src/external_acl.cc

   1 /*
   2  * Copyright (C) 1996-2015 The Squid Software Foundation and contributors
   3  *
   4  * Squid software is distributed under GPLv2+ license and includes
   5  * contributions from numerous individuals and organizations.
   6  * Please see the COPYING and CONTRIBUTORS files for details.
   7  */
   8
   9 /* DEBUG: section 82    External ACL */
  10
  11 #include "squid.h"
  12 #include "acl/Acl.h"
  13 #include "acl/FilledChecklist.h"
  14 #include "cache_cf.h"
  15 #include "client_side.h"
  16 #include "client_side_request.h"
  17 #include "comm/Connection.h"
  18 #include "ConfigParser.h"
  19 #include "ExternalACL.h"
  20 #include "ExternalACLEntry.h"
  21 #include "fde.h"
  22 #include "format/Token.h"
  23 #include "helper.h"
  24 #include "helper/Reply.h"
  25 #include "HttpHeaderTools.h"
  26 #include "HttpReply.h"
  27 #include "HttpRequest.h"
  28 #include "ip/tools.h"
  29 #include "MemBuf.h"
  30 #include "mgr/Registration.h"
  31 #include "rfc1738.h"
  32 #include "SquidConfig.h"
  33 #include "SquidString.h"
  34 #include "SquidTime.h"
  35 #include "Store.h"
  36 #include "tools.h"
  37 #include "URL.h"
  38 #include "wordlist.h"
  39 #if USE_OPENSSL
  40 #include "ssl/ServerBump.h"
  41 #include "ssl/support.h"
  42 #endif
  43 #if USE_AUTH
  44 #include "auth/Acl.h"
  45 #include "auth/Gadgets.h"
  46 #include "auth/UserRequest.h"
  47 #endif
  48 #if USE_IDENT
  49 #include "ident/AclIdent.h"
  50 #endif
  51
  52 #ifndef DEFAULT_EXTERNAL_ACL_TTL
  53 #define DEFAULT_EXTERNAL_ACL_TTL 1 * 60 * 60
  54 #endif
  55 #ifndef DEFAULT_EXTERNAL_ACL_CHILDREN
  56 #define DEFAULT_EXTERNAL_ACL_CHILDREN 5
  57 #endif
  58
  59 static char *makeExternalAclKey(ACLFilledChecklist * ch, external_acl_data * acl_data);
  60 static void external_acl_cache_delete(external_acl * def, const ExternalACLEntryPointer &entry);
  61 static int external_acl_entry_expired(external_acl * def, const ExternalACLEntryPointer &entry);
  62 static int external_acl_grace_expired(external_acl * def, const ExternalACLEntryPointer &entry);
  63 static void external_acl_cache_touch(external_acl * def, const ExternalACLEntryPointer &entry);
  64 static ExternalACLEntryPointer external_acl_cache_add(external_acl * def, const char *key, ExternalACLEntryData const &data);
  65
  66 /******************************************************************
  67  * external_acl directive
  68  */
  69
  70 class external_acl
  71 {
  72     /* FIXME: These are not really cbdata, but it is an easy way
  73      * to get them pooled, refcounted, accounted and freed properly...
  74      */
  75     CBDATA_CLASS(external_acl);
  76
  77 public:
  78     external_acl();
  79     ~external_acl();
  80
  81     external_acl *next;
  82
  83     void add(const ExternalACLEntryPointer &);
  84
  85     void trimCache();
  86
  87     int ttl;
  88
  89     int negative_ttl;
  90
  91     int grace;
  92
  93     char *name;
  94
  95     Format::Format format;
  96
  97     wordlist *cmdline;
  98
  99     Helper::ChildConfig children;
 100
 101     helper *theHelper;
 102
 103     hash_table *cache;
 104
 105     dlink_list lru_list;
 106
 107     int cache_size;
 108
 109     int cache_entries;
 110
 111     dlink_list queue;
 112
 113 #if USE_AUTH
 114     /**
 115      * Configuration flag. May only be altered by the configuration parser.
 116      *
 117      * Indicates that all uses of this external_acl_type helper require authentication
 118      * details to be processed. If none are available its a fail match.
 119      */
 120     bool require_auth;
 121 #endif
 122
 123     enum {
 124         QUOTE_METHOD_SHELL = 1,
 125         QUOTE_METHOD_URL
 126     } quote;
 127
 128     Ip::Address local_addr;
 129 };
 130
 131 CBDATA_CLASS_INIT(external_acl);
 132
 133 external_acl::external_acl() :
 134     next(NULL),
 135     ttl(DEFAULT_EXTERNAL_ACL_TTL),
 136     negative_ttl(-1),
 137     grace(1),
 138     name(NULL),
 139     format("external_acl_type"),
 140     cmdline(NULL),
 141     children(DEFAULT_EXTERNAL_ACL_CHILDREN),
 142     theHelper(NULL),
 143     cache(NULL),
 144     cache_size(256*1024),
 145     cache_entries(0),
 146 #if USE_AUTH
 147     require_auth(0),
 148 #endif
 149     quote(external_acl::QUOTE_METHOD_URL)
 150 {
 151     local_addr.setLocalhost();
 152 }
 153
 154 external_acl::~external_acl()
 155 {
 156     xfree(name);
 157     wordlistDestroy(&cmdline);
 158
 159     if (theHelper) {
 160         helperShutdown(theHelper);
 161         delete theHelper;
 162         theHelper = NULL;
 163     }
 164
 165     while (lru_list.tail) {
 166         ExternalACLEntryPointer e(static_cast<ExternalACLEntry *>(lru_list.tail->data));
 167         external_acl_cache_delete(this, e);
 168     }
 169     if (cache)
 170         hashFreeMemory(cache);
 171
 172     while (next) {
 173         external_acl *node = next;
 174         next = node->next;
 175         node->next = NULL; // prevent recursion
 176         delete node;
 177     }
 178 }
 179
 180 void
 181 parse_externalAclHelper(external_acl ** list)
 182 {
 183     external_acl *a = new external_acl;
 184     char *token = ConfigParser::NextToken();
 185
 186     if (!token)
 187         self_destruct();
 188
 189     a->name = xstrdup(token);
 190
 191     // Allow supported %macros inside quoted tokens
 192     ConfigParser::EnableMacros();
 193     token = ConfigParser::NextToken();
 194
 195     /* Parse options */
 196     while (token) {
 197         if (strncmp(token, "ttl=", 4) == 0) {
 198             a->ttl = atoi(token + 4);
 199         } else if (strncmp(token, "negative_ttl=", 13) == 0) {
 200             a->negative_ttl = atoi(token + 13);
 201         } else if (strncmp(token, "children=", 9) == 0) {
 202             a->children.n_max = atoi(token + 9);
 203             debugs(0, DBG_CRITICAL, "WARNING: external_acl_type option children=N has been deprecated in favor of children-max=N and children-startup=N");
 204         } else if (strncmp(token, "children-max=", 13) == 0) {
 205             a->children.n_max = atoi(token + 13);
 206         } else if (strncmp(token, "children-startup=", 17) == 0) {
 207             a->children.n_startup = atoi(token + 17);
 208         } else if (strncmp(token, "children-idle=", 14) == 0) {
 209             a->children.n_idle = atoi(token + 14);
 210         } else if (strncmp(token, "concurrency=", 12) == 0) {
 211             a->children.concurrency = atoi(token + 12);
 212         } else if (strncmp(token, "queue-size=", 11) == 0) {
 213             a->children.queue_size = atoi(token + 11);
 214             a->children.defaultQueueSize = false;
 215         } else if (strncmp(token, "cache=", 6) == 0) {
 216             a->cache_size = atoi(token + 6);
 217         } else if (strncmp(token, "grace=", 6) == 0) {
 218             a->grace = atoi(token + 6);
 219         } else if (strcmp(token, "protocol=2.5") == 0) {
 220             a->quote = external_acl::QUOTE_METHOD_SHELL;
 221         } else if (strcmp(token, "protocol=3.0") == 0) {
 222             debugs(3, DBG_PARSE_NOTE(2), "WARNING: external_acl_type option protocol=3.0 is deprecated. Remove this from your config.");
 223             a->quote = external_acl::QUOTE_METHOD_URL;
 224         } else if (strcmp(token, "quote=url") == 0) {
 225             debugs(3, DBG_PARSE_NOTE(2), "WARNING: external_acl_type option quote=url is deprecated. Remove this from your config.");
 226             a->quote = external_acl::QUOTE_METHOD_URL;
 227         } else if (strcmp(token, "quote=shell") == 0) {
 228             debugs(3, DBG_PARSE_NOTE(2), "WARNING: external_acl_type option quote=shell is deprecated. Use protocol=2.5 if still needed.");
 229             a->quote = external_acl::QUOTE_METHOD_SHELL;
 230
 231             /* INET6: allow admin to configure some helpers explicitly to
 232                       bind to IPv4/v6 localhost port. */
 233         } else if (strcmp(token, "ipv4") == 0) {
 234             if ( !a->local_addr.setIPv4() ) {
 235                 debugs(3, DBG_CRITICAL, "WARNING: Error converting " << a->local_addr << " to IPv4 in " << a->name );
 236             }
 237         } else if (strcmp(token, "ipv6") == 0) {
 238             if (!Ip::EnableIpv6)
 239                 debugs(3, DBG_CRITICAL, "WARNING: --enable-ipv6 required for external ACL helpers to use IPv6: " << a->name );
 240             // else nothing to do.
 241         } else {
 242             break;
 243         }
 244
 245         token = ConfigParser::NextToken();
 246     }
 247     ConfigParser::DisableMacros();
 248
 249     /* check that child startup value is sane. */
 250     if (a->children.n_startup > a->children.n_max)
 251         a->children.n_startup = a->children.n_max;
 252
 253     /* check that child idle value is sane. */
 254     if (a->children.n_idle > a->children.n_max)
 255         a->children.n_idle = a->children.n_max;
 256     if (a->children.n_idle < 1)
 257         a->children.n_idle = 1;
 258
 259     if (a->negative_ttl == -1)
 260         a->negative_ttl = a->ttl;
 261
 262     if (a->children.defaultQueueSize)
 263         a->children.queue_size = 2 * a->children.n_max;
 264
 265     /* Legacy external_acl_type format parser.
 266      * Handles a series of %... tokens where any non-% means
 267      * the start of another parameter field (ie the path to binary).
 268      */
 269     enum Format::Quoting quote = Format::LOG_QUOTE_NONE;
 270     Format::Token **fmt = &a->format.format;
 271     while (token) {
 272         /* stop on first non-% token found */
 273         if (*token != '%')
 274             break;
 275
 276         *fmt = new Format::Token;
 277
 278         // compatibility for old tokens incompatible with Format::Token syntax
 279 #if USE_OPENSSL // dont bother if we dont have to.
 280         if (strncmp(token, "%USER_CERT_", 11) == 0) {
 281             (*fmt)->type = Format::LFT_EXT_ACL_USER_CERT;
 282             (*fmt)->data.string = xstrdup(token + 11);
 283             (*fmt)->data.header.header = (*fmt)->data.string;
 284         } else if (strncmp(token, "%USER_CA_CERT_", 14) == 0) {
 285             (*fmt)->type = Format::LFT_EXT_ACL_USER_CA_CERT;
 286             (*fmt)->data.string = xstrdup(token + 14);
 287             (*fmt)->data.header.header = (*fmt)->data.string;
 288         } else if (strncmp(token, "%CA_CERT_", 9) == 0) {
 289             debugs(82, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: external_acl_type %CA_CERT_* code is obsolete. Use %USER_CA_CERT_* instead");
 290             (*fmt)->type = Format::LFT_EXT_ACL_USER_CA_CERT;
 291             (*fmt)->data.string = xstrdup(token + 9);
 292             (*fmt)->data.header.header = (*fmt)->data.string;
 293         } else
 294 #endif
 295         {
 296             // we can use the Format::Token::parse() method since it
 297             // only pulls off one token. Since we already checked
 298             // for '%' prefix above this is guaranteed to be a token.
 299             const size_t len = (*fmt)->parse(token, &quote);
 300             assert(len == strlen(token));
 301         }
 302
 303         // process special token-specific actions (only if necessary)
 304 #if USE_AUTH
 305         if ((*fmt)->type == Format::LFT_USER_LOGIN)
 306             a->require_auth = true;
 307 #endif
 308
 309         fmt = &((*fmt)->next);
 310         token = ConfigParser::NextToken();
 311     }
 312
 313     /* There must be at least one format token */
 314     if (!a->format.format)
 315         self_destruct();
 316
 317     /* helper */
 318     if (!token)
 319         self_destruct();
 320
 321     wordlistAdd(&a->cmdline, token);
 322
 323     /* arguments */
 324     parse_wordlist(&a->cmdline);
 325
 326     while (*list)
 327         list = &(*list)->next;
 328
 329     *list = a;
 330 }
 331
 332 void
 333 dump_externalAclHelper(StoreEntry * sentry, const char *name, const external_acl * list)
 334 {
 335     const external_acl *node;
 336     const wordlist *word;
 337
 338     for (node = list; node; node = node->next) {
 339         storeAppendPrintf(sentry, "%s %s", name, node->name);
 340
 341         if (!node->local_addr.isIPv6())
 342             storeAppendPrintf(sentry, " ipv4");
 343         else
 344             storeAppendPrintf(sentry, " ipv6");
 345
 346         if (node->ttl != DEFAULT_EXTERNAL_ACL_TTL)
 347             storeAppendPrintf(sentry, " ttl=%d", node->ttl);
 348
 349         if (node->negative_ttl != node->ttl)
 350             storeAppendPrintf(sentry, " negative_ttl=%d", node->negative_ttl);
 351
 352         if (node->grace)
 353             storeAppendPrintf(sentry, " grace=%d", node->grace);
 354
 355         if (node->children.n_max != DEFAULT_EXTERNAL_ACL_CHILDREN)
 356             storeAppendPrintf(sentry, " children-max=%d", node->children.n_max);
 357
 358         if (node->children.n_startup != 1)
 359             storeAppendPrintf(sentry, " children-startup=%d", node->children.n_startup);
 360
 361         if (node->children.n_idle != (node->children.n_max + node->children.n_startup) )
 362             storeAppendPrintf(sentry, " children-idle=%d", node->children.n_idle);
 363
 364         if (node->children.concurrency)
 365             storeAppendPrintf(sentry, " concurrency=%d", node->children.concurrency);
 366
 367         if (node->cache)
 368             storeAppendPrintf(sentry, " cache=%d", node->cache_size);
 369
 370         if (node->quote == external_acl::QUOTE_METHOD_SHELL)
 371             storeAppendPrintf(sentry, " protocol=2.5");
 372
 373         node->format.dump(sentry, NULL, false);
 374
 375         for (word = node->cmdline; word; word = word->next)
 376             storeAppendPrintf(sentry, " %s", word->key);
 377
 378         storeAppendPrintf(sentry, "\n");
 379     }
 380 }
 381
 382 void
 383 free_externalAclHelper(external_acl ** list)
 384 {
 385     delete *list;
 386     *list = NULL;
 387 }
 388
 389 static external_acl *
 390 find_externalAclHelper(const char *name)
 391 {
 392     external_acl *node;
 393
 394     for (node = Config.externalAclHelperList; node; node = node->next) {
 395         if (strcmp(node->name, name) == 0)
 396             return node;
 397     }
 398
 399     return NULL;
 400 }
 401
 402 void
 403 external_acl::add(const ExternalACLEntryPointer &anEntry)
 404 {
 405     trimCache();
 406     assert(anEntry != NULL);
 407     assert (anEntry->def == NULL);
 408     anEntry->def = this;
 409     ExternalACLEntry *e = const_cast<ExternalACLEntry *>(anEntry.getRaw()); // XXX: make hash a std::map of Pointer.
 410     hash_join(cache, e);
 411     dlinkAdd(e, &e->lru, &lru_list);
 412     e->lock(); //cbdataReference(e); // lock it on behalf of the hash
 413     ++cache_entries;
 414 }
 415
 416 void
 417 external_acl::trimCache()
 418 {
 419     if (cache_size && cache_entries >= cache_size) {
 420         ExternalACLEntryPointer e(static_cast<ExternalACLEntry *>(lru_list.tail->data));
 421         external_acl_cache_delete(this, e);
 422     }
 423 }
 424
 425 /******************************************************************
 426  * external acl type
 427  */
 428
 429 class external_acl_data
 430 {
 431     CBDATA_CLASS(external_acl_data);
 432
 433 public:
 434     explicit external_acl_data(external_acl *aDef) : def(cbdataReference(aDef)), name(NULL), arguments(NULL) {}
 435     ~external_acl_data();
 436
 437     external_acl *def;
 438     const char *name;
 439     wordlist *arguments;
 440 };
 441
 442 CBDATA_CLASS_INIT(external_acl_data);
 443
 444 external_acl_data::~external_acl_data()
 445 {
 446     xfree(name);
 447     wordlistDestroy(&arguments);
 448     cbdataReferenceDone(def);
 449 }
 450
 451 void
 452 ACLExternal::parse()
 453 {
 454     if (data)
 455         self_destruct();
 456
 457     char *token = ConfigParser::strtokFile();
 458
 459     if (!token)
 460         self_destruct();
 461
 462     data = new external_acl_data(find_externalAclHelper(token));
 463
 464     if (!data->def)
 465         self_destruct();
 466
 467     // def->name is the name of the external_acl_type.
 468     // this is the name of the 'acl' directive being tested
 469     data->name = xstrdup(AclMatchedName);
 470
 471     while ((token = ConfigParser::strtokFile())) {
 472         wordlistAdd(&data->arguments, token);
 473     }
 474 }
 475
 476 bool
 477 ACLExternal::valid () const
 478 {
 479 #if USE_AUTH
 480     if (data->def->require_auth) {
 481         if (authenticateSchemeCount() == 0) {
 482             debugs(28, DBG_CRITICAL, "Can't use proxy auth because no authentication schemes were compiled.");
 483             return false;
 484         }
 485
 486         if (authenticateActiveSchemeCount() == 0) {
 487             debugs(28, DBG_CRITICAL, "Can't use proxy auth because no authentication schemes are fully configured.");
 488             return false;
 489         }
 490     }
 491 #endif
 492
 493     return true;
 494 }
 495
 496 bool
 497 ACLExternal::empty () const
 498 {
 499     return false;
 500 }
 501
 502 ACLExternal::~ACLExternal()
 503 {
 504     delete data;
 505     xfree(class_);
 506 }
 507
 508 static void
 509 copyResultsFromEntry(HttpRequest *req, const ExternalACLEntryPointer &entry)
 510 {
 511     if (req) {
 512 #if USE_AUTH
 513         if (entry->user.size())
 514             req->extacl_user = entry->user;
 515
 516         if (entry->password.size())
 517             req->extacl_passwd = entry->password;
 518 #endif
 519         if (!req->tag.size())
 520             req->tag = entry->tag;
 521
 522         if (entry->log.size())
 523             req->extacl_log = entry->log;
 524
 525         if (entry->message.size())
 526             req->extacl_message = entry->message;
 527
 528         // attach the helper kv-pair to the transaction
 529         UpdateRequestNotes(req->clientConnectionManager.get(), *req, entry->notes);
 530     }
 531 }
 532
 533 static allow_t
 534 aclMatchExternal(external_acl_data *acl, ACLFilledChecklist *ch)
 535 {
 536     debugs(82, 9, HERE << "acl=\"" << acl->def->name << "\"");
 537     ExternalACLEntryPointer entry = ch->extacl_entry;
 538
 539     external_acl_message = "MISSING REQUIRED INFORMATION";
 540
 541     if (entry != NULL) {
 542         if (entry->def == acl->def) {
 543             /* Ours, use it.. if the key matches */
 544             const char *key = makeExternalAclKey(ch, acl);
 545             if (!key)
 546                 return ACCESS_DUNNO; // insufficent data to continue
 547             if (strcmp(key, (char*)entry->key) != 0) {
 548                 debugs(82, 9, "entry key='" << (char *)entry->key << "', our key='" << key << "' dont match. Discarded.");
 549                 // too bad. need a new lookup.
 550                 entry = ch->extacl_entry = NULL;
 551             }
 552         } else {
 553             /* Not ours.. get rid of it */
 554             debugs(82, 9, "entry " << entry << " not valid or not ours. Discarded.");
 555             if (entry != NULL) {
 556                 debugs(82, 9, "entry def=" << entry->def << ", our def=" << acl->def);
 557                 const char *key = makeExternalAclKey(ch, acl); // may be nil
 558                 debugs(82, 9, "entry key='" << (char *)entry->key << "', our key='" << key << "'");
 559             }
 560             entry = ch->extacl_entry = NULL;
 561         }
 562     }
 563
 564     if (!entry) {
 565         debugs(82, 9, HERE << "No helper entry available");
 566 #if USE_AUTH
 567         if (acl->def->require_auth) {
 568             /* Make sure the user is authenticated */
 569             debugs(82, 3, HERE << acl->def->name << " check user authenticated.");
 570             const allow_t ti = AuthenticateAcl(ch);
 571             if (ti != ACCESS_ALLOWED) {
 572                 debugs(82, 2, HERE << acl->def->name << " user not authenticated (" << ti << ")");
 573                 return ti;
 574             }
 575             debugs(82, 3, HERE << acl->def->name << " user is authenticated.");
 576         }
 577 #endif
 578         const char *key = makeExternalAclKey(ch, acl);
 579
 580         if (!key) {
 581             /* Not sufficient data to process */
 582             return ACCESS_DUNNO;
 583         }
 584
 585         entry = static_cast<ExternalACLEntry *>(hash_lookup(acl->def->cache, key));
 586
 587         const ExternalACLEntryPointer staleEntry = entry;
 588         if (entry != NULL && external_acl_entry_expired(acl->def, entry))
 589             entry = NULL;
 590
 591         if (entry != NULL && external_acl_grace_expired(acl->def, entry)) {
 592             // refresh in the background
 593             ExternalACLLookup::Start(ch, acl, true);
 594             debugs(82, 4, HERE << "no need to wait for the refresh of '" <<
 595                    key << "' in '" << acl->def->name << "' (ch=" << ch << ").");
 596         }
 597
 598         if (!entry) {
 599             debugs(82, 2, HERE << acl->def->name << "(\"" << key << "\") = lookup needed");
 600
 601             if (!acl->def->theHelper->queueFull()) {
 602                 debugs(82, 2, HERE << "\"" << key << "\": queueing a call.");
 603                 if (!ch->goAsync(ExternalACLLookup::Instance()))
 604                     debugs(82, 2, "\"" << key << "\": no async support!");
 605                 debugs(82, 2, HERE << "\"" << key << "\": return -1.");
 606                 return ACCESS_DUNNO; // expired cached or simply absent entry
 607             } else {
 608                 if (!staleEntry) {
 609                     debugs(82, DBG_IMPORTANT, "WARNING: external ACL '" << acl->def->name <<
 610                            "' queue overload. Request rejected '" << key << "'.");
 611                     external_acl_message = "SYSTEM TOO BUSY, TRY AGAIN LATER";
 612                     return ACCESS_DUNNO;
 613                 } else {
 614                     debugs(82, DBG_IMPORTANT, "WARNING: external ACL '" << acl->def->name <<
 615                            "' queue overload. Using stale result. '" << key << "'.");
 616                     entry = staleEntry;
 617                     /* Fall thru to processing below */
 618                 }
 619             }
 620         }
 621     }
 622
 623     debugs(82, 4, HERE << "entry = { date=" <<
 624            (long unsigned int) entry->date <<
 625            ", result=" << entry->result <<
 626            " tag=" << entry->tag <<
 627            " log=" << entry->log << " }");
 628 #if USE_AUTH
 629     debugs(82, 4, HERE << "entry user=" << entry->user);
 630 #endif
 631
 632     external_acl_cache_touch(acl->def, entry);
 633     external_acl_message = entry->message.termedBuf();
 634
 635     debugs(82, 2, HERE << acl->def->name << " = " << entry->result);
 636     copyResultsFromEntry(ch->request, entry);
 637     return entry->result;
 638 }
 639
 640 int
 641 ACLExternal::match(ACLChecklist *checklist)
 642 {
 643     allow_t answer = aclMatchExternal(data, Filled(checklist));
 644
 645     // convert to tri-state ACL match 1,0,-1
 646     switch (answer) {
 647     case ACCESS_ALLOWED:
 648         return 1; // match
 649
 650     case ACCESS_DENIED:
 651         return 0; // non-match
 652
 653     case ACCESS_DUNNO:
 654     case ACCESS_AUTH_REQUIRED:
 655     default:
 656         // If the answer is not allowed or denied (matches/not matches) and
 657         // async authentication is not in progress, then we are done.
 658         if (checklist->keepMatching())
 659             checklist->markFinished(answer, "aclMatchExternal exception");
 660         return -1; // other
 661     }
 662 }
 663
 664 SBufList
 665 ACLExternal::dump() const
 666 {
 667     external_acl_data const *acl = data;
 668     SBufList rv;
 669     rv.push_back(SBuf(acl->def->name));
 670
 671     for (wordlist *arg = acl->arguments; arg; arg = arg->next) {
 672         SBuf s;
 673         s.Printf(" %s", arg->key);
 674         rv.push_back(s);
 675     }
 676
 677     return rv;
 678 }
 679
 680 /******************************************************************
 681  * external_acl cache
 682  */
 683
 684 static void
 685 external_acl_cache_touch(external_acl * def, const ExternalACLEntryPointer &entry)
 686 {
 687     // this must not be done when nothing is being cached.
 688     if (def->cache_size <= 0 || (def->ttl <= 0 && entry->result == 1) || (def->negative_ttl <= 0 && entry->result != 1))
 689         return;
 690
 691     dlinkDelete(&entry->lru, &def->lru_list);
 692     ExternalACLEntry *e = const_cast<ExternalACLEntry *>(entry.getRaw()); // XXX: make hash a std::map of Pointer.
 693     dlinkAdd(e, &entry->lru, &def->lru_list);
 694 }
 695
 696 static char *
 697 makeExternalAclKey(ACLFilledChecklist * ch, external_acl_data * acl_data)
 698 {
 699     static MemBuf mb;
 700
 701     // check for special case tokens in the format
 702     for (Format::Token *t = acl_data->def->format.format; t ; t = t->next) {
 703
 704         if (t->type == Format::LFT_EXT_ACL_NAME) {
 705             // setup for %ACL
 706             safe_free(ch->al->_private.lastAclName);
 707             ch->al->_private.lastAclName = xstrdup(acl_data->name);
 708         }
 709
 710         if (t->type == Format::LFT_EXT_ACL_NAME) {
 711             // setup string for %DATA
 712             SBuf sb;
 713             bool first = true;
 714             for (auto arg = acl_data->arguments; arg; arg = arg->next) {
 715                 if (!first)
 716                     sb.append(" ", 1);
 717
 718                 if (acl_data->def->quote == external_acl::QUOTE_METHOD_URL) {
 719                     const char *quoted = rfc1738_escape(arg->key);
 720                     sb.append(quoted, strlen(quoted));
 721                 } else {
 722                     static MemBuf mb2;
 723                     mb2.init();
 724                     strwordquote(&mb2, arg->key);
 725                     sb.append(mb2.buf, mb2.size);
 726                     mb2.clean();
 727                 }
 728
 729                 first = false;
 730             }
 731         }
 732
 733         if (t->type == Format::LFT_USER_IDENT) {
 734             if (!ch->rfc931 || !*ch->rfc931) {
 735                 // if we fail to go async, we still return NULL and the caller
 736                 // will detect the failure in ACLExternal::match().
 737                 (void)ch->goAsync(IdentLookup::Instance());
 738                 return NULL;
 739             }
 740         }
 741     }
 742
 743     acl_data->def->format.assemble(mb, ch->al, 0);
 744
 745     return mb.buf;
 746 }
 747
 748 static int
 749 external_acl_entry_expired(external_acl * def, const ExternalACLEntryPointer &entry)
 750 {
 751     if (def->cache_size <= 0)
 752         return 1;
 753
 754     if (entry->date + (entry->result == 1 ? def->ttl : def->negative_ttl) < squid_curtime)
 755         return 1;
 756     else
 757         return 0;
 758 }
 759
 760 static int
 761 external_acl_grace_expired(external_acl * def, const ExternalACLEntryPointer &entry)
 762 {
 763     if (def->cache_size <= 0)
 764         return 1;
 765
 766     int ttl;
 767     ttl = entry->result == 1 ? def->ttl : def->negative_ttl;
 768     ttl = (ttl * (100 - def->grace)) / 100;
 769
 770     if (entry->date + ttl <= squid_curtime)
 771         return 1;
 772     else
 773         return 0;
 774 }
 775
 776 static ExternalACLEntryPointer
 777 external_acl_cache_add(external_acl * def, const char *key, ExternalACLEntryData const & data)
 778 {
 779     ExternalACLEntryPointer entry;
 780
 781     // do not bother caching this result if TTL is going to expire it immediately
 782     if (def->cache_size <= 0 || (def->ttl <= 0 && data.result == 1) || (def->negative_ttl <= 0 && data.result != 1)) {
 783         debugs(82,6, HERE);
 784         entry = new ExternalACLEntry;
 785         entry->key = xstrdup(key);
 786         entry->update(data);
 787         entry->def = def;
 788         return entry;
 789     }
 790
 791     entry = static_cast<ExternalACLEntry *>(hash_lookup(def->cache, key));
 792     debugs(82, 2, "external_acl_cache_add: Adding '" << key << "' = " << data.result);
 793
 794     if (entry != NULL) {
 795         debugs(82, 3, "updating existing entry");
 796         entry->update(data);
 797         external_acl_cache_touch(def, entry);
 798         return entry;
 799     }
 800
 801     entry = new ExternalACLEntry;
 802     entry->key = xstrdup(key);
 803     entry->update(data);
 804
 805     def->add(entry);
 806
 807     return entry;
 808 }
 809
 810 static void
 811 external_acl_cache_delete(external_acl * def, const ExternalACLEntryPointer &entry)
 812 {
 813     assert(entry != NULL);
 814     assert(def->cache_size > 0 && entry->def == def);
 815     ExternalACLEntry *e = const_cast<ExternalACLEntry *>(entry.getRaw()); // XXX: make hash a std::map of Pointer.
 816     hash_remove_link(def->cache, e);
 817     dlinkDelete(&e->lru, &def->lru_list);
 818     e->unlock(); // unlock on behalf of the hash
 819     def->cache_entries -= 1;
 820 }
 821
 822 /******************************************************************
 823  * external_acl helpers
 824  */
 825
 826 class externalAclState
 827 {
 828     CBDATA_CLASS(externalAclState);
 829
 830 public:
 831     externalAclState(external_acl* aDef, const char *aKey) :
 832         callback(NULL),
 833         callback_data(NULL),
 834         key(xstrdup(aKey)),
 835         def(cbdataReference(aDef)),
 836         queue(NULL)
 837     {}
 838     ~externalAclState();
 839
 840     EAH *callback;
 841     void *callback_data;
 842     char *key;
 843     external_acl *def;
 844     dlink_node list;
 845     externalAclState *queue;
 846 };
 847
 848 CBDATA_CLASS_INIT(externalAclState);
 849
 850 externalAclState::~externalAclState()
 851 {
 852     xfree(key);
 853     cbdataReferenceDone(callback_data);
 854     cbdataReferenceDone(def);
 855 }
 856
 857 /*
 858  * The helper program receives queries on stdin, one
 859  * per line, and must return the result on on stdout
 860  *
 861  * General result syntax:
 862  *
 863  *   OK/ERR keyword=value ...
 864  *
 865  * Keywords:
 866  *
 867  *   user=      The users name (login)
 868  *   message=   Message describing the reason
 869  *   tag=   A string tag to be applied to the request that triggered the acl match.
 870  *          applies to both OK and ERR responses.
 871  *          Won't override existing request tags.
 872  *   log=   A string to be used in access logging
 873  *
 874  * Other keywords may be added to the protocol later
 875  *
 876  * value needs to be URL-encoded or enclosed in double quotes (")
 877  * with \-escaping on any whitespace, quotes, or slashes (\).
 878  */
 879 static void
 880 externalAclHandleReply(void *data, const Helper::Reply &reply)
 881 {
 882     externalAclState *state = static_cast<externalAclState *>(data);
 883     externalAclState *next;
 884     ExternalACLEntryData entryData;
 885     entryData.result = ACCESS_DENIED;
 886
 887     debugs(82, 2, HERE << "reply=" << reply);
 888
 889     if (reply.result == Helper::Okay)
 890         entryData.result = ACCESS_ALLOWED;
 891     // XXX: handle other non-DENIED results better
 892
 893     // XXX: make entryData store a proper Helper::Reply object instead of copying.
 894
 895     entryData.notes.append(&reply.notes);
 896
 897     const char *label = reply.notes.findFirst("tag");
 898     if (label != NULL && *label != '\0')
 899         entryData.tag = label;
 900
 901     label = reply.notes.findFirst("message");
 902     if (label != NULL && *label != '\0')
 903         entryData.message = label;
 904
 905     label = reply.notes.findFirst("log");
 906     if (label != NULL && *label != '\0')
 907         entryData.log = label;
 908
 909 #if USE_AUTH
 910     label = reply.notes.findFirst("user");
 911     if (label != NULL && *label != '\0')
 912         entryData.user = label;
 913
 914     label = reply.notes.findFirst("password");
 915     if (label != NULL && *label != '\0')
 916         entryData.password = label;
 917 #endif
 918
 919     dlinkDelete(&state->list, &state->def->queue);
 920
 921     ExternalACLEntryPointer entry;
 922     if (cbdataReferenceValid(state->def)) {
 923         // only cache OK and ERR results.
 924         if (reply.result == Helper::Okay || reply.result == Helper::Error)
 925             entry = external_acl_cache_add(state->def, state->key, entryData);
 926         else {
 927             const ExternalACLEntryPointer oldentry = static_cast<ExternalACLEntry *>(hash_lookup(state->def->cache, state->key));
 928
 929             if (oldentry != NULL)
 930                 external_acl_cache_delete(state->def, oldentry);
 931         }
 932     }
 933
 934     do {
 935         void *cbdata;
 936         if (state->callback && cbdataReferenceValidDone(state->callback_data, &cbdata))
 937             state->callback(cbdata, entry);
 938
 939         next = state->queue;
 940         state->queue = NULL;
 941
 942         delete state;
 943
 944         state = next;
 945     } while (state);
 946 }
 947
 948 void
 949 ACLExternal::ExternalAclLookup(ACLChecklist *checklist, ACLExternal * me)
 950 {
 951     ExternalACLLookup::Start(checklist, me->data, false);
 952 }
 953
 954 void
 955 ExternalACLLookup::Start(ACLChecklist *checklist, external_acl_data *acl, bool inBackground)
 956 {
 957     external_acl *def = acl->def;
 958
 959     ACLFilledChecklist *ch = Filled(checklist);
 960     const char *key = makeExternalAclKey(ch, acl);
 961     assert(key); // XXX: will fail if EXT_ACL_IDENT case needs an async lookup
 962
 963     debugs(82, 2, HERE << (inBackground ? "bg" : "fg") << " lookup in '" <<
 964            def->name << "' for '" << key << "'");
 965
 966     /* Check for a pending lookup to hook into */
 967     // only possible if we are caching results.
 968     externalAclState *oldstate = NULL;
 969     if (def->cache_size > 0) {
 970         for (dlink_node *node = def->queue.head; node; node = node->next) {
 971             externalAclState *oldstatetmp = static_cast<externalAclState *>(node->data);
 972
 973             if (strcmp(key, oldstatetmp->key) == 0) {
 974                 oldstate = oldstatetmp;
 975                 break;
 976             }
 977         }
 978     }
 979
 980     // A background refresh has no need to piggiback on a pending request:
 981     // When the pending request completes, the cache will be refreshed anyway.
 982     if (oldstate && inBackground) {
 983         debugs(82, 7, HERE << "'" << def->name << "' queue is already being refreshed (ch=" << ch << ")");
 984         return;
 985     }
 986
 987     externalAclState *state = new externalAclState(def, key);
 988
 989     if (!inBackground) {
 990         state->callback = &ExternalACLLookup::LookupDone;
 991         state->callback_data = cbdataReference(checklist);
 992     }
 993
 994     if (oldstate) {
 995         /* Hook into pending lookup */
 996         state->queue = oldstate->queue;
 997         oldstate->queue = state;
 998     } else {
 999         /* No pending lookup found. Sumbit to helper */
1000
1001         MemBuf buf;
1002         buf.init();
1003         buf.appendf("%s\n", key);
1004         debugs(82, 4, "externalAclLookup: looking up for '" << key << "' in '" << def->name << "'.");
1005
1006         if (!def->theHelper->trySubmit(buf.buf, externalAclHandleReply, state)) {
1007             debugs(82, 7, HERE << "'" << def->name << "' submit to helper failed");
1008             assert(inBackground); // or the caller should have checked
1009             delete state;
1010             return;
1011         }
1012
1013         dlinkAdd(state, &state->list, &def->queue);
1014
1015         buf.clean();
1016     }
1017
1018     debugs(82, 4, "externalAclLookup: will wait for the result of '" << key <<
1019            "' in '" << def->name << "' (ch=" << ch << ").");
1020 }
1021
1022 static void
1023 externalAclStats(StoreEntry * sentry)
1024 {
1025     for (external_acl *p = Config.externalAclHelperList; p; p = p->next) {
1026         storeAppendPrintf(sentry, "External ACL Statistics: %s\n", p->name);
1027         storeAppendPrintf(sentry, "Cache size: %d\n", p->cache->count);
1028         assert(p->theHelper);
1029         p->theHelper->packStatsInto(sentry);
1030         storeAppendPrintf(sentry, "\n");
1031     }
1032 }
1033
1034 static void
1035 externalAclRegisterWithCacheManager(void)
1036 {
1037     Mgr::RegisterAction("external_acl",
1038                         "External ACL stats",
1039                         externalAclStats, 0, 1);
1040 }
1041
1042 void
1043 externalAclInit(void)
1044 {
1045     for (external_acl *p = Config.externalAclHelperList; p; p = p->next) {
1046         if (!p->cache)
1047             p->cache = hash_create((HASHCMP *) strcmp, hashPrime(1024), hash4);
1048
1049         if (!p->theHelper)
1050             p->theHelper = new helper(p->name);
1051
1052         p->theHelper->cmdline = p->cmdline;
1053
1054         p->theHelper->childs.updateLimits(p->children);
1055
1056         p->theHelper->ipc_type = IPC_TCP_SOCKET;
1057
1058         p->theHelper->addr = p->local_addr;
1059
1060         helperOpenServers(p->theHelper);
1061     }
1062
1063     externalAclRegisterWithCacheManager();
1064 }
1065
1066 void
1067 externalAclShutdown(void)
1068 {
1069     external_acl *p;
1070
1071     for (p = Config.externalAclHelperList; p; p = p->next) {
1072         helperShutdown(p->theHelper);
1073     }
1074 }
1075
1076 ExternalACLLookup ExternalACLLookup::instance_;
1077 ExternalACLLookup *
1078 ExternalACLLookup::Instance()
1079 {
1080     return &instance_;
1081 }
1082
1083 void
1084 ExternalACLLookup::checkForAsync(ACLChecklist *checklist)const
1085 {
1086     /* TODO: optimise this - we probably have a pointer to this
1087      * around somewhere */
1088     ACL *acl = ACL::FindByName(AclMatchedName);
1089     assert(acl);
1090     ACLExternal *me = dynamic_cast<ACLExternal *> (acl);
1091     assert (me);
1092     ACLExternal::ExternalAclLookup(checklist, me);
1093 }
1094
1095 /// Called when an async lookup returns
1096 void
1097 ExternalACLLookup::LookupDone(void *data, const ExternalACLEntryPointer &result)
1098 {
1099     ACLFilledChecklist *checklist = Filled(static_cast<ACLChecklist*>(data));
1100     checklist->extacl_entry = result;
1101     checklist->resumeNonBlockingCheck(ExternalACLLookup::Instance());
1102 }
1103
1104 /* This registers "external" in the registry. To do dynamic definitions
1105  * of external ACL's, rather than a static prototype, have a Prototype instance
1106  * prototype in the class that defines each external acl 'class'.
1107  * Then, then the external acl instance is created, it self registers under
1108  * it's name.
1109  * Be sure that clone is fully functional for that acl class though!
1110  */
1111 ACL::Prototype ACLExternal::RegistryProtoype(&ACLExternal::RegistryEntry_, "external");
1112
1113 ACLExternal ACLExternal::RegistryEntry_("external");
1114
1115 ACL *
1116 ACLExternal::clone() const
1117 {
1118     return new ACLExternal(*this);
1119 }
1120
1121 ACLExternal::ACLExternal(char const *theClass) : data(NULL), class_(xstrdup(theClass))
1122 {}
1123
1124 ACLExternal::ACLExternal(ACLExternal const & old) : data(NULL), class_(old.class_ ? xstrdup(old.class_) : NULL)
1125 {
1126     /* we don't have copy constructors for the data yet */
1127     assert(!old.data);
1128 }
1129
1130 char const *
1131 ACLExternal::typeString() const
1132 {
1133     return class_;
1134 }
1135
1136 bool
1137 ACLExternal::isProxyAuth() const
1138 {
1139 #if USE_AUTH
1140     return data->def->require_auth;
1141 #else
1142     return false;
1143 #endif
1144 }
1145