]>
Commit | Line | Data |
---|---|---|
d9572179 | 1 | /* |
b8ae064d | 2 | * Copyright (C) 1996-2023 The Squid Software Foundation and contributors |
d9572179 | 3 | * |
bbc27441 AJ |
4 | * Squid software is distributed under GPLv2+ license and includes |
5 | * contributions from numerous individuals and organizations. | |
6 | * Please see the COPYING and CONTRIBUTORS files for details. | |
d9572179 | 7 | */ |
8 | ||
bbc27441 AJ |
9 | /* DEBUG: section 82 External ACL */ |
10 | ||
582c2af2 | 11 | #include "squid.h" |
c0941a6a | 12 | #include "acl/Acl.h" |
582c2af2 | 13 | #include "acl/FilledChecklist.h" |
8a01b99e | 14 | #include "cache_cf.h" |
a46d2c0e | 15 | #include "client_side.h" |
4e56d7f6 | 16 | #include "client_side_request.h" |
5c336a3b | 17 | #include "comm/Connection.h" |
2eceb328 | 18 | #include "ConfigParser.h" |
582c2af2 | 19 | #include "ExternalACL.h" |
f9b6ff6e | 20 | #include "ExternalACLEntry.h" |
582c2af2 | 21 | #include "fde.h" |
4e56d7f6 | 22 | #include "format/Token.h" |
aa839030 | 23 | #include "helper.h" |
24438ec5 | 24 | #include "helper/Reply.h" |
d3dddfb5 | 25 | #include "http/Stream.h" |
a5bac1d2 | 26 | #include "HttpHeaderTools.h" |
582c2af2 FC |
27 | #include "HttpReply.h" |
28 | #include "HttpRequest.h" | |
29 | #include "ip/tools.h" | |
0eb49b6d | 30 | #include "MemBuf.h" |
582c2af2 | 31 | #include "mgr/Registration.h" |
1fa9b1a7 | 32 | #include "rfc1738.h" |
4d5904f7 | 33 | #include "SquidConfig.h" |
f9b6ff6e | 34 | #include "SquidString.h" |
582c2af2 | 35 | #include "Store.h" |
4e540555 | 36 | #include "tools.h" |
d295d770 | 37 | #include "wordlist.h" |
cb4f4424 | 38 | #if USE_OPENSSL |
cedca6e7 | 39 | #include "ssl/ServerBump.h" |
4db984be CT |
40 | #include "ssl/support.h" |
41 | #endif | |
582c2af2 FC |
42 | #if USE_AUTH |
43 | #include "auth/Acl.h" | |
44 | #include "auth/Gadgets.h" | |
45 | #include "auth/UserRequest.h" | |
46 | #endif | |
d9572179 | 47 | |
48 | #ifndef DEFAULT_EXTERNAL_ACL_TTL | |
49 | #define DEFAULT_EXTERNAL_ACL_TTL 1 * 60 * 60 | |
50 | #endif | |
d4f2f353 | 51 | #ifndef DEFAULT_EXTERNAL_ACL_CHILDREN |
52 | #define DEFAULT_EXTERNAL_ACL_CHILDREN 5 | |
d9572179 | 53 | #endif |
54 | ||
abdd93d0 AJ |
55 | static void external_acl_cache_delete(external_acl * def, const ExternalACLEntryPointer &entry); |
56 | static int external_acl_entry_expired(external_acl * def, const ExternalACLEntryPointer &entry); | |
57 | static int external_acl_grace_expired(external_acl * def, const ExternalACLEntryPointer &entry); | |
58 | static void external_acl_cache_touch(external_acl * def, const ExternalACLEntryPointer &entry); | |
59 | static ExternalACLEntryPointer external_acl_cache_add(external_acl * def, const char *key, ExternalACLEntryData const &data); | |
d9572179 | 60 | |
61 | /****************************************************************** | |
62 | * external_acl directive | |
63 | */ | |
62e76326 | 64 | |
1e5562e3 | 65 | class external_acl |
62e76326 | 66 | { |
9837567d | 67 | /* XXX: These are not really cbdata, but it is an easy way |
f205a92e | 68 | * to get them pooled, refcounted, accounted and freed properly... |
9837567d | 69 | * Use RefCountable MEMPROXY_CLASS instead |
f205a92e | 70 | */ |
f963b531 | 71 | CBDATA_CLASS(external_acl); |
1e5562e3 | 72 | |
73 | public: | |
f963b531 AJ |
74 | external_acl(); |
75 | ~external_acl(); | |
76 | ||
d9572179 | 77 | external_acl *next; |
1e5562e3 | 78 | |
abdd93d0 | 79 | void add(const ExternalACLEntryPointer &); |
1e5562e3 | 80 | |
81 | void trimCache(); | |
82 | ||
329c128c | 83 | bool maybeCacheable(const Acl::Answer &) const; |
194ccc9c | 84 | |
d9572179 | 85 | int ttl; |
1e5562e3 | 86 | |
d9572179 | 87 | int negative_ttl; |
1e5562e3 | 88 | |
47b0c1fa | 89 | int grace; |
90 | ||
d9572179 | 91 | char *name; |
1e5562e3 | 92 | |
4e56d7f6 | 93 | Format::Format format; |
1e5562e3 | 94 | |
d9572179 | 95 | wordlist *cmdline; |
1e5562e3 | 96 | |
76d9b994 | 97 | Helper::ChildConfig children; |
07eca7e0 | 98 | |
e05a9d51 | 99 | Helper::Client::Pointer theHelper; |
1e5562e3 | 100 | |
d9572179 | 101 | hash_table *cache; |
1e5562e3 | 102 | |
d9572179 | 103 | dlink_list lru_list; |
1e5562e3 | 104 | |
d9572179 | 105 | int cache_size; |
1e5562e3 | 106 | |
d9572179 | 107 | int cache_entries; |
1e5562e3 | 108 | |
d9572179 | 109 | dlink_list queue; |
1e5562e3 | 110 | |
2f1431ea | 111 | #if USE_AUTH |
3265364b AJ |
112 | /** |
113 | * Configuration flag. May only be altered by the configuration parser. | |
114 | * | |
115 | * Indicates that all uses of this external_acl_type helper require authentication | |
116 | * details to be processed. If none are available its a fail match. | |
117 | */ | |
e870b1f8 | 118 | bool require_auth; |
2f1431ea | 119 | #endif |
dc1af3cf | 120 | |
95d78f10 | 121 | Format::Quoting quote; // default quoting to use, set by protocol= parameter |
cc192b50 | 122 | |
b7ac5457 | 123 | Ip::Address local_addr; |
d9572179 | 124 | }; |
125 | ||
f963b531 AJ |
126 | CBDATA_CLASS_INIT(external_acl); |
127 | ||
128 | external_acl::external_acl() : | |
aee3523a | 129 | next(nullptr), |
f963b531 AJ |
130 | ttl(DEFAULT_EXTERNAL_ACL_TTL), |
131 | negative_ttl(-1), | |
132 | grace(1), | |
aee3523a | 133 | name(nullptr), |
4e56d7f6 | 134 | format("external_acl_type"), |
aee3523a | 135 | cmdline(nullptr), |
f963b531 | 136 | children(DEFAULT_EXTERNAL_ACL_CHILDREN), |
aee3523a AR |
137 | theHelper(nullptr), |
138 | cache(nullptr), | |
f963b531 AJ |
139 | cache_size(256*1024), |
140 | cache_entries(0), | |
141 | #if USE_AUTH | |
142 | require_auth(0), | |
143 | #endif | |
95d78f10 | 144 | quote(Format::LOG_QUOTE_URL) |
d9572179 | 145 | { |
f963b531 AJ |
146 | local_addr.setLocalhost(); |
147 | } | |
62e76326 | 148 | |
f963b531 AJ |
149 | external_acl::~external_acl() |
150 | { | |
151 | xfree(name); | |
f963b531 AJ |
152 | wordlistDestroy(&cmdline); |
153 | ||
154 | if (theHelper) { | |
155 | helperShutdown(theHelper); | |
aee3523a | 156 | theHelper = nullptr; |
d9572179 | 157 | } |
62e76326 | 158 | |
f963b531 AJ |
159 | while (lru_list.tail) { |
160 | ExternalACLEntryPointer e(static_cast<ExternalACLEntry *>(lru_list.tail->data)); | |
161 | external_acl_cache_delete(this, e); | |
162 | } | |
163 | if (cache) | |
164 | hashFreeMemory(cache); | |
165 | ||
166 | while (next) { | |
167 | external_acl *node = next; | |
168 | next = node->next; | |
aee3523a | 169 | node->next = nullptr; // prevent recursion |
f963b531 | 170 | delete node; |
abdd93d0 | 171 | } |
d9572179 | 172 | } |
173 | ||
174 | void | |
175 | parse_externalAclHelper(external_acl ** list) | |
176 | { | |
f963b531 | 177 | char *token = ConfigParser::NextToken(); |
62e76326 | 178 | |
7b6ce1c0 | 179 | if (!token) { |
62e76326 | 180 | self_destruct(); |
7b6ce1c0 AJ |
181 | return; |
182 | } | |
62e76326 | 183 | |
7b6ce1c0 | 184 | external_acl *a = new external_acl; |
d9572179 | 185 | a->name = xstrdup(token); |
186 | ||
2eceb328 CT |
187 | // Allow supported %macros inside quoted tokens |
188 | ConfigParser::EnableMacros(); | |
189 | token = ConfigParser::NextToken(); | |
62e76326 | 190 | |
d9572179 | 191 | /* Parse options */ |
192 | while (token) { | |
62e76326 | 193 | if (strncmp(token, "ttl=", 4) == 0) { |
194 | a->ttl = atoi(token + 4); | |
195 | } else if (strncmp(token, "negative_ttl=", 13) == 0) { | |
196 | a->negative_ttl = atoi(token + 13); | |
07eca7e0 | 197 | } else if (strncmp(token, "children=", 9) == 0) { |
48d54e4d | 198 | a->children.n_max = atoi(token + 9); |
fa84c01d | 199 | debugs(0, DBG_CRITICAL, "WARNING: external_acl_type option children=N has been deprecated in favor of children-max=N and children-startup=N"); |
48d54e4d AJ |
200 | } else if (strncmp(token, "children-max=", 13) == 0) { |
201 | a->children.n_max = atoi(token + 13); | |
202 | } else if (strncmp(token, "children-startup=", 17) == 0) { | |
203 | a->children.n_startup = atoi(token + 17); | |
204 | } else if (strncmp(token, "children-idle=", 14) == 0) { | |
205 | a->children.n_idle = atoi(token + 14); | |
07eca7e0 | 206 | } else if (strncmp(token, "concurrency=", 12) == 0) { |
48d54e4d | 207 | a->children.concurrency = atoi(token + 12); |
6825b101 CT |
208 | } else if (strncmp(token, "queue-size=", 11) == 0) { |
209 | a->children.queue_size = atoi(token + 11); | |
210 | a->children.defaultQueueSize = false; | |
62e76326 | 211 | } else if (strncmp(token, "cache=", 6) == 0) { |
212 | a->cache_size = atoi(token + 6); | |
47b0c1fa | 213 | } else if (strncmp(token, "grace=", 6) == 0) { |
214 | a->grace = atoi(token + 6); | |
dc1af3cf | 215 | } else if (strcmp(token, "protocol=2.5") == 0) { |
95d78f10 | 216 | a->quote = Format::LOG_QUOTE_SHELL; |
dc1af3cf | 217 | } else if (strcmp(token, "protocol=3.0") == 0) { |
05e52854 | 218 | debugs(3, DBG_PARSE_NOTE(2), "WARNING: external_acl_type option protocol=3.0 is deprecated. Remove this from your config."); |
95d78f10 | 219 | a->quote = Format::LOG_QUOTE_URL; |
dc1af3cf | 220 | } else if (strcmp(token, "quote=url") == 0) { |
05e52854 | 221 | debugs(3, DBG_PARSE_NOTE(2), "WARNING: external_acl_type option quote=url is deprecated. Remove this from your config."); |
95d78f10 | 222 | a->quote = Format::LOG_QUOTE_URL; |
dc1af3cf | 223 | } else if (strcmp(token, "quote=shell") == 0) { |
05e52854 | 224 | debugs(3, DBG_PARSE_NOTE(2), "WARNING: external_acl_type option quote=shell is deprecated. Use protocol=2.5 if still needed."); |
95d78f10 | 225 | a->quote = Format::LOG_QUOTE_SHELL; |
cc192b50 | 226 | |
26ac0430 AJ |
227 | /* INET6: allow admin to configure some helpers explicitly to |
228 | bind to IPv4/v6 localhost port. */ | |
cc192b50 | 229 | } else if (strcmp(token, "ipv4") == 0) { |
4dd643d5 | 230 | if ( !a->local_addr.setIPv4() ) { |
fa84c01d | 231 | debugs(3, DBG_CRITICAL, "WARNING: Error converting " << a->local_addr << " to IPv4 in " << a->name ); |
cc192b50 | 232 | } |
233 | } else if (strcmp(token, "ipv6") == 0) { | |
055421ee | 234 | if (!Ip::EnableIpv6) |
fa84c01d | 235 | debugs(3, DBG_CRITICAL, "WARNING: --enable-ipv6 required for external ACL helpers to use IPv6: " << a->name ); |
055421ee | 236 | // else nothing to do. |
62e76326 | 237 | } else { |
238 | break; | |
239 | } | |
240 | ||
2eceb328 | 241 | token = ConfigParser::NextToken(); |
d9572179 | 242 | } |
2eceb328 | 243 | ConfigParser::DisableMacros(); |
62e76326 | 244 | |
6f78f0ed | 245 | /* check that child startup value is sane. */ |
a3cecd6c AJ |
246 | if (a->children.n_startup > a->children.n_max) |
247 | a->children.n_startup = a->children.n_max; | |
48d54e4d | 248 | |
6f78f0ed | 249 | /* check that child idle value is sane. */ |
a3cecd6c AJ |
250 | if (a->children.n_idle > a->children.n_max) |
251 | a->children.n_idle = a->children.n_max; | |
252 | if (a->children.n_idle < 1) | |
253 | a->children.n_idle = 1; | |
48d54e4d | 254 | |
d9572179 | 255 | if (a->negative_ttl == -1) |
62e76326 | 256 | a->negative_ttl = a->ttl; |
d9572179 | 257 | |
e44a3ec4 | 258 | if (a->children.defaultQueueSize) |
6825b101 CT |
259 | a->children.queue_size = 2 * a->children.n_max; |
260 | ||
4e56d7f6 AJ |
261 | /* Legacy external_acl_type format parser. |
262 | * Handles a series of %... tokens where any non-% means | |
263 | * the start of another parameter field (ie the path to binary). | |
264 | */ | |
265 | enum Format::Quoting quote = Format::LOG_QUOTE_NONE; | |
266 | Format::Token **fmt = &a->format.format; | |
712fa21e | 267 | bool data_used = false; |
d9572179 | 268 | while (token) { |
4e56d7f6 | 269 | /* stop on first non-% token found */ |
62e76326 | 270 | if (*token != '%') |
271 | break; | |
272 | ||
4e56d7f6 | 273 | *fmt = new Format::Token; |
09e34608 AJ |
274 | // these tokens are whitespace delimited |
275 | (*fmt)->space = true; | |
4e56d7f6 | 276 | |
3a80bdd7 | 277 | // set the default encoding to match the protocol= config |
95d78f10 AJ |
278 | // this will be overridden by explicit %macro attributes |
279 | (*fmt)->quote = a->quote; | |
280 | ||
4e56d7f6 | 281 | // compatibility for old tokens incompatible with Format::Token syntax |
61beade2 | 282 | #if USE_OPENSSL // do not bother unless we have to. |
4e56d7f6 AJ |
283 | if (strncmp(token, "%USER_CERT_", 11) == 0) { |
284 | (*fmt)->type = Format::LFT_EXT_ACL_USER_CERT; | |
285 | (*fmt)->data.string = xstrdup(token + 11); | |
286 | (*fmt)->data.header.header = (*fmt)->data.string; | |
f06585e0 | 287 | } else if (strncmp(token, "%USER_CA_CERT_", 14) == 0) { |
4e56d7f6 AJ |
288 | (*fmt)->type = Format::LFT_EXT_ACL_USER_CA_CERT; |
289 | (*fmt)->data.string = xstrdup(token + 14); | |
290 | (*fmt)->data.header.header = (*fmt)->data.string; | |
f06585e0 | 291 | } else if (strncmp(token, "%CA_CERT_", 9) == 0) { |
3650c90e | 292 | debugs(82, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: external_acl_type %CA_CERT_* code is obsolete. Use %USER_CA_CERT_* instead"); |
4e56d7f6 AJ |
293 | (*fmt)->type = Format::LFT_EXT_ACL_USER_CA_CERT; |
294 | (*fmt)->data.string = xstrdup(token + 9); | |
295 | (*fmt)->data.header.header = (*fmt)->data.string; | |
296 | } else | |
a7ad6e4e | 297 | #endif |
62b9cc19 | 298 | if (strncmp(token,"%<{", 3) == 0) { |
299 | SBuf tmp("%<h"); | |
300 | tmp.append(token+2); | |
301 | debugs(82, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: external_acl_type format %<{...} is deprecated. Use " << tmp); | |
302 | const size_t parsedLen = (*fmt)->parse(tmp.c_str(), "e); | |
303 | assert(parsedLen == tmp.length()); | |
304 | assert((*fmt)->type == Format::LFT_REPLY_HEADER || | |
305 | (*fmt)->type == Format::LFT_REPLY_HEADER_ELEM); | |
306 | ||
307 | } else if (strncmp(token,"%>{", 3) == 0) { | |
308 | SBuf tmp("%>ha"); | |
309 | tmp.append(token+2); | |
310 | debugs(82, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: external_acl_type format %>{...} is deprecated. Use " << tmp); | |
311 | const size_t parsedLen = (*fmt)->parse(tmp.c_str(), "e); | |
312 | assert(parsedLen == tmp.length()); | |
313 | assert((*fmt)->type == Format::LFT_ADAPTED_REQUEST_HEADER || | |
314 | (*fmt)->type == Format::LFT_ADAPTED_REQUEST_HEADER_ELEM); | |
315 | ||
316 | } else { | |
317 | // we can use the Format::Token::parse() method since it | |
318 | // only pulls off one token. Since we already checked | |
319 | // for '%' prefix above this is guaranteed to be a token. | |
320 | const size_t len = (*fmt)->parse(token, "e); | |
321 | assert(len == strlen(token)); | |
322 | } | |
4e56d7f6 AJ |
323 | |
324 | // process special token-specific actions (only if necessary) | |
2f1431ea | 325 | #if USE_AUTH |
4e56d7f6 AJ |
326 | if ((*fmt)->type == Format::LFT_USER_LOGIN) |
327 | a->require_auth = true; | |
2f1431ea | 328 | #endif |
62e76326 | 329 | |
95d78f10 AJ |
330 | if ((*fmt)->type == Format::LFT_EXT_ACL_DATA) |
331 | data_used = true; | |
712fa21e | 332 | |
4e56d7f6 | 333 | fmt = &((*fmt)->next); |
2eceb328 | 334 | token = ConfigParser::NextToken(); |
d9572179 | 335 | } |
336 | ||
337 | /* There must be at least one format token */ | |
7b6ce1c0 AJ |
338 | if (!a->format.format) { |
339 | delete a; | |
62e76326 | 340 | self_destruct(); |
7b6ce1c0 AJ |
341 | return; |
342 | } | |
d9572179 | 343 | |
712fa21e AJ |
344 | // format has implicit %DATA on the end if not used explicitly |
345 | if (!data_used) { | |
346 | *fmt = new Format::Token; | |
347 | (*fmt)->type = Format::LFT_EXT_ACL_DATA; | |
262eaf9a | 348 | (*fmt)->quote = Format::LOG_QUOTE_NONE; |
712fa21e AJ |
349 | } |
350 | ||
d9572179 | 351 | /* helper */ |
7b6ce1c0 AJ |
352 | if (!token) { |
353 | delete a; | |
62e76326 | 354 | self_destruct(); |
7b6ce1c0 AJ |
355 | return; |
356 | } | |
62e76326 | 357 | |
d9572179 | 358 | wordlistAdd(&a->cmdline, token); |
359 | ||
360 | /* arguments */ | |
a336d130 | 361 | parse_wordlist(&a->cmdline); |
d9572179 | 362 | |
363 | while (*list) | |
62e76326 | 364 | list = &(*list)->next; |
365 | ||
d9572179 | 366 | *list = a; |
367 | } | |
368 | ||
369 | void | |
370 | dump_externalAclHelper(StoreEntry * sentry, const char *name, const external_acl * list) | |
371 | { | |
372 | const external_acl *node; | |
d9572179 | 373 | const wordlist *word; |
62e76326 | 374 | |
d9572179 | 375 | for (node = list; node; node = node->next) { |
62e76326 | 376 | storeAppendPrintf(sentry, "%s %s", name, node->name); |
377 | ||
4dd643d5 | 378 | if (!node->local_addr.isIPv6()) |
cc192b50 | 379 | storeAppendPrintf(sentry, " ipv4"); |
380 | else | |
381 | storeAppendPrintf(sentry, " ipv6"); | |
382 | ||
62e76326 | 383 | if (node->ttl != DEFAULT_EXTERNAL_ACL_TTL) |
384 | storeAppendPrintf(sentry, " ttl=%d", node->ttl); | |
385 | ||
386 | if (node->negative_ttl != node->ttl) | |
387 | storeAppendPrintf(sentry, " negative_ttl=%d", node->negative_ttl); | |
388 | ||
47b0c1fa | 389 | if (node->grace) |
390 | storeAppendPrintf(sentry, " grace=%d", node->grace); | |
391 | ||
48d54e4d AJ |
392 | if (node->children.n_max != DEFAULT_EXTERNAL_ACL_CHILDREN) |
393 | storeAppendPrintf(sentry, " children-max=%d", node->children.n_max); | |
62e76326 | 394 | |
2ccfb9a7 | 395 | if (node->children.n_startup != 0) // sync with helper/ChildConfig.cc default |
48d54e4d | 396 | storeAppendPrintf(sentry, " children-startup=%d", node->children.n_startup); |
62e76326 | 397 | |
2ccfb9a7 | 398 | if (node->children.n_idle != 1) // sync with helper/ChildConfig.cc default |
48d54e4d AJ |
399 | storeAppendPrintf(sentry, " children-idle=%d", node->children.n_idle); |
400 | ||
2ccfb9a7 | 401 | if (node->children.concurrency != 0) |
48d54e4d | 402 | storeAppendPrintf(sentry, " concurrency=%d", node->children.concurrency); |
07eca7e0 | 403 | |
47b0c1fa | 404 | if (node->cache) |
405 | storeAppendPrintf(sentry, " cache=%d", node->cache_size); | |
406 | ||
95d78f10 | 407 | if (node->quote == Format::LOG_QUOTE_SHELL) |
05e52854 AJ |
408 | storeAppendPrintf(sentry, " protocol=2.5"); |
409 | ||
aee3523a | 410 | node->format.dump(sentry, nullptr, false); |
62e76326 | 411 | |
412 | for (word = node->cmdline; word; word = word->next) | |
413 | storeAppendPrintf(sentry, " %s", word->key); | |
414 | ||
415 | storeAppendPrintf(sentry, "\n"); | |
d9572179 | 416 | } |
417 | } | |
418 | ||
419 | void | |
420 | free_externalAclHelper(external_acl ** list) | |
421 | { | |
f963b531 | 422 | delete *list; |
aee3523a | 423 | *list = nullptr; |
d9572179 | 424 | } |
425 | ||
426 | static external_acl * | |
427 | find_externalAclHelper(const char *name) | |
428 | { | |
429 | external_acl *node; | |
430 | ||
431 | for (node = Config.externalAclHelperList; node; node = node->next) { | |
62e76326 | 432 | if (strcmp(node->name, name) == 0) |
433 | return node; | |
d9572179 | 434 | } |
62e76326 | 435 | |
aee3523a | 436 | return nullptr; |
d9572179 | 437 | } |
438 | ||
1e5562e3 | 439 | void |
abdd93d0 | 440 | external_acl::add(const ExternalACLEntryPointer &anEntry) |
1e5562e3 | 441 | { |
442 | trimCache(); | |
aee3523a AR |
443 | assert(anEntry != nullptr); |
444 | assert (anEntry->def == nullptr); | |
1e5562e3 | 445 | anEntry->def = this; |
abdd93d0 AJ |
446 | ExternalACLEntry *e = const_cast<ExternalACLEntry *>(anEntry.getRaw()); // XXX: make hash a std::map of Pointer. |
447 | hash_join(cache, e); | |
448 | dlinkAdd(e, &e->lru, &lru_list); | |
449 | e->lock(); //cbdataReference(e); // lock it on behalf of the hash | |
95dc7ff4 | 450 | ++cache_entries; |
1e5562e3 | 451 | } |
452 | ||
453 | void | |
454 | external_acl::trimCache() | |
455 | { | |
abdd93d0 AJ |
456 | if (cache_size && cache_entries >= cache_size) { |
457 | ExternalACLEntryPointer e(static_cast<ExternalACLEntry *>(lru_list.tail->data)); | |
458 | external_acl_cache_delete(this, e); | |
459 | } | |
1e5562e3 | 460 | } |
461 | ||
194ccc9c | 462 | bool |
329c128c | 463 | external_acl::maybeCacheable(const Acl::Answer &result) const |
194ccc9c CT |
464 | { |
465 | if (cache_size <= 0) | |
466 | return false; // cache is disabled | |
467 | ||
468 | if (result == ACCESS_DUNNO) | |
469 | return false; // non-cacheable response | |
470 | ||
06bf5384 | 471 | if ((result.allowed() ? ttl : negative_ttl) <= 0) |
194ccc9c CT |
472 | return false; // not caching this type of response |
473 | ||
474 | return true; | |
475 | } | |
476 | ||
d9572179 | 477 | /****************************************************************** |
478 | * external acl type | |
479 | */ | |
480 | ||
f963b531 AJ |
481 | class external_acl_data |
482 | { | |
483 | CBDATA_CLASS(external_acl_data); | |
484 | ||
485 | public: | |
25aa6c9a | 486 | explicit external_acl_data(external_acl * const aDef): def(cbdataReference(aDef)), arguments(nullptr) {} |
f963b531 AJ |
487 | ~external_acl_data(); |
488 | ||
d9572179 | 489 | external_acl *def; |
25aa6c9a | 490 | SBuf name; |
d9572179 | 491 | wordlist *arguments; |
492 | }; | |
493 | ||
f963b531 AJ |
494 | CBDATA_CLASS_INIT(external_acl_data); |
495 | ||
496 | external_acl_data::~external_acl_data() | |
d9572179 | 497 | { |
f963b531 AJ |
498 | wordlistDestroy(&arguments); |
499 | cbdataReferenceDone(def); | |
d9572179 | 500 | } |
501 | ||
502 | void | |
b0dd28ba | 503 | ACLExternal::parse() |
d9572179 | 504 | { |
7b6ce1c0 | 505 | if (data) { |
62e76326 | 506 | self_destruct(); |
7b6ce1c0 AJ |
507 | return; |
508 | } | |
62e76326 | 509 | |
16c5ad96 | 510 | char *token = ConfigParser::strtokFile(); |
62e76326 | 511 | |
7b6ce1c0 | 512 | if (!token) { |
62e76326 | 513 | self_destruct(); |
7b6ce1c0 AJ |
514 | return; |
515 | } | |
62e76326 | 516 | |
f963b531 | 517 | data = new external_acl_data(find_externalAclHelper(token)); |
62e76326 | 518 | |
7b6ce1c0 AJ |
519 | if (!data->def) { |
520 | delete data; | |
62e76326 | 521 | self_destruct(); |
7b6ce1c0 AJ |
522 | return; |
523 | } | |
62e76326 | 524 | |
ec2d5242 HN |
525 | // def->name is the name of the external_acl_type. |
526 | // this is the name of the 'acl' directive being tested | |
25aa6c9a | 527 | data->name = name; |
ec2d5242 | 528 | |
16c5ad96 | 529 | while ((token = ConfigParser::strtokFile())) { |
62e76326 | 530 | wordlistAdd(&data->arguments, token); |
d9572179 | 531 | } |
d9572179 | 532 | } |
533 | ||
4b0f5de8 | 534 | bool |
535 | ACLExternal::valid () const | |
536 | { | |
2f1431ea | 537 | #if USE_AUTH |
4b0f5de8 | 538 | if (data->def->require_auth) { |
539 | if (authenticateSchemeCount() == 0) { | |
d816f28d | 540 | debugs(28, DBG_CRITICAL, "ERROR: Cannot use proxy auth because no authentication schemes were compiled."); |
4b0f5de8 | 541 | return false; |
542 | } | |
543 | ||
544 | if (authenticateActiveSchemeCount() == 0) { | |
d816f28d | 545 | debugs(28, DBG_CRITICAL, "ERROR: Cannot use proxy auth because no authentication schemes are fully configured."); |
4b0f5de8 | 546 | return false; |
547 | } | |
548 | } | |
2f1431ea | 549 | #endif |
4b0f5de8 | 550 | |
551 | return true; | |
552 | } | |
553 | ||
554 | bool | |
555 | ACLExternal::empty () const | |
556 | { | |
557 | return false; | |
558 | } | |
559 | ||
b0dd28ba | 560 | ACLExternal::~ACLExternal() |
d9572179 | 561 | { |
f963b531 AJ |
562 | delete data; |
563 | xfree(class_); | |
d9572179 | 564 | } |
565 | ||
1abe0161 | 566 | static void |
f05e4f37 | 567 | copyResultsFromEntry(const HttpRequest::Pointer &req, const ExternalACLEntryPointer &entry) |
1abe0161 AJ |
568 | { |
569 | if (req) { | |
570 | #if USE_AUTH | |
571 | if (entry->user.size()) | |
572 | req->extacl_user = entry->user; | |
573 | ||
574 | if (entry->password.size()) | |
575 | req->extacl_passwd = entry->password; | |
576 | #endif | |
577 | if (!req->tag.size()) | |
578 | req->tag = entry->tag; | |
579 | ||
580 | if (entry->log.size()) | |
581 | req->extacl_log = entry->log; | |
582 | ||
583 | if (entry->message.size()) | |
584 | req->extacl_message = entry->message; | |
a1df1417 NH |
585 | |
586 | // attach the helper kv-pair to the transaction | |
587 | UpdateRequestNotes(req->clientConnectionManager.get(), *req, entry->notes); | |
1abe0161 AJ |
588 | } |
589 | } | |
590 | ||
5fb6afec EB |
591 | // TODO: Diff reduction. Rename this helper method to match_() or similar. |
592 | Acl::Answer | |
593 | ACLExternal::aclMatchExternal(external_acl_data *acl, ACLFilledChecklist *ch) const | |
d9572179 | 594 | { |
0d645414 AR |
595 | // Despite its external_acl C++ type name, acl->def is not an ACL (i.e. not |
596 | // a reference-counted Acl::Node) and gets invalidated by reconfiguration. | |
597 | // TODO: RefCount external_acl, so that we do not have to bail here. | |
598 | if (!cbdataReferenceValid(acl->def)) { | |
599 | debugs(82, 3, "cannot resume matching; external_acl gone"); | |
600 | return ACCESS_DUNNO; | |
601 | } | |
602 | ||
bf95c10a | 603 | debugs(82, 9, "acl=\"" << acl->def->name << "\""); |
abdd93d0 | 604 | ExternalACLEntryPointer entry = ch->extacl_entry; |
62e76326 | 605 | |
6f58d7d7 AR |
606 | external_acl_message = "MISSING REQUIRED INFORMATION"; |
607 | ||
aee3523a | 608 | if (entry != nullptr) { |
abdd93d0 | 609 | if (entry->def == acl->def) { |
ad06254e | 610 | /* Ours, use it.. if the key matches */ |
6f58d7d7 AR |
611 | const char *key = makeExternalAclKey(ch, acl); |
612 | if (!key) | |
2f8abb64 | 613 | return ACCESS_DUNNO; // insufficient data to continue |
ad06254e | 614 | if (strcmp(key, (char*)entry->key) != 0) { |
61beade2 | 615 | debugs(82, 9, "entry key='" << (char *)entry->key << "', our key='" << key << "' do not match. Discarded."); |
ad06254e | 616 | // too bad. need a new lookup. |
aee3523a | 617 | entry = ch->extacl_entry = nullptr; |
ad06254e | 618 | } |
62e76326 | 619 | } else { |
abdd93d0 AJ |
620 | /* Not ours.. get rid of it */ |
621 | debugs(82, 9, "entry " << entry << " not valid or not ours. Discarded."); | |
aee3523a | 622 | if (entry != nullptr) { |
abdd93d0 | 623 | debugs(82, 9, "entry def=" << entry->def << ", our def=" << acl->def); |
6f58d7d7 | 624 | const char *key = makeExternalAclKey(ch, acl); // may be nil |
abdd93d0 | 625 | debugs(82, 9, "entry key='" << (char *)entry->key << "', our key='" << key << "'"); |
c69ce640 | 626 | } |
aee3523a | 627 | entry = ch->extacl_entry = nullptr; |
62e76326 | 628 | } |
d9572179 | 629 | } |
62e76326 | 630 | |
d9572179 | 631 | if (!entry) { |
bf95c10a | 632 | debugs(82, 9, "No helper entry available"); |
2f1431ea | 633 | #if USE_AUTH |
62e76326 | 634 | if (acl->def->require_auth) { |
62e76326 | 635 | /* Make sure the user is authenticated */ |
bf95c10a | 636 | debugs(82, 3, acl->def->name << " check user authenticated."); |
5fb6afec | 637 | const auto ti = AuthenticateAcl(ch, *this); |
06bf5384 | 638 | if (!ti.allowed()) { |
bf95c10a | 639 | debugs(82, 2, acl->def->name << " user not authenticated (" << ti << ")"); |
e0f7153c | 640 | return ti; |
62e76326 | 641 | } |
bf95c10a | 642 | debugs(82, 3, acl->def->name << " user is authenticated."); |
62e76326 | 643 | } |
2f1431ea | 644 | #endif |
6f58d7d7 | 645 | const char *key = makeExternalAclKey(ch, acl); |
41218131 | 646 | |
647 | if (!key) { | |
648 | /* Not sufficient data to process */ | |
e5f825ea | 649 | return ACCESS_DUNNO; |
41218131 | 650 | } |
651 | ||
abdd93d0 | 652 | entry = static_cast<ExternalACLEntry *>(hash_lookup(acl->def->cache, key)); |
62e76326 | 653 | |
abdd93d0 | 654 | const ExternalACLEntryPointer staleEntry = entry; |
aee3523a AR |
655 | if (entry != nullptr && external_acl_entry_expired(acl->def, entry)) |
656 | entry = nullptr; | |
e0f7153c | 657 | |
aee3523a | 658 | if (entry != nullptr && external_acl_grace_expired(acl->def, entry)) { |
e0f7153c | 659 | // refresh in the background |
5fb6afec | 660 | startLookup(ch, acl, true); |
bf95c10a | 661 | debugs(82, 4, "no need to wait for the refresh of '" << |
e0f7153c AR |
662 | key << "' in '" << acl->def->name << "' (ch=" << ch << ")."); |
663 | } | |
664 | ||
665 | if (!entry) { | |
bf95c10a | 666 | debugs(82, 2, acl->def->name << "(\"" << key << "\") = lookup needed"); |
95a83c22 | 667 | |
6082a0e2 EB |
668 | // TODO: All other helpers allow temporary overload. Should not we? |
669 | if (!acl->def->theHelper->willOverload()) { | |
bf95c10a | 670 | debugs(82, 2, "\"" << key << "\": queueing a call."); |
5fb6afec | 671 | if (!ch->goAsync(StartLookup, *this)) |
6f58d7d7 | 672 | debugs(82, 2, "\"" << key << "\": no async support!"); |
bf95c10a | 673 | debugs(82, 2, "\"" << key << "\": return -1."); |
e0f7153c | 674 | return ACCESS_DUNNO; // expired cached or simply absent entry |
47b0c1fa | 675 | } else { |
e0f7153c | 676 | if (!staleEntry) { |
e5f825ea | 677 | debugs(82, DBG_IMPORTANT, "WARNING: external ACL '" << acl->def->name << |
6082a0e2 | 678 | "' queue full. Request rejected '" << key << "'."); |
4a972fa2 | 679 | external_acl_message = "SYSTEM TOO BUSY, TRY AGAIN LATER"; |
e5f825ea | 680 | return ACCESS_DUNNO; |
47b0c1fa | 681 | } else { |
e5f825ea | 682 | debugs(82, DBG_IMPORTANT, "WARNING: external ACL '" << acl->def->name << |
6082a0e2 | 683 | "' queue full. Using stale result. '" << key << "'."); |
e0f7153c | 684 | entry = staleEntry; |
47b0c1fa | 685 | /* Fall thru to processing below */ |
686 | } | |
687 | } | |
688 | } | |
d9572179 | 689 | } |
62e76326 | 690 | |
bf95c10a | 691 | debugs(82, 4, "entry = { date=" << |
e0f7153c AR |
692 | (long unsigned int) entry->date << |
693 | ", result=" << entry->result << | |
694 | " tag=" << entry->tag << | |
695 | " log=" << entry->log << " }"); | |
696 | #if USE_AUTH | |
bf95c10a | 697 | debugs(82, 4, "entry user=" << entry->user); |
e0f7153c AR |
698 | #endif |
699 | ||
d9572179 | 700 | external_acl_cache_touch(acl->def, entry); |
a7a42b14 | 701 | external_acl_message = entry->message.termedBuf(); |
4a972fa2 | 702 | |
bf95c10a | 703 | debugs(82, 2, acl->def->name << " = " << entry->result); |
1abe0161 | 704 | copyResultsFromEntry(ch->request, entry); |
e5f825ea | 705 | return entry->result; |
d9572179 | 706 | } |
707 | ||
b0dd28ba | 708 | int |
709 | ACLExternal::match(ACLChecklist *checklist) | |
710 | { | |
329c128c | 711 | auto answer = aclMatchExternal(data, Filled(checklist)); |
e5f825ea AJ |
712 | |
713 | // convert to tri-state ACL match 1,0,-1 | |
9b831d57 | 714 | switch (answer) { |
e5f825ea | 715 | case ACCESS_ALLOWED: |
e5f825ea AJ |
716 | return 1; // match |
717 | ||
718 | case ACCESS_DENIED: | |
e5f825ea AJ |
719 | return 0; // non-match |
720 | ||
721 | case ACCESS_DUNNO: | |
722 | case ACCESS_AUTH_REQUIRED: | |
723 | default: | |
e0f7153c | 724 | // If the answer is not allowed or denied (matches/not matches) and |
6f58d7d7 AR |
725 | // async authentication is not in progress, then we are done. |
726 | if (checklist->keepMatching()) | |
e0f7153c | 727 | checklist->markFinished(answer, "aclMatchExternal exception"); |
e5f825ea AJ |
728 | return -1; // other |
729 | } | |
b0dd28ba | 730 | } |
731 | ||
dfad5100 | 732 | SBufList |
b0dd28ba | 733 | ACLExternal::dump() const |
d9572179 | 734 | { |
b0dd28ba | 735 | external_acl_data const *acl = data; |
dfad5100 FC |
736 | SBufList rv; |
737 | rv.push_back(SBuf(acl->def->name)); | |
62e76326 | 738 | |
dfad5100 FC |
739 | for (wordlist *arg = acl->arguments; arg; arg = arg->next) { |
740 | SBuf s; | |
741 | s.Printf(" %s", arg->key); | |
742 | rv.push_back(s); | |
d9572179 | 743 | } |
62e76326 | 744 | |
dfad5100 | 745 | return rv; |
d9572179 | 746 | } |
747 | ||
748 | /****************************************************************** | |
749 | * external_acl cache | |
750 | */ | |
751 | ||
d9572179 | 752 | static void |
abdd93d0 | 753 | external_acl_cache_touch(external_acl * def, const ExternalACLEntryPointer &entry) |
d9572179 | 754 | { |
c69ce640 | 755 | // this must not be done when nothing is being cached. |
194ccc9c | 756 | if (!def->maybeCacheable(entry->result)) |
c69ce640 AJ |
757 | return; |
758 | ||
d9572179 | 759 | dlinkDelete(&entry->lru, &def->lru_list); |
abdd93d0 AJ |
760 | ExternalACLEntry *e = const_cast<ExternalACLEntry *>(entry.getRaw()); // XXX: make hash a std::map of Pointer. |
761 | dlinkAdd(e, &entry->lru, &def->lru_list); | |
d9572179 | 762 | } |
763 | ||
5fb6afec EB |
764 | char * |
765 | ACLExternal::makeExternalAclKey(ACLFilledChecklist * ch, external_acl_data * acl_data) const | |
d9572179 | 766 | { |
032785bf | 767 | static MemBuf mb; |
09e34608 | 768 | mb.reset(); |
62e76326 | 769 | |
4e56d7f6 AJ |
770 | // check for special case tokens in the format |
771 | for (Format::Token *t = acl_data->def->format.format; t ; t = t->next) { | |
62e76326 | 772 | |
4e56d7f6 AJ |
773 | if (t->type == Format::LFT_EXT_ACL_NAME) { |
774 | // setup for %ACL | |
25aa6c9a | 775 | ch->al->lastAclName = acl_data->name; |
789dda8d CT |
776 | } |
777 | ||
778647be | 778 | if (t->type == Format::LFT_EXT_ACL_DATA) { |
4e56d7f6 AJ |
779 | // setup string for %DATA |
780 | SBuf sb; | |
4e56d7f6 | 781 | for (auto arg = acl_data->arguments; arg; arg = arg->next) { |
778647be | 782 | if (sb.length()) |
ec2d5242 HN |
783 | sb.append(" ", 1); |
784 | ||
95d78f10 | 785 | if (acl_data->def->quote == Format::LOG_QUOTE_URL) { |
ec2d5242 HN |
786 | const char *quoted = rfc1738_escape(arg->key); |
787 | sb.append(quoted, strlen(quoted)); | |
788 | } else { | |
789 | static MemBuf mb2; | |
790 | mb2.init(); | |
791 | strwordquote(&mb2, arg->key); | |
792 | sb.append(mb2.buf, mb2.size); | |
793 | mb2.clean(); | |
794 | } | |
ec2d5242 | 795 | } |
778647be | 796 | |
b0e14ce2 | 797 | ch->al->lastAclData = sb; |
dc1af3cf | 798 | } |
d9572179 | 799 | } |
62e76326 | 800 | |
712fa21e | 801 | // assemble the full helper lookup string |
4e56d7f6 AJ |
802 | acl_data->def->format.assemble(mb, ch->al, 0); |
803 | ||
d9572179 | 804 | return mb.buf; |
d9572179 | 805 | } |
806 | ||
807 | static int | |
abdd93d0 | 808 | external_acl_entry_expired(external_acl * def, const ExternalACLEntryPointer &entry) |
d9572179 | 809 | { |
194ccc9c | 810 | if (def->cache_size <= 0 || entry->result == ACCESS_DUNNO) |
c69ce640 AJ |
811 | return 1; |
812 | ||
06bf5384 | 813 | if (entry->date + (entry->result.allowed() ? def->ttl : def->negative_ttl) < squid_curtime) |
62e76326 | 814 | return 1; |
d9572179 | 815 | else |
62e76326 | 816 | return 0; |
d9572179 | 817 | } |
62e76326 | 818 | |
47b0c1fa | 819 | static int |
abdd93d0 | 820 | external_acl_grace_expired(external_acl * def, const ExternalACLEntryPointer &entry) |
47b0c1fa | 821 | { |
194ccc9c | 822 | if (def->cache_size <= 0 || entry->result == ACCESS_DUNNO) |
c69ce640 AJ |
823 | return 1; |
824 | ||
47b0c1fa | 825 | int ttl; |
06bf5384 | 826 | ttl = entry->result.allowed() ? def->ttl : def->negative_ttl; |
47b0c1fa | 827 | ttl = (ttl * (100 - def->grace)) / 100; |
828 | ||
98b70eff | 829 | if (entry->date + ttl <= squid_curtime) |
47b0c1fa | 830 | return 1; |
831 | else | |
832 | return 0; | |
833 | } | |
834 | ||
abdd93d0 | 835 | static ExternalACLEntryPointer |
1e5562e3 | 836 | external_acl_cache_add(external_acl * def, const char *key, ExternalACLEntryData const & data) |
d9572179 | 837 | { |
abdd93d0 | 838 | ExternalACLEntryPointer entry; |
c69ce640 | 839 | |
194ccc9c | 840 | if (!def->maybeCacheable(data.result)) { |
bf95c10a | 841 | debugs(82,6, MYNAME); |
194ccc9c CT |
842 | |
843 | if (data.result == ACCESS_DUNNO) { | |
844 | if (const ExternalACLEntryPointer oldentry = static_cast<ExternalACLEntry *>(hash_lookup(def->cache, key))) | |
845 | external_acl_cache_delete(def, oldentry); | |
846 | } | |
c69ce640 AJ |
847 | entry = new ExternalACLEntry; |
848 | entry->key = xstrdup(key); | |
849 | entry->update(data); | |
850 | entry->def = def; | |
851 | return entry; | |
852 | } | |
853 | ||
854 | entry = static_cast<ExternalACLEntry *>(hash_lookup(def->cache, key)); | |
bf8fe701 | 855 | debugs(82, 2, "external_acl_cache_add: Adding '" << key << "' = " << data.result); |
62e76326 | 856 | |
aee3523a | 857 | if (entry != nullptr) { |
abdd93d0 | 858 | debugs(82, 3, "updating existing entry"); |
c69ce640 | 859 | entry->update(data); |
62e76326 | 860 | external_acl_cache_touch(def, entry); |
62e76326 | 861 | return entry; |
d9572179 | 862 | } |
62e76326 | 863 | |
1e5562e3 | 864 | entry = new ExternalACLEntry; |
4a8b20e8 | 865 | entry->key = xstrdup(key); |
c69ce640 | 866 | entry->update(data); |
1e5562e3 | 867 | |
6ca34f6f | 868 | def->add(entry); |
1e5562e3 | 869 | |
d9572179 | 870 | return entry; |
871 | } | |
872 | ||
873 | static void | |
abdd93d0 | 874 | external_acl_cache_delete(external_acl * def, const ExternalACLEntryPointer &entry) |
d9572179 | 875 | { |
aee3523a | 876 | assert(entry != nullptr); |
c69ce640 | 877 | assert(def->cache_size > 0 && entry->def == def); |
abdd93d0 AJ |
878 | ExternalACLEntry *e = const_cast<ExternalACLEntry *>(entry.getRaw()); // XXX: make hash a std::map of Pointer. |
879 | hash_remove_link(def->cache, e); | |
880 | dlinkDelete(&e->lru, &def->lru_list); | |
881 | e->unlock(); // unlock on behalf of the hash | |
d9572179 | 882 | def->cache_entries -= 1; |
d9572179 | 883 | } |
884 | ||
885 | /****************************************************************** | |
886 | * external_acl helpers | |
887 | */ | |
888 | ||
f963b531 AJ |
889 | class externalAclState |
890 | { | |
891 | CBDATA_CLASS(externalAclState); | |
892 | ||
893 | public: | |
894 | externalAclState(external_acl* aDef, const char *aKey) : | |
aee3523a AR |
895 | callback(nullptr), |
896 | callback_data(nullptr), | |
f963b531 AJ |
897 | key(xstrdup(aKey)), |
898 | def(cbdataReference(aDef)), | |
aee3523a | 899 | queue(nullptr) |
f963b531 AJ |
900 | {} |
901 | ~externalAclState(); | |
62e76326 | 902 | |
d9572179 | 903 | EAH *callback; |
904 | void *callback_data; | |
905 | char *key; | |
906 | external_acl *def; | |
907 | dlink_node list; | |
908 | externalAclState *queue; | |
909 | }; | |
910 | ||
f963b531 AJ |
911 | CBDATA_CLASS_INIT(externalAclState); |
912 | ||
913 | externalAclState::~externalAclState() | |
d9572179 | 914 | { |
f963b531 AJ |
915 | xfree(key); |
916 | cbdataReferenceDone(callback_data); | |
917 | cbdataReferenceDone(def); | |
d9572179 | 918 | } |
919 | ||
d9572179 | 920 | /* |
921 | * The helper program receives queries on stdin, one | |
07eca7e0 | 922 | * per line, and must return the result on on stdout |
d9572179 | 923 | * |
924 | * General result syntax: | |
925 | * | |
926 | * OK/ERR keyword=value ... | |
927 | * | |
928 | * Keywords: | |
929 | * | |
4a972fa2 | 930 | * user= The users name (login) |
931 | * message= Message describing the reason | |
f53969cc SM |
932 | * tag= A string tag to be applied to the request that triggered the acl match. |
933 | * applies to both OK and ERR responses. | |
934 | * Won't override existing request tags. | |
935 | * log= A string to be used in access logging | |
d9572179 | 936 | * |
937 | * Other keywords may be added to the protocol later | |
938 | * | |
05e52854 AJ |
939 | * value needs to be URL-encoded or enclosed in double quotes (") |
940 | * with \-escaping on any whitespace, quotes, or slashes (\). | |
d9572179 | 941 | */ |
d9572179 | 942 | static void |
24438ec5 | 943 | externalAclHandleReply(void *data, const Helper::Reply &reply) |
d9572179 | 944 | { |
e6ccf245 | 945 | externalAclState *state = static_cast<externalAclState *>(data); |
d9572179 | 946 | externalAclState *next; |
1e5562e3 | 947 | ExternalACLEntryData entryData; |
d9572179 | 948 | |
bf95c10a | 949 | debugs(82, 2, "reply=" << reply); |
d9572179 | 950 | |
2428ce02 | 951 | if (reply.result == Helper::Okay) |
0272dd08 | 952 | entryData.result = ACCESS_ALLOWED; |
194ccc9c CT |
953 | else if (reply.result == Helper::Error) |
954 | entryData.result = ACCESS_DENIED; | |
955 | else //BrokenHelper,TimedOut or Unknown. Should not cached. | |
956 | entryData.result = ACCESS_DUNNO; | |
62e76326 | 957 | |
24438ec5 | 958 | // XXX: make entryData store a proper Helper::Reply object instead of copying. |
ab332e27 | 959 | |
a0592634 AJ |
960 | entryData.notes.append(&reply.notes); |
961 | ||
cf9f0261 | 962 | const char *label = reply.notes.findFirst("tag"); |
aee3523a | 963 | if (label != nullptr && *label != '\0') |
cf9f0261 | 964 | entryData.tag = label; |
62e76326 | 965 | |
cf9f0261 | 966 | label = reply.notes.findFirst("message"); |
aee3523a | 967 | if (label != nullptr && *label != '\0') |
cf9f0261 | 968 | entryData.message = label; |
62e76326 | 969 | |
cf9f0261 | 970 | label = reply.notes.findFirst("log"); |
aee3523a | 971 | if (label != nullptr && *label != '\0') |
cf9f0261 | 972 | entryData.log = label; |
62e76326 | 973 | |
2f1431ea | 974 | #if USE_AUTH |
cf9f0261 | 975 | label = reply.notes.findFirst("user"); |
aee3523a | 976 | if (label != nullptr && *label != '\0') |
cf9f0261 | 977 | entryData.user = label; |
7bbefa01 | 978 | |
cf9f0261 | 979 | label = reply.notes.findFirst("password"); |
aee3523a | 980 | if (label != nullptr && *label != '\0') |
cf9f0261 | 981 | entryData.password = label; |
2f1431ea | 982 | #endif |
62e76326 | 983 | |
23da195f CT |
984 | // XXX: This state->def access conflicts with the cbdata validity check |
985 | // below. | |
d9572179 | 986 | dlinkDelete(&state->list, &state->def->queue); |
62e76326 | 987 | |
abdd93d0 | 988 | ExternalACLEntryPointer entry; |
194ccc9c CT |
989 | if (cbdataReferenceValid(state->def)) |
990 | entry = external_acl_cache_add(state->def, state->key, entryData); | |
d9572179 | 991 | |
992 | do { | |
62e76326 | 993 | void *cbdata; |
47b0c1fa | 994 | if (state->callback && cbdataReferenceValidDone(state->callback_data, &cbdata)) |
62e76326 | 995 | state->callback(cbdata, entry); |
996 | ||
997 | next = state->queue; | |
aee3523a | 998 | state->queue = nullptr; |
d9572179 | 999 | |
f963b531 | 1000 | delete state; |
d9572179 | 1001 | |
62e76326 | 1002 | state = next; |
d9572179 | 1003 | } while (state); |
1004 | } | |
1005 | ||
5fb6afec EB |
1006 | /// Asks the helper (if needed) or returns the [cached] result (otherwise). |
1007 | /// Does not support "background" lookups. See also: ACLExternal::Start(). | |
d9572179 | 1008 | void |
922513e5 | 1009 | ACLExternal::StartLookup(ACLFilledChecklist &checklist, const Acl::Node &acl) |
d9572179 | 1010 | { |
5fb6afec EB |
1011 | const auto &me = dynamic_cast<const ACLExternal&>(acl); |
1012 | me.startLookup(&checklist, me.data, false); | |
e0f7153c | 1013 | } |
c8e7608c | 1014 | |
5fb6afec EB |
1015 | // If possible, starts an asynchronous lookup of an external ACL. |
1016 | // Otherwise, asserts (or bails if background refresh is requested). | |
e0f7153c | 1017 | void |
5fb6afec | 1018 | ACLExternal::startLookup(ACLFilledChecklist *ch, external_acl_data *acl, bool inBackground) const |
e0f7153c AR |
1019 | { |
1020 | external_acl *def = acl->def; | |
c0f81932 | 1021 | |
c8e7608c | 1022 | const char *key = makeExternalAclKey(ch, acl); |
e94ff527 | 1023 | assert(key); |
62e76326 | 1024 | |
bf95c10a | 1025 | debugs(82, 2, (inBackground ? "bg" : "fg") << " lookup in '" << |
e0f7153c | 1026 | def->name << "' for '" << key << "'"); |
62e76326 | 1027 | |
47b0c1fa | 1028 | /* Check for a pending lookup to hook into */ |
c69ce640 | 1029 | // only possible if we are caching results. |
aee3523a | 1030 | externalAclState *oldstate = nullptr; |
c69ce640 | 1031 | if (def->cache_size > 0) { |
e0f7153c | 1032 | for (dlink_node *node = def->queue.head; node; node = node->next) { |
c69ce640 | 1033 | externalAclState *oldstatetmp = static_cast<externalAclState *>(node->data); |
62e76326 | 1034 | |
c69ce640 AJ |
1035 | if (strcmp(key, oldstatetmp->key) == 0) { |
1036 | oldstate = oldstatetmp; | |
1037 | break; | |
1038 | } | |
47b0c1fa | 1039 | } |
1040 | } | |
62e76326 | 1041 | |
e0f7153c AR |
1042 | // A background refresh has no need to piggiback on a pending request: |
1043 | // When the pending request completes, the cache will be refreshed anyway. | |
1044 | if (oldstate && inBackground) { | |
bf95c10a | 1045 | debugs(82, 7, "'" << def->name << "' queue is already being refreshed (ch=" << ch << ")"); |
47b0c1fa | 1046 | return; |
1047 | } | |
62e76326 | 1048 | |
f963b531 | 1049 | externalAclState *state = new externalAclState(def, key); |
62e76326 | 1050 | |
e0f7153c | 1051 | if (!inBackground) { |
5fb6afec EB |
1052 | state->callback = &LookupDone; |
1053 | state->callback_data = cbdataReference(ch); | |
d9572179 | 1054 | } |
62e76326 | 1055 | |
47b0c1fa | 1056 | if (oldstate) { |
1057 | /* Hook into pending lookup */ | |
1058 | state->queue = oldstate->queue; | |
1059 | oldstate->queue = state; | |
1060 | } else { | |
e0f7153c AR |
1061 | /* No pending lookup found. Sumbit to helper */ |
1062 | ||
e0f7153c | 1063 | MemBuf buf; |
2fe7eff9 | 1064 | buf.init(); |
4391cd15 | 1065 | buf.appendf("%s\n", key); |
bf8fe701 | 1066 | debugs(82, 4, "externalAclLookup: looking up for '" << key << "' in '" << def->name << "'."); |
ab321f4b | 1067 | |
6825b101 | 1068 | if (!def->theHelper->trySubmit(buf.buf, externalAclHandleReply, state)) { |
bf95c10a | 1069 | debugs(82, 7, "'" << def->name << "' submit to helper failed"); |
6825b101 | 1070 | assert(inBackground); // or the caller should have checked |
f963b531 | 1071 | delete state; |
6825b101 CT |
1072 | return; |
1073 | } | |
62e76326 | 1074 | |
47b0c1fa | 1075 | dlinkAdd(state, &state->list, &def->queue); |
62e76326 | 1076 | |
2fe7eff9 | 1077 | buf.clean(); |
47b0c1fa | 1078 | } |
62e76326 | 1079 | |
bf8fe701 | 1080 | debugs(82, 4, "externalAclLookup: will wait for the result of '" << key << |
1081 | "' in '" << def->name << "' (ch=" << ch << ")."); | |
d9572179 | 1082 | } |
1083 | ||
1084 | static void | |
1085 | externalAclStats(StoreEntry * sentry) | |
1086 | { | |
f963b531 | 1087 | for (external_acl *p = Config.externalAclHelperList; p; p = p->next) { |
62e76326 | 1088 | storeAppendPrintf(sentry, "External ACL Statistics: %s\n", p->name); |
1089 | storeAppendPrintf(sentry, "Cache size: %d\n", p->cache->count); | |
bf3e8d5a AJ |
1090 | assert(p->theHelper); |
1091 | p->theHelper->packStatsInto(sentry); | |
62e76326 | 1092 | storeAppendPrintf(sentry, "\n"); |
d9572179 | 1093 | } |
1094 | } | |
1095 | ||
6b7d87bb FC |
1096 | static void |
1097 | externalAclRegisterWithCacheManager(void) | |
1098 | { | |
8822ebee | 1099 | Mgr::RegisterAction("external_acl", |
d9fc6862 A |
1100 | "External ACL stats", |
1101 | externalAclStats, 0, 1); | |
6b7d87bb FC |
1102 | } |
1103 | ||
d9572179 | 1104 | void |
1105 | externalAclInit(void) | |
1106 | { | |
f963b531 | 1107 | for (external_acl *p = Config.externalAclHelperList; p; p = p->next) { |
62e76326 | 1108 | if (!p->cache) |
30abd221 | 1109 | p->cache = hash_create((HASHCMP *) strcmp, hashPrime(1024), hash4); |
62e76326 | 1110 | |
1111 | if (!p->theHelper) | |
e05a9d51 | 1112 | p->theHelper = Helper::Client::Make("external_acl_type"); |
62e76326 | 1113 | |
1114 | p->theHelper->cmdline = p->cmdline; | |
1115 | ||
1af735c7 | 1116 | p->theHelper->childs.updateLimits(p->children); |
07eca7e0 | 1117 | |
62e76326 | 1118 | p->theHelper->ipc_type = IPC_TCP_SOCKET; |
1119 | ||
cc192b50 | 1120 | p->theHelper->addr = p->local_addr; |
1121 | ||
bd71920d | 1122 | p->theHelper->openSessions(); |
d9572179 | 1123 | } |
62e76326 | 1124 | |
ea391f18 | 1125 | externalAclRegisterWithCacheManager(); |
d9572179 | 1126 | } |
1127 | ||
1128 | void | |
1129 | externalAclShutdown(void) | |
1130 | { | |
1131 | external_acl *p; | |
62e76326 | 1132 | |
d9572179 | 1133 | for (p = Config.externalAclHelperList; p; p = p->next) { |
62e76326 | 1134 | helperShutdown(p->theHelper); |
d9572179 | 1135 | } |
1136 | } | |
225b7b10 | 1137 | |
e0f7153c | 1138 | /// Called when an async lookup returns |
225b7b10 | 1139 | void |
5fb6afec | 1140 | ACLExternal::LookupDone(void *data, const ExternalACLEntryPointer &result) |
225b7b10 | 1141 | { |
c0941a6a | 1142 | ACLFilledChecklist *checklist = Filled(static_cast<ACLChecklist*>(data)); |
abdd93d0 | 1143 | checklist->extacl_entry = result; |
5fb6afec | 1144 | checklist->resumeNonBlockingCheck(); |
225b7b10 | 1145 | } |
b0dd28ba | 1146 | |
aee3523a | 1147 | ACLExternal::ACLExternal(char const *theClass) : data(nullptr), class_(xstrdup(theClass)) |
b0dd28ba | 1148 | {} |
1149 | ||
b0dd28ba | 1150 | char const * |
1151 | ACLExternal::typeString() const | |
1152 | { | |
1153 | return class_; | |
1154 | } | |
1155 | ||
e870b1f8 | 1156 | bool |
1157 | ACLExternal::isProxyAuth() const | |
1158 | { | |
2f1431ea | 1159 | #if USE_AUTH |
e870b1f8 | 1160 | return data->def->require_auth; |
2f1431ea AJ |
1161 | #else |
1162 | return false; | |
1163 | #endif | |
e870b1f8 | 1164 | } |
f53969cc | 1165 |