[squid-dev] [PATCH] Reuse reserved Negotiate and NTLM helpers after an idle timeout.

[Christos Tsantilas]

Squid can be killed or maimed by enough clients that start multi-step 
connection authentication but never follow up with the second HTTP 
request while keeping their HTTP connection open. Affected helpers 
remain in the "reserved" state and cannot be reused for other clients. 
Observed helper exhaustion has happened without any malicious intent.

To address the problem, we add a helper reservation timeout. Timed out 
reserved helpers may be reused by new clients/connections. To minimize 
problems with slow-to-resume-authentication clients, timed out reserved 
helpers are not reused until there are no unreserved running helpers 
left. The reservations are tracked using unique integer IDs.

Also fixed Squid crashes caused by unexpected helper termination -- the 
raw UserRequest::authserver pointer could point to a deleted helper.

This is a Measurement Factory project.