Fix stale=true on digest requests with unknown nonce
The nonce staleness check only worked if the stale nonce had not yet
been garbage collected, often resulting in incorrect stale=false
responses and resulting auth popups when using digest auth.
Note: this fix is different from how it's done in squid-2 where fixHeader
is called on all schemes in such conditions but only the active one with
and auth_user_request. Not entirely sure why that is done, but commit
message says something about Negotiate authentication.
Amos Jeffries [Fri, 5 Mar 2010 02:07:24 +0000 (15:07 +1300)]
Rationalize the default httpd_accel_surrogate_id
Prevents more posibilities for data leakage by making the default
surrogate ID based on visible_hostname (public FQDN for the proxy).
Now that Surrogate_Capability: header is sent by default in accelerator
environments it makes more sense to default it to a value fairly unique
or at least restricted to that local administrative domain.
When visible_hostname is setup correctly (either automatic or manual)
each stand-alone squid install should have a unique ID. Groups of proxies
sharing work for a domain should also be by default sharing an ID and
thus sharing the override behavior.
When visible_hostname is unavailable it will retain the old default of
'unset-id'.
Amos Jeffries [Sun, 14 Feb 2010 05:36:46 +0000 (18:36 +1300)]
Author: Serassio Guido <serassio@squid-cache.org>
Windows port: Update mswin_check_ad_group to version 2.0
The global groups support was rewritten, now is based on ADSI.
New Features:
- support for Domain Local, Domain Global ad Universal groups
- full group nesting support
This helper, like the previous version, can be compiled only using
Microsoft Visual Studio because some needed library are not available
on MSYS+MinGW or Cygwin.
Amos Jeffries [Sat, 6 Feb 2010 06:32:11 +0000 (19:32 +1300)]
Author: Henrik Nordstrom <hno@squid-cache.org>
Clean up use of httpReplySetHeaders to be consistent across the code, and
remove the unneeded http_version argument.
Amos Jeffries [Fri, 5 Feb 2010 23:27:27 +0000 (12:27 +1300)]
Author: Jean-Gabriel Dick <jean-gabriel.dick@curie.fr>
Bug 1843: multicast-siblings cache_peer option for optimising multicast ICP relations
'multicast-siblings' : this option is meant to be used only for cache peers of
type "multicast". It instructs Squid that ALL members of this multicast group
have "sibling" relationship with it, not "parent". This is an optimization
that avoids useless multicast queries to a multicast group when the requested
object would be fetched only from a "parent" cache, anyway. It's useful, e.g.,
when configuring a pool of redundant Squid proxies, being members of the same
multicast group.
Amos Jeffries [Sun, 31 Jan 2010 06:20:21 +0000 (19:20 +1300)]
Author: Graham Keeling <graham@equiinet.com>
WCCPv1 not connecting to router correctly
I am coming across a problem with WCCPv1...
squid-2.5 connects to UDP port 2048, I get replies, and everything else then works.
squid-3.1 looks like it is trying to connect to UDP port 0 on the cisco.
[and fails to work]
I have looked at the src/wccp.c for squid-2.5, and it is clear that the port is
being set to 2048 for the connection to the router.
I have also looked at the source for 2.6, 2.7 and 3.0 (src/wccp.cc for this
version).
In all those, it appears to be setting the port on the outgoing connection.
Add the http::>ha format code and make http::>h log virgin request headers
This patch:
- Modify the existin "http::>h format code to log HTTP request headers
before any adaptation and redirection
- Add the new format code "http::>ha" which allow the user to log HTTP
request header or header fields after adaptation and redirection.
Amos Jeffries [Thu, 21 Jan 2010 10:01:16 +0000 (23:01 +1300)]
Author: Wolfgang Nothdurft <wolfgang@linogate.de>
Bug 2730: Regressions in follow_x_forwarded_for since Squid-2
Two Major Regressions:
* Omitted testing for trust of the directly connecting client.
this is critical is trusting the header content itself.
The absence permitted remote clients to forge X-Forwarded-For
and gain access to resources through Squid.
(mitigated by the following)
* Bad logic in implementing the trust model resulted in any XFF
headers containing untrusted IPs to be dropped in their entirety.
This resulted in clients transiting more than one proxy heirarchy to
be incorrectly logged and reported in the second.
Some polish alterations to the existing logics:
* Testing the direct client address for trust means the testing must be
fully async 'slow'. Thus avoiding the memory leaks found on occasion.
* acl_uses_indirect_client is not strictly needed to test multiple levels
of X-Forwarded-For properly. The entire list of IPs are now always
tested until on untrusted is found or an ACL failure occurs.
projects / thirdparty / squid.git / log
