Bug 3616: Retrieve client connection for ACL checks from the related HttpRequest...

This patch enable SSL client certificate ACL checks (user_cert and ca_cert)
in all cases the client connection information can retrieved from the related
HttpRequest object, eg when making peering decisions (peer_cache_access ACL).

Also fixes assertion failure caused by acl dst on transparent proxy.

Discussed under the "Supply client connection and IDENT information to
peer_cache_access ACL check" thread on squid-dev.

This is a Measurement Factory project

diff --git a/src/acl/FilledChecklist.cc b/src/acl/FilledChecklist.cc
index 16d6f276603a88aa264141716bf8978a65062426..5515debd73849a8198f35def508739595b25f63b 100644 (file)
--- a/src/acl/FilledChecklist.cc
+++ b/src/acl/FilledChecklist.cc
@@ -110,6 +110,8 @@ ACLFilledChecklist::conn() const
 void
 ACLFilledChecklist::conn(ConnStateData *aConn)
 {
+    if (conn() == aConn)
+        return;
     assert (conn() == NULL);
     conn_ = cbdataReference(aConn);
 }
@@ -205,6 +207,9 @@ ACLFilledChecklist::ACLFilledChecklist(const acl_access *A, HttpRequest *http_re
 #endif /* FOLLOW_X_FORWARDED_FOR */
             src_addr = request->client_addr;
         my_addr = request->my_addr;
+
+        if (request->clientConnectionManager.valid())
+            conn(request->clientConnectionManager.get()); 
     }
 
 #if USE_IDENT

diff --git a/src/client_side.cc b/src/client_side.cc
index 14169ba4aa99ba73eb9e139b10efcd393346d856..9f375368a6ed796f760637c8e3d14bc7b692b918 100644 (file)
--- a/src/client_side.cc
+++ b/src/client_side.cc
@@ -3856,16 +3856,6 @@ clientAclChecklistCreate(const acl_access * acl, ClientHttpRequest * http)
      * the ident result on persistent connections...
      */
     /* connection oriented auth also needs these two lines for it's operation. */
-    /*
-     * Internal requests do not have a connection reference, because: A) their
-     * byte count may be transformed before being applied to an outbound
-     * connection B) they are internal - any limiting on them should be done on
-     * the server end.
-     */
-
-    if (conn != NULL)
-        ch->conn(conn);        /* unreferenced in FilledCheckList.cc */
-
     return ch;
 }
 

diff --git a/src/neighbors.cc b/src/neighbors.cc
index cd98407319bdd21f73429ebee8b91c98b1c02b98..ee3e961a3739b017dd3a7e3645323be595063b16 100644 (file)
--- a/src/neighbors.cc
+++ b/src/neighbors.cc
@@ -194,17 +194,6 @@ peerAllowedToUse(const peer * p, HttpRequest * request)
     checklist.src_addr = request->client_addr;
     checklist.my_addr = request->my_addr;
 
-#if 0 && USE_IDENT
-    /*
-     * this is currently broken because 'request->user_ident' has been
-     * moved to conn->rfc931 and we don't have access to the parent
-     * ConnStateData here.
-     */
-    if (request->user_ident[0])
-        xstrncpy(checklist.rfc931, request->user_ident, USER_IDENT_SZ);
-
-#endif
-
     return (checklist.fastCheck() == ACCESS_ALLOWED);
 }