Skip to content

Commit

Permalink
Nil request dereference in ACLExtUser and SourceDomainCheck ACLs (#1931)
Browse files Browse the repository at this point in the history
ACLExtUser-based ACLs (i.e. ext_user and ext_user_regex) dereferenced a
nil request pointer when they were used in a context without a request
(e.g., when honoring on_unsupported_protocol).

SourceDomainCheck-based ACLs (i.e. srcdomain and srcdom_regex) have a
similar bug, although we do not know whether broken slow ACL code is
reachable without a request (e.g., on_unsupported_protocol tests cannot
reach that code until that directive starts supporting slow ACLs). This
change does not start to require request presence for these two ACLs to
avoid breaking any existing configurations that "work" without one.
  • Loading branch information
eduard-bagdasaryan authored and kinkie committed Jan 20, 2025
1 parent 05139d2 commit a3ff3cc
Show file tree
Hide file tree
Showing 2 changed files with 7 additions and 2 deletions.
1 change: 1 addition & 0 deletions src/acl/ExtUser.h
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@ class ACLExtUser : public ACL
char const *typeString() const override;
void parse() override;
int match(ACLChecklist *checklist) override;
bool requiresRequest() const override { return true; }
SBufList dump() const override;
bool empty () const override;

Expand Down
8 changes: 6 additions & 2 deletions src/acl/SourceDomain.cc
Original file line number Diff line number Diff line change
Expand Up @@ -36,8 +36,12 @@ SourceDomainLookup::LookupDone(const char *, const Dns::LookupDetails &details,
{
ACLFilledChecklist *checklist = Filled((ACLChecklist*)data);
checklist->markSourceDomainChecked();
checklist->request->recordLookup(details);
checklist->resumeNonBlockingCheck(SourceDomainLookup::Instance());
if (checklist->request)
checklist->request->recordLookup(details);
else
debugs(28, 3, "no request to recordLookup()");

checklist->resumeNonBlockingCheck();
}

int
Expand Down

0 comments on commit a3ff3cc

Please sign in to comment.