Amos Jeffries [Tue, 14 Oct 2008 09:54:26 +0000 (22:54 +1300)]
Bug 1441: tcp_outgoing_address + peering need acl matching actual endpoint
Adds the 'peername' ACL to match against the cache_peer name=X values.
Also, adds peername ACL tests to tcp_outgoing_addr.
NOTE: Only checks against the first peer of all possible peers selected for
the connection. So on failures the outgoing address may still be incorrect for
the secondary peers.
Thanks for testing to Andrew McMillan <andrew@morphoss.com>
Amos Jeffries [Mon, 13 Oct 2008 09:41:25 +0000 (22:41 +1300)]
Add configure option --with-logdir=PATH for change of the log directory
Not all OS and builds can cope with the BSD /var/logs default.
This lets users and maintainers set OS-dependant log location without
needing to patch and bootstrap the code.
Amos Jeffries [Sun, 12 Oct 2008 23:50:38 +0000 (12:50 +1300)]
Update public IPv6 configure sub-options.
Drop all mention of CNAME recursion. Still buggy and experimental.
Alter --with-ipv4-mapping to default ON.
This is harmless if system defaults it to ON. But resolves problems
seen with systems where OS default is OFF disabling this advanced
hybrid-stack feature which squid needs.
Seen in some Linux, FreeBSD 7.1, OpenBSD, and Vista.
Amos Jeffries [Thu, 9 Oct 2008 13:00:28 +0000 (02:00 +1300)]
SourceFormat: Convert md5checker script into a recursive formatter+validator
This converts the md5 validation script from a single layer to a
recursive script.
Given a directory path calls the formater.pl script for all .h .c .cc and
.cci files within. Validating each file conversion as it goes and aborts
at the first error found.
This is intended for maintenance of the central Squid-3 repository code.
NP: As with the original checker its a bash script.
Probably non-portable right now without adaptions.
Amos Jeffries [Mon, 6 Oct 2008 10:14:06 +0000 (23:14 +1300)]
Author: Markus Moeller <markus_moeller@compuserve.com>
Update squid_kerb_auth helper to 1.0.3 release
Also add missing config.test file (empty) so
--enable-negotiate-auth-helpers=X will build it with Squid.
squid_kerb_auth 1.0.3 Official ReadMe file:
--------------------------------------------------------------------------------
readme.txt is the squid_kerb_auth read-me file.
Author: Markus Moeller (markus_moeller at compuserve.com)
Copyright (C) 2007 Markus Moeller. All rights reserved.
--------------------------------------------------------------------------------
squid_kerb_auth Read Me
Markus Moeller
May 12, 2007
1 Introduction
squid_kerb_auth is a reference implementation that supports authentication via
the Negotiate RFC 4559 for proxies. It decodes RFC 2478 SPNEGO GSS-API tokens
from IE7 either through helper functions or via SPNEGO supporting Kerberos libraries
and RFC 1964 Kerberos tokens from Firefox on Linux. Currently, squid_kerb_auth
supports Squid 2.6 on Linux.
squid_auth_kerb requires either MIT or Heimdal Kerberos libraries and header files.
2 Building and Installation
Run ./configure
for help use ./configure --help
Copy the helper squid_kerb_auth to an apropriate directory.
3 Configuration
a) Configure IE or Firefox to point to the squid proxy by using the fqdn. IE and Firefox will use the
fqdn to query for a HTTP/fqdn Kerberos service principal.
b) Create a keytab which contains the HTTP/fqdn Kerberos service principal and place it into a directory
where the squid run user can read the keytab.
c) Add the following line to squid.conf
auth_param negotiate program /usr/sbin/squid_kerb_auth
auth_param negotiate children 10
auth_param negotiate keep_alive on
d) Modify squid startup file
Add the following lines to the squid startup script to point squid to a keytab file which
contains the HTTP/fqdn service principal for the default Kerberos domain. The fqdn must be
the proxy name set in IE or firefox. You can not use an IP address.
If you use a different Kerberos domain than the machine itself is in you can point squid to
the seperate Kerberos config file by setting the following environmnet variable in the startup
script.
If squid_kerb_auth doesn't determine for some reason the right service principal you can provide
it with -s HTTP/fqdn.
If you serve multiple Kerberos realms add a HTTP/fqdn@REALM service principal per realm to the
HTTP.keytab file and use the -s GSS_C_NO_NAME option with squid_kerb_auth.
Amos Jeffries [Sun, 5 Oct 2008 01:39:55 +0000 (14:39 +1300)]
Bug 2393: DNS requests getting stuck in idns queue
Port of Squid-2 fix by Henrik Nordstrom
There seems to be two problems here.
a) On TCP communication failure Squid starts to restransmit the TCP query as
fast as it can, with no bounds checking. Keeps doing that until there is a
response or Squid is restarted...
b) For some reason the retransmit queue seems to halt for you. I have not yet
reproduced this issue, but may be related to the first..
This patch makes Squid log the DNS failure if it fails to connect to
a DNS server over TCP. TCP is required if the DNS response do not fit
within the small DNS UDP packet size (ca 0.5kb).
This patch makes Squid log the DNS failure if it fails to connect to
a DNS server over TCP. TCP is required if the DNS response do not fit
within the small DNS UDP packet size (ca 0.5kb).
This patch apparently do not solve the segmentation fault, but at least
logs the condition properly.
Alex Rousskov [Tue, 30 Sep 2008 20:36:15 +0000 (14:36 -0600)]
Removed UNUSED_CODE guards around check_null_access_log() because it is still
used. I do not know whether the latter is a bug, so this fix may be wrong,
but it allows trunk to build.
Alex Rousskov [Tue, 30 Sep 2008 18:17:32 +0000 (12:17 -0600)]
eCAP support, phase 2: Implemented libecap interfaces, added eCAP
squid.conf options. Link with libecap when eCAP support is enabled.
eCAP code needs polishing and enhancement but appears to work for a few
targeted cases. I am committing this now so that users working on eCAP
modules can test and provide more specific feedback.
These adaptation-specific changes should not have significant effect on
core code.
The libecap library is available at http://www.e-cap.org/
Alex Rousskov [Tue, 30 Sep 2008 17:28:53 +0000 (11:28 -0600)]
Catch most exceptions in main() to report exceptions uncaught by Squid. This
is for last resort reporting only -- the program would exit anyway (usually
with less information) if we did not catch these.
The code re-throws caught exceptions to reduce side effects of catching it,
just in case. May need more work depending on how compilers handle rethrowing.
Alex Rousskov [Tue, 30 Sep 2008 16:59:13 +0000 (10:59 -0600)]
Added HttpRequest::clone, completing HttpMsg::clone API. When ICAP is
converted to use this, it should work faster for a common "no modifications"
case because it would not have to print and parse the headers.
TODO: Consider renaming the method since it does not produce an exact,
true replica. Some connection-related flags and peer settings are not
cloned because the clone is not always "attached" or "coming from"
the same connection (e.g., it is cloned for eCAP to modify). We may also
#ifdef the method if it is not needed outside of adaptation code.
The HttpMsg::body_pipe field is now copied when a message is cloned.
I was not sure what the right thing to do there is. The field itself
may be misplaced (it is not about the message structure or properties,
but about the current body transfer state, but we lack a good place to
store that...). To reduce the number of cloning exceptions, and since
eCAP and probably ICAP code benefit from pipe copying, it is copied
for now. It would not be too hard to change.
Alex Rousskov [Tue, 30 Sep 2008 16:21:43 +0000 (10:21 -0600)]
Made TextException a child of std::exception so that it is easier to catch
more exceptions (standard and custom) with one catch(). The catching code
usually does not care what the exception is anyway.
TextException needs more work to report more information in what() method.
Catch std::exception to catch more printable exceptions. TextException is an
std::exception [child].
These changes were inspired by and required for eCAP.
Strange Install blocker bug found. No solution yet.
(19:04:54) rousskov: 2008/09/30 00:05:20| errorpage.cc(290) errorTryLoadText:
'/usr/local/squid3-ecap/share/errors/templates//usr/local/squid3-ecap/etc/errorpage.css':
(2) No such file or directory
(19:07:52) rousskov: $ make install > /tmp/tm
(19:07:52) rousskov: /bin/bash: -c: line 17: syntax error near unexpected token `then'
(19:07:52) rousskov: /bin/bash: -c: line 17: `@if test -f /usr/local/squid3-ecap/etc/errorpage.css ; then \'
Alex Rousskov [Tue, 30 Sep 2008 06:33:34 +0000 (00:33 -0600)]
To keep swanSong() checks simple, we need to NULL-ify vb body_pipe even if
we never were a consumer (because of useVirgin short circuiting).
For useVirgin() cloning to work when we were a consumer, we need to clone
before we clear the consumer (and body_pipe with it).
The whole thing is icky. This should be improved when Adaptation::Message does
not have to store a copy of body_pipe (there is already a TODO for that,
IIRC).
Adds %l replacement tag to include CSS file data into an error page.
Adds error_stylesheet option to name a file as the CSS content to insert
into each error pages displayed. (default /etc/squid/errorpage.css)
Adds CSS hooks into the templates.
Adds errorpage.css to squid config directory with current CSS settings
pulled from old templates and demo entries for new hooks.
The combined effect of these is allows company sites to stylize the pages
produced to some extent limited only by the CSS capabilities. Without
worrying about translation texts themselves.
Only works for dynamically translated pages based on updated templates.
Default CSS file may need some cleaning.
Alex Rousskov [Mon, 29 Sep 2008 03:50:32 +0000 (21:50 -0600)]
Polished code by introducing two explicit and mostly independent states
(proxying virgin body and proxying adapted body) as well as a flag to
check for virgin body content access after the pipe was invalidated.
Alex Rousskov [Sun, 28 Sep 2008 14:48:27 +0000 (08:48 -0600)]
Fixed comm_close handling in deferred reads. The code was expecting old-style
comm_remove_close_handler call to work if the close handler has not been
dialed yet. We now store a new-style callback so that we can reliably cancel
the close hander call.
Removed all methods from CommRead except for constructors. Apparently,
they were all unused and most were not even defined.
Alex Rousskov [Sun, 28 Sep 2008 01:16:18 +0000 (19:16 -0600)]
Made TextException a child of std::exception so that it is easier to catch
more exceptions (standard and custom) with one catch(). The catching code
usually does not care what the exception is anyway.
TextException needs more work to report more information in what() method.
projects / thirdparty / squid.git / log
