Windows: fix collision between POSIX wrappers and DiskIO class methods
The POSIX function shutdown() is #define'd on Windows. This causes
compiler issues with the DiskIO method of same name. Rename the method
to gracefulShutdown() instead.
Also, Bug 3189 was incomplete and missed a change to DiskThreads
Windows initialization method.
Jan Sievers [Tue, 10 Sep 2013 11:28:13 +0000 (05:28 -0600)]
Regression Bug 3077: off-by-one error in Digest header decoding
This is a regression in the 3.2 and later version of the original bug
fix patch.
The effect is that all attributes are treated as quoted-string values
with unescaping performed. This ends with credentials wrongly being
rejected as invalid.
Squid would semi-silently accept invalid IP address or hostname in some
directives which required them (eg wccp_router) and use the magic
IP_ANYADDR value. This change makes configure halt with a FATAL error
instead.
Handle infinite certificate validation loops caused by OpenSSL bug #3090.
If OpenSSL is stuck in a validation loop, Squid breaks the loop and
triggers a
new custom SQUID_X509_V_ERR_INFINITE_VALIDATION SSL validation error.
That
error cannot be bypassed using sslproxy_cert_error because to break the
loop
Squid has to tell OpenSSL that the certificate is invalid, which
terminates
the SSL connection.
Validation loops exceeding SQUID_CERT_VALIDATION_ITERATION_MAX
iterations
are deemed infinite. That macro is defined to be 16384, but that default
can
be overwritten using CPPFLAGS.
* _SQUID_WINDOWS_ for any Windows build specific code
* _SQUID_CYGWIN_ for CygWin Windows build specific code
* _SQUID_MINGW_ for MinGW Windows build specific code
Invalid casting seems to confuse the ABI generator and results in
illegal instruction faults when the unit tests is run.
The class API is already const-correct so there is no need for the cast
to occur, and it should not be done on a non-pointer type anyway.
Also, fixes a missing "struct" type identifier found along the way.
This patch sends an If-None-Match request, when we need to re-validate
if a cached object which has a strong ETag is still valid.
This is also done in the cases an HTTP client request contains HTTP
headers prohibiting a from-cache response (i.e., a "reload" request).
The use of If-None-Match request in this context violates RFC 2616 and
requires using reload-into-ims option within refresh_pattern squid.conf
directive.
The exact definition of a "reload request" and the adjustment/removal of
"reload" headers is the same as currently used for reload-into-ims
option support. This patch is not modifying that code/logic, just adding
an If-None-Match header in addition to the IMS header that Squid already
adds.
Fix external ACL user:pass detail logging after adaptation
When a request is successfully adapted, the external ACL username and
password are now inherited with this patch. This means the
LFT_USER_NAME log token can display the username from an external ACL
if available, for adapted requests.
The HttpRequest will inherit the password for good measure as well -
while none too useful, it seems strange to inherit the username but
not the password.
We can do better than just producing errors about invalid port details
and treating it as port-0.
We can instead undo the port separation and pass it through as part of
the host name to be verified with the default port number properly
assumed.
Protect against buffer overrun in DNS query generation
see SQUID-2013:2.
This bug has been present as long as the internal DNS component however
most code reaching this point is passing through URL validation first.
With Squid-3.2 Host header verification using DNS directly we may have
problems.
- The SSL_CTX_new in newer openSSL releases requires a const
'SSL_METHOD *' argument and in older releases requires non const
'SSL_METHD *' argument. Currently we are trying to identify openSSL
version using the OPENSSL_VERSION_NUMBER macro define but we are failing
to correctly identify all cases.
- sk_OPENSSL_PSTRING_value is buggy in early openSSL-1.0.0? releases
causing compile errors to squid.
Amos Jeffries [Sun, 30 Jun 2013 08:45:09 +0000 (02:45 -0600)]
Bug 3762: remove bogus WARNING in cache.log
The warning is bogus for several reasons:
* it appears with memory-only cache configurations
* it only checks the size of first SwapDir (as seen in bug 3762)
* very large memory spaces are now possible which may make disk appear
small by comparison.
Its usefulness in detecting memory and disk misconfigurations has long
been almosy nil. Removing this entirey to resolve the bogus noise in
the above mentioned legitimate configurations.
Alexis Robert [Sat, 29 Jun 2013 08:23:49 +0000 (02:23 -0600)]
Fix Ip::Address::operator =(sockaddr_storage)
The memcpy() for AF_INET6 is using a length of sizeof(sockaddr_in) instead
of sizeof(sockaddr_in6), so squid was trying to connect to truncatured IPv6
addresses with strange ports.
Alex Rousskov [Sat, 29 Jun 2013 08:20:01 +0000 (02:20 -0600)]
Make sure %<tt includes all [failed] connection attempts.
The old code was using zero n_tries to detect the first connection
attempt,
but n_tries is not incremented when we are opening a new connection
rather
than reusing an old one. Perhaps n_tries should be updated differently
as
well, but this change simply makes %<tt (hier.total_response_time)
management
independent from that [complex] counter.
Alex Rousskov [Wed, 5 Jun 2013 13:00:09 +0000 (07:00 -0600)]
Bug 3717: assertion failed with dstdom_regex with IP based URL
A combination of ACL negation and async lookup leads to
Checklist.cc:287:"!needsAsync && !matchFinished" assertions.
The lower-level ACL code says "not a match because I need an async lookup" but
the negation-handling code in ACL::matches() ignores the "need an async
lookup" part and converts "not a match" into a "match". This patch prevents
that conversion, while allowing Checklist code to decide what to do with
an async lookup (depending on whether the directive being checked supports
slow ACLs).
Note that this change prevents admins from negating async lookups in
directives that do not support them: both "!foo" and "foo" will probably not
match in those directives if ACL foo needs an async lookup.
Amos Jeffries [Tue, 4 Jun 2013 06:58:07 +0000 (00:58 -0600)]
Fix incorrect external_acl_type codes
Documentation describes %USER_CA_CERT_* codes for outputing the CA cert
attributes. However the directive parser and internals were all
referencing it as %CA_CERT_*.
This updates the internals to match documentation, and adds an upgrade
notice for any installations using the old token name.
Also, Prepare external_acl_type format codes for libformat upgrade.
Add upgrade warnings for the %> and %< header codes which will change
radically in a future version when libformat is integrated.
Also, while we are at it support the other logformat codes which map 1:1
but silently for now and only on parse.
Alex Rousskov [Sun, 2 Jun 2013 16:01:18 +0000 (10:01 -0600)]
Ask for SSL key password when started with -N but without sslpassword_program.
Do not give SSL a password-asking callback if sslpassword_program is not
configured. Without a callback, OpenSSL itself asks for the password (which
works if Squid runs in foreground because of -N).
The fix applies to Ssl::readCertChainAndPrivateKeyFromFiles() context only.
This is not the only place where we read private keys. Some other places are
working correctly, but others may need more work. Also,
Ssl::readCertChainAndPrivateKeyFromFiles() may not really work if
sslpassword_program _is_ configured because "user data" pointer will be nil.
Ming Fu [Thu, 23 May 2013 02:26:18 +0000 (20:26 -0600)]
Bug 1991: kqueue causes SSL to hang
Compare the code in normal select and epoll v.s. kqueue. The select use a 0
wait time to get out of select wait in order to handle a list of read_pendings.
However, epoll add the read_pending to read and write event monitor. At a first
look, this seems strange as why read pending has anything to do with write. It
became obvious when the write ready event is triggered. During a write ready
event, if read_pending is on, the read callback is called before the write
callback. As the write buffer is unlikely to be full for an extended period, a
write callback is guaranteed in the immediate future for the read_pending
socket by waiting on write.
The patch follows that same logic as epoll and applies it on kqueue.
Bug 3744: squid terminated: FATAL: Bungled (null) line 3: sslproxy_cert_sign signTrusted all
This bug is a Makefile dependencies problem.
- The cf_gen includes the cf_gen_defines.cci so this file should included in
cf_gen dependencies.
- Currently the cf_gen_defines.cci exist in cf_gen.$(OBJEXT) dependencies but
does not have any effect because the obj file never build and used.
- Also the cf_gen_defines.cci file depends on autoconf.h so this file should
added to to cf_gen_defines.cc dependencies.
All of the sources has the autoconf.h file in their dependencies.
But the cf_gen_defines.cci is auto-generated and does not exist when the
dependencies computed.
Bug 3759: OpenSSL compilation error on stock Fedora17, RHEL, CentOS 6 systems
OpenSSL-1.0.x has changes in TXT_DB interface over the earlier openSSL releases.
Also looks that the IMPLEMENT_LHASH_* macros are not correctly implemented and
causes compile failures.
Some of the linux distributions to overcome the above problems trying to patch
openSSL SDK. For squid this is means that the current checks based on openSSL
version can not work.
This patch try to detect at configure time:
- if the TXT_DB uses the new implementation investigated in openSSL-1.0.x
releases
- If the IMPLEMENT_LHASH_* openSSL macros are correctly implemented.
Then uses the autoconf defines to implement the correct workarounds for used
openSSL SDK.
This patch try to avoid using the SSL_get_certificate function. While configures
squid run tests:
- to examine if the workaround code can be used
- to detect buggy SSL_get_certificate
Inside Ssl::verifySslCertificate try to use workarround code and if this is not
possible uses the SSL_get_certificate if it is not buggy, else hit an assertion
Amos Jeffries [Sun, 19 May 2013 02:43:38 +0000 (20:43 -0600)]
Log an ERROR instead of halting on unknown cache_dir types
Squid-3 can run fine without any configured cache_dir. This assists with
upgrade from older Squid-2 where COSS or NULL cache types may be present.
It also assists with backward compatibility for any future cache types
which may be added in future.
Silamael [Sun, 19 May 2013 02:38:40 +0000 (20:38 -0600)]
Bug 2648: Add missing piece omitted from rev.9677
rev.9677 created forward_max_tries directive but omitted one of the
checks. This adds that check and allows forward_max_tries to be set
to values greater than 10.
Amos Jeffries [Sun, 19 May 2013 02:35:36 +0000 (20:35 -0600)]
Remove origin_tries limiter on forwarding
This limit seems to have been set to prevent large amount of looping when
DIRECT attempts fail under the old model of constant DNS lookups and
retries.
However it is hard-coded and has no configuration knob visible. Under
the curent model of all destinations being enumerated once and tried
sequentially this protection would seem to be no longer necessary and
somewhat harmful as it will be preventing retries reaching destinations
with more than 2 unreachable IPs (think 3 IPv6 and an IPv4 on IPv4-only
network).
Alex Rousskov [Sun, 19 May 2013 02:34:11 +0000 (20:34 -0600)]
Fixed leaking configurable SSL error details.
Trunk r11496 "Configurable SSL error details messages" correctly disabled
collection of HTTP statistics for non-HTTP header fields, such as configurable
SSL error details. However, it also incorrectly disabled deletion of those
non-HTTP header fields.
Configurable SSL error details are only created during [re]configuration time,
so the leak went unnoticed since 2011-06-17, but the same bug caused a major
runtime annotation leak later (r12413) until the new annotation code was
redesigned to avoid using HttpHeader (r12779).
Alex Rousskov [Sun, 19 May 2013 02:32:10 +0000 (20:32 -0600)]
Avoid !closing assertions when helpers call comm_read [during reconfigure].
While helper reading code does check for COMM_ERR_CLOSING, it is not sufficient
because helperReturnBuffer() called by the reading code may notice the helper
shutdown flag (set earlier by reconfigure) and start closing the connection
underneath the reading code feet.
The stricter xato*() parsing bounds checks are halting on the ','
delimiters. Fix this by adding an optional end-of-value parameter to the
relevant parse functions and sending the delimiter in.
This fix makes xatoui() and xatoll() more friendly to parsing
unterminated strings.
previous to this fix the latter two values of tcpkeepalive= were
undocumented optional. This makes Squid enforce the documented format
where all three values are required if any is set.
* Mostly adding DEFAULT_DOC directive to hide strange default values.
This wll help us move to different internal values for no-limit etc
at some point in the future.
* Migrates some access controls to "DEFAULT: none" instead of "deny all".
This reduces run-time CPU cycles running useless ACL tests.
NP: some access controls have been left unchanged due to complexity in
the code testing them (ie icap_access).
* added documentation for several directives which were missing text
* corrected buffered_logs documentation (text by Alex Rousskov)
* updated cf_gen tool to produce more descriptive error messages
* corrected icp_access default to match documented 'deny all' permission
Alex Rousskov [Thu, 25 Apr 2013 15:47:40 +0000 (09:47 -0600)]
Prevent external_acl.cc "inBackground" assertion on queue overloads.
The enqueue check for external ACL lookups was inconsistent with the final
queue length check in ExternalACLLookup::Start(). The former allowed adding to
the already full (but not yet overflowing) queue while the latter
rightfully(?) asserted that the queue should not overflow.
The SSL_get_certificate implementation in OpenSSL 1.0.1d and 1.0.1e releases,
will crash if called before the certificate sent to the client.
This patch add a hack when one of the problematic OpenSSL versions used to
retrieve the certificate directly from SSL_CTX object, instead of creating
a temporary SSL object, and call SSL_get_certificate.
Some systems like GNU Hurd provide the mmap() API but lack MAP_NORESERVE
support. This option is an optimization, so we can define the macro
ourselves to nil and apparently not suffer (many) bad side effects.
Bug 3817: Memory leak in SSL cert validate for alt_name peer certs
Inside function Ssl::matchX509CommonNames which checks a domain name against
certificate common name and alternate names, if the domain matches any of the
alternate names the function return without releasing allocated data.
Michal Luscon [Thu, 18 Apr 2013 05:30:47 +0000 (23:30 -0600)]
Bug 3825: basic_ncsa_auth segfaulting with glibc-2.17
It appears the crypt() function may return NULL strings. Check for those
before all strcmp() operations.
NOTE: The MD5 output checks are probably not needed but since SquidMD5 is
an object build-time switched between several encryption library API
definitions it is better to be safe here as well.
Fix enter_suid/leave_suid build errors in ip/Intercept.cc
Intercept.cc:210: error: 'enter_suid' was not declared in this scope
Intercept.cc:217: error: 'leave_suid' was not declared in this scope
We should just be including tools.h, but on some GCC the src/tools.h and
src/ip/tools.h include locations clash when building inside src/ip/.
For now we must reference the src/tools.h by its long path.
This adds support for the PF 'divert-to' target which presents the
client and remote IPs directly to Squid in accept() parameters the
way Linux TPROXY target does.
It also adds support for the SO_BINDANY option on outgoing traffic for
client IP address spoofing which completes the TPROXY behaviour.
To enable these features Squid built with --enable-pf-transparent can
be configured with:
http_port 1234 tproxy
There is no reason why manager access should be excluded from CONNECT and
Safe_ports security checks. Also, under the new design manager ACL is a
REGEX pattern test, which may be quite slow.
Overall there should be better performnce under certain DoS condtions
having the manager tests after the port tests, with no change under the
other more common traffic.
Amos Jeffries [Fri, 29 Mar 2013 05:59:17 +0000 (23:59 -0600)]
Fix memory leaks in ConnStateData pinning
ConnStateData does not cleanup any of the pinning child structure fields.
This results in a leak of pinned host and peer details.
Run the full un-pin cleanup operation from ConnStateData::swanSong in
order to clean up all the pinning state instead of just the release the
Comm::Connection.
This fix keeps Rock cache_dirs visible to Cache Manager after reconfigure.
We still lack proper support for complex reconfiguration changes involving
cache_dirs.
projects / thirdparty / squid.git / log
