Description: fix cookie data leak via If-Not-Modified HTTP conditional Origin: backport, http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-2016_11.patch Bug: http://bugs.squid-cache.org/show_bug.cgi?id=4169 Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=848493 Index: squid3-3.5.12/src/LogTags.h =================================================================== --- squid3-3.5.12.orig/src/LogTags.h 2015-12-02 13:10:29.000000000 -0500 +++ squid3-3.5.12/src/LogTags.h 2017-02-03 12:54:46.616638717 -0500 @@ -27,6 +27,7 @@ LOG_TCP_REFRESH_MODIFIED, // refresh from origin replaced existing entry LOG_TCP_CLIENT_REFRESH_MISS, LOG_TCP_IMS_HIT, + LOG_TCP_INM_HIT, LOG_TCP_SWAPFAIL_MISS, LOG_TCP_NEGATIVE_HIT, LOG_TCP_MEM_HIT, @@ -53,6 +54,7 @@ return (code == LOG_TCP_HIT) || (code == LOG_TCP_IMS_HIT) || + (code == LOG_TCP_INM_HIT) || (code == LOG_TCP_REFRESH_FAIL_OLD) || (code == LOG_TCP_REFRESH_UNMODIFIED) || (code == LOG_TCP_NEGATIVE_HIT) || Index: squid3-3.5.12/src/client_side.cc =================================================================== --- squid3-3.5.12.orig/src/client_side.cc 2017-02-03 12:54:27.000000000 -0500 +++ squid3-3.5.12/src/client_side.cc 2017-02-03 12:54:46.620638766 -0500 @@ -415,6 +415,7 @@ statCounter.client_http.nearHitSvcTime.count(svc_time); break; + case LOG_TCP_INM_HIT: case LOG_TCP_IMS_HIT: statCounter.client_http.nearMissSvcTime.count(svc_time); break; Index: squid3-3.5.12/src/client_side_reply.cc =================================================================== --- squid3-3.5.12.orig/src/client_side_reply.cc 2015-12-02 13:10:29.000000000 -0500 +++ squid3-3.5.12/src/client_side_reply.cc 2017-02-03 12:56:24.317842799 -0500 @@ -545,6 +545,7 @@ debugs(88, 5, "negative-HIT"); http->logType = LOG_TCP_NEGATIVE_HIT; sendMoreData(result); + return; } else if (blockedHit()) { debugs(88, 5, "send_hit forces a MISS"); http->logType = LOG_TCP_MISS; @@ -596,27 +597,29 @@ http->logType = LOG_TCP_MISS; processMiss(); } + return; } else if (r->conditional()) { debugs(88, 5, "conditional HIT"); - processConditional(result); - } else { - /* - * plain ol' cache hit - */ - debugs(88, 5, "plain old HIT"); + if (processConditional(result)) + return; + } + + /* + * plain ol' cache hit + */ + debugs(88, 5, "plain old HIT"); #if USE_DELAY_POOLS - if (e->store_status != STORE_OK) - http->logType = LOG_TCP_MISS; - else + if (e->store_status != STORE_OK) + http->logType = LOG_TCP_MISS; + else #endif - if (e->mem_status == IN_MEMORY) - http->logType = LOG_TCP_MEM_HIT; - else if (Config.onoff.offline) - http->logType = LOG_TCP_OFFLINE_HIT; + if (e->mem_status == IN_MEMORY) + http->logType = LOG_TCP_MEM_HIT; + else if (Config.onoff.offline) + http->logType = LOG_TCP_OFFLINE_HIT; - sendMoreData(result); - } + sendMoreData(result); } /** @@ -710,17 +713,16 @@ } /// process conditional request from client -void +bool clientReplyContext::processConditional(StoreIOBuffer &result) { StoreEntry *const e = http->storeEntry(); if (e->getReply()->sline.status() != Http::scOkay) { - debugs(88, 4, "clientReplyContext::processConditional: Reply code " << - e->getReply()->sline.status() << " != 200"); + debugs(88, 4, "Reply code " << e->getReply()->sline.status() << " != 200"); http->logType = LOG_TCP_MISS; processMiss(); - return; + return true; } HttpRequest &r = *http->request; @@ -728,51 +730,39 @@ if (r.header.has(HDR_IF_MATCH) && !e->hasIfMatchEtag(r)) { // RFC 2616: reply with 412 Precondition Failed if If-Match did not match sendPreconditionFailedError(); - return; + return true; } - bool matchedIfNoneMatch = false; if (r.header.has(HDR_IF_NONE_MATCH)) { - if (!e->hasIfNoneMatchEtag(r)) { - // RFC 2616: ignore IMS if If-None-Match did not match - r.flags.ims = false; - r.ims = -1; - r.imslen = 0; - r.header.delById(HDR_IF_MODIFIED_SINCE); - http->logType = LOG_TCP_MISS; - sendMoreData(result); - return; - } + // RFC 7232: If-None-Match recipient MUST ignore IMS + r.flags.ims = false; + r.ims = -1; + r.imslen = 0; + r.header.delById(HDR_IF_MODIFIED_SINCE); - if (!r.flags.ims) { - // RFC 2616: if If-None-Match matched and there is no IMS, - // reply with 304 Not Modified or 412 Precondition Failed + if (e->hasIfNoneMatchEtag(r)) { sendNotModifiedOrPreconditionFailedError(); - return; + return true; } - // otherwise check IMS below to decide if we reply with 304 or 412 - matchedIfNoneMatch = true; + // None-Match is true (no ETag matched); treat as an unconditional hit + return false; } if (r.flags.ims) { // handle If-Modified-Since requests from the client if (e->modifiedSince(&r)) { - http->logType = LOG_TCP_IMS_HIT; - sendMoreData(result); - return; - } + // Modified-Since is true; treat as an unconditional hit + return false; - if (matchedIfNoneMatch) { - // If-None-Match matched, reply with 304 Not Modified or - // 412 Precondition Failed - sendNotModifiedOrPreconditionFailedError(); - return; + } else { + // otherwise reply with 304 Not Modified + sendNotModified(); } - - // otherwise reply with 304 Not Modified - sendNotModified(); + return true; } + + return false; } /// whether squid.conf send_hit prevents us from serving this hit @@ -1919,7 +1909,12 @@ StoreEntry *e = http->storeEntry(); const time_t timestamp = e->timestamp; HttpReply *const temprep = e->getReply()->make304(); - http->logType = LOG_TCP_IMS_HIT; + // log as TCP_INM_HIT if code 304 generated for + // If-None-Match request + if (!http->request->flags.ims) + http->logType = LOG_TCP_INM_HIT; + else + http->logType = LOG_TCP_IMS_HIT; removeClientStoreReference(&sc, http); createStoreEntry(http->request->method, RequestFlags()); e = http->storeEntry(); Index: squid3-3.5.12/src/client_side_reply.h =================================================================== --- squid3-3.5.12.orig/src/client_side_reply.h 2015-12-02 13:10:29.000000000 -0500 +++ squid3-3.5.12/src/client_side_reply.h 2017-02-03 12:54:46.616638717 -0500 @@ -114,7 +114,7 @@ bool alwaysAllowResponse(Http::StatusCode sline) const; int checkTransferDone(); void processOnlyIfCachedMiss(); - void processConditional(StoreIOBuffer &result); + bool processConditional(StoreIOBuffer &result); void cacheHit(StoreIOBuffer result); void handleIMSReply(StoreIOBuffer result); void sendMoreData(StoreIOBuffer result);