src/external_acl.cc

   1
   2 /*
   3  * $Id$
   4  *
   5  * DEBUG: section 82    External ACL
   6  * AUTHOR: Henrik Nordstrom, MARA Systems AB
   7  *
   8  * SQUID Web Proxy Cache          http://www.squid-cache.org/
   9  * ----------------------------------------------------------
  10  *
  11  *  The contents of this file is Copyright (C) 2002 by MARA Systems AB,
  12  *  Sweden, unless otherwise is indicated in the specific function. The
  13  *  author gives his full permission to include this file into the Squid
  14  *  software product under the terms of the GNU General Public License as
  15  *  published by the Free Software Foundation; either version 2 of the
  16  *  License, or (at your option) any later version.
  17  *
  18  *  Squid is the result of efforts by numerous individuals from
  19  *  the Internet community; see the CONTRIBUTORS file for full
  20  *  details.   Many organizations have provided support for Squid's
  21  *  development; see the SPONSORS file for full details.  Squid is
  22  *  Copyrighted (C) 2001 by the Regents of the University of
  23  *  California; see the COPYRIGHT file for full details.  Squid
  24  *  incorporates software developed and/or copyrighted by other
  25  *  sources; see the CREDITS file for full details.
  26  *
  27  *  This program is free software; you can redistribute it and/or modify
  28  *  it under the terms of the GNU General Public License as published by
  29  *  the Free Software Foundation; either version 2 of the License, or
  30  *  (at your option) any later version.
  31  *
  32  *  This program is distributed in the hope that it will be useful,
  33  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  34  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  35  *  GNU General Public License for more details.
  36  *
  37  *  You should have received a copy of the GNU General Public License
  38  *  along with this program; if not, write to the Free Software
  39  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA.
  40  *
  41  */
  42
  43 #include "squid.h"
  44 #include "CacheManager.h"
  45 #include "ExternalACL.h"
  46 #include "ExternalACLEntry.h"
  47 #include "auth/UserRequest.h"
  48 #include "SquidTime.h"
  49 #include "Store.h"
  50 #include "fde.h"
  51 #include "acl/FilledChecklist.h"
  52 #include "acl/Acl.h"
  53 #if USE_IDENT
  54 #include "ident/AclIdent.h"
  55 #endif
  56 #include "client_side.h"
  57 #include "HttpRequest.h"
  58 #include "HttpReply.h"
  59 #include "auth/Acl.h"
  60 #include "auth/Gadgets.h"
  61 #include "helper.h"
  62 #include "MemBuf.h"
  63 #include "rfc1738.h"
  64 #include "URLScheme.h"
  65 #include "wordlist.h"
  66
  67 #ifndef DEFAULT_EXTERNAL_ACL_TTL
  68 #define DEFAULT_EXTERNAL_ACL_TTL 1 * 60 * 60
  69 #endif
  70 #ifndef DEFAULT_EXTERNAL_ACL_CHILDREN
  71 #define DEFAULT_EXTERNAL_ACL_CHILDREN 5
  72 #endif
  73
  74 typedef struct _external_acl_format external_acl_format;
  75
  76 static char *makeExternalAclKey(ACLFilledChecklist * ch, external_acl_data * acl_data);
  77 static void external_acl_cache_delete(external_acl * def, external_acl_entry * entry);
  78 static int external_acl_entry_expired(external_acl * def, external_acl_entry * entry);
  79 static int external_acl_grace_expired(external_acl * def, external_acl_entry * entry);
  80 static void external_acl_cache_touch(external_acl * def, external_acl_entry * entry);
  81 static external_acl_entry *external_acl_cache_add(external_acl * def, const char *key, ExternalACLEntryData const &data);
  82
  83 /******************************************************************
  84  * external_acl directive
  85  */
  86
  87 class external_acl
  88 {
  89
  90 public:
  91     external_acl *next;
  92
  93     void add
  94     (ExternalACLEntry *);
  95
  96     void trimCache();
  97
  98     int ttl;
  99
 100     int negative_ttl;
 101
 102     int grace;
 103
 104     char *name;
 105
 106     external_acl_format *format;
 107
 108     wordlist *cmdline;
 109
 110     HelperChildConfig children;
 111
 112     helper *theHelper;
 113
 114     hash_table *cache;
 115
 116     dlink_list lru_list;
 117
 118     int cache_size;
 119
 120     int cache_entries;
 121
 122     dlink_list queue;
 123
 124     bool require_auth;
 125
 126     enum {
 127         QUOTE_METHOD_SHELL = 1,
 128         QUOTE_METHOD_URL
 129     } quote;
 130
 131     Ip::Address local_addr;
 132 };
 133
 134 struct _external_acl_format {
 135     enum format_type {
 136         EXT_ACL_UNKNOWN,
 137         EXT_ACL_LOGIN,
 138 #if USE_IDENT
 139         EXT_ACL_IDENT,
 140 #endif
 141         EXT_ACL_SRC,
 142         EXT_ACL_SRCPORT,
 143 #if USE_SQUID_EUI
 144         EXT_ACL_SRCEUI48,
 145         EXT_ACL_SRCEUI64,
 146 #endif
 147         EXT_ACL_MYADDR,
 148         EXT_ACL_MYPORT,
 149         EXT_ACL_URI,
 150         EXT_ACL_DST,
 151         EXT_ACL_PROTO,
 152         EXT_ACL_PORT,
 153         EXT_ACL_PATH,
 154         EXT_ACL_METHOD,
 155
 156         EXT_ACL_HEADER_REQUEST,
 157         EXT_ACL_HEADER_REQUEST_MEMBER,
 158         EXT_ACL_HEADER_REQUEST_ID,
 159         EXT_ACL_HEADER_REQUEST_ID_MEMBER,
 160
 161         EXT_ACL_HEADER_REPLY,
 162         EXT_ACL_HEADER_REPLY_MEMBER,
 163         EXT_ACL_HEADER_REPLY_ID,
 164         EXT_ACL_HEADER_REPLY_ID_MEMBER,
 165
 166 #if USE_SSL
 167         EXT_ACL_USER_CERT,
 168         EXT_ACL_CA_CERT,
 169         EXT_ACL_USER_CERT_RAW,
 170         EXT_ACL_USER_CERTCHAIN_RAW,
 171 #endif
 172         EXT_ACL_EXT_USER,
 173         EXT_ACL_END
 174     } type;
 175     external_acl_format *next;
 176     char *header;
 177     char *member;
 178     char separator;
 179     http_hdr_type header_id;
 180 };
 181
 182 /* FIXME: These are not really cbdata, but it is an easy way
 183  * to get them pooled, refcounted, accounted and freed properly...
 184  */
 185 CBDATA_TYPE(external_acl);
 186 CBDATA_TYPE(external_acl_format);
 187
 188 static void
 189 free_external_acl_format(void *data)
 190 {
 191     external_acl_format *p = static_cast<external_acl_format *>(data);
 192     safe_free(p->header);
 193 }
 194
 195 static void
 196 free_external_acl(void *data)
 197 {
 198     external_acl *p = static_cast<external_acl *>(data);
 199     safe_free(p->name);
 200
 201     while (p->format) {
 202         external_acl_format *f = p->format;
 203         p->format = f->next;
 204         cbdataFree(f);
 205     }
 206
 207     wordlistDestroy(&p->cmdline);
 208
 209     if (p->theHelper) {
 210         helperShutdown(p->theHelper);
 211         delete p->theHelper;
 212         p->theHelper = NULL;
 213     }
 214
 215     while (p->lru_list.tail)
 216         external_acl_cache_delete(p, static_cast<external_acl_entry *>(p->lru_list.tail->data));
 217     if (p->cache)
 218         hashFreeMemory(p->cache);
 219 }
 220
 221 /**
 222  * Parse the External ACL format %<{.*} and %>{.*} token(s) to pass a specific
 223  * request or reply header to external helper.
 224  *
 225  \param header   - the token being parsed (without the identifying prefix)
 226  \param type     - format enum identifier for this element, pulled from identifying prefix
 227  \param format   - structure to contain all the info about this format element.
 228  */
 229 void
 230 parse_header_token(external_acl_format *format, char *header, const _external_acl_format::format_type type)
 231 {
 232     /* header format */
 233     char *member, *end;
 234
 235     /** Cut away the closing brace */
 236     end = strchr(header, '}');
 237     if (end && strlen(end) == 1)
 238         *end = '\0';
 239     else
 240         self_destruct();
 241
 242     member = strchr(header, ':');
 243
 244     if (member) {
 245         /* Split in header and member */
 246         *member++ = '\0';
 247
 248         if (!xisalnum(*member))
 249             format->separator = *member++;
 250         else
 251             format->separator = ',';
 252
 253         format->member = xstrdup(member);
 254
 255         if (type == _external_acl_format::EXT_ACL_HEADER_REQUEST)
 256             format->type = _external_acl_format::EXT_ACL_HEADER_REQUEST_MEMBER;
 257         else
 258             format->type = _external_acl_format::EXT_ACL_HEADER_REQUEST_MEMBER;
 259     } else {
 260         format->type = type;
 261     }
 262
 263     format->header = xstrdup(header);
 264     format->header_id = httpHeaderIdByNameDef(header, strlen(header));
 265
 266     if (format->header_id != -1) {
 267         if (member) {
 268             if (type == _external_acl_format::EXT_ACL_HEADER_REQUEST)
 269                 format->type = _external_acl_format::EXT_ACL_HEADER_REQUEST_ID_MEMBER;
 270             else
 271                 format->type = _external_acl_format::EXT_ACL_HEADER_REPLY_ID_MEMBER;
 272         } else {
 273             if (type == _external_acl_format::EXT_ACL_HEADER_REQUEST)
 274                 format->type = _external_acl_format::EXT_ACL_HEADER_REQUEST_ID;
 275             else
 276                 format->type = _external_acl_format::EXT_ACL_HEADER_REPLY_ID;
 277         }
 278     }
 279 }
 280
 281 void
 282 parse_externalAclHelper(external_acl ** list)
 283 {
 284     external_acl *a;
 285     char *token;
 286     external_acl_format **p;
 287
 288     CBDATA_INIT_TYPE_FREECB(external_acl, free_external_acl);
 289     CBDATA_INIT_TYPE_FREECB(external_acl_format, free_external_acl_format);
 290
 291     a = cbdataAlloc(external_acl);
 292
 293     /* set defaults */
 294     a->ttl = DEFAULT_EXTERNAL_ACL_TTL;
 295     a->negative_ttl = -1;
 296     a->cache_size = 256*1024;
 297     a->children.n_max = DEFAULT_EXTERNAL_ACL_CHILDREN;
 298     a->children.n_startup = a->children.n_max;
 299     a->children.n_idle = 1;
 300     a->local_addr.SetLocalhost();
 301     a->quote = external_acl::QUOTE_METHOD_URL;
 302
 303     token = strtok(NULL, w_space);
 304
 305     if (!token)
 306         self_destruct();
 307
 308     a->name = xstrdup(token);
 309
 310     token = strtok(NULL, w_space);
 311
 312     /* Parse options */
 313     while (token) {
 314         if (strncmp(token, "ttl=", 4) == 0) {
 315             a->ttl = atoi(token + 4);
 316         } else if (strncmp(token, "negative_ttl=", 13) == 0) {
 317             a->negative_ttl = atoi(token + 13);
 318         } else if (strncmp(token, "children=", 9) == 0) {
 319             a->children.n_max = atoi(token + 9);
 320             debugs(0, 0, "WARNING: external_acl_type option children=N has been deprecated in favor of children-max=N and children-startup=N");
 321         } else if (strncmp(token, "children-max=", 13) == 0) {
 322             a->children.n_max = atoi(token + 13);
 323         } else if (strncmp(token, "children-startup=", 17) == 0) {
 324             a->children.n_startup = atoi(token + 17);
 325         } else if (strncmp(token, "children-idle=", 14) == 0) {
 326             a->children.n_idle = atoi(token + 14);
 327         } else if (strncmp(token, "concurrency=", 12) == 0) {
 328             a->children.concurrency = atoi(token + 12);
 329         } else if (strncmp(token, "cache=", 6) == 0) {
 330             a->cache_size = atoi(token + 6);
 331         } else if (strncmp(token, "grace=", 6) == 0) {
 332             a->grace = atoi(token + 6);
 333         } else if (strcmp(token, "protocol=2.5") == 0) {
 334             a->quote = external_acl::QUOTE_METHOD_SHELL;
 335         } else if (strcmp(token, "protocol=3.0") == 0) {
 336             a->quote = external_acl::QUOTE_METHOD_URL;
 337         } else if (strcmp(token, "quote=url") == 0) {
 338             a->quote = external_acl::QUOTE_METHOD_URL;
 339         } else if (strcmp(token, "quote=shell") == 0) {
 340             a->quote = external_acl::QUOTE_METHOD_SHELL;
 341
 342             /* INET6: allow admin to configure some helpers explicitly to
 343                       bind to IPv4/v6 localhost port. */
 344         } else if (strcmp(token, "ipv4") == 0) {
 345             if ( !a->local_addr.SetIPv4() ) {
 346                 debugs(3, 0, "WARNING: Error converting " << a->local_addr << " to IPv4 in " << a->name );
 347             }
 348         } else if (strcmp(token, "ipv6") == 0) {
 349 #if !USE_IPV6
 350             debugs(3, 0, "WARNING: --enable-ipv6 required for external ACL helpers to use IPv6: " << a->name );
 351 #else
 352             (void)0;
 353 #endif
 354         } else {
 355             break;
 356         }
 357
 358         token = strtok(NULL, w_space);
 359     }
 360
 361     /* check that child startup value is sane. */
 362     if (a->children.n_startup > a->children.n_max)
 363         a->children.n_startup = a->children.n_max;
 364
 365     /* check that child idle value is sane. */
 366     if (a->children.n_idle > a->children.n_max)
 367         a->children.n_idle = a->children.n_max;
 368     if (a->children.n_idle < 1)
 369         a->children.n_idle = 1;
 370
 371     if (a->negative_ttl == -1)
 372         a->negative_ttl = a->ttl;
 373
 374     /* Parse format */
 375     p = &a->format;
 376
 377     while (token) {
 378         external_acl_format *format;
 379
 380         /* stop on first non-format token found */
 381
 382         if (*token != '%')
 383             break;
 384
 385         format = cbdataAlloc(external_acl_format);
 386
 387         if (strncmp(token, "%{", 2) == 0) {
 388             // deprecated. but assume the old configs all referred to request headers.
 389             debugs(82, DBG_IMPORTANT, "WARNING: external_acl_type format %{...} is being replaced by %>{...} for : " << token);
 390             parse_header_token(format, (token+2), _external_acl_format::EXT_ACL_HEADER_REQUEST);
 391         } else if (strncmp(token, "%>{", 3) == 0) {
 392             parse_header_token(format, (token+3), _external_acl_format::EXT_ACL_HEADER_REQUEST);
 393         } else if (strncmp(token, "%<{", 3) == 0) {
 394             parse_header_token(format, (token+3), _external_acl_format::EXT_ACL_HEADER_REPLY);
 395         } else if (strcmp(token, "%LOGIN") == 0) {
 396             format->type = _external_acl_format::EXT_ACL_LOGIN;
 397             a->require_auth = true;
 398         }
 399
 400 #if USE_IDENT
 401         else if (strcmp(token, "%IDENT") == 0)
 402             format->type = _external_acl_format::EXT_ACL_IDENT;
 403
 404 #endif
 405
 406         else if (strcmp(token, "%SRC") == 0)
 407             format->type = _external_acl_format::EXT_ACL_SRC;
 408         else if (strcmp(token, "%SRCPORT") == 0)
 409             format->type = _external_acl_format::EXT_ACL_SRCPORT;
 410 #if USE_SQUID_EUI
 411         else if (strcmp(token, "%SRCEUI48") == 0)
 412             format->type = _external_acl_format::EXT_ACL_SRCEUI48;
 413         else if (strcmp(token, "%SRCEUI64") == 0)
 414             format->type = _external_acl_format::EXT_ACL_SRCEUI64;
 415 #endif
 416         else if (strcmp(token, "%MYADDR") == 0)
 417             format->type = _external_acl_format::EXT_ACL_MYADDR;
 418         else if (strcmp(token, "%MYPORT") == 0)
 419             format->type = _external_acl_format::EXT_ACL_MYPORT;
 420         else if (strcmp(token, "%URI") == 0)
 421             format->type = _external_acl_format::EXT_ACL_URI;
 422         else if (strcmp(token, "%DST") == 0)
 423             format->type = _external_acl_format::EXT_ACL_DST;
 424         else if (strcmp(token, "%PROTO") == 0)
 425             format->type = _external_acl_format::EXT_ACL_PROTO;
 426         else if (strcmp(token, "%PORT") == 0)
 427             format->type = _external_acl_format::EXT_ACL_PORT;
 428         else if (strcmp(token, "%PATH") == 0)
 429             format->type = _external_acl_format::EXT_ACL_PATH;
 430         else if (strcmp(token, "%METHOD") == 0)
 431             format->type = _external_acl_format::EXT_ACL_METHOD;
 432
 433 #if USE_SSL
 434         else if (strcmp(token, "%USER_CERT") == 0)
 435             format->type = _external_acl_format::EXT_ACL_USER_CERT_RAW;
 436         else if (strcmp(token, "%USER_CERTCHAIN") == 0)
 437             format->type = _external_acl_format::EXT_ACL_USER_CERTCHAIN_RAW;
 438         else if (strncmp(token, "%USER_CERT_", 11) == 0) {
 439             format->type = _external_acl_format::EXT_ACL_USER_CERT;
 440             format->header = xstrdup(token + 11);
 441         } else if (strncmp(token, "%CA_CERT_", 11) == 0) {
 442             format->type = _external_acl_format::EXT_ACL_USER_CERT;
 443             format->header = xstrdup(token + 11);
 444         }
 445 #endif
 446         else if (strcmp(token, "%EXT_USER") == 0)
 447             format->type = _external_acl_format::EXT_ACL_EXT_USER;
 448         else {
 449             debugs(0,0, "ERROR: Unknown Format token " << token);
 450             self_destruct();
 451         }
 452
 453         *p = format;
 454         p = &format->next;
 455         token = strtok(NULL, w_space);
 456     }
 457
 458     /* There must be at least one format token */
 459     if (!a->format)
 460         self_destruct();
 461
 462     /* helper */
 463     if (!token)
 464         self_destruct();
 465
 466     wordlistAdd(&a->cmdline, token);
 467
 468     /* arguments */
 469     parse_wordlist(&a->cmdline);
 470
 471     while (*list)
 472         list = &(*list)->next;
 473
 474     *list = a;
 475 }
 476
 477 void
 478 dump_externalAclHelper(StoreEntry * sentry, const char *name, const external_acl * list)
 479 {
 480     const external_acl *node;
 481     const external_acl_format *format;
 482     const wordlist *word;
 483
 484     for (node = list; node; node = node->next) {
 485         storeAppendPrintf(sentry, "%s %s", name, node->name);
 486
 487         if (!node->local_addr.IsIPv6())
 488             storeAppendPrintf(sentry, " ipv4");
 489         else
 490             storeAppendPrintf(sentry, " ipv6");
 491
 492         if (node->ttl != DEFAULT_EXTERNAL_ACL_TTL)
 493             storeAppendPrintf(sentry, " ttl=%d", node->ttl);
 494
 495         if (node->negative_ttl != node->ttl)
 496             storeAppendPrintf(sentry, " negative_ttl=%d", node->negative_ttl);
 497
 498         if (node->grace)
 499             storeAppendPrintf(sentry, " grace=%d", node->grace);
 500
 501         if (node->children.n_max != DEFAULT_EXTERNAL_ACL_CHILDREN)
 502             storeAppendPrintf(sentry, " children-max=%d", node->children.n_max);
 503
 504         if (node->children.n_startup != 1)
 505             storeAppendPrintf(sentry, " children-startup=%d", node->children.n_startup);
 506
 507         if (node->children.n_idle != (node->children.n_max + node->children.n_startup) )
 508             storeAppendPrintf(sentry, " children-idle=%d", node->children.n_idle);
 509
 510         if (node->children.concurrency)
 511             storeAppendPrintf(sentry, " concurrency=%d", node->children.concurrency);
 512
 513         if (node->cache)
 514             storeAppendPrintf(sentry, " cache=%d", node->cache_size);
 515
 516         for (format = node->format; format; format = format->next) {
 517             switch (format->type) {
 518
 519             case _external_acl_format::EXT_ACL_HEADER_REQUEST:
 520             case _external_acl_format::EXT_ACL_HEADER_REQUEST_ID:
 521                 storeAppendPrintf(sentry, " %%>{%s}", format->header);
 522                 break;
 523
 524             case _external_acl_format::EXT_ACL_HEADER_REQUEST_MEMBER:
 525             case _external_acl_format::EXT_ACL_HEADER_REQUEST_ID_MEMBER:
 526                 storeAppendPrintf(sentry, " %%>{%s:%s}", format->header, format->member);
 527                 break;
 528
 529             case _external_acl_format::EXT_ACL_HEADER_REPLY:
 530             case _external_acl_format::EXT_ACL_HEADER_REPLY_ID:
 531                 storeAppendPrintf(sentry, " %%<{%s}", format->header);
 532                 break;
 533
 534             case _external_acl_format::EXT_ACL_HEADER_REPLY_MEMBER:
 535             case _external_acl_format::EXT_ACL_HEADER_REPLY_ID_MEMBER:
 536                 storeAppendPrintf(sentry, " %%<{%s:%s}", format->header, format->member);
 537                 break;
 538 #define DUMP_EXT_ACL_TYPE(a) \
 539             case _external_acl_format::EXT_ACL_##a: \
 540                 storeAppendPrintf(sentry, " %%%s", #a); \
 541                 break
 542
 543                 DUMP_EXT_ACL_TYPE(LOGIN);
 544 #if USE_IDENT
 545
 546                 DUMP_EXT_ACL_TYPE(IDENT);
 547 #endif
 548
 549                 DUMP_EXT_ACL_TYPE(SRC);
 550                 DUMP_EXT_ACL_TYPE(SRCPORT);
 551 #if USE_SQUID_EUI
 552                 DUMP_EXT_ACL_TYPE(SRCEUI48);
 553                 DUMP_EXT_ACL_TYPE(SRCEUI64);
 554 #endif
 555
 556                 DUMP_EXT_ACL_TYPE(MYADDR);
 557                 DUMP_EXT_ACL_TYPE(MYPORT);
 558                 DUMP_EXT_ACL_TYPE(URI);
 559                 DUMP_EXT_ACL_TYPE(DST);
 560                 DUMP_EXT_ACL_TYPE(PROTO);
 561                 DUMP_EXT_ACL_TYPE(PORT);
 562                 DUMP_EXT_ACL_TYPE(PATH);
 563                 DUMP_EXT_ACL_TYPE(METHOD);
 564 #if USE_SSL
 565
 566             case _external_acl_format::EXT_ACL_USER_CERT_RAW:
 567                 storeAppendPrintf(sentry, " %%USER_CERT");
 568                 break;
 569
 570             case _external_acl_format::EXT_ACL_USER_CERTCHAIN_RAW:
 571                 storeAppendPrintf(sentry, " %%USER_CERTCHAIN");
 572                 break;
 573
 574             case _external_acl_format::EXT_ACL_USER_CERT:
 575                 storeAppendPrintf(sentry, " %%USER_CERT_%s", format->header);
 576                 break;
 577
 578             case _external_acl_format::EXT_ACL_CA_CERT:
 579                 storeAppendPrintf(sentry, " %%USER_CERT_%s", format->header);
 580                 break;
 581 #endif
 582
 583                 DUMP_EXT_ACL_TYPE(EXT_USER);
 584
 585             default:
 586                 fatal("unknown external_acl format error");
 587                 break;
 588             }
 589         }
 590
 591         for (word = node->cmdline; word; word = word->next)
 592             storeAppendPrintf(sentry, " %s", word->key);
 593
 594         storeAppendPrintf(sentry, "\n");
 595     }
 596 }
 597
 598 void
 599 free_externalAclHelper(external_acl ** list)
 600 {
 601     while (*list) {
 602         external_acl *node = *list;
 603         *list = node->next;
 604         node->next = NULL;
 605         cbdataFree(node);
 606     }
 607 }
 608
 609 static external_acl *
 610 find_externalAclHelper(const char *name)
 611 {
 612     external_acl *node;
 613
 614     for (node = Config.externalAclHelperList; node; node = node->next) {
 615         if (strcmp(node->name, name) == 0)
 616             return node;
 617     }
 618
 619     return NULL;
 620 }
 621
 622 void
 623
 624 external_acl::add
 625 (ExternalACLEntry *anEntry)
 626 {
 627     trimCache();
 628     assert (anEntry->def == NULL);
 629     anEntry->def = this;
 630     hash_join(cache, anEntry);
 631     dlinkAdd(anEntry, &anEntry->lru, &lru_list);
 632     cache_entries++;
 633 }
 634
 635 void
 636 external_acl::trimCache()
 637 {
 638     if (cache_size && cache_entries >= cache_size)
 639         external_acl_cache_delete(this, static_cast<external_acl_entry *>(lru_list.tail->data));
 640 }
 641
 642
 643 /******************************************************************
 644  * external acl type
 645  */
 646
 647 struct _external_acl_data {
 648     external_acl *def;
 649     wordlist *arguments;
 650 };
 651
 652 CBDATA_TYPE(external_acl_data);
 653 static void
 654 free_external_acl_data(void *data)
 655 {
 656     external_acl_data *p = static_cast<external_acl_data *>(data);
 657     wordlistDestroy(&p->arguments);
 658     cbdataReferenceDone(p->def);
 659 }
 660
 661 void
 662 ACLExternal::parse()
 663 {
 664     char *token;
 665
 666     if (data)
 667         self_destruct();
 668
 669     CBDATA_INIT_TYPE_FREECB(external_acl_data, free_external_acl_data);
 670
 671     data = cbdataAlloc(external_acl_data);
 672
 673     token = strtok(NULL, w_space);
 674
 675     if (!token)
 676         self_destruct();
 677
 678     data->def = cbdataReference(find_externalAclHelper(token));
 679
 680     if (!data->def)
 681         self_destruct();
 682
 683     while ((token = strtokFile())) {
 684         wordlistAdd(&data->arguments, token);
 685     }
 686 }
 687
 688 bool
 689 ACLExternal::valid () const
 690 {
 691     if (data->def->require_auth) {
 692         if (authenticateSchemeCount() == 0) {
 693             debugs(28, 0, "Can't use proxy auth because no authentication schemes were compiled.");
 694             return false;
 695         }
 696
 697         if (authenticateActiveSchemeCount() == 0) {
 698             debugs(28, 0, "Can't use proxy auth because no authentication schemes are fully configured.");
 699             return false;
 700         }
 701     }
 702
 703     return true;
 704 }
 705
 706 bool
 707 ACLExternal::empty () const
 708 {
 709     return false;
 710 }
 711
 712 ACLExternal::~ACLExternal()
 713 {
 714     cbdataFree(data);
 715     safe_free (class_);
 716 }
 717
 718 static int
 719 aclMatchExternal(external_acl_data *acl, ACLFilledChecklist *ch)
 720 {
 721     int result;
 722     external_acl_entry *entry;
 723     const char *key = "";
 724     debugs(82, 9, "aclMatchExternal: acl=\"" << acl->def->name << "\"");
 725     entry = ch->extacl_entry;
 726
 727     if (entry) {
 728         if (cbdataReferenceValid(entry) && entry->def == acl->def &&
 729                 strcmp((char *)entry->key, key) == 0) {
 730             /* Ours, use it.. */
 731         } else {
 732             /* Not valid, or not ours.. get rid of it */
 733             cbdataReferenceDone(ch->extacl_entry);
 734             entry = NULL;
 735         }
 736     }
 737
 738     external_acl_message = "MISSING REQUIRED INFORMATION";
 739
 740     if (!entry) {
 741         if (acl->def->require_auth) {
 742             int ti;
 743             /* Make sure the user is authenticated */
 744
 745             if ((ti = AuthenticateAcl(ch)) != 1) {
 746                 debugs(82, 2, "aclMatchExternal: " << acl->def->name << " user not authenticated (" << ti << ")");
 747                 return ti;
 748             }
 749         }
 750
 751         key = makeExternalAclKey(ch, acl);
 752
 753         if (acl->def->require_auth)
 754             AUTHUSERREQUESTUNLOCK(ch->auth_user_request, "ACLChecklist via aclMatchExternal");
 755
 756         if (!key) {
 757             /* Not sufficient data to process */
 758             return -1;
 759         }
 760
 761         entry = static_cast<external_acl_entry *>(hash_lookup(acl->def->cache, key));
 762
 763         if (!entry || external_acl_grace_expired(acl->def, entry)) {
 764             debugs(82, 2, "aclMatchExternal: " << acl->def->name << "(\"" << key << "\") = lookup needed");
 765             debugs(82, 2, "aclMatchExternal: \"" << key << "\": entry=@" <<
 766                    entry << ", age=" << (entry ? (long int) squid_curtime - entry->date : 0));
 767
 768             if (acl->def->theHelper->stats.queue_size <= (int)acl->def->theHelper->childs.n_active) {
 769                 debugs(82, 2, "aclMatchExternal: \"" << key << "\": queueing a call.");
 770                 ch->changeState (ExternalACLLookup::Instance());
 771
 772                 if (entry == NULL) {
 773                     debugs(82, 2, "aclMatchExternal: \"" << key << "\": return -1.");
 774                     return -1;
 775                 }
 776             } else {
 777                 if (!entry) {
 778                     debugs(82, 1, "aclMatchExternal: '" << acl->def->name <<
 779                            "' queue overload. Request rejected '" << key << "'.");
 780                     external_acl_message = "SYSTEM TOO BUSY, TRY AGAIN LATER";
 781                     return -1;
 782                 } else {
 783                     debugs(82, 1, "aclMatchExternal: '" << acl->def->name <<
 784                            "' queue overload. Using stale result. '" << key << "'.");
 785                     /* Fall thru to processing below */
 786                 }
 787             }
 788         }
 789     }
 790
 791     external_acl_cache_touch(acl->def, entry);
 792     result = entry->result;
 793     external_acl_message = entry->message.termedBuf();
 794
 795     debugs(82, 2, "aclMatchExternal: " << acl->def->name << " = " << result);
 796
 797     if (ch->request) {
 798         if (entry->user.size())
 799             ch->request->extacl_user = entry->user;
 800
 801         if (entry->password.size())
 802             ch->request->extacl_passwd = entry->password;
 803
 804         if (!ch->request->tag.size())
 805             ch->request->tag = entry->tag;
 806
 807         if (entry->log.size())
 808             ch->request->extacl_log = entry->log;
 809
 810         if (entry->message.size())
 811             ch->request->extacl_message = entry->message;
 812     }
 813
 814     return result;
 815 }
 816
 817 int
 818 ACLExternal::match(ACLChecklist *checklist)
 819 {
 820     return aclMatchExternal (data, Filled(checklist));
 821 }
 822
 823 wordlist *
 824 ACLExternal::dump() const
 825 {
 826     external_acl_data const *acl = data;
 827     wordlist *result = NULL;
 828     wordlist *arg;
 829     MemBuf mb;
 830     mb.init();
 831     mb.Printf("%s", acl->def->name);
 832
 833     for (arg = acl->arguments; arg; arg = arg->next) {
 834         mb.Printf(" %s", arg->key);
 835     }
 836
 837     wordlistAdd(&result, mb.buf);
 838     mb.clean();
 839     return result;
 840 }
 841
 842 /******************************************************************
 843  * external_acl cache
 844  */
 845
 846 static void
 847 external_acl_cache_touch(external_acl * def, external_acl_entry * entry)
 848 {
 849     dlinkDelete(&entry->lru, &def->lru_list);
 850     dlinkAdd(entry, &entry->lru, &def->lru_list);
 851 }
 852
 853 static char *
 854 makeExternalAclKey(ACLFilledChecklist * ch, external_acl_data * acl_data)
 855 {
 856     static MemBuf mb;
 857     char buf[256];
 858     int first = 1;
 859     wordlist *arg;
 860     external_acl_format *format;
 861     HttpRequest *request = ch->request;
 862     HttpReply *reply = ch->reply;
 863     mb.reset();
 864
 865     for (format = acl_data->def->format; format; format = format->next) {
 866         const char *str = NULL;
 867         String sb;
 868
 869         switch (format->type) {
 870
 871         case _external_acl_format::EXT_ACL_LOGIN:
 872             assert (ch->auth_user_request);
 873             str = ch->auth_user_request->username();
 874             break;
 875 #if USE_IDENT
 876
 877         case _external_acl_format::EXT_ACL_IDENT:
 878             str = ch->rfc931;
 879
 880             if (!str || !*str) {
 881                 ch->changeState(IdentLookup::Instance());
 882                 return NULL;
 883             }
 884
 885             break;
 886 #endif
 887
 888         case _external_acl_format::EXT_ACL_SRC:
 889             str = ch->src_addr.NtoA(buf,sizeof(buf));
 890             break;
 891
 892         case _external_acl_format::EXT_ACL_SRCPORT:
 893             snprintf(buf, sizeof(buf), "%d", request->client_addr.GetPort());
 894             str = buf;
 895             break;
 896
 897 #if USE_SQUID_EUI
 898         case _external_acl_format::EXT_ACL_SRCEUI48:
 899             if (request->client_eui48.encode(buf, sizeof(buf)))
 900                 str = buf;
 901             break;
 902
 903         case _external_acl_format::EXT_ACL_SRCEUI64:
 904             if (request->client_eui64.encode(buf, sizeof(buf)))
 905                 str = buf;
 906             break;
 907 #endif
 908
 909         case _external_acl_format::EXT_ACL_MYADDR:
 910             str = request->my_addr.NtoA(buf, sizeof(buf));
 911             break;
 912
 913         case _external_acl_format::EXT_ACL_MYPORT:
 914             snprintf(buf, sizeof(buf), "%d", request->my_addr.GetPort());
 915             str = buf;
 916             break;
 917
 918         case _external_acl_format::EXT_ACL_URI:
 919             str = urlCanonical(request);
 920             break;
 921
 922         case _external_acl_format::EXT_ACL_DST:
 923             str = request->GetHost();
 924             break;
 925
 926         case _external_acl_format::EXT_ACL_PROTO:
 927             str = ProtocolStr[request->protocol];
 928             break;
 929
 930         case _external_acl_format::EXT_ACL_PORT:
 931             snprintf(buf, sizeof(buf), "%d", request->port);
 932             str = buf;
 933             break;
 934
 935         case _external_acl_format::EXT_ACL_PATH:
 936             str = request->urlpath.termedBuf();
 937             break;
 938
 939         case _external_acl_format::EXT_ACL_METHOD:
 940             str = RequestMethodStr(request->method);
 941             break;
 942
 943         case _external_acl_format::EXT_ACL_HEADER_REQUEST:
 944             sb = request->header.getByName(format->header);
 945             str = sb.termedBuf();
 946             break;
 947
 948         case _external_acl_format::EXT_ACL_HEADER_REQUEST_ID:
 949             sb = request->header.getStrOrList(format->header_id);
 950             str = sb.termedBuf();
 951             break;
 952
 953         case _external_acl_format::EXT_ACL_HEADER_REQUEST_MEMBER:
 954             sb = request->header.getByNameListMember(format->header, format->member, format->separator);
 955             str = sb.termedBuf();
 956             break;
 957
 958         case _external_acl_format::EXT_ACL_HEADER_REQUEST_ID_MEMBER:
 959             sb = request->header.getListMember(format->header_id, format->member, format->separator);
 960             str = sb.termedBuf();
 961             break;
 962
 963         case _external_acl_format::EXT_ACL_HEADER_REPLY:
 964             if (reply) {
 965                 sb = reply->header.getByName(format->header);
 966                 str = sb.termedBuf();
 967             }
 968             break;
 969
 970         case _external_acl_format::EXT_ACL_HEADER_REPLY_ID:
 971             if (reply) {
 972                 sb = reply->header.getStrOrList(format->header_id);
 973                 str = sb.termedBuf();
 974             }
 975             break;
 976
 977         case _external_acl_format::EXT_ACL_HEADER_REPLY_MEMBER:
 978             if (reply) {
 979                 sb = reply->header.getByNameListMember(format->header, format->member, format->separator);
 980                 str = sb.termedBuf();
 981             }
 982             break;
 983
 984         case _external_acl_format::EXT_ACL_HEADER_REPLY_ID_MEMBER:
 985             if (reply) {
 986                 sb = reply->header.getListMember(format->header_id, format->member, format->separator);
 987                 str = sb.termedBuf();
 988             }
 989             break;
 990 #if USE_SSL
 991
 992         case _external_acl_format::EXT_ACL_USER_CERT_RAW:
 993
 994             if (ch->conn() != NULL) {
 995                 SSL *ssl = fd_table[ch->conn()->fd].ssl;
 996
 997                 if (ssl)
 998                     str = sslGetUserCertificatePEM(ssl);
 999             }
1000
1001             break;
1002
1003         case _external_acl_format::EXT_ACL_USER_CERTCHAIN_RAW:
1004
1005             if (ch->conn() != NULL) {
1006                 SSL *ssl = fd_table[ch->conn()->fd].ssl;
1007
1008                 if (ssl)
1009                     str = sslGetUserCertificateChainPEM(ssl);
1010             }
1011
1012             break;
1013
1014         case _external_acl_format::EXT_ACL_USER_CERT:
1015
1016             if (ch->conn() != NULL) {
1017                 SSL *ssl = fd_table[ch->conn()->fd].ssl;
1018
1019                 if (ssl)
1020                     str = sslGetUserAttribute(ssl, format->header);
1021             }
1022
1023             break;
1024
1025         case _external_acl_format::EXT_ACL_CA_CERT:
1026
1027             if (ch->conn() != NULL) {
1028                 SSL *ssl = fd_table[ch->conn()->fd].ssl;
1029
1030                 if (ssl)
1031                     str = sslGetCAAttribute(ssl, format->header);
1032             }
1033
1034             break;
1035 #endif
1036
1037         case _external_acl_format::EXT_ACL_EXT_USER:
1038             str = request->extacl_user.termedBuf();
1039             break;
1040
1041         case _external_acl_format::EXT_ACL_UNKNOWN:
1042
1043         case _external_acl_format::EXT_ACL_END:
1044             fatal("unknown external_acl format error");
1045             break;
1046         }
1047
1048         if (str)
1049             if (!*str)
1050                 str = NULL;
1051
1052         if (!str)
1053             str = "-";
1054
1055         if (!first)
1056             mb.append(" ", 1);
1057
1058         if (acl_data->def->quote == external_acl::QUOTE_METHOD_URL) {
1059             const char *quoted = rfc1738_escape(str);
1060             mb.append(quoted, strlen(quoted));
1061         } else {
1062             strwordquote(&mb, str);
1063         }
1064
1065         sb.clean();
1066
1067         first = 0;
1068     }
1069
1070     for (arg = acl_data->arguments; arg; arg = arg->next) {
1071         if (!first)
1072             mb.append(" ", 1);
1073
1074         if (acl_data->def->quote == external_acl::QUOTE_METHOD_URL) {
1075             const char *quoted = rfc1738_escape(arg->key);
1076             mb.append(quoted, strlen(quoted));
1077         } else {
1078             strwordquote(&mb, arg->key);
1079         }
1080
1081         first = 0;
1082     }
1083
1084     return mb.buf;
1085 }
1086
1087 static int
1088 external_acl_entry_expired(external_acl * def, external_acl_entry * entry)
1089 {
1090     if (entry->date + (entry->result == 1 ? def->ttl : def->negative_ttl) < squid_curtime)
1091         return 1;
1092     else
1093         return 0;
1094 }
1095
1096 static int
1097 external_acl_grace_expired(external_acl * def, external_acl_entry * entry)
1098 {
1099     int ttl;
1100     ttl = entry->result == 1 ? def->ttl : def->negative_ttl;
1101     ttl = (ttl * (100 - def->grace)) / 100;
1102
1103     if (entry->date + ttl < squid_curtime)
1104         return 1;
1105     else
1106         return 0;
1107 }
1108
1109 static external_acl_entry *
1110 external_acl_cache_add(external_acl * def, const char *key, ExternalACLEntryData const & data)
1111 {
1112     ExternalACLEntry *entry = static_cast<ExternalACLEntry *>(hash_lookup(def->cache, key));
1113     debugs(82, 2, "external_acl_cache_add: Adding '" << key << "' = " << data.result);
1114
1115     if (entry) {
1116         debugs(82, 3, "ExternalACLEntry::update: updating existing entry");
1117         entry->update (data);
1118         external_acl_cache_touch(def, entry);
1119
1120         return entry;
1121     }
1122
1123     entry = new ExternalACLEntry;
1124     entry->key = xstrdup(key);
1125     entry->update (data);
1126
1127     def->add
1128     (entry);
1129
1130     return entry;
1131 }
1132
1133 static void
1134 external_acl_cache_delete(external_acl * def, external_acl_entry * entry)
1135 {
1136     assert (entry->def == def);
1137     hash_remove_link(def->cache, entry);
1138     dlinkDelete(&entry->lru, &def->lru_list);
1139     def->cache_entries -= 1;
1140     delete entry;
1141 }
1142
1143 /******************************************************************
1144  * external_acl helpers
1145  */
1146
1147 typedef struct _externalAclState externalAclState;
1148
1149 struct _externalAclState {
1150     EAH *callback;
1151     void *callback_data;
1152     char *key;
1153     external_acl *def;
1154     dlink_node list;
1155     externalAclState *queue;
1156 };
1157
1158 CBDATA_TYPE(externalAclState);
1159 static void
1160 free_externalAclState(void *data)
1161 {
1162     externalAclState *state = static_cast<externalAclState *>(data);
1163     safe_free(state->key);
1164     cbdataReferenceDone(state->callback_data);
1165     cbdataReferenceDone(state->def);
1166 }
1167
1168 /*
1169  * The helper program receives queries on stdin, one
1170  * per line, and must return the result on on stdout
1171  *
1172  * General result syntax:
1173  *
1174  *   OK/ERR keyword=value ...
1175  *
1176  * Keywords:
1177  *
1178  *   user=      The users name (login)
1179  *   message=   Message describing the reason
1180  *   tag=       A string tag to be applied to the request that triggered the acl match.
1181  *              applies to both OK and ERR responses.
1182  *              Won't override existing request tags.
1183  *   log=       A string to be used in access logging
1184  *
1185  * Other keywords may be added to the protocol later
1186  *
1187  * value needs to be enclosed in quotes if it may contain whitespace, or
1188  * the whitespace escaped using \ (\ escaping obviously also applies to
1189  * any " characters)
1190  */
1191
1192 static void
1193 externalAclHandleReply(void *data, char *reply)
1194 {
1195     externalAclState *state = static_cast<externalAclState *>(data);
1196     externalAclState *next;
1197     char *status;
1198     char *token;
1199     char *value;
1200     char *t;
1201     ExternalACLEntryData entryData;
1202     entryData.result = 0;
1203     external_acl_entry *entry = NULL;
1204
1205     debugs(82, 2, "externalAclHandleReply: reply=\"" << reply << "\"");
1206
1207     if (reply) {
1208         status = strwordtok(reply, &t);
1209
1210         if (status && strcmp(status, "OK") == 0)
1211             entryData.result = 1;
1212
1213         while ((token = strwordtok(NULL, &t))) {
1214             value = strchr(token, '=');
1215
1216             if (value) {
1217                 *value++ = '\0';        /* terminate the token, and move up to the value */
1218
1219                 if (state->def->quote == external_acl::QUOTE_METHOD_URL)
1220                     rfc1738_unescape(value);
1221
1222                 if (strcmp(token, "user") == 0)
1223                     entryData.user = value;
1224                 else if (strcmp(token, "message") == 0)
1225                     entryData.message = value;
1226                 else if (strcmp(token, "error") == 0)
1227                     entryData.message = value;
1228                 else if (strcmp(token, "tag") == 0)
1229                     entryData.tag = value;
1230                 else if (strcmp(token, "log") == 0)
1231                     entryData.log = value;
1232                 else if (strcmp(token, "password") == 0)
1233                     entryData.password = value;
1234                 else if (strcmp(token, "passwd") == 0)
1235                     entryData.password = value;
1236                 else if (strcmp(token, "login") == 0)
1237                     entryData.user = value;
1238             }
1239         }
1240     }
1241
1242     dlinkDelete(&state->list, &state->def->queue);
1243
1244     if (cbdataReferenceValid(state->def)) {
1245         if (reply)
1246             entry = external_acl_cache_add(state->def, state->key, entryData);
1247         else {
1248             external_acl_entry *oldentry = (external_acl_entry *)hash_lookup(state->def->cache, state->key);
1249
1250             if (oldentry)
1251                 external_acl_cache_delete(state->def, oldentry);
1252         }
1253     }
1254
1255     do {
1256         void *cbdata;
1257         cbdataReferenceDone(state->def);
1258
1259         if (state->callback && cbdataReferenceValidDone(state->callback_data, &cbdata))
1260             state->callback(cbdata, entry);
1261
1262         next = state->queue;
1263
1264         cbdataFree(state);
1265
1266         state = next;
1267     } while (state);
1268 }
1269
1270 void
1271 ACLExternal::ExternalAclLookup(ACLChecklist *checklist, ACLExternal * me, EAH * callback, void *callback_data)
1272 {
1273     MemBuf buf;
1274     external_acl_data *acl = me->data;
1275     external_acl *def = acl->def;
1276     externalAclState *state;
1277     dlink_node *node;
1278     externalAclState *oldstate = NULL;
1279     bool graceful = 0;
1280
1281     ACLFilledChecklist *ch = Filled(checklist);
1282     if (acl->def->require_auth) {
1283         int ti;
1284         /* Make sure the user is authenticated */
1285
1286         if ((ti = AuthenticateAcl(ch)) != 1) {
1287             debugs(82, 1, "externalAclLookup: " << acl->def->name <<
1288                    " user authentication failure (" << ti << ", ch=" << ch << ")");
1289             callback(callback_data, NULL);
1290             return;
1291         }
1292     }
1293
1294     const char *key = makeExternalAclKey(ch, acl);
1295
1296     if (!key) {
1297         debugs(82, 1, "externalAclLookup: lookup in '" << def->name <<
1298                "', prerequisit failure (ch=" << ch << ")");
1299         callback(callback_data, NULL);
1300         return;
1301     }
1302
1303     debugs(82, 2, "externalAclLookup: lookup in '" << def->name << "' for '" << key << "'");
1304
1305     external_acl_entry *entry = static_cast<external_acl_entry *>(hash_lookup(def->cache, key));
1306
1307     if (entry && external_acl_entry_expired(def, entry))
1308         entry = NULL;
1309
1310     /* Check for a pending lookup to hook into */
1311     for (node = def->queue.head; node; node = node->next) {
1312         externalAclState *oldstatetmp = static_cast<externalAclState *>(node->data);
1313
1314         if (strcmp(key, oldstatetmp->key) == 0) {
1315             oldstate = oldstatetmp;
1316             break;
1317         }
1318     }
1319
1320     if (entry && external_acl_grace_expired(def, entry)) {
1321         if (oldstate) {
1322             debugs(82, 4, "externalAclLookup: in grace period, but already pending lookup ('" << key << "', ch=" << ch << ")");
1323             callback(callback_data, entry);
1324             return;
1325         } else {
1326             graceful = 1; // grace expired, (neg)ttl did not, and we must start a new lookup.
1327         }
1328     }
1329
1330     // The entry is in the cache, grace_ttl did not expired.
1331     if (!graceful && entry && !external_acl_grace_expired(def, entry)) {
1332         /* Should not really happen, but why not.. */
1333         callback(callback_data, entry);
1334         debugs(82, 4, "externalAclLookup: no lookup pending for '" << key << "', and grace not expired");
1335         debugs(82, 4, "externalAclLookup: (what tha' hell?)");
1336         return;
1337     }
1338
1339     /* No pending lookup found. Sumbit to helper */
1340     state = cbdataAlloc(externalAclState);
1341
1342     state->def = cbdataReference(def);
1343
1344     state->key = xstrdup(key);
1345
1346     if (!graceful) {
1347         state->callback = callback;
1348         state->callback_data = cbdataReference(callback_data);
1349     }
1350
1351     if (oldstate) {
1352         /* Hook into pending lookup */
1353         state->queue = oldstate->queue;
1354         oldstate->queue = state;
1355     } else {
1356         /* Check for queue overload */
1357
1358         if (def->theHelper->stats.queue_size >= (int)def->theHelper->childs.n_running) {
1359             debugs(82, 1, "externalAclLookup: '" << def->name << "' queue overload (ch=" << ch << ")");
1360             cbdataFree(state);
1361             callback(callback_data, entry);
1362             return;
1363         }
1364
1365         /* Send it off to the helper */
1366         buf.init();
1367
1368         buf.Printf("%s\n", key);
1369
1370         debugs(82, 4, "externalAclLookup: looking up for '" << key << "' in '" << def->name << "'.");
1371
1372         helperSubmit(def->theHelper, buf.buf, externalAclHandleReply, state);
1373
1374         dlinkAdd(state, &state->list, &def->queue);
1375
1376         buf.clean();
1377     }
1378
1379     if (graceful) {
1380         /* No need to wait during grace period */
1381         debugs(82, 4, "externalAclLookup: no need to wait for the result of '" <<
1382                key << "' in '" << def->name << "' (ch=" << ch << ").");
1383         debugs(82, 4, "externalAclLookup: using cached entry " << entry);
1384
1385         if (entry != NULL) {
1386             debugs(82, 4, "externalAclLookup: entry = { date=" <<
1387                    (long unsigned int) entry->date << ", result=" <<
1388                    entry->result << ", user=" << entry->user << " tag=" <<
1389                    entry->tag << " log=" << entry->log << " }");
1390
1391         }
1392
1393         callback(callback_data, entry);
1394         return;
1395     }
1396
1397     debugs(82, 4, "externalAclLookup: will wait for the result of '" << key <<
1398            "' in '" << def->name << "' (ch=" << ch << ").");
1399 }
1400
1401 static void
1402 externalAclStats(StoreEntry * sentry)
1403 {
1404     external_acl *p;
1405
1406     for (p = Config.externalAclHelperList; p; p = p->next) {
1407         storeAppendPrintf(sentry, "External ACL Statistics: %s\n", p->name);
1408         storeAppendPrintf(sentry, "Cache size: %d\n", p->cache->count);
1409         helperStats(sentry, p->theHelper);
1410         storeAppendPrintf(sentry, "\n");
1411     }
1412 }
1413
1414 static void
1415 externalAclRegisterWithCacheManager(void)
1416 {
1417     CacheManager::GetInstance()->
1418     registerAction("external_acl",
1419                    "External ACL stats",
1420                    externalAclStats, 0, 1);
1421 }
1422
1423 void
1424 externalAclInit(void)
1425 {
1426     static int firstTimeInit = 1;
1427     external_acl *p;
1428
1429     for (p = Config.externalAclHelperList; p; p = p->next) {
1430         if (!p->cache)
1431             p->cache = hash_create((HASHCMP *) strcmp, hashPrime(1024), hash4);
1432
1433         if (!p->theHelper)
1434             p->theHelper = new helper(p->name);
1435
1436         p->theHelper->cmdline = p->cmdline;
1437
1438         p->theHelper->childs = p->children;
1439
1440         p->theHelper->ipc_type = IPC_TCP_SOCKET;
1441
1442         p->theHelper->addr = p->local_addr;
1443
1444         helperOpenServers(p->theHelper);
1445     }
1446
1447     if (firstTimeInit) {
1448         firstTimeInit = 0;
1449         CBDATA_INIT_TYPE_FREECB(externalAclState, free_externalAclState);
1450     }
1451
1452     externalAclRegisterWithCacheManager();
1453 }
1454
1455 void
1456 externalAclShutdown(void)
1457 {
1458     external_acl *p;
1459
1460     for (p = Config.externalAclHelperList; p; p = p->next) {
1461         helperShutdown(p->theHelper);
1462     }
1463 }
1464
1465 ExternalACLLookup ExternalACLLookup::instance_;
1466 ExternalACLLookup *
1467 ExternalACLLookup::Instance()
1468 {
1469     return &instance_;
1470 }
1471
1472 void
1473 ExternalACLLookup::checkForAsync(ACLChecklist *checklist)const
1474 {
1475     /* TODO: optimise this - we probably have a pointer to this
1476      * around somewhere */
1477     ACL *acl = ACL::FindByName(AclMatchedName);
1478     assert(acl);
1479     ACLExternal *me = dynamic_cast<ACLExternal *> (acl);
1480     assert (me);
1481     checklist->asyncInProgress(true);
1482     ACLExternal::ExternalAclLookup(checklist, me, LookupDone, checklist);
1483 }
1484
1485 void
1486 ExternalACLLookup::LookupDone(void *data, void *result)
1487 {
1488     ACLFilledChecklist *checklist = Filled(static_cast<ACLChecklist*>(data));
1489     checklist->extacl_entry = cbdataReference((external_acl_entry *)result);
1490     checklist->asyncInProgress(false);
1491     checklist->changeState (ACLChecklist::NullState::Instance());
1492     checklist->check();
1493 }
1494
1495 /* This registers "external" in the registry. To do dynamic definitions
1496  * of external ACL's, rather than a static prototype, have a Prototype instance
1497  * prototype in the class that defines each external acl 'class'.
1498  * Then, then the external acl instance is created, it self registers under
1499  * it's name.
1500  * Be sure that clone is fully functional for that acl class though!
1501  */
1502 ACL::Prototype ACLExternal::RegistryProtoype(&ACLExternal::RegistryEntry_, "external");
1503
1504 ACLExternal ACLExternal::RegistryEntry_("external");
1505
1506 ACL *
1507 ACLExternal::clone() const
1508 {
1509     return new ACLExternal(*this);
1510 }
1511
1512 ACLExternal::ACLExternal (char const *theClass) : data (NULL), class_ (xstrdup (theClass))
1513 {}
1514
1515 ACLExternal::ACLExternal (ACLExternal const & old) : data (NULL), class_ (old.class_ ? xstrdup (old.class_) : NULL)
1516 {
1517     /* we don't have copy constructors for the data yet */
1518     assert (!old.data);
1519 }
1520
1521 char const *
1522 ACLExternal::typeString() const
1523 {
1524     return class_;
1525 }
1526
1527 bool
1528 ACLExternal::isProxyAuth() const
1529 {
1530     return data->def->require_auth;
1531 }