Blame SOURCES/squid-CVE-2016-10002.patch

643dd3
------------------------------------------------------------
643dd3
revno: 14109
643dd3
revision-id: squid3@treenet.co.nz-20161111060325-yh8chavvnzuvfh3h
643dd3
parent: squid3@treenet.co.nz-20161101112231-k77st4up2sekl5zx
643dd3
fixes bug: http://bugs.squid-cache.org/show_bug.cgi?id=3379
643dd3
author: Garri Djavadyan <garryd@comnet.uz>, Amos Jeffries <squid3@treenet.co.nz>
643dd3
committer: Amos Jeffries <squid3@treenet.co.nz>
643dd3
branch nick: 3.5
643dd3
timestamp: Fri 2016-11-11 19:03:25 +1300
643dd3
message:
643dd3
  Bug 3379: Combination of If-Match and a Cache Hit result in TCP Connection Failure
643dd3
------------------------------------------------------------
643dd3
# Bazaar merge directive format 2 (Bazaar 0.90)
643dd3
# revision_id: squid3@treenet.co.nz-20161111060325-yh8chavvnzuvfh3h
643dd3
# target_branch: http://bzr.squid-cache.org/bzr/squid3/3.5
643dd3
# testament_sha1: 50d66878a765925d9a64569b3c226bebdee1f736
643dd3
# timestamp: 2016-11-11 06:10:37 +0000
643dd3
# source_branch: http://bzr.squid-cache.org/bzr/squid3/3.5
643dd3
# base_revision_id: squid3@treenet.co.nz-20161101112231-\
643dd3
#   k77st4up2sekl5zx
643dd3
# 
643dd3
# Begin patch
643dd3
=== modified file 'src/client_side_reply.cc'
643dd3
--- src/client_side_reply.cc  2016-10-09 19:47:26 +0000
643dd3
+++ src/client_side_reply.cc  2016-11-11 06:03:25 +0000
643dd3
@@ -589,6 +589,7 @@
643dd3
         debugs(88, 5, "negative-HIT");
643dd3
         http->logType = LOG_TCP_NEGATIVE_HIT;
643dd3
         sendMoreData(result);
643dd3
+        return;
643dd3
     } else if (blockedHit()) {
643dd3
         debugs(88, 5, "send_hit forces a MISS");
643dd3
         http->logType = LOG_TCP_MISS;
643dd3
@@ -641,27 +642,29 @@
643dd3
             http->logType = LOG_TCP_MISS;
643dd3
             processMiss();
643dd3
         }
643dd3
+        return;
643dd3
     } else if (r->conditional()) {
643dd3
         debugs(88, 5, "conditional HIT");
643dd3
-        processConditional(result);
643dd3
-    } else {
643dd3
-        /*
643dd3
-         * plain ol' cache hit
643dd3
-         */
643dd3
-        debugs(88, 5, "plain old HIT");
643dd3
+        if (processConditional(result))
643dd3
+            return;
643dd3
+    }
643dd3
+
643dd3
+    /*
643dd3
+     * plain ol' cache hit
643dd3
+     */
643dd3
+    debugs(88, 5, "plain old HIT");
643dd3
 
643dd3
 #if USE_DELAY_POOLS
643dd3
-        if (e->store_status != STORE_OK)
643dd3
-            http->logType = LOG_TCP_MISS;
643dd3
-        else
643dd3
+    if (e->store_status != STORE_OK)
643dd3
+        http->logType = LOG_TCP_MISS;
643dd3
+    else
643dd3
 #endif
643dd3
-            if (e->mem_status == IN_MEMORY)
643dd3
-                http->logType = LOG_TCP_MEM_HIT;
643dd3
-            else if (Config.onoff.offline)
643dd3
-                http->logType = LOG_TCP_OFFLINE_HIT;
643dd3
+        if (e->mem_status == IN_MEMORY)
643dd3
+            http->logType = LOG_TCP_MEM_HIT;
643dd3
+        else if (Config.onoff.offline)
643dd3
+            http->logType = LOG_TCP_OFFLINE_HIT;
643dd3
 
643dd3
-        sendMoreData(result);
643dd3
-    }
643dd3
+    sendMoreData(result);
643dd3
 }
643dd3
 
643dd3
 /**
643dd3
@@ -755,17 +758,16 @@
643dd3
 }
643dd3
 
643dd3
 /// process conditional request from client
643dd3
-void
643dd3
+bool
643dd3
 clientReplyContext::processConditional(StoreIOBuffer &result)
643dd3
 {
643dd3
     StoreEntry *const e = http->storeEntry();
643dd3
 
643dd3
     if (e->getReply()->sline.status() != Http::scOkay) {
643dd3
-        debugs(88, 4, "clientReplyContext::processConditional: Reply code " <<
643dd3
-               e->getReply()->sline.status() << " != 200");
643dd3
+        debugs(88, 4, "Reply code " << e->getReply()->sline.status() << " != 200");
643dd3
         http->logType = LOG_TCP_MISS;
643dd3
         processMiss();
643dd3
-        return;
643dd3
+        return true;
643dd3
     }
643dd3
 
643dd3
     HttpRequest &r = *http->request;
643dd3
@@ -773,7 +775,7 @@
643dd3
     if (r.header.has(HDR_IF_MATCH) && !e->hasIfMatchEtag(r)) {
643dd3
         // RFC 2616: reply with 412 Precondition Failed if If-Match did not match
643dd3
         sendPreconditionFailedError();
643dd3
-        return;
643dd3
+        return true;
643dd3
     }
643dd3
 
643dd3
     bool matchedIfNoneMatch = false;
643dd3
@@ -786,14 +788,14 @@
643dd3
             r.header.delById(HDR_IF_MODIFIED_SINCE);
643dd3
             http->logType = LOG_TCP_MISS;
643dd3
             sendMoreData(result);
643dd3
-            return;
643dd3
+            return true;
643dd3
         }
643dd3
 
643dd3
         if (!r.flags.ims) {
643dd3
             // RFC 2616: if If-None-Match matched and there is no IMS,
643dd3
             // reply with 304 Not Modified or 412 Precondition Failed
643dd3
             sendNotModifiedOrPreconditionFailedError();
643dd3
-            return;
643dd3
+            return true;
643dd3
         }
643dd3
 
643dd3
         // otherwise check IMS below to decide if we reply with 304 or 412
643dd3
@@ -805,19 +807,20 @@
643dd3
         if (e->modifiedSince(&r)) {
643dd3
             http->logType = LOG_TCP_IMS_HIT;
643dd3
             sendMoreData(result);
643dd3
-            return;
643dd3
-        }
643dd3
 
643dd3
-        if (matchedIfNoneMatch) {
643dd3
+        } else if (matchedIfNoneMatch) {
643dd3
             // If-None-Match matched, reply with 304 Not Modified or
643dd3
             // 412 Precondition Failed
643dd3
             sendNotModifiedOrPreconditionFailedError();
643dd3
-            return;
643dd3
+
643dd3
+        } else {
643dd3
+            // otherwise reply with 304 Not Modified
643dd3
+            sendNotModified();
643dd3
         }
643dd3
-
643dd3
-        // otherwise reply with 304 Not Modified
643dd3
-        sendNotModified();
643dd3
+        return true;
643dd3
     }
643dd3
+
643dd3
+    return false;
643dd3
 }
643dd3
 
643dd3
 /// whether squid.conf send_hit prevents us from serving this hit
643dd3
643dd3
=== modified file 'src/client_side_reply.h'
643dd3
--- src/client_side_reply.h 2016-09-23 15:28:42 +0000
643dd3
+++ src/client_side_reply.h 2016-11-11 06:03:25 +0000
643dd3
@@ -114,7 +114,7 @@
643dd3
     bool alwaysAllowResponse(Http::StatusCode sline) const;
643dd3
     int checkTransferDone();
643dd3
     void processOnlyIfCachedMiss();
643dd3
-    void processConditional(StoreIOBuffer &result);
643dd3
+    bool processConditional(StoreIOBuffer &result);
643dd3
     void cacheHit(StoreIOBuffer result);
643dd3
     void handleIMSReply(StoreIOBuffer result);
643dd3
     void sendMoreData(StoreIOBuffer result);
643dd3
643dd3
------------------------------------------------------------
643dd3
revno: 14126
643dd3
revision-id: squid3@treenet.co.nz-20161215103357-827wow3k1y3k9yql
643dd3
parent: squid3@treenet.co.nz-20161215093634-ykbs6tv8pdusz7cj
643dd3
fixes bug: http://bugs.squid-cache.org/show_bug.cgi?id=4169
643dd3
author: Garri Djavadyan <garryd@comnet.uz>
643dd3
committer: Amos Jeffries <squid3@treenet.co.nz>
643dd3
branch nick: 3.5
643dd3
timestamp: Thu 2016-12-15 23:33:57 +1300
643dd3
message:
643dd3
  Bug 4169: HIT marked as MISS when If-None-Match does not match
643dd3
------------------------------------------------------------
643dd3
# Bazaar merge directive format 2 (Bazaar 0.90)
643dd3
# revision_id: squid3@treenet.co.nz-20161215103357-827wow3k1y3k9yql
643dd3
# target_branch: http://bzr.squid-cache.org/bzr/squid3/3.5
643dd3
# testament_sha1: 258cd3e400bcb137a7bcdf6e7e0240287ea581a3
643dd3
# timestamp: 2016-12-15 10:34:30 +0000
643dd3
# source_branch: http://bzr.squid-cache.org/bzr/squid3/3.5
643dd3
# base_revision_id: squid3@treenet.co.nz-20161215093634-\
643dd3
#   ykbs6tv8pdusz7cj
643dd3
# 
643dd3
# Begin patch
643dd3
=== modified file 'src/LogTags.h'
643dd3
--- src/LogTags.h 2016-10-09 19:47:26 +0000
643dd3
+++ src/LogTags.h 2016-12-15 10:33:57 +0000
643dd3
@@ -28,6 +28,7 @@
643dd3
     LOG_TCP_REFRESH_MODIFIED,   // refresh from origin replaced existing entry
643dd3
     LOG_TCP_CLIENT_REFRESH_MISS,
643dd3
     LOG_TCP_IMS_HIT,
643dd3
+    LOG_TCP_INM_HIT,
643dd3
     LOG_TCP_SWAPFAIL_MISS,
643dd3
     LOG_TCP_NEGATIVE_HIT,
643dd3
     LOG_TCP_MEM_HIT,
643dd3
@@ -54,6 +55,7 @@
643dd3
     return
643dd3
         (code == LOG_TCP_HIT) ||
643dd3
         (code == LOG_TCP_IMS_HIT) ||
643dd3
+        (code == LOG_TCP_INM_HIT) ||
643dd3
         (code == LOG_TCP_REFRESH_FAIL_OLD) ||
643dd3
         (code == LOG_TCP_REFRESH_UNMODIFIED) ||
643dd3
         (code == LOG_TCP_NEGATIVE_HIT) ||
643dd3
643dd3
=== modified file 'src/client_side.cc'
643dd3
--- src/client_side.cc  2016-12-09 01:58:33 +0000
643dd3
+++ src/client_side.cc  2016-12-15 10:33:57 +0000
643dd3
@@ -429,6 +429,7 @@
643dd3
         statCounter.client_http.nearHitSvcTime.count(svc_time);
643dd3
         break;
643dd3
 
643dd3
+    case LOG_TCP_INM_HIT:
643dd3
     case LOG_TCP_IMS_HIT:
643dd3
         statCounter.client_http.nearMissSvcTime.count(svc_time);
643dd3
         break;
643dd3
643dd3
=== modified file 'src/client_side_reply.cc'
643dd3
--- src/client_side_reply.cc  2016-12-15 09:36:34 +0000
643dd3
+++ src/client_side_reply.cc  2016-12-15 10:33:57 +0000
643dd3
@@ -778,40 +778,27 @@
643dd3
         return true;
643dd3
     }
643dd3
 
643dd3
-    bool matchedIfNoneMatch = false;
643dd3
     if (r.header.has(HDR_IF_NONE_MATCH)) {
643dd3
-        if (!e->hasIfNoneMatchEtag(r)) {
643dd3
-            // RFC 2616: ignore IMS if If-None-Match did not match
643dd3
-            r.flags.ims = false;
643dd3
-            r.ims = -1;
643dd3
-            r.imslen = 0;
643dd3
-            r.header.delById(HDR_IF_MODIFIED_SINCE);
643dd3
-            http->logType = LOG_TCP_MISS;
643dd3
-            sendMoreData(result);
643dd3
-            return true;
643dd3
-        }
643dd3
+        // RFC 7232: If-None-Match recipient MUST ignore IMS
643dd3
+        r.flags.ims = false;
643dd3
+        r.ims = -1;
643dd3
+        r.imslen = 0;
643dd3
+        r.header.delById(HDR_IF_MODIFIED_SINCE);
643dd3
 
643dd3
-        if (!r.flags.ims) {
643dd3
-            // RFC 2616: if If-None-Match matched and there is no IMS,
643dd3
-            // reply with 304 Not Modified or 412 Precondition Failed
643dd3
+        if (e->hasIfNoneMatchEtag(r)) {
643dd3
             sendNotModifiedOrPreconditionFailedError();
643dd3
             return true;
643dd3
         }
643dd3
 
643dd3
-        // otherwise check IMS below to decide if we reply with 304 or 412
643dd3
-        matchedIfNoneMatch = true;
643dd3
+        // None-Match is true (no ETag matched); treat as an unconditional hit
643dd3
+        return false;
643dd3
     }
643dd3
 
643dd3
     if (r.flags.ims) {
643dd3
         // handle If-Modified-Since requests from the client
643dd3
         if (e->modifiedSince(&r)) {
643dd3
-            http->logType = LOG_TCP_IMS_HIT;
643dd3
-            sendMoreData(result);
643dd3
-
643dd3
-        } else if (matchedIfNoneMatch) {
643dd3
-            // If-None-Match matched, reply with 304 Not Modified or
643dd3
-            // 412 Precondition Failed
643dd3
-            sendNotModifiedOrPreconditionFailedError();
643dd3
+            // Modified-Since is true; treat as an unconditional hit
643dd3
+            return false;
643dd3
 
643dd3
         } else {
643dd3
             // otherwise reply with 304 Not Modified
643dd3
@@ -1974,7 +1961,12 @@
643dd3
     StoreEntry *e = http->storeEntry();
643dd3
     const time_t timestamp = e->timestamp;
643dd3
     HttpReply *const temprep = e->getReply()->make304();
643dd3
-    http->logType = LOG_TCP_IMS_HIT;
643dd3
+    // log as TCP_INM_HIT if code 304 generated for
643dd3
+    // If-None-Match request
643dd3
+    if (!http->request->flags.ims)
643dd3
+        http->logType = LOG_TCP_INM_HIT;
643dd3
+    else
643dd3
+        http->logType = LOG_TCP_IMS_HIT;
643dd3
     removeClientStoreReference(&sc, http);
643dd3
     createStoreEntry(http->request->method, RequestFlags());
643dd3
     e = http->storeEntry();
643dd3