diff -u -r src/ACLChecklist.cc src/ACLChecklist.cc --- src/ACLChecklist.cc Sat May 17 17:04:07 2003 +++ src/ACLChecklist.cc Sun Jul 6 21:01:45 2003 @@ -306,6 +306,7 @@ allow_(ACCESS_DENIED), state_(NullState::Instance()), destinationDomainChecked_(false), + originDomainChecked_(false), sourceDomainChecked_(false) { @@ -405,6 +406,19 @@ { assert (!finished() && !destinationDomainChecked()); destinationDomainChecked_ = true; +} + +bool +ACLChecklist::originDomainChecked() const +{ + return originDomainChecked_; +} + +void +ACLChecklist::markOriginDomainChecked() +{ + assert (!finished() && !originDomainChecked()); + originDomainChecked_ = true; } bool diff -u -r src/ACLChecklist.h src/ACLChecklist.h --- src/ACLChecklist.h Tue May 20 05:17:38 2003 +++ src/ACLChecklist.h Sun Jul 6 21:02:11 2003 @@ -114,6 +114,8 @@ struct in_addr dst_addr; + struct in_addr origin_addr; + struct in_addr my_addr; unsigned short my_port; request_t *request; @@ -131,6 +133,8 @@ ExternalACLEntry *extacl_entry; bool destinationDomainChecked() const; void markDestinationDomainChecked(); + bool originDomainChecked() const; + void markOriginDomainChecked(); bool sourceDomainChecked() const; void markSourceDomainChecked(); @@ -143,6 +147,7 @@ allow_t allow_; AsyncState *state_; bool destinationDomainChecked_; + bool originDomainChecked_; bool sourceDomainChecked_; bool checking_; bool checking() const; diff -u -r src/HttpHeader.cc src/HttpHeader.cc --- src/HttpHeader.cc Sun Mar 9 20:56:36 2003 +++ src/HttpHeader.cc Mon Jul 7 23:58:59 2003 @@ -127,6 +127,7 @@ {"X-Cache", HDR_X_CACHE, ftStr}, {"X-Cache-Lookup", HDR_X_CACHE_LOOKUP, ftStr}, {"X-Forwarded-For", HDR_X_FORWARDED_FOR, ftStr}, + {"X-RequestOrigin", HDR_X_REQUESTORIGIN, ftStr}, {"X-Request-URI", HDR_X_REQUEST_URI, ftStr}, {"X-Squid-Error", HDR_X_SQUID_ERROR, ftStr}, {"Negotiate", HDR_NEGOTIATE, ftStr}, @@ -227,7 +228,8 @@ HDR_IF_MATCH, HDR_IF_MODIFIED_SINCE, HDR_IF_NONE_MATCH, HDR_IF_RANGE, HDR_MAX_FORWARDS, HDR_PROXY_CONNECTION, HDR_PROXY_AUTHORIZATION, HDR_RANGE, HDR_REFERER, HDR_REQUEST_RANGE, - HDR_USER_AGENT, HDR_X_FORWARDED_FOR, HDR_SURROGATE_CAPABILITY + HDR_USER_AGENT, HDR_X_FORWARDED_FOR, HDR_SURROGATE_CAPABILITY, + HDR_X_REQUESTORIGIN }; /* header accounting */ diff -u -r src/Makefile.am src/Makefile.am --- src/Makefile.am Fri Jun 27 15:32:30 2003 +++ src/Makefile.am Sun Jul 6 21:05:11 2003 @@ -247,6 +247,10 @@ ACLSourceDomain.h \ ACLSourceIP.cc \ ACLSourceIP.h \ + ACLOriginDomain.cc \ + ACLOriginDomain.h \ + ACLOriginIP.cc \ + ACLOriginIP.h \ ACLStrategised.cc \ ACLStrategised.h \ ACLStrategy.h \ diff -u -r src/client_side.cc src/client_side.cc --- src/client_side.cc Fri Jun 27 15:32:30 2003 +++ src/client_side.cc Mon Jul 7 23:44:10 2003 @@ -2163,6 +2163,10 @@ http->request = requestLink(request); clientSetKeepaliveFlag(http); /* Do we expect a request-body? */ + + const char* origin = httpHeaderGetStr(&http->request->header, HDR_X_REQUESTORIGIN); + if (origin == NULL) origin = "127.0.0.1"; + strncpy(request->origin, origin, SQUIDHOSTNAMELEN); if (request->content_length > 0) { conn->body.size_left = request->content_length; diff -u -r src/enums.h src/enums.h --- src/enums.h Wed Apr 23 23:35:09 2003 +++ src/enums.h Sun Jul 6 20:53:31 2003 @@ -186,6 +186,7 @@ HDR_X_FORWARDED_FOR, HDR_X_REQUEST_URI, /* appended if ADD_X_REQUEST_URI is #defined */ HDR_X_SQUID_ERROR, + HDR_X_REQUESTORIGIN, HDR_NEGOTIATE, #if X_ACCELERATOR_VARY HDR_X_ACCELERATOR_VARY, diff -u -r src/structs.h src/structs.h --- src/structs.h Tue Jul 1 13:42:28 2003 +++ src/structs.h Sun Jul 6 19:51:38 2003 @@ -1676,6 +1676,7 @@ protocol_t protocol; char login[MAX_LOGIN_SZ]; char host[SQUIDHOSTNAMELEN + 1]; + char origin[SQUIDHOSTNAMELEN + 1]; auth_user_request_t *auth_user_request; u_short port; String urlpath; --- src/ACLOriginIP.h Tue Jul 8 00:04:08 2003 +++ src/ACLOriginIP.h Sun Jul 6 20:05:17 2003 @@ -0,0 +1,80 @@ + +/* + * $Id: squid.patch,v 1.1 2003/07/09 03:34:03 megacz Exp $ + * + * + * SQUID Web Proxy Cache http://www.squid-cache.org/ + * ---------------------------------------------------------- + * + * Squid is the result of efforts by numerous individuals from + * the Internet community; see the CONTRIBUTORS file for full + * details. Many organizations have provided support for Squid's + * development; see the SPONSORS file for full details. Squid is + * Copyrighted (C) 2001 by the Regents of the University of + * California; see the COPYRIGHT file for full details. Squid + * incorporates software developed and/or copyrighted by other + * sources; see the CREDITS file for full details. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA. + * + * + * Copyright (c) 2003, Robert Collins + */ + +/* + * This file implements an ACL based on the X-RequestOrigin HTTP + * header as described in http://www.xwt.org/x-requestorigin.txt + * + * This file was adapted from ACLDestinationIP.h. + */ + +#ifndef SQUID_ACLORIGINIP_H +#define SQUID_ACLORIGINIP_H +#include "ACLChecklist.h" +#include "ACLIP.h" + +class OriginIPLookup : public ACLChecklist::AsyncState +{ + +public: + static OriginIPLookup *Instance(); + virtual void checkForAsync(ACLChecklist *)const; + +private: + static OriginIPLookup instance_; + static IPH LookupDone; +}; + +class ACLOriginIP : public ACLIP +{ + +public: + void *operator new(size_t); + void operator delete(void *); + virtual void deleteSelf() const; + + virtual char const *typeString() const; + virtual int match(ACLChecklist *checklist); + virtual bool requiresRequest() const {return true;} + + virtual ACL *clone()const; + +private: + static MemPool *Pool; + static Prototype RegistryProtoype; + static ACLOriginIP RegistryEntry_; +}; + +#endif /* SQUID_ACLDESTINATIONIP_H */ --- src/ACLOriginIP.cc Tue Jul 8 00:04:07 2003 +++ src/ACLOriginIP.cc Sun Jul 6 20:08:47 2003 @@ -0,0 +1,137 @@ +/* + * $Id: squid.patch,v 1.1 2003/07/09 03:34:03 megacz Exp $ + * + * DEBUG: section 28 Access Control + * AUTHOR: Duane Wessels + * + * SQUID Web Proxy Cache http://www.squid-cache.org/ + * ---------------------------------------------------------- + * + * Squid is the result of efforts by numerous individuals from + * the Internet community; see the CONTRIBUTORS file for full + * details. Many organizations have provided support for Squid's + * development; see the SPONSORS file for full details. Squid is + * Copyrighted (C) 2001 by the Regents of the University of + * California; see the COPYRIGHT file for full details. Squid + * incorporates software developed and/or copyrighted by other + * sources; see the CREDITS file for full details. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA. + * + * Copyright (c) 2003, Robert Collins + */ + +/* + * This file implements an ACL based on the X-RequestOrigin HTTP + * header as described in http://www.xwt.org/x-requestorigin.txt + * + * This file was adapted from ACLDestinationIP.cc. + */ + +#include "squid.h" +#include "ACLOriginIP.h" +#include "ACLChecklist.h" + +MemPool *ACLOriginIP::Pool(NULL); +void * +ACLOriginIP::operator new (size_t byteCount) +{ + /* derived classes with different sizes must implement their own new */ + assert (byteCount == sizeof (ACLOriginIP)); + + if (!Pool) + Pool = memPoolCreate("ACLOriginIP", sizeof (ACLOriginIP)); + + return memPoolAlloc(Pool); +} + +void +ACLOriginIP::operator delete (void *address) +{ + memPoolFree (Pool, address); +} + +void +ACLOriginIP::deleteSelf() const +{ + delete this; +} + +char const * +ACLOriginIP::typeString() const +{ + return "origin"; +} + +int +ACLOriginIP::match(ACLChecklist *checklist) +{ + const ipcache_addrs *ia = ipcache_gethostbyname(checklist->request->origin, IP_LOOKUP_IF_MISS); + + if (ia) { + /* Entry in cache found */ + + for (int k = 0; k < (int) ia->count; k++) { + if (ACLIP::match(ia->in_addrs[k])) + return 1; + } + + return 0; + } else if (!checklist->request->flags.destinationIPLookedUp()) { + /* No entry in cache, lookup not attempted */ + debug(28, 3) ("aclMatchAcl: Can't yet compare '%s' ACL for '%s'\n", + name, checklist->request->origin); + checklist->changeState (OriginIPLookup::Instance()); + return 0; + } else { + return ACLIP::match(no_addr); + } +} + +OriginIPLookup OriginIPLookup::instance_; + +OriginIPLookup * +OriginIPLookup::Instance() +{ + return &instance_; +} + +void +OriginIPLookup::checkForAsync(ACLChecklist *checklist)const +{ + checklist->asyncInProgress(true); + ipcache_nbgethostbyname(checklist->request->origin, LookupDone, checklist); +} + +void +OriginIPLookup::LookupDone(const ipcache_addrs * ia, void *data) +{ + ACLChecklist *checklist = (ACLChecklist *)data; + assert (checklist->asyncState() == OriginIPLookup::Instance()); + checklist->request->flags.destinationIPLookupCompleted(); + checklist->asyncInProgress(false); + checklist->changeState (ACLChecklist::NullState::Instance()); + checklist->check(); +} + +ACL::Prototype ACLOriginIP::RegistryProtoype(&ACLOriginIP::RegistryEntry_, "origin"); + +ACLOriginIP ACLOriginIP::RegistryEntry_; + +ACL * +ACLOriginIP::clone() const +{ + return new ACLOriginIP(*this); +} --- src/ACLOriginDomain.cc Tue Jul 8 00:03:59 2003 +++ src/ACLOriginDomain.cc Mon Jul 7 23:48:54 2003 @@ -0,0 +1,191 @@ +/* + * $Id: squid.patch,v 1.1 2003/07/09 03:34:03 megacz Exp $ + * + * DEBUG: section 28 Access Control + * AUTHOR: Duane Wessels + * + * SQUID Web Proxy Cache http://www.squid-cache.org/ + * ---------------------------------------------------------- + * + * Squid is the result of efforts by numerous individuals from + * the Internet community; see the CONTRIBUTORS file for full + * details. Many organizations have provided support for Squid's + * development; see the SPONSORS file for full details. Squid is + * Copyrighted (C) 2001 by the Regents of the University of + * California; see the COPYRIGHT file for full details. Squid + * incorporates software developed and/or copyrighted by other + * sources; see the CREDITS file for full details. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA. + * + * + * Copyright (c) 2003, Robert Collins + */ + +/* + * This file implements an ACL based on the X-RequestOrigin HTTP + * header as described in http://www.xwt.org/x-requestorigin.txt + * + * This file was adapted from ACLDestinationDomain.cc. + */ + +#include "squid.h" +#include "ACLOriginDomain.h" +#include "authenticate.h" +#include "ACLChecklist.h" +#include "ACLRegexData.h" +#include "ACLDomainData.h" + +MemPool *ACLOriginDomain::Pool(NULL); +void * +ACLOriginDomain::operator new (size_t byteCount) +{ + /* derived classes with different sizes must implement their own new */ + assert (byteCount == sizeof (ACLOriginDomain)); + + if (!Pool) + Pool = memPoolCreate("ACLOriginDomain", sizeof (ACLOriginDomain)); + + return memPoolAlloc(Pool); +} + +void +ACLOriginDomain::operator delete (void *address) +{ + memPoolFree (Pool, address); +} + +void +ACLOriginDomain::deleteSelf() const +{ + delete this; +} + +ACLOriginDomain::~ACLOriginDomain() +{ + data->deleteSelf(); +} + +ACLOriginDomain::ACLOriginDomain(ACLData *newData, char const *theType) : data (newData), type_(theType) {} + +ACLOriginDomain::ACLOriginDomain (ACLOriginDomain const &old) : data (old.data->clone()), type_(old.type_) +{} + +ACLOriginDomain & +ACLOriginDomain::operator= (ACLOriginDomain const &rhs) +{ + data = rhs.data->clone(); + type_ = rhs.type_; + return *this; +} + +char const * +ACLOriginDomain::typeString() const +{ + return type_; +} + +void +ACLOriginDomain::parse() +{ + data->parse(); +} + +int +ACLOriginDomain::match(ACLChecklist *checklist) +{ + const ipcache_addrs *ia = NULL; + debug(0, -1000) ("match(%s)\n", checklist->request->origin); + if ((ia = ipcacheCheckNumeric(checklist->request->origin)) == NULL) + return data->match(checklist->request->origin); + + const char *fqdn = NULL; + + fqdn = fqdncache_gethostbyaddr(ia->in_addrs[0], FQDN_LOOKUP_IF_MISS); + + if (fqdn) + return data->match(fqdn); + + if (!checklist->originDomainChecked()) { + debug(28, 3) ("aclMatchAcl: Can't yet compare '%s' ACL for '%s'\n", + name, inet_ntoa(ia->in_addrs[0])); + checklist->changeState(OriginDomainLookup::Instance()); + return 0; + } + + return data->match("none"); +} + +wordlist * +ACLOriginDomain::dump() const +{ + return data->dump(); +} + +bool +ACLOriginDomain::valid () const +{ + return data != NULL; +} + +OriginDomainLookup OriginDomainLookup::instance_; + +OriginDomainLookup * +OriginDomainLookup::Instance() +{ + return &instance_; +} + +void +OriginDomainLookup::checkForAsync(ACLChecklist *checklist)const +{ + + ipcache_addrs *ia; + ia = ipcacheCheckNumeric(checklist->request->origin); + + if (ia == NULL) { + /* Make fatal? XXX this is checked during match() */ + checklist->markOriginDomainChecked(); + checklist->changeState (ACLChecklist::NullState::Instance()); + } else { + checklist->asyncInProgress(true); + checklist->origin_addr = ia->in_addrs[0]; + fqdncache_nbgethostbyaddr(checklist->origin_addr, + LookupDone, checklist); + } +} + +void +OriginDomainLookup::LookupDone(const char *fqdn, void *data) +{ + ACLChecklist *checklist = (ACLChecklist *)data; + assert (checklist->asyncState() == OriginDomainLookup::Instance()); + + checklist->asyncInProgress(false); + checklist->changeState (ACLChecklist::NullState::Instance()); + checklist->markOriginDomainChecked(); + checklist->check(); +} + +ACL::Prototype ACLOriginDomain::LiteralRegistryProtoype(&ACLOriginDomain::LiteralRegistryEntry_, "origindomain"); +ACLOriginDomain ACLOriginDomain::LiteralRegistryEntry_(new ACLDomainData, "origindomain"); +ACL::Prototype ACLOriginDomain::RegexRegistryProtoype(&ACLOriginDomain::RegexRegistryEntry_, "origindom_regex"); +ACLOriginDomain ACLOriginDomain::RegexRegistryEntry_(new ACLRegexData, "origindom_regex"); + +ACL * +ACLOriginDomain::clone() const +{ + return new ACLOriginDomain(*this); +} --- src/ACLOriginDomain.h Tue Jul 8 00:04:00 2003 +++ src/ACLOriginDomain.h Sun Jul 6 20:04:27 2003 @@ -0,0 +1,94 @@ + +/* + * $Id: squid.patch,v 1.1 2003/07/09 03:34:03 megacz Exp $ + * + * + * SQUID Web Proxy Cache http://www.squid-cache.org/ + * ---------------------------------------------------------- + * + * Squid is the result of efforts by numerous individuals from + * the Internet community; see the CONTRIBUTORS file for full + * details. Many organizations have provided support for Squid's + * development; see the SPONSORS file for full details. Squid is + * Copyrighted (C) 2001 by the Regents of the University of + * California; see the COPYRIGHT file for full details. Squid + * incorporates software developed and/or copyrighted by other + * sources; see the CREDITS file for full details. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA. + * + * + * Copyright (c) 2003, Robert Collins + */ + +/* + * This file implements an ACL based on the X-RequestOrigin HTTP + * header as described in http://www.xwt.org/x-requestorigin.txt + * + * This file was adapted from ACLDestinationDomain.h. + */ + +#ifndef SQUID_ACLORIGINDOMAIN_H +#define SQUID_ACLORIGINDOMAIN_H +#include "ACL.h" +#include "ACLData.h" +#include "ACLChecklist.h" + +class OriginDomainLookup : public ACLChecklist::AsyncState +{ + +public: + static OriginDomainLookup *Instance(); + virtual void checkForAsync(ACLChecklist *)const; + +private: + static OriginDomainLookup instance_; + static void LookupDone(const char *, void *); +}; + +class ACLOriginDomain : public ACL +{ + +public: + void *operator new(size_t); + void operator delete(void *); + virtual void deleteSelf() const; + + ~ACLOriginDomain(); + ACLOriginDomain(ACLData *, char const *); + ACLOriginDomain (ACLOriginDomain const &); + ACLOriginDomain &operator= (ACLOriginDomain const &); + + virtual char const *typeString() const; + virtual void parse(); + virtual int match(ACLChecklist *checklist); + virtual wordlist *dump() const; + virtual bool valid () const; + virtual bool requiresRequest() const {return true;} + + virtual ACL *clone()const; + +private: + static MemPool *Pool; + static Prototype LiteralRegistryProtoype; + static Prototype LegacyRegistryProtoype; + static ACLOriginDomain LiteralRegistryEntry_; + static Prototype RegexRegistryProtoype; + static ACLOriginDomain RegexRegistryEntry_; + ACLData *data; + char const *type_; +}; + +#endif /* SQUID_ACLDESTINATIONDOMAIN_H */ --- configure.in Thu Jul 3 17:13:11 2003 +++ configure.in Sun Jul 6 21:36:34 2003 @@ -124,8 +124,8 @@ dnl set squid required flags if test "$GCC" = "yes"; then - SQUID_CFLAGS="-Werror -Wall -Wpointer-arith -Wwrite-strings -Wmissing-prototypes -Wmissing-declarations -Wcomments" - SQUID_CXXFLAGS="-Werror -Wall -Wpointer-arith -Wwrite-strings -Wmissing-prototypes -Wcomments" + SQUID_CFLAGS="-Wall -Wpointer-arith -Wwrite-strings -Wmissing-prototypes -Wmissing-declarations -Wcomments" + SQUID_CXXFLAGS="-Wall -Wpointer-arith -Wwrite-strings -Wmissing-prototypes -Wcomments" else SQUID_CFLAGS= SQUID_CXXFLAGS=