Alex Rousskov [Wed, 7 Jul 2010 00:22:37 +0000 (18:22 -0600)]
Do not stop testheaders.sh on the first error, to be compatible with
"make -k check".
If testheaders.sh stops on the first error, it becomes very difficult to
test your changes with "make check" when somebody else broke some other
code or when the checks reach src/cf_parser.h and fail.
TODO: stop on the first error unless running under "make -k check".
Bundle a slightly hacked version of libltdl/ltdl.h which does not use <>
for inclusion of its dependency files. This makes it portable to OS with
older libtool versions.
Amos Jeffries [Wed, 30 Jun 2010 12:32:50 +0000 (00:32 +1200)]
NTLM helpers cleanup pt 3: migrate libsmbval into libntlmauth
Library changes:
* ntlmauth.* files moved to libntlmauth/
* helpers/ntlm_auth/smb_lm/smbval moved to libntlmauth/
* No behaviour changes. Since I can't test the deeper logics.
Just enough to make the code built with portable types available in Squid
* API shuffled slightly to use less .h and to remove all external uses of
private *-priv.h definitions.
Library now provides three NTLM backend API:
libntlmauth/ntlmauth.h - NTLM packet handling
libntlmauth/smb.h - SMB LM credential validation
libntlmauth/rfcnb.h - RFCNB (NetBIOS) domain server communications
Helper Changes:
* NTLM helpers tweaked slightly to build with the adjusted libntlmauth API
and ntlm_smb_lm_auth helper to build as C++
* automake logics updated to obey --disable-auth and --disable-auth-ntlm
NOTE: There will be extra code safety and testing benefits gained by
converting libntlmauth to C++ as well. But that requries someone who
can test the code behaviour during the upgrade. For now this wil do.
Amos Jeffries [Sun, 27 Jun 2010 08:41:35 +0000 (02:41 -0600)]
Correct deny_info tokens again.
url_presentable was not just enabling URL-encoding.
It restricts the set of tokens to those which produce data usable in
deny_info URLs.
Renamed to building_deny_info_url for clarity of use and added back in the
restrictions on adding protocol dumps and non-existent page names into the
URL.
Robert Collins [Tue, 15 Jun 2010 08:26:43 +0000 (20:26 +1200)]
Bug 2950: HTTP responses with no Date, Last-modified or expired can
now be cached (given an appropriate refresh_pattern). Previously we
were not caching them in case of an infinite loop in cache farms:
however Squid adds Date: headers now which remove that concern.
Amos Jeffries [Tue, 15 Jun 2010 07:18:24 +0000 (01:18 -0600)]
Maintenance: snapshot detect package name and version better.
The old patterns are no longer unique. Were setting the snapshot package
and version variables wrong.
Detect and use the formal PACKAGE_FOO=FOO settings instead now.
Author: Tsantilas Christos <chtsanti@users.sourceforge.net> , Alex Rousskov <rousskov@measurement-factory.com>
Support ICAP 206 Partial Content extension
The ICAP 206 Partial Content extension allows the ICAP agents to optionally
combine adapted and original HTTP message content.
For more information about ICAP Partial Content extension look at the
draft from the ICAP forum:
Amos Jeffries [Mon, 14 Jun 2010 11:33:42 +0000 (23:33 +1200)]
Drop no_check.pl NTLM helper
It was a near duplicate of ntlm_fake_auth. But with some additional
cons:
* predictable challenge nonce (BAD)
* less configurable
* required run-time perl infrastructure.
The original perl code is kept as ntlm_fake_auth.pl.in for now but does
not get built and installed.
Henrik informs that loosp using fd_set() (select and win32-select) must
be kept below FD_SETSIZE or they can hang Squid or cause out-of-bounds
memory errors.
NP: Squid-2 does not appear to limit select() like this. May need fixing too.
Amos Jeffries [Fri, 11 Jun 2010 06:20:24 +0000 (18:20 +1200)]
Upgrade ntlm_fake_auth helper and internal libntlmauth
Fake auth helper changes:
- renames fakeauth to ntlm_fake_auth
- links ntlm_fake_auth to libntlmauth
- removes duplicate code provided by libcompat and libntlmauth
- moves the remaining bits of fakeauth/ntlm.h to ntlm_fake_auth.cc
Library API changes:
- moves some of the basic NTLM operations into libntlmauth
* fetch_string UNICODE support
* make challenge packet
* validate packet type
* make challenge nonce
* unpack user and domain from authenticate packet
- tweaks libntlmauth to split the make challenge operation so that it
only generates the challenge object (does not encode blob for sending,
or hard-code field values any more).
Other related changes:
- tweaks the smb_lm helper which already linked libntlmauth so that it
uses the updated API correctly after the above changes.
- documents libntlmauth and some of ntlm_fake_auth helper
Amos Jeffries [Fri, 11 Jun 2010 05:24:52 +0000 (23:24 -0600)]
Port from 2.7: max_filedescriptor config option
Since Squid no longer really has any hardcoded filedescriptor limitations
it makes sense to have a squid.conf directive allowing the number of
filedescriptors to be tuned runtime. Default if unset is to obey whatever
ulimit settings as before.
setMaxFD: figures out what to we can use for Squid_MaxFD
setSystemLimits: Configures the system limitations to match our
expectations which might be lower than what setMaxFD finds if
the comm loop has additional restrictions
Amos Jeffries [Wed, 2 Jun 2010 13:44:26 +0000 (01:44 +1200)]
Bug 2305: Multiple leaks and assertion crashes in authentication.
* implements proper RefCounting using the RefCount.h classes for
almost all auth objects in Squid.
* Restructures auth objects with a simpler structure of duties and scopes.
* Prunes away several circular and indirectly circular pointer loops
* Adds an API to auth config for handling the mainRotate() event. To only
shutdown helpers, fixing the loss of cached credentials on rotate.
* Adds a username_cache page to cachemgr interface to display the current
credentials and their TTLs to various revalidation or garbage events.
With this we end up with several global pointers for the auth schemes which
have been built into the current Squid. These are RefCount pointers, fixing
the leak of schemes on shutdown. Schemes are now also permanent structures
for the runtime of Squid, fixing leaks on reconfigure and rotate actions.
These AuthSchemes are responsible for creating auth Config objects for each
auth protocol configured in squid.conf. These config objects are now also
able to be altered with a reconfigure instead of requiring a restart.
Each HTTP request authentication attempt generates AuthUserRequest objects,
which may or may not pointer to an AuthUser set of credentials being checked.
AuthUserRequest is RefCounted instead of locked, fixing several assertion
crashes.
AuthUser is now RefCounted instead of locked. It's children inherit
these properties. This simplifies the object handling a lot and fixes
several assertions.
* This also means AuthUser no longer needs a back-pointer to all
AuthUserRequest in order to see if its still needed alive, fixing one
circular lock loop and a few possible assertions.
* The username cache pointers to only AuthUser objects, fixing a second
cirular lock loop and potentially leakage. Also simplifying the hash cache
handling a lot.
Non-Auth code needing a reference to authentication credentials should
hold a pointer to either an AuthUserRequest or AuthUser object. Not any
other auth object.
FUTURE WORK;
There is still some conditions leading to auth re-challenge when they
are not expected.
A fair chunk of classes and enums have been shuffled into separate files
to keep the scopes clearer. This could be increased in future when
building the Auth namespace.
Potential is now present for simpler TTL handling for all auth types.
This work was a collaboration between multiple interested parties over
the last year, with additional developer time and testing funded by
Netspace Online Systems.
Amos Jeffries [Mon, 31 May 2010 09:32:19 +0000 (21:32 +1200)]
Substitute Perl shell path into Basic auth helper scripts
This fixes these helpers by default on OS where the perl shell is not at
/usr/bin/perl. The problem of cross-compiling shell variation remains as
it was before.
Henrik Nordstrom [Sat, 29 May 2010 22:02:54 +0000 (00:02 +0200)]
Rework memory pools
- Default to the old simple non-chunked pool type using malloc
with a simple freelist per pool.
- Various statistics & cachemgr Memory Utilization fixes
- Source reorganisation to split pool implementations from the general
framework. Allocators now in MemPoolChunked.cc and MemPoolMalloc.cc,
with general framework & statistics in MemPool.cc.
The chunked allocator is still available and can be activated by setting
the environment variable MEMPOOLS=1 but the default is now the non-chunked
allocator which has been fixed to account allocations properly for statistics
and also maintain a simple freelist to cache allocations.
No squid.conf changes, other than that the memory_pools and
memory_pools_limit directives now works as intended (not possible
with the chunked allocator).
projects / thirdparty / squid.git / log
