external_acl.cc
Go to the documentation of this file.
1/*
2 * Copyright (C) 1996-2023 The Squid Software Foundation and contributors
3 *
4 * Squid software is distributed under GPLv2+ license and includes
5 * contributions from numerous individuals and organizations.
6 * Please see the COPYING and CONTRIBUTORS files for details.
7 */
8
9/* DEBUG: section 82 External ACL */
10
11#include "squid.h"
12#include "acl/Acl.h"
13#include "acl/FilledChecklist.h"
14#include "cache_cf.h"
15#include "client_side.h"
16#include "client_side_request.h"
17#include "comm/Connection.h"
18#include "ConfigParser.h"
19#include "ExternalACL.h"
20#include "ExternalACLEntry.h"
21#include "fde.h"
22#include "format/Token.h"
23#include "helper.h"
24#include "helper/Reply.h"
25#include "http/Stream.h"
26#include "HttpHeaderTools.h"
27#include "HttpReply.h"
28#include "HttpRequest.h"
29#include "ip/tools.h"
30#include "MemBuf.h"
31#include "mgr/Registration.h"
32#include "rfc1738.h"
33#include "SquidConfig.h"
34#include "SquidString.h"
35#include "Store.h"
36#include "tools.h"
37#include "wordlist.h"
38#if USE_OPENSSL
39#include "ssl/ServerBump.h"
40#include "ssl/support.h"
41#endif
42#if USE_AUTH
43#include "auth/Acl.h"
44#include "auth/Gadgets.h"
45#include "auth/UserRequest.h"
46#endif
47#if USE_IDENT
48#include "ident/AclIdent.h"
49#endif
50
51#ifndef DEFAULT_EXTERNAL_ACL_TTL
52#define DEFAULT_EXTERNAL_ACL_TTL 1 * 60 * 60
53#endif
54#ifndef DEFAULT_EXTERNAL_ACL_CHILDREN
55#define DEFAULT_EXTERNAL_ACL_CHILDREN 5
56#endif
57
58static char *makeExternalAclKey(ACLFilledChecklist * ch, external_acl_data * acl_data);
64
65/******************************************************************
66 * external_acl directive
67 */
68
70{
71 /* XXX: These are not really cbdata, but it is an easy way
72 * to get them pooled, refcounted, accounted and freed properly...
73 * Use RefCountable MEMPROXY_CLASS instead
74 */
76
77public:
80
82
83 void add(const ExternalACLEntryPointer &);
84
85 void trimCache();
86
87 bool maybeCacheable(const Acl::Answer &) const;
88
89 int ttl;
90
92
93 int grace;
94
95 char *name;
96
98
100
102
104
106
108
110
112
114
115#if USE_AUTH
123#endif
124
125 Format::Quoting quote; // default quoting to use, set by protocol= parameter
126
128};
129
131
133 next(nullptr),
135 negative_ttl(-1),
136 grace(1),
137 name(nullptr),
138 format("external_acl_type"),
139 cmdline(nullptr),
141 theHelper(nullptr),
142 cache(nullptr),
143 cache_size(256*1024),
144 cache_entries(0),
145#if USE_AUTH
146 require_auth(0),
147#endif
149{
151}
152
154{
155 xfree(name);
157
158 if (theHelper) {
160 theHelper = nullptr;
161 }
162
163 while (lru_list.tail) {
166 }
167 if (cache)
169
170 while (next) {
172 next = node->next;
173 node->next = nullptr; // prevent recursion
174 delete node;
175 }
176}
177
178void
180{
181 char *token = ConfigParser::NextToken();
182
183 if (!token) {
185 return;
186 }
187
188 external_acl *a = new external_acl;
189 a->name = xstrdup(token);
190
191 // Allow supported %macros inside quoted tokens
193 token = ConfigParser::NextToken();
194
195 /* Parse options */
196 while (token) {
197 if (strncmp(token, "ttl=", 4) == 0) {
198 a->ttl = atoi(token + 4);
199 } else if (strncmp(token, "negative_ttl=", 13) == 0) {
200 a->negative_ttl = atoi(token + 13);
201 } else if (strncmp(token, "children=", 9) == 0) {
202 a->children.n_max = atoi(token + 9);
203 debugs(0, DBG_CRITICAL, "WARNING: external_acl_type option children=N has been deprecated in favor of children-max=N and children-startup=N");
204 } else if (strncmp(token, "children-max=", 13) == 0) {
205 a->children.n_max = atoi(token + 13);
206 } else if (strncmp(token, "children-startup=", 17) == 0) {
207 a->children.n_startup = atoi(token + 17);
208 } else if (strncmp(token, "children-idle=", 14) == 0) {
209 a->children.n_idle = atoi(token + 14);
210 } else if (strncmp(token, "concurrency=", 12) == 0) {
211 a->children.concurrency = atoi(token + 12);
212 } else if (strncmp(token, "queue-size=", 11) == 0) {
213 a->children.queue_size = atoi(token + 11);
214 a->children.defaultQueueSize = false;
215 } else if (strncmp(token, "cache=", 6) == 0) {
216 a->cache_size = atoi(token + 6);
217 } else if (strncmp(token, "grace=", 6) == 0) {
218 a->grace = atoi(token + 6);
219 } else if (strcmp(token, "protocol=2.5") == 0) {
221 } else if (strcmp(token, "protocol=3.0") == 0) {
222 debugs(3, DBG_PARSE_NOTE(2), "WARNING: external_acl_type option protocol=3.0 is deprecated. Remove this from your config.");
224 } else if (strcmp(token, "quote=url") == 0) {
225 debugs(3, DBG_PARSE_NOTE(2), "WARNING: external_acl_type option quote=url is deprecated. Remove this from your config.");
227 } else if (strcmp(token, "quote=shell") == 0) {
228 debugs(3, DBG_PARSE_NOTE(2), "WARNING: external_acl_type option quote=shell is deprecated. Use protocol=2.5 if still needed.");
230
231 /* INET6: allow admin to configure some helpers explicitly to
232 bind to IPv4/v6 localhost port. */
233 } else if (strcmp(token, "ipv4") == 0) {
234 if ( !a->local_addr.setIPv4() ) {
235 debugs(3, DBG_CRITICAL, "WARNING: Error converting " << a->local_addr << " to IPv4 in " << a->name );
236 }
237 } else if (strcmp(token, "ipv6") == 0) {
238 if (!Ip::EnableIpv6)
239 debugs(3, DBG_CRITICAL, "WARNING: --enable-ipv6 required for external ACL helpers to use IPv6: " << a->name );
240 // else nothing to do.
241 } else {
242 break;
243 }
244
245 token = ConfigParser::NextToken();
246 }
248
249 /* check that child startup value is sane. */
250 if (a->children.n_startup > a->children.n_max)
252
253 /* check that child idle value is sane. */
254 if (a->children.n_idle > a->children.n_max)
256 if (a->children.n_idle < 1)
257 a->children.n_idle = 1;
258
259 if (a->negative_ttl == -1)
260 a->negative_ttl = a->ttl;
261
263 a->children.queue_size = 2 * a->children.n_max;
264
265 /* Legacy external_acl_type format parser.
266 * Handles a series of %... tokens where any non-% means
267 * the start of another parameter field (ie the path to binary).
268 */
270 Format::Token **fmt = &a->format.format;
271 bool data_used = false;
272 while (token) {
273 /* stop on first non-% token found */
274 if (*token != '%')
275 break;
276
277 *fmt = new Format::Token;
278 // these tokens are whitespace delimited
279 (*fmt)->space = true;
280
281 // set the default encoding to match the protocol= config
282 // this will be overridden by explicit %macro attributes
283 (*fmt)->quote = a->quote;
284
285 // compatibility for old tokens incompatible with Format::Token syntax
286#if USE_OPENSSL // do not bother unless we have to.
287 if (strncmp(token, "%USER_CERT_", 11) == 0) {
288 (*fmt)->type = Format::LFT_EXT_ACL_USER_CERT;
289 (*fmt)->data.string = xstrdup(token + 11);
290 (*fmt)->data.header.header = (*fmt)->data.string;
291 } else if (strncmp(token, "%USER_CA_CERT_", 14) == 0) {
293 (*fmt)->data.string = xstrdup(token + 14);
294 (*fmt)->data.header.header = (*fmt)->data.string;
295 } else if (strncmp(token, "%CA_CERT_", 9) == 0) {
296 debugs(82, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: external_acl_type %CA_CERT_* code is obsolete. Use %USER_CA_CERT_* instead");
298 (*fmt)->data.string = xstrdup(token + 9);
299 (*fmt)->data.header.header = (*fmt)->data.string;
300 } else
301#endif
302 if (strncmp(token,"%<{", 3) == 0) {
303 SBuf tmp("%<h");
304 tmp.append(token+2);
305 debugs(82, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: external_acl_type format %<{...} is deprecated. Use " << tmp);
306 const size_t parsedLen = (*fmt)->parse(tmp.c_str(), &quote);
307 assert(parsedLen == tmp.length());
308 assert((*fmt)->type == Format::LFT_REPLY_HEADER ||
309 (*fmt)->type == Format::LFT_REPLY_HEADER_ELEM);
310
311 } else if (strncmp(token,"%>{", 3) == 0) {
312 SBuf tmp("%>ha");
313 tmp.append(token+2);
314 debugs(82, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: external_acl_type format %>{...} is deprecated. Use " << tmp);
315 const size_t parsedLen = (*fmt)->parse(tmp.c_str(), &quote);
316 assert(parsedLen == tmp.length());
319
320 } else {
321 // we can use the Format::Token::parse() method since it
322 // only pulls off one token. Since we already checked
323 // for '%' prefix above this is guaranteed to be a token.
324 const size_t len = (*fmt)->parse(token, &quote);
325 assert(len == strlen(token));
326 }
327
328 // process special token-specific actions (only if necessary)
329#if USE_AUTH
330 if ((*fmt)->type == Format::LFT_USER_LOGIN)
331 a->require_auth = true;
332#endif
333
334 if ((*fmt)->type == Format::LFT_EXT_ACL_DATA)
335 data_used = true;
336
337 fmt = &((*fmt)->next);
338 token = ConfigParser::NextToken();
339 }
340
341 /* There must be at least one format token */
342 if (!a->format.format) {
343 delete a;
345 return;
346 }
347
348 // format has implicit %DATA on the end if not used explicitly
349 if (!data_used) {
350 *fmt = new Format::Token;
352 (*fmt)->quote = Format::LOG_QUOTE_NONE;
353 }
354
355 /* helper */
356 if (!token) {
357 delete a;
359 return;
360 }
361
362 wordlistAdd(&a->cmdline, token);
363
364 /* arguments */
366
367 while (*list)
368 list = &(*list)->next;
369
370 *list = a;
371}
372
373void
374dump_externalAclHelper(StoreEntry * sentry, const char *name, const external_acl * list)
375{
376 const external_acl *node;
377 const wordlist *word;
378
379 for (node = list; node; node = node->next) {
380 storeAppendPrintf(sentry, "%s %s", name, node->name);
381
382 if (!node->local_addr.isIPv6())
383 storeAppendPrintf(sentry, " ipv4");
384 else
385 storeAppendPrintf(sentry, " ipv6");
386
387 if (node->ttl != DEFAULT_EXTERNAL_ACL_TTL)
388 storeAppendPrintf(sentry, " ttl=%d", node->ttl);
389
390 if (node->negative_ttl != node->ttl)
391 storeAppendPrintf(sentry, " negative_ttl=%d", node->negative_ttl);
392
393 if (node->grace)
394 storeAppendPrintf(sentry, " grace=%d", node->grace);
395
396 if (node->children.n_max != DEFAULT_EXTERNAL_ACL_CHILDREN)
397 storeAppendPrintf(sentry, " children-max=%d", node->children.n_max);
398
399 if (node->children.n_startup != 0) // sync with helper/ChildConfig.cc default
400 storeAppendPrintf(sentry, " children-startup=%d", node->children.n_startup);
401
402 if (node->children.n_idle != 1) // sync with helper/ChildConfig.cc default
403 storeAppendPrintf(sentry, " children-idle=%d", node->children.n_idle);
404
405 if (node->children.concurrency != 0)
406 storeAppendPrintf(sentry, " concurrency=%d", node->children.concurrency);
407
408 if (node->cache)
409 storeAppendPrintf(sentry, " cache=%d", node->cache_size);
410
411 if (node->quote == Format::LOG_QUOTE_SHELL)
412 storeAppendPrintf(sentry, " protocol=2.5");
413
414 node->format.dump(sentry, nullptr, false);
415
416 for (word = node->cmdline; word; word = word->next)
417 storeAppendPrintf(sentry, " %s", word->key);
418
419 storeAppendPrintf(sentry, "\n");
420 }
421}
422
423void
425{
426 delete *list;
427 *list = nullptr;
428}
429
430static external_acl *
431find_externalAclHelper(const char *name)
432{
434
436 if (strcmp(node->name, name) == 0)
437 return node;
438 }
439
440 return nullptr;
441}
442
443void
445{
446 trimCache();
447 assert(anEntry != nullptr);
448 assert (anEntry->def == nullptr);
449 anEntry->def = this;
450 ExternalACLEntry *e = const_cast<ExternalACLEntry *>(anEntry.getRaw()); // XXX: make hash a std::map of Pointer.
451 hash_join(cache, e);
452 dlinkAdd(e, &e->lru, &lru_list);
453 e->lock(); //cbdataReference(e); // lock it on behalf of the hash
455}
456
457void
459{
463 }
464}
465
466bool
468{
469 if (cache_size <= 0)
470 return false; // cache is disabled
471
472 if (result == ACCESS_DUNNO)
473 return false; // non-cacheable response
474
475 if ((result.allowed() ? ttl : negative_ttl) <= 0)
476 return false; // not caching this type of response
477
478 return true;
479}
480
481/******************************************************************
482 * external acl type
483 */
484
486{
488
489public:
490 explicit external_acl_data(external_acl *aDef) : def(cbdataReference(aDef)), name(nullptr), arguments(nullptr) {}
492
494 const char *name;
496};
497
499
501{
502 xfree(name);
505}
506
507void
509{
510 if (data) {
512 return;
513 }
514
515 char *token = ConfigParser::strtokFile();
516
517 if (!token) {
519 return;
520 }
521
523
524 if (!data->def) {
525 delete data;
527 return;
528 }
529
530 // def->name is the name of the external_acl_type.
531 // this is the name of the 'acl' directive being tested
533
534 while ((token = ConfigParser::strtokFile())) {
535 wordlistAdd(&data->arguments, token);
536 }
537}
538
539bool
541{
542#if USE_AUTH
543 if (data->def->require_auth) {
544 if (authenticateSchemeCount() == 0) {
545 debugs(28, DBG_CRITICAL, "ERROR: Cannot use proxy auth because no authentication schemes were compiled.");
546 return false;
547 }
548
550 debugs(28, DBG_CRITICAL, "ERROR: Cannot use proxy auth because no authentication schemes are fully configured.");
551 return false;
552 }
553 }
554#endif
555
556 return true;
557}
558
559bool
561{
562 return false;
563}
564
566{
567 delete data;
568 xfree(class_);
569}
570
571static void
573{
574 if (req) {
575#if USE_AUTH
576 if (entry->user.size())
577 req->extacl_user = entry->user;
578
579 if (entry->password.size())
580 req->extacl_passwd = entry->password;
581#endif
582 if (!req->tag.size())
583 req->tag = entry->tag;
584
585 if (entry->log.size())
586 req->extacl_log = entry->log;
587
588 if (entry->message.size())
589 req->extacl_message = entry->message;
590
591 // attach the helper kv-pair to the transaction
593 }
594}
595
596static Acl::Answer
598{
599 debugs(82, 9, "acl=\"" << acl->def->name << "\"");
601
602 external_acl_message = "MISSING REQUIRED INFORMATION";
603
604 if (entry != nullptr) {
605 if (entry->def == acl->def) {
606 /* Ours, use it.. if the key matches */
607 const char *key = makeExternalAclKey(ch, acl);
608 if (!key)
609 return ACCESS_DUNNO; // insufficient data to continue
610 if (strcmp(key, (char*)entry->key) != 0) {
611 debugs(82, 9, "entry key='" << (char *)entry->key << "', our key='" << key << "' do not match. Discarded.");
612 // too bad. need a new lookup.
613 entry = ch->extacl_entry = nullptr;
614 }
615 } else {
616 /* Not ours.. get rid of it */
617 debugs(82, 9, "entry " << entry << " not valid or not ours. Discarded.");
618 if (entry != nullptr) {
619 debugs(82, 9, "entry def=" << entry->def << ", our def=" << acl->def);
620 const char *key = makeExternalAclKey(ch, acl); // may be nil
621 debugs(82, 9, "entry key='" << (char *)entry->key << "', our key='" << key << "'");
622 }
623 entry = ch->extacl_entry = nullptr;
624 }
625 }
626
627 if (!entry) {
628 debugs(82, 9, "No helper entry available");
629#if USE_AUTH
630 if (acl->def->require_auth) {
631 /* Make sure the user is authenticated */
632 debugs(82, 3, acl->def->name << " check user authenticated.");
633 const auto ti = AuthenticateAcl(ch);
634 if (!ti.allowed()) {
635 debugs(82, 2, acl->def->name << " user not authenticated (" << ti << ")");
636 return ti;
637 }
638 debugs(82, 3, acl->def->name << " user is authenticated.");
639 }
640#endif
641 const char *key = makeExternalAclKey(ch, acl);
642
643 if (!key) {
644 /* Not sufficient data to process */
645 return ACCESS_DUNNO;
646 }
647
648 entry = static_cast<ExternalACLEntry *>(hash_lookup(acl->def->cache, key));
649
650 const ExternalACLEntryPointer staleEntry = entry;
651 if (entry != nullptr && external_acl_entry_expired(acl->def, entry))
652 entry = nullptr;
653
654 if (entry != nullptr && external_acl_grace_expired(acl->def, entry)) {
655 // refresh in the background
656 ExternalACLLookup::Start(ch, acl, true);
657 debugs(82, 4, "no need to wait for the refresh of '" <<
658 key << "' in '" << acl->def->name << "' (ch=" << ch << ").");
659 }
660
661 if (!entry) {
662 debugs(82, 2, acl->def->name << "(\"" << key << "\") = lookup needed");
663
664 // TODO: All other helpers allow temporary overload. Should not we?
665 if (!acl->def->theHelper->willOverload()) {
666 debugs(82, 2, "\"" << key << "\": queueing a call.");
668 debugs(82, 2, "\"" << key << "\": no async support!");
669 debugs(82, 2, "\"" << key << "\": return -1.");
670 return ACCESS_DUNNO; // expired cached or simply absent entry
671 } else {
672 if (!staleEntry) {
673 debugs(82, DBG_IMPORTANT, "WARNING: external ACL '" << acl->def->name <<
674 "' queue full. Request rejected '" << key << "'.");
675 external_acl_message = "SYSTEM TOO BUSY, TRY AGAIN LATER";
676 return ACCESS_DUNNO;
677 } else {
678 debugs(82, DBG_IMPORTANT, "WARNING: external ACL '" << acl->def->name <<
679 "' queue full. Using stale result. '" << key << "'.");
680 entry = staleEntry;
681 /* Fall thru to processing below */
682 }
683 }
684 }
685 }
686
687 debugs(82, 4, "entry = { date=" <<
688 (long unsigned int) entry->date <<
689 ", result=" << entry->result <<
690 " tag=" << entry->tag <<
691 " log=" << entry->log << " }");
692#if USE_AUTH
693 debugs(82, 4, "entry user=" << entry->user);
694#endif
695
696 external_acl_cache_touch(acl->def, entry);
698
699 debugs(82, 2, acl->def->name << " = " << entry->result);
700 copyResultsFromEntry(ch->request, entry);
701 return entry->result;
702}
703
704int
706{
707 auto answer = aclMatchExternal(data, Filled(checklist));
708
709 // convert to tri-state ACL match 1,0,-1
710 switch (answer) {
711 case ACCESS_ALLOWED:
712 return 1; // match
713
714 case ACCESS_DENIED:
715 return 0; // non-match
716
717 case ACCESS_DUNNO:
719 default:
720 // If the answer is not allowed or denied (matches/not matches) and
721 // async authentication is not in progress, then we are done.
722 if (checklist->keepMatching())
723 checklist->markFinished(answer, "aclMatchExternal exception");
724 return -1; // other
725 }
726}
727
730{
731 external_acl_data const *acl = data;
732 SBufList rv;
733 rv.push_back(SBuf(acl->def->name));
734
735 for (wordlist *arg = acl->arguments; arg; arg = arg->next) {
736 SBuf s;
737 s.Printf(" %s", arg->key);
738 rv.push_back(s);
739 }
740
741 return rv;
742}
743
744/******************************************************************
745 * external_acl cache
746 */
747
748static void
750{
751 // this must not be done when nothing is being cached.
752 if (!def->maybeCacheable(entry->result))
753 return;
754
755 dlinkDelete(&entry->lru, &def->lru_list);
756 ExternalACLEntry *e = const_cast<ExternalACLEntry *>(entry.getRaw()); // XXX: make hash a std::map of Pointer.
757 dlinkAdd(e, &entry->lru, &def->lru_list);
758}
759
760static char *
762{
763 static MemBuf mb;
764 mb.reset();
765
766 // check for special case tokens in the format
767 for (Format::Token *t = acl_data->def->format.format; t ; t = t->next) {
768
769 if (t->type == Format::LFT_EXT_ACL_NAME) {
770 // setup for %ACL
772 ch->al->lastAclName = xstrdup(acl_data->name);
773 }
774
775 if (t->type == Format::LFT_EXT_ACL_DATA) {
776 // setup string for %DATA
777 SBuf sb;
778 for (auto arg = acl_data->arguments; arg; arg = arg->next) {
779 if (sb.length())
780 sb.append(" ", 1);
781
782 if (acl_data->def->quote == Format::LOG_QUOTE_URL) {
783 const char *quoted = rfc1738_escape(arg->key);
784 sb.append(quoted, strlen(quoted));
785 } else {
786 static MemBuf mb2;
787 mb2.init();
788 strwordquote(&mb2, arg->key);
789 sb.append(mb2.buf, mb2.size);
790 mb2.clean();
791 }
792 }
793
794 ch->al->lastAclData = sb;
795 }
796
797#if USE_IDENT
798 if (t->type == Format::LFT_USER_IDENT) {
799 if (!*ch->rfc931) {
800 // if we fail to go async, we still return NULL and the caller
801 // will detect the failure in ACLExternal::match().
802 (void)ch->goAsync(IdentLookup::Instance());
803 return nullptr;
804 }
805 }
806#endif
807 }
808
809 // assemble the full helper lookup string
810 acl_data->def->format.assemble(mb, ch->al, 0);
811
812 return mb.buf;
813}
814
815static int
817{
818 if (def->cache_size <= 0 || entry->result == ACCESS_DUNNO)
819 return 1;
820
821 if (entry->date + (entry->result.allowed() ? def->ttl : def->negative_ttl) < squid_curtime)
822 return 1;
823 else
824 return 0;
825}
826
827static int
829{
830 if (def->cache_size <= 0 || entry->result == ACCESS_DUNNO)
831 return 1;
832
833 int ttl;
834 ttl = entry->result.allowed() ? def->ttl : def->negative_ttl;
835 ttl = (ttl * (100 - def->grace)) / 100;
836
837 if (entry->date + ttl <= squid_curtime)
838 return 1;
839 else
840 return 0;
841}
842
844external_acl_cache_add(external_acl * def, const char *key, ExternalACLEntryData const & data)
845{
847
848 if (!def->maybeCacheable(data.result)) {
849 debugs(82,6, MYNAME);
850
851 if (data.result == ACCESS_DUNNO) {
852 if (const ExternalACLEntryPointer oldentry = static_cast<ExternalACLEntry *>(hash_lookup(def->cache, key)))
853 external_acl_cache_delete(def, oldentry);
854 }
855 entry = new ExternalACLEntry;
856 entry->key = xstrdup(key);
857 entry->update(data);
858 entry->def = def;
859 return entry;
860 }
861
862 entry = static_cast<ExternalACLEntry *>(hash_lookup(def->cache, key));
863 debugs(82, 2, "external_acl_cache_add: Adding '" << key << "' = " << data.result);
864
865 if (entry != nullptr) {
866 debugs(82, 3, "updating existing entry");
867 entry->update(data);
868 external_acl_cache_touch(def, entry);
869 return entry;
870 }
871
872 entry = new ExternalACLEntry;
873 entry->key = xstrdup(key);
874 entry->update(data);
875
876 def->add(entry);
877
878 return entry;
879}
880
881static void
883{
884 assert(entry != nullptr);
885 assert(def->cache_size > 0 && entry->def == def);
886 ExternalACLEntry *e = const_cast<ExternalACLEntry *>(entry.getRaw()); // XXX: make hash a std::map of Pointer.
887 hash_remove_link(def->cache, e);
888 dlinkDelete(&e->lru, &def->lru_list);
889 e->unlock(); // unlock on behalf of the hash
890 def->cache_entries -= 1;
891}
892
893/******************************************************************
894 * external_acl helpers
895 */
896
898{
900
901public:
902 externalAclState(external_acl* aDef, const char *aKey) :
903 callback(nullptr),
904 callback_data(nullptr),
905 key(xstrdup(aKey)),
906 def(cbdataReference(aDef)),
907 queue(nullptr)
908 {}
910
913 char *key;
917};
918
920
922{
923 xfree(key);
926}
927
928/*
929 * The helper program receives queries on stdin, one
930 * per line, and must return the result on on stdout
931 *
932 * General result syntax:
933 *
934 * OK/ERR keyword=value ...
935 *
936 * Keywords:
937 *
938 * user= The users name (login)
939 * message= Message describing the reason
940 * tag= A string tag to be applied to the request that triggered the acl match.
941 * applies to both OK and ERR responses.
942 * Won't override existing request tags.
943 * log= A string to be used in access logging
944 *
945 * Other keywords may be added to the protocol later
946 *
947 * value needs to be URL-encoded or enclosed in double quotes (")
948 * with \-escaping on any whitespace, quotes, or slashes (\‍).
949 */
950static void
951externalAclHandleReply(void *data, const Helper::Reply &reply)
952{
953 externalAclState *state = static_cast<externalAclState *>(data);
954 externalAclState *next;
955 ExternalACLEntryData entryData;
956
957 debugs(82, 2, "reply=" << reply);
958
959 if (reply.result == Helper::Okay)
960 entryData.result = ACCESS_ALLOWED;
961 else if (reply.result == Helper::Error)
962 entryData.result = ACCESS_DENIED;
963 else //BrokenHelper,TimedOut or Unknown. Should not cached.
964 entryData.result = ACCESS_DUNNO;
965
966 // XXX: make entryData store a proper Helper::Reply object instead of copying.
967
968 entryData.notes.append(&reply.notes);
969
970 const char *label = reply.notes.findFirst("tag");
971 if (label != nullptr && *label != '\0')
972 entryData.tag = label;
973
974 label = reply.notes.findFirst("message");
975 if (label != nullptr && *label != '\0')
976 entryData.message = label;
977
978 label = reply.notes.findFirst("log");
979 if (label != nullptr && *label != '\0')
980 entryData.log = label;
981
982#if USE_AUTH
983 label = reply.notes.findFirst("user");
984 if (label != nullptr && *label != '\0')
985 entryData.user = label;
986
987 label = reply.notes.findFirst("password");
988 if (label != nullptr && *label != '\0')
989 entryData.password = label;
990#endif
991
992 // XXX: This state->def access conflicts with the cbdata validity check
993 // below.
994 dlinkDelete(&state->list, &state->def->queue);
995
997 if (cbdataReferenceValid(state->def))
998 entry = external_acl_cache_add(state->def, state->key, entryData);
999
1000 do {
1001 void *cbdata;
1002 if (state->callback && cbdataReferenceValidDone(state->callback_data, &cbdata))
1003 state->callback(cbdata, entry);
1004
1005 next = state->queue;
1006 state->queue = nullptr;
1007
1008 delete state;
1009
1010 state = next;
1011 } while (state);
1012}
1013
1014void
1016{
1017 ExternalACLLookup::Start(checklist, me->data, false);
1018}
1019
1020void
1021ExternalACLLookup::Start(ACLChecklist *checklist, external_acl_data *acl, bool inBackground)
1022{
1023 external_acl *def = acl->def;
1024
1025 ACLFilledChecklist *ch = Filled(checklist);
1026 const char *key = makeExternalAclKey(ch, acl);
1027 assert(key); // XXX: will fail if EXT_ACL_IDENT case needs an async lookup
1028
1029 debugs(82, 2, (inBackground ? "bg" : "fg") << " lookup in '" <<
1030 def->name << "' for '" << key << "'");
1031
1032 /* Check for a pending lookup to hook into */
1033 // only possible if we are caching results.
1034 externalAclState *oldstate = nullptr;
1035 if (def->cache_size > 0) {
1036 for (dlink_node *node = def->queue.head; node; node = node->next) {
1037 externalAclState *oldstatetmp = static_cast<externalAclState *>(node->data);
1038
1039 if (strcmp(key, oldstatetmp->key) == 0) {
1040 oldstate = oldstatetmp;
1041 break;
1042 }
1043 }
1044 }
1045
1046 // A background refresh has no need to piggiback on a pending request:
1047 // When the pending request completes, the cache will be refreshed anyway.
1048 if (oldstate && inBackground) {
1049 debugs(82, 7, "'" << def->name << "' queue is already being refreshed (ch=" << ch << ")");
1050 return;
1051 }
1052
1053 externalAclState *state = new externalAclState(def, key);
1054
1055 if (!inBackground) {
1057 state->callback_data = cbdataReference(checklist);
1058 }
1059
1060 if (oldstate) {
1061 /* Hook into pending lookup */
1062 state->queue = oldstate->queue;
1063 oldstate->queue = state;
1064 } else {
1065 /* No pending lookup found. Sumbit to helper */
1066
1067 MemBuf buf;
1068 buf.init();
1069 buf.appendf("%s\n", key);
1070 debugs(82, 4, "externalAclLookup: looking up for '" << key << "' in '" << def->name << "'.");
1071
1072 if (!def->theHelper->trySubmit(buf.buf, externalAclHandleReply, state)) {
1073 debugs(82, 7, "'" << def->name << "' submit to helper failed");
1074 assert(inBackground); // or the caller should have checked
1075 delete state;
1076 return;
1077 }
1078
1079 dlinkAdd(state, &state->list, &def->queue);
1080
1081 buf.clean();
1082 }
1083
1084 debugs(82, 4, "externalAclLookup: will wait for the result of '" << key <<
1085 "' in '" << def->name << "' (ch=" << ch << ").");
1086}
1087
1088static void
1090{
1091 for (external_acl *p = Config.externalAclHelperList; p; p = p->next) {
1092 storeAppendPrintf(sentry, "External ACL Statistics: %s\n", p->name);
1093 storeAppendPrintf(sentry, "Cache size: %d\n", p->cache->count);
1094 assert(p->theHelper);
1095 p->theHelper->packStatsInto(sentry);
1096 storeAppendPrintf(sentry, "\n");
1097 }
1098}
1099
1100static void
1102{
1103 Mgr::RegisterAction("external_acl",
1104 "External ACL stats",
1105 externalAclStats, 0, 1);
1106}
1107
1108void
1110{
1111 for (external_acl *p = Config.externalAclHelperList; p; p = p->next) {
1112 if (!p->cache)
1113 p->cache = hash_create((HASHCMP *) strcmp, hashPrime(1024), hash4);
1114
1115 if (!p->theHelper)
1116 p->theHelper = Helper::Client::Make("external_acl_type");
1117
1118 p->theHelper->cmdline = p->cmdline;
1119
1120 p->theHelper->childs.updateLimits(p->children);
1121
1122 p->theHelper->ipc_type = IPC_TCP_SOCKET;
1123
1124 p->theHelper->addr = p->local_addr;
1125
1126 p->theHelper->openSessions();
1127 }
1128
1130}
1131
1132void
1134{
1135 external_acl *p;
1136
1137 for (p = Config.externalAclHelperList; p; p = p->next) {
1139 }
1140}
1141
1145{
1146 return &instance_;
1147}
1148
1149void
1151{
1152 /* TODO: optimise this - we probably have a pointer to this
1153 * around somewhere */
1155 assert(acl);
1156 ACLExternal *me = dynamic_cast<ACLExternal *> (acl);
1157 assert (me);
1158 ACLExternal::ExternalAclLookup(checklist, me);
1159}
1160
1162void
1164{
1165 ACLFilledChecklist *checklist = Filled(static_cast<ACLChecklist*>(data));
1166 checklist->extacl_entry = result;
1168}
1169
1170ACLExternal::ACLExternal(char const *theClass) : data(nullptr), class_(xstrdup(theClass))
1171{}
1172
1173char const *
1175{
1176 return class_;
1177}
1178
1179bool
1181{
1182#if USE_AUTH
1183 return data->def->require_auth;
1184#else
1185 return false;
1186#endif
1187}
1188
void EAH(void *data, const ExternalACLEntryPointer &result)
Definition: ExternalACL.h:69
ACLFilledChecklist * Filled(ACLChecklist *checklist)
convenience and safety wrapper for dynamic_cast<ACLFilledChecklist*>
void UpdateRequestNotes(ConnStateData *csd, HttpRequest &request, NotePairs const &helperNotes)
Definition: HttpRequest.cc:760
time_t squid_curtime
Definition: stub_libtime.cc:20
class SquidConfig Config
Definition: SquidConfig.cc:12
#define assert(EX)
Definition: assert.h:17
Acl::Answer AuthenticateAcl(ACLChecklist *ch)
Definition: Acl.cc:28
int authenticateActiveSchemeCount(void)
Definition: Gadgets.cc:38
int authenticateSchemeCount(void)
Definition: Gadgets.cc:53
void parse_wordlist(wordlist **list)
Definition: cache_cf.cc:3140
void self_destruct(void)
Definition: cache_cf.cc:277
int cbdataReferenceValid(const void *p)
Definition: cbdata.cc:265
#define cbdataReferenceDone(var)
Definition: cbdata.h:352
#define cbdataReference(var)
Definition: cbdata.h:343
#define CBDATA_CLASS_INIT(type)
Definition: cbdata.h:320
#define cbdataReferenceValidDone(var, ptr)
Definition: cbdata.h:239
#define CBDATA_CLASS(type)
Definition: cbdata.h:289
void markFinished(const Acl::Answer &newAnswer, const char *reason)
Definition: Checklist.cc:57
bool goAsync(AsyncState *)
Definition: Checklist.cc:114
bool keepMatching() const
Whether we should continue to match tree nodes or stop/pause.
Definition: Checklist.h:146
void resumeNonBlockingCheck(AsyncState *state)
Definition: Checklist.cc:261
bool empty() const override
bool isProxyAuth() const override
ACLExternal(char const *)
external_acl_data * data
Definition: ExternalACL.h:62
~ACLExternal() override
char const * typeString() const override
static void ExternalAclLookup(ACLChecklist *ch, ACLExternal *)
bool valid() const override
int match(ACLChecklist *checklist) override
Matches the actual data in checklist against this ACL.
void parse() override
parses node representation in squid.conf; dies on failures
SBufList dump() const override
char const * class_
Definition: ExternalACL.h:63
char rfc931[USER_IDENT_SZ]
AccessLogEntry::Pointer al
info for the future access.log, and external ACL
ExternalACLEntryPointer extacl_entry
HttpRequest::Pointer request
Definition: Acl.h:46
static ACL * FindByName(const char *name)
Definition: Acl.cc:118
SBuf lastAclData
string for external_acl_type DATA format code
const char * lastAclName
string for external_acl_type ACL format code
bool allowed() const
Definition: Acl.h:156
Cbc * get() const
a temporary valid raw Cbc pointer or NULL
Definition: CbcPointer.h:159
static void DisableMacros()
Do not allow macros inside quoted strings.
Definition: ConfigParser.h:147
static char * NextToken()
static void EnableMacros()
Allow macros inside quoted strings.
Definition: ConfigParser.h:144
static char * strtokFile()
Definition: ConfigParser.cc:65
NotePairs notes
list of all kv-pairs returned by the helper
external_acl * def
Acl::Answer result
NotePairs notes
list of all kv-pairs returned by the helper
void update(ExternalACLEntryData const &)
static ExternalACLLookup instance_
Definition: ExternalACL.h:31
static void Start(ACLChecklist *checklist, external_acl_data *acl, bool bg)
static ExternalACLLookup * Instance()
void checkForAsync(ACLChecklist *) const override
static void LookupDone(void *data, const ExternalACLEntryPointer &result)
Called when an async lookup returns.
void assemble(MemBuf &mb, const AccessLogEntryPointer &al, int logSequenceNumber) const
assemble the state information into a formatted line.
Definition: Format.cc:377
Token * format
Definition: Format.h:60
Token * next
Definition: Token.h:71
ByteCode_t type
Definition: Token.h:50
bool space
Definition: Token.h:68
unsigned int n_max
Definition: ChildConfig.h:48
unsigned int n_startup
Definition: ChildConfig.h:57
unsigned int n_idle
Definition: ChildConfig.h:66
unsigned int queue_size
Definition: ChildConfig.h:91
unsigned int concurrency
Definition: ChildConfig.h:72
static Pointer Make(const char *name)
Definition: helper.cc:759
NotePairs notes
Definition: Reply.h:62
Helper::ResultCode result
The helper response 'result' field.
Definition: Reply.h:59
String extacl_log
Definition: HttpRequest.h:182
CbcPointer< ConnStateData > clientConnectionManager
Definition: HttpRequest.h:232
String extacl_user
Definition: HttpRequest.h:178
String extacl_message
Definition: HttpRequest.h:184
String extacl_passwd
Definition: HttpRequest.h:180
String tag
Definition: HttpRequest.h:176
static IdentLookup * Instance()
Definition: AclIdent.cc:93
bool setIPv4()
Definition: Address.cc:224
void setLocalhost()
Definition: Address.cc:255
Definition: MemBuf.h:24
void clean()
Definition: MemBuf.cc:110
void init(mb_size_t szInit, mb_size_t szMax)
Definition: MemBuf.cc:93
mb_size_t size
Definition: MemBuf.h:135
char * buf
Definition: MemBuf.h:134
void reset()
Definition: MemBuf.cc:129
void append(const NotePairs *src)
Append the entries of the src NotePairs list to our list.
Definition: Notes.cc:374
const char * findFirst(const char *noteKey) const
Definition: Notes.cc:297
void appendf(const char *fmt,...) PRINTF_FORMAT_ARG2
Append operation with printf-style arguments.
Definition: Packable.h:61
C * getRaw() const
Definition: RefCount.h:89
Definition: SBuf.h:94
const char * c_str()
Definition: SBuf.cc:516
size_type length() const
Returns the number of bytes stored in SBuf.
Definition: SBuf.h:415
SBuf & Printf(const char *fmt,...) PRINTF_FORMAT_ARG2
Definition: SBuf.cc:214
SBuf & append(const SBuf &S)
Definition: SBuf.cc:185
external_acl * externalAclHelperList
Definition: SquidConfig.h:503
char const * termedBuf() const
Definition: SquidString.h:92
size_type size() const
Definition: SquidString.h:73
Definition: cbdata.cc:38
externalAclState(external_acl *aDef, const char *aKey)
external_acl * def
externalAclState * queue
const char * name
wordlist * arguments
external_acl * def
external_acl_data(external_acl *aDef)
Format::Quoting quote
hash_table * cache
Ip::Address local_addr
wordlist * cmdline
Definition: external_acl.cc:99
Helper::Client::Pointer theHelper
Helper::ChildConfig children
dlink_list lru_list
external_acl * next
Definition: external_acl.cc:81
void trimCache()
void add(const ExternalACLEntryPointer &)
bool maybeCacheable(const Acl::Answer &) const
Format::Format format
Definition: external_acl.cc:97
dlink_list queue
char * key
Definition: wordlist.h:32
wordlist * next
Definition: wordlist.h:33
#define DBG_PARSE_NOTE(x)
Definition: Stream.h:42
#define MYNAME
Definition: Stream.h:236
#define DBG_IMPORTANT
Definition: Stream.h:38
#define debugs(SECTION, LEVEL, CONTENT)
Definition: Stream.h:194
#define DBG_CRITICAL
Definition: Stream.h:37
#define IPC_TCP_SOCKET
Definition: defines.h:91
void externalAclInit(void)
static void externalAclRegisterWithCacheManager(void)
void parse_externalAclHelper(external_acl **list)
static void externalAclHandleReply(void *data, const Helper::Reply &reply)
static void externalAclStats(StoreEntry *sentry)
static int external_acl_grace_expired(external_acl *def, const ExternalACLEntryPointer &entry)
static void external_acl_cache_delete(external_acl *def, const ExternalACLEntryPointer &entry)
static char * makeExternalAclKey(ACLFilledChecklist *ch, external_acl_data *acl_data)
static void copyResultsFromEntry(const HttpRequest::Pointer &req, const ExternalACLEntryPointer &entry)
void free_externalAclHelper(external_acl **list)
static Acl::Answer aclMatchExternal(external_acl_data *acl, ACLFilledChecklist *ch)
#define DEFAULT_EXTERNAL_ACL_CHILDREN
Definition: external_acl.cc:55
static void external_acl_cache_touch(external_acl *def, const ExternalACLEntryPointer &entry)
static int external_acl_entry_expired(external_acl *def, const ExternalACLEntryPointer &entry)
static ExternalACLEntryPointer external_acl_cache_add(external_acl *def, const char *key, ExternalACLEntryData const &data)
static external_acl * find_externalAclHelper(const char *name)
#define DEFAULT_EXTERNAL_ACL_TTL
Definition: external_acl.cc:52
void dump_externalAclHelper(StoreEntry *sentry, const char *name, const external_acl *list)
void externalAclShutdown(void)
const char * external_acl_message
const char * AclMatchedName
Definition: Acl.cc:29
@ ACCESS_AUTH_REQUIRED
Definition: Acl.h:120
@ ACCESS_DENIED
Definition: Acl.h:115
@ ACCESS_ALLOWED
Definition: Acl.h:116
@ ACCESS_DUNNO
Definition: Acl.h:117
SQUIDCEXTERN hash_table * hash_create(HASHCMP *, int, HASHHASH *)
Definition: hash.cc:108
SQUIDCEXTERN void hash_join(hash_table *, hash_link *)
Definition: hash.cc:131
SQUIDCEXTERN int hashPrime(int n)
Definition: hash.cc:293
int HASHCMP(const void *, const void *)
Definition: hash.h:13
SQUIDCEXTERN void hashFreeMemory(hash_table *)
Definition: hash.cc:268
SQUIDCEXTERN void hash_remove_link(hash_table *, hash_link *)
Definition: hash.cc:220
SQUIDCEXTERN HASHHASH hash4
Definition: hash.h:46
SQUIDCEXTERN hash_link * hash_lookup(hash_table *, const void *)
Definition: hash.cc:146
void helperShutdown(const Helper::Client::Pointer &hlp)
Definition: helper.cc:771
const char * quote
Definition: Quoting.cc:17
@ LFT_REPLY_HEADER
Definition: ByteCode.h:129
@ LFT_EXT_ACL_USER_CA_CERT
Definition: ByteCode.h:247
@ LFT_USER_LOGIN
Definition: ByteCode.h:150
@ LFT_EXT_ACL_DATA
Definition: ByteCode.h:252
@ LFT_USER_IDENT
Definition: ByteCode.h:151
@ LFT_EXT_ACL_NAME
Definition: ByteCode.h:251
@ LFT_ADAPTED_REQUEST_HEADER
Definition: ByteCode.h:95
@ LFT_REPLY_HEADER_ELEM
Definition: ByteCode.h:130
@ LFT_ADAPTED_REQUEST_HEADER_ELEM
Definition: ByteCode.h:96
@ LFT_EXT_ACL_USER_CERT
Definition: ByteCode.h:246
Quoting
Quoting style for a format output.
Definition: ByteCode.h:261
@ LOG_QUOTE_URL
Definition: ByteCode.h:265
@ LOG_QUOTE_SHELL
Definition: ByteCode.h:266
@ LOG_QUOTE_NONE
Definition: ByteCode.h:262
@ Error
Definition: ResultCode.h:19
@ Okay
Definition: ResultCode.h:18
void RegisterAction(char const *action, char const *desc, OBJH *handler, int pw_req_flag, int atomic)
Definition: Registration.cc:16
#define xfree
#define xstrdup
#define rfc1738_escape(x)
Definition: rfc1738.h:52
std::list< SBuf > SBufList
Definition: forward.h:23
static struct stat sb
Definition: squidclient.cc:71
void storeAppendPrintf(StoreEntry *e, const char *fmt,...)
Definition: store.cc:841
int EnableIpv6
Whether IPv6 is supported and type of support.
Definition: tools.h:25
Definition: parse.c:104
struct node * next
Definition: parse.c:105
void strwordquote(MemBuf *mb, const char *str)
Definition: tools.cc:1080
const char * wordlistAdd(wordlist **list, const char *key)
Definition: wordlist.cc:25
void wordlistDestroy(wordlist **list)
destroy a wordlist
Definition: wordlist.cc:16
#define safe_free(x)
Definition: xalloc.h:73

 

Introduction

Documentation

Support

Miscellaneous

Web Site Translations

Mirrors