManager->port->flags.isIntercepted();
             if (request->flags.sslPeek && !isConnectRequest) {
                 if (X509 *srvX509 = errDetails->peerCert()) {
                     if (const char *name = Ssl::CommonHostName(srvX509)) {
@@ -963,8 +962,7 @@ FwdState::initiateSSL()
         // unless it was the CONNECT request with a user-typed address.
         const char *hostname = request->GetHost();
         const bool hostnameIsIp = request->GetHostIsNumeric();
-        const bool isConnectRequest = !request->clientConnectionManager->port->flags.tproxyIntercept &&
-                                      !request->clientConnectionManager->port->flags.natIntercept;
+        const bool isConnectRequest = !request->clientConnectionManager->port->flags.isIntercepted();
         if (!request->flags.sslPeek || isConnectRequest)
             SSL_set_ex_data(ssl, ssl_ex_index_server, (void*)hostname);
 

diff --git a/src/tools.cc b/src/tools.cc
index 7311975b73a79bd64a0e4b52bdfb59f5a8be34a9..069caef7410bcb7f82e5075dd76bbbf749087e3e 100644 (file)
--- a/src/tools.cc
+++ b/src/tools.cc
@@ -1209,7 +1209,7 @@ getMyPort(void)
     AnyP::PortCfg *p = NULL;
     if ((p = Config.Sockaddr.http)) {
         // skip any special interception ports
-        while (p && (p->flags.natIntercept || p->flags.tproxyIntercept))
+        while (p && p->flags.isIntercepted())
             p = p->next;
         if (p)
             return p->s.GetPort();
@@ -1218,7 +1218,7 @@ getMyPort(void)
 #if USE_SSL
     if ((p = Config.Sockaddr.https)) {
         // skip any special interception ports
-        while (p && (p->flags.natIntercept || p->flags.tproxyIntercept))
+        while (p && p->flags.isIntercepted())
             p = p->next;
         if (p)
             return p->s.GetPort();