Clarify http_port mode options and enhance config validation.
This makes some changes to the config validation of http_port lines
and documentation of http_port.
It alters documentation to call accel, tproxy, intercept, and sslbump
options "mode flags" since they determine the overall code paths which
traffic received is handled by.
The http_port syntax docs are updated to show that mode flags must go
first before any options. This is not strictly true, since the mode flag
only must go before mode-specific options. But its clearer to explain the
syntax docs like this. Both mode and options remain completely optional
(except that some options require certain modes as before).
The parser is updated to validate that only one of the mode flags is used.
Attempts to mix them will result in a fatal error. Attempts to use any of
the mode-specific options without the correct mode being enabled first will
result in a fatal message.
As a side-effect of this the implicit enabling of accel on several of its
options has been dropped. Explicit use as mode flag is preferred (and
required) instead for clear reading of the config.
Implications for older configs are that the http_port may fail a parse
check until some basic re-ordering of options or splitting of http_port
into multiple entries is done. Hopefully the messages emitted on failure
are clear enough for people to follow easily.
Bug 2899: Restore lost rfc1738_unescape() data type
Data type was converted to char from int during recent upgrades.
On unix systems char is unsigned making the safety checks fail on build.
This reverts the type back to a usable signed int, no logic changes.
* merge multiple authenticate and authenticateChildren members from
child classes into the parent AuthUserRequest
* severe circular ref-count links between AuthUser object and
AuthUserRequest. It appears to be unused and causes problems by merely
existing.
* remove entry from client_side unsettign the auth credentials of a
request simply because it was being logged.
The log code woud be better pulling the credentials from the request
directly when needed instead of cloning the text. RefCount in both request
and AuthUser holds the info in place until log output is finished.
But that polish is left for later.
Author: Matthew Morgan <atcs.matthew@gmail.com>
Add acl support to range_offset_limit.
It is being parsed using the same data types as reply_body_max_size,
which means the limit value gets run through parseBytesLine64, and the
acl is optional.
If people are using the old global style of range_offset_limit, they
shouldn't have to do anything to their configs.
getRangeOffsetLimit is now a member of HttpRequest, and it caches it's
value the same way reply_body_max_size does for faster repeat checking.
Author: Alex Rousskov
Modify icap_service_failure_limit option to forget old ICAP errors.
A busy or remote ICAP server may produce a steady but shallow stream of
errors. Any ICAP server may become nearly unusable in a short period of
time, producing a burst of errors. To avoid disabling a generally usable
service, it is important to distinguish these two cases. Just counting
the number of errors and suspending the service after
icap_service_failure_limit is reached often either suspends the service
in both cases or never suspends it at all, depending on the option
value.
One way to distinguish a large burst of errors from a steady but shallow
error stream is to forget about old errors. The icap_service_failure_limit
option modified to instructs Squid to ignore errors that
are "too old" to be counted as a part of a burst.
Another way to look at this feature is to say that the modified
icap_service_failure_limit limits the ICAP error _rate_. For example,
# suspend service usage after 10 failures in 5 seconds:
icap_service_failure_limit 10 in 5 seconds
Squid does not remember every transaction error that occurred within the
allowed "oldest error" time period. That would be result in a precise
but too expensive implementation, especially during error bursts on a
busy server. Instead, Squid divides the period in ten slots, counts the
number of errors that occurred in each slot, and forget the oldest
slot(s) as needed. Thus, the algorithm has about 90% precision as far as
timing of the failures is concerned. That 90% precision ought to be good
enough for any deployment.
Amos Jeffries [Sun, 21 Mar 2010 03:08:26 +0000 (21:08 -0600)]
Compat: Shuffle squid.h portability definitions into libcompat
* Improves and shuffles the memory allocator and string buffer protection
* Fixing many of the unsafe string buffer handling helpers
* removing several duplicated hacks already in libcompat
* Adds NetBSD portability file
projects / thirdparty / squid.git / log
