Amos Jeffries [Thu, 9 Oct 2008 13:00:28 +0000 (02:00 +1300)]
SourceFormat: Convert md5checker script into a recursive formatter+validator
This converts the md5 validation script from a single layer to a
recursive script.
Given a directory path calls the formater.pl script for all .h .c .cc and
.cci files within. Validating each file conversion as it goes and aborts
at the first error found.
This is intended for maintenance of the central Squid-3 repository code.
NP: As with the original checker its a bash script.
Probably non-portable right now without adaptions.
Amos Jeffries [Mon, 6 Oct 2008 10:14:06 +0000 (23:14 +1300)]
Author: Markus Moeller <markus_moeller@compuserve.com>
Update squid_kerb_auth helper to 1.0.3 release
Also add missing config.test file (empty) so
--enable-negotiate-auth-helpers=X will build it with Squid.
squid_kerb_auth 1.0.3 Official ReadMe file:
--------------------------------------------------------------------------------
readme.txt is the squid_kerb_auth read-me file.
Author: Markus Moeller (markus_moeller at compuserve.com)
Copyright (C) 2007 Markus Moeller. All rights reserved.
--------------------------------------------------------------------------------
squid_kerb_auth Read Me
Markus Moeller
May 12, 2007
1 Introduction
squid_kerb_auth is a reference implementation that supports authentication via
the Negotiate RFC 4559 for proxies. It decodes RFC 2478 SPNEGO GSS-API tokens
from IE7 either through helper functions or via SPNEGO supporting Kerberos libraries
and RFC 1964 Kerberos tokens from Firefox on Linux. Currently, squid_kerb_auth
supports Squid 2.6 on Linux.
squid_auth_kerb requires either MIT or Heimdal Kerberos libraries and header files.
2 Building and Installation
Run ./configure
for help use ./configure --help
Copy the helper squid_kerb_auth to an apropriate directory.
3 Configuration
a) Configure IE or Firefox to point to the squid proxy by using the fqdn. IE and Firefox will use the
fqdn to query for a HTTP/fqdn Kerberos service principal.
b) Create a keytab which contains the HTTP/fqdn Kerberos service principal and place it into a directory
where the squid run user can read the keytab.
c) Add the following line to squid.conf
auth_param negotiate program /usr/sbin/squid_kerb_auth
auth_param negotiate children 10
auth_param negotiate keep_alive on
d) Modify squid startup file
Add the following lines to the squid startup script to point squid to a keytab file which
contains the HTTP/fqdn service principal for the default Kerberos domain. The fqdn must be
the proxy name set in IE or firefox. You can not use an IP address.
If you use a different Kerberos domain than the machine itself is in you can point squid to
the seperate Kerberos config file by setting the following environmnet variable in the startup
script.
If squid_kerb_auth doesn't determine for some reason the right service principal you can provide
it with -s HTTP/fqdn.
If you serve multiple Kerberos realms add a HTTP/fqdn@REALM service principal per realm to the
HTTP.keytab file and use the -s GSS_C_NO_NAME option with squid_kerb_auth.
Amos Jeffries [Sun, 5 Oct 2008 01:39:55 +0000 (14:39 +1300)]
Bug 2393: DNS requests getting stuck in idns queue
Port of Squid-2 fix by Henrik Nordstrom
There seems to be two problems here.
a) On TCP communication failure Squid starts to restransmit the TCP query as
fast as it can, with no bounds checking. Keeps doing that until there is a
response or Squid is restarted...
b) For some reason the retransmit queue seems to halt for you. I have not yet
reproduced this issue, but may be related to the first..
This patch makes Squid log the DNS failure if it fails to connect to
a DNS server over TCP. TCP is required if the DNS response do not fit
within the small DNS UDP packet size (ca 0.5kb).
This patch makes Squid log the DNS failure if it fails to connect to
a DNS server over TCP. TCP is required if the DNS response do not fit
within the small DNS UDP packet size (ca 0.5kb).
This patch apparently do not solve the segmentation fault, but at least
logs the condition properly.
Alex Rousskov [Tue, 30 Sep 2008 20:36:15 +0000 (14:36 -0600)]
Removed UNUSED_CODE guards around check_null_access_log() because it is still
used. I do not know whether the latter is a bug, so this fix may be wrong,
but it allows trunk to build.
Alex Rousskov [Tue, 30 Sep 2008 18:17:32 +0000 (12:17 -0600)]
eCAP support, phase 2: Implemented libecap interfaces, added eCAP
squid.conf options. Link with libecap when eCAP support is enabled.
eCAP code needs polishing and enhancement but appears to work for a few
targeted cases. I am committing this now so that users working on eCAP
modules can test and provide more specific feedback.
These adaptation-specific changes should not have significant effect on
core code.
The libecap library is available at http://www.e-cap.org/
Alex Rousskov [Tue, 30 Sep 2008 17:28:53 +0000 (11:28 -0600)]
Catch most exceptions in main() to report exceptions uncaught by Squid. This
is for last resort reporting only -- the program would exit anyway (usually
with less information) if we did not catch these.
The code re-throws caught exceptions to reduce side effects of catching it,
just in case. May need more work depending on how compilers handle rethrowing.
Alex Rousskov [Tue, 30 Sep 2008 16:59:13 +0000 (10:59 -0600)]
Added HttpRequest::clone, completing HttpMsg::clone API. When ICAP is
converted to use this, it should work faster for a common "no modifications"
case because it would not have to print and parse the headers.
TODO: Consider renaming the method since it does not produce an exact,
true replica. Some connection-related flags and peer settings are not
cloned because the clone is not always "attached" or "coming from"
the same connection (e.g., it is cloned for eCAP to modify). We may also
#ifdef the method if it is not needed outside of adaptation code.
The HttpMsg::body_pipe field is now copied when a message is cloned.
I was not sure what the right thing to do there is. The field itself
may be misplaced (it is not about the message structure or properties,
but about the current body transfer state, but we lack a good place to
store that...). To reduce the number of cloning exceptions, and since
eCAP and probably ICAP code benefit from pipe copying, it is copied
for now. It would not be too hard to change.
Alex Rousskov [Tue, 30 Sep 2008 16:21:43 +0000 (10:21 -0600)]
Made TextException a child of std::exception so that it is easier to catch
more exceptions (standard and custom) with one catch(). The catching code
usually does not care what the exception is anyway.
TextException needs more work to report more information in what() method.
Catch std::exception to catch more printable exceptions. TextException is an
std::exception [child].
These changes were inspired by and required for eCAP.
Strange Install blocker bug found. No solution yet.
(19:04:54) rousskov: 2008/09/30 00:05:20| errorpage.cc(290) errorTryLoadText:
'/usr/local/squid3-ecap/share/errors/templates//usr/local/squid3-ecap/etc/errorpage.css':
(2) No such file or directory
(19:07:52) rousskov: $ make install > /tmp/tm
(19:07:52) rousskov: /bin/bash: -c: line 17: syntax error near unexpected token `then'
(19:07:52) rousskov: /bin/bash: -c: line 17: `@if test -f /usr/local/squid3-ecap/etc/errorpage.css ; then \'
Alex Rousskov [Tue, 30 Sep 2008 06:33:34 +0000 (00:33 -0600)]
To keep swanSong() checks simple, we need to NULL-ify vb body_pipe even if
we never were a consumer (because of useVirgin short circuiting).
For useVirgin() cloning to work when we were a consumer, we need to clone
before we clear the consumer (and body_pipe with it).
The whole thing is icky. This should be improved when Adaptation::Message does
not have to store a copy of body_pipe (there is already a TODO for that,
IIRC).
Adds %l replacement tag to include CSS file data into an error page.
Adds error_stylesheet option to name a file as the CSS content to insert
into each error pages displayed. (default /etc/squid/errorpage.css)
Adds CSS hooks into the templates.
Adds errorpage.css to squid config directory with current CSS settings
pulled from old templates and demo entries for new hooks.
The combined effect of these is allows company sites to stylize the pages
produced to some extent limited only by the CSS capabilities. Without
worrying about translation texts themselves.
Only works for dynamically translated pages based on updated templates.
Default CSS file may need some cleaning.
Alex Rousskov [Mon, 29 Sep 2008 03:50:32 +0000 (21:50 -0600)]
Polished code by introducing two explicit and mostly independent states
(proxying virgin body and proxying adapted body) as well as a flag to
check for virgin body content access after the pipe was invalidated.
Alex Rousskov [Sun, 28 Sep 2008 14:48:27 +0000 (08:48 -0600)]
Fixed comm_close handling in deferred reads. The code was expecting old-style
comm_remove_close_handler call to work if the close handler has not been
dialed yet. We now store a new-style callback so that we can reliably cancel
the close hander call.
Removed all methods from CommRead except for constructors. Apparently,
they were all unused and most were not even defined.
Alex Rousskov [Sun, 28 Sep 2008 01:16:18 +0000 (19:16 -0600)]
Made TextException a child of std::exception so that it is easier to catch
more exceptions (standard and custom) with one catch(). The catching code
usually does not care what the exception is anyway.
TextException needs more work to report more information in what() method.
Alex Rousskov [Sat, 27 Sep 2008 18:17:22 +0000 (12:17 -0600)]
Use message representatives to store virgin and adapted messages.
Migrating to a model where all message changes are done via transaction,
not the message itself. A message cannot handle many changes on its own
because it is not a job, and placing some changes in MessageRep and some
in XactionRep results in messy code.
Alex Rousskov [Sat, 27 Sep 2008 18:12:43 +0000 (12:12 -0600)]
Synced with libecap changes related to FirstLine move to Message.
Migrating to a model where all message changes are done via transaction,
not the message itself. A message cannot handle many changes on its own
because it is not a job, and placing some changes in MessageRep and some
in XactionRep results in messy code.
Alex Rousskov [Thu, 25 Sep 2008 17:27:58 +0000 (11:27 -0600)]
Performance fix: Check half-closed descriptors at most once per second.
A few revisions back, comm checked half-closed descriptors once per second,
but the code was buggy. I replaced it with a simpler code that checked each
half-closed descriptor whenever the OS would mark it as ready for reading.
That was a bad idea: The checks wasted a lot of CPU cycles because half-closed
descriptors are usually ready for reading all the time.
This revision resurrects 1 check/sec limit, but hopefully with fewer bugs. In
my limited tests CPU usage seems to be back to normal.
All half-closed descriptors are now stored in TheHalfClosed set. When it is
time to check the corresponding connections, Comm schedules a read for
each descriptor that is not already reading. Conflicts with regular/user
reads are resolved as before -- we silently cancel the internal half-closed
read.
TODO: It is possible that we do not need to read at all and should call
getsockopt() instead to test the connection.
Alex Rousskov [Thu, 25 Sep 2008 17:22:12 +0000 (11:22 -0600)]
Added a DescriptorSet class to manage an unordered collection of unique
descriptors.
DescriptorSet is used for half-closed descriptor monitoring. It might be
useful for deferred reads as well, but that remains to be seen.
DescriptorSet has O(1) complexity for search, insertion, and deletion. It uses
about 2*sizeof(int)*MaxFD bytes total. Splay tree that used to store
half-closed descriptors previously uses less RAM for small number of
descriptors but has O(log n) complexity. Same for std::set<int>, a potential
DescriptorSet replacement.
projects / thirdparty / squid.git / log
