Amos Jeffries [Fri, 19 Aug 2011 03:35:19 +0000 (21:35 -0600)]
Converts the bulk of cf_gen to C++ OOP code.
* char* tree members to std::string. Which eliminates xstrdup() and
xis*() calls.
* structs to classes and replaces calloc/free with new/delete.
* link cf_gen_depends.cci directly to autoconf.h defines.
The result of these is that we can erase the dependencies on util.h,
time.cc, config.h, libcompat.la, libmisc.la and other libraries.
Directly fixing seevral build and cross-compile issues that keep appearing
on various OS.
TODO:
There is a bit further cleanup we can do. Replacing several classes with
std::list<std::string>.
Pawel Worach [Sun, 14 Aug 2011 12:42:59 +0000 (00:42 +1200)]
Fix NIS helper build on FreeBSD
Fails on clang++ and other strict compilers due to missing __cplusplus
checks in FreeBSD system headers and yp_prot.h typedefs bool unless
BOOL_DEFINED is defined.
Amos Jeffries [Sat, 13 Aug 2011 15:53:38 +0000 (09:53 -0600)]
Support extended authentication states to ACL results
Support sub-states of authentication to be sent as results from ACLs.
This allows future work to resolve issues around cases such as expired
but known credentials being used in fast category access controls.
The new authentication states are:
ACCESS_AUTH_OK
- equivalent to ACCESS_ALLOWED
ACCESS_AUTH_REQUIRED
- Missing Credentials. Used to be ACCESS_REQ_PROXY_AUTH
ACCESS_AUTH_EXPIRED_OK
- Expired now. Were Okay.
ACCESS_AUTH_EXPIRED_BAD
- Expired now. Were Failed.
Also converts cases of ACCESS_REQ_PROXY_AUTH to the new name.
As yet no attempt is made to alter auth or access control logics to use
the new states.
Alex Rousskov [Sat, 13 Aug 2011 04:15:06 +0000 (22:15 -0600)]
Bug 3217: "!fd_table[fd].closing()" from ServerStateData::noteMoreBodySpaceAvailable
It is possible that the next hop connection is going through the closing steps
when we receive a "noteMoreBodySpaceAvailable" notification from the response
body consumer. Do not try to read in this case.
Mrcus Kool [Tue, 9 Aug 2011 07:09:03 +0000 (01:09 -0600)]
Optimize regular expression ACLs
This patch is inspired by the work that I did for ufdbGuard and a few emails with Amos.
The new code optimises lists of regular expressions.
The optimisations are:
* initial .* is stripped
* RE-1 RE-2 ... RE-n are joined into one large RE: (RE-1)|(RE-2)|...|(RE-n)
* -i ... -i options are optimised: the second one is ignored, same for +i
If compounding optimization fails it falls back to using unoptimized
expressions.
Amos Jeffries [Mon, 8 Aug 2011 00:21:01 +0000 (12:21 +1200)]
Remove hierarchy_stoplist default value
This should have been done long ago with the other dynamic website
handling changes. It has caused a certain amount of confusion when things
which apparently should go to peers fail to reach them.
author: Christos Tsantilas <chtsanti@users.sourceforge.net>, Amos Jeffries <squid3@treenet.co.nz>
Bug fix: The Ip::Address::IsAnyAddr method return false for IPv4 anyaddr.
- The ip::Address::IsAnyAddr() returns true only for ipv6 anyaddr
(0000:0000:0000:0000:0000:0000:0000:0000) and returns false when we have an
ipv4 anyaddr (0000:0000:0000:0000:0000:FFFF:0000:0000)
- The ip::Address::IsIPv4 method returns false in the case of IPv4 anyaddr.
The above can cause bugs, eg:
- inside Ip::Address::SetIPv4(). When it is called for an IPv6 anyaddr the ip
address will not considred as anyaddr any morei (it IsAnyAddr will return
false).
- inside cache_cf.cc file inside dump_generic_http_port function:
if (s->s.IsAnyAddr() && !s->s.IsIPv6())
storeAppendPrintf(e, " ipv4");
The if condition in the above statement can never be true. But the s->s can
be an ipv4 anyaddr.
- other places where the code will not work as expected in the case we are
listening to an ipv4 anyaddr ip address.
This patch:
- moving the IsIPv4/6 to base purely on the v4-mapped or not
- making both protocols ANYADDR match the same test
- making both protocols NOADDR match the same test
- Fixing the IsIPv4/6 documentation to match the implementation
Amos Jeffries [Thu, 4 Aug 2011 03:21:06 +0000 (21:21 -0600)]
SourceLayout: format namespace for custom tag-based formats
Part 1 of enabling non-logging components to support custom formats in strings
Shuffle the log custom format code into its own library separate from the
logging functionality.
One minor logic change removing redundant LogFileEnabled flag.
TODO:
- use MemBuf instead or as well as StoreEntry as the output buffer
- separate from AccessLogEntry confusion
- upgrade deny_info URL generation format
- upgrade external_acl_type format
- add custom helper formats
Amos Jeffries [Wed, 3 Aug 2011 12:35:41 +0000 (06:35 -0600)]
Bug 3243: CVE-2009-0801 Bypass of browser same-origin access control in intercepted communication
Add a verify step between header parsing and http_access to validate that the
Host: header matches the URL for forward-proxied traffic or the destination
IP:port for intercepted traffic.
This is part 1 of the CVE protections. The validation step required to detect
forgery and protect against cache poisoning.
author: Measurement Factory
Bug 3118: ecap_enable on forces icap_enable on
We were updating [Icap|Ecap]::TheConfig even when [icap|ecap]_enable was false,
which may lead to service activation for Icap or Ecap services that should be
disabled. The patch removes such services from service groups before they are
activated.
The patch also warns the user when an adaptation group loses some but not all
of its services due to the new group cleanup code.
- The "Sender Host Address" field of the ICP messages header it is a 32bit
integer so it can be only an ipv4 ip address. Moreover according the ICP RFC:
"Sender Host Address
The IPv4 address of the host sending the ICP message. This field
should probably not be trusted over what is provided by getpeer-
name(), accept(), and recvfrom(). There is some ambiguity over
the original purpose of this field. In practice it is not used."
This patch set the "Sender Host Address" field always to 0.
- Remove the echo_hdr static variable from neighbors.cc file and the
theIcpPublicHostID variables from the icp_v2.cc file. They are part of the
old "source_ping" squid feature code which does not exist any more.
- Remove the theIcpPrivateHostID variable from the icp_v2.cc file. It was used
only to set the "Sender Host Address" icp message header field.
Display HTTP protocol syntax at section 11 level 2
This enables easy debugging of what HTTP requests and replies are flowing
over the between Squid and external clients/servers. Avoiding the need
for level-9 debug traces or packet-level deciphering.
Default to vhost for accelerator mode (reverse proxy)
Defaults to match HTTP requirements, and Host awareness is a
rather strong HTTP/1.1 requirement. The default in HTTP/1.1 is to read
the Host header (unless URL is absolute) but a server MAY optionally
ignore the Host header if desired.
The option no-vhost is provided to disable this behaviour if necessary.
Regression fix: vhost and defaultsite causing vport to be ignored
Instead of dropping it completely we should be sanely combining them like
Squid-2 does for most cases. This appears to have been lost while removing
the getmyHostname() from the process and reducing the
prepareTransparentUrl code.
This fix makes vport apply even if vhost was used. It will modify the
Host: header contents according to the documented vport semantics.
This fix makes vport apply even if defaultsite= was used. It will append
the specified port to the domain name given. Domains with port attached
are not supported and will produce invalid URLs.
TODO: detect this case while parsing the initial config and warn.
Enable negative cacheing on unknown or -1 expiry timestamp
This syncs the squid-3 code with what squid-2 does. THere seem to be no
problems in squid-2, but squid-3 does not cache at times when it should
according to negative_ttl
The SharedListenResponse because copied using memcpy function (TypedMsgHdr.cc
file, 154 line, Ipc::TypedMsgHdr::getRaw method) can not have complex class
members like the SharedListenResponse::conn which is a RefCounted object.
This patch
- Remove the SharedListenResponse::conn member and replaced with a
single SharedListenResponse::fd (integer filedescriptor) member.
- Does not create a new Comm::Connection object for listening sockets
inside IPC code , but use the Comm:Connection object created while
initializing the listening socket and passed to the Ipc::StartListening
method.
Bug 2051: 'default' cache_peer option does not match documentation
Move the default parent to second-lowest priority on the parent
selection. This also allows the other more delicate balancing
algorithms to work properly with a default configured.
sourcehash and userhash are reversed in priority to simplify the
selection code around #if..#endif once default is moved.
Also, getAnyParent() is dropped. It is redundant with the FIRSTUP
algorithm.
In summary:
* use nonBlockingCheck() or fastCheck() to test ACLs.
* be prepared to handle any allow_t in the result.
ACL testing functions publicly available from ACLChecklist are:
- nonBlockingCheck (public), fastCheck public), check (public but not to be used)
- matchAclListFast (public), matchAclListSlow (private), matchAclList (private).
Given that there are only two types of test performed, this array of API
methods has been causing confusion and mistakes for some developers.
This patch seeks to clarify that API by correcting a flaw in the naming
of check() and matchAclListFast().
Due to "Fast" ACLs coming in two types there are two overloaded
fastCheck() functions. Now with identical output behaviour. Both return
the allow_t result of the lookup. This is expected to _usually_ be
ACCESS_ALLOWED / ACCESS_DENIED but that is not always the case.
Callers need to be written with consideration that the set of enum
results may change.
- fastCheck(), no parameters, when a full set of "Fast" *_access lines
are to be scanned. The checklist constructor accepts the list to be
scanned. This is the old fastCheck(), with the new ALLOWED / DENIED
/ DUNNO result.
- fastCheck(list), one parameter, when a single-line set of ACLs is to
be scanned. This is the old matchAclListFast(), with the new ALLOWED
/ DENIED / DUNNO result. Will return ALLOWED whenever the whole set
of ACLs matches. Other results may vary.
- nonBlockingCheck() - for "Slow" non-blocking lookups with asynchronous
callback handler. NP: not touched by this patch.
The output change from boolean to allow_t is due to the fastCheck()
callers mixed set of needs allow/deny/other which boolean cannot meet.
Mapping that tri-state need to a boolean result has led to inconsistent
cases of fastCheck() producing unusual values for "true". Sometimes
wrongly for the caller.
Added result lookup type ACCESS_DUNNO, to indicate a test was unable to
be completed BUT there was no allow/deny/auth-required resulting.
Alters all previous calling code to use the new fastCheck() API output.
Some have been polished up to boolean where appropriate instead of
relying on integer values.
Removes matchAclListFast/matchAclListSlow,
Renames check() to matchNonBlocking;
all match*() functions are internal operations during ACL testing.
FQDN had memDataInit() in its component setup, which movedin rev 11499.
The assert is in memCheckInit() and tests that memInit() worked properly.
But if a pool is initialized only when its component is loaded, that
check will fail on several conditions unrelated to the operation of
memory. Seemingly trivial changes to component loading order is one case.
This patch allows modules to initialize/register their own pools on
demand later in the startup process.
* shuffle MEM_DONTFREE which is an existing fixed entry that must not be
memInitCheck()'d to the end of the MemPool type enum list.
* update memCheckInit() to stop scanning for missing pools at that marker.
* shuffle pool types which are initialized by their components after the
marker value. Such that no false problem is reported if (a) the
component is never initialized for that worker, or (b) the component is
only initialized during the configuration process.
* document this layout significance in the enum list to aid future pool
additions or moves.
* add asserts to memAllocate() and memFree() to highlight the cases of
brokenness memCheckInit() was catching. Using assert() instead of if()
so that optimized builds can avoid the penalty of an extra test on each
alloc/free.
projects / thirdparty / squid.git / log
