This patch fixes errors only, so that build succeeds, but deprecation
warnings remain. It seems we need considerable changes to replace those
deprecated functions in the warnings.
Fix a major memset() mistake leaking memory and possibly breaking CA
chains for proxyspecs and struct filtering rules.
Fix wrong memset size.
Fix redundant WUNRES attrib, MALLOC attrib has WUNRES already.
And fix param names.
Now we can specify multiple sites in one struct rule: SNI, CN, Host,
URI, and DstIp destination sites. We create a new rule for each
destination site type specified. Struct rules can be complicated and
long, so this is expected to help with rule reuse.
Error out unit tests if DEBUG_PROXY enabled, because we debug print
line_num if DEBUG_PROXY enabled. We cannot support line_num in expected
debug output, it would make things complicated with very little benefit.
But we don't support $macros within multi valued Log lines, i.e. cannot
mix log actions with $macros, use either log actions concat with spaces
or just a $macro, and no point trying to support it either.
Don't forget tot increment precedence if only Desc is used.
But do not increment precedence twice for both User and Desc.
Note that the ordering of User and Desc in the rule is not known.
The ReconnectSSL option allows rule developers to write struct filtering
rules using SNI and CN SSL specifications to override the SSL
configuration of a connection.
Otherwise, without this new option, filtering rules cannot change SSL
options using SSL filtering fields to match connections (the SSL config
in the rule would not have any effect on the server side of the matching
connection). Without ReconnectSSL, only DstIP and DstPort fields can be
used to override the SSL config of a connection.
If the ReconnectSSL option in a struct filtering rule is set, we
disconnect and free the server side of the matching SSL connection, and
reconnect it with the SSL options in the matching struct filtering rule.
This enforces the SSL config in the rule.
Do not use the ReconnectSSL option if server disconnect is not desirable
or acceptable in your case.
We have to apply the DstHost filter both (1) as early as in
pxy_conn_connect() and also (2) after user owner of the conn is
determined in srvdst connected callback functions for tcp and ssl.
Otherwise, we cannot override SSL options of conns if we don't apply it
before SSL establishment (1), and we cannot apply user auth filtering
rules if we don't apply after determining the user owner of conn (2).
This commit actually adds the same calls in the same places as they were
before the structured filtering rules were introduced.
So for example, now we have to apply filters 4x for an HTTPS conn: 2x
dsthost, 1x ssl, and 1x http.