Bug 1441: tcp_outgoing_address + peering need acl matching actual endpoint

Adds the 'peername' ACL to match against the cache_peer name=X values.

Also, adds peername ACL tests to tcp_outgoing_addr.

NOTE:  Only checks against the first peer of all possible peers selected for
the connection. So on failures the outgoing address may still be incorrect for
the secondary peers.

Thanks for testing to Andrew McMillan <andrew@morphoss.com>

diff --git a/src/ACLChecklist.cc b/src/ACLChecklist.cc
index 37ea646b6ba248119e6bd7d280d0aa41bdf8517b..6ec741400962b7e409af9d8f20e3e6a3dd9625d2 100644 (file)
--- a/src/ACLChecklist.cc
+++ b/src/ACLChecklist.cc
@@ -358,6 +358,7 @@ ACLChecklist::operator delete (void *address)
 
 ACLChecklist::ACLChecklist() :
         accessList (NULL),
+        dst_peer(NULL),
         request (NULL),
         reply (NULL),
         auth_user_request (NULL),

diff --git a/src/ACLChecklist.h b/src/ACLChecklist.h
index 72a0cced0777a22a3ee9ba7b5357cee10200051b..3e2f422283453983bff2c0a36bee28932ed91dc2 100644 (file)
--- a/src/ACLChecklist.h
+++ b/src/ACLChecklist.h
@@ -35,6 +35,7 @@
 
 #include "typedefs.h"
 #include "client_side.h"
+#include "structs.h"
 
 class ExternalACLEntry;
 
@@ -128,6 +129,8 @@ public:
 
     IPAddress my_addr;
 
+    struct peer *dst_peer;
+
     HttpRequest *request;
     /* for acls that look at reply data */
     HttpReply *reply;

diff --git a/src/ACLMyPortName.cc b/src/ACLMyPortName.cc
index d1b42dc5744f04d92b50b6fe515938d7831fac11..1cfabd327a5f78d18827f91b10feef9d2a7ce8e6 100644 (file)
--- a/src/ACLMyPortName.cc
+++ b/src/ACLMyPortName.cc
@@ -39,9 +39,6 @@
 #include "ACLStringData.h"
 #include "ACLChecklist.h"
 
-/* explicit template instantiation required for some systems */
-
-template class ACLStrategised<const char *>;
 
 ACL::Prototype ACLMyPortName::RegistryProtoype(&ACLMyPortName::RegistryEntry_, "myportname");
 

diff --git a/src/ACLPeerName.cc b/src/ACLPeerName.cc
new file mode 100644 (file)
index 0000000..8e3d4b9
--- /dev/null
+++ b/src/ACLPeerName.cc
@@ -0,0 +1,24 @@
+#include "squid.h"
+#include "ACLPeerName.h"
+#include "ACLStringData.h"
+#include "ACLChecklist.h"
+
+ACL::Prototype ACLPeerName::RegistryProtoype(&ACLPeerName::RegistryEntry_, "peername");
+
+ACLStrategised<const char *> ACLPeerName::RegistryEntry_(new ACLStringData, ACLPeerNameStrategy::Instance(), "peername");
+
+int
+ACLPeerNameStrategy::match (ACLData<MatchType> * &data, ACLChecklist *checklist)
+{
+    if (checklist->dst_peer != NULL && checklist->dst_peer->name != NULL)
+       return data->match(checklist->dst_peer->name);
+    return 0;
+}
+
+ACLPeerNameStrategy *
+ACLPeerNameStrategy::Instance()
+{
+    return &Instance_;
+}
+
+ACLPeerNameStrategy ACLPeerNameStrategy::Instance_;

diff --git a/src/ACLPeerName.h b/src/ACLPeerName.h
new file mode 100644 (file)
index 0000000..c7abebf
--- /dev/null
+++ b/src/ACLPeerName.h
@@ -0,0 +1,33 @@
+#ifndef SQUID_ACLPEERNAME_H
+#define SQUID_ACLPEERNAME_H
+
+#include "ACLStrategy.h"
+#include "ACLStrategised.h"
+
+class ACLPeerNameStrategy : public ACLStrategy<const char *>
+{
+
+public:
+    virtual int match (ACLData<MatchType> * &, ACLChecklist *);
+    static ACLPeerNameStrategy *Instance();
+    /* Not implemented to prevent copies of the instance. */
+    /* Not private to prevent brain dead g+++ warnings about
+     * private constructors with no friends */
+    ACLPeerNameStrategy(ACLPeerNameStrategy const &);
+
+private:
+    static ACLPeerNameStrategy Instance_;
+    ACLPeerNameStrategy(){}
+
+    ACLPeerNameStrategy&operator=(ACLPeerNameStrategy const &);
+};
+
+class ACLPeerName
+{
+
+private:
+    static ACL::Prototype RegistryProtoype;
+    static ACLStrategised<const char *> RegistryEntry_;
+};
+
+#endif /* SQUID_ACLPEERNAME_H */

diff --git a/src/ACLStrategised.cc b/src/ACLStrategised.cc
index 8093738f27d84bdfc07ef61deef946b1e722b904..85cc1ed9349a905b8d9f114213cfe0f4d0294238 100644 (file)
--- a/src/ACLStrategised.cc
+++ b/src/ACLStrategised.cc
@@ -42,11 +42,15 @@
 #include "ACLDomainData.h"
 
 /*
- *  moved template instantiation into ACLStrategized.cc from
- *  ACLHTTPRepHeader.cc and ACLHTTPReqHeader.cc to compile on
- *  Mac OSX 10.5 Leopard, this corrects a duplicate symbol error
+ *  moved template instantiation into ACLStrategized.cc
+ *  to compile on Mac OSX 10.5 Leopard.
+ *  This corrects a duplicate symbol error
  */
 
 /* explicit template instantiation required for some systems */
 
+/* ACLHTTPRepHeader + ACLHTTPReqHeader */
 template class ACLStrategised<HttpHeader*>;
+
+/* ACLMyPortName + ACLMyPeerName */
+template class ACLStrategised<const char *>;

diff --git a/src/Makefile.am b/src/Makefile.am
index 4bfb3f4182b06a570f851b77bd4a3bafe3d04acd..17ebd27b2f74591ec59471cf5f85aa9798dd88ec 100644 (file)
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -365,6 +365,8 @@ squid_ACLSOURCES = \
        ACLMyPort.h \
        ACLMyPortName.cc \
        ACLMyPortName.h \
+       ACLPeerName.cc \
+       ACLPeerName.h \
        ACLProtocol.cc \
        ACLProtocol.h \
        ACLProtocolData.cc \

diff --git a/src/cf.data.pre b/src/cf.data.pre
index 14d2fb12747485f765047b51b3220fadf8699f45..7ed08c83dd08cc7436127b59491f1b5b90d61a55 100644 (file)
--- a/src/cf.data.pre
+++ b/src/cf.data.pre
@@ -518,6 +518,10 @@ DOC_START
          # cache_peer_access mycache.mydomain.net allow asexample
          # cache_peer_access mycache_mydomain.net deny all
 
+       acl aclname peername myPeer ...
+         # match against a named cache_peer entry
+         # set unique name= on cache_peer lines for reliable use.
+
        acl aclname time [day-abbrevs] [h1:m1-h2:m2]
          #  day-abbrevs:
          #     S - Sunday
@@ -1360,6 +1364,12 @@ DOC_START
 
        tcp_outgoing_address 2002::1 to_ipv6
        tcp_outgoing_address 10.1.0.3 !to_ipv6
+
+       WARNING:
+         'dst ipv6' bases its selection assuming DIRECT access.
+         If peers are used the peername ACL are needed to select outgoing
+         address which can link to the peer.
+
 DOC_END
 
 COMMENT_START
@@ -1766,7 +1776,7 @@ DOC_START
                     use 'name=xxx' if you have multiple peers on the same
                     host but different ports. This name can be used to
                     differentiate the peers in cache_peer_access and similar
-                    directives.
+                    directives. Including the peername ACL type.
 
                     use 'forceddomain=name' to forcibly set the Host header
                     of requests forwarded to this peer. Useful in accelerator

diff --git a/src/forward.cc b/src/forward.cc
index 39471e21d9aaa595f8563ddc1925487854c762f8..a8ef963efb4afbb992b268165ea979764b64a8f1 100644 (file)
--- a/src/forward.cc
+++ b/src/forward.cc
@@ -857,7 +857,7 @@ FwdState::connectStart()
 
 #endif
 
-    outgoing = getOutgoingAddr(request);
+    outgoing = getOutgoingAddr(request, fs->_peer);
 
     tos = getOutgoingTOS(request);
 
@@ -1323,13 +1323,15 @@ aclMapTOS(acl_tos * head, ACLChecklist * ch)
 }
 
 IPAddress
-getOutgoingAddr(HttpRequest * request)
+getOutgoingAddr(HttpRequest * request, struct peer *dst_peer)
 {
     ACLChecklist ch;
 
     if (request && request->flags.spoof_client_ip)
         return request->client_addr;
 
+    ch.dst_peer = dst_peer;
+
     if (request) {
         ch.src_addr = request->client_addr;
         ch.my_addr = request->my_addr;

diff --git a/src/neighbors.cc b/src/neighbors.cc
index 537b65d6e1011523146b74e1c1c1f429de914c40..c1f9cbd1d021f6f8952384886c8c33b9fcbab459 100644 (file)
--- a/src/neighbors.cc
+++ b/src/neighbors.cc
@@ -1380,7 +1380,7 @@ peerProbeConnect(peer * p)
     if (squid_curtime - p->stats.last_connect_probe == 0)
         return ret;/* don't probe to often */
 
-    IPAddress temp(getOutgoingAddr(NULL));
+    IPAddress temp(getOutgoingAddr(NULL,p));
 
     fd = comm_open(SOCK_STREAM, IPPROTO_TCP, temp, COMM_NONBLOCKING, p->host);
 

diff --git a/src/protos.h b/src/protos.h
index 94379bfb8f3e42c32aa900d14af90a78102aebf7..90203bbec39f9d3a720a5bc04b66643bbfc83492 100644 (file)
--- a/src/protos.h
+++ b/src/protos.h
@@ -445,7 +445,7 @@ SQUIDCEXTERN void peerDigestNeeded(PeerDigest * pd);
 SQUIDCEXTERN void peerDigestNotePeerGone(PeerDigest * pd);
 SQUIDCEXTERN void peerDigestStatsReport(const PeerDigest * pd, StoreEntry * e);
 
-extern IPAddress getOutgoingAddr(HttpRequest * request);
+extern IPAddress getOutgoingAddr(HttpRequest * request, struct peer *dst_peer);
 unsigned long getOutgoingTOS(HttpRequest * request);
 
 SQUIDCEXTERN void urnStart(HttpRequest *, StoreEntry *);

diff --git a/src/tunnel.cc b/src/tunnel.cc
index 81844bbe30e09e9ca717e7705f4c579baa947fb5..3e994f92d10bc43d10d5b79dbc14ba28c3a68b89 100644 (file)
--- a/src/tunnel.cc
+++ b/src/tunnel.cc
@@ -635,7 +635,7 @@ tunnelStart(ClientHttpRequest * http, int64_t * size_ptr, int *status_ptr)
     statCounter.server.all.requests++;
     statCounter.server.other.requests++;
     /* Create socket. */
-    IPAddress temp = getOutgoingAddr(request);
+    IPAddress temp = getOutgoingAddr(request,NULL);
     sock = comm_openex(SOCK_STREAM,
                        IPPROTO_TCP,
                        temp,