òÁÍÂÌÅÒšš | ðÏÞÔÁšš |  | îÁÓÔÒÏÊËÁšš | ðÏÍÏÝØšš | ÷ÙÈÏÄšš

evgen__k@rambler.ru

÷ÈÏÄÑÝÉÅ š|š îÁÐÉÓÁÔØ ÐÉÓØÍÏ š|š ÷ÓÅ ÐÁÐËÉ š|š æÉÌØÔÒÙ

ðÁÐËÁ "÷ÈÏÄÑÝÉÅ" >> ÐÒÏÓÍÏÔÒ ÐÉÓØÍÁ Nš3592

| óÌÅÄÕÀÝÅÅ ÎÅÐÒÏÞÉÔÁÎÎÏÅ | ïÔ×ÅÔÉÔØ | ïÔ×ÅÔÉÔØ ×ÓÅÍ | ðÅÒÅÓÌÁÔØ ÓšÒÅÄÁËÔÉÒÏ×ÁÎÉÅÍ |
÷ÅÒÎÕÔØÓÑ ×šÐÁÐËÕ '÷ÈÏÄÑÝÉÅ' | õÄÁÌÉÔØ | õÓÔÁÎÏ×ÉÔØ ÆÌÁÇ | óÏÈÒÁÎÉÔØ ËÁË ÎÅÐÒÏÞÉÔÁÎÎÏÅ

ïÔÐÒÁ×ÉÔÅÌØ: Florian DECKERT <fdeckert@sopragroup.com>
ôÅÍÁ: Re: Patch proposal for web surfing agreement
äÁÔÁ: Mon, 21 Jul 2003 14:13:37 +0200
ëÏÍÕ: Evgeny Kotsuba <evgen__k@rambler.ru>

`Hello Evgeny, Here is our patch against Squid2.5.STABLE3. To use it, we added the following options in squid.conf (included in the patch in cf.data.pre) I must confess I was not the hacker. I'm only the sysAdmin ;-) The coder is scaro@sopragroup.com in case you need some code customization.
regards
# # NOTE: special word BLOCK can be added to the proxy_auth acltype
# # parameters. When present, first requests of the authenticated user
# # are blocked and an ACCESS_DENIED page is returned.
# # See blocking_info and blocking_ttl tags below for customizations.
acl password proxy_auth REQUIRED BLOCK
# TAG: blocking_ttl
# The time during which a newly authenticated user will see its requests
# rejected (see blocking_info below for page customization).
# Default is `0' which blocks only the first request sent by the user.
#DEFAULT: 0 seconds
blocking_ttl 10 seconds
# TAG: blocking_info
# Usage: blocking_info front_page_name acl
# Example: blocking_info FRONT_PAGE password
#
# This can be used to return a customized page to a newly authenticated
# user. The page is returned in place of his request.
# DEFAULT: none
blocking_info ERR_agrement password
Evgeny Kotsuba wrote:
`

> > `
> > We are now looking to merge our patch into the main squid tree and provide support for further squid release.
> > `

> `
> Very interesting,
> I will wait for it for 2.5
> SY,
> EK
> SY,
> Evgeny Kotsuba
> `

`
-- Florian DECKERT
System Manager
tel : +33 4 50 33 31 37
SOPRA Group PAE Les glaisins bp238 - 74940 Annecy le vieux cedex - France
--
"Welcome to the real world" (The Matrix : 1999)
--
Ce message est exclusivement destin? aux personnes dont le nom figure ci-dessus. Il peut contenir des informations confidentielles dont la divulgation est ? ce titre rigoureusement interdite en l'absence d'autorisation nominative explicite de l'?metteur. Dans l"hypoth?se o? vous auriez re?u ce message par erreur, merci de le renvoyer ? l'adresse ?lectronique ci-dessous et de d?truire toute copie.
This message may contain confidential and proprietary material for the sole use of the intended recipient. Any review or distribution by others is strictly prohibited. If you are not the intended recipient, please contact the sender and delete all copies
` `diff -r -c old/squid-2.5.STABLE3/src/acl.c new/squid-2.5.STABLE3/src/acl.c
*** old/squid-2.5.STABLE3/src/acl.c Mon May 12 09:24:37 2003
--- new/squid-2.5.STABLE3/src/acl.c Tue Jun 17 11:34:35 2003
***************
*** 37,43 ****
šš#include "splay.h"
šš
ššstatic void aclParseDomainList(void *curlist);
! static void aclParseUserList(void **current);
ššstatic void aclParseIpList(void *curlist);
ššstatic void aclParseIntlist(void *curlist);
šš#if SQUID_SNMP
--- 37,43 ----
šš#include "splay.h"
šš
ššstatic void aclParseDomainList(void *curlist);
! static int aclParseUserList(void **current);
ššstatic void aclParseIpList(void *curlist);
ššstatic void aclParseIntlist(void *curlist);
šš#if SQUID_SNMP
***************
*** 614,625 ****
šš}
šš#endif
šš
! static void
ššaclParseUserList(void **current)
šš{
ššššššchar *t = NULL;
ššššššacl_user_data *data;
ššššššsplayNode *Top = NULL;
šš
ššššššdebug(28, 2) ("aclParseUserList: parsing user list\n");
ššššššif (*current == NULL) {
--- 614,626 ----
šš}
šš#endif
šš
! static int
ššaclParseUserList(void **current)
šš{
ššššššchar *t = NULL;
ššššššacl_user_data *data;
ššššššsplayNode *Top = NULL;
+ int blocked = 0;
šš
ššššššdebug(28, 2) ("aclParseUserList: parsing user list\n");
ššššššif (*current == NULL) {
***************
*** 648,659 ****
--- 649,666 ----
šš
ššššššdebug(28, 4) ("aclParseUserList: parsing user list\n");
ššššššwhile ((t = strtokFile())) {
+ if ((! blocked) && (strcmp("BLOCK", t) == 0)) {
+ debug(28, 5) ("aclParseUserList: BLOCK-type enabled\n");
+ blocked = 1;
+ continue;
+ }
šš debug(28, 6) ("aclParseUserList: Got token: %s\n", t);
šš if (data->flags.case_insensitive)
šš Tolower(t);
šš Top = splay_insert(xstrdup(t), Top, (SPLAYCMP *) strcmp);
šššššš}
ššššššdata->names = Top;
+ return blocked;
šš}
šš
šš
***************
*** 785,791 ****
šš debug(28, 0) ("aclParseAclLine: IGNORING: Proxy Auth ACL '%s' \
ššbecause no authentication schemes are fully configured.\n", A->cfgline);
šš } else {
! aclParseUserList(&A->data);
šš }
šš break;
ššššššcase ACL_PROXY_AUTH_REGEX:
--- 792,799 ----
šš debug(28, 0) ("aclParseAclLine: IGNORING: Proxy Auth ACL '%s' \
ššbecause no authentication schemes are fully configured.\n", A->cfgline);
šš } else {
! if (aclParseUserList(&A->data))
! A->blocked = 1;
šš }
šš break;
ššššššcase ACL_PROXY_AUTH_REGEX:
***************
*** 1170,1180 ****
--- 1178,1190 ----
šš/* aclMatchProxyAuth can return two exit codes:
ššš* 0 : Authorisation for this ACL failed. (Did not match)
ššš* 1 : Authorisation OK. (Matched)
+ * -3 : Authorisation OK. (Matched), but still in blocking period
ššš*/
ššstatic int
ššaclMatchProxyAuth(void *data, auth_user_request_t * auth_user_request,
ššššššaclCheck_t * checklist, squid_acl acltype)
šš{
+ int ret;
šššššš/* checklist is used to register user name when identified, nothing else */
šššššš/* General program flow in proxy_auth acls
ššššššš* 1. Consistency checks: are we getting sensible data
***************
*** 1191,1199 ****
šššššš/* this ACL check completed */
ššššššauthenticateAuthUserRequestUnlock(auth_user_request);
šššššš/* check to see if we have matched the user-acl before */
! return aclCacheMatchAcl(&auth_user_request->auth_user->
šš proxy_match_cache, acltype, data,
šš authenticateUserRequestUsername(auth_user_request));
šš}
šš
ššCBDATA_TYPE(acl_user_ip_data);
--- 1201,1225 ----
šššššš/* this ACL check completed */
ššššššauthenticateAuthUserRequestUnlock(auth_user_request);
šššššš/* check to see if we have matched the user-acl before */
! ret = aclCacheMatchAcl(&auth_user_request->auth_user->
šš proxy_match_cache, acltype, data,
šš authenticateUserRequestUsername(auth_user_request));
+ if (ret != 1)
+ return ret;
+ if (!auth_user_request->auth_user->request_blocking_done) {
+ if (!Config.blockingTTL) {
+ auth_user_request->auth_user->request_blocking_done = 1;
+ return -3;
+ }
+ if (!auth_user_request->auth_user->validatedtime)
+ auth_user_request->auth_user->validatedtime = current_time.tv_sec;
+ if (Config.blockingTTL + auth_user_request->auth_user->validatedtime
+ < current_time.tv_sec) {
+ auth_user_request->auth_user->request_blocking_done = 1;
+ } else
+ return -3;
+ }
+ return 1;
šš}
šš
ššCBDATA_TYPE(acl_user_ip_data);
***************
*** 1620,1625 ****
--- 1646,1656 ----
šš return ti;
šš ti = aclMatchProxyAuth(ae->data, checklist->auth_user_request,
šš checklist, ae->type);
+ if (ti == -3) { /* user validated OK but we must block the request */
+ if (ae->blocked) /* acl contains BLOCK */
+ RequestBlockingAclMatchedName = ae->name;
+ ti = 1;
+ }
šš checklist->auth_user_request = NULL;
šš return ti;
šš /* NOTREACHED */
***************
*** 1691,1696 ****
--- 1722,1728 ----
ššint
ššaclMatchAclList(const acl_list * list, aclCheck_t * checklist)
šš{
+ RequestBlockingAclMatchedName = NULL;
ššššššwhile (list) {
šš int answer;
šš checklist->current_acl = list->acl;
diff -r -c old/squid-2.5.STABLE3/src/authenticate.c new/squid-2.5.STABLE3/src/authenticate.c
*** old/squid-2.5.STABLE3/src/authenticate.c Sun May 18 23:49:19 2003
--- new/squid-2.5.STABLE3/src/authenticate.c Mon Jun 16 14:13:48 2003
***************
*** 187,192 ****
--- 187,194 ----
šššššštemp_auth->references = 0;
šššššštemp_auth->auth_module = authenticateAuthSchemeId(scheme) + 1;
šššššštemp_auth->usernamehash = NULL;
+ temp_auth->request_blocking_done = 0;
+ temp_auth->validatedtime = 0;
ššššššreturn temp_auth;
šš}
šš
diff -r -c old/squid-2.5.STABLE3/src/cf.data.pre new/squid-2.5.STABLE3/src/cf.data.pre
*** old/squid-2.5.STABLE3/src/cf.data.pre Wed May 21 16:34:38 2003
--- new/squid-2.5.STABLE3/src/cf.data.pre Mon Jun 16 13:33:10 2003
***************
*** 1963,1968 ****
--- 1963,1973 ----
šš # to check username/password combinations (see
šš # auth_param directive).
šš #
+ # NOTE: special word BLOCK can be added to the proxy_auth acltype
+ # parameters. When present, first requests of the authenticated user
+ # are blocked and an ACCESS_DENIED page is returned.
+ # See blocking_info and blocking_ttl tags below for customizations.
+ #
šš # WARNING: proxy_auth can't be used in a transparent proxy. It
šš # collides with any authentication done by origin servers. It may
šš # seem like it works at first, but it doesn't.
***************
*** 2629,2634 ****
--- 2634,2661 ----
šš
šš Alternatively you can tell Squid to reset the TCP connection
šš by specifying TCP_RESET.
+ DOC_END
+
+ NAME: blocking_ttl
+ TYPE: time_t
+ DEFAULT: 0 seconds
+ LOC: Config.blockingTTL
+ DOC_START
+ The time during which a newly authenticated user will see its requests
+ rejected (see blocking_info below for page customization).
+ Default is `0' which blocks only the first request sent by the user.
+ DOC_END
+
+ NAME: blocking_info
+ TYPE: denyinfo
+ LOC: Config.blockInfoList
+ DEFAULT: none
+ DOC_START
+ Usage: blocking_info front_page_name acl
+ Example: blocking_info FRONT_PAGE password
+
+ This can be used to return a customized page to a newly authenticated
+ user. The page is returned in place of his request.
ššDOC_END
šš
ššNAME: memory_pools
diff -r -c old/squid-2.5.STABLE3/src/client_side.c new/squid-2.5.STABLE3/src/client_side.c
*** old/squid-2.5.STABLE3/src/client_side.c Sat May 24 13:08:41 2003
--- new/squid-2.5.STABLE3/src/client_side.c Mon Jun 16 14:05:46 2003
***************
*** 238,248 ****
--- 238,274 ----
ššššššproxy_auth_msg = authenticateAuthUserRequestMessage(http->conn->auth_user_request ? http->conn->auth_user_request : http->request->auth_user_request);
ššššššhttp->acl_checklist = NULL;
ššššššif (answer == ACCESS_ALLOWED) {
+ if (RequestBlockingAclMatchedName) {
+ debug(33, 2)
+ ("The request is blocked by rule '%s'\n",
+ RequestBlockingAclMatchedName);
+ page_id = aclGetDenyInfoPage(&Config.blockInfoList,
+ RequestBlockingAclMatchedName);
+ if (page_id <= 0)
+ page_id = ERR_ACCESS_DENIED;
+ http->log_type = LOG_TAG_NONE;
+ http->entry = clientCreateStoreEntry(http, http->request->method,
+ null_request_flags);
+ status = HTTP_FORBIDDEN;
+ err = errorCon(page_id, status);
+ err->request = requestLink(http->request);
+ err->src_addr = http->conn->peer.sin_addr;
+ if (http->conn->auth_user_request)
+ err->auth_user_request = http->conn->auth_user_request;
+ else if (http->request->auth_user_request)
+ err->auth_user_request = http->request->auth_user_request;
+ /* lock for the error state */
+ if (err->auth_user_request)
+ authenticateAuthUserRequestLock(err->auth_user_request);
+ err->callback_data = NULL;
+ errorAppendEntry(http->entry, err);
+ } else {
šš safe_free(http->uri);
šš http->uri = xstrdup(urlCanonical(http->request));
šš assert(http->redirect_state == REDIRECT_NONE);
šš http->redirect_state = REDIRECT_PENDING;
šš redirectStart(http, clientRedirectDone, http);
+ }
šššššš} else {
šš debug(33, 5) ("Access Denied: %s\n", http->uri);
šš debug(33, 5) ("AclMatchedName = %s\n",
diff -r -c old/squid-2.5.STABLE3/src/globals.h new/squid-2.5.STABLE3/src/globals.h
*** old/squid-2.5.STABLE3/src/globals.h Tue Jan 14 00:01:13 2003
--- new/squid-2.5.STABLE3/src/globals.h Mon Jun 16 13:23:15 2003
***************
*** 166,170 ****
--- 166,171 ----
šš#if HAVE_SBRK
ššextern void *sbrk_start; /* 0 */
šš#endif
+ extern const char *RequestBlockingAclMatchedName; /* NULL */
šš
šš#endif /* SQUID_GLOBALS_H */
diff -r -c old/squid-2.5.STABLE3/src/structs.h new/squid-2.5.STABLE3/src/structs.h
*** old/squid-2.5.STABLE3/src/structs.h Sun May 11 00:17:44 2003
--- new/squid-2.5.STABLE3/src/structs.h Tue Jun 17 10:00:04 2003
***************
*** 118,123 ****
--- 118,125 ----
ššššššdlink_list ip_list;
ššššššsize_t ipcount;
ššššššlong expiretime;
+ int request_blocking_done; /* 1 = first requests already blocked */
+ time_t validatedtime;
šššššš/* how many references are outstanding to this instance */
ššššššsize_t references;
šššššš/* the auth scheme has it's own private data area */
***************
*** 248,253 ****
--- 250,256 ----
ššššššchar name[ACL_NAME_SZ];
ššššššsquid_acl type;
ššššššvoid *data;
+ int blocked;
ššššššchar *cfgline;
ššššššacl *next;
šš};
***************
*** 615,620 ****
--- 618,625 ----
šš acl_tos *outgoing_tos;
šššššš} accessList;
ššššššacl_deny_info_list *denyInfoList;
+ acl_deny_info_list *blockInfoList;
+ time_t blockingTTL;
ššššššstruct _authConfig {
šš authScheme *schemes;
šš int n_allocated;
`

| óÌÅÄÕÀÝÅÅ ÎÅÐÒÏÞÉÔÁÎÎÏÅ | ïÔ×ÅÔÉÔØ | ïÔ×ÅÔÉÔØ ×ÓÅÍ | ðÅÒÅÓÌÁÔØ ÓšÒÅÄÁËÔÉÒÏ×ÁÎÉÅÍ |
÷ÅÒÎÕÔØÓÑ ×šÐÁÐËÕ '÷ÈÏÄÑÝÉÅ' | õÄÁÌÉÔØ | õÓÔÁÎÏ×ÉÔØ ÆÌÁÇ | óÏÈÒÁÎÉÔØ ËÁË ÎÅÐÒÏÞÉÔÁÎÎÏÅ

/ | ×šÐÁÐËÕš |

ó×ÑÚÁÔØÓÑšÓšÎÁÍÉ. ïšòÁÍÂÌÅÒÅ. ðÒÁ×Ï×ÁÑ ÉÎÆÏÒÍÁÃÉÑ. ïÂÓÕÄÉÔØ òÁÍÂÌÅÒ. äÏÂÁ×ÉÔØšÒÅÓÕÒÓ. òÁÚÍÅÓÔÉÔØšÒÅËÌÁÍÕ. | Copyright ¿ 1996-2003 ïáï "òÁÍÂÌÅÒ éÎÔÅÒÎÅÔ èÏÌÄÉÎÇ"