client_side_request.cc
Go to the documentation of this file.
1 /*
2  * Copyright (C) 1996-2018 The Squid Software Foundation and contributors
3  *
4  * Squid software is distributed under GPLv2+ license and includes
5  * contributions from numerous individuals and organizations.
6  * Please see the COPYING and CONTRIBUTORS files for details.
7  */
8 
9 /* DEBUG: section 85 Client-side Request Routines */
10 
11 /*
12  * General logic of request processing:
13  *
14  * We run a series of tests to determine if access will be permitted, and to do
15  * any redirection. Then we call into the result clientStream to retrieve data.
16  * From that point on it's up to reply management.
17  */
18 
19 #include "squid.h"
20 #include "acl/FilledChecklist.h"
21 #include "acl/Gadgets.h"
22 #include "anyp/PortCfg.h"
23 #include "base/AsyncJobCalls.h"
24 #include "client_side.h"
25 #include "client_side_reply.h"
26 #include "client_side_request.h"
27 #include "ClientRequestContext.h"
28 #include "clientStream.h"
29 #include "comm/Connection.h"
30 #include "comm/Write.h"
31 #include "err_detail_type.h"
32 #include "errorpage.h"
33 #include "fd.h"
34 #include "fde.h"
35 #include "format/Token.h"
36 #include "gopher.h"
37 #include "helper.h"
38 #include "helper/Reply.h"
39 #include "http.h"
40 #include "http/Stream.h"
41 #include "HttpHdrCc.h"
42 #include "HttpReply.h"
43 #include "HttpRequest.h"
44 #include "ip/NfMarkConfig.h"
45 #include "ip/QosConfig.h"
46 #include "ipcache.h"
47 #include "log/access_log.h"
48 #include "MemObject.h"
49 #include "Parsing.h"
50 #include "profiler/Profiler.h"
51 #include "redirect.h"
52 #include "rfc1738.h"
53 #include "SquidConfig.h"
54 #include "SquidTime.h"
55 #include "Store.h"
56 #include "StrList.h"
57 #include "tools.h"
58 #include "wordlist.h"
59 #if USE_AUTH
60 #include "auth/UserRequest.h"
61 #endif
62 #if USE_ADAPTATION
63 #include "adaptation/AccessCheck.h"
64 #include "adaptation/Answer.h"
65 #include "adaptation/Iterator.h"
66 #include "adaptation/Service.h"
67 #if ICAP_CLIENT
69 #endif
70 #endif
71 #if USE_OPENSSL
72 #include "ssl/ServerBump.h"
73 #include "ssl/support.h"
74 #endif
75 
76 #if LINGERING_CLOSE
77 #define comm_close comm_lingering_close
78 #endif
79 
80 static const char *const crlf = "\r\n";
81 
82 #if FOLLOW_X_FORWARDED_FOR
83 static void clientFollowXForwardedForCheck(allow_t answer, void *data);
84 #endif /* FOLLOW_X_FORWARDED_FOR */
85 
87 
89 
90 /* Local functions */
91 /* other */
92 static void clientAccessCheckDoneWrapper(allow_t, void *);
93 #if USE_OPENSSL
94 static void sslBumpAccessCheckDoneWrapper(allow_t, void *);
95 #endif
96 static int clientHierarchical(ClientHttpRequest * http);
100 static void checkNoCacheDoneWrapper(allow_t, void *);
104 static void checkFailureRatio(err_type, hier_code);
105 
107 {
108  /*
109  * Release our "lock" on our parent, ClientHttpRequest, if we
110  * still have one
111  */
112 
113  if (http)
115 
116  delete error;
117  debugs(85,3, "ClientRequestContext destructed, this=" << this);
118 }
119 
121  http(cbdataReference(anHttp)),
122  acl_checklist(NULL),
123  redirect_state(REDIRECT_NONE),
124  store_id_state(REDIRECT_NONE),
125  host_header_verify_done(false),
126  http_access_done(false),
127  adapted_http_access_done(false),
128 #if USE_ADAPTATION
129  adaptation_acl_check_done(false),
130 #endif
131  redirect_done(false),
132  store_id_done(false),
133  no_cache_done(false),
134  interpreted_req_hdrs(false),
135  toClientMarkingDone(false),
136 #if USE_OPENSSL
137  sslBumpCheckDone(false),
138 #endif
139  error(NULL),
140  readNextRequest(false)
141 {
142  debugs(85, 3, "ClientRequestContext constructed, this=" << this);
143 }
144 
146 
148 #if USE_ADAPTATION
149  AsyncJob("ClientHttpRequest"),
150 #endif
151  request(NULL),
152  uri(NULL),
153  log_uri(NULL),
154  req_sz(0),
155  calloutContext(NULL),
156  maxReplyBodySize_(0),
157  entry_(NULL),
158  loggingEntry_(NULL),
159  conn_(NULL)
160 #if USE_OPENSSL
161  , sslBumpNeed_(Ssl::bumpEnd)
162 #endif
163 #if USE_ADAPTATION
164  , request_satisfaction_mode(false)
165  , request_satisfaction_offset(0)
166 #endif
167 {
168  setConn(aConn);
169  al = new AccessLogEntry;
171  if (aConn) {
173  al->cache.port = aConn->port;
174  al->cache.caddr = aConn->log_addr;
175 
176 #if USE_OPENSSL
177  if (aConn->clientConnection != NULL && aConn->clientConnection->isOpen()) {
178  if (auto ssl = fd_table[aConn->clientConnection->fd].ssl.get())
179  al->cache.sslClientCert.resetWithoutLocking(SSL_get_peer_certificate(ssl));
180  }
181 #endif
182  }
184 }
185 
186 /*
187  * returns true if client specified that the object must come from the cache
188  * without contacting origin server
189  */
190 bool
192 {
193  assert(request);
194  return request->cache_control &&
196 }
197 
210 static void
212 {
213  // Can be set at compile time with -D compiler flag
214 #ifndef FAILURE_MODE_TIME
215 #define FAILURE_MODE_TIME 300
216 #endif
217 
218  if (hcode == HIER_NONE)
219  return;
220 
221  // don't bother when ICP is disabled.
222  if (Config.Port.icp <= 0)
223  return;
224 
225  static double magic_factor = 100.0;
226  double n_good;
227  double n_bad;
228 
229  n_good = magic_factor / (1.0 + request_failure_ratio);
230 
231  n_bad = magic_factor - n_good;
232 
233  switch (etype) {
234 
235  case ERR_DNS_FAIL:
236 
237  case ERR_CONNECT_FAIL:
239 
240  case ERR_READ_ERROR:
241  ++n_bad;
242  break;
243 
244  default:
245  ++n_good;
246  }
247 
248  request_failure_ratio = n_bad / n_good;
249 
251  return;
252 
253  if (request_failure_ratio < 1.0)
254  return;
255 
256  debugs(33, DBG_CRITICAL, "WARNING: Failure Ratio at "<< std::setw(4)<<
257  std::setprecision(3) << request_failure_ratio);
258 
259  debugs(33, DBG_CRITICAL, "WARNING: ICP going into HIT-only mode for " <<
260  FAILURE_MODE_TIME / 60 << " minutes...");
261 
263 
264  request_failure_ratio = 0.8; /* reset to something less than 1.0 */
265 }
266 
268 {
269  debugs(33, 3, "httpRequestFree: " << uri);
271 
272  // Even though freeResources() below may destroy the request,
273  // we no longer set request->body_pipe to NULL here
274  // because we did not initiate that pipe (ConnStateData did)
275 
276  /* the ICP check here was erroneous
277  * - StoreEntry::releaseRequest was always called if entry was valid
278  */
279 
280  logRequest();
281 
283 
284  if (request)
286 
287  freeResources();
288 
289 #if USE_ADAPTATION
291 
292  if (adaptedBodySource != NULL)
294 #endif
295 
296  if (calloutContext)
297  delete calloutContext;
298 
300 
301  if (conn_)
303 
304  /* moving to the next connection is handled by the context free */
306 
308 }
309 
319 int
320 clientBeginRequest(const HttpRequestMethod& method, char const *url, CSCB * streamcallback,
321  CSD * streamdetach, ClientStreamData streamdata, HttpHeader const *header,
322  char *tailbuf, size_t taillen, const MasterXaction::Pointer &mx)
323 {
324  size_t url_sz;
327  StoreIOBuffer tempBuffer;
328  if (http->al != NULL)
329  http->al->cache.start_time = current_time;
330  /* this is only used to adjust the connection offset in client_side.c */
331  http->req_sz = 0;
332  tempBuffer.length = taillen;
333  tempBuffer.data = tailbuf;
334  /* client stream setup */
336  clientReplyStatus, new clientReplyContext(http), streamcallback,
337  streamdetach, streamdata, tempBuffer);
338  /* make it visible in the 'current acctive requests list' */
339  /* Set flags */
340  /* internal requests only makes sense in an
341  * accelerator today. TODO: accept flags ? */
342  http->flags.accel = true;
343  /* allow size for url rewriting */
344  url_sz = strlen(url) + Config.appendDomainLen + 5;
345  http->uri = (char *)xcalloc(url_sz, 1);
346  strcpy(http->uri, url); // XXX: polluting http->uri before parser validation
347 
348  if ((request = HttpRequest::FromUrl(http->uri, mx, method)) == NULL) {
349  debugs(85, 5, "Invalid URL: " << http->uri);
350  return -1;
351  }
352 
353  /*
354  * now update the headers in request with our supplied headers.
355  * HttpRequest::FromUrl() should return a blank header set, but
356  * we use Update to be sure of correctness.
357  */
358  if (header)
359  request->header.update(header);
360 
361  /* http struct now ready */
362 
363  /*
364  * build new header list *? TODO
365  */
366  request->flags.accelerated = http->flags.accel;
367 
368  /* this is an internally created
369  * request, not subject to acceleration
370  * target overrides */
371  /*
372  * FIXME? Do we want to detect and handle internal requests of internal
373  * objects ?
374  */
375 
376  /* Internally created requests cannot have bodies today */
377  request->content_length = 0;
378 
379  request->client_addr.setNoAddr();
380 
381 #if FOLLOW_X_FORWARDED_FOR
382  request->indirect_client_addr.setNoAddr();
383 #endif /* FOLLOW_X_FORWARDED_FOR */
384 
385  request->my_addr.setNoAddr(); /* undefined for internal requests */
386 
387  request->my_addr.port(0);
388 
389  request->http_ver = Http::ProtocolVersion();
390 
391  http->initRequest(request);
392 
393  /* optional - skip the access check ? */
394  http->calloutContext = new ClientRequestContext(http);
395 
396  http->calloutContext->http_access_done = false;
397 
398  http->calloutContext->redirect_done = true;
399 
400  http->calloutContext->no_cache_done = true;
401 
402  http->doCallouts();
403 
404  return 0;
405 }
406 
407 bool
409 {
410  ClientHttpRequest *http_ = http;
411 
412  if (cbdataReferenceValid(http_))
413  return true;
414 
415  http = NULL;
416 
417  cbdataReferenceDone(http_);
418 
419  return false;
420 }
421 
422 #if FOLLOW_X_FORWARDED_FOR
423 
437 static void
439 {
440  ClientRequestContext *calloutContext = (ClientRequestContext *) data;
441 
442  if (!calloutContext->httpStateIsValid())
443  return;
444 
445  ClientHttpRequest *http = calloutContext->http;
446  HttpRequest *request = http->request;
447 
448  if (answer.allowed() && request->x_forwarded_for_iterator.size() != 0) {
449 
450  /*
451  * Remove the last comma-delimited element from the
452  * x_forwarded_for_iterator and use it to repeat the cycle.
453  */
454  const char *p;
455  const char *asciiaddr;
456  int l;
458  p = request->x_forwarded_for_iterator.termedBuf();
459  l = request->x_forwarded_for_iterator.size();
460 
461  /*
462  * XXX x_forwarded_for_iterator should really be a list of
463  * IP addresses, but it's a String instead. We have to
464  * walk backwards through the String, biting off the last
465  * comma-delimited part each time. As long as the data is in
466  * a String, we should probably implement and use a variant of
467  * strListGetItem() that walks backwards instead of forwards
468  * through a comma-separated list. But we don't even do that;
469  * we just do the work in-line here.
470  */
471  /* skip trailing space and commas */
472  while (l > 0 && (p[l-1] == ',' || xisspace(p[l-1])))
473  --l;
474  request->x_forwarded_for_iterator.cut(l);
475  /* look for start of last item in list */
476  while (l > 0 && ! (p[l-1] == ',' || xisspace(p[l-1])))
477  --l;
478  asciiaddr = p+l;
479  if ((addr = asciiaddr)) {
480  request->indirect_client_addr = addr;
481  request->x_forwarded_for_iterator.cut(l);
484  /* override the default src_addr tested if we have to go deeper than one level into XFF */
485  Filled(calloutContext->acl_checklist)->src_addr = request->indirect_client_addr;
486  }
488  return;
489  }
490  }
491 
492  /* clean up, and pass control to clientAccessCheck */
494  /*
495  * Ensure that the access log shows the indirect client
496  * instead of the direct client.
497  */
498  http->al->cache.caddr = request->indirect_client_addr;
499  if (ConnStateData *conn = http->getConn())
500  conn->log_addr = request->indirect_client_addr;
501  }
502  request->x_forwarded_for_iterator.clean();
503  request->flags.done_follow_x_forwarded_for = true;
504 
505  if (answer.conflicted()) {
506  debugs(28, DBG_CRITICAL, "ERROR: Processing X-Forwarded-For. Stopping at IP address: " << request->indirect_client_addr );
507  }
508 
509  /* process actual access ACL as normal. */
510  calloutContext->clientAccessCheck();
511 }
512 #endif /* FOLLOW_X_FORWARDED_FOR */
513 
514 static void
516 {
517  ClientRequestContext *c = static_cast<ClientRequestContext*>(data);
518  c->hostHeaderIpVerify(ia, dns);
519 }
520 
521 void
523 {
525 
526  // note the DNS details for the transaction stats.
527  http->request->recordLookup(dns);
528 
529  // Is the NAT destination IP in DNS?
530  if (ia && ia->have(clientConn->local)) {
531  debugs(85, 3, "validate IP " << clientConn->local << " possible from Host:");
532  http->request->flags.hostVerified = true;
533  http->doCallouts();
534  return;
535  }
536  debugs(85, 3, HERE << "FAIL: validate IP " << clientConn->local << " possible from Host:");
537  hostHeaderVerifyFailed("local IP", "any domain IP");
538 }
539 
540 void
542 {
543  // IP address validation for Host: failed. Admin wants to ignore them.
544  // NP: we do not yet handle CONNECT tunnels well, so ignore for them
546  debugs(85, 3, "SECURITY ALERT: Host header forgery detected on " << http->getConn()->clientConnection <<
547  " (" << A << " does not match " << B << ") on URL: " << http->request->effectiveRequestUri());
548 
549  // NP: it is tempting to use 'flags.noCache' but that is all about READing cache data.
550  // The problems here are about WRITE for new cache content, which means flags.cachable
551  http->request->flags.cachable = false; // MUST NOT cache (for now)
552  // XXX: when we have updated the cache key to base on raw-IP + URI this cacheable limit can go.
553  http->request->flags.hierarchical = false; // MUST NOT pass to peers (for now)
554  // XXX: when we have sorted out the best way to relay requests properly to peers this hierarchical limit can go.
555  http->doCallouts();
556  return;
557  }
558 
559  debugs(85, DBG_IMPORTANT, "SECURITY ALERT: Host header forgery detected on " <<
560  http->getConn()->clientConnection << " (" << A << " does not match " << B << ")");
561  if (const char *ua = http->request->header.getStr(Http::HdrType::USER_AGENT))
562  debugs(85, DBG_IMPORTANT, "SECURITY ALERT: By user agent: " << ua);
563  debugs(85, DBG_IMPORTANT, "SECURITY ALERT: on URL: " << http->request->effectiveRequestUri());
564 
565  // IP address validation for Host: failed. reject the connection.
567  clientReplyContext *repContext = dynamic_cast<clientReplyContext *>(node->data.getRaw());
568  assert (repContext);
569  repContext->setReplyToError(ERR_CONFLICT_HOST, Http::scConflict,
570  http->request->method, NULL,
572  http->request,
573  NULL,
574 #if USE_AUTH
575  http->getConn() != NULL && http->getConn()->getAuth() != NULL ?
577 #else
578  NULL);
579 #endif
581  clientStreamRead(node, http, node->readBuffer);
582 }
583 
584 void
586 {
587  // Require a Host: header.
588  const char *host = http->request->header.getStr(Http::HdrType::HOST);
589 
590  if (!host) {
591  // TODO: dump out the HTTP/1.1 error about missing host header.
592  // otherwise this is fine, can't forge a header value when its not even set.
593  debugs(85, 3, HERE << "validate skipped with no Host: header present.");
594  http->doCallouts();
595  return;
596  }
597 
598  if (http->request->flags.internal) {
599  // TODO: kill this when URL handling allows partial URLs out of accel mode
600  // and we no longer screw with the URL just to add our internal host there
601  debugs(85, 6, HERE << "validate skipped due to internal composite URL.");
602  http->doCallouts();
603  return;
604  }
605 
606  // Locate if there is a port attached, strip ready for IP lookup
607  char *portStr = NULL;
608  char *hostB = xstrdup(host);
609  host = hostB;
610  if (host[0] == '[') {
611  // IPv6 literal.
612  portStr = strchr(hostB, ']');
613  if (portStr && *(++portStr) != ':') {
614  portStr = NULL;
615  }
616  } else {
617  // Domain or IPv4 literal with port
618  portStr = strrchr(hostB, ':');
619  }
620 
621  uint16_t port = 0;
622  if (portStr) {
623  *portStr = '\0'; // strip the ':'
624  if (*(++portStr) != '\0') {
625  char *end = NULL;
626  int64_t ret = strtoll(portStr, &end, 10);
627  if (end == portStr || *end != '\0' || ret < 1 || ret > 0xFFFF) {
628  // invalid port details. Replace the ':'
629  *(--portStr) = ':';
630  portStr = NULL;
631  } else
632  port = (ret & 0xFFFF);
633  }
634  }
635 
636  debugs(85, 3, "validate host=" << host << ", port=" << port << ", portStr=" << (portStr?portStr:"NULL"));
638  // verify the Host: port (if any) matches the apparent destination
639  if (portStr && port != http->getConn()->clientConnection->local.port()) {
640  debugs(85, 3, "FAIL on validate port " << http->getConn()->clientConnection->local.port() <<
641  " matches Host: port " << port << " (" << portStr << ")");
642  hostHeaderVerifyFailed("intercepted port", portStr);
643  } else {
644  // XXX: match the scheme default port against the apparent destination
645 
646  // verify the destination DNS is one of the Host: headers IPs
648  }
649  } else if (!Config.onoff.hostStrictVerify) {
650  debugs(85, 3, "validate skipped.");
651  http->doCallouts();
652  } else if (strlen(host) != strlen(http->request->url.host())) {
653  // Verify forward-proxy requested URL domain matches the Host: header
654  debugs(85, 3, "FAIL on validate URL domain length " << http->request->url.host() << " matches Host: " << host);
656  } else if (matchDomainName(host, http->request->url.host()) != 0) {
657  // Verify forward-proxy requested URL domain matches the Host: header
658  debugs(85, 3, "FAIL on validate URL domain " << http->request->url.host() << " matches Host: " << host);
660  } else if (portStr && port != http->request->url.port()) {
661  // Verify forward-proxy requested URL domain matches the Host: header
662  debugs(85, 3, "FAIL on validate URL port " << http->request->url.port() << " matches Host: port " << portStr);
663  hostHeaderVerifyFailed("URL port", portStr);
664  } else if (!portStr && http->request->method != Http::METHOD_CONNECT && http->request->url.port() != http->request->url.getScheme().defaultPort()) {
665  // Verify forward-proxy requested URL domain matches the Host: header
666  // Special case: we don't have a default-port to check for CONNECT. Assume URL is correct.
667  debugs(85, 3, "FAIL on validate URL port " << http->request->url.port() << " matches Host: default port " << http->request->url.getScheme().defaultPort());
668  hostHeaderVerifyFailed("URL port", "default port");
669  } else {
670  // Okay no problem.
671  debugs(85, 3, "validate passed.");
672  http->request->flags.hostVerified = true;
673  http->doCallouts();
674  }
675  safe_free(hostB);
676 }
677 
678 /* This is the entry point for external users of the client_side routines */
679 void
681 {
682 #if FOLLOW_X_FORWARDED_FOR
683  if (!http->request->flags.doneFollowXff() &&
686 
687  /* we always trust the direct client address for actual use */
690 
691  /* setup the XFF iterator for processing */
693 
694  /* begin by checking to see if we trust direct client enough to walk XFF */
697  return;
698  }
699 #endif
700 
701  if (Config.accessList.http) {
704  } else {
705  debugs(0, DBG_CRITICAL, "No http_access configuration found. This will block ALL traffic");
707  }
708 }
709 
715 void
717 {
721  } else {
722  debugs(85, 2, HERE << "No adapted_http_access configuration. default: ALLOW");
724  }
725 }
726 
727 void
729 {
730  ClientRequestContext *calloutContext = (ClientRequestContext *) data;
731 
732  if (!calloutContext->httpStateIsValid())
733  return;
734 
735  calloutContext->clientAccessCheckDone(answer);
736 }
737 
738 void
740 {
742  err_type page_id;
743  Http::StatusCode status;
744  debugs(85, 2, "The request " << http->request->method << ' ' <<
745  http->uri << " is " << answer <<
746  "; last ACL checked: " << (AclMatchedName ? AclMatchedName : "[none]"));
747 
748 #if USE_AUTH
749  char const *proxy_auth_msg = "<null>";
750  if (http->getConn() != NULL && http->getConn()->getAuth() != NULL)
751  proxy_auth_msg = http->getConn()->getAuth()->denyMessage("<null>");
752  else if (http->request->auth_user_request != NULL)
753  proxy_auth_msg = http->request->auth_user_request->denyMessage("<null>");
754 #endif
755 
756  if (!answer.allowed()) {
757  // auth has a grace period where credentials can be expired but okay not to challenge.
758 
759  /* Send an auth challenge or error */
760  // XXX: do we still need aclIsProxyAuth() ?
761  bool auth_challenge = (answer == ACCESS_AUTH_REQUIRED || aclIsProxyAuth(AclMatchedName));
762  debugs(85, 5, "Access Denied: " << http->uri);
763  debugs(85, 5, "AclMatchedName = " << (AclMatchedName ? AclMatchedName : "<null>"));
764 #if USE_AUTH
765  if (auth_challenge)
766  debugs(33, 5, "Proxy Auth Message = " << (proxy_auth_msg ? proxy_auth_msg : "<null>"));
767 #endif
768 
769  /*
770  * NOTE: get page_id here, based on AclMatchedName because if
771  * USE_DELAY_POOLS is enabled, then AclMatchedName gets clobbered in
772  * the clientCreateStoreEntry() call just below. Pedro Ribeiro
773  * <pribeiro@isel.pt>
774  */
775  page_id = aclGetDenyInfoPage(&Config.denyInfoList, AclMatchedName, answer != ACCESS_AUTH_REQUIRED);
776 
778 
779  if (auth_challenge) {
780 #if USE_AUTH
781  if (http->request->flags.sslBumped) {
782  /*SSL Bumped request, authentication is not possible*/
783  status = Http::scForbidden;
784  } else if (!http->flags.accel) {
785  /* Proxy authorisation needed */
787  } else {
788  /* WWW authorisation needed */
789  status = Http::scUnauthorized;
790  }
791 #else
792  // need auth, but not possible to do.
793  status = Http::scForbidden;
794 #endif
795  if (page_id == ERR_NONE)
796  page_id = ERR_CACHE_ACCESS_DENIED;
797  } else {
798  status = Http::scForbidden;
799 
800  if (page_id == ERR_NONE)
801  page_id = ERR_ACCESS_DENIED;
802  }
803 
804  Ip::Address tmpnoaddr;
805  tmpnoaddr.setNoAddr();
806  error = clientBuildError(page_id, status,
807  NULL,
808  http->getConn() != NULL ? http->getConn()->clientConnection->remote : tmpnoaddr,
809  http->request
810  );
811 
812 #if USE_AUTH
814  http->getConn() != NULL && http->getConn()->getAuth() != NULL ?
816 #endif
817 
818  readNextRequest = true;
819  }
820 
821  /* ACCESS_ALLOWED continues here ... */
822  xfree(http->uri);
824  http->doCallouts();
825 }
826 
827 #if USE_ADAPTATION
828 void
830 {
831  debugs(93,3,HERE << this << " adaptationAclCheckDone called");
832 
833 #if ICAP_CLIENT
835  if (ih != NULL) {
836  if (getConn() != NULL && getConn()->clientConnection != NULL) {
837  ih->rfc931 = getConn()->clientConnection->rfc931;
838 #if USE_OPENSSL
839  if (getConn()->clientConnection->isOpen()) {
840  ih->ssluser = sslGetUserEmail(fd_table[getConn()->clientConnection->fd].ssl.get());
841  }
842 #endif
843  }
844  ih->log_uri = log_uri;
845  ih->req_sz = req_sz;
846  }
847 #endif
848 
849  if (!g) {
850  debugs(85,3, HERE << "no adaptation needed");
851  doCallouts();
852  return;
853  }
854 
855  startAdaptation(g);
856 }
857 
858 #endif
859 
860 static void
862 {
863  ClientRequestContext *context = (ClientRequestContext *)data;
864  ClientHttpRequest *http = context->http;
865  context->acl_checklist = NULL;
866 
867  if (answer.allowed())
869  else {
870  Helper::Reply const nilReply(Helper::Error);
871  context->clientRedirectDone(nilReply);
872  }
873 }
874 
875 void
877 {
878  debugs(33, 5, HERE << "'" << http->uri << "'");
883  } else
885 }
886 
891 static void
893 {
894  ClientRequestContext *context = static_cast<ClientRequestContext *>(data);
895  ClientHttpRequest *http = context->http;
896  context->acl_checklist = NULL;
897 
898  if (answer.allowed())
899  storeIdStart(http, clientStoreIdDoneWrapper, context);
900  else {
901  debugs(85, 3, "access denied expected ERR reply handling: " << answer);
902  Helper::Reply const nilReply(Helper::Error);
903  context->clientStoreIdDone(nilReply);
904  }
905 }
906 
912 void
914 {
915  debugs(33, 5,"'" << http->uri << "'");
916 
917  if (Config.accessList.store_id) {
920  } else
922 }
923 
924 static int
926 {
927  HttpRequest *request = http->request;
928  HttpRequestMethod method = request->method;
929 
930  // intercepted requests MUST NOT (yet) be sent to peers unless verified
931  if (!request->flags.hostVerified && (request->flags.intercepted || request->flags.interceptTproxy))
932  return 0;
933 
934  /*
935  * IMS needs a private key, so we can use the hierarchy for IMS only if our
936  * neighbors support private keys
937  */
938 
939  if (request->flags.ims && !neighbors_do_private_keys)
940  return 0;
941 
942  /*
943  * This is incorrect: authenticating requests can be sent via a hierarchy
944  * (they can even be cached if the correct headers are set on the reply)
945  */
946  if (request->flags.auth)
947  return 0;
948 
949  if (method == Http::METHOD_TRACE)
950  return 1;
951 
952  if (method != Http::METHOD_GET)
953  return 0;
954 
955  if (request->flags.loopDetected)
956  return 0;
957 
958  if (request->url.getScheme() == AnyP::PROTO_HTTP)
959  return method.respMaybeCacheable();
960 
961  if (request->url.getScheme() == AnyP::PROTO_GOPHER)
962  return gopherCachable(request);
963 
964  if (request->url.getScheme() == AnyP::PROTO_CACHE_OBJECT)
965  return 0;
966 
967  return 1;
968 }
969 
970 static void
972 {
973  HttpRequest *request = http->request;
974  HttpHeader *req_hdr = &request->header;
975  ConnStateData *http_conn = http->getConn();
976 
977  /* Internal requests such as those from ESI includes may be without
978  * a client connection
979  */
980  if (!http_conn)
981  return;
982 
983  request->flags.connectionAuthDisabled = http_conn->port->connection_auth_disabled;
984  if (!request->flags.connectionAuthDisabled) {
985  if (Comm::IsConnOpen(http_conn->pinning.serverConnection)) {
986  if (http_conn->pinning.auth) {
987  request->flags.connectionAuth = true;
988  request->flags.auth = true;
989  } else {
990  request->flags.connectionProxyAuth = true;
991  }
992  // These should already be linked correctly.
993  assert(request->clientConnectionManager == http_conn);
994  }
995  }
996 
997  /* check if connection auth is used, and flag as candidate for pinning
998  * in such case.
999  * Note: we may need to set flags.connectionAuth even if the connection
1000  * is already pinned if it was pinned earlier due to proxy auth
1001  */
1002  if (!request->flags.connectionAuth) {
1005  HttpHeaderEntry *e;
1006  int may_pin = 0;
1007  while ((e = req_hdr->getEntry(&pos))) {
1009  const char *value = e->value.rawBuf();
1010  if (strncasecmp(value, "NTLM ", 5) == 0
1011  ||
1012  strncasecmp(value, "Negotiate ", 10) == 0
1013  ||
1014  strncasecmp(value, "Kerberos ", 9) == 0) {
1015  if (e->id == Http::HdrType::AUTHORIZATION) {
1016  request->flags.connectionAuth = true;
1017  may_pin = 1;
1018  } else {
1019  request->flags.connectionProxyAuth = true;
1020  may_pin = 1;
1021  }
1022  }
1023  }
1024  }
1025  if (may_pin && !request->pinnedConnection()) {
1026  // These should already be linked correctly. Just need the ServerConnection to pinn.
1027  assert(request->clientConnectionManager == http_conn);
1028  }
1029  }
1030  }
1031 }
1032 
1033 static void
1035 {
1036  HttpRequest *request = http->request;
1037  HttpHeader *req_hdr = &request->header;
1038  bool no_cache = false;
1039 
1040  request->imslen = -1;
1041  request->ims = req_hdr->getTime(Http::HdrType::IF_MODIFIED_SINCE);
1042 
1043  if (request->ims > 0)
1044  request->flags.ims = true;
1045 
1046  if (!request->flags.ignoreCc) {
1047  if (request->cache_control) {
1048  if (request->cache_control->hasNoCache())
1049  no_cache=true;
1050 
1051  // RFC 2616: treat Pragma:no-cache as if it was Cache-Control:no-cache when Cache-Control is missing
1052  } else if (req_hdr->has(Http::HdrType::PRAGMA))
1053  no_cache = req_hdr->hasListMember(Http::HdrType::PRAGMA,"no-cache",',');
1054  }
1055 
1056  if (request->method == Http::METHOD_OTHER) {
1057  no_cache=true;
1058  }
1059 
1060  if (no_cache) {
1061 #if USE_HTTP_VIOLATIONS
1062 
1064  request->flags.nocacheHack = true;
1065  else if (refresh_nocache_hack)
1066  request->flags.nocacheHack = true;
1067  else
1068 #endif
1069 
1070  request->flags.noCache = true;
1071  }
1072 
1073  /* ignore range header in non-GETs or non-HEADs */
1074  if (request->method == Http::METHOD_GET || request->method == Http::METHOD_HEAD) {
1075  // XXX: initialize if we got here without HttpRequest::parseHeader()
1076  if (!request->range)
1077  request->range = req_hdr->getRange();
1078 
1079  if (request->range) {
1080  request->flags.isRanged = true;
1082  /* XXX: This is suboptimal. We should give the stream the range set,
1083  * and thereby let the top of the stream set the offset when the
1084  * size becomes known. As it is, we will end up requesting from 0
1085  * for evey -X range specification.
1086  * RBC - this may be somewhat wrong. We should probably set the range
1087  * iter up at this point.
1088  */
1089  node->readBuffer.offset = request->range->lowestOffset(0);
1090  http->range_iter.pos = request->range->begin();
1091  http->range_iter.end = request->range->end();
1092  http->range_iter.valid = true;
1093  }
1094  }
1095 
1096  /* Only HEAD and GET requests permit a Range or Request-Range header.
1097  * If these headers appear on any other type of request, delete them now.
1098  */
1099  else {
1100  req_hdr->delById(Http::HdrType::RANGE);
1102  request->ignoreRange("neither HEAD nor GET");
1103  }
1104 
1105  if (req_hdr->has(Http::HdrType::AUTHORIZATION))
1106  request->flags.auth = true;
1107 
1108  clientCheckPinning(http);
1109 
1110  if (!request->url.userInfo().isEmpty())
1111  request->flags.auth = true;
1112 
1113  if (req_hdr->has(Http::HdrType::VIA)) {
1114  String s = req_hdr->getList(Http::HdrType::VIA);
1115  /*
1116  * ThisCache cannot be a member of Via header, "1.1 ThisCache" can.
1117  * Note ThisCache2 has a space prepended to the hostname so we don't
1118  * accidentally match super-domains.
1119  */
1120 
1121  if (strListIsSubstr(&s, ThisCache2, ',')) {
1122  debugObj(33, 1, "WARNING: Forwarding loop detected for:\n",
1123  request, (ObjPackMethod) & httpRequestPack);
1124  request->flags.loopDetected = true;
1125  }
1126 
1127 #if USE_FORW_VIA_DB
1128  fvdbCountVia(s.termedBuf());
1129 
1130 #endif
1131 
1132  s.clean();
1133  }
1134 
1135 #if USE_FORW_VIA_DB
1136 
1137  if (req_hdr->has(Http::HdrType::X_FORWARDED_FOR)) {
1139  fvdbCountForw(s.termedBuf());
1140  s.clean();
1141  }
1142 
1143 #endif
1144 
1145  request->flags.cachable = http->request->maybeCacheable();
1146 
1147  if (clientHierarchical(http))
1148  request->flags.hierarchical = true;
1149 
1150  debugs(85, 5, "clientInterpretRequestHeaders: REQ_NOCACHE = " <<
1151  (request->flags.noCache ? "SET" : "NOT SET"));
1152  debugs(85, 5, "clientInterpretRequestHeaders: REQ_CACHABLE = " <<
1153  (request->flags.cachable ? "SET" : "NOT SET"));
1154  debugs(85, 5, "clientInterpretRequestHeaders: REQ_HIERARCHICAL = " <<
1155  (request->flags.hierarchical ? "SET" : "NOT SET"));
1156 
1157 }
1158 
1159 void
1161 {
1162  ClientRequestContext *calloutContext = (ClientRequestContext *)data;
1163 
1164  if (!calloutContext->httpStateIsValid())
1165  return;
1166 
1167  calloutContext->clientRedirectDone(result);
1168 }
1169 
1170 void
1172 {
1173  ClientRequestContext *calloutContext = (ClientRequestContext *)data;
1174 
1175  if (!calloutContext->httpStateIsValid())
1176  return;
1177 
1178  calloutContext->clientStoreIdDone(result);
1179 }
1180 
1181 void
1183 {
1184  HttpRequest *old_request = http->request;
1185  debugs(85, 5, HERE << "'" << http->uri << "' result=" << reply);
1188 
1189  // Put helper response Notes into the transaction state record (ALE) eventually
1190  // do it early to ensure that no matter what the outcome the notes are present.
1191  if (http->al)
1192  http->al->syncNotes(old_request);
1193 
1194  UpdateRequestNotes(http->getConn(), *old_request, reply.notes);
1195 
1196  switch (reply.result) {
1197  case Helper::TimedOut:
1200  debugs(85, DBG_IMPORTANT, "ERROR: URL rewrite helper: Timedout");
1201  }
1202  break;
1203 
1204  case Helper::Unknown:
1205  case Helper::TT:
1206  // Handler in redirect.cc should have already mapped Unknown
1207  // IF it contained valid entry for the old URL-rewrite helper protocol
1208  debugs(85, DBG_IMPORTANT, "ERROR: URL rewrite helper returned invalid result code. Wrong helper? " << reply);
1209  break;
1210 
1211  case Helper::BrokenHelper:
1212  debugs(85, DBG_IMPORTANT, "ERROR: URL rewrite helper: " << reply);
1213  break;
1214 
1215  case Helper::Error:
1216  // no change to be done.
1217  break;
1218 
1219  case Helper::Okay: {
1220  // #1: redirect with a specific status code OK status=NNN url="..."
1221  // #2: redirect with a default status code OK url="..."
1222  // #3: re-write the URL OK rewrite-url="..."
1223 
1224  const char *statusNote = reply.notes.findFirst("status");
1225  const char *urlNote = reply.notes.findFirst("url");
1226 
1227  if (urlNote != NULL) {
1228  // HTTP protocol redirect to be done.
1229 
1230  // TODO: change default redirect status for appropriate requests
1231  // Squid defaults to 302 status for now for better compatibility with old clients.
1232  // HTTP/1.0 client should get 302 (Http::scFound)
1233  // HTTP/1.1 client contacting reverse-proxy should get 307 (Http::scTemporaryRedirect)
1234  // HTTP/1.1 client being diverted by forward-proxy should get 303 (Http::scSeeOther)
1236  if (statusNote != NULL) {
1237  const char * result = statusNote;
1238  status = static_cast<Http::StatusCode>(atoi(result));
1239  }
1240 
1241  if (status == Http::scMovedPermanently
1242  || status == Http::scFound
1243  || status == Http::scSeeOther
1244  || status == Http::scPermanentRedirect
1245  || status == Http::scTemporaryRedirect) {
1246  http->redirect.status = status;
1247  http->redirect.location = xstrdup(urlNote);
1248  // TODO: validate the URL produced here is RFC 2616 compliant absolute URI
1249  } else {
1250  debugs(85, DBG_CRITICAL, "ERROR: URL-rewrite produces invalid " << status << " redirect Location: " << urlNote);
1251  }
1252  } else {
1253  // URL-rewrite wanted. Ew.
1254  urlNote = reply.notes.findFirst("rewrite-url");
1255 
1256  // prevent broken helpers causing too much damage. If old URL == new URL skip the re-write.
1257  if (urlNote != NULL && strcmp(urlNote, http->uri)) {
1258  AnyP::Uri tmpUrl;
1259  if (tmpUrl.parse(old_request->method, urlNote)) {
1260  HttpRequest *new_request = old_request->clone();
1261  new_request->url = tmpUrl;
1262  debugs(61, 2, "URL-rewriter diverts URL from " << old_request->effectiveRequestUri() << " to " << new_request->effectiveRequestUri());
1263 
1264  // update the new request to flag the re-writing was done on it
1265  new_request->flags.redirected = true;
1266 
1267  // unlink bodypipe from the old request. Not needed there any longer.
1268  if (old_request->body_pipe != NULL) {
1269  old_request->body_pipe = NULL;
1270  debugs(61,2, HERE << "URL-rewriter diverts body_pipe " << new_request->body_pipe <<
1271  " from request " << old_request << " to " << new_request);
1272  }
1273 
1274  http->resetRequest(new_request);
1275  old_request = nullptr;
1276  } else {
1277  debugs(85, DBG_CRITICAL, "ERROR: URL-rewrite produces invalid request: " <<
1278  old_request->method << " " << urlNote << " " << old_request->http_ver);
1279  }
1280  }
1281  }
1282  }
1283  break;
1284  }
1285 
1286  /* FIXME PIPELINE: This is innacurate during pipelining */
1287 
1290 
1291  assert(http->uri);
1292 
1293  http->doCallouts();
1294 }
1295 
1299 void
1301 {
1302  HttpRequest *old_request = http->request;
1303  debugs(85, 5, "'" << http->uri << "' result=" << reply);
1306 
1307  // Put helper response Notes into the transaction state record (ALE) eventually
1308  // do it early to ensure that no matter what the outcome the notes are present.
1309  if (http->al)
1310  http->al->syncNotes(old_request);
1311 
1312  UpdateRequestNotes(http->getConn(), *old_request, reply.notes);
1313 
1314  switch (reply.result) {
1315  case Helper::Unknown:
1316  case Helper::TT:
1317  // Handler in redirect.cc should have already mapped Unknown
1318  // IF it contained valid entry for the old helper protocol
1319  debugs(85, DBG_IMPORTANT, "ERROR: storeID helper returned invalid result code. Wrong helper? " << reply);
1320  break;
1321 
1322  case Helper::TimedOut:
1323  // Timeouts for storeID are not implemented
1324  case Helper::BrokenHelper:
1325  debugs(85, DBG_IMPORTANT, "ERROR: storeID helper: " << reply);
1326  break;
1327 
1328  case Helper::Error:
1329  // no change to be done.
1330  break;
1331 
1332  case Helper::Okay: {
1333  const char *urlNote = reply.notes.findFirst("store-id");
1334 
1335  // prevent broken helpers causing too much damage. If old URL == new URL skip the re-write.
1336  if (urlNote != NULL && strcmp(urlNote, http->uri) ) {
1337  // Debug section required for some very specific cases.
1338  debugs(85, 9, "Setting storeID with: " << urlNote );
1339  http->request->store_id = urlNote;
1340  http->store_id = urlNote;
1341  }
1342  }
1343  break;
1344  }
1345 
1346  http->doCallouts();
1347 }
1348 
1352 void
1354 {
1355  if (Config.accessList.noCache) {
1358  } else {
1359  /* unless otherwise specified, we try to cache. */
1361  }
1362 }
1363 
1364 static void
1366 {
1367  ClientRequestContext *calloutContext = (ClientRequestContext *) data;
1368 
1369  if (!calloutContext->httpStateIsValid())
1370  return;
1371 
1372  calloutContext->checkNoCacheDone(answer);
1373 }
1374 
1375 void
1377 {
1378  acl_checklist = NULL;
1379  if (answer.denied()) {
1380  http->request->flags.noCache = true; // do not read reply from cache
1381  http->request->flags.cachable = false; // do not store reply into cache
1382  }
1383  http->doCallouts();
1384 }
1385 
1386 #if USE_OPENSSL
1387 bool
1389 {
1390  if (!http->getConn()) {
1391  http->al->ssl.bumpMode = Ssl::bumpEnd; // SslBump does not apply; log -
1392  return false;
1393  }
1394 
1396  if (http->request->flags.forceTunnel) {
1397  debugs(85, 5, "not needed; already decided to tunnel " << http->getConn());
1398  if (bumpMode != Ssl::bumpEnd)
1399  http->al->ssl.bumpMode = bumpMode; // inherited from bumped connection
1400  return false;
1401  }
1402 
1403  // If SSL connection tunneling or bumping decision has been made, obey it.
1404  if (bumpMode != Ssl::bumpEnd) {
1405  debugs(85, 5, HERE << "SslBump already decided (" << bumpMode <<
1406  "), " << "ignoring ssl_bump for " << http->getConn());
1407 
1408  // We need the following "if" for transparently bumped TLS connection,
1409  // because in this case we are running ssl_bump access list before
1410  // the doCallouts runs. It can be removed after the bug #4340 fixed.
1411  // We do not want to proceed to bumping steps:
1412  // - if the TLS connection with the client is already established
1413  // because we are accepting normal HTTP requests on TLS port,
1414  // or because of the client-first bumping mode
1415  // - When the bumping is already started
1416  if (!http->getConn()->switchedToHttps() &&
1417  !http->getConn()->serverBump())
1418  http->sslBumpNeed(bumpMode); // for processRequest() to bump if needed and not already bumped
1419  http->al->ssl.bumpMode = bumpMode; // inherited from bumped connection
1420  return false;
1421  }
1422 
1423  // If we have not decided yet, decide whether to bump now.
1424 
1425  // Bumping here can only start with a CONNECT request on a bumping port
1426  // (bumping of intercepted SSL conns is decided before we get 1st request).
1427  // We also do not bump redirected CONNECT requests.
1430  !http->getConn()->port->flags.tunnelSslBumping) {
1431  http->al->ssl.bumpMode = Ssl::bumpEnd; // SslBump does not apply; log -
1432  debugs(85, 5, HERE << "cannot SslBump this request");
1433  return false;
1434  }
1435 
1436  // Do not bump during authentication: clients would not proxy-authenticate
1437  // if we delay a 407 response and respond with 200 OK to CONNECT.
1439  http->al->ssl.bumpMode = Ssl::bumpEnd; // SslBump does not apply; log -
1440  debugs(85, 5, HERE << "no SslBump during proxy authentication");
1441  return false;
1442  }
1443 
1444  if (error) {
1445  debugs(85, 5, "SslBump applies. Force bump action on error " << errorTypeName(error->type));
1448  return false;
1449  }
1450 
1451  debugs(85, 5, HERE << "SslBump possible, checking ACL");
1452 
1454  aclChecklist->nonBlockingCheck(sslBumpAccessCheckDoneWrapper, this);
1455  return true;
1456 }
1457 
1462 static void
1464 {
1465  ClientRequestContext *calloutContext = static_cast<ClientRequestContext *>(data);
1466 
1467  if (!calloutContext->httpStateIsValid())
1468  return;
1469  calloutContext->sslBumpAccessCheckDone(answer);
1470 }
1471 
1472 void
1474 {
1475  if (!httpStateIsValid())
1476  return;
1477 
1478  const Ssl::BumpMode bumpMode = answer.allowed() ?
1479  static_cast<Ssl::BumpMode>(answer.kind) : Ssl::bumpSplice;
1480  http->sslBumpNeed(bumpMode); // for processRequest() to bump if needed
1481  http->al->ssl.bumpMode = bumpMode; // for logging
1482 
1483  if (bumpMode == Ssl::bumpTerminate) {
1485  if (Comm::IsConnOpen(clientConn)) {
1486  debugs(85, 3, "closing after Ssl::bumpTerminate ");
1487  clientConn->close();
1488  }
1489  return;
1490  }
1491 
1492  http->doCallouts();
1493 }
1494 #endif
1495 
1496 /*
1497  * Identify requests that do not go through the store and client side stream
1498  * and forward them to the appropriate location. All other requests, request
1499  * them.
1500  */
1501 void
1503 {
1504  debugs(85, 4, request->method << ' ' << uri);
1505 
1506  const bool untouchedConnect = request->method == Http::METHOD_CONNECT && !redirect.status;
1507 
1508 #if USE_OPENSSL
1509  if (untouchedConnect && sslBumpNeeded()) {
1511  sslBumpStart();
1512  return;
1513  }
1514 #endif
1515 
1516  if (untouchedConnect || request->flags.forceTunnel) {
1517  getConn()->stopReading(); // tunnels read for themselves
1518  tunnelStart(this);
1519  return;
1520  }
1521 
1522  httpStart();
1523 }
1524 
1525 void
1527 {
1529  // XXX: Re-initializes rather than updates. Should not be needed at all.
1531  debugs(85, 4, logType.c_str() << " for '" << uri << "'");
1532 
1533  /* no one should have touched this */
1534  assert(out.offset == 0);
1535  /* Use the Stream Luke */
1537  clientStreamRead(node, this, node->readBuffer);
1539 }
1540 
1541 #if USE_OPENSSL
1542 
1543 void
1545 {
1546  debugs(83, 3, HERE << "sslBump required: "<< Ssl::bumpMode(mode));
1547  sslBumpNeed_ = mode;
1548 }
1549 
1550 // called when comm_write has completed
1551 static void
1552 SslBumpEstablish(const Comm::ConnectionPointer &, char *, size_t, Comm::Flag errflag, int, void *data)
1553 {
1554  ClientHttpRequest *r = static_cast<ClientHttpRequest*>(data);
1555  debugs(85, 5, HERE << "responded to CONNECT: " << r << " ? " << errflag);
1556 
1557  assert(r && cbdataReferenceValid(r));
1558  r->sslBumpEstablish(errflag);
1559 }
1560 
1561 void
1563 {
1564  // Bail out quickly on Comm::ERR_CLOSING - close handlers will tidy up
1565  if (errflag == Comm::ERR_CLOSING)
1566  return;
1567 
1568  if (errflag) {
1569  debugs(85, 3, HERE << "CONNECT response failure in SslBump: " << errflag);
1571  return;
1572  }
1573 
1574  // We lack HttpReply which logRequest() uses to log the status code.
1575  // TODO: Use HttpReply instead of the "200 Connection established" string.
1576  al->http.code = 200;
1577 
1578 #if USE_AUTH
1579  // Preserve authentication info for the ssl-bumped request
1580  if (request->auth_user_request != NULL)
1581  getConn()->setAuth(request->auth_user_request, "SSL-bumped CONNECT");
1582 #endif
1583 
1584  assert(sslBumpNeeded());
1586 }
1587 
1588 void
1590 {
1591  debugs(85, 5, HERE << "Confirming " << Ssl::bumpMode(sslBumpNeed_) <<
1592  "-bumped CONNECT tunnel on FD " << getConn()->clientConnection);
1594 
1595  AsyncCall::Pointer bumpCall = commCbCall(85, 5, "ClientSocketContext::sslBumpEstablish",
1597 
1599  CommIoCbParams &params = GetCommParams<CommIoCbParams>(bumpCall);
1600  params.flag = Comm::OK;
1601  params.conn = getConn()->clientConnection;
1602  ScheduleCallHere(bumpCall);
1603  return;
1604  }
1605 
1606  // send an HTTP 200 response to kick client SSL negotiation
1607  // TODO: Unify with tunnel.cc and add a Server(?) header
1608  static const char *const conn_established = "HTTP/1.1 200 Connection established\r\n\r\n";
1609  Comm::Write(getConn()->clientConnection, conn_established, strlen(conn_established), bumpCall, NULL);
1610 }
1611 
1612 #endif
1613 
1614 bool
1616 {
1618  int64_t contentLength =
1620  assert(contentLength >= 0);
1621 
1622  if (out.offset < contentLength)
1623  return false;
1624 
1625  return true;
1626 }
1627 
1628 void
1630 {
1631  entry_ = newEntry;
1632 }
1633 
1634 void
1636 {
1637  if (loggingEntry_)
1638  loggingEntry_->unlock("ClientHttpRequest::loggingEntry");
1639 
1640  loggingEntry_ = newEntry;
1641 
1642  if (loggingEntry_)
1643  loggingEntry_->lock("ClientHttpRequest::loggingEntry");
1644 }
1645 
1646 void
1648 {
1649  assignRequest(aRequest);
1650  if (const auto csd = getConn()) {
1651  if (!csd->notes()->empty())
1652  request->notes()->appendNewOnly(csd->notes().getRaw());
1653  }
1654  // al is created in the constructor
1655  assert(al);
1656  if (!al->request) {
1657  al->request = request;
1659  al->syncNotes(request);
1660  }
1661 }
1662 
1663 void
1665 {
1666  assert(request != newRequest);
1667  clearRequest();
1668  assignRequest(newRequest);
1669  xfree(uri);
1671 }
1672 
1673 void
1675 {
1676  assert(newRequest);
1677  assert(!request);
1678  const_cast<HttpRequest *&>(request) = newRequest;
1681 }
1682 
1683 void
1685 {
1686  HttpRequest *oldRequest = request;
1687  HTTPMSGUNLOCK(oldRequest);
1688  const_cast<HttpRequest *&>(request) = nullptr;
1689  absorbLogUri(nullptr);
1690 }
1691 
1692 /*
1693  * doCallouts() - This function controls the order of "callout"
1694  * executions, including non-blocking access control checks, the
1695  * redirector, and ICAP. Previously, these callouts were chained
1696  * together such that "clientAccessCheckDone()" would call
1697  * "clientRedirectStart()" and so on.
1698  *
1699  * The ClientRequestContext (aka calloutContext) class holds certain
1700  * state data for the callout/callback operations. Previously
1701  * ClientHttpRequest would sort of hand off control to ClientRequestContext
1702  * for a short time. ClientRequestContext would then delete itself
1703  * and pass control back to ClientHttpRequest when all callouts
1704  * were finished.
1705  *
1706  * This caused some problems for ICAP because we want to make the
1707  * ICAP callout after checking ACLs, but before checking the no_cache
1708  * list. We can't stuff the ICAP state into the ClientRequestContext
1709  * class because we still need the ICAP state after ClientRequestContext
1710  * goes away.
1711  *
1712  * Note that ClientRequestContext is created before the first call
1713  * to doCallouts().
1714  *
1715  * If one of the callouts notices that ClientHttpRequest is no
1716  * longer valid, it should call cbdataReferenceDone() so that
1717  * ClientHttpRequest's reference count goes to zero and it will get
1718  * deleted. ClientHttpRequest will then delete ClientRequestContext.
1719  *
1720  * Note that we set the _done flags here before actually starting
1721  * the callout. This is strictly for convenience.
1722  */
1723 
1726 
1727 void
1729 {
1731 
1732  if (!calloutContext->error) {
1733  // CVE-2009-0801: verify the Host: header is consistent with other known details.
1735  debugs(83, 3, HERE << "Doing calloutContext->hostHeaderVerify()");
1738  return;
1739  }
1740 
1742  debugs(83, 3, HERE << "Doing calloutContext->clientAccessCheck()");
1745  return;
1746  }
1747 
1748 #if USE_ADAPTATION
1753  request, NULL, calloutContext->http->al, this))
1754  return; // will call callback
1755  }
1756 #endif
1757 
1758  if (!calloutContext->redirect_done) {
1759  calloutContext->redirect_done = true;
1760 
1761  if (Config.Program.redirect) {
1762  debugs(83, 3, HERE << "Doing calloutContext->clientRedirectStart()");
1765  return;
1766  }
1767  }
1768 
1770  debugs(83, 3, HERE << "Doing calloutContext->clientAccessCheck2()");
1773  return;
1774  }
1775 
1776  if (!calloutContext->store_id_done) {
1777  calloutContext->store_id_done = true;
1778 
1779  if (Config.Program.store_id) {
1780  debugs(83, 3,"Doing calloutContext->clientStoreIdStart()");
1783  return;
1784  }
1785  }
1786 
1788  debugs(83, 3, HERE << "Doing clientInterpretRequestHeaders()");
1791  }
1792 
1793  if (!calloutContext->no_cache_done) {
1794  calloutContext->no_cache_done = true;
1795 
1797  debugs(83, 3, HERE << "Doing calloutContext->checkNoCache()");
1799  return;
1800  }
1801  }
1802  } // if !calloutContext->error
1803 
1804  // Set appropriate MARKs and CONNMARKs if needed.
1806  ACLFilledChecklist ch(nullptr, request, nullptr);
1807  ch.al = calloutContext->http->al;
1809  ch.my_addr = request->my_addr;
1810  ch.syncAle(request, log_uri);
1811 
1814  tos_t tos = aclMapTOS(Ip::Qos::TheConfig.tosToClient, &ch);
1815  if (tos)
1817 
1818  const auto packetMark = aclFindNfMarkConfig(Ip::Qos::TheConfig.nfmarkToClient, &ch);
1819  if (!packetMark.isEmpty())
1820  Ip::Qos::setSockNfmark(getConn()->clientConnection, packetMark.mark);
1821 
1822  const auto connmark = aclFindNfMarkConfig(Ip::Qos::TheConfig.nfConnmarkToClient, &ch);
1823  if (!connmark.isEmpty())
1825  }
1826  }
1827 
1828 #if USE_OPENSSL
1829  // Even with calloutContext->error, we call sslBumpAccessCheck() to decide
1830  // whether SslBump applies to this transaction. If it applies, we will
1831  // attempt to bump the client to serve the error.
1835  return;
1836  /* else no ssl bump required*/
1837  }
1838 #endif
1839 
1840  if (calloutContext->error) {
1841  // XXX: prformance regression. c_str() reallocates
1842  SBuf storeUriBuf(request->storeId());
1843  const char *storeUri = storeUriBuf.c_str();
1844  StoreEntry *e = storeCreateEntry(storeUri, storeUri, request->flags, request->method);
1845 #if USE_OPENSSL
1846  if (sslBumpNeeded()) {
1847  // We have to serve an error, so bump the client first.
1849  // set final error but delay sending until we bump
1853  getConn()->setServerBump(srvBump);
1854  e->unlock("ClientHttpRequest::doCallouts+sslBumpNeeded");
1855  } else
1856 #endif
1857  {
1858  // send the error to the client now
1860  clientReplyContext *repContext = dynamic_cast<clientReplyContext *>(node->data.getRaw());
1861  assert (repContext);
1862  repContext->setReplyToStoreEntry(e, "immediate SslBump error");
1866  getConn()->flags.readMore = true; // resume any pipeline reads.
1868  clientStreamRead(node, this, node->readBuffer);
1869  e->unlock("ClientHttpRequest::doCallouts-sslBumpNeeded");
1870  return;
1871  }
1872  }
1873 
1875  delete calloutContext;
1876  calloutContext = NULL;
1877 #if HEADERS_LOG
1878 
1879  headersLog(0, 1, request->method, request);
1880 #endif
1881 
1882  debugs(83, 3, HERE << "calling processRequest()");
1883  processRequest();
1884 
1885 #if ICAP_CLIENT
1887  if (ih != NULL)
1888  ih->logType = logType;
1889 #endif
1890 }
1891 
1892 void
1894 {
1895  assert(request);
1896  const auto canonicalUri = request->canonicalCleanUrl();
1897  absorbLogUri(xstrndup(canonicalUri, MAX_URL));
1898 }
1899 
1900 void
1902 {
1903  assert(rawUri);
1904  // Should(!request);
1905 
1906  // TODO: SBuf() performance regression, fix by converting rawUri to SBuf
1907  char *canonicalUri = urlCanonicalCleanWithoutRequest(SBuf(rawUri), method, AnyP::UriScheme());
1908 
1909  absorbLogUri(AnyP::Uri::cleanup(canonicalUri));
1910 
1911  char *cleanedRawUri = AnyP::Uri::cleanup(rawUri);
1912  al->setVirginUrlForMissingRequest(SBuf(cleanedRawUri));
1913  xfree(cleanedRawUri);
1914 }
1915 
1916 void
1918 {
1919  xfree(log_uri);
1920  const_cast<char *&>(log_uri) = aUri;
1921 }
1922 
1923 void
1925 {
1926  assert(!uri);
1927  assert(aUri);
1928  // Should(!request);
1929 
1930  uri = xstrdup(aUri);
1931  // TODO: SBuf() performance regression, fix by converting setErrorUri() parameter to SBuf
1932  const SBuf errorUri(aUri);
1933  const auto canonicalUri = urlCanonicalCleanWithoutRequest(errorUri, HttpRequestMethod(), AnyP::UriScheme());
1934  absorbLogUri(xstrndup(canonicalUri, MAX_URL));
1935 
1936  al->setVirginUrlForMissingRequest(errorUri);
1937 }
1938 
1939 #if USE_ADAPTATION
1940 void
1943 {
1944  debugs(85, 3, HERE << "adaptation needed for " << this);
1948  new Adaptation::Iterator(request, NULL, al, g));
1949 
1950  // we could try to guess whether we can bypass this adaptation
1951  // initiation failure, but it should not really happen
1953 }
1954 
1955 void
1957 {
1958  assert(cbdataReferenceValid(this)); // indicates bug
1961 
1962  switch (answer.kind) {
1964  handleAdaptedHeader(const_cast<Http::Message*>(answer.message.getRaw()));
1965  break;
1966 
1968  handleAdaptationBlock(answer);
1969  break;
1970 
1973  break;
1974  }
1975 }
1976 
1977 void
1979 {
1980  assert(msg);
1981 
1982  if (HttpRequest *new_req = dynamic_cast<HttpRequest*>(msg)) {
1983  // update the new message to flag whether URL re-writing was done on it
1984  if (request->effectiveRequestUri() != new_req->effectiveRequestUri())
1985  new_req->flags.redirected = true;
1986  resetRequest(new_req);
1987  assert(request->method.id());
1988  } else if (HttpReply *new_rep = dynamic_cast<HttpReply*>(msg)) {
1989  debugs(85,3,HERE << "REQMOD reply is HTTP reply");
1990 
1991  // subscribe to receive reply body
1992  if (new_rep->body_pipe != NULL) {
1993  adaptedBodySource = new_rep->body_pipe;
1994  int consumer_ok = adaptedBodySource->setConsumerIfNotLate(this);
1995  assert(consumer_ok);
1996  }
1997 
1999  clientReplyContext *repContext = dynamic_cast<clientReplyContext *>(node->data.getRaw());
2000  assert(repContext);
2001  repContext->createStoreEntry(request->method, request->flags);
2002 
2005  storeEntry()->replaceHttpReply(new_rep);
2007 
2008  if (!adaptedBodySource) // no body
2009  storeEntry()->complete();
2010  clientGetMoreData(node, this);
2011  }
2012 
2013  // we are done with getting headers (but may be receiving body)
2015 
2017  doCallouts();
2018 }
2019 
2020 void
2022 {
2024  AclMatchedName = answer.ruleId.termedBuf();
2027  AclMatchedName = NULL;
2028 }
2029 
2030 void
2032 {
2033  if (!adaptedBodySource)
2034  return;
2035 
2037 }
2038 
2039 void
2041 {
2044 
2045  if (size_t contentSize = adaptedBodySource->buf().contentSize()) {
2046  const size_t spaceAvailable = storeEntry()->bytesWanted(Range<size_t>(0,contentSize));
2047 
2048  if (spaceAvailable < contentSize ) {
2049  // No or partial body data consuming
2050  typedef NullaryMemFunT<ClientHttpRequest> Dialer;
2051  AsyncCall::Pointer call = asyncCall(93, 5, "ClientHttpRequest::resumeBodyStorage",
2052  Dialer(this, &ClientHttpRequest::resumeBodyStorage));
2053  storeEntry()->deferProducer(call);
2054  }
2055 
2056  if (!spaceAvailable)
2057  return;
2058 
2059  if (spaceAvailable < contentSize )
2060  contentSize = spaceAvailable;
2061 
2063  const StoreIOBuffer ioBuf(&bpc.buf, request_satisfaction_offset, contentSize);
2064  storeEntry()->write(ioBuf);
2065  // assume StoreEntry::write() writes the entire ioBuf
2067  bpc.buf.consume(contentSize);
2068  bpc.checkIn();
2069  }
2070 
2073  // else wait for more body data
2074 }
2075 
2076 void
2078 {
2080  // should we end request satisfaction now?
2083 }
2084 
2085 void
2087 {
2088  debugs(85,4, HERE << this << " ends request satisfaction");
2091 
2092  // TODO: anything else needed to end store entry formation correctly?
2093  storeEntry()->complete();
2094 }
2095 
2096 void
2098 {
2101 
2102  debugs(85,3, HERE << "REQMOD body production failed");
2103  if (request_satisfaction_mode) { // too late to recover or serve an error
2106  Must(Comm::IsConnOpen(c));
2107  c->close(); // drastic, but we may be writing a response already
2108  } else {
2110  }
2111 }
2112 
2113 void
2114 ClientHttpRequest::handleAdaptationFailure(int errDetail, bool bypassable)
2115 {
2116  debugs(85,3, HERE << "handleAdaptationFailure(" << bypassable << ")");
2117 
2118  const bool usedStore = storeEntry() && !storeEntry()->isEmpty();
2119  const bool usedPipe = request->body_pipe != NULL &&
2120  request->body_pipe->consumedSize() > 0;
2121 
2122  if (bypassable && !usedStore && !usedPipe) {
2123  debugs(85,3, HERE << "ICAP REQMOD callout failed, bypassing: " << calloutContext);
2124  if (calloutContext)
2125  doCallouts();
2126  return;
2127  }
2128 
2129  debugs(85,3, HERE << "ICAP REQMOD callout failed, responding with error");
2130 
2132  clientReplyContext *repContext = dynamic_cast<clientReplyContext *>(node->data.getRaw());
2133  assert(repContext);
2134 
2135  calloutsError(ERR_ICAP_FAILURE, errDetail);
2136 
2137  if (calloutContext)
2138  doCallouts();
2139 }
2140 
2141 void
2142 ClientHttpRequest::callException(const std::exception &ex)
2143 {
2144  if (const auto clientConn = getConn() ? getConn()->clientConnection : nullptr) {
2146  debugs(85, 3, "closing after exception: " << ex.what());
2147  clientConn->close(); // initiate orderly top-to-bottom cleanup
2148  return;
2149  }
2150  }
2151  debugs(85, DBG_IMPORTANT, "ClientHttpRequest exception without connection. Ignoring " << ex.what());
2152  // XXX: Normally, we mustStop() but we cannot do that here because it is
2153  // likely to leave Http::Stream and ConnStateData with a dangling http
2154  // pointer. See r13480 or XXX in Http::Stream class description.
2155 }
2156 #endif
2157 
2158 // XXX: modify and use with ClientRequestContext::clientAccessCheckDone too.
2159 void
2161 {
2162  // The original author of the code also wanted to pass an errno to
2163  // setReplyToError, but it seems unlikely that the errno reflects the
2164  // true cause of the error at this point, so I did not pass it.
2165  if (calloutContext) {
2166  Ip::Address noAddr;
2167  noAddr.setNoAddr();
2168  ConnStateData * c = getConn();
2170  NULL,
2171  c != NULL ? c->clientConnection->remote : noAddr,
2172  request
2173  );
2174 #if USE_AUTH
2176  c != NULL && c->getAuth() != NULL ? c->getAuth() : request->auth_user_request;
2177 #endif
2178  calloutContext->error->detailError(errDetail);
2180  if (c != NULL)
2181  c->expectNoForwarding();
2182  }
2183  //else if(calloutContext == NULL) is it possible?
2184 }
2185 
iterates services in ServiceGroup, starting adaptation launchers
Definition: Iterator.h:31
bool switchedToHttps() const
Definition: client_side.h:252
void recordLookup(const Dns::LookupDetails &detail)
Definition: HttpRequest.cc:587
int delById(Http::HdrType id)
Definition: HttpHeader.cc:681
void nonBlockingCheck(ACLCB *callback, void *callback_data)
Definition: Checklist.cc:238
summarizes adaptation service answer for the noteAdaptationAnswer() API
Definition: Answer.h:22
AnyP::ProtocolVersion ProtocolVersion(unsigned int aMajor, unsigned int aMinor)
HTTP version label information.
static void sslBumpAccessCheckDoneWrapper(allow_t, void *)
static void clientInterpretRequestHeaders(ClientHttpRequest *http)
int has(Http::HdrType id) const
Definition: HttpHeader.cc:1011
bool interceptTproxy
Set for requests handled by a &quot;tproxy&quot; port.
Definition: RequestFlags.h:68
void redirectStart(ClientHttpRequest *http, HLPCB *handler, void *data)
Definition: redirect.cc:288
err_type errType
Definition: HttpRequest.h:153
const char * crlf
Definition: Elements.cc:12
void setAuth(const Auth::UserRequest::Pointer &aur, const char *cause)
Definition: client_side.cc:500
#define fd_table
Definition: fde.h:157
Ssl::ServerBump * serverBump()
Definition: client_side.h:253
ConnStateData * pinnedConnection()
Definition: HttpRequest.cc:668
CbcPointer< Initiate > initiateAdaptation(Initiate *x)
&lt; starts freshly created initiate and returns a safe pointer to it
Definition: Initiator.cc:23
ClientHttpRequest * http
HttpHdrRange * range
Definition: HttpRequest.h:135
#define assert(EX)
Definition: assert.h:17
Ip::Address my_addr
Definition: HttpRequest.h:147
int matchDomainName(const char *h, const char *d, uint flags)
Definition: Uri.cc:660
void clientStreamInit(dlink_list *list, CSR *func, CSD *rdetach, CSS *readstatus, ClientStreamData readdata, CSCB *callback, CSD *cdetach, ClientStreamData callbackdata, StoreIOBuffer tailBuffer)
String ruleId
ACL (or similar rule) name that blocked forwarding.
Definition: Answer.h:40
static void checkFailureRatio(err_type, hier_code)
bool hierarchical
Definition: RequestFlags.h:34
int neighbors_do_private_keys
#define HttpHeaderInitPos
Definition: HttpHeader.h:48
ConnStateData * getConn() const
#define cbdataReferenceDone(var)
Definition: cbdata.h:350
static HLPCB clientRedirectDoneWrapper
wordlist * store_id
Definition: SquidConfig.h:195
void UpdateRequestNotes(ConnStateData *csd, HttpRequest &request, NotePairs const &helperNotes)
Definition: HttpRequest.cc:703
HttpHdrCc * cache_control
Definition: Message.h:76
int unlock(const char *context)
Definition: store.cc:457
void fd_note(int fd, const char *s)
Definition: fd.cc:250
Ssl::BumpMode sslBumpNeed() const
returns raw sslBump mode value
struct ClientHttpRequest::Redirect redirect
bool loopDetected
Definition: RequestFlags.h:36
virtual void noteBodyProducerAborted(BodyPipe::Pointer)
Definition: Acl.h:113
bool timestampsSet()
Definition: store.cc:1454
Definition: SBuf.h:86
static uint32 B
Definition: md4.c:43
virtual void noteBodyProductionEnded(BodyPipe::Pointer)
SQUIDCEXTERN CSD clientReplyDetach
Definition: client_side.h:444
#define xcalloc
Definition: membanger.c:57
#define REDIRECT_NONE
Definition: defines.h:87
Ip::Address src_addr
void checkNoCacheDone(const allow_t &answer)
Comm::ConnectionPointer clientConnection
int log_uses_indirect_client
Definition: SquidConfig.h:331
acl_access * redirector
Definition: SquidConfig.h:376
void consume(mb_size_t sz)
removes sz bytes and &quot;packs&quot; by moving content left
Definition: MemBuf.cc:171
ACLFilledChecklist * Filled(ACLChecklist *checklist)
convenience and safety wrapper for dynamic_cast&lt;ACLFilledChecklist*&gt;
HttpRequestMethod method
Definition: HttpRequest.h:106
void setErrorUri(const char *errorUri)
const MemBuf & buf() const
Definition: BodyPipe.h:137
void assignRequest(HttpRequest *aRequest)
#define SQUIDCEXTERN
Definition: squid.h:26
struct _request * request(char *urlin)
Definition: tcp-banger2.c:291
void error(char *format,...)
Http::MessagePointer message
HTTP request or response to forward.
Definition: Answer.h:39
bool initiated(const CbcPointer< AsyncJob > &job) const
Must(initiated(initiate)) instead of Must(initiate.set()), for clarity.
Definition: Initiator.h:52
int bumpMode
whether and how the request was SslBumped
#define xstrdup
ClientHttpRequest(ConnStateData *csd)
char * xstrndup(const char *s, size_t n)
Definition: xstring.cc:56
struct timeval start_time
The time the master transaction started.
void announceInitiatorAbort(CbcPointer< Initiate > &x)
inform the transaction about abnormal termination and clear the pointer
Definition: Initiator.cc:38
#define safe_free(x)
Definition: xalloc.h:73
bool exhausted() const
Definition: BodyPipe.cc:174
const char * bumpMode(int bm)
Definition: support.h:144
int64_t bodySize(const HttpRequestMethod &) const
Definition: HttpReply.cc:371
Definition: Flag.h:16
int clientBeginRequest(const HttpRequestMethod &method, char const *url, CSCB *streamcallback, CSD *streamdetach, ClientStreamData streamdata, HttpHeader const *header, char *tailbuf, size_t taillen, const MasterXaction::Pointer &mx)
AccessLogEntry::Pointer al
info for the future access.log, and external ACL
Definition: Range.h:18
static void hostHeaderIpVerifyWrapper(const ipcache_addrs *ia, const Dns::LookupDetails &dns, void *data)
encapsulates DNS lookup results
Definition: LookupDetails.h:20
void HTTPMSGLOCK(Http::Message *a)
Definition: Message.h:157
void calloutsError(const err_type error, const int errDetail)
Build an error reply. For use with the callouts.
void handleAdaptedHeader(Http::Message *msg)
void appendNewOnly(const NotePairs *src)
Definition: Notes.cc:349
ErrorState * clientBuildError(err_type, Http::StatusCode, char const *, Ip::Address &, HttpRequest *)
#define Must(condition)
Like assert() but throws an exception instead of aborting the process.
Definition: TextException.h:69
HttpHeaderEntry * getEntry(HttpHeaderPos *pos) const
Definition: HttpHeader.cc:598
virtual void noteAdaptationAclCheckDone(Adaptation::ServiceGroupPointer group)
Comm::ConnectionPointer tcpClient
TCP/IP level details about the client connection.
AnyP::ProtocolVersion http_ver
Definition: Message.h:72
#define xisspace(x)
Definition: xis.h:17
HttpHdrRange * getRange() const
Definition: HttpHeader.cc:1272
#define DBG_CRITICAL
Definition: Debug.h:45
Auth::UserRequest::Pointer auth_user_request
Definition: errorpage.h:145
bool doneFollowXff() const
Definition: RequestFlags.h:121
char * p
Definition: membanger.c:43
wordlist * redirect
Definition: SquidConfig.h:194
int conn
the current server connection FD
Definition: Transport.cc:26
time_t ims
Definition: HttpRequest.h:137
bool done_follow_x_forwarded_for
Definition: RequestFlags.h:101
void clientStreamRead(clientStreamNode *thisObject, ClientHttpRequest *http, StoreIOBuffer readBuffer)
bool hostVerified
Definition: RequestFlags.h:66
void SBufToCstring(char *d, const SBuf &s)
Definition: SBuf.h:741
Ip::Address log_addr
Definition: client_side.h:127
struct timeval current_time
Definition: stub_time.cc:15
void startAdaptation(const Adaptation::ServiceGroupPointer &g)
Initiate an asynchronous adaptation transaction which will call us back.
int aclIsProxyAuth(const char *name)
Definition: Gadgets.cc:74
size_type size() const
Definition: SquidString.h:72
iterator end()
const SBuf storeId()
Definition: HttpRequest.cc:676
char * canonicalCleanUrl() const
Definition: HttpRequest.cc:757
time_t squid_curtime
Definition: stub_time.cc:17
Comm::ConnectionPointer serverConnection
Definition: client_side.h:134
void replaceHttpReply(HttpReply *, bool andStartWriting=true)
Definition: store.cc:1782
no adapted message will come; see bypassable
Definition: Answer.h:29
bool readMore
needs comm_read (for this request or new requests)
Definition: client_side.h:130
uint64_t consumedSize() const
Definition: BodyPipe.h:111
a netfilter mark/mask pair
Definition: NfMarkConfig.h:20
int64_t lowestOffset(int64_t) const
HttpHdrRangeIter range_iter
bool connectionAuth
Definition: RequestFlags.h:78
char * urlCanonicalCleanWithoutRequest(const SBuf &url, const HttpRequestMethod &method, const AnyP::UriScheme &scheme)
Definition: Uri.cc:518
AsyncCall * asyncCall(int aDebugSection, int aDebugLevel, const char *aName, const Dialer &aDialer)
Definition: AsyncCall.h:156
Helper::ResultCode result
The helper response &#39;result&#39; field.
Definition: Reply.h:58
MemObject * memObject() const
void complete()
Definition: store.cc:1058
unsigned char tos_t
Definition: forward.h:26
Http::HdrType id
Definition: HttpHeader.h:63
static const char *const conn_established
Definition: tunnel.cc:240
size_t appendDomainLen
Definition: SquidConfig.h:216
bool readNextRequest
whether Squid should read after error handling
void fvdbCountVia(const char *key)
int gopherCachable(const HttpRequest *req)
Definition: gopher.cc:294
NotePairs::Pointer notes()
Definition: HttpRequest.cc:695
ACLFilledChecklist * clientAclChecklistCreate(const acl_access *acl, ClientHttpRequest *http)
bool setNfConnmark(Comm::ConnectionPointer &conn, const ConnectionDirection connDir, const NfMarkConfig &cm)
void setNoAddr()
Definition: Address.cc:285
void setVirginUrlForMissingRequest(const SBuf &vu)
Remember Client URI (or equivalent) when there is no HttpRequest.
void HLPCB(void *, const Helper::Reply &)
Definition: forward.h:27
Comm::ConnectionPointer conn
Definition: CommCalls.h:85
bool IsConnOpen(const Comm::ConnectionPointer &conn)
Definition: Connection.cc:24
acl_access * followXFF
Definition: SquidConfig.h:390
void const char HLPCB void * data
Definition: stub_helper.cc:16
NotePairs notes
Definition: Reply.h:61
int64_t offset
Definition: StoreIOBuffer.h:55
LogTags logType
the processing tags associated with this request transaction.
Definition: parse.c:104
iterator begin()
StatusCode
Definition: StatusCode.h:20
bool have(const Ip::Address &ip, size_t *position=nullptr) const
Definition: ipcache.cc:974
bool isEmpty() const
Definition: Store.h:60
String store_id
Definition: HttpRequest.h:131
int64_t content_length
Definition: Message.h:83
void setConn(ConnStateData *aConn)
int reload_into_ims
Definition: SquidConfig.h:295
void port(unsigned short p)
Definition: Uri.h:83
struct SquidConfig::UrlHelperTimeout onUrlRewriteTimeout
#define debugs(SECTION, LEVEL, CONTENT)
Definition: Debug.h:124
#define cbdataReference(var)
Definition: cbdata.h:341
unsigned short defaultPort() const
Definition: UriScheme.cc:52
StoreEntry * storeCreateEntry(const char *url, const char *logUrl, const RequestFlags &flags, const HttpRequestMethod &method)
Definition: store.cc:776
void stopReading()
cancels Comm::Read() if it is scheduled
Definition: Server.cc:56
#define DBG_IMPORTANT
Definition: Debug.h:46
char const * rawBuf() const
Definition: SquidString.h:85
struct SquidConfig::@99 Port
bool hasNoCache(const String **val=nullptr) const
Definition: HttpHdrCc.h:89
void setLogUriToRawUri(const char *rawUri, const HttpRequestMethod &)
static void SslBumpEstablish(const Comm::ConnectionPointer &, char *, size_t, Comm::Flag errflag, int, void *data)
bool parse(const HttpRequestMethod &, const char *url)
Definition: Uri.cc:191
void update(const LogTags_ot t)
Definition: LogTags.cc:44
bool connectionAuthDisabled
Definition: RequestFlags.h:80
void expectNoForwarding()
cleans up virgin request [body] forwarding state
virtual HttpRequest * clone() const
Definition: HttpRequest.cc:176
Ip::Address client_addr
Definition: HttpRequest.h:141
void CSCB(clientStreamNode *, ClientHttpRequest *, HttpReply *, StoreIOBuffer)
client stream read callback
static void clientAccessCheckDoneWrapper(allow_t, void *)
bool connectionProxyAuth
Definition: RequestFlags.h:83
SQUIDCEXTERN CSR clientGetMoreData
Definition: client_side.h:442
char const * termedBuf() const
Definition: SquidString.h:91
int kind
which custom access list verb matched
Definition: Acl.h:153
void absorbLogUri(char *aUri)
assigns log_uri with aUri without copying the entire C-string
const char * c_str() const
compute the status access.log field
Definition: LogTags.cc:56
String getList(Http::HdrType id) const
Definition: HttpHeader.cc:828
bool onlyIfCached() const
StoreEntry * storeEntry() const
unsigned short icp
Definition: SquidConfig.h:135
const SBuf & effectiveRequestUri() const
RFC 7230 section 5.5 - Effective Request URI.
Definition: HttpRequest.cc:687
common parts of HttpRequest and HttpReply
Definition: Message.h:24
Config TheConfig
Globally available instance of Qos::Config.
Definition: QosConfig.cc:271
AnyP::Uri url
the request URI
Definition: HttpRequest.h:107
int strListIsSubstr(const String *list, const char *s, char del)
Definition: StrList.cc:54
void * addr
Definition: membanger.c:46
void handleAdaptationBlock(const Adaptation::Answer &answer)
void userInfo(const SBuf &s)
Definition: Uri.h:75
CbcPointer< ConnStateData > clientConnectionManager
Definition: HttpRequest.h:222
struct SquidConfig::@113 accessList
HttpRequest * request
bool allowed() const
Definition: Acl.h:141
AnyP::UriScheme const & getScheme() const
Definition: Uri.h:67
BodyPipe::Pointer adaptedBodySource
Http::StatusCode httpStatus
Definition: errorpage.h:143
bool setConsumerIfNotLate(const Consumer::Pointer &aConsumer)
Definition: BodyPipe.cc:228
Ip::NfMarkConfig aclFindNfMarkConfig(acl_nfmark *head, ACLChecklist *ch)
Checks for a netfilter mark value to apply depending on the ACL.
Definition: FwdState.cc:1284
const char * c_str()
Definition: SBuf.cc:526
bool conflicted() const
whether Squid is uncertain about the allowed() or denied() answer
Definition: Acl.h:150
ClientStreamData data
Definition: clientStream.h:94
AccessLogEntry::Pointer al
access.log entry
void ipcache_nbgethostbyname(const char *name, IPH *handler, void *handlerData)
Definition: ipcache.cc:600
void resumeBodyStorage()
called by StoreEntry when it has more buffer space available
const char * AclMatchedName
Definition: Acl.cc:30
class AccessLogEntry::HttpDetails http
void host(const char *src)
Definition: Uri.cc:47
bool update(HttpHeader const *fresh)
Definition: HttpHeader.cc:283
ClientRequestContext * calloutContext
static int port
Definition: ldap_backend.cc:69
void tunnelStart(ClientHttpRequest *)
Definition: tunnel.cc:1084
void setLogUriToRequestUri()
sets log_uri when we know the current request
int hasListMember(Http::HdrType id, const char *member, const char separator) const
Definition: HttpHeader.cc:1674
void cut(size_type newLength)
Definition: String.cc:236
String x_forwarded_for_iterator
Definition: HttpRequest.h:180
Security::CertPointer sslClientCert
cert received from the client
struct ClientHttpRequest::Out out
static HttpRequest * FromUrl(const char *url, const MasterXaction::Pointer &, const HttpRequestMethod &method=Http::METHOD_GET)
Definition: HttpRequest.cc:523
void ignoreRange(const char *reason)
forgets about the cached Range header (for a reason)
Definition: HttpRequest.cc:628
acl_access * adapted_http
Definition: SquidConfig.h:359
std::ostream & HERE(std::ostream &s)
Definition: Debug.h:153
class AccessLogEntry::CacheDetails cache
ssize_t HttpHeaderPos
Definition: HttpHeader.h:45
struct SquidConfig::@112 onoff
static uint32 A
Definition: md4.c:43
void handleAdaptationFailure(int errDetail, bool bypassable=false)
class AccessLogEntry::SslDetails ssl
char const * denyMessage(char const *const default_message=NULL) const
Definition: UserRequest.cc:127
unsigned short port() const
Definition: Address.cc:771
#define FAILURE_MODE_TIME
acl_access * noCache
Definition: SquidConfig.h:365
mb_size_t contentSize() const
available data size
Definition: MemBuf.h:47
Flag
Definition: Flag.h:15
Ip::Address local
Definition: Connection.h:135
static char * cleanup(const char *uri)
Definition: Uri.cc:941
HttpHeader header
Definition: Message.h:74
bool accelerated
Definition: RequestFlags.h:60
Http::MethodType id() const
Definition: RequestMethod.h:73
bool final
whether the error, if any, cannot be bypassed
Definition: Answer.h:41
Ssl::BumpMode sslBumpNeed_
whether (and how) the request needs to be bumped
AclDenyInfoList * denyInfoList
Definition: SquidConfig.h:407
struct SquidConfig::@104 Program
char rfc931[USER_IDENT_SZ]
Definition: Connection.h:165
RequestFlags flags
Definition: HttpRequest.h:133
#define REDIRECT_DONE
Definition: defines.h:89
Adaptation::Icap::History::Pointer icapHistory() const
Returns possibly nil history, creating it if icap logging is enabled.
Definition: HttpRequest.cc:399
ClientRequestContext(ClientHttpRequest *)
void clearRequest()
resets the current request and log_uri to nil
bool maybeCacheable()
Definition: HttpRequest.cc:538
void setServerBump(Ssl::ServerBump *srvBump)
Definition: client_side.h:254
virtual void noteMoreBodyDataAvailable(BodyPipe::Pointer)
err_type type
Definition: errorpage.h:140
Ip::Address remote
Definition: Connection.h:138
void Comm::ConnectionPointer & clientConn
Definition: stub_tunnel.cc:19
hier_code
Definition: hier_code.h:12
#define ScheduleCallHere(call)
Definition: AsyncCall.h:166
void httpRequestPack(void *obj, Packable *p)
Definition: HttpRequest.cc:371
Definition: Uri.h:30
StoreEntry * loggingEntry_
int acl_uses_indirect_client
Definition: SquidConfig.h:329
void write(StoreIOBuffer)
Definition: store.cc:797
bool intercepted
Definition: RequestFlags.h:64
bool sslBumpNeeded() const
returns true if and only if the request needs to be bumped
#define PROF_start(probename)
Definition: Profiler.h:62
StoreIOBuffer readBuffer
Definition: clientStream.h:95
bool isOpen() const
Definition: Connection.h:87
bool respMaybeCacheable() const
SQUIDCEXTERN CSS clientReplyStatus
Definition: client_side.h:443
AnyP::PortCfgPointer port
Kind kind
the type of the answer
Definition: Answer.h:42
#define CBDATA_CLASS_INIT(type)
Definition: cbdata.h:318
void detailError(err_type aType, int aDetail)
sets error detail if no earlier detail was available
Definition: HttpRequest.cc:456
forward the supplied adapted HTTP message
Definition: Answer.h:27
struct ClientHttpRequest::Flags flags
Comm::Flag flag
comm layer result status.
Definition: CommCalls.h:87
CbcPointer< Adaptation::Initiate > virginHeadSource
double request_failure_ratio
bool denied() const
Definition: Acl.h:147
static void clientStoreIdAccessCheckDone(allow_t answer, void *data)
static int clientHierarchical(ClientHttpRequest *http)
block or deny the master xaction; see authority
Definition: Answer.h:28
void(* ObjPackMethod)(void *obj, Packable *p)
Definition: tools.h:33
struct ConnStateData::@39 flags
size_t HttpReply *STUB StoreEntry const KeyScope scope const HttpRequestMethod & method
Definition: stub_store.cc:122
static bool Start(Method method, VectPoint vp, HttpRequest *req, HttpReply *rep, AccessLogEntry::Pointer &al, Adaptation::Initiator *initiator)
Definition: AccessCheck.cc:30
void syncNotes(HttpRequest *request)
accepted (from a client by Squid)
Definition: QosConfig.h:67
ConnStateData * conn_
void stopConsumingFrom(RefCount< BodyPipe > &)
Definition: BodyPipe.cc:118
void storeIdStart(ClientHttpRequest *http, HLPCB *handler, void *data)
Definition: redirect.cc:314
Comm::ConnectionPointer clientConnection
Definition: Server.h:97
void hostHeaderIpVerify(const ipcache_addrs *ia, const Dns::LookupDetails &dns)
Auth::UserRequest::Pointer auth_user_request
Definition: HttpRequest.h:119
const char * errorTypeName(err_type err)
Definition: err_type.h:100
time_t getTime(Http::HdrType id) const
Definition: HttpHeader.cc:1195
int setSockNfmark(const Comm::ConnectionPointer &conn, nfmark_t mark)
Definition: QosConfig.cc:586
void errorAppendEntry(StoreEntry *entry, ErrorState *err)
Definition: errorpage.cc:575
clientStream_status_t CSS(clientStreamNode *, ClientHttpRequest *)
int hostStrictVerify
Definition: SquidConfig.h:340
BodyPipe::Pointer body_pipe
optional pipeline to receive message body
Definition: Message.h:97
CommCbFunPtrCallT< Dialer > * commCbCall(int debugSection, int debugLevel, const char *callName, const Dialer &dialer)
Definition: CommCalls.h:342
#define REDIRECT_PENDING
Definition: defines.h:88
int cbdataReferenceValid(const void *p)
Definition: cbdata.cc:412
HttpHdrRange::iterator end
void sslBumpEstablish(Comm::Flag errflag)
Ssl::BumpMode sslBumpMode
ssl_bump decision (Ssl::bumpEnd if n/a).
Definition: client_side.h:272
const HttpReplyPointer & getReply() const
Definition: MemObject.h:57
static void checkNoCacheDoneWrapper(allow_t, void *)
static void clientRedirectAccessCheckDone(allow_t answer, void *data)
void clientRedirectDone(const Helper::Reply &reply)
const char * getStr(Http::HdrType id) const
Definition: HttpHeader.cc:1212
void detailError(int dCode)
set error type-specific detail code
Definition: errorpage.h:97
size_t bytesWanted(Range< size_t > const aRange, bool ignoreDelayPool=false) const
Definition: store.cc:228
time_t hit_only_mode_until
virtual void noteAdaptationAnswer(const Adaptation::Answer &answer)
void deferProducer(const AsyncCall::Pointer &producer)
call back producer when more buffer space is available
Definition: store.cc:352
HttpRequest *const request
static void clientCheckPinning(ClientHttpRequest *http)
void clean()
Definition: String.cc:125
void switchToHttps(HttpRequest *request, Ssl::BumpMode bumpServerMode)
#define MAX_URL
Definition: defines.h:118
BumpMode
Definition: support.h:130
#define PROF_stop(probename)
Definition: Profiler.h:63
void initRequest(HttpRequest *)
ACLChecklist * acl_checklist
struct ConnStateData::@40 pinning
void sslBumpAccessCheckDone(const allow_t &answer)
The callback function for ssl-bump access check list.
int64_t strtoll(const char *nptr, char **endptr, int base)
Definition: strtoll.c:81
HttpHdrRange::iterator pos
void CSD(clientStreamNode *, ClientHttpRequest *)
client stream detach
void CSR(clientStreamNode *, ClientHttpRequest *)
client stream read
void clientAccessCheckDone(const allow_t &answer)
bool hasOnlyIfCached() const
Definition: HttpHdrCc.h:145
StoreEntry * loggingEntry() const
#define xfree
const char * findFirst(const char *noteKey) const
Definition: Notes.cc:265
const char * sslGetUserEmail(SSL *ssl)
Definition: support.cc:686
int setSockTos(const Comm::ConnectionPointer &conn, tos_t tos)
Definition: QosConfig.cc:558
acl_access * http
Definition: SquidConfig.h:358
HierarchyLogEntry hier
static void clientFollowXForwardedForCheck(allow_t answer, void *data)
void httpRequestFree(void *data)
Definition: client_side.cc:485
static HLPCB clientStoreIdDoneWrapper
Ip::Address indirect_client_addr
Definition: HttpRequest.h:144
C * getRaw() const
Definition: RefCount.h:74
class SquidConfig Config
Definition: SquidConfig.cc:12
tos_t aclMapTOS(acl_tos *head, ACLChecklist *ch)
Checks for a TOS value to apply depending on the ACL.
Definition: FwdState.cc:1272
squidaio_request_t * head
Definition: aiops.cc:127
acl_access * ssl_bump
Definition: SquidConfig.h:387
#define NULL
Definition: types.h:166
const Auth::UserRequest::Pointer & getAuth() const
Definition: client_side.h:114
void hostHeaderVerifyFailed(const char *A, const char *B)
void HTTPMSGUNLOCK(Http::Message *a)
Definition: Message.h:147
ErrorState * error
saved error page for centralized/delayed processing
void debugObj(int section, int level, const char *label, void *obj, ObjPackMethod pm)
Definition: tools.cc:900
int refresh_nocache_hack
#define false
Definition: GnuRegex.c:233
virtual void syncAle(HttpRequest *adaptedRequest, const char *logUri) const
assigns uninitialized adapted_request and url ALE components
void Write(const Comm::ConnectionPointer &conn, const char *buf, int size, AsyncCall::Pointer &callback, FREE *free_func)
Definition: Write.cc:35
void clientStoreIdDone(const Helper::Reply &reply)
err_type
Definition: err_type.h:12
err_type aclGetDenyInfoPage(AclDenyInfoList **head, const char *name, int redirect_allowed)
Definition: Gadgets.cc:40
MemBuf & buf
Definition: BodyPipe.h:74
bool forceTunnel
whether to forward via TunnelStateData (instead of FwdState)
Definition: RequestFlags.h:113
bool nocacheHack
Definition: RequestFlags.h:58
void resetRequest(HttpRequest *)
void fvdbCountForw(const char *key)
void clearAdaptation(CbcPointer< Initiate > &x)
clears the pointer (does not call announceInitiatorAbort)
Definition: Initiator.cc:32
char ThisCache2[RFC2181_MAXHOSTNAMELEN<< 1]
void lock(const char *context)
Definition: store.cc:433
virtual void callException(const std::exception &ex)
called when the job throws during an async call

 

Introduction

Documentation

Support

Miscellaneous

Web Site Translations

Mirrors