Added support for FreeBSD accept filters

ported from squid-2

Accept filters support will be enabled if the system defines the
SO_ACCEPTFILTER socket option.   A filter will be applied to Squid's
listen socket(s) if set with the 'accept_filter' directive in
squid.conf.

Typical use will be to apply the 'httpready' filter, which requires
loading the 'accf_http' kernel module.  The 'httpready' filter delays
passing new connection descriptors to Squid until a full HTTP request
is received.

diff --git a/src/cf.data.pre b/src/cf.data.pre
index df9e62bf09476050fb7e1be5f9b27de4ef99e134..e76a997f074b19cd1f992b47f6410eefdfc43df1 100644 (file)
--- a/src/cf.data.pre
+++ b/src/cf.data.pre
@@ -1,6 +1,6 @@
 
 #
-# $Id: cf.data.pre,v 1.443 2007/06/27 04:26:12 hno Exp $
+# $Id: cf.data.pre,v 1.444 2007/07/09 19:54:13 wessels Exp $
 #
 # SQUID Web Proxy Cache                http://www.squid-cache.org/
 # ----------------------------------------------------------
@@ -5166,4 +5166,22 @@ Example:
 icap_access class_1 allow all
 DOC_END
 
+NAME: accept_filter
+IFDEF: SO_ACCEPTFILTER
+TYPE: string
+DEFAULT: none
+LOC: Config.accept_filter
+DOC_START
+       The name of an accept(2) filter to install on Squid's
+       listen socket(s).  This feature is perhaps specific to
+       FreeBSD and requires support in the kernel.
+
+       The 'httpready' filter delays delivering new connections
+       to Squid until a full HTTP request has been recieved.
+       See the accf_http(9) man page.
+
+EXAMPLE:
+accept_filter httpready
+DOC_END
+
 EOF

diff --git a/src/comm.cc b/src/comm.cc
index 2dd4a58a33a8c5158d629cf3c4de3f4325aa3be7..ce9767f486d57ab3626d8e577dd4370526b2238f 100644 (file)
--- a/src/comm.cc
+++ b/src/comm.cc
@@ -1,6 +1,6 @@
 
 /*
- * $Id: comm.cc,v 1.431 2007/05/26 06:38:04 wessels Exp $
+ * $Id: comm.cc,v 1.432 2007/07/09 19:54:13 wessels Exp $
  *
  * DEBUG: section 5     Socket Functions
  * AUTHOR: Harvest Derived
@@ -2050,6 +2050,19 @@ comm_listen(int sock) {
         return x;
     }
 
+#ifdef SO_ACCEPTFILTER
+    if (Config.accept_filter) {
+       struct accept_filter_arg afa;
+       bzero(&afa, sizeof(afa));
+       debug(5, 0) ("Installing accept filter '%s' on FD %d\n",
+       Config.accept_filter, sock);
+       xstrncpy(afa.af_name, Config.accept_filter, sizeof(afa.af_name));
+       x = setsockopt(sock, SOL_SOCKET, SO_ACCEPTFILTER, &afa, sizeof(afa));
+       if (x < 0)
+           debug(5, 0) ("SO_ACCEPTFILTER '%s': %s\n", Config.accept_filter, xstrerror());
+    }
+#endif
+
     return sock;
 }
 

diff --git a/src/structs.h b/src/structs.h
index 9413663f4c682c3c1d59d69f892562482d329c45..ddc23c1aae9b14bb910616255a4fbd27d09a9669 100644 (file)
--- a/src/structs.h
+++ b/src/structs.h
@@ -1,6 +1,6 @@
 
 /*
- * $Id: structs.h,v 1.558 2007/05/29 13:31:41 amosjeffries Exp $
+ * $Id: structs.h,v 1.559 2007/07/09 19:54:13 wessels Exp $
  *
  *
  * SQUID Web Proxy Cache          http://www.squid-cache.org/
@@ -737,6 +737,10 @@ struct _SquidConfig
 
     ssl_client;
 #endif
+
+#ifdef SO_ACCEPTFILTER
+    char *accept_filter;
+#endif
 };
 
 struct _SquidConfig2