hno squid-2.3.DEVEL2.CONNECT_miss_access.patch

Squid-2.3.DEVEL2: CONNECT was not under the control of miss_access

Adds miss_access control to the CONNECT method.

diff --git a/ChangeLog b/ChangeLog
index 13550eb2d9fb8bdc22340e5d86a07b2426484426..63b7b91ae0286971bad25e7bc93b7ddfa81081c1 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -33,6 +33,7 @@ Changes to Squid-2.4.DEVEL3 ():
          the last path component of cache_dir.
        - no_cache is now a full ACL check without, allowing most ACL types
          to be used.
+       - The CONNECT method now obeys miss_access requirements
 
 Changes to Squid-2.4.DEVEL2 ():
 

diff --git a/src/ssl.cc b/src/ssl.cc
index 101bd62269fe969e320cf124173fcad8e857e7f4..d7404c86ea00fe495caf787d588a09926bcac2a6 100644 (file)
--- a/src/ssl.cc
+++ b/src/ssl.cc
@@ -1,6 +1,6 @@
 
 /*
- * $Id: ssl.cc,v 1.103 2000/05/02 19:35:23 hno Exp $
+ * $Id: ssl.cc,v 1.104 2000/05/02 19:55:45 hno Exp $
  *
  * DEBUG: section 26    Secure Sockets Layer Proxy
  * AUTHOR: Duane Wessels
@@ -425,6 +425,31 @@ sslStart(int fd, const char *url, request_t * request, size_t * size_ptr)
     SslStateData *sslState = NULL;
     int sock;
     ErrorState *err = NULL;
+    aclCheck_t ch;
+    int answer;
+    /*
+       * client_addr == no_addr indicates this is an "internal" request
+       * from peer_digest.c, asn.c, netdb.c, etc and should always
+       * be allowed.  yuck, I know.
+       */
+    if (request->client_addr.s_addr != no_addr.s_addr) {
+       /*
+          * Check if this host is allowed to fetch MISSES from us (miss_access)
+          */
+       memset(&ch, '\0', sizeof(aclCheck_t));
+       ch.src_addr = request->client_addr;
+       ch.my_addr = request->my_addr;
+       ch.my_port = request->my_port;
+       ch.request = request;
+       answer = aclCheckFast(Config.accessList.miss, &ch);
+       if (answer == 0) {
+           err = errorCon(ERR_FORWARDING_DENIED, HTTP_FORBIDDEN);
+           err->request = requestLink(request);
+           err->src_addr = request->client_addr;
+           errorSend(fd, err);
+           return;
+       }
+    }
     debug(26, 3) ("sslStart: '%s %s'\n",
        RequestMethodStr[request->method], url);
     Counter.server.all.requests++;

diff --git a/src/tunnel.cc b/src/tunnel.cc
index 111352f23f49894b18e3dae7c501903e89d757e3..e79b5270c3284301dfa70f35ce52e427e68c4266 100644 (file)
--- a/src/tunnel.cc
+++ b/src/tunnel.cc
@@ -1,6 +1,6 @@
 
 /*
- * $Id: tunnel.cc,v 1.103 2000/05/02 19:35:23 hno Exp $
+ * $Id: tunnel.cc,v 1.104 2000/05/02 19:55:45 hno Exp $
  *
  * DEBUG: section 26    Secure Sockets Layer Proxy
  * AUTHOR: Duane Wessels
@@ -425,6 +425,31 @@ sslStart(int fd, const char *url, request_t * request, size_t * size_ptr)
     SslStateData *sslState = NULL;
     int sock;
     ErrorState *err = NULL;
+    aclCheck_t ch;
+    int answer;
+    /*
+       * client_addr == no_addr indicates this is an "internal" request
+       * from peer_digest.c, asn.c, netdb.c, etc and should always
+       * be allowed.  yuck, I know.
+       */
+    if (request->client_addr.s_addr != no_addr.s_addr) {
+       /*
+          * Check if this host is allowed to fetch MISSES from us (miss_access)
+          */
+       memset(&ch, '\0', sizeof(aclCheck_t));
+       ch.src_addr = request->client_addr;
+       ch.my_addr = request->my_addr;
+       ch.my_port = request->my_port;
+       ch.request = request;
+       answer = aclCheckFast(Config.accessList.miss, &ch);
+       if (answer == 0) {
+           err = errorCon(ERR_FORWARDING_DENIED, HTTP_FORBIDDEN);
+           err->request = requestLink(request);
+           err->src_addr = request->client_addr;
+           errorSend(fd, err);
+           return;
+       }
+    }
     debug(26, 3) ("sslStart: '%s %s'\n",
        RequestMethodStr[request->method], url);
     Counter.server.all.requests++;