No-lookup DNS ACLs

Currently, dst, dstdom, dstdom_regex (and other?) DNS-related ACLs do DNS
lookups if such a lookup is needed to convert an IP address into a domain name
or vice versa. This creates two kinds of problems:

 - It is difficult to identify requests that use raw IP addresses in Request-URI
   or Host headers. One would have to use something like url_regex and possibly
   req_header to identify those before using dst ACLs to match the request
   destination against a known IP subnet. IPv6 would only make this harder.

 - It is difficult to use dst* ACLs in options that support fast ACLs only.
   If an async lookup is required, the answer will be unpredictable (now)
   or DUNNO (when the ACL bugs are fixed), possibly with warnings and other
   complications.

This patch adds a -n option to dst, dstdom, dstdom_regex and other DNS-related
ACLs. The option disable lookups and address type conversions. If lookup or
conversion is required because the parameter type (IP or domain name) does not
match the message address type (domain name or IP), then the ACL with a -n
option would immediately declare a mismatch without any warnings or lookups.

The "--" option can be used to stop processing all options, in the case the
first acl value has '-' character as first character (for example the '-' is
a valid domain name)

For example:

    # Matches requests with full URI host set to localhost
    # but not requests with full URI host set to 127.0.0.1
    acl toLocalRawName dstdom -n localhost
    http_access allow toLocalRawName

    # Use -- option to stop processing flags
    acl AnACL dst_domain -n -- -cream-and-sugar.tumblr.com

    # Matches requests with full URI host set to 127.0.0.1
    # but not requests with full URI host set to localhost
    acl toLocalRawIp dst -n 127.0.0.1/32
    cache_peer_access peer1 allow toLocalRawIp

Please note that -n prohibits lookups in Squid's DNS caches as well.

This is a Measurement Factory project

diff --git a/src/AclRegs.cc b/src/AclRegs.cc
index c84ff9bef2089f5131b94804d224c64f9f16aca7..fb112f18bae6638bbca82ce45753be2c92deb481 100644 (file)
--- a/src/AclRegs.cc
+++ b/src/AclRegs.cc
@@ -80,10 +80,12 @@
 
 ACL::Prototype ACLBrowser::RegistryProtoype(&ACLBrowser::RegistryEntry_, "browser");
 ACLStrategised<char const *> ACLBrowser::RegistryEntry_(new ACLRegexData, ACLRequestHeaderStrategy<HDR_USER_AGENT>::Instance(), "browser");
+ACLFlag  DestinationDomainFlags[] = {ACL_F_NO_LOOKUP, ACL_F_END};
 ACL::Prototype ACLDestinationDomain::LiteralRegistryProtoype(&ACLDestinationDomain::LiteralRegistryEntry_, "dstdomain");
-ACLStrategised<char const *> ACLDestinationDomain::LiteralRegistryEntry_(new ACLDomainData, ACLDestinationDomainStrategy::Instance(), "dstdomain");
+ACLStrategised<char const *> ACLDestinationDomain::LiteralRegistryEntry_(new ACLDomainData, ACLDestinationDomainStrategy::Instance(), "dstdomain", DestinationDomainFlags);
 ACL::Prototype ACLDestinationDomain::RegexRegistryProtoype(&ACLDestinationDomain::RegexRegistryEntry_, "dstdom_regex");
-ACLStrategised<char const *> ACLDestinationDomain::RegexRegistryEntry_(new ACLRegexData,ACLDestinationDomainStrategy::Instance() ,"dstdom_regex");
+ACLFlag  DestinationDomainRegexFlags[] = {ACL_F_NO_LOOKUP, ACL_F_REGEX_CASE, ACL_F_END};
+ACLStrategised<char const *> ACLDestinationDomain::RegexRegistryEntry_(new ACLRegexData,ACLDestinationDomainStrategy::Instance() ,"dstdom_regex", DestinationDomainRegexFlags);
 ACL::Prototype ACLDestinationIP::RegistryProtoype(&ACLDestinationIP::RegistryEntry_, "dst");
 ACLDestinationIP ACLDestinationIP::RegistryEntry_;
 #if USE_AUTH

diff --git a/src/ConfigParser.cc b/src/ConfigParser.cc
index 7c81e44256aebaae26f8a56db1516c232fcb88a2..ceac61590aedc9f9a8886192456c451aaab8672a 100644 (file)
--- a/src/ConfigParser.cc
+++ b/src/ConfigParser.cc
@@ -38,6 +38,9 @@
 #include "fatal.h"
 #include "globals.h"
 
+char *ConfigParser::lastToken = NULL;
+std::queue<std::string> ConfigParser::undo;
+
 void
 ConfigParser::destruct()
 {
@@ -46,15 +49,38 @@ ConfigParser::destruct()
            cfg_filename, config_lineno, config_input_line);
 }
 
+void
+ConfigParser::strtokFileUndo()
+{
+    assert(lastToken);
+    undo.push(lastToken);
+}
+
+void
+ConfigParser::strtokFilePutBack(const char *tok)
+{
+    assert(tok);
+    undo.push(tok);
+}
+
 char *
 ConfigParser::strtokFile(void)
 {
     static int fromFile = 0;
     static FILE *wordFile = NULL;
+    LOCAL_ARRAY(char, undoToken, CONFIG_LINE_LIMIT);
 
     char *t, *fn;
     LOCAL_ARRAY(char, buf, CONFIG_LINE_LIMIT);
 
+    if (!undo.empty()) {
+        strncpy(undoToken, undo.front().c_str(), sizeof(undoToken));
+        undoToken[sizeof(undoToken) - 1] = '\0';
+        undo.pop();
+        return undoToken;
+    }
+
+    lastToken = NULL;
     do {
 
         if (!fromFile) {
@@ -82,7 +108,7 @@ ConfigParser::strtokFile(void)
 
                 fromFile = 1;
             } else {
-                return t;
+                return lastToken = t;
             }
         }
 
@@ -113,7 +139,7 @@ ConfigParser::strtokFile(void)
         /* skip blank lines */
     } while ( *t == '#' || !*t );
 
-    return t;
+    return lastToken = t;
 }
 
 void

diff --git a/src/ConfigParser.h b/src/ConfigParser.h
index b3d778f3d25435820ad927c1d111c7fbba4240a8..c5807d8f5fafced57eaf19cef350488f06964659 100644 (file)
--- a/src/ConfigParser.h
+++ b/src/ConfigParser.h
@@ -35,6 +35,10 @@
 #define SQUID_CONFIGPARSER_H
 
 #include "SquidString.h"
+#include <queue>
+#if HAVE_STRING
+#include <string>
+#endif
 
 class wordlist;
 /**
@@ -76,6 +80,11 @@ public:
     static const char *QuoteString(String &var);
     static void ParseWordList(wordlist **list);
     static char * strtokFile();
+    static void strtokFileUndo();
+    static void strtokFilePutBack(const char *);
+private:
+    static char *lastToken;
+    static std::queue<std::string> undo;
 };
 
 int parseConfigFile(const char *file_name);

diff --git a/src/acl/Acl.cc b/src/acl/Acl.cc
index 5043159ef8159df56c50b7616bdaea260db6e9c5..68bd743b7938297de639b4e51dc934639a35869e 100644 (file)
--- a/src/acl/Acl.cc
+++ b/src/acl/Acl.cc
@@ -33,14 +33,70 @@
 #include "acl/Acl.h"
 #include "acl/Checklist.h"
 #include "anyp/PortCfg.h"
+#include "cache_cf.h"
 #include "ConfigParser.h"
 #include "Debug.h"
 #include "dlink.h"
 #include "globals.h"
 #include "SquidConfig.h"
 
+const ACLFlag ACLFlags::NoFlags[1] = {ACL_F_END};
+
 const char *AclMatchedName = NULL;
 
+bool ACLFlags::supported(const ACLFlag f) const 
+{
+    if (f == ACL_F_REGEX_CASE)
+        return true;
+    return (supported_.find(f) != std::string::npos); 
+}
+
+void 
+ACLFlags::parseFlags(char * &nextToken)
+{
+    while((nextToken = ConfigParser::strtokFile()) != NULL && nextToken[0] == '-') {
+
+        //if token is the "--" break flag
+        if (strcmp(nextToken, "--") == 0) 
+            break;
+
+        for (const char *flg = nextToken+1; *flg!='\0'; flg++ ) {
+            if (supported(*flg)) {
+                makeSet(*flg);
+            }
+            else {
+                debugs(28, 0, HERE << "Flag '" << *flg << "' not supported");
+                self_destruct();
+            }
+        }
+    }
+
+    /*Regex code needs to parse -i file*/
+    if ( isSet(ACL_F_REGEX_CASE))
+        ConfigParser::strtokFilePutBack("-i");
+
+    if (nextToken != NULL && strcmp(nextToken, "--") != 0 )
+        ConfigParser::strtokFileUndo();
+}
+
+const char *
+ACLFlags::flagsStr() const
+{
+    static char buf[64];
+    if (flags_ == 0)
+        return "";
+
+    char *s = buf;
+    *s++ = '-';
+    for (ACLFlag f = 'A'; f <= 'z'; f++) {
+        // ACL_F_REGEX_CASE (-i) flag handled by ACLRegexData class, ignore
+        if (isSet(f) && f != ACL_F_REGEX_CASE)
+            *s++ = f;
+    }
+    *s = '\0';
+    return buf;
+}
+
 void *
 ACL::operator new (size_t byteCount)
 {
@@ -180,6 +236,9 @@ ACL::ParseAclLine(ConfigParser &parser, ACL ** head)
      */
     AclMatchedName = A->name;  /* ugly */
 
+    char *aTok;
+    A->flags.parseFlags(aTok);
+
     /*split the function here */
     A->parse();
 
@@ -425,8 +484,11 @@ ACL::Prototype::Factory (char const *typeToClone)
     debugs(28, 4, "ACL::Prototype::Factory: cloning an object for type '" << typeToClone << "'");
 
     for (iterator i = Registry->begin(); i != Registry->end(); ++i)
-        if (!strcmp (typeToClone, (*i)->typeString))
-            return (*i)->prototype->clone();
+        if (!strcmp (typeToClone, (*i)->typeString)) {
+            ACL *A = (*i)->prototype->clone();
+            A->flags = (*i)->prototype->flags;
+            return A;
+        }
 
     debugs(28, 4, "ACL::Prototype::Factory: cloning failed, no type '" << typeToClone << "' available");
 

diff --git a/src/acl/Acl.h b/src/acl/Acl.h
index 8919e51d57aa48f26d238afbf52b7b6111ad3f43..0727ef9c9e36f05596ea877cfece801560c6fe7b 100644 (file)
--- a/src/acl/Acl.h
+++ b/src/acl/Acl.h
@@ -42,11 +42,54 @@
 #if HAVE_OSTREAM
 #include <ostream>
 #endif
+#if HAVE_STRING
+#include <string>
+#endif
 
 class ConfigParser;
 class ACLChecklist;
 class ACLList;
 
+typedef char ACLFlag;
+// ACLData Flags
+#define ACL_F_REGEX_CASE 'i'
+#define ACL_F_NO_LOOKUP 'n'
+#define ACL_F_END '\0'
+
+/**
+ * \ingroup ACLAPI
+ * Used to hold a list of one-letter flags which can be passed as parameters
+ * to acls  (eg '-i', '-n' etc)
+ */
+class ACLFlags
+{
+public:
+    explicit ACLFlags(const ACLFlag flags[]) : supported_(flags), flags_(0) {}
+    ACLFlags() : flags_(0) {}
+    bool supported(const ACLFlag f) const; ///< True if the given flag supported
+    void makeSet(const ACLFlag f) { flags_ |= flagToInt(f); } ///< Set the given flag
+    /// Return true if the given flag is set
+    bool isSet(const ACLFlag f) const { return flags_ & flagToInt(f);}
+    /// Parse a flags given in the form -[A..Z|a..z]
+    void parseFlags(char * &nextToken);
+    const char *flagsStr() const; ///< Convert the flags to a string representation
+
+private:
+    /// Convert a flag to a 64bit unsigned integer.
+    /// The characters from 'A' to 'z' represented by the values from 65 to 122.
+    /// They are 57 different characters which can be fit to the bits of an 64bit 
+    /// integer.
+    uint64_t flagToInt(const ACLFlag f) const {
+        assert('A' <= f && f <= 'z');
+        return ((uint64_t)1 << (f - 'A'));
+    }
+
+    std::string supported_; ///< The supported character flags
+    uint64_t flags_; ///< The flags which is set
+public:
+    static const ACLFlag NoFlags[1]; ///< An empty flags list
+};
+
 /// \ingroup ACLAPI
 class ACL
 {
@@ -61,6 +104,7 @@ public:
     static ACL* FindByName(const char *name);
 
     ACL();
+    explicit ACL(const ACLFlag flgs[]) : cfgline(NULL), flags(flgs){}
     virtual ~ACL();
     virtual ACL *clone()const = 0;
     virtual void parse() = 0;
@@ -82,6 +126,7 @@ public:
     char name[ACL_NAME_SZ];
     char *cfgline;
     ACL *next;
+    ACLFlags flags; ///< The list of given ACL flags
 
 public:
 

diff --git a/src/acl/Asn.cc b/src/acl/Asn.cc
index f2ba6236509fd40c79663e1cf248b6b54e7084d2..b799c9ef24aed8c14980331a88ebc8201ed58a36 100644 (file)
--- a/src/acl/Asn.cc
+++ b/src/acl/Asn.cc
@@ -609,7 +609,7 @@ ACL::Prototype ACLASN::DestinationRegistryProtoype(&ACLASN::DestinationRegistryE
 ACLStrategised<Ip::Address> ACLASN::DestinationRegistryEntry_(new ACLASN, ACLDestinationASNStrategy::Instance(), "dst_as");
 
 int
-ACLSourceASNStrategy::match (ACLData<Ip::Address> * &data, ACLFilledChecklist *checklist)
+ACLSourceASNStrategy::match (ACLData<Ip::Address> * &data, ACLFilledChecklist *checklist, ACLFlags &)
 {
     return data->match(checklist->src_addr);
 }
@@ -623,7 +623,7 @@ ACLSourceASNStrategy::Instance()
 ACLSourceASNStrategy ACLSourceASNStrategy::Instance_;
 
 int
-ACLDestinationASNStrategy::match (ACLData<MatchType> * &data, ACLFilledChecklist *checklist)
+ACLDestinationASNStrategy::match (ACLData<MatchType> * &data, ACLFilledChecklist *checklist, ACLFlags &)
 {
     const ipcache_addrs *ia = ipcache_gethostbyname(checklist->request->GetHost(), IP_LOOKUP_IF_MISS);
 

diff --git a/src/acl/Certificate.cc b/src/acl/Certificate.cc
index ad39cfc0b8af34f94a57ccfd27195f80cf69bf7a..16b0ca997d16515b14e958ffcdef148a34ff5fbf 100644 (file)
--- a/src/acl/Certificate.cc
+++ b/src/acl/Certificate.cc
@@ -48,7 +48,7 @@
 #include "globals.h"
 
 int
-ACLCertificateStrategy::match (ACLData<MatchType> * &data, ACLFilledChecklist *checklist)
+ACLCertificateStrategy::match (ACLData<MatchType> * &data, ACLFilledChecklist *checklist, ACLFlags &)
 {
     const int fd = checklist->fd();
     const bool goodDescriptor = 0 <= fd && fd <= Biggest_FD;

diff --git a/src/acl/Certificate.h b/src/acl/Certificate.h
index 56db4fb800620034c7264d51f6899d9c47f2d4ab..b9d0d0da16f7afd66825b09b5fd1e8625ca9b239 100644 (file)
--- a/src/acl/Certificate.h
+++ b/src/acl/Certificate.h
@@ -44,7 +44,7 @@ class ACLCertificateStrategy : public ACLStrategy<X509 *>
 {
 
 public:
-    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *);
+    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *, ACLFlags &);
     static ACLCertificateStrategy *Instance();
     /* Not implemented to prevent copies of the instance. */
     /* Not private to prevent brain dead g+++ warnings about

diff --git a/src/acl/DestinationAsn.h b/src/acl/DestinationAsn.h
index 1df42699e223a6129ddf06f9514fe417630d4a55..078b82a9fdd491e072eec82b507d41774cb2d234 100644 (file)
--- a/src/acl/DestinationAsn.h
+++ b/src/acl/DestinationAsn.h
@@ -41,7 +41,7 @@ class ACLDestinationASNStrategy : public ACLStrategy<Ip::Address>
 {
 
 public:
-    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *);
+    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *, ACLFlags &);
     virtual bool requiresRequest() const {return true;}
 
     static ACLDestinationASNStrategy *Instance();

diff --git a/src/acl/DestinationDomain.cc b/src/acl/DestinationDomain.cc
index bcc4aef3d216670449571dd83828cf70cbe87b0e..82c1e3dea1134d1351ee2c9c6532a02d15021da6 100644 (file)
--- a/src/acl/DestinationDomain.cc
+++ b/src/acl/DestinationDomain.cc
@@ -71,7 +71,7 @@ DestinationDomainLookup::LookupDone(const char *fqdn, const DnsLookupDetails &de
 }
 
 int
-ACLDestinationDomainStrategy::match (ACLData<MatchType> * &data, ACLFilledChecklist *checklist)
+ACLDestinationDomainStrategy::match (ACLData<MatchType> * &data, ACLFilledChecklist *checklist, ACLFlags &flags)
 {
     assert(checklist != NULL && checklist->request != NULL);
 
@@ -79,6 +79,11 @@ ACLDestinationDomainStrategy::match (ACLData<MatchType> * &data, ACLFilledCheckl
         return 1;
     }
 
+    if (flags.isSet(ACL_F_NO_LOOKUP)) {
+        debugs(28, 3, "aclMatchAcl:  No-lookup DNS ACL '" << AclMatchedName << "' for '" << checklist->request->GetHost() << "'");
+        return 0;
+    }
+
     /* numeric IPA? no, trust the above result. */
     if (checklist->request->GetHostIsNumeric() == 0) {
         return 0;

diff --git a/src/acl/DestinationDomain.h b/src/acl/DestinationDomain.h
index 05c09be3358bccba86fe31f8a9e842d30bff8d54..d772521fd6e58adffe04c400730eebf476127b91 100644 (file)
--- a/src/acl/DestinationDomain.h
+++ b/src/acl/DestinationDomain.h
@@ -43,7 +43,7 @@ class ACLDestinationDomainStrategy : public ACLStrategy<char const *>
 {
 
 public:
-    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *);
+    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *, ACLFlags &);
     static ACLDestinationDomainStrategy *Instance();
     virtual bool requiresRequest() const {return true;}
 

diff --git a/src/acl/DestinationIp.cc b/src/acl/DestinationIp.cc
index 721fc0dd32783489fb6b161f3d1cde85534f2d79..2dfc602ea37bdaf22ef32db675fcf0fcffbb418f 100644 (file)
--- a/src/acl/DestinationIp.cc
+++ b/src/acl/DestinationIp.cc
@@ -39,6 +39,8 @@
 #include "HttpRequest.h"
 #include "SquidConfig.h"
 
+ACLFlag ACLDestinationIP::SupportedFlags[] = {ACL_F_NO_LOOKUP, ACL_F_END};
+
 char const *
 ACLDestinationIP::typeString() const
 {
@@ -59,6 +61,17 @@ ACLDestinationIP::match(ACLChecklist *cl)
         return ACLIP::match(checklist->conn()->clientConnection->local);
     }
 
+    if (flags.isSet(ACL_F_NO_LOOKUP)) {
+        if (!checklist->request->GetHostIsNumeric()) {
+            debugs(28, 3, "aclMatchAcl:  No-lookup DNS ACL '" << AclMatchedName << "' for '" << checklist->request->GetHost() << "'");
+            return 0;
+        }
+
+        if(ACLIP::match(checklist->request->host_addr))
+            return 1;
+        return 0;
+    }
+
     const ipcache_addrs *ia = ipcache_gethostbyname(checklist->request->GetHost(), IP_LOOKUP_IF_MISS);
 
     if (ia) {

diff --git a/src/acl/DestinationIp.h b/src/acl/DestinationIp.h
index 24521a44a3902de34d841d39f42eab51c381488c..f58cf3ffd52db4e204305ced337e6c128baf6c48 100644 (file)
--- a/src/acl/DestinationIp.h
+++ b/src/acl/DestinationIp.h
@@ -55,12 +55,14 @@ class ACLDestinationIP : public ACLIP
 public:
     MEMPROXY_CLASS(ACLDestinationIP);
 
+    ACLDestinationIP(): ACLIP(ACLDestinationIP::SupportedFlags) {}
     virtual char const *typeString() const;
     virtual int match(ACLChecklist *checklist);
     virtual bool requiresRequest() const {return true;}
 
     virtual ACL *clone()const;
 
+    static ACLFlag SupportedFlags[];
 private:
     static Prototype RegistryProtoype;
     static ACLDestinationIP RegistryEntry_;

diff --git a/src/acl/HierCode.cc b/src/acl/HierCode.cc
index 3072ca4e19576812239726c437607a990292029e..c691e78e51d3ac54df44fe26c2ab359623a504ac 100644 (file)
--- a/src/acl/HierCode.cc
+++ b/src/acl/HierCode.cc
@@ -9,7 +9,7 @@
 template class ACLStrategised<hier_code>;
 
 int
-ACLHierCodeStrategy::match (ACLData<MatchType> * &data, ACLFilledChecklist *checklist)
+ACLHierCodeStrategy::match (ACLData<MatchType> * &data, ACLFilledChecklist *checklist, ACLFlags &)
 {
     return data->match (checklist->request->hier.code);
 }

diff --git a/src/acl/HierCode.h b/src/acl/HierCode.h
index 60661e7f76b0503400e8ce3b85d22a1b70bf3d86..ac9aac8d2a222a6e216fd88a882f8afe2951afdc 100644 (file)
--- a/src/acl/HierCode.h
+++ b/src/acl/HierCode.h
@@ -10,7 +10,7 @@ class ACLHierCodeStrategy : public ACLStrategy<hier_code>
 {
 
 public:
-    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *);
+    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *, ACLFlags &);
     virtual bool requiresRequest() const {return true;}
 
     static ACLHierCodeStrategy *Instance();

diff --git a/src/acl/HttpRepHeader.cc b/src/acl/HttpRepHeader.cc
index 58fe358377289584b604f5f59744750f697df537..d14daa29085c409c76b2c599b0c4404a532a0a30 100644 (file)
--- a/src/acl/HttpRepHeader.cc
+++ b/src/acl/HttpRepHeader.cc
@@ -38,7 +38,7 @@
 #include "HttpReply.h"
 
 int
-ACLHTTPRepHeaderStrategy::match (ACLData<MatchType> * &data, ACLFilledChecklist *checklist)
+ACLHTTPRepHeaderStrategy::match (ACLData<MatchType> * &data, ACLFilledChecklist *checklist, ACLFlags &)
 {
     return data->match (&checklist->reply->header);
 }

diff --git a/src/acl/HttpRepHeader.h b/src/acl/HttpRepHeader.h
index d40108dcd78b7741cb5a2db5f778a91310f690f1..1f019058a5f0677b4877855994729a91574a0de2 100644 (file)
--- a/src/acl/HttpRepHeader.h
+++ b/src/acl/HttpRepHeader.h
@@ -42,7 +42,7 @@ class ACLHTTPRepHeaderStrategy : public ACLStrategy<HttpHeader*>
 {
 
 public:
-    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *);
+    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *, ACLFlags &);
     virtual bool requiresReply() const { return true; }
 
     static ACLHTTPRepHeaderStrategy *Instance();

diff --git a/src/acl/HttpReqHeader.cc b/src/acl/HttpReqHeader.cc
index 043464e4d997cf41546a589a99096d5372f7bf32..49c701b04da6844b720b2ed0aa91a46320b59bdf 100644 (file)
--- a/src/acl/HttpReqHeader.cc
+++ b/src/acl/HttpReqHeader.cc
@@ -38,7 +38,7 @@
 #include "HttpRequest.h"
 
 int
-ACLHTTPReqHeaderStrategy::match (ACLData<MatchType> * &data, ACLFilledChecklist *checklist)
+ACLHTTPReqHeaderStrategy::match (ACLData<MatchType> * &data, ACLFilledChecklist *checklist, ACLFlags &)
 {
     return data->match (&checklist->request->header);
 }

diff --git a/src/acl/HttpReqHeader.h b/src/acl/HttpReqHeader.h
index 584a2904ddfe441c3298067447c4a74aa40d6e9b..e805207ebe149f79c550cd9f664ce86eadc7a870 100644 (file)
--- a/src/acl/HttpReqHeader.h
+++ b/src/acl/HttpReqHeader.h
@@ -42,7 +42,7 @@ class ACLHTTPReqHeaderStrategy : public ACLStrategy<HttpHeader*>
 {
 
 public:
-    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *);
+    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *, ACLFlags &);
     virtual bool requiresRequest() const { return true; }
 
     static ACLHTTPReqHeaderStrategy *Instance();

diff --git a/src/acl/Ip.cc b/src/acl/Ip.cc
index 578fca96281bcfb016511b460cd81fb7688e7298..9d599ea5ad4d80a1c8f003c0d2440ad7b192a07f 100644 (file)
--- a/src/acl/Ip.cc
+++ b/src/acl/Ip.cc
@@ -509,7 +509,12 @@ ACLIP::parse()
 {
     char *t = NULL;
 
-    while ((t = strtokFile())) {
+    flags.parseFlags(t);
+
+    if (!t)
+        return;
+
+    do {
         acl_ip_data *q = acl_ip_data::FactoryParse(t);
 
         while (q != NULL) {
@@ -519,7 +524,7 @@ ACLIP::parse()
             data = data->insert(q, acl_ip_data::NetworkCompare);
             q = next_node;
         }
-    }
+    } while ((t = strtokFile()));
 }
 
 ACLIP::~ACLIP()

diff --git a/src/acl/Ip.h b/src/acl/Ip.h
index ce75d397b032552b155aaf352d380a506a35a52c..49f8f0031815868b48f0988d472f728611838063 100644 (file)
--- a/src/acl/Ip.h
+++ b/src/acl/Ip.h
@@ -33,6 +33,7 @@
 #define SQUID_ACLIP_H
 
 #include "acl/Acl.h"
+#include "acl/Data.h"
 #include "splay.h"
 #include "ip/Address.h"
 
@@ -74,6 +75,7 @@ public:
     void operator delete(void *);
 
     ACLIP() : data(NULL) {}
+    explicit ACLIP(const ACLFlag flgs[]) : ACL(flgs), data(NULL) {}
 
     ~ACLIP();
 

diff --git a/src/acl/LocalPort.cc b/src/acl/LocalPort.cc
index 269f01a0e70cd0a832e041289d93ed4a6c48c904..7b22577e7e3fd208f10c754ad6b4db530c0ca6f4 100644 (file)
--- a/src/acl/LocalPort.cc
+++ b/src/acl/LocalPort.cc
@@ -37,7 +37,7 @@
 #include "acl/Checklist.h"
 
 int
-ACLLocalPortStrategy::match (ACLData<MatchType> * &data, ACLFilledChecklist *checklist)
+ACLLocalPortStrategy::match (ACLData<MatchType> * &data, ACLFilledChecklist *checklist, ACLFlags &)
 {
     return data->match (checklist->my_addr.GetPort());
 }

diff --git a/src/acl/LocalPort.h b/src/acl/LocalPort.h
index 2041d14d3335d562c9d9e3eb33434a4571950553..dd57aa03eaec554a1ca197266ae5e60395cf70ce 100644 (file)
--- a/src/acl/LocalPort.h
+++ b/src/acl/LocalPort.h
@@ -41,7 +41,7 @@ class ACLLocalPortStrategy : public ACLStrategy<int>
 {
 
 public:
-    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *);
+    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *, ACLFlags &);
     static ACLLocalPortStrategy *Instance();
     /**
      * Not implemented to prevent copies of the instance.

diff --git a/src/acl/Method.cc b/src/acl/Method.cc
index 534080e406c8225370ea363879aecb1bf802ee53..08fd2eeb58dcf994e2a4b35cfbc8df7a1bdae813 100644 (file)
--- a/src/acl/Method.cc
+++ b/src/acl/Method.cc
@@ -42,7 +42,7 @@
 template class ACLStrategised<HttpRequestMethod>;
 
 int
-ACLMethodStrategy::match (ACLData<MatchType> * &data, ACLFilledChecklist *checklist)
+ACLMethodStrategy::match (ACLData<MatchType> * &data, ACLFilledChecklist *checklist, ACLFlags &)
 {
     return data->match (checklist->request->method);
 }

diff --git a/src/acl/Method.h b/src/acl/Method.h
index 43c492747a3843614c544a8634b91a3bd8cf1070..96ade28de3f782390a5f0957593c074a30e1cb3e 100644 (file)
--- a/src/acl/Method.h
+++ b/src/acl/Method.h
@@ -42,7 +42,7 @@ class ACLMethodStrategy : public ACLStrategy<HttpRequestMethod>
 {
 
 public:
-    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *);
+    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *, ACLFlags &);
     virtual bool requiresRequest() const {return true;}
 
     static ACLMethodStrategy *Instance();

diff --git a/src/acl/MyPortName.cc b/src/acl/MyPortName.cc
index 860b4d2c2a9c559d24d4f33e31f8775d50b4747d..f2d5ebb92cfb54c62bf3d3cab2a611a1fe38fcf0 100644 (file)
--- a/src/acl/MyPortName.cc
+++ b/src/acl/MyPortName.cc
@@ -42,7 +42,7 @@
 #include "client_side.h"
 
 int
-ACLMyPortNameStrategy::match(ACLData<MatchType> * &data, ACLFilledChecklist *checklist)
+ACLMyPortNameStrategy::match(ACLData<MatchType> * &data, ACLFilledChecklist *checklist, ACLFlags &)
 {
     if (checklist->conn() != NULL)
         return data->match(checklist->conn()->port->name);

diff --git a/src/acl/MyPortName.h b/src/acl/MyPortName.h
index a7eed13c8ccc384775d7f34c36aa99c4cac323ae..9890d5a38120618729728edcf4f5c9670f92dedc 100644 (file)
--- a/src/acl/MyPortName.h
+++ b/src/acl/MyPortName.h
@@ -40,7 +40,7 @@ class ACLMyPortNameStrategy : public ACLStrategy<const char *>
 {
 
 public:
-    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *);
+    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *, ACLFlags &);
     static ACLMyPortNameStrategy *Instance();
     /* Not implemented to prevent copies of the instance. */
     /* Not private to prevent brain dead g+++ warnings about

diff --git a/src/acl/PeerName.cc b/src/acl/PeerName.cc
index 52eed518891484e9c4fac1b62fe7c3816e828daa..a3c36eb2d03f147cc88b6fefceb440a8bdbb3210 100644 (file)
--- a/src/acl/PeerName.cc
+++ b/src/acl/PeerName.cc
@@ -6,7 +6,7 @@
 #include "CachePeer.h"
 
 int
-ACLPeerNameStrategy::match (ACLData<MatchType> * &data, ACLFilledChecklist *checklist)
+ACLPeerNameStrategy::match (ACLData<MatchType> * &data, ACLFilledChecklist *checklist, ACLFlags &)
 {
     if (checklist->dst_peer != NULL && checklist->dst_peer->name != NULL)
         return data->match(checklist->dst_peer->name);

diff --git a/src/acl/PeerName.h b/src/acl/PeerName.h
index 3e646c1955f896fc9f6f391a15a191862216c57e..84c23ee6fa836e095b7e1ff42a692ac0bdd7db9c 100644 (file)
--- a/src/acl/PeerName.h
+++ b/src/acl/PeerName.h
@@ -8,7 +8,7 @@ class ACLPeerNameStrategy : public ACLStrategy<const char *>
 {
 
 public:
-    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *);
+    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *, ACLFlags &);
     static ACLPeerNameStrategy *Instance();
     /* Not implemented to prevent copies of the instance. */
     /* Not private to prevent brain dead g+++ warnings about

diff --git a/src/acl/Protocol.cc b/src/acl/Protocol.cc
index 9cd806585ad3e3f86824e169a5bb6bb1263126be..067977b9f8132727638c46e971994e880efa4b06 100644 (file)
--- a/src/acl/Protocol.cc
+++ b/src/acl/Protocol.cc
@@ -42,7 +42,7 @@
 template class ACLStrategised<AnyP::ProtocolType>;
 
 int
-ACLProtocolStrategy::match (ACLData<MatchType> * &data, ACLFilledChecklist *checklist)
+ACLProtocolStrategy::match (ACLData<MatchType> * &data, ACLFilledChecklist *checklist, ACLFlags &)
 {
     return data->match (checklist->request->protocol);
 }

diff --git a/src/acl/Protocol.h b/src/acl/Protocol.h
index 74a02c62cd69746dac70ed6b992eb27e3c1700b9..d2aea168b4bad2c2b0996feaa254e16897d90595 100644 (file)
--- a/src/acl/Protocol.h
+++ b/src/acl/Protocol.h
@@ -42,7 +42,7 @@ class ACLProtocolStrategy : public ACLStrategy<AnyP::ProtocolType>
 {
 
 public:
-    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *);
+    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *, ACLFlags &);
     virtual bool requiresRequest() const {return true;}
 
     static ACLProtocolStrategy *Instance();

diff --git a/src/acl/ReplyHeaderStrategy.h b/src/acl/ReplyHeaderStrategy.h
index b8670a3931fb3ff797e6e0ca2d14ec785c7c0f2e..857b7d9d3fe1d88dd144061cc0a4aea44fefddd2 100644 (file)
--- a/src/acl/ReplyHeaderStrategy.h
+++ b/src/acl/ReplyHeaderStrategy.h
@@ -45,7 +45,7 @@ class ACLReplyHeaderStrategy : public ACLStrategy<char const *>
 {
 
 public:
-    virtual int match (ACLData<char const *> * &, ACLFilledChecklist *);
+    virtual int match (ACLData<char const *> * &, ACLFilledChecklist *, ACLFlags &);
     virtual bool requiresReply() const {return true;}
 
     static ACLReplyHeaderStrategy *Instance();
@@ -63,7 +63,7 @@ private:
 
 template <http_hdr_type header>
 int
-ACLReplyHeaderStrategy<header>::match (ACLData<char const *> * &data, ACLFilledChecklist *checklist)
+ACLReplyHeaderStrategy<header>::match (ACLData<char const *> * &data, ACLFilledChecklist *checklist, ACLFlags &)
 {
     char const *theHeader = checklist->reply->header.getStr(header);
 

diff --git a/src/acl/ReplyMimeType.h b/src/acl/ReplyMimeType.h
index 3a110d550955971d278fe38c34e9c7a9b38ecb8e..cec43f710693a13a3e5defe4469e1e3398334f8b 100644 (file)
--- a/src/acl/ReplyMimeType.h
+++ b/src/acl/ReplyMimeType.h
@@ -51,7 +51,7 @@ private:
 
 template <>
 inline int
-ACLReplyHeaderStrategy<HDR_CONTENT_TYPE>::match(ACLData<char const *> * &data, ACLFilledChecklist *checklist)
+ACLReplyHeaderStrategy<HDR_CONTENT_TYPE>::match(ACLData<char const *> * &data, ACLFilledChecklist *checklist, ACLFlags &)
 {
     char const *theHeader = checklist->reply->header.getStr(HDR_CONTENT_TYPE);
 

diff --git a/src/acl/RequestHeaderStrategy.h b/src/acl/RequestHeaderStrategy.h
index 4304867dcece79a323f1b387e2275b4433aa3216..7d2c71890972deb205ec0ed4349f7330dd5ac0db 100644 (file)
--- a/src/acl/RequestHeaderStrategy.h
+++ b/src/acl/RequestHeaderStrategy.h
@@ -45,7 +45,7 @@ class ACLRequestHeaderStrategy : public ACLStrategy<char const *>
 {
 
 public:
-    virtual int match (ACLData<char const *> * &, ACLFilledChecklist *);
+    virtual int match (ACLData<char const *> * &, ACLFilledChecklist *, ACLFlags &);
     virtual bool requiresRequest() const {return true;}
 
     static ACLRequestHeaderStrategy *Instance();
@@ -63,7 +63,7 @@ private:
 
 template <http_hdr_type header>
 int
-ACLRequestHeaderStrategy<header>::match (ACLData<char const *> * &data, ACLFilledChecklist *checklist)
+ACLRequestHeaderStrategy<header>::match (ACLData<char const *> * &data, ACLFilledChecklist *checklist, ACLFlags &)
 {
     char const *theHeader = checklist->request->header.getStr(header);
 

diff --git a/src/acl/RequestMimeType.h b/src/acl/RequestMimeType.h
index 87caf4a773c4be37cd25875714cdf8e115c9440b..2859370839498e5b412e567077c87600671be1c2 100644 (file)
--- a/src/acl/RequestMimeType.h
+++ b/src/acl/RequestMimeType.h
@@ -51,7 +51,7 @@ private:
 
 template <>
 inline int
-ACLRequestHeaderStrategy<HDR_CONTENT_TYPE>::match (ACLData<char const *> * &data, ACLFilledChecklist *checklist)
+ACLRequestHeaderStrategy<HDR_CONTENT_TYPE>::match (ACLData<char const *> * &data, ACLFilledChecklist *checklist, ACLFlags &)
 {
     char const *theHeader = checklist->request->header.getStr(HDR_CONTENT_TYPE);
 

diff --git a/src/acl/ServerCertificate.cc b/src/acl/ServerCertificate.cc
index 29e43450e72633984c7decda4a1af9a76335ec1e..f87189a6389249c3678f2fcc2911b0a5f2e517cc 100644 (file)
--- a/src/acl/ServerCertificate.cc
+++ b/src/acl/ServerCertificate.cc
@@ -13,7 +13,7 @@
 #include "ssl/ServerBump.h"
 
 int
-ACLServerCertificateStrategy::match(ACLData<MatchType> * &data, ACLFilledChecklist *checklist)
+ACLServerCertificateStrategy::match(ACLData<MatchType> * &data, ACLFilledChecklist *checklist, ACLFlags &)
 {
     X509 *cert = NULL;
     if (checklist->serverCert.get())

diff --git a/src/acl/ServerCertificate.h b/src/acl/ServerCertificate.h
index 84e245d3e14036a6ca94fc448ac13661f3e5f78b..e32cda36691a54e14138051f5c001607d3ff3ced 100644 (file)
--- a/src/acl/ServerCertificate.h
+++ b/src/acl/ServerCertificate.h
@@ -14,7 +14,7 @@
 class ACLServerCertificateStrategy : public ACLStrategy<X509 *>
 {
 public:
-    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *);
+    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *, ACLFlags &);
     static ACLServerCertificateStrategy *Instance();
     /* Not implemented to prevent copies of the instance. */
     /* Not private to prevent brain dead g+++ warnings about

diff --git a/src/acl/SourceAsn.h b/src/acl/SourceAsn.h
index 89c335e6fbb23325bd8b3884d8dd6334e4f9ecb3..448709b2633ebfb9f2ccd75f158c09888c4ae724 100644 (file)
--- a/src/acl/SourceAsn.h
+++ b/src/acl/SourceAsn.h
@@ -44,7 +44,7 @@ class ACLSourceASNStrategy : public ACLStrategy<Ip::Address>
 {
 
 public:
-    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *);
+    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *, ACLFlags &);
     static ACLSourceASNStrategy *Instance();
     /* Not implemented to prevent copies of the instance. */
     /* Not private to prevent brain dead g+++ warnings about

diff --git a/src/acl/SourceDomain.cc b/src/acl/SourceDomain.cc
index d4bc7af22eed02541780bbf4a81f289c9668ae17..dced292ccf341db356927c46aa61100b0e563c06 100644 (file)
--- a/src/acl/SourceDomain.cc
+++ b/src/acl/SourceDomain.cc
@@ -69,7 +69,7 @@ SourceDomainLookup::LookupDone(const char *fqdn, const DnsLookupDetails &details
 }
 
 int
-ACLSourceDomainStrategy::match (ACLData<MatchType> * &data, ACLFilledChecklist *checklist)
+ACLSourceDomainStrategy::match (ACLData<MatchType> * &data, ACLFilledChecklist *checklist, ACLFlags &)
 {
     const char *fqdn = NULL;
     fqdn = fqdncache_gethostbyaddr(checklist->src_addr, FQDN_LOOKUP_IF_MISS);

diff --git a/src/acl/SourceDomain.h b/src/acl/SourceDomain.h
index f800b79fd775f4b442e81d863d9af3ae189f7c3f..8e82857419787f4165e4c0bcd596aa1fbb3bee1a 100644 (file)
--- a/src/acl/SourceDomain.h
+++ b/src/acl/SourceDomain.h
@@ -42,7 +42,7 @@ class ACLSourceDomainStrategy : public ACLStrategy<char const *>
 {
 
 public:
-    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *);
+    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *, ACLFlags &);
     static ACLSourceDomainStrategy *Instance();
     /* Not implemented to prevent copies of the instance. */
     /* Not private to prevent brain dead g+++ warnings about

diff --git a/src/acl/SslError.cc b/src/acl/SslError.cc
index 95506d5a4ccded92a194241bed2e4d23cf666e2a..6eae03e67b599d0ac22049c9bc8b014d71912c35 100644 (file)
--- a/src/acl/SslError.cc
+++ b/src/acl/SslError.cc
@@ -4,7 +4,7 @@
 #include "acl/Checklist.h"
 
 int
-ACLSslErrorStrategy::match (ACLData<MatchType> * &data, ACLFilledChecklist *checklist)
+ACLSslErrorStrategy::match (ACLData<MatchType> * &data, ACLFilledChecklist *checklist, ACLFlags &)
 {
     return data->match (checklist->sslErrors);
 }

diff --git a/src/acl/SslError.h b/src/acl/SslError.h
index e7ae0ba6bb1f7b1576bd6a1921576dbfb0223bd3..c6b5b2564983fbe3ed144301832cbf271ee1e97b 100644 (file)
--- a/src/acl/SslError.h
+++ b/src/acl/SslError.h
@@ -8,7 +8,7 @@ class ACLSslErrorStrategy : public ACLStrategy<const Ssl::Errors *>
 {
 
 public:
-    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *);
+    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *, ACLFlags &);
     static ACLSslErrorStrategy *Instance();
     /* Not implemented to prevent copies of the instance. */
     /* Not private to prevent brain dead g+++ warnings about

diff --git a/src/acl/Strategised.h b/src/acl/Strategised.h
index 76e2558bdd28d3f623174557bfc282e4a3760971..971cc62a5c9df3c33a18c770b4669b40a568ce39 100644 (file)
--- a/src/acl/Strategised.h
+++ b/src/acl/Strategised.h
@@ -49,7 +49,7 @@ public:
     void operator delete(void *);
 
     ~ACLStrategised();
-    ACLStrategised(ACLData<MatchType> *, ACLStrategy<MatchType> *, char const *);
+    ACLStrategised(ACLData<MatchType> *, ACLStrategy<MatchType> *, char const *, const ACLFlag flags[] = ACLFlags::NoFlags);
     ACLStrategised (ACLStrategised const &);
     ACLStrategised &operator= (ACLStrategised const &);
 
@@ -107,7 +107,7 @@ ACLStrategised<MatchType>::~ACLStrategised()
 }
 
 template <class MatchType>
-ACLStrategised<MatchType>::ACLStrategised(ACLData<MatchType> *newData, ACLStrategy<MatchType> *theStrategy, char const *theType) : data (newData), type_(theType), matcher(theStrategy) {}
+ACLStrategised<MatchType>::ACLStrategised(ACLData<MatchType> *newData, ACLStrategy<MatchType> *theStrategy, char const *theType, const ACLFlag flgs[]) : ACL(flgs), data (newData), type_(theType), matcher(theStrategy) {}
 
 template <class MatchType>
 ACLStrategised<MatchType>::ACLStrategised (ACLStrategised const &old) : data (old.data->clone()), type_(old.type_), matcher (old.matcher)
@@ -150,7 +150,7 @@ ACLStrategised<MatchType>::match(ACLChecklist *cl)
 {
     ACLFilledChecklist *checklist = dynamic_cast<ACLFilledChecklist*>(cl);
     assert(checklist);
-    return matcher->match(data, checklist);
+    return matcher->match(data, checklist, flags);
 }
 
 template <class MatchType>

diff --git a/src/acl/Strategy.h b/src/acl/Strategy.h
index 10565ba269fefc8b8802cfd68a8da2ea3d75d7c3..b016e4d5ec772b7f42cf6c11f536589e14674074 100644 (file)
--- a/src/acl/Strategy.h
+++ b/src/acl/Strategy.h
@@ -34,6 +34,7 @@
 #ifndef SQUID_ACLSTRATEGY_H
 #define SQUID_ACLSTRATEGY_H
 
+#include "acl/Acl.h"
 #include "acl/Data.h"
 
 class ACLFilledChecklist;
@@ -45,7 +46,7 @@ class ACLStrategy
 
 public:
     typedef M MatchType;
-    virtual int match (ACLData<M> * &, ACLFilledChecklist *) = 0;
+    virtual int match (ACLData<M> * &, ACLFilledChecklist *, ACLFlags &) = 0;
     virtual bool requiresRequest() const {return false;}
 
     virtual bool requiresReply() const {return false;}

diff --git a/src/acl/Tag.cc b/src/acl/Tag.cc
index ef4ac006950c85f0ffc345d125c7167b205a8e5b..17ffdcdd2832328517bf47979f7a6b838ce6a697 100644 (file)
--- a/src/acl/Tag.cc
+++ b/src/acl/Tag.cc
@@ -41,7 +41,7 @@
 #include "HttpRequest.h"
 
 int
-ACLTagStrategy::match (ACLData<MatchType> * &data, ACLFilledChecklist *checklist)
+ACLTagStrategy::match (ACLData<MatchType> * &data, ACLFilledChecklist *checklist, ACLFlags &)
 {
     if (checklist->request != NULL)
         return data->match (checklist->request->tag.termedBuf());

diff --git a/src/acl/Tag.h b/src/acl/Tag.h
index 1d0d5e6a4980c0c545c1138ae0794b15d0909d6d..bdd243183083b61492160b28c3e0a2a179cfc363 100644 (file)
--- a/src/acl/Tag.h
+++ b/src/acl/Tag.h
@@ -41,7 +41,7 @@ class ACLTagStrategy : public ACLStrategy<const char *>
 {
 
 public:
-    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *);
+    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *, ACLFlags &);
     static ACLTagStrategy *Instance();
     /* Not implemented to prevent copies of the instance. */
     /* Not private to prevent brain dead g+++ warnings about

diff --git a/src/acl/Time.cc b/src/acl/Time.cc
index 4520f53fa0fbfe3e39530fae746fc6a309ef9602..208b0872902e5cc0870a3eb8486c79477b642e53 100644 (file)
--- a/src/acl/Time.cc
+++ b/src/acl/Time.cc
@@ -38,7 +38,7 @@
 #include "SquidTime.h"
 
 int
-ACLTimeStrategy::match (ACLData<MatchType> * &data, ACLFilledChecklist *checklist)
+ACLTimeStrategy::match (ACLData<MatchType> * &data, ACLFilledChecklist *checklist, ACLFlags &)
 {
     return data->match (squid_curtime);
 }

diff --git a/src/acl/Time.h b/src/acl/Time.h
index fd3b7ee301a620d537e13fd1b8746cf92f474cf8..9e81c22e55b1edf6f946eac45c6a5b7dbdc22b13 100644 (file)
--- a/src/acl/Time.h
+++ b/src/acl/Time.h
@@ -43,7 +43,7 @@ class ACLTimeStrategy : public ACLStrategy<time_t>
 {
 
 public:
-    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *);
+    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *, ACLFlags &);
     static ACLTimeStrategy *Instance();
     /* Not implemented to prevent copies of the instance. */
     /* Not private to prevent brain dead g+++ warnings about

diff --git a/src/acl/Url.cc b/src/acl/Url.cc
index 1be778c3a8efce384338df9cb32353c5adb90922..e4d12d4cb0ac678f2f10738532e5bc434abf7322 100644 (file)
--- a/src/acl/Url.cc
+++ b/src/acl/Url.cc
@@ -40,7 +40,7 @@
 #include "URL.h"
 
 int
-ACLUrlStrategy::match (ACLData<char const *> * &data, ACLFilledChecklist *checklist)
+ACLUrlStrategy::match (ACLData<char const *> * &data, ACLFilledChecklist *checklist, ACLFlags &)
 {
     char *esc_buf = xstrdup(urlCanonical(checklist->request));
     rfc1738_unescape(esc_buf);

diff --git a/src/acl/Url.h b/src/acl/Url.h
index 96fb47fe3ee357b1eb56fcf4f9f40eb82ed99dcd..d82fbf041156612d77bcb7c46229d2e607930598 100644 (file)
--- a/src/acl/Url.h
+++ b/src/acl/Url.h
@@ -41,7 +41,7 @@ class ACLUrlStrategy : public ACLStrategy<char const *>
 {
 
 public:
-    virtual int match (ACLData<char const *> * &, ACLFilledChecklist *);
+    virtual int match (ACLData<char const *> * &, ACLFilledChecklist *, ACLFlags &);
     virtual bool requiresRequest() const {return true;}
 
     static ACLUrlStrategy *Instance();

diff --git a/src/acl/UrlLogin.cc b/src/acl/UrlLogin.cc
index b40a4b6baa6af78a09533d438d47a4740ec06572..bdefaf0f9e7c6f5a6f36771658e3747fb3c02d86 100644 (file)
--- a/src/acl/UrlLogin.cc
+++ b/src/acl/UrlLogin.cc
@@ -38,7 +38,7 @@
 #include "rfc1738.h"
 
 int
-ACLUrlLoginStrategy::match (ACLData<char const *> * &data, ACLFilledChecklist *checklist)
+ACLUrlLoginStrategy::match (ACLData<char const *> * &data, ACLFilledChecklist *checklist, ACLFlags &)
 {
     char *esc_buf = xstrdup(checklist->request->login);
     rfc1738_unescape(esc_buf);

diff --git a/src/acl/UrlLogin.h b/src/acl/UrlLogin.h
index c29b7458167a9a67e2f79e34d8865077fdf8e0b4..572b3ad3541ebc746b94f63054215d26e284997e 100644 (file)
--- a/src/acl/UrlLogin.h
+++ b/src/acl/UrlLogin.h
@@ -45,7 +45,7 @@ class ACLUrlLoginStrategy : public ACLStrategy<char const *>
 {
 
 public:
-    virtual int match (ACLData<char const *> * &, ACLFilledChecklist *);
+    virtual int match (ACLData<char const *> * &, ACLFilledChecklist *, ACLFlags &);
     virtual bool requiresRequest() const {return true;}
 
     static ACLUrlLoginStrategy *Instance();

diff --git a/src/acl/UrlPath.cc b/src/acl/UrlPath.cc
index c29d32a8d3ec8be9330c3980112cbbf7cd528b36..018e20bbc5a6eeef1430f68c1702c568fb26af7b 100644 (file)
--- a/src/acl/UrlPath.cc
+++ b/src/acl/UrlPath.cc
@@ -40,7 +40,7 @@
 #include "rfc1738.h"
 
 int
-ACLUrlPathStrategy::match (ACLData<char const *> * &data, ACLFilledChecklist *checklist)
+ACLUrlPathStrategy::match (ACLData<char const *> * &data, ACLFilledChecklist *checklist, ACLFlags &)
 {
     char *esc_buf = xstrdup(checklist->request->urlpath.termedBuf());
     rfc1738_unescape(esc_buf);

diff --git a/src/acl/UrlPath.h b/src/acl/UrlPath.h
index a6fdce96e3deb0aaa6a0d511ca48e8a55710e444..0ae533d25bce8831a516e3112816b0fdb90a5fcf 100644 (file)
--- a/src/acl/UrlPath.h
+++ b/src/acl/UrlPath.h
@@ -42,7 +42,7 @@ class ACLUrlPathStrategy : public ACLStrategy<char const *>
 {
 
 public:
-    virtual int match (ACLData<char const *> * &, ACLFilledChecklist *);
+    virtual int match (ACLData<char const *> * &, ACLFilledChecklist *, ACLFlags &);
     virtual bool requiresRequest() const {return true;}
 
     static ACLUrlPathStrategy *Instance();

diff --git a/src/acl/UrlPort.cc b/src/acl/UrlPort.cc
index c938ab4c6979b993e325ea350cb4881bc35f2e38..81cbf474149733b6da20e6f96df88f91d78828e6 100644 (file)
--- a/src/acl/UrlPort.cc
+++ b/src/acl/UrlPort.cc
@@ -38,7 +38,7 @@
 #include "HttpRequest.h"
 
 int
-ACLUrlPortStrategy::match (ACLData<MatchType> * &data, ACLFilledChecklist *checklist)
+ACLUrlPortStrategy::match (ACLData<MatchType> * &data, ACLFilledChecklist *checklist, ACLFlags &)
 {
     return data->match (checklist->request->port);
 }

diff --git a/src/acl/UrlPort.h b/src/acl/UrlPort.h
index 49a8849215f9649ff42ede55f37cd1b7a772c351..bdc07708ca59643a41078c8a1a5efc764686e20e 100644 (file)
--- a/src/acl/UrlPort.h
+++ b/src/acl/UrlPort.h
@@ -40,7 +40,7 @@ class ACLUrlPortStrategy : public ACLStrategy<int>
 {
 
 public:
-    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *);
+    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *, ACLFlags &);
     virtual bool requiresRequest() const {return true;}
 
     static ACLUrlPortStrategy *Instance();

diff --git a/src/cache_cf.cc b/src/cache_cf.cc
index a543b10ba30a13626c6b2277ee6d0a1709b19806..cc45babfbd07a7475d95e7791a195f65d01c5cd1 100644 (file)
--- a/src/cache_cf.cc
+++ b/src/cache_cf.cc
@@ -1276,10 +1276,11 @@ dump_acl(StoreEntry * entry, const char *name, ACL * ae)
 
     while (ae != NULL) {
         debugs(3, 3, "dump_acl: " << name << " " << ae->name);
-        storeAppendPrintf(entry, "%s %s %s ",
+        storeAppendPrintf(entry, "%s %s %s %s ",
                           name,
                           ae->name,
-                          ae->typeString());
+                          ae->typeString(),
+                          ae->flags.flagsStr());
         v = w = ae->dump();
 
         while (v != NULL) {

diff --git a/src/external_acl.cc b/src/external_acl.cc
index c0c46bb973180951d4d419e6bdea61ecf8d90375..0d41b8e700ef8e9bc0ff26f1c5cdf3f6c81d9506 100644 (file)
--- a/src/external_acl.cc
+++ b/src/external_acl.cc
@@ -705,7 +705,7 @@ ACLExternal::parse()
 
     data = cbdataAlloc(external_acl_data);
 
-    token = strtok(NULL, w_space);
+    token = strtokFile();
 
     if (!token)
         self_destruct();

diff --git a/src/snmp_core.cc b/src/snmp_core.cc
index 344651c0b8054ecf3991fe0314b3264797c3a527..1c4d8d184458624b6da872599f8af97dbf5470d0 100644 (file)
--- a/src/snmp_core.cc
+++ b/src/snmp_core.cc
@@ -1160,7 +1160,7 @@ class ACLSNMPCommunityStrategy : public ACLStrategy<char const *>
 {
 
 public:
-    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *);
+    virtual int match (ACLData<MatchType> * &, ACLFilledChecklist *, ACLFlags &);
     static ACLSNMPCommunityStrategy *Instance();
     /* Not implemented to prevent copies of the instance. */
     /* Not private to prevent brain dead g++ warnings about
@@ -1186,7 +1186,7 @@ ACL::Prototype ACLSNMPCommunity::RegistryProtoype(&ACLSNMPCommunity::RegistryEnt
 ACLStrategised<char const *> ACLSNMPCommunity::RegistryEntry_(new ACLStringData, ACLSNMPCommunityStrategy::Instance(), "snmp_community");
 
 int
-ACLSNMPCommunityStrategy::match (ACLData<MatchType> * &data, ACLFilledChecklist *checklist)
+ACLSNMPCommunityStrategy::match (ACLData<MatchType> * &data, ACLFilledChecklist *checklist, ACLFlags &)
 {
     return data->match (checklist->snmp_community);
 }