Blame SOURCES/squid-CVE-2016-10002.patch

ba1db3
------------------------------------------------------------
ba1db3
revno: 14109
ba1db3
revision-id: squid3@treenet.co.nz-20161111060325-yh8chavvnzuvfh3h
ba1db3
parent: squid3@treenet.co.nz-20161101112231-k77st4up2sekl5zx
ba1db3
fixes bug: http://bugs.squid-cache.org/show_bug.cgi?id=3379
ba1db3
author: Garri Djavadyan <garryd@comnet.uz>, Amos Jeffries <squid3@treenet.co.nz>
ba1db3
committer: Amos Jeffries <squid3@treenet.co.nz>
ba1db3
branch nick: 3.5
ba1db3
timestamp: Fri 2016-11-11 19:03:25 +1300
ba1db3
message:
ba1db3
  Bug 3379: Combination of If-Match and a Cache Hit result in TCP Connection Failure
ba1db3
------------------------------------------------------------
ba1db3
# Bazaar merge directive format 2 (Bazaar 0.90)
ba1db3
# revision_id: squid3@treenet.co.nz-20161111060325-yh8chavvnzuvfh3h
ba1db3
# target_branch: http://bzr.squid-cache.org/bzr/squid3/3.5
ba1db3
# testament_sha1: 50d66878a765925d9a64569b3c226bebdee1f736
ba1db3
# timestamp: 2016-11-11 06:10:37 +0000
ba1db3
# source_branch: http://bzr.squid-cache.org/bzr/squid3/3.5
ba1db3
# base_revision_id: squid3@treenet.co.nz-20161101112231-\
ba1db3
#   k77st4up2sekl5zx
ba1db3
# 
ba1db3
# Begin patch
ba1db3
=== modified file 'src/client_side_reply.cc'
ba1db3
--- src/client_side_reply.cc  2016-10-09 19:47:26 +0000
ba1db3
+++ src/client_side_reply.cc  2016-11-11 06:03:25 +0000
ba1db3
@@ -589,6 +589,7 @@
ba1db3
         debugs(88, 5, "negative-HIT");
ba1db3
         http->logType = LOG_TCP_NEGATIVE_HIT;
ba1db3
         sendMoreData(result);
ba1db3
+        return;
ba1db3
     } else if (blockedHit()) {
ba1db3
         debugs(88, 5, "send_hit forces a MISS");
ba1db3
         http->logType = LOG_TCP_MISS;
ba1db3
@@ -641,27 +642,29 @@
ba1db3
             http->logType = LOG_TCP_MISS;
ba1db3
             processMiss();
ba1db3
         }
ba1db3
+        return;
ba1db3
     } else if (r->conditional()) {
ba1db3
         debugs(88, 5, "conditional HIT");
ba1db3
-        processConditional(result);
ba1db3
-    } else {
ba1db3
-        /*
ba1db3
-         * plain ol' cache hit
ba1db3
-         */
ba1db3
-        debugs(88, 5, "plain old HIT");
ba1db3
+        if (processConditional(result))
ba1db3
+            return;
ba1db3
+    }
ba1db3
+
ba1db3
+    /*
ba1db3
+     * plain ol' cache hit
ba1db3
+     */
ba1db3
+    debugs(88, 5, "plain old HIT");
ba1db3
 
ba1db3
 #if USE_DELAY_POOLS
ba1db3
-        if (e->store_status != STORE_OK)
ba1db3
-            http->logType = LOG_TCP_MISS;
ba1db3
-        else
ba1db3
+    if (e->store_status != STORE_OK)
ba1db3
+        http->logType = LOG_TCP_MISS;
ba1db3
+    else
ba1db3
 #endif
ba1db3
-            if (e->mem_status == IN_MEMORY)
ba1db3
-                http->logType = LOG_TCP_MEM_HIT;
ba1db3
-            else if (Config.onoff.offline)
ba1db3
-                http->logType = LOG_TCP_OFFLINE_HIT;
ba1db3
+        if (e->mem_status == IN_MEMORY)
ba1db3
+            http->logType = LOG_TCP_MEM_HIT;
ba1db3
+        else if (Config.onoff.offline)
ba1db3
+            http->logType = LOG_TCP_OFFLINE_HIT;
ba1db3
 
ba1db3
-        sendMoreData(result);
ba1db3
-    }
ba1db3
+    sendMoreData(result);
ba1db3
 }
ba1db3
 
ba1db3
 /**
ba1db3
@@ -755,17 +758,16 @@
ba1db3
 }
ba1db3
 
ba1db3
 /// process conditional request from client
ba1db3
-void
ba1db3
+bool
ba1db3
 clientReplyContext::processConditional(StoreIOBuffer &result)
ba1db3
 {
ba1db3
     StoreEntry *const e = http->storeEntry();
ba1db3
 
ba1db3
     if (e->getReply()->sline.status() != Http::scOkay) {
ba1db3
-        debugs(88, 4, "clientReplyContext::processConditional: Reply code " <<
ba1db3
-               e->getReply()->sline.status() << " != 200");
ba1db3
+        debugs(88, 4, "Reply code " << e->getReply()->sline.status() << " != 200");
ba1db3
         http->logType = LOG_TCP_MISS;
ba1db3
         processMiss();
ba1db3
-        return;
ba1db3
+        return true;
ba1db3
     }
ba1db3
 
ba1db3
     HttpRequest &r = *http->request;
ba1db3
@@ -773,7 +775,7 @@
ba1db3
     if (r.header.has(HDR_IF_MATCH) && !e->hasIfMatchEtag(r)) {
ba1db3
         // RFC 2616: reply with 412 Precondition Failed if If-Match did not match
ba1db3
         sendPreconditionFailedError();
ba1db3
-        return;
ba1db3
+        return true;
ba1db3
     }
ba1db3
 
ba1db3
     bool matchedIfNoneMatch = false;
ba1db3
@@ -786,14 +788,14 @@
ba1db3
             r.header.delById(HDR_IF_MODIFIED_SINCE);
ba1db3
             http->logType = LOG_TCP_MISS;
ba1db3
             sendMoreData(result);
ba1db3
-            return;
ba1db3
+            return true;
ba1db3
         }
ba1db3
 
ba1db3
         if (!r.flags.ims) {
ba1db3
             // RFC 2616: if If-None-Match matched and there is no IMS,
ba1db3
             // reply with 304 Not Modified or 412 Precondition Failed
ba1db3
             sendNotModifiedOrPreconditionFailedError();
ba1db3
-            return;
ba1db3
+            return true;
ba1db3
         }
ba1db3
 
ba1db3
         // otherwise check IMS below to decide if we reply with 304 or 412
ba1db3
@@ -805,19 +807,20 @@
ba1db3
         if (e->modifiedSince(&r)) {
ba1db3
             http->logType = LOG_TCP_IMS_HIT;
ba1db3
             sendMoreData(result);
ba1db3
-            return;
ba1db3
-        }
ba1db3
 
ba1db3
-        if (matchedIfNoneMatch) {
ba1db3
+        } else if (matchedIfNoneMatch) {
ba1db3
             // If-None-Match matched, reply with 304 Not Modified or
ba1db3
             // 412 Precondition Failed
ba1db3
             sendNotModifiedOrPreconditionFailedError();
ba1db3
-            return;
ba1db3
+
ba1db3
+        } else {
ba1db3
+            // otherwise reply with 304 Not Modified
ba1db3
+            sendNotModified();
ba1db3
         }
ba1db3
-
ba1db3
-        // otherwise reply with 304 Not Modified
ba1db3
-        sendNotModified();
ba1db3
+        return true;
ba1db3
     }
ba1db3
+
ba1db3
+    return false;
ba1db3
 }
ba1db3
 
ba1db3
 /// whether squid.conf send_hit prevents us from serving this hit
ba1db3
ba1db3
=== modified file 'src/client_side_reply.h'
ba1db3
--- src/client_side_reply.h 2016-09-23 15:28:42 +0000
ba1db3
+++ src/client_side_reply.h 2016-11-11 06:03:25 +0000
ba1db3
@@ -114,7 +114,7 @@
ba1db3
     bool alwaysAllowResponse(Http::StatusCode sline) const;
ba1db3
     int checkTransferDone();
ba1db3
     void processOnlyIfCachedMiss();
ba1db3
-    void processConditional(StoreIOBuffer &result);
ba1db3
+    bool processConditional(StoreIOBuffer &result);
ba1db3
     void cacheHit(StoreIOBuffer result);
ba1db3
     void handleIMSReply(StoreIOBuffer result);
ba1db3
     void sendMoreData(StoreIOBuffer result);
ba1db3
ba1db3
------------------------------------------------------------
ba1db3
revno: 14126
ba1db3
revision-id: squid3@treenet.co.nz-20161215103357-827wow3k1y3k9yql
ba1db3
parent: squid3@treenet.co.nz-20161215093634-ykbs6tv8pdusz7cj
ba1db3
fixes bug: http://bugs.squid-cache.org/show_bug.cgi?id=4169
ba1db3
author: Garri Djavadyan <garryd@comnet.uz>
ba1db3
committer: Amos Jeffries <squid3@treenet.co.nz>
ba1db3
branch nick: 3.5
ba1db3
timestamp: Thu 2016-12-15 23:33:57 +1300
ba1db3
message:
ba1db3
  Bug 4169: HIT marked as MISS when If-None-Match does not match
ba1db3
------------------------------------------------------------
ba1db3
# Bazaar merge directive format 2 (Bazaar 0.90)
ba1db3
# revision_id: squid3@treenet.co.nz-20161215103357-827wow3k1y3k9yql
ba1db3
# target_branch: http://bzr.squid-cache.org/bzr/squid3/3.5
ba1db3
# testament_sha1: 258cd3e400bcb137a7bcdf6e7e0240287ea581a3
ba1db3
# timestamp: 2016-12-15 10:34:30 +0000
ba1db3
# source_branch: http://bzr.squid-cache.org/bzr/squid3/3.5
ba1db3
# base_revision_id: squid3@treenet.co.nz-20161215093634-\
ba1db3
#   ykbs6tv8pdusz7cj
ba1db3
# 
ba1db3
# Begin patch
ba1db3
=== modified file 'src/LogTags.h'
ba1db3
--- src/LogTags.h 2016-10-09 19:47:26 +0000
ba1db3
+++ src/LogTags.h 2016-12-15 10:33:57 +0000
ba1db3
@@ -28,6 +28,7 @@
ba1db3
     LOG_TCP_REFRESH_MODIFIED,   // refresh from origin replaced existing entry
ba1db3
     LOG_TCP_CLIENT_REFRESH_MISS,
ba1db3
     LOG_TCP_IMS_HIT,
ba1db3
+    LOG_TCP_INM_HIT,
ba1db3
     LOG_TCP_SWAPFAIL_MISS,
ba1db3
     LOG_TCP_NEGATIVE_HIT,
ba1db3
     LOG_TCP_MEM_HIT,
ba1db3
@@ -54,6 +55,7 @@
ba1db3
     return
ba1db3
         (code == LOG_TCP_HIT) ||
ba1db3
         (code == LOG_TCP_IMS_HIT) ||
ba1db3
+        (code == LOG_TCP_INM_HIT) ||
ba1db3
         (code == LOG_TCP_REFRESH_FAIL_OLD) ||
ba1db3
         (code == LOG_TCP_REFRESH_UNMODIFIED) ||
ba1db3
         (code == LOG_TCP_NEGATIVE_HIT) ||
ba1db3
ba1db3
=== modified file 'src/client_side.cc'
ba1db3
--- src/client_side.cc  2016-12-09 01:58:33 +0000
ba1db3
+++ src/client_side.cc  2016-12-15 10:33:57 +0000
ba1db3
@@ -429,6 +429,7 @@
ba1db3
         statCounter.client_http.nearHitSvcTime.count(svc_time);
ba1db3
         break;
ba1db3
 
ba1db3
+    case LOG_TCP_INM_HIT:
ba1db3
     case LOG_TCP_IMS_HIT:
ba1db3
         statCounter.client_http.nearMissSvcTime.count(svc_time);
ba1db3
         break;
ba1db3
ba1db3
=== modified file 'src/client_side_reply.cc'
ba1db3
--- src/client_side_reply.cc  2016-12-15 09:36:34 +0000
ba1db3
+++ src/client_side_reply.cc  2016-12-15 10:33:57 +0000
ba1db3
@@ -778,40 +778,27 @@
ba1db3
         return true;
ba1db3
     }
ba1db3
 
ba1db3
-    bool matchedIfNoneMatch = false;
ba1db3
     if (r.header.has(HDR_IF_NONE_MATCH)) {
ba1db3
-        if (!e->hasIfNoneMatchEtag(r)) {
ba1db3
-            // RFC 2616: ignore IMS if If-None-Match did not match
ba1db3
-            r.flags.ims = false;
ba1db3
-            r.ims = -1;
ba1db3
-            r.imslen = 0;
ba1db3
-            r.header.delById(HDR_IF_MODIFIED_SINCE);
ba1db3
-            http->logType = LOG_TCP_MISS;
ba1db3
-            sendMoreData(result);
ba1db3
-            return true;
ba1db3
-        }
ba1db3
+        // RFC 7232: If-None-Match recipient MUST ignore IMS
ba1db3
+        r.flags.ims = false;
ba1db3
+        r.ims = -1;
ba1db3
+        r.imslen = 0;
ba1db3
+        r.header.delById(HDR_IF_MODIFIED_SINCE);
ba1db3
 
ba1db3
-        if (!r.flags.ims) {
ba1db3
-            // RFC 2616: if If-None-Match matched and there is no IMS,
ba1db3
-            // reply with 304 Not Modified or 412 Precondition Failed
ba1db3
+        if (e->hasIfNoneMatchEtag(r)) {
ba1db3
             sendNotModifiedOrPreconditionFailedError();
ba1db3
             return true;
ba1db3
         }
ba1db3
 
ba1db3
-        // otherwise check IMS below to decide if we reply with 304 or 412
ba1db3
-        matchedIfNoneMatch = true;
ba1db3
+        // None-Match is true (no ETag matched); treat as an unconditional hit
ba1db3
+        return false;
ba1db3
     }
ba1db3
 
ba1db3
     if (r.flags.ims) {
ba1db3
         // handle If-Modified-Since requests from the client
ba1db3
         if (e->modifiedSince(&r)) {
ba1db3
-            http->logType = LOG_TCP_IMS_HIT;
ba1db3
-            sendMoreData(result);
ba1db3
-
ba1db3
-        } else if (matchedIfNoneMatch) {
ba1db3
-            // If-None-Match matched, reply with 304 Not Modified or
ba1db3
-            // 412 Precondition Failed
ba1db3
-            sendNotModifiedOrPreconditionFailedError();
ba1db3
+            // Modified-Since is true; treat as an unconditional hit
ba1db3
+            return false;
ba1db3
 
ba1db3
         } else {
ba1db3
             // otherwise reply with 304 Not Modified
ba1db3
@@ -1974,7 +1961,12 @@
ba1db3
     StoreEntry *e = http->storeEntry();
ba1db3
     const time_t timestamp = e->timestamp;
ba1db3
     HttpReply *const temprep = e->getReply()->make304();
ba1db3
-    http->logType = LOG_TCP_IMS_HIT;
ba1db3
+    // log as TCP_INM_HIT if code 304 generated for
ba1db3
+    // If-None-Match request
ba1db3
+    if (!http->request->flags.ims)
ba1db3
+        http->logType = LOG_TCP_INM_HIT;
ba1db3
+    else
ba1db3
+        http->logType = LOG_TCP_IMS_HIT;
ba1db3
     removeClientStoreReference(&sc, http);
ba1db3
     createStoreEntry(http->request->method, RequestFlags());
ba1db3
     e = http->storeEntry();
ba1db3