When the force_request_body_continuation access list is configured squid is
sends 100-Continue responses to all HTTP GET messages unless the admin
is very careful with the ACLs. This can be reproduced trivially with
force_request_body_continuation allow all
We should not evaluate force_request_body_continuation if the request
does not include "Expect: 100-continue" header.
Amos Jeffries [Sun, 18 Jan 2015 16:34:13 +0000 (08:34 -0800)]
Support rotate=N option on access_log
Add a rotate=N option to access_log directive to set per-log what the
retained log count will be. At present it is only used by the stdio:
logging module, which is also the only one to use logfile_rotate
directive.
If this option is absent (as will be the common case) the log rotation
defaults to using the value of logfile_rotate directive.
Also, add missing dump output of other access_log options if they differ
from the defaults.
The use-cases for this are:
1) Unix fifo logging requires all the stdio: module operations except
that the normal rotate/rename operation is NOT performed on the fifo
socket. It makes more sense to add this option which can also meet case
#2 than to create a whole new module just for fifo.
2) managing only some access_log files with a third-party log manager.
Those specific logs need rotate=0, but the Squid managed logs may
require non-0 values.
Amos Jeffries [Sat, 17 Jan 2015 09:15:53 +0000 (01:15 -0800)]
Bug 3997: Excessive NTLM or Negotiate auth helper annotations
With the transaction annotations feature added in Squid-3.4 auth
helper response values get recorded as annotatiions. In the case
of NTLM and Negotiate authentication the helper response contains
a large credentials token which changes frequently.
Also, user credentials state is cached. In the case of NTLM and
Negotiate the active credentials are cached in the TCP connection
state data, but also for the cache mgr helper reports make use of
caching in a global username cache.
When these two features are combined, the global username cache
for mgr reporting accumulates all TCP connection specific
token= values presented by the client on all its connections, and
any changes to the token over its lifetime.
The result is that for users performing either many transactions,
or staying connected for long periods the memory consumption from
unnecesarily stored tokens is excessive. When clients do both the
machine memory can be consumed, and the CPU can reach 100%
consumption just walking the annotations lists during regular
operations.
To fix this we drop the security credentials tokens from cached
annotations list in NTLM and Negotiate. Digest is also included
though its HA1 token value is static it has similar privacy issues
related to storage.
Also, use the new 3.5 APi for username cache key creation to build
the global username cache key for NTLM/Negotiate using the TCP
connection specific token so that credentials and associated
tokens do not get accidentally shared between connections and the
manager can accurately report users.
Intercepting proxies often receive non-HTTP connections. Squid cannot currently
deal with such connections well because it assumes that a given port receives
HTTP, FTP, or HTTPS traffic exclusively. This patch allows Squid to tunnel
unexpected connections instead of terminating them with an error.
In this project, we define an unexpected connection as a connection that
resulted in a Squid error during first request parsing. Which errors trigger
tunneling behavior is configurable by the admin using ACLs.
# tunnel everything that does not look like HTTP:
on_first_request_error tunnel foreignProtocol
# tunnel if we think the client waits for the server to talk first:
on_first_request_error tunnel serverTalksFirstProtocol
# in all other error cases, just send an HTTP "error page" response:
on_first_request_error respond all
# Configure how long to wait for the first byte on the incoming
# connection before raising an ERR_REQUEST_START_TIMEOUT error.
request_start_timeout 5 seconds
The overall intent of this TCP tunnel is to get Squid out of the communication
loop to the extent possible. Once the decision to tunnel is made, no Squid
errors are going to be sent to the client and tunneled traffic is not going to
be sent to Squid adaptation services or logged to access.log (except for a
single summary line at the end of the transaction). Connection closure at the
server (or client) end of the tunnel is propagated to the other end by closing
the corresponding connection.
This patch also:
Add "on_first_request_error", a new ACL-driven squid.conf directive that can
be used to establish a blind TCP tunnel which relays all bytes from/to the
intercepted connection to/from the intended destination address. See the sketch
above.
The on_first_request_error directive supports fast ACLs only.
Add "squid_error", a new ACL type to match transactions that triggered a given
Squid error. Squid error IDs are used to configure one or more errors to match.
This is similar to the existing ssl_error ACL type but works with
Squid-generated errors rather than SSL library errors.
Add "ERR_PROTOCOL_UNKNOWN", a Squid error triggered for http_port connections
that start with something that lacks even basic HTTP request structure. This
error is triggered by the HTTP request parser, and probably only when/after the
current parsing code detects an error. That is, we do not want to introduce
new error conditions, but we want to treat some of the currently triggered
parsing errors as a "wrong protocol" error, possibly after checking the parsing
state or the input buffer for some clues. There is no known way to reliably
distinguish malformed HTTP requests from non-HTTP traffic so the parser has
to use some imprecise heuristics to make a decision in some cases.
In the future, it would be possible to add code to reliably detect some popular
non-HTTP protocols, but adding such code is outside this project scope.
Add "request_start_timeout", a new squid.conf directive to trigger a new
Squid ERR_REQUEST_START_TIMEOUT error if no bytes are received from the
client on a newly established http_port connection during the configured
time period. Applies to all http_ports (for now).
No support for tunneling through cache_peers is included. Configurations
that direct outgoing traffic through a peer may break Squid.
Amos Jeffries [Mon, 12 Jan 2015 08:11:06 +0000 (00:11 -0800)]
squidclient: Fix -A and -P options
With --https addition the A and P values are re-used for --cert and
--params within HTTPS options. This works for long options, but they
cannot be listed as short options by the Transport:: module because
they are required at the top level by old-style HTTP parameters.
Amos Jeffries [Thu, 8 Jan 2015 23:41:52 +0000 (15:41 -0800)]
Update IPC sockets verification check
Coverity Scan gets confused by the code trick of using memset() on a
buffer then filling arbitrary string data into all but the final byte of
that buffer - thus implicitly null terminating.
Try an explicit null termination instead of memset(), this should make
Coverity a bit happier and is also faster than zero'ing the entire buf.
Turn c++11 initializer lists into explicit constructors
Only fairly recent versions of gcc and clang support well c++11-style
initializer lists; reverting to traditional constructors obtains
better portability at the price of less readable code.
This changeset can be reverted after RHEL/CentOS 6, Debian Wheezy and
Ubuntu Precise will not be supported anymore.
Amos Jeffries [Sun, 4 Jan 2015 07:40:55 +0000 (23:40 -0800)]
Improved automake 1.13+ support in unit-tests
Automake 1.13+ are warning about subdir-objects being enabled in
future versions but Squid currently relies on several environment
constructs that prevent that feature from working.
* All cppunit tests share a main() implementation in testMain.cc
which is not able to easily be built as a .o from locations
such as compat/.
Fix this by making the code to include/unitTestMain.h and
including it as an inline main() definition for all cppunit
tests core .cc files.
* lib/testAll unit test
Fix by splitting out into multiple unit-test binaries as is done
by the rest of Squid. And removing duplicate testMain.cc.
* lib/ and src/ objects link to objects in child directories
Enable subdir-objects when possible. Some remain due to
depending on stubs files in the not yet created src/tests/ build
directory. That will be fixed in a future commit.
Amos Jeffries [Fri, 2 Jan 2015 13:15:24 +0000 (05:15 -0800)]
Bug 3754: configure doesnt detect IPFilter 5.1.2 system headers
Solaris 10+ bundles IPFilter code natively, but the IPFilter
headers contain a duplicate definition of minor_t which does
not match the existing OS definition.
The result is that no applications (such as Squid) will build
on Solaris with the natively provided headers.
Also, the upstream IPFilter code separate from Solaris contains
the same minor_t definition so building against a separate
install of IPFilter does not fix the issue.
We must instead play fancy games #define'ing minor_t to a
different real-name for the OS headers and its own name for
the IPFilter headers.
Thanks to Yuri Voinov for sponsoring the Solaris 10
machine and environment resources for this fix.
Amos Jeffries [Thu, 1 Jan 2015 08:57:18 +0000 (00:57 -0800)]
Cleanup: fix most 'unused parameter' warnings
... and several bugs hidden by lack of this check:
* url_rewrite_timeout parser/dumper using wrong cf.data.pre
parameter definition.
* url_rewrite_timeout parser/dumper using wrong object for
state data.
Global a Config object instead of parameter object.
Preventing future use of multiple Config objects. There is
more to be done as the Timeout value itself is not stored
as part of the object apparently detailing the timeout.
* request_header_add directive dump() omitting directive
name in mgr:config output.
* dead code as HTCP packet handlers for NOP, MON, SET
* mime icons download operation incorrectly initialized.
was using the 'view' access parameter to set download
access permission.
* peerCountHandleIcpReply() assertions testing validity
after pointers already used. This would lead to segfault
on errors, now leading to assertion logging.
Only the default built code was checked and updated at this
time. There are 62 known warnings still appearing due to
parameters being only used inside conditional code, possibly
more issues in code not enabled in this build and certainly
a lot more in the stubs and unit tests which were not checked.
projects / thirdparty / squid.git / log
