cache and clean the VOMS AC only once per connection

As a consequence, the VOMS AC is available during the logging operation at the end of the request and can be seen in the access log, e.g. with the following change in the configuration file:

http {
log_format storm '$time_iso8601 [$request_id] $remote_addr '
                    '- $remote_user "$request" <$upstream_response_time> '
                    '$ssl_protocol/$ssl_cipher '
                    '"$ssl_client_s_dn" '
                    '[$voms_fqans] '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';
    access_log ... storm;
    ...

In the access log one can then see, for example:

2018-06-27T13:56:19+00:00 [4cc92445bf56587e6d589fb7c697841b] 127.0.0.1 - - "GET / HTTP/1.1" <-> TLSv1.2/ECDHE-RSA-AES256-GCM-SHA384 "CN=1744748182,CN=test0,O=IGI,C=IT" [/test/exp1,/test/exp2,/test/exp3/Role=PIPPO] 200 330 "-" "curl/7.29.0" "-"

There are no tests for this change. A test can be done using, for example:

curl --cert t/certs/3.pem --capath t/trust-anchors --cacert t/certs/3.cert.pem https://nginx-voms.example:8443 https://nginx-voms.example:8443

Note that two identical URLs are requested and curl sends them within the same connection (i.e. the connection is kept alive). To verify that the VOMS AC is cached and cleaned only once per connection one can check the error log, for example:

2018/06/27 13:56:19 [debug] 9207#9207: *1 generic_getter
2018/06/27 13:56:19 [debug] 9207#9207: *1 get_voms_ac
2018/06/27 13:56:19 [debug] 9207#9207: *1 get_voms_ac_from_cache
2018/06/27 13:56:19 [debug] 9207#9207: *1 retrieve_voms_ac_from_proxy
2018/06/27 13:56:19 [debug] 9207#9207: *1 cache_voms_ac
2018/06/27 13:56:19 [debug] 9207#9207: *1 generic_getter
2018/06/27 13:56:19 [debug] 9207#9207: *1 get_voms_ac
2018/06/27 13:56:19 [debug] 9207#9207: *1 get_voms_ac_from_cache
2018/06/27 13:56:19 [debug] 9207#9207: *1 generic_getter
2018/06/27 13:56:19 [debug] 9207#9207: *1 get_voms_ac
2018/06/27 13:56:19 [debug] 9207#9207: *1 get_voms_ac_from_cache
...
2018/06/27 13:56:57 [info] 9207#9207: *2 client 127.0.0.1 closed keepalive connection
2018/06/27 13:56:57 [debug] 9207#9207: *2 clean_voms_ac

src/ngx_http_voms_module.cpp

@@ -22,6 +22,7 @@ extern "C" {
 #include <cassert>
 #include <chrono>
 #include <iostream>
+#include <map>
 #include <memory>
 #include <numeric>
 #include <string>
@@ -63,8 +64,6 @@ ngx_module_t ngx_http_voms_module = {
     NGX_MODULE_V1_PADDING  //
 };
 
-static std::unique_ptr<vomsdata> vomsdata_ptr;
-
 static ngx_int_t generic_getter(  //
     ngx_http_request_t* r,
     ngx_http_variable_value_t* v,
@@ -344,52 +343,62 @@ static MaybeVomsAc retrieve_voms_ac_from_proxy(ngx_http_request_t* r)
     return boost::none;
   }
 
-  if (!vomsdata_ptr) {
-    vomsdata_ptr.reset(new vomsdata);
-  }
-  auto ok =
-      vomsdata_ptr->Retrieve(client_cert.get(), client_chain, RECURSE_CHAIN);
+  vomsdata vd;
+
+  auto ok = vd.Retrieve(client_cert.get(), client_chain, RECURSE_CHAIN);
   if (!ok) {
-    auto msg = vomsdata_ptr->ErrorMessage().c_str();
+    auto msg = vd.ErrorMessage().c_str();
     ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "%s", msg);
     return boost::none;
   }
 
-  if (vomsdata_ptr->data.empty()) {
+  if (vd.data.empty()) {
     ngx_log_error(NGX_LOG_DEBUG, r->connection->log, 0, "no ACs in proxy");
     return boost::none;
   }
 
-  return vomsdata_ptr->data.front();
+  return vd.data.front();
 }
 
+// note that an entry in the cache is always created if within a connection a
+// request is made to one of the voms_* variables. If the presented
+// credential is a normal certificate or a proxy without attribute certificates,
+// the unique_ptr points to a MaybeVomsAc that is empty (in the sense of an
+// std::optional)
+static std::map<ngx_connection_t*, std::unique_ptr<MaybeVomsAc>> ac_cache;
+
 static void clean_voms_ac(void* data)
 {
-  auto r = static_cast<ngx_http_request_t*>(data);
-  ngx_log_error(NGX_LOG_DEBUG, r->connection->log, 0, "%s", __func__);
-
-  auto p = static_cast<MaybeVomsAc*>(
-      ngx_http_get_module_ctx(r, ngx_http_voms_module));
-  delete p;
+  auto c = static_cast<ngx_connection_t*>(data);
+  ngx_log_error(NGX_LOG_DEBUG, c->log, 0, "%s", __func__);
+  auto n = ac_cache.erase(c);
+  // we erase from the cache exactly once per connection
+  assert(n == 1);
 }
 
-static void cache_voms_ac(ngx_http_request_t* r, MaybeVomsAc* ac)
+static void cache_voms_ac(ngx_http_request_t* r,
+                          std::unique_ptr<MaybeVomsAc> acp)
 {
-  ngx_http_set_ctx(r, ac, ngx_http_voms_module);
-  auto cln = ngx_http_cleanup_add(r, 0);
+  ngx_log_error(NGX_LOG_DEBUG, r->connection->log, 0, "%s", __func__);
+  auto c = r->connection;
+  auto cln = ngx_pool_cleanup_add(c->pool, 0);
   if (cln) {
+    auto r = ac_cache.insert({c, std::move(acp)});
+    // we insert into the cache exactly once per connection
+    assert(r.second);
     cln->handler = clean_voms_ac;
-    cln->data = r;
+    cln->data = c;
   } else {
     ngx_log_error(
-        NGX_LOG_ERR, r->connection->log, 0, "ngx_http_cleanup_add() failed");
+        NGX_LOG_ERR, r->connection->log, 0, "ngx_pool_cleanup_add() failed");
   }
 }
 
 static MaybeVomsAc* get_voms_ac_from_cache(ngx_http_request_t* r)
 {
-  return static_cast<MaybeVomsAc*>(
-      ngx_http_get_module_ctx(r, ngx_http_voms_module));
+  ngx_log_error(NGX_LOG_DEBUG, r->connection->log, 0, "%s", __func__);
+  auto it = ac_cache.find(r->connection);
+  return it != ac_cache.end() ? it->second.get() : nullptr;
 }
 
 static MaybeVomsAc const& get_voms_ac(ngx_http_request_t* r)
@@ -399,8 +408,9 @@ static MaybeVomsAc const& get_voms_ac(ngx_http_request_t* r)
   MaybeVomsAc* acp = get_voms_ac_from_cache(r);
 
   if (!acp) {
-    acp = new MaybeVomsAc(retrieve_voms_ac_from_proxy(r));
-    cache_voms_ac(r, acp);
+    auto p = std::make_unique<MaybeVomsAc>(retrieve_voms_ac_from_proxy(r));
+    acp = p.get();
+    cache_voms_ac(r, std::move(p));
   }
 
   return *acp;