Amos Jeffries [Wed, 13 Jan 2010 12:11:48 +0000 (01:11 +1300)]
Add client_ip_max_connections
Given some incentive after deep consideration of the slowloris claims.
While I still do not believe Squid is vulnerable per-se and some people
have tested and found no such failures as claimed for the DoS attack.
We found we could provide better administrative controls. This is one such
that has been asked about many times and still did not exist. It operates
essentially the same as maxconn ACL, but does not require HTTP headers and
other request data to fully exist like ACLs do.
It is tested immediately after accept() and is request type agnostic, right
down to DNS TCP requests. So care is warranted in hierarchy situations or where
clients may be behind NAT.
Utilizes the client DB to monitor accepted TCP links. Operates prior to
everything so as to eliminate resource usage on the blocking case and
close the windows of opportunity for dribble-attacks etc.
Default (-1) is to keep the status-quo of no limits.
Amos Jeffries [Wed, 13 Jan 2010 04:17:42 +0000 (17:17 +1300)]
Regression Fix: Make Squid abort on parse failures.
The addition of multi-file parsing and catching of thrown errors between
them caused any errors in sub-files to be non-fatal and allow Squid to
run as if everything was normal, even if parts of the config were not
being loaded.
Squid will now propigate the error exception out and exit with a count of
the errors found.
Amos Jeffries [Wed, 13 Jan 2010 03:59:53 +0000 (16:59 +1300)]
Bug 2811: pt 1: Correct Peer table OID numbering
The IPv6 alterations to the cache_peer table display should not have
altered existing OID numbers. This fixes that by bumping the new table
format to a new OID number .1.3.6.1.4.1.3495.1.5.1.3 for version 3 of the
table.
NP: version 1 of the table was in 2.0->2.5, and 3.0
version 2 of the table was in 2.6+
Amos Jeffries [Wed, 13 Jan 2010 01:53:11 +0000 (14:53 +1300)]
Account for mem_node overhead inside cache_mem
This makes squid include the overhead memory space when determining the
number of data pages available in cache_mem memory space. Forming a much
better limit on memory cache usage.
This does NOT solve any issues created by sizeof(mem_node) being unaligned
with the system malloc implementation page size. That still needs to be
resolved.
The patch allows Squid v3.1 to build on RHEL 5.4 which has autoconf v2.59.
Without the patch, USE_DISKIO_AIO is zero but the corresponding AIO files
are compiled, leading to errors. I do not know if other platforms are
affected.
Amos Jeffries [Wed, 16 Dec 2009 01:01:25 +0000 (14:01 +1300)]
Bug 2395: FTP errors not displayed
* Fix PUT and other errors hanging
* Fix assertion "entry->store_status == STORE_PENDING" caused by FTP
* Several variable-shadowing cases resolved for the fix.
Amos Jeffries [Wed, 16 Dec 2009 00:51:19 +0000 (13:51 +1300)]
Bug 2830: clarify where NULL byte is in headers.
Debug printing used to naturally stop string output at the null byte.
This should show the first segment of headers up to the NULL and the
segment of headers after it. So that its clear to admin that there are
more headers _after_ the portion that used to be logged.
Amos Jeffries [Mon, 23 Nov 2009 02:20:24 +0000 (15:20 +1300)]
Polish ACL src/dst magic monikers and push upgrading to 'all'.
* Adds 'ipv4' magic moniker. Slightly safer and friendlier than !ipv6
* Updates the IP range parse to detect several old broken cases of 'all'.
Warn loudly and replace with 'all' during parse.
This is needed for all the people who use the 'all' pattern for special
purposes under another name; auth hiding, deny_info redirects, etc.
Henrik Nordstrom [Sat, 21 Nov 2009 22:20:01 +0000 (23:20 +0100)]
FreeBSD for some reason some times do not like our big cf.data script
Split in multiple expressions specified by -e arguments. Seems to work better.
The large blob had a bit of extra space characters in it from the line folding
which seems to be related to the failure. (each command began with a space)
Amos Jeffries [Sat, 21 Nov 2009 00:56:13 +0000 (13:56 +1300)]
Author: Henrik Nordstrom <henrik@henriknordstrom.net>
Style Makefile.am to use variable expansion instead of @ AUTOMAKEVAR
@AUTOMAKEVAR@ is troublesome when used in \ constructs as it may expand
to empty and the last line in a \ construct must not be empty or some
make versions will fail.
thankfully automake adds all variables for us, so using
is preferred.
Also:
* Cleanup our big sed rule to avoid automake collisions
* Odd REPL_POLICIES comment reference in repl/Makefile.am
Amos Jeffries [Sat, 14 Nov 2009 11:28:42 +0000 (00:28 +1300)]
Polish rfc1738 library code. Add cppunit tests.
* Adds API header file for this library.
* Reveals the do_escape API and creates meaningful flags for its API.
* Adds documentation.
* Convert original unit tests by Robert Collins to cppunit code
* Add new tests based on work for Samba by Andrew Bartlett
Amos Jeffries [Thu, 12 Nov 2009 13:46:50 +0000 (02:46 +1300)]
Author: Francesco Chemolli <kinkie@squid-cache.org>
Bug 2778: fix linking issues using SunCC
SunCC doesn't handle inline extern functions, and misses some duplicate
code detection features gcc has; as a result squid-specific operator new and
operator delete get defined multiple times and fail linking.
* Implemented a compiler-specific workaround by de-inlining the code.
* Improved Solaris OS detection logic.
Amos Jeffries [Wed, 4 Nov 2009 04:06:57 +0000 (17:06 +1300)]
Author: Henrik Nordstrom <henrik@henriknordstrom.net>
Various TPROXYv2 detection fixes
* Typo in quoting of build option
* Temporary patch forcing LINUX_TPROXY2 disabled if requirements unmet.
will be redone later to properly wind up dependencies and enabling of LINUX_TPROXY2 & friends.
Amos Jeffries [Tue, 27 Oct 2009 05:24:36 +0000 (18:24 +1300)]
Author: Henrik Nordstrom <henrik@henriknordstrom.net>
Polished ESI support
* make libxml2 and libexpat parser modules pluggable (Henrik)
* make libexpat and libxml2 tunable at configure time (Amos + Henrik)
* Fix Bug 2794: ESI parsing fails on FreeBSD (Francesco Chemolli)
* Enable ESI by default and auto-test
projects / thirdparty / squid.git / log
