client_side_request.cc
Go to the documentation of this file.
1 /*
2  * Copyright (C) 1996-2017 The Squid Software Foundation and contributors
3  *
4  * Squid software is distributed under GPLv2+ license and includes
5  * contributions from numerous individuals and organizations.
6  * Please see the COPYING and CONTRIBUTORS files for details.
7  */
8 
9 /* DEBUG: section 85 Client-side Request Routines */
10 
11 /*
12  * General logic of request processing:
13  *
14  * We run a series of tests to determine if access will be permitted, and to do
15  * any redirection. Then we call into the result clientStream to retrieve data.
16  * From that point on it's up to reply management.
17  */
18 
19 #include "squid.h"
20 #include "acl/FilledChecklist.h"
21 #include "acl/Gadgets.h"
22 #include "anyp/PortCfg.h"
23 #include "base/AsyncJobCalls.h"
24 #include "client_side.h"
25 #include "client_side_reply.h"
26 #include "client_side_request.h"
27 #include "ClientRequestContext.h"
28 #include "clientStream.h"
29 #include "comm/Connection.h"
30 #include "comm/Write.h"
31 #include "err_detail_type.h"
32 #include "errorpage.h"
33 #include "fd.h"
34 #include "fde.h"
35 #include "format/Token.h"
36 #include "gopher.h"
37 #include "helper.h"
38 #include "helper/Reply.h"
39 #include "http.h"
40 #include "http/Stream.h"
41 #include "HttpHdrCc.h"
42 #include "HttpReply.h"
43 #include "HttpRequest.h"
44 #include "ip/QosConfig.h"
45 #include "ipcache.h"
46 #include "log/access_log.h"
47 #include "MemObject.h"
48 #include "Parsing.h"
49 #include "profiler/Profiler.h"
50 #include "redirect.h"
51 #include "SquidConfig.h"
52 #include "SquidTime.h"
53 #include "Store.h"
54 #include "StrList.h"
55 #include "tools.h"
56 #include "URL.h"
57 #include "wordlist.h"
58 #if USE_AUTH
59 #include "auth/UserRequest.h"
60 #endif
61 #if USE_ADAPTATION
62 #include "adaptation/AccessCheck.h"
63 #include "adaptation/Answer.h"
64 #include "adaptation/Iterator.h"
65 #include "adaptation/Service.h"
66 #if ICAP_CLIENT
68 #endif
69 #endif
70 #if USE_OPENSSL
71 #include "ssl/ServerBump.h"
72 #include "ssl/support.h"
73 #endif
74 
75 #if LINGERING_CLOSE
76 #define comm_close comm_lingering_close
77 #endif
78 
79 static const char *const crlf = "\r\n";
80 
81 #if FOLLOW_X_FORWARDED_FOR
82 static void clientFollowXForwardedForCheck(allow_t answer, void *data);
83 #endif /* FOLLOW_X_FORWARDED_FOR */
84 
86 
88 
89 /* Local functions */
90 /* other */
91 static void clientAccessCheckDoneWrapper(allow_t, void *);
92 #if USE_OPENSSL
93 static void sslBumpAccessCheckDoneWrapper(allow_t, void *);
94 #endif
95 static int clientHierarchical(ClientHttpRequest * http);
99 static void checkNoCacheDoneWrapper(allow_t, void *);
103 static void checkFailureRatio(err_type, hier_code);
104 
106 {
107  /*
108  * Release our "lock" on our parent, ClientHttpRequest, if we
109  * still have one
110  */
111 
112  if (http)
114 
115  delete error;
116  debugs(85,3, "ClientRequestContext destructed, this=" << this);
117 }
118 
120  http(cbdataReference(anHttp)),
121  acl_checklist(NULL),
122  redirect_state(REDIRECT_NONE),
123  store_id_state(REDIRECT_NONE),
124  host_header_verify_done(false),
125  http_access_done(false),
126  adapted_http_access_done(false),
127 #if USE_ADAPTATION
128  adaptation_acl_check_done(false),
129 #endif
130  redirect_done(false),
131  store_id_done(false),
132  no_cache_done(false),
133  interpreted_req_hdrs(false),
134  tosToClientDone(false),
135  nfmarkToClientDone(false),
136 #if USE_OPENSSL
137  sslBumpCheckDone(false),
138 #endif
139  error(NULL),
140  readNextRequest(false)
141 {
142  debugs(85, 3, "ClientRequestContext constructed, this=" << this);
143 }
144 
146 
148 #if USE_ADAPTATION
149  AsyncJob("ClientHttpRequest"),
150 #endif
151  request(NULL),
152  uri(NULL),
153  log_uri(NULL),
154  req_sz(0),
155  logType(LOG_TAG_NONE),
156  calloutContext(NULL),
157  maxReplyBodySize_(0),
158  entry_(NULL),
159  loggingEntry_(NULL),
160  conn_(NULL)
161 #if USE_OPENSSL
162  , sslBumpNeed_(Ssl::bumpEnd)
163 #endif
164 #if USE_ADAPTATION
165  , request_satisfaction_mode(false)
166  , request_satisfaction_offset(0)
167 #endif
168 {
169  setConn(aConn);
170  al = new AccessLogEntry;
172  if (aConn) {
174  al->cache.port = aConn->port;
175  al->cache.caddr = aConn->log_addr;
176 
177 #if USE_OPENSSL
178  if (aConn->clientConnection != NULL && aConn->clientConnection->isOpen()) {
179  if (auto ssl = fd_table[aConn->clientConnection->fd].ssl.get())
180  al->cache.sslClientCert.resetWithoutLocking(SSL_get_peer_certificate(ssl));
181  }
182 #endif
183  }
185 }
186 
187 /*
188  * returns true if client specified that the object must come from the cache
189  * without contacting origin server
190  */
191 bool
193 {
194  assert(request);
195  return request->cache_control &&
197 }
198 
211 static void
213 {
214  // Can be set at compile time with -D compiler flag
215 #ifndef FAILURE_MODE_TIME
216 #define FAILURE_MODE_TIME 300
217 #endif
218 
219  if (hcode == HIER_NONE)
220  return;
221 
222  // don't bother when ICP is disabled.
223  if (Config.Port.icp <= 0)
224  return;
225 
226  static double magic_factor = 100.0;
227  double n_good;
228  double n_bad;
229 
230  n_good = magic_factor / (1.0 + request_failure_ratio);
231 
232  n_bad = magic_factor - n_good;
233 
234  switch (etype) {
235 
236  case ERR_DNS_FAIL:
237 
238  case ERR_CONNECT_FAIL:
240 
241  case ERR_READ_ERROR:
242  ++n_bad;
243  break;
244 
245  default:
246  ++n_good;
247  }
248 
249  request_failure_ratio = n_bad / n_good;
250 
252  return;
253 
254  if (request_failure_ratio < 1.0)
255  return;
256 
257  debugs(33, DBG_CRITICAL, "WARNING: Failure Ratio at "<< std::setw(4)<<
258  std::setprecision(3) << request_failure_ratio);
259 
260  debugs(33, DBG_CRITICAL, "WARNING: ICP going into HIT-only mode for " <<
261  FAILURE_MODE_TIME / 60 << " minutes...");
262 
264 
265  request_failure_ratio = 0.8; /* reset to something less than 1.0 */
266 }
267 
269 {
270  debugs(33, 3, "httpRequestFree: " << uri);
272 
273  // Even though freeResources() below may destroy the request,
274  // we no longer set request->body_pipe to NULL here
275  // because we did not initiate that pipe (ConnStateData did)
276 
277  /* the ICP check here was erroneous
278  * - StoreEntry::releaseRequest was always called if entry was valid
279  */
280 
281  logRequest();
282 
284 
285  if (request)
287 
288  freeResources();
289 
290 #if USE_ADAPTATION
292 
293  if (adaptedBodySource != NULL)
295 #endif
296 
297  if (calloutContext)
298  delete calloutContext;
299 
301 
302  if (conn_)
304 
305  /* moving to the next connection is handled by the context free */
307 
309 }
310 
320 int
321 clientBeginRequest(const HttpRequestMethod& method, char const *url, CSCB * streamcallback,
322  CSD * streamdetach, ClientStreamData streamdata, HttpHeader const *header,
323  char *tailbuf, size_t taillen, const MasterXaction::Pointer &mx)
324 {
325  size_t url_sz;
328  StoreIOBuffer tempBuffer;
329  if (http->al != NULL)
330  http->al->cache.start_time = current_time;
331  /* this is only used to adjust the connection offset in client_side.c */
332  http->req_sz = 0;
333  tempBuffer.length = taillen;
334  tempBuffer.data = tailbuf;
335  /* client stream setup */
337  clientReplyStatus, new clientReplyContext(http), streamcallback,
338  streamdetach, streamdata, tempBuffer);
339  /* make it visible in the 'current acctive requests list' */
340  /* Set flags */
341  /* internal requests only makes sense in an
342  * accelerator today. TODO: accept flags ? */
343  http->flags.accel = true;
344  /* allow size for url rewriting */
345  url_sz = strlen(url) + Config.appendDomainLen + 5;
346  http->uri = (char *)xcalloc(url_sz, 1);
347  strcpy(http->uri, url); // XXX: polluting http->uri before parser validation
348 
349  if ((request = HttpRequest::FromUrl(http->uri, mx, method)) == NULL) {
350  debugs(85, 5, "Invalid URL: " << http->uri);
351  return -1;
352  }
353 
354  /*
355  * now update the headers in request with our supplied headers.
356  * HttpRequest::FromUrl() should return a blank header set, but
357  * we use Update to be sure of correctness.
358  */
359  if (header)
360  request->header.update(header);
361 
362  http->log_uri = xstrdup(urlCanonicalClean(request));
363 
364  /* http struct now ready */
365 
366  /*
367  * build new header list *? TODO
368  */
369  request->flags.accelerated = http->flags.accel;
370 
371  /* this is an internally created
372  * request, not subject to acceleration
373  * target overrides */
374  /*
375  * FIXME? Do we want to detect and handle internal requests of internal
376  * objects ?
377  */
378 
379  /* Internally created requests cannot have bodies today */
380  request->content_length = 0;
381 
382  request->client_addr.setNoAddr();
383 
384 #if FOLLOW_X_FORWARDED_FOR
385  request->indirect_client_addr.setNoAddr();
386 #endif /* FOLLOW_X_FORWARDED_FOR */
387 
388  request->my_addr.setNoAddr(); /* undefined for internal requests */
389 
390  request->my_addr.port(0);
391 
392  request->http_ver = Http::ProtocolVersion();
393 
394  http->request = request;
395  HTTPMSGLOCK(http->request);
396 
397  /* optional - skip the access check ? */
398  http->calloutContext = new ClientRequestContext(http);
399 
400  http->calloutContext->http_access_done = false;
401 
402  http->calloutContext->redirect_done = true;
403 
404  http->calloutContext->no_cache_done = true;
405 
406  http->doCallouts();
407 
408  return 0;
409 }
410 
411 bool
413 {
414  ClientHttpRequest *http_ = http;
415 
416  if (cbdataReferenceValid(http_))
417  return true;
418 
419  http = NULL;
420 
421  cbdataReferenceDone(http_);
422 
423  return false;
424 }
425 
426 #if FOLLOW_X_FORWARDED_FOR
427 
441 static void
443 {
444  ClientRequestContext *calloutContext = (ClientRequestContext *) data;
445 
446  if (!calloutContext->httpStateIsValid())
447  return;
448 
449  ClientHttpRequest *http = calloutContext->http;
450  HttpRequest *request = http->request;
451 
452  if (answer.allowed() && request->x_forwarded_for_iterator.size() != 0) {
453 
454  /*
455  * Remove the last comma-delimited element from the
456  * x_forwarded_for_iterator and use it to repeat the cycle.
457  */
458  const char *p;
459  const char *asciiaddr;
460  int l;
462  p = request->x_forwarded_for_iterator.termedBuf();
463  l = request->x_forwarded_for_iterator.size();
464 
465  /*
466  * XXX x_forwarded_for_iterator should really be a list of
467  * IP addresses, but it's a String instead. We have to
468  * walk backwards through the String, biting off the last
469  * comma-delimited part each time. As long as the data is in
470  * a String, we should probably implement and use a variant of
471  * strListGetItem() that walks backwards instead of forwards
472  * through a comma-separated list. But we don't even do that;
473  * we just do the work in-line here.
474  */
475  /* skip trailing space and commas */
476  while (l > 0 && (p[l-1] == ',' || xisspace(p[l-1])))
477  --l;
478  request->x_forwarded_for_iterator.cut(l);
479  /* look for start of last item in list */
480  while (l > 0 && ! (p[l-1] == ',' || xisspace(p[l-1])))
481  --l;
482  asciiaddr = p+l;
483  if ((addr = asciiaddr)) {
484  request->indirect_client_addr = addr;
485  request->x_forwarded_for_iterator.cut(l);
488  /* override the default src_addr tested if we have to go deeper than one level into XFF */
489  Filled(calloutContext->acl_checklist)->src_addr = request->indirect_client_addr;
490  }
492  return;
493  }
494  }
495 
496  /* clean up, and pass control to clientAccessCheck */
498  /*
499  * Ensure that the access log shows the indirect client
500  * instead of the direct client.
501  */
502  ConnStateData *conn = http->getConn();
503  conn->log_addr = request->indirect_client_addr;
504  http->al->cache.caddr = conn->log_addr;
505  }
506  request->x_forwarded_for_iterator.clean();
507  request->flags.done_follow_x_forwarded_for = true;
508 
509  if (answer.conflicted()) {
510  debugs(28, DBG_CRITICAL, "ERROR: Processing X-Forwarded-For. Stopping at IP address: " << request->indirect_client_addr );
511  }
512 
513  /* process actual access ACL as normal. */
514  calloutContext->clientAccessCheck();
515 }
516 #endif /* FOLLOW_X_FORWARDED_FOR */
517 
518 static void
520 {
521  ClientRequestContext *c = static_cast<ClientRequestContext*>(data);
522  c->hostHeaderIpVerify(ia, dns);
523 }
524 
525 void
527 {
529 
530  // note the DNS details for the transaction stats.
531  http->request->recordLookup(dns);
532 
533  // Is the NAT destination IP in DNS?
534  if (ia && ia->have(clientConn->local)) {
535  debugs(85, 3, "validate IP " << clientConn->local << " possible from Host:");
536  http->request->flags.hostVerified = true;
537  http->doCallouts();
538  return;
539  }
540  debugs(85, 3, HERE << "FAIL: validate IP " << clientConn->local << " possible from Host:");
541  hostHeaderVerifyFailed("local IP", "any domain IP");
542 }
543 
544 void
546 {
547  // IP address validation for Host: failed. Admin wants to ignore them.
548  // NP: we do not yet handle CONNECT tunnels well, so ignore for them
550  debugs(85, 3, "SECURITY ALERT: Host header forgery detected on " << http->getConn()->clientConnection <<
551  " (" << A << " does not match " << B << ") on URL: " << http->request->effectiveRequestUri());
552 
553  // NP: it is tempting to use 'flags.noCache' but that is all about READing cache data.
554  // The problems here are about WRITE for new cache content, which means flags.cachable
555  http->request->flags.cachable = false; // MUST NOT cache (for now)
556  // XXX: when we have updated the cache key to base on raw-IP + URI this cacheable limit can go.
557  http->request->flags.hierarchical = false; // MUST NOT pass to peers (for now)
558  // XXX: when we have sorted out the best way to relay requests properly to peers this hierarchical limit can go.
559  http->doCallouts();
560  return;
561  }
562 
563  debugs(85, DBG_IMPORTANT, "SECURITY ALERT: Host header forgery detected on " <<
564  http->getConn()->clientConnection << " (" << A << " does not match " << B << ")");
565  if (const char *ua = http->request->header.getStr(Http::HdrType::USER_AGENT))
566  debugs(85, DBG_IMPORTANT, "SECURITY ALERT: By user agent: " << ua);
567  debugs(85, DBG_IMPORTANT, "SECURITY ALERT: on URL: " << http->request->effectiveRequestUri());
568 
569  // IP address validation for Host: failed. reject the connection.
571  clientReplyContext *repContext = dynamic_cast<clientReplyContext *>(node->data.getRaw());
572  assert (repContext);
573  repContext->setReplyToError(ERR_CONFLICT_HOST, Http::scConflict,
574  http->request->method, NULL,
576  http->request,
577  NULL,
578 #if USE_AUTH
579  http->getConn() != NULL && http->getConn()->getAuth() != NULL ?
581 #else
582  NULL);
583 #endif
585  clientStreamRead(node, http, node->readBuffer);
586 }
587 
588 void
590 {
591  // Require a Host: header.
592  const char *host = http->request->header.getStr(Http::HdrType::HOST);
593 
594  if (!host) {
595  // TODO: dump out the HTTP/1.1 error about missing host header.
596  // otherwise this is fine, can't forge a header value when its not even set.
597  debugs(85, 3, HERE << "validate skipped with no Host: header present.");
598  http->doCallouts();
599  return;
600  }
601 
602  if (http->request->flags.internal) {
603  // TODO: kill this when URL handling allows partial URLs out of accel mode
604  // and we no longer screw with the URL just to add our internal host there
605  debugs(85, 6, HERE << "validate skipped due to internal composite URL.");
606  http->doCallouts();
607  return;
608  }
609 
610  // Locate if there is a port attached, strip ready for IP lookup
611  char *portStr = NULL;
612  char *hostB = xstrdup(host);
613  host = hostB;
614  if (host[0] == '[') {
615  // IPv6 literal.
616  portStr = strchr(hostB, ']');
617  if (portStr && *(++portStr) != ':') {
618  portStr = NULL;
619  }
620  } else {
621  // Domain or IPv4 literal with port
622  portStr = strrchr(hostB, ':');
623  }
624 
625  uint16_t port = 0;
626  if (portStr) {
627  *portStr = '\0'; // strip the ':'
628  if (*(++portStr) != '\0') {
629  char *end = NULL;
630  int64_t ret = strtoll(portStr, &end, 10);
631  if (end == portStr || *end != '\0' || ret < 1 || ret > 0xFFFF) {
632  // invalid port details. Replace the ':'
633  *(--portStr) = ':';
634  portStr = NULL;
635  } else
636  port = (ret & 0xFFFF);
637  }
638  }
639 
640  debugs(85, 3, "validate host=" << host << ", port=" << port << ", portStr=" << (portStr?portStr:"NULL"));
642  // verify the Host: port (if any) matches the apparent destination
643  if (portStr && port != http->getConn()->clientConnection->local.port()) {
644  debugs(85, 3, "FAIL on validate port " << http->getConn()->clientConnection->local.port() <<
645  " matches Host: port " << port << " (" << portStr << ")");
646  hostHeaderVerifyFailed("intercepted port", portStr);
647  } else {
648  // XXX: match the scheme default port against the apparent destination
649 
650  // verify the destination DNS is one of the Host: headers IPs
652  }
653  } else if (!Config.onoff.hostStrictVerify) {
654  debugs(85, 3, "validate skipped.");
655  http->doCallouts();
656  } else if (strlen(host) != strlen(http->request->url.host())) {
657  // Verify forward-proxy requested URL domain matches the Host: header
658  debugs(85, 3, "FAIL on validate URL domain length " << http->request->url.host() << " matches Host: " << host);
660  } else if (matchDomainName(host, http->request->url.host()) != 0) {
661  // Verify forward-proxy requested URL domain matches the Host: header
662  debugs(85, 3, "FAIL on validate URL domain " << http->request->url.host() << " matches Host: " << host);
664  } else if (portStr && port != http->request->url.port()) {
665  // Verify forward-proxy requested URL domain matches the Host: header
666  debugs(85, 3, "FAIL on validate URL port " << http->request->url.port() << " matches Host: port " << portStr);
667  hostHeaderVerifyFailed("URL port", portStr);
668  } else if (!portStr && http->request->method != Http::METHOD_CONNECT && http->request->url.port() != http->request->url.getScheme().defaultPort()) {
669  // Verify forward-proxy requested URL domain matches the Host: header
670  // Special case: we don't have a default-port to check for CONNECT. Assume URL is correct.
671  debugs(85, 3, "FAIL on validate URL port " << http->request->url.port() << " matches Host: default port " << http->request->url.getScheme().defaultPort());
672  hostHeaderVerifyFailed("URL port", "default port");
673  } else {
674  // Okay no problem.
675  debugs(85, 3, "validate passed.");
676  http->request->flags.hostVerified = true;
677  http->doCallouts();
678  }
679  safe_free(hostB);
680 }
681 
682 /* This is the entry point for external users of the client_side routines */
683 void
685 {
686 #if FOLLOW_X_FORWARDED_FOR
687  if (!http->request->flags.doneFollowXff() &&
690 
691  /* we always trust the direct client address for actual use */
694 
695  /* setup the XFF iterator for processing */
697 
698  /* begin by checking to see if we trust direct client enough to walk XFF */
701  return;
702  }
703 #endif
704 
705  if (Config.accessList.http) {
708  } else {
709  debugs(0, DBG_CRITICAL, "No http_access configuration found. This will block ALL traffic");
711  }
712 }
713 
719 void
721 {
725  } else {
726  debugs(85, 2, HERE << "No adapted_http_access configuration. default: ALLOW");
728  }
729 }
730 
731 void
733 {
734  ClientRequestContext *calloutContext = (ClientRequestContext *) data;
735 
736  if (!calloutContext->httpStateIsValid())
737  return;
738 
739  calloutContext->clientAccessCheckDone(answer);
740 }
741 
742 void
744 {
746  err_type page_id;
747  Http::StatusCode status;
748  debugs(85, 2, "The request " << http->request->method << ' ' <<
749  http->uri << " is " << answer <<
750  "; last ACL checked: " << (AclMatchedName ? AclMatchedName : "[none]"));
751 
752 #if USE_AUTH
753  char const *proxy_auth_msg = "<null>";
754  if (http->getConn() != NULL && http->getConn()->getAuth() != NULL)
755  proxy_auth_msg = http->getConn()->getAuth()->denyMessage("<null>");
756  else if (http->request->auth_user_request != NULL)
757  proxy_auth_msg = http->request->auth_user_request->denyMessage("<null>");
758 #endif
759 
760  if (!answer.allowed()) {
761  // auth has a grace period where credentials can be expired but okay not to challenge.
762 
763  /* Send an auth challenge or error */
764  // XXX: do we still need aclIsProxyAuth() ?
765  bool auth_challenge = (answer == ACCESS_AUTH_REQUIRED || aclIsProxyAuth(AclMatchedName));
766  debugs(85, 5, "Access Denied: " << http->uri);
767  debugs(85, 5, "AclMatchedName = " << (AclMatchedName ? AclMatchedName : "<null>"));
768 #if USE_AUTH
769  if (auth_challenge)
770  debugs(33, 5, "Proxy Auth Message = " << (proxy_auth_msg ? proxy_auth_msg : "<null>"));
771 #endif
772 
773  /*
774  * NOTE: get page_id here, based on AclMatchedName because if
775  * USE_DELAY_POOLS is enabled, then AclMatchedName gets clobbered in
776  * the clientCreateStoreEntry() call just below. Pedro Ribeiro
777  * <pribeiro@isel.pt>
778  */
779  page_id = aclGetDenyInfoPage(&Config.denyInfoList, AclMatchedName, answer != ACCESS_AUTH_REQUIRED);
780 
782 
783  if (auth_challenge) {
784 #if USE_AUTH
785  if (http->request->flags.sslBumped) {
786  /*SSL Bumped request, authentication is not possible*/
787  status = Http::scForbidden;
788  } else if (!http->flags.accel) {
789  /* Proxy authorisation needed */
791  } else {
792  /* WWW authorisation needed */
793  status = Http::scUnauthorized;
794  }
795 #else
796  // need auth, but not possible to do.
797  status = Http::scForbidden;
798 #endif
799  if (page_id == ERR_NONE)
800  page_id = ERR_CACHE_ACCESS_DENIED;
801  } else {
802  status = Http::scForbidden;
803 
804  if (page_id == ERR_NONE)
805  page_id = ERR_ACCESS_DENIED;
806  }
807 
808  Ip::Address tmpnoaddr;
809  tmpnoaddr.setNoAddr();
810  error = clientBuildError(page_id, status,
811  NULL,
812  http->getConn() != NULL ? http->getConn()->clientConnection->remote : tmpnoaddr,
813  http->request
814  );
815 
816 #if USE_AUTH
818  http->getConn() != NULL && http->getConn()->getAuth() != NULL ?
820 #endif
821 
822  readNextRequest = true;
823  }
824 
825  /* ACCESS_ALLOWED continues here ... */
826  xfree(http->uri);
828  http->doCallouts();
829 }
830 
831 #if USE_ADAPTATION
832 void
834 {
835  debugs(93,3,HERE << this << " adaptationAclCheckDone called");
836 
837 #if ICAP_CLIENT
839  if (ih != NULL) {
840  if (getConn() != NULL && getConn()->clientConnection != NULL) {
841  ih->rfc931 = getConn()->clientConnection->rfc931;
842 #if USE_OPENSSL
843  if (getConn()->clientConnection->isOpen()) {
844  ih->ssluser = sslGetUserEmail(fd_table[getConn()->clientConnection->fd].ssl.get());
845  }
846 #endif
847  }
848  ih->log_uri = log_uri;
849  ih->req_sz = req_sz;
850  }
851 #endif
852 
853  if (!g) {
854  debugs(85,3, HERE << "no adaptation needed");
855  doCallouts();
856  return;
857  }
858 
859  startAdaptation(g);
860 }
861 
862 #endif
863 
864 static void
866 {
867  ClientRequestContext *context = (ClientRequestContext *)data;
868  ClientHttpRequest *http = context->http;
869  context->acl_checklist = NULL;
870 
871  if (answer.allowed())
873  else {
874  Helper::Reply const nilReply(Helper::Error);
875  context->clientRedirectDone(nilReply);
876  }
877 }
878 
879 void
881 {
882  debugs(33, 5, HERE << "'" << http->uri << "'");
887  } else
889 }
890 
895 static void
897 {
898  ClientRequestContext *context = static_cast<ClientRequestContext *>(data);
899  ClientHttpRequest *http = context->http;
900  context->acl_checklist = NULL;
901 
902  if (answer.allowed())
903  storeIdStart(http, clientStoreIdDoneWrapper, context);
904  else {
905  debugs(85, 3, "access denied expected ERR reply handling: " << answer);
906  Helper::Reply const nilReply(Helper::Error);
907  context->clientStoreIdDone(nilReply);
908  }
909 }
910 
916 void
918 {
919  debugs(33, 5,"'" << http->uri << "'");
920 
921  if (Config.accessList.store_id) {
924  } else
926 }
927 
928 static int
930 {
931  HttpRequest *request = http->request;
932  HttpRequestMethod method = request->method;
933 
934  // intercepted requests MUST NOT (yet) be sent to peers unless verified
935  if (!request->flags.hostVerified && (request->flags.intercepted || request->flags.interceptTproxy))
936  return 0;
937 
938  /*
939  * IMS needs a private key, so we can use the hierarchy for IMS only if our
940  * neighbors support private keys
941  */
942 
943  if (request->flags.ims && !neighbors_do_private_keys)
944  return 0;
945 
946  /*
947  * This is incorrect: authenticating requests can be sent via a hierarchy
948  * (they can even be cached if the correct headers are set on the reply)
949  */
950  if (request->flags.auth)
951  return 0;
952 
953  if (method == Http::METHOD_TRACE)
954  return 1;
955 
956  if (method != Http::METHOD_GET)
957  return 0;
958 
959  if (request->flags.loopDetected)
960  return 0;
961 
962  if (request->url.getScheme() == AnyP::PROTO_HTTP)
963  return method.respMaybeCacheable();
964 
965  if (request->url.getScheme() == AnyP::PROTO_GOPHER)
966  return gopherCachable(request);
967 
968  if (request->url.getScheme() == AnyP::PROTO_CACHE_OBJECT)
969  return 0;
970 
971  return 1;
972 }
973 
974 static void
976 {
977  HttpRequest *request = http->request;
978  HttpHeader *req_hdr = &request->header;
979  ConnStateData *http_conn = http->getConn();
980 
981  /* Internal requests such as those from ESI includes may be without
982  * a client connection
983  */
984  if (!http_conn)
985  return;
986 
987  request->flags.connectionAuthDisabled = http_conn->port->connection_auth_disabled;
988  if (!request->flags.connectionAuthDisabled) {
989  if (Comm::IsConnOpen(http_conn->pinning.serverConnection)) {
990  if (http_conn->pinning.auth) {
991  request->flags.connectionAuth = true;
992  request->flags.auth = true;
993  } else {
994  request->flags.connectionProxyAuth = true;
995  }
996  // These should already be linked correctly.
997  assert(request->clientConnectionManager == http_conn);
998  }
999  }
1000 
1001  /* check if connection auth is used, and flag as candidate for pinning
1002  * in such case.
1003  * Note: we may need to set flags.connectionAuth even if the connection
1004  * is already pinned if it was pinned earlier due to proxy auth
1005  */
1006  if (!request->flags.connectionAuth) {
1009  HttpHeaderEntry *e;
1010  int may_pin = 0;
1011  while ((e = req_hdr->getEntry(&pos))) {
1013  const char *value = e->value.rawBuf();
1014  if (strncasecmp(value, "NTLM ", 5) == 0
1015  ||
1016  strncasecmp(value, "Negotiate ", 10) == 0
1017  ||
1018  strncasecmp(value, "Kerberos ", 9) == 0) {
1019  if (e->id == Http::HdrType::AUTHORIZATION) {
1020  request->flags.connectionAuth = true;
1021  may_pin = 1;
1022  } else {
1023  request->flags.connectionProxyAuth = true;
1024  may_pin = 1;
1025  }
1026  }
1027  }
1028  }
1029  if (may_pin && !request->pinnedConnection()) {
1030  // These should already be linked correctly. Just need the ServerConnection to pinn.
1031  assert(request->clientConnectionManager == http_conn);
1032  }
1033  }
1034  }
1035 }
1036 
1037 static void
1039 {
1040  HttpRequest *request = http->request;
1041  HttpHeader *req_hdr = &request->header;
1042  bool no_cache = false;
1043 
1044  request->imslen = -1;
1045  request->ims = req_hdr->getTime(Http::HdrType::IF_MODIFIED_SINCE);
1046 
1047  if (request->ims > 0)
1048  request->flags.ims = true;
1049 
1050  if (!request->flags.ignoreCc) {
1051  if (request->cache_control) {
1052  if (request->cache_control->hasNoCache())
1053  no_cache=true;
1054 
1055  // RFC 2616: treat Pragma:no-cache as if it was Cache-Control:no-cache when Cache-Control is missing
1056  } else if (req_hdr->has(Http::HdrType::PRAGMA))
1057  no_cache = req_hdr->hasListMember(Http::HdrType::PRAGMA,"no-cache",',');
1058  }
1059 
1060  if (request->method == Http::METHOD_OTHER) {
1061  no_cache=true;
1062  }
1063 
1064  if (no_cache) {
1065 #if USE_HTTP_VIOLATIONS
1066 
1068  request->flags.nocacheHack = true;
1069  else if (refresh_nocache_hack)
1070  request->flags.nocacheHack = true;
1071  else
1072 #endif
1073 
1074  request->flags.noCache = true;
1075  }
1076 
1077  /* ignore range header in non-GETs or non-HEADs */
1078  if (request->method == Http::METHOD_GET || request->method == Http::METHOD_HEAD) {
1079  // XXX: initialize if we got here without HttpRequest::parseHeader()
1080  if (!request->range)
1081  request->range = req_hdr->getRange();
1082 
1083  if (request->range) {
1084  request->flags.isRanged = true;
1086  /* XXX: This is suboptimal. We should give the stream the range set,
1087  * and thereby let the top of the stream set the offset when the
1088  * size becomes known. As it is, we will end up requesting from 0
1089  * for evey -X range specification.
1090  * RBC - this may be somewhat wrong. We should probably set the range
1091  * iter up at this point.
1092  */
1093  node->readBuffer.offset = request->range->lowestOffset(0);
1094  http->range_iter.pos = request->range->begin();
1095  http->range_iter.end = request->range->end();
1096  http->range_iter.valid = true;
1097  }
1098  }
1099 
1100  /* Only HEAD and GET requests permit a Range or Request-Range header.
1101  * If these headers appear on any other type of request, delete them now.
1102  */
1103  else {
1104  req_hdr->delById(Http::HdrType::RANGE);
1106  request->ignoreRange("neither HEAD nor GET");
1107  }
1108 
1109  if (req_hdr->has(Http::HdrType::AUTHORIZATION))
1110  request->flags.auth = true;
1111 
1112  clientCheckPinning(http);
1113 
1114  if (!request->url.userInfo().isEmpty())
1115  request->flags.auth = true;
1116 
1117  if (req_hdr->has(Http::HdrType::VIA)) {
1118  String s = req_hdr->getList(Http::HdrType::VIA);
1119  /*
1120  * ThisCache cannot be a member of Via header, "1.1 ThisCache" can.
1121  * Note ThisCache2 has a space prepended to the hostname so we don't
1122  * accidentally match super-domains.
1123  */
1124 
1125  if (strListIsSubstr(&s, ThisCache2, ',')) {
1126  debugObj(33, 1, "WARNING: Forwarding loop detected for:\n",
1127  request, (ObjPackMethod) & httpRequestPack);
1128  request->flags.loopDetected = true;
1129  }
1130 
1131 #if USE_FORW_VIA_DB
1132  fvdbCountVia(s.termedBuf());
1133 
1134 #endif
1135 
1136  s.clean();
1137  }
1138 
1139 #if USE_FORW_VIA_DB
1140 
1141  if (req_hdr->has(Http::HdrType::X_FORWARDED_FOR)) {
1143  fvdbCountForw(s.termedBuf());
1144  s.clean();
1145  }
1146 
1147 #endif
1148 
1149  request->flags.cachable = http->request->maybeCacheable();
1150 
1151  if (clientHierarchical(http))
1152  request->flags.hierarchical = true;
1153 
1154  debugs(85, 5, "clientInterpretRequestHeaders: REQ_NOCACHE = " <<
1155  (request->flags.noCache ? "SET" : "NOT SET"));
1156  debugs(85, 5, "clientInterpretRequestHeaders: REQ_CACHABLE = " <<
1157  (request->flags.cachable ? "SET" : "NOT SET"));
1158  debugs(85, 5, "clientInterpretRequestHeaders: REQ_HIERARCHICAL = " <<
1159  (request->flags.hierarchical ? "SET" : "NOT SET"));
1160 
1161 }
1162 
1163 void
1165 {
1166  ClientRequestContext *calloutContext = (ClientRequestContext *)data;
1167 
1168  if (!calloutContext->httpStateIsValid())
1169  return;
1170 
1171  calloutContext->clientRedirectDone(result);
1172 }
1173 
1174 void
1176 {
1177  ClientRequestContext *calloutContext = (ClientRequestContext *)data;
1178 
1179  if (!calloutContext->httpStateIsValid())
1180  return;
1181 
1182  calloutContext->clientStoreIdDone(result);
1183 }
1184 
1185 void
1187 {
1188  HttpRequest *old_request = http->request;
1189  debugs(85, 5, HERE << "'" << http->uri << "' result=" << reply);
1192 
1193  // Put helper response Notes into the transaction state record (ALE) eventually
1194  // do it early to ensure that no matter what the outcome the notes are present.
1195  if (http->al)
1196  http->al->syncNotes(old_request);
1197 
1198  UpdateRequestNotes(http->getConn(), *old_request, reply.notes);
1199 
1200  switch (reply.result) {
1201  case Helper::TimedOut:
1204  debugs(85, DBG_IMPORTANT, "ERROR: URL rewrite helper: Timedout");
1205  }
1206  break;
1207 
1208  case Helper::Unknown:
1209  case Helper::TT:
1210  // Handler in redirect.cc should have already mapped Unknown
1211  // IF it contained valid entry for the old URL-rewrite helper protocol
1212  debugs(85, DBG_IMPORTANT, "ERROR: URL rewrite helper returned invalid result code. Wrong helper? " << reply);
1213  break;
1214 
1215  case Helper::BrokenHelper:
1216  debugs(85, DBG_IMPORTANT, "ERROR: URL rewrite helper: " << reply);
1217  break;
1218 
1219  case Helper::Error:
1220  // no change to be done.
1221  break;
1222 
1223  case Helper::Okay: {
1224  // #1: redirect with a specific status code OK status=NNN url="..."
1225  // #2: redirect with a default status code OK url="..."
1226  // #3: re-write the URL OK rewrite-url="..."
1227 
1228  const char *statusNote = reply.notes.findFirst("status");
1229  const char *urlNote = reply.notes.findFirst("url");
1230 
1231  if (urlNote != NULL) {
1232  // HTTP protocol redirect to be done.
1233 
1234  // TODO: change default redirect status for appropriate requests
1235  // Squid defaults to 302 status for now for better compatibility with old clients.
1236  // HTTP/1.0 client should get 302 (Http::scFound)
1237  // HTTP/1.1 client contacting reverse-proxy should get 307 (Http::scTemporaryRedirect)
1238  // HTTP/1.1 client being diverted by forward-proxy should get 303 (Http::scSeeOther)
1240  if (statusNote != NULL) {
1241  const char * result = statusNote;
1242  status = static_cast<Http::StatusCode>(atoi(result));
1243  }
1244 
1245  if (status == Http::scMovedPermanently
1246  || status == Http::scFound
1247  || status == Http::scSeeOther
1248  || status == Http::scPermanentRedirect
1249  || status == Http::scTemporaryRedirect) {
1250  http->redirect.status = status;
1251  http->redirect.location = xstrdup(urlNote);
1252  // TODO: validate the URL produced here is RFC 2616 compliant absolute URI
1253  } else {
1254  debugs(85, DBG_CRITICAL, "ERROR: URL-rewrite produces invalid " << status << " redirect Location: " << urlNote);
1255  }
1256  } else {
1257  // URL-rewrite wanted. Ew.
1258  urlNote = reply.notes.findFirst("rewrite-url");
1259 
1260  // prevent broken helpers causing too much damage. If old URL == new URL skip the re-write.
1261  if (urlNote != NULL && strcmp(urlNote, http->uri)) {
1262  URL tmpUrl;
1263  if (tmpUrl.parse(old_request->method, urlNote)) {
1264  HttpRequest *new_request = old_request->clone();
1265  new_request->url = tmpUrl;
1266  debugs(61, 2, "URL-rewriter diverts URL from " << old_request->effectiveRequestUri() << " to " << new_request->effectiveRequestUri());
1267 
1268  // update the new request to flag the re-writing was done on it
1269  new_request->flags.redirected = true;
1270 
1271  // unlink bodypipe from the old request. Not needed there any longer.
1272  if (old_request->body_pipe != NULL) {
1273  old_request->body_pipe = NULL;
1274  debugs(61,2, HERE << "URL-rewriter diverts body_pipe " << new_request->body_pipe <<
1275  " from request " << old_request << " to " << new_request);
1276  }
1277 
1278  // update the current working ClientHttpRequest fields
1279  xfree(http->uri);
1280  http->uri = SBufToCstring(new_request->effectiveRequestUri());
1281  HTTPMSGUNLOCK(old_request);
1282  http->request = new_request;
1284  } else {
1285  debugs(85, DBG_CRITICAL, "ERROR: URL-rewrite produces invalid request: " <<
1286  old_request->method << " " << urlNote << " " << old_request->http_ver);
1287  }
1288  }
1289  }
1290  }
1291  break;
1292  }
1293 
1294  /* FIXME PIPELINE: This is innacurate during pipelining */
1295 
1298 
1299  assert(http->uri);
1300 
1301  http->doCallouts();
1302 }
1303 
1307 void
1309 {
1310  HttpRequest *old_request = http->request;
1311  debugs(85, 5, "'" << http->uri << "' result=" << reply);
1314 
1315  // Put helper response Notes into the transaction state record (ALE) eventually
1316  // do it early to ensure that no matter what the outcome the notes are present.
1317  if (http->al)
1318  http->al->syncNotes(old_request);
1319 
1320  UpdateRequestNotes(http->getConn(), *old_request, reply.notes);
1321 
1322  switch (reply.result) {
1323  case Helper::Unknown:
1324  case Helper::TT:
1325  // Handler in redirect.cc should have already mapped Unknown
1326  // IF it contained valid entry for the old helper protocol
1327  debugs(85, DBG_IMPORTANT, "ERROR: storeID helper returned invalid result code. Wrong helper? " << reply);
1328  break;
1329 
1330  case Helper::TimedOut:
1331  // Timeouts for storeID are not implemented
1332  case Helper::BrokenHelper:
1333  debugs(85, DBG_IMPORTANT, "ERROR: storeID helper: " << reply);
1334  break;
1335 
1336  case Helper::Error:
1337  // no change to be done.
1338  break;
1339 
1340  case Helper::Okay: {
1341  const char *urlNote = reply.notes.findFirst("store-id");
1342 
1343  // prevent broken helpers causing too much damage. If old URL == new URL skip the re-write.
1344  if (urlNote != NULL && strcmp(urlNote, http->uri) ) {
1345  // Debug section required for some very specific cases.
1346  debugs(85, 9, "Setting storeID with: " << urlNote );
1347  http->request->store_id = urlNote;
1348  http->store_id = urlNote;
1349  }
1350  }
1351  break;
1352  }
1353 
1354  http->doCallouts();
1355 }
1356 
1360 void
1362 {
1363  if (Config.accessList.noCache) {
1366  } else {
1367  /* unless otherwise specified, we try to cache. */
1369  }
1370 }
1371 
1372 static void
1374 {
1375  ClientRequestContext *calloutContext = (ClientRequestContext *) data;
1376 
1377  if (!calloutContext->httpStateIsValid())
1378  return;
1379 
1380  calloutContext->checkNoCacheDone(answer);
1381 }
1382 
1383 void
1385 {
1386  acl_checklist = NULL;
1387  if (answer.denied()) {
1388  http->request->flags.noCache = true; // dont read reply from cache
1389  http->request->flags.cachable = false; // dont store reply into cache
1390  }
1391  http->doCallouts();
1392 }
1393 
1394 #if USE_OPENSSL
1395 bool
1397 {
1398  if (!http->getConn()) {
1399  http->al->ssl.bumpMode = Ssl::bumpEnd; // SslBump does not apply; log -
1400  return false;
1401  }
1402 
1404  if (http->request->flags.forceTunnel) {
1405  debugs(85, 5, "not needed; already decided to tunnel " << http->getConn());
1406  if (bumpMode != Ssl::bumpEnd)
1407  http->al->ssl.bumpMode = bumpMode; // inherited from bumped connection
1408  return false;
1409  }
1410 
1411  // If SSL connection tunneling or bumping decision has been made, obey it.
1412  if (bumpMode != Ssl::bumpEnd) {
1413  debugs(85, 5, HERE << "SslBump already decided (" << bumpMode <<
1414  "), " << "ignoring ssl_bump for " << http->getConn());
1415 
1416  // We need the following "if" for transparently bumped TLS connection,
1417  // because in this case we are running ssl_bump access list before
1418  // the doCallouts runs. It can be removed after the bug #4340 fixed.
1419  // We do not want to proceed to bumping steps:
1420  // - if the TLS connection with the client is already established
1421  // because we are accepting normal HTTP requests on TLS port,
1422  // or because of the client-first bumping mode
1423  // - When the bumping is already started
1424  if (!http->getConn()->switchedToHttps() &&
1425  !http->getConn()->serverBump())
1426  http->sslBumpNeed(bumpMode); // for processRequest() to bump if needed and not already bumped
1427  http->al->ssl.bumpMode = bumpMode; // inherited from bumped connection
1428  return false;
1429  }
1430 
1431  // If we have not decided yet, decide whether to bump now.
1432 
1433  // Bumping here can only start with a CONNECT request on a bumping port
1434  // (bumping of intercepted SSL conns is decided before we get 1st request).
1435  // We also do not bump redirected CONNECT requests.
1438  !http->getConn()->port->flags.tunnelSslBumping) {
1439  http->al->ssl.bumpMode = Ssl::bumpEnd; // SslBump does not apply; log -
1440  debugs(85, 5, HERE << "cannot SslBump this request");
1441  return false;
1442  }
1443 
1444  // Do not bump during authentication: clients would not proxy-authenticate
1445  // if we delay a 407 response and respond with 200 OK to CONNECT.
1447  http->al->ssl.bumpMode = Ssl::bumpEnd; // SslBump does not apply; log -
1448  debugs(85, 5, HERE << "no SslBump during proxy authentication");
1449  return false;
1450  }
1451 
1452  if (error) {
1453  debugs(85, 5, "SslBump applies. Force bump action on error " << errorTypeName(error->type));
1456  return false;
1457  }
1458 
1459  debugs(85, 5, HERE << "SslBump possible, checking ACL");
1460 
1462  aclChecklist->nonBlockingCheck(sslBumpAccessCheckDoneWrapper, this);
1463  return true;
1464 }
1465 
1470 static void
1472 {
1473  ClientRequestContext *calloutContext = static_cast<ClientRequestContext *>(data);
1474 
1475  if (!calloutContext->httpStateIsValid())
1476  return;
1477  calloutContext->sslBumpAccessCheckDone(answer);
1478 }
1479 
1480 void
1482 {
1483  if (!httpStateIsValid())
1484  return;
1485 
1486  const Ssl::BumpMode bumpMode = answer.allowed() ?
1487  static_cast<Ssl::BumpMode>(answer.kind) : Ssl::bumpSplice;
1488  http->sslBumpNeed(bumpMode); // for processRequest() to bump if needed
1489  http->al->ssl.bumpMode = bumpMode; // for logging
1490 
1491  if (bumpMode == Ssl::bumpTerminate) {
1493  if (Comm::IsConnOpen(clientConn)) {
1494  debugs(85, 3, "closing after Ssl::bumpTerminate ");
1495  clientConn->close();
1496  }
1497  return;
1498  }
1499 
1500  http->doCallouts();
1501 }
1502 #endif
1503 
1504 /*
1505  * Identify requests that do not go through the store and client side stream
1506  * and forward them to the appropriate location. All other requests, request
1507  * them.
1508  */
1509 void
1511 {
1512  debugs(85, 4, request->method << ' ' << uri);
1513 
1514  const bool untouchedConnect = request->method == Http::METHOD_CONNECT && !redirect.status;
1515 
1516 #if USE_OPENSSL
1517  if (untouchedConnect && sslBumpNeeded()) {
1519  sslBumpStart();
1520  return;
1521  }
1522 #endif
1523 
1524  if (untouchedConnect || request->flags.forceTunnel) {
1525  getConn()->stopReading(); // tunnels read for themselves
1526  tunnelStart(this);
1527  return;
1528  }
1529 
1530  httpStart();
1531 }
1532 
1533 void
1535 {
1538  debugs(85, 4, logType.c_str() << " for '" << uri << "'");
1539 
1540  /* no one should have touched this */
1541  assert(out.offset == 0);
1542  /* Use the Stream Luke */
1544  clientStreamRead(node, this, node->readBuffer);
1546 }
1547 
1548 #if USE_OPENSSL
1549 
1550 void
1552 {
1553  debugs(83, 3, HERE << "sslBump required: "<< Ssl::bumpMode(mode));
1554  sslBumpNeed_ = mode;
1555 }
1556 
1557 // called when comm_write has completed
1558 static void
1559 SslBumpEstablish(const Comm::ConnectionPointer &, char *, size_t, Comm::Flag errflag, int, void *data)
1560 {
1561  ClientHttpRequest *r = static_cast<ClientHttpRequest*>(data);
1562  debugs(85, 5, HERE << "responded to CONNECT: " << r << " ? " << errflag);
1563 
1564  assert(r && cbdataReferenceValid(r));
1565  r->sslBumpEstablish(errflag);
1566 }
1567 
1568 void
1570 {
1571  // Bail out quickly on Comm::ERR_CLOSING - close handlers will tidy up
1572  if (errflag == Comm::ERR_CLOSING)
1573  return;
1574 
1575  if (errflag) {
1576  debugs(85, 3, HERE << "CONNECT response failure in SslBump: " << errflag);
1578  return;
1579  }
1580 
1581  // We lack HttpReply which logRequest() uses to log the status code.
1582  // TODO: Use HttpReply instead of the "200 Connection established" string.
1583  al->http.code = 200;
1584 
1585 #if USE_AUTH
1586  // Preserve authentication info for the ssl-bumped request
1587  if (request->auth_user_request != NULL)
1588  getConn()->setAuth(request->auth_user_request, "SSL-bumped CONNECT");
1589 #endif
1590 
1591  assert(sslBumpNeeded());
1593 }
1594 
1595 void
1597 {
1598  debugs(85, 5, HERE << "Confirming " << Ssl::bumpMode(sslBumpNeed_) <<
1599  "-bumped CONNECT tunnel on FD " << getConn()->clientConnection);
1601 
1602  AsyncCall::Pointer bumpCall = commCbCall(85, 5, "ClientSocketContext::sslBumpEstablish",
1604 
1606  CommIoCbParams &params = GetCommParams<CommIoCbParams>(bumpCall);
1607  params.flag = Comm::OK;
1608  params.conn = getConn()->clientConnection;
1609  ScheduleCallHere(bumpCall);
1610  return;
1611  }
1612 
1613  // send an HTTP 200 response to kick client SSL negotiation
1614  // TODO: Unify with tunnel.cc and add a Server(?) header
1615  static const char *const conn_established = "HTTP/1.1 200 Connection established\r\n\r\n";
1616  Comm::Write(getConn()->clientConnection, conn_established, strlen(conn_established), bumpCall, NULL);
1617 }
1618 
1619 #endif
1620 
1621 bool
1623 {
1625  int64_t contentLength =
1627  assert(contentLength >= 0);
1628 
1629  if (out.offset < contentLength)
1630  return false;
1631 
1632  return true;
1633 }
1634 
1635 void
1637 {
1638  entry_ = newEntry;
1639 }
1640 
1641 void
1643 {
1644  if (loggingEntry_)
1645  loggingEntry_->unlock("ClientHttpRequest::loggingEntry");
1646 
1647  loggingEntry_ = newEntry;
1648 
1649  if (loggingEntry_)
1650  loggingEntry_->lock("ClientHttpRequest::loggingEntry");
1651 }
1652 
1653 /*
1654  * doCallouts() - This function controls the order of "callout"
1655  * executions, including non-blocking access control checks, the
1656  * redirector, and ICAP. Previously, these callouts were chained
1657  * together such that "clientAccessCheckDone()" would call
1658  * "clientRedirectStart()" and so on.
1659  *
1660  * The ClientRequestContext (aka calloutContext) class holds certain
1661  * state data for the callout/callback operations. Previously
1662  * ClientHttpRequest would sort of hand off control to ClientRequestContext
1663  * for a short time. ClientRequestContext would then delete itself
1664  * and pass control back to ClientHttpRequest when all callouts
1665  * were finished.
1666  *
1667  * This caused some problems for ICAP because we want to make the
1668  * ICAP callout after checking ACLs, but before checking the no_cache
1669  * list. We can't stuff the ICAP state into the ClientRequestContext
1670  * class because we still need the ICAP state after ClientRequestContext
1671  * goes away.
1672  *
1673  * Note that ClientRequestContext is created before the first call
1674  * to doCallouts().
1675  *
1676  * If one of the callouts notices that ClientHttpRequest is no
1677  * longer valid, it should call cbdataReferenceDone() so that
1678  * ClientHttpRequest's reference count goes to zero and it will get
1679  * deleted. ClientHttpRequest will then delete ClientRequestContext.
1680  *
1681  * Note that we set the _done flags here before actually starting
1682  * the callout. This is strictly for convenience.
1683  */
1684 
1687 
1688 void
1690 {
1692 
1693  auto &ale = calloutContext->http->al;
1694  /*Save the original request for logging purposes*/
1695  if (!ale->request) {
1696  ale->request = request;
1697  HTTPMSGLOCK(ale->request);
1698 
1699  // Make the previously set client connection ID available as annotation.
1700  if (ConnStateData *csd = calloutContext->http->getConn()) {
1701  if (!csd->notes()->empty())
1702  calloutContext->http->request->notes()->appendNewOnly(csd->notes().getRaw());
1703  }
1704  ale->syncNotes(calloutContext->http->request);
1705  }
1706 
1707  if (!calloutContext->error) {
1708  // CVE-2009-0801: verify the Host: header is consistent with other known details.
1710  debugs(83, 3, HERE << "Doing calloutContext->hostHeaderVerify()");
1713  return;
1714  }
1715 
1717  debugs(83, 3, HERE << "Doing calloutContext->clientAccessCheck()");
1720  return;
1721  }
1722 
1723 #if USE_ADAPTATION
1728  request, NULL, calloutContext->http->al, this))
1729  return; // will call callback
1730  }
1731 #endif
1732 
1733  if (!calloutContext->redirect_done) {
1734  calloutContext->redirect_done = true;
1735 
1736  if (Config.Program.redirect) {
1737  debugs(83, 3, HERE << "Doing calloutContext->clientRedirectStart()");
1740  return;
1741  }
1742  }
1743 
1745  debugs(83, 3, HERE << "Doing calloutContext->clientAccessCheck2()");
1748  return;
1749  }
1750 
1751  if (!calloutContext->store_id_done) {
1752  calloutContext->store_id_done = true;
1753 
1754  if (Config.Program.store_id) {
1755  debugs(83, 3,"Doing calloutContext->clientStoreIdStart()");
1758  return;
1759  }
1760  }
1761 
1763  debugs(83, 3, HERE << "Doing clientInterpretRequestHeaders()");
1766  }
1767 
1768  if (!calloutContext->no_cache_done) {
1769  calloutContext->no_cache_done = true;
1770 
1772  debugs(83, 3, HERE << "Doing calloutContext->checkNoCache()");
1774  return;
1775  }
1776  }
1777  } // if !calloutContext->error
1778 
1784  ch.my_addr = request->my_addr;
1785  tos_t tos = aclMapTOS(Ip::Qos::TheConfig.tosToClient, &ch);
1786  if (tos)
1788  }
1789  }
1790 
1796  ch.my_addr = request->my_addr;
1797  nfmark_t mark = aclMapNfmark(Ip::Qos::TheConfig.nfmarkToClient, &ch);
1798  if (mark)
1800  }
1801  }
1802 
1803 #if USE_OPENSSL
1804  // Even with calloutContext->error, we call sslBumpAccessCheck() to decide
1805  // whether SslBump applies to this transaction. If it applies, we will
1806  // attempt to bump the client to serve the error.
1810  return;
1811  /* else no ssl bump required*/
1812  }
1813 #endif
1814 
1815  if (calloutContext->error) {
1816  // XXX: prformance regression. c_str() reallocates
1817  SBuf storeUriBuf(request->storeId());
1818  const char *storeUri = storeUriBuf.c_str();
1819  StoreEntry *e = storeCreateEntry(storeUri, storeUri, request->flags, request->method);
1820 #if USE_OPENSSL
1821  if (sslBumpNeeded()) {
1822  // We have to serve an error, so bump the client first.
1824  // set final error but delay sending until we bump
1828  getConn()->setServerBump(srvBump);
1829  e->unlock("ClientHttpRequest::doCallouts+sslBumpNeeded");
1830  } else
1831 #endif
1832  {
1833  // send the error to the client now
1835  clientReplyContext *repContext = dynamic_cast<clientReplyContext *>(node->data.getRaw());
1836  assert (repContext);
1837  repContext->setReplyToStoreEntry(e, "immediate SslBump error");
1841  getConn()->flags.readMore = true; // resume any pipeline reads.
1843  clientStreamRead(node, this, node->readBuffer);
1844  e->unlock("ClientHttpRequest::doCallouts-sslBumpNeeded");
1845  return;
1846  }
1847  }
1848 
1850  delete calloutContext;
1851  calloutContext = NULL;
1852 #if HEADERS_LOG
1853 
1854  headersLog(0, 1, request->method, request);
1855 #endif
1856 
1857  debugs(83, 3, HERE << "calling processRequest()");
1858  processRequest();
1859 
1860 #if ICAP_CLIENT
1862  if (ih != NULL)
1863  ih->logType = logType;
1864 #endif
1865 }
1866 
1867 #if USE_ADAPTATION
1868 void
1871 {
1872  debugs(85, 3, HERE << "adaptation needed for " << this);
1876  new Adaptation::Iterator(request, NULL, al, g));
1877 
1878  // we could try to guess whether we can bypass this adaptation
1879  // initiation failure, but it should not really happen
1881 }
1882 
1883 void
1885 {
1886  assert(cbdataReferenceValid(this)); // indicates bug
1889 
1890  switch (answer.kind) {
1892  handleAdaptedHeader(const_cast<Http::Message*>(answer.message.getRaw()));
1893  break;
1894 
1896  handleAdaptationBlock(answer);
1897  break;
1898 
1901  break;
1902  }
1903 }
1904 
1905 void
1907 {
1908  assert(msg);
1909 
1910  if (HttpRequest *new_req = dynamic_cast<HttpRequest*>(msg)) {
1911  /*
1912  * Replace the old request with the new request.
1913  */
1915  request = new_req;
1917 
1918  // update the new message to flag whether URL re-writing was done on it
1919  if (request->effectiveRequestUri().cmp(uri) != 0)
1920  request->flags.redirected = 1;
1921 
1922  /*
1923  * Store the new URI for logging
1924  */
1925  xfree(uri);
1928  assert(request->method.id());
1929  } else if (HttpReply *new_rep = dynamic_cast<HttpReply*>(msg)) {
1930  debugs(85,3,HERE << "REQMOD reply is HTTP reply");
1931 
1932  // subscribe to receive reply body
1933  if (new_rep->body_pipe != NULL) {
1934  adaptedBodySource = new_rep->body_pipe;
1935  int consumer_ok = adaptedBodySource->setConsumerIfNotLate(this);
1936  assert(consumer_ok);
1937  }
1938 
1940  clientReplyContext *repContext = dynamic_cast<clientReplyContext *>(node->data.getRaw());
1941  assert(repContext);
1942  repContext->createStoreEntry(request->method, request->flags);
1943 
1947  storeEntry()->replaceHttpReply(new_rep);
1949 
1950  if (!adaptedBodySource) // no body
1951  storeEntry()->complete();
1952  clientGetMoreData(node, this);
1953  }
1954 
1955  // we are done with getting headers (but may be receiving body)
1957 
1959  doCallouts();
1960 }
1961 
1962 void
1964 {
1966  AclMatchedName = answer.ruleId.termedBuf();
1969  AclMatchedName = NULL;
1970 }
1971 
1972 void
1974 {
1975  if (!adaptedBodySource)
1976  return;
1977 
1979 }
1980 
1981 void
1983 {
1986 
1987  if (size_t contentSize = adaptedBodySource->buf().contentSize()) {
1988  const size_t spaceAvailable = storeEntry()->bytesWanted(Range<size_t>(0,contentSize));
1989 
1990  if (spaceAvailable < contentSize ) {
1991  // No or partial body data consuming
1992  typedef NullaryMemFunT<ClientHttpRequest> Dialer;
1993  AsyncCall::Pointer call = asyncCall(93, 5, "ClientHttpRequest::resumeBodyStorage",
1994  Dialer(this, &ClientHttpRequest::resumeBodyStorage));
1995  storeEntry()->deferProducer(call);
1996  }
1997 
1998  if (!spaceAvailable)
1999  return;
2000 
2001  if (spaceAvailable < contentSize )
2002  contentSize = spaceAvailable;
2003 
2005  const StoreIOBuffer ioBuf(&bpc.buf, request_satisfaction_offset, contentSize);
2006  storeEntry()->write(ioBuf);
2007  // assume StoreEntry::write() writes the entire ioBuf
2009  bpc.buf.consume(contentSize);
2010  bpc.checkIn();
2011  }
2012 
2015  // else wait for more body data
2016 }
2017 
2018 void
2020 {
2022  // should we end request satisfaction now?
2025 }
2026 
2027 void
2029 {
2030  debugs(85,4, HERE << this << " ends request satisfaction");
2033 
2034  // TODO: anything else needed to end store entry formation correctly?
2035  storeEntry()->complete();
2036 }
2037 
2038 void
2040 {
2043 
2044  debugs(85,3, HERE << "REQMOD body production failed");
2045  if (request_satisfaction_mode) { // too late to recover or serve an error
2048  Must(Comm::IsConnOpen(c));
2049  c->close(); // drastic, but we may be writing a response already
2050  } else {
2052  }
2053 }
2054 
2055 void
2056 ClientHttpRequest::handleAdaptationFailure(int errDetail, bool bypassable)
2057 {
2058  debugs(85,3, HERE << "handleAdaptationFailure(" << bypassable << ")");
2059 
2060  const bool usedStore = storeEntry() && !storeEntry()->isEmpty();
2061  const bool usedPipe = request->body_pipe != NULL &&
2062  request->body_pipe->consumedSize() > 0;
2063 
2064  if (bypassable && !usedStore && !usedPipe) {
2065  debugs(85,3, HERE << "ICAP REQMOD callout failed, bypassing: " << calloutContext);
2066  if (calloutContext)
2067  doCallouts();
2068  return;
2069  }
2070 
2071  debugs(85,3, HERE << "ICAP REQMOD callout failed, responding with error");
2072 
2074  clientReplyContext *repContext = dynamic_cast<clientReplyContext *>(node->data.getRaw());
2075  assert(repContext);
2076 
2077  calloutsError(ERR_ICAP_FAILURE, errDetail);
2078 
2079  if (calloutContext)
2080  doCallouts();
2081 }
2082 
2083 void
2084 ClientHttpRequest::callException(const std::exception &ex)
2085 {
2086  if (const auto clientConn = getConn() ? getConn()->clientConnection : nullptr) {
2088  debugs(85, 3, "closing after exception: " << ex.what());
2089  clientConn->close(); // initiate orderly top-to-bottom cleanup
2090  return;
2091  }
2092  }
2093  debugs(85, DBG_IMPORTANT, "ClientHttpRequest exception without connection. Ignoring " << ex.what());
2094  // XXX: Normally, we mustStop() but we cannot do that here because it is
2095  // likely to leave Http::Stream and ConnStateData with a dangling http
2096  // pointer. See r13480 or XXX in Http::Stream class description.
2097 }
2098 #endif
2099 
2100 // XXX: modify and use with ClientRequestContext::clientAccessCheckDone too.
2101 void
2103 {
2104  // The original author of the code also wanted to pass an errno to
2105  // setReplyToError, but it seems unlikely that the errno reflects the
2106  // true cause of the error at this point, so I did not pass it.
2107  if (calloutContext) {
2108  Ip::Address noAddr;
2109  noAddr.setNoAddr();
2110  ConnStateData * c = getConn();
2112  NULL,
2113  c != NULL ? c->clientConnection->remote : noAddr,
2114  request
2115  );
2116 #if USE_AUTH
2118  c != NULL && c->getAuth() != NULL ? c->getAuth() : request->auth_user_request;
2119 #endif
2120  calloutContext->error->detailError(errDetail);
2122  if (c != NULL)
2123  c->expectNoForwarding();
2124  }
2125  //else if(calloutContext == NULL) is it possible?
2126 }
2127 
iterates services in ServiceGroup, starting adaptation launchers
Definition: Iterator.h:31
bool switchedToHttps() const
Definition: client_side.h:252
void recordLookup(const Dns::LookupDetails &detail)
Definition: HttpRequest.cc:587
int delById(Http::HdrType id)
Definition: HttpHeader.cc:672
void nonBlockingCheck(ACLCB *callback, void *callback_data)
Definition: Checklist.cc:238
summarizes adaptation service answer for the noteAdaptationAnswer() API
Definition: Answer.h:22
AnyP::ProtocolVersion ProtocolVersion(unsigned int aMajor, unsigned int aMinor)
HTTP version label information.
static void sslBumpAccessCheckDoneWrapper(allow_t, void *)
static void clientInterpretRequestHeaders(ClientHttpRequest *http)
int has(Http::HdrType id) const
Definition: HttpHeader.cc:1002
bool interceptTproxy
Set for requests handled by a "tproxy" port.
Definition: RequestFlags.h:68
void redirectStart(ClientHttpRequest *http, HLPCB *handler, void *data)
Definition: redirect.cc:288
err_type errType
Definition: HttpRequest.h:149
void setAuth(const Auth::UserRequest::Pointer &aur, const char *cause)
Definition: client_side.cc:503
#define fd_table
Definition: fde.h:157
Ssl::ServerBump * serverBump()
Definition: client_side.h:253
ConnStateData * pinnedConnection()
Definition: HttpRequest.cc:654
CbcPointer< Initiate > initiateAdaptation(Initiate *x)
< starts freshly created initiate and returns a safe pointer to it
Definition: Initiator.cc:23
SQUIDCEXTERN CSD clientReplyDetach
ClientHttpRequest * http
HttpHdrRange * range
Definition: HttpRequest.h:131
#define assert(EX)
Definition: assert.h:17
Ip::Address my_addr
Definition: HttpRequest.h:143
void clientStreamInit(dlink_list *list, CSR *func, CSD *rdetach, CSS *readstatus, ClientStreamData readdata, CSCB *callback, CSD *cdetach, ClientStreamData callbackdata, StoreIOBuffer tailBuffer)
String ruleId
ACL (or similar rule) name that blocked forwarding.
Definition: Answer.h:40
static void checkFailureRatio(err_type, hier_code)
bool hierarchical
Definition: RequestFlags.h:34
int neighbors_do_private_keys
#define HttpHeaderInitPos
Definition: HttpHeader.h:48
ConnStateData * getConn() const
#define cbdataReferenceDone(var)
Definition: cbdata.h:350
nfmark_t aclMapNfmark(acl_nfmark *head, ACLChecklist *ch)
Checks for a netfilter mark value to apply depending on the ACL.
Definition: FwdState.cc:1282
static HLPCB clientRedirectDoneWrapper
wordlist * store_id
Definition: SquidConfig.h:191
void UpdateRequestNotes(ConnStateData *csd, HttpRequest &request, NotePairs const &helperNotes)
Definition: HttpRequest.cc:689
HttpHdrCc * cache_control
Definition: Message.h:76
int unlock(const char *context)
Definition: store.cc:485
void fd_note(int fd, const char *s)
Definition: fd.cc:251
Ssl::BumpMode sslBumpNeed() const
returns raw sslBump mode value
struct ClientHttpRequest::Redirect redirect
bool loopDetected
Definition: RequestFlags.h:36
virtual void noteBodyProducerAborted(BodyPipe::Pointer)
Definition: Acl.h:113
bool timestampsSet()
Definition: store.cc:1525
Definition: SBuf.h:87
static uint32 B
Definition: md4.c:43
virtual void noteBodyProductionEnded(BodyPipe::Pointer)
#define xcalloc
Definition: membanger.c:57
#define REDIRECT_NONE
Definition: defines.h:87
Ip::Address src_addr
void checkNoCacheDone(const allow_t &answer)
Comm::ConnectionPointer clientConnection
int log_uses_indirect_client
Definition: SquidConfig.h:328
acl_access * redirector
Definition: SquidConfig.h:373
void consume(mb_size_t sz)
removes sz bytes and "packs" by moving content left
Definition: MemBuf.cc:180
ACLFilledChecklist * Filled(ACLChecklist *checklist)
convenience and safety wrapper for dynamic_cast<ACLFilledChecklist*>
HttpRequestMethod method
Definition: HttpRequest.h:102
void setLogUri(ClientHttpRequest *http, char const *uri, bool cleanUrl)
const MemBuf & buf() const
Definition: BodyPipe.h:137
#define SQUIDCEXTERN
Definition: squid.h:26
struct _request * request(char *urlin)
Definition: tcp-banger2.c:291
void error(char *format,...)
Http::MessagePointer message
HTTP request or response to forward.
Definition: Answer.h:39
bool initiated(const CbcPointer< AsyncJob > &job) const
Must(initiated(initiate)) instead of Must(initiate.set()), for clarity.
Definition: Initiator.h:52
int bumpMode
whether and how the request was SslBumped
#define xstrdup
ClientHttpRequest(ConnStateData *csd)
bool parse(const HttpRequestMethod &, const char *url)
Definition: url.cc:191
struct timeval start_time
The time the master transaction started.
void announceInitiatorAbort(CbcPointer< Initiate > &x)
inform the transaction about abnormal termination and clear the pointer
Definition: Initiator.cc:38
#define safe_free(x)
Definition: xalloc.h:73
bool exhausted() const
Definition: BodyPipe.cc:174
const char * bumpMode(int bm)
Definition: support.h:139
int64_t bodySize(const HttpRequestMethod &) const
Definition: HttpReply.cc:361
Definition: Flag.h:16
int clientBeginRequest(const HttpRequestMethod &method, char const *url, CSCB *streamcallback, CSD *streamdetach, ClientStreamData streamdata, HttpHeader const *header, char *tailbuf, size_t taillen, const MasterXaction::Pointer &mx)
Definition: Range.h:18
static void hostHeaderIpVerifyWrapper(const ipcache_addrs *ia, const Dns::LookupDetails &dns, void *data)
void port(unsigned short p)
Definition: URL.h:74
encapsulates DNS lookup results
Definition: LookupDetails.h:20
void HTTPMSGLOCK(Http::Message *a)
Definition: Message.h:154
void calloutsError(const err_type error, const int errDetail)
Build an error reply. For use with the callouts.
void handleAdaptedHeader(Http::Message *msg)
void appendNewOnly(const NotePairs *src)
Definition: Notes.cc:347
HttpHeaderEntry * getEntry(HttpHeaderPos *pos) const
Definition: HttpHeader.cc:589
virtual void noteAdaptationAclCheckDone(Adaptation::ServiceGroupPointer group)
int matchDomainName(const char *h, const char *d, uint flags)
Definition: url.cc:660
Comm::ConnectionPointer tcpClient
TCP/IP level details about the client connection.
AnyP::ProtocolVersion http_ver
Definition: Message.h:72
#define xisspace(x)
Definition: xis.h:17
HttpHdrRange * getRange() const
Definition: HttpHeader.cc:1263
#define DBG_CRITICAL
Definition: Debug.h:44
Auth::UserRequest::Pointer auth_user_request
Definition: errorpage.h:144
bool doneFollowXff() const
Definition: RequestFlags.h:121
char * p
Definition: membanger.c:43
wordlist * redirect
Definition: SquidConfig.h:190
int conn
the current server connection FD
Definition: Transport.cc:26
time_t ims
Definition: HttpRequest.h:133
bool done_follow_x_forwarded_for
Definition: RequestFlags.h:101
void clientStreamRead(clientStreamNode *thisObject, ClientHttpRequest *http, StoreIOBuffer readBuffer)
bool hostVerified
Definition: RequestFlags.h:66
void SBufToCstring(char *d, const SBuf &s)
Definition: SBuf.h:743
Ip::Address log_addr
Definition: client_side.h:127
struct timeval current_time
Definition: stub_time.cc:15
void startAdaptation(const Adaptation::ServiceGroupPointer &g)
Initiate an asynchronous adaptation transaction which will call us back.
int aclIsProxyAuth(const char *name)
Definition: Gadgets.cc:74
size_type size() const
Definition: SquidString.h:71
iterator end()
const SBuf storeId()
Definition: HttpRequest.cc:662
time_t squid_curtime
Definition: stub_time.cc:17
Comm::ConnectionPointer serverConnection
Definition: client_side.h:134
void replaceHttpReply(HttpReply *, bool andStartWriting=true)
Definition: store.cc:1854
no adapted message will come; see bypassable
Definition: Answer.h:29
bool readMore
needs comm_read (for this request or new requests)
Definition: client_side.h:130
uint64_t consumedSize() const
Definition: BodyPipe.h:111
int64_t lowestOffset(int64_t) const
Definition: URL.h:24
void host(const char *src)
Definition: url.cc:47
HttpHdrRangeIter range_iter
bool connectionAuth
Definition: RequestFlags.h:78
void userInfo(const SBuf &s)
Definition: URL.h:66
AsyncCall * asyncCall(int aDebugSection, int aDebugLevel, const char *aName, const Dialer &aDialer)
Definition: AsyncCall.h:156
Helper::ResultCode result
The helper response 'result' field.
Definition: Reply.h:58
MemObject * memObject() const
virtual void complete()
Definition: store.cc:1088
unsigned char tos_t
Definition: forward.h:26
Http::HdrType id
Definition: HttpHeader.h:63
static const char *const conn_established
Definition: tunnel.cc:240
size_t appendDomainLen
Definition: SquidConfig.h:212
bool readNextRequest
whether Squid should read after error handling
void fvdbCountVia(const char *key)
int gopherCachable(const HttpRequest *req)
Definition: gopher.cc:295
NotePairs::Pointer notes()
Definition: HttpRequest.cc:681
ACLFilledChecklist * clientAclChecklistCreate(const acl_access *acl, ClientHttpRequest *http)
static const char *const crlf
void setNoAddr()
Definition: Address.cc:285
void HLPCB(void *, const Helper::Reply &)
Definition: forward.h:27
Comm::ConnectionPointer conn
Definition: CommCalls.h:85
bool IsConnOpen(const Comm::ConnectionPointer &conn)
Definition: Connection.cc:24
acl_access * followXFF
Definition: SquidConfig.h:387
void const char HLPCB void * data
Definition: stub_helper.cc:16
NotePairs notes
Definition: Reply.h:61
int64_t offset
Definition: StoreIOBuffer.h:55
LogTags logType
the processing tags associated with this request transaction.
Definition: parse.c:104
iterator begin()
StatusCode
Definition: StatusCode.h:20
bool have(const Ip::Address &ip, size_t *position=nullptr) const
Definition: ipcache.cc:974
String store_id
Definition: HttpRequest.h:127
int64_t content_length
Definition: Message.h:83
void setConn(ConnStateData *aConn)
int reload_into_ims
Definition: SquidConfig.h:291
struct SquidConfig::UrlHelperTimeout onUrlRewriteTimeout
#define debugs(SECTION, LEVEL, CONTENT)
Definition: Debug.h:123
#define cbdataReference(var)
Definition: cbdata.h:341
unsigned short defaultPort() const
Definition: UriScheme.cc:52
StoreEntry * storeCreateEntry(const char *url, const char *logUrl, const RequestFlags &flags, const HttpRequestMethod &method)
Definition: store.cc:800
void stopReading()
cancels Comm::Read() if it is scheduled
Definition: Server.cc:56
#define DBG_IMPORTANT
Definition: Debug.h:45
char const * rawBuf() const
Definition: SquidString.h:84
struct SquidConfig::@99 Port
bool hasNoCache(const String **val=nullptr) const
Definition: HttpHdrCc.h:89
static void SslBumpEstablish(const Comm::ConnectionPointer &, char *, size_t, Comm::Flag errflag, int, void *data)
bool connectionAuthDisabled
Definition: RequestFlags.h:80
void expectNoForwarding()
cleans up virgin request [body] forwarding state
virtual HttpRequest * clone() const
Definition: HttpRequest.cc:176
Ip::Address client_addr
Definition: HttpRequest.h:137
#define EBIT_CLR(flag, bit)
Definition: defines.h:106
void CSCB(clientStreamNode *, ClientHttpRequest *, HttpReply *, StoreIOBuffer)
client stream read callback
AnyP::UriScheme const & getScheme() const
Definition: URL.h:58
static void clientAccessCheckDoneWrapper(allow_t, void *)
bool connectionProxyAuth
Definition: RequestFlags.h:83
char const * termedBuf() const
Definition: SquidString.h:90
int kind
which custom access list verb matched
Definition: Acl.h:153
const char * c_str() const
compute the status access.log field
Definition: LogTags.cc:47
String getList(Http::HdrType id) const
Definition: HttpHeader.cc:819
bool onlyIfCached() const
StoreEntry * storeEntry() const
unsigned short icp
Definition: SquidConfig.h:131
const SBuf & effectiveRequestUri() const
RFC 7230 section 5.5 - Effective Request URI.
Definition: HttpRequest.cc:673
common parts of HttpRequest and HttpReply
Definition: Message.h:24
Config TheConfig
Globally available instance of Qos::Config.
Definition: QosConfig.cc:207
int strListIsSubstr(const String *list, const char *s, char del)
Definition: StrList.cc:54
void * addr
Definition: membanger.c:46
void handleAdaptationBlock(const Adaptation::Answer &answer)
CbcPointer< ConnStateData > clientConnectionManager
Definition: HttpRequest.h:218
struct SquidConfig::@113 accessList
HttpRequest * request
bool allowed() const
Definition: Acl.h:141
BodyPipe::Pointer adaptedBodySource
Http::StatusCode httpStatus
Definition: errorpage.h:142
bool setConsumerIfNotLate(const Consumer::Pointer &aConsumer)
Definition: BodyPipe.cc:228
const char * c_str()
Definition: SBuf.cc:546
bool conflicted() const
whether Squid is uncertain about the allowed() or denied() answer
Definition: Acl.h:150
ClientStreamData data
Definition: clientStream.h:94
AccessLogEntry::Pointer al
access.log entry
void ipcache_nbgethostbyname(const char *name, IPH *handler, void *handlerData)
Definition: ipcache.cc:600
void resumeBodyStorage()
called by StoreEntry when it has more buffer space available
const char * AclMatchedName
Definition: Acl.cc:30
class AccessLogEntry::HttpDetails http
bool update(HttpHeader const *fresh)
Definition: HttpHeader.cc:280
ClientRequestContext * calloutContext
static int port
Definition: ldap_backend.cc:69
void tunnelStart(ClientHttpRequest *)
Definition: tunnel.cc:1084
ErrorState * clientBuildError(err_type, Http::StatusCode, char const *url, Ip::Address &, HttpRequest *)
URL url
the request URI
Definition: HttpRequest.h:103
int hasListMember(Http::HdrType id, const char *member, const char separator) const
Definition: HttpHeader.cc:1665
void cut(size_type newLength)
Definition: String.cc:236
String x_forwarded_for_iterator
Definition: HttpRequest.h:176
Security::CertPointer sslClientCert
cert received from the client
struct ClientHttpRequest::Out out
static HttpRequest * FromUrl(const char *url, const MasterXaction::Pointer &, const HttpRequestMethod &method=Http::METHOD_GET)
Definition: HttpRequest.cc:523
void ignoreRange(const char *reason)
forgets about the cached Range header (for a reason)
Definition: HttpRequest.cc:628
acl_access * adapted_http
Definition: SquidConfig.h:356
std::ostream & HERE(std::ostream &s)
Definition: Debug.h:147
class AccessLogEntry::CacheDetails cache
ssize_t HttpHeaderPos
Definition: HttpHeader.h:45
struct SquidConfig::@112 onoff
static uint32 A
Definition: md4.c:43
void handleAdaptationFailure(int errDetail, bool bypassable=false)
class AccessLogEntry::SslDetails ssl
char const * denyMessage(char const *const default_message=NULL) const
Definition: UserRequest.cc:127
unsigned short port() const
Definition: Address.cc:786
#define FAILURE_MODE_TIME
acl_access * noCache
Definition: SquidConfig.h:362
mb_size_t contentSize() const
available data size
Definition: MemBuf.h:47
Flag
Definition: Flag.h:15
#define Must(cond)
Definition: TextException.h:89
Ip::Address local
Definition: Connection.h:135
HttpHeader header
Definition: Message.h:74
bool accelerated
Definition: RequestFlags.h:60
Http::MethodType id() const
Definition: RequestMethod.h:73
bool final
whether the error, if any, cannot be bypassed
Definition: Answer.h:41
Ssl::BumpMode sslBumpNeed_
whether (and how) the request needs to be bumped
AclDenyInfoList * denyInfoList
Definition: SquidConfig.h:403
struct SquidConfig::@104 Program
char rfc931[USER_IDENT_SZ]
Definition: Connection.h:155
RequestFlags flags
Definition: HttpRequest.h:129
#define REDIRECT_DONE
Definition: defines.h:89
Adaptation::Icap::History::Pointer icapHistory() const
Returns possibly nil history, creating it if icap logging is enabled.
Definition: HttpRequest.cc:399
ClientRequestContext(ClientHttpRequest *)
bool maybeCacheable()
Definition: HttpRequest.cc:538
void setServerBump(Ssl::ServerBump *srvBump)
Definition: client_side.h:254
virtual void noteMoreBodyDataAvailable(BodyPipe::Pointer)
err_type type
Definition: errorpage.h:139
Ip::Address remote
Definition: Connection.h:138
void Comm::ConnectionPointer & clientConn
Definition: stub_tunnel.cc:19
hier_code
Definition: hier_code.h:12
#define ScheduleCallHere(call)
Definition: AsyncCall.h:166
void httpRequestPack(void *obj, Packable *p)
Definition: HttpRequest.cc:371
StoreEntry * loggingEntry_
int acl_uses_indirect_client
Definition: SquidConfig.h:326
virtual void write(StoreIOBuffer)
Definition: store.cc:822
bool intercepted
Definition: RequestFlags.h:64
bool sslBumpNeeded() const
returns true if and only if the request needs to be bumped
#define PROF_start(probename)
Definition: Profiler.h:62
StoreIOBuffer readBuffer
Definition: clientStream.h:95
bool isOpen() const
Definition: Connection.h:87
bool respMaybeCacheable() const
AnyP::PortCfgPointer port
Kind kind
the type of the answer
Definition: Answer.h:42
#define CBDATA_CLASS_INIT(type)
Definition: cbdata.h:318
void detailError(err_type aType, int aDetail)
sets error detail if no earlier detail was available
Definition: HttpRequest.cc:456
forward the supplied adapted HTTP message
Definition: Answer.h:27
struct ClientHttpRequest::Flags flags
Comm::Flag flag
comm layer result status.
Definition: CommCalls.h:87
CbcPointer< Adaptation::Initiate > virginHeadSource
double request_failure_ratio
bool denied() const
Definition: Acl.h:147
static void clientStoreIdAccessCheckDone(allow_t answer, void *data)
static int clientHierarchical(ClientHttpRequest *http)
block or deny the master xaction; see authority
Definition: Answer.h:28
void(* ObjPackMethod)(void *obj, Packable *p)
Definition: tools.h:33
struct ConnStateData::@39 flags
size_t HttpReply *STUB StoreEntry const KeyScope scope const HttpRequestMethod & method
Definition: stub_store.cc:126
static bool Start(Method method, VectPoint vp, HttpRequest *req, HttpReply *rep, AccessLogEntry::Pointer &al, Adaptation::Initiator *initiator)
Definition: AccessCheck.cc:30
void syncNotes(HttpRequest *request)
int cmp(const SBuf &S, const size_type n) const
shorthand version for compare()
Definition: SBuf.h:265
ConnStateData * conn_
void stopConsumingFrom(RefCount< BodyPipe > &)
Definition: BodyPipe.cc:118
void storeIdStart(ClientHttpRequest *http, HLPCB *handler, void *data)
Definition: redirect.cc:314
Comm::ConnectionPointer clientConnection
Definition: Server.h:97
void hostHeaderIpVerify(const ipcache_addrs *ia, const Dns::LookupDetails &dns)
Auth::UserRequest::Pointer auth_user_request
Definition: HttpRequest.h:115
const char * errorTypeName(err_type err)
Definition: err_type.h:100
time_t getTime(Http::HdrType id) const
Definition: HttpHeader.cc:1186
int setSockNfmark(const Comm::ConnectionPointer &conn, nfmark_t mark)
Definition: QosConfig.cc:522
void errorAppendEntry(StoreEntry *entry, ErrorState *err)
Definition: errorpage.cc:576
clientStream_status_t CSS(clientStreamNode *, ClientHttpRequest *)
int hostStrictVerify
Definition: SquidConfig.h:337
BodyPipe::Pointer body_pipe
optional pipeline to receive message body
Definition: Message.h:97
CommCbFunPtrCallT< Dialer > * commCbCall(int debugSection, int debugLevel, const char *callName, const Dialer &dialer)
Definition: CommCalls.h:342
#define REDIRECT_PENDING
Definition: defines.h:88
int cbdataReferenceValid(const void *p)
Definition: cbdata.cc:412
HttpHdrRange::iterator end
void sslBumpEstablish(Comm::Flag errflag)
Ssl::BumpMode sslBumpMode
ssl_bump decision (Ssl::bumpEnd if n/a).
Definition: client_side.h:272
const HttpReplyPointer & getReply() const
Definition: MemObject.h:55
static void checkNoCacheDoneWrapper(allow_t, void *)
static void clientRedirectAccessCheckDone(allow_t answer, void *data)
void clientRedirectDone(const Helper::Reply &reply)
const char * getStr(Http::HdrType id) const
Definition: HttpHeader.cc:1203
void detailError(int dCode)
set error type-specific detail code
Definition: errorpage.h:96
virtual size_t bytesWanted(Range< size_t > const aRange, bool ignoreDelayPool=false) const
Definition: store.cc:226
time_t hit_only_mode_until
virtual void noteAdaptationAnswer(const Adaptation::Answer &answer)
void deferProducer(const AsyncCall::Pointer &producer)
call back producer when more buffer space is available
Definition: store.cc:350
static void clientCheckPinning(ClientHttpRequest *http)
void clean()
Definition: String.cc:125
void switchToHttps(HttpRequest *request, Ssl::BumpMode bumpServerMode)
BumpMode
Definition: support.h:125
#define PROF_stop(probename)
Definition: Profiler.h:63
ACLChecklist * acl_checklist
struct ConnStateData::@40 pinning
void sslBumpAccessCheckDone(const allow_t &answer)
The callback function for ssl-bump access check list.
int64_t strtoll(const char *nptr, char **endptr, int base)
Definition: strtoll.c:81
virtual bool isEmpty() const
Definition: Store.h:60
HttpHdrRange::iterator pos
void CSD(clientStreamNode *, ClientHttpRequest *)
client stream detach
void CSR(clientStreamNode *, ClientHttpRequest *)
client stream read
void clientAccessCheckDone(const allow_t &answer)
bool hasOnlyIfCached() const
Definition: HttpHdrCc.h:145
StoreEntry * loggingEntry() const
#define xfree
const char * findFirst(const char *noteKey) const
Definition: Notes.cc:263
SQUIDCEXTERN CSR clientGetMoreData
const char * sslGetUserEmail(SSL *ssl)
Definition: support.cc:708
int setSockTos(const Comm::ConnectionPointer &conn, tos_t tos)
Definition: QosConfig.cc:494
acl_access * http
Definition: SquidConfig.h:355
HierarchyLogEntry hier
static void clientFollowXForwardedForCheck(allow_t answer, void *data)
void httpRequestFree(void *data)
Definition: client_side.cc:488
static HLPCB clientStoreIdDoneWrapper
Ip::Address indirect_client_addr
Definition: HttpRequest.h:140
uint32_t nfmark_t
Definition: forward.h:25
C * getRaw() const
Definition: RefCount.h:74
class SquidConfig Config
Definition: SquidConfig.cc:12
tos_t aclMapTOS(acl_tos *head, ACLChecklist *ch)
Checks for a TOS value to apply depending on the ACL.
Definition: FwdState.cc:1270
squidaio_request_t * head
Definition: aiops.cc:127
acl_access * ssl_bump
Definition: SquidConfig.h:384
#define NULL
Definition: types.h:166
const Auth::UserRequest::Pointer & getAuth() const
Definition: client_side.h:114
void hostHeaderVerifyFailed(const char *A, const char *B)
void HTTPMSGUNLOCK(Http::Message *a)
Definition: Message.h:144
SQUIDCEXTERN CSS clientReplyStatus
ErrorState * error
saved error page for centralized/delayed processing
void debugObj(int section, int level, const char *label, void *obj, ObjPackMethod pm)
Definition: tools.cc:900
int refresh_nocache_hack
#define false
Definition: GnuRegex.c:233
void Write(const Comm::ConnectionPointer &conn, const char *buf, int size, AsyncCall::Pointer &callback, FREE *free_func)
Definition: Write.cc:35
void clientStoreIdDone(const Helper::Reply &reply)
err_type
Definition: err_type.h:12
err_type aclGetDenyInfoPage(AclDenyInfoList **head, const char *name, int redirect_allowed)
Definition: Gadgets.cc:40
char * urlCanonicalClean(const HttpRequest *request)
Definition: url.cc:518
MemBuf & buf
Definition: BodyPipe.h:74
bool forceTunnel
whether to forward via TunnelStateData (instead of FwdState)
Definition: RequestFlags.h:113
bool nocacheHack
Definition: RequestFlags.h:58
void fvdbCountForw(const char *key)
void clearAdaptation(CbcPointer< Initiate > &x)
clears the pointer (does not call announceInitiatorAbort)
Definition: Initiator.cc:32
char ThisCache2[RFC2181_MAXHOSTNAMELEN<< 1]
void lock(const char *context)
Definition: store.cc:448
virtual void callException(const std::exception &ex)
called when the job throws during an async call

 

Introduction

Documentation

Support

Miscellaneous

Web Site Translations

Mirrors