{"push_id":1021648584,"size":173,"distinct_size":130,"ref":"refs/heads/distrotech-squid","head":"937eeba8a4db790dbead2f02a01d0986f4b4b429","before":"ade8716c4a51a47af549811a4f7ba8d8f891cdae","commits":[{"sha":"23231858f21cad99348d6cc1f62554cb4d128fff","author":{"email":"bed9ff5a6ab5f897c8046509d7ce778bd810426b@treenet.co.nz","name":"Amos Jeffries"},"message":"Bug 4387: Kerberos build errors on Solaris","distinct":false,"url":"https://api.github.com/repos/Distrotech/squid/commits/23231858f21cad99348d6cc1f62554cb4d128fff"},{"sha":"c5590b28dc79aa234f0caf7fca888cf3a9b13b26","author":{"email":"9eb0a552acce8f0c5161155fabcef38f3dcb9fe7@users.sourceforge.net","name":"Christos Tsantilas"},"message":"Restrict SslBump inspections of cache_peer connections.\n\nThis change is specific to FwdState code path. It does not affect tunneled\ntraffic. Thus, it does not affect CONNECT tunnels unless they are being\ninspected with SslBump code.\n\nThe old code always used PeekingPeerConnector when connecting to a TLS-related\ncache_peer. That approach worked because PeekingPeerConnector does not always\ninspect the SSL/TLS connection it establishes. We were kind of lucky that\nPeekingPeerConnector exceptions matched FwdState needs.\n\nThe primary PeekingPeerConnector goal is to inspect. As its code evolves, it may\nenable inspection when FwdState does not want it. Non-peeking cases inside\nPeekingPeerConnector should all deal with exceptional situations that\nare difficult to predict a priori, before the connector object is created.\n\nThis change restricts inspection to cases where an inspected SSL client\nconnection is being forwarded, reducing the probability that a peer\nconnection is wrongly inspected. This change does not fix any known bugs.\n\nThis is a Measurement Factory project.","distinct":false,"url":"https://api.github.com/repos/Distrotech/squid/commits/c5590b28dc79aa234f0caf7fca888cf3a9b13b26"},{"sha":"c8adbedb85c3de9c427b40c4b533014f310d7ac6","author":{"email":"bed9ff5a6ab5f897c8046509d7ce778bd810426b@treenet.co.nz","name":"Amos Jeffries"},"message":"Cleanup: Simplify HTTP 1xx control message writing\n\nThe ::Server class heirarchy has the responsibility of writing to\nclient connection sockets. The logic that was in ClientSocketContext\ncan be moved (unchanged) to HttpControlMsgSink and ConnStateData.\nThere was actually never any need to have it spread outside the\nConnStateData class hierarchy in the first place.\n\nNo logic is changed in this patch, just symbol shuffling and one\nmethod inlined into its caller.","distinct":false,"url":"https://api.github.com/repos/Distrotech/squid/commits/c8adbedb85c3de9c427b40c4b533014f310d7ac6"},{"sha":"7a0cf7b5dd9f46db3e02d49d04a3e6511ec307a9","author":{"email":"16c5e7dad2d753ec6d0699bbd6a5329bdc576f2a@squid-cache.org","name":"Source Maintenance"},"message":"SourceFormat Enforcement","distinct":false,"url":"https://api.github.com/repos/Distrotech/squid/commits/7a0cf7b5dd9f46db3e02d49d04a3e6511ec307a9"},{"sha":"439673c50af485d45459250646363bfa3b450a3a","author":{"email":"9eb0a552acce8f0c5161155fabcef38f3dcb9fe7@users.sourceforge.net","name":"Christos Tsantilas"},"message":"Complete certificate chains using external intermediate certificates\nstored in sslproxy_foreign_intermediate_certs file.\n\nMany origin servers do not send complete certificate chains. Many\nbrowsers use certificate extensions in the server certificate to\ndownload the missing intermediate certificates automatically from\nthe Internet. Squid does not do that (yet?).\n\nThis patch adds the sslproxy_foreign_intermediate_certs configuration directive\nto allow an admin to supply a file with intermediate certificates that\nSquid may use to complete certificate chains. These intermediate\ncertificates are _not_ treated as trusted root certificates.\n\nThis is a Measurement Factory project.","distinct":false,"url":"https://api.github.com/repos/Distrotech/squid/commits/439673c50af485d45459250646363bfa3b450a3a"},{"sha":"1f3081b06126603e64dfaa5422931a71efce4009","author":{"email":"16c5e7dad2d753ec6d0699bbd6a5329bdc576f2a@squid-cache.org","name":"Source Maintenance"},"message":"SourceFormat Enforcement","distinct":false,"url":"https://api.github.com/repos/Distrotech/squid/commits/1f3081b06126603e64dfaa5422931a71efce4009"},{"sha":"598d6bf22c9a15876e4c7377145b97fb14a848dd","author":{"email":"bed9ff5a6ab5f897c8046509d7ce778bd810426b@treenet.co.nz","name":"Amos Jeffries"},"message":"Cleanup: add Security::ContextPointer as smart pointer to SSL_CTX*\n\nDue to circular dependency issues between ssl/libsquidssl.la and\nsecurity/libsecurity.la the code within src/ssl/ is restricted to\nonly using Security::ContextPtr, it MUST NOT use ContextPointer\n\nCode outside of src/ssl/ should always use Security::ContextPointer\nwhen storing a reference to a context.\n\nUnfortunately some uses of SSL_CTX_Pointer and AnyP::PortCfg remain\nin src/ssl/support.cc for now.","distinct":false,"url":"https://api.github.com/repos/Distrotech/squid/commits/598d6bf22c9a15876e4c7377145b97fb14a848dd"},{"sha":"aa01b6a1ed1c54ab17d0fd42cc9414f17f96b82e","author":{"email":"bed9ff5a6ab5f897c8046509d7ce778bd810426b@treenet.co.nz","name":"Amos Jeffries"},"message":"Cleanup TLS: shuffle AnyP::PortCfg::staticSslContext into libsecurity\n\nThere are no logic changes in this patch. Only symbol moves and debugs\ndocumentation polish.","distinct":false,"url":"https://api.github.com/repos/Distrotech/squid/commits/aa01b6a1ed1c54ab17d0fd42cc9414f17f96b82e"},{"sha":"aed161eed947f821ae7e17a57abc000706bdd7b7","author":{"email":"bed9ff5a6ab5f897c8046509d7ce778bd810426b@treenet.co.nz","name":"Amos Jeffries"},"message":"Bug 4392: assertion CbcPointer.h:159: 'c' via tunnelServerClosed or tunnelClientClosed","distinct":false,"url":"https://api.github.com/repos/Distrotech/squid/commits/aed161eed947f821ae7e17a57abc000706bdd7b7"},{"sha":"d58d227f230affd9c41055470ceff52f74808b27","author":{"email":"bed9ff5a6ab5f897c8046509d7ce778bd810426b@treenet.co.nz","name":"Amos Jeffries"},"message":"Cleanup TLS: shuffle context creation to libsecurity","distinct":false,"url":"https://api.github.com/repos/Distrotech/squid/commits/d58d227f230affd9c41055470ceff52f74808b27"},{"sha":"4bb7c885a4fb9f650927c6b27f91592f1ac6ce27","author":{"email":"bed9ff5a6ab5f897c8046509d7ce778bd810426b@treenet.co.nz","name":"Amos Jeffries"},"message":"Add missing stub defines for rev.14433","distinct":false,"url":"https://api.github.com/repos/Distrotech/squid/commits/4bb7c885a4fb9f650927c6b27f91592f1ac6ce27"},{"sha":"cc9e1bff757a65cd0e77ae5c484a810ac048a17d","author":{"email":"bed9ff5a6ab5f897c8046509d7ce778bd810426b@treenet.co.nz","name":"Amos Jeffries"},"message":"Cleanup: Expose SSL initialization function to libsecurity\n\nSSL initialize needs to be performed before any security context\nobjects are generated. Expose the function so that the new blank\ncontext methods can use it.","distinct":false,"url":"https://api.github.com/repos/Distrotech/squid/commits/cc9e1bff757a65cd0e77ae5c484a810ac048a17d"},{"sha":"dfe4c0b2b2edec5b30652a782a3a41206762b7e0","author":{"email":"bed9ff5a6ab5f897c8046509d7ce778bd810426b@treenet.co.nz","name":"Amos Jeffries"},"message":"Make TidyPointer act like other pointers in bool comparison","distinct":false,"url":"https://api.github.com/repos/Distrotech/squid/commits/dfe4c0b2b2edec5b30652a782a3a41206762b7e0"},{"sha":"55c36aa6c3e2e697e8f30d7c94a6452af7eab902","author":{"email":"bed9ff5a6ab5f897c8046509d7ce778bd810426b@treenet.co.nz","name":"Amos Jeffries"},"message":"Cleanup: pass PeerOptions to sslCreateClientContext()\n\n... to reduce context creation code and simplify upcoming libsecurity\nmigration steps.","distinct":false,"url":"https://api.github.com/repos/Distrotech/squid/commits/55c36aa6c3e2e697e8f30d7c94a6452af7eab902"},{"sha":"51f906dfa9863e2ad076bddc4e2b872e6f328119","author":{"email":"9eb0a552acce8f0c5161155fabcef38f3dcb9fe7@users.sourceforge.net","name":"Christos Tsantilas"},"message":"Fix connections over plain squid port to SSL origins\n\nAfter the \"Restrict SslBump inspections of cache_peer connections\"/r14425 patch\nhttps requests over plain proxy port (eg. \"GET https://www.example.com/\" on\nhttp_port) does not work any more.\nThis is because the BlindPeerConnector class, which used now for any connection\nto the https peers or servers designed initialy to work with cache_peer\nconnections.\n\nThis small patch fix Ssl::BlindPeerConnector to initiate SSL connections\ndestined to origin SSL servers.\n\nThis is a Measurement Factory project.","distinct":false,"url":"https://api.github.com/repos/Distrotech/squid/commits/51f906dfa9863e2ad076bddc4e2b872e6f328119"},{"sha":"f4ee8f7141d3a3888d8ab5be8f03f11469f8cfae","author":{"email":"bed9ff5a6ab5f897c8046509d7ce778bd810426b@treenet.co.nz","name":"Amos Jeffries"},"message":"TLS: refactor cert=/key= storage in libsecurity\n\nThis updates the cert=/key= filename storage from single entries\nin PeerOptions to a list of key pairs in preparation for supporting\nmultiple certificates on client or server TLS contexts.\n\nkey= following a cert= parameter is now enforced, rather than just\nwarned about.\n\nsquid.conf can now be configured with multiple [cert= [key=...]]\npairs of filenames, however only the first is used. This differs\nfrom older behaviour where the last value(s) were used. But since\nconfigurations with multiple values was not supported previously\nthis seems acceptible breakage.\n\nSince the multi-cert support is not fully existing yet this config\nability is left undocumented for now.","distinct":false,"url":"https://api.github.com/repos/Distrotech/squid/commits/f4ee8f7141d3a3888d8ab5be8f03f11469f8cfae"},{"sha":"13772adbea7c106839bb6412e4c2d1d7e4dd4d9c","author":{"email":"bed9ff5a6ab5f897c8046509d7ce778bd810426b@treenet.co.nz","name":"Amos Jeffries"},"message":"Refactor ClientSocketContext write(2) using Server:: write methods\n\nWriting to the client connection is scoped as an action for class Server\nand its child classes. There is no need for ClientSocketContext to be\nproviding the callback handlers and performing I/O error handling.\n\nWith Server providing the current write handler we can move from\nCBDATA callbacks to AsyncCall. Initial testing indicates this has some\nminor performance benefit.","distinct":false,"url":"https://api.github.com/repos/Distrotech/squid/commits/13772adbea7c106839bb6412e4c2d1d7e4dd4d9c"},{"sha":"084c6f16bc747e569392be2d237fbddc27c478d1","author":{"email":"9eb0a552acce8f0c5161155fabcef38f3dcb9fe7@users.sourceforge.net","name":"Christos Tsantilas"},"message":"The user baseDN is ignored for ext_ldap_group_acl helper\n\nThe user baseDN provided with -B argument is always ignored, which leads to\nproblems if user baseDN and group baseDN are not the same.\n\nThe bug introduced with the r14382 patch.","distinct":false,"url":"https://api.github.com/repos/Distrotech/squid/commits/084c6f16bc747e569392be2d237fbddc27c478d1"},{"sha":"30c062cd6c9df0a0e7e2cdc73f674f2964f0355f","author":{"email":"9eb0a552acce8f0c5161155fabcef38f3dcb9fe7@users.sourceforge.net","name":"Christos Tsantilas"},"message":"Avoid memory leaks when a certificate validator is used with SslBump\n\nWhen a certificate validator was used, sslCrtvdHandleReplyWrapper delivered\nvalidator response directly to the Ssl::PeerConnector job using job's\nSsl::CertValidationHelper::CVHCB callback. If that synchronous call happened\nto be the last job call, then Ssl::PeerConnector::done() would become true\nfor the job, as it should, but nobody would notice that the PeerConnector\njob object should be deleted, and the object would leak.\n\nThis fix converts CVHCB into an async job call to avoid direct, unprotected\njob calls in this context.\n\nThis is a Measurement Factory project.","distinct":false,"url":"https://api.github.com/repos/Distrotech/squid/commits/30c062cd6c9df0a0e7e2cdc73f674f2964f0355f"},{"sha":"d82383fcabec7238f60c5a43fedc32ad278e1554","author":{"email":"9eb0a552acce8f0c5161155fabcef38f3dcb9fe7@users.sourceforge.net","name":"Christos Tsantilas"},"message":"%ssl::<cert_errors logformat code part2: provide depth information\n\nThe first implementation of %ssl::<cert_errors formating code does not provide\ninformation about the certificate the errors belongs.\nThis patch prints the chain depth information for error, if exist, using the\nfollowing format for the printed certificate error:\n   ERROR@depth=X\n\nThe patch also adds the \"error_depth_\" parameter to cert validator, used to\npass depth information from cert validator to squid.\n\nThis is a Measurement Factory project","distinct":false,"url":"https://api.github.com/repos/Distrotech/squid/commits/d82383fcabec7238f60c5a43fedc32ad278e1554"}]}