#include <Checklist.h>

Inheritance diagram for ACLChecklist:
Collaboration diagram for ACLChecklist:

Classes

class  AsyncState
 
class  Breadcrumb
 Position of a child node within an ACL tree. More...
 
class  NullState
 

Public Member Functions

 ACLChecklist ()
 
virtual ~ACLChecklist ()
 
void nonBlockingCheck (ACLCB *callback, void *callback_data)
 
allow_t const & fastCheck ()
 
allow_t const & fastCheck (const Acl::Tree *list)
 
bool goAsync (AsyncState *)
 
bool matchChild (const Acl::InnerNode *parent, Acl::Nodes::const_iterator pos, const ACL *child)
 
bool keepMatching () const
 Whether we should continue to match tree nodes or stop/pause. More...
 
bool finished () const
 whether markFinished() was called More...
 
bool asyncInProgress () const
 async call has been started and has not finished (or failed) yet More...
 
void markFinished (const allow_t &newAnswer, const char *reason)
 
const allow_tcurrentAnswer () const
 
bool bannedAction (const allow_t &action) const
 whether the action is banned or not More...
 
void banAction (const allow_t &action)
 add action to the list of banned actions More...
 
virtual bool hasRequest () const =0
 
virtual bool hasReply () const =0
 
virtual bool hasAle () const =0
 
virtual void syncAle () const =0
 
const Acl::TreechangeAcl (const Acl::Tree *t)
 
void resumeNonBlockingCheck (AsyncState *state)
 

Public Attributes

ACLCBcallback
 
void * callback_data
 

Private Types

enum  NodeMatchingResult {
  nmrMatch,
  nmrMismatch,
  nmrFinished,
  nmrNeedsAsync
}
 possible outcomes when trying to match a single ACL node in a list More...
 
enum  AsyncStage {
  asyncNone,
  asyncStarting,
  asyncRunning,
  asyncFailed
}
 

Private Member Functions

void checkCallback (allow_t answer)
 Calls non-blocking check callback with the answer and destroys self. More...
 
void matchAndFinish ()
 performs (or resumes) an ACL tree match and, if successful, sets the action More...
 
void changeState (AsyncState *)
 
AsyncStateasyncState () const
 
void preCheck (const char *what)
 prepare for checking ACLs; called once per check More...
 
bool prepNonBlocking ()
 common parts of nonBlockingCheck() and resumeNonBlockingCheck() More...
 
void completeNonBlocking ()
 
void calcImplicitAnswer ()
 
bool callerGone ()
 

Private Attributes

const Acl::TreeaccessList
 
bool asyncCaller_
 whether the caller supports async/slow ACLs More...
 
bool occupied_
 whether a check (fast or non-blocking) is in progress More...
 
bool finished_
 
allow_t allow_
 
AsyncStage asyncStage_
 
AsyncStatestate_
 
Breadcrumb matchLoc_
 location of the node running matches() now More...
 
Breadcrumb asyncLoc_
 currentNode_ that called goAsync() More...
 
unsigned asyncLoopDepth_
 how many times the current async state has resumed More...
 
std::stack< BreadcrumbmatchPath
 suspended (due to an async lookup) matches() in the ACL tree More...
 
std::vector< allow_tbannedActions_
 the list of actions which must ignored during acl checks More...
 

Detailed Description

Base class for maintaining Squid and transaction state for access checks. Provides basic ACL checking methods. Its only child, ACLFilledChecklist, keeps the actual state data. The split is necessary to avoid exposing all ACL-related code to virtually Squid data types.

Definition at line 24 of file Checklist.h.

Member Enumeration Documentation

Enumerator
asyncNone 
asyncStarting 
asyncRunning 
asyncFailed 

Definition at line 228 of file Checklist.h.

Enumerator
nmrMatch 
nmrMismatch 
nmrFinished 
nmrNeedsAsync 

Definition at line 214 of file Checklist.h.

Constructor & Destructor Documentation

ACLChecklist::ACLChecklist ( )

Definition at line 177 of file Checklist.cc.

ACLChecklist::~ACLChecklist ( )
virtual

Definition at line 191 of file Checklist.cc.

References assert, asyncInProgress(), changeAcl(), and debugs.

Member Function Documentation

ACLChecklist::AsyncState * ACLChecklist::asyncState ( ) const
private

Definition at line 227 of file Checklist.cc.

References state_.

Referenced by resumeNonBlockingCheck().

void ACLChecklist::banAction ( const allow_t action)
bool ACLChecklist::bannedAction ( const allow_t action) const

Definition at line 394 of file Checklist.cc.

References action(), bannedActions_, debugs, and allow_t::kind.

Referenced by Acl::Tree::bannedAction().

void ACLChecklist::calcImplicitAnswer ( )
private

When no rules matched, the answer is the inversion of the last rule action (or ACCESS_DUNNO if the reversal is not possible).

Definition at line 371 of file Checklist.cc.

References ACCESS_ALLOWED, ACCESS_DENIED, ACCESS_DUNNO, accessList, cbdataReferenceValid(), debugs, HERE(), Acl::Tree::lastAction(), and markFinished().

Referenced by completeNonBlocking(), and fastCheck().

bool ACLChecklist::callerGone ( )
private

Definition at line 388 of file Checklist.cc.

References callback_data, and cbdataReferenceValid().

Referenced by prepNonBlocking().

const Acl::Tree* ACLChecklist::changeAcl ( const Acl::Tree t)
inline

change the current ACL list

Returns
a pointer to the old list value (may be nullptr)

Definition at line 171 of file Checklist.h.

References accessList, cbdataReference, and cbdataReferenceDone.

Referenced by ACLFilledChecklist::ACLFilledChecklist(), fastCheck(), ConnStateData::whenClientIpKnown(), and ~ACLChecklist().

void ACLChecklist::changeState ( AsyncState newState)
private

Definition at line 215 of file Checklist.cc.

References assert, ACLChecklist::NullState::Instance(), and state_.

Referenced by goAsync(), and resumeNonBlockingCheck().

void ACLChecklist::checkCallback ( allow_t  answer)
private
void ACLChecklist::completeNonBlocking ( )
private
const allow_t& ACLChecklist::currentAnswer ( ) const
inline

Definition at line 154 of file Checklist.h.

References allow_.

Referenced by completeNonBlocking(), and fastCheck().

allow_t const & ACLChecklist::fastCheck ( )

Perform a blocking (immediate) check for a list of allow/deny rules. Each rule comes with a list of ACLs.

The first rule where all ACLs match wins. If there is such a rule, the result becomes that rule keyword (ACCESS_ALLOWED or ACCESS_DENIED).

If there are rules but all ACL lists mismatch, an implicit rule is used Its result is the negation of the keyword of the last seen rule.

Some ACLs may stop the check prematurely by setting an exceptional check result (e.g., ACCESS_AUTH_REQUIRED) instead of declaring a match or mismatch.

Some ACLs may require an async lookup which is prohibited by this method. In this case, the exceptional check result of ACCESS_DUNNO is immediately returned.

If there are no rules to check at all, the result becomes ACCESS_DUNNO.

Definition at line 336 of file Checklist.cc.

References accessList, asyncCaller_, calcImplicitAnswer(), cbdataReference, cbdataReferenceDone, cbdataReferenceValid(), currentAnswer(), debugs, finished(), matchAndFinish(), NULL, occupied_, preCheck(), PROF_start, and PROF_stop.

Referenced by accessLogLogTo(), aclMapNfmark(), aclMapTOS(), Client::blockCaching(), clientReplyContext::blockedHit(), HttpReply::calcMaxBodySize(), Adaptation::Icap::Launcher::canRepeat(), DelayId::DelayClient(), HttpStateData::finishingBrokenPost(), getOutgoingAddress(), HttpRequest::getRangeOffsetLimit(), HttpStateData::handle1xx(), Ftp::Server::handleUploadRequest(), httpHdrAdd(), httpHdrMangle(), icpAccessAllowed(), ClientHttpRequest::logRequest(), HttpRequest::manager(), Note::match(), FwdState::pconnPop(), peerAllowedToUse(), ConnStateData::proxyProtocolValidateClient(), schemesConfig(), Ftp::Client::sendPassive(), Http::Stream::sendStartOfMessage(), ConnStateData::serveDelayedError(), snmpDecodePacket(), ssl_verify_cb(), Security::PeerConnector::sslCrtvdCheckForErrors(), FwdState::Start(), tunnelStart(), and ConnStateData::whenClientIpKnown().

allow_t const & ACLChecklist::fastCheck ( const Acl::Tree list)

Perform a blocking (immediate) check whether a list of ACLs matches. This method is meant to be used with squid.conf ACL-driven options that lack allow/deny keywords and are tested one ACL list at a time. Whether the checks for other occurrences of the same option continue after this call is up to the caller and option semantics.

If all ACLs match, the result becomes ACCESS_ALLOWED.

If all ACLs mismatch, the result becomes ACCESS_DENIED.

Some ACLs may stop the check prematurely by setting an exceptional check result (e.g., ACCESS_AUTH_REQUIRED) instead of declaring a match or mismatch.

Some ACLs may require an async lookup which is prohibited by this method. In this case, the exceptional check result of ACCESS_DUNNO is immediately returned.

If there are no ACLs to check at all, the result becomes ACCESS_ALLOWED.

Definition at line 308 of file Checklist.cc.

References ACCESS_DENIED, accessList, asyncCaller_, cbdataReferenceValid(), changeAcl(), currentAnswer(), finished(), markFinished(), matchAndFinish(), occupied_, preCheck(), PROF_start, and PROF_stop.

virtual bool ACLChecklist::hasAle ( ) const
pure virtual
virtual bool ACLChecklist::hasReply ( ) const
pure virtual
virtual bool ACLChecklist::hasRequest ( ) const
pure virtual
bool ACLChecklist::keepMatching ( ) const
inline
void ACLChecklist::markFinished ( const allow_t newAnswer,
const char *  reason 
)

called when no more ACLs should be checked; sets the final answer and prints a debugging message explaining the reason for that answer

Definition at line 58 of file Checklist.cc.

References allow_, assert, asyncInProgress(), debugs, finished(), finished_, and HERE().

Referenced by calcImplicitAnswer(), fastCheck(), ACLMaxUserIP::match(), ACLProxyAuth::match(), ACLIdent::match(), ACLExternal::match(), and matchAndFinish().

void ACLChecklist::matchAndFinish ( )
private
bool ACLChecklist::matchChild ( const Acl::InnerNode parent,
Acl::Nodes::const_iterator  pos,
const ACL child 
)

Matches (or resumes matching of) a child node while maintaning resumption breadcrumbs if a [grand]child node goes async.

Definition at line 82 of file Checklist.cc.

References assert, asyncInProgress(), asyncLoc_, asyncLoopDepth_, ACLChecklist::Breadcrumb::clear(), ACL::matches(), matchLoc_, and matchPath.

Referenced by Acl::AllOf::doMatch(), Acl::NotNode::doMatch(), Acl::AndNode::doMatch(), and Acl::OrNode::doMatch().

void ACLChecklist::nonBlockingCheck ( ACLCB callback_,
void *  callback_data_ 
)

Start a non-blocking (async) check for a list of allow/deny rules. Each rule comes with a list of ACLs.

The callback specified will be called with the result of the check.

The first rule where all ACLs match wins. If there is such a rule, the result becomes that rule keyword (ACCESS_ALLOWED or ACCESS_DENIED).

If there are rules but all ACL lists mismatch, an implicit rule is used. Its result is the negation of the keyword of the last seen rule.

Some ACLs may stop the check prematurely by setting an exceptional check result (e.g., ACCESS_AUTH_REQUIRED) instead of declaring a match or mismatch.

If there are no rules to check at all, the result becomes ACCESS_DUNNO. Calling this method with no rules to check wastes a lot of CPU cycles and will result in a DBG_CRITICAL debugging message.

Kick off a non-blocking (slow) ACL access list test

NP: this should probably be made Async now.

The ACL List should NEVER be NULL when calling this method. Always caller should check for NULL and handle appropriate to its needs first. We cannot select a sensible default for all callers here.

Definition at line 238 of file Checklist.cc.

References ACCESS_DUNNO, accessList, asyncCaller_, asyncInProgress(), callback, callback_data, cbdataReference, checkCallback(), completeNonBlocking(), DBG_CRITICAL, debugs, matchAndFinish(), NULL, preCheck(), and prepNonBlocking().

Referenced by Ssl::PeekingPeerConnector::checkForPeekAndSplice(), ClientRequestContext::checkNoCache(), ClientRequestContext::clientAccessCheck(), ClientRequestContext::clientAccessCheck2(), clientFollowXForwardedForCheck(), ClientRequestContext::clientRedirectStart(), ClientRequestContext::clientStoreIdStart(), peerSelectFoo(), ConnStateData::postHttpsAccept(), clientReplyContext::processReplyAccess(), ClientRequestContext::sslBumpAccessCheck(), and ConnStateData::startPeekAndSplice().

void ACLChecklist::preCheck ( const char *  what)
private

Called first (and once) by all checks to initialize their state.

Definition at line 68 of file Checklist.cc.

References AclMatchedName, assert, asyncLoopDepth_, debugs, finished_, HERE(), NULL, and occupied_.

Referenced by fastCheck(), and nonBlockingCheck().

bool ACLChecklist::prepNonBlocking ( )
private
If the accessList is no longer valid (i.e. its been freed because of a reconfigure), then bail with ACCESS_DUNNO.

Definition at line 21 of file Checklist.cc.

References ACCESS_DUNNO, accessList, assert, callerGone(), cbdataReferenceDone, cbdataReferenceValid(), checkCallback(), and debugs.

Referenced by nonBlockingCheck(), and resumeNonBlockingCheck().

virtual void ACLChecklist::syncAle ( ) const
pure virtual

Implemented in ACLFilledChecklist.

Referenced by ACL::matches().

Member Data Documentation

const Acl::Tree* ACLChecklist::accessList
private
allow_t ACLChecklist::allow_
private

Definition at line 226 of file Checklist.h.

Referenced by currentAnswer(), and markFinished().

bool ACLChecklist::asyncCaller_
private

Definition at line 223 of file Checklist.h.

Referenced by fastCheck(), goAsync(), and nonBlockingCheck().

Breadcrumb ACLChecklist::asyncLoc_
private

Definition at line 232 of file Checklist.h.

Referenced by goAsync(), and matchChild().

unsigned ACLChecklist::asyncLoopDepth_
private

Definition at line 233 of file Checklist.h.

Referenced by goAsync(), matchChild(), and preCheck().

AsyncStage ACLChecklist::asyncStage_
private

Definition at line 229 of file Checklist.h.

Referenced by asyncInProgress(), goAsync(), and resumeNonBlockingCheck().

std::vector<allow_t> ACLChecklist::bannedActions_
private

Definition at line 240 of file Checklist.h.

Referenced by banAction(), and bannedAction().

ACLCB* ACLChecklist::callback

Definition at line 192 of file Checklist.h.

Referenced by checkCallback(), and nonBlockingCheck().

void* ACLChecklist::callback_data

Definition at line 193 of file Checklist.h.

Referenced by callerGone(), checkCallback(), and nonBlockingCheck().

bool ACLChecklist::finished_
private

Definition at line 225 of file Checklist.h.

Referenced by finished(), markFinished(), and preCheck().

Breadcrumb ACLChecklist::matchLoc_
private

Definition at line 231 of file Checklist.h.

Referenced by goAsync(), and matchChild().

std::stack<Breadcrumb> ACLChecklist::matchPath
private

Definition at line 238 of file Checklist.h.

Referenced by matchAndFinish(), matchChild(), and resumeNonBlockingCheck().

bool ACLChecklist::occupied_
private

Definition at line 224 of file Checklist.h.

Referenced by checkCallback(), fastCheck(), and preCheck().

AsyncState* ACLChecklist::state_
private

Definition at line 230 of file Checklist.h.

Referenced by asyncState(), and changeState().


The documentation for this class was generated from the following files:

 

Introduction

Documentation

Support

Miscellaneous

Web Site Translations

Mirrors