2 * DEBUG: section 28 Access Control
6 #include "acl/Checklist.h"
9 #include "profiler/Profiler.h"
11 /// common parts of nonBlockingCheck() and resumeNonBlockingCheck()
13 ACLChecklist::prepNonBlocking()
18 checkCallback(ACCESS_DUNNO
); // the answer does not really matter
23 * If the accessList is no longer valid (i.e. its been
24 * freed because of a reconfigure), then bail with ACCESS_DUNNO.
27 if (!cbdataReferenceValid(accessList
)) {
28 cbdataReferenceDone(accessList
);
29 debugs(28, 4, "ACLChecklist::check: " << this << " accessList is invalid");
30 checkCallback(ACCESS_DUNNO
);
38 ACLChecklist::completeNonBlocking()
40 assert(!asyncInProgress());
45 cbdataReferenceDone(accessList
);
46 checkCallback(currentAnswer());
50 ACLChecklist::markFinished(const allow_t
&finalAnswer
, const char *reason
)
52 assert (!finished() && !asyncInProgress());
55 debugs(28, 3, HERE
<< this << " answer " << allow_
<< " for " << reason
);
58 /// Called first (and once) by all checks to initialize their state
60 ACLChecklist::preCheck(const char *what
)
62 debugs(28, 3, HERE
<< this << " checking " << what
);
64 // concurrent checks using the same Checklist are not supported
68 AclMatchedName
= NULL
;
73 ACLChecklist::matchChild(const Acl::InnerNode
*current
, Acl::Nodes::const_iterator pos
, const ACL
*child
)
75 assert(current
&& child
);
77 // Remember the current tree location to prevent "async loop" cases where
78 // the same child node wants to go async more than once.
79 matchLoc_
= Breadcrumb(current
, pos
);
81 // if there are any breadcrumbs left, then follow them on the way down
83 if (matchPath
.empty()) {
84 result
= child
->matches(this);
86 const Breadcrumb
top(matchPath
.top());
87 assert(child
== top
.parent
);
89 result
= top
.parent
->resumeMatchingAt(this, top
.position
);
92 if (asyncInProgress()) {
93 // We get here for node N that called goAsync() and then, as the call
94 // stack unwinds, for the nodes higher in the ACL tree that led to N.
95 matchPath
.push(Breadcrumb(current
, pos
));
105 ACLChecklist::goAsync(AsyncState
*state
)
108 assert(!asyncInProgress());
109 assert(matchLoc_
.parent
);
111 // TODO: add a once-in-a-while WARNING about fast directive using slow ACL?
113 debugs(28, 2, this << " a fast-only directive uses a slow ACL!");
117 // TODO: add a once-in-a-while WARNING about async loops?
118 if (matchLoc_
== asyncLoc_
) {
119 debugs(28, 2, this << " a slow ACL resumes by going async again!");
123 asyncLoc_
= matchLoc_
; // prevent async loops
125 asyncStage_
= asyncStarting
;
127 state
->checkForAsync(this); // this is supposed to go async
129 // Did AsyncState object actually go async? If not, tell the caller.
130 if (asyncStage_
!= asyncStarting
) {
131 assert(asyncStage_
== asyncFailed
);
132 asyncStage_
= asyncNone
; // sanity restored
136 // yes, we must pause until the async callback calls resumeNonBlockingCheck
137 asyncStage_
= asyncRunning
;
141 // ACLFilledChecklist overwrites this to unclock something before we
144 ACLChecklist::checkCallback(allow_t answer
)
148 debugs(28, 3, "ACLChecklist::checkCallback: " << this << " answer=" << answer
);
150 callback_
= callback
;
153 if (cbdataReferenceValidDone(callback_data
, &cbdata_
))
154 callback_(answer
, cbdata_
);
156 // not really meaningful just before delete, but here for completeness sake
162 ACLChecklist::ACLChecklist() :
165 callback_data (NULL
),
169 allow_(ACCESS_DENIED
),
170 asyncStage_(asyncNone
),
171 state_(NullState::Instance())
175 ACLChecklist::~ACLChecklist()
177 assert (!asyncInProgress());
179 cbdataReferenceDone(accessList
);
181 debugs(28, 4, "ACLChecklist::~ACLChecklist: destroyed " << this);
184 ACLChecklist::NullState
*
185 ACLChecklist::NullState::Instance()
191 ACLChecklist::NullState::checkForAsync(ACLChecklist
*) const
193 assert(false); // or the Checklist will never get out of the async state
196 ACLChecklist::NullState
ACLChecklist::NullState::_instance
;
199 ACLChecklist::changeState (AsyncState
*newState
)
201 /* only change from null to active and back again,
202 * not active to active.
203 * relax this once conversion to states is complete
206 assert (state_
== NullState::Instance() || newState
== NullState::Instance());
210 ACLChecklist::AsyncState
*
211 ACLChecklist::asyncState() const
217 * Kick off a non-blocking (slow) ACL access list test
219 * NP: this should probably be made Async now.
222 ACLChecklist::nonBlockingCheck(ACLCB
* callback_
, void *callback_data_
)
224 preCheck("slow rules");
225 callback
= callback_
;
226 callback_data
= cbdataReference(callback_data_
);
229 /** The ACL List should NEVER be NULL when calling this method.
230 * Always caller should check for NULL and handle appropriate to its needs first.
231 * We cannot select a sensible default for all callers here. */
232 if (accessList
== NULL
) {
233 debugs(28, DBG_CRITICAL
, "SECURITY ERROR: ACL " << this << " checked with nothing to match against!!");
234 checkCallback(ACCESS_DUNNO
);
238 if (prepNonBlocking()) {
239 matchAndFinish(); // calls markFinished() on success
240 if (!asyncInProgress())
241 completeNonBlocking();
242 } // else checkCallback() has been called
246 ACLChecklist::resumeNonBlockingCheck(AsyncState
*state
)
248 assert(asyncState() == state
);
249 changeState(NullState::Instance());
251 if (asyncStage_
== asyncStarting
) { // oops, we did not really go async
252 asyncStage_
= asyncFailed
; // goAsync() checks for that
253 // Do not fall through to resume checks from the async callback. Let
254 // the still-pending(!) goAsync() notice and notify its caller instead.
257 assert(asyncStage_
== asyncRunning
);
258 asyncStage_
= asyncNone
;
260 assert(!matchPath
.empty());
262 if (!prepNonBlocking())
263 return; // checkCallback() has been called
268 if (asyncInProgress())
269 assert(!matchPath
.empty()); // we have breadcrumbs to resume matching
271 completeNonBlocking();
274 /// performs (or resumes) an ACL tree match and, if successful, sets the action
276 ACLChecklist::matchAndFinish()
279 if (matchPath
.empty()) {
280 result
= accessList
->matches(this);
282 const Breadcrumb
top(matchPath
.top());
284 result
= top
.parent
->resumeMatchingAt(this, top
.position
);
287 if (result
) // the entire tree matched
288 markFinished(accessList
->winningAction(), "match");
292 ACLChecklist::fastCheck(const Acl::Tree
* list
)
294 PROF_start(aclCheckFast
);
296 preCheck("fast ACLs");
297 asyncCaller_
= false;
299 // Concurrent checks are not supported, but sequential checks are, and they
300 // may use a mixture of fastCheck(void) and fastCheck(list) calls.
301 const Acl::Tree
* const savedList
= accessList
;
303 accessList
= cbdataReference(list
);
305 // assume DENY/ALLOW on mis/matches due to action-free accessList
306 // matchAndFinish() takes care of the ALLOW case
307 if (accessList
&& cbdataReferenceValid(accessList
))
308 matchAndFinish(); // calls markFinished() on success
310 markFinished(ACCESS_DENIED
, "ACLs failed to match");
312 cbdataReferenceDone(accessList
);
313 accessList
= savedList
;
315 PROF_stop(aclCheckFast
);
316 return currentAnswer();
319 /* Warning: do not cbdata lock this here - it
320 * may be static or on the stack
323 ACLChecklist::fastCheck()
325 PROF_start(aclCheckFast
);
327 preCheck("fast rules");
328 asyncCaller_
= false;
330 debugs(28, 5, "aclCheckFast: list: " << accessList
);
331 const Acl::Tree
*acl
= cbdataReference(accessList
);
332 if (acl
!= NULL
&& cbdataReferenceValid(acl
)) {
333 matchAndFinish(); // calls markFinished() on success
335 // if finished (on a match or in exceptional cases), stop
337 cbdataReferenceDone(acl
);
339 PROF_stop(aclCheckFast
);
340 return currentAnswer();
343 // fall through for mismatch handling
346 // There were no rules to match or no rules matched
347 calcImplicitAnswer();
348 cbdataReferenceDone(acl
);
350 PROF_stop(aclCheckFast
);
352 return currentAnswer();
355 /// When no rules matched, the answer is the inversion of the last rule
356 /// action (or ACCESS_DUNNO if the reversal is not possible).
358 ACLChecklist::calcImplicitAnswer()
360 const allow_t lastAction
= (accessList
&& cbdataReferenceValid(accessList
)) ?
361 accessList
->lastAction() : allow_t(ACCESS_DUNNO
);
362 allow_t implicitRuleAnswer
= ACCESS_DUNNO
;
363 if (lastAction
== ACCESS_DENIED
) // reverse last seen "deny"
364 implicitRuleAnswer
= ACCESS_ALLOWED
;
365 else if (lastAction
== ACCESS_ALLOWED
) // reverse last seen "allow"
366 implicitRuleAnswer
= ACCESS_DENIED
;
367 // else we saw no rules and will respond with ACCESS_DUNNO
369 debugs(28, 3, HERE
<< this << " NO match found, last action " <<
370 lastAction
<< " so returning " << implicitRuleAnswer
);
371 markFinished(implicitRuleAnswer
, "implicit rule won");
375 ACLChecklist::callerGone()
377 return !cbdataReferenceValid(callback_data
);