Amos Jeffries [Wed, 1 Feb 2012 07:44:49 +0000 (00:44 -0700)]
Bug 3370: external ACL sometimes skipping
Emit tag/user/log/message/pass details to the request in the case where
the external ACL entry has expired but within graceful revalidate period.
The result of this bug appears as incorrect matches later down the ACL
processing in any config relying on the external ACL output values.
Example; for bypassing auth login, or for filtering tagged traffic.
Alex Rousskov [Sat, 21 Jan 2012 01:16:48 +0000 (18:16 -0700)]
Do not add HTTP 110 and 111 Warnings to TCP_REFRESH_UNMODIFIED responses.
The old "stale if hit" logic did not account for cases where the stored
stale response became fresh due to a successful revalidation with the
origin server.
When the stored response was stale at the time of the request, we were
adding 110 "Response is stale" and even 111 "Revalidation failed"
Warning headers to responses while logging TCP_REFRESH_UNMODIFIED, which
is considered a hit.
Alex Rousskov [Sat, 14 Jan 2012 07:19:41 +0000 (00:19 -0700)]
Bug 3420: Request body consumption races and !theConsumer exception.
Also fixes endless waiting for HTTP client to send req body we no longer need.
Before these changes, the client side used a single "closing" state to
handle two different error conditions:
1. We stopped receiving request body because of some error.
2. We stopped sending response because of some error.
When a "directional" error occurred, we try to keep the transaction going in
the other direction (e.g., to give ICAP the entire request or to give HTTP
client the entire response). However, because there was just one "closing"
state, the code failed to correctly detect or process many corner cases,
resulting in stuck transactions and !theConsumer assertions/exceptions due to
races between enableAutoConsumption() and expectNoConsumption() calls.
This patch replaces the "closing" state with two direction-specific "we
stopped sending/receiving" flags.
Now, when the response sending code is done, it now checks whether the
receiving code stopped and closes the connection as needed. This is done both
when we encounter a sending error (ClientSocketContext::initiateClose) and
when we successfully sent the entire response to the client
(ClientSocketContext::keepaliveNextRequest).
Similarly, when the request body reading code is done, it now checks whether
the receiving code stopped and closes the connection as needed. This is done
both when we encounter a receiving error
(ConnStateData::noteBodyConsumerAborted) and when we successfully receive the
entire request body from the client (ClientSocketContext::writeComplete).
TODO: This patch focuses on various error cases. We might still have problems
when there is an early HTTP response and no errors of any kind. I marked the
corresponding old code with an XXX.
External ACL sometimes cannot find the credentials in ACL Checklist even
if they are attached to the HTTPRequest object.
This seems to happen when the checklist is created and the line match
started before the credentials are known. The credentials validation
updates the HTTP request state but is not aware of ACL checklists needing
to be updated so it never happens.
This patch:
* locate the %LOGIN value from either place where credentials can be found,
* updates the checklist if it was unset,
* passes '-' to the helper if no credentials at all were given.
Although the earlier logics forcing a lookup means this '-' case should
not happen it might if the external ACL were processed in 'fast' check.
Martin Huter [Fri, 2 Dec 2011 12:17:07 +0000 (05:17 -0700)]
Bug 2619: Excessive RAM growth due to unlimited adapted body data consumption
If the client does not read from the open connection (i.e. the user does not
confirm the browsers download-message-box in microsofts IE), squid keeps on
reading data from the ICAP server into the store entry, while no more data
can be delivered to the client.
Thus the store entry in memory is growing and squid may - in worst case -
consume memory up to the size of the users download.
This patch add API to StoreEntry to call the producer back when released
memory/space from the StoreEntry and add code to the ICAP client code to not
consume body data comes from the ICAP server when there is not available space
in the store entry.
Alex Rousskov [Thu, 24 Nov 2011 07:20:46 +0000 (00:20 -0700)]
Avoid crashes when processing bad X509 common names (CN).
X509_REQ_get_pubkey() returns a refcounted object that we must clean after use.
X509_REQ_get_subject_name() does not; cleaning the result may cause segfaults.
How we are supposed to tell the difference is beyond me.
Amos Jeffries [Tue, 11 Oct 2011 02:12:56 +0000 (20:12 -0600)]
Add directive dns_v4_first to make IPv4 connections before IPv6 is tried.
Default off, to prefer the faster protocol.
The use-case for this is networks which are IPv6-enabled but stuck
behind slow tunnels and whose upstream is not supporting full transit
services over IP.
Bug 3190: Large HTTP POST stuck after early ICAP 400 error response
When an ICAP REQMOD service responds with an error to
(or the REQMOD transaction aborts while processing) a large HTTP
request, the HTTP request may get stuck because the request body
buffer gets full and nobody consumes the no-longer-needed content.
The ICAP code quits but leaves the body buffer intact in case the
client-side code wants to bypass the error. After that, nobody consumes
the request body because the buggy client side does not inform the body
pipe that there will be no other consumers, which would have triggered
a noteBodyConsumerAborted() callback and enable auto-consumption or closed
the client connection.
Amos Jeffries [Sun, 28 Aug 2011 06:14:58 +0000 (00:14 -0600)]
Remove hierarchy_stoplist default value
This should have been done long ago with the other dynamic website
handling changes. It has caused a certain amount of confusion when things
which apparently should go to peers fail to reach them.
Alex Rousskov [Sat, 27 Aug 2011 12:34:04 +0000 (06:34 -0600)]
Polished unused code.
The unused dlopen() call is actually useful to enable when lt_dlopen() reports
"file not found" errors for loadable modules that do exist but that Libtool
cannot load successfully due to undefined symbols or other errors.
This inability to correctly report a library loading error is a long-standing
Libtool bug, stemming from Libtool's desire to try and load several
differently named library files until one succeeds, losing true error
information in the process.
Amos Jeffries [Sat, 27 Aug 2011 07:45:03 +0000 (01:45 -0600)]
Fix NIS helper build on FreeBSD
Fails on clang++ and other strict compilers due to missing __cplusplus
checks in FreeBSD system headers and yp_prot.h typedefs bool unless
BOOL_DEFINED is defined.
Alex Rousskov [Sat, 27 Aug 2011 07:14:24 +0000 (01:14 -0600)]
Bug 3217: "!fd_table[fd].closing()" from ServerStateData::noteMoreBodySpaceAvailable
It is possible that the next hop connection is going through the closing steps
when we receive a "noteMoreBodySpaceAvailable" notification from the response
body consumer. Do not try to read in this case.
Bertrand Jacquin [Sat, 27 Aug 2011 06:48:42 +0000 (00:48 -0600)]
Bug 2662: cf_gen failure when cross compiling
Adds support for "./configure HOSTCXX=foo" to specify a host compiler
to build cf_gen with. If none is specified the normal build compiler will
be used.
Regression fix: vhost and defaultsite causing vport to be ignored
Instead of dropping it completely we should be sanely combining them like
Squid-2 does for most cases. This appears to have been lost while removing
the getmyHostname() from the process and reducing the
prepareTransparentUrl code.
This fix makes vport apply even if vhost was used. It will modify the
Host: header contents according to the documented vport semantics.
This fix makes vport apply even if defaultsite= was used. It will append
the specified port to the domain name given. Domains with port attached
are not supported and will produce invalid URLs.
TODO: detect this case while parsing the initial config and warn.
Regression fix: vhost and defaultsite causing vport to be ignored
Instead of dropping it completely we should be sanely combining them like
Squid-2 does for most cases. This appears to have been lost while removing
the getmyHostname() from the process and reducing the
prepareTransparentUrl code.
This fix makes vport apply even if vhost was used. It will modify the
Host: header contents according to the documented vport semantics.
This fix makes vport apply even if defaultsite= was used. It will append
the specified port to the domain name given. Domains with port attached
are not supported and will produce invalid URLs.
TODO: detect this case while parsing the initial config and warn.
Enable negative cacheing on unknown or -1 expiry timestamp
This syncs the squid-3 code with what squid-2 does. There seem to be no
problems in squid-2, but squid-3 does not cache at times when it should
according to negative_ttl
Bug 2051: 'default' cache_peer option does not match documentation
Move the default parent to second-lowest priority on the parent
selection. This also allows the other more delicate balancing
algorithms to work properly with a default configured.
sourcehash and userhash are reversed in priority to simplify and
speed the selection code.
Also, getAnyParent() is dropped. It is redundant with the FIRSTUP
algorithm.
projects / thirdparty / squid.git / log
