external_acl.cc
Go to the documentation of this file.
1 /*
2  * Copyright (C) 1996-2025 The Squid Software Foundation and contributors
3  *
4  * Squid software is distributed under GPLv2+ license and includes
5  * contributions from numerous individuals and organizations.
6  * Please see the COPYING and CONTRIBUTORS files for details.
7  */
8 
9 /* DEBUG: section 82 External ACL */
10 
11 #include "squid.h"
12 #include "acl/Acl.h"
13 #include "acl/FilledChecklist.h"
14 #include "cache_cf.h"
15 #include "client_side.h"
16 #include "client_side_request.h"
17 #include "comm/Connection.h"
18 #include "ConfigParser.h"
19 #include "ExternalACL.h"
20 #include "ExternalACLEntry.h"
21 #include "fde.h"
22 #include "format/Token.h"
23 #include "helper.h"
24 #include "helper/Reply.h"
25 #include "http/Stream.h"
26 #include "HttpReply.h"
27 #include "HttpRequest.h"
28 #include "ip/tools.h"
29 #include "MemBuf.h"
30 #include "mgr/Registration.h"
31 #include "rfc1738.h"
32 #include "SquidConfig.h"
33 #include "SquidString.h"
34 #include "Store.h"
35 #include "tools.h"
36 #include "wordlist.h"
37 #if USE_OPENSSL
38 #include "ssl/ServerBump.h"
39 #include "ssl/support.h"
40 #endif
41 #if USE_AUTH
42 #include "auth/Acl.h"
43 #include "auth/Gadgets.h"
44 #include "auth/UserRequest.h"
45 #endif
46 
47 #ifndef DEFAULT_EXTERNAL_ACL_TTL
48 #define DEFAULT_EXTERNAL_ACL_TTL 1 * 60 * 60
49 #endif
50 #ifndef DEFAULT_EXTERNAL_ACL_CHILDREN
51 #define DEFAULT_EXTERNAL_ACL_CHILDREN 5
52 #endif
53 
54 static void external_acl_cache_delete(external_acl * def, const ExternalACLEntryPointer &entry);
57 static void external_acl_cache_touch(external_acl * def, const ExternalACLEntryPointer &entry);
58 static ExternalACLEntryPointer external_acl_cache_add(external_acl * def, const char *key, ExternalACLEntryData const &data);
59 
60 /******************************************************************
61  * external_acl directive
62  */
63 
65 {
66  /* XXX: These are not really cbdata, but it is an easy way
67  * to get them pooled, refcounted, accounted and freed properly...
68  * Use RefCountable MEMPROXY_CLASS instead
69  */
71 
72 public:
73  external_acl();
74  ~external_acl();
75 
77 
79 
80  void trimCache();
81 
82  bool maybeCacheable(const Acl::Answer &) const;
83 
84  int ttl;
85 
87 
88  int grace;
89 
90  char *name;
91 
93 
95 
97 
99 
101 
103 
105 
107 
109 
110 #if USE_AUTH
111 
117  bool require_auth;
118 #endif
119 
120  Format::Quoting quote; // default quoting to use, set by protocol= parameter
121 
123 };
124 
126 
128  next(nullptr),
130  negative_ttl(-1),
131  grace(1),
132  name(nullptr),
133  format("external_acl_type"),
134  cmdline(nullptr),
136  theHelper(nullptr),
137  cache(nullptr),
138  cache_size(256*1024),
139  cache_entries(0),
140 #if USE_AUTH
141  require_auth(0),
142 #endif
143  quote(Format::LOG_QUOTE_URL)
144 {
146 }
147 
149 {
150  xfree(name);
152 
153  if (theHelper) {
155  theHelper = nullptr;
156  }
157 
158  while (lru_list.tail) {
160  external_acl_cache_delete(this, e);
161  }
162  if (cache)
164 
165  while (next) {
167  next = node->next;
168  node->next = nullptr; // prevent recursion
169  delete node;
170  }
171 }
172 
173 void
175 {
176  char *token = ConfigParser::NextToken();
177 
178  if (!token) {
179  self_destruct();
180  return;
181  }
182 
183  external_acl *a = new external_acl;
184  a->name = xstrdup(token);
185 
186  // Allow supported %macros inside quoted tokens
188  token = ConfigParser::NextToken();
189 
190  /* Parse options */
191  while (token) {
192  if (strncmp(token, "ttl=", 4) == 0) {
193  a->ttl = atoi(token + 4);
194  } else if (strncmp(token, "negative_ttl=", 13) == 0) {
195  a->negative_ttl = atoi(token + 13);
196  } else if (strncmp(token, "children=", 9) == 0) {
197  a->children.n_max = atoi(token + 9);
198  debugs(0, DBG_CRITICAL, "WARNING: external_acl_type option children=N has been deprecated in favor of children-max=N and children-startup=N");
199  } else if (strncmp(token, "children-max=", 13) == 0) {
200  a->children.n_max = atoi(token + 13);
201  } else if (strncmp(token, "children-startup=", 17) == 0) {
202  a->children.n_startup = atoi(token + 17);
203  } else if (strncmp(token, "children-idle=", 14) == 0) {
204  a->children.n_idle = atoi(token + 14);
205  } else if (strncmp(token, "concurrency=", 12) == 0) {
206  a->children.concurrency = atoi(token + 12);
207  } else if (strncmp(token, "queue-size=", 11) == 0) {
208  a->children.queue_size = atoi(token + 11);
209  a->children.defaultQueueSize = false;
210  } else if (strncmp(token, "cache=", 6) == 0) {
211  a->cache_size = atoi(token + 6);
212  } else if (strncmp(token, "grace=", 6) == 0) {
213  a->grace = atoi(token + 6);
214  } else if (strcmp(token, "protocol=2.5") == 0) {
216  } else if (strcmp(token, "protocol=3.0") == 0) {
217  debugs(3, DBG_PARSE_NOTE(2), "WARNING: external_acl_type option protocol=3.0 is deprecated. Remove this from your config.");
219  } else if (strcmp(token, "quote=url") == 0) {
220  debugs(3, DBG_PARSE_NOTE(2), "WARNING: external_acl_type option quote=url is deprecated. Remove this from your config.");
222  } else if (strcmp(token, "quote=shell") == 0) {
223  debugs(3, DBG_PARSE_NOTE(2), "WARNING: external_acl_type option quote=shell is deprecated. Use protocol=2.5 if still needed.");
225 
226  /* INET6: allow admin to configure some helpers explicitly to
227  bind to IPv4/v6 localhost port. */
228  } else if (strcmp(token, "ipv4") == 0) {
229  if ( !a->local_addr.setIPv4() ) {
230  debugs(3, DBG_CRITICAL, "WARNING: Error converting " << a->local_addr << " to IPv4 in " << a->name );
231  }
232  } else if (strcmp(token, "ipv6") == 0) {
233  if (!Ip::EnableIpv6)
234  debugs(3, DBG_CRITICAL, "WARNING: --enable-ipv6 required for external ACL helpers to use IPv6: " << a->name );
235  // else nothing to do.
236  } else {
237  break;
238  }
239 
240  token = ConfigParser::NextToken();
241  }
243 
244  /* check that child startup value is sane. */
245  if (a->children.n_startup > a->children.n_max)
247 
248  /* check that child idle value is sane. */
249  if (a->children.n_idle > a->children.n_max)
250  a->children.n_idle = a->children.n_max;
251  if (a->children.n_idle < 1)
252  a->children.n_idle = 1;
253 
254  if (a->negative_ttl == -1)
255  a->negative_ttl = a->ttl;
256 
257  if (a->children.defaultQueueSize)
258  a->children.queue_size = 2 * a->children.n_max;
259 
260  /* Legacy external_acl_type format parser.
261  * Handles a series of %... tokens where any non-% means
262  * the start of another parameter field (ie the path to binary).
263  */
265  Format::Token **fmt = &a->format.format;
266  bool data_used = false;
267  while (token) {
268  /* stop on first non-% token found */
269  if (*token != '%')
270  break;
271 
272  *fmt = new Format::Token;
273  // these tokens are whitespace delimited
274  (*fmt)->space = true;
275 
276  // set the default encoding to match the protocol= config
277  // this will be overridden by explicit %macro attributes
278  (*fmt)->quote = a->quote;
279 
280  // compatibility for old tokens incompatible with Format::Token syntax
281 #if USE_OPENSSL // do not bother unless we have to.
282  if (strncmp(token, "%USER_CERT_", 11) == 0) {
283  (*fmt)->type = Format::LFT_EXT_ACL_USER_CERT;
284  (*fmt)->data.string = xstrdup(token + 11);
285  (*fmt)->data.header.header = (*fmt)->data.string;
286  } else if (strncmp(token, "%USER_CA_CERT_", 14) == 0) {
287  (*fmt)->type = Format::LFT_EXT_ACL_USER_CA_CERT;
288  (*fmt)->data.string = xstrdup(token + 14);
289  (*fmt)->data.header.header = (*fmt)->data.string;
290  } else if (strncmp(token, "%CA_CERT_", 9) == 0) {
291  debugs(82, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: external_acl_type %CA_CERT_* code is obsolete. Use %USER_CA_CERT_* instead");
292  (*fmt)->type = Format::LFT_EXT_ACL_USER_CA_CERT;
293  (*fmt)->data.string = xstrdup(token + 9);
294  (*fmt)->data.header.header = (*fmt)->data.string;
295  } else
296 #endif
297  if (strncmp(token,"%<{", 3) == 0) {
298  SBuf tmp("%<h");
299  tmp.append(token+2);
300  debugs(82, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: external_acl_type format %<{...} is deprecated. Use " << tmp);
301  const size_t parsedLen = (*fmt)->parse(tmp.c_str(), &quote);
302  assert(parsedLen == tmp.length());
303  assert((*fmt)->type == Format::LFT_REPLY_HEADER ||
304  (*fmt)->type == Format::LFT_REPLY_HEADER_ELEM);
305 
306  } else if (strncmp(token,"%>{", 3) == 0) {
307  SBuf tmp("%>ha");
308  tmp.append(token+2);
309  debugs(82, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: external_acl_type format %>{...} is deprecated. Use " << tmp);
310  const size_t parsedLen = (*fmt)->parse(tmp.c_str(), &quote);
311  assert(parsedLen == tmp.length());
312  assert((*fmt)->type == Format::LFT_ADAPTED_REQUEST_HEADER ||
314 
315  } else {
316  // we can use the Format::Token::parse() method since it
317  // only pulls off one token. Since we already checked
318  // for '%' prefix above this is guaranteed to be a token.
319  const size_t len = (*fmt)->parse(token, &quote);
320  assert(len == strlen(token));
321  }
322 
323  // process special token-specific actions (only if necessary)
324 #if USE_AUTH
325  if ((*fmt)->type == Format::LFT_USER_LOGIN)
326  a->require_auth = true;
327 #endif
328 
329  if ((*fmt)->type == Format::LFT_EXT_ACL_DATA)
330  data_used = true;
331 
332  fmt = &((*fmt)->next);
333  token = ConfigParser::NextToken();
334  }
335 
336  /* There must be at least one format token */
337  if (!a->format.format) {
338  delete a;
339  self_destruct();
340  return;
341  }
342 
343  // format has implicit %DATA on the end if not used explicitly
344  if (!data_used) {
345  *fmt = new Format::Token;
346  (*fmt)->type = Format::LFT_EXT_ACL_DATA;
347  (*fmt)->quote = Format::LOG_QUOTE_NONE;
348  }
349 
350  /* helper */
351  if (!token) {
352  delete a;
353  self_destruct();
354  return;
355  }
356 
357  wordlistAdd(&a->cmdline, token);
358 
359  /* arguments */
360  parse_wordlist(&a->cmdline);
361 
362  while (*list)
363  list = &(*list)->next;
364 
365  *list = a;
366 }
367 
368 void
369 dump_externalAclHelper(StoreEntry * sentry, const char *name, const external_acl * list)
370 {
371  const external_acl *node;
372  const wordlist *word;
373 
374  for (node = list; node; node = node->next) {
375  storeAppendPrintf(sentry, "%s %s", name, node->name);
376 
377  if (!node->local_addr.isIPv6())
378  storeAppendPrintf(sentry, " ipv4");
379  else
380  storeAppendPrintf(sentry, " ipv6");
381 
382  if (node->ttl != DEFAULT_EXTERNAL_ACL_TTL)
383  storeAppendPrintf(sentry, " ttl=%d", node->ttl);
384 
385  if (node->negative_ttl != node->ttl)
386  storeAppendPrintf(sentry, " negative_ttl=%d", node->negative_ttl);
387 
388  if (node->grace)
389  storeAppendPrintf(sentry, " grace=%d", node->grace);
390 
391  if (node->children.n_max != DEFAULT_EXTERNAL_ACL_CHILDREN)
392  storeAppendPrintf(sentry, " children-max=%d", node->children.n_max);
393 
394  if (node->children.n_startup != 0) // sync with helper/ChildConfig.cc default
395  storeAppendPrintf(sentry, " children-startup=%d", node->children.n_startup);
396 
397  if (node->children.n_idle != 1) // sync with helper/ChildConfig.cc default
398  storeAppendPrintf(sentry, " children-idle=%d", node->children.n_idle);
399 
400  if (node->children.concurrency != 0)
401  storeAppendPrintf(sentry, " concurrency=%d", node->children.concurrency);
402 
403  if (node->cache)
404  storeAppendPrintf(sentry, " cache=%d", node->cache_size);
405 
406  if (node->quote == Format::LOG_QUOTE_SHELL)
407  storeAppendPrintf(sentry, " protocol=2.5");
408 
409  node->format.dump(sentry, nullptr, false);
410 
411  for (word = node->cmdline; word; word = word->next)
412  storeAppendPrintf(sentry, " %s", word->key);
413 
414  storeAppendPrintf(sentry, "\n");
415  }
416 }
417 
418 void
420 {
421  delete *list;
422  *list = nullptr;
423 }
424 
425 static external_acl *
426 find_externalAclHelper(const char *name)
427 {
429 
431  if (strcmp(node->name, name) == 0)
432  return node;
433  }
434 
435  return nullptr;
436 }
437 
438 void
440 {
441  trimCache();
442  assert(anEntry != nullptr);
443  assert (anEntry->def == nullptr);
444  anEntry->def = this;
445  ExternalACLEntry *e = const_cast<ExternalACLEntry *>(anEntry.getRaw()); // XXX: make hash a std::map of Pointer.
446  hash_join(cache, e);
447  dlinkAdd(e, &e->lru, &lru_list);
448  e->lock(); //cbdataReference(e); // lock it on behalf of the hash
449  ++cache_entries;
450 }
451 
452 void
454 {
455  if (cache_size && cache_entries >= cache_size) {
457  external_acl_cache_delete(this, e);
458  }
459 }
460 
461 bool
463 {
464  if (cache_size <= 0)
465  return false; // cache is disabled
466 
467  if (result == ACCESS_DUNNO)
468  return false; // non-cacheable response
469 
470  if ((result.allowed() ? ttl : negative_ttl) <= 0)
471  return false; // not caching this type of response
472 
473  return true;
474 }
475 
476 /******************************************************************
477  * external acl type
478  */
479 
481 {
483 
484 public:
485  explicit external_acl_data(external_acl * const aDef): def(cbdataReference(aDef)), arguments(nullptr) {}
487 
488  external_acl *def;
489  SBuf name;
491 };
492 
494 
496 {
499 }
500 
501 void
503 {
504  if (data) {
505  self_destruct();
506  return;
507  }
508 
509  char *token = ConfigParser::strtokFile();
510 
511  if (!token) {
512  self_destruct();
513  return;
514  }
515 
517 
518  if (!data->def) {
519  delete data;
520  self_destruct();
521  return;
522  }
523 
524  // def->name is the name of the external_acl_type.
525  // this is the name of the 'acl' directive being tested
526  data->name = name;
527 
528  while ((token = ConfigParser::strtokFile())) {
529  wordlistAdd(&data->arguments, token);
530  }
531 }
532 
533 bool
535 {
536 #if USE_AUTH
537  if (data->def->require_auth) {
538  if (authenticateSchemeCount() == 0) {
539  debugs(28, DBG_CRITICAL, "ERROR: Cannot use proxy auth because no authentication schemes were compiled.");
540  return false;
541  }
542 
543  if (authenticateActiveSchemeCount() == 0) {
544  debugs(28, DBG_CRITICAL, "ERROR: Cannot use proxy auth because no authentication schemes are fully configured.");
545  return false;
546  }
547  }
548 #endif
549 
550  return true;
551 }
552 
553 bool
555 {
556  return false;
557 }
558 
560 {
561  delete data;
562  xfree(class_);
563 }
564 
565 static void
567 {
568  if (req) {
569 #if USE_AUTH
570  if (entry->user.size())
571  req->extacl_user = entry->user;
572 
573  if (entry->password.size())
574  req->extacl_passwd = entry->password;
575 #endif
576  if (!req->tag.size())
577  req->tag = entry->tag;
578 
579  if (entry->log.size())
580  req->extacl_log = entry->log;
581 
582  if (entry->message.size())
583  req->extacl_message = entry->message;
584 
585  // attach the helper kv-pair to the transaction
586  UpdateRequestNotes(req->clientConnectionManager.get(), *req, entry->notes);
587  }
588 }
589 
590 // TODO: Diff reduction. Rename this helper method to match_() or similar.
593 {
594  // Despite its external_acl C++ type name, acl->def is not an ACL (i.e. not
595  // a reference-counted Acl::Node) and gets invalidated by reconfiguration.
596  // TODO: RefCount external_acl, so that we do not have to bail here.
597  if (!cbdataReferenceValid(acl->def)) {
598  debugs(82, 3, "cannot resume matching; external_acl gone");
599  return ACCESS_DUNNO;
600  }
601 
602  debugs(82, 9, "acl=\"" << acl->def->name << "\"");
604 
605  external_acl_message = "MISSING REQUIRED INFORMATION";
606 
607  if (entry != nullptr) {
608  if (entry->def == acl->def) {
609  /* Ours, use it.. if the key matches */
610  const char *key = makeExternalAclKey(ch, acl);
611  if (!key)
612  return ACCESS_DUNNO; // insufficient data to continue
613  if (strcmp(key, (char*)entry->key) != 0) {
614  debugs(82, 9, "entry key='" << (char *)entry->key << "', our key='" << key << "' do not match. Discarded.");
615  // too bad. need a new lookup.
616  entry = ch->extacl_entry = nullptr;
617  }
618  } else {
619  /* Not ours.. get rid of it */
620  debugs(82, 9, "entry " << entry << " not valid or not ours. Discarded.");
621  if (entry != nullptr) {
622  debugs(82, 9, "entry def=" << entry->def << ", our def=" << acl->def);
623  const char *key = makeExternalAclKey(ch, acl); // may be nil
624  debugs(82, 9, "entry key='" << (char *)entry->key << "', our key='" << key << "'");
625  }
626  entry = ch->extacl_entry = nullptr;
627  }
628  }
629 
630  if (!entry) {
631  debugs(82, 9, "No helper entry available");
632 #if USE_AUTH
633  if (acl->def->require_auth) {
634  /* Make sure the user is authenticated */
635  debugs(82, 3, acl->def->name << " check user authenticated.");
636  const auto ti = AuthenticateAcl(ch, *this);
637  if (!ti.allowed()) {
638  debugs(82, 2, acl->def->name << " user not authenticated (" << ti << ")");
639  return ti;
640  }
641  debugs(82, 3, acl->def->name << " user is authenticated.");
642  }
643 #endif
644  const char *key = makeExternalAclKey(ch, acl);
645 
646  if (!key) {
647  /* Not sufficient data to process */
648  return ACCESS_DUNNO;
649  }
650 
651  entry = static_cast<ExternalACLEntry *>(hash_lookup(acl->def->cache, key));
652 
653  const ExternalACLEntryPointer staleEntry = entry;
654  if (entry != nullptr && external_acl_entry_expired(acl->def, entry))
655  entry = nullptr;
656 
657  if (entry != nullptr && external_acl_grace_expired(acl->def, entry)) {
658  // refresh in the background
659  startLookup(ch, acl, true);
660  debugs(82, 4, "no need to wait for the refresh of '" <<
661  key << "' in '" << acl->def->name << "' (ch=" << ch << ").");
662  }
663 
664  if (!entry) {
665  debugs(82, 2, acl->def->name << "(\"" << key << "\") = lookup needed");
666 
667  // TODO: All other helpers allow temporary overload. Should not we?
668  if (!acl->def->theHelper->willOverload()) {
669  debugs(82, 2, "\"" << key << "\": queueing a call.");
670  if (!ch->goAsync(StartLookup, *this))
671  debugs(82, 2, "\"" << key << "\": no async support!");
672  debugs(82, 2, "\"" << key << "\": return -1.");
673  return ACCESS_DUNNO; // expired cached or simply absent entry
674  } else {
675  if (!staleEntry) {
676  debugs(82, DBG_IMPORTANT, "WARNING: external ACL '" << acl->def->name <<
677  "' queue full. Request rejected '" << key << "'.");
678  external_acl_message = "SYSTEM TOO BUSY, TRY AGAIN LATER";
679  return ACCESS_DUNNO;
680  } else {
681  debugs(82, DBG_IMPORTANT, "WARNING: external ACL '" << acl->def->name <<
682  "' queue full. Using stale result. '" << key << "'.");
683  entry = staleEntry;
684  /* Fall thru to processing below */
685  }
686  }
687  }
688  }
689 
690  debugs(82, 4, "entry = { date=" <<
691  (long unsigned int) entry->date <<
692  ", result=" << entry->result <<
693  " tag=" << entry->tag <<
694  " log=" << entry->log << " }");
695 #if USE_AUTH
696  debugs(82, 4, "entry user=" << entry->user);
697 #endif
698 
699  external_acl_cache_touch(acl->def, entry);
701 
702  debugs(82, 2, acl->def->name << " = " << entry->result);
703  copyResultsFromEntry(ch->request, entry);
704  return entry->result;
705 }
706 
707 int
709 {
710  auto answer = aclMatchExternal(data, Filled(checklist));
711 
712  // convert to tri-state ACL match 1,0,-1
713  switch (answer) {
714  case ACCESS_ALLOWED:
715  return 1; // match
716 
717  case ACCESS_DENIED:
718  return 0; // non-match
719 
720  case ACCESS_DUNNO:
722  default:
723  // If the answer is not allowed or denied (matches/not matches) and
724  // async authentication is not in progress, then we are done.
725  if (checklist->keepMatching())
726  checklist->markFinished(answer, "aclMatchExternal exception");
727  return -1; // other
728  }
729 }
730 
731 SBufList
733 {
734  external_acl_data const *acl = data;
735  SBufList rv;
736  rv.push_back(SBuf(acl->def->name));
737 
738  for (wordlist *arg = acl->arguments; arg; arg = arg->next) {
739  SBuf s;
740  s.Printf(" %s", arg->key);
741  rv.push_back(s);
742  }
743 
744  return rv;
745 }
746 
747 /******************************************************************
748  * external_acl cache
749  */
750 
751 static void
753 {
754  // this must not be done when nothing is being cached.
755  if (!def->maybeCacheable(entry->result))
756  return;
757 
758  dlinkDelete(&entry->lru, &def->lru_list);
759  ExternalACLEntry *e = const_cast<ExternalACLEntry *>(entry.getRaw()); // XXX: make hash a std::map of Pointer.
760  dlinkAdd(e, &entry->lru, &def->lru_list);
761 }
762 
763 char *
765 {
766  static MemBuf mb;
767  mb.reset();
768 
769  // check for special case tokens in the format
770  for (Format::Token *t = acl_data->def->format.format; t ; t = t->next) {
771 
772  if (t->type == Format::LFT_EXT_ACL_NAME) {
773  // setup for %ACL
774  ch->al->lastAclName = acl_data->name;
775  }
776 
777  if (t->type == Format::LFT_EXT_ACL_DATA) {
778  // setup string for %DATA
779  SBuf sb;
780  for (auto arg = acl_data->arguments; arg; arg = arg->next) {
781  if (sb.length())
782  sb.append(" ", 1);
783 
784  if (acl_data->def->quote == Format::LOG_QUOTE_URL) {
785  const char *quoted = rfc1738_escape(arg->key);
786  sb.append(quoted, strlen(quoted));
787  } else {
788  static MemBuf mb2;
789  mb2.init();
790  strwordquote(&mb2, arg->key);
791  sb.append(mb2.buf, mb2.size);
792  mb2.clean();
793  }
794  }
795 
796  ch->al->lastAclData = sb;
797  }
798  }
799 
800  // assemble the full helper lookup string
801  acl_data->def->format.assemble(mb, ch->al, 0);
802 
803  return mb.buf;
804 }
805 
806 static int
808 {
809  if (def->cache_size <= 0 || entry->result == ACCESS_DUNNO)
810  return 1;
811 
812  if (entry->date + (entry->result.allowed() ? def->ttl : def->negative_ttl) < squid_curtime)
813  return 1;
814  else
815  return 0;
816 }
817 
818 static int
820 {
821  if (def->cache_size <= 0 || entry->result == ACCESS_DUNNO)
822  return 1;
823 
824  int ttl;
825  ttl = entry->result.allowed() ? def->ttl : def->negative_ttl;
826  ttl = (ttl * (100 - def->grace)) / 100;
827 
828  if (entry->date + ttl <= squid_curtime)
829  return 1;
830  else
831  return 0;
832 }
833 
835 external_acl_cache_add(external_acl * def, const char *key, ExternalACLEntryData const & data)
836 {
838 
839  if (!def->maybeCacheable(data.result)) {
840  debugs(82,6, MYNAME);
841 
842  if (data.result == ACCESS_DUNNO) {
843  if (const ExternalACLEntryPointer oldentry = static_cast<ExternalACLEntry *>(hash_lookup(def->cache, key)))
844  external_acl_cache_delete(def, oldentry);
845  }
846  entry = new ExternalACLEntry;
847  entry->key = xstrdup(key);
848  entry->update(data);
849  entry->def = def;
850  return entry;
851  }
852 
853  entry = static_cast<ExternalACLEntry *>(hash_lookup(def->cache, key));
854  debugs(82, 2, "external_acl_cache_add: Adding '" << key << "' = " << data.result);
855 
856  if (entry != nullptr) {
857  debugs(82, 3, "updating existing entry");
858  entry->update(data);
859  external_acl_cache_touch(def, entry);
860  return entry;
861  }
862 
863  entry = new ExternalACLEntry;
864  entry->key = xstrdup(key);
865  entry->update(data);
866 
867  def->add(entry);
868 
869  return entry;
870 }
871 
872 static void
874 {
875  assert(entry != nullptr);
876  assert(def->cache_size > 0 && entry->def == def);
877  ExternalACLEntry *e = const_cast<ExternalACLEntry *>(entry.getRaw()); // XXX: make hash a std::map of Pointer.
878  hash_remove_link(def->cache, e);
879  dlinkDelete(&e->lru, &def->lru_list);
880  e->unlock(); // unlock on behalf of the hash
881  def->cache_entries -= 1;
882 }
883 
884 /******************************************************************
885  * external_acl helpers
886  */
887 
889 {
891 
892 public:
893  externalAclState(external_acl* aDef, const char *aKey) :
894  callback(nullptr),
895  callback_data(nullptr),
896  key(xstrdup(aKey)),
897  def(cbdataReference(aDef)),
898  queue(nullptr)
899  {}
901 
902  EAH *callback;
903  void *callback_data;
904  char *key;
908 };
909 
911 
913 {
914  xfree(key);
917 }
918 
919 /*
920  * The helper program receives queries on stdin, one
921  * per line, and must return the result on on stdout
922  *
923  * General result syntax:
924  *
925  * OK/ERR keyword=value ...
926  *
927  * Keywords:
928  *
929  * user= The users name (login)
930  * message= Message describing the reason
931  * tag= A string tag to be applied to the request that triggered the acl match.
932  * applies to both OK and ERR responses.
933  * Won't override existing request tags.
934  * log= A string to be used in access logging
935  *
936  * Other keywords may be added to the protocol later
937  *
938  * value needs to be URL-encoded or enclosed in double quotes (")
939  * with \-escaping on any whitespace, quotes, or slashes (\).
940  */
941 static void
942 externalAclHandleReply(void *data, const Helper::Reply &reply)
943 {
944  externalAclState *state = static_cast<externalAclState *>(data);
945  externalAclState *next;
946  ExternalACLEntryData entryData;
947 
948  debugs(82, 2, "reply=" << reply);
949 
950  if (reply.result == Helper::Okay)
951  entryData.result = ACCESS_ALLOWED;
952  else if (reply.result == Helper::Error)
953  entryData.result = ACCESS_DENIED;
954  else //BrokenHelper,TimedOut or Unknown. Should not cached.
955  entryData.result = ACCESS_DUNNO;
956 
957  // XXX: make entryData store a proper Helper::Reply object instead of copying.
958 
959  entryData.notes.append(&reply.notes);
960 
961  const char *label = reply.notes.findFirst("tag");
962  if (label != nullptr && *label != '\0')
963  entryData.tag = label;
964 
965  label = reply.notes.findFirst("message");
966  if (label != nullptr && *label != '\0')
967  entryData.message = label;
968 
969  label = reply.notes.findFirst("log");
970  if (label != nullptr && *label != '\0')
971  entryData.log = label;
972 
973 #if USE_AUTH
974  label = reply.notes.findFirst("user");
975  if (label != nullptr && *label != '\0')
976  entryData.user = label;
977 
978  label = reply.notes.findFirst("password");
979  if (label != nullptr && *label != '\0')
980  entryData.password = label;
981 #endif
982 
983  // XXX: This state->def access conflicts with the cbdata validity check
984  // below.
985  dlinkDelete(&state->list, &state->def->queue);
986 
988  if (cbdataReferenceValid(state->def))
989  entry = external_acl_cache_add(state->def, state->key, entryData);
990 
991  do {
992  void *cbdata;
993  if (state->callback && cbdataReferenceValidDone(state->callback_data, &cbdata))
994  state->callback(cbdata, entry);
995 
996  next = state->queue;
997  state->queue = nullptr;
998 
999  delete state;
1000 
1001  state = next;
1002  } while (state);
1003 }
1004 
1007 void
1009 {
1010  const auto &me = dynamic_cast<const ACLExternal&>(acl);
1011  me.startLookup(&checklist, me.data, false);
1012 }
1013 
1014 // If possible, starts an asynchronous lookup of an external ACL.
1015 // Otherwise, asserts (or bails if background refresh is requested).
1016 void
1018 {
1019  external_acl *def = acl->def;
1020 
1021  const char *key = makeExternalAclKey(ch, acl);
1022  assert(key);
1023 
1024  debugs(82, 2, (inBackground ? "bg" : "fg") << " lookup in '" <<
1025  def->name << "' for '" << key << "'");
1026 
1027  /* Check for a pending lookup to hook into */
1028  // only possible if we are caching results.
1029  externalAclState *oldstate = nullptr;
1030  if (def->cache_size > 0) {
1031  for (dlink_node *node = def->queue.head; node; node = node->next) {
1032  externalAclState *oldstatetmp = static_cast<externalAclState *>(node->data);
1033 
1034  if (strcmp(key, oldstatetmp->key) == 0) {
1035  oldstate = oldstatetmp;
1036  break;
1037  }
1038  }
1039  }
1040 
1041  // A background refresh has no need to piggiback on a pending request:
1042  // When the pending request completes, the cache will be refreshed anyway.
1043  if (oldstate && inBackground) {
1044  debugs(82, 7, "'" << def->name << "' queue is already being refreshed (ch=" << ch << ")");
1045  return;
1046  }
1047 
1048  externalAclState *state = new externalAclState(def, key);
1049 
1050  if (!inBackground) {
1051  state->callback = &LookupDone;
1052  state->callback_data = cbdataReference(ch);
1053  }
1054 
1055  if (oldstate) {
1056  /* Hook into pending lookup */
1057  state->queue = oldstate->queue;
1058  oldstate->queue = state;
1059  } else {
1060  /* No pending lookup found. Submit to helper */
1061 
1062  MemBuf buf;
1063  buf.init();
1064  buf.appendf("%s\n", key);
1065  debugs(82, 4, "externalAclLookup: looking up for '" << key << "' in '" << def->name << "'.");
1066 
1067  if (!def->theHelper->trySubmit(buf.buf, externalAclHandleReply, state)) {
1068  debugs(82, 7, "'" << def->name << "' submit to helper failed");
1069  assert(inBackground); // or the caller should have checked
1070  delete state;
1071  return;
1072  }
1073 
1074  dlinkAdd(state, &state->list, &def->queue);
1075 
1076  buf.clean();
1077  }
1078 
1079  debugs(82, 4, "externalAclLookup: will wait for the result of '" << key <<
1080  "' in '" << def->name << "' (ch=" << ch << ").");
1081 }
1082 
1083 static void
1085 {
1086  for (external_acl *p = Config.externalAclHelperList; p; p = p->next) {
1087  storeAppendPrintf(sentry, "External ACL Statistics: %s\n", p->name);
1088  storeAppendPrintf(sentry, "Cache size: %d\n", p->cache->count);
1089  assert(p->theHelper);
1090  p->theHelper->packStatsInto(sentry);
1091  storeAppendPrintf(sentry, "\n");
1092  }
1093 }
1094 
1095 static void
1097 {
1098  Mgr::RegisterAction("external_acl",
1099  "External ACL stats",
1100  externalAclStats, 0, 1);
1101 }
1102 
1103 void
1105 {
1106  for (external_acl *p = Config.externalAclHelperList; p; p = p->next) {
1107  if (!p->cache)
1108  p->cache = hash_create((HASHCMP *) strcmp, hashPrime(1024), hash4);
1109 
1110  if (!p->theHelper)
1111  p->theHelper = Helper::Client::Make("external_acl_type");
1112 
1113  p->theHelper->cmdline = p->cmdline;
1114 
1115  p->theHelper->childs.updateLimits(p->children);
1116 
1117  p->theHelper->ipc_type = IPC_TCP_SOCKET;
1118 
1119  p->theHelper->addr = p->local_addr;
1120 
1121  p->theHelper->openSessions();
1122  }
1123 
1125 }
1126 
1127 void
1129 {
1130  external_acl *p;
1131 
1132  for (p = Config.externalAclHelperList; p; p = p->next) {
1134  }
1135 }
1136 
1138 void
1140 {
1141  ACLFilledChecklist *checklist = Filled(static_cast<ACLChecklist*>(data));
1142  checklist->extacl_entry = result;
1143  checklist->resumeNonBlockingCheck();
1144 }
1145 
1146 ACLExternal::ACLExternal(char const *theClass) : data(nullptr), class_(xstrdup(theClass))
1147 {}
1148 
1149 char const *
1151 {
1152  return class_;
1153 }
1154 
1155 bool
1157 {
1158 #if USE_AUTH
1159  return data->def->require_auth;
1160 #else
1161  return false;
1162 #endif
1163 }
1164 
external_acl * next
Definition: external_acl.cc:78
Format::Format format
Definition: external_acl.cc:94
void trimCache()
void EAH(void *data, const ExternalACLEntryPointer &result)
Definition: ExternalACL.h:56
Definition: parse.c:104
Cbc * get() const
a temporary valid raw Cbc pointer or NULL
Definition: CbcPointer.h:159
char * buf
Definition: MemBuf.h:134
wordlist * cmdline
Definition: external_acl.cc:96
Token * next
Definition: Token.h:73
#define IPC_TCP_SOCKET
Definition: defines.h:89
void wordlistDestroy(wordlist **list)
destroy a wordlist
Definition: wordlist.cc:16
void push_back(char)
Append a single character. The character may be NUL (\0).
Definition: SBuf.cc:208
Helper::Client::Pointer theHelper
void externalAclShutdown(void)
static void copyResultsFromEntry(const HttpRequest::Pointer &req, const ExternalACLEntryPointer &entry)
void appendf(const char *fmt,...) PRINTF_FORMAT_ARG2
Append operation with printf-style arguments.
Definition: Packable.h:61
#define DBG_CRITICAL
Definition: Stream.h:37
unsigned int queue_size
Definition: ChildConfig.h:91
NotePairs notes
list of all kv-pairs returned by the helper
@ LOG_QUOTE_URL
Definition: ByteCode.h:266
const char * findFirst(const char *noteKey) const
Definition: Notes.cc:307
void setLocalhost()
Definition: Address.cc:275
ExternalACLEntryPointer extacl_entry
#define cbdataReferenceValidDone(var, ptr)
Definition: cbdata.h:239
static void StartLookup(ACLFilledChecklist &, const Acl::Node &)
static char * strtokFile()
Definition: ConfigParser.cc:65
@ Error
Definition: ResultCode.h:19
mb_size_t size
Definition: MemBuf.h:135
external_acl_data * data
Definition: ExternalACL.h:49
bool empty() const override
struct node * next
Definition: parse.c:105
@ LFT_USER_LOGIN
Definition: ByteCode.h:152
bool valid() const override
static void externalAclHandleReply(void *data, const Helper::Reply &reply)
const char * external_acl_message
void add(const ExternalACLEntryPointer &)
static void external_acl_cache_touch(external_acl *def, const ExternalACLEntryPointer &entry)
const char * typeString() const override
static void EnableMacros()
Allow macros inside quoted strings.
Definition: ConfigParser.h:144
external_acl * def
void free_externalAclHelper(external_acl **list)
std::list< SBuf > SBufList
Definition: forward.h:22
bool keepMatching() const
Whether we should continue to match tree nodes or stop/pause.
Definition: Checklist.h:96
void storeAppendPrintf(StoreEntry *e, const char *fmt,...)
Definition: store.cc:855
void hash_remove_link(hash_table *, hash_link *)
Definition: hash.cc:220
Acl::Answer aclMatchExternal(external_acl_data *, ACLFilledChecklist *) const
#define CBDATA_CLASS(type)
Definition: cbdata.h:289
void init(mb_size_t szInit, mb_size_t szMax)
Definition: MemBuf.cc:93
Definition: SBuf.h:93
dlink_list queue
unsigned int n_idle
Definition: ChildConfig.h:66
#define DEFAULT_EXTERNAL_ACL_CHILDREN
Definition: external_acl.cc:51
#define xstrdup
Definition: cbdata.cc:37
bool goAsync(AsyncStarter, const Acl::Node &)
Definition: Checklist.cc:104
C * getRaw() const
Definition: RefCount.h:89
int cbdataReferenceValid(const void *p)
Definition: cbdata.cc:270
bool isProxyAuth() const override
AccessLogEntry::Pointer al
info for the future access.log, and external ACL
hash_link * hash_lookup(hash_table *, const void *)
Definition: hash.cc:146
const char * class_
Definition: ExternalACL.h:50
#define rfc1738_escape(x)
Definition: rfc1738.h:52
int HASHCMP(const void *, const void *)
Definition: hash.h:13
Format::Quoting quote
static ExternalACLEntryPointer external_acl_cache_add(external_acl *def, const char *key, ExternalACLEntryData const &data)
HASHHASH hash4
Definition: hash.h:46
Token * format
Definition: Format.h:60
char * makeExternalAclKey(ACLFilledChecklist *, external_acl_data *) const
@ LFT_ADAPTED_REQUEST_HEADER
Definition: ByteCode.h:97
int hashPrime(int n)
Definition: hash.cc:293
#define cbdataReference(var)
Definition: cbdata.h:348
void hashFreeMemory(hash_table *)
Definition: hash.cc:268
ByteCode_t type
Definition: Token.h:50
static Pointer Make(const char *name)
Definition: helper.cc:758
String extacl_user
Definition: HttpRequest.h:176
SBuf lastAclData
string for external_acl_type DATA format code
@ LOG_QUOTE_NONE
Definition: ByteCode.h:263
void self_destruct(void)
Definition: cache_cf.cc:275
int match(ACLChecklist *checklist) override
Matches the actual data in checklist against this Acl::Node.
wordlist * arguments
static int external_acl_grace_expired(external_acl *def, const ExternalACLEntryPointer &entry)
void startLookup(ACLFilledChecklist *, external_acl_data *, bool inBackground) const
bool space
Definition: Token.h:70
void helperShutdown(const Helper::Client::Pointer &hlp)
Definition: helper.cc:770
@ ACCESS_AUTH_REQUIRED
Definition: Acl.h:46
@ LOG_QUOTE_SHELL
Definition: ByteCode.h:267
static void DisableMacros()
Do not allow macros inside quoted strings.
Definition: ConfigParser.h:147
hash_table * cache
externalAclState * queue
static void externalAclStats(StoreEntry *sentry)
#define DBG_PARSE_NOTE(x)
Definition: Stream.h:42
static void LookupDone(void *data, const ExternalACLEntryPointer &)
Called when an async lookup returns.
Helper::ResultCode result
The helper response 'result' field.
Definition: Reply.h:59
void update(ExternalACLEntryData const &)
ACLFilledChecklist * Filled(ACLChecklist *checklist)
convenience and safety wrapper for dynamic_cast<ACLFilledChecklist*>
static external_acl * find_externalAclHelper(const char *name)
Definition: MemBuf.h:23
HttpRequest::Pointer request
external_acl * externalAclHelperList
Definition: SquidConfig.h:503
SBuf & Printf(const char *fmt,...) PRINTF_FORMAT_ARG2
Definition: SBuf.cc:214
void clean()
Definition: MemBuf.cc:110
NotePairs notes
Definition: Reply.h:62
void markFinished(const Acl::Answer &newAnswer, const char *reason)
Definition: Checklist.cc:45
@ LFT_REPLY_HEADER
Definition: ByteCode.h:131
ACLExternal(char const *)
#define assert(EX)
Definition: assert.h:17
@ Okay
Definition: ResultCode.h:18
static void externalAclRegisterWithCacheManager(void)
@ LFT_EXT_ACL_USER_CA_CERT
Definition: ByteCode.h:248
@ LFT_EXT_ACL_DATA
Definition: ByteCode.h:253
unsigned int n_max
Definition: ChildConfig.h:48
static void external_acl_cache_delete(external_acl *def, const ExternalACLEntryPointer &entry)
bool setIPv4()
Definition: Address.cc:244
external_acl * def
#define cbdataReferenceDone(var)
Definition: cbdata.h:357
const char * c_str()
Definition: SBuf.cc:516
external_acl_data(external_acl *const aDef)
#define CBDATA_CLASS_INIT(type)
Definition: cbdata.h:325
size_type length() const
Returns the number of bytes stored in SBuf.
Definition: SBuf.h:419
Helper::ChildConfig children
Definition: external_acl.cc:98
String extacl_log
Definition: HttpRequest.h:180
time_t squid_curtime
Definition: stub_libtime.cc:20
Acl::Answer AuthenticateAcl(ACLChecklist *ch, const Acl::Node &acl)
Definition: Acl.cc:28
SBuf & append(const SBuf &S)
Definition: SBuf.cc:185
#define xfree
static char * NextToken()
@ LFT_EXT_ACL_NAME
Definition: ByteCode.h:252
wordlist * next
Definition: wordlist.h:60
externalAclState(external_acl *aDef, const char *aKey)
void strwordquote(MemBuf *mb, const char *str)
Definition: tools.cc:1081
@ LFT_EXT_ACL_USER_CERT
Definition: ByteCode.h:247
unsigned int n_startup
Definition: ChildConfig.h:57
~ACLExternal() override
@ LFT_ADAPTED_REQUEST_HEADER_ELEM
Definition: ByteCode.h:98
void append(const NotePairs *src)
Append the entries of the src NotePairs list to our list.
Definition: Notes.cc:384
#define DEFAULT_EXTERNAL_ACL_TTL
Definition: external_acl.cc:48
const char * termedBuf() const
Definition: SquidString.h:93
char * key
Definition: wordlist.h:59
void parse_externalAclHelper(external_acl **list)
bool allowed() const
Definition: Acl.h:82
int authenticateSchemeCount(void)
Definition: Gadgets.cc:53
static int external_acl_entry_expired(external_acl *def, const ExternalACLEntryPointer &entry)
Definition: Node.h:25
hash_table * hash_create(HASHCMP *, int, HASHHASH *)
Definition: hash.cc:108
size_type size() const
Definition: SquidString.h:74
SBufList dump() const override
void RegisterAction(char const *action, char const *desc, OBJH *handler, Protected, Atomic, Format)
Definition: Registration.cc:54
bool maybeCacheable(const Acl::Answer &) const
int authenticateActiveSchemeCount(void)
Definition: Gadgets.cc:38
@ ACCESS_ALLOWED
Definition: Acl.h:42
void parse() override
parses node representation in squid.conf; dies on failures
@ ACCESS_DENIED
Definition: Acl.h:41
#define DBG_IMPORTANT
Definition: Stream.h:38
Acl::Answer result
#define MYNAME
Definition: Stream.h:219
void reset()
Definition: MemBuf.cc:129
SBuf lastAclName
string for external_acl_type ACL format code
void assemble(MemBuf &mb, const AccessLogEntryPointer &al, int logSequenceNumber) const
assemble the state information into a formatted line.
Definition: Format.cc:377
NotePairs notes
list of all kv-pairs returned by the helper
@ ACCESS_DUNNO
Definition: Acl.h:43
String extacl_message
Definition: HttpRequest.h:182
@ LFT_REPLY_HEADER_ELEM
Definition: ByteCode.h:132
unsigned int concurrency
Definition: ChildConfig.h:72
dlink_list lru_list
void parse_wordlist(wordlist **list)
Definition: cache_cf.cc:3133
const char * wordlistAdd(wordlist **list, const char *key)
Definition: wordlist.cc:25
int EnableIpv6
Whether IPv6 is supported and type of support.
Definition: tools.h:25
#define debugs(SECTION, LEVEL, CONTENT)
Definition: Stream.h:192
String tag
Definition: HttpRequest.h:174
String extacl_passwd
Definition: HttpRequest.h:178
void hash_join(hash_table *, hash_link *)
Definition: hash.cc:131
Ip::Address local_addr
CbcPointer< ConnStateData > clientConnectionManager
Definition: HttpRequest.h:230
void resumeNonBlockingCheck()
Definition: Checklist.cc:230
class SquidConfig Config
Definition: SquidConfig.cc:12
void UpdateRequestNotes(ConnStateData *csd, HttpRequest &request, NotePairs const &helperNotes)
Definition: HttpRequest.cc:757
void dump_externalAclHelper(StoreEntry *sentry, const char *name, const external_acl *list)
Quoting
Quoting style for a format output.
Definition: ByteCode.h:262
void externalAclInit(void)
SBuf name
Definition: Node.h:81
external_acl * def

 

Introduction

Documentation

Support

Miscellaneous