]> git.ipfire.org Git - thirdparty/squid.git/blob - src/external_acl.cc
projects / thirdparty / squid.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Convert external ACL to use ACL states
[thirdparty/squid.git] / src / external_acl.cc
1
2 /*
3 * $Id$
4 *
5 * DEBUG: section 82 External ACL
6 * AUTHOR: Henrik Nordstrom, MARA Systems AB
7 *
8 * SQUID Web Proxy Cache http://www.squid-cache.org/
9 * ----------------------------------------------------------
10 *
11 * The contents of this file is Copyright (C) 2002 by MARA Systems AB,
12 * Sweden, unless otherwise is indicated in the specific function. The
13 * author gives his full permission to include this file into the Squid
14 * software product under the terms of the GNU General Public License as
15 * published by the Free Software Foundation; either version 2 of the
16 * License, or (at your option) any later version.
17 *
18 * Squid is the result of efforts by numerous individuals from
19 * the Internet community; see the CONTRIBUTORS file for full
20 * details. Many organizations have provided support for Squid's
21 * development; see the SPONSORS file for full details. Squid is
22 * Copyrighted (C) 2001 by the Regents of the University of
23 * California; see the COPYRIGHT file for full details. Squid
24 * incorporates software developed and/or copyrighted by other
25 * sources; see the CREDITS file for full details.
26 *
27 * This program is free software; you can redistribute it and/or modify
28 * it under the terms of the GNU General Public License as published by
29 * the Free Software Foundation; either version 2 of the License, or
30 * (at your option) any later version.
31 *
32 * This program is distributed in the hope that it will be useful,
33 * but WITHOUT ANY WARRANTY; without even the implied warranty of
34 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
35 * GNU General Public License for more details.
36 *
37 * You should have received a copy of the GNU General Public License
38 * along with this program; if not, write to the Free Software
39 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA.
40 *
41 */
42
43 #include "squid.h"
44 #include "mgr/Registration.h"
45 #include "ExternalACL.h"
46 #include "ExternalACLEntry.h"
47 #if USE_AUTH
48 #include "auth/Acl.h"
49 #include "auth/Gadgets.h"
50 #include "auth/UserRequest.h"
51 #endif
52 #include "SquidTime.h"
53 #include "Store.h"
54 #include "fde.h"
55 #include "acl/FilledChecklist.h"
56 #include "acl/Acl.h"
57 #if USE_IDENT
58 #include "ident/AclIdent.h"
59 #endif
60 #include "ip/tools.h"
61 #include "client_side.h"
62 #include "comm/Connection.h"
63 #include "HttpRequest.h"
64 #include "HttpReply.h"
65 #include "helper.h"
66 #include "MemBuf.h"
67 #include "rfc1738.h"
68 #include "URLScheme.h"
69 #include "wordlist.h"
70 #if USE_SSL
71 #include "ssl/support.h"
72 #endif
73
74 #ifndef DEFAULT_EXTERNAL_ACL_TTL
75 #define DEFAULT_EXTERNAL_ACL_TTL 1 * 60 * 60
76 #endif
77 #ifndef DEFAULT_EXTERNAL_ACL_CHILDREN
78 #define DEFAULT_EXTERNAL_ACL_CHILDREN 5
79 #endif
80
81 typedef struct _external_acl_format external_acl_format;
82
83 static char *makeExternalAclKey(ACLFilledChecklist * ch, external_acl_data * acl_data);
84 static void external_acl_cache_delete(external_acl * def, external_acl_entry * entry);
85 static int external_acl_entry_expired(external_acl * def, external_acl_entry * entry);
86 static int external_acl_grace_expired(external_acl * def, external_acl_entry * entry);
87 static void external_acl_cache_touch(external_acl * def, external_acl_entry * entry);
88 static external_acl_entry *external_acl_cache_add(external_acl * def, const char *key, ExternalACLEntryData const &data);
89
90 /******************************************************************
91 * external_acl directive
92 */
93
94 class external_acl
95 {
96
97 public:
98 external_acl *next;
99
100 void add(ExternalACLEntry *);
101
102 void trimCache();
103
104 int ttl;
105
106 int negative_ttl;
107
108 int grace;
109
110 char *name;
111
112 external_acl_format *format;
113
114 wordlist *cmdline;
115
116 HelperChildConfig children;
117
118 helper *theHelper;
119
120 hash_table *cache;
121
122 dlink_list lru_list;
123
124 int cache_size;
125
126 int cache_entries;
127
128 dlink_list queue;
129
130 #if USE_AUTH
131 /**
132 * Configuration flag. May only be altered by the configuration parser.
133 *
134 * Indicates that all uses of this external_acl_type helper require authentication
135 * details to be processed. If none are available its a fail match.
136 */
137 bool require_auth;
138 #endif
139
140 enum {
141 QUOTE_METHOD_SHELL = 1,
142 QUOTE_METHOD_URL
143 } quote;
144
145 Ip::Address local_addr;
146 };
147
148 struct _external_acl_format {
149 enum format_type {
150 EXT_ACL_UNKNOWN,
151 #if USE_AUTH
152 EXT_ACL_LOGIN,
153 #endif
154 #if USE_IDENT
155 EXT_ACL_IDENT,
156 #endif
157 EXT_ACL_SRC,
158 EXT_ACL_SRCPORT,
159 #if USE_SQUID_EUI
160 EXT_ACL_SRCEUI48,
161 EXT_ACL_SRCEUI64,
162 #endif
163 EXT_ACL_MYADDR,
164 EXT_ACL_MYPORT,
165 EXT_ACL_URI,
166 EXT_ACL_DST,
167 EXT_ACL_PROTO,
168 EXT_ACL_PORT,
169 EXT_ACL_PATH,
170 EXT_ACL_METHOD,
171
172 EXT_ACL_HEADER_REQUEST,
173 EXT_ACL_HEADER_REQUEST_MEMBER,
174 EXT_ACL_HEADER_REQUEST_ID,
175 EXT_ACL_HEADER_REQUEST_ID_MEMBER,
176
177 EXT_ACL_HEADER_REPLY,
178 EXT_ACL_HEADER_REPLY_MEMBER,
179 EXT_ACL_HEADER_REPLY_ID,
180 EXT_ACL_HEADER_REPLY_ID_MEMBER,
181
182 #if USE_SSL
183 EXT_ACL_USER_CERT,
184 EXT_ACL_CA_CERT,
185 EXT_ACL_USER_CERT_RAW,
186 EXT_ACL_USER_CERTCHAIN_RAW,
187 #endif
188 #if USE_AUTH
189 EXT_ACL_EXT_USER,
190 #endif
191 EXT_ACL_EXT_LOG,
192 EXT_ACL_TAG,
193 EXT_ACL_END
194 } type;
195 external_acl_format *next;
196 char *header;
197 char *member;
198 char separator;
199 http_hdr_type header_id;
200 };
201
202 /* FIXME: These are not really cbdata, but it is an easy way
203 * to get them pooled, refcounted, accounted and freed properly...
204 */
205 CBDATA_TYPE(external_acl);
206 CBDATA_TYPE(external_acl_format);
207
208 static void
209 free_external_acl_format(void *data)
210 {
211 external_acl_format *p = static_cast<external_acl_format *>(data);
212 safe_free(p->header);
213 }
214
215 static void
216 free_external_acl(void *data)
217 {
218 external_acl *p = static_cast<external_acl *>(data);
219 safe_free(p->name);
220
221 while (p->format) {
222 external_acl_format *f = p->format;
223 p->format = f->next;
224 cbdataFree(f);
225 }
226
227 wordlistDestroy(&p->cmdline);
228
229 if (p->theHelper) {
230 helperShutdown(p->theHelper);
231 delete p->theHelper;
232 p->theHelper = NULL;
233 }
234
235 while (p->lru_list.tail)
236 external_acl_cache_delete(p, static_cast<external_acl_entry *>(p->lru_list.tail->data));
237 if (p->cache)
238 hashFreeMemory(p->cache);
239 }
240
241 /**
242 * Parse the External ACL format %<{.*} and %>{.*} token(s) to pass a specific
243 * request or reply header to external helper.
244 *
245 \param header - the token being parsed (without the identifying prefix)
246 \param type - format enum identifier for this element, pulled from identifying prefix
247 \param format - structure to contain all the info about this format element.
248 */
249 void
250 parse_header_token(external_acl_format *format, char *header, const _external_acl_format::format_type type)
251 {
252 /* header format */
253 char *member, *end;
254
255 /** Cut away the closing brace */
256 end = strchr(header, '}');
257 if (end && strlen(end) == 1)
258 *end = '\0';
259 else
260 self_destruct();
261
262 member = strchr(header, ':');
263
264 if (member) {
265 /* Split in header and member */
266 *member++ = '\0';
267
268 if (!xisalnum(*member))
269 format->separator = *member++;
270 else
271 format->separator = ',';
272
273 format->member = xstrdup(member);
274
275 if (type == _external_acl_format::EXT_ACL_HEADER_REQUEST)
276 format->type = _external_acl_format::EXT_ACL_HEADER_REQUEST_MEMBER;
277 else
278 format->type = _external_acl_format::EXT_ACL_HEADER_REQUEST_MEMBER;
279 } else {
280 format->type = type;
281 }
282
283 format->header = xstrdup(header);
284 format->header_id = httpHeaderIdByNameDef(header, strlen(header));
285
286 if (format->header_id != -1) {
287 if (member) {
288 if (type == _external_acl_format::EXT_ACL_HEADER_REQUEST)
289 format->type = _external_acl_format::EXT_ACL_HEADER_REQUEST_ID_MEMBER;
290 else
291 format->type = _external_acl_format::EXT_ACL_HEADER_REPLY_ID_MEMBER;
292 } else {
293 if (type == _external_acl_format::EXT_ACL_HEADER_REQUEST)
294 format->type = _external_acl_format::EXT_ACL_HEADER_REQUEST_ID;
295 else
296 format->type = _external_acl_format::EXT_ACL_HEADER_REPLY_ID;
297 }
298 }
299 }
300
301 void
302 parse_externalAclHelper(external_acl ** list)
303 {
304 external_acl *a;
305 char *token;
306 external_acl_format **p;
307
308 CBDATA_INIT_TYPE_FREECB(external_acl, free_external_acl);
309 CBDATA_INIT_TYPE_FREECB(external_acl_format, free_external_acl_format);
310
311 a = cbdataAlloc(external_acl);
312
313 /* set defaults */
314 a->ttl = DEFAULT_EXTERNAL_ACL_TTL;
315 a->negative_ttl = -1;
316 a->cache_size = 256*1024;
317 a->children.n_max = DEFAULT_EXTERNAL_ACL_CHILDREN;
318 a->children.n_startup = a->children.n_max;
319 a->children.n_idle = 1;
320 a->local_addr.SetLocalhost();
321 a->quote = external_acl::QUOTE_METHOD_URL;
322
323 token = strtok(NULL, w_space);
324
325 if (!token)
326 self_destruct();
327
328 a->name = xstrdup(token);
329
330 token = strtok(NULL, w_space);
331
332 /* Parse options */
333 while (token) {
334 if (strncmp(token, "ttl=", 4) == 0) {
335 a->ttl = atoi(token + 4);
336 } else if (strncmp(token, "negative_ttl=", 13) == 0) {
337 a->negative_ttl = atoi(token + 13);
338 } else if (strncmp(token, "children=", 9) == 0) {
339 a->children.n_max = atoi(token + 9);
340 debugs(0, 0, "WARNING: external_acl_type option children=N has been deprecated in favor of children-max=N and children-startup=N");
341 } else if (strncmp(token, "children-max=", 13) == 0) {
342 a->children.n_max = atoi(token + 13);
343 } else if (strncmp(token, "children-startup=", 17) == 0) {
344 a->children.n_startup = atoi(token + 17);
345 } else if (strncmp(token, "children-idle=", 14) == 0) {
346 a->children.n_idle = atoi(token + 14);
347 } else if (strncmp(token, "concurrency=", 12) == 0) {
348 a->children.concurrency = atoi(token + 12);
349 } else if (strncmp(token, "cache=", 6) == 0) {
350 a->cache_size = atoi(token + 6);
351 } else if (strncmp(token, "grace=", 6) == 0) {
352 a->grace = atoi(token + 6);
353 } else if (strcmp(token, "protocol=2.5") == 0) {
354 a->quote = external_acl::QUOTE_METHOD_SHELL;
355 } else if (strcmp(token, "protocol=3.0") == 0) {
356 a->quote = external_acl::QUOTE_METHOD_URL;
357 } else if (strcmp(token, "quote=url") == 0) {
358 a->quote = external_acl::QUOTE_METHOD_URL;
359 } else if (strcmp(token, "quote=shell") == 0) {
360 a->quote = external_acl::QUOTE_METHOD_SHELL;
361
362 /* INET6: allow admin to configure some helpers explicitly to
363 bind to IPv4/v6 localhost port. */
364 } else if (strcmp(token, "ipv4") == 0) {
365 if ( !a->local_addr.SetIPv4() ) {
366 debugs(3, 0, "WARNING: Error converting " << a->local_addr << " to IPv4 in " << a->name );
367 }
368 } else if (strcmp(token, "ipv6") == 0) {
369 if (!Ip::EnableIpv6)
370 debugs(3, 0, "WARNING: --enable-ipv6 required for external ACL helpers to use IPv6: " << a->name );
371 // else nothing to do.
372 } else {
373 break;
374 }
375
376 token = strtok(NULL, w_space);
377 }
378
379 /* check that child startup value is sane. */
380 if (a->children.n_startup > a->children.n_max)
381 a->children.n_startup = a->children.n_max;
382
383 /* check that child idle value is sane. */
384 if (a->children.n_idle > a->children.n_max)
385 a->children.n_idle = a->children.n_max;
386 if (a->children.n_idle < 1)
387 a->children.n_idle = 1;
388
389 if (a->negative_ttl == -1)
390 a->negative_ttl = a->ttl;
391
392 /* Parse format */
393 p = &a->format;
394
395 while (token) {
396 external_acl_format *format;
397
398 /* stop on first non-format token found */
399
400 if (*token != '%')
401 break;
402
403 format = cbdataAlloc(external_acl_format);
404
405 if (strncmp(token, "%{", 2) == 0) {
406 // deprecated. but assume the old configs all referred to request headers.
407 debugs(82, DBG_IMPORTANT, "WARNING: external_acl_type format %{...} is being replaced by %>{...} for : " << token);
408 parse_header_token(format, (token+2), _external_acl_format::EXT_ACL_HEADER_REQUEST);
409 } else if (strncmp(token, "%>{", 3) == 0) {
410 parse_header_token(format, (token+3), _external_acl_format::EXT_ACL_HEADER_REQUEST);
411 } else if (strncmp(token, "%<{", 3) == 0) {
412 parse_header_token(format, (token+3), _external_acl_format::EXT_ACL_HEADER_REPLY);
413 #if USE_AUTH
414 } else if (strcmp(token, "%LOGIN") == 0) {
415 format->type = _external_acl_format::EXT_ACL_LOGIN;
416 a->require_auth = true;
417 #endif
418 }
419
420 #if USE_IDENT
421 else if (strcmp(token, "%IDENT") == 0)
422 format->type = _external_acl_format::EXT_ACL_IDENT;
423
424 #endif
425
426 else if (strcmp(token, "%SRC") == 0)
427 format->type = _external_acl_format::EXT_ACL_SRC;
428 else if (strcmp(token, "%SRCPORT") == 0)
429 format->type = _external_acl_format::EXT_ACL_SRCPORT;
430 #if USE_SQUID_EUI
431 else if (strcmp(token, "%SRCEUI48") == 0)
432 format->type = _external_acl_format::EXT_ACL_SRCEUI48;
433 else if (strcmp(token, "%SRCEUI64") == 0)
434 format->type = _external_acl_format::EXT_ACL_SRCEUI64;
435 #endif
436 else if (strcmp(token, "%MYADDR") == 0)
437 format->type = _external_acl_format::EXT_ACL_MYADDR;
438 else if (strcmp(token, "%MYPORT") == 0)
439 format->type = _external_acl_format::EXT_ACL_MYPORT;
440 else if (strcmp(token, "%URI") == 0)
441 format->type = _external_acl_format::EXT_ACL_URI;
442 else if (strcmp(token, "%DST") == 0)
443 format->type = _external_acl_format::EXT_ACL_DST;
444 else if (strcmp(token, "%PROTO") == 0)
445 format->type = _external_acl_format::EXT_ACL_PROTO;
446 else if (strcmp(token, "%PORT") == 0)
447 format->type = _external_acl_format::EXT_ACL_PORT;
448 else if (strcmp(token, "%PATH") == 0)
449 format->type = _external_acl_format::EXT_ACL_PATH;
450 else if (strcmp(token, "%METHOD") == 0)
451 format->type = _external_acl_format::EXT_ACL_METHOD;
452
453 #if USE_SSL
454 else if (strcmp(token, "%USER_CERT") == 0)
455 format->type = _external_acl_format::EXT_ACL_USER_CERT_RAW;
456 else if (strcmp(token, "%USER_CERTCHAIN") == 0)
457 format->type = _external_acl_format::EXT_ACL_USER_CERTCHAIN_RAW;
458 else if (strncmp(token, "%USER_CERT_", 11) == 0) {
459 format->type = _external_acl_format::EXT_ACL_USER_CERT;
460 format->header = xstrdup(token + 11);
461 } else if (strncmp(token, "%CA_CERT_", 11) == 0) {
462 format->type = _external_acl_format::EXT_ACL_USER_CERT;
463 format->header = xstrdup(token + 11);
464 }
465 #endif
466 #if USE_AUTH
467 else if (strcmp(token, "%EXT_USER") == 0)
468 format->type = _external_acl_format::EXT_ACL_EXT_USER;
469 #endif
470 else if (strcmp(token, "%EXT_LOG") == 0)
471 format->type = _external_acl_format::EXT_ACL_EXT_LOG;
472 else if (strcmp(token, "%TAG") == 0)
473 format->type = _external_acl_format::EXT_ACL_TAG;
474 else {
475 debugs(0,0, "ERROR: Unknown Format token " << token);
476 self_destruct();
477 }
478
479 *p = format;
480 p = &format->next;
481 token = strtok(NULL, w_space);
482 }
483
484 /* There must be at least one format token */
485 if (!a->format)
486 self_destruct();
487
488 /* helper */
489 if (!token)
490 self_destruct();
491
492 wordlistAdd(&a->cmdline, token);
493
494 /* arguments */
495 parse_wordlist(&a->cmdline);
496
497 while (*list)
498 list = &(*list)->next;
499
500 *list = a;
501 }
502
503 void
504 dump_externalAclHelper(StoreEntry * sentry, const char *name, const external_acl * list)
505 {
506 const external_acl *node;
507 const external_acl_format *format;
508 const wordlist *word;
509
510 for (node = list; node; node = node->next) {
511 storeAppendPrintf(sentry, "%s %s", name, node->name);
512
513 if (!node->local_addr.IsIPv6())
514 storeAppendPrintf(sentry, " ipv4");
515 else
516 storeAppendPrintf(sentry, " ipv6");
517
518 if (node->ttl != DEFAULT_EXTERNAL_ACL_TTL)
519 storeAppendPrintf(sentry, " ttl=%d", node->ttl);
520
521 if (node->negative_ttl != node->ttl)
522 storeAppendPrintf(sentry, " negative_ttl=%d", node->negative_ttl);
523
524 if (node->grace)
525 storeAppendPrintf(sentry, " grace=%d", node->grace);
526
527 if (node->children.n_max != DEFAULT_EXTERNAL_ACL_CHILDREN)
528 storeAppendPrintf(sentry, " children-max=%d", node->children.n_max);
529
530 if (node->children.n_startup != 1)
531 storeAppendPrintf(sentry, " children-startup=%d", node->children.n_startup);
532
533 if (node->children.n_idle != (node->children.n_max + node->children.n_startup) )
534 storeAppendPrintf(sentry, " children-idle=%d", node->children.n_idle);
535
536 if (node->children.concurrency)
537 storeAppendPrintf(sentry, " concurrency=%d", node->children.concurrency);
538
539 if (node->cache)
540 storeAppendPrintf(sentry, " cache=%d", node->cache_size);
541
542 for (format = node->format; format; format = format->next) {
543 switch (format->type) {
544
545 case _external_acl_format::EXT_ACL_HEADER_REQUEST:
546 case _external_acl_format::EXT_ACL_HEADER_REQUEST_ID:
547 storeAppendPrintf(sentry, " %%>{%s}", format->header);
548 break;
549
550 case _external_acl_format::EXT_ACL_HEADER_REQUEST_MEMBER:
551 case _external_acl_format::EXT_ACL_HEADER_REQUEST_ID_MEMBER:
552 storeAppendPrintf(sentry, " %%>{%s:%s}", format->header, format->member);
553 break;
554
555 case _external_acl_format::EXT_ACL_HEADER_REPLY:
556 case _external_acl_format::EXT_ACL_HEADER_REPLY_ID:
557 storeAppendPrintf(sentry, " %%<{%s}", format->header);
558 break;
559
560 case _external_acl_format::EXT_ACL_HEADER_REPLY_MEMBER:
561 case _external_acl_format::EXT_ACL_HEADER_REPLY_ID_MEMBER:
562 storeAppendPrintf(sentry, " %%<{%s:%s}", format->header, format->member);
563 break;
564 #define DUMP_EXT_ACL_TYPE(a) \
565 case _external_acl_format::EXT_ACL_##a: \
566 storeAppendPrintf(sentry, " %%%s", #a); \
567 break
568 #if USE_AUTH
569 DUMP_EXT_ACL_TYPE(LOGIN);
570 #endif
571 #if USE_IDENT
572
573 DUMP_EXT_ACL_TYPE(IDENT);
574 #endif
575
576 DUMP_EXT_ACL_TYPE(SRC);
577 DUMP_EXT_ACL_TYPE(SRCPORT);
578 #if USE_SQUID_EUI
579 DUMP_EXT_ACL_TYPE(SRCEUI48);
580 DUMP_EXT_ACL_TYPE(SRCEUI64);
581 #endif
582
583 DUMP_EXT_ACL_TYPE(MYADDR);
584 DUMP_EXT_ACL_TYPE(MYPORT);
585 DUMP_EXT_ACL_TYPE(URI);
586 DUMP_EXT_ACL_TYPE(DST);
587 DUMP_EXT_ACL_TYPE(PROTO);
588 DUMP_EXT_ACL_TYPE(PORT);
589 DUMP_EXT_ACL_TYPE(PATH);
590 DUMP_EXT_ACL_TYPE(METHOD);
591 #if USE_SSL
592
593 case _external_acl_format::EXT_ACL_USER_CERT_RAW:
594 storeAppendPrintf(sentry, " %%USER_CERT");
595 break;
596
597 case _external_acl_format::EXT_ACL_USER_CERTCHAIN_RAW:
598 storeAppendPrintf(sentry, " %%USER_CERTCHAIN");
599 break;
600
601 case _external_acl_format::EXT_ACL_USER_CERT:
602 storeAppendPrintf(sentry, " %%USER_CERT_%s", format->header);
603 break;
604
605 case _external_acl_format::EXT_ACL_CA_CERT:
606 storeAppendPrintf(sentry, " %%USER_CERT_%s", format->header);
607 break;
608 #endif
609 #if USE_AUTH
610 DUMP_EXT_ACL_TYPE(EXT_USER);
611 #endif
612 DUMP_EXT_ACL_TYPE(EXT_LOG);
613 DUMP_EXT_ACL_TYPE(TAG);
614 default:
615 fatal("unknown external_acl format error");
616 break;
617 }
618 }
619
620 for (word = node->cmdline; word; word = word->next)
621 storeAppendPrintf(sentry, " %s", word->key);
622
623 storeAppendPrintf(sentry, "\n");
624 }
625 }
626
627 void
628 free_externalAclHelper(external_acl ** list)
629 {
630 while (*list) {
631 external_acl *node = *list;
632 *list = node->next;
633 node->next = NULL;
634 cbdataFree(node);
635 }
636 }
637
638 static external_acl *
639 find_externalAclHelper(const char *name)
640 {
641 external_acl *node;
642
643 for (node = Config.externalAclHelperList; node; node = node->next) {
644 if (strcmp(node->name, name) == 0)
645 return node;
646 }
647
648 return NULL;
649 }
650
651 void
652 external_acl::add(ExternalACLEntry *anEntry)
653 {
654 trimCache();
655 assert (anEntry->def == NULL);
656 anEntry->def = this;
657 hash_join(cache, anEntry);
658 dlinkAdd(anEntry, &anEntry->lru, &lru_list);
659 cache_entries++;
660 }
661
662 void
663 external_acl::trimCache()
664 {
665 if (cache_size && cache_entries >= cache_size)
666 external_acl_cache_delete(this, static_cast<external_acl_entry *>(lru_list.tail->data));
667 }
668
669
670 /******************************************************************
671 * external acl type
672 */
673
674 struct _external_acl_data {
675 external_acl *def;
676 wordlist *arguments;
677 };
678
679 CBDATA_TYPE(external_acl_data);
680 static void
681 free_external_acl_data(void *data)
682 {
683 external_acl_data *p = static_cast<external_acl_data *>(data);
684 wordlistDestroy(&p->arguments);
685 cbdataReferenceDone(p->def);
686 }
687
688 void
689 ACLExternal::parse()
690 {
691 char *token;
692
693 if (data)
694 self_destruct();
695
696 CBDATA_INIT_TYPE_FREECB(external_acl_data, free_external_acl_data);
697
698 data = cbdataAlloc(external_acl_data);
699
700 token = strtok(NULL, w_space);
701
702 if (!token)
703 self_destruct();
704
705 data->def = cbdataReference(find_externalAclHelper(token));
706
707 if (!data->def)
708 self_destruct();
709
710 while ((token = strtokFile())) {
711 wordlistAdd(&data->arguments, token);
712 }
713 }
714
715 bool
716 ACLExternal::valid () const
717 {
718 #if USE_AUTH
719 if (data->def->require_auth) {
720 if (authenticateSchemeCount() == 0) {
721 debugs(28, 0, "Can't use proxy auth because no authentication schemes were compiled.");
722 return false;
723 }
724
725 if (authenticateActiveSchemeCount() == 0) {
726 debugs(28, 0, "Can't use proxy auth because no authentication schemes are fully configured.");
727 return false;
728 }
729 }
730 #endif
731
732 return true;
733 }
734
735 bool
736 ACLExternal::empty () const
737 {
738 return false;
739 }
740
741 ACLExternal::~ACLExternal()
742 {
743 cbdataFree(data);
744 safe_free (class_);
745 }
746
747 static allow_t
748 aclMatchExternal(external_acl_data *acl, ACLFilledChecklist *ch)
749 {
750 const char *key = "";
751 debugs(82, 9, HERE << "acl=\"" << acl->def->name << "\"");
752 external_acl_entry *entry = ch->extacl_entry;
753
754 if (entry) {
755 if (cbdataReferenceValid(entry) && entry->def == acl->def) {
756 /* Ours, use it.. */
757 } else {
758 /* Not valid, or not ours.. get rid of it */
759 debugs(82, 9, HERE << "entry " << entry << " not valid or not ours. Discarded.");
760 if (entry) {
761 debugs(82, 9, HERE << "entry def=" << entry->def << ", our def=" << acl->def);
762 key = makeExternalAclKey(ch, acl);
763 debugs(82, 9, HERE << "entry key='" << (char *)entry->key << "', our key='" << key << "'");
764 }
765 cbdataReferenceDone(ch->extacl_entry);
766 entry = NULL;
767 }
768 }
769
770 external_acl_message = "MISSING REQUIRED INFORMATION";
771
772 if (!entry) {
773 debugs(82, 9, HERE << "No helper entry available");
774 #if USE_AUTH
775 if (acl->def->require_auth) {
776 int ti = AuthenticateAcl(ch);
777 /* Make sure the user is authenticated */
778 debugs(82, 3, HERE << acl->def->name << " check user authenticated.");
779 if (ti != 1) {
780 debugs(82, 2, HERE << acl->def->name << " user not authenticated (" << ti << ")");
781 return ACCESS_AUTH_REQUIRED;
782 }
783 debugs(82, 3, HERE << acl->def->name << " user is authenticated.");
784 }
785 #endif
786 key = makeExternalAclKey(ch, acl);
787
788 if (!key) {
789 /* Not sufficient data to process */
790 return ACCESS_DUNNO;
791 }
792
793 entry = static_cast<external_acl_entry *>(hash_lookup(acl->def->cache, key));
794
795 if (!entry || external_acl_grace_expired(acl->def, entry)) {
796 debugs(82, 2, HERE << acl->def->name << "(\"" << key << "\") = lookup needed");
797 debugs(82, 2, HERE << "\"" << key << "\": entry=@" <<
798 entry << ", age=" << (entry ? (long int) squid_curtime - entry->date : 0));
799
800 if (acl->def->theHelper->stats.queue_size <= (int)acl->def->theHelper->childs.n_active) {
801 debugs(82, 2, HERE << "\"" << key << "\": queueing a call.");
802 ch->changeState(ExternalACLLookup::Instance());
803 debugs(82, 2, HERE << "\"" << key << "\": return -1.");
804 return ACCESS_DUNNO; // to get here we have to have an expired cache entry. MUST not use.
805 } else {
806 if (!entry) {
807 debugs(82, DBG_IMPORTANT, "WARNING: external ACL '" << acl->def->name <<
808 "' queue overload. Request rejected '" << key << "'.");
809 external_acl_message = "SYSTEM TOO BUSY, TRY AGAIN LATER";
810 return ACCESS_DUNNO;
811 } else {
812 debugs(82, DBG_IMPORTANT, "WARNING: external ACL '" << acl->def->name <<
813 "' queue overload. Using stale result. '" << key << "'.");
814 /* Fall thru to processing below */
815 }
816 }
817 }
818 }
819
820 external_acl_cache_touch(acl->def, entry);
821 external_acl_message = entry->message.termedBuf();
822
823 debugs(82, 2, HERE << acl->def->name << " = " << entry->result);
824
825 if (ch->request) {
826 #if USE_AUTH
827 if (entry->user.size())
828 ch->request->extacl_user = entry->user;
829
830 if (entry->password.size())
831 ch->request->extacl_passwd = entry->password;
832 #endif
833 if (!ch->request->tag.size())
834 ch->request->tag = entry->tag;
835
836 if (entry->log.size())
837 ch->request->extacl_log = entry->log;
838
839 if (entry->message.size())
840 ch->request->extacl_message = entry->message;
841 }
842
843 return entry->result;
844 }
845
846 int
847 ACLExternal::match(ACLChecklist *checklist)
848 {
849 allow_t answer = aclMatchExternal(data, Filled(checklist));
850 checklist->currentAnswer(answer);
851
852 // convert to tri-state ACL match 1,0,-1
853 switch(answer)
854 {
855 case ACCESS_ALLOWED:
856 case ACCESS_AUTH_EXPIRED_OK:
857 return 1; // match
858
859 case ACCESS_DENIED:
860 case ACCESS_AUTH_EXPIRED_BAD:
861 return 0; // non-match
862
863 case ACCESS_DUNNO:
864 case ACCESS_AUTH_REQUIRED:
865 default:
866 return -1; // other
867 }
868 }
869
870 wordlist *
871 ACLExternal::dump() const
872 {
873 external_acl_data const *acl = data;
874 wordlist *result = NULL;
875 wordlist *arg;
876 MemBuf mb;
877 mb.init();
878 mb.Printf("%s", acl->def->name);
879
880 for (arg = acl->arguments; arg; arg = arg->next) {
881 mb.Printf(" %s", arg->key);
882 }
883
884 wordlistAdd(&result, mb.buf);
885 mb.clean();
886 return result;
887 }
888
889 /******************************************************************
890 * external_acl cache
891 */
892
893 static void
894 external_acl_cache_touch(external_acl * def, external_acl_entry * entry)
895 {
896 // this must not be done when nothing is being cached.
897 if (def->cache_size <= 0 || (def->ttl <= 0 && entry->result == 1) || (def->negative_ttl <= 0 && entry->result != 1))
898 return;
899
900 dlinkDelete(&entry->lru, &def->lru_list);
901 dlinkAdd(entry, &entry->lru, &def->lru_list);
902 }
903
904 static char *
905 makeExternalAclKey(ACLFilledChecklist * ch, external_acl_data * acl_data)
906 {
907 static MemBuf mb;
908 char buf[256];
909 int first = 1;
910 wordlist *arg;
911 external_acl_format *format;
912 HttpRequest *request = ch->request;
913 HttpReply *reply = ch->reply;
914 mb.reset();
915
916 for (format = acl_data->def->format; format; format = format->next) {
917 const char *str = NULL;
918 String sb;
919
920 switch (format->type) {
921 #if USE_AUTH
922 case _external_acl_format::EXT_ACL_LOGIN:
923 assert (ch->auth_user_request != NULL);
924 str = ch->auth_user_request->username();
925 break;
926 #endif
927 #if USE_IDENT
928 case _external_acl_format::EXT_ACL_IDENT:
929 str = ch->rfc931;
930
931 if (!str || !*str) {
932 ch->changeState(IdentLookup::Instance());
933 return NULL;
934 }
935
936 break;
937 #endif
938
939 case _external_acl_format::EXT_ACL_SRC:
940 str = ch->src_addr.NtoA(buf,sizeof(buf));
941 break;
942
943 case _external_acl_format::EXT_ACL_SRCPORT:
944 snprintf(buf, sizeof(buf), "%d", request->client_addr.GetPort());
945 str = buf;
946 break;
947
948 #if USE_SQUID_EUI
949 case _external_acl_format::EXT_ACL_SRCEUI48:
950 if (request->clientConnectionManager.valid() && request->clientConnectionManager->clientConnection != NULL &&
951 request->clientConnectionManager->clientConnection->remoteEui48.encode(buf, sizeof(buf)))
952 str = buf;
953 break;
954
955 case _external_acl_format::EXT_ACL_SRCEUI64:
956 if (request->clientConnectionManager.valid() && request->clientConnectionManager->clientConnection != NULL &&
957 request->clientConnectionManager->clientConnection->remoteEui64.encode(buf, sizeof(buf)))
958 str = buf;
959 break;
960 #endif
961
962 case _external_acl_format::EXT_ACL_MYADDR:
963 str = request->my_addr.NtoA(buf, sizeof(buf));
964 break;
965
966 case _external_acl_format::EXT_ACL_MYPORT:
967 snprintf(buf, sizeof(buf), "%d", request->my_addr.GetPort());
968 str = buf;
969 break;
970
971 case _external_acl_format::EXT_ACL_URI:
972 str = urlCanonical(request);
973 break;
974
975 case _external_acl_format::EXT_ACL_DST:
976 str = request->GetHost();
977 break;
978
979 case _external_acl_format::EXT_ACL_PROTO:
980 str = AnyP::ProtocolType_str[request->protocol];
981 break;
982
983 case _external_acl_format::EXT_ACL_PORT:
984 snprintf(buf, sizeof(buf), "%d", request->port);
985 str = buf;
986 break;
987
988 case _external_acl_format::EXT_ACL_PATH:
989 str = request->urlpath.termedBuf();
990 break;
991
992 case _external_acl_format::EXT_ACL_METHOD:
993 str = RequestMethodStr(request->method);
994 break;
995
996 case _external_acl_format::EXT_ACL_HEADER_REQUEST:
997 sb = request->header.getByName(format->header);
998 str = sb.termedBuf();
999 break;
1000
1001 case _external_acl_format::EXT_ACL_HEADER_REQUEST_ID:
1002 sb = request->header.getStrOrList(format->header_id);
1003 str = sb.termedBuf();
1004 break;
1005
1006 case _external_acl_format::EXT_ACL_HEADER_REQUEST_MEMBER:
1007 sb = request->header.getByNameListMember(format->header, format->member, format->separator);
1008 str = sb.termedBuf();
1009 break;
1010
1011 case _external_acl_format::EXT_ACL_HEADER_REQUEST_ID_MEMBER:
1012 sb = request->header.getListMember(format->header_id, format->member, format->separator);
1013 str = sb.termedBuf();
1014 break;
1015
1016 case _external_acl_format::EXT_ACL_HEADER_REPLY:
1017 if (reply) {
1018 sb = reply->header.getByName(format->header);
1019 str = sb.termedBuf();
1020 }
1021 break;
1022
1023 case _external_acl_format::EXT_ACL_HEADER_REPLY_ID:
1024 if (reply) {
1025 sb = reply->header.getStrOrList(format->header_id);
1026 str = sb.termedBuf();
1027 }
1028 break;
1029
1030 case _external_acl_format::EXT_ACL_HEADER_REPLY_MEMBER:
1031 if (reply) {
1032 sb = reply->header.getByNameListMember(format->header, format->member, format->separator);
1033 str = sb.termedBuf();
1034 }
1035 break;
1036
1037 case _external_acl_format::EXT_ACL_HEADER_REPLY_ID_MEMBER:
1038 if (reply) {
1039 sb = reply->header.getListMember(format->header_id, format->member, format->separator);
1040 str = sb.termedBuf();
1041 }
1042 break;
1043 #if USE_SSL
1044
1045 case _external_acl_format::EXT_ACL_USER_CERT_RAW:
1046
1047 if (ch->conn() != NULL && Comm::IsConnOpen(ch->conn()->clientConnection)) {
1048 SSL *ssl = fd_table[ch->conn()->clientConnection->fd].ssl;
1049
1050 if (ssl)
1051 str = sslGetUserCertificatePEM(ssl);
1052 }
1053
1054 break;
1055
1056 case _external_acl_format::EXT_ACL_USER_CERTCHAIN_RAW:
1057
1058 if (ch->conn() != NULL && Comm::IsConnOpen(ch->conn()->clientConnection)) {
1059 SSL *ssl = fd_table[ch->conn()->clientConnection->fd].ssl;
1060
1061 if (ssl)
1062 str = sslGetUserCertificateChainPEM(ssl);
1063 }
1064
1065 break;
1066
1067 case _external_acl_format::EXT_ACL_USER_CERT:
1068
1069 if (ch->conn() != NULL && Comm::IsConnOpen(ch->conn()->clientConnection)) {
1070 SSL *ssl = fd_table[ch->conn()->clientConnection->fd].ssl;
1071
1072 if (ssl)
1073 str = sslGetUserAttribute(ssl, format->header);
1074 }
1075
1076 break;
1077
1078 case _external_acl_format::EXT_ACL_CA_CERT:
1079
1080 if (ch->conn() != NULL && Comm::IsConnOpen(ch->conn()->clientConnection)) {
1081 SSL *ssl = fd_table[ch->conn()->clientConnection->fd].ssl;
1082
1083 if (ssl)
1084 str = sslGetCAAttribute(ssl, format->header);
1085 }
1086
1087 break;
1088 #endif
1089 #if USE_AUTH
1090 case _external_acl_format::EXT_ACL_EXT_USER:
1091 str = request->extacl_user.termedBuf();
1092 break;
1093 #endif
1094 case _external_acl_format::EXT_ACL_EXT_LOG:
1095 str = request->extacl_log.termedBuf();
1096 break;
1097 case _external_acl_format::EXT_ACL_TAG:
1098 str = request->tag.termedBuf();
1099 break;
1100 case _external_acl_format::EXT_ACL_UNKNOWN:
1101
1102 case _external_acl_format::EXT_ACL_END:
1103 fatal("unknown external_acl format error");
1104 break;
1105 }
1106
1107 if (str)
1108 if (!*str)
1109 str = NULL;
1110
1111 if (!str)
1112 str = "-";
1113
1114 if (!first)
1115 mb.append(" ", 1);
1116
1117 if (acl_data->def->quote == external_acl::QUOTE_METHOD_URL) {
1118 const char *quoted = rfc1738_escape(str);
1119 mb.append(quoted, strlen(quoted));
1120 } else {
1121 strwordquote(&mb, str);
1122 }
1123
1124 sb.clean();
1125
1126 first = 0;
1127 }
1128
1129 for (arg = acl_data->arguments; arg; arg = arg->next) {
1130 if (!first)
1131 mb.append(" ", 1);
1132
1133 if (acl_data->def->quote == external_acl::QUOTE_METHOD_URL) {
1134 const char *quoted = rfc1738_escape(arg->key);
1135 mb.append(quoted, strlen(quoted));
1136 } else {
1137 strwordquote(&mb, arg->key);
1138 }
1139
1140 first = 0;
1141 }
1142
1143 return mb.buf;
1144 }
1145
1146 static int
1147 external_acl_entry_expired(external_acl * def, external_acl_entry * entry)
1148 {
1149 if (def->cache_size <= 0)
1150 return 1;
1151
1152 if (entry->date + (entry->result == 1 ? def->ttl : def->negative_ttl) < squid_curtime)
1153 return 1;
1154 else
1155 return 0;
1156 }
1157
1158 static int
1159 external_acl_grace_expired(external_acl * def, external_acl_entry * entry)
1160 {
1161 if (def->cache_size <= 0)
1162 return 1;
1163
1164 int ttl;
1165 ttl = entry->result == 1 ? def->ttl : def->negative_ttl;
1166 ttl = (ttl * (100 - def->grace)) / 100;
1167
1168 if (entry->date + ttl <= squid_curtime)
1169 return 1;
1170 else
1171 return 0;
1172 }
1173
1174 static external_acl_entry *
1175 external_acl_cache_add(external_acl * def, const char *key, ExternalACLEntryData const & data)
1176 {
1177 ExternalACLEntry *entry;
1178
1179 // do not bother caching this result if TTL is going to expire it immediately
1180 if (def->cache_size <= 0 || (def->ttl <= 0 && data.result == 1) || (def->negative_ttl <= 0 && data.result != 1)) {
1181 debugs(82,6, HERE);
1182 entry = new ExternalACLEntry;
1183 entry->key = xstrdup(key);
1184 entry->update(data);
1185 entry->def = def;
1186 return entry;
1187 }
1188
1189 entry = static_cast<ExternalACLEntry *>(hash_lookup(def->cache, key));
1190 debugs(82, 2, "external_acl_cache_add: Adding '" << key << "' = " << data.result);
1191
1192 if (entry) {
1193 debugs(82, 3, "ExternalACLEntry::update: updating existing entry");
1194 entry->update(data);
1195 external_acl_cache_touch(def, entry);
1196
1197 return entry;
1198 }
1199
1200 entry = new ExternalACLEntry;
1201 entry->key = xstrdup(key);
1202 entry->update(data);
1203
1204 def->add(entry);
1205
1206 return entry;
1207 }
1208
1209 static void
1210 external_acl_cache_delete(external_acl * def, external_acl_entry * entry)
1211 {
1212 assert(def->cache_size > 0 && entry->def == def);
1213 hash_remove_link(def->cache, entry);
1214 dlinkDelete(&entry->lru, &def->lru_list);
1215 def->cache_entries -= 1;
1216 delete entry;
1217 }
1218
1219 /******************************************************************
1220 * external_acl helpers
1221 */
1222
1223 typedef struct _externalAclState externalAclState;
1224
1225 struct _externalAclState {
1226 EAH *callback;
1227 void *callback_data;
1228 char *key;
1229 external_acl *def;
1230 dlink_node list;
1231 externalAclState *queue;
1232 };
1233
1234 CBDATA_TYPE(externalAclState);
1235 static void
1236 free_externalAclState(void *data)
1237 {
1238 externalAclState *state = static_cast<externalAclState *>(data);
1239 safe_free(state->key);
1240 cbdataReferenceDone(state->callback_data);
1241 cbdataReferenceDone(state->def);
1242 }
1243
1244 /*
1245 * The helper program receives queries on stdin, one
1246 * per line, and must return the result on on stdout
1247 *
1248 * General result syntax:
1249 *
1250 * OK/ERR keyword=value ...
1251 *
1252 * Keywords:
1253 *
1254 * user= The users name (login)
1255 * message= Message describing the reason
1256 * tag= A string tag to be applied to the request that triggered the acl match.
1257 * applies to both OK and ERR responses.
1258 * Won't override existing request tags.
1259 * log= A string to be used in access logging
1260 *
1261 * Other keywords may be added to the protocol later
1262 *
1263 * value needs to be enclosed in quotes if it may contain whitespace, or
1264 * the whitespace escaped using \ (\ escaping obviously also applies to
1265 * any " characters)
1266 */
1267
1268 static void
1269 externalAclHandleReply(void *data, char *reply)
1270 {
1271 externalAclState *state = static_cast<externalAclState *>(data);
1272 externalAclState *next;
1273 char *status;
1274 char *token;
1275 char *value;
1276 char *t = NULL;
1277 ExternalACLEntryData entryData;
1278 entryData.result = ACCESS_DENIED;
1279 external_acl_entry *entry = NULL;
1280
1281 debugs(82, 2, "externalAclHandleReply: reply=\"" << reply << "\"");
1282
1283 if (reply) {
1284 status = strwordtok(reply, &t);
1285
1286 if (status && strcmp(status, "OK") == 0)
1287 entryData.result = ACCESS_ALLOWED;
1288
1289 while ((token = strwordtok(NULL, &t))) {
1290 value = strchr(token, '=');
1291
1292 if (value) {
1293 *value++ = '\0'; /* terminate the token, and move up to the value */
1294
1295 if (state->def->quote == external_acl::QUOTE_METHOD_URL)
1296 rfc1738_unescape(value);
1297
1298 if (strcmp(token, "message") == 0)
1299 entryData.message = value;
1300 else if (strcmp(token, "error") == 0)
1301 entryData.message = value;
1302 else if (strcmp(token, "tag") == 0)
1303 entryData.tag = value;
1304 else if (strcmp(token, "log") == 0)
1305 entryData.log = value;
1306 #if USE_AUTH
1307 else if (strcmp(token, "user") == 0)
1308 entryData.user = value;
1309 else if (strcmp(token, "password") == 0)
1310 entryData.password = value;
1311 else if (strcmp(token, "passwd") == 0)
1312 entryData.password = value;
1313 else if (strcmp(token, "login") == 0)
1314 entryData.user = value;
1315 #endif
1316 }
1317 }
1318 }
1319
1320 dlinkDelete(&state->list, &state->def->queue);
1321
1322 if (cbdataReferenceValid(state->def)) {
1323 if (reply)
1324 entry = external_acl_cache_add(state->def, state->key, entryData);
1325 else {
1326 external_acl_entry *oldentry = (external_acl_entry *)hash_lookup(state->def->cache, state->key);
1327
1328 if (oldentry)
1329 external_acl_cache_delete(state->def, oldentry);
1330 }
1331 }
1332
1333 do {
1334 void *cbdata;
1335 cbdataReferenceDone(state->def);
1336
1337 if (state->callback && cbdataReferenceValidDone(state->callback_data, &cbdata))
1338 state->callback(cbdata, entry);
1339
1340 next = state->queue;
1341
1342 cbdataFree(state);
1343
1344 state = next;
1345 } while (state);
1346 }
1347
1348 void
1349 ACLExternal::ExternalAclLookup(ACLChecklist *checklist, ACLExternal * me, EAH * callback, void *callback_data)
1350 {
1351 MemBuf buf;
1352 external_acl_data *acl = me->data;
1353 external_acl *def = acl->def;
1354 externalAclState *state;
1355 dlink_node *node;
1356 externalAclState *oldstate = NULL;
1357 bool graceful = 0;
1358
1359 ACLFilledChecklist *ch = Filled(checklist);
1360 #if USE_AUTH
1361 if (acl->def->require_auth) {
1362 int ti;
1363 /* Make sure the user is authenticated */
1364 debugs(82, 3, HERE << acl->def->name << " check user authenticated.");
1365
1366 if ((ti = AuthenticateAcl(ch)) != 1) {
1367 debugs(82, DBG_IMPORTANT, "WARNING: " << acl->def->name <<
1368 " user authentication failure (" << ti << ", ch=" << ch << ")");
1369 callback(callback_data, NULL);
1370 return;
1371 }
1372 debugs(82, 3, HERE << acl->def->name << " user is authenticated.");
1373 }
1374 #endif
1375
1376 const char *key = makeExternalAclKey(ch, acl);
1377
1378 if (!key) {
1379 debugs(82, 1, "externalAclLookup: lookup in '" << def->name <<
1380 "', prerequisit failure (ch=" << ch << ")");
1381 callback(callback_data, NULL);
1382 return;
1383 }
1384
1385 debugs(82, 2, "externalAclLookup: lookup in '" << def->name << "' for '" << key << "'");
1386
1387 external_acl_entry *entry = static_cast<external_acl_entry *>(hash_lookup(def->cache, key));
1388
1389 if (entry && external_acl_entry_expired(def, entry))
1390 entry = NULL;
1391
1392 /* Check for a pending lookup to hook into */
1393 // only possible if we are caching results.
1394 if (def->cache_size > 0) {
1395 for (node = def->queue.head; node; node = node->next) {
1396 externalAclState *oldstatetmp = static_cast<externalAclState *>(node->data);
1397
1398 if (strcmp(key, oldstatetmp->key) == 0) {
1399 oldstate = oldstatetmp;
1400 break;
1401 }
1402 }
1403 }
1404
1405 if (entry && external_acl_grace_expired(def, entry)) {
1406 if (oldstate) {
1407 debugs(82, 4, "externalAclLookup: in grace period, but already pending lookup ('" << key << "', ch=" << ch << ")");
1408 callback(callback_data, entry);
1409 return;
1410 } else {
1411 graceful = 1; // grace expired, (neg)ttl did not, and we must start a new lookup.
1412 }
1413 }
1414
1415 // The entry is in the cache, grace_ttl did not expired.
1416 if (!graceful && entry && !external_acl_grace_expired(def, entry)) {
1417 /* Should not really happen, but why not.. */
1418 callback(callback_data, entry);
1419 debugs(82, 4, "externalAclLookup: no lookup pending for '" << key << "', and grace not expired");
1420 debugs(82, 4, "externalAclLookup: (what tha' hell?)");
1421 return;
1422 }
1423
1424 /* No pending lookup found. Sumbit to helper */
1425 state = cbdataAlloc(externalAclState);
1426
1427 state->def = cbdataReference(def);
1428
1429 state->key = xstrdup(key);
1430
1431 if (!graceful) {
1432 state->callback = callback;
1433 state->callback_data = cbdataReference(callback_data);
1434 }
1435
1436 if (oldstate) {
1437 /* Hook into pending lookup */
1438 state->queue = oldstate->queue;
1439 oldstate->queue = state;
1440 } else {
1441 /* Check for queue overload */
1442
1443 if (def->theHelper->stats.queue_size >= (int)def->theHelper->childs.n_running) {
1444 debugs(82, 1, "externalAclLookup: '" << def->name << "' queue overload (ch=" << ch << ")");
1445 cbdataFree(state);
1446 callback(callback_data, entry);
1447 return;
1448 }
1449
1450 /* Send it off to the helper */
1451 buf.init();
1452
1453 buf.Printf("%s\n", key);
1454
1455 debugs(82, 4, "externalAclLookup: looking up for '" << key << "' in '" << def->name << "'.");
1456
1457 helperSubmit(def->theHelper, buf.buf, externalAclHandleReply, state);
1458
1459 dlinkAdd(state, &state->list, &def->queue);
1460
1461 buf.clean();
1462 }
1463
1464 if (graceful) {
1465 /* No need to wait during grace period */
1466 debugs(82, 4, "externalAclLookup: no need to wait for the result of '" <<
1467 key << "' in '" << def->name << "' (ch=" << ch << ").");
1468 debugs(82, 4, "externalAclLookup: using cached entry " << entry);
1469
1470 if (entry != NULL) {
1471 debugs(82, 4, "externalAclLookup: entry = { date=" <<
1472 (long unsigned int) entry->date <<
1473 ", result=" << entry->result <<
1474 " tag=" << entry->tag <<
1475 " log=" << entry->log << " }");
1476 #if USE_AUTH
1477 debugs(82, 4, "externalAclLookup: user=" << entry->user);
1478 #endif
1479
1480 }
1481
1482 callback(callback_data, entry);
1483 return;
1484 }
1485
1486 debugs(82, 4, "externalAclLookup: will wait for the result of '" << key <<
1487 "' in '" << def->name << "' (ch=" << ch << ").");
1488 }
1489
1490 static void
1491 externalAclStats(StoreEntry * sentry)
1492 {
1493 external_acl *p;
1494
1495 for (p = Config.externalAclHelperList; p; p = p->next) {
1496 storeAppendPrintf(sentry, "External ACL Statistics: %s\n", p->name);
1497 storeAppendPrintf(sentry, "Cache size: %d\n", p->cache->count);
1498 helperStats(sentry, p->theHelper);
1499 storeAppendPrintf(sentry, "\n");
1500 }
1501 }
1502
1503 static void
1504 externalAclRegisterWithCacheManager(void)
1505 {
1506 Mgr::RegisterAction("external_acl",
1507 "External ACL stats",
1508 externalAclStats, 0, 1);
1509 }
1510
1511 void
1512 externalAclInit(void)
1513 {
1514 static int firstTimeInit = 1;
1515 external_acl *p;
1516
1517 for (p = Config.externalAclHelperList; p; p = p->next) {
1518 if (!p->cache)
1519 p->cache = hash_create((HASHCMP *) strcmp, hashPrime(1024), hash4);
1520
1521 if (!p->theHelper)
1522 p->theHelper = new helper(p->name);
1523
1524 p->theHelper->cmdline = p->cmdline;
1525
1526 p->theHelper->childs = p->children;
1527
1528 p->theHelper->ipc_type = IPC_TCP_SOCKET;
1529
1530 p->theHelper->addr = p->local_addr;
1531
1532 helperOpenServers(p->theHelper);
1533 }
1534
1535 if (firstTimeInit) {
1536 firstTimeInit = 0;
1537 CBDATA_INIT_TYPE_FREECB(externalAclState, free_externalAclState);
1538 }
1539
1540 externalAclRegisterWithCacheManager();
1541 }
1542
1543 void
1544 externalAclShutdown(void)
1545 {
1546 external_acl *p;
1547
1548 for (p = Config.externalAclHelperList; p; p = p->next) {
1549 helperShutdown(p->theHelper);
1550 }
1551 }
1552
1553 ExternalACLLookup ExternalACLLookup::instance_;
1554 ExternalACLLookup *
1555 ExternalACLLookup::Instance()
1556 {
1557 return &instance_;
1558 }
1559
1560 void
1561 ExternalACLLookup::checkForAsync(ACLChecklist *checklist)const
1562 {
1563 /* TODO: optimise this - we probably have a pointer to this
1564 * around somewhere */
1565 ACL *acl = ACL::FindByName(AclMatchedName);
1566 assert(acl);
1567 ACLExternal *me = dynamic_cast<ACLExternal *> (acl);
1568 assert (me);
1569 checklist->asyncInProgress(true);
1570 ACLExternal::ExternalAclLookup(checklist, me, LookupDone, checklist);
1571 }
1572
1573 void
1574 ExternalACLLookup::LookupDone(void *data, void *result)
1575 {
1576 ACLFilledChecklist *checklist = Filled(static_cast<ACLChecklist*>(data));
1577 checklist->extacl_entry = cbdataReference((external_acl_entry *)result);
1578 checklist->asyncInProgress(false);
1579 checklist->changeState (ACLChecklist::NullState::Instance());
1580 checklist->matchNonBlocking();
1581 }
1582
1583 /* This registers "external" in the registry. To do dynamic definitions
1584 * of external ACL's, rather than a static prototype, have a Prototype instance
1585 * prototype in the class that defines each external acl 'class'.
1586 * Then, then the external acl instance is created, it self registers under
1587 * it's name.
1588 * Be sure that clone is fully functional for that acl class though!
1589 */
1590 ACL::Prototype ACLExternal::RegistryProtoype(&ACLExternal::RegistryEntry_, "external");
1591
1592 ACLExternal ACLExternal::RegistryEntry_("external");
1593
1594 ACL *
1595 ACLExternal::clone() const
1596 {
1597 return new ACLExternal(*this);
1598 }
1599
1600 ACLExternal::ACLExternal (char const *theClass) : data (NULL), class_ (xstrdup (theClass))
1601 {}
1602
1603 ACLExternal::ACLExternal (ACLExternal const & old) : data (NULL), class_ (old.class_ ? xstrdup (old.class_) : NULL)
1604 {
1605 /* we don't have copy constructors for the data yet */
1606 assert (!old.data);
1607 }
1608
1609 char const *
1610 ACLExternal::typeString() const
1611 {
1612 return class_;
1613 }
1614
1615 bool
1616 ACLExternal::isProxyAuth() const
1617 {
1618 #if USE_AUTH
1619 return data->def->require_auth;
1620 #else
1621 return false;
1622 #endif
1623 }
Mirror of https://github.com/squid-cache/squid.git