client_side_request.cc
Go to the documentation of this file.
1 /*
2  * Copyright (C) 1996-2021 The Squid Software Foundation and contributors
3  *
4  * Squid software is distributed under GPLv2+ license and includes
5  * contributions from numerous individuals and organizations.
6  * Please see the COPYING and CONTRIBUTORS files for details.
7  */
8 
9 /* DEBUG: section 85 Client-side Request Routines */
10 
11 /*
12  * General logic of request processing:
13  *
14  * We run a series of tests to determine if access will be permitted, and to do
15  * any redirection. Then we call into the result clientStream to retrieve data.
16  * From that point on it's up to reply management.
17  */
18 
19 #include "squid.h"
20 #include "acl/FilledChecklist.h"
21 #include "acl/Gadgets.h"
22 #include "anyp/PortCfg.h"
23 #include "base/AsyncJobCalls.h"
24 #include "client_side.h"
25 #include "client_side_reply.h"
26 #include "client_side_request.h"
27 #include "ClientRequestContext.h"
28 #include "clientStream.h"
29 #include "comm/Connection.h"
30 #include "comm/Write.h"
31 #include "error/Detail.h"
32 #include "errorpage.h"
33 #include "fd.h"
34 #include "fde.h"
35 #include "format/Token.h"
36 #include "FwdState.h"
37 #include "gopher.h"
38 #include "helper.h"
39 #include "helper/Reply.h"
40 #include "http.h"
41 #include "http/Stream.h"
42 #include "HttpHdrCc.h"
43 #include "HttpReply.h"
44 #include "HttpRequest.h"
45 #include "ip/NfMarkConfig.h"
46 #include "ip/QosConfig.h"
47 #include "ipcache.h"
48 #include "log/access_log.h"
49 #include "MemObject.h"
50 #include "Parsing.h"
51 #include "proxyp/Header.h"
52 #include "redirect.h"
53 #include "rfc1738.h"
54 #include "sbuf/StringConvert.h"
55 #include "SquidConfig.h"
56 #include "SquidTime.h"
57 #include "Store.h"
58 #include "StrList.h"
59 #include "tools.h"
60 #include "wordlist.h"
61 #if USE_AUTH
62 #include "auth/UserRequest.h"
63 #endif
64 #if USE_ADAPTATION
65 #include "adaptation/AccessCheck.h"
66 #include "adaptation/Answer.h"
67 #include "adaptation/Iterator.h"
68 #include "adaptation/Service.h"
69 #if ICAP_CLIENT
71 #endif
72 #endif
73 #if USE_OPENSSL
74 #include "ssl/ServerBump.h"
75 #include "ssl/support.h"
76 #endif
77 
78 static const char *const crlf = "\r\n";
79 
80 #if FOLLOW_X_FORWARDED_FOR
81 static void clientFollowXForwardedForCheck(Acl::Answer answer, void *data);
82 #endif /* FOLLOW_X_FORWARDED_FOR */
83 
85 
87 
88 /* Local functions */
89 /* other */
90 static void clientAccessCheckDoneWrapper(Acl::Answer, void *);
91 #if USE_OPENSSL
92 static void sslBumpAccessCheckDoneWrapper(Acl::Answer, void *);
93 #endif
94 static int clientHierarchical(ClientHttpRequest * http);
98 static void checkNoCacheDoneWrapper(Acl::Answer, void *);
102 static void checkFailureRatio(err_type, hier_code);
103 
105 {
106  /*
107  * Release our "lock" on our parent, ClientHttpRequest, if we
108  * still have one
109  */
110 
111  if (http)
113 
114  delete error;
115  debugs(85,3, "ClientRequestContext destructed, this=" << this);
116 }
117 
119  http(cbdataReference(anHttp)),
120  acl_checklist(NULL),
121  redirect_state(REDIRECT_NONE),
122  store_id_state(REDIRECT_NONE),
123  host_header_verify_done(false),
124  http_access_done(false),
125  adapted_http_access_done(false),
126 #if USE_ADAPTATION
127  adaptation_acl_check_done(false),
128 #endif
129  redirect_done(false),
130  store_id_done(false),
131  no_cache_done(false),
132  interpreted_req_hdrs(false),
133  toClientMarkingDone(false),
134 #if USE_OPENSSL
135  sslBumpCheckDone(false),
136 #endif
137  error(NULL),
138  readNextRequest(false)
139 {
140  debugs(85, 3, "ClientRequestContext constructed, this=" << this);
141 }
142 
144 
146 #if USE_ADAPTATION
147  AsyncJob("ClientHttpRequest"),
148 #endif
149  request(NULL),
150  uri(NULL),
151  log_uri(NULL),
152  req_sz(0),
153  al(new AccessLogEntry()),
154  calloutContext(NULL),
155  maxReplyBodySize_(0),
156  entry_(NULL),
157  loggingEntry_(NULL),
158  conn_(cbdataReference(aConn))
159 #if USE_OPENSSL
160  , sslBumpNeed_(Ssl::bumpEnd)
161 #endif
162 #if USE_ADAPTATION
163  , receivedWholeAdaptedReply(false)
164  , request_satisfaction_mode(false)
165  , request_satisfaction_offset(0)
166 #endif
167 {
169  al->cache.start_time = current_time;
170  if (aConn) {
171  al->tcpClient = clientConnection = aConn->clientConnection;
172  al->cache.port = aConn->port;
173  al->cache.caddr = aConn->log_addr;
174  al->proxyProtocolHeader = aConn->proxyProtocolHeader();
175  al->updateError(aConn->bareError);
176 
177 #if USE_OPENSSL
178  if (aConn->clientConnection != NULL && aConn->clientConnection->isOpen()) {
179  if (auto ssl = fd_table[aConn->clientConnection->fd].ssl.get())
180  al->cache.sslClientCert.resetWithoutLocking(SSL_get_peer_certificate(ssl));
181  }
182 #endif
183  }
185 }
186 
187 /*
188  * returns true if client specified that the object must come from the cache
189  * without contacting origin server
190  */
191 bool
193 {
194  assert(request);
195  return request->cache_control &&
197 }
198 
211 static void
213 {
214  // Can be set at compile time with -D compiler flag
215 #ifndef FAILURE_MODE_TIME
216 #define FAILURE_MODE_TIME 300
217 #endif
218 
219  if (hcode == HIER_NONE)
220  return;
221 
222  // don't bother when ICP is disabled.
223  if (Config.Port.icp <= 0)
224  return;
225 
226  static double magic_factor = 100.0;
227  double n_good;
228  double n_bad;
229 
230  n_good = magic_factor / (1.0 + request_failure_ratio);
231 
232  n_bad = magic_factor - n_good;
233 
234  switch (etype) {
235 
236  case ERR_DNS_FAIL:
237 
238  case ERR_CONNECT_FAIL:
240 
241  case ERR_READ_ERROR:
242  ++n_bad;
243  break;
244 
245  default:
246  ++n_good;
247  }
248 
249  request_failure_ratio = n_bad / n_good;
250 
252  return;
253 
254  if (request_failure_ratio < 1.0)
255  return;
256 
257  debugs(33, DBG_CRITICAL, "WARNING: Failure Ratio at "<< std::setw(4)<<
258  std::setprecision(3) << request_failure_ratio);
259 
260  debugs(33, DBG_CRITICAL, "WARNING: ICP going into HIT-only mode for " <<
261  FAILURE_MODE_TIME / 60 << " minutes...");
262 
264 
265  request_failure_ratio = 0.8; /* reset to something less than 1.0 */
266 }
267 
269 {
270  debugs(33, 3, "httpRequestFree: " << uri);
271 
272  // Even though freeResources() below may destroy the request,
273  // we no longer set request->body_pipe to NULL here
274  // because we did not initiate that pipe (ConnStateData did)
275 
276  /* the ICP check here was erroneous
277  * - StoreEntry::releaseRequest was always called if entry was valid
278  */
279 
280  logRequest();
281 
283 
284  if (request)
285  checkFailureRatio(request->error.category, al->hier.code);
286 
287  freeResources();
288 
289 #if USE_ADAPTATION
291 
292  if (adaptedBodySource != NULL)
294 #endif
295 
296  if (calloutContext)
297  delete calloutContext;
298 
300 
301  if (conn_)
303 
304  /* moving to the next connection is handled by the context free */
306 }
307 
317 int
318 clientBeginRequest(const HttpRequestMethod& method, char const *url, CSCB * streamcallback,
319  CSD * streamdetach, ClientStreamData streamdata, HttpHeader const *header,
320  char *tailbuf, size_t taillen, const MasterXaction::Pointer &mx)
321 {
322  size_t url_sz;
325  StoreIOBuffer tempBuffer;
326  if (http->al != NULL)
327  http->al->cache.start_time = current_time;
328  /* this is only used to adjust the connection offset in client_side.c */
329  http->req_sz = 0;
330  tempBuffer.length = taillen;
331  tempBuffer.data = tailbuf;
332  /* client stream setup */
334  clientReplyStatus, new clientReplyContext(http), streamcallback,
335  streamdetach, streamdata, tempBuffer);
336  /* make it visible in the 'current acctive requests list' */
337  /* Set flags */
338  /* internal requests only makes sense in an
339  * accelerator today. TODO: accept flags ? */
340  http->flags.accel = true;
341  /* allow size for url rewriting */
342  url_sz = strlen(url) + Config.appendDomainLen + 5;
343  http->uri = (char *)xcalloc(url_sz, 1);
344  strcpy(http->uri, url); // XXX: polluting http->uri before parser validation
345 
346  request = HttpRequest::FromUrlXXX(http->uri, mx, method);
347  if (!request) {
348  debugs(85, 5, "Invalid URL: " << http->uri);
349  return -1;
350  }
351 
352  /*
353  * now update the headers in request with our supplied headers.
354  * HttpRequest::FromUrl() should return a blank header set, but
355  * we use Update to be sure of correctness.
356  */
357  if (header)
358  request->header.update(header);
359 
360  /* http struct now ready */
361 
362  /*
363  * build new header list *? TODO
364  */
365  request->flags.accelerated = http->flags.accel;
366 
367  /* this is an internally created
368  * request, not subject to acceleration
369  * target overrides */
370  // TODO: detect and handle internal requests of internal objects?
371 
372  /* Internally created requests cannot have bodies today */
373  request->content_length = 0;
374 
375  request->client_addr.setNoAddr();
376 
377 #if FOLLOW_X_FORWARDED_FOR
378  request->indirect_client_addr.setNoAddr();
379 #endif /* FOLLOW_X_FORWARDED_FOR */
380 
381  request->my_addr.setNoAddr(); /* undefined for internal requests */
382 
383  request->my_addr.port(0);
384 
385  request->http_ver = Http::ProtocolVersion();
386 
387  http->initRequest(request);
388 
389  /* optional - skip the access check ? */
390  http->calloutContext = new ClientRequestContext(http);
391 
392  http->calloutContext->http_access_done = false;
393 
394  http->calloutContext->redirect_done = true;
395 
396  http->calloutContext->no_cache_done = true;
397 
398  http->doCallouts();
399 
400  return 0;
401 }
402 
403 bool
405 {
406  ClientHttpRequest *http_ = http;
407 
408  if (cbdataReferenceValid(http_))
409  return true;
410 
411  http = NULL;
412 
413  cbdataReferenceDone(http_);
414 
415  return false;
416 }
417 
418 #if FOLLOW_X_FORWARDED_FOR
419 
433 static void
435 {
436  ClientRequestContext *calloutContext = (ClientRequestContext *) data;
437 
438  if (!calloutContext->httpStateIsValid())
439  return;
440 
441  ClientHttpRequest *http = calloutContext->http;
442  HttpRequest *request = http->request;
443 
444  if (answer.allowed() && request->x_forwarded_for_iterator.size() != 0) {
445 
446  /*
447  * Remove the last comma-delimited element from the
448  * x_forwarded_for_iterator and use it to repeat the cycle.
449  */
450  const char *p;
451  const char *asciiaddr;
452  int l;
453  Ip::Address addr;
454  p = request->x_forwarded_for_iterator.termedBuf();
455  l = request->x_forwarded_for_iterator.size();
456 
457  /*
458  * XXX x_forwarded_for_iterator should really be a list of
459  * IP addresses, but it's a String instead. We have to
460  * walk backwards through the String, biting off the last
461  * comma-delimited part each time. As long as the data is in
462  * a String, we should probably implement and use a variant of
463  * strListGetItem() that walks backwards instead of forwards
464  * through a comma-separated list. But we don't even do that;
465  * we just do the work in-line here.
466  */
467  /* skip trailing space and commas */
468  while (l > 0 && (p[l-1] == ',' || xisspace(p[l-1])))
469  --l;
470  request->x_forwarded_for_iterator.cut(l);
471  /* look for start of last item in list */
472  while (l > 0 && ! (p[l-1] == ',' || xisspace(p[l-1])))
473  --l;
474  asciiaddr = p+l;
475  if ((addr = asciiaddr)) {
476  request->indirect_client_addr = addr;
477  request->x_forwarded_for_iterator.cut(l);
480  /* override the default src_addr tested if we have to go deeper than one level into XFF */
481  Filled(calloutContext->acl_checklist)->src_addr = request->indirect_client_addr;
482  }
484  return;
485  }
486  }
487 
488  /* clean up, and pass control to clientAccessCheck */
490  /*
491  * Ensure that the access log shows the indirect client
492  * instead of the direct client.
493  */
494  http->al->cache.caddr = request->indirect_client_addr;
495  if (ConnStateData *conn = http->getConn())
496  conn->log_addr = request->indirect_client_addr;
497  }
498  request->x_forwarded_for_iterator.clean();
499  request->flags.done_follow_x_forwarded_for = true;
500 
501  if (answer.conflicted()) {
502  debugs(28, DBG_CRITICAL, "ERROR: Processing X-Forwarded-For. Stopping at IP address: " << request->indirect_client_addr );
503  }
504 
505  /* process actual access ACL as normal. */
506  calloutContext->clientAccessCheck();
507 }
508 #endif /* FOLLOW_X_FORWARDED_FOR */
509 
510 static void
512 {
513  ClientRequestContext *c = static_cast<ClientRequestContext*>(data);
514  c->hostHeaderIpVerify(ia, dns);
515 }
516 
517 void
519 {
521 
522  // note the DNS details for the transaction stats.
523  http->request->recordLookup(dns);
524 
525  // Is the NAT destination IP in DNS?
526  if (ia && ia->have(clientConn->local)) {
527  debugs(85, 3, "validate IP " << clientConn->local << " possible from Host:");
528  http->request->flags.hostVerified = true;
529  http->doCallouts();
530  return;
531  }
532  debugs(85, 3, HERE << "FAIL: validate IP " << clientConn->local << " possible from Host:");
533  hostHeaderVerifyFailed("local IP", "any domain IP");
534 }
535 
536 void
538 {
539  // IP address validation for Host: failed. Admin wants to ignore them.
540  // NP: we do not yet handle CONNECT tunnels well, so ignore for them
542  debugs(85, 3, "SECURITY ALERT: Host header forgery detected on " << http->getConn()->clientConnection <<
543  " (" << A << " does not match " << B << ") on URL: " << http->request->effectiveRequestUri());
544 
545  // NP: it is tempting to use 'flags.noCache' but that is all about READing cache data.
546  // The problems here are about WRITE for new cache content, which means flags.cachable
547  http->request->flags.cachable = false; // MUST NOT cache (for now)
548  // XXX: when we have updated the cache key to base on raw-IP + URI this cacheable limit can go.
549  http->request->flags.hierarchical = false; // MUST NOT pass to peers (for now)
550  // XXX: when we have sorted out the best way to relay requests properly to peers this hierarchical limit can go.
551  http->doCallouts();
552  return;
553  }
554 
555  debugs(85, DBG_IMPORTANT, "SECURITY ALERT: Host header forgery detected on " <<
556  http->getConn()->clientConnection << " (" << A << " does not match " << B << ")");
557  if (const char *ua = http->request->header.getStr(Http::HdrType::USER_AGENT))
558  debugs(85, DBG_IMPORTANT, "SECURITY ALERT: By user agent: " << ua);
559  debugs(85, DBG_IMPORTANT, "SECURITY ALERT: on URL: " << http->request->effectiveRequestUri());
560 
561  // IP address validation for Host: failed. reject the connection.
563  clientReplyContext *repContext = dynamic_cast<clientReplyContext *>(node->data.getRaw());
564  assert (repContext);
565  repContext->setReplyToError(ERR_CONFLICT_HOST, Http::scConflict,
566  http->request->method, NULL,
567  http->getConn(),
568  http->request,
569  NULL,
570 #if USE_AUTH
571  http->getConn() != NULL && http->getConn()->getAuth() != NULL ?
573 #else
574  NULL);
575 #endif
577  clientStreamRead(node, http, node->readBuffer);
578 }
579 
580 void
582 {
583  // Require a Host: header.
584  const char *host = http->request->header.getStr(Http::HdrType::HOST);
585 
586  if (!host) {
587  // TODO: dump out the HTTP/1.1 error about missing host header.
588  // otherwise this is fine, can't forge a header value when its not even set.
589  debugs(85, 3, HERE << "validate skipped with no Host: header present.");
590  http->doCallouts();
591  return;
592  }
593 
594  if (http->request->flags.internal) {
595  // TODO: kill this when URL handling allows partial URLs out of accel mode
596  // and we no longer screw with the URL just to add our internal host there
597  debugs(85, 6, HERE << "validate skipped due to internal composite URL.");
598  http->doCallouts();
599  return;
600  }
601 
602  // Locate if there is a port attached, strip ready for IP lookup
603  char *portStr = NULL;
604  char *hostB = xstrdup(host);
605  host = hostB;
606  if (host[0] == '[') {
607  // IPv6 literal.
608  portStr = strchr(hostB, ']');
609  if (portStr && *(++portStr) != ':') {
610  portStr = NULL;
611  }
612  } else {
613  // Domain or IPv4 literal with port
614  portStr = strrchr(hostB, ':');
615  }
616 
617  uint16_t port = 0;
618  if (portStr) {
619  *portStr = '\0'; // strip the ':'
620  if (*(++portStr) != '\0') {
621  char *end = NULL;
622  int64_t ret = strtoll(portStr, &end, 10);
623  if (end == portStr || *end != '\0' || ret < 1 || ret > 0xFFFF) {
624  // invalid port details. Replace the ':'
625  *(--portStr) = ':';
626  portStr = NULL;
627  } else
628  port = (ret & 0xFFFF);
629  }
630  }
631 
632  debugs(85, 3, "validate host=" << host << ", port=" << port << ", portStr=" << (portStr?portStr:"NULL"));
634  // verify the Host: port (if any) matches the apparent destination
635  if (portStr && port != http->getConn()->clientConnection->local.port()) {
636  debugs(85, 3, "FAIL on validate port " << http->getConn()->clientConnection->local.port() <<
637  " matches Host: port " << port << " (" << portStr << ")");
638  hostHeaderVerifyFailed("intercepted port", portStr);
639  } else {
640  // XXX: match the scheme default port against the apparent destination
641 
642  // verify the destination DNS is one of the Host: headers IPs
644  }
645  } else if (!Config.onoff.hostStrictVerify) {
646  debugs(85, 3, "validate skipped.");
647  http->doCallouts();
648  } else if (strlen(host) != strlen(http->request->url.host())) {
649  // Verify forward-proxy requested URL domain matches the Host: header
650  debugs(85, 3, "FAIL on validate URL domain length " << http->request->url.host() << " matches Host: " << host);
652  } else if (matchDomainName(host, http->request->url.host()) != 0) {
653  // Verify forward-proxy requested URL domain matches the Host: header
654  debugs(85, 3, "FAIL on validate URL domain " << http->request->url.host() << " matches Host: " << host);
656  } else if (portStr && port != http->request->url.port()) {
657  // Verify forward-proxy requested URL domain matches the Host: header
658  debugs(85, 3, "FAIL on validate URL port " << http->request->url.port() << " matches Host: port " << portStr);
659  hostHeaderVerifyFailed("URL port", portStr);
660  } else if (!portStr && http->request->method != Http::METHOD_CONNECT && http->request->url.port() != http->request->url.getScheme().defaultPort()) {
661  // Verify forward-proxy requested URL domain matches the Host: header
662  // Special case: we don't have a default-port to check for CONNECT. Assume URL is correct.
663  debugs(85, 3, "FAIL on validate URL port " << http->request->url.port() << " matches Host: default port " << http->request->url.getScheme().defaultPort());
664  hostHeaderVerifyFailed("URL port", "default port");
665  } else {
666  // Okay no problem.
667  debugs(85, 3, "validate passed.");
668  http->request->flags.hostVerified = true;
669  http->doCallouts();
670  }
671  safe_free(hostB);
672 }
673 
674 /* This is the entry point for external users of the client_side routines */
675 void
677 {
678 #if FOLLOW_X_FORWARDED_FOR
679  if (!http->request->flags.doneFollowXff() &&
682 
683  /* we always trust the direct client address for actual use */
686 
687  /* setup the XFF iterator for processing */
689 
690  /* begin by checking to see if we trust direct client enough to walk XFF */
693  return;
694  }
695 #endif
696 
697  if (Config.accessList.http) {
700  } else {
701  debugs(0, DBG_CRITICAL, "No http_access configuration found. This will block ALL traffic");
703  }
704 }
705 
711 void
713 {
717  } else {
718  debugs(85, 2, HERE << "No adapted_http_access configuration. default: ALLOW");
720  }
721 }
722 
723 void
725 {
726  ClientRequestContext *calloutContext = (ClientRequestContext *) data;
727 
728  if (!calloutContext->httpStateIsValid())
729  return;
730 
731  calloutContext->clientAccessCheckDone(answer);
732 }
733 
734 void
736 {
738  err_type page_id;
739  Http::StatusCode status;
740  debugs(85, 2, "The request " << http->request->method << ' ' <<
741  http->uri << " is " << answer <<
742  "; last ACL checked: " << (AclMatchedName ? AclMatchedName : "[none]"));
743 
744 #if USE_AUTH
745  char const *proxy_auth_msg = "<null>";
746  if (http->getConn() != NULL && http->getConn()->getAuth() != NULL)
747  proxy_auth_msg = http->getConn()->getAuth()->denyMessage("<null>");
748  else if (http->request->auth_user_request != NULL)
749  proxy_auth_msg = http->request->auth_user_request->denyMessage("<null>");
750 #endif
751 
752  if (!answer.allowed()) {
753  // auth has a grace period where credentials can be expired but okay not to challenge.
754 
755  /* Send an auth challenge or error */
756  // XXX: do we still need aclIsProxyAuth() ?
757  bool auth_challenge = (answer == ACCESS_AUTH_REQUIRED || aclIsProxyAuth(AclMatchedName));
758  debugs(85, 5, "Access Denied: " << http->uri);
759  debugs(85, 5, "AclMatchedName = " << (AclMatchedName ? AclMatchedName : "<null>"));
760 #if USE_AUTH
761  if (auth_challenge)
762  debugs(33, 5, "Proxy Auth Message = " << (proxy_auth_msg ? proxy_auth_msg : "<null>"));
763 #endif
764 
765  /*
766  * NOTE: get page_id here, based on AclMatchedName because if
767  * USE_DELAY_POOLS is enabled, then AclMatchedName gets clobbered in
768  * the clientCreateStoreEntry() call just below. Pedro Ribeiro
769  * <pribeiro@isel.pt>
770  */
772 
774 
775  if (auth_challenge) {
776 #if USE_AUTH
777  if (http->request->flags.sslBumped) {
778  /*SSL Bumped request, authentication is not possible*/
779  status = Http::scForbidden;
780  } else if (!http->flags.accel) {
781  /* Proxy authorisation needed */
783  } else {
784  /* WWW authorisation needed */
785  status = Http::scUnauthorized;
786  }
787 #else
788  // need auth, but not possible to do.
789  status = Http::scForbidden;
790 #endif
791  if (page_id == ERR_NONE)
792  page_id = ERR_CACHE_ACCESS_DENIED;
793  } else {
794  status = Http::scForbidden;
795 
796  if (page_id == ERR_NONE)
797  page_id = ERR_ACCESS_DENIED;
798  }
799 
800  error = clientBuildError(page_id, status, nullptr, http->getConn(), http->request, http->al);
801 
802 #if USE_AUTH
804  http->getConn() != NULL && http->getConn()->getAuth() != NULL ?
806 #endif
807 
808  readNextRequest = true;
809  }
810 
811  /* ACCESS_ALLOWED continues here ... */
812  xfree(http->uri);
814  http->doCallouts();
815 }
816 
817 #if USE_ADAPTATION
818 void
820 {
821  debugs(93,3,HERE << this << " adaptationAclCheckDone called");
822 
823 #if ICAP_CLIENT
825  if (ih != NULL) {
826  if (getConn() != NULL && getConn()->clientConnection != NULL) {
827  ih->rfc931 = getConn()->clientConnection->rfc931;
828 #if USE_OPENSSL
829  if (getConn()->clientConnection->isOpen()) {
830  ih->ssluser = sslGetUserEmail(fd_table[getConn()->clientConnection->fd].ssl.get());
831  }
832 #endif
833  }
834  ih->log_uri = log_uri;
835  ih->req_sz = req_sz;
836  }
837 #endif
838 
839  if (!g) {
840  debugs(85,3, HERE << "no adaptation needed");
841  doCallouts();
842  return;
843  }
844 
845  startAdaptation(g);
846 }
847 
848 #endif
849 
850 static void
852 {
853  ClientRequestContext *context = (ClientRequestContext *)data;
854  ClientHttpRequest *http = context->http;
855  context->acl_checklist = NULL;
856 
857  if (answer.allowed())
859  else {
860  Helper::Reply const nilReply(Helper::Error);
861  context->clientRedirectDone(nilReply);
862  }
863 }
864 
865 void
867 {
868  debugs(33, 5, HERE << "'" << http->uri << "'");
869  http->al->syncNotes(http->request);
873  } else
875 }
876 
881 static void
883 {
884  ClientRequestContext *context = static_cast<ClientRequestContext *>(data);
885  ClientHttpRequest *http = context->http;
886  context->acl_checklist = NULL;
887 
888  if (answer.allowed())
889  storeIdStart(http, clientStoreIdDoneWrapper, context);
890  else {
891  debugs(85, 3, "access denied expected ERR reply handling: " << answer);
892  Helper::Reply const nilReply(Helper::Error);
893  context->clientStoreIdDone(nilReply);
894  }
895 }
896 
902 void
904 {
905  debugs(33, 5,"'" << http->uri << "'");
906 
907  if (Config.accessList.store_id) {
910  } else
912 }
913 
914 static int
916 {
917  HttpRequest *request = http->request;
918  HttpRequestMethod method = request->method;
919 
920  // intercepted requests MUST NOT (yet) be sent to peers unless verified
921  if (!request->flags.hostVerified && (request->flags.intercepted || request->flags.interceptTproxy))
922  return 0;
923 
924  /*
925  * IMS needs a private key, so we can use the hierarchy for IMS only if our
926  * neighbors support private keys
927  */
928 
929  if (request->flags.ims && !neighbors_do_private_keys)
930  return 0;
931 
932  /*
933  * This is incorrect: authenticating requests can be sent via a hierarchy
934  * (they can even be cached if the correct headers are set on the reply)
935  */
936  if (request->flags.auth)
937  return 0;
938 
939  if (method == Http::METHOD_TRACE)
940  return 1;
941 
942  if (method != Http::METHOD_GET)
943  return 0;
944 
945  if (request->flags.loopDetected)
946  return 0;
947 
948  if (request->url.getScheme() == AnyP::PROTO_HTTP)
949  return method.respMaybeCacheable();
950 
951  if (request->url.getScheme() == AnyP::PROTO_GOPHER)
952  return gopherCachable(request);
953 
954  if (request->url.getScheme() == AnyP::PROTO_CACHE_OBJECT)
955  return 0;
956 
957  return 1;
958 }
959 
960 static void
962 {
963  HttpRequest *request = http->request;
964  HttpHeader *req_hdr = &request->header;
965  ConnStateData *http_conn = http->getConn();
966 
967  /* Internal requests such as those from ESI includes may be without
968  * a client connection
969  */
970  if (!http_conn)
971  return;
972 
973  request->flags.connectionAuthDisabled = http_conn->port->connection_auth_disabled;
974  if (!request->flags.connectionAuthDisabled) {
975  if (Comm::IsConnOpen(http_conn->pinning.serverConnection)) {
976  if (http_conn->pinning.auth) {
977  request->flags.connectionAuth = true;
978  request->flags.auth = true;
979  } else {
980  request->flags.connectionProxyAuth = true;
981  }
982  // These should already be linked correctly.
983  assert(request->clientConnectionManager == http_conn);
984  }
985  }
986 
987  /* check if connection auth is used, and flag as candidate for pinning
988  * in such case.
989  * Note: we may need to set flags.connectionAuth even if the connection
990  * is already pinned if it was pinned earlier due to proxy auth
991  */
992  if (!request->flags.connectionAuth) {
995  HttpHeaderEntry *e;
996  int may_pin = 0;
997  while ((e = req_hdr->getEntry(&pos))) {
999  const char *value = e->value.rawBuf();
1000  if (strncasecmp(value, "NTLM ", 5) == 0
1001  ||
1002  strncasecmp(value, "Negotiate ", 10) == 0
1003  ||
1004  strncasecmp(value, "Kerberos ", 9) == 0) {
1005  if (e->id == Http::HdrType::AUTHORIZATION) {
1006  request->flags.connectionAuth = true;
1007  may_pin = 1;
1008  } else {
1009  request->flags.connectionProxyAuth = true;
1010  may_pin = 1;
1011  }
1012  }
1013  }
1014  }
1015  if (may_pin && !request->pinnedConnection()) {
1016  // These should already be linked correctly. Just need the ServerConnection to pinn.
1017  assert(request->clientConnectionManager == http_conn);
1018  }
1019  }
1020  }
1021 }
1022 
1023 static void
1025 {
1026  HttpRequest *request = http->request;
1027  HttpHeader *req_hdr = &request->header;
1028  bool no_cache = false;
1029 
1030  request->imslen = -1;
1032 
1033  if (request->ims > 0)
1034  request->flags.ims = true;
1035 
1036  if (!request->flags.ignoreCc) {
1037  if (request->cache_control) {
1038  if (request->cache_control->hasNoCache())
1039  no_cache=true;
1040 
1041  // RFC 2616: treat Pragma:no-cache as if it was Cache-Control:no-cache when Cache-Control is missing
1042  } else if (req_hdr->has(Http::HdrType::PRAGMA))
1043  no_cache = req_hdr->hasListMember(Http::HdrType::PRAGMA,"no-cache",',');
1044  }
1045 
1046  if (request->method == Http::METHOD_OTHER) {
1047  no_cache=true;
1048  }
1049 
1050  if (no_cache) {
1051 #if USE_HTTP_VIOLATIONS
1052 
1054  request->flags.nocacheHack = true;
1055  else if (refresh_nocache_hack)
1056  request->flags.nocacheHack = true;
1057  else
1058 #endif
1059 
1060  request->flags.noCache = true;
1061  }
1062 
1063  /* ignore range header in non-GETs or non-HEADs */
1065  // XXX: initialize if we got here without HttpRequest::parseHeader()
1066  if (!request->range)
1067  request->range = req_hdr->getRange();
1068 
1069  if (request->range) {
1070  request->flags.isRanged = true;
1072  /* XXX: This is suboptimal. We should give the stream the range set,
1073  * and thereby let the top of the stream set the offset when the
1074  * size becomes known. As it is, we will end up requesting from 0
1075  * for evey -X range specification.
1076  * RBC - this may be somewhat wrong. We should probably set the range
1077  * iter up at this point.
1078  */
1079  node->readBuffer.offset = request->range->lowestOffset(0);
1080  }
1081  }
1082 
1083  /* Only HEAD and GET requests permit a Range or Request-Range header.
1084  * If these headers appear on any other type of request, delete them now.
1085  */
1086  else {
1087  req_hdr->delById(Http::HdrType::RANGE);
1089  request->ignoreRange("neither HEAD nor GET");
1090  }
1091 
1092  if (req_hdr->has(Http::HdrType::AUTHORIZATION))
1093  request->flags.auth = true;
1094 
1095  clientCheckPinning(http);
1096 
1097  if (!request->url.userInfo().isEmpty())
1098  request->flags.auth = true;
1099 
1100  if (req_hdr->has(Http::HdrType::VIA)) {
1101  String s = req_hdr->getList(Http::HdrType::VIA);
1102  /*
1103  * ThisCache cannot be a member of Via header, "1.1 ThisCache" can.
1104  * Note ThisCache2 has a space prepended to the hostname so we don't
1105  * accidentally match super-domains.
1106  */
1107 
1108  if (strListIsSubstr(&s, ThisCache2, ',')) {
1109  request->flags.loopDetected = true;
1110  }
1111 
1112 #if USE_FORW_VIA_DB
1114 
1115 #endif
1116 
1117  s.clean();
1118  }
1119 
1120  // headers only relevant to reverse-proxy
1121  if (request->flags.accelerated) {
1122  // check for a cdn-info member with a cdn-id matching surrogate_id
1123  // XXX: HttpHeader::hasListMember() does not handle OWS around ";" yet
1125  request->flags.loopDetected = true;
1126  }
1127 
1128  if (request->flags.loopDetected) {
1129  debugObj(33, DBG_IMPORTANT, "WARNING: Forwarding loop detected for:\n",
1131  }
1132 
1133 #if USE_FORW_VIA_DB
1134 
1135  if (req_hdr->has(Http::HdrType::X_FORWARDED_FOR)) {
1138  s.clean();
1139  }
1140 
1141 #endif
1142 
1143  request->flags.cachable = http->request->maybeCacheable();
1144 
1145  if (clientHierarchical(http))
1146  request->flags.hierarchical = true;
1147 
1148  debugs(85, 5, "clientInterpretRequestHeaders: REQ_NOCACHE = " <<
1149  (request->flags.noCache ? "SET" : "NOT SET"));
1150  debugs(85, 5, "clientInterpretRequestHeaders: REQ_CACHABLE = " <<
1151  (request->flags.cachable ? "SET" : "NOT SET"));
1152  debugs(85, 5, "clientInterpretRequestHeaders: REQ_HIERARCHICAL = " <<
1153  (request->flags.hierarchical ? "SET" : "NOT SET"));
1154 
1155 }
1156 
1157 void
1158 clientRedirectDoneWrapper(void *data, const Helper::Reply &result)
1159 {
1160  ClientRequestContext *calloutContext = (ClientRequestContext *)data;
1161 
1162  if (!calloutContext->httpStateIsValid())
1163  return;
1164 
1165  calloutContext->clientRedirectDone(result);
1166 }
1167 
1168 void
1169 clientStoreIdDoneWrapper(void *data, const Helper::Reply &result)
1170 {
1171  ClientRequestContext *calloutContext = (ClientRequestContext *)data;
1172 
1173  if (!calloutContext->httpStateIsValid())
1174  return;
1175 
1176  calloutContext->clientStoreIdDone(result);
1177 }
1178 
1179 void
1181 {
1182  HttpRequest *old_request = http->request;
1183  debugs(85, 5, HERE << "'" << http->uri << "' result=" << reply);
1186 
1187  // Put helper response Notes into the transaction state record (ALE) eventually
1188  // do it early to ensure that no matter what the outcome the notes are present.
1189  if (http->al)
1190  http->al->syncNotes(old_request);
1191 
1192  UpdateRequestNotes(http->getConn(), *old_request, reply.notes);
1193 
1194  switch (reply.result) {
1195  case Helper::TimedOut:
1197  static const auto d = MakeNamedErrorDetail("REDIRECTOR_TIMEDOUT");
1199  debugs(85, DBG_IMPORTANT, "ERROR: URL rewrite helper: Timedout");
1200  }
1201  break;
1202 
1203  case Helper::Unknown:
1204  case Helper::TT:
1205  // Handler in redirect.cc should have already mapped Unknown
1206  // IF it contained valid entry for the old URL-rewrite helper protocol
1207  debugs(85, DBG_IMPORTANT, "ERROR: URL rewrite helper returned invalid result code. Wrong helper? " << reply);
1208  break;
1209 
1210  case Helper::BrokenHelper:
1211  debugs(85, DBG_IMPORTANT, "ERROR: URL rewrite helper: " << reply);
1212  break;
1213 
1214  case Helper::Error:
1215  // no change to be done.
1216  break;
1217 
1218  case Helper::Okay: {
1219  // #1: redirect with a specific status code OK status=NNN url="..."
1220  // #2: redirect with a default status code OK url="..."
1221  // #3: re-write the URL OK rewrite-url="..."
1222 
1223  const char *statusNote = reply.notes.findFirst("status");
1224  const char *urlNote = reply.notes.findFirst("url");
1225 
1226  if (urlNote != NULL) {
1227  // HTTP protocol redirect to be done.
1228 
1229  // TODO: change default redirect status for appropriate requests
1230  // Squid defaults to 302 status for now for better compatibility with old clients.
1231  // HTTP/1.0 client should get 302 (Http::scFound)
1232  // HTTP/1.1 client contacting reverse-proxy should get 307 (Http::scTemporaryRedirect)
1233  // HTTP/1.1 client being diverted by forward-proxy should get 303 (Http::scSeeOther)
1235  if (statusNote != NULL) {
1236  const char * result = statusNote;
1237  status = static_cast<Http::StatusCode>(atoi(result));
1238  }
1239 
1240  if (status == Http::scMovedPermanently
1241  || status == Http::scFound
1242  || status == Http::scSeeOther
1243  || status == Http::scPermanentRedirect
1244  || status == Http::scTemporaryRedirect) {
1245  http->redirect.status = status;
1246  http->redirect.location = xstrdup(urlNote);
1247  // TODO: validate the URL produced here is RFC 2616 compliant absolute URI
1248  } else {
1249  debugs(85, DBG_CRITICAL, "ERROR: URL-rewrite produces invalid " << status << " redirect Location: " << urlNote);
1250  }
1251  } else {
1252  // URL-rewrite wanted. Ew.
1253  urlNote = reply.notes.findFirst("rewrite-url");
1254 
1255  // prevent broken helpers causing too much damage. If old URL == new URL skip the re-write.
1256  if (urlNote != NULL && strcmp(urlNote, http->uri)) {
1257  AnyP::Uri tmpUrl;
1258  if (tmpUrl.parse(old_request->method, SBuf(urlNote))) {
1259  HttpRequest *new_request = old_request->clone();
1260  new_request->url = tmpUrl;
1261  debugs(61, 2, "URL-rewriter diverts URL from " << old_request->effectiveRequestUri() << " to " << new_request->effectiveRequestUri());
1262 
1263  // update the new request to flag the re-writing was done on it
1264  new_request->flags.redirected = true;
1265 
1266  // unlink bodypipe from the old request. Not needed there any longer.
1267  if (old_request->body_pipe != NULL) {
1268  old_request->body_pipe = NULL;
1269  debugs(61,2, HERE << "URL-rewriter diverts body_pipe " << new_request->body_pipe <<
1270  " from request " << old_request << " to " << new_request);
1271  }
1272 
1273  http->resetRequest(new_request);
1274  old_request = nullptr;
1275  } else {
1276  debugs(85, DBG_CRITICAL, "ERROR: URL-rewrite produces invalid request: " <<
1277  old_request->method << " " << urlNote << " " << old_request->http_ver);
1278  }
1279  }
1280  }
1281  }
1282  break;
1283  }
1284 
1285  /* XXX PIPELINE: This is inaccurate during pipelining */
1286 
1289 
1290  assert(http->uri);
1291 
1292  http->doCallouts();
1293 }
1294 
1298 void
1300 {
1301  HttpRequest *old_request = http->request;
1302  debugs(85, 5, "'" << http->uri << "' result=" << reply);
1305 
1306  // Put helper response Notes into the transaction state record (ALE) eventually
1307  // do it early to ensure that no matter what the outcome the notes are present.
1308  if (http->al)
1309  http->al->syncNotes(old_request);
1310 
1311  UpdateRequestNotes(http->getConn(), *old_request, reply.notes);
1312 
1313  switch (reply.result) {
1314  case Helper::Unknown:
1315  case Helper::TT:
1316  // Handler in redirect.cc should have already mapped Unknown
1317  // IF it contained valid entry for the old helper protocol
1318  debugs(85, DBG_IMPORTANT, "ERROR: storeID helper returned invalid result code. Wrong helper? " << reply);
1319  break;
1320 
1321  case Helper::TimedOut:
1322  // Timeouts for storeID are not implemented
1323  case Helper::BrokenHelper:
1324  debugs(85, DBG_IMPORTANT, "ERROR: storeID helper: " << reply);
1325  break;
1326 
1327  case Helper::Error:
1328  // no change to be done.
1329  break;
1330 
1331  case Helper::Okay: {
1332  const char *urlNote = reply.notes.findFirst("store-id");
1333 
1334  // prevent broken helpers causing too much damage. If old URL == new URL skip the re-write.
1335  if (urlNote != NULL && strcmp(urlNote, http->uri) ) {
1336  // Debug section required for some very specific cases.
1337  debugs(85, 9, "Setting storeID with: " << urlNote );
1338  http->request->store_id = urlNote;
1339  http->store_id = urlNote;
1340  }
1341  }
1342  break;
1343  }
1344 
1345  http->doCallouts();
1346 }
1347 
1351 void
1353 {
1354  if (Config.accessList.noCache) {
1357  } else {
1358  /* unless otherwise specified, we try to cache. */
1360  }
1361 }
1362 
1363 static void
1365 {
1366  ClientRequestContext *calloutContext = (ClientRequestContext *) data;
1367 
1368  if (!calloutContext->httpStateIsValid())
1369  return;
1370 
1371  calloutContext->checkNoCacheDone(answer);
1372 }
1373 
1374 void
1376 {
1377  acl_checklist = NULL;
1378  if (answer.denied()) {
1379  http->request->flags.noCache = true; // do not read reply from cache
1380  http->request->flags.cachable = false; // do not store reply into cache
1381  }
1382  http->doCallouts();
1383 }
1384 
1385 #if USE_OPENSSL
1386 bool
1388 {
1389  if (!http->getConn()) {
1390  http->al->ssl.bumpMode = Ssl::bumpEnd; // SslBump does not apply; log -
1391  return false;
1392  }
1393 
1395  if (http->request->flags.forceTunnel) {
1396  debugs(85, 5, "not needed; already decided to tunnel " << http->getConn());
1397  if (bumpMode != Ssl::bumpEnd)
1398  http->al->ssl.bumpMode = bumpMode; // inherited from bumped connection
1399  return false;
1400  }
1401 
1402  // If SSL connection tunneling or bumping decision has been made, obey it.
1403  if (bumpMode != Ssl::bumpEnd) {
1404  debugs(85, 5, HERE << "SslBump already decided (" << bumpMode <<
1405  "), " << "ignoring ssl_bump for " << http->getConn());
1406 
1407  // We need the following "if" for transparently bumped TLS connection,
1408  // because in this case we are running ssl_bump access list before
1409  // the doCallouts runs. It can be removed after the bug #4340 fixed.
1410  // We do not want to proceed to bumping steps:
1411  // - if the TLS connection with the client is already established
1412  // because we are accepting normal HTTP requests on TLS port,
1413  // or because of the client-first bumping mode
1414  // - When the bumping is already started
1415  if (!http->getConn()->switchedToHttps() &&
1416  !http->getConn()->serverBump())
1417  http->sslBumpNeed(bumpMode); // for processRequest() to bump if needed and not already bumped
1418  http->al->ssl.bumpMode = bumpMode; // inherited from bumped connection
1419  return false;
1420  }
1421 
1422  // If we have not decided yet, decide whether to bump now.
1423 
1424  // Bumping here can only start with a CONNECT request on a bumping port
1425  // (bumping of intercepted SSL conns is decided before we get 1st request).
1426  // We also do not bump redirected CONNECT requests.
1429  !http->getConn()->port->flags.tunnelSslBumping) {
1430  http->al->ssl.bumpMode = Ssl::bumpEnd; // SslBump does not apply; log -
1431  debugs(85, 5, HERE << "cannot SslBump this request");
1432  return false;
1433  }
1434 
1435  // Do not bump during authentication: clients would not proxy-authenticate
1436  // if we delay a 407 response and respond with 200 OK to CONNECT.
1438  http->al->ssl.bumpMode = Ssl::bumpEnd; // SslBump does not apply; log -
1439  debugs(85, 5, HERE << "no SslBump during proxy authentication");
1440  return false;
1441  }
1442 
1443  if (error) {
1444  debugs(85, 5, "SslBump applies. Force bump action on error " << errorTypeName(error->type));
1446  http->al->ssl.bumpMode = Ssl::bumpBump;
1447  return false;
1448  }
1449 
1450  debugs(85, 5, HERE << "SslBump possible, checking ACL");
1451 
1453  aclChecklist->nonBlockingCheck(sslBumpAccessCheckDoneWrapper, this);
1454  return true;
1455 }
1456 
1461 static void
1463 {
1464  ClientRequestContext *calloutContext = static_cast<ClientRequestContext *>(data);
1465 
1466  if (!calloutContext->httpStateIsValid())
1467  return;
1468  calloutContext->sslBumpAccessCheckDone(answer);
1469 }
1470 
1471 void
1473 {
1474  if (!httpStateIsValid())
1475  return;
1476 
1477  const Ssl::BumpMode bumpMode = answer.allowed() ?
1478  static_cast<Ssl::BumpMode>(answer.kind) : Ssl::bumpSplice;
1479  http->sslBumpNeed(bumpMode); // for processRequest() to bump if needed
1480  http->al->ssl.bumpMode = bumpMode; // for logging
1481 
1482  if (bumpMode == Ssl::bumpTerminate) {
1483  const Comm::ConnectionPointer clientConn = http->getConn() ? http->getConn()->clientConnection : nullptr;
1484  if (Comm::IsConnOpen(clientConn)) {
1485  debugs(85, 3, "closing after Ssl::bumpTerminate ");
1486  clientConn->close();
1487  }
1488  return;
1489  }
1490 
1491  http->doCallouts();
1492 }
1493 #endif
1494 
1495 /*
1496  * Identify requests that do not go through the store and client side stream
1497  * and forward them to the appropriate location. All other requests, request
1498  * them.
1499  */
1500 void
1502 {
1503  debugs(85, 4, request->method << ' ' << uri);
1504 
1505  const bool untouchedConnect = request->method == Http::METHOD_CONNECT && !redirect.status;
1506 
1507 #if USE_OPENSSL
1508  if (untouchedConnect && sslBumpNeeded()) {
1510  sslBumpStart();
1511  return;
1512  }
1513 #endif
1514 
1515  if (untouchedConnect || request->flags.forceTunnel) {
1516  getConn()->stopReading(); // tunnels read for themselves
1517  tunnelStart(this);
1518  return;
1519  }
1520 
1521  httpStart();
1522 }
1523 
1524 void
1526 {
1527  // XXX: Re-initializes rather than updates. Should not be needed at all.
1529  debugs(85, 4, loggingTags().c_str() << " for '" << uri << "'");
1530 
1531  /* no one should have touched this */
1532  assert(out.offset == 0);
1533  /* Use the Stream Luke */
1535  clientStreamRead(node, this, node->readBuffer);
1536 }
1537 
1538 #if USE_OPENSSL
1539 
1540 void
1542 {
1543  debugs(83, 3, HERE << "sslBump required: "<< Ssl::bumpMode(mode));
1544  sslBumpNeed_ = mode;
1545 }
1546 
1547 // called when comm_write has completed
1548 static void
1549 SslBumpEstablish(const Comm::ConnectionPointer &, char *, size_t, Comm::Flag errflag, int, void *data)
1550 {
1551  ClientHttpRequest *r = static_cast<ClientHttpRequest*>(data);
1552  debugs(85, 5, HERE << "responded to CONNECT: " << r << " ? " << errflag);
1553 
1554  assert(r && cbdataReferenceValid(r));
1555  r->sslBumpEstablish(errflag);
1556 }
1557 
1558 void
1560 {
1561  // Bail out quickly on Comm::ERR_CLOSING - close handlers will tidy up
1562  if (errflag == Comm::ERR_CLOSING)
1563  return;
1564 
1565  if (errflag) {
1566  debugs(85, 3, HERE << "CONNECT response failure in SslBump: " << errflag);
1568  return;
1569  }
1570 
1571 #if USE_AUTH
1572  // Preserve authentication info for the ssl-bumped request
1573  if (request->auth_user_request != NULL)
1574  getConn()->setAuth(request->auth_user_request, "SSL-bumped CONNECT");
1575 #endif
1576 
1577  assert(sslBumpNeeded());
1579 }
1580 
1581 void
1583 {
1584  debugs(85, 5, HERE << "Confirming " << Ssl::bumpMode(sslBumpNeed_) <<
1585  "-bumped CONNECT tunnel on FD " << getConn()->clientConnection);
1587 
1588  AsyncCall::Pointer bumpCall = commCbCall(85, 5, "ClientSocketContext::sslBumpEstablish",
1590 
1592  CommIoCbParams &params = GetCommParams<CommIoCbParams>(bumpCall);
1593  params.flag = Comm::OK;
1594  params.conn = getConn()->clientConnection;
1595  ScheduleCallHere(bumpCall);
1596  return;
1597  }
1598 
1600 
1601  const auto mb = al->reply->pack();
1602  // send an HTTP 200 response to kick client SSL negotiation
1603  // TODO: Unify with tunnel.cc and add a Server(?) header
1604  Comm::Write(getConn()->clientConnection, mb, bumpCall);
1605  delete mb;
1606 }
1607 
1608 #endif
1609 
1610 void
1612 {
1613  if (request)
1615  else
1616  al->updateError(error);
1617 }
1618 
1619 bool
1621 {
1622  // TODO: See also (and unify with) clientReplyContext::storeNotOKTransferDone()
1623  int64_t contentLength =
1625  assert(contentLength >= 0);
1626 
1627  if (out.offset < contentLength)
1628  return false;
1629 
1630  return true;
1631 }
1632 
1633 void
1635 {
1636  entry_ = newEntry;
1637 }
1638 
1639 void
1641 {
1642  if (loggingEntry_)
1643  loggingEntry_->unlock("ClientHttpRequest::loggingEntry");
1644 
1645  loggingEntry_ = newEntry;
1646 
1647  if (loggingEntry_)
1648  loggingEntry_->lock("ClientHttpRequest::loggingEntry");
1649 }
1650 
1651 void
1653 {
1654  assignRequest(aRequest);
1655  if (const auto csd = getConn()) {
1656  if (!csd->notes()->empty())
1657  request->notes()->appendNewOnly(csd->notes().getRaw());
1658  }
1659  // al is created in the constructor
1660  assert(al);
1661  if (!al->request) {
1662  al->request = request;
1663  HTTPMSGLOCK(al->request);
1664  al->syncNotes(request);
1665  }
1666 }
1667 
1668 void
1670 {
1671  assert(request != newRequest);
1672  clearRequest();
1673  assignRequest(newRequest);
1674  xfree(uri);
1676 }
1677 
1678 void
1680 {
1681  assert(newRequest);
1682  assert(!request);
1683  const_cast<HttpRequest *&>(request) = newRequest;
1686 }
1687 
1688 void
1690 {
1691  HttpRequest *oldRequest = request;
1692  HTTPMSGUNLOCK(oldRequest);
1693  const_cast<HttpRequest *&>(request) = nullptr;
1694  absorbLogUri(nullptr);
1695 }
1696 
1697 /*
1698  * doCallouts() - This function controls the order of "callout"
1699  * executions, including non-blocking access control checks, the
1700  * redirector, and ICAP. Previously, these callouts were chained
1701  * together such that "clientAccessCheckDone()" would call
1702  * "clientRedirectStart()" and so on.
1703  *
1704  * The ClientRequestContext (aka calloutContext) class holds certain
1705  * state data for the callout/callback operations. Previously
1706  * ClientHttpRequest would sort of hand off control to ClientRequestContext
1707  * for a short time. ClientRequestContext would then delete itself
1708  * and pass control back to ClientHttpRequest when all callouts
1709  * were finished.
1710  *
1711  * This caused some problems for ICAP because we want to make the
1712  * ICAP callout after checking ACLs, but before checking the no_cache
1713  * list. We can't stuff the ICAP state into the ClientRequestContext
1714  * class because we still need the ICAP state after ClientRequestContext
1715  * goes away.
1716  *
1717  * Note that ClientRequestContext is created before the first call
1718  * to doCallouts().
1719  *
1720  * If one of the callouts notices that ClientHttpRequest is no
1721  * longer valid, it should call cbdataReferenceDone() so that
1722  * ClientHttpRequest's reference count goes to zero and it will get
1723  * deleted. ClientHttpRequest will then delete ClientRequestContext.
1724  *
1725  * Note that we set the _done flags here before actually starting
1726  * the callout. This is strictly for convenience.
1727  */
1728 
1729 void
1731 {
1733 
1734  if (!calloutContext->error) {
1735  // CVE-2009-0801: verify the Host: header is consistent with other known details.
1737  debugs(83, 3, HERE << "Doing calloutContext->hostHeaderVerify()");
1740  return;
1741  }
1742 
1744  debugs(83, 3, HERE << "Doing calloutContext->clientAccessCheck()");
1747  return;
1748  }
1749 
1750 #if USE_ADAPTATION
1755  request, NULL, calloutContext->http->al, this))
1756  return; // will call callback
1757  }
1758 #endif
1759 
1760  if (!calloutContext->redirect_done) {
1761  calloutContext->redirect_done = true;
1762 
1763  if (Config.Program.redirect) {
1764  debugs(83, 3, HERE << "Doing calloutContext->clientRedirectStart()");
1767  return;
1768  }
1769  }
1770 
1772  debugs(83, 3, HERE << "Doing calloutContext->clientAccessCheck2()");
1775  return;
1776  }
1777 
1778  if (!calloutContext->store_id_done) {
1779  calloutContext->store_id_done = true;
1780 
1781  if (Config.Program.store_id) {
1782  debugs(83, 3,"Doing calloutContext->clientStoreIdStart()");
1785  return;
1786  }
1787  }
1788 
1790  debugs(83, 3, HERE << "Doing clientInterpretRequestHeaders()");
1793  }
1794 
1795  if (!calloutContext->no_cache_done) {
1796  calloutContext->no_cache_done = true;
1797 
1799  debugs(83, 3, HERE << "Doing calloutContext->checkNoCache()");
1801  return;
1802  }
1803  }
1804  } // if !calloutContext->error
1805 
1806  // Set appropriate MARKs and CONNMARKs if needed.
1808  ACLFilledChecklist ch(nullptr, request, nullptr);
1809  ch.al = calloutContext->http->al;
1811  ch.my_addr = request->my_addr;
1812  ch.syncAle(request, log_uri);
1813 
1816  tos_t tos = aclMapTOS(Ip::Qos::TheConfig.tosToClient, &ch);
1817  if (tos)
1819 
1820  const auto packetMark = aclFindNfMarkConfig(Ip::Qos::TheConfig.nfmarkToClient, &ch);
1821  if (!packetMark.isEmpty())
1822  Ip::Qos::setSockNfmark(getConn()->clientConnection, packetMark.mark);
1823 
1824  const auto connmark = aclFindNfMarkConfig(Ip::Qos::TheConfig.nfConnmarkToClient, &ch);
1825  if (!connmark.isEmpty())
1827  }
1828  }
1829 
1830 #if USE_OPENSSL
1831  // Even with calloutContext->error, we call sslBumpAccessCheck() to decide
1832  // whether SslBump applies to this transaction. If it applies, we will
1833  // attempt to bump the client to serve the error.
1837  return;
1838  /* else no ssl bump required*/
1839  }
1840 #endif
1841 
1842  if (calloutContext->error) {
1843  // XXX: prformance regression. c_str() reallocates
1844  SBuf storeUriBuf(request->storeId());
1845  const char *storeUri = storeUriBuf.c_str();
1846  StoreEntry *e = storeCreateEntry(storeUri, storeUri, request->flags, request->method);
1847 #if USE_OPENSSL
1848  if (sslBumpNeeded()) {
1849  // We have to serve an error, so bump the client first.
1851  // set final error but delay sending until we bump
1852  Ssl::ServerBump *srvBump = new Ssl::ServerBump(this, e, Ssl::bumpClientFirst);
1855  getConn()->setServerBump(srvBump);
1856  e->unlock("ClientHttpRequest::doCallouts+sslBumpNeeded");
1857  } else
1858 #endif
1859  {
1860  // send the error to the client now
1862  clientReplyContext *repContext = dynamic_cast<clientReplyContext *>(node->data.getRaw());
1863  assert (repContext);
1864  repContext->setReplyToStoreEntry(e, "immediate SslBump error");
1868  getConn()->flags.readMore = true; // resume any pipeline reads.
1870  clientStreamRead(node, this, node->readBuffer);
1871  e->unlock("ClientHttpRequest::doCallouts-sslBumpNeeded");
1872  return;
1873  }
1874  }
1875 
1877  delete calloutContext;
1878  calloutContext = NULL;
1879 #if HEADERS_LOG
1880 
1881  headersLog(0, 1, request->method, request);
1882 #endif
1883 
1884  debugs(83, 3, HERE << "calling processRequest()");
1885  processRequest();
1886 
1887 #if ICAP_CLIENT
1889  if (ih != NULL)
1890  ih->logType = loggingTags();
1891 #endif
1892 }
1893 
1894 void
1896 {
1897  assert(request);
1898  const auto canonicalUri = request->canonicalCleanUrl();
1899  absorbLogUri(xstrndup(canonicalUri, MAX_URL));
1900 }
1901 
1902 void
1904 {
1905  assert(rawUri);
1906  // Should(!request);
1907 
1908  // TODO: SBuf() performance regression, fix by converting rawUri to SBuf
1909  char *canonicalUri = urlCanonicalCleanWithoutRequest(SBuf(rawUri), method, AnyP::UriScheme());
1910 
1911  absorbLogUri(AnyP::Uri::cleanup(canonicalUri));
1912 
1913  char *cleanedRawUri = AnyP::Uri::cleanup(rawUri);
1914  al->setVirginUrlForMissingRequest(SBuf(cleanedRawUri));
1915  xfree(cleanedRawUri);
1916 }
1917 
1918 void
1920 {
1921  xfree(log_uri);
1922  const_cast<char *&>(log_uri) = aUri;
1923 }
1924 
1925 void
1927 {
1928  assert(!uri);
1929  assert(aUri);
1930  // Should(!request);
1931 
1932  uri = xstrdup(aUri);
1933  // TODO: SBuf() performance regression, fix by converting setErrorUri() parameter to SBuf
1934  const SBuf errorUri(aUri);
1935  const auto canonicalUri = urlCanonicalCleanWithoutRequest(errorUri, HttpRequestMethod(), AnyP::UriScheme());
1936  absorbLogUri(xstrndup(canonicalUri, MAX_URL));
1937 
1938  al->setVirginUrlForMissingRequest(errorUri);
1939 }
1940 
1941 // XXX: This should not be a _request_ method. Move range_iter elsewhere.
1942 int64_t
1944 {
1945  assert(request);
1946  assert(request->range);
1947 
1949  range_iter.end = request->range->end();
1950  range_iter.debt_size = 0;
1951  const auto multipart = request->range->specs.size() > 1;
1952  if (multipart)
1954  range_iter.valid = true; // TODO: Remove.
1955  range_iter.updateSpec(); // TODO: Refactor to initialize rather than update.
1956 
1958  const auto &firstRange = *range_iter.pos;
1959  assert(firstRange);
1960  out.offset = firstRange->offset;
1961 
1962  return multipart ? mRangeCLen() : firstRange->length;
1963 }
1964 
1965 #if USE_ADAPTATION
1966 void
1969 {
1970  debugs(85, 3, HERE << "adaptation needed for " << this);
1974  new Adaptation::Iterator(request, NULL, al, g));
1975 
1976  // we could try to guess whether we can bypass this adaptation
1977  // initiation failure, but it should not really happen
1979 }
1980 
1981 void
1983 {
1984  assert(cbdataReferenceValid(this)); // indicates bug
1987 
1988  switch (answer.kind) {
1990  handleAdaptedHeader(const_cast<Http::Message*>(answer.message.getRaw()));
1991  break;
1992 
1994  handleAdaptationBlock(answer);
1995  break;
1996 
1998  static const auto d = MakeNamedErrorDetail("CLT_REQMOD_ABORT");
1999  handleAdaptationFailure(d, !answer.final);
2000  break;
2001  }
2002  }
2003 }
2004 
2005 void
2007 {
2008  assert(msg);
2009 
2010  if (HttpRequest *new_req = dynamic_cast<HttpRequest*>(msg)) {
2011  // update the new message to flag whether URL re-writing was done on it
2012  if (request->effectiveRequestUri() != new_req->effectiveRequestUri())
2013  new_req->flags.redirected = true;
2014  resetRequest(new_req);
2015  assert(request->method.id());
2016  } else if (HttpReply *new_rep = dynamic_cast<HttpReply*>(msg)) {
2017  debugs(85,3,HERE << "REQMOD reply is HTTP reply");
2018 
2019  // subscribe to receive reply body
2020  if (new_rep->body_pipe != NULL) {
2021  adaptedBodySource = new_rep->body_pipe;
2022  int consumer_ok = adaptedBodySource->setConsumerIfNotLate(this);
2023  assert(consumer_ok);
2024  }
2025 
2027  clientReplyContext *repContext = dynamic_cast<clientReplyContext *>(node->data.getRaw());
2028  assert(repContext);
2029  repContext->createStoreEntry(request->method, request->flags);
2030 
2033  storeEntry()->replaceHttpReply(new_rep);
2035 
2036  al->reply = new_rep;
2037 
2038  if (!adaptedBodySource) // no body
2039  storeEntry()->complete();
2040  clientGetMoreData(node, this);
2041  }
2042 
2043  // we are done with getting headers (but may be receiving body)
2045 
2047  doCallouts();
2048 }
2049 
2050 void
2052 {
2053  static const auto d = MakeNamedErrorDetail("REQMOD_BLOCK");
2055  AclMatchedName = answer.ruleId.termedBuf();
2058  AclMatchedName = NULL;
2059 }
2060 
2061 void
2063 {
2064  if (!adaptedBodySource)
2065  return;
2066 
2068 }
2069 
2070 void
2072 {
2075 
2076  if (size_t contentSize = adaptedBodySource->buf().contentSize()) {
2077  const size_t spaceAvailable = storeEntry()->bytesWanted(Range<size_t>(0,contentSize));
2078 
2079  if (spaceAvailable < contentSize ) {
2080  // No or partial body data consuming
2081  typedef NullaryMemFunT<ClientHttpRequest> Dialer;
2082  AsyncCall::Pointer call = asyncCall(93, 5, "ClientHttpRequest::resumeBodyStorage",
2083  Dialer(this, &ClientHttpRequest::resumeBodyStorage));
2084  storeEntry()->deferProducer(call);
2085  }
2086 
2087  if (!spaceAvailable)
2088  return;
2089 
2090  if (spaceAvailable < contentSize )
2091  contentSize = spaceAvailable;
2092 
2094  const StoreIOBuffer ioBuf(&bpc.buf, request_satisfaction_offset, contentSize);
2095  storeEntry()->write(ioBuf);
2096  // assume StoreEntry::write() writes the entire ioBuf
2098  bpc.buf.consume(contentSize);
2099  bpc.checkIn();
2100  }
2101 
2104  // else wait for more body data
2105 }
2106 
2107 void
2109 {
2111 
2112  // distinguish this code path from future noteBodyProducerAborted() that
2113  // would continue storing/delivering (truncated) reply if necessary (TODO)
2115 
2116  // should we end request satisfaction now?
2119 }
2120 
2121 void
2123 {
2124  debugs(85,4, HERE << this << " ends request satisfaction");
2127 
2128  // TODO: anything else needed to end store entry formation correctly?
2130  // We received the entire reply per receivedWholeAdaptedReply.
2131  // We are called when we consumed everything received (per our callers).
2132  // We consume only what we store per noteMoreBodyDataAvailable().
2133  storeEntry()->completeSuccessfully("received, consumed, and, hence, stored the entire REQMOD reply");
2134  } else {
2135  storeEntry()->completeTruncated("REQMOD request satisfaction default");
2136  }
2137 }
2138 
2139 void
2141 {
2144 
2145  debugs(85,3, HERE << "REQMOD body production failed");
2146  if (request_satisfaction_mode) { // too late to recover or serve an error
2147  static const auto d = MakeNamedErrorDetail("CLT_REQMOD_RESP_BODY");
2150  Must(Comm::IsConnOpen(c));
2151  c->close(); // drastic, but we may be writing a response already
2152  } else {
2153  static const auto d = MakeNamedErrorDetail("CLT_REQMOD_REQ_BODY");
2155  }
2156 }
2157 
2158 void
2160 {
2161  debugs(85,3, HERE << "handleAdaptationFailure(" << bypassable << ")");
2162 
2163  const bool usedStore = storeEntry() && !storeEntry()->isEmpty();
2164  const bool usedPipe = request->body_pipe != NULL &&
2165  request->body_pipe->consumedSize() > 0;
2166 
2167  if (bypassable && !usedStore && !usedPipe) {
2168  debugs(85,3, HERE << "ICAP REQMOD callout failed, bypassing: " << calloutContext);
2169  if (calloutContext)
2170  doCallouts();
2171  return;
2172  }
2173 
2174  debugs(85,3, HERE << "ICAP REQMOD callout failed, responding with error");
2175 
2177  clientReplyContext *repContext = dynamic_cast<clientReplyContext *>(node->data.getRaw());
2178  assert(repContext);
2179 
2180  calloutsError(ERR_ICAP_FAILURE, errDetail);
2181 
2182  if (calloutContext)
2183  doCallouts();
2184 }
2185 
2186 void
2187 ClientHttpRequest::callException(const std::exception &ex)
2188 {
2189  if (const auto clientConn = getConn() ? getConn()->clientConnection : nullptr) {
2190  if (Comm::IsConnOpen(clientConn)) {
2191  debugs(85, 3, "closing after exception: " << ex.what());
2192  clientConn->close(); // initiate orderly top-to-bottom cleanup
2193  return;
2194  }
2195  }
2196  debugs(85, DBG_IMPORTANT, "ClientHttpRequest exception without connection. Ignoring " << ex.what());
2197  // XXX: Normally, we mustStop() but we cannot do that here because it is
2198  // likely to leave Http::Stream and ConnStateData with a dangling http
2199  // pointer. See r13480 or XXX in Http::Stream class description.
2200 }
2201 #endif
2202 
2203 // XXX: modify and use with ClientRequestContext::clientAccessCheckDone too.
2204 void
2206 {
2207  // The original author of the code also wanted to pass an errno to
2208  // setReplyToError, but it seems unlikely that the errno reflects the
2209  // true cause of the error at this point, so I did not pass it.
2210  if (calloutContext) {
2211  ConnStateData * c = getConn();
2213  nullptr, c, request, al);
2214 #if USE_AUTH
2216  c != NULL && c->getAuth() != NULL ? c->getAuth() : request->auth_user_request;
2217 #endif
2218  calloutContext->error->detailError(errDetail);
2220  if (c != NULL)
2221  c->expectNoForwarding();
2222  }
2223  //else if(calloutContext == NULL) is it possible?
2224 }
2225 
const MemBuf & buf() const
Definition: BodyPipe.h:137
static char * cleanup(const char *uri)
Definition: Uri.cc:909
Definition: parse.c:104
void appendNewOnly(const NotePairs *src)
Definition: Notes.cc:381
char method[16]
Definition: tcp-banger2.c:115
@ ERR_SECURE_CONNECT_FAIL
Definition: forward.h:31
void absorbLogUri(char *aUri)
assigns log_uri with aUri without copying the entire C-string
@ METHOD_OTHER
Definition: MethodType.h:93
void resetRequest(HttpRequest *)
void * xcalloc(size_t n, size_t sz)
Definition: xalloc.cc:71
HttpHdrRange * getRange() const
Definition: HttpHeader.cc:1248
static HLPCB clientRedirectDoneWrapper
bool initiated(const CbcPointer< AsyncJob > &job) const
Must(initiated(initiate)) instead of Must(initiate.set()), for clarity.
Definition: Initiator.h:52
AnyP::ProtocolVersion http_ver
Definition: Message.h:73
void assignRequest(HttpRequest *aRequest)
@ scUnauthorized
Definition: StatusCode.h:45
@ METHOD_HEAD
Definition: MethodType.h:28
void port(unsigned short p)
Definition: Uri.h:94
AnyP::Uri url
the request URI
Definition: HttpRequest.h:115
common parts of HttpRequest and HttpReply
Definition: Message.h:26
bool interceptTproxy
Set for requests handled by a "tproxy" port.
Definition: RequestFlags.h:66
@ ERR_READ_ERROR
Definition: forward.h:28
void setServerBump(Ssl::ServerBump *srvBump)
Definition: client_side.h:287
BodyPipe::Pointer body_pipe
optional pipeline to receive message body
Definition: Message.h:98
char * canonicalCleanUrl() const
Definition: HttpRequest.cc:822
const char * findFirst(const char *noteKey) const
Definition: Notes.cc:297
Definition: Uri.h:31
char const * denyMessage(char const *const default_message=NULL) const
Definition: UserRequest.cc:127
virtual void noteAdaptationAnswer(const Adaptation::Answer &answer)
@ ERR_GATEWAY_FAILURE
Definition: forward.h:67
Ip::Address src_addr
ACLFilledChecklist * clientAclChecklistCreate(const acl_access *acl, ClientHttpRequest *http)
int setSockNfmark(const Comm::ConnectionPointer &conn, nfmark_t mark)
Definition: QosConfig.cc:601
const char * getStr(Http::HdrType id) const
Definition: HttpHeader.cc:1191
@ Error
Definition: ResultCode.h:19
void setAuth(const Auth::UserRequest::Pointer &aur, const char *cause)
Definition: client_side.cc:510
struct ClientHttpRequest::Redirect redirect
void fd_note(int fd, const char *s)
Definition: fd.cc:217
HttpHeader header
Definition: Message.h:75
int hasListMember(Http::HdrType id, const char *member, const char separator) const
Definition: HttpHeader.cc:1690
void errorAppendEntry(StoreEntry *entry, ErrorState *err)
Definition: errorpage.cc:720
#define FAILURE_MODE_TIME
void initRequest(HttpRequest *)
const ProxyProtocol::HeaderPointer & proxyProtocolHeader() const
Definition: client_side.h:361
RequestFlags flags
Definition: HttpRequest.h:141
@ Unknown
Definition: ResultCode.h:17
struct ConnStateData::@39 pinning
HttpHdrRange::iterator pos
int aclIsProxyAuth(const char *name)
Definition: Gadgets.cc:73
ssize_t HttpHeaderPos
Definition: HttpHeader.h:45
void clientStreamRead(clientStreamNode *thisObject, ClientHttpRequest *http, StoreIOBuffer readBuffer)
bool final
whether the error, if any, cannot be bypassed
Definition: Answer.h:41
ConnStateData * getConn() const
String x_forwarded_for_iterator
Definition: HttpRequest.h:187
void setErrorUri(const char *errorUri)
unsigned short icp
Definition: SquidConfig.h:139
acl_access * noCache
Definition: SquidConfig.h:373
static void clientAccessCheckDoneWrapper(Acl::Answer, void *)
#define HttpHeaderInitPos
Definition: HttpHeader.h:48
acl_access * adapted_http
Definition: SquidConfig.h:367
bool readNextRequest
whether Squid should read after error handling
#define ScheduleCallHere(call)
Definition: AsyncCall.h:166
void lock(const char *context)
Definition: store.cc:459
int hostStrictVerify
Definition: SquidConfig.h:344
void tunnelStart(ClientHttpRequest *)
Definition: tunnel.cc:1102
void error(char *format,...)
Ip::Address log_addr
Definition: client_side.h:137
bool sslBumpNeeded() const
returns true if and only if the request needs to be bumped
@ ERR_CACHE_ACCESS_DENIED
Definition: forward.h:19
int64_t bodySize(const HttpRequestMethod &) const
Definition: HttpReply.cc:375
bool parse(const HttpRequestMethod &, const SBuf &url)
Definition: Uri.cc:253
int64_t prepPartialResponseGeneration()
Comm::ConnectionPointer serverConnection
Definition: client_side.h:144
Definition: SBuf.h:87
BumpMode
Definition: support.h:126
@ ERR_CONFLICT_HOST
Definition: forward.h:48
ErrorState * error
saved error page for centralized/delayed processing
void calloutsError(const err_type error, const ErrorDetail::Pointer &errDetail)
Build an error reply. For use with the callouts.
void SBufToCstring(char *d, const SBuf &s)
Definition: SBuf.h:745
void httpRequestPack(void *obj, Packable *p)
Definition: HttpRequest.cc:362
@ scMovedPermanently
Definition: StatusCode.h:37
#define xstrdup
void updateLoggingTags(const LogTags_ot code)
update the code in the transaction processing tags
double request_failure_ratio
bool hostVerified
Definition: RequestFlags.h:64
bool maybeCacheable()
Definition: HttpRequest.cc:539
@ bumpTerminate
Definition: support.h:126
struct ClientHttpRequest::Flags flags
bool have(const Ip::Address &ip, size_t *position=nullptr) const
Definition: ipcache.cc:974
#define REDIRECT_DONE
Definition: defines.h:57
String getList(Http::HdrType id) const
Definition: HttpHeader.cc:841
bool hierarchical
Definition: RequestFlags.h:34
static int clientHierarchical(ClientHttpRequest *http)
clientStream_status_t CSS(clientStreamNode *, ClientHttpRequest *)
@ bumpEnd
Definition: support.h:126
Auth::UserRequest::Pointer auth_user_request
Definition: HttpRequest.h:127
void hostHeaderIpVerify(const ipcache_addrs *ia, const Dns::LookupDetails &dns)
int content_length
Definition: tcp-banger2.c:121
struct ClientHttpRequest::Out out
C * getRaw() const
Definition: RefCount.h:80
unsigned char tos_t
Definition: forward.h:27
void detailError(const ErrorDetail::Pointer &dCode)
set error type-specific detail code
Definition: errorpage.h:109
int cbdataReferenceValid(const void *p)
Definition: cbdata.cc:398
static void clientFollowXForwardedForCheck(Acl::Answer answer, void *data)
AccessLogEntry::Pointer al
info for the future access.log, and external ACL
bool IsConnOpen(const Comm::ConnectionPointer &conn)
Definition: Connection.cc:27
@ OK
Definition: Flag.h:16
const char * sslGetUserEmail(SSL *ssl)
Definition: support.cc:877
struct ConnStateData::@38 flags
#define REDIRECT_PENDING
Definition: defines.h:56
void HTTPMSGUNLOCK(M *&a)
Definition: Message.h:150
@ ERR_NONE
Definition: forward.h:15
void replaceHttpReply(const HttpReplyPointer &, const bool andStartWriting=true)
Definition: store.cc:1722
#define DBG_CRITICAL
Definition: Debug.h:40
StatusCode
Definition: StatusCode.h:20
err_type
Definition: forward.h:14
ClientRequestContext(ClientHttpRequest *)
int matchDomainName(const char *h, const char *d, MatchDomainNameFlags flags)
Definition: Uri.cc:735
bool respMaybeCacheable() const
@ akForward
forward the supplied adapted HTTP message
Definition: Answer.h:27
void detailError(const err_type c, const ErrorDetail::Pointer &d)
sets error detail if no earlier detail was available
Definition: HttpRequest.h:101
@ ERR_CLOSING
Definition: Flag.h:25
time_t hit_only_mode_until
CbcPointer< Initiate > initiateAdaptation(Initiate *x)
< starts freshly created initiate and returns a safe pointer to it
Definition: Initiator.cc:23
struct SquidConfig::@103 Program
#define cbdataReference(var)
Definition: cbdata.h:341
bool setConsumerIfNotLate(const Consumer::Pointer &aConsumer)
Definition: BodyPipe.cc:228
@ IF_MODIFIED_SINCE
#define DBG_IMPORTANT
Definition: Debug.h:41
void handleAdaptedHeader(Http::Message *msg)
AclDenyInfoList * denyInfoList
Definition: SquidConfig.h:415
static int port
Definition: ldap_backend.cc:69
Error error
the first transaction problem encountered (or falsy)
Definition: HttpRequest.h:161
@ scSeeOther
Definition: StatusCode.h:39
bool exhausted() const
Definition: BodyPipe.cc:174
AnyP::UriScheme const & getScheme() const
Definition: Uri.h:67
virtual void callException(const std::exception &ex)
called when the job throws during an async call
static void hostHeaderIpVerifyWrapper(const ipcache_addrs *ia, const Dns::LookupDetails &dns, void *data)
ClientHttpRequest * http
void fvdbCountVia(const SBuf &)
iterator end()
HttpHdrRangeIter range_iter
SQUIDCEXTERN CSD clientReplyDetach
a transaction problem
Definition: Error.h:18
bool readMore
needs comm_read (for this request or new requests)
Definition: client_side.h:140
static void Reset()
forgets the current context, setting it to nil/unknown
Definition: CodeContext.cc:75
const char * errorTypeName(err_type err)
Definition: Error.h:53
Definition: Range.h:19
@ ERR_ACCESS_DENIED
Definition: forward.h:18
int acl_uses_indirect_client
Definition: SquidConfig.h:333
virtual HttpRequest * clone() const
Definition: HttpRequest.cc:176
#define MAX_URL
Definition: defines.h:78
MemBuf & buf
Definition: BodyPipe.h:74
SQUIDCEXTERN CSS clientReplyStatus
@ ERR_ICAP_FAILURE
Definition: forward.h:64
@ ACCESS_AUTH_REQUIRED
Definition: Acl.h:114
virtual void noteBodyProductionEnded(BodyPipe::Pointer)
const char * AclMatchedName
Definition: Acl.cc:29
Http::MethodType id() const
Definition: RequestMethod.h:70
void clientStoreIdDone(const Helper::Reply &reply)
static void checkFailureRatio(err_type, hier_code)
mb_size_t contentSize() const
available data size
Definition: MemBuf.h:47
void setLogUriToRawUri(const char *rawUri, const HttpRequestMethod &)
void clearRequest()
resets the current request and log_uri to nil
@ scTemporaryRedirect
Definition: StatusCode.h:42
char rfc931[USER_IDENT_SZ]
Definition: Connection.h:174
void(* ObjPackMethod)(void *obj, Packable *p)
Definition: tools.h:33
#define NULL
Definition: types.h:166
void CSD(clientStreamNode *, ClientHttpRequest *)
client stream detach
void CSR(clientStreamNode *, ClientHttpRequest *)
client stream read
@ scForbidden
Definition: StatusCode.h:47
Ssl::BumpMode sslBumpMode
ssl_bump decision (Ssl::bumpEnd if n/a).
Definition: client_side.h:305
err_type aclGetDenyInfoPage(AclDenyInfoList **head, const char *name, int redirect_allowed)
Definition: Gadgets.cc:42
#define debugs(SECTION, LEVEL, CONTENT)
Definition: Debug.h:123
char ThisCache2[RFC2181_MAXHOSTNAMELEN<< 1]
void stopConsumingFrom(RefCount< BodyPipe > &)
Definition: BodyPipe.cc:118
@ HIER_NONE
Definition: hier_code.h:13
const HttpReply & baseReply() const
Definition: MemObject.h:59
iterates services in ServiceGroup, starting adaptation launchers
Definition: Iterator.h:32
wordlist * store_id
Definition: SquidConfig.h:200
acl_access * http
Definition: SquidConfig.h:366
Helper::ResultCode result
The helper response 'result' field.
Definition: Reply.h:59
void recordLookup(const Dns::LookupDetails &detail)
Definition: HttpRequest.cc:588
struct SquidConfig::UrlHelperTimeout onUrlRewriteTimeout
err_type type
Definition: errorpage.h:168
static uint32 A
Definition: md4.c:43
Ip::Address indirect_client_addr
Definition: HttpRequest.h:152
ACLFilledChecklist * Filled(ACLChecklist *checklist)
convenience and safety wrapper for dynamic_cast<ACLFilledChecklist*>
struct SquidConfig::@98 Port
@ LOG_TAG_NONE
Definition: LogTags.h:38
void handleAdaptationBlock(const Adaptation::Answer &answer)
void clearAdaptation(CbcPointer< Initiate > &x)
clears the pointer (does not call announceInitiatorAbort)
Definition: Initiator.cc:32
unsigned short port() const
Definition: Address.cc:778
#define SQUIDCEXTERN
Definition: squid.h:21
SBuf StringToSBuf(const String &s)
create a new SBuf from a String by copying contents
Definition: StringConvert.h:17
Ip::Address local
Definition: Connection.h:144
void ipcache_nbgethostbyname(const char *name, IPH *handler, void *handlerData)
Definition: ipcache.cc:600
int gopherCachable(const HttpRequest *req)
Definition: gopher.cc:289
Comm::ConnectionPointer clientConnection
Definition: Xaction.cc:49
std::ostream & HERE(std::ostream &s)
Definition: Debug.h:152
acl_access * ssl_bump
Definition: SquidConfig.h:395
int refresh_nocache_hack
NotePairs notes
Definition: Reply.h:62
Kind kind
the type of the answer
Definition: Answer.h:42
int delById(Http::HdrType id)
Definition: HttpHeader.cc:694
Http::HdrType id
Definition: HttpHeader.h:63
@ METHOD_CONNECT
Definition: MethodType.h:29
Adaptation::Icap::History::Pointer icapHistory() const
Returns possibly nil history, creating it if icap logging is enabled.
Definition: HttpRequest.cc:390
int unlock(const char *context)
Definition: store.cc:483
bool denied() const
Definition: Acl.h:155
Comm::ConnectionPointer conn
Definition: CommCalls.h:85
#define safe_free(x)
Definition: xalloc.h:73
time_t getTime(Http::HdrType id) const
Definition: HttpHeader.cc:1174
@ scPermanentRedirect
Definition: StatusCode.h:43
struct SquidConfig::@112 accessList
CommCbFunPtrCallT< Dialer > * commCbCall(int debugSection, int debugLevel, const char *callName, const Dialer &dialer)
Definition: CommCalls.h:342
bool hasOnlyIfCached() const
Definition: HttpHdrCc.h:145
int neighbors_do_private_keys
iterator begin()
int conn
the current server connection FD
Definition: Transport.cc:26
#define assert(EX)
Definition: assert.h:19
@ Okay
Definition: ResultCode.h:18
char const * termedBuf() const
Definition: SquidString.h:92
struct SquidConfig::@104 Accel
bool intercepted
Definition: RequestFlags.h:62
HttpHdrCc * cache_control
Definition: Message.h:77
void clientAccessCheckDone(const Acl::Answer &answer)
bool switchedToHttps() const
Definition: client_side.h:285
virtual void syncAle(HttpRequest *adaptedRequest, const char *logUri) const
assigns uninitialized adapted_request and url ALE components
void HTTPMSGLOCK(Http::Message *a)
Definition: Message.h:161
Comm::Flag flag
comm layer result status.
Definition: CommCalls.h:87
void hostHeaderVerifyFailed(const char *A, const char *B)
encapsulates DNS lookup results
Definition: LookupDetails.h:21
@ METHOD_TRACE
Definition: MethodType.h:30
ACLChecklist * acl_checklist
#define cbdataReferenceDone(var)
Definition: cbdata.h:350
@ toutActBypass
Definition: redirect.h:16
void write(StoreIOBuffer)
Definition: store.cc:794
Ip::Address my_addr
Definition: HttpRequest.h:155
@ PROTO_GOPHER
Definition: ProtocolType.h:30
@ scInternalServerError
Definition: StatusCode.h:71
HttpHdrRange * range
Definition: HttpRequest.h:143
const char * c_str()
Definition: SBuf.cc:516
void Write(const Comm::ConnectionPointer &conn, const char *buf, int size, AsyncCall::Pointer &callback, FREE *free_func)
Definition: Write.cc:34
int64_t strtoll(const char *nptr, char **endptr, int base)
Definition: strtoll.c:61
#define CBDATA_CLASS_INIT(type)
Definition: cbdata.h:318
time_t squid_curtime
Definition: stub_time.cc:17
@ ERR_DNS_FAIL
Definition: forward.h:35
Comm::ConnectionPointer clientConnection
Definition: Server.h:98
size_t bytesWanted(Range< size_t > const aRange, bool ignoreDelayPool=false) const
Definition: store.cc:249
char * xstrndup(const char *s, size_t n)
Definition: xstring.cc:56
void updateError(const Error &error)
if necessary, stores new error information (if any)
StoreEntry * storeCreateEntry(const char *url, const char *logUrl, const RequestFlags &flags, const HttpRequestMethod &method)
Definition: store.cc:773
#define xfree
bool doneFollowXff() const
Definition: RequestFlags.h:119
ConnStateData * conn_
void completeSuccessfully(const char *whyWeAreSureWeStoredTheWholeReply)
Definition: store.cc:1031
summarizes adaptation service answer for the noteAdaptationAnswer() API
Definition: Answer.h:23
Flag
Definition: Flag.h:15
const LogTags & loggingTags() const
the processing tags associated with this request transaction.
int strListIsSubstr(const String *list, const char *s, char del)
Definition: StrList.cc:63
void sslBumpAccessCheckDone(const Acl::Answer &answer)
The callback function for ssl-bump access check list.
void stopReading()
cancels Comm::Read() if it is scheduled
Definition: Server.cc:60
@ PROTO_CACHE_OBJECT
Definition: ProtocolType.h:32
#define fd_table
Definition: fde.h:189
void complete()
Definition: store.cc:1045
void switchToHttps(ClientHttpRequest *, Ssl::BumpMode bumpServerMode)
virtual void noteAdaptationAclCheckDone(Adaptation::ServiceGroupPointer group)
void expectNoForwarding()
cleans up virgin request [body] forwarding state
tos_t aclMapTOS(acl_tos *head, ACLChecklist *ch)
Checks for a TOS value to apply depending on the ACL.
Definition: FwdState.cc:1498
const Auth::UserRequest::Pointer & getAuth() const
Definition: client_side.h:124
HttpHdrRange::iterator end
@ scFound
Definition: StatusCode.h:38
virtual void noteBodyProducerAborted(BodyPipe::Pointer)
Ssl::BumpMode sslBumpNeed_
whether (and how) the request needs to be bumped
static void checkNoCacheDoneWrapper(Acl::Answer, void *)
@ pointPreCache
Definition: Elements.h:18
HttpRequestMethod method
Definition: HttpRequest.h:114
Config TheConfig
Globally available instance of Qos::Config.
Definition: QosConfig.cc:282
void fvdbCountForwarded(const SBuf &)
count occurrences of the given X-Forwarded-For header value
Http::MessagePointer message
HTTP request or response to forward.
Definition: Answer.h:39
#define REDIRECT_NONE
Definition: defines.h:55
bool setNfConnmark(Comm::ConnectionPointer &conn, const ConnectionDirection connDir, const NfMarkConfig &cm)
@ PROTO_HTTP
Definition: ProtocolType.h:25
int log_uses_indirect_client
Definition: SquidConfig.h:335
std::vector< HttpHdrRangeSpec * > specs
struct timeval current_time
Definition: stub_time.cc:15
@ LOG_TCP_DENIED
Definition: LogTags.h:52
bool allowed() const
Definition: Acl.h:149
static void clientRedirectAccessCheckDone(Acl::Answer answer, void *data)
wordlist * redirect
Definition: SquidConfig.h:199
struct SquidConfig::@111 onoff
void resumeBodyStorage()
called by StoreEntry when it has more buffer space available
void handleAdaptationFailure(const ErrorDetail::Pointer &errDetail, bool bypassable=false)
bool timestampsSet()
Definition: store.cc:1410
unsigned short defaultPort() const
Definition: UriScheme.cc:71
@ akError
no adapted message will come; see bypassable
Definition: Answer.h:29
Error bareError
a problem that occurred without a request (e.g., while parsing headers)
Definition: client_side.h:382
int has(Http::HdrType id) const
Definition: HttpHeader.cc:990
const SBuf storeId()
Definition: HttpRequest.cc:741
int reload_into_ims
Definition: SquidConfig.h:300
ErrorState * clientBuildError(err_type, Http::StatusCode, char const *url, const ConnStateData *, HttpRequest *, const AccessLogEntry::Pointer &)
char * url
Definition: tcp-banger2.c:114
void announceInitiatorAbort(CbcPointer< Initiate > &x)
inform the transaction about abnormal termination and clear the pointer
Definition: Initiator.cc:38
bool isEmpty() const
Definition: Store.h:67
@ bumpBump
Definition: support.h:126
static const char *const crlf
@ ERR_CONNECT_FAIL
Definition: forward.h:30
static HttpRequest * FromUrlXXX(const char *url, const MasterXaction::Pointer &, const HttpRequestMethod &method=Http::METHOD_GET)
Definition: HttpRequest.cc:529
int clientBeginRequest(const HttpRequestMethod &method, char const *url, CSCB *streamcallback, CSD *streamdetach, ClientStreamData streamdata, HttpHeader const *header, char *tailbuf, size_t taillen, const MasterXaction::Pointer &mx)
#define Must(condition)
Like assert() but throws an exception instead of aborting the process.
Definition: TextException.h:73
Ip::NfMarkConfig aclFindNfMarkConfig(acl_nfmark *head, ACLChecklist *ch)
Checks for a netfilter mark value to apply depending on the ACL.
Definition: FwdState.cc:1510
bool auth
pinned for www authentication
Definition: client_side.h:148
void clientRedirectDone(const Helper::Reply &reply)
@ ACCESS_ALLOWED
Definition: Acl.h:110
@ ACCESS_DENIED
Definition: Acl.h:109
void redirectStart(ClientHttpRequest *http, HLPCB *handler, void *data)
Definition: redirect.cc:285
@ scProxyAuthenticationRequired
Definition: StatusCode.h:51
Ssl::ServerBump * serverBump()
Definition: client_side.h:286
static void clientCheckPinning(ClientHttpRequest *http)
AsyncCall * asyncCall(int aDebugSection, int aDebugLevel, const char *aName, const Dialer &aDialer)
Definition: AsyncCall.h:156
static HttpReplyPointer MakeConnectionEstablished()
construct and return an HTTP/200 (Connection Established) response
Definition: HttpReply.cc:120
char * surrogate_id
Definition: SquidConfig.h:218
hier_code
Definition: hier_code.h:12
acl_access * redirector
Definition: SquidConfig.h:384
String rangeBoundaryStr() const
Definition: client_side.cc:796
const AccessLogEntry::Pointer al
access.log entry
int kind
the matched custom access list verb (or zero)
Definition: Acl.h:163
CbcPointer< Adaptation::Initiate > virginHeadSource
@ methodReqmod
Definition: Elements.h:17
@ BrokenHelper
Definition: ResultCode.h:20
void setLogUriToRequestUri()
sets log_uri when we know the current request
int setSockTos(const Comm::ConnectionPointer &conn, tos_t tos)
Definition: QosConfig.cc:569
bool conflicted() const
whether Squid is uncertain about the allowed() or denied() answer
Definition: Acl.h:158
void storeIdStart(ClientHttpRequest *http, HLPCB *handler, void *data)
Definition: redirect.cc:311
void clientStreamInit(dlink_list *list, CSR *func, CSD *rdetach, CSS *readstatus, ClientStreamData readdata, CSCB *callback, CSD *cdetach, ClientStreamData callbackdata, StoreIOBuffer tailBuffer)
void checkNoCacheDone(const Acl::Answer &answer)
void update(const Error &)
if necessary, stores the given error information (if any)
Definition: Error.cc:16
@ dirAccepted
accepted (from a client by Squid)
Definition: QosConfig.h:67
bool receivedWholeAdaptedReply
noteBodyProductionEnded() was called
@ scConflict
Definition: StatusCode.h:53
char * urlCanonicalCleanWithoutRequest(const SBuf &url, const HttpRequestMethod &method, const AnyP::UriScheme &scheme)
Definition: Uri.cc:619
Ssl::BumpMode sslBumpNeed() const
returns raw sslBump mode value
ClientRequestContext * calloutContext
static void SslBumpEstablish(const Comm::ConnectionPointer &, char *, size_t, Comm::Flag errflag, int, void *data)
static void sslBumpAccessCheckDoneWrapper(Acl::Answer, void *)
void HLPCB(void *, const Helper::Reply &)
Definition: forward.h:27
err_type category
primary error classification (or ERR_NONE)
Definition: Error.h:35
int port
port of pinned connection
Definition: client_side.h:146
void deferProducer(const AsyncCall::Pointer &producer)
call back producer when more buffer space is available
Definition: store.cc:378
void debugObj(int section, int level, const char *label, void *obj, ObjPackMethod pm)
Definition: tools.cc:905
#define xisspace(x)
Definition: xis.h:17
static void clientStoreIdAccessCheckDone(Acl::Answer answer, void *data)
StoreEntry * storeEntry() const
bool isOpen() const
Definition: Connection.h:99
StoreEntry * loggingEntry_
StoreEntry * loggingEntry() const
static uint32 B
Definition: md4.c:43
size_t appendDomainLen
Definition: SquidConfig.h:221
@ akBlock
block or deny the master xaction; see authority
Definition: Answer.h:28
@ bumpClientFirst
Definition: support.h:126
HttpHeaderEntry * getEntry(HttpHeaderPos *pos) const
Definition: HttpHeader.cc:611
void consume(mb_size_t sz)
removes sz bytes and "packs" by moving content left
Definition: MemBuf.cc:170
@ METHOD_GET
Definition: MethodType.h:25
MemObject * memObject() const
static StatHist s
#define false
Definition: GnuRegex.c:233
const SBuf & effectiveRequestUri() const
RFC 7230 section 5.5 - Effective Request URI.
Definition: HttpRequest.cc:752
void startAdaptation(const Adaptation::ServiceGroupPointer &g)
Initiate an asynchronous adaptation transaction which will call us back.
void CSCB(clientStreamNode *, ClientHttpRequest *, HttpReply *, StoreIOBuffer)
client stream read callback
acl_access * followXFF
Definition: SquidConfig.h:398
NotePairs::Pointer notes()
Definition: HttpRequest.cc:760
Ip::Address client_addr
Definition: HttpRequest.h:149
void host(const char *src)
Definition: Uri.cc:98
virtual void noteMoreBodyDataAvailable(BodyPipe::Pointer)
String ruleId
ACL (or similar rule) name that blocked forwarding.
Definition: Answer.h:40
bool forceTunnel
whether to forward via TunnelStateData (instead of FwdState)
Definition: RequestFlags.h:111
struct _request * request(char *urlin)
Definition: tcp-banger2.c:291
ClientHttpRequest(ConnStateData *csd)
void sslBumpEstablish(Comm::Flag errflag)
@ TimedOut
Definition: ResultCode.h:21
const char * bumpMode(int bm)
Definition: support.h:138
void nonBlockingCheck(ACLCB *callback, void *callback_data)
Definition: Checklist.cc:237
static void clientInterpretRequestHeaders(ClientHttpRequest *http)
char const * rawBuf() const
Definition: SquidString.h:86
String store_id
Definition: HttpRequest.h:139
static HLPCB clientStoreIdDoneWrapper
void completeTruncated(const char *whyWeConsiderTheReplyTruncated)
Definition: store.cc:1038
uint64_t consumedSize() const
Definition: BodyPipe.h:111
Http::StatusCode httpStatus
Definition: errorpage.h:171
Auth::UserRequest::Pointer auth_user_request
Definition: errorpage.h:173
SQUIDCEXTERN CSR clientGetMoreData
static bool Start(Method method, VectPoint vp, HttpRequest *req, HttpReply *, const AccessLogEntryPointer &, Adaptation::Initiator *)
Definition: AccessCheck.cc:30
class SquidConfig Config
Definition: SquidConfig.cc:12
void UpdateRequestNotes(ConnStateData *csd, HttpRequest &request, NotePairs const &helperNotes)
Definition: HttpRequest.cc:768
HttpRequest *const request
ErrorDetail::Pointer MakeNamedErrorDetail(const char *name)
Definition: Detail.cc:54
AnyP::ProtocolVersion ProtocolVersion(unsigned int aMajor, unsigned int aMinor)
HTTP version label information.
@ PROXY_AUTHORIZATION
int64_t mRangeCLen() const
Definition: client_side.cc:756
@ bumpSplice
Definition: support.h:126
BodyPipe::Pointer adaptedBodySource

 

Introduction

Documentation

Support

Miscellaneous

Web Site Translations

Mirrors