- Move the CertItem class from ValidateCertificateResponse class to
CertValidateMessage class
- Add the Ssl::CertValidateMessage::getCertByName method to search
an for a certificate in a std::vector<CertItem> list
- Implement the Ssl::ValidateCertificateResponse::getError to search in
Ssl::ValidateCertificateResponse::errors list for a error
- Improve the Ssl::CertValidateMessage::parseResponse method
- Remove the ValidateCertificateResponse::ErrorItem::certId member. The
user should always link with a certificate, not with an index to certificate.
- The CertValidateMessage::parseResponse takes as argument the list of peer
Certificates. It uses this list to fill the ValidateCertificateResponse
object.
- Return ERR_GATEWAY_FAILURE/HTTP_INTERNAL_SERVER_ERROR error if:
* Failed to compose the Ssl::CertValidateMessage message to sent to
cert validator
* The response from cert validator is wrong
* The cert validator returns an error.
- Implement the FwdState::sslCrtvdCheckForErrors method. This method
checks if the errors returned from cert validator class can be
ignored or an error to the user must returned.
- Now if the Config.ssl_client.cert_error is not used, then the first
error in the list returned from cert validator, is the error which
considered as the error which causes the failure
- Implement the FwdState::sslCrtvdCheckForErrors method. This method
checks if the errors returned from cert validator class can be
ignored or an error to the user must returned.
- Now if the Config.ssl_client.cert_error is not used, then the first
error in the list returned from cert validator, is the error which
considered as the error which causes the failure
Clarified some comments in HttpHeaderFieldStat
Sorted class forward declarations in HTtpHeaderTools
Fixed debug in RequestFlags.cc
Properly indented constructor in RequestFlags.h
class-ified AclAddress
- Remove the ValidateCertificateResponse::ErrorItem::certId member. The
user should always link with a certificate, not with an index to certificate.
- The CertValidateMessage::parseResponse takes as argument the list of peer
Certificates. It uses this list to fill the ValidateCertificateResponse
object.
- Return ERR_GATEWAY_FAILURE/HTTP_INTERNAL_SERVER_ERROR error if:
* Failed to compose the Ssl::CertValidateMessage message to sent to
cert validator
* The response from cert validator is wrong
* The cert validator returns an error.
Complete the task of splitting protos.h into more specific files
Remove inclusion of protos.h from most files
Clean CVS and arch file-tags up
Rework some module initialization code so that it is the callee's task and not the callers' to do feature-enabling
Added ssl-crtd option to the maximus build test
Changed many functions' linkage type from C to C++
Alex Rousskov [Mon, 10 Sep 2012 23:07:01 +0000 (17:07 -0600)]
Do not reuse persistent connections for PUTs to avoid ERR_ZERO_SIZE_OBJECT.
A compliant proxy may retry PUTs, but Squid lacks the [rather complicated]
code required to protect the PUT request body from being nibbled during the
first try or [also tricky] code to send 100-continue expectation requiredto
delay body sending. Thus, Squid cannot safely retry some PUTs today, and
FwdState::checkRetriable() must return false for all PUTs, to avoid
bogus ERR_ZERO_SIZE_OBJECT errors (especially for clients that did not
reuse a pconn and, hence, may not be ready to handle/retry an error response).
In theory, requests with safe or idempotent methods other than PUT might have
bodies so we apply the same logic to them as well.
This reopens Squid bug #3398, undoing trunk r11859 commit which attempted
to close that bug.
Alex Rousskov [Mon, 10 Sep 2012 22:38:09 +0000 (16:38 -0600)]
Do not chunk responses carrying a Content-Range header.
When Squid forwards a response with a Content-Range header,
ClientSocketContext::socketState() detects the end of the response range(s)
and returns STREAM_*COMPLETE to ClientSocketContext::writeComplete().
The latter thinks that the writing of the response to the client must be
over and calls keepaliveNextRequest() instead of writing the last-chunk
(if any). If the to-client response was chunked, the client gets stuck
waiting for that missing last-chunk.
The multipart Range request case was already excluded from chunking (or it
would probably suffer from the same problem). With this change, no
Content-Range responses will be chunked.
N.B. Some servers send Content-Range responses to basic GET requests
without a Range header, so the problem affects more than just Range requests.
TODO: A proper fix would be to rewrite ClientSocketContext::writeComplete()
and other code so that it does not mix internal ClientStream completion with
[possibly chunk-encoded] writing completion. This should probably be done
along with fixing ClientSocketContext::socketState() and other state-checking
code to ignore to-client persistence (flags.proxy_keepalive), which is not
related to the internal ClientStream state.
Implemented some more getters/setters for RequestFlags.
Moved from a preprocessor-backed conditional code to a compiler-backed conditional code for follow-x-forwarded-for
Bug fix: TLS/SSL Options does not apply to the dynamically generated certificates
The TLS/SSL options configured with http_port configuration parameter does not
used to generate SSL_CTX context objects used to establish SSL connections.
This is means that certificate based authentication, or SSL version selection
and other SSL/TLS http_port options does not work for ssl-bumped connection.
This patch fixes this problem.
projects / thirdparty / squid.git / log
