- more perl paths fixes

[packages/squid.git] / squid-2.5.STABLE1-max_user_ip.patch

Index: squid/src/cf.data.pre
diff -c squid/src/cf.data.pre:1.245.2.27 squid/src/cf.data.pre:1.245.2.30
*** squid/src/cf.data.pre:1.245.2.27	Sun Sep 29 13:05:02 2002
--- squid/src/cf.data.pre	Mon Oct  7 22:29:40 2002
***************
*** 1288,1294 ****
  	to replay attacks unless you are using an one-time password
  	system (such as SecureID).  If you are using such a system,
  	you will be vulnerable to replay attacks unless you also
! 	enable the IP ttl is strict option.
  
  	=== Parameters for the digest scheme follow ===
  
--- 1288,1294 ----
  	to replay attacks unless you are using an one-time password
  	system (such as SecureID).  If you are using such a system,
  	you will be vulnerable to replay attacks unless you also
! 	use the max_user_ip ACL in an http_access rule.
  
  	=== Parameters for the digest scheme follow ===
  
***************
*** 1426,1448 ****
  LOC: Config.authenticateIpTTL
  DEFAULT: 0 seconds
  DOC_START
! 	With this option you control how long a proxy authentication
! 	will be bound to a specific IP address. If a request using
! 	the same user name is received during this time then access
! 	will be denied and both users are required to reauthenticate
! 	them selves.  The idea behind this is to make it annoying
! 	for people to share their password to their friends, but
! 	yet allow a dialup user to reconnect on a different dialup
! 	port.
! 
! 	The default is 0 to disable the check. Recommended value
! 	if you have dialup users are no more than 60 seconds to allow
! 	the user to redial without hassle. If all your users are
! 	stationary then higher values may be used.
! 
! 	See also the acl max_user_ip. The max_user_ip acl replaces
! 	the authenticate_ip_ttl_is_strict option found in earlier
! 	Squid versions.
  DOC_END
  
  NAME: external_acl_type
--- 1426,1438 ----
  LOC: Config.authenticateIpTTL
  DEFAULT: 0 seconds
  DOC_START
! 	If you use proxy authentication and the 'max_user_ip' ACL,
! 	this directive controls how long Squid remembers the IP
! 	addresses associated with each user.  Use a small value
! 	(e.g., 60 seconds) if your users might change addresses
! 	quickly, as is the case with dialups.   You might be safe
! 	using a larger value (e.g., 2 hours) in a corporate LAN
! 	environment with relatively static address assignments.
  DOC_END
  
  NAME: external_acl_type
***************
*** 1968,1982 ****
  
  	acl aclname max_user_ip [-s] number
  	  # This will be matched when the user attempts to log in from more
! 	  # than <number> different ip address's. The authenticate_ip_ttl
  	  # parameter controls the timeout on the ip entries.
  	  # If -s is specified then the limit is strict, denying browsing
  	  # from any further IP addresses until the ttl has expired. Without
! 	  # -s Squid will just annoy the user by "randomly" deny requests.
  	  # (the counter is then reset each time the limit is reached and a
  	  # request is denied)
  	  # NOTE: in acceleration mode or where there is mesh of child proxies,
! 	  # clients may appear to come from multiple address's if they are
  	  # going through proxy farms, so a limit of 1 may cause user problems.
  
  	acl aclname req_mime_type mime-type1 ...
--- 1958,1972 ----
  
  	acl aclname max_user_ip [-s] number
  	  # This will be matched when the user attempts to log in from more
! 	  # than <number> different ip addresses. The authenticate_ip_ttl
  	  # parameter controls the timeout on the ip entries.
  	  # If -s is specified then the limit is strict, denying browsing
  	  # from any further IP addresses until the ttl has expired. Without
! 	  # -s Squid will just annoy the user by "randomly" denying requests.
  	  # (the counter is then reset each time the limit is reached and a
  	  # request is denied)
  	  # NOTE: in acceleration mode or where there is mesh of child proxies,
! 	  # clients may appear to come from multiple addresses if they are
  	  # going through proxy farms, so a limit of 1 may cause user problems.
  
  	acl aclname req_mime_type mime-type1 ...
Index: squid/src/authenticate.c
diff -c squid/src/authenticate.c:1.36.2.3 squid/src/authenticate.c:1.36.2.6
*** squid/src/authenticate.c:1.36.2.3	Wed Oct  2 03:02:29 2002
--- squid/src/authenticate.c	Mon Oct  7 21:31:06 2002
***************
*** 244,250 ****
      return NULL;
  }
  
! void
  authenticateAuthUserRequestSetIp(auth_user_request_t * auth_user_request, struct in_addr ipaddr)
  {
      auth_user_ip_t *ipdata, *tempnode;
--- 244,250 ----
      return NULL;
  }
  
! static void
  authenticateAuthUserRequestSetIp(auth_user_request_t * auth_user_request, struct in_addr ipaddr)
  {
      auth_user_ip_t *ipdata, *tempnode;
***************
*** 265,271 ****
  	tempnode = (auth_user_ip_t *) ipdata->node.next;
  	/* walk the ip list */
  	if (ipdata->ipaddr.s_addr == ipaddr.s_addr) {
! 	    /* This ip has alreadu been seen. */
  	    found = 1;
  	    /* update IP ttl */
  	    ipdata->ip_expiretime = squid_curtime;
--- 265,271 ----
  	tempnode = (auth_user_ip_t *) ipdata->node.next;
  	/* walk the ip list */
  	if (ipdata->ipaddr.s_addr == ipaddr.s_addr) {
! 	    /* This ip has already been seen. */
  	    found = 1;
  	    /* update IP ttl */
  	    ipdata->ip_expiretime = squid_curtime;
***************
*** 438,446 ****
      }
      /*
       * a note on proxy_auth logix here:
!      * proxy_auth==NULL -> unauthenticated request || already authenticated connection
!      * so we test for an authenticated connection when we recieve no authentication
!      * header.
       */
      if (((proxy_auth == NULL) && (!authenticateUserAuthenticated(*auth_user_request ? *auth_user_request : conn->auth_user_request)))
  	|| (conn->auth_type == AUTH_BROKEN)) {
--- 438,446 ----
      }
      /*
       * a note on proxy_auth logix here:
!      * proxy_auth==NULL -> unauthenticated request || already
!      * authenticated connection so we test for an authenticated
!      * connection when we recieve no authentication header.
       */
      if (((proxy_auth == NULL) && (!authenticateUserAuthenticated(*auth_user_request ? *auth_user_request : conn->auth_user_request)))
  	|| (conn->auth_type == AUTH_BROKEN)) {
***************
*** 585,591 ****
  	    *auth_user_request = t;
  	return t->lastReply;
      }
- 
      /* ok, call the actual authenticator routine. */
      result = authenticateAuthenticate(auth_user_request, headertype, request, conn, src_addr);
      t = *auth_user_request ? *auth_user_request : conn->auth_user_request;
--- 585,590 ----
***************
*** 734,741 ****
  	    }
  	}
      }
!     /* allow protocol specific headers to be _added_ to the existing response - ie
!      * digest auth
       */
      if ((auth_user_request != NULL) && (auth_user_request->auth_user->auth_module > 0)
  	&& (authscheme_list[auth_user_request->auth_user->auth_module - 1].AddHeader))
--- 733,741 ----
  	    }
  	}
      }
!     /*
!      * allow protocol specific headers to be _added_ to the existing
!      * response - ie digest auth
       */
      if ((auth_user_request != NULL) && (auth_user_request->auth_user->auth_module > 0)
  	&& (authscheme_list[auth_user_request->auth_user->auth_module - 1].AddHeader))
***************
*** 811,827 ****
      return auth_user->references;
  }
  
! /* Combine two user structs. ONLY to be called from within a scheme module.
!  * The scheme module is responsible for ensuring that the two users _can_ be merged 
!  * without invalidating all the request scheme data. 
!  * the scheme is also responsible for merging any user related scheme data itself. */
  void
  authenticateAuthUserMerge(auth_user_t * from, auth_user_t * to)
  {
      dlink_node *link, *tmplink;
      auth_user_request_t *auth_user_request;
! /* XXX combine two authuser structs. Incomplete: it should merge in hash references 
!  * too and ask the module to merge in scheme data */
      debug(29, 5) ("authenticateAuthUserMerge auth_user '%p' into auth_user '%p'.\n", from, to);
      link = from->requests.head;
      while (link) {
--- 811,833 ----
      return auth_user->references;
  }
  
! /*
!  * Combine two user structs. ONLY to be called from within a scheme
!  * module.  The scheme module is responsible for ensuring that the
!  * two users _can_ be merged without invalidating all the request
!  * scheme data. the scheme is also responsible for merging any user
!  * related scheme data itself.
!  */
  void
  authenticateAuthUserMerge(auth_user_t * from, auth_user_t * to)
  {
      dlink_node *link, *tmplink;
      auth_user_request_t *auth_user_request;
!     /*
!      * XXX combine two authuser structs. Incomplete: it should merge
!      * in hash references too and ask the module to merge in scheme
!      * data
!      */
      debug(29, 5) ("authenticateAuthUserMerge auth_user '%p' into auth_user '%p'.\n", from, to);
      link = from->requests.head;
      while (link) {
Index: squid/src/acl.c
diff -c squid/src/acl.c:1.270.2.9 squid/src/acl.c:1.270.2.10
*** squid/src/acl.c:1.270.2.9	Wed Oct  2 03:02:29 2002
--- squid/src/acl.c	Mon Oct  7 21:33:52 2002
***************
*** 1249,1255 ****
      return W;
  }
  
! /* aclMatchUserMaxIP - check for users logging in from multiple IP's 
   * 0 : No match
   * 1 : Match 
   */
--- 1249,1256 ----
      return W;
  }
  
! /*
!  * aclMatchUserMaxIP - check for users logging in from multiple IP's 
   * 0 : No match
   * 1 : Match 
   */
***************
*** 1258,1264 ****
      struct in_addr src_addr)
  {
  /*
!  * > the logic for flush the ip list when the limit is hit vs keep it sorted in most recent access order and just drop the oldest one off is currently undecided
   */
      acl_user_ip_data *acldata = data;
  
--- 1259,1267 ----
      struct in_addr src_addr)
  {
  /*
!  * the logic for flush the ip list when the limit is hit vs keep
!  * it sorted in most recent access order and just drop the oldest
!  * one off is currently undecided
   */
      acl_user_ip_data *acldata = data;
  
***************
*** 1267,1280 ****
  
      /* this is a match */
      if (acldata->flags.strict) {
! 	/* simply deny access - the user name is already associated with
  	 * the request 
  	 */
  	/* remove _this_ ip, as it is the culprit for going over the limit */
  	authenticateAuthUserRequestRemoveIp(auth_user_request, src_addr);
  	debug(28, 4) ("aclMatchUserMaxIP: Denying access in strict mode\n");
      } else {
! 	/* non-strict - remove some/all of the cached entries 
  	 * ie to allow the user to move machines easily
  	 */
  	authenticateAuthUserRequestClearIp(auth_user_request);
--- 1270,1285 ----
  
      /* this is a match */
      if (acldata->flags.strict) {
! 	/*
! 	 * simply deny access - the user name is already associated with
  	 * the request 
  	 */
  	/* remove _this_ ip, as it is the culprit for going over the limit */
  	authenticateAuthUserRequestRemoveIp(auth_user_request, src_addr);
  	debug(28, 4) ("aclMatchUserMaxIP: Denying access in strict mode\n");
      } else {
! 	/*
! 	 * non-strict - remove some/all of the cached entries 
  	 * ie to allow the user to move machines easily
  	 */
  	authenticateAuthUserRequestClearIp(auth_user_request);
***************
*** 1288,1294 ****
  aclLookupProxyAuthStart(aclCheck_t * checklist)
  {
      auth_user_request_t *auth_user_request;
!     assert(checklist->auth_user_request != NULL);	/* this is created for us */
      auth_user_request = checklist->auth_user_request;
  
      assert(authenticateValidateUser(auth_user_request));
--- 1293,1300 ----
  aclLookupProxyAuthStart(aclCheck_t * checklist)
  {
      auth_user_request_t *auth_user_request;
!     /* make sure someone created auth_user_request for us */
!     assert(checklist->auth_user_request != NULL);
      auth_user_request = checklist->auth_user_request;
  
      assert(authenticateValidateUser(auth_user_request));
Index: squid/src/protos.h
diff -c squid/src/protos.h:1.420.2.13 squid/src/protos.h:1.420.2.14
*** squid/src/protos.h:1.420.2.13	Wed Oct  2 03:02:30 2002
--- squid/src/protos.h	Tue Oct  8 10:08:30 2002
***************
*** 759,765 ****
  extern void authenticateAuthUserRequestLock(auth_user_request_t *);
  extern char *authenticateAuthUserRequestMessage(auth_user_request_t *);
  extern int authenticateAuthUserInuse(auth_user_t * auth_user);
- extern void authenticateAuthUserRequestSetIp(auth_user_request_t *, struct in_addr);
  extern void authenticateAuthUserRequestRemoveIp(auth_user_request_t *, struct in_addr);
  extern void authenticateAuthUserRequestClearIp(auth_user_request_t *);
  extern size_t authenticateAuthUserRequestIPCount(auth_user_request_t *);
--- 759,764 ----