client_side_request.cc
Go to the documentation of this file.
1 /*
2  * Copyright (C) 1996-2020 The Squid Software Foundation and contributors
3  *
4  * Squid software is distributed under GPLv2+ license and includes
5  * contributions from numerous individuals and organizations.
6  * Please see the COPYING and CONTRIBUTORS files for details.
7  */
8 
9 /* DEBUG: section 85 Client-side Request Routines */
10 
11 /*
12  * General logic of request processing:
13  *
14  * We run a series of tests to determine if access will be permitted, and to do
15  * any redirection. Then we call into the result clientStream to retrieve data.
16  * From that point on it's up to reply management.
17  */
18 
19 #include "squid.h"
20 #include "acl/FilledChecklist.h"
21 #include "acl/Gadgets.h"
22 #include "anyp/PortCfg.h"
23 #include "base/AsyncJobCalls.h"
24 #include "client_side.h"
25 #include "client_side_reply.h"
26 #include "client_side_request.h"
27 #include "ClientRequestContext.h"
28 #include "clientStream.h"
29 #include "comm/Connection.h"
30 #include "comm/Write.h"
31 #include "err_detail_type.h"
32 #include "errorpage.h"
33 #include "fd.h"
34 #include "fde.h"
35 #include "format/Token.h"
36 #include "gopher.h"
37 #include "helper.h"
38 #include "helper/Reply.h"
39 #include "http.h"
40 #include "http/Stream.h"
41 #include "HttpHdrCc.h"
42 #include "HttpReply.h"
43 #include "HttpRequest.h"
44 #include "ip/NfMarkConfig.h"
45 #include "ip/QosConfig.h"
46 #include "ipcache.h"
47 #include "log/access_log.h"
48 #include "MemObject.h"
49 #include "Parsing.h"
50 #include "profiler/Profiler.h"
51 #include "proxyp/Header.h"
52 #include "redirect.h"
53 #include "rfc1738.h"
54 #include "SquidConfig.h"
55 #include "SquidTime.h"
56 #include "Store.h"
57 #include "StrList.h"
58 #include "tools.h"
59 #include "wordlist.h"
60 #if USE_AUTH
61 #include "auth/UserRequest.h"
62 #endif
63 #if USE_ADAPTATION
64 #include "adaptation/AccessCheck.h"
65 #include "adaptation/Answer.h"
66 #include "adaptation/Iterator.h"
67 #include "adaptation/Service.h"
68 #if ICAP_CLIENT
70 #endif
71 #endif
72 #if USE_OPENSSL
73 #include "ssl/ServerBump.h"
74 #include "ssl/support.h"
75 #endif
76 
77 #if LINGERING_CLOSE
78 #define comm_close comm_lingering_close
79 #endif
80 
81 static const char *const crlf = "\r\n";
82 
83 #if FOLLOW_X_FORWARDED_FOR
84 static void clientFollowXForwardedForCheck(Acl::Answer answer, void *data);
85 #endif /* FOLLOW_X_FORWARDED_FOR */
86 
88 
90 
91 /* Local functions */
92 /* other */
93 static void clientAccessCheckDoneWrapper(Acl::Answer, void *);
94 #if USE_OPENSSL
95 static void sslBumpAccessCheckDoneWrapper(Acl::Answer, void *);
96 #endif
97 static int clientHierarchical(ClientHttpRequest * http);
101 static void checkNoCacheDoneWrapper(Acl::Answer, void *);
105 static void checkFailureRatio(err_type, hier_code);
106 
108 {
109  /*
110  * Release our "lock" on our parent, ClientHttpRequest, if we
111  * still have one
112  */
113 
114  if (http)
116 
117  delete error;
118  debugs(85,3, "ClientRequestContext destructed, this=" << this);
119 }
120 
122  http(cbdataReference(anHttp)),
123  acl_checklist(NULL),
124  redirect_state(REDIRECT_NONE),
125  store_id_state(REDIRECT_NONE),
126  host_header_verify_done(false),
127  http_access_done(false),
128  adapted_http_access_done(false),
129 #if USE_ADAPTATION
130  adaptation_acl_check_done(false),
131 #endif
132  redirect_done(false),
133  store_id_done(false),
134  no_cache_done(false),
135  interpreted_req_hdrs(false),
136  toClientMarkingDone(false),
137 #if USE_OPENSSL
138  sslBumpCheckDone(false),
139 #endif
140  error(NULL),
141  readNextRequest(false)
142 {
143  debugs(85, 3, "ClientRequestContext constructed, this=" << this);
144 }
145 
147 
149 #if USE_ADAPTATION
150  AsyncJob("ClientHttpRequest"),
151 #endif
152  request(NULL),
153  uri(NULL),
154  log_uri(NULL),
155  req_sz(0),
156  calloutContext(NULL),
157  maxReplyBodySize_(0),
158  entry_(NULL),
159  loggingEntry_(NULL),
160  conn_(NULL)
161 #if USE_OPENSSL
162  , sslBumpNeed_(Ssl::bumpEnd)
163 #endif
164 #if USE_ADAPTATION
165  , request_satisfaction_mode(false)
166  , request_satisfaction_offset(0)
167 #endif
168 {
169  setConn(aConn);
170  al = new AccessLogEntry;
173  if (aConn) {
175  al->cache.port = aConn->port;
176  al->cache.caddr = aConn->log_addr;
178 
179 #if USE_OPENSSL
180  if (aConn->clientConnection != NULL && aConn->clientConnection->isOpen()) {
181  if (auto ssl = fd_table[aConn->clientConnection->fd].ssl.get())
182  al->cache.sslClientCert.resetWithoutLocking(SSL_get_peer_certificate(ssl));
183  }
184 #endif
185  }
187 }
188 
189 /*
190  * returns true if client specified that the object must come from the cache
191  * without contacting origin server
192  */
193 bool
195 {
196  assert(request);
197  return request->cache_control &&
199 }
200 
213 static void
215 {
216  // Can be set at compile time with -D compiler flag
217 #ifndef FAILURE_MODE_TIME
218 #define FAILURE_MODE_TIME 300
219 #endif
220 
221  if (hcode == HIER_NONE)
222  return;
223 
224  // don't bother when ICP is disabled.
225  if (Config.Port.icp <= 0)
226  return;
227 
228  static double magic_factor = 100.0;
229  double n_good;
230  double n_bad;
231 
232  n_good = magic_factor / (1.0 + request_failure_ratio);
233 
234  n_bad = magic_factor - n_good;
235 
236  switch (etype) {
237 
238  case ERR_DNS_FAIL:
239 
240  case ERR_CONNECT_FAIL:
242 
243  case ERR_READ_ERROR:
244  ++n_bad;
245  break;
246 
247  default:
248  ++n_good;
249  }
250 
251  request_failure_ratio = n_bad / n_good;
252 
254  return;
255 
256  if (request_failure_ratio < 1.0)
257  return;
258 
259  debugs(33, DBG_CRITICAL, "WARNING: Failure Ratio at "<< std::setw(4)<<
260  std::setprecision(3) << request_failure_ratio);
261 
262  debugs(33, DBG_CRITICAL, "WARNING: ICP going into HIT-only mode for " <<
263  FAILURE_MODE_TIME / 60 << " minutes...");
264 
266 
267  request_failure_ratio = 0.8; /* reset to something less than 1.0 */
268 }
269 
271 {
272  debugs(33, 3, "httpRequestFree: " << uri);
274 
275  // Even though freeResources() below may destroy the request,
276  // we no longer set request->body_pipe to NULL here
277  // because we did not initiate that pipe (ConnStateData did)
278 
279  /* the ICP check here was erroneous
280  * - StoreEntry::releaseRequest was always called if entry was valid
281  */
282 
283  logRequest();
284 
286 
287  if (request)
289 
290  freeResources();
291 
292 #if USE_ADAPTATION
294 
295  if (adaptedBodySource != NULL)
297 #endif
298 
299  if (calloutContext)
300  delete calloutContext;
301 
303 
304  if (conn_)
306 
307  /* moving to the next connection is handled by the context free */
309 
311 }
312 
322 int
323 clientBeginRequest(const HttpRequestMethod& method, char const *url, CSCB * streamcallback,
324  CSD * streamdetach, ClientStreamData streamdata, HttpHeader const *header,
325  char *tailbuf, size_t taillen, const MasterXaction::Pointer &mx)
326 {
327  size_t url_sz;
330  StoreIOBuffer tempBuffer;
331  if (http->al != NULL)
332  http->al->cache.start_time = current_time;
333  /* this is only used to adjust the connection offset in client_side.c */
334  http->req_sz = 0;
335  tempBuffer.length = taillen;
336  tempBuffer.data = tailbuf;
337  /* client stream setup */
339  clientReplyStatus, new clientReplyContext(http), streamcallback,
340  streamdetach, streamdata, tempBuffer);
341  /* make it visible in the 'current acctive requests list' */
342  /* Set flags */
343  /* internal requests only makes sense in an
344  * accelerator today. TODO: accept flags ? */
345  http->flags.accel = true;
346  /* allow size for url rewriting */
347  url_sz = strlen(url) + Config.appendDomainLen + 5;
348  http->uri = (char *)xcalloc(url_sz, 1);
349  strcpy(http->uri, url); // XXX: polluting http->uri before parser validation
350 
352  if (!request) {
353  debugs(85, 5, "Invalid URL: " << http->uri);
354  return -1;
355  }
356 
357  /*
358  * now update the headers in request with our supplied headers.
359  * HttpRequest::FromUrl() should return a blank header set, but
360  * we use Update to be sure of correctness.
361  */
362  if (header)
363  request->header.update(header);
364 
365  /* http struct now ready */
366 
367  /*
368  * build new header list *? TODO
369  */
370  request->flags.accelerated = http->flags.accel;
371 
372  /* this is an internally created
373  * request, not subject to acceleration
374  * target overrides */
375  // TODO: detect and handle internal requests of internal objects?
376 
377  /* Internally created requests cannot have bodies today */
378  request->content_length = 0;
379 
380  request->client_addr.setNoAddr();
381 
382 #if FOLLOW_X_FORWARDED_FOR
383  request->indirect_client_addr.setNoAddr();
384 #endif /* FOLLOW_X_FORWARDED_FOR */
385 
386  request->my_addr.setNoAddr(); /* undefined for internal requests */
387 
388  request->my_addr.port(0);
389 
390  request->http_ver = Http::ProtocolVersion();
391 
392  http->initRequest(request);
393 
394  /* optional - skip the access check ? */
395  http->calloutContext = new ClientRequestContext(http);
396 
397  http->calloutContext->http_access_done = false;
398 
399  http->calloutContext->redirect_done = true;
400 
401  http->calloutContext->no_cache_done = true;
402 
403  http->doCallouts();
404 
405  return 0;
406 }
407 
408 bool
410 {
411  ClientHttpRequest *http_ = http;
412 
413  if (cbdataReferenceValid(http_))
414  return true;
415 
416  http = NULL;
417 
418  cbdataReferenceDone(http_);
419 
420  return false;
421 }
422 
423 #if FOLLOW_X_FORWARDED_FOR
424 
438 static void
440 {
441  ClientRequestContext *calloutContext = (ClientRequestContext *) data;
442 
443  if (!calloutContext->httpStateIsValid())
444  return;
445 
446  ClientHttpRequest *http = calloutContext->http;
447  HttpRequest *request = http->request;
448 
449  if (answer.allowed() && request->x_forwarded_for_iterator.size() != 0) {
450 
451  /*
452  * Remove the last comma-delimited element from the
453  * x_forwarded_for_iterator and use it to repeat the cycle.
454  */
455  const char *p;
456  const char *asciiaddr;
457  int l;
458  Ip::Address addr;
459  p = request->x_forwarded_for_iterator.termedBuf();
460  l = request->x_forwarded_for_iterator.size();
461 
462  /*
463  * XXX x_forwarded_for_iterator should really be a list of
464  * IP addresses, but it's a String instead. We have to
465  * walk backwards through the String, biting off the last
466  * comma-delimited part each time. As long as the data is in
467  * a String, we should probably implement and use a variant of
468  * strListGetItem() that walks backwards instead of forwards
469  * through a comma-separated list. But we don't even do that;
470  * we just do the work in-line here.
471  */
472  /* skip trailing space and commas */
473  while (l > 0 && (p[l-1] == ',' || xisspace(p[l-1])))
474  --l;
475  request->x_forwarded_for_iterator.cut(l);
476  /* look for start of last item in list */
477  while (l > 0 && ! (p[l-1] == ',' || xisspace(p[l-1])))
478  --l;
479  asciiaddr = p+l;
480  if ((addr = asciiaddr)) {
481  request->indirect_client_addr = addr;
482  request->x_forwarded_for_iterator.cut(l);
485  /* override the default src_addr tested if we have to go deeper than one level into XFF */
486  Filled(calloutContext->acl_checklist)->src_addr = request->indirect_client_addr;
487  }
489  return;
490  }
491  }
492 
493  /* clean up, and pass control to clientAccessCheck */
495  /*
496  * Ensure that the access log shows the indirect client
497  * instead of the direct client.
498  */
499  http->al->cache.caddr = request->indirect_client_addr;
500  if (ConnStateData *conn = http->getConn())
501  conn->log_addr = request->indirect_client_addr;
502  }
503  request->x_forwarded_for_iterator.clean();
504  request->flags.done_follow_x_forwarded_for = true;
505 
506  if (answer.conflicted()) {
507  debugs(28, DBG_CRITICAL, "ERROR: Processing X-Forwarded-For. Stopping at IP address: " << request->indirect_client_addr );
508  }
509 
510  /* process actual access ACL as normal. */
511  calloutContext->clientAccessCheck();
512 }
513 #endif /* FOLLOW_X_FORWARDED_FOR */
514 
515 static void
517 {
518  ClientRequestContext *c = static_cast<ClientRequestContext*>(data);
519  c->hostHeaderIpVerify(ia, dns);
520 }
521 
522 void
524 {
526 
527  // note the DNS details for the transaction stats.
528  http->request->recordLookup(dns);
529 
530  // Is the NAT destination IP in DNS?
531  if (ia && ia->have(clientConn->local)) {
532  debugs(85, 3, "validate IP " << clientConn->local << " possible from Host:");
533  http->request->flags.hostVerified = true;
534  http->doCallouts();
535  return;
536  }
537  debugs(85, 3, HERE << "FAIL: validate IP " << clientConn->local << " possible from Host:");
538  hostHeaderVerifyFailed("local IP", "any domain IP");
539 }
540 
541 void
543 {
544  // IP address validation for Host: failed. Admin wants to ignore them.
545  // NP: we do not yet handle CONNECT tunnels well, so ignore for them
547  debugs(85, 3, "SECURITY ALERT: Host header forgery detected on " << http->getConn()->clientConnection <<
548  " (" << A << " does not match " << B << ") on URL: " << http->request->effectiveRequestUri());
549 
550  // NP: it is tempting to use 'flags.noCache' but that is all about READing cache data.
551  // The problems here are about WRITE for new cache content, which means flags.cachable
552  http->request->flags.cachable = false; // MUST NOT cache (for now)
553  // XXX: when we have updated the cache key to base on raw-IP + URI this cacheable limit can go.
554  http->request->flags.hierarchical = false; // MUST NOT pass to peers (for now)
555  // XXX: when we have sorted out the best way to relay requests properly to peers this hierarchical limit can go.
556  http->doCallouts();
557  return;
558  }
559 
560  debugs(85, DBG_IMPORTANT, "SECURITY ALERT: Host header forgery detected on " <<
561  http->getConn()->clientConnection << " (" << A << " does not match " << B << ")");
562  if (const char *ua = http->request->header.getStr(Http::HdrType::USER_AGENT))
563  debugs(85, DBG_IMPORTANT, "SECURITY ALERT: By user agent: " << ua);
564  debugs(85, DBG_IMPORTANT, "SECURITY ALERT: on URL: " << http->request->effectiveRequestUri());
565 
566  // IP address validation for Host: failed. reject the connection.
568  clientReplyContext *repContext = dynamic_cast<clientReplyContext *>(node->data.getRaw());
569  assert (repContext);
570  repContext->setReplyToError(ERR_CONFLICT_HOST, Http::scConflict,
571  http->request->method, NULL,
573  http->request,
574  NULL,
575 #if USE_AUTH
576  http->getConn() != NULL && http->getConn()->getAuth() != NULL ?
578 #else
579  NULL);
580 #endif
582  clientStreamRead(node, http, node->readBuffer);
583 }
584 
585 void
587 {
588  // Require a Host: header.
589  const char *host = http->request->header.getStr(Http::HdrType::HOST);
590 
591  if (!host) {
592  // TODO: dump out the HTTP/1.1 error about missing host header.
593  // otherwise this is fine, can't forge a header value when its not even set.
594  debugs(85, 3, HERE << "validate skipped with no Host: header present.");
595  http->doCallouts();
596  return;
597  }
598 
599  if (http->request->flags.internal) {
600  // TODO: kill this when URL handling allows partial URLs out of accel mode
601  // and we no longer screw with the URL just to add our internal host there
602  debugs(85, 6, HERE << "validate skipped due to internal composite URL.");
603  http->doCallouts();
604  return;
605  }
606 
607  // Locate if there is a port attached, strip ready for IP lookup
608  char *portStr = NULL;
609  char *hostB = xstrdup(host);
610  host = hostB;
611  if (host[0] == '[') {
612  // IPv6 literal.
613  portStr = strchr(hostB, ']');
614  if (portStr && *(++portStr) != ':') {
615  portStr = NULL;
616  }
617  } else {
618  // Domain or IPv4 literal with port
619  portStr = strrchr(hostB, ':');
620  }
621 
622  uint16_t port = 0;
623  if (portStr) {
624  *portStr = '\0'; // strip the ':'
625  if (*(++portStr) != '\0') {
626  char *end = NULL;
627  int64_t ret = strtoll(portStr, &end, 10);
628  if (end == portStr || *end != '\0' || ret < 1 || ret > 0xFFFF) {
629  // invalid port details. Replace the ':'
630  *(--portStr) = ':';
631  portStr = NULL;
632  } else
633  port = (ret & 0xFFFF);
634  }
635  }
636 
637  debugs(85, 3, "validate host=" << host << ", port=" << port << ", portStr=" << (portStr?portStr:"NULL"));
639  // verify the Host: port (if any) matches the apparent destination
640  if (portStr && port != http->getConn()->clientConnection->local.port()) {
641  debugs(85, 3, "FAIL on validate port " << http->getConn()->clientConnection->local.port() <<
642  " matches Host: port " << port << " (" << portStr << ")");
643  hostHeaderVerifyFailed("intercepted port", portStr);
644  } else {
645  // XXX: match the scheme default port against the apparent destination
646 
647  // verify the destination DNS is one of the Host: headers IPs
649  }
650  } else if (!Config.onoff.hostStrictVerify) {
651  debugs(85, 3, "validate skipped.");
652  http->doCallouts();
653  } else if (strlen(host) != strlen(http->request->url.host())) {
654  // Verify forward-proxy requested URL domain matches the Host: header
655  debugs(85, 3, "FAIL on validate URL domain length " << http->request->url.host() << " matches Host: " << host);
657  } else if (matchDomainName(host, http->request->url.host()) != 0) {
658  // Verify forward-proxy requested URL domain matches the Host: header
659  debugs(85, 3, "FAIL on validate URL domain " << http->request->url.host() << " matches Host: " << host);
661  } else if (portStr && port != http->request->url.port()) {
662  // Verify forward-proxy requested URL domain matches the Host: header
663  debugs(85, 3, "FAIL on validate URL port " << http->request->url.port() << " matches Host: port " << portStr);
664  hostHeaderVerifyFailed("URL port", portStr);
665  } else if (!portStr && http->request->method != Http::METHOD_CONNECT && http->request->url.port() != http->request->url.getScheme().defaultPort()) {
666  // Verify forward-proxy requested URL domain matches the Host: header
667  // Special case: we don't have a default-port to check for CONNECT. Assume URL is correct.
668  debugs(85, 3, "FAIL on validate URL port " << http->request->url.port() << " matches Host: default port " << http->request->url.getScheme().defaultPort());
669  hostHeaderVerifyFailed("URL port", "default port");
670  } else {
671  // Okay no problem.
672  debugs(85, 3, "validate passed.");
673  http->request->flags.hostVerified = true;
674  http->doCallouts();
675  }
676  safe_free(hostB);
677 }
678 
679 /* This is the entry point for external users of the client_side routines */
680 void
682 {
683 #if FOLLOW_X_FORWARDED_FOR
684  if (!http->request->flags.doneFollowXff() &&
687 
688  /* we always trust the direct client address for actual use */
691 
692  /* setup the XFF iterator for processing */
694 
695  /* begin by checking to see if we trust direct client enough to walk XFF */
698  return;
699  }
700 #endif
701 
702  if (Config.accessList.http) {
705  } else {
706  debugs(0, DBG_CRITICAL, "No http_access configuration found. This will block ALL traffic");
708  }
709 }
710 
716 void
718 {
722  } else {
723  debugs(85, 2, HERE << "No adapted_http_access configuration. default: ALLOW");
725  }
726 }
727 
728 void
730 {
731  ClientRequestContext *calloutContext = (ClientRequestContext *) data;
732 
733  if (!calloutContext->httpStateIsValid())
734  return;
735 
736  calloutContext->clientAccessCheckDone(answer);
737 }
738 
739 void
741 {
743  err_type page_id;
744  Http::StatusCode status;
745  debugs(85, 2, "The request " << http->request->method << ' ' <<
746  http->uri << " is " << answer <<
747  "; last ACL checked: " << (AclMatchedName ? AclMatchedName : "[none]"));
748 
749 #if USE_AUTH
750  char const *proxy_auth_msg = "<null>";
751  if (http->getConn() != NULL && http->getConn()->getAuth() != NULL)
752  proxy_auth_msg = http->getConn()->getAuth()->denyMessage("<null>");
753  else if (http->request->auth_user_request != NULL)
754  proxy_auth_msg = http->request->auth_user_request->denyMessage("<null>");
755 #endif
756 
757  if (!answer.allowed()) {
758  // auth has a grace period where credentials can be expired but okay not to challenge.
759 
760  /* Send an auth challenge or error */
761  // XXX: do we still need aclIsProxyAuth() ?
762  bool auth_challenge = (answer == ACCESS_AUTH_REQUIRED || aclIsProxyAuth(AclMatchedName));
763  debugs(85, 5, "Access Denied: " << http->uri);
764  debugs(85, 5, "AclMatchedName = " << (AclMatchedName ? AclMatchedName : "<null>"));
765 #if USE_AUTH
766  if (auth_challenge)
767  debugs(33, 5, "Proxy Auth Message = " << (proxy_auth_msg ? proxy_auth_msg : "<null>"));
768 #endif
769 
770  /*
771  * NOTE: get page_id here, based on AclMatchedName because if
772  * USE_DELAY_POOLS is enabled, then AclMatchedName gets clobbered in
773  * the clientCreateStoreEntry() call just below. Pedro Ribeiro
774  * <pribeiro@isel.pt>
775  */
777 
779 
780  if (auth_challenge) {
781 #if USE_AUTH
782  if (http->request->flags.sslBumped) {
783  /*SSL Bumped request, authentication is not possible*/
784  status = Http::scForbidden;
785  } else if (!http->flags.accel) {
786  /* Proxy authorisation needed */
788  } else {
789  /* WWW authorisation needed */
790  status = Http::scUnauthorized;
791  }
792 #else
793  // need auth, but not possible to do.
794  status = Http::scForbidden;
795 #endif
796  if (page_id == ERR_NONE)
797  page_id = ERR_CACHE_ACCESS_DENIED;
798  } else {
799  status = Http::scForbidden;
800 
801  if (page_id == ERR_NONE)
802  page_id = ERR_ACCESS_DENIED;
803  }
804 
805  Ip::Address tmpnoaddr;
806  tmpnoaddr.setNoAddr();
807  error = clientBuildError(page_id, status,
808  NULL,
809  http->getConn() != NULL ? http->getConn()->clientConnection->remote : tmpnoaddr,
810  http->request, http->al
811  );
812 
813 #if USE_AUTH
815  http->getConn() != NULL && http->getConn()->getAuth() != NULL ?
817 #endif
818 
819  readNextRequest = true;
820  }
821 
822  /* ACCESS_ALLOWED continues here ... */
823  xfree(http->uri);
825  http->doCallouts();
826 }
827 
828 #if USE_ADAPTATION
829 void
831 {
832  debugs(93,3,HERE << this << " adaptationAclCheckDone called");
833 
834 #if ICAP_CLIENT
836  if (ih != NULL) {
837  if (getConn() != NULL && getConn()->clientConnection != NULL) {
838  ih->rfc931 = getConn()->clientConnection->rfc931;
839 #if USE_OPENSSL
840  if (getConn()->clientConnection->isOpen()) {
841  ih->ssluser = sslGetUserEmail(fd_table[getConn()->clientConnection->fd].ssl.get());
842  }
843 #endif
844  }
845  ih->log_uri = log_uri;
846  ih->req_sz = req_sz;
847  }
848 #endif
849 
850  if (!g) {
851  debugs(85,3, HERE << "no adaptation needed");
852  doCallouts();
853  return;
854  }
855 
856  startAdaptation(g);
857 }
858 
859 #endif
860 
861 static void
863 {
865  ClientHttpRequest *http = context->http;
866  context->acl_checklist = NULL;
867 
868  if (answer.allowed())
870  else {
871  Helper::Reply const nilReply(Helper::Error);
872  context->clientRedirectDone(nilReply);
873  }
874 }
875 
876 void
878 {
879  debugs(33, 5, HERE << "'" << http->uri << "'");
884  } else
886 }
887 
892 static void
894 {
895  ClientRequestContext *context = static_cast<ClientRequestContext *>(data);
896  ClientHttpRequest *http = context->http;
897  context->acl_checklist = NULL;
898 
899  if (answer.allowed())
900  storeIdStart(http, clientStoreIdDoneWrapper, context);
901  else {
902  debugs(85, 3, "access denied expected ERR reply handling: " << answer);
903  Helper::Reply const nilReply(Helper::Error);
904  context->clientStoreIdDone(nilReply);
905  }
906 }
907 
913 void
915 {
916  debugs(33, 5,"'" << http->uri << "'");
917 
918  if (Config.accessList.store_id) {
921  } else
923 }
924 
925 static int
927 {
928  HttpRequest *request = http->request;
930 
931  // intercepted requests MUST NOT (yet) be sent to peers unless verified
932  if (!request->flags.hostVerified && (request->flags.intercepted || request->flags.interceptTproxy))
933  return 0;
934 
935  /*
936  * IMS needs a private key, so we can use the hierarchy for IMS only if our
937  * neighbors support private keys
938  */
939 
940  if (request->flags.ims && !neighbors_do_private_keys)
941  return 0;
942 
943  /*
944  * This is incorrect: authenticating requests can be sent via a hierarchy
945  * (they can even be cached if the correct headers are set on the reply)
946  */
947  if (request->flags.auth)
948  return 0;
949 
950  if (method == Http::METHOD_TRACE)
951  return 1;
952 
953  if (method != Http::METHOD_GET)
954  return 0;
955 
956  if (request->flags.loopDetected)
957  return 0;
958 
959  if (request->url.getScheme() == AnyP::PROTO_HTTP)
960  return method.respMaybeCacheable();
961 
962  if (request->url.getScheme() == AnyP::PROTO_GOPHER)
963  return gopherCachable(request);
964 
965  if (request->url.getScheme() == AnyP::PROTO_CACHE_OBJECT)
966  return 0;
967 
968  return 1;
969 }
970 
971 static void
973 {
974  HttpRequest *request = http->request;
975  HttpHeader *req_hdr = &request->header;
976  ConnStateData *http_conn = http->getConn();
977 
978  /* Internal requests such as those from ESI includes may be without
979  * a client connection
980  */
981  if (!http_conn)
982  return;
983 
984  request->flags.connectionAuthDisabled = http_conn->port->connection_auth_disabled;
985  if (!request->flags.connectionAuthDisabled) {
986  if (Comm::IsConnOpen(http_conn->pinning.serverConnection)) {
987  if (http_conn->pinning.auth) {
988  request->flags.connectionAuth = true;
989  request->flags.auth = true;
990  } else {
991  request->flags.connectionProxyAuth = true;
992  }
993  // These should already be linked correctly.
994  assert(request->clientConnectionManager == http_conn);
995  }
996  }
997 
998  /* check if connection auth is used, and flag as candidate for pinning
999  * in such case.
1000  * Note: we may need to set flags.connectionAuth even if the connection
1001  * is already pinned if it was pinned earlier due to proxy auth
1002  */
1003  if (!request->flags.connectionAuth) {
1006  HttpHeaderEntry *e;
1007  int may_pin = 0;
1008  while ((e = req_hdr->getEntry(&pos))) {
1010  const char *value = e->value.rawBuf();
1011  if (strncasecmp(value, "NTLM ", 5) == 0
1012  ||
1013  strncasecmp(value, "Negotiate ", 10) == 0
1014  ||
1015  strncasecmp(value, "Kerberos ", 9) == 0) {
1016  if (e->id == Http::HdrType::AUTHORIZATION) {
1017  request->flags.connectionAuth = true;
1018  may_pin = 1;
1019  } else {
1020  request->flags.connectionProxyAuth = true;
1021  may_pin = 1;
1022  }
1023  }
1024  }
1025  }
1026  if (may_pin && !request->pinnedConnection()) {
1027  // These should already be linked correctly. Just need the ServerConnection to pinn.
1028  assert(request->clientConnectionManager == http_conn);
1029  }
1030  }
1031  }
1032 }
1033 
1034 static void
1036 {
1037  HttpRequest *request = http->request;
1038  HttpHeader *req_hdr = &request->header;
1039  bool no_cache = false;
1040 
1041  request->imslen = -1;
1043 
1044  if (request->ims > 0)
1045  request->flags.ims = true;
1046 
1047  if (!request->flags.ignoreCc) {
1048  if (request->cache_control) {
1049  if (request->cache_control->hasNoCache())
1050  no_cache=true;
1051 
1052  // RFC 2616: treat Pragma:no-cache as if it was Cache-Control:no-cache when Cache-Control is missing
1053  } else if (req_hdr->has(Http::HdrType::PRAGMA))
1054  no_cache = req_hdr->hasListMember(Http::HdrType::PRAGMA,"no-cache",',');
1055  }
1056 
1057  if (request->method == Http::METHOD_OTHER) {
1058  no_cache=true;
1059  }
1060 
1061  if (no_cache) {
1062 #if USE_HTTP_VIOLATIONS
1063 
1065  request->flags.nocacheHack = true;
1066  else if (refresh_nocache_hack)
1067  request->flags.nocacheHack = true;
1068  else
1069 #endif
1070 
1071  request->flags.noCache = true;
1072  }
1073 
1074  /* ignore range header in non-GETs or non-HEADs */
1076  // XXX: initialize if we got here without HttpRequest::parseHeader()
1077  if (!request->range)
1078  request->range = req_hdr->getRange();
1079 
1080  if (request->range) {
1081  request->flags.isRanged = true;
1083  /* XXX: This is suboptimal. We should give the stream the range set,
1084  * and thereby let the top of the stream set the offset when the
1085  * size becomes known. As it is, we will end up requesting from 0
1086  * for evey -X range specification.
1087  * RBC - this may be somewhat wrong. We should probably set the range
1088  * iter up at this point.
1089  */
1090  node->readBuffer.offset = request->range->lowestOffset(0);
1091  http->range_iter.pos = request->range->begin();
1092  http->range_iter.end = request->range->end();
1093  http->range_iter.valid = true;
1094  }
1095  }
1096 
1097  /* Only HEAD and GET requests permit a Range or Request-Range header.
1098  * If these headers appear on any other type of request, delete them now.
1099  */
1100  else {
1101  req_hdr->delById(Http::HdrType::RANGE);
1103  request->ignoreRange("neither HEAD nor GET");
1104  }
1105 
1106  if (req_hdr->has(Http::HdrType::AUTHORIZATION))
1107  request->flags.auth = true;
1108 
1109  clientCheckPinning(http);
1110 
1111  if (!request->url.userInfo().isEmpty())
1112  request->flags.auth = true;
1113 
1114  if (req_hdr->has(Http::HdrType::VIA)) {
1115  String s = req_hdr->getList(Http::HdrType::VIA);
1116  /*
1117  * ThisCache cannot be a member of Via header, "1.1 ThisCache" can.
1118  * Note ThisCache2 has a space prepended to the hostname so we don't
1119  * accidentally match super-domains.
1120  */
1121 
1122  if (strListIsSubstr(&s, ThisCache2, ',')) {
1123  request->flags.loopDetected = true;
1124  }
1125 
1126 #if USE_FORW_VIA_DB
1127  fvdbCountVia(s.termedBuf());
1128 
1129 #endif
1130 
1131  s.clean();
1132  }
1133 
1134  // headers only relevant to reverse-proxy
1135  if (request->flags.accelerated) {
1136  // check for a cdn-info member with a cdn-id matching surrogate_id
1137  // XXX: HttpHeader::hasListMember() does not handle OWS around ";" yet
1139  request->flags.loopDetected = true;
1140  }
1141 
1142  if (request->flags.loopDetected) {
1143  debugObj(33, DBG_IMPORTANT, "WARNING: Forwarding loop detected for:\n",
1145  }
1146 
1147 #if USE_FORW_VIA_DB
1148 
1149  if (req_hdr->has(Http::HdrType::X_FORWARDED_FOR)) {
1151  fvdbCountForw(s.termedBuf());
1152  s.clean();
1153  }
1154 
1155 #endif
1156 
1157  request->flags.cachable = http->request->maybeCacheable();
1158 
1159  if (clientHierarchical(http))
1160  request->flags.hierarchical = true;
1161 
1162  debugs(85, 5, "clientInterpretRequestHeaders: REQ_NOCACHE = " <<
1163  (request->flags.noCache ? "SET" : "NOT SET"));
1164  debugs(85, 5, "clientInterpretRequestHeaders: REQ_CACHABLE = " <<
1165  (request->flags.cachable ? "SET" : "NOT SET"));
1166  debugs(85, 5, "clientInterpretRequestHeaders: REQ_HIERARCHICAL = " <<
1167  (request->flags.hierarchical ? "SET" : "NOT SET"));
1168 
1169 }
1170 
1171 void
1173 {
1174  ClientRequestContext *calloutContext = (ClientRequestContext *)data;
1175 
1176  if (!calloutContext->httpStateIsValid())
1177  return;
1178 
1179  calloutContext->clientRedirectDone(result);
1180 }
1181 
1182 void
1184 {
1185  ClientRequestContext *calloutContext = (ClientRequestContext *)data;
1186 
1187  if (!calloutContext->httpStateIsValid())
1188  return;
1189 
1190  calloutContext->clientStoreIdDone(result);
1191 }
1192 
1193 void
1195 {
1196  HttpRequest *old_request = http->request;
1197  debugs(85, 5, HERE << "'" << http->uri << "' result=" << reply);
1200 
1201  // Put helper response Notes into the transaction state record (ALE) eventually
1202  // do it early to ensure that no matter what the outcome the notes are present.
1203  if (http->al)
1204  http->al->syncNotes(old_request);
1205 
1206  UpdateRequestNotes(http->getConn(), *old_request, reply.notes);
1207 
1208  switch (reply.result) {
1209  case Helper::TimedOut:
1212  debugs(85, DBG_IMPORTANT, "ERROR: URL rewrite helper: Timedout");
1213  }
1214  break;
1215 
1216  case Helper::Unknown:
1217  case Helper::TT:
1218  // Handler in redirect.cc should have already mapped Unknown
1219  // IF it contained valid entry for the old URL-rewrite helper protocol
1220  debugs(85, DBG_IMPORTANT, "ERROR: URL rewrite helper returned invalid result code. Wrong helper? " << reply);
1221  break;
1222 
1223  case Helper::BrokenHelper:
1224  debugs(85, DBG_IMPORTANT, "ERROR: URL rewrite helper: " << reply);
1225  break;
1226 
1227  case Helper::Error:
1228  // no change to be done.
1229  break;
1230 
1231  case Helper::Okay: {
1232  // #1: redirect with a specific status code OK status=NNN url="..."
1233  // #2: redirect with a default status code OK url="..."
1234  // #3: re-write the URL OK rewrite-url="..."
1235 
1236  const char *statusNote = reply.notes.findFirst("status");
1237  const char *urlNote = reply.notes.findFirst("url");
1238 
1239  if (urlNote != NULL) {
1240  // HTTP protocol redirect to be done.
1241 
1242  // TODO: change default redirect status for appropriate requests
1243  // Squid defaults to 302 status for now for better compatibility with old clients.
1244  // HTTP/1.0 client should get 302 (Http::scFound)
1245  // HTTP/1.1 client contacting reverse-proxy should get 307 (Http::scTemporaryRedirect)
1246  // HTTP/1.1 client being diverted by forward-proxy should get 303 (Http::scSeeOther)
1248  if (statusNote != NULL) {
1249  const char * result = statusNote;
1250  status = static_cast<Http::StatusCode>(atoi(result));
1251  }
1252 
1253  if (status == Http::scMovedPermanently
1254  || status == Http::scFound
1255  || status == Http::scSeeOther
1256  || status == Http::scPermanentRedirect
1257  || status == Http::scTemporaryRedirect) {
1258  http->redirect.status = status;
1259  http->redirect.location = xstrdup(urlNote);
1260  // TODO: validate the URL produced here is RFC 2616 compliant absolute URI
1261  } else {
1262  debugs(85, DBG_CRITICAL, "ERROR: URL-rewrite produces invalid " << status << " redirect Location: " << urlNote);
1263  }
1264  } else {
1265  // URL-rewrite wanted. Ew.
1266  urlNote = reply.notes.findFirst("rewrite-url");
1267 
1268  // prevent broken helpers causing too much damage. If old URL == new URL skip the re-write.
1269  if (urlNote != NULL && strcmp(urlNote, http->uri)) {
1270  AnyP::Uri tmpUrl;
1271  if (tmpUrl.parse(old_request->method, SBuf(urlNote))) {
1272  HttpRequest *new_request = old_request->clone();
1273  new_request->url = tmpUrl;
1274  debugs(61, 2, "URL-rewriter diverts URL from " << old_request->effectiveRequestUri() << " to " << new_request->effectiveRequestUri());
1275 
1276  // update the new request to flag the re-writing was done on it
1277  new_request->flags.redirected = true;
1278 
1279  // unlink bodypipe from the old request. Not needed there any longer.
1280  if (old_request->body_pipe != NULL) {
1281  old_request->body_pipe = NULL;
1282  debugs(61,2, HERE << "URL-rewriter diverts body_pipe " << new_request->body_pipe <<
1283  " from request " << old_request << " to " << new_request);
1284  }
1285 
1286  http->resetRequest(new_request);
1287  old_request = nullptr;
1288  } else {
1289  debugs(85, DBG_CRITICAL, "ERROR: URL-rewrite produces invalid request: " <<
1290  old_request->method << " " << urlNote << " " << old_request->http_ver);
1291  }
1292  }
1293  }
1294  }
1295  break;
1296  }
1297 
1298  /* XXX PIPELINE: This is inaccurate during pipelining */
1299 
1302 
1303  assert(http->uri);
1304 
1305  http->doCallouts();
1306 }
1307 
1311 void
1313 {
1314  HttpRequest *old_request = http->request;
1315  debugs(85, 5, "'" << http->uri << "' result=" << reply);
1318 
1319  // Put helper response Notes into the transaction state record (ALE) eventually
1320  // do it early to ensure that no matter what the outcome the notes are present.
1321  if (http->al)
1322  http->al->syncNotes(old_request);
1323 
1324  UpdateRequestNotes(http->getConn(), *old_request, reply.notes);
1325 
1326  switch (reply.result) {
1327  case Helper::Unknown:
1328  case Helper::TT:
1329  // Handler in redirect.cc should have already mapped Unknown
1330  // IF it contained valid entry for the old helper protocol
1331  debugs(85, DBG_IMPORTANT, "ERROR: storeID helper returned invalid result code. Wrong helper? " << reply);
1332  break;
1333 
1334  case Helper::TimedOut:
1335  // Timeouts for storeID are not implemented
1336  case Helper::BrokenHelper:
1337  debugs(85, DBG_IMPORTANT, "ERROR: storeID helper: " << reply);
1338  break;
1339 
1340  case Helper::Error:
1341  // no change to be done.
1342  break;
1343 
1344  case Helper::Okay: {
1345  const char *urlNote = reply.notes.findFirst("store-id");
1346 
1347  // prevent broken helpers causing too much damage. If old URL == new URL skip the re-write.
1348  if (urlNote != NULL && strcmp(urlNote, http->uri) ) {
1349  // Debug section required for some very specific cases.
1350  debugs(85, 9, "Setting storeID with: " << urlNote );
1351  http->request->store_id = urlNote;
1352  http->store_id = urlNote;
1353  }
1354  }
1355  break;
1356  }
1357 
1358  http->doCallouts();
1359 }
1360 
1364 void
1366 {
1367  if (Config.accessList.noCache) {
1370  } else {
1371  /* unless otherwise specified, we try to cache. */
1373  }
1374 }
1375 
1376 static void
1378 {
1379  ClientRequestContext *calloutContext = (ClientRequestContext *) data;
1380 
1381  if (!calloutContext->httpStateIsValid())
1382  return;
1383 
1384  calloutContext->checkNoCacheDone(answer);
1385 }
1386 
1387 void
1389 {
1390  acl_checklist = NULL;
1391  if (answer.denied()) {
1392  http->request->flags.noCache = true; // do not read reply from cache
1393  http->request->flags.cachable = false; // do not store reply into cache
1394  }
1395  http->doCallouts();
1396 }
1397 
1398 #if USE_OPENSSL
1399 bool
1401 {
1402  if (!http->getConn()) {
1403  http->al->ssl.bumpMode = Ssl::bumpEnd; // SslBump does not apply; log -
1404  return false;
1405  }
1406 
1408  if (http->request->flags.forceTunnel) {
1409  debugs(85, 5, "not needed; already decided to tunnel " << http->getConn());
1410  if (bumpMode != Ssl::bumpEnd)
1411  http->al->ssl.bumpMode = bumpMode; // inherited from bumped connection
1412  return false;
1413  }
1414 
1415  // If SSL connection tunneling or bumping decision has been made, obey it.
1416  if (bumpMode != Ssl::bumpEnd) {
1417  debugs(85, 5, HERE << "SslBump already decided (" << bumpMode <<
1418  "), " << "ignoring ssl_bump for " << http->getConn());
1419 
1420  // We need the following "if" for transparently bumped TLS connection,
1421  // because in this case we are running ssl_bump access list before
1422  // the doCallouts runs. It can be removed after the bug #4340 fixed.
1423  // We do not want to proceed to bumping steps:
1424  // - if the TLS connection with the client is already established
1425  // because we are accepting normal HTTP requests on TLS port,
1426  // or because of the client-first bumping mode
1427  // - When the bumping is already started
1428  if (!http->getConn()->switchedToHttps() &&
1429  !http->getConn()->serverBump())
1430  http->sslBumpNeed(bumpMode); // for processRequest() to bump if needed and not already bumped
1431  http->al->ssl.bumpMode = bumpMode; // inherited from bumped connection
1432  return false;
1433  }
1434 
1435  // If we have not decided yet, decide whether to bump now.
1436 
1437  // Bumping here can only start with a CONNECT request on a bumping port
1438  // (bumping of intercepted SSL conns is decided before we get 1st request).
1439  // We also do not bump redirected CONNECT requests.
1442  !http->getConn()->port->flags.tunnelSslBumping) {
1443  http->al->ssl.bumpMode = Ssl::bumpEnd; // SslBump does not apply; log -
1444  debugs(85, 5, HERE << "cannot SslBump this request");
1445  return false;
1446  }
1447 
1448  // Do not bump during authentication: clients would not proxy-authenticate
1449  // if we delay a 407 response and respond with 200 OK to CONNECT.
1451  http->al->ssl.bumpMode = Ssl::bumpEnd; // SslBump does not apply; log -
1452  debugs(85, 5, HERE << "no SslBump during proxy authentication");
1453  return false;
1454  }
1455 
1456  if (error) {
1457  debugs(85, 5, "SslBump applies. Force bump action on error " << errorTypeName(error->type));
1460  return false;
1461  }
1462 
1463  debugs(85, 5, HERE << "SslBump possible, checking ACL");
1464 
1466  aclChecklist->nonBlockingCheck(sslBumpAccessCheckDoneWrapper, this);
1467  return true;
1468 }
1469 
1474 static void
1476 {
1477  ClientRequestContext *calloutContext = static_cast<ClientRequestContext *>(data);
1478 
1479  if (!calloutContext->httpStateIsValid())
1480  return;
1481  calloutContext->sslBumpAccessCheckDone(answer);
1482 }
1483 
1484 void
1486 {
1487  if (!httpStateIsValid())
1488  return;
1489 
1490  const Ssl::BumpMode bumpMode = answer.allowed() ?
1491  static_cast<Ssl::BumpMode>(answer.kind) : Ssl::bumpSplice;
1492  http->sslBumpNeed(bumpMode); // for processRequest() to bump if needed
1493  http->al->ssl.bumpMode = bumpMode; // for logging
1494 
1495  if (bumpMode == Ssl::bumpTerminate) {
1496  const Comm::ConnectionPointer clientConn = http->getConn() ? http->getConn()->clientConnection : nullptr;
1497  if (Comm::IsConnOpen(clientConn)) {
1498  debugs(85, 3, "closing after Ssl::bumpTerminate ");
1499  clientConn->close();
1500  }
1501  return;
1502  }
1503 
1504  http->doCallouts();
1505 }
1506 #endif
1507 
1508 /*
1509  * Identify requests that do not go through the store and client side stream
1510  * and forward them to the appropriate location. All other requests, request
1511  * them.
1512  */
1513 void
1515 {
1516  debugs(85, 4, request->method << ' ' << uri);
1517 
1518  const bool untouchedConnect = request->method == Http::METHOD_CONNECT && !redirect.status;
1519 
1520 #if USE_OPENSSL
1521  if (untouchedConnect && sslBumpNeeded()) {
1523  sslBumpStart();
1524  return;
1525  }
1526 #endif
1527 
1528  if (untouchedConnect || request->flags.forceTunnel) {
1529  getConn()->stopReading(); // tunnels read for themselves
1530  tunnelStart(this);
1531  return;
1532  }
1533 
1534  httpStart();
1535 }
1536 
1537 void
1539 {
1541  // XXX: Re-initializes rather than updates. Should not be needed at all.
1543  debugs(85, 4, logType.c_str() << " for '" << uri << "'");
1544 
1545  /* no one should have touched this */
1546  assert(out.offset == 0);
1547  /* Use the Stream Luke */
1549  clientStreamRead(node, this, node->readBuffer);
1551 }
1552 
1553 #if USE_OPENSSL
1554 
1555 void
1557 {
1558  debugs(83, 3, HERE << "sslBump required: "<< Ssl::bumpMode(mode));
1559  sslBumpNeed_ = mode;
1560 }
1561 
1562 // called when comm_write has completed
1563 static void
1564 SslBumpEstablish(const Comm::ConnectionPointer &, char *, size_t, Comm::Flag errflag, int, void *data)
1565 {
1566  ClientHttpRequest *r = static_cast<ClientHttpRequest*>(data);
1567  debugs(85, 5, HERE << "responded to CONNECT: " << r << " ? " << errflag);
1568 
1569  assert(r && cbdataReferenceValid(r));
1570  r->sslBumpEstablish(errflag);
1571 }
1572 
1573 void
1575 {
1576  // Bail out quickly on Comm::ERR_CLOSING - close handlers will tidy up
1577  if (errflag == Comm::ERR_CLOSING)
1578  return;
1579 
1580  if (errflag) {
1581  debugs(85, 3, HERE << "CONNECT response failure in SslBump: " << errflag);
1583  return;
1584  }
1585 
1586 #if USE_AUTH
1587  // Preserve authentication info for the ssl-bumped request
1588  if (request->auth_user_request != NULL)
1589  getConn()->setAuth(request->auth_user_request, "SSL-bumped CONNECT");
1590 #endif
1591 
1592  assert(sslBumpNeeded());
1594 }
1595 
1596 void
1598 {
1599  debugs(85, 5, HERE << "Confirming " << Ssl::bumpMode(sslBumpNeed_) <<
1600  "-bumped CONNECT tunnel on FD " << getConn()->clientConnection);
1602 
1603  AsyncCall::Pointer bumpCall = commCbCall(85, 5, "ClientSocketContext::sslBumpEstablish",
1605 
1607  CommIoCbParams &params = GetCommParams<CommIoCbParams>(bumpCall);
1608  params.flag = Comm::OK;
1609  params.conn = getConn()->clientConnection;
1610  ScheduleCallHere(bumpCall);
1611  return;
1612  }
1613 
1615 
1616  const auto mb = al->reply->pack();
1617  // send an HTTP 200 response to kick client SSL negotiation
1618  // TODO: Unify with tunnel.cc and add a Server(?) header
1619  Comm::Write(getConn()->clientConnection, mb, bumpCall);
1620  delete mb;
1621 }
1622 
1623 #endif
1624 
1625 bool
1627 {
1628  // TODO: See also (and unify with) clientReplyContext::storeNotOKTransferDone()
1629  int64_t contentLength =
1631  assert(contentLength >= 0);
1632 
1633  if (out.offset < contentLength)
1634  return false;
1635 
1636  return true;
1637 }
1638 
1639 void
1641 {
1642  entry_ = newEntry;
1643 }
1644 
1645 void
1647 {
1648  if (loggingEntry_)
1649  loggingEntry_->unlock("ClientHttpRequest::loggingEntry");
1650 
1651  loggingEntry_ = newEntry;
1652 
1653  if (loggingEntry_)
1654  loggingEntry_->lock("ClientHttpRequest::loggingEntry");
1655 }
1656 
1657 void
1659 {
1660  assignRequest(aRequest);
1661  if (const auto csd = getConn()) {
1662  if (!csd->notes()->empty())
1663  request->notes()->appendNewOnly(csd->notes().getRaw());
1664  }
1665  // al is created in the constructor
1666  assert(al);
1667  if (!al->request) {
1668  al->request = request;
1670  al->syncNotes(request);
1671  }
1672 }
1673 
1674 void
1676 {
1677  assert(request != newRequest);
1678  clearRequest();
1679  assignRequest(newRequest);
1680  xfree(uri);
1682 }
1683 
1684 void
1686 {
1687  assert(newRequest);
1688  assert(!request);
1689  const_cast<HttpRequest *&>(request) = newRequest;
1692 }
1693 
1694 void
1696 {
1697  HttpRequest *oldRequest = request;
1698  HTTPMSGUNLOCK(oldRequest);
1699  const_cast<HttpRequest *&>(request) = nullptr;
1700  absorbLogUri(nullptr);
1701 }
1702 
1703 /*
1704  * doCallouts() - This function controls the order of "callout"
1705  * executions, including non-blocking access control checks, the
1706  * redirector, and ICAP. Previously, these callouts were chained
1707  * together such that "clientAccessCheckDone()" would call
1708  * "clientRedirectStart()" and so on.
1709  *
1710  * The ClientRequestContext (aka calloutContext) class holds certain
1711  * state data for the callout/callback operations. Previously
1712  * ClientHttpRequest would sort of hand off control to ClientRequestContext
1713  * for a short time. ClientRequestContext would then delete itself
1714  * and pass control back to ClientHttpRequest when all callouts
1715  * were finished.
1716  *
1717  * This caused some problems for ICAP because we want to make the
1718  * ICAP callout after checking ACLs, but before checking the no_cache
1719  * list. We can't stuff the ICAP state into the ClientRequestContext
1720  * class because we still need the ICAP state after ClientRequestContext
1721  * goes away.
1722  *
1723  * Note that ClientRequestContext is created before the first call
1724  * to doCallouts().
1725  *
1726  * If one of the callouts notices that ClientHttpRequest is no
1727  * longer valid, it should call cbdataReferenceDone() so that
1728  * ClientHttpRequest's reference count goes to zero and it will get
1729  * deleted. ClientHttpRequest will then delete ClientRequestContext.
1730  *
1731  * Note that we set the _done flags here before actually starting
1732  * the callout. This is strictly for convenience.
1733  */
1734 
1737 
1738 void
1740 {
1742 
1743  if (!calloutContext->error) {
1744  // CVE-2009-0801: verify the Host: header is consistent with other known details.
1746  debugs(83, 3, HERE << "Doing calloutContext->hostHeaderVerify()");
1749  return;
1750  }
1751 
1753  debugs(83, 3, HERE << "Doing calloutContext->clientAccessCheck()");
1756  return;
1757  }
1758 
1759 #if USE_ADAPTATION
1764  request, NULL, calloutContext->http->al, this))
1765  return; // will call callback
1766  }
1767 #endif
1768 
1769  if (!calloutContext->redirect_done) {
1770  calloutContext->redirect_done = true;
1771 
1772  if (Config.Program.redirect) {
1773  debugs(83, 3, HERE << "Doing calloutContext->clientRedirectStart()");
1776  return;
1777  }
1778  }
1779 
1781  debugs(83, 3, HERE << "Doing calloutContext->clientAccessCheck2()");
1784  return;
1785  }
1786 
1787  if (!calloutContext->store_id_done) {
1788  calloutContext->store_id_done = true;
1789 
1790  if (Config.Program.store_id) {
1791  debugs(83, 3,"Doing calloutContext->clientStoreIdStart()");
1794  return;
1795  }
1796  }
1797 
1799  debugs(83, 3, HERE << "Doing clientInterpretRequestHeaders()");
1802  }
1803 
1804  if (!calloutContext->no_cache_done) {
1805  calloutContext->no_cache_done = true;
1806 
1808  debugs(83, 3, HERE << "Doing calloutContext->checkNoCache()");
1810  return;
1811  }
1812  }
1813  } // if !calloutContext->error
1814 
1815  // Set appropriate MARKs and CONNMARKs if needed.
1817  ACLFilledChecklist ch(nullptr, request, nullptr);
1818  ch.al = calloutContext->http->al;
1820  ch.my_addr = request->my_addr;
1821  ch.syncAle(request, log_uri);
1822 
1825  tos_t tos = aclMapTOS(Ip::Qos::TheConfig.tosToClient, &ch);
1826  if (tos)
1828 
1829  const auto packetMark = aclFindNfMarkConfig(Ip::Qos::TheConfig.nfmarkToClient, &ch);
1830  if (!packetMark.isEmpty())
1831  Ip::Qos::setSockNfmark(getConn()->clientConnection, packetMark.mark);
1832 
1833  const auto connmark = aclFindNfMarkConfig(Ip::Qos::TheConfig.nfConnmarkToClient, &ch);
1834  if (!connmark.isEmpty())
1836  }
1837  }
1838 
1839 #if USE_OPENSSL
1840  // Even with calloutContext->error, we call sslBumpAccessCheck() to decide
1841  // whether SslBump applies to this transaction. If it applies, we will
1842  // attempt to bump the client to serve the error.
1846  return;
1847  /* else no ssl bump required*/
1848  }
1849 #endif
1850 
1851  if (calloutContext->error) {
1852  // XXX: prformance regression. c_str() reallocates
1853  SBuf storeUriBuf(request->storeId());
1854  const char *storeUri = storeUriBuf.c_str();
1855  StoreEntry *e = storeCreateEntry(storeUri, storeUri, request->flags, request->method);
1856 #if USE_OPENSSL
1857  if (sslBumpNeeded()) {
1858  // We have to serve an error, so bump the client first.
1860  // set final error but delay sending until we bump
1861  Ssl::ServerBump *srvBump = new Ssl::ServerBump(this, e, Ssl::bumpClientFirst);
1864  getConn()->setServerBump(srvBump);
1865  e->unlock("ClientHttpRequest::doCallouts+sslBumpNeeded");
1866  } else
1867 #endif
1868  {
1869  // send the error to the client now
1871  clientReplyContext *repContext = dynamic_cast<clientReplyContext *>(node->data.getRaw());
1872  assert (repContext);
1873  repContext->setReplyToStoreEntry(e, "immediate SslBump error");
1877  getConn()->flags.readMore = true; // resume any pipeline reads.
1879  clientStreamRead(node, this, node->readBuffer);
1880  e->unlock("ClientHttpRequest::doCallouts-sslBumpNeeded");
1881  return;
1882  }
1883  }
1884 
1886  delete calloutContext;
1887  calloutContext = NULL;
1888 #if HEADERS_LOG
1889 
1890  headersLog(0, 1, request->method, request);
1891 #endif
1892 
1893  debugs(83, 3, HERE << "calling processRequest()");
1894  processRequest();
1895 
1896 #if ICAP_CLIENT
1898  if (ih != NULL)
1899  ih->logType = logType;
1900 #endif
1901 }
1902 
1903 void
1905 {
1906  assert(request);
1907  const auto canonicalUri = request->canonicalCleanUrl();
1908  absorbLogUri(xstrndup(canonicalUri, MAX_URL));
1909 }
1910 
1911 void
1913 {
1914  assert(rawUri);
1915  // Should(!request);
1916 
1917  // TODO: SBuf() performance regression, fix by converting rawUri to SBuf
1918  char *canonicalUri = urlCanonicalCleanWithoutRequest(SBuf(rawUri), method, AnyP::UriScheme());
1919 
1920  absorbLogUri(AnyP::Uri::cleanup(canonicalUri));
1921 
1922  char *cleanedRawUri = AnyP::Uri::cleanup(rawUri);
1923  al->setVirginUrlForMissingRequest(SBuf(cleanedRawUri));
1924  xfree(cleanedRawUri);
1925 }
1926 
1927 void
1929 {
1930  xfree(log_uri);
1931  const_cast<char *&>(log_uri) = aUri;
1932 }
1933 
1934 void
1936 {
1937  assert(!uri);
1938  assert(aUri);
1939  // Should(!request);
1940 
1941  uri = xstrdup(aUri);
1942  // TODO: SBuf() performance regression, fix by converting setErrorUri() parameter to SBuf
1943  const SBuf errorUri(aUri);
1944  const auto canonicalUri = urlCanonicalCleanWithoutRequest(errorUri, HttpRequestMethod(), AnyP::UriScheme());
1945  absorbLogUri(xstrndup(canonicalUri, MAX_URL));
1946 
1947  al->setVirginUrlForMissingRequest(errorUri);
1948 }
1949 
1950 #if USE_ADAPTATION
1951 void
1954 {
1955  debugs(85, 3, HERE << "adaptation needed for " << this);
1959  new Adaptation::Iterator(request, NULL, al, g));
1960 
1961  // we could try to guess whether we can bypass this adaptation
1962  // initiation failure, but it should not really happen
1964 }
1965 
1966 void
1968 {
1969  assert(cbdataReferenceValid(this)); // indicates bug
1972 
1973  switch (answer.kind) {
1975  handleAdaptedHeader(const_cast<Http::Message*>(answer.message.getRaw()));
1976  break;
1977 
1979  handleAdaptationBlock(answer);
1980  break;
1981 
1984  break;
1985  }
1986 }
1987 
1988 void
1990 {
1991  assert(msg);
1992 
1993  if (HttpRequest *new_req = dynamic_cast<HttpRequest*>(msg)) {
1994  // update the new message to flag whether URL re-writing was done on it
1995  if (request->effectiveRequestUri() != new_req->effectiveRequestUri())
1996  new_req->flags.redirected = true;
1997  resetRequest(new_req);
1998  assert(request->method.id());
1999  } else if (HttpReply *new_rep = dynamic_cast<HttpReply*>(msg)) {
2000  debugs(85,3,HERE << "REQMOD reply is HTTP reply");
2001 
2002  // subscribe to receive reply body
2003  if (new_rep->body_pipe != NULL) {
2004  adaptedBodySource = new_rep->body_pipe;
2005  int consumer_ok = adaptedBodySource->setConsumerIfNotLate(this);
2006  assert(consumer_ok);
2007  }
2008 
2010  clientReplyContext *repContext = dynamic_cast<clientReplyContext *>(node->data.getRaw());
2011  assert(repContext);
2012  repContext->createStoreEntry(request->method, request->flags);
2013 
2016  storeEntry()->replaceHttpReply(new_rep);
2018 
2019  al->reply = new_rep;
2020 
2021  if (!adaptedBodySource) // no body
2022  storeEntry()->complete();
2023  clientGetMoreData(node, this);
2024  }
2025 
2026  // we are done with getting headers (but may be receiving body)
2028 
2030  doCallouts();
2031 }
2032 
2033 void
2035 {
2037  AclMatchedName = answer.ruleId.termedBuf();
2040  AclMatchedName = NULL;
2041 }
2042 
2043 void
2045 {
2046  if (!adaptedBodySource)
2047  return;
2048 
2050 }
2051 
2052 void
2054 {
2057 
2058  if (size_t contentSize = adaptedBodySource->buf().contentSize()) {
2059  const size_t spaceAvailable = storeEntry()->bytesWanted(Range<size_t>(0,contentSize));
2060 
2061  if (spaceAvailable < contentSize ) {
2062  // No or partial body data consuming
2063  typedef NullaryMemFunT<ClientHttpRequest> Dialer;
2064  AsyncCall::Pointer call = asyncCall(93, 5, "ClientHttpRequest::resumeBodyStorage",
2065  Dialer(this, &ClientHttpRequest::resumeBodyStorage));
2066  storeEntry()->deferProducer(call);
2067  }
2068 
2069  if (!spaceAvailable)
2070  return;
2071 
2072  if (spaceAvailable < contentSize )
2073  contentSize = spaceAvailable;
2074 
2076  const StoreIOBuffer ioBuf(&bpc.buf, request_satisfaction_offset, contentSize);
2077  storeEntry()->write(ioBuf);
2078  // assume StoreEntry::write() writes the entire ioBuf
2080  bpc.buf.consume(contentSize);
2081  bpc.checkIn();
2082  }
2083 
2086  // else wait for more body data
2087 }
2088 
2089 void
2091 {
2093  // should we end request satisfaction now?
2096 }
2097 
2098 void
2100 {
2101  debugs(85,4, HERE << this << " ends request satisfaction");
2104 
2105  // TODO: anything else needed to end store entry formation correctly?
2106  storeEntry()->complete();
2107 }
2108 
2109 void
2111 {
2114 
2115  debugs(85,3, HERE << "REQMOD body production failed");
2116  if (request_satisfaction_mode) { // too late to recover or serve an error
2119  Must(Comm::IsConnOpen(c));
2120  c->close(); // drastic, but we may be writing a response already
2121  } else {
2123  }
2124 }
2125 
2126 void
2127 ClientHttpRequest::handleAdaptationFailure(int errDetail, bool bypassable)
2128 {
2129  debugs(85,3, HERE << "handleAdaptationFailure(" << bypassable << ")");
2130 
2131  const bool usedStore = storeEntry() && !storeEntry()->isEmpty();
2132  const bool usedPipe = request->body_pipe != NULL &&
2133  request->body_pipe->consumedSize() > 0;
2134 
2135  if (bypassable && !usedStore && !usedPipe) {
2136  debugs(85,3, HERE << "ICAP REQMOD callout failed, bypassing: " << calloutContext);
2137  if (calloutContext)
2138  doCallouts();
2139  return;
2140  }
2141 
2142  debugs(85,3, HERE << "ICAP REQMOD callout failed, responding with error");
2143 
2145  clientReplyContext *repContext = dynamic_cast<clientReplyContext *>(node->data.getRaw());
2146  assert(repContext);
2147 
2148  calloutsError(ERR_ICAP_FAILURE, errDetail);
2149 
2150  if (calloutContext)
2151  doCallouts();
2152 }
2153 
2154 void
2155 ClientHttpRequest::callException(const std::exception &ex)
2156 {
2157  if (const auto clientConn = getConn() ? getConn()->clientConnection : nullptr) {
2158  if (Comm::IsConnOpen(clientConn)) {
2159  debugs(85, 3, "closing after exception: " << ex.what());
2160  clientConn->close(); // initiate orderly top-to-bottom cleanup
2161  return;
2162  }
2163  }
2164  debugs(85, DBG_IMPORTANT, "ClientHttpRequest exception without connection. Ignoring " << ex.what());
2165  // XXX: Normally, we mustStop() but we cannot do that here because it is
2166  // likely to leave Http::Stream and ConnStateData with a dangling http
2167  // pointer. See r13480 or XXX in Http::Stream class description.
2168 }
2169 #endif
2170 
2171 // XXX: modify and use with ClientRequestContext::clientAccessCheckDone too.
2172 void
2174 {
2175  // The original author of the code also wanted to pass an errno to
2176  // setReplyToError, but it seems unlikely that the errno reflects the
2177  // true cause of the error at this point, so I did not pass it.
2178  if (calloutContext) {
2179  Ip::Address noAddr;
2180  noAddr.setNoAddr();
2181  ConnStateData * c = getConn();
2183  NULL,
2184  c != NULL ? c->clientConnection->remote : noAddr,
2185  request,
2186  al
2187  );
2188 #if USE_AUTH
2190  c != NULL && c->getAuth() != NULL ? c->getAuth() : request->auth_user_request;
2191 #endif
2192  calloutContext->error->detailError(errDetail);
2194  if (c != NULL)
2195  c->expectNoForwarding();
2196  }
2197  //else if(calloutContext == NULL) is it possible?
2198 }
2199 
const MemBuf & buf() const
Definition: BodyPipe.h:137
static char * cleanup(const char *uri)
Definition: Uri.cc:926
Definition: parse.c:104
void appendNewOnly(const NotePairs *src)
Definition: Notes.cc:381
char method[16]
Definition: tcp-banger2.c:115
void absorbLogUri(char *aUri)
assigns log_uri with aUri without copying the entire C-string
@ METHOD_OTHER
Definition: MethodType.h:95
void resetRequest(HttpRequest *)
void * xcalloc(size_t n, size_t sz)
Definition: xalloc.cc:72
@ ERR_ICAP_FAILURE
Definition: err_type.h:62
const char * errorTypeName(err_type err)
Definition: err_type.h:102
HttpHdrRange * getRange() const
Definition: HttpHeader.cc:1268
void fvdbCountVia(const char *key)
static HLPCB clientRedirectDoneWrapper
bool initiated(const CbcPointer< AsyncJob > &job) const
Must(initiated(initiate)) instead of Must(initiate.set()), for clarity.
Definition: Initiator.h:52
AnyP::ProtocolVersion http_ver
Definition: Message.h:73
void assignRequest(HttpRequest *aRequest)
@ scUnauthorized
Definition: StatusCode.h:45
@ METHOD_HEAD
Definition: MethodType.h:28
const char * rawBuf() const
Definition: SquidString.h:85
void port(unsigned short p)
Definition: Uri.h:94
AnyP::Uri url
the request URI
Definition: HttpRequest.h:115
common parts of HttpRequest and HttpReply
Definition: Message.h:25
bool interceptTproxy
Set for requests handled by a "tproxy" port.
Definition: RequestFlags.h:66
void setServerBump(Ssl::ServerBump *srvBump)
Definition: client_side.h:268
BodyPipe::Pointer body_pipe
optional pipeline to receive message body
Definition: Message.h:98
char * canonicalCleanUrl() const
Definition: HttpRequest.cc:775
const char * findFirst(const char *noteKey) const
Definition: Notes.cc:297
Definition: Uri.h:30
virtual void noteAdaptationAnswer(const Adaptation::Answer &answer)
Ip::Address src_addr
ACLFilledChecklist * clientAclChecklistCreate(const acl_access *acl, ClientHttpRequest *http)
int setSockNfmark(const Comm::ConnectionPointer &conn, nfmark_t mark)
Definition: QosConfig.cc:586
const char * getStr(Http::HdrType id) const
Definition: HttpHeader.cc:1208
@ Error
Definition: ResultCode.h:19
@ ERR_DETAIL_REQMOD_BLOCK
void setAuth(const Auth::UserRequest::Pointer &aur, const char *cause)
Definition: client_side.cc:510
struct ClientHttpRequest::Redirect redirect
void fd_note(int fd, const char *s)
Definition: fd.cc:246
HttpHeader header
Definition: Message.h:75
LogTags logType
the processing tags associated with this request transaction.
int hasListMember(Http::HdrType id, const char *member, const char separator) const
Definition: HttpHeader.cc:1709
void errorAppendEntry(StoreEntry *entry, ErrorState *err)
Definition: errorpage.cc:711
#define FAILURE_MODE_TIME
void initRequest(HttpRequest *)
const ProxyProtocol::HeaderPointer & proxyProtocolHeader() const
Definition: client_side.h:342
RequestFlags flags
Definition: HttpRequest.h:141
@ Unknown
Definition: ResultCode.h:17
HttpHdrRange::iterator pos
int aclIsProxyAuth(const char *name)
Definition: Gadgets.cc:72
ssize_t HttpHeaderPos
Definition: HttpHeader.h:45
void clientStreamRead(clientStreamNode *thisObject, ClientHttpRequest *http, StoreIOBuffer readBuffer)
@ ERR_CACHE_ACCESS_DENIED
Definition: err_type.h:17
bool final
whether the error, if any, cannot be bypassed
Definition: Answer.h:41
ConnStateData * getConn() const
String x_forwarded_for_iterator
Definition: HttpRequest.h:188
void setErrorUri(const char *errorUri)
unsigned short icp
Definition: SquidConfig.h:138
struct ConnStateData::@39 flags
acl_access * noCache
Definition: SquidConfig.h:370
@ ERR_NONE
Definition: err_type.h:13
static void clientAccessCheckDoneWrapper(Acl::Answer, void *)
#define HttpHeaderInitPos
Definition: HttpHeader.h:48
acl_access * adapted_http
Definition: SquidConfig.h:364
bool readNextRequest
whether Squid should read after error handling
#define ScheduleCallHere(call)
Definition: AsyncCall.h:166
void lock(const char *context)
Definition: store.cc:459
int hostStrictVerify
Definition: SquidConfig.h:343
void tunnelStart(ClientHttpRequest *)
Definition: tunnel.cc:1106
void error(char *format,...)
struct SquidConfig::@113 accessList
Ip::Address log_addr
Definition: client_side.h:129
bool sslBumpNeeded() const
returns true if and only if the request needs to be bumped
HttpReplyPointer reply
int64_t bodySize(const HttpRequestMethod &) const
Definition: HttpReply.cc:375
bool parse(const HttpRequestMethod &, const SBuf &url)
Definition: Uri.cc:253
void httpRequestFree(void *data)
Definition: client_side.cc:495
Comm::ConnectionPointer serverConnection
Definition: client_side.h:136
Definition: SBuf.h:86
BumpMode
Definition: support.h:136
ErrorState * error
saved error page for centralized/delayed processing
void SBufToCstring(char *d, const SBuf &s)
Definition: SBuf.h:741
void httpRequestPack(void *obj, Packable *p)
Definition: HttpRequest.cc:364
void setVirginUrlForMissingRequest(const SBuf &vu)
Remember Client URI (or equivalent) when there is no HttpRequest.
@ scMovedPermanently
Definition: StatusCode.h:37
#define xstrdup
Ip::NfMarkConfig aclFindNfMarkConfig(acl_nfmark *head, ACLChecklist *ch)
Checks for a netfilter mark value to apply depending on the ACL.
Definition: FwdState.cc:1429
double request_failure_ratio
bool hostVerified
Definition: RequestFlags.h:64
bool maybeCacheable()
Definition: HttpRequest.cc:556
@ bumpTerminate
Definition: support.h:136
struct ClientHttpRequest::Flags flags
bool have(const Ip::Address &ip, size_t *position=nullptr) const
Definition: ipcache.cc:972
#define REDIRECT_DONE
Definition: defines.h:89
class AccessLogEntry::SslDetails ssl
String getList(Http::HdrType id) const
Definition: HttpHeader.cc:858
bool hierarchical
Definition: RequestFlags.h:34
static int clientHierarchical(ClientHttpRequest *http)
clientStream_status_t CSS(clientStreamNode *, ClientHttpRequest *)
@ bumpEnd
Definition: support.h:136
ErrorState * clientBuildError(err_type, Http::StatusCode, char const *url, Ip::Address &, HttpRequest *, const AccessLogEntry::Pointer &)
Auth::UserRequest::Pointer auth_user_request
Definition: HttpRequest.h:127
void hostHeaderIpVerify(const ipcache_addrs *ia, const Dns::LookupDetails &dns)
HierarchyLogEntry hier
int content_length
Definition: tcp-banger2.c:121
struct ClientHttpRequest::Out out
C * getRaw() const
Definition: RefCount.h:80
double const StatHist & B
unsigned char tos_t
Definition: forward.h:26
int cbdataReferenceValid(const void *p)
Definition: cbdata.cc:412
struct timeval start_time
The time the master transaction started.
static void clientFollowXForwardedForCheck(Acl::Answer answer, void *data)
AccessLogEntry::Pointer al
info for the future access.log, and external ACL
bool IsConnOpen(const Comm::ConnectionPointer &conn)
Definition: Connection.cc:26
@ OK
Definition: Flag.h:16
const char * sslGetUserEmail(SSL *ssl)
Definition: support.cc:734
#define REDIRECT_PENDING
Definition: defines.h:88
void HTTPMSGUNLOCK(M *&a)
Definition: Message.h:149
@ ERR_SECURE_CONNECT_FAIL
Definition: err_type.h:29
void detailError(err_type aType, int aDetail)
sets error detail if no earlier detail was available
Definition: HttpRequest.cc:468
void replaceHttpReply(const HttpReplyPointer &, const bool andStartWriting=true)
Definition: store.cc:1782
#define DBG_CRITICAL
Definition: Debug.h:45
StatusCode
Definition: StatusCode.h:20
ClientRequestContext(ClientHttpRequest *)
int matchDomainName(const char *h, const char *d, MatchDomainNameFlags flags)
Definition: Uri.cc:744
@ akForward
forward the supplied adapted HTTP message
Definition: Answer.h:27
@ ERR_CLOSING
Definition: Flag.h:25
time_t hit_only_mode_until
CbcPointer< Initiate > initiateAdaptation(Initiate *x)
< starts freshly created initiate and returns a safe pointer to it
Definition: Initiator.cc:23
#define cbdataReference(var)
Definition: cbdata.h:341
bool setConsumerIfNotLate(const Consumer::Pointer &aConsumer)
Definition: BodyPipe.cc:228
#define PROF_stop(probename)
Definition: Profiler.h:63
@ IF_MODIFIED_SINCE
#define DBG_IMPORTANT
Definition: Debug.h:46
void handleAdaptedHeader(Http::Message *msg)
AclDenyInfoList * denyInfoList
Definition: SquidConfig.h:412
static int port
Definition: ldap_backend.cc:69
@ ERR_DETAIL_CLT_REQMOD_ABORT
@ scSeeOther
Definition: StatusCode.h:39
void setConn(ConnStateData *aConn)
bool exhausted() const
Definition: BodyPipe.cc:174
const char * c_str() const
compute the status access.log field
Definition: LogTags.cc:56
virtual void callException(const std::exception &ex)
called when the job throws during an async call
static void hostHeaderIpVerifyWrapper(const ipcache_addrs *ia, const Dns::LookupDetails &dns, void *data)
ClientHttpRequest * http
HttpHdrRangeIter range_iter
SQUIDCEXTERN CSD clientReplyDetach
bool readMore
needs comm_read (for this request or new requests)
Definition: client_side.h:132
static void Reset()
forgets the current context, setting it to nil/unknown
Definition: CodeContext.cc:75
Definition: Range.h:18
@ ERR_CONFLICT_HOST
Definition: err_type.h:46
int acl_uses_indirect_client
Definition: SquidConfig.h:332
virtual HttpRequest * clone() const
Definition: HttpRequest.cc:177
#define MAX_URL
Definition: defines.h:118
void handleAdaptationFailure(int errDetail, bool bypassable=false)
void syncNotes(HttpRequest *request)
HttpRequest * request
MemBuf & buf
Definition: BodyPipe.h:74
SQUIDCEXTERN CSS clientReplyStatus
@ ACCESS_AUTH_REQUIRED
Definition: Acl.h:108
virtual void noteBodyProductionEnded(BodyPipe::Pointer)
const char * AclMatchedName
Definition: Acl.cc:30
void update(const LogTags_ot t)
Definition: LogTags.cc:44
Http::MethodType id() const
Definition: RequestMethod.h:76
void clientStoreIdDone(const Helper::Reply &reply)
static void checkFailureRatio(err_type, hier_code)
mb_size_t contentSize() const
available data size
Definition: MemBuf.h:47
void setLogUriToRawUri(const char *rawUri, const HttpRequestMethod &)
void clearRequest()
resets the current request and log_uri to nil
@ scTemporaryRedirect
Definition: StatusCode.h:42
char rfc931[USER_IDENT_SZ]
Definition: Connection.h:186
void(* ObjPackMethod)(void *obj, Packable *p)
Definition: tools.h:33
#define NULL
Definition: types.h:166
void CSD(clientStreamNode *, ClientHttpRequest *)
client stream detach
void CSR(clientStreamNode *, ClientHttpRequest *)
client stream read
@ scForbidden
Definition: StatusCode.h:47
Ssl::BumpMode sslBumpMode
ssl_bump decision (Ssl::bumpEnd if n/a).
Definition: client_side.h:286
err_type aclGetDenyInfoPage(AclDenyInfoList **head, const char *name, int redirect_allowed)
Definition: Gadgets.cc:41
#define debugs(SECTION, LEVEL, CONTENT)
Definition: Debug.h:128
char ThisCache2[RFC2181_MAXHOSTNAMELEN<< 1]
void stopConsumingFrom(RefCount< BodyPipe > &)
Definition: BodyPipe.cc:118
@ HIER_NONE
Definition: hier_code.h:13
const HttpReply & baseReply() const
Definition: MemObject.h:59
void setNoAddr()
Definition: Address.cc:292
iterates services in ServiceGroup, starting adaptation launchers
Definition: Iterator.h:31
wordlist * store_id
Definition: SquidConfig.h:198
acl_access * http
Definition: SquidConfig.h:363
@ ERR_DETAIL_CLT_REQMOD_RESP_BODY
Helper::ResultCode result
The helper response 'result' field.
Definition: Reply.h:59
void recordLookup(const Dns::LookupDetails &detail)
Definition: HttpRequest.cc:605
struct SquidConfig::UrlHelperTimeout onUrlRewriteTimeout
err_type type
Definition: errorpage.h:171
static uint32 A
Definition: md4.c:43
Ip::Address indirect_client_addr
Definition: HttpRequest.h:152
ACLFilledChecklist * Filled(ACLChecklist *checklist)
convenience and safety wrapper for dynamic_cast<ACLFilledChecklist*>
@ LOG_TAG_NONE
Definition: LogTags.h:23
void handleAdaptationBlock(const Adaptation::Answer &answer)
MemBuf * pack() const
Definition: HttpReply.cc:111
void clearAdaptation(CbcPointer< Initiate > &x)
clears the pointer (does not call announceInitiatorAbort)
Definition: Initiator.cc:32
unsigned short port() const
Definition: Address.cc:778
#define SQUIDCEXTERN
Definition: squid.h:21
@ ERR_CONNECT_FAIL
Definition: err_type.h:28
err_type errType
Definition: HttpRequest.h:161
Ip::Address local
Definition: Connection.h:156
void ipcache_nbgethostbyname(const char *name, IPH *handler, void *handlerData)
Definition: ipcache.cc:598
void detailError(int dCode)
set error type-specific detail code
Definition: errorpage.h:112
@ ERR_DNS_FAIL
Definition: err_type.h:33
int gopherCachable(const HttpRequest *req)
Definition: gopher.cc:294
Comm::ConnectionPointer clientConnection
Definition: Xaction.cc:47
std::ostream & HERE(std::ostream &s)
Definition: Debug.h:157
acl_access * ssl_bump
Definition: SquidConfig.h:392
AccessLogEntry::Pointer al
access.log entry
int refresh_nocache_hack
NotePairs notes
Definition: Reply.h:62
Kind kind
the type of the answer
Definition: Answer.h:42
int delById(Http::HdrType id)
Definition: HttpHeader.cc:711
Http::HdrType id
Definition: HttpHeader.h:63
err_type
Definition: err_type.h:12
@ METHOD_CONNECT
Definition: MethodType.h:29
Comm::ConnectionPointer tcpClient
TCP/IP level details about the client connection.
void const char HLPCB void * data
Definition: stub_helper.cc:16
Adaptation::Icap::History::Pointer icapHistory() const
Returns possibly nil history, creating it if icap logging is enabled.
Definition: HttpRequest.cc:392
int unlock(const char *context)
Definition: store.cc:483
bool denied() const
Definition: Acl.h:149
Comm::ConnectionPointer conn
Definition: CommCalls.h:85
#define safe_free(x)
Definition: xalloc.h:73
time_t getTime(Http::HdrType id) const
Definition: HttpHeader.cc:1191
Ip::Address remote
Definition: Connection.h:159
@ scPermanentRedirect
Definition: StatusCode.h:43
struct SquidConfig::@104 Program
CommCbFunPtrCallT< Dialer > * commCbCall(int debugSection, int debugLevel, const char *callName, const Dialer &dialer)
Definition: CommCalls.h:342
bool hasOnlyIfCached() const
Definition: HttpHdrCc.h:145
int neighbors_do_private_keys
struct ConnStateData::@40 pinning
int conn
the current server connection FD
Definition: Transport.cc:26
#define assert(EX)
Definition: assert.h:19
@ Okay
Definition: ResultCode.h:18
static bool Start(Method method, VectPoint vp, HttpRequest *req, HttpReply *rep, AccessLogEntry::Pointer &al, Adaptation::Initiator *initiator)
Definition: AccessCheck.cc:30
bool intercepted
Definition: RequestFlags.h:62
HttpHdrCc * cache_control
Definition: Message.h:77
class AccessLogEntry::CacheDetails cache
void calloutsError(const err_type error, const int errDetail)
Build an error reply. For use with the callouts.
void clientAccessCheckDone(const Acl::Answer &answer)
bool switchedToHttps() const
Definition: client_side.h:266
virtual void syncAle(HttpRequest *adaptedRequest, const char *logUri) const
assigns uninitialized adapted_request and url ALE components
void HTTPMSGLOCK(Http::Message *a)
Definition: Message.h:160
Comm::Flag flag
comm layer result status.
Definition: CommCalls.h:87
void hostHeaderVerifyFailed(const char *A, const char *B)
encapsulates DNS lookup results
Definition: LookupDetails.h:20
@ ERR_READ_ERROR
Definition: err_type.h:26
const AnyP::UriScheme & getScheme() const
Definition: Uri.h:67
@ METHOD_TRACE
Definition: MethodType.h:30
ACLChecklist * acl_checklist
#define cbdataReferenceDone(var)
Definition: cbdata.h:350
@ toutActBypass
Definition: redirect.h:16
void write(StoreIOBuffer)
Definition: store.cc:824
Ip::Address my_addr
Definition: HttpRequest.h:155
@ PROTO_GOPHER
Definition: ProtocolType.h:30
@ scInternalServerError
Definition: StatusCode.h:71
const char * c_str()
Definition: SBuf.cc:526
void Write(const Comm::ConnectionPointer &conn, const char *buf, int size, AsyncCall::Pointer &callback, FREE *free_func)
Definition: Write.cc:35
int64_t strtoll(const char *nptr, char **endptr, int base)
Definition: strtoll.c:81
#define CBDATA_CLASS_INIT(type)
Definition: cbdata.h:318
time_t squid_curtime
Definition: stub_time.cc:17
Comm::ConnectionPointer clientConnection
Definition: Server.h:97
size_t bytesWanted(Range< size_t > const aRange, bool ignoreDelayPool=false) const
Definition: store.cc:249
char * xstrndup(const char *s, size_t n)
Definition: xstring.cc:56
StoreEntry * storeCreateEntry(const char *url, const char *logUrl, const RequestFlags &flags, const HttpRequestMethod &method)
Definition: store.cc:803
#define xfree
bool doneFollowXff() const
Definition: RequestFlags.h:119
struct SquidConfig::@112 onoff
ConnStateData * conn_
summarizes adaptation service answer for the noteAdaptationAnswer() API
Definition: Answer.h:22
Flag
Definition: Flag.h:15
Security::CertPointer sslClientCert
cert received from the client
int strListIsSubstr(const String *list, const char *s, char del)
Definition: StrList.cc:63
const char * denyMessage(char const *const default_message=NULL) const
Definition: UserRequest.cc:127
void sslBumpAccessCheckDone(const Acl::Answer &answer)
The callback function for ssl-bump access check list.
void stopReading()
cancels Comm::Read() if it is scheduled
Definition: Server.cc:56
@ PROTO_CACHE_OBJECT
Definition: ProtocolType.h:32
#define fd_table
Definition: fde.h:189
void fvdbCountForw(const char *key)
void complete()
Definition: store.cc:1078
void switchToHttps(ClientHttpRequest *, Ssl::BumpMode bumpServerMode)
@ ERR_DETAIL_CLT_REQMOD_REQ_BODY
virtual void noteAdaptationAclCheckDone(Adaptation::ServiceGroupPointer group)
void expectNoForwarding()
cleans up virgin request [body] forwarding state
const Auth::UserRequest::Pointer & getAuth() const
Definition: client_side.h:116
HttpHdrRange::iterator end
@ scFound
Definition: StatusCode.h:38
virtual void noteBodyProducerAborted(BodyPipe::Pointer)
Ssl::BumpMode sslBumpNeed_
whether (and how) the request needs to be bumped
ProxyProtocol::HeaderPointer proxyProtocolHeader
see ConnStateData::proxyProtocolHeader_
static void checkNoCacheDoneWrapper(Acl::Answer, void *)
@ pointPreCache
Definition: Elements.h:18
HttpRequestMethod method
Definition: HttpRequest.h:114
Config TheConfig
Globally available instance of Qos::Config.
Definition: QosConfig.cc:271
Http::MessagePointer message
HTTP request or response to forward.
Definition: Answer.h:39
#define REDIRECT_NONE
Definition: defines.h:87
@ ERR_GATEWAY_FAILURE
Definition: err_type.h:65
bool setNfConnmark(Comm::ConnectionPointer &conn, const ConnectionDirection connDir, const NfMarkConfig &cm)
@ PROTO_HTTP
Definition: ProtocolType.h:25
int log_uses_indirect_client
Definition: SquidConfig.h:334
const char * termedBuf() const
Definition: SquidString.h:91
struct timeval current_time
Definition: stub_time.cc:15
@ LOG_TCP_DENIED
Definition: LogTags.h:37
bool allowed() const
Definition: Acl.h:143
static void clientRedirectAccessCheckDone(Acl::Answer answer, void *data)
a netfilter mark/mask pair
Definition: NfMarkConfig.h:20
wordlist * redirect
Definition: SquidConfig.h:197
void resumeBodyStorage()
called by StoreEntry when it has more buffer space available
squidaio_request_t * head
Definition: aiops.cc:127
bool timestampsSet()
Definition: store.cc:1449
unsigned short defaultPort() const
Definition: UriScheme.cc:71
@ akError
no adapted message will come; see bypassable
Definition: Answer.h:29
int has(Http::HdrType id) const
Definition: HttpHeader.cc:1007
const SBuf storeId()
Definition: HttpRequest.cc:694
int reload_into_ims
Definition: SquidConfig.h:298
char * url
Definition: tcp-banger2.c:114
struct SquidConfig::@99 Port
void announceInitiatorAbort(CbcPointer< Initiate > &x)
inform the transaction about abnormal termination and clear the pointer
Definition: Initiator.cc:38
bool isEmpty() const
Definition: Store.h:67
@ bumpBump
Definition: support.h:136
AnyP::PortCfgPointer port
static const char *const crlf
size_t HttpReply *STUB StoreEntry const KeyScope scope const HttpRequestMethod & method
Definition: stub_store.cc:108
@ ERR_DETAIL_REDIRECTOR_TIMEDOUT
static HttpRequest * FromUrlXXX(const char *url, const MasterXaction::Pointer &, const HttpRequestMethod &method=Http::METHOD_GET)
Definition: HttpRequest.cc:546
@ ERR_ACCESS_DENIED
Definition: err_type.h:16
int clientBeginRequest(const HttpRequestMethod &method, char const *url, CSCB *streamcallback, CSD *streamdetach, ClientStreamData streamdata, HttpHeader const *header, char *tailbuf, size_t taillen, const MasterXaction::Pointer &mx)
#define Must(condition)
Like assert() but throws an exception instead of aborting the process.
Definition: TextException.h:69
bool auth
pinned for www authentication
Definition: client_side.h:140
void clientRedirectDone(const Helper::Reply &reply)
@ ACCESS_ALLOWED
Definition: Acl.h:104
@ ACCESS_DENIED
Definition: Acl.h:103
void redirectStart(ClientHttpRequest *http, HLPCB *handler, void *data)
Definition: redirect.cc:288
@ scProxyAuthenticationRequired
Definition: StatusCode.h:51
Ssl::ServerBump * serverBump()
Definition: client_side.h:267
static void clientCheckPinning(ClientHttpRequest *http)
AsyncCall * asyncCall(int aDebugSection, int aDebugLevel, const char *aName, const Dialer &aDialer)
Definition: AsyncCall.h:156
static HttpReplyPointer MakeConnectionEstablished()
construct and return an HTTP/200 (Connection Established) response
Definition: HttpReply.cc:120
char * surrogate_id
Definition: SquidConfig.h:216
hier_code
Definition: hier_code.h:12
acl_access * redirector
Definition: SquidConfig.h:381
int kind
the matched custom access list verb (or zero)
Definition: Acl.h:157
CbcPointer< Adaptation::Initiate > virginHeadSource
@ methodReqmod
Definition: Elements.h:17
@ BrokenHelper
Definition: ResultCode.h:20
void setLogUriToRequestUri()
sets log_uri when we know the current request
int setSockTos(const Comm::ConnectionPointer &conn, tos_t tos)
Definition: QosConfig.cc:558
bool conflicted() const
whether Squid is uncertain about the allowed() or denied() answer
Definition: Acl.h:152
void storeIdStart(ClientHttpRequest *http, HLPCB *handler, void *data)
Definition: redirect.cc:314
void clientStreamInit(dlink_list *list, CSR *func, CSD *rdetach, CSS *readstatus, ClientStreamData readdata, CSCB *callback, CSD *cdetach, ClientStreamData callbackdata, StoreIOBuffer tailBuffer)
void checkNoCacheDone(const Acl::Answer &answer)
@ dirAccepted
accepted (from a client by Squid)
Definition: QosConfig.h:67
@ scConflict
Definition: StatusCode.h:53
char * urlCanonicalCleanWithoutRequest(const SBuf &url, const HttpRequestMethod &method, const AnyP::UriScheme &scheme)
Definition: Uri.cc:628
Ssl::BumpMode sslBumpNeed() const
returns raw sslBump mode value
ClientRequestContext * calloutContext
static void SslBumpEstablish(const Comm::ConnectionPointer &, char *, size_t, Comm::Flag errflag, int, void *data)
static void sslBumpAccessCheckDoneWrapper(Acl::Answer, void *)
void HLPCB(void *, const Helper::Reply &)
Definition: forward.h:27
int port
port of pinned connection
Definition: client_side.h:138
void deferProducer(const AsyncCall::Pointer &producer)
call back producer when more buffer space is available
Definition: store.cc:378
void debugObj(int section, int level, const char *label, void *obj, ObjPackMethod pm)
Definition: tools.cc:900
#define xisspace(x)
Definition: xis.h:17
static void clientStoreIdAccessCheckDone(Acl::Answer answer, void *data)
StoreEntry * storeEntry() const
int bumpMode
whether and how the request was SslBumped
bool isOpen() const
Definition: Connection.h:100
StoreEntry * loggingEntry_
StoreEntry * loggingEntry() const
size_t appendDomainLen
Definition: SquidConfig.h:219
@ akBlock
block or deny the master xaction; see authority
Definition: Answer.h:28
@ bumpClientFirst
Definition: support.h:136
HttpHeaderEntry * getEntry(HttpHeaderPos *pos) const
Definition: HttpHeader.cc:628
void consume(mb_size_t sz)
removes sz bytes and "packs" by moving content left
Definition: MemBuf.cc:171
@ METHOD_GET
Definition: MethodType.h:25
MemObject * memObject() const
#define false
Definition: GnuRegex.c:233
const SBuf & effectiveRequestUri() const
RFC 7230 section 5.5 - Effective Request URI.
Definition: HttpRequest.cc:705
void startAdaptation(const Adaptation::ServiceGroupPointer &g)
Initiate an asynchronous adaptation transaction which will call us back.
void CSCB(clientStreamNode *, ClientHttpRequest *, HttpReply *, StoreIOBuffer)
client stream read callback
acl_access * followXFF
Definition: SquidConfig.h:395
NotePairs::Pointer notes()
Definition: HttpRequest.cc:713
Ip::Address client_addr
Definition: HttpRequest.h:149
void host(const char *src)
Definition: Uri.cc:98
virtual void noteMoreBodyDataAvailable(BodyPipe::Pointer)
String ruleId
ACL (or similar rule) name that blocked forwarding.
Definition: Answer.h:40
bool forceTunnel
whether to forward via TunnelStateData (instead of FwdState)
Definition: RequestFlags.h:111
struct _request * request(char *urlin)
Definition: tcp-banger2.c:291
ClientHttpRequest(ConnStateData *csd)
void sslBumpEstablish(Comm::Flag errflag)
@ TimedOut
Definition: ResultCode.h:21
const char * bumpMode(int bm)
Definition: support.h:148
void nonBlockingCheck(ACLCB *callback, void *callback_data)
Definition: Checklist.cc:238
static void clientInterpretRequestHeaders(ClientHttpRequest *http)
void resetWithoutLocking(T *t)
Reset raw pointer - unlock any previous one and save new one without locking.
String store_id
Definition: HttpRequest.h:139
static HLPCB clientStoreIdDoneWrapper
uint64_t consumedSize() const
Definition: BodyPipe.h:111
Http::StatusCode httpStatus
Definition: errorpage.h:174
Auth::UserRequest::Pointer auth_user_request
Definition: errorpage.h:176
SQUIDCEXTERN CSR clientGetMoreData
tos_t aclMapTOS(acl_tos *head, ACLChecklist *ch)
Checks for a TOS value to apply depending on the ACL.
Definition: FwdState.cc:1417
#define PROF_start(probename)
Definition: Profiler.h:62
class SquidConfig Config
Definition: SquidConfig.cc:12
void UpdateRequestNotes(ConnStateData *csd, HttpRequest &request, NotePairs const &helperNotes)
Definition: HttpRequest.cc:721
struct SquidConfig::@105 Accel
HttpRequest *const request
void clean()
Definition: String.cc:125
AnyP::ProtocolVersion ProtocolVersion(unsigned int aMajor, unsigned int aMinor)
HTTP version label information.
@ PROXY_AUTHORIZATION
@ bumpSplice
Definition: support.h:136
BodyPipe::Pointer adaptedBodySource

 

Introduction

Documentation

Support

Miscellaneous

Web Site Translations

Mirrors