Author: Henrik Nordstrom <henrik@henriknordstrom.net>

Make ESI behave reasonable when built but not used

- Move (and extent/correct) hardcoded CC ignore to a new http_port
  option ignore-cc

- Limit Surrogate-Capability header addition to accelerated requests.

diff --git a/doc/release-notes/release-3.1.sgml b/doc/release-notes/release-3.1.sgml
index 5b3e2f9a9a312fae05446ef6b5de9d3f5ca95fe3..a7d74a792916f850eb0fc2ed69b00a2ee3518da8 100644 (file)
--- a/doc/release-notes/release-3.1.sgml
+++ b/doc/release-notes/release-3.1.sgml
@@ -1199,7 +1199,7 @@ NOCOMMENT_START
        X-Forwarded-For entries, and place itself as the sole entry.
        </verb>
 
-       <tag>http_port transparent intercept sslbump connection-auth[=on|off]</tag>
+       <tag>http_port transparent intercept sslbump connection-auth[=on|off] ignore-cc</tag>
        <p>Option 'transparent' is being deprecated in favour of 'intercept' which more clearly identifies what the option does.
        For now option 'tproxy' remains with old behaviour meaning fully-invisible proxy using TPROXY support.</p>
        <p>New port options
@@ -1221,6 +1221,11 @@ NOCOMMENT_START
                        the connection, interval how often to probe, and
                        timeout the time before giving up.
 
+          ignore-cc    Ignore request Cache-Control headers.
+
+                       Warning: This option violates HTTP specifications if
+                       used in non-accelerator setups.
+
           sslBump      Intercept each CONNECT request matching ssl_bump ACL,
                        establish secure connection with the client and with
                        the server, decrypt HTTP messages as they pass through

diff --git a/src/ProtoPort.h b/src/ProtoPort.h
index b421dd1267a705da99d549c59964bbc0d3c2f6c9..15d6abf6486f49eeca520a51c46525ce8bcb773e 100644 (file)
--- a/src/ProtoPort.h
+++ b/src/ProtoPort.h
@@ -24,6 +24,7 @@ struct http_port_list {
     unsigned int allow_direct:1;       /**< Allow direct forwarding in accelerator mode */
     unsigned int vhost:1;              /**< uses host header */
     unsigned int sslBump:1;            /**< intercepts CONNECT requests */
+    unsigned int ignore_cc:1;          /**< Ignore request Cache-Control directives */
 
     int vport;                 /* virtual port support, -1 for dynamic, >0 static*/
     bool connection_auth_disabled;     /* Don't support connection oriented auth */

diff --git a/src/cache_cf.cc b/src/cache_cf.cc
index 3ef655023cfa52037e028b17dbdc4c0492dbd4d6..b56ecc38e3ac30dd94d46d0d3b98914446897ac2 100644 (file)
--- a/src/cache_cf.cc
+++ b/src/cache_cf.cc
@@ -3002,6 +3002,14 @@ parse_http_port_option(http_port_list * s, char *token)
         s->accel = 1;
     } else if (strcmp(token, "allow-direct") == 0) {
         s->allow_direct = 1;
+    } else if (strcmp(token, "ignore-cc") == 0) {
+        s->ignore_cc = 1;
+#if !HTTP_VIOLATIONS
+        if (!s->accel) {
+            debugs(3, DBG_CRITICAL, "FATAL: ignore-cc is only valid in accelerator mode");
+            self_destruct();
+        }
+#endif
     } else if (strcmp(token, "no-connection-auth") == 0) {
         s->connection_auth_disabled = true;
     } else if (strcmp(token, "connection-auth=off") == 0) {

diff --git a/src/cf.data.pre b/src/cf.data.pre
index f399e6ec103dfdabfe75e64d924676295b374263..4703109eed5eccc1e03e957f3faea0ed6211bcc8 100644 (file)
--- a/src/cf.data.pre
+++ b/src/cf.data.pre
@@ -1105,6 +1105,11 @@ DOC_START
           protocol=    Protocol to reconstruct accelerated requests with.
                        Defaults to http.
 
+          ignore-cc    Ignore request Cache-Control headers.
+
+                       Warning: This option violates HTTP specifications if
+                       used in non-accelerator setups.
+
           connection-auth[=on|off]
                        use connection-auth=off to tell Squid to prevent 
                        forwarding Microsoft connection oriented authentication

diff --git a/src/client_side.cc b/src/client_side.cc
index 1b05a9000360eb05a14309e7c1858bae85dc7205..5377c8ee06849b8bf36b468c2d38456efd8196b1 100644 (file)
--- a/src/client_side.cc
+++ b/src/client_side.cc
@@ -2370,6 +2370,7 @@ clientProcessRequest(ConnStateData *conn, HttpParser *hp, ClientSocketContext *c
     }
 
     request->flags.accelerated = http->flags.accel;
+    request->flags.ignore_cc = conn->port->ignore_cc;
     request->flags.no_direct = request->flags.accelerated ? !conn->port->allow_direct : 0;
 
     /** \par

diff --git a/src/client_side_request.cc b/src/client_side_request.cc
index 4e9d29c9b5de7cc25efe7d9e89808da085ebc264..608a447d2d65896eb9440ac7d34cb9a44da9db34 100644 (file)
--- a/src/client_side_request.cc
+++ b/src/client_side_request.cc
@@ -742,10 +742,7 @@ clientInterpretRequestHeaders(ClientHttpRequest * http)
     HttpRequest *request = http->request;
     HttpHeader *req_hdr = &request->header;
     int no_cache = 0;
-#if !(USE_SQUID_ESI) || defined(USE_USERAGENT_LOG) || defined(USE_REFERER_LOG)
-
     const char *str;
-#endif
 
     request->imslen = -1;
     request->ims = req_hdr->getTime(HDR_IF_MODIFIED_SINCE);
@@ -753,44 +750,39 @@ clientInterpretRequestHeaders(ClientHttpRequest * http)
     if (request->ims > 0)
         request->flags.ims = 1;
 
-#if USE_SQUID_ESI
-    /*
-     * We ignore Cache-Control as per the Edge Architecture Section 3. See
-     * www.esi.org for more information.
-     */
-#else
+    if (!request->flags.ignore_cc) {
+        if (req_hdr->has(HDR_PRAGMA)) {
+            String s = req_hdr->getList(HDR_PRAGMA);
 
-    if (req_hdr->has(HDR_PRAGMA)) {
-        String s = req_hdr->getList(HDR_PRAGMA);
+            if (strListIsMember(&s, "no-cache", ','))
+                no_cache++;
 
-        if (strListIsMember(&s, "no-cache", ','))
-            no_cache++;
-
-        s.clean();
-    }
+            s.clean();
+        }
 
-    if (request->cache_control)
-        if (EBIT_TEST(request->cache_control->mask, CC_NO_CACHE))
-            no_cache++;
+        if (request->cache_control)
+            if (EBIT_TEST(request->cache_control->mask, CC_NO_CACHE))
+                no_cache++;
 
-    /*
-    * Work around for supporting the Reload button in IE browsers when Squid
-    * is used as an accelerator or transparent proxy, by turning accelerated
-    * IMS request to no-cache requests. Now knows about IE 5.5 fix (is
-    * actually only fixed in SP1, but we can't tell whether we are talking to
-    * SP1 or not so all 5.5 versions are treated 'normally').
-    */
-    if (Config.onoff.ie_refresh) {
-        if (http->flags.accel && request->flags.ims) {
-            if ((str = req_hdr->getStr(HDR_USER_AGENT))) {
-                if (strstr(str, "MSIE 5.01") != NULL)
-                    no_cache++;
-                else if (strstr(str, "MSIE 5.0") != NULL)
-                    no_cache++;
-                else if (strstr(str, "MSIE 4.") != NULL)
-                    no_cache++;
-                else if (strstr(str, "MSIE 3.") != NULL)
-                    no_cache++;
+        /*
+        * Work around for supporting the Reload button in IE browsers when Squid
+        * is used as an accelerator or transparent proxy, by turning accelerated
+        * IMS request to no-cache requests. Now knows about IE 5.5 fix (is
+        * actually only fixed in SP1, but we can't tell whether we are talking to
+        * SP1 or not so all 5.5 versions are treated 'normally').
+        */
+        if (Config.onoff.ie_refresh) {
+            if (http->flags.accel && request->flags.ims) {
+                if ((str = req_hdr->getStr(HDR_USER_AGENT))) {
+                    if (strstr(str, "MSIE 5.01") != NULL)
+                        no_cache++;
+                    else if (strstr(str, "MSIE 5.0") != NULL)
+                        no_cache++;
+                    else if (strstr(str, "MSIE 4.") != NULL)
+                        no_cache++;
+                    else if (strstr(str, "MSIE 3.") != NULL)
+                        no_cache++;
+                }
             }
         }
     }
@@ -799,7 +791,6 @@ clientInterpretRequestHeaders(ClientHttpRequest * http)
         no_cache++;
     }
 
-#endif
     if (no_cache) {
 #if HTTP_VIOLATIONS
 

diff --git a/src/http.cc b/src/http.cc
index 8eef8db54ca53b7b2d4a305809c248a94c654647..98f26cfb229b44966860a6b4a977fe3fd8805b73 100644 (file)
--- a/src/http.cc
+++ b/src/http.cc
@@ -1503,7 +1503,7 @@ HttpStateData::httpBuildRequestHeader(HttpRequest * request,
     }
 
 #if USE_SQUID_ESI
-    {
+    if (orig_request->flags.accelerated) {
         /* Append Surrogate-Capabilities */
         String strSurrogate (hdr_in->getList(HDR_SURROGATE_CAPABILITY));
         snprintf(bbuf, BBUF_SZ, "%s=\"Surrogate/1.0 ESI/1.0\"",

diff --git a/src/refresh.cc b/src/refresh.cc
index ea3199bf9013a2a9028dd3e275568c434594ab1c..7891c34ee8276b1d196219c18959678e728f4ddc 100644 (file)
--- a/src/refresh.cc
+++ b/src/refresh.cc
@@ -281,7 +281,7 @@ refreshCheck(const StoreEntry * entry, HttpRequest * request, time_t delta)
     }
 
     /* request-specific checks */
-    if (request) {
+    if (request && !request->flags.ignore_cc) {
         HttpHdrCc *cc = request->cache_control;
 
         if (request->flags.ims && (R->flags.refresh_ims || Config.onoff.refresh_all_ims)) {

diff --git a/src/structs.h b/src/structs.h
index 4601e7c38cee51ab5c102f3c6fa646226428ce59..fb20eb0f317032e7fa9dc17948afc3ebdf1a8a59 100644 (file)
--- a/src/structs.h
+++ b/src/structs.h
@@ -999,7 +999,7 @@ struct _iostats {
 
 
 struct request_flags {
-    request_flags(): range(0),nocache(0),ims(0),auth(0),cachable(0),hierarchical(0),loopdetect(0),proxy_keepalive(0),proxying(0),refresh(0),redirected(0),need_validation(0),accelerated(0),intercepted(0),spoof_client_ip(0),internal(0),internalclient(0),must_keepalive(0),destinationIPLookedUp_(0) {
+    request_flags(): range(0),nocache(0),ims(0),auth(0),cachable(0),hierarchical(0),loopdetect(0),proxy_keepalive(0),proxying(0),refresh(0),redirected(0),need_validation(0),accelerated(0),ignore_cc(0),intercepted(0),spoof_client_ip(0),internal(0),internalclient(0),must_keepalive(0),destinationIPLookedUp_(0) {
 #if HTTP_VIOLATIONS
         nocache_hack = 0;
 #endif
@@ -1025,6 +1025,7 @@ unsigned int proxying:
     unsigned int nocache_hack:1;       /* for changing/ignoring no-cache requests */
 #endif
     unsigned int accelerated:1;
+    unsigned int ignore_cc:1;
     unsigned int intercepted:1;  /**< transparently intercepted request */
     unsigned int spoof_client_ip:1;  /**< spoof client ip if possible */
     unsigned int internal:1;