src/acl/Acl.cc

   1 /*
   2  * DEBUG: section 28    Access Control
   3  *
   4  * SQUID Web Proxy Cache          http://www.squid-cache.org/
   5  * ----------------------------------------------------------
   6  *
   7  *  Squid is the result of efforts by numerous individuals from
   8  *  the Internet community; see the CONTRIBUTORS file for full
   9  *  details.   Many organizations have provided support for Squid's
  10  *  development; see the SPONSORS file for full details.  Squid is
  11  *  Copyrighted (C) 2001 by the Regents of the University of
  12  *  California; see the COPYRIGHT file for full details.  Squid
  13  *  incorporates software developed and/or copyrighted by other
  14  *  sources; see the CREDITS file for full details.
  15  *
  16  *  This program is free software; you can redistribute it and/or modify
  17  *  it under the terms of the GNU General Public License as published by
  18  *  the Free Software Foundation; either version 2 of the License, or
  19  *  (at your option) any later version.
  20  *
  21  *  This program is distributed in the hope that it will be useful,
  22  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  23  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  24  *  GNU General Public License for more details.
  25  *
  26  *  You should have received a copy of the GNU General Public License
  27  *  along with this program; if not, write to the Free Software
  28  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA.
  29  *
  30  */
  31 #include "squid.h"
  32 #include "acl/Acl.h"
  33 #include "acl/Checklist.h"
  34 #include "anyp/PortCfg.h"
  35 #include "cache_cf.h"
  36 #include "ConfigParser.h"
  37 #include "Debug.h"
  38 #include "dlink.h"
  39 #include "globals.h"
  40 #include "profiler/Profiler.h"
  41 #include "SquidConfig.h"
  42
  43 const ACLFlag ACLFlags::NoFlags[1] = {ACL_F_END};
  44
  45 const char *AclMatchedName = NULL;
  46
  47 bool ACLFlags::supported(const ACLFlag f) const
  48 {
  49     if (f == ACL_F_REGEX_CASE)
  50         return true;
  51     return (supported_.find(f) != std::string::npos);
  52 }
  53
  54 void
  55 ACLFlags::parseFlags()
  56 {
  57     char *nextToken;
  58     while ((nextToken = ConfigParser::strtokFile()) != NULL && nextToken[0] == '-') {
  59
  60         //if token is the "--" break flag
  61         if (strcmp(nextToken, "--") == 0)
  62             break;
  63
  64         for (const char *flg = nextToken+1; *flg!='\0'; flg++ ) {
  65             if (supported(*flg)) {
  66                 makeSet(*flg);
  67             } else {
  68                 debugs(28, 0, HERE << "Flag '" << *flg << "' not supported");
  69                 self_destruct();
  70             }
  71         }
  72     }
  73
  74     /*Regex code needs to parse -i file*/
  75     if ( isSet(ACL_F_REGEX_CASE))
  76         ConfigParser::strtokFilePutBack("-i");
  77
  78     if (nextToken != NULL && strcmp(nextToken, "--") != 0 )
  79         ConfigParser::strtokFileUndo();
  80 }
  81
  82 const char *
  83 ACLFlags::flagsStr() const
  84 {
  85     static char buf[64];
  86     if (flags_ == 0)
  87         return "";
  88
  89     char *s = buf;
  90     *s++ = '-';
  91     for (ACLFlag f = 'A'; f <= 'z'; f++) {
  92         // ACL_F_REGEX_CASE (-i) flag handled by ACLRegexData class, ignore
  93         if (isSet(f) && f != ACL_F_REGEX_CASE)
  94             *s++ = f;
  95     }
  96     *s = '\0';
  97     return buf;
  98 }
  99
 100 void *
 101 ACL::operator new (size_t byteCount)
 102 {
 103     fatal ("unusable ACL::new");
 104     return (void *)1;
 105 }
 106
 107 void
 108 ACL::operator delete (void *address)
 109 {
 110     fatal ("unusable ACL::delete");
 111 }
 112
 113 ACL *
 114 ACL::FindByName(const char *name)
 115 {
 116     ACL *a;
 117     debugs(28, 9, "ACL::FindByName '" << name << "'");
 118
 119     for (a = Config.aclList; a; a = a->next)
 120         if (!strcasecmp(a->name, name))
 121             return a;
 122
 123     debugs(28, 9, "ACL::FindByName found no match");
 124
 125     return NULL;
 126 }
 127
 128 ACL *
 129 ACL::Factory (char const *type)
 130 {
 131     ACL *result = Prototype::Factory (type);
 132
 133     if (!result)
 134         fatal ("Unknown acl type in ACL::Factory");
 135
 136     return result;
 137 }
 138
 139 ACL::ACL() :
 140         cfgline(NULL),
 141         next(NULL),
 142         registered(false)
 143 {
 144     *name = 0;
 145 }
 146
 147 bool ACL::valid () const
 148 {
 149     return true;
 150 }
 151
 152 bool
 153 ACL::matches(ACLChecklist *checklist) const
 154 {
 155     PROF_start(ACL_matches);
 156     debugs(28, 5, "checking " << name);
 157
 158     // XXX: AclMatchedName does not contain a matched ACL name when the acl
 159     // does not match. It contains the last (usually leaf) ACL name checked
 160     // (or is NULL if no ACLs were checked).
 161     AclMatchedName = name;
 162
 163     int result = 0;
 164     if (!checklist->hasRequest() && requiresRequest()) {
 165         debugs(28, DBG_IMPORTANT, "WARNING: " << name << " ACL is used in " <<
 166                "context without an HTTP request. Assuming mismatch.");
 167     } else if (!checklist->hasReply() && requiresReply()) {
 168         debugs(28, DBG_IMPORTANT, "WARNING: " << name << " ACL is used in " <<
 169                "context without an HTTP response. Assuming mismatch.");
 170     } else {
 171         // have to cast because old match() API is missing const
 172         result = const_cast<ACL*>(this)->match(checklist);
 173     }
 174
 175     const char *extra = checklist->asyncInProgress() ? " async" : "";
 176     debugs(28, 3, "checked: " << name << " = " << result << extra);
 177     PROF_stop(ACL_matches);
 178     return result == 1; // true for match; false for everything else
 179 }
 180
 181 void
 182 ACL::context(const char *aName, const char *aCfgLine)
 183 {
 184     name[0] = '\0';
 185     if (aName)
 186         xstrncpy(name, aName, ACL_NAME_SZ-1);
 187     safe_free(cfgline);
 188     if (aCfgLine)
 189         cfgline = xstrdup(aCfgLine);
 190 }
 191
 192 void
 193 ACL::ParseAclLine(ConfigParser &parser, ACL ** head)
 194 {
 195     /* we're already using strtok() to grok the line */
 196     char *t = NULL;
 197     ACL *A = NULL;
 198     LOCAL_ARRAY(char, aclname, ACL_NAME_SZ);
 199     int new_acl = 0;
 200
 201     /* snarf the ACL name */
 202
 203     if ((t = strtok(NULL, w_space)) == NULL) {
 204         debugs(28, DBG_CRITICAL, "aclParseAclLine: missing ACL name.");
 205         parser.destruct();
 206         return;
 207     }
 208
 209     if (strlen(t) >= ACL_NAME_SZ) {
 210         debugs(28, DBG_CRITICAL, "aclParseAclLine: aclParseAclLine: ACL name '" << t <<
 211                "' too long, max " << ACL_NAME_SZ - 1 << " characters supported");
 212         parser.destruct();
 213         return;
 214     }
 215
 216     xstrncpy(aclname, t, ACL_NAME_SZ);
 217     /* snarf the ACL type */
 218     const char *theType;
 219
 220     if ((theType = strtok(NULL, w_space)) == NULL) {
 221         debugs(28, DBG_CRITICAL, "aclParseAclLine: missing ACL type.");
 222         parser.destruct();
 223         return;
 224     }
 225
 226     // Is this ACL going to work?
 227     if (strcmp(theType, "myip") == 0) {
 228         AnyP::PortCfg *p = Config.Sockaddr.http;
 229         while (p) {
 230             // Bug 3239: not reliable when there is interception traffic coming
 231             if (p->flags.natIntercept)
 232                 debugs(28, DBG_CRITICAL, "WARNING: 'myip' ACL is not reliable for interception proxies. Please use 'myportname' instead.");
 233             p = p->next;
 234         }
 235         debugs(28, DBG_IMPORTANT, "UPGRADE: ACL 'myip' type is has been renamed to 'localip' and matches the IP the client connected to.");
 236         theType = "localip";
 237     } else if (strcmp(theType, "myport") == 0) {
 238         AnyP::PortCfg *p = Config.Sockaddr.http;
 239         while (p) {
 240             // Bug 3239: not reliable when there is interception traffic coming
 241             // Bug 3239: myport - not reliable (yet) when there is interception traffic coming
 242             if (p->flags.natIntercept)
 243                 debugs(28, DBG_CRITICAL, "WARNING: 'myport' ACL is not reliable for interception proxies. Please use 'myportname' instead.");
 244             p = p->next;
 245         }
 246         theType = "localport";
 247         debugs(28, DBG_IMPORTANT, "UPGRADE: ACL 'myport' type is has been renamed to 'localport' and matches the port the client connected to.");
 248     }
 249
 250     if (!Prototype::Registered(theType)) {
 251         debugs(28, DBG_CRITICAL, "FATAL: Invalid ACL type '" << theType << "'");
 252         // XXX: make this an ERROR and skip the ACL creation. We *may* die later when its use is attempted. Or may not.
 253         parser.destruct();
 254         return;
 255     }
 256
 257     if ((A = FindByName(aclname)) == NULL) {
 258         debugs(28, 3, "aclParseAclLine: Creating ACL '" << aclname << "'");
 259         A = ACL::Factory(theType);
 260         A->context(aclname, config_input_line);
 261         new_acl = 1;
 262     } else {
 263         if (strcmp (A->typeString(),theType) ) {
 264             debugs(28, DBG_CRITICAL, "aclParseAclLine: ACL '" << A->name << "' already exists with different type.");
 265             parser.destruct();
 266             return;
 267         }
 268
 269         debugs(28, 3, "aclParseAclLine: Appending to '" << aclname << "'");
 270         new_acl = 0;
 271     }
 272
 273     /*
 274      * Here we set AclMatchedName in case we need to use it in a
 275      * warning message in aclDomainCompare().
 276      */
 277     AclMatchedName = A->name;   /* ugly */
 278
 279     A->flags.parseFlags();
 280
 281     /*split the function here */
 282     A->parse();
 283
 284     /*
 285      * Clear AclMatchedName from our temporary hack
 286      */
 287     AclMatchedName = NULL;      /* ugly */
 288
 289     if (!new_acl)
 290         return;
 291
 292     if (A->empty()) {
 293         debugs(28, DBG_CRITICAL, "Warning: empty ACL: " << A->cfgline);
 294     }
 295
 296     if (!A->valid()) {
 297         fatalf("ERROR: Invalid ACL: %s\n",
 298                A->cfgline);
 299     }
 300
 301     /* append */
 302     assert(head && *head == Config.aclList);
 303     A->registered = true;
 304
 305     while (*head)
 306         head = &(*head)->next;
 307
 308     *head = A;
 309 }
 310
 311 bool
 312 ACL::isProxyAuth() const
 313 {
 314     return false;
 315 }
 316
 317 /* ACL result caching routines */
 318
 319 int
 320 ACL::matchForCache(ACLChecklist *checklist)
 321 {
 322     /* This is a fatal to ensure that cacheMatchAcl calls are _only_
 323      * made for supported acl types */
 324     fatal("aclCacheMatchAcl: unknown or unexpected ACL type");
 325     return 0;           /* NOTREACHED */
 326 }
 327
 328 /*
 329  * we lookup an acl's cached results, and if we cannot find the acl being
 330  * checked we check it and cache the result. This function is a template
 331  * method to support caching of multiple acl types.
 332  * Note that caching of time based acl's is not
 333  * wise in long lived caches (i.e. the auth_user proxy match cache)
 334  * RBC
 335  * TODO: does a dlink_list perform well enough? Kinkie
 336  */
 337 int
 338 ACL::cacheMatchAcl(dlink_list * cache, ACLChecklist *checklist)
 339 {
 340     acl_proxy_auth_match_cache *auth_match;
 341     dlink_node *link;
 342     link = cache->head;
 343
 344     while (link) {
 345         auth_match = (acl_proxy_auth_match_cache *)link->data;
 346
 347         if (auth_match->acl_data == this) {
 348             debugs(28, 4, "ACL::cacheMatchAcl: cache hit on acl '" << name << "' (" << this << ")");
 349             return auth_match->matchrv;
 350         }
 351
 352         link = link->next;
 353     }
 354
 355     auth_match = new acl_proxy_auth_match_cache();
 356     auth_match->matchrv = matchForCache (checklist);
 357     auth_match->acl_data = this;
 358     dlinkAddTail(auth_match, &auth_match->link, cache);
 359     debugs(28, 4, "ACL::cacheMatchAcl: miss for '" << name << "'. Adding result " << auth_match->matchrv);
 360     return auth_match->matchrv;
 361 }
 362
 363 void
 364 aclCacheMatchFlush(dlink_list * cache)
 365 {
 366     acl_proxy_auth_match_cache *auth_match;
 367     dlink_node *link, *tmplink;
 368     link = cache->head;
 369
 370     debugs(28, 8, "aclCacheMatchFlush called for cache " << cache);
 371
 372     while (link) {
 373         auth_match = (acl_proxy_auth_match_cache *)link->data;
 374         tmplink = link;
 375         link = link->next;
 376         dlinkDelete(tmplink, cache);
 377         delete auth_match;
 378     }
 379 }
 380
 381 bool
 382 ACL::requiresReply() const
 383 {
 384     return false;
 385 }
 386
 387 bool
 388 ACL::requiresRequest() const
 389 {
 390     return false;
 391 }
 392
 393 /*********************/
 394 /* Destroy functions */
 395 /*********************/
 396
 397 ACL::~ACL()
 398 {
 399     debugs(28, 3, "ACL::~ACL: '" << cfgline << "'");
 400     safe_free(cfgline);
 401     AclMatchedName = NULL; // in case it was pointing to our name
 402 }
 403
 404 ACL::Prototype::Prototype() : prototype (NULL), typeString (NULL) {}
 405
 406 ACL::Prototype::Prototype (ACL const *aPrototype, char const *aType) : prototype (aPrototype), typeString (aType)
 407 {
 408     registerMe ();
 409 }
 410
 411 Vector<ACL::Prototype const *> * ACL::Prototype::Registry;
 412 void *ACL::Prototype::Initialized;
 413
 414 bool
 415 ACL::Prototype::Registered(char const *aType)
 416 {
 417     debugs(28, 7, "ACL::Prototype::Registered: invoked for type " << aType);
 418
 419     for (iterator i = Registry->begin(); i != Registry->end(); ++i)
 420         if (!strcmp (aType, (*i)->typeString)) {
 421             debugs(28, 7, "ACL::Prototype::Registered:    yes");
 422             return true;
 423         }
 424
 425     debugs(28, 7, "ACL::Prototype::Registered:    no");
 426     return false;
 427 }
 428
 429 void
 430 ACL::Prototype::registerMe ()
 431 {
 432     if (!Registry || (Initialized != ((char *)Registry - 5))  ) {
 433         /* TODO: extract this */
 434         /* Not initialised */
 435         Registry = new Vector <ACL::Prototype const *>;
 436         Initialized = (char *)Registry - 5;
 437     }
 438
 439     if (Registered (typeString))
 440         fatalf ("Attempt to register %s twice", typeString);
 441
 442     Registry->push_back (this);
 443 }
 444
 445 ACL::Prototype::~Prototype()
 446 {
 447     // TODO: unregister me
 448 }
 449
 450 ACL *
 451 ACL::Prototype::Factory (char const *typeToClone)
 452 {
 453     debugs(28, 4, "ACL::Prototype::Factory: cloning an object for type '" << typeToClone << "'");
 454
 455     for (iterator i = Registry->begin(); i != Registry->end(); ++i)
 456         if (!strcmp (typeToClone, (*i)->typeString)) {
 457             ACL *A = (*i)->prototype->clone();
 458             A->flags = (*i)->prototype->flags;
 459             return A;
 460         }
 461
 462     debugs(28, 4, "ACL::Prototype::Factory: cloning failed, no type '" << typeToClone << "' available");
 463
 464     return NULL;
 465 }
 466
 467 void
 468 ACL::Initialize()
 469 {
 470     ACL *a = Config.aclList;
 471     debugs(53, 3, "ACL::Initialize");
 472
 473     while (a) {
 474         a->prepareForUse();
 475         a = a->next;
 476     }
 477 }