Alex Rousskov [Wed, 7 Jul 2010 03:17:47 +0000 (21:17 -0600)]
Moved KidIdentifier to globals to make pinger happy.
Pinger and possibly other optional externals require KidIdentifier via
debugs(). Instead of making KidIdentifier global, we could add a "plugin" API
to add program-dependent stuff to debugs() and friends, but we should not add
that kind of complexity unless really necessary. We could also link pinger
with libipc.la but that will probably cause more problems with IPC
dependencies.
Alex Rousskov [Wed, 7 Jul 2010 00:45:34 +0000 (18:45 -0600)]
SMP support, part 1: Essential non-caching functionality.
Added workers squid.conf option to specify how many main Squid
processes to fork and maintain. Zero means old no-daemon mode.
One means the old non-SMP mode.
Added support for process_name and process_number macros and
if-statement conditionals in squid.conf. Search for .pre changes for
documented details. These features allow the admin to configure each
worker process differently if needed.
Support multiple workers listening on the same HTTP[S] port (port
sharing). This allows multiple workers to split the load without any
special rules.
Support or prohibit port sharing for WCCP, DNS, ICP, HTCP, SNMP, and
Ident protocols, depending on protocol-specific restrictions. Sharing is
implemented by registering listening socket descriptors with the
Coordinator process and obtaining them from the Coordinator as needed.
Here are protocol-specific notes:
WCCP: Restricted to the Coordinator process due to how WCCP works.
Workers do not need access to the WCCP code.
DNS: Done by each worker with no sharing. Fixed source ports not
supported unless each worker is given its own outgoing address
because we do not want to match outgoing queries and incoming
responses across processes.
SNMP: Workers share incoming and outgoing sockets.
ICP and HTCP _clients_: Cannot be supported in SMP environment
unless each process has its own address (i.e., unique IP address
and/or unique [ICP] port) because we do not want to match outgoing
queries and incoming responses across processes.
ICP and HTCP _servers_: share listening sockets.
Ident clients do not need to share sockets because they use
unique ports.
Support management signals (squid -k ...) in SMP mode, acting as a
single Squid instance.
Refork dying workers, similar to how we reforked dying process in
non-SMP daemon mode.
Alex Rousskov [Wed, 7 Jul 2010 00:22:37 +0000 (18:22 -0600)]
Do not stop testheaders.sh on the first error, to be compatible with
"make -k check".
If testheaders.sh stops on the first error, it becomes very difficult to
test your changes with "make check" when somebody else broke some other
code or when the checks reach src/cf_parser.h and fail.
TODO: stop on the first error unless running under "make -k check".
Bundle a slightly hacked version of libltdl/ltdl.h which does not use <>
for inclusion of its dependency files. This makes it portable to OS with
older libtool versions.
Amos Jeffries [Wed, 30 Jun 2010 12:32:50 +0000 (00:32 +1200)]
NTLM helpers cleanup pt 3: migrate libsmbval into libntlmauth
Library changes:
* ntlmauth.* files moved to libntlmauth/
* helpers/ntlm_auth/smb_lm/smbval moved to libntlmauth/
* No behaviour changes. Since I can't test the deeper logics.
Just enough to make the code built with portable types available in Squid
* API shuffled slightly to use less .h and to remove all external uses of
private *-priv.h definitions.
Library now provides three NTLM backend API:
libntlmauth/ntlmauth.h - NTLM packet handling
libntlmauth/smb.h - SMB LM credential validation
libntlmauth/rfcnb.h - RFCNB (NetBIOS) domain server communications
Helper Changes:
* NTLM helpers tweaked slightly to build with the adjusted libntlmauth API
and ntlm_smb_lm_auth helper to build as C++
* automake logics updated to obey --disable-auth and --disable-auth-ntlm
NOTE: There will be extra code safety and testing benefits gained by
converting libntlmauth to C++ as well. But that requries someone who
can test the code behaviour during the upgrade. For now this wil do.
Amos Jeffries [Sun, 27 Jun 2010 08:41:35 +0000 (02:41 -0600)]
Correct deny_info tokens again.
url_presentable was not just enabling URL-encoding.
It restricts the set of tokens to those which produce data usable in
deny_info URLs.
Renamed to building_deny_info_url for clarity of use and added back in the
restrictions on adding protocol dumps and non-existent page names into the
URL.
Robert Collins [Tue, 15 Jun 2010 08:26:43 +0000 (20:26 +1200)]
Bug 2950: HTTP responses with no Date, Last-modified or expired can
now be cached (given an appropriate refresh_pattern). Previously we
were not caching them in case of an infinite loop in cache farms:
however Squid adds Date: headers now which remove that concern.
Amos Jeffries [Tue, 15 Jun 2010 07:18:24 +0000 (01:18 -0600)]
Maintenance: snapshot detect package name and version better.
The old patterns are no longer unique. Were setting the snapshot package
and version variables wrong.
Detect and use the formal PACKAGE_FOO=FOO settings instead now.
Alex Rousskov [Mon, 14 Jun 2010 21:22:01 +0000 (15:22 -0600)]
Support ICP and HTCP _servers_ sharing listening sockets.
Without a shared cache, the servers will report many false misses.
ICP and HTCP _clients_ cannot be supported in SMP environment unless each
process has its own address (i.e., unique IP address and/or unique [ICP] port)
because we cannot match outgoing queries and incoming responses across
processes. If ICP/HTCP support in SMP is needed, the easiest change would
be to use random source ports for sending ICP/HTCP queries. This may also
improve security by avoiding well-known source ports for UDP queries.
Author: Tsantilas Christos <chtsanti@users.sourceforge.net> , Alex Rousskov <rousskov@measurement-factory.com>
Support ICAP 206 Partial Content extension
The ICAP 206 Partial Content extension allows the ICAP agents to optionally
combine adapted and original HTTP message content.
For more information about ICAP Partial Content extension look at the
draft from the ICAP forum:
Amos Jeffries [Mon, 14 Jun 2010 11:33:42 +0000 (23:33 +1200)]
Drop no_check.pl NTLM helper
It was a near duplicate of ntlm_fake_auth. But with some additional
cons:
* predictable challenge nonce (BAD)
* less configurable
* required run-time perl infrastructure.
The original perl code is kept as ntlm_fake_auth.pl.in for now but does
not get built and installed.
Henrik informs that loosp using fd_set() (select and win32-select) must
be kept below FD_SETSIZE or they can hang Squid or cause out-of-bounds
memory errors.
NP: Squid-2 does not appear to limit select() like this. May need fixing too.
Amos Jeffries [Fri, 11 Jun 2010 06:20:24 +0000 (18:20 +1200)]
Upgrade ntlm_fake_auth helper and internal libntlmauth
Fake auth helper changes:
- renames fakeauth to ntlm_fake_auth
- links ntlm_fake_auth to libntlmauth
- removes duplicate code provided by libcompat and libntlmauth
- moves the remaining bits of fakeauth/ntlm.h to ntlm_fake_auth.cc
Library API changes:
- moves some of the basic NTLM operations into libntlmauth
* fetch_string UNICODE support
* make challenge packet
* validate packet type
* make challenge nonce
* unpack user and domain from authenticate packet
- tweaks libntlmauth to split the make challenge operation so that it
only generates the challenge object (does not encode blob for sending,
or hard-code field values any more).
Other related changes:
- tweaks the smb_lm helper which already linked libntlmauth so that it
uses the updated API correctly after the above changes.
- documents libntlmauth and some of ntlm_fake_auth helper
Amos Jeffries [Fri, 11 Jun 2010 05:24:52 +0000 (23:24 -0600)]
Port from 2.7: max_filedescriptor config option
Since Squid no longer really has any hardcoded filedescriptor limitations
it makes sense to have a squid.conf directive allowing the number of
filedescriptors to be tuned runtime. Default if unset is to obey whatever
ulimit settings as before.
setMaxFD: figures out what to we can use for Squid_MaxFD
setSystemLimits: Configures the system limitations to match our
expectations which might be lower than what setMaxFD finds if
the comm loop has additional restrictions
Alex Rousskov [Sat, 5 Jun 2010 19:08:44 +0000 (13:08 -0600)]
Only one process (called the "primary" process) should handle WCCP. In SMP
mode, this is the Coordinator process.
Identified several commonly use process kinds and added the corresponding
Iam*Process() tests to avoid duplicating complex conditions throughout the
code. Note that kinds are not mutually exclusive. For example, a primary
process is also the master process and the worker process when running
in a no-daemon mode.
Alex Rousskov [Sat, 5 Jun 2010 18:32:22 +0000 (12:32 -0600)]
Replaced blocking comm_open_listener() call for incoming and outgoing SNMP
ports with Ipc::StartListening calls, to use the "shared listen" feature when
doing SMP.
projects / thirdparty / squid.git / log
