Convert external ACL to use ACL states

diff --git a/src/ExternalACLEntry.cc b/src/ExternalACLEntry.cc
index a9074fec7b01e3d29dfddb09da65f1c7b42f7917..ade17e63b4670356ffdb436ddea7114c7c8dc5f9 100644 (file)
--- a/src/ExternalACLEntry.cc
+++ b/src/ExternalACLEntry.cc
@@ -69,7 +69,7 @@ ExternalACLEntry::operator delete (void *address)
 ExternalACLEntry::ExternalACLEntry()
 {
     lru.next = lru.prev = NULL;
-    result = 0;
+    result = ACCESS_DENIED;
     date = 0;
     def = NULL;
 }

diff --git a/src/ExternalACLEntry.h b/src/ExternalACLEntry.h
index 25be0daf611330cec6d4fa957d985490a42622b7..d77c0a36b8e578f0c64cb478516ee33bfd5a8f7e 100644 (file)
--- a/src/ExternalACLEntry.h
+++ b/src/ExternalACLEntry.h
@@ -44,7 +44,7 @@
 #ifndef SQUID_EXTERNALACLENTRY_H
 #define SQUID_EXTERNALACLENTRY_H
 
-
+#include "acl/Acl.h"
 #include "cbdata.h"
 
 /******************************************************************
@@ -58,9 +58,9 @@ class ExternalACLEntryData
 {
 
 public:
-    ExternalACLEntryData() : result (-1) {}
+    ExternalACLEntryData() : result(ACCESS_DUNNO) {}
 
-    int result;
+    allow_t result;
 #if USE_AUTH
     // TODO use an AuthUser to hold this info
     String user;
@@ -89,7 +89,7 @@ public:
 
     void update(ExternalACLEntryData const &);
     dlink_node lru;
-    int result;
+    allow_t result;
     time_t date;
 #if USE_AUTH
     String user;

diff --git a/src/acl/Acl.h b/src/acl/Acl.h
index e6a8e4dfc19185849745da8e6e88ded623a52a9d..6e8c83a96651cb0884c0ea519b3dab7d196d9261 100644 (file)
--- a/src/acl/Acl.h
+++ b/src/acl/Acl.h
@@ -111,7 +111,6 @@ typedef enum {
     ACCESS_DUNNO,
 
     // Authentication ACL result states
-    ACCESS_AUTH_OK = ACCESS_ALLOWED,
     ACCESS_AUTH_REQUIRED,    // Missing Credentials
     ACCESS_AUTH_EXPIRED_OK,  // Expired now. Were Okay.
     ACCESS_AUTH_EXPIRED_BAD  // Expired now. Were Failed.

diff --git a/src/external_acl.cc b/src/external_acl.cc
index 042293c49b4db35ab23df6ca1bbe7a2e71d3171d..3f8b8a991814c13872c17cc35761819af010bc64 100644 (file)
--- a/src/external_acl.cc
+++ b/src/external_acl.cc
@@ -744,14 +744,12 @@ ACLExternal::~ACLExternal()
     safe_free (class_);
 }
 
-static int
+static allow_t
 aclMatchExternal(external_acl_data *acl, ACLFilledChecklist *ch)
 {
-    int result;
-    external_acl_entry *entry;
     const char *key = "";
     debugs(82, 9, HERE << "acl=\"" << acl->def->name << "\"");
-    entry = ch->extacl_entry;
+    external_acl_entry *entry = ch->extacl_entry;
 
     if (entry) {
         if (cbdataReferenceValid(entry) && entry->def == acl->def) {
@@ -775,43 +773,43 @@ aclMatchExternal(external_acl_data *acl, ACLFilledChecklist *ch)
         debugs(82, 9, HERE << "No helper entry available");
 #if USE_AUTH
         if (acl->def->require_auth) {
-            int ti;
+            int ti = AuthenticateAcl(ch);
             /* Make sure the user is authenticated */
-            debugs(82, 3, "aclMatchExternal: " << acl->def->name << " check user authenticated.");
-            if ((ti = AuthenticateAcl(ch)) != 1) {
-                debugs(82, 2, "aclMatchExternal: " << acl->def->name << " user not authenticated (" << ti << ")");
-                return ti;
+            debugs(82, 3, HERE << acl->def->name << " check user authenticated.");
+            if (ti != 1) {
+                debugs(82, 2, HERE << acl->def->name << " user not authenticated (" << ti << ")");
+                return ACCESS_AUTH_REQUIRED;
             }
-            debugs(82, 3, "aclMatchExternal: " << acl->def->name << " user is authenticated.");
+            debugs(82, 3, HERE << acl->def->name << " user is authenticated.");
         }
 #endif
         key = makeExternalAclKey(ch, acl);
 
         if (!key) {
             /* Not sufficient data to process */
-            return -1;
+            return ACCESS_DUNNO;
         }
 
         entry = static_cast<external_acl_entry *>(hash_lookup(acl->def->cache, key));
 
         if (!entry || external_acl_grace_expired(acl->def, entry)) {
-            debugs(82, 2, "aclMatchExternal: " << acl->def->name << "(\"" << key << "\") = lookup needed");
-            debugs(82, 2, "aclMatchExternal: \"" << key << "\": entry=@" <<
+            debugs(82, 2, HERE << acl->def->name << "(\"" << key << "\") = lookup needed");
+            debugs(82, 2, HERE << "\"" << key << "\": entry=@" <<
                    entry << ", age=" << (entry ? (long int) squid_curtime - entry->date : 0));
 
             if (acl->def->theHelper->stats.queue_size <= (int)acl->def->theHelper->childs.n_active) {
-                debugs(82, 2, "aclMatchExternal: \"" << key << "\": queueing a call.");
+                debugs(82, 2, HERE << "\"" << key << "\": queueing a call.");
                 ch->changeState(ExternalACLLookup::Instance());
-                debugs(82, 2, "aclMatchExternal: \"" << key << "\": return -1.");
-                return -1; // to get here we have to have an expired cache entry. MUST not use.
+                debugs(82, 2, HERE << "\"" << key << "\": return -1.");
+                return ACCESS_DUNNO; // to get here we have to have an expired cache entry. MUST not use.
             } else {
                 if (!entry) {
-                    debugs(82, 1, "aclMatchExternal: '" << acl->def->name <<
+                    debugs(82, DBG_IMPORTANT, "WARNING: external ACL '" << acl->def->name <<
                            "' queue overload. Request rejected '" << key << "'.");
                     external_acl_message = "SYSTEM TOO BUSY, TRY AGAIN LATER";
-                    return -1;
+                    return ACCESS_DUNNO;
                 } else {
-                    debugs(82, 1, "aclMatchExternal: '" << acl->def->name <<
+                    debugs(82, DBG_IMPORTANT, "WARNING: external ACL '" << acl->def->name <<
                            "' queue overload. Using stale result. '" << key << "'.");
                     /* Fall thru to processing below */
                 }
@@ -820,10 +818,9 @@ aclMatchExternal(external_acl_data *acl, ACLFilledChecklist *ch)
     }
 
     external_acl_cache_touch(acl->def, entry);
-    result = entry->result;
     external_acl_message = entry->message.termedBuf();
 
-    debugs(82, 2, "aclMatchExternal: " << acl->def->name << " = " << result);
+    debugs(82, 2, HERE << acl->def->name << " = " << entry->result);
 
     if (ch->request) {
 #if USE_AUTH
@@ -843,13 +840,31 @@ aclMatchExternal(external_acl_data *acl, ACLFilledChecklist *ch)
             ch->request->extacl_message = entry->message;
     }
 
-    return result;
+    return entry->result;
 }
 
 int
 ACLExternal::match(ACLChecklist *checklist)
 {
-    return aclMatchExternal (data, Filled(checklist));
+    allow_t answer = aclMatchExternal(data, Filled(checklist));
+    checklist->currentAnswer(answer);
+
+    // convert to tri-state ACL match 1,0,-1
+    switch(answer)
+    {
+    case ACCESS_ALLOWED:
+    case ACCESS_AUTH_EXPIRED_OK:
+        return 1; // match
+
+    case ACCESS_DENIED:
+    case ACCESS_AUTH_EXPIRED_BAD:
+        return 0; // non-match
+
+    case ACCESS_DUNNO:
+    case ACCESS_AUTH_REQUIRED:
+    default:
+        return -1; // other
+    }
 }
 
 wordlist *
@@ -1260,7 +1275,7 @@ externalAclHandleReply(void *data, char *reply)
     char *value;
     char *t = NULL;
     ExternalACLEntryData entryData;
-    entryData.result = 0;
+    entryData.result = ACCESS_DENIED;
     external_acl_entry *entry = NULL;
 
     debugs(82, 2, "externalAclHandleReply: reply=\"" << reply << "\"");
@@ -1269,7 +1284,7 @@ externalAclHandleReply(void *data, char *reply)
         status = strwordtok(reply, &t);
 
         if (status && strcmp(status, "OK") == 0)
-            entryData.result = 1;
+            entryData.result = ACCESS_ALLOWED;
 
         while ((token = strwordtok(NULL, &t))) {
             value = strchr(token, '=');
@@ -1346,15 +1361,15 @@ ACLExternal::ExternalAclLookup(ACLChecklist *checklist, ACLExternal * me, EAH *
     if (acl->def->require_auth) {
         int ti;
         /* Make sure the user is authenticated */
-        debugs(82, 3, "aclMatchExternal: " << acl->def->name << " check user authenticated.");
+        debugs(82, 3, HERE << acl->def->name << " check user authenticated.");
 
         if ((ti = AuthenticateAcl(ch)) != 1) {
-            debugs(82, 1, "externalAclLookup: " << acl->def->name <<
+            debugs(82, DBG_IMPORTANT, "WARNING: " << acl->def->name <<
                    " user authentication failure (" << ti << ", ch=" << ch << ")");
             callback(callback_data, NULL);
             return;
         }
-        debugs(82, 3, "aclMatchExternal: " << acl->def->name << " user is authenticated.");
+        debugs(82, 3, HERE << acl->def->name << " user is authenticated.");
     }
 #endif