Display correct information on dstdomain clashes

Abort with an error when a wildcard entry is going to be
discarded because of a sub-domain entry.
Also whenever there is a mixup between a domain and its
sub-domain wildcard alternative.

Raise a non-fatal warning when a useless subdomain entry
is being discarded and its super-set wildcard kept.

Care is taken to present the singular subdomain for
possible removal and keep the wildcard.

diff --git a/src/acl/DomainData.cc b/src/acl/DomainData.cc
index 320d42ed17bf2d927eca3b69c260044a748cbca4..26950937fe42865f39b513db3f7fdaeda0df4eb4 100644 (file)
--- a/src/acl/DomainData.cc
+++ b/src/acl/DomainData.cc
@@ -95,13 +95,20 @@ aclDomainCompare(T const &a, T const &b)
         char *const d3 = d2;
         char *const d4 = d1;
         ret = aclHostDomainCompare(d3, d4);
-    }
-
-    /* FIXME this warning may display d1 and d2 when it should display d3 and d4 */
-    if (ret == 0) {
-        debugs(28, 0, "WARNING: '" << d1 << "' is a subdomain of '" << d2 << "'");
-        debugs(28, 0, "WARNING: because of this '" << (char *) a << "' is ignored to keep splay tree searching predictable");
-        debugs(28, 0, "WARNING: You should probably remove '" << d1 << "' from the ACL named '" << AclMatchedName << "'");
+        if (ret == 0) {
+            // When a.example.com comes after .example.com in an ACL
+            // sub-domain is ignored. That is okay. Just important
+            debugs(28, DBG_IMPORTANT, "WARNING: '" << d3 << "' is a subdomain of '" << d4 << "'");
+            debugs(28, DBG_IMPORTANT, "WARNING: because of this '" << d3 << "' is ignored to keep splay tree searching predictable");
+            debugs(28, DBG_IMPORTANT, "WARNING: You should remove '" << (*d3=='.'?d4:d3) << "' from the ACL named '" << AclMatchedName << "'");
+        }
+    } else if (ret == 0) {
+        // When a.example.com comes before .example.com in an ACL
+        // discarding the wildcard is critically bad.
+        debugs(28, DBG_CRITICAL, "ERROR: '" << d1 << "' is a subdomain of '" << d2 << "'");
+        debugs(28, DBG_CRITICAL, "ERROR: because of this '" << d2 << "' is ignored to keep splay tree searching predictable");
+        debugs(28, DBG_CRITICAL, "ERROR: You should remove '" << (*d1=='.'?d2:d1) << "' from the ACL named '" << AclMatchedName << "'");
+        self_destruct();
     }
 
     return ret;