client_side_request.cc
Go to the documentation of this file.
1/*
2 * Copyright (C) 1996-2023 The Squid Software Foundation and contributors
3 *
4 * Squid software is distributed under GPLv2+ license and includes
5 * contributions from numerous individuals and organizations.
6 * Please see the COPYING and CONTRIBUTORS files for details.
7 */
8
9/* DEBUG: section 85 Client-side Request Routines */
10
11/*
12 * General logic of request processing:
13 *
14 * We run a series of tests to determine if access will be permitted, and to do
15 * any redirection. Then we call into the result clientStream to retrieve data.
16 * From that point on it's up to reply management.
17 */
18
19#include "squid.h"
20#include "acl/FilledChecklist.h"
21#include "acl/Gadgets.h"
22#include "anyp/PortCfg.h"
23#include "base/AsyncJobCalls.h"
24#include "client_side.h"
25#include "client_side_reply.h"
26#include "client_side_request.h"
28#include "clientStream.h"
29#include "comm/Connection.h"
30#include "comm/Write.h"
31#include "error/Detail.h"
32#include "errorpage.h"
33#include "fd.h"
34#include "fde.h"
35#include "format/Token.h"
36#include "FwdState.h"
37#include "helper.h"
38#include "helper/Reply.h"
39#include "http.h"
40#include "http/Stream.h"
41#include "HttpHdrCc.h"
42#include "HttpReply.h"
43#include "HttpRequest.h"
44#include "internal.h"
45#include "ip/NfMarkConfig.h"
46#include "ip/QosConfig.h"
47#include "ipcache.h"
48#include "log/access_log.h"
49#include "MemObject.h"
50#include "Parsing.h"
51#include "proxyp/Header.h"
52#include "redirect.h"
53#include "rfc1738.h"
54#include "sbuf/StringConvert.h"
55#include "SquidConfig.h"
56#include "Store.h"
57#include "StrList.h"
58#include "tools.h"
59#include "wordlist.h"
60#if USE_AUTH
61#include "auth/UserRequest.h"
62#endif
63#if USE_ADAPTATION
65#include "adaptation/Answer.h"
66#include "adaptation/Iterator.h"
67#include "adaptation/Service.h"
68#if ICAP_CLIENT
70#endif
71#endif
72#if USE_OPENSSL
73#include "ssl/ServerBump.h"
74#include "ssl/support.h"
75#endif
76
77#if FOLLOW_X_FORWARDED_FOR
78static void clientFollowXForwardedForCheck(Acl::Answer answer, void *data);
79#endif /* FOLLOW_X_FORWARDED_FOR */
80
82
84
85/* Local functions */
86/* other */
87static void clientAccessCheckDoneWrapper(Acl::Answer, void *);
88#if USE_OPENSSL
90#endif
91static int clientHierarchical(ClientHttpRequest * http);
95static void checkNoCacheDoneWrapper(Acl::Answer, void *);
100
102{
103 /*
104 * Release our "lock" on our parent, ClientHttpRequest, if we
105 * still have one
106 */
107
108 if (http)
110
111 delete error;
112 debugs(85,3, "ClientRequestContext destructed, this=" << this);
113}
114
116 http(cbdataReference(anHttp))
117{
118 debugs(85, 3, "ClientRequestContext constructed, this=" << this);
119}
120
122
124#if USE_ADAPTATION
125 AsyncJob("ClientHttpRequest"),
126#endif
127 al(new AccessLogEntry()),
128 conn_(cbdataReference(aConn))
129{
132 if (aConn) {
133 al->tcpClient = aConn->clientConnection;
134 al->cache.port = aConn->port;
135 al->cache.caddr = aConn->log_addr;
137 al->updateError(aConn->bareError);
138
139#if USE_OPENSSL
140 if (aConn->clientConnection != nullptr && aConn->clientConnection->isOpen()) {
141 if (auto ssl = fd_table[aConn->clientConnection->fd].ssl.get())
142 al->cache.sslClientCert.resetWithoutLocking(SSL_get_peer_certificate(ssl));
143 }
144#endif
145 }
147}
148
149/*
150 * returns true if client specified that the object must come from the cache
151 * without contacting origin server
152 */
153bool
155{
157 return request->cache_control &&
159}
160
173static void
175{
176 // Can be set at compile time with -D compiler flag
177#ifndef FAILURE_MODE_TIME
178#define FAILURE_MODE_TIME 300
179#endif
180
181 if (hcode == HIER_NONE)
182 return;
183
184 // don't bother when ICP is disabled.
185 if (Config.Port.icp <= 0)
186 return;
187
188 static double magic_factor = 100.0;
189 double n_good;
190 double n_bad;
191
192 n_good = magic_factor / (1.0 + request_failure_ratio);
193
194 n_bad = magic_factor - n_good;
195
196 switch (etype) {
197
198 case ERR_DNS_FAIL:
199
200 case ERR_CONNECT_FAIL:
202
203 case ERR_READ_ERROR:
204 ++n_bad;
205 break;
206
207 default:
208 ++n_good;
209 }
210
211 request_failure_ratio = n_bad / n_good;
212
214 return;
215
216 if (request_failure_ratio < 1.0)
217 return;
218
219 debugs(33, DBG_CRITICAL, "WARNING: Failure Ratio at "<< std::setw(4)<<
220 std::setprecision(3) << request_failure_ratio);
221
222 debugs(33, DBG_CRITICAL, "WARNING: ICP going into HIT-only mode for " <<
223 FAILURE_MODE_TIME / 60 << " minutes...");
224
226
227 request_failure_ratio = 0.8; /* reset to something less than 1.0 */
228}
229
231{
232 debugs(33, 3, "httpRequestFree: " << uri);
233
234 // Even though freeResources() below may destroy the request,
235 // we no longer set request->body_pipe to NULL here
236 // because we did not initiate that pipe (ConnStateData did)
237
238 /* the ICP check here was erroneous
239 * - StoreEntry::releaseRequest was always called if entry was valid
240 */
241
242 logRequest();
243
244 loggingEntry(nullptr);
245
246 if (request)
248
250
251#if USE_ADAPTATION
253
254 if (adaptedBodySource != nullptr)
256#endif
257
258 delete calloutContext;
259
260 if (conn_)
262
263 /* moving to the next connection is handled by the context free */
265}
266
276int
277clientBeginRequest(const HttpRequestMethod& method, char const *url, CSCB * streamcallback,
278 CSD * streamdetach, ClientStreamData streamdata, HttpHeader const *header,
279 char *tailbuf, size_t taillen, const MasterXaction::Pointer &mx)
280{
281 size_t url_sz;
282 ClientHttpRequest *http = new ClientHttpRequest(nullptr);
283 HttpRequest *request;
284 StoreIOBuffer tempBuffer;
285 if (http->al != nullptr)
287 /* this is only used to adjust the connection offset in client_side.c */
288 http->req_sz = 0;
289 tempBuffer.length = taillen;
290 tempBuffer.data = tailbuf;
291 /* client stream setup */
293 clientReplyStatus, new clientReplyContext(http), streamcallback,
294 streamdetach, streamdata, tempBuffer);
295 /* make it visible in the 'current acctive requests list' */
296 /* Set flags */
297 /* internal requests only makes sense in an
298 * accelerator today. TODO: accept flags ? */
299 http->flags.accel = true;
300 /* allow size for url rewriting */
301 url_sz = strlen(url) + Config.appendDomainLen + 5;
302 http->uri = (char *)xcalloc(url_sz, 1);
303 strcpy(http->uri, url); // XXX: polluting http->uri before parser validation
304
305 request = HttpRequest::FromUrlXXX(http->uri, mx, method);
306 if (!request) {
307 debugs(85, 5, "Invalid URL: " << http->uri);
308 return -1;
309 }
310
311 /*
312 * now update the headers in request with our supplied headers.
313 * HttpRequest::FromUrl() should return a blank header set, but
314 * we use Update to be sure of correctness.
315 */
316 if (header)
317 request->header.update(header);
318
319 /* http struct now ready */
320
321 /*
322 * build new header list *? TODO
323 */
324 request->flags.accelerated = http->flags.accel;
325
326 /* this is an internally created
327 * request, not subject to acceleration
328 * target overrides */
329 // TODO: detect and handle internal requests of internal objects?
330
331 /* Internally created requests cannot have bodies today */
332 request->content_length = 0;
333
334 request->client_addr.setNoAddr();
335
336#if FOLLOW_X_FORWARDED_FOR
338#endif /* FOLLOW_X_FORWARDED_FOR */
339
340 request->my_addr.setNoAddr(); /* undefined for internal requests */
341
342 request->my_addr.port(0);
343
344 request->http_ver = Http::ProtocolVersion();
345
346 http->initRequest(request);
347
348 /* optional - skip the access check ? */
349 http->calloutContext = new ClientRequestContext(http);
350
351 http->calloutContext->http_access_done = false;
352
353 http->calloutContext->redirect_done = true;
354
355 http->calloutContext->no_cache_done = true;
356
357 http->doCallouts();
358
359 return 0;
360}
361
362bool
364{
365 ClientHttpRequest *http_ = http;
366
367 if (cbdataReferenceValid(http_))
368 return true;
369
370 http = nullptr;
371
372 cbdataReferenceDone(http_);
373
374 return false;
375}
376
377#if FOLLOW_X_FORWARDED_FOR
392static void
394{
395 ClientRequestContext *calloutContext = (ClientRequestContext *) data;
396
397 if (!calloutContext->httpStateIsValid())
398 return;
399
400 ClientHttpRequest *http = calloutContext->http;
401 HttpRequest *request = http->request;
402
403 if (answer.allowed() && request->x_forwarded_for_iterator.size() != 0) {
404
405 /*
406 * Remove the last comma-delimited element from the
407 * x_forwarded_for_iterator and use it to repeat the cycle.
408 */
409 const char *p;
410 const char *asciiaddr;
411 int l;
412 Ip::Address addr;
413 p = request->x_forwarded_for_iterator.termedBuf();
414 l = request->x_forwarded_for_iterator.size();
415
416 /*
417 * XXX x_forwarded_for_iterator should really be a list of
418 * IP addresses, but it's a String instead. We have to
419 * walk backwards through the String, biting off the last
420 * comma-delimited part each time. As long as the data is in
421 * a String, we should probably implement and use a variant of
422 * strListGetItem() that walks backwards instead of forwards
423 * through a comma-separated list. But we don't even do that;
424 * we just do the work in-line here.
425 */
426 /* skip trailing space and commas */
427 while (l > 0 && (p[l-1] == ',' || xisspace(p[l-1])))
428 --l;
429 request->x_forwarded_for_iterator.cut(l);
430 /* look for start of last item in list */
431 while (l > 0 && ! (p[l-1] == ',' || xisspace(p[l-1])))
432 --l;
433 asciiaddr = p+l;
434 if ((addr = asciiaddr)) {
435 request->indirect_client_addr = addr;
436 request->x_forwarded_for_iterator.cut(l);
439 /* override the default src_addr tested if we have to go deeper than one level into XFF */
440 Filled(calloutContext->acl_checklist)->src_addr = request->indirect_client_addr;
441 }
443 return;
444 }
445 }
446
447 /* clean up, and pass control to clientAccessCheck */
449 /*
450 * Ensure that the access log shows the indirect client
451 * instead of the direct client.
452 */
453 http->al->cache.caddr = request->indirect_client_addr;
454 if (ConnStateData *conn = http->getConn())
455 conn->log_addr = request->indirect_client_addr;
456 }
458 request->flags.done_follow_x_forwarded_for = true;
459
460 if (answer.conflicted()) {
461 debugs(28, DBG_CRITICAL, "ERROR: Processing X-Forwarded-For. Stopping at IP address: " << request->indirect_client_addr );
462 }
463
464 /* process actual access ACL as normal. */
465 calloutContext->clientAccessCheck();
466}
467#endif /* FOLLOW_X_FORWARDED_FOR */
468
469static void
471{
472 ClientRequestContext *c = static_cast<ClientRequestContext*>(data);
473 c->hostHeaderIpVerify(ia, dns);
474}
475
476void
478{
480
481 // note the DNS details for the transaction stats.
483
484 // Is the NAT destination IP in DNS?
485 if (ia && ia->have(clientConn->local)) {
486 debugs(85, 3, "validate IP " << clientConn->local << " possible from Host:");
488 http->doCallouts();
489 return;
490 }
491 debugs(85, 3, "FAIL: validate IP " << clientConn->local << " possible from Host:");
492 hostHeaderVerifyFailed("local IP", "any domain IP");
493}
494
495void
497{
498 // IP address validation for Host: failed. Admin wants to ignore them.
499 // NP: we do not yet handle CONNECT tunnels well, so ignore for them
501 debugs(85, 3, "SECURITY ALERT: Host header forgery detected on " << http->getConn()->clientConnection <<
502 " (" << A << " does not match " << B << ") on URL: " << http->request->effectiveRequestUri());
503
504 // MUST NOT cache (for now). It is tempting to set flags.noCache, but
505 // that flag is about satisfying _this_ request. We are actually OK with
506 // satisfying this request from the cache, but want to prevent _other_
507 // requests from being satisfied using this response.
509
510 // XXX: when we have updated the cache key to base on raw-IP + URI this cacheable limit can go.
511 http->request->flags.hierarchical = false; // MUST NOT pass to peers (for now)
512 // XXX: when we have sorted out the best way to relay requests properly to peers this hierarchical limit can go.
513 http->doCallouts();
514 return;
515 }
516
517 debugs(85, DBG_IMPORTANT, "SECURITY ALERT: Host header forgery detected on " <<
518 http->getConn()->clientConnection << " (" << A << " does not match " << B << ")");
519 if (const char *ua = http->request->header.getStr(Http::HdrType::USER_AGENT))
520 debugs(85, DBG_IMPORTANT, "SECURITY ALERT: By user agent: " << ua);
521 debugs(85, DBG_IMPORTANT, "SECURITY ALERT: on URL: " << http->request->effectiveRequestUri());
522
523 // IP address validation for Host: failed. reject the connection.
525 clientReplyContext *repContext = dynamic_cast<clientReplyContext *>(node->data.getRaw());
526 assert (repContext);
527 repContext->setReplyToError(ERR_CONFLICT_HOST, Http::scConflict,
528 nullptr,
529 http->getConn(),
530 http->request,
531 nullptr,
532#if USE_AUTH
533 http->getConn() != nullptr && http->getConn()->getAuth() != nullptr ?
535#else
536 nullptr);
537#endif
539 clientStreamRead(node, http, node->readBuffer);
540}
541
542void
544{
545 // Require a Host: header.
546 const char *host = http->request->header.getStr(Http::HdrType::HOST);
547
548 if (!host) {
549 // TODO: dump out the HTTP/1.1 error about missing host header.
550 // otherwise this is fine, can't forge a header value when its not even set.
551 debugs(85, 3, "validate skipped with no Host: header present.");
552 http->doCallouts();
553 return;
554 }
555
556 if (http->request->flags.internal) {
557 // TODO: kill this when URL handling allows partial URLs out of accel mode
558 // and we no longer screw with the URL just to add our internal host there
559 debugs(85, 6, "validate skipped due to internal composite URL.");
560 http->doCallouts();
561 return;
562 }
563
564 // TODO: Unify Host value parsing below with AnyP::Uri authority parsing
565 // Locate if there is a port attached, strip ready for IP lookup
566 char *portStr = nullptr;
567 char *hostB = xstrdup(host);
568 host = hostB;
569 if (host[0] == '[') {
570 // IPv6 literal.
571 portStr = strchr(hostB, ']');
572 if (portStr && *(++portStr) != ':') {
573 portStr = nullptr;
574 }
575 } else {
576 // Domain or IPv4 literal with port
577 portStr = strrchr(hostB, ':');
578 }
579
580 uint16_t port = 0;
581 if (portStr) {
582 *portStr = '\0'; // strip the ':'
583 if (*(++portStr) != '\0') {
584 char *end = nullptr;
585 int64_t ret = strtoll(portStr, &end, 10);
586 if (end == portStr || *end != '\0' || ret < 1 || ret > 0xFFFF) {
587 // invalid port details. Replace the ':'
588 *(--portStr) = ':';
589 portStr = nullptr;
590 } else
591 port = (ret & 0xFFFF);
592 }
593 }
594
595 debugs(85, 3, "validate host=" << host << ", port=" << port << ", portStr=" << (portStr?portStr:"NULL"));
597 // verify the Host: port (if any) matches the apparent destination
598 if (portStr && port != http->getConn()->clientConnection->local.port()) {
599 debugs(85, 3, "FAIL on validate port " << http->getConn()->clientConnection->local.port() <<
600 " matches Host: port " << port << " (" << portStr << ")");
601 hostHeaderVerifyFailed("intercepted port", portStr);
602 } else {
603 // XXX: match the scheme default port against the apparent destination
604
605 // verify the destination DNS is one of the Host: headers IPs
607 }
608 } else if (!Config.onoff.hostStrictVerify) {
609 debugs(85, 3, "validate skipped.");
610 http->doCallouts();
611 } else if (strlen(host) != strlen(http->request->url.host())) {
612 // Verify forward-proxy requested URL domain matches the Host: header
613 debugs(85, 3, "FAIL on validate URL domain length " << http->request->url.host() << " matches Host: " << host);
615 } else if (matchDomainName(host, http->request->url.host()) != 0) {
616 // Verify forward-proxy requested URL domain matches the Host: header
617 debugs(85, 3, "FAIL on validate URL domain " << http->request->url.host() << " matches Host: " << host);
619 } else if (portStr && !http->request->url.port()) {
620 debugs(85, 3, "FAIL on validate portless URI matches Host: " << portStr);
621 hostHeaderVerifyFailed("portless URI", portStr);
622 } else if (portStr && port != *http->request->url.port()) {
623 // Verify forward-proxy requested URL domain matches the Host: header
624 debugs(85, 3, "FAIL on validate URL port " << *http->request->url.port() << " matches Host: port " << portStr);
625 hostHeaderVerifyFailed("URL port", portStr);
626 } else if (!portStr && http->request->method != Http::METHOD_CONNECT && http->request->url.port() != http->request->url.getScheme().defaultPort()) {
627 // Verify forward-proxy requested URL domain matches the Host: header
628 // Special case: we don't have a default-port to check for CONNECT. Assume URL is correct.
629 debugs(85, 3, "FAIL on validate URL port " << http->request->url.port().value_or(0) << " matches Host: default port " << http->request->url.getScheme().defaultPort().value_or(0));
630 hostHeaderVerifyFailed("URL port", "default port");
631 } else {
632 // Okay no problem.
633 debugs(85, 3, "validate passed.");
635 http->doCallouts();
636 }
637 safe_free(hostB);
638}
639
640/* This is the entry point for external users of the client_side routines */
641void
643{
644#if FOLLOW_X_FORWARDED_FOR
645 if (!http->request->flags.doneFollowXff() &&
648
649 /* we always trust the direct client address for actual use */
652
653 /* setup the XFF iterator for processing */
655
656 /* begin by checking to see if we trust direct client enough to walk XFF */
659 return;
660 }
661#endif
662
663 if (Config.accessList.http) {
666 } else {
667 debugs(0, DBG_CRITICAL, "No http_access configuration found. This will block ALL traffic");
669 }
670}
671
677void
679{
683 } else {
684 debugs(85, 2, "No adapted_http_access configuration. default: ALLOW");
686 }
687}
688
689void
691{
692 ClientRequestContext *calloutContext = (ClientRequestContext *) data;
693
694 if (!calloutContext->httpStateIsValid())
695 return;
696
697 calloutContext->clientAccessCheckDone(answer);
698}
699
700void
702{
703 acl_checklist = nullptr;
704 err_type page_id;
705 Http::StatusCode status;
706 debugs(85, 2, "The request " << http->request->method << ' ' <<
707 http->uri << " is " << answer <<
708 "; last ACL checked: " << (AclMatchedName ? AclMatchedName : "[none]"));
709
710#if USE_AUTH
711 char const *proxy_auth_msg = "<null>";
712 if (http->getConn() != nullptr && http->getConn()->getAuth() != nullptr)
713 proxy_auth_msg = http->getConn()->getAuth()->denyMessage("<null>");
714 else if (http->request->auth_user_request != nullptr)
715 proxy_auth_msg = http->request->auth_user_request->denyMessage("<null>");
716#endif
717
718 if (!answer.allowed()) {
719 // auth has a grace period where credentials can be expired but okay not to challenge.
720
721 /* Send an auth challenge or error */
722 // XXX: do we still need aclIsProxyAuth() ?
723 bool auth_challenge = (answer == ACCESS_AUTH_REQUIRED || aclIsProxyAuth(AclMatchedName));
724 debugs(85, 5, "Access Denied: " << http->uri);
725 debugs(85, 5, "AclMatchedName = " << (AclMatchedName ? AclMatchedName : "<null>"));
726#if USE_AUTH
727 if (auth_challenge)
728 debugs(33, 5, "Proxy Auth Message = " << (proxy_auth_msg ? proxy_auth_msg : "<null>"));
729#endif
730
731 /*
732 * NOTE: get page_id here, based on AclMatchedName because if
733 * USE_DELAY_POOLS is enabled, then AclMatchedName gets clobbered in
734 * the clientCreateStoreEntry() call just below. Pedro Ribeiro
735 * <pribeiro@isel.pt>
736 */
738
740
741 if (auth_challenge) {
742#if USE_AUTH
743 if (http->request->flags.sslBumped) {
744 /*SSL Bumped request, authentication is not possible*/
745 status = Http::scForbidden;
746 } else if (!http->flags.accel) {
747 /* Proxy authorisation needed */
749 } else {
750 /* WWW authorisation needed */
751 status = Http::scUnauthorized;
752 }
753#else
754 // need auth, but not possible to do.
755 status = Http::scForbidden;
756#endif
757 if (page_id == ERR_NONE)
758 page_id = ERR_CACHE_ACCESS_DENIED;
759 } else {
760 status = Http::scForbidden;
761
762 if (page_id == ERR_NONE)
763 page_id = ERR_ACCESS_DENIED;
764 }
765
766 error = clientBuildError(page_id, status, nullptr, http->getConn(), http->request, http->al);
767
768#if USE_AUTH
770 http->getConn() != nullptr && http->getConn()->getAuth() != nullptr ?
772#endif
773
774 readNextRequest = true;
775 }
776
777 /* ACCESS_ALLOWED continues here ... */
778 xfree(http->uri);
780 http->doCallouts();
781}
782
783#if USE_ADAPTATION
784void
786{
787 debugs(93,3, this << " adaptationAclCheckDone called");
788
789#if ICAP_CLIENT
791 if (ih != nullptr) {
792 if (getConn() != nullptr && getConn()->clientConnection != nullptr) {
793 ih->rfc931 = getConn()->clientConnection->rfc931;
794#if USE_OPENSSL
795 if (getConn()->clientConnection->isOpen()) {
796 ih->ssluser = sslGetUserEmail(fd_table[getConn()->clientConnection->fd].ssl.get());
797 }
798#endif
799 }
800 ih->log_uri = log_uri;
801 ih->req_sz = req_sz;
802 }
803#endif
804
805 if (!g) {
806 debugs(85,3, "no adaptation needed");
807 doCallouts();
808 return;
809 }
810
812}
813
814#endif
815
816static void
818{
820 ClientHttpRequest *http = context->http;
821 context->acl_checklist = nullptr;
822
823 if (answer.allowed())
825 else {
826 Helper::Reply const nilReply(Helper::Error);
827 context->clientRedirectDone(nilReply);
828 }
829}
830
831void
833{
834 debugs(33, 5, "'" << http->uri << "'");
839 } else
841}
842
847static void
849{
850 ClientRequestContext *context = static_cast<ClientRequestContext *>(data);
851 ClientHttpRequest *http = context->http;
852 context->acl_checklist = nullptr;
853
854 if (answer.allowed())
856 else {
857 debugs(85, 3, "access denied expected ERR reply handling: " << answer);
858 Helper::Reply const nilReply(Helper::Error);
859 context->clientStoreIdDone(nilReply);
860 }
861}
862
868void
870{
871 debugs(33, 5,"'" << http->uri << "'");
872
876 } else
878}
879
880static int
882{
883 HttpRequest *request = http->request;
884 HttpRequestMethod method = request->method;
885
886 // intercepted requests MUST NOT (yet) be sent to peers unless verified
887 if (!request->flags.hostVerified && (request->flags.intercepted || request->flags.interceptTproxy))
888 return 0;
889
890 /*
891 * IMS needs a private key, so we can use the hierarchy for IMS only if our
892 * neighbors support private keys
893 */
894
895 if (request->flags.ims && !neighbors_do_private_keys)
896 return 0;
897
898 /*
899 * This is incorrect: authenticating requests can be sent via a hierarchy
900 * (they can even be cached if the correct headers are set on the reply)
901 */
902 if (request->flags.auth)
903 return 0;
904
905 if (method == Http::METHOD_TRACE)
906 return 1;
907
908 if (method != Http::METHOD_GET)
909 return 0;
910
911 if (request->flags.loopDetected)
912 return 0;
913
914 if (request->url.getScheme() == AnyP::PROTO_HTTP)
915 return method.respMaybeCacheable();
916
917 return 1;
918}
919
920static void
922{
923 HttpRequest *request = http->request;
924 HttpHeader *req_hdr = &request->header;
925 ConnStateData *http_conn = http->getConn();
926
927 /* Internal requests such as those from ESI includes may be without
928 * a client connection
929 */
930 if (!http_conn)
931 return;
932
933 request->flags.connectionAuthDisabled = http_conn->port->connection_auth_disabled;
934 if (!request->flags.connectionAuthDisabled) {
935 if (Comm::IsConnOpen(http_conn->pinning.serverConnection)) {
936 if (http_conn->pinning.auth) {
937 request->flags.connectionAuth = true;
938 request->flags.auth = true;
939 } else {
940 request->flags.connectionProxyAuth = true;
941 }
942 // These should already be linked correctly.
943 assert(request->clientConnectionManager == http_conn);
944 }
945 }
946
947 /* check if connection auth is used, and flag as candidate for pinning
948 * in such case.
949 * Note: we may need to set flags.connectionAuth even if the connection
950 * is already pinned if it was pinned earlier due to proxy auth
951 */
952 if (!request->flags.connectionAuth) {
956 int may_pin = 0;
957 while ((e = req_hdr->getEntry(&pos))) {
959 const char *value = e->value.rawBuf();
960 if (strncasecmp(value, "NTLM ", 5) == 0
961 ||
962 strncasecmp(value, "Negotiate ", 10) == 0
963 ||
964 strncasecmp(value, "Kerberos ", 9) == 0) {
966 request->flags.connectionAuth = true;
967 may_pin = 1;
968 } else {
969 request->flags.connectionProxyAuth = true;
970 may_pin = 1;
971 }
972 }
973 }
974 }
975 if (may_pin && !request->pinnedConnection()) {
976 // These should already be linked correctly. Just need the ServerConnection to pinn.
977 assert(request->clientConnectionManager == http_conn);
978 }
979 }
980 }
981}
982
983static void
985{
986 HttpRequest *request = http->request;
987 HttpHeader *req_hdr = &request->header;
988 bool no_cache = false;
989
990 request->imslen = -1;
991 request->ims = req_hdr->getTime(Http::HdrType::IF_MODIFIED_SINCE);
992
993 if (request->ims > 0)
994 request->flags.ims = true;
995
996 if (!request->flags.ignoreCc) {
997 if (request->cache_control) {
998 if (request->cache_control->hasNoCache())
999 no_cache=true;
1000
1001 // RFC 2616: treat Pragma:no-cache as if it was Cache-Control:no-cache when Cache-Control is missing
1002 } else if (req_hdr->has(Http::HdrType::PRAGMA))
1003 no_cache = req_hdr->hasListMember(Http::HdrType::PRAGMA,"no-cache",',');
1004 }
1005
1006 if (request->method == Http::METHOD_OTHER) {
1007 no_cache=true;
1008 }
1009
1010 if (no_cache) {
1011#if USE_HTTP_VIOLATIONS
1012
1014 request->flags.nocacheHack = true;
1015 else if (refresh_nocache_hack)
1016 request->flags.nocacheHack = true;
1017 else
1018#endif
1019
1020 request->flags.noCache = true;
1021 }
1022
1023 /* ignore range header in non-GETs or non-HEADs */
1024 if (request->method == Http::METHOD_GET || request->method == Http::METHOD_HEAD) {
1025 // XXX: initialize if we got here without HttpRequest::parseHeader()
1026 if (!request->range)
1027 request->range = req_hdr->getRange();
1028
1029 if (request->range) {
1030 request->flags.isRanged = true;
1032 /* XXX: This is suboptimal. We should give the stream the range set,
1033 * and thereby let the top of the stream set the offset when the
1034 * size becomes known. As it is, we will end up requesting from 0
1035 * for evey -X range specification.
1036 * RBC - this may be somewhat wrong. We should probably set the range
1037 * iter up at this point.
1038 */
1039 node->readBuffer.offset = request->range->lowestOffset(0);
1040 }
1041 }
1042
1043 /* Only HEAD and GET requests permit a Range or Request-Range header.
1044 * If these headers appear on any other type of request, delete them now.
1045 */
1046 else {
1047 req_hdr->delById(Http::HdrType::RANGE);
1049 request->ignoreRange("neither HEAD nor GET");
1050 }
1051
1052 if (req_hdr->has(Http::HdrType::AUTHORIZATION))
1053 request->flags.auth = true;
1054
1055 clientCheckPinning(http);
1056
1057 if (!request->url.userInfo().isEmpty())
1058 request->flags.auth = true;
1059
1060 if (req_hdr->has(Http::HdrType::VIA)) {
1061 String s = req_hdr->getList(Http::HdrType::VIA);
1062 /*
1063 * ThisCache cannot be a member of Via header, "1.1 ThisCache" can.
1064 * Note ThisCache2 has a space prepended to the hostname so we don't
1065 * accidentally match super-domains.
1066 */
1067
1068 if (strListIsSubstr(&s, ThisCache2, ',')) {
1069 request->flags.loopDetected = true;
1070 }
1071
1072#if USE_FORW_VIA_DB
1074
1075#endif
1076
1077 s.clean();
1078 }
1079
1080 // headers only relevant to reverse-proxy
1081 if (request->flags.accelerated) {
1082 // check for a cdn-info member with a cdn-id matching surrogate_id
1083 // XXX: HttpHeader::hasListMember() does not handle OWS around ";" yet
1085 request->flags.loopDetected = true;
1086 }
1087
1088 if (request->flags.loopDetected) {
1089 debugObj(33, DBG_IMPORTANT, "WARNING: Forwarding loop detected for:\n",
1090 request, (ObjPackMethod) & httpRequestPack);
1091 }
1092
1093#if USE_FORW_VIA_DB
1094
1095 if (req_hdr->has(Http::HdrType::X_FORWARDED_FOR)) {
1098 s.clean();
1099 }
1100
1101#endif
1102
1103 if (http->request->maybeCacheable())
1104 request->flags.cachable.support();
1105 else
1106 request->flags.cachable.veto();
1107
1108 if (clientHierarchical(http))
1109 request->flags.hierarchical = true;
1110
1111 debugs(85, 5, "clientInterpretRequestHeaders: REQ_NOCACHE = " <<
1112 (request->flags.noCache ? "SET" : "NOT SET"));
1113 debugs(85, 5, "clientInterpretRequestHeaders: REQ_CACHABLE = " <<
1114 (request->flags.cachable ? "SET" : "NOT SET"));
1115 debugs(85, 5, "clientInterpretRequestHeaders: REQ_HIERARCHICAL = " <<
1116 (request->flags.hierarchical ? "SET" : "NOT SET"));
1117
1118}
1119
1120void
1122{
1123 ClientRequestContext *calloutContext = (ClientRequestContext *)data;
1124
1125 if (!calloutContext->httpStateIsValid())
1126 return;
1127
1128 calloutContext->clientRedirectDone(result);
1129}
1130
1131void
1132clientStoreIdDoneWrapper(void *data, const Helper::Reply &result)
1133{
1134 ClientRequestContext *calloutContext = (ClientRequestContext *)data;
1135
1136 if (!calloutContext->httpStateIsValid())
1137 return;
1138
1139 calloutContext->clientStoreIdDone(result);
1140}
1141
1142void
1144{
1145 HttpRequest *old_request = http->request;
1146 debugs(85, 5, "'" << http->uri << "' result=" << reply);
1149
1150 // Put helper response Notes into the transaction state record (ALE) eventually
1151 // do it early to ensure that no matter what the outcome the notes are present.
1152 if (http->al)
1153 http->al->syncNotes(old_request);
1154
1155 UpdateRequestNotes(http->getConn(), *old_request, reply.notes);
1156
1157 switch (reply.result) {
1158 case Helper::TimedOut:
1160 static const auto d = MakeNamedErrorDetail("REDIRECTOR_TIMEDOUT");
1162 debugs(85, DBG_IMPORTANT, "ERROR: URL rewrite helper: Timedout");
1163 }
1164 break;
1165
1166 case Helper::Unknown:
1167 case Helper::TT:
1168 // Handler in redirect.cc should have already mapped Unknown
1169 // IF it contained valid entry for the old URL-rewrite helper protocol
1170 debugs(85, DBG_IMPORTANT, "ERROR: URL rewrite helper returned invalid result code. Wrong helper? " << reply);
1171 break;
1172
1174 debugs(85, DBG_IMPORTANT, "ERROR: URL rewrite helper: " << reply);
1175 break;
1176
1177 case Helper::Error:
1178 // no change to be done.
1179 break;
1180
1181 case Helper::Okay: {
1182 // #1: redirect with a specific status code OK status=NNN url="..."
1183 // #2: redirect with a default status code OK url="..."
1184 // #3: re-write the URL OK rewrite-url="..."
1185
1186 const char *statusNote = reply.notes.findFirst("status");
1187 const char *urlNote = reply.notes.findFirst("url");
1188
1189 if (urlNote != nullptr) {
1190 // HTTP protocol redirect to be done.
1191
1192 // TODO: change default redirect status for appropriate requests
1193 // Squid defaults to 302 status for now for better compatibility with old clients.
1194 // HTTP/1.0 client should get 302 (Http::scFound)
1195 // HTTP/1.1 client contacting reverse-proxy should get 307 (Http::scTemporaryRedirect)
1196 // HTTP/1.1 client being diverted by forward-proxy should get 303 (Http::scSeeOther)
1198 if (statusNote != nullptr) {
1199 const char * result = statusNote;
1200 status = static_cast<Http::StatusCode>(atoi(result));
1201 }
1202
1203 if (status == Http::scMovedPermanently
1204 || status == Http::scFound
1205 || status == Http::scSeeOther
1206 || status == Http::scPermanentRedirect
1207 || status == Http::scTemporaryRedirect) {
1208 http->redirect.status = status;
1209 http->redirect.location = xstrdup(urlNote);
1210 // TODO: validate the URL produced here is RFC 2616 compliant absolute URI
1211 } else {
1212 debugs(85, DBG_CRITICAL, "ERROR: URL-rewrite produces invalid " << status << " redirect Location: " << urlNote);
1213 }
1214 } else {
1215 // URL-rewrite wanted. Ew.
1216 urlNote = reply.notes.findFirst("rewrite-url");
1217
1218 // prevent broken helpers causing too much damage. If old URL == new URL skip the re-write.
1219 if (urlNote != nullptr && strcmp(urlNote, http->uri)) {
1220 AnyP::Uri tmpUrl;
1221 if (tmpUrl.parse(old_request->method, SBuf(urlNote))) {
1222 HttpRequest *new_request = old_request->clone();
1223 new_request->url = tmpUrl;
1224 debugs(61, 2, "URL-rewriter diverts URL from " << old_request->effectiveRequestUri() << " to " << new_request->effectiveRequestUri());
1225
1226 // unlink bodypipe from the old request. Not needed there any longer.
1227 if (old_request->body_pipe != nullptr) {
1228 old_request->body_pipe = nullptr;
1229 debugs(61,2, "URL-rewriter diverts body_pipe " << new_request->body_pipe <<
1230 " from request " << old_request << " to " << new_request);
1231 }
1232
1233 http->resetRequestXXX(new_request, true);
1234 old_request = nullptr;
1235 } else {
1236 debugs(85, DBG_CRITICAL, "ERROR: URL-rewrite produces invalid request: " <<
1237 old_request->method << " " << urlNote << " " << old_request->http_ver);
1238 }
1239 }
1240 }
1241 }
1242 break;
1243 }
1244
1245 /* XXX PIPELINE: This is inaccurate during pipelining */
1246
1247 if (http->getConn() != nullptr && Comm::IsConnOpen(http->getConn()->clientConnection))
1249
1250 assert(http->uri);
1251
1252 http->doCallouts();
1253}
1254
1258void
1260{
1261 HttpRequest *old_request = http->request;
1262 debugs(85, 5, "'" << http->uri << "' result=" << reply);
1265
1266 // Put helper response Notes into the transaction state record (ALE) eventually
1267 // do it early to ensure that no matter what the outcome the notes are present.
1268 if (http->al)
1269 http->al->syncNotes(old_request);
1270
1271 UpdateRequestNotes(http->getConn(), *old_request, reply.notes);
1272
1273 switch (reply.result) {
1274 case Helper::Unknown:
1275 case Helper::TT:
1276 // Handler in redirect.cc should have already mapped Unknown
1277 // IF it contained valid entry for the old helper protocol
1278 debugs(85, DBG_IMPORTANT, "ERROR: storeID helper returned invalid result code. Wrong helper? " << reply);
1279 break;
1280
1281 case Helper::TimedOut:
1282 // Timeouts for storeID are not implemented
1284 debugs(85, DBG_IMPORTANT, "ERROR: storeID helper: " << reply);
1285 break;
1286
1287 case Helper::Error:
1288 // no change to be done.
1289 break;
1290
1291 case Helper::Okay: {
1292 const char *urlNote = reply.notes.findFirst("store-id");
1293
1294 // prevent broken helpers causing too much damage. If old URL == new URL skip the re-write.
1295 if (urlNote != nullptr && strcmp(urlNote, http->uri) ) {
1296 // Debug section required for some very specific cases.
1297 debugs(85, 9, "Setting storeID with: " << urlNote );
1298 http->request->store_id = urlNote;
1299 http->store_id = urlNote;
1300 }
1301 }
1302 break;
1303 }
1304
1305 http->doCallouts();
1306}
1307
1309void
1311{
1315 } else {
1316 /* unless otherwise specified, we try to cache. */
1318 }
1319}
1320
1321static void
1323{
1324 ClientRequestContext *calloutContext = (ClientRequestContext *) data;
1325
1326 if (!calloutContext->httpStateIsValid())
1327 return;
1328
1329 calloutContext->checkNoCacheDone(answer);
1330}
1331
1332void
1334{
1335 acl_checklist = nullptr;
1336 if (answer.denied()) {
1337 http->request->flags.disableCacheUse("a cache deny rule matched");
1338 }
1339 http->doCallouts();
1340}
1341
1342#if USE_OPENSSL
1343bool
1345{
1346 if (!http->getConn()) {
1347 http->al->ssl.bumpMode = Ssl::bumpEnd; // SslBump does not apply; log -
1348 return false;
1349 }
1350
1352 if (http->request->flags.forceTunnel) {
1353 debugs(85, 5, "not needed; already decided to tunnel " << http->getConn());
1354 if (bumpMode != Ssl::bumpEnd)
1355 http->al->ssl.bumpMode = bumpMode; // inherited from bumped connection
1356 return false;
1357 }
1358
1359 // If SSL connection tunneling or bumping decision has been made, obey it.
1360 if (bumpMode != Ssl::bumpEnd) {
1361 debugs(85, 5, "SslBump already decided (" << bumpMode <<
1362 "), " << "ignoring ssl_bump for " << http->getConn());
1363
1364 // We need the following "if" for transparently bumped TLS connection,
1365 // because in this case we are running ssl_bump access list before
1366 // the doCallouts runs. It can be removed after the bug #4340 fixed.
1367 // We do not want to proceed to bumping steps:
1368 // - if the TLS connection with the client is already established
1369 // because we are accepting normal HTTP requests on TLS port,
1370 // or because of the client-first bumping mode
1371 // - When the bumping is already started
1372 if (!http->getConn()->switchedToHttps() &&
1373 !http->getConn()->serverBump())
1374 http->sslBumpNeed(bumpMode); // for processRequest() to bump if needed and not already bumped
1375 http->al->ssl.bumpMode = bumpMode; // inherited from bumped connection
1376 return false;
1377 }
1378
1379 // If we have not decided yet, decide whether to bump now.
1380
1381 // Bumping here can only start with a CONNECT request on a bumping port
1382 // (bumping of intercepted SSL conns is decided before we get 1st request).
1383 // We also do not bump redirected CONNECT requests.
1386 !http->getConn()->port->flags.tunnelSslBumping) {
1387 http->al->ssl.bumpMode = Ssl::bumpEnd; // SslBump does not apply; log -
1388 debugs(85, 5, "cannot SslBump this request");
1389 return false;
1390 }
1391
1392 // Do not bump during authentication: clients would not proxy-authenticate
1393 // if we delay a 407 response and respond with 200 OK to CONNECT.
1395 http->al->ssl.bumpMode = Ssl::bumpEnd; // SslBump does not apply; log -
1396 debugs(85, 5, "no SslBump during proxy authentication");
1397 return false;
1398 }
1399
1400 if (error) {
1401 debugs(85, 5, "SslBump applies. Force bump action on error " << errorTypeName(error->type));
1404 return false;
1405 }
1406
1407 debugs(85, 5, "SslBump possible, checking ACL");
1408
1411 return true;
1412}
1413
1418static void
1420{
1421 ClientRequestContext *calloutContext = static_cast<ClientRequestContext *>(data);
1422
1423 if (!calloutContext->httpStateIsValid())
1424 return;
1425 calloutContext->sslBumpAccessCheckDone(answer);
1426}
1427
1428void
1430{
1431 if (!httpStateIsValid())
1432 return;
1433
1434 const Ssl::BumpMode bumpMode = answer.allowed() ?
1435 static_cast<Ssl::BumpMode>(answer.kind) : Ssl::bumpSplice;
1436 http->sslBumpNeed(bumpMode); // for processRequest() to bump if needed
1437 http->al->ssl.bumpMode = bumpMode; // for logging
1438
1440 const Comm::ConnectionPointer clientConn = http->getConn() ? http->getConn()->clientConnection : nullptr;
1441 if (Comm::IsConnOpen(clientConn)) {
1442 debugs(85, 3, "closing after Ssl::bumpTerminate ");
1443 clientConn->close();
1444 }
1445 return;
1446 }
1447
1448 http->doCallouts();
1449}
1450#endif
1451
1452/*
1453 * Identify requests that do not go through the store and client side stream
1454 * and forward them to the appropriate location. All other requests, request
1455 * them.
1456 */
1457void
1459{
1460 debugs(85, 4, request->method << ' ' << uri);
1461
1462 const bool untouchedConnect = request->method == Http::METHOD_CONNECT && !redirect.status;
1463
1464#if USE_OPENSSL
1465 if (untouchedConnect && sslBumpNeeded()) {
1467 sslBumpStart();
1468 return;
1469 }
1470#endif
1471
1472 if (untouchedConnect || request->flags.forceTunnel) {
1473 getConn()->stopReading(); // tunnels read for themselves
1474 tunnelStart(this);
1475 return;
1476 }
1477
1478 httpStart();
1479}
1480
1481void
1483{
1484 // XXX: Re-initializes rather than updates. Should not be needed at all.
1486 debugs(85, 4, loggingTags().c_str() << " for '" << uri << "'");
1487
1488 /* no one should have touched this */
1489 assert(out.offset == 0);
1490 /* Use the Stream Luke */
1492 clientStreamRead(node, this, node->readBuffer);
1493}
1494
1495#if USE_OPENSSL
1496
1497void
1499{
1500 debugs(83, 3, "sslBump required: "<< Ssl::bumpMode(mode));
1501 sslBumpNeed_ = mode;
1502}
1503
1504// called when comm_write has completed
1505static void
1506SslBumpEstablish(const Comm::ConnectionPointer &, char *, size_t, Comm::Flag errflag, int, void *data)
1507{
1508 ClientHttpRequest *r = static_cast<ClientHttpRequest*>(data);
1509 debugs(85, 5, "responded to CONNECT: " << r << " ? " << errflag);
1510
1512 r->sslBumpEstablish(errflag);
1513}
1514
1515void
1517{
1518 // Bail out quickly on Comm::ERR_CLOSING - close handlers will tidy up
1519 if (errflag == Comm::ERR_CLOSING)
1520 return;
1521
1522 if (errflag) {
1523 debugs(85, 3, "CONNECT response failure in SslBump: " << errflag);
1525 return;
1526 }
1527
1528#if USE_AUTH
1529 // Preserve authentication info for the ssl-bumped request
1530 if (request->auth_user_request != nullptr)
1531 getConn()->setAuth(request->auth_user_request, "SSL-bumped CONNECT");
1532#endif
1533
1536}
1537
1538void
1540{
1541 debugs(85, 5, "Confirming " << Ssl::bumpMode(sslBumpNeed_) <<
1542 "-bumped CONNECT tunnel on FD " << getConn()->clientConnection);
1544
1545 AsyncCall::Pointer bumpCall = commCbCall(85, 5, "ClientSocketContext::sslBumpEstablish",
1547
1549 CommIoCbParams &params = GetCommParams<CommIoCbParams>(bumpCall);
1550 params.flag = Comm::OK;
1551 params.conn = getConn()->clientConnection;
1552 ScheduleCallHere(bumpCall);
1553 return;
1554 }
1555
1557
1558 const auto mb = al->reply->pack();
1559 // send an HTTP 200 response to kick client SSL negotiation
1560 // TODO: Unify with tunnel.cc and add a Server(?) header
1561 Comm::Write(getConn()->clientConnection, mb, bumpCall);
1562 delete mb;
1563}
1564
1565#endif
1566
1567void
1569{
1570 if (request)
1572 else
1574}
1575
1576bool
1578{
1579 // TODO: See also (and unify with) clientReplyContext::storeNotOKTransferDone()
1580 int64_t contentLength =
1582 assert(contentLength >= 0);
1583
1584 if (out.offset < contentLength)
1585 return false;
1586
1587 return true;
1588}
1589
1590void
1592{
1593 entry_ = newEntry;
1594}
1595
1596void
1598{
1599 if (loggingEntry_)
1600 loggingEntry_->unlock("ClientHttpRequest::loggingEntry");
1601
1602 loggingEntry_ = newEntry;
1603
1604 if (loggingEntry_)
1605 loggingEntry_->lock("ClientHttpRequest::loggingEntry");
1606}
1607
1608void
1610{
1611 assignRequest(aRequest);
1612 if (const auto csd = getConn()) {
1613 if (!csd->notes()->empty())
1614 request->notes()->appendNewOnly(csd->notes().getRaw());
1615 }
1616 // al is created in the constructor
1617 assert(al);
1618 if (!al->request) {
1619 al->request = request;
1622 }
1623}
1624
1625void
1627{
1628 const auto uriChanged = request->effectiveRequestUri() != newRequest->effectiveRequestUri();
1629 resetRequestXXX(newRequest, uriChanged);
1630}
1631
1632void
1633ClientHttpRequest::resetRequestXXX(HttpRequest *newRequest, const bool uriChanged)
1634{
1635 assert(request != newRequest);
1636 clearRequest();
1637 assignRequest(newRequest);
1638 xfree(uri);
1640
1641 if (uriChanged) {
1642 request->flags.redirected = true;
1644 }
1645}
1646
1647void
1649{
1650 if (!internalCheck(request->url.path()))
1651 return;
1652
1654 debugs(33, 3, "internal URL found: " << request->url.getScheme() << "://" << request->url.authority(true));
1655 request->flags.internal = true;
1657 debugs(33, 3, "internal URL found: " << request->url.getScheme() << "://" << request->url.authority(true) << " (global_internal_static on)");
1661 request->flags.internal = true;
1663 } else {
1664 debugs(33, 3, "internal URL found: " << request->url.getScheme() << "://" << request->url.authority(true) << " (not this proxy)");
1665 }
1666
1668 request->flags.disableCacheUse("cache manager URL");
1669}
1670
1671void
1673{
1674 assert(newRequest);
1675 assert(!request);
1676 const_cast<HttpRequest *&>(request) = newRequest;
1679}
1680
1681void
1683{
1684 HttpRequest *oldRequest = request;
1685 HTTPMSGUNLOCK(oldRequest);
1686 const_cast<HttpRequest *&>(request) = nullptr;
1687 absorbLogUri(nullptr);
1688}
1689
1690/*
1691 * doCallouts() - This function controls the order of "callout"
1692 * executions, including non-blocking access control checks, the
1693 * redirector, and ICAP. Previously, these callouts were chained
1694 * together such that "clientAccessCheckDone()" would call
1695 * "clientRedirectStart()" and so on.
1696 *
1697 * The ClientRequestContext (aka calloutContext) class holds certain
1698 * state data for the callout/callback operations. Previously
1699 * ClientHttpRequest would sort of hand off control to ClientRequestContext
1700 * for a short time. ClientRequestContext would then delete itself
1701 * and pass control back to ClientHttpRequest when all callouts
1702 * were finished.
1703 *
1704 * This caused some problems for ICAP because we want to make the
1705 * ICAP callout after checking ACLs, but before checking the no_cache
1706 * list. We can't stuff the ICAP state into the ClientRequestContext
1707 * class because we still need the ICAP state after ClientRequestContext
1708 * goes away.
1709 *
1710 * Note that ClientRequestContext is created before the first call
1711 * to doCallouts().
1712 *
1713 * If one of the callouts notices that ClientHttpRequest is no
1714 * longer valid, it should call cbdataReferenceDone() so that
1715 * ClientHttpRequest's reference count goes to zero and it will get
1716 * deleted. ClientHttpRequest will then delete ClientRequestContext.
1717 *
1718 * Note that we set the _done flags here before actually starting
1719 * the callout. This is strictly for convenience.
1720 */
1721
1722void
1724{
1726
1727 if (!calloutContext->error) {
1728 // CVE-2009-0801: verify the Host: header is consistent with other known details.
1730 debugs(83, 3, "Doing calloutContext->hostHeaderVerify()");
1733 return;
1734 }
1735
1737 debugs(83, 3, "Doing calloutContext->clientAccessCheck()");
1740 return;
1741 }
1742
1743#if USE_ADAPTATION
1748 request, nullptr, calloutContext->http->al, this))
1749 return; // will call callback
1750 }
1751#endif
1752
1755
1756 if (Config.Program.redirect) {
1757 debugs(83, 3, "Doing calloutContext->clientRedirectStart()");
1760 return;
1761 }
1762 }
1763
1765 debugs(83, 3, "Doing calloutContext->clientAccessCheck2()");
1768 return;
1769 }
1770
1773
1774 if (Config.Program.store_id) {
1775 debugs(83, 3,"Doing calloutContext->clientStoreIdStart()");
1778 return;
1779 }
1780 }
1781
1783 debugs(83, 3, "Doing clientInterpretRequestHeaders()");
1786 }
1787
1790
1792 debugs(83, 3, "Doing calloutContext->checkNoCache()");
1794 return;
1795 }
1796 }
1797 } // if !calloutContext->error
1798
1799 // Set appropriate MARKs and CONNMARKs if needed.
1800 if (getConn() && Comm::IsConnOpen(getConn()->clientConnection)) {
1801 ACLFilledChecklist ch(nullptr, request, nullptr);
1802 ch.al = calloutContext->http->al;
1804 ch.my_addr = request->my_addr;
1805 ch.syncAle(request, log_uri);
1806
1809 tos_t tos = aclMapTOS(Ip::Qos::TheConfig.tosToClient, &ch);
1810 if (tos)
1811 Ip::Qos::setSockTos(getConn()->clientConnection, tos);
1812
1813 const auto packetMark = aclFindNfMarkConfig(Ip::Qos::TheConfig.nfmarkToClient, &ch);
1814 if (!packetMark.isEmpty())
1815 Ip::Qos::setSockNfmark(getConn()->clientConnection, packetMark.mark);
1816
1817 const auto connmark = aclFindNfMarkConfig(Ip::Qos::TheConfig.nfConnmarkToClient, &ch);
1818 if (!connmark.isEmpty())
1819 Ip::Qos::setNfConnmark(getConn()->clientConnection, Ip::Qos::dirAccepted, connmark);
1820 }
1821 }
1822
1823#if USE_OPENSSL
1824 // Even with calloutContext->error, we call sslBumpAccessCheck() to decide
1825 // whether SslBump applies to this transaction. If it applies, we will
1826 // attempt to bump the client to serve the error.
1830 return;
1831 /* else no ssl bump required*/
1832 }
1833#endif
1834
1835 if (calloutContext->error) {
1836 // XXX: prformance regression. c_str() reallocates
1837 SBuf storeUriBuf(request->storeId());
1838 const char *storeUri = storeUriBuf.c_str();
1839 StoreEntry *e = storeCreateEntry(storeUri, storeUri, request->flags, request->method);
1840#if USE_OPENSSL
1841 if (sslBumpNeeded()) {
1842 // We have to serve an error, so bump the client first.
1844 // set final error but delay sending until we bump
1845 Ssl::ServerBump *srvBump = new Ssl::ServerBump(this, e, Ssl::bumpClientFirst);
1847 calloutContext->error = nullptr;
1848 getConn()->setServerBump(srvBump);
1849 e->unlock("ClientHttpRequest::doCallouts+sslBumpNeeded");
1850 } else
1851#endif
1852 {
1853 // send the error to the client now
1855 clientReplyContext *repContext = dynamic_cast<clientReplyContext *>(node->data.getRaw());
1856 assert (repContext);
1857 repContext->setReplyToStoreEntry(e, "immediate SslBump error");
1859 calloutContext->error = nullptr;
1861 getConn()->flags.readMore = true; // resume any pipeline reads.
1863 clientStreamRead(node, this, node->readBuffer);
1864 e->unlock("ClientHttpRequest::doCallouts-sslBumpNeeded");
1865 return;
1866 }
1867 }
1868
1870 delete calloutContext;
1871 calloutContext = nullptr;
1872
1873 debugs(83, 3, "calling processRequest()");
1875
1876#if ICAP_CLIENT
1878 if (ih != nullptr)
1879 ih->logType = loggingTags();
1880#endif
1881}
1882
1883void
1885{
1886 assert(request);
1887 const auto canonicalUri = request->canonicalCleanUrl();
1888 absorbLogUri(xstrndup(canonicalUri, MAX_URL));
1889}
1890
1891void
1893{
1894 assert(rawUri);
1895 // Should(!request);
1896
1897 // TODO: SBuf() performance regression, fix by converting rawUri to SBuf
1898 char *canonicalUri = urlCanonicalCleanWithoutRequest(SBuf(rawUri), method, AnyP::UriScheme());
1899
1900 absorbLogUri(AnyP::Uri::cleanup(canonicalUri));
1901
1902 char *cleanedRawUri = AnyP::Uri::cleanup(rawUri);
1903 al->setVirginUrlForMissingRequest(SBuf(cleanedRawUri));
1904 xfree(cleanedRawUri);
1905}
1906
1907void
1909{
1910 xfree(log_uri);
1911 const_cast<char *&>(log_uri) = aUri;
1912}
1913
1914void
1916{
1917 assert(!uri);
1918 assert(aUri);
1919 // Should(!request);
1920
1921 uri = xstrdup(aUri);
1922 // TODO: SBuf() performance regression, fix by converting setErrorUri() parameter to SBuf
1923 const SBuf errorUri(aUri);
1924 const auto canonicalUri = urlCanonicalCleanWithoutRequest(errorUri, HttpRequestMethod(), AnyP::UriScheme());
1925 absorbLogUri(xstrndup(canonicalUri, MAX_URL));
1926
1928}
1929
1930// XXX: This should not be a _request_ method. Move range_iter elsewhere.
1931int64_t
1933{
1934 assert(request);
1936
1940 const auto multipart = request->range->specs.size() > 1;
1941 if (multipart)
1943 range_iter.valid = true; // TODO: Remove.
1944 range_iter.updateSpec(); // TODO: Refactor to initialize rather than update.
1945
1947 const auto &firstRange = *range_iter.pos;
1948 assert(firstRange);
1949 out.offset = firstRange->offset;
1950
1951 return multipart ? mRangeCLen() : firstRange->length;
1952}
1953
1954#if USE_ADAPTATION
1956void
1958{
1959 debugs(85, 3, "adaptation needed for " << this);
1963 new Adaptation::Iterator(request, nullptr, al, g));
1964
1965 // we could try to guess whether we can bypass this adaptation
1966 // initiation failure, but it should not really happen
1968}
1969
1970void
1972{
1973 assert(cbdataReferenceValid(this)); // indicates bug
1976
1977 switch (answer.kind) {
1979 handleAdaptedHeader(const_cast<Http::Message*>(answer.message.getRaw()));
1980 break;
1981
1983 handleAdaptationBlock(answer);
1984 break;
1985
1987 static const auto d = MakeNamedErrorDetail("CLT_REQMOD_ABORT");
1988 handleAdaptationFailure(d, !answer.final);
1989 break;
1990 }
1991 }
1992}
1993
1994void
1996{
1997 assert(msg);
1998
1999 if (HttpRequest *new_req = dynamic_cast<HttpRequest*>(msg)) {
2000 resetRequest(new_req);
2001 assert(request->method.id());
2002 } else if (HttpReply *new_rep = dynamic_cast<HttpReply*>(msg)) {
2003 debugs(85,3, "REQMOD reply is HTTP reply");
2004
2005 // subscribe to receive reply body
2006 if (new_rep->body_pipe != nullptr) {
2007 adaptedBodySource = new_rep->body_pipe;
2008 int consumer_ok = adaptedBodySource->setConsumerIfNotLate(this);
2009 assert(consumer_ok);
2010 }
2011
2013 clientReplyContext *repContext = dynamic_cast<clientReplyContext *>(node->data.getRaw());
2014 assert(repContext);
2015 repContext->createStoreEntry(request->method, request->flags);
2016
2019 storeEntry()->replaceHttpReply(new_rep);
2021
2022 al->reply = new_rep;
2023
2024 if (!adaptedBodySource) // no body
2025 storeEntry()->complete();
2026 clientGetMoreData(node, this);
2027 }
2028
2029 // we are done with getting headers (but may be receiving body)
2031
2033 doCallouts();
2034}
2035
2036void
2038{
2039 static const auto d = MakeNamedErrorDetail("REQMOD_BLOCK");
2041 AclMatchedName = answer.ruleId.termedBuf();
2044 AclMatchedName = nullptr;
2045}
2046
2047void
2049{
2050 if (!adaptedBodySource)
2051 return;
2052
2054}
2055
2056void
2058{
2060 assert(adaptedBodySource != nullptr);
2061
2062 if (size_t contentSize = adaptedBodySource->buf().contentSize()) {
2063 const size_t spaceAvailable = storeEntry()->bytesWanted(Range<size_t>(0,contentSize));
2064
2065 if (spaceAvailable < contentSize ) {
2066 // No or partial body data consuming
2067 typedef NullaryMemFunT<ClientHttpRequest> Dialer;
2068 AsyncCall::Pointer call = asyncCall(93, 5, "ClientHttpRequest::resumeBodyStorage",
2070 storeEntry()->deferProducer(call);
2071 }
2072
2073 if (!spaceAvailable)
2074 return;
2075
2076 if (spaceAvailable < contentSize )
2077 contentSize = spaceAvailable;
2078
2080 const StoreIOBuffer ioBuf(&bpc.buf, request_satisfaction_offset, contentSize);
2081 storeEntry()->write(ioBuf);
2082 // assume StoreEntry::write() writes the entire ioBuf
2084 bpc.buf.consume(contentSize);
2085 bpc.checkIn();
2086 }
2087
2089 // XXX: Setting receivedWholeAdaptedReply here is a workaround for a
2090 // regression, as described in https://bugs.squid-cache.org/show_bug.cgi?id=5187#c6
2092 debugs(85, DBG_IMPORTANT, "WARNING: Squid bug 5187 workaround triggered");
2094 }
2095 // else wait for more body data
2096}
2097
2098void
2100{
2102
2103 // distinguish this code path from future noteBodyProducerAborted() that
2104 // would continue storing/delivering (truncated) reply if necessary (TODO)
2106
2107 // should we end request satisfaction now?
2108 if (adaptedBodySource != nullptr && adaptedBodySource->exhausted())
2110}
2111
2112void
2114{
2115 debugs(85,4, this << " ends request satisfaction");
2118
2119 // TODO: anything else needed to end store entry formation correctly?
2121 // We received the entire reply per receivedWholeAdaptedReply.
2122 // We are called when we consumed everything received (per our callers).
2123 // We consume only what we store per noteMoreBodyDataAvailable().
2124 storeEntry()->completeSuccessfully("received, consumed, and, hence, stored the entire REQMOD reply");
2125 } else {
2126 storeEntry()->completeTruncated("REQMOD request satisfaction default");
2127 }
2128}
2129
2130void
2132{
2135
2136 debugs(85,3, "REQMOD body production failed");
2137 if (request_satisfaction_mode) { // too late to recover or serve an error
2138 static const auto d = MakeNamedErrorDetail("CLT_REQMOD_RESP_BODY");
2142 c->close(); // drastic, but we may be writing a response already
2143 } else {
2144 static const auto d = MakeNamedErrorDetail("CLT_REQMOD_REQ_BODY");
2146 }
2147}
2148
2149void
2151{
2152 debugs(85,3, "handleAdaptationFailure(" << bypassable << ")");
2153
2154 const bool usedStore = storeEntry() && !storeEntry()->isEmpty();
2155 const bool usedPipe = request->body_pipe != nullptr &&
2157
2158 if (bypassable && !usedStore && !usedPipe) {
2159 debugs(85,3, "ICAP REQMOD callout failed, bypassing: " << calloutContext);
2160 if (calloutContext)
2161 doCallouts();
2162 return;
2163 }
2164
2165 debugs(85,3, "ICAP REQMOD callout failed, responding with error");
2166
2168 clientReplyContext *repContext = dynamic_cast<clientReplyContext *>(node->data.getRaw());
2169 assert(repContext);
2170
2171 calloutsError(ERR_ICAP_FAILURE, errDetail);
2172
2173 if (calloutContext)
2174 doCallouts();
2175}
2176
2177void
2178ClientHttpRequest::callException(const std::exception &ex)
2179{
2180 if (const auto clientConn = getConn() ? getConn()->clientConnection : nullptr) {
2181 if (Comm::IsConnOpen(clientConn)) {
2182 debugs(85, 3, "closing after exception: " << ex.what());
2183 clientConn->close(); // initiate orderly top-to-bottom cleanup
2184 return;
2185 }
2186 }
2187 debugs(85, DBG_IMPORTANT, "ClientHttpRequest exception without connection. Ignoring " << ex.what());
2188 // XXX: Normally, we mustStop() but we cannot do that here because it is
2189 // likely to leave Http::Stream and ConnStateData with a dangling http
2190 // pointer. See r13480 or XXX in Http::Stream class description.
2191}
2192#endif
2193
2194// XXX: modify and use with ClientRequestContext::clientAccessCheckDone too.
2195void
2197{
2198 // The original author of the code also wanted to pass an errno to
2199 // setReplyToError, but it seems unlikely that the errno reflects the
2200 // true cause of the error at this point, so I did not pass it.
2201 if (calloutContext) {
2202 ConnStateData * c = getConn();
2204 nullptr, c, request, al);
2205#if USE_AUTH
2207 c != nullptr && c->getAuth() != nullptr ? c->getAuth() : request->auth_user_request;
2208#endif
2209 calloutContext->error->detailError(errDetail);
2211 if (c != nullptr)
2212 c->expectNoForwarding();
2213 }
2214 //else if(calloutContext == NULL) is it possible?
2215}
2216
#define ScheduleCallHere(call)
Definition: AsyncCall.h:166
RefCount< AsyncCallT< Dialer > > asyncCall(int aDebugSection, int aDebugLevel, const char *aName, const Dialer &aDialer)
Definition: AsyncCall.h:156
CommCbFunPtrCallT< Dialer > * commCbCall(int debugSection, int debugLevel, const char *callName, const Dialer &dialer)
Definition: CommCalls.h:312
ErrorDetail::Pointer MakeNamedErrorDetail(const char *name)
Definition: Detail.cc:54
const char * errorTypeName(err_type err)
Definition: Error.h:77
ACLFilledChecklist * Filled(ACLChecklist *checklist)
convenience and safety wrapper for dynamic_cast<ACLFilledChecklist*>
Ip::NfMarkConfig aclFindNfMarkConfig(acl_nfmark *head, ACLChecklist *ch)
Checks for a netfilter mark value to apply depending on the ACL.
Definition: FwdState.cc:1465
tos_t aclMapTOS(acl_tos *head, ACLChecklist *ch)
Checks for a TOS value to apply depending on the ACL.
Definition: FwdState.cc:1453
ssize_t HttpHeaderPos
Definition: HttpHeader.h:45
#define HttpHeaderInitPos
Definition: HttpHeader.h:48
void UpdateRequestNotes(ConnStateData *csd, HttpRequest &request, NotePairs const &helperNotes)
Definition: HttpRequest.cc:760
void httpRequestPack(void *obj, Packable *p)
Definition: HttpRequest.cc:361
@ LOG_TCP_DENIED
Definition: LogTags.h:52
@ LOG_TAG_NONE
Definition: LogTags.h:38
time_t squid_curtime
Definition: stub_libtime.cc:20
void SBufToCstring(char *d, const SBuf &s)
Definition: SBuf.h:752
class SquidConfig Config
Definition: SquidConfig.cc:12
int strListIsSubstr(const String *list, const char *s, char del)
Definition: StrList.cc:63
SBuf StringToSBuf(const String &s)
create a new SBuf from a String by copying contents
Definition: StringConvert.h:17
#define Must(condition)
Definition: TextException.h:75
int conn
the current server connection FD
Definition: Transport.cc:26
int matchDomainName(const char *h, const char *d, MatchDomainNameFlags flags)
Definition: Uri.cc:820
char * urlCanonicalCleanWithoutRequest(const SBuf &url, const HttpRequestMethod &method, const AnyP::UriScheme &scheme)
Definition: Uri.cc:704
void fvdbCountVia(const SBuf &)
void fvdbCountForwarded(const SBuf &)
count occurrences of the given X-Forwarded-For header value
void error(char *format,...)
#define assert(EX)
Definition: assert.h:17
int cbdataReferenceValid(const void *p)
Definition: cbdata.cc:265
#define cbdataReferenceDone(var)
Definition: cbdata.h:352
#define cbdataReference(var)
Definition: cbdata.h:343
#define CBDATA_CLASS_INIT(type)
Definition: cbdata.h:320
void nonBlockingCheck(ACLCB *callback, void *callback_data)
Definition: Checklist.cc:237
Ip::Address src_addr
AccessLogEntry::Pointer al
info for the future access.log, and external ACL
void syncAle(HttpRequest *adaptedRequest, const char *logUri) const override
assigns uninitialized adapted_request and url ALE components
AnyP::PortCfgPointer port
Security::CertPointer sslClientCert
cert received from the client
struct timeval start_time
The time the master transaction started.
int bumpMode
whether and how the request was SslBumped
HttpReplyPointer reply
class AccessLogEntry::CacheDetails cache
HierarchyLogEntry hier
void syncNotes(HttpRequest *request)
Comm::ConnectionPointer tcpClient
TCP/IP level details about the client connection.
HttpRequest * request
void setVirginUrlForMissingRequest(const SBuf &vu)
Remember Client URI (or equivalent) when there is no HttpRequest.
ProxyProtocol::HeaderPointer proxyProtocolHeader
see ConnStateData::proxyProtocolHeader_
class AccessLogEntry::SslDetails ssl
void updateError(const Error &)
sets (or updates the already stored) transaction error as needed
int kind
the matched custom access list verb (or zero)
Definition: Acl.h:170
bool denied() const
Definition: Acl.h:162
bool conflicted() const
whether Squid is uncertain about the allowed() or denied() answer
Definition: Acl.h:165
bool allowed() const
Definition: Acl.h:156
static bool Start(Method method, VectPoint vp, HttpRequest *req, HttpReply *, const AccessLogEntryPointer &, Adaptation::Initiator *)
Definition: AccessCheck.cc:30
summarizes adaptation service answer for the noteAdaptationAnswer() API
Definition: Answer.h:23
String ruleId
ACL (or similar rule) name that blocked forwarding.
Definition: Answer.h:40
Kind kind
the type of the answer
Definition: Answer.h:42
Http::MessagePointer message
HTTP request or response to forward.
Definition: Answer.h:39
bool final
whether the error, if any, cannot be bypassed
Definition: Answer.h:41
@ akForward
forward the supplied adapted HTTP message
Definition: Answer.h:27
@ akBlock
block or deny the master xaction; see authority
Definition: Answer.h:28
@ akError
no adapted message will come; see bypassable
Definition: Answer.h:29
CbcPointer< Initiate > initiateAdaptation(Initiate *x)
< starts freshly created initiate and returns a safe pointer to it
Definition: Initiator.cc:23
void clearAdaptation(CbcPointer< Initiate > &x)
clears the pointer (does not call announceInitiatorAbort)
Definition: Initiator.cc:32
void announceInitiatorAbort(CbcPointer< Initiate > &x)
inform the transaction about abnormal termination and clear the pointer
Definition: Initiator.cc:38
bool initiated(const CbcPointer< AsyncJob > &job) const
Must(initiated(initiate)) instead of Must(initiate.set()), for clarity.
Definition: Initiator.h:52
iterates services in ServiceGroup, starting adaptation launchers
Definition: Iterator.h:32
Port defaultPort() const
Definition: UriScheme.cc:71
Definition: Uri.h:31
AnyP::UriScheme const & getScheme() const
Definition: Uri.h:67
SBuf & authority(bool requirePort=false) const
Definition: Uri.cc:646
void setScheme(const AnyP::ProtocolType &p, const char *str)
convert the URL scheme to that given
Definition: Uri.h:70
void path(const char *p)
Definition: Uri.h:101
static char * cleanup(const char *uri)
Definition: Uri.cc:993
void port(const Port p)
reset authority port subcomponent
Definition: Uri.h:95
void host(const char *src)
Definition: Uri.cc:100
bool parse(const HttpRequestMethod &, const SBuf &url)
Definition: Uri.cc:252
void userInfo(const SBuf &s)
Definition: Uri.h:79
char const * denyMessage(char const *const default_message=nullptr) const
Definition: UserRequest.cc:127
void stopConsumingFrom(RefCount< BodyPipe > &)
Definition: BodyPipe.cc:118
MemBuf & buf
Definition: BodyPipe.h:74
const MemBuf & buf() const
Definition: BodyPipe.h:137
bool exhausted() const
Definition: BodyPipe.cc:174
uint64_t consumedSize() const
Definition: BodyPipe.h:111
bool setConsumerIfNotLate(const Consumer::Pointer &aConsumer)
Definition: BodyPipe.cc:228
int64_t prepPartialResponseGeneration()
ClientHttpRequest(ConnStateData *)
void noteAdaptationAclCheckDone(Adaptation::ServiceGroupPointer) override
void noteMoreBodyDataAvailable(BodyPipe::Pointer) override
struct ClientHttpRequest::Out out
void clearRequest()
resets the current request and log_uri to nil
HttpRequest *const request
void resumeBodyStorage()
called by StoreEntry when it has more buffer space available
bool receivedWholeAdaptedReply
noteBodyProductionEnded() was called
void noteBodyProductionEnded(BodyPipe::Pointer) override
StoreEntry * loggingEntry_
int64_t mRangeCLen() const
Definition: client_side.cc:764
void calloutsError(const err_type, const ErrorDetail::Pointer &)
Build an error reply. For use with the callouts.
void absorbLogUri(char *)
assigns log_uri with aUri without copying the entire C-string
ConnStateData * getConn() const
String rangeBoundaryStr() const
Definition: client_side.cc:804
void initRequest(HttpRequest *)
void setLogUriToRequestUri()
sets log_uri when we know the current request
void checkForInternalAccess()
Checks whether the current request is internal and adjusts it accordingly.
void updateError(const Error &)
if necessary, stores new error information (if any)
CbcPointer< Adaptation::Initiate > virginHeadSource
void updateLoggingTags(const LogTags_ot code)
update the code in the transaction processing tags
MemObject * memObject() const
void setLogUriToRawUri(const char *, const HttpRequestMethod &)
size_t req_sz
raw request size on input, not current request size
ConnStateData * conn_
void setErrorUri(const char *)
BodyPipe::Pointer adaptedBodySource
Ssl::BumpMode sslBumpNeed_
whether (and how) the request needs to be bumped
HttpHdrRangeIter range_iter
void noteAdaptationAnswer(const Adaptation::Answer &) override
void handleAdaptedHeader(Http::Message *)
struct ClientHttpRequest::Flags flags
void resetRequest(HttpRequest *)
void resetRequestXXX(HttpRequest *, bool uriChanged)
void callException(const std::exception &) override
called when the job throws during an async call
void assignRequest(HttpRequest *)
StoreEntry * storeEntry() const
void handleAdaptationBlock(const Adaptation::Answer &)
void noteBodyProducerAborted(BodyPipe::Pointer) override
void sslBumpEstablish(Comm::Flag)
bool sslBumpNeeded() const
returns true if and only if the request needs to be bumped
ClientRequestContext * calloutContext
Ssl::BumpMode sslBumpNeed() const
returns raw sslBump mode value
const LogTags & loggingTags() const
the processing tags associated with this request transaction.
void handleAdaptationFailure(const ErrorDetail::Pointer &, bool bypassable=false)
const AccessLogEntry::Pointer al
access.log entry
StoreEntry * loggingEntry() const
void startAdaptation(const Adaptation::ServiceGroupPointer &)
Initiate an asynchronous adaptation transaction which will call us back.
struct ClientHttpRequest::Redirect redirect
void clientAccessCheckDone(const Acl::Answer &)
void clientStoreIdDone(const Helper::Reply &)
void clientRedirectDone(const Helper::Reply &)
void sslBumpAccessCheckDone(const Acl::Answer &answer)
The callback function for ssl-bump access check list.
ClientRequestContext(ClientHttpRequest *)
bool readNextRequest
whether Squid should read after error handling
ClientHttpRequest * http
ACLChecklist * acl_checklist
need ptr back so we can unregister if needed
void checkNoCache()
applies "cache allow/deny" rules, asynchronously if needed
ErrorState * error
saved error page for centralized/delayed processing
void hostHeaderVerifyFailed(const char *A, const char *B)
void hostHeaderIpVerify(const ipcache_addrs *, const Dns::LookupDetails &)
void checkNoCacheDone(const Acl::Answer &)
static void Reset()
forgets the current context, setting it to nil/unknown
Definition: CodeContext.cc:77
Comm::Flag flag
comm layer result status.
Definition: CommCalls.h:82
Comm::ConnectionPointer conn
Definition: CommCalls.h:80
bool isOpen() const
Definition: Connection.h:101
char rfc931[USER_IDENT_SZ]
Definition: Connection.h:176
Ip::Address local
Definition: Connection.h:146
Ssl::ServerBump * serverBump()
Definition: client_side.h:285
bool auth
pinned for www authentication
Definition: client_side.h:147
bool switchedToHttps() const
Definition: client_side.h:284
const ProxyProtocol::HeaderPointer & proxyProtocolHeader() const
Definition: client_side.h:360
Comm::ConnectionPointer serverConnection
Definition: client_side.h:143
void switchToHttps(ClientHttpRequest *, Ssl::BumpMode bumpServerMode)
void setAuth(const Auth::UserRequest::Pointer &aur, const char *cause)
Definition: client_side.cc:518
const Auth::UserRequest::Pointer & getAuth() const
Definition: client_side.h:123
Error bareError
a problem that occurred without a request (e.g., while parsing headers)
Definition: client_side.h:381
void expectNoForwarding()
cleans up virgin request [body] forwarding state
struct ConnStateData::@37 pinning
struct ConnStateData::@36 flags
bool isOpen() const
Definition: client_side.cc:664
Ip::Address log_addr
Definition: client_side.h:136
Ssl::BumpMode sslBumpMode
ssl_bump decision (Ssl::bumpEnd if n/a).
Definition: client_side.h:304
bool readMore
needs comm_read (for this request or new requests)
Definition: client_side.h:139
AnyP::Port port
destination port of the request that caused serverConnection
Definition: client_side.h:145
void setServerBump(Ssl::ServerBump *srvBump)
Definition: client_side.h:286
bool have(const Ip::Address &ip, size_t *position=nullptr) const
Definition: ipcache.cc:982
encapsulates DNS lookup results
Definition: LookupDetails.h:23
err_type type
Definition: errorpage.h:170
void detailError(const ErrorDetail::Pointer &dCode)
set error type-specific detail code
Definition: errorpage.h:111
Auth::UserRequest::Pointer auth_user_request
Definition: errorpage.h:175
Http::StatusCode httpStatus
Definition: errorpage.h:173
a transaction problem
Definition: Error.h:27
err_type category
primary error classification (or ERR_NONE)
Definition: Error.h:55
void update(const Error &)
if necessary, stores the given error information (if any)
Definition: Error.cc:51
NotePairs notes
Definition: Reply.h:62
Helper::ResultCode result
The helper response 'result' field.
Definition: Reply.h:59
bool hasNoCache(const String **val=nullptr) const
Definition: HttpHdrCc.h:89
bool hasOnlyIfCached() const
Definition: HttpHdrCc.h:145
HttpHdrRange::iterator pos
HttpHdrRange::iterator end
iterator begin()
iterator end()
std::vector< HttpHdrRangeSpec * > specs
int64_t lowestOffset(int64_t) const
Http::HdrType id
Definition: HttpHeader.h:66
int delById(Http::HdrType id)
Definition: HttpHeader.cc:667
String getList(Http::HdrType id) const
Definition: HttpHeader.cc:789
void update(const HttpHeader *fresh)
Definition: HttpHeader.cc:268
HttpHeaderEntry * getEntry(HttpHeaderPos *pos) const
Definition: HttpHeader.cc:584
const char * getStr(Http::HdrType id) const
Definition: HttpHeader.cc:1164
time_t getTime(Http::HdrType id) const
Definition: HttpHeader.cc:1147
HttpHdrRange * getRange() const
Definition: HttpHeader.cc:1221
int has(Http::HdrType id) const
Definition: HttpHeader.cc:938
int hasListMember(Http::HdrType id, const char *member, const char separator) const
Definition: HttpHeader.cc:1663
MemBuf * pack() const
Definition: HttpReply.cc:112
int64_t bodySize(const HttpRequestMethod &) const
Definition: HttpReply.cc:377
static HttpReplyPointer MakeConnectionEstablished()
construct and return an HTTP/200 (Connection Established) response
Definition: HttpReply.cc:121
bool respMaybeCacheable() const
Http::MethodType id() const
Definition: RequestMethod.h:70
void recordLookup(const Dns::LookupDetails &detail)
Definition: HttpRequest.cc:580
HttpHdrRange * range
Definition: HttpRequest.h:143
CbcPointer< ConnStateData > clientConnectionManager
Definition: HttpRequest.h:232
HttpRequestMethod method
Definition: HttpRequest.h:114
HttpRequest * clone() const override
Definition: HttpRequest.cc:175
Ip::Address indirect_client_addr
Definition: HttpRequest.h:152
static HttpRequest * FromUrlXXX(const char *url, const MasterXaction::Pointer &, const HttpRequestMethod &method=Http::METHOD_GET)
Definition: HttpRequest.cc:528
time_t ims
Definition: HttpRequest.h:145
String store_id
Definition: HttpRequest.h:139
RequestFlags flags
Definition: HttpRequest.h:141
String x_forwarded_for_iterator
Definition: HttpRequest.h:187
void detailError(const err_type c, const ErrorDetail::Pointer &d)
sets error detail if no earlier detail was available
Definition: HttpRequest.h:101
NotePairs::Pointer notes()
Definition: HttpRequest.cc:752
ConnStateData * pinnedConnection()
Definition: HttpRequest.cc:725
void ignoreRange(const char *reason)
forgets about the cached Range header (for a reason)
Definition: HttpRequest.cc:621
const SBuf storeId()
Definition: HttpRequest.cc:733
bool maybeCacheable()
Definition: HttpRequest.cc:538
char * canonicalCleanUrl() const
Definition: HttpRequest.cc:814
Ip::Address my_addr
Definition: HttpRequest.h:155
Auth::UserRequest::Pointer auth_user_request
Definition: HttpRequest.h:127
Error error
the first transaction problem encountered (or falsy)
Definition: HttpRequest.h:161
Adaptation::Icap::History::Pointer icapHistory() const
Returns possibly nil history, creating it if icap logging is enabled.
Definition: HttpRequest.cc:389
AnyP::Uri url
the request URI
Definition: HttpRequest.h:115
Ip::Address client_addr
Definition: HttpRequest.h:149
const SBuf & effectiveRequestUri() const
RFC 7230 section 5.5 - Effective Request URI.
Definition: HttpRequest.cc:744
common parts of HttpRequest and HttpReply
Definition: Message.h:26
HttpHeader header
Definition: Message.h:74
int64_t content_length
Definition: Message.h:83
BodyPipe::Pointer body_pipe
optional pipeline to receive message body
Definition: Message.h:97
HttpHdrCc * cache_control
Definition: Message.h:76
AnyP::ProtocolVersion http_ver
Definition: Message.h:72
void setNoAddr()
Definition: Address.cc:292
unsigned short port() const
Definition: Address.cc:778
mb_size_t contentSize() const
available data size
Definition: MemBuf.h:47
void consume(mb_size_t sz)
removes sz bytes and "packs" by moving content left
Definition: MemBuf.cc:168
const HttpReply & baseReply() const
Definition: MemObject.h:60
void appendNewOnly(const NotePairs *src)
Definition: Notes.cc:381
const char * findFirst(const char *noteKey) const
Definition: Notes.cc:297
Definition: Range.h:19
C * getRaw() const
Definition: RefCount.h:89
bool doneFollowXff() const
Definition: RequestFlags.h:128
bool interceptTproxy
Set for requests handled by a "tproxy" port.
Definition: RequestFlags.h:70
bool accelerated
Definition: RequestFlags.h:62
bool connectionAuth
Definition: RequestFlags.h:85
bool forceTunnel
whether to forward via TunnelStateData (instead of FwdState)
Definition: RequestFlags.h:120
bool connectionProxyAuth
Definition: RequestFlags.h:90
bool hostVerified
Definition: RequestFlags.h:68
bool done_follow_x_forwarded_for
Definition: RequestFlags.h:108
void disableCacheUse(const char *reason)
Definition: RequestFlags.cc:30
bool intercepted
Definition: RequestFlags.h:66
bool nocacheHack
Definition: RequestFlags.h:60
bool loopDetected
Definition: RequestFlags.h:40
bool connectionAuthDisabled
Definition: RequestFlags.h:87
SupportOrVeto cachable
whether the response may be stored in the cache
Definition: RequestFlags.h:35
bool hierarchical
Definition: RequestFlags.h:38
Definition: SBuf.h:94
const char * c_str()
Definition: SBuf.cc:516
void resetWithoutLocking(T *t)
Reset raw pointer - unlock any previous one and save new one without locking.
Comm::ConnectionPointer clientConnection
Definition: Server.h:100
void stopReading()
cancels Comm::Read() if it is scheduled
Definition: Server.cc:60
struct SquidConfig::@94 Port
size_t appendDomainLen
Definition: SquidConfig.h:223
acl_access * adapted_http
Definition: SquidConfig.h:360
int log_uses_indirect_client
Definition: SquidConfig.h:328
int acl_uses_indirect_client
Definition: SquidConfig.h:326
wordlist * store_id
Definition: SquidConfig.h:202
acl_access * followXFF
Definition: SquidConfig.h:391
acl_access * redirector
Definition: SquidConfig.h:377
struct SquidConfig::@107 accessList
int hostStrictVerify
Definition: SquidConfig.h:337
int reload_into_ims
Definition: SquidConfig.h:293
struct SquidConfig::@106 onoff
acl_access * http
Definition: SquidConfig.h:359
wordlist * redirect
Definition: SquidConfig.h:201
struct SquidConfig::@99 Program
struct SquidConfig::@100 Accel
char * surrogate_id
Definition: SquidConfig.h:220
AclDenyInfoList * denyInfoList
Definition: SquidConfig.h:408
unsigned short icp
Definition: SquidConfig.h:141
struct SquidConfig::UrlHelperTimeout onUrlRewriteTimeout
acl_access * ssl_bump
Definition: SquidConfig.h:388
acl_access * noCache
Definition: SquidConfig.h:366
int global_internal_static
Definition: SquidConfig.h:322
void completeSuccessfully(const char *whyWeAreSureWeStoredTheWholeReply)
Definition: store.cc:1003
size_t bytesWanted(Range< size_t > const aRange, bool ignoreDelayPool=false) const
Definition: store.cc:212
void completeTruncated(const char *whyWeConsiderTheReplyTruncated)
Definition: store.cc:1010
int unlock(const char *context)
Definition: store.cc:455
void complete()
Definition: store.cc:1017
void write(StoreIOBuffer)
Definition: store.cc:766
void lock(const char *context)
Definition: store.cc:431
bool timestampsSet()
Definition: store.cc:1373
void replaceHttpReply(const HttpReplyPointer &, const bool andStartWriting=true)
Definition: store.cc:1691
bool isEmpty() const
Definition: Store.h:66
void deferProducer(const AsyncCall::Pointer &producer)
call back producer when more buffer space is available
Definition: store.cc:352
void clean()
Definition: String.cc:103
char const * rawBuf() const
Definition: SquidString.h:86
void cut(size_type newLength)
Definition: String.cc:203
char const * termedBuf() const
Definition: SquidString.h:92
size_type size() const
Definition: SquidString.h:73
void veto()
makes decision() false regardless of past or future support() calls
Definition: SupportOrVeto.h:29
void CSD(clientStreamNode *, ClientHttpRequest *)
client stream detach
void CSR(clientStreamNode *, ClientHttpRequest *)
client stream read
void CSCB(clientStreamNode *, ClientHttpRequest *, HttpReply *, StoreIOBuffer)
client stream read callback
clientStream_status_t CSS(clientStreamNode *, ClientHttpRequest *)
ACLFilledChecklist * clientAclChecklistCreate(const acl_access *acl, ClientHttpRequest *http)
static void clientInterpretRequestHeaders(ClientHttpRequest *http)
static void clientRedirectAccessCheckDone(Acl::Answer answer, void *data)
static void clientFollowXForwardedForCheck(Acl::Answer answer, void *data)
#define FAILURE_MODE_TIME
static void checkNoCacheDoneWrapper(Acl::Answer, void *)
static void sslBumpAccessCheckDoneWrapper(Acl::Answer, void *)
ErrorState * clientBuildError(err_type, Http::StatusCode, char const *url, const ConnStateData *, HttpRequest *, const AccessLogEntry::Pointer &)
static void hostHeaderIpVerifyWrapper(const ipcache_addrs *ia, const Dns::LookupDetails &dns, void *data)
static void clientCheckPinning(ClientHttpRequest *http)
static int clientHierarchical(ClientHttpRequest *http)
static HLPCB clientStoreIdDoneWrapper
static void clientStoreIdAccessCheckDone(Acl::Answer answer, void *data)
int clientBeginRequest(const HttpRequestMethod &method, char const *url, CSCB *streamcallback, CSD *streamdetach, ClientStreamData streamdata, HttpHeader const *header, char *tailbuf, size_t taillen, const MasterXaction::Pointer &mx)
static void checkFailureRatio(err_type, hier_code)
static HLPCB clientRedirectDoneWrapper
SQUIDCEXTERN CSR clientGetMoreData
static void clientAccessCheckDoneWrapper(Acl::Answer, void *)
SQUIDCEXTERN CSS clientReplyStatus
SQUIDCEXTERN CSD clientReplyDetach
static void SslBumpEstablish(const Comm::ConnectionPointer &, char *, size_t, Comm::Flag errflag, int, void *data)
void tunnelStart(ClientHttpRequest *)
Definition: tunnel.cc:1139
#define DBG_IMPORTANT
Definition: Stream.h:38
#define debugs(SECTION, LEVEL, CONTENT)
Definition: Stream.h:194
#define DBG_CRITICAL
Definition: Stream.h:37
#define REDIRECT_DONE
Definition: defines.h:57
#define REDIRECT_PENDING
Definition: defines.h:56
#define MAX_URL
Definition: defines.h:78
static int port
Definition: ldap_backend.cc:70
err_type
Definition: forward.h:14
@ ERR_ACCESS_DENIED
Definition: forward.h:18
@ ERR_CONNECT_FAIL
Definition: forward.h:30
@ ERR_SECURE_CONNECT_FAIL
Definition: forward.h:31
@ ERR_DNS_FAIL
Definition: forward.h:35
@ ERR_GATEWAY_FAILURE
Definition: forward.h:67
@ ERR_NONE
Definition: forward.h:15
@ ERR_ICAP_FAILURE
Definition: forward.h:64
@ ERR_CONFLICT_HOST
Definition: forward.h:48
@ ERR_READ_ERROR
Definition: forward.h:28
@ ERR_CACHE_ACCESS_DENIED
Definition: forward.h:19
void fd_note(int fd, const char *s)
Definition: fd.cc:216
#define fd_table
Definition: fde.h:189
int refresh_nocache_hack
char ThisCache2[RFC2181_MAXHOSTNAMELEN<< 1]
int neighbors_do_private_keys
double request_failure_ratio
time_t hit_only_mode_until
err_type aclGetDenyInfoPage(AclDenyInfoList **head, const char *name, int redirect_allowed)
Definition: Gadgets.cc:39
int aclIsProxyAuth(const char *name)
Definition: Gadgets.cc:70
const char * AclMatchedName
Definition: Acl.cc:29
@ ACCESS_AUTH_REQUIRED
Definition: Acl.h:120
@ ACCESS_DENIED
Definition: Acl.h:115
@ ACCESS_ALLOWED
Definition: Acl.h:116
void clientStreamRead(clientStreamNode *thisObject, ClientHttpRequest *http, StoreIOBuffer readBuffer)
void clientStreamInit(dlink_list *list, CSR *func, CSD *rdetach, CSS *readstatus, ClientStreamData readdata, CSCB *callback, CSD *cdetach, ClientStreamData callbackdata, StoreIOBuffer tailBuffer)
void errorAppendEntry(StoreEntry *entry, ErrorState *err)
Definition: errorpage.cc:717
void ipcache_nbgethostbyname(const char *name, IPH *handler, void *handlerData)
Definition: ipcache.cc:608
const char * bumpMode(int bm)
Definition: support.h:138
const char * sslGetUserEmail(SSL *ssl)
Definition: support.cc:885
BumpMode
Definition: support.h:126
@ bumpTerminate
Definition: support.h:126
@ bumpEnd
Definition: support.h:126
@ bumpClientFirst
Definition: support.h:126
@ bumpSplice
Definition: support.h:126
@ bumpBump
Definition: support.h:126
void HLPCB(void *, const Helper::Reply &)
Definition: forward.h:33
hier_code
Definition: hier_code.h:12
@ HIER_NONE
Definition: hier_code.h:13
void HTTPMSGUNLOCK(M *&a)
Definition: Message.h:150
void HTTPMSGLOCK(Http::Message *a)
Definition: Message.h:161
bool ForSomeCacheManager(const SBuf &urlPath)
Definition: internal.cc:87
bool internalStaticCheck(const SBuf &urlPath)
Definition: internal.cc:80
bool internalCheck(const SBuf &urlPath)
Definition: internal.cc:73
const char * internalHostname(void)
Definition: internal.cc:150
int internalHostnameIs(const char *arg)
Definition: internal.cc:166
unsigned char tos_t
Definition: forward.h:27
static uint32 A
Definition: md4.c:43
static uint32 B
Definition: md4.c:43
@ methodReqmod
Definition: Elements.h:17
@ pointPreCache
Definition: Elements.h:18
@ PROTO_HTTP
Definition: ProtocolType.h:25
bool IsConnOpen(const Comm::ConnectionPointer &conn)
Definition: Connection.cc:27
void Write(const Comm::ConnectionPointer &conn, const char *buf, int size, AsyncCall::Pointer &callback, FREE *free_func)
Definition: Write.cc:33
Flag
Definition: Flag.h:15
@ OK
Definition: Flag.h:16
@ ERR_CLOSING
Definition: Flag.h:24
@ Unknown
Definition: ResultCode.h:17
@ BrokenHelper
Definition: ResultCode.h:20
@ Error
Definition: ResultCode.h:19
@ TimedOut
Definition: ResultCode.h:21
@ Okay
Definition: ResultCode.h:18
StatusCode
Definition: StatusCode.h:20
@ scForbidden
Definition: StatusCode.h:47
@ scUnauthorized
Definition: StatusCode.h:45
@ scFound
Definition: StatusCode.h:38
@ scInternalServerError
Definition: StatusCode.h:71
@ scConflict
Definition: StatusCode.h:53
@ scPermanentRedirect
Definition: StatusCode.h:43
@ scSeeOther
Definition: StatusCode.h:39
@ scProxyAuthenticationRequired
Definition: StatusCode.h:51
@ scTemporaryRedirect
Definition: StatusCode.h:42
@ scMovedPermanently
Definition: StatusCode.h:37
@ METHOD_TRACE
Definition: MethodType.h:30
@ METHOD_OTHER
Definition: MethodType.h:93
@ METHOD_CONNECT
Definition: MethodType.h:29
@ METHOD_GET
Definition: MethodType.h:25
@ METHOD_HEAD
Definition: MethodType.h:28
@ PROXY_AUTHORIZATION
@ IF_MODIFIED_SINCE
AnyP::ProtocolVersion ProtocolVersion(unsigned int aMajor, unsigned int aMinor)
HTTP version label information.
bool setNfConnmark(Comm::ConnectionPointer &conn, const ConnectionDirection connDir, const NfMarkConfig &cm)
Definition: QosConfig.cc:181
@ dirAccepted
accepted (from a client by Squid)
Definition: QosConfig.h:69
Config TheConfig
Globally available instance of Qos::Config.
Definition: QosConfig.cc:283
int setSockTos(const Comm::ConnectionPointer &conn, tos_t tos)
Definition: QosConfig.cc:570
int setSockNfmark(const Comm::ConnectionPointer &conn, nfmark_t mark)
Definition: QosConfig.cc:602
#define xfree
#define xstrdup
void storeIdStart(ClientHttpRequest *http, HLPCB *handler, void *data)
Definition: redirect.cc:311
void redirectStart(ClientHttpRequest *http, HLPCB *handler, void *data)
Definition: redirect.cc:285
@ toutActBypass
Definition: redirect.h:16
#define SQUIDCEXTERN
Definition: squid.h:21
StoreEntry * storeCreateEntry(const char *url, const char *logUrl, const RequestFlags &flags, const HttpRequestMethod &method)
Definition: store.cc:745
int64_t strtoll(const char *nptr, char **endptr, int base)
Definition: strtoll.c:61
Definition: parse.c:104
struct timeval current_time
the current UNIX time in timeval {seconds, microseconds} format
Definition: gadgets.cc:17
int getMyPort(void)
Definition: tools.cc:1041
void debugObj(int section, int level, const char *label, void *obj, ObjPackMethod pm)
Definition: tools.cc:938
void(* ObjPackMethod)(void *obj, Packable *p)
Definition: tools.h:33
void * xcalloc(size_t n, size_t sz)
Definition: xalloc.cc:71
#define safe_free(x)
Definition: xalloc.h:73
#define xisspace(x)
Definition: xis.h:15
char * xstrndup(const char *s, size_t n)
Definition: xstring.cc:56

 

Introduction

Documentation

Support

Miscellaneous

Web Site Translations

Mirrors