2 * Copyright (C) 1996-2014 The Squid Software Foundation and contributors
4 * Squid software is distributed under GPLv2+ license and includes
5 * contributions from numerous individuals and organizations.
6 * Please see the COPYING and CONTRIBUTORS files for details.
9 /* DEBUG: section 28 Access Control */
12 #include "acl/Checklist.h"
15 #include "profiler/Profiler.h"
17 /// common parts of nonBlockingCheck() and resumeNonBlockingCheck()
19 ACLChecklist::prepNonBlocking()
24 checkCallback(ACCESS_DUNNO
); // the answer does not really matter
29 * If the accessList is no longer valid (i.e. its been
30 * freed because of a reconfigure), then bail with ACCESS_DUNNO.
33 if (!cbdataReferenceValid(accessList
)) {
34 cbdataReferenceDone(accessList
);
35 debugs(28, 4, "ACLChecklist::check: " << this << " accessList is invalid");
36 checkCallback(ACCESS_DUNNO
);
44 ACLChecklist::completeNonBlocking()
46 assert(!asyncInProgress());
51 cbdataReferenceDone(accessList
);
52 checkCallback(currentAnswer());
56 ACLChecklist::markFinished(const allow_t
&finalAnswer
, const char *reason
)
58 assert (!finished() && !asyncInProgress());
61 debugs(28, 3, HERE
<< this << " answer " << allow_
<< " for " << reason
);
64 /// Called first (and once) by all checks to initialize their state
66 ACLChecklist::preCheck(const char *what
)
68 debugs(28, 3, HERE
<< this << " checking " << what
);
70 // concurrent checks using the same Checklist are not supported
75 AclMatchedName
= NULL
;
80 ACLChecklist::matchChild(const Acl::InnerNode
*current
, Acl::Nodes::const_iterator pos
, const ACL
*child
)
82 assert(current
&& child
);
84 // Remember the current tree location to prevent "async loop" cases where
85 // the same child node wants to go async more than once.
86 matchLoc_
= Breadcrumb(current
, pos
);
89 // if there are any breadcrumbs left, then follow them on the way down
91 if (matchPath
.empty()) {
92 result
= child
->matches(this);
94 const Breadcrumb
top(matchPath
.top());
95 assert(child
== top
.parent
);
97 result
= top
.parent
->resumeMatchingAt(this, top
.position
);
100 if (asyncInProgress()) {
101 // We get here for node N that called goAsync() and then, as the call
102 // stack unwinds, for the nodes higher in the ACL tree that led to N.
103 matchPath
.push(Breadcrumb(current
, pos
));
113 ACLChecklist::goAsync(AsyncState
*state
)
116 assert(!asyncInProgress());
117 assert(matchLoc_
.parent
);
119 // TODO: add a once-in-a-while WARNING about fast directive using slow ACL?
121 debugs(28, 2, this << " a fast-only directive uses a slow ACL!");
125 // TODO: add a once-in-a-while WARNING about async loops?
126 if (matchLoc_
== asyncLoc_
) {
127 debugs(28, 2, this << " a slow ACL resumes by going async again! (loop #" << asyncLoopDepth_
<< ")");
128 // external_acl_type may cause async auth lookup plus its own async check
129 // which has the appearance of a loop. Allow some retries.
130 // TODO: make it configurable and check BH retry attempts vs this check?
131 if (asyncLoopDepth_
> 5)
135 asyncLoc_
= matchLoc_
; // prevent async loops
138 asyncStage_
= asyncStarting
;
140 state
->checkForAsync(this); // this is supposed to go async
142 // Did AsyncState object actually go async? If not, tell the caller.
143 if (asyncStage_
!= asyncStarting
) {
144 assert(asyncStage_
== asyncFailed
);
145 asyncStage_
= asyncNone
; // sanity restored
149 // yes, we must pause until the async callback calls resumeNonBlockingCheck
150 asyncStage_
= asyncRunning
;
154 // ACLFilledChecklist overwrites this to unclock something before we
157 ACLChecklist::checkCallback(allow_t answer
)
161 debugs(28, 3, "ACLChecklist::checkCallback: " << this << " answer=" << answer
);
163 callback_
= callback
;
166 if (cbdataReferenceValidDone(callback_data
, &cbdata_
))
167 callback_(answer
, cbdata_
);
169 // not really meaningful just before delete, but here for completeness sake
175 ACLChecklist::ACLChecklist() :
178 callback_data (NULL
),
182 allow_(ACCESS_DENIED
),
183 asyncStage_(asyncNone
),
184 state_(NullState::Instance()),
189 ACLChecklist::~ACLChecklist()
191 assert (!asyncInProgress());
193 cbdataReferenceDone(accessList
);
195 debugs(28, 4, "ACLChecklist::~ACLChecklist: destroyed " << this);
198 ACLChecklist::NullState
*
199 ACLChecklist::NullState::Instance()
205 ACLChecklist::NullState::checkForAsync(ACLChecklist
*) const
207 assert(false); // or the Checklist will never get out of the async state
210 ACLChecklist::NullState
ACLChecklist::NullState::_instance
;
213 ACLChecklist::changeState (AsyncState
*newState
)
215 /* only change from null to active and back again,
216 * not active to active.
217 * relax this once conversion to states is complete
220 assert (state_
== NullState::Instance() || newState
== NullState::Instance());
224 ACLChecklist::AsyncState
*
225 ACLChecklist::asyncState() const
231 * Kick off a non-blocking (slow) ACL access list test
233 * NP: this should probably be made Async now.
236 ACLChecklist::nonBlockingCheck(ACLCB
* callback_
, void *callback_data_
)
238 preCheck("slow rules");
239 callback
= callback_
;
240 callback_data
= cbdataReference(callback_data_
);
243 /** The ACL List should NEVER be NULL when calling this method.
244 * Always caller should check for NULL and handle appropriate to its needs first.
245 * We cannot select a sensible default for all callers here. */
246 if (accessList
== NULL
) {
247 debugs(28, DBG_CRITICAL
, "SECURITY ERROR: ACL " << this << " checked with nothing to match against!!");
248 checkCallback(ACCESS_DUNNO
);
252 if (prepNonBlocking()) {
253 matchAndFinish(); // calls markFinished() on success
254 if (!asyncInProgress())
255 completeNonBlocking();
256 } // else checkCallback() has been called
260 ACLChecklist::resumeNonBlockingCheck(AsyncState
*state
)
262 assert(asyncState() == state
);
263 changeState(NullState::Instance());
265 if (asyncStage_
== asyncStarting
) { // oops, we did not really go async
266 asyncStage_
= asyncFailed
; // goAsync() checks for that
267 // Do not fall through to resume checks from the async callback. Let
268 // the still-pending(!) goAsync() notice and notify its caller instead.
271 assert(asyncStage_
== asyncRunning
);
272 asyncStage_
= asyncNone
;
274 assert(!matchPath
.empty());
276 if (!prepNonBlocking())
277 return; // checkCallback() has been called
282 if (asyncInProgress())
283 assert(!matchPath
.empty()); // we have breadcrumbs to resume matching
285 completeNonBlocking();
288 /// performs (or resumes) an ACL tree match and, if successful, sets the action
290 ACLChecklist::matchAndFinish()
293 if (matchPath
.empty()) {
294 result
= accessList
->matches(this);
296 const Breadcrumb
top(matchPath
.top());
298 result
= top
.parent
->resumeMatchingAt(this, top
.position
);
301 if (result
) // the entire tree matched
302 markFinished(accessList
->winningAction(), "match");
306 ACLChecklist::fastCheck(const Acl::Tree
* list
)
308 PROF_start(aclCheckFast
);
310 preCheck("fast ACLs");
311 asyncCaller_
= false;
313 // Concurrent checks are not supported, but sequential checks are, and they
314 // may use a mixture of fastCheck(void) and fastCheck(list) calls.
315 const Acl::Tree
* const savedList
= accessList
;
317 accessList
= cbdataReference(list
);
319 // assume DENY/ALLOW on mis/matches due to action-free accessList
320 // matchAndFinish() takes care of the ALLOW case
321 if (accessList
&& cbdataReferenceValid(accessList
))
322 matchAndFinish(); // calls markFinished() on success
324 markFinished(ACCESS_DENIED
, "ACLs failed to match");
326 cbdataReferenceDone(accessList
);
327 accessList
= savedList
;
329 PROF_stop(aclCheckFast
);
330 return currentAnswer();
333 /* Warning: do not cbdata lock this here - it
334 * may be static or on the stack
337 ACLChecklist::fastCheck()
339 PROF_start(aclCheckFast
);
341 preCheck("fast rules");
342 asyncCaller_
= false;
344 debugs(28, 5, "aclCheckFast: list: " << accessList
);
345 const Acl::Tree
*acl
= cbdataReference(accessList
);
346 if (acl
!= NULL
&& cbdataReferenceValid(acl
)) {
347 matchAndFinish(); // calls markFinished() on success
349 // if finished (on a match or in exceptional cases), stop
351 cbdataReferenceDone(acl
);
353 PROF_stop(aclCheckFast
);
354 return currentAnswer();
357 // fall through for mismatch handling
360 // There were no rules to match or no rules matched
361 calcImplicitAnswer();
362 cbdataReferenceDone(acl
);
364 PROF_stop(aclCheckFast
);
366 return currentAnswer();
369 /// When no rules matched, the answer is the inversion of the last rule
370 /// action (or ACCESS_DUNNO if the reversal is not possible).
372 ACLChecklist::calcImplicitAnswer()
374 const allow_t lastAction
= (accessList
&& cbdataReferenceValid(accessList
)) ?
375 accessList
->lastAction() : allow_t(ACCESS_DUNNO
);
376 allow_t implicitRuleAnswer
= ACCESS_DUNNO
;
377 if (lastAction
== ACCESS_DENIED
) // reverse last seen "deny"
378 implicitRuleAnswer
= ACCESS_ALLOWED
;
379 else if (lastAction
== ACCESS_ALLOWED
) // reverse last seen "allow"
380 implicitRuleAnswer
= ACCESS_DENIED
;
381 // else we saw no rules and will respond with ACCESS_DUNNO
383 debugs(28, 3, HERE
<< this << " NO match found, last action " <<
384 lastAction
<< " so returning " << implicitRuleAnswer
);
385 markFinished(implicitRuleAnswer
, "implicit rule won");
389 ACLChecklist::callerGone()
391 return !cbdataReferenceValid(callback_data
);