bughz/tinyproxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
rofl0r-patch-1
tinyproxy/src/acl.h

37 lines
1.3 KiB
C
Raw Permalink Normal View History

Updated copyright, license notices in source code The notices have been changed to a more GNU look. Documentation comments have been separated from the copyright header. I've tried to keep all copyright notices intact. Some author contact details have been updated.
2008-05-24 16:05:49 +08:00
/* tinyproxy - A fast light-weight HTTP proxy
* Copyright (C) 2000 Robert James Kaes <rjkaes@users.sourceforge.net>
Improvied access control semantics. Allows for a finger control for allowing and denying hosts.
2000-09-12 08:08:48 +08:00
*
Updated copyright, license notices in source code The notices have been changed to a more GNU look. Documentation comments have been separated from the copyright header. I've tried to keep all copyright notices intact. Some author contact details have been updated.
2008-05-24 16:05:49 +08:00
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
Improvied access control semantics. Allows for a finger control for allowing and denying hosts.
2000-09-12 08:08:48 +08:00
*
Updated copyright, license notices in source code The notices have been changed to a more GNU look. Documentation comments have been separated from the copyright header. I've tried to keep all copyright notices intact. Some author contact details have been updated.
2008-05-24 16:05:49 +08:00
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
Improvied access control semantics. Allows for a finger control for allowing and denying hosts.
2000-09-12 08:08:48 +08:00
*
Updated copyright, license notices in source code The notices have been changed to a more GNU look. Documentation comments have been separated from the copyright header. I've tried to keep all copyright notices intact. Some author contact details have been updated.
2008-05-24 16:05:49 +08:00
* You should have received a copy of the GNU General Public License along
* with this program; if not, write to the Free Software Foundation, Inc.,
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
Improvied access control semantics. Allows for a finger control for allowing and denying hosts.
2000-09-12 08:08:48 +08:00
*/
Updated copyright, license notices in source code The notices have been changed to a more GNU look. Documentation comments have been separated from the copyright header. I've tried to keep all copyright notices intact. Some author contact details have been updated.
2008-05-24 16:05:49 +08:00
/* See 'acl.c' for detailed information. */
Fixed up the names of the DEFINES.
2001-06-02 10:07:34 +08:00
#ifndef TINYPROXY_ACL_H
#define TINYPROXY_ACL_H
Improvied access control semantics. Allows for a finger control for allowing and denying hosts.
2000-09-12 08:08:48 +08:00
make acl lookup 450x faster by using sblist tested with 32K acl rules, generated by for x in `seq 128` ; do for y in `seq 255` ; do \ echo "Deny 10.$x.$y.0/24" ; done ; done after loading the config (which is dogslow too), tinyproxy required 9.5 seconds for the acl check on every request. after switching the list implementation to sblist, a request with the full acl check now takes only 0.025 seconds. the time spent for loading the config file is identical for both list implementations, roughly 30 seconds. (in a previous test, 65K acl rules were generated, but every connection required almost 2 minutes to crunch through the list...)
2020-09-08 05:09:35 +08:00
#include "sblist.h"
do hostname resolution only when it is absolutely necessary for ACL check tinyproxy used to do a full hostname resolution whenever a new client connection happened, which could cause very long delays (as reported in #198). there's only a single place/scenario that actually requires a hostname, and that is when an Allow/Deny rule exists for a hostname or domain, rather than a raw IP address. since it is very likely this feature is not very widely used, it makes absolute sense to only do the costly resolution when it is unavoidable.
2018-12-31 23:47:40 +08:00
#include "sock.h"
Move definition of "struct config_s" from main.h to conf.h Michael
2009-12-08 05:23:31 +08:00
Indent code to Tinyproxy coding style The modified files were indented with GNU indent using the following command: indent -npro -kr -i8 -ts8 -sob -l80 -ss -cs -cp1 -bs -nlps -nprs -pcs \ -saf -sai -saw -sc -cdw -ce -nut -il0 No other changes of any sort were made.
2009-09-15 03:41:25 +08:00
typedef enum { ACL_ALLOW, ACL_DENY } acl_access_t;
make acl lookup 450x faster by using sblist tested with 32K acl rules, generated by for x in `seq 128` ; do for y in `seq 255` ; do \ echo "Deny 10.$x.$y.0/24" ; done ; done after loading the config (which is dogslow too), tinyproxy required 9.5 seconds for the acl check on every request. after switching the list implementation to sblist, a request with the full acl check now takes only 0.025 seconds. the time spent for loading the config file is identical for both list implementations, roughly 30 seconds. (in a previous test, 65K acl rules were generated, but every connection required almost 2 minutes to crunch through the list...)
2020-09-08 05:09:35 +08:00
typedef sblist* acl_list_t;
Improvied access control semantics. Allows for a finger control for allowing and denying hosts.
2000-09-12 08:08:48 +08:00
Add access_list to the config struct instead of a global variable in acl.c. Change insert_acl, check_acl and flush_access_list to take a corresponding argument. Michael
2009-12-07 06:30:23 +08:00
extern int insert_acl (char *location, acl_access_t access_type,
acl: typedef access_list to acl_list_t this allows to switch the underlying implementation easily.
2020-09-08 04:53:14 +08:00
acl_list_t *access_list);
do hostname resolution only when it is absolutely necessary for ACL check tinyproxy used to do a full hostname resolution whenever a new client connection happened, which could cause very long delays (as reported in #198). there's only a single place/scenario that actually requires a hostname, and that is when an Allow/Deny rule exists for a hostname or domain, rather than a raw IP address. since it is very likely this feature is not very widely used, it makes absolute sense to only do the costly resolution when it is unavoidable.
2018-12-31 23:47:40 +08:00
extern int check_acl (const char *ip_address, union sockaddr_union *addr,
acl: typedef access_list to acl_list_t this allows to switch the underlying implementation easily.
2020-09-08 04:53:14 +08:00
acl_list_t access_list);
extern void flush_access_list (acl_list_t access_list);
Improvied access control semantics. Allows for a finger control for allowing and denying hosts.
2000-09-12 08:08:48 +08:00
#endif
Reference in New Issue Copy Permalink