[squid-dev] [PATCH] adapting 100-Continue / A Bug 4067 fix

[Alex Rousskov]

On 11/09/2014 02:02 PM, Tsantilas Christos wrote:

>  void
>  Http::Server::processParsedRequest(ClientSocketContext *context)
>  {
> +    if (!buildHttpRequest(context))
> +        return;
> +
> +    if (Config.accessList.forceRequestBodyContinuation) {
> +        ClientHttpRequest *http = context->http;
> +        HttpRequest *request = http->request;
> +        ACLFilledChecklist bodyContinuationCheck(Config.accessList.forceRequestBodyContinuation, request, NULL);
> +        if (bodyContinuationCheck.fastCheck() == ACCESS_ALLOWED) {
> +            debugs(33, 5, "Body Continuation forced");
> +            request->forcedBodyContinuation = true;


The HTTP code above sends 100-Continue responses to HTTP GET messages
unless the admin is very careful with the ACLs. This can be reproduced
trivially with

  force_request_body_continuation allow all

We should not evaluate force_request_body_continuation if the request
does not have a body IMO. The force_request_body_continuation
documentation makes that option specific to upload requests. If you
agree, please adjust the committed code accordingly.


The similar FTP check seems to be inside the upload-specific code and,
hence, should not need additional "do we expect a body?" guards.


Thank you,

Alex.