Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1 | /* |
| 2 | * ACL management functions. |
| 3 | * |
Willy Tarreau | d4c33c8 | 2013-01-07 21:59:07 +0100 | [diff] [blame] | 4 | * Copyright 2000-2013 Willy Tarreau <w@1wt.eu> |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 5 | * |
| 6 | * This program is free software; you can redistribute it and/or |
| 7 | * modify it under the terms of the GNU General Public License |
| 8 | * as published by the Free Software Foundation; either version |
| 9 | * 2 of the License, or (at your option) any later version. |
| 10 | * |
| 11 | */ |
| 12 | |
Willy Tarreau | ae8b796 | 2007-06-09 23:10:04 +0200 | [diff] [blame] | 13 | #include <ctype.h> |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 14 | #include <stdio.h> |
| 15 | #include <string.h> |
| 16 | |
| 17 | #include <common/config.h> |
| 18 | #include <common/mini-clist.h> |
| 19 | #include <common/standard.h> |
Krzysztof Piotr Oledzki | 8c8bd45 | 2010-01-29 19:29:32 +0100 | [diff] [blame] | 20 | #include <common/uri_auth.h> |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 21 | |
Willy Tarreau | 2b5285d | 2010-05-09 23:45:24 +0200 | [diff] [blame] | 22 | #include <types/global.h> |
| 23 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 24 | #include <proto/acl.h> |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 25 | #include <proto/arg.h> |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 26 | #include <proto/auth.h> |
Willy Tarreau | c7e4238 | 2012-08-24 19:22:53 +0200 | [diff] [blame] | 27 | #include <proto/channel.h> |
Willy Tarreau | 404e8ab | 2009-07-26 19:40:40 +0200 | [diff] [blame] | 28 | #include <proto/log.h> |
Thierry FOURNIER | ed66c29 | 2013-11-28 11:05:19 +0100 | [diff] [blame] | 29 | #include <proto/pattern.h> |
Willy Tarreau | 0b1cd94 | 2010-05-16 22:18:27 +0200 | [diff] [blame] | 30 | #include <proto/proxy.h> |
Willy Tarreau | 8ed669b | 2013-01-11 15:49:37 +0100 | [diff] [blame] | 31 | #include <proto/sample.h> |
Willy Tarreau | d28c353 | 2012-04-19 19:28:33 +0200 | [diff] [blame] | 32 | #include <proto/stick_table.h> |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 33 | |
Willy Tarreau | c426296 | 2010-05-10 23:42:40 +0200 | [diff] [blame] | 34 | #include <ebsttree.h> |
| 35 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 36 | /* List head of all known ACL keywords */ |
| 37 | static struct acl_kw_list acl_keywords = { |
| 38 | .list = LIST_HEAD_INIT(acl_keywords.list) |
| 39 | }; |
| 40 | |
Willy Tarreau | 0cba607 | 2013-11-28 22:21:02 +0100 | [diff] [blame] | 41 | /* input values are 0 or 3, output is the same */ |
| 42 | static inline enum acl_test_res pat2acl(enum pat_match_res res) |
| 43 | { |
| 44 | return (enum acl_test_res)res; |
| 45 | } |
| 46 | |
Willy Tarreau | a590983 | 2007-06-17 20:40:25 +0200 | [diff] [blame] | 47 | /* |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 48 | * Registers the ACL keyword list <kwl> as a list of valid keywords for next |
| 49 | * parsing sessions. |
| 50 | */ |
| 51 | void acl_register_keywords(struct acl_kw_list *kwl) |
| 52 | { |
| 53 | LIST_ADDQ(&acl_keywords.list, &kwl->list); |
| 54 | } |
| 55 | |
| 56 | /* |
| 57 | * Unregisters the ACL keyword list <kwl> from the list of valid keywords. |
| 58 | */ |
| 59 | void acl_unregister_keywords(struct acl_kw_list *kwl) |
| 60 | { |
| 61 | LIST_DEL(&kwl->list); |
| 62 | LIST_INIT(&kwl->list); |
| 63 | } |
| 64 | |
| 65 | /* Return a pointer to the ACL <name> within the list starting at <head>, or |
| 66 | * NULL if not found. |
| 67 | */ |
| 68 | struct acl *find_acl_by_name(const char *name, struct list *head) |
| 69 | { |
| 70 | struct acl *acl; |
| 71 | list_for_each_entry(acl, head, list) { |
| 72 | if (strcmp(acl->name, name) == 0) |
| 73 | return acl; |
| 74 | } |
| 75 | return NULL; |
| 76 | } |
| 77 | |
| 78 | /* Return a pointer to the ACL keyword <kw>, or NULL if not found. Note that if |
| 79 | * <kw> contains an opening parenthesis, only the left part of it is checked. |
| 80 | */ |
| 81 | struct acl_keyword *find_acl_kw(const char *kw) |
| 82 | { |
| 83 | int index; |
| 84 | const char *kwend; |
| 85 | struct acl_kw_list *kwl; |
| 86 | |
| 87 | kwend = strchr(kw, '('); |
| 88 | if (!kwend) |
| 89 | kwend = kw + strlen(kw); |
| 90 | |
| 91 | list_for_each_entry(kwl, &acl_keywords.list, list) { |
| 92 | for (index = 0; kwl->kw[index].kw != NULL; index++) { |
| 93 | if ((strncmp(kwl->kw[index].kw, kw, kwend - kw) == 0) && |
| 94 | kwl->kw[index].kw[kwend-kw] == 0) |
| 95 | return &kwl->kw[index]; |
| 96 | } |
| 97 | } |
| 98 | return NULL; |
| 99 | } |
| 100 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 101 | static struct acl_expr *prune_acl_expr(struct acl_expr *expr) |
| 102 | { |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 103 | struct arg *arg; |
| 104 | |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 105 | pattern_prune_expr(&expr->pat); |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 106 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 107 | for (arg = expr->smp->arg_p; arg; arg++) { |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 108 | if (arg->type == ARGT_STOP) |
| 109 | break; |
Willy Tarreau | 496aa01 | 2012-06-01 10:38:29 +0200 | [diff] [blame] | 110 | if (arg->type == ARGT_STR || arg->unresolved) { |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 111 | free(arg->data.str.str); |
| 112 | arg->data.str.str = NULL; |
Willy Tarreau | 496aa01 | 2012-06-01 10:38:29 +0200 | [diff] [blame] | 113 | arg->unresolved = 0; |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 114 | } |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 115 | } |
| 116 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 117 | if (expr->smp->arg_p != empty_arg_list) |
| 118 | free(expr->smp->arg_p); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 119 | return expr; |
| 120 | } |
| 121 | |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 122 | /* Parse an ACL expression starting at <args>[0], and return it. If <err> is |
| 123 | * not NULL, it will be filled with a pointer to an error message in case of |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 124 | * error. This pointer must be freeable or NULL. <al> is an arg_list serving |
| 125 | * as a list head to report missing dependencies. |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 126 | * |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 127 | * Right now, the only accepted syntax is : |
| 128 | * <subject> [<value>...] |
| 129 | */ |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 130 | struct acl_expr *parse_acl_expr(const char **args, char **err, struct arg_list *al) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 131 | { |
| 132 | __label__ out_return, out_free_expr, out_free_pattern; |
| 133 | struct acl_expr *expr; |
| 134 | struct acl_keyword *aclkw; |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 135 | struct pattern *pattern; |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 136 | int opaque, patflags; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 137 | const char *arg; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 138 | struct sample_expr *smp = NULL; |
| 139 | const char *p; |
| 140 | int idx = 0; |
| 141 | char *ckw = NULL; |
| 142 | const char *begw; |
| 143 | const char *endw; |
| 144 | unsigned long prev_type; |
| 145 | int cur_type; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 146 | |
Willy Tarreau | bef91e7 | 2013-03-31 23:14:46 +0200 | [diff] [blame] | 147 | /* First, we lookd for an ACL keyword. And if we don't find one, then |
| 148 | * we look for a sample fetch keyword. |
| 149 | */ |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 150 | aclkw = find_acl_kw(args[0]); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 151 | if (!aclkw || !aclkw->parse) { |
Willy Tarreau | bef91e7 | 2013-03-31 23:14:46 +0200 | [diff] [blame] | 152 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 153 | smp = sample_parse_expr((char **)args, &idx, trash.str, trash.size, al); |
Willy Tarreau | bef91e7 | 2013-03-31 23:14:46 +0200 | [diff] [blame] | 154 | |
| 155 | if (!smp) { |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 156 | memprintf(err, "unknown ACL or sample keyword '%s': %s", *args, trash.str); |
Willy Tarreau | bef91e7 | 2013-03-31 23:14:46 +0200 | [diff] [blame] | 157 | goto out_return; |
| 158 | } |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 159 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 160 | |
| 161 | expr = (struct acl_expr *)calloc(1, sizeof(*expr)); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 162 | if (!expr) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 163 | memprintf(err, "out of memory when parsing ACL expression"); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 164 | goto out_return; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 165 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 166 | |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 167 | pattern_init_expr(&expr->pat); |
Thierry FOURNIER | d163e1c | 2013-11-28 11:41:23 +0100 | [diff] [blame] | 168 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 169 | expr->kw = aclkw ? aclkw->kw : smp->fetch->kw; |
Thierry FOURNIER | d163e1c | 2013-11-28 11:41:23 +0100 | [diff] [blame] | 170 | expr->pat.parse = aclkw ? aclkw->parse : NULL; |
| 171 | expr->pat.match = aclkw ? aclkw->match : NULL; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 172 | expr->smp = aclkw ? NULL : smp; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 173 | |
Thierry FOURNIER | d163e1c | 2013-11-28 11:41:23 +0100 | [diff] [blame] | 174 | if (!expr->pat.parse) { |
Willy Tarreau | 9987ea9 | 2013-06-11 21:09:06 +0200 | [diff] [blame] | 175 | /* some types can be automatically converted */ |
| 176 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 177 | switch (expr->smp ? expr->smp->fetch->out_type : aclkw->smp->out_type) { |
Willy Tarreau | 9987ea9 | 2013-06-11 21:09:06 +0200 | [diff] [blame] | 178 | case SMP_T_BOOL: |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 179 | expr->pat.parse = pat_parse_fcts[PAT_MATCH_BOOL]; |
| 180 | expr->pat.match = pat_match_fcts[PAT_MATCH_BOOL]; |
Willy Tarreau | 9987ea9 | 2013-06-11 21:09:06 +0200 | [diff] [blame] | 181 | break; |
| 182 | case SMP_T_SINT: |
| 183 | case SMP_T_UINT: |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 184 | expr->pat.parse = pat_parse_fcts[PAT_MATCH_INT]; |
| 185 | expr->pat.match = pat_match_fcts[PAT_MATCH_INT]; |
Willy Tarreau | 9987ea9 | 2013-06-11 21:09:06 +0200 | [diff] [blame] | 186 | break; |
| 187 | case SMP_T_IPV4: |
| 188 | case SMP_T_IPV6: |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 189 | expr->pat.parse = pat_parse_fcts[PAT_MATCH_IP]; |
| 190 | expr->pat.match = pat_match_fcts[PAT_MATCH_IP]; |
Willy Tarreau | 9987ea9 | 2013-06-11 21:09:06 +0200 | [diff] [blame] | 191 | break; |
| 192 | } |
| 193 | } |
| 194 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 195 | /* now parse the rest of acl only if "find_acl_kw" match */ |
| 196 | if (aclkw) { |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 197 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 198 | /* build new sample expression */ |
| 199 | expr->smp = calloc(1, sizeof(struct sample_expr)); |
| 200 | if (!expr->smp) { |
| 201 | memprintf(err, "out of memory when parsing ACL expression"); |
| 202 | goto out_return; |
| 203 | } |
| 204 | LIST_INIT(&(expr->smp->conv_exprs)); |
| 205 | expr->smp->fetch = aclkw->smp; |
| 206 | expr->smp->arg_p = empty_arg_list; |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 207 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 208 | /* look for the begining of the subject arguments */ |
| 209 | p = strchr(args[0], ','); |
| 210 | arg = strchr(args[0], '('); |
| 211 | if (p && arg && p < arg) |
| 212 | arg = NULL; |
| 213 | |
| 214 | if (expr->smp->fetch->arg_mask) { |
| 215 | int nbargs = 0; |
| 216 | char *end; |
| 217 | |
| 218 | if (arg != NULL) { |
| 219 | /* there are 0 or more arguments in the form "subject(arg[,arg]*)" */ |
| 220 | arg++; |
| 221 | end = strchr(arg, ')'); |
| 222 | if (!end) { |
| 223 | memprintf(err, "missing closing ')' after arguments to ACL keyword '%s'", expr->kw); |
| 224 | goto out_free_expr; |
| 225 | } |
| 226 | |
| 227 | /* Parse the arguments. Note that currently we have no way to |
| 228 | * report parsing errors, hence the NULL in the error pointers. |
| 229 | * An error is also reported if some mandatory arguments are |
| 230 | * missing. We prepare the args list to report unresolved |
| 231 | * dependencies. |
| 232 | */ |
| 233 | al->ctx = ARGC_ACL; |
| 234 | al->kw = expr->kw; |
| 235 | al->conv = NULL; |
| 236 | nbargs = make_arg_list(arg, end - arg, expr->smp->fetch->arg_mask, &expr->smp->arg_p, |
| 237 | err, NULL, NULL, al); |
| 238 | if (nbargs < 0) { |
| 239 | /* note that make_arg_list will have set <err> here */ |
| 240 | memprintf(err, "in argument to '%s', %s", expr->kw, *err); |
| 241 | goto out_free_expr; |
| 242 | } |
| 243 | |
| 244 | if (!expr->smp->arg_p) |
| 245 | expr->smp->arg_p = empty_arg_list; |
| 246 | |
| 247 | if (expr->smp->fetch->val_args && !expr->smp->fetch->val_args(expr->smp->arg_p, err)) { |
| 248 | /* invalid keyword argument, error must have been |
| 249 | * set by val_args(). |
| 250 | */ |
| 251 | memprintf(err, "in argument to '%s', %s", expr->kw, *err); |
| 252 | goto out_free_expr; |
| 253 | } |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 254 | } |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 255 | else if (ARGM(expr->smp->fetch->arg_mask) == 1) { |
| 256 | int type = (expr->smp->fetch->arg_mask >> 4) & 15; |
Willy Tarreau | ae52f06 | 2012-04-26 12:13:35 +0200 | [diff] [blame] | 257 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 258 | /* If a proxy is noted as a mandatory argument, we'll fake |
| 259 | * an empty one so that acl_find_targets() resolves it as |
| 260 | * the current one later. |
| 261 | */ |
| 262 | if (type != ARGT_FE && type != ARGT_BE && type != ARGT_TAB) { |
| 263 | memprintf(err, "ACL keyword '%s' expects %d arguments", expr->kw, ARGM(expr->smp->fetch->arg_mask)); |
| 264 | goto out_free_expr; |
| 265 | } |
Willy Tarreau | 2e845be | 2012-10-19 19:49:09 +0200 | [diff] [blame] | 266 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 267 | /* Build an arg list containing the type as an empty string |
| 268 | * and the usual STOP. |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 269 | */ |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 270 | expr->smp->arg_p = calloc(2, sizeof(*expr->smp->arg_p)); |
| 271 | expr->smp->arg_p[0].type = type; |
| 272 | expr->smp->arg_p[0].unresolved = 1; |
| 273 | expr->smp->arg_p[0].data.str.str = strdup(""); |
| 274 | expr->smp->arg_p[0].data.str.size = 1; |
| 275 | expr->smp->arg_p[0].data.str.len = 0; |
| 276 | |
| 277 | al->ctx = ARGC_ACL; |
| 278 | al->kw = expr->kw; |
| 279 | al->conv = NULL; |
| 280 | arg_list_add(al, &expr->smp->arg_p[0], 0); |
| 281 | |
| 282 | expr->smp->arg_p[1].type = ARGT_STOP; |
| 283 | } |
| 284 | else if (ARGM(expr->smp->fetch->arg_mask)) { |
| 285 | /* there were some mandatory arguments */ |
| 286 | memprintf(err, "ACL keyword '%s' expects %d arguments", expr->kw, ARGM(expr->smp->fetch->arg_mask)); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 287 | goto out_free_expr; |
| 288 | } |
Willy Tarreau | 61612d4 | 2012-04-19 18:42:05 +0200 | [diff] [blame] | 289 | } |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 290 | else { |
| 291 | if (arg ) { |
| 292 | /* no argument expected */ |
| 293 | memprintf(err, "ACL keyword '%s' takes no argument", expr->kw); |
Willy Tarreau | fc2c1fd | 2012-04-19 23:35:54 +0200 | [diff] [blame] | 294 | goto out_free_expr; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 295 | } |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 296 | } |
Willy Tarreau | 9ca6936 | 2013-10-22 19:10:06 +0200 | [diff] [blame] | 297 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 298 | /* Now process the converters if any. We have two supported syntaxes |
| 299 | * for the converters, which can be combined : |
| 300 | * - comma-delimited list of converters just after the keyword and args ; |
| 301 | * - one converter per keyword |
| 302 | * The combination allows to have each keyword being a comma-delimited |
| 303 | * series of converters. |
| 304 | * |
| 305 | * We want to process the former first, then the latter. For this we start |
| 306 | * from the beginning of the supposed place in the exiting conv chain, which |
| 307 | * starts at the last comma (endt). |
| 308 | */ |
Willy Tarreau | f75d008 | 2013-04-07 21:20:44 +0200 | [diff] [blame] | 309 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 310 | /* look for the begining of the converters list */ |
| 311 | arg = strchr(args[0], ','); |
Willy Tarreau | 61612d4 | 2012-04-19 18:42:05 +0200 | [diff] [blame] | 312 | if (arg) { |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 313 | prev_type = expr->smp->fetch->out_type; |
| 314 | while (1) { |
| 315 | struct sample_conv *conv; |
| 316 | struct sample_conv_expr *conv_expr; |
| 317 | |
| 318 | if (*arg == ')') /* skip last closing parenthesis */ |
| 319 | arg++; |
| 320 | |
| 321 | if (*arg && *arg != ',') { |
| 322 | if (ckw) |
| 323 | memprintf(err, "ACL keyword '%s' : missing comma after conv keyword '%s'.", |
| 324 | expr->kw, ckw); |
| 325 | else |
| 326 | memprintf(err, "ACL keyword '%s' : missing comma after fetch keyword.", |
| 327 | expr->kw); |
| 328 | goto out_free_expr; |
| 329 | } |
| 330 | |
| 331 | while (*arg == ',') /* then trailing commas */ |
| 332 | arg++; |
| 333 | |
| 334 | begw = arg; /* start of conv keyword */ |
| 335 | |
| 336 | if (!*begw) |
| 337 | /* none ? end of converters */ |
| 338 | break; |
| 339 | |
| 340 | for (endw = begw; *endw && *endw != '(' && *endw != ','; endw++); |
| 341 | |
| 342 | free(ckw); |
| 343 | ckw = my_strndup(begw, endw - begw); |
| 344 | |
| 345 | conv = find_sample_conv(begw, endw - begw); |
| 346 | if (!conv) { |
| 347 | /* Unknown converter method */ |
| 348 | memprintf(err, "ACL keyword '%s' : unknown conv method '%s'.", |
| 349 | expr->kw, ckw); |
| 350 | goto out_free_expr; |
| 351 | } |
| 352 | |
| 353 | arg = endw; |
| 354 | if (*arg == '(') { |
| 355 | /* look for the end of this term */ |
| 356 | while (*arg && *arg != ')') |
| 357 | arg++; |
| 358 | if (*arg != ')') { |
| 359 | memprintf(err, "ACL keyword '%s' : syntax error: missing ')' after conv keyword '%s'.", |
| 360 | expr->kw, ckw); |
| 361 | goto out_free_expr; |
| 362 | } |
| 363 | } |
| 364 | |
| 365 | if (conv->in_type >= SMP_TYPES || conv->out_type >= SMP_TYPES) { |
| 366 | memprintf(err, "ACL keyword '%s' : returns type of conv method '%s' is unknown.", |
| 367 | expr->kw, ckw); |
| 368 | goto out_free_expr; |
| 369 | } |
| 370 | |
| 371 | /* If impossible type conversion */ |
| 372 | if (!sample_casts[prev_type][conv->in_type]) { |
| 373 | memprintf(err, "ACL keyword '%s' : conv method '%s' cannot be applied.", |
| 374 | expr->kw, ckw); |
| 375 | goto out_free_expr; |
| 376 | } |
| 377 | |
| 378 | prev_type = conv->out_type; |
| 379 | conv_expr = calloc(1, sizeof(struct sample_conv_expr)); |
| 380 | if (!conv_expr) |
| 381 | goto out_free_expr; |
| 382 | |
| 383 | LIST_ADDQ(&(expr->smp->conv_exprs), &(conv_expr->list)); |
| 384 | conv_expr->conv = conv; |
| 385 | |
| 386 | if (arg != endw) { |
| 387 | char *err_msg = NULL; |
| 388 | int err_arg; |
| 389 | |
| 390 | if (!conv->arg_mask) { |
| 391 | memprintf(err, "ACL keyword '%s' : conv method '%s' does not support any args.", |
| 392 | expr->kw, ckw); |
| 393 | goto out_free_expr; |
| 394 | } |
| 395 | |
| 396 | al->kw = expr->smp->fetch->kw; |
| 397 | al->conv = conv_expr->conv->kw; |
| 398 | if (make_arg_list(endw + 1, arg - endw - 1, conv->arg_mask, &conv_expr->arg_p, &err_msg, NULL, &err_arg, al) < 0) { |
| 399 | memprintf(err, "ACL keyword '%s' : invalid arg %d in conv method '%s' : %s.", |
| 400 | expr->kw, err_arg+1, ckw, err_msg); |
| 401 | free(err_msg); |
| 402 | goto out_free_expr; |
| 403 | } |
| 404 | |
| 405 | if (!conv_expr->arg_p) |
| 406 | conv_expr->arg_p = empty_arg_list; |
| 407 | |
Thierry FOURNIER | 9c1d67e | 2013-11-21 13:37:41 +0100 | [diff] [blame] | 408 | if (conv->val_args && !conv->val_args(conv_expr->arg_p, conv, &err_msg)) { |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 409 | memprintf(err, "ACL keyword '%s' : invalid args in conv method '%s' : %s.", |
| 410 | expr->kw, ckw, err_msg); |
| 411 | free(err_msg); |
| 412 | goto out_free_expr; |
| 413 | } |
| 414 | } |
| 415 | else if (ARGM(conv->arg_mask)) { |
| 416 | memprintf(err, "ACL keyword '%s' : missing args for conv method '%s'.", |
| 417 | expr->kw, ckw); |
| 418 | goto out_free_expr; |
| 419 | } |
| 420 | } |
Willy Tarreau | 61612d4 | 2012-04-19 18:42:05 +0200 | [diff] [blame] | 421 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 422 | } |
| 423 | |
Willy Tarreau | 3c3dfd5 | 2013-11-04 18:09:12 +0100 | [diff] [blame] | 424 | /* Additional check to protect against common mistakes */ |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 425 | cur_type = smp_expr_output_type(expr->smp); |
Thierry FOURNIER | d163e1c | 2013-11-28 11:41:23 +0100 | [diff] [blame] | 426 | if (expr->pat.parse && cur_type != SMP_T_BOOL && !*args[1]) { |
Willy Tarreau | 3c3dfd5 | 2013-11-04 18:09:12 +0100 | [diff] [blame] | 427 | Warning("parsing acl keyword '%s' :\n" |
| 428 | " no pattern to match against were provided, so this ACL will never match.\n" |
| 429 | " If this is what you intended, please add '--' to get rid of this warning.\n" |
| 430 | " If you intended to match only for existence, please use '-m found'.\n" |
| 431 | " If you wanted to force an int to match as a bool, please use '-m bool'.\n" |
| 432 | "\n", |
| 433 | args[0]); |
| 434 | } |
| 435 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 436 | args++; |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 437 | |
| 438 | /* check for options before patterns. Supported options are : |
| 439 | * -i : ignore case for all patterns by default |
| 440 | * -f : read patterns from those files |
Willy Tarreau | 5adeda1 | 2013-03-31 22:13:34 +0200 | [diff] [blame] | 441 | * -m : force matching method (must be used before -f) |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 442 | * -- : everything after this is not an option |
| 443 | */ |
| 444 | patflags = 0; |
| 445 | while (**args == '-') { |
| 446 | if ((*args)[1] == 'i') |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 447 | patflags |= PAT_F_IGNORE_CASE; |
Willy Tarreau | 2b5285d | 2010-05-09 23:45:24 +0200 | [diff] [blame] | 448 | else if ((*args)[1] == 'f') { |
Thierry FOURNIER | d163e1c | 2013-11-28 11:41:23 +0100 | [diff] [blame] | 449 | if (!expr->pat.parse) { |
Willy Tarreau | 9987ea9 | 2013-06-11 21:09:06 +0200 | [diff] [blame] | 450 | memprintf(err, "matching method must be specified first (using '-m') when using a sample fetch of this type ('%s')", expr->kw); |
Willy Tarreau | bef91e7 | 2013-03-31 23:14:46 +0200 | [diff] [blame] | 451 | goto out_free_expr; |
| 452 | } |
| 453 | |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 454 | if (!pattern_read_from_file(&expr->pat, args[1], patflags | PAT_F_FROM_FILE, err)) |
Willy Tarreau | 2b5285d | 2010-05-09 23:45:24 +0200 | [diff] [blame] | 455 | goto out_free_expr; |
Willy Tarreau | 5adeda1 | 2013-03-31 22:13:34 +0200 | [diff] [blame] | 456 | args++; |
| 457 | } |
| 458 | else if ((*args)[1] == 'm') { |
| 459 | int idx; |
| 460 | |
Thierry FOURNIER | d163e1c | 2013-11-28 11:41:23 +0100 | [diff] [blame] | 461 | if (!LIST_ISEMPTY(&expr->pat.patterns) || !eb_is_empty(&expr->pat.pattern_tree)) { |
Willy Tarreau | 5adeda1 | 2013-03-31 22:13:34 +0200 | [diff] [blame] | 462 | memprintf(err, "'-m' must only be specified before patterns and files in parsing ACL expression"); |
| 463 | goto out_free_expr; |
| 464 | } |
| 465 | |
Willy Tarreau | 6f8fe31 | 2013-11-28 22:24:25 +0100 | [diff] [blame] | 466 | idx = pat_find_match_name(args[1]); |
Willy Tarreau | 5adeda1 | 2013-03-31 22:13:34 +0200 | [diff] [blame] | 467 | if (idx < 0) { |
| 468 | memprintf(err, "unknown matching method '%s' when parsing ACL expression", args[1]); |
| 469 | goto out_free_expr; |
| 470 | } |
| 471 | |
| 472 | /* Note: -m found is always valid, bool/int are compatible, str/bin/reg/len are compatible */ |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 473 | if (idx == PAT_MATCH_FOUND || /* -m found */ |
| 474 | ((idx == PAT_MATCH_BOOL || idx == PAT_MATCH_INT) && /* -m bool/int */ |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 475 | (cur_type == SMP_T_BOOL || |
| 476 | cur_type == SMP_T_UINT || |
| 477 | cur_type == SMP_T_SINT)) || |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 478 | (idx == PAT_MATCH_IP && /* -m ip */ |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 479 | (cur_type == SMP_T_IPV4 || |
| 480 | cur_type == SMP_T_IPV6)) || |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 481 | ((idx == PAT_MATCH_BIN || idx == PAT_MATCH_LEN || idx == PAT_MATCH_STR || |
| 482 | idx == PAT_MATCH_BEG || idx == PAT_MATCH_SUB || idx == PAT_MATCH_DIR || |
| 483 | idx == PAT_MATCH_DOM || idx == PAT_MATCH_END || idx == PAT_MATCH_REG) && /* strings */ |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 484 | (cur_type == SMP_T_STR || |
| 485 | cur_type == SMP_T_BIN || |
| 486 | cur_type == SMP_T_CSTR || |
| 487 | cur_type == SMP_T_CBIN))) { |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 488 | expr->pat.parse = pat_parse_fcts[idx]; |
| 489 | expr->pat.match = pat_match_fcts[idx]; |
Willy Tarreau | 5adeda1 | 2013-03-31 22:13:34 +0200 | [diff] [blame] | 490 | } |
| 491 | else { |
Willy Tarreau | 93fddf1 | 2013-03-31 22:59:32 +0200 | [diff] [blame] | 492 | memprintf(err, "matching method '%s' cannot be used with fetch keyword '%s'", args[1], expr->kw); |
Willy Tarreau | 5adeda1 | 2013-03-31 22:13:34 +0200 | [diff] [blame] | 493 | goto out_free_expr; |
| 494 | } |
Willy Tarreau | 2b5285d | 2010-05-09 23:45:24 +0200 | [diff] [blame] | 495 | args++; |
| 496 | } |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 497 | else if ((*args)[1] == '-') { |
| 498 | args++; |
| 499 | break; |
| 500 | } |
| 501 | else |
| 502 | break; |
| 503 | args++; |
| 504 | } |
| 505 | |
Thierry FOURNIER | d163e1c | 2013-11-28 11:41:23 +0100 | [diff] [blame] | 506 | if (!expr->pat.parse) { |
Willy Tarreau | 9987ea9 | 2013-06-11 21:09:06 +0200 | [diff] [blame] | 507 | memprintf(err, "matching method must be specified first (using '-m') when using a sample fetch of this type ('%s')", expr->kw); |
Willy Tarreau | bef91e7 | 2013-03-31 23:14:46 +0200 | [diff] [blame] | 508 | goto out_free_expr; |
| 509 | } |
| 510 | |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 511 | /* now parse all patterns */ |
Willy Tarreau | ae8b796 | 2007-06-09 23:10:04 +0200 | [diff] [blame] | 512 | opaque = 0; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 513 | while (**args) { |
Willy Tarreau | ae8b796 | 2007-06-09 23:10:04 +0200 | [diff] [blame] | 514 | int ret; |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 515 | pattern = (struct pattern *)calloc(1, sizeof(*pattern)); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 516 | if (!pattern) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 517 | memprintf(err, "out of memory when parsing ACL pattern"); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 518 | goto out_free_expr; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 519 | } |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 520 | pattern->flags = patflags; |
| 521 | |
Willy Tarreau | c92ddbc | 2012-04-27 22:10:57 +0200 | [diff] [blame] | 522 | pattern->type = SMP_TYPES; /* unspecified type */ |
Thierry FOURNIER | d163e1c | 2013-11-28 11:41:23 +0100 | [diff] [blame] | 523 | ret = expr->pat.parse(args, pattern, NULL, &opaque, err); |
Willy Tarreau | 7dcb648 | 2012-04-27 17:52:25 +0200 | [diff] [blame] | 524 | if (!ret) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 525 | goto out_free_pattern; |
Willy Tarreau | 7dcb648 | 2012-04-27 17:52:25 +0200 | [diff] [blame] | 526 | |
Thierry FOURNIER | d163e1c | 2013-11-28 11:41:23 +0100 | [diff] [blame] | 527 | LIST_ADDQ(&expr->pat.patterns, &pattern->list); |
Willy Tarreau | ae8b796 | 2007-06-09 23:10:04 +0200 | [diff] [blame] | 528 | args += ret; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 529 | } |
| 530 | |
| 531 | return expr; |
| 532 | |
| 533 | out_free_pattern: |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 534 | pattern_free(pattern); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 535 | out_free_expr: |
| 536 | prune_acl_expr(expr); |
| 537 | free(expr); |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 538 | free(ckw); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 539 | out_return: |
| 540 | return NULL; |
| 541 | } |
| 542 | |
Krzysztof Piotr Oledzki | a643baf | 2008-05-29 23:53:44 +0200 | [diff] [blame] | 543 | /* Purge everything in the acl <acl>, then return <acl>. */ |
| 544 | struct acl *prune_acl(struct acl *acl) { |
| 545 | |
| 546 | struct acl_expr *expr, *exprb; |
| 547 | |
| 548 | free(acl->name); |
| 549 | |
| 550 | list_for_each_entry_safe(expr, exprb, &acl->expr, list) { |
| 551 | LIST_DEL(&expr->list); |
| 552 | prune_acl_expr(expr); |
| 553 | free(expr); |
| 554 | } |
| 555 | |
| 556 | return acl; |
| 557 | } |
| 558 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 559 | /* Parse an ACL with the name starting at <args>[0], and with a list of already |
| 560 | * known ACLs in <acl>. If the ACL was not in the list, it will be added. |
Willy Tarreau | 2a56c5e | 2010-03-15 16:13:29 +0100 | [diff] [blame] | 561 | * A pointer to that ACL is returned. If the ACL has an empty name, then it's |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 562 | * an anonymous one and it won't be merged with any other one. If <err> is not |
| 563 | * NULL, it will be filled with an appropriate error. This pointer must be |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 564 | * freeable or NULL. <al> is the arg_list serving as a head for unresolved |
| 565 | * dependencies. |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 566 | * |
| 567 | * args syntax: <aclname> <acl_expr> |
| 568 | */ |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 569 | struct acl *parse_acl(const char **args, struct list *known_acl, char **err, struct arg_list *al) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 570 | { |
| 571 | __label__ out_return, out_free_acl_expr, out_free_name; |
| 572 | struct acl *cur_acl; |
| 573 | struct acl_expr *acl_expr; |
| 574 | char *name; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 575 | const char *pos; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 576 | |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 577 | if (**args && (pos = invalid_char(*args))) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 578 | memprintf(err, "invalid character in ACL name : '%c'", *pos); |
Willy Tarreau | 2e74c3f | 2007-12-02 18:45:09 +0100 | [diff] [blame] | 579 | goto out_return; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 580 | } |
Willy Tarreau | 2e74c3f | 2007-12-02 18:45:09 +0100 | [diff] [blame] | 581 | |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 582 | acl_expr = parse_acl_expr(args + 1, err, al); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 583 | if (!acl_expr) { |
| 584 | /* parse_acl_expr will have filled <err> here */ |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 585 | goto out_return; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 586 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 587 | |
Willy Tarreau | 404e8ab | 2009-07-26 19:40:40 +0200 | [diff] [blame] | 588 | /* Check for args beginning with an opening parenthesis just after the |
| 589 | * subject, as this is almost certainly a typo. Right now we can only |
| 590 | * emit a warning, so let's do so. |
| 591 | */ |
Krzysztof Piotr Oledzki | 4cdd831 | 2009-10-05 00:23:35 +0200 | [diff] [blame] | 592 | if (!strchr(args[1], '(') && *args[2] == '(') |
Willy Tarreau | 404e8ab | 2009-07-26 19:40:40 +0200 | [diff] [blame] | 593 | Warning("parsing acl '%s' :\n" |
| 594 | " matching '%s' for pattern '%s' is likely a mistake and probably\n" |
| 595 | " not what you want. Maybe you need to remove the extraneous space before '('.\n" |
| 596 | " If you are really sure this is not an error, please insert '--' between the\n" |
| 597 | " match and the pattern to make this warning message disappear.\n", |
| 598 | args[0], args[1], args[2]); |
| 599 | |
Willy Tarreau | 2a56c5e | 2010-03-15 16:13:29 +0100 | [diff] [blame] | 600 | if (*args[0]) |
| 601 | cur_acl = find_acl_by_name(args[0], known_acl); |
| 602 | else |
| 603 | cur_acl = NULL; |
| 604 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 605 | if (!cur_acl) { |
| 606 | name = strdup(args[0]); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 607 | if (!name) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 608 | memprintf(err, "out of memory when parsing ACL"); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 609 | goto out_free_acl_expr; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 610 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 611 | cur_acl = (struct acl *)calloc(1, sizeof(*cur_acl)); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 612 | if (cur_acl == NULL) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 613 | memprintf(err, "out of memory when parsing ACL"); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 614 | goto out_free_name; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 615 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 616 | |
| 617 | LIST_INIT(&cur_acl->expr); |
| 618 | LIST_ADDQ(known_acl, &cur_acl->list); |
| 619 | cur_acl->name = name; |
| 620 | } |
| 621 | |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 622 | /* We want to know what features the ACL needs (typically HTTP parsing), |
| 623 | * and where it may be used. If an ACL relies on multiple matches, it is |
| 624 | * OK if at least one of them may match in the context where it is used. |
| 625 | */ |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 626 | cur_acl->use |= acl_expr->smp->fetch->use; |
| 627 | cur_acl->val |= acl_expr->smp->fetch->val; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 628 | LIST_ADDQ(&cur_acl->expr, &acl_expr->list); |
| 629 | return cur_acl; |
| 630 | |
| 631 | out_free_name: |
| 632 | free(name); |
| 633 | out_free_acl_expr: |
| 634 | prune_acl_expr(acl_expr); |
| 635 | free(acl_expr); |
| 636 | out_return: |
| 637 | return NULL; |
| 638 | } |
| 639 | |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 640 | /* Some useful ACLs provided by default. Only those used are allocated. */ |
| 641 | |
| 642 | const struct { |
| 643 | const char *name; |
| 644 | const char *expr[4]; /* put enough for longest expression */ |
| 645 | } default_acl_list[] = { |
Willy Tarreau | 58393e1 | 2008-07-20 10:39:22 +0200 | [diff] [blame] | 646 | { .name = "TRUE", .expr = {"always_true",""}}, |
| 647 | { .name = "FALSE", .expr = {"always_false",""}}, |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 648 | { .name = "LOCALHOST", .expr = {"src","127.0.0.1/8",""}}, |
Willy Tarreau | 2492d5b | 2009-07-11 00:06:00 +0200 | [diff] [blame] | 649 | { .name = "HTTP", .expr = {"req_proto_http",""}}, |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 650 | { .name = "HTTP_1.0", .expr = {"req_ver","1.0",""}}, |
| 651 | { .name = "HTTP_1.1", .expr = {"req_ver","1.1",""}}, |
| 652 | { .name = "METH_CONNECT", .expr = {"method","CONNECT",""}}, |
| 653 | { .name = "METH_GET", .expr = {"method","GET","HEAD",""}}, |
| 654 | { .name = "METH_HEAD", .expr = {"method","HEAD",""}}, |
| 655 | { .name = "METH_OPTIONS", .expr = {"method","OPTIONS",""}}, |
| 656 | { .name = "METH_POST", .expr = {"method","POST",""}}, |
| 657 | { .name = "METH_TRACE", .expr = {"method","TRACE",""}}, |
| 658 | { .name = "HTTP_URL_ABS", .expr = {"url_reg","^[^/:]*://",""}}, |
| 659 | { .name = "HTTP_URL_SLASH", .expr = {"url_beg","/",""}}, |
| 660 | { .name = "HTTP_URL_STAR", .expr = {"url","*",""}}, |
| 661 | { .name = "HTTP_CONTENT", .expr = {"hdr_val(content-length)","gt","0",""}}, |
Emeric Brun | bede3d0 | 2009-06-30 17:54:00 +0200 | [diff] [blame] | 662 | { .name = "RDP_COOKIE", .expr = {"req_rdp_cookie_cnt","gt","0",""}}, |
Willy Tarreau | c631770 | 2008-07-20 09:29:50 +0200 | [diff] [blame] | 663 | { .name = "REQ_CONTENT", .expr = {"req_len","gt","0",""}}, |
Willy Tarreau | b6fb420 | 2008-07-20 11:18:28 +0200 | [diff] [blame] | 664 | { .name = "WAIT_END", .expr = {"wait_end",""}}, |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 665 | { .name = NULL, .expr = {""}} |
| 666 | }; |
| 667 | |
| 668 | /* Find a default ACL from the default_acl list, compile it and return it. |
| 669 | * If the ACL is not found, NULL is returned. In theory, it cannot fail, |
| 670 | * except when default ACLs are broken, in which case it will return NULL. |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 671 | * If <known_acl> is not NULL, the ACL will be queued at its tail. If <err> is |
| 672 | * not NULL, it will be filled with an error message if an error occurs. This |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 673 | * pointer must be freeable or NULL. <al> is an arg_list serving as a list head |
| 674 | * to report missing dependencies. |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 675 | */ |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 676 | static struct acl *find_acl_default(const char *acl_name, struct list *known_acl, |
| 677 | char **err, struct arg_list *al) |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 678 | { |
| 679 | __label__ out_return, out_free_acl_expr, out_free_name; |
| 680 | struct acl *cur_acl; |
| 681 | struct acl_expr *acl_expr; |
| 682 | char *name; |
| 683 | int index; |
| 684 | |
| 685 | for (index = 0; default_acl_list[index].name != NULL; index++) { |
| 686 | if (strcmp(acl_name, default_acl_list[index].name) == 0) |
| 687 | break; |
| 688 | } |
| 689 | |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 690 | if (default_acl_list[index].name == NULL) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 691 | memprintf(err, "no such ACL : '%s'", acl_name); |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 692 | return NULL; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 693 | } |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 694 | |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 695 | acl_expr = parse_acl_expr((const char **)default_acl_list[index].expr, err, al); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 696 | if (!acl_expr) { |
| 697 | /* parse_acl_expr must have filled err here */ |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 698 | goto out_return; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 699 | } |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 700 | |
| 701 | name = strdup(acl_name); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 702 | if (!name) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 703 | memprintf(err, "out of memory when building default ACL '%s'", acl_name); |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 704 | goto out_free_acl_expr; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 705 | } |
| 706 | |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 707 | cur_acl = (struct acl *)calloc(1, sizeof(*cur_acl)); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 708 | if (cur_acl == NULL) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 709 | memprintf(err, "out of memory when building default ACL '%s'", acl_name); |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 710 | goto out_free_name; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 711 | } |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 712 | |
| 713 | cur_acl->name = name; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 714 | cur_acl->use |= acl_expr->smp->fetch->use; |
| 715 | cur_acl->val |= acl_expr->smp->fetch->val; |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 716 | LIST_INIT(&cur_acl->expr); |
| 717 | LIST_ADDQ(&cur_acl->expr, &acl_expr->list); |
| 718 | if (known_acl) |
| 719 | LIST_ADDQ(known_acl, &cur_acl->list); |
| 720 | |
| 721 | return cur_acl; |
| 722 | |
| 723 | out_free_name: |
| 724 | free(name); |
| 725 | out_free_acl_expr: |
| 726 | prune_acl_expr(acl_expr); |
| 727 | free(acl_expr); |
| 728 | out_return: |
| 729 | return NULL; |
| 730 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 731 | |
| 732 | /* Purge everything in the acl_cond <cond>, then return <cond>. */ |
| 733 | struct acl_cond *prune_acl_cond(struct acl_cond *cond) |
| 734 | { |
| 735 | struct acl_term_suite *suite, *tmp_suite; |
| 736 | struct acl_term *term, *tmp_term; |
| 737 | |
| 738 | /* iterate through all term suites and free all terms and all suites */ |
| 739 | list_for_each_entry_safe(suite, tmp_suite, &cond->suites, list) { |
| 740 | list_for_each_entry_safe(term, tmp_term, &suite->terms, list) |
| 741 | free(term); |
| 742 | free(suite); |
| 743 | } |
| 744 | return cond; |
| 745 | } |
| 746 | |
| 747 | /* Parse an ACL condition starting at <args>[0], relying on a list of already |
| 748 | * known ACLs passed in <known_acl>. The new condition is returned (or NULL in |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 749 | * case of low memory). Supports multiple conditions separated by "or". If |
| 750 | * <err> is not NULL, it will be filled with a pointer to an error message in |
| 751 | * case of error, that the caller is responsible for freeing. The initial |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 752 | * location must either be freeable or NULL. The list <al> serves as a list head |
| 753 | * for unresolved dependencies. |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 754 | */ |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 755 | struct acl_cond *parse_acl_cond(const char **args, struct list *known_acl, |
Willy Tarreau | 0cba607 | 2013-11-28 22:21:02 +0100 | [diff] [blame] | 756 | enum acl_cond_pol pol, char **err, struct arg_list *al) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 757 | { |
| 758 | __label__ out_return, out_free_suite, out_free_term; |
Willy Tarreau | 74b98a8 | 2007-06-16 19:35:18 +0200 | [diff] [blame] | 759 | int arg, neg; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 760 | const char *word; |
| 761 | struct acl *cur_acl; |
| 762 | struct acl_term *cur_term; |
| 763 | struct acl_term_suite *cur_suite; |
| 764 | struct acl_cond *cond; |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 765 | unsigned int suite_val; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 766 | |
| 767 | cond = (struct acl_cond *)calloc(1, sizeof(*cond)); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 768 | if (cond == NULL) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 769 | memprintf(err, "out of memory when parsing condition"); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 770 | goto out_return; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 771 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 772 | |
| 773 | LIST_INIT(&cond->list); |
| 774 | LIST_INIT(&cond->suites); |
| 775 | cond->pol = pol; |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 776 | cond->val = 0; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 777 | |
| 778 | cur_suite = NULL; |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 779 | suite_val = ~0U; |
Willy Tarreau | 74b98a8 | 2007-06-16 19:35:18 +0200 | [diff] [blame] | 780 | neg = 0; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 781 | for (arg = 0; *args[arg]; arg++) { |
| 782 | word = args[arg]; |
| 783 | |
| 784 | /* remove as many exclamation marks as we can */ |
| 785 | while (*word == '!') { |
| 786 | neg = !neg; |
| 787 | word++; |
| 788 | } |
| 789 | |
| 790 | /* an empty word is allowed because we cannot force the user to |
| 791 | * always think about not leaving exclamation marks alone. |
| 792 | */ |
| 793 | if (!*word) |
| 794 | continue; |
| 795 | |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 796 | if (strcasecmp(word, "or") == 0 || strcmp(word, "||") == 0) { |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 797 | /* new term suite */ |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 798 | cond->val |= suite_val; |
| 799 | suite_val = ~0U; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 800 | cur_suite = NULL; |
| 801 | neg = 0; |
| 802 | continue; |
| 803 | } |
| 804 | |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 805 | if (strcmp(word, "{") == 0) { |
| 806 | /* we may have a complete ACL expression between two braces, |
| 807 | * find the last one. |
| 808 | */ |
| 809 | int arg_end = arg + 1; |
| 810 | const char **args_new; |
| 811 | |
| 812 | while (*args[arg_end] && strcmp(args[arg_end], "}") != 0) |
| 813 | arg_end++; |
| 814 | |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 815 | if (!*args[arg_end]) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 816 | memprintf(err, "missing closing '}' in condition"); |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 817 | goto out_free_suite; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 818 | } |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 819 | |
| 820 | args_new = calloc(1, (arg_end - arg + 1) * sizeof(*args_new)); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 821 | if (!args_new) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 822 | memprintf(err, "out of memory when parsing condition"); |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 823 | goto out_free_suite; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 824 | } |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 825 | |
Willy Tarreau | 2a56c5e | 2010-03-15 16:13:29 +0100 | [diff] [blame] | 826 | args_new[0] = ""; |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 827 | memcpy(args_new + 1, args + arg + 1, (arg_end - arg) * sizeof(*args_new)); |
| 828 | args_new[arg_end - arg] = ""; |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 829 | cur_acl = parse_acl(args_new, known_acl, err, al); |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 830 | free(args_new); |
| 831 | |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 832 | if (!cur_acl) { |
| 833 | /* note that parse_acl() must have filled <err> here */ |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 834 | goto out_free_suite; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 835 | } |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 836 | word = args[arg + 1]; |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 837 | arg = arg_end; |
| 838 | } |
| 839 | else { |
| 840 | /* search for <word> in the known ACL names. If we do not find |
| 841 | * it, let's look for it in the default ACLs, and if found, add |
| 842 | * it to the list of ACLs of this proxy. This makes it possible |
| 843 | * to override them. |
| 844 | */ |
| 845 | cur_acl = find_acl_by_name(word, known_acl); |
| 846 | if (cur_acl == NULL) { |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 847 | cur_acl = find_acl_default(word, known_acl, err, al); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 848 | if (cur_acl == NULL) { |
| 849 | /* note that find_acl_default() must have filled <err> here */ |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 850 | goto out_free_suite; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 851 | } |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 852 | } |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 853 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 854 | |
| 855 | cur_term = (struct acl_term *)calloc(1, sizeof(*cur_term)); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 856 | if (cur_term == NULL) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 857 | memprintf(err, "out of memory when parsing condition"); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 858 | goto out_free_suite; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 859 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 860 | |
| 861 | cur_term->acl = cur_acl; |
| 862 | cur_term->neg = neg; |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 863 | |
| 864 | /* Here it is a bit complex. The acl_term_suite is a conjunction |
| 865 | * of many terms. It may only be used if all of its terms are |
| 866 | * usable at the same time. So the suite's validity domain is an |
| 867 | * AND between all ACL keywords' ones. But, the global condition |
| 868 | * is valid if at least one term suite is OK. So it's an OR between |
| 869 | * all of their validity domains. We could emit a warning as soon |
| 870 | * as suite_val is null because it means that the last ACL is not |
| 871 | * compatible with the previous ones. Let's remain simple for now. |
| 872 | */ |
| 873 | cond->use |= cur_acl->use; |
| 874 | suite_val &= cur_acl->val; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 875 | |
| 876 | if (!cur_suite) { |
| 877 | cur_suite = (struct acl_term_suite *)calloc(1, sizeof(*cur_suite)); |
Willy Tarreau | f678b7f | 2013-01-24 00:25:39 +0100 | [diff] [blame] | 878 | if (cur_suite == NULL) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 879 | memprintf(err, "out of memory when parsing condition"); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 880 | goto out_free_term; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 881 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 882 | LIST_INIT(&cur_suite->terms); |
| 883 | LIST_ADDQ(&cond->suites, &cur_suite->list); |
| 884 | } |
| 885 | LIST_ADDQ(&cur_suite->terms, &cur_term->list); |
Willy Tarreau | 74b98a8 | 2007-06-16 19:35:18 +0200 | [diff] [blame] | 886 | neg = 0; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 887 | } |
| 888 | |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 889 | cond->val |= suite_val; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 890 | return cond; |
| 891 | |
| 892 | out_free_term: |
| 893 | free(cur_term); |
| 894 | out_free_suite: |
| 895 | prune_acl_cond(cond); |
| 896 | free(cond); |
| 897 | out_return: |
| 898 | return NULL; |
| 899 | } |
| 900 | |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 901 | /* Builds an ACL condition starting at the if/unless keyword. The complete |
| 902 | * condition is returned. NULL is returned in case of error or if the first |
| 903 | * word is neither "if" nor "unless". It automatically sets the file name and |
Willy Tarreau | 25320b2 | 2013-03-24 07:22:08 +0100 | [diff] [blame] | 904 | * the line number in the condition for better error reporting, and sets the |
| 905 | * HTTP intiailization requirements in the proxy. If <err> is not NULL, it will |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 906 | * be filled with a pointer to an error message in case of error, that the |
| 907 | * caller is responsible for freeing. The initial location must either be |
| 908 | * freeable or NULL. |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 909 | */ |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 910 | struct acl_cond *build_acl_cond(const char *file, int line, struct proxy *px, const char **args, char **err) |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 911 | { |
Willy Tarreau | 0cba607 | 2013-11-28 22:21:02 +0100 | [diff] [blame] | 912 | enum acl_cond_pol pol = ACL_COND_NONE; |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 913 | struct acl_cond *cond = NULL; |
| 914 | |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 915 | if (err) |
| 916 | *err = NULL; |
| 917 | |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 918 | if (!strcmp(*args, "if")) { |
| 919 | pol = ACL_COND_IF; |
| 920 | args++; |
| 921 | } |
| 922 | else if (!strcmp(*args, "unless")) { |
| 923 | pol = ACL_COND_UNLESS; |
| 924 | args++; |
| 925 | } |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 926 | else { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 927 | memprintf(err, "conditions must start with either 'if' or 'unless'"); |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 928 | return NULL; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 929 | } |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 930 | |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 931 | cond = parse_acl_cond(args, &px->acl, pol, err, &px->conf.args); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 932 | if (!cond) { |
| 933 | /* note that parse_acl_cond must have filled <err> here */ |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 934 | return NULL; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 935 | } |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 936 | |
| 937 | cond->file = file; |
| 938 | cond->line = line; |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 939 | px->http_needed |= !!(cond->use & SMP_USE_HTTP_ANY); |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 940 | return cond; |
| 941 | } |
| 942 | |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 943 | /* Execute condition <cond> and return either ACL_TEST_FAIL, ACL_TEST_MISS or |
| 944 | * ACL_TEST_PASS depending on the test results. ACL_TEST_MISS may only be |
Willy Tarreau | 32a6f2e | 2012-04-25 10:13:36 +0200 | [diff] [blame] | 945 | * returned if <opt> does not contain SMP_OPT_FINAL, indicating that incomplete |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 946 | * data is being examined. The function automatically sets SMP_OPT_ITERATE. This |
| 947 | * function only computes the condition, it does not apply the polarity required |
| 948 | * by IF/UNLESS, it's up to the caller to do this using something like this : |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 949 | * |
| 950 | * res = acl_pass(res); |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 951 | * if (res == ACL_TEST_MISS) |
Willy Tarreau | b686644 | 2008-07-14 23:54:42 +0200 | [diff] [blame] | 952 | * return 0; |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 953 | * if (cond->pol == ACL_COND_UNLESS) |
| 954 | * res = !res; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 955 | */ |
Willy Tarreau | 0cba607 | 2013-11-28 22:21:02 +0100 | [diff] [blame] | 956 | enum acl_test_res acl_exec_cond(struct acl_cond *cond, struct proxy *px, struct session *l4, void *l7, unsigned int opt) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 957 | { |
| 958 | __label__ fetch_next; |
| 959 | struct acl_term_suite *suite; |
| 960 | struct acl_term *term; |
| 961 | struct acl_expr *expr; |
| 962 | struct acl *acl; |
Willy Tarreau | 3740635 | 2012-04-23 16:16:37 +0200 | [diff] [blame] | 963 | struct sample smp; |
Willy Tarreau | 0cba607 | 2013-11-28 22:21:02 +0100 | [diff] [blame] | 964 | enum acl_test_res acl_res, suite_res, cond_res; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 965 | |
Willy Tarreau | 7a777ed | 2012-04-26 11:44:02 +0200 | [diff] [blame] | 966 | /* ACLs are iterated over all values, so let's always set the flag to |
| 967 | * indicate this to the fetch functions. |
| 968 | */ |
| 969 | opt |= SMP_OPT_ITERATE; |
| 970 | |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 971 | /* We're doing a logical OR between conditions so we initialize to FAIL. |
| 972 | * The MISS status is propagated down from the suites. |
| 973 | */ |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 974 | cond_res = ACL_TEST_FAIL; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 975 | list_for_each_entry(suite, &cond->suites, list) { |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 976 | /* Evaluate condition suite <suite>. We stop at the first term |
Willy Tarreau | 0cba607 | 2013-11-28 22:21:02 +0100 | [diff] [blame] | 977 | * which returns ACL_TEST_FAIL. The MISS status is still propagated |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 978 | * in case of uncertainty in the result. |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 979 | */ |
| 980 | |
| 981 | /* we're doing a logical AND between terms, so we must set the |
| 982 | * initial value to PASS. |
| 983 | */ |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 984 | suite_res = ACL_TEST_PASS; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 985 | list_for_each_entry(term, &suite->terms, list) { |
| 986 | acl = term->acl; |
| 987 | |
| 988 | /* FIXME: use cache ! |
| 989 | * check acl->cache_idx for this. |
| 990 | */ |
| 991 | |
| 992 | /* ACL result not cached. Let's scan all the expressions |
| 993 | * and use the first one to match. |
| 994 | */ |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 995 | acl_res = ACL_TEST_FAIL; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 996 | list_for_each_entry(expr, &acl->expr, list) { |
Willy Tarreau | d41f8d8 | 2007-06-10 10:06:18 +0200 | [diff] [blame] | 997 | /* we need to reset context and flags */ |
Willy Tarreau | 3740635 | 2012-04-23 16:16:37 +0200 | [diff] [blame] | 998 | memset(&smp, 0, sizeof(smp)); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 999 | fetch_next: |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1000 | if (!sample_process(px, l4, l7, opt, expr->smp, &smp)) { |
Willy Tarreau | b686644 | 2008-07-14 23:54:42 +0200 | [diff] [blame] | 1001 | /* maybe we could not fetch because of missing data */ |
Willy Tarreau | 32a6f2e | 2012-04-25 10:13:36 +0200 | [diff] [blame] | 1002 | if (smp.flags & SMP_F_MAY_CHANGE && !(opt & SMP_OPT_FINAL)) |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 1003 | acl_res |= ACL_TEST_MISS; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1004 | continue; |
Willy Tarreau | b686644 | 2008-07-14 23:54:42 +0200 | [diff] [blame] | 1005 | } |
Willy Tarreau | c426296 | 2010-05-10 23:42:40 +0200 | [diff] [blame] | 1006 | |
Willy Tarreau | 0cba607 | 2013-11-28 22:21:02 +0100 | [diff] [blame] | 1007 | acl_res |= pat2acl(pattern_exec_match(&expr->pat, &smp, NULL)); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1008 | /* |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1009 | * OK now acl_res holds the result of this expression |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 1010 | * as one of ACL_TEST_FAIL, ACL_TEST_MISS or ACL_TEST_PASS. |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1011 | * |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1012 | * Then if (!MISS) we can cache the result, and put |
Willy Tarreau | 3740635 | 2012-04-23 16:16:37 +0200 | [diff] [blame] | 1013 | * (smp.flags & SMP_F_VOLATILE) in the cache flags. |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1014 | * |
| 1015 | * FIXME: implement cache. |
| 1016 | * |
| 1017 | */ |
| 1018 | |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1019 | /* we're ORing these terms, so a single PASS is enough */ |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 1020 | if (acl_res == ACL_TEST_PASS) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1021 | break; |
| 1022 | |
Willy Tarreau | 3740635 | 2012-04-23 16:16:37 +0200 | [diff] [blame] | 1023 | if (smp.flags & SMP_F_NOT_LAST) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1024 | goto fetch_next; |
Willy Tarreau | b686644 | 2008-07-14 23:54:42 +0200 | [diff] [blame] | 1025 | |
| 1026 | /* sometimes we know the fetched data is subject to change |
| 1027 | * later and give another chance for a new match (eg: request |
| 1028 | * size, time, ...) |
| 1029 | */ |
Willy Tarreau | 32a6f2e | 2012-04-25 10:13:36 +0200 | [diff] [blame] | 1030 | if (smp.flags & SMP_F_MAY_CHANGE && !(opt & SMP_OPT_FINAL)) |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 1031 | acl_res |= ACL_TEST_MISS; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1032 | } |
| 1033 | /* |
| 1034 | * Here we have the result of an ACL (cached or not). |
| 1035 | * ACLs are combined, negated or not, to form conditions. |
| 1036 | */ |
| 1037 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1038 | if (term->neg) |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1039 | acl_res = acl_neg(acl_res); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1040 | |
| 1041 | suite_res &= acl_res; |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1042 | |
Willy Tarreau | 79c412b | 2013-10-30 19:30:32 +0100 | [diff] [blame] | 1043 | /* we're ANDing these terms, so a single FAIL or MISS is enough */ |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 1044 | if (suite_res != ACL_TEST_PASS) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1045 | break; |
| 1046 | } |
| 1047 | cond_res |= suite_res; |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1048 | |
| 1049 | /* we're ORing these terms, so a single PASS is enough */ |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 1050 | if (cond_res == ACL_TEST_PASS) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1051 | break; |
| 1052 | } |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1053 | return cond_res; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1054 | } |
| 1055 | |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 1056 | /* Returns a pointer to the first ACL conflicting with usage at place <where> |
| 1057 | * which is one of the SMP_VAL_* bits indicating a check place, or NULL if |
| 1058 | * no conflict is found. Only full conflicts are detected (ACL is not usable). |
| 1059 | * Use the next function to check for useless keywords. |
Willy Tarreau | dd64f8d | 2008-07-27 22:02:32 +0200 | [diff] [blame] | 1060 | */ |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 1061 | const struct acl *acl_cond_conflicts(const struct acl_cond *cond, unsigned int where) |
Willy Tarreau | dd64f8d | 2008-07-27 22:02:32 +0200 | [diff] [blame] | 1062 | { |
| 1063 | struct acl_term_suite *suite; |
| 1064 | struct acl_term *term; |
| 1065 | struct acl *acl; |
| 1066 | |
| 1067 | list_for_each_entry(suite, &cond->suites, list) { |
| 1068 | list_for_each_entry(term, &suite->terms, list) { |
| 1069 | acl = term->acl; |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 1070 | if (!(acl->val & where)) |
Willy Tarreau | dd64f8d | 2008-07-27 22:02:32 +0200 | [diff] [blame] | 1071 | return acl; |
| 1072 | } |
| 1073 | } |
| 1074 | return NULL; |
| 1075 | } |
| 1076 | |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 1077 | /* Returns a pointer to the first ACL and its first keyword to conflict with |
| 1078 | * usage at place <where> which is one of the SMP_VAL_* bits indicating a check |
| 1079 | * place. Returns true if a conflict is found, with <acl> and <kw> set (if non |
| 1080 | * null), or false if not conflict is found. The first useless keyword is |
| 1081 | * returned. |
| 1082 | */ |
Willy Tarreau | 93fddf1 | 2013-03-31 22:59:32 +0200 | [diff] [blame] | 1083 | int acl_cond_kw_conflicts(const struct acl_cond *cond, unsigned int where, struct acl const **acl, char const **kw) |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 1084 | { |
| 1085 | struct acl_term_suite *suite; |
| 1086 | struct acl_term *term; |
| 1087 | struct acl_expr *expr; |
| 1088 | |
| 1089 | list_for_each_entry(suite, &cond->suites, list) { |
| 1090 | list_for_each_entry(term, &suite->terms, list) { |
| 1091 | list_for_each_entry(expr, &term->acl->expr, list) { |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1092 | if (!(expr->smp->fetch->val & where)) { |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 1093 | if (acl) |
| 1094 | *acl = term->acl; |
| 1095 | if (kw) |
| 1096 | *kw = expr->kw; |
| 1097 | return 1; |
| 1098 | } |
| 1099 | } |
| 1100 | } |
| 1101 | } |
| 1102 | return 0; |
| 1103 | } |
| 1104 | |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1105 | /* |
| 1106 | * Find targets for userlist and groups in acl. Function returns the number |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1107 | * of errors or OK if everything is fine. It must be called only once sample |
| 1108 | * fetch arguments have been resolved (after smp_resolve_args()). |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1109 | */ |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1110 | int acl_find_targets(struct proxy *p) |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1111 | { |
| 1112 | |
| 1113 | struct acl *acl; |
| 1114 | struct acl_expr *expr; |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 1115 | struct pattern *pattern; |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1116 | int cfgerr = 0; |
| 1117 | |
| 1118 | list_for_each_entry(acl, &p->acl, list) { |
| 1119 | list_for_each_entry(expr, &acl->expr, list) { |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1120 | if (!strcmp(expr->kw, "http_auth_group")) { |
| 1121 | /* Note: the ARGT_USR argument may only have been resolved earlier |
| 1122 | * by smp_resolve_args(). |
| 1123 | */ |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1124 | if (expr->smp->arg_p->unresolved) { |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1125 | Alert("Internal bug in proxy %s: %sacl %s %s() makes use of unresolved userlist '%s'. Please report this.\n", |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1126 | p->id, *acl->name ? "" : "anonymous ", acl->name, expr->kw, expr->smp->arg_p->data.str.str); |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1127 | cfgerr++; |
Willy Tarreau | 496aa01 | 2012-06-01 10:38:29 +0200 | [diff] [blame] | 1128 | continue; |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1129 | } |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1130 | |
Thierry FOURNIER | d163e1c | 2013-11-28 11:41:23 +0100 | [diff] [blame] | 1131 | if (LIST_ISEMPTY(&expr->pat.patterns)) { |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1132 | Alert("proxy %s: acl %s %s(): no groups specified.\n", |
Willy Tarreau | 93fddf1 | 2013-03-31 22:59:32 +0200 | [diff] [blame] | 1133 | p->id, acl->name, expr->kw); |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1134 | cfgerr++; |
| 1135 | continue; |
| 1136 | } |
| 1137 | |
Thierry FOURNIER | d163e1c | 2013-11-28 11:41:23 +0100 | [diff] [blame] | 1138 | list_for_each_entry(pattern, &expr->pat.patterns, list) { |
Willy Tarreau | 7d1df41 | 2012-11-23 23:47:36 +0100 | [diff] [blame] | 1139 | /* this keyword only has one argument */ |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1140 | pattern->val.group_mask = auth_resolve_groups(expr->smp->arg_p->data.usr, pattern->ptr.str); |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1141 | |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1142 | if (!pattern->val.group_mask) { |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1143 | Alert("proxy %s: acl %s %s(): invalid group '%s'.\n", |
| 1144 | p->id, acl->name, expr->kw, pattern->ptr.str); |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1145 | cfgerr++; |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1146 | } |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1147 | free(pattern->ptr.str); |
| 1148 | pattern->ptr.str = NULL; |
| 1149 | pattern->len = 0; |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1150 | } |
| 1151 | } |
| 1152 | } |
| 1153 | } |
| 1154 | |
| 1155 | return cfgerr; |
| 1156 | } |
Willy Tarreau | dd64f8d | 2008-07-27 22:02:32 +0200 | [diff] [blame] | 1157 | |
Willy Tarreau | 8ed669b | 2013-01-11 15:49:37 +0100 | [diff] [blame] | 1158 | /* initializes ACLs by resolving the sample fetch names they rely upon. |
| 1159 | * Returns 0 on success, otherwise an error. |
| 1160 | */ |
| 1161 | int init_acl() |
| 1162 | { |
| 1163 | int err = 0; |
| 1164 | int index; |
| 1165 | const char *name; |
| 1166 | struct acl_kw_list *kwl; |
| 1167 | struct sample_fetch *smp; |
| 1168 | |
| 1169 | list_for_each_entry(kwl, &acl_keywords.list, list) { |
| 1170 | for (index = 0; kwl->kw[index].kw != NULL; index++) { |
| 1171 | name = kwl->kw[index].fetch_kw; |
| 1172 | if (!name) |
| 1173 | name = kwl->kw[index].kw; |
| 1174 | |
| 1175 | smp = find_sample_fetch(name, strlen(name)); |
| 1176 | if (!smp) { |
| 1177 | Alert("Critical internal error: ACL keyword '%s' relies on sample fetch '%s' which was not registered!\n", |
| 1178 | kwl->kw[index].kw, name); |
| 1179 | err++; |
| 1180 | continue; |
| 1181 | } |
| 1182 | kwl->kw[index].smp = smp; |
| 1183 | } |
| 1184 | } |
| 1185 | return err; |
| 1186 | } |
Willy Tarreau | d4c33c8 | 2013-01-07 21:59:07 +0100 | [diff] [blame] | 1187 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1188 | /************************************************************************/ |
Willy Tarreau | d4c33c8 | 2013-01-07 21:59:07 +0100 | [diff] [blame] | 1189 | /* All supported sample and ACL keywords must be declared here. */ |
| 1190 | /************************************************************************/ |
| 1191 | |
| 1192 | /* Note: must not be declared <const> as its list will be overwritten. |
Willy Tarreau | 61612d4 | 2012-04-19 18:42:05 +0200 | [diff] [blame] | 1193 | * Please take care of keeping this list alphabetically sorted. |
| 1194 | */ |
Willy Tarreau | dc13c11 | 2013-06-21 23:16:39 +0200 | [diff] [blame] | 1195 | static struct acl_kw_list acl_kws = {ILH, { |
Willy Tarreau | d4c33c8 | 2013-01-07 21:59:07 +0100 | [diff] [blame] | 1196 | { /* END */ }, |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1197 | }}; |
| 1198 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1199 | __attribute__((constructor)) |
| 1200 | static void __acl_init(void) |
| 1201 | { |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1202 | acl_register_keywords(&acl_kws); |
| 1203 | } |
| 1204 | |
| 1205 | |
| 1206 | /* |
| 1207 | * Local variables: |
| 1208 | * c-indent-level: 8 |
| 1209 | * c-basic-offset: 8 |
| 1210 | * End: |
| 1211 | */ |