Bug 3678: external acl grace period causes acl lookup failures

diff --git a/src/external_acl.cc b/src/external_acl.cc
index b3821c5b662f8e0f779024c331171f8b6ec15c1b..53a2350108dfe30834beee6a6ad30575fd807fef 100644 (file)
--- a/src/external_acl.cc
+++ b/src/external_acl.cc
@@ -830,8 +830,13 @@ aclMatchExternal(external_acl_data *acl, ACLFilledChecklist *ch)
             if (acl->def->theHelper->stats.queue_size <= (int)acl->def->theHelper->childs.n_active) {
                 debugs(82, 2, "aclMatchExternal: \"" << key << "\": queueing a call.");
                 ch->changeState(ExternalACLLookup::Instance());
-                debugs(82, 2, "aclMatchExternal: \"" << key << "\": return -1.");
-                return -1; // to get here we have to have an expired cache entry. MUST not use.
+                if (!entry) {
+                    debugs(82, 2, "aclMatchExternal: \"" << key << "\": return -1.");
+                    return -1; // to get here we have to have an expired cache entry. MUST not use.
+                }
+                // else we have a usable entry in grace period
+                debugs(82, 2, "aclMatchExternal: \"" << key << "\": grace period active, will use results from entry.");
+                // Fall thru to processing below.
             } else {
                 if (!entry) {
                     debugs(82, 1, "aclMatchExternal: '" << acl->def->name <<