Robert Collins [Tue, 15 Jun 2010 08:26:43 +0000 (20:26 +1200)]
Bug 2950: HTTP responses with no Date, Last-modified or expired can
now be cached (given an appropriate refresh_pattern). Previously we
were not caching them in case of an infinite loop in cache farms:
however Squid adds Date: headers now which remove that concern.
Amos Jeffries [Tue, 15 Jun 2010 07:18:24 +0000 (01:18 -0600)]
Maintenance: snapshot detect package name and version better.
The old patterns are no longer unique. Were setting the snapshot package
and version variables wrong.
Detect and use the formal PACKAGE_FOO=FOO settings instead now.
Author: Tsantilas Christos <chtsanti@users.sourceforge.net> , Alex Rousskov <rousskov@measurement-factory.com>
Support ICAP 206 Partial Content extension
The ICAP 206 Partial Content extension allows the ICAP agents to optionally
combine adapted and original HTTP message content.
For more information about ICAP Partial Content extension look at the
draft from the ICAP forum:
Amos Jeffries [Mon, 14 Jun 2010 11:33:42 +0000 (23:33 +1200)]
Drop no_check.pl NTLM helper
It was a near duplicate of ntlm_fake_auth. But with some additional
cons:
* predictable challenge nonce (BAD)
* less configurable
* required run-time perl infrastructure.
The original perl code is kept as ntlm_fake_auth.pl.in for now but does
not get built and installed.
Henrik informs that loosp using fd_set() (select and win32-select) must
be kept below FD_SETSIZE or they can hang Squid or cause out-of-bounds
memory errors.
NP: Squid-2 does not appear to limit select() like this. May need fixing too.
Amos Jeffries [Fri, 11 Jun 2010 06:20:24 +0000 (18:20 +1200)]
Upgrade ntlm_fake_auth helper and internal libntlmauth
Fake auth helper changes:
- renames fakeauth to ntlm_fake_auth
- links ntlm_fake_auth to libntlmauth
- removes duplicate code provided by libcompat and libntlmauth
- moves the remaining bits of fakeauth/ntlm.h to ntlm_fake_auth.cc
Library API changes:
- moves some of the basic NTLM operations into libntlmauth
* fetch_string UNICODE support
* make challenge packet
* validate packet type
* make challenge nonce
* unpack user and domain from authenticate packet
- tweaks libntlmauth to split the make challenge operation so that it
only generates the challenge object (does not encode blob for sending,
or hard-code field values any more).
Other related changes:
- tweaks the smb_lm helper which already linked libntlmauth so that it
uses the updated API correctly after the above changes.
- documents libntlmauth and some of ntlm_fake_auth helper
Amos Jeffries [Fri, 11 Jun 2010 05:24:52 +0000 (23:24 -0600)]
Port from 2.7: max_filedescriptor config option
Since Squid no longer really has any hardcoded filedescriptor limitations
it makes sense to have a squid.conf directive allowing the number of
filedescriptors to be tuned runtime. Default if unset is to obey whatever
ulimit settings as before.
setMaxFD: figures out what to we can use for Squid_MaxFD
setSystemLimits: Configures the system limitations to match our
expectations which might be lower than what setMaxFD finds if
the comm loop has additional restrictions
Amos Jeffries [Wed, 2 Jun 2010 13:44:26 +0000 (01:44 +1200)]
Bug 2305: Multiple leaks and assertion crashes in authentication.
* implements proper RefCounting using the RefCount.h classes for
almost all auth objects in Squid.
* Restructures auth objects with a simpler structure of duties and scopes.
* Prunes away several circular and indirectly circular pointer loops
* Adds an API to auth config for handling the mainRotate() event. To only
shutdown helpers, fixing the loss of cached credentials on rotate.
* Adds a username_cache page to cachemgr interface to display the current
credentials and their TTLs to various revalidation or garbage events.
With this we end up with several global pointers for the auth schemes which
have been built into the current Squid. These are RefCount pointers, fixing
the leak of schemes on shutdown. Schemes are now also permanent structures
for the runtime of Squid, fixing leaks on reconfigure and rotate actions.
These AuthSchemes are responsible for creating auth Config objects for each
auth protocol configured in squid.conf. These config objects are now also
able to be altered with a reconfigure instead of requiring a restart.
Each HTTP request authentication attempt generates AuthUserRequest objects,
which may or may not pointer to an AuthUser set of credentials being checked.
AuthUserRequest is RefCounted instead of locked, fixing several assertion
crashes.
AuthUser is now RefCounted instead of locked. It's children inherit
these properties. This simplifies the object handling a lot and fixes
several assertions.
* This also means AuthUser no longer needs a back-pointer to all
AuthUserRequest in order to see if its still needed alive, fixing one
circular lock loop and a few possible assertions.
* The username cache pointers to only AuthUser objects, fixing a second
cirular lock loop and potentially leakage. Also simplifying the hash cache
handling a lot.
Non-Auth code needing a reference to authentication credentials should
hold a pointer to either an AuthUserRequest or AuthUser object. Not any
other auth object.
FUTURE WORK;
There is still some conditions leading to auth re-challenge when they
are not expected.
A fair chunk of classes and enums have been shuffled into separate files
to keep the scopes clearer. This could be increased in future when
building the Auth namespace.
Potential is now present for simpler TTL handling for all auth types.
This work was a collaboration between multiple interested parties over
the last year, with additional developer time and testing funded by
Netspace Online Systems.
Amos Jeffries [Mon, 31 May 2010 09:32:19 +0000 (21:32 +1200)]
Substitute Perl shell path into Basic auth helper scripts
This fixes these helpers by default on OS where the perl shell is not at
/usr/bin/perl. The problem of cross-compiling shell variation remains as
it was before.
Henrik Nordstrom [Sat, 29 May 2010 22:02:54 +0000 (00:02 +0200)]
Rework memory pools
- Default to the old simple non-chunked pool type using malloc
with a simple freelist per pool.
- Various statistics & cachemgr Memory Utilization fixes
- Source reorganisation to split pool implementations from the general
framework. Allocators now in MemPoolChunked.cc and MemPoolMalloc.cc,
with general framework & statistics in MemPool.cc.
The chunked allocator is still available and can be activated by setting
the environment variable MEMPOOLS=1 but the default is now the non-chunked
allocator which has been fixed to account allocations properly for statistics
and also maintain a simple freelist to cache allocations.
No squid.conf changes, other than that the memory_pools and
memory_pools_limit directives now works as intended (not possible
with the chunked allocator).
Amos Jeffries [Thu, 27 May 2010 00:51:44 +0000 (12:51 +1200)]
Author: Alex Rousskov <rousskov@measurement-factory.com>
Bug 2697: Adaptation leaks and extra requests after reconfiguration
This patch "detaches" services from the configuration during reconfiguration.
Detached services do not participate in new adaptation transactions but allow
the old transactions to finish nicely. Once all users are gone, the refcounted
service disappears.
As a side effect of these fixes, several aspects of eCAP service registration
and mapping of loaded and configured eCAP services have been fixed. We will be
able to claim support for eCAP reconfiguration after libecap adds
reconfiguration API.
Amos Jeffries [Tue, 25 May 2010 11:12:20 +0000 (23:12 +1200)]
Author: Wojciech Zatorski <zator@bg.szczecin.pl>
Author: Amos Jeffries <squid3@treenet.co.nz>
Support TPROXYv4 spoofing of X-Forwarded-For client address.
Assumes correct configuration use of the X-Forwarded-For header with
a zone of trusted sources.
SECURITY WARNING:
This patch depends on security features not present in older Squid
versions and is not to be ported or applied to earlier releases.
Amos Jeffries [Tue, 25 May 2010 10:30:55 +0000 (22:30 +1200)]
Author: Mark Nottingham <mnot@pobox.com>
Bug 2631: store-stale refresh_pattern option
RFC2616 allows almost anything to be cached*; most of the constraints are on
what can be used out of cache.
For example, this response:
HTTP/1.1 200 OK
Content-Type: text/html
Date: [date]
[ content ]
is cacheable as per HTTP; it just is considered stale as soon as it is cached.
However, Squid (and many others) don't cache all of these responses, at least
in part because doing so would decrease cache efficiency, and introduce more
load (e.g., on disk subsystems, etc.).
In particular, Squid won't cache a response unless it has either explicit
freshness (e.g., Expires, CC: max-age) or a validator (Last-Modified or ETag).
Nevertheless, doing so is desirable in some circumstances, because in some
deployments the client wants to be able to ask for a stale response. For
example;
GET /foo HTTP/1.1
Host: example.com
Cache-Control: max-age=3600, max-stale
Should retrieve the above response from cache, as long as it is less than an
hour old.
This patch adds a 'store-stale' refresh_pattern option that allows this.
Alex Rousskov [Sun, 23 May 2010 23:04:05 +0000 (17:04 -0600)]
Fixed IpAddress port printing for ports higher than 9999:
snprintf includes zero-terminator in its size limit, so 7
rather than 6 bytes are needed to snprintf a colon followed
by 5 port digits.
Alex Rousskov [Sun, 23 May 2010 16:43:46 +0000 (10:43 -0600)]
Bug 2633 fix: Ecap::HeaderRep::value(name) fails when there is no named header
field
Calling Adaptation::Ecap::HeaderRep::value(const Name &name) with names
of header fields that do not exist leads to
ICAP/AsyncJob.cc(218) dial: AsyncJob::noteStart threw exception:
basic_string::_S_construct NULL not valid
I suspect this is a combination of
- std::string constructor incapable of handling a nil char* pointer.
- String::termedBuf() returning an nil pointer when the string is empty.
When there is no specified header field in the message, the value()
wrapper in Squid gets an empty String for the header value, which is
then used to create std::string, which fails or leads to failure.
I think it is wrong for termedBuf to return nil (because nil is not
0-terminated). I have not tried to fix that because we will have a new
String class soon.
Fixed header accounting to avoid the "Headers[id].stat.aliveCount" assertion.
We were incrementing the alive header field counter twice for each decrement,
which probably resulted in the alive counter wrapping back to zero, triggering
the assertion.
projects / thirdparty / squid.git / log
