src/acl/Acl.cc

   1 /*
   2  * DEBUG: section 28    Access Control
   3  * AUTHOR: Duane Wessels
   4  *
   5  * SQUID Web Proxy Cache          http://www.squid-cache.org/
   6  * ----------------------------------------------------------
   7  *
   8  *  Squid is the result of efforts by numerous individuals from
   9  *  the Internet community; see the CONTRIBUTORS file for full
  10  *  details.   Many organizations have provided support for Squid's
  11  *  development; see the SPONSORS file for full details.  Squid is
  12  *  Copyrighted (C) 2001 by the Regents of the University of
  13  *  California; see the COPYRIGHT file for full details.  Squid
  14  *  incorporates software developed and/or copyrighted by other
  15  *  sources; see the CREDITS file for full details.
  16  *
  17  *  This program is free software; you can redistribute it and/or modify
  18  *  it under the terms of the GNU General Public License as published by
  19  *  the Free Software Foundation; either version 2 of the License, or
  20  *  (at your option) any later version.
  21  *
  22  *  This program is distributed in the hope that it will be useful,
  23  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  24  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  25  *  GNU General Public License for more details.
  26  *
  27  *  You should have received a copy of the GNU General Public License
  28  *  along with this program; if not, write to the Free Software
  29  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA.
  30  *
  31  */
  32 #include "squid.h"
  33 #include "acl/Acl.h"
  34 #include "acl/Checklist.h"
  35 #include "anyp/PortCfg.h"
  36 #include "cache_cf.h"
  37 #include "ConfigParser.h"
  38 #include "Debug.h"
  39 #include "dlink.h"
  40 #include "globals.h"
  41 #include "SquidConfig.h"
  42
  43 const ACLFlag ACLFlags::NoFlags[1] = {ACL_F_END};
  44
  45 const char *AclMatchedName = NULL;
  46
  47 bool ACLFlags::supported(const ACLFlag f) const
  48 {
  49     if (f == ACL_F_REGEX_CASE)
  50         return true;
  51     return (supported_.find(f) != std::string::npos);
  52 }
  53
  54 void
  55 ACLFlags::parseFlags()
  56 {
  57     char *nextToken;
  58     while ((nextToken = ConfigParser::strtokFile()) != NULL && nextToken[0] == '-') {
  59
  60         //if token is the "--" break flag
  61         if (strcmp(nextToken, "--") == 0)
  62             break;
  63
  64         for (const char *flg = nextToken+1; *flg!='\0'; flg++ ) {
  65             if (supported(*flg)) {
  66                 makeSet(*flg);
  67             } else {
  68                 debugs(28, 0, HERE << "Flag '" << *flg << "' not supported");
  69                 self_destruct();
  70             }
  71         }
  72     }
  73
  74     /*Regex code needs to parse -i file*/
  75     if ( isSet(ACL_F_REGEX_CASE))
  76         ConfigParser::strtokFilePutBack("-i");
  77
  78     if (nextToken != NULL && strcmp(nextToken, "--") != 0 )
  79         ConfigParser::strtokFileUndo();
  80 }
  81
  82 const char *
  83 ACLFlags::flagsStr() const
  84 {
  85     static char buf[64];
  86     if (flags_ == 0)
  87         return "";
  88
  89     char *s = buf;
  90     *s++ = '-';
  91     for (ACLFlag f = 'A'; f <= 'z'; f++) {
  92         // ACL_F_REGEX_CASE (-i) flag handled by ACLRegexData class, ignore
  93         if (isSet(f) && f != ACL_F_REGEX_CASE)
  94             *s++ = f;
  95     }
  96     *s = '\0';
  97     return buf;
  98 }
  99
 100 void *
 101 ACL::operator new (size_t byteCount)
 102 {
 103     fatal ("unusable ACL::new");
 104     return (void *)1;
 105 }
 106
 107 void
 108 ACL::operator delete (void *address)
 109 {
 110     fatal ("unusable ACL::delete");
 111 }
 112
 113 ACL *
 114 ACL::FindByName(const char *name)
 115 {
 116     ACL *a;
 117     debugs(28, 9, "ACL::FindByName '" << name << "'");
 118
 119     for (a = Config.aclList; a; a = a->next)
 120         if (!strcasecmp(a->name, name))
 121             return a;
 122
 123     debugs(28, 9, "ACL::FindByName found no match");
 124
 125     return NULL;
 126 }
 127
 128 ACL *
 129 ACL::Factory (char const *type)
 130 {
 131     ACL *result = Prototype::Factory (type);
 132
 133     if (!result)
 134         fatal ("Unknown acl type in ACL::Factory");
 135
 136     return result;
 137 }
 138
 139 ACL::ACL() :
 140         cfgline(NULL),
 141         next(NULL)
 142 {
 143     *name = 0;
 144 }
 145
 146 bool ACL::valid () const
 147 {
 148     return true;
 149 }
 150
 151 void
 152 ACL::ParseAclLine(ConfigParser &parser, ACL ** head)
 153 {
 154     /* we're already using strtok() to grok the line */
 155     char *t = NULL;
 156     ACL *A = NULL;
 157     LOCAL_ARRAY(char, aclname, ACL_NAME_SZ);
 158     int new_acl = 0;
 159
 160     /* snarf the ACL name */
 161
 162     if ((t = strtok(NULL, w_space)) == NULL) {
 163         debugs(28, DBG_CRITICAL, "aclParseAclLine: missing ACL name.");
 164         parser.destruct();
 165         return;
 166     }
 167
 168     if (strlen(t) >= ACL_NAME_SZ) {
 169         debugs(28, DBG_CRITICAL, "aclParseAclLine: aclParseAclLine: ACL name '" << t <<
 170                "' too long, max " << ACL_NAME_SZ - 1 << " characters supported");
 171         parser.destruct();
 172         return;
 173     }
 174
 175     xstrncpy(aclname, t, ACL_NAME_SZ);
 176     /* snarf the ACL type */
 177     const char *theType;
 178
 179     if ((theType = strtok(NULL, w_space)) == NULL) {
 180         debugs(28, DBG_CRITICAL, "aclParseAclLine: missing ACL type.");
 181         parser.destruct();
 182         return;
 183     }
 184
 185     // Is this ACL going to work?
 186     if (strcmp(theType, "myip") == 0) {
 187         AnyP::PortCfg *p = Config.Sockaddr.http;
 188         while (p) {
 189             // Bug 3239: not reliable when there is interception traffic coming
 190             if (p->flags.natIntercept)
 191                 debugs(28, DBG_CRITICAL, "WARNING: 'myip' ACL is not reliable for interception proxies. Please use 'myportname' instead.");
 192             p = p->next;
 193         }
 194         debugs(28, DBG_IMPORTANT, "UPGRADE: ACL 'myip' type is has been renamed to 'localip' and matches the IP the client connected to.");
 195         theType = "localip";
 196     } else if (strcmp(theType, "myport") == 0) {
 197         AnyP::PortCfg *p = Config.Sockaddr.http;
 198         while (p) {
 199             // Bug 3239: not reliable when there is interception traffic coming
 200             // Bug 3239: myport - not reliable (yet) when there is interception traffic coming
 201             if (p->flags.natIntercept)
 202                 debugs(28, DBG_CRITICAL, "WARNING: 'myport' ACL is not reliable for interception proxies. Please use 'myportname' instead.");
 203             p = p->next;
 204         }
 205         theType = "localport";
 206         debugs(28, DBG_IMPORTANT, "UPGRADE: ACL 'myport' type is has been renamed to 'localport' and matches the port the client connected to.");
 207     }
 208
 209     if (!Prototype::Registered(theType)) {
 210         debugs(28, DBG_CRITICAL, "FATAL: Invalid ACL type '" << theType << "'");
 211         // XXX: make this an ERROR and skip the ACL creation. We *may* die later when its use is attempted. Or may not.
 212         parser.destruct();
 213         return;
 214     }
 215
 216     if ((A = FindByName(aclname)) == NULL) {
 217         debugs(28, 3, "aclParseAclLine: Creating ACL '" << aclname << "'");
 218         A = ACL::Factory(theType);
 219         xstrncpy(A->name, aclname, ACL_NAME_SZ);
 220         A->cfgline = xstrdup(config_input_line);
 221         new_acl = 1;
 222     } else {
 223         if (strcmp (A->typeString(),theType) ) {
 224             debugs(28, DBG_CRITICAL, "aclParseAclLine: ACL '" << A->name << "' already exists with different type.");
 225             parser.destruct();
 226             return;
 227         }
 228
 229         debugs(28, 3, "aclParseAclLine: Appending to '" << aclname << "'");
 230         new_acl = 0;
 231     }
 232
 233     /*
 234      * Here we set AclMatchedName in case we need to use it in a
 235      * warning message in aclDomainCompare().
 236      */
 237     AclMatchedName = A->name;   /* ugly */
 238
 239     A->flags.parseFlags();
 240
 241     /*split the function here */
 242     A->parse();
 243
 244     /*
 245      * Clear AclMatchedName from our temporary hack
 246      */
 247     AclMatchedName = NULL;      /* ugly */
 248
 249     if (!new_acl)
 250         return;
 251
 252     if (A->empty()) {
 253         debugs(28, DBG_CRITICAL, "Warning: empty ACL: " << A->cfgline);
 254     }
 255
 256     if (!A->valid()) {
 257         fatalf("ERROR: Invalid ACL: %s\n",
 258                A->cfgline);
 259     }
 260
 261     /* append */
 262     while (*head)
 263         head = &(*head)->next;
 264
 265     *head = A;
 266 }
 267
 268 bool
 269 ACL::isProxyAuth() const
 270 {
 271     return false;
 272 }
 273
 274 ACLList::ACLList() : op (1), _acl (NULL), next (NULL)
 275 {}
 276
 277 void
 278 ACLList::negated(bool isNegated)
 279 {
 280     if (isNegated)
 281         op = 0;
 282     else
 283         op = 1;
 284 }
 285
 286 /* ACL result caching routines */
 287
 288 int
 289 ACL::matchForCache(ACLChecklist *checklist)
 290 {
 291     /* This is a fatal to ensure that cacheMatchAcl calls are _only_
 292      * made for supported acl types */
 293     fatal("aclCacheMatchAcl: unknown or unexpected ACL type");
 294     return 0;           /* NOTREACHED */
 295 }
 296
 297 /*
 298  * we lookup an acl's cached results, and if we cannot find the acl being
 299  * checked we check it and cache the result. This function is a template
 300  * method to support caching of multiple acl types.
 301  * Note that caching of time based acl's is not
 302  * wise in long lived caches (i.e. the auth_user proxy match cache)
 303  * RBC
 304  * TODO: does a dlink_list perform well enough? Kinkie
 305  */
 306 int
 307 ACL::cacheMatchAcl(dlink_list * cache, ACLChecklist *checklist)
 308 {
 309     acl_proxy_auth_match_cache *auth_match;
 310     dlink_node *link;
 311     link = cache->head;
 312
 313     while (link) {
 314         auth_match = (acl_proxy_auth_match_cache *)link->data;
 315
 316         if (auth_match->acl_data == this) {
 317             debugs(28, 4, "ACL::cacheMatchAcl: cache hit on acl '" << name << "' (" << this << ")");
 318             return auth_match->matchrv;
 319         }
 320
 321         link = link->next;
 322     }
 323
 324     auth_match = new acl_proxy_auth_match_cache();
 325     auth_match->matchrv = matchForCache (checklist);
 326     auth_match->acl_data = this;
 327     dlinkAddTail(auth_match, &auth_match->link, cache);
 328     debugs(28, 4, "ACL::cacheMatchAcl: miss for '" << name << "'. Adding result " << auth_match->matchrv);
 329     return auth_match->matchrv;
 330 }
 331
 332 void
 333 aclCacheMatchFlush(dlink_list * cache)
 334 {
 335     acl_proxy_auth_match_cache *auth_match;
 336     dlink_node *link, *tmplink;
 337     link = cache->head;
 338
 339     debugs(28, 8, "aclCacheMatchFlush called for cache " << cache);
 340
 341     while (link) {
 342         auth_match = (acl_proxy_auth_match_cache *)link->data;
 343         tmplink = link;
 344         link = link->next;
 345         dlinkDelete(tmplink, cache);
 346         delete auth_match;
 347     }
 348 }
 349
 350 bool
 351 ACL::requiresReply() const
 352 {
 353     return false;
 354 }
 355
 356 bool
 357 ACL::requiresRequest() const
 358 {
 359     return false;
 360 }
 361
 362 int
 363 ACL::checklistMatches(ACLChecklist *checklist)
 364 {
 365     int rv;
 366
 367     if (!checklist->hasRequest() && requiresRequest()) {
 368         debugs(28, DBG_IMPORTANT, "ACL::checklistMatches WARNING: '" << name << "' ACL is used but there is no HTTP request -- not matching.");
 369         return 0;
 370     }
 371
 372     if (!checklist->hasReply() && requiresReply()) {
 373         debugs(28, DBG_IMPORTANT, "ACL::checklistMatches WARNING: '" << name << "' ACL is used but there is no HTTP reply -- not matching.");
 374         return 0;
 375     }
 376
 377     debugs(28, 3, "ACL::checklistMatches: checking '" << name << "'");
 378     rv= match(checklist);
 379     debugs(28, 3, "ACL::ChecklistMatches: result for '" << name << "' is " << rv);
 380     return rv;
 381 }
 382
 383 bool
 384 ACLList::matches (ACLChecklist *checklist) const
 385 {
 386     assert (_acl);
 387     // XXX: AclMatchedName does not contain a matched ACL name when the acl
 388     // does not match (or contains stale name if no ACLs are checked). In
 389     // either case, we get misleading debugging and possibly incorrect error
 390     // messages. Unfortunately, deny_info's "when none http_access
 391     // lines match" exception essentially requires this mess.
 392     // TODO: Rework by using an acl-free deny_info for the no-match cases?
 393     AclMatchedName = _acl->name;
 394     debugs(28, 3, "ACLList::matches: checking " << (op ? null_string : "!") << _acl->name);
 395
 396     if (_acl->checklistMatches(checklist) != op) {
 397         debugs(28, 4, "ACLList::matches: result is false");
 398         return false;
 399     }
 400
 401     debugs(28, 4, "ACLList::matches: result is true");
 402     return true;
 403 }
 404
 405 /*********************/
 406 /* Destroy functions */
 407 /*********************/
 408
 409 ACL::~ACL()
 410 {
 411     debugs(28, 3, "ACL::~ACL: '" << cfgline << "'");
 412     safe_free(cfgline);
 413 }
 414
 415 /* to be split into separate files in the future */
 416
 417 CBDATA_CLASS_INIT(acl_access);
 418
 419 void *
 420 acl_access::operator new (size_t)
 421 {
 422     CBDATA_INIT_TYPE(acl_access);
 423     acl_access *result = cbdataAlloc(acl_access);
 424     return result;
 425 }
 426
 427 void
 428 acl_access::operator delete (void *address)
 429 {
 430     acl_access *t = static_cast<acl_access *>(address);
 431     cbdataFree(t);
 432 }
 433
 434 ACL::Prototype::Prototype() : prototype (NULL), typeString (NULL) {}
 435
 436 ACL::Prototype::Prototype (ACL const *aPrototype, char const *aType) : prototype (aPrototype), typeString (aType)
 437 {
 438     registerMe ();
 439 }
 440
 441 Vector<ACL::Prototype const *> * ACL::Prototype::Registry;
 442 void *ACL::Prototype::Initialized;
 443
 444 bool
 445 ACL::Prototype::Registered(char const *aType)
 446 {
 447     debugs(28, 7, "ACL::Prototype::Registered: invoked for type " << aType);
 448
 449     for (iterator i = Registry->begin(); i != Registry->end(); ++i)
 450         if (!strcmp (aType, (*i)->typeString)) {
 451             debugs(28, 7, "ACL::Prototype::Registered:    yes");
 452             return true;
 453         }
 454
 455     debugs(28, 7, "ACL::Prototype::Registered:    no");
 456     return false;
 457 }
 458
 459 void
 460 ACL::Prototype::registerMe ()
 461 {
 462     if (!Registry || (Initialized != ((char *)Registry - 5))  ) {
 463         /* TODO: extract this */
 464         /* Not initialised */
 465         Registry = new Vector <ACL::Prototype const *>;
 466         Initialized = (char *)Registry - 5;
 467     }
 468
 469     if (Registered (typeString))
 470         fatalf ("Attempt to register %s twice", typeString);
 471
 472     Registry->push_back (this);
 473 }
 474
 475 ACL::Prototype::~Prototype()
 476 {
 477     // TODO: unregister me
 478 }
 479
 480 ACL *
 481 ACL::Prototype::Factory (char const *typeToClone)
 482 {
 483     debugs(28, 4, "ACL::Prototype::Factory: cloning an object for type '" << typeToClone << "'");
 484
 485     for (iterator i = Registry->begin(); i != Registry->end(); ++i)
 486         if (!strcmp (typeToClone, (*i)->typeString)) {
 487             ACL *A = (*i)->prototype->clone();
 488             A->flags = (*i)->prototype->flags;
 489             return A;
 490         }
 491
 492     debugs(28, 4, "ACL::Prototype::Factory: cloning failed, no type '" << typeToClone << "' available");
 493
 494     return NULL;
 495 }
 496
 497 void
 498 ACL::Initialize()
 499 {
 500     ACL *a = Config.aclList;
 501     debugs(53, 3, "ACL::Initialize");
 502
 503     while (a) {
 504         a->prepareForUse();
 505         a = a->next;
 506     }
 507 }