SourceFormat Enforcement

[thirdparty/squid.git] / src / auth / Acl.cc

diff --git a/src/auth/Acl.cc b/src/auth/Acl.cc
index 6537b225b4251ac1b704a38ed9bea71d70e1c0f7..ceb1e2eb97fdea09d04cbda41b602d75d1b59634 100644 (file)
--- a/src/auth/Acl.cc
+++ b/src/auth/Acl.cc
@@ -1,9 +1,20 @@
-#include "squid-old.h"
+/*
+ * Copyright (C) 1996-2017 The Squid Software Foundation and contributors
+ *
+ * Squid software is distributed under GPLv2+ license and includes
+ * contributions from numerous individuals and organizations.
+ * Please see the COPYING and CONTRIBUTORS files for details.
+ */
+
+#include "squid.h"
 #include "acl/Acl.h"
 #include "acl/FilledChecklist.h"
-#include "auth/UserRequest.h"
 #include "auth/Acl.h"
 #include "auth/AclProxyAuth.h"
+#include "auth/UserRequest.h"
+#include "client_side.h"
+#include "fatal.h"
+#include "http/Stream.h"
 #include "HttpRequest.h"
 
 /**
@@ -18,34 +29,34 @@ AuthenticateAcl(ACLChecklist *ch)
 {
     ACLFilledChecklist *checklist = Filled(ch);
     HttpRequest *request = checklist->request;
-    http_hdr_type headertype;
+    Http::HdrType headertype;
 
     if (NULL == request) {
         fatal ("requiresRequest SHOULD have been true for this ACL!!");
         return ACCESS_DENIED;
     } else if (request->flags.sslBumped) {
         debugs(28, 5, "SslBumped request: It is an encapsulated request do not authenticate");
-        checklist->auth_user_request = checklist->conn() != NULL ? checklist->conn()->auth_user_request : request->auth_user_request;
+        checklist->auth_user_request = checklist->conn() != NULL ? checklist->conn()->getAuth() : request->auth_user_request;
         if (checklist->auth_user_request != NULL)
             return ACCESS_ALLOWED;
         else
             return ACCESS_DENIED;
     } else if (request->flags.accelerated) {
         /* WWW authorization on accelerated requests */
-        headertype = HDR_AUTHORIZATION;
-    } else if (request->flags.intercepted || request->flags.spoof_client_ip) {
+        headertype = Http::HdrType::AUTHORIZATION;
+    } else if (request->flags.intercepted || request->flags.interceptTproxy) {
         debugs(28, DBG_IMPORTANT, "NOTICE: Authentication not applicable on intercepted requests.");
         return ACCESS_DENIED;
     } else {
         /* Proxy authorization on proxy requests */
-        headertype = HDR_PROXY_AUTHORIZATION;
+        headertype = Http::HdrType::PROXY_AUTHORIZATION;
     }
 
     /* get authed here */
     /* Note: this fills in auth_user_request when applicable */
     const AuthAclState result = Auth::UserRequest::tryToAuthenticateAndSetAuthUser(
                                     &checklist->auth_user_request, headertype, request,
-                                    checklist->conn(), checklist->src_addr);
+                                    checklist->conn(), checklist->src_addr, checklist->al);
     switch (result) {
 
     case AUTH_ACL_CANNOT_AUTHENTICATE:
@@ -57,13 +68,18 @@ AuthenticateAcl(ACLChecklist *ch)
         break;
 
     case AUTH_ACL_HELPER:
-        debugs(28, 4, HERE << "returning " << ACCESS_DENIED << " sending credentials to helper.");
-        checklist->changeState(ProxyAuthLookup::Instance());
+        if (checklist->goAsync(ProxyAuthLookup::Instance()))
+            debugs(28, 4, "returning " << ACCESS_DUNNO << " sending credentials to helper.");
+        else
+            debugs(28, 2, "cannot go async; returning " << ACCESS_DUNNO);
         return ACCESS_DUNNO; // XXX: break this down into DUNNO, EXPIRED_OK, EXPIRED_BAD states
 
     case AUTH_ACL_CHALLENGE:
-        debugs(28, 4, HERE << "returning " << ACCESS_DENIED << " sending authentication challenge.");
-        checklist->changeState(ProxyAuthNeeded::Instance());
+        debugs(28, 4, HERE << "returning " << ACCESS_AUTH_REQUIRED << " sending authentication challenge.");
+        /* Client is required to resend the request with correct authentication
+         * credentials. (This may be part of a stateful auth protocol.)
+         * The request is denied.
+         */
         return ACCESS_AUTH_REQUIRED;
 
     default:
@@ -71,3 +87,4 @@ AuthenticateAcl(ACLChecklist *ch)
         return ACCESS_DENIED;
     }
 }
+