Date: Mon, 23 Apr 2007 22:50:12 +0200 (CEST) From: Thomas-Martin Seck <tmseck@netcologne.de> To: FreeBSD-gnats-submit@FreeBSD.org Subject: ports/112054: [Maintainer] www/squid: add vendor patch for Squid bug #1814 Message-ID: <200704232050.l3NKoChP028885@hardy.tmseck.homedns.org> Resent-Message-ID: <200704232100.l3NL0BDv037869@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 112054 >Category: ports >Synopsis: [Maintainer] www/squid: add vendor patch for Squid bug #1814 >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: maintainer-update >Submitter-Id: current-users >Arrival-Date: Mon Apr 23 21:00:11 GMT 2007 >Closed-Date: >Last-Modified: >Originator: Thomas-Martin Seck >Release: FreeBSD 6.2-STABLE i386 >Organization: a private site in Germany >Environment: FreeBSD ports collection as of April 23, 2007. >Description: Add a patch for Squid bug #1814, see <http://www.squid-cache.org/bugs/show_bug.cgi?id=1814>. The patchset is a slightly modified version of the Squid patchset 11375. Since this patch conflicts with the ICAP patchset and only affects non-default configurations that have been compiled using the WITH_SQUID_SSL configuration option, apply the patch only when this option is enabled. Set IGNORE when both WITH_SQUID_SSL and WITH_SQUID_ICAP are defined. Bump PORTREVISION (not strictly necessary because the default installation and package remain unchanged but maybe helpful to identify the fixed version). I leave this to the committer's discretion. Added file: files/extra-patch-changeset_11375 >How-To-Repeat: >Fix: Apply this patch: Index: Makefile =================================================================== --- Makefile (.../www/squid) (revision 1152) +++ Makefile (.../local/squid) (revision 1152) @@ -76,6 +76,7 @@ PORTNAME= squid PORTVERSION= 2.6.12 +PORTREVISION= 1 CATEGORIES= www MASTER_SITES= ftp://ftp.squid-cache.org/pub/%SUBDIR%/ \ ftp://ftp.vistech.net/pub/squid/%SUBDIR%/ \ @@ -279,7 +280,11 @@ --with-openssl="${OPENSSLBASE}" CFLAGS+= -I${OPENSSLINC} LDFLAGS+= -L${OPENSSLLIB} +.if defined(WITH_SQUID_ICAP) +IGNORE= is currently broken with both ICAP and SSL support enabled because of conflicting patches. This will be resolved for Squid 2.6.13 .endif +EXTRA_PATCHES+= ${PATCHDIR}/extra-patch-changeset_11375 +.endif .if defined(WITH_SQUID_PINGER) CONFIGURE_ARGS+= --enable-icmp libexec+= pinger Index: files/extra-patch-changeset_11375 =================================================================== --- files/extra-patch-changeset_11375 (.../www/squid) (revision 0) +++ files/extra-patch-changeset_11375 (.../local/squid) (revision 1152) @@ -0,0 +1,77 @@ +--------------------- +PatchSet 11375 +Date: 2007/04/17 09:35:17 +Author: hno +Branch: SQUID_2_6 +Tag: (none) +Log: +MFC: Bug #1814: SSL memory leak on persistent SSL connections + +Memory leak when attemting to reuse SSL-negotiated outgoing connections. + +Mainly affects reverse proxy setups using SSL-enabled peers. + +Merged changes: +2007/04/16 23:05:50 hno +8 -6 Bug #1814: SSL memory leak on persistent SSL connections + +Members: + src/forward.c:1.120.2.2->1.120.2.3 + +Note: this patchset was slightly modified for the FreeBSD port + to make it apply cleanly (one hunk removed, path information stripped) + +Index: squid/src/forward.c +=================================================================== +RCS file: /cvsroot/squid/squid/src/forward.c,v +retrieving revision 1.120.2.2 +retrieving revision 1.120.2.3 +diff -u -r1.120.2.2 -r1.120.2.3 +--- src/forward.c 26 Mar 2007 23:14:09 -0000 1.120.2.2 ++++ src/forward.c 17 Apr 2007 09:35:17 -0000 1.120.2.3 +@@ -319,6 +319,7 @@ + fd_table[fd].ssl = ssl; + fd_table[fd].read_method = &ssl_read_method; + fd_table[fd].write_method = &ssl_write_method; ++ fd_note(fd, "Negotiating SSL"); + fwdNegotiateSSL(fd, fwdState); + } + #endif +@@ -357,10 +358,6 @@ + comm_close(server_fd); + } else { + debug(17, 3) ("fwdConnectDone: FD %d: '%s'\n", server_fd, storeUrl(fwdState->entry)); +- fd_note(server_fd, storeUrl(fwdState->entry)); +- fd_table[server_fd].uses++; +- if (fd_table[server_fd].uses == 1 && fs->peer) +- peerConnectSucceded(fs->peer); + #if USE_SSL + if ((fs->peer && fs->peer->use_ssl) || + (!fs->peer && request->protocol == PROTO_HTTPS)) { +@@ -535,7 +532,7 @@ + hierarchyNote(&fwdState->request->hier, fs->code, fd_table[fd].ipaddr); + else + hierarchyNote(&fwdState->request->hier, fs->code, name); +- fwdConnectDone(fd, COMM_OK, fwdState); ++ fwdDispatch(fwdState); + return; + } else { + /* Discard the persistent connection to not cause +@@ -653,6 +650,7 @@ + StoreEntry *entry = fwdState->entry; + ErrorState *err; + int server_fd = fwdState->server_fd; ++ FwdServer *fs = fwdState->servers; + debug(17, 3) ("fwdDispatch: FD %d: Fetching '%s %s'\n", + fwdState->client_fd, + RequestMethodStr[request->method], +@@ -667,6 +665,10 @@ + assert(entry->ping_status != PING_WAITING); + assert(entry->lock_count); + EBIT_SET(entry->flags, ENTRY_DISPATCHED); ++ fd_note(server_fd, storeUrl(fwdState->entry)); ++ fd_table[server_fd].uses++; ++ if (fd_table[server_fd].uses == 1 && fs->peer) ++ peerConnectSucceded(fs->peer); + netdbPingSite(request->host); + entry->mem_obj->refresh_timestamp = squid_curtime; + if (fwdState->servers && (p = fwdState->servers->peer)) { >Release-Note: >Audit-Trail: >Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200704232050.l3NKoChP028885>