From: Amos Jeffries Date: Wed, 2 Jun 2010 13:44:26 +0000 (+1200) Subject: Bug 2305: Multiple leaks and assertion crashes in authentication. X-Git-Tag: SQUID_3_2_0_1~167 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4542b25ba0c3d195fcd2f43de2e6ba3167957156;p=thirdparty%2Fsquid.git Bug 2305: Multiple leaks and assertion crashes in authentication. * implements proper RefCounting using the RefCount.h classes for almost all auth objects in Squid. * Restructures auth objects with a simpler structure of duties and scopes. * Prunes away several circular and indirectly circular pointer loops * Adds an API to auth config for handling the mainRotate() event. To only shutdown helpers, fixing the loss of cached credentials on rotate. * Adds a username_cache page to cachemgr interface to display the current credentials and their TTLs to various revalidation or garbage events. With this we end up with several global pointers for the auth schemes which have been built into the current Squid. These are RefCount pointers, fixing the leak of schemes on shutdown. Schemes are now also permanent structures for the runtime of Squid, fixing leaks on reconfigure and rotate actions. These AuthSchemes are responsible for creating auth Config objects for each auth protocol configured in squid.conf. These config objects are now also able to be altered with a reconfigure instead of requiring a restart. Each HTTP request authentication attempt generates AuthUserRequest objects, which may or may not pointer to an AuthUser set of credentials being checked. AuthUserRequest is RefCounted instead of locked, fixing several assertion crashes. AuthUser is now RefCounted instead of locked. It's children inherit these properties. This simplifies the object handling a lot and fixes several assertions. * This also means AuthUser no longer needs a back-pointer to all AuthUserRequest in order to see if its still needed alive, fixing one circular lock loop and a few possible assertions. * The username cache pointers to only AuthUser objects, fixing a second cirular lock loop and potentially leakage. Also simplifying the hash cache handling a lot. Non-Auth code needing a reference to authentication credentials should hold a pointer to either an AuthUserRequest or AuthUser object. Not any other auth object. FUTURE WORK; There is still some conditions leading to auth re-challenge when they are not expected. A fair chunk of classes and enums have been shuffled into separate files to keep the scopes clearer. This could be increased in future when building the Auth namespace. Potential is now present for simpler TTL handling for all auth types. This work was a collaboration between multiple interested parties over the last year, with additional developer time and testing funded by Netspace Online Systems. --- 4542b25ba0c3d195fcd2f43de2e6ba3167957156