blob: bdd12045c814146fefa97deef94b362119877aca [file] [log] [blame]
Willy Tarreaua84d3742007-05-07 00:36:48 +02001/*
2 * ACL management functions.
3 *
Willy Tarreau11382812008-07-09 16:18:21 +02004 * Copyright 2000-2008 Willy Tarreau <w@1wt.eu>
Willy Tarreaua84d3742007-05-07 00:36:48 +02005 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
Willy Tarreauae8b7962007-06-09 23:10:04 +020013#include <ctype.h>
Willy Tarreaua84d3742007-05-07 00:36:48 +020014#include <stdio.h>
15#include <string.h>
16
17#include <common/config.h>
18#include <common/mini-clist.h>
19#include <common/standard.h>
Krzysztof Piotr Oledzki8c8bd452010-01-29 19:29:32 +010020#include <common/uri_auth.h>
Willy Tarreaua84d3742007-05-07 00:36:48 +020021
Willy Tarreau2b5285d2010-05-09 23:45:24 +020022#include <types/global.h>
23
Willy Tarreaua84d3742007-05-07 00:36:48 +020024#include <proto/acl.h>
Krzysztof Piotr Oledzkif9423ae2010-01-29 19:26:18 +010025#include <proto/auth.h>
Willy Tarreau404e8ab2009-07-26 19:40:40 +020026#include <proto/log.h>
Willy Tarreaua84d3742007-05-07 00:36:48 +020027
Willy Tarreauc4262962010-05-10 23:42:40 +020028#include <ebsttree.h>
29
Willy Tarreaua9802632008-07-25 19:13:19 +020030/* The capabilities of filtering hooks describe the type of information
31 * available to each of them.
32 */
33const unsigned int filt_cap[] = {
34 [ACL_HOOK_REQ_FE_TCP] = ACL_USE_TCP4_ANY|ACL_USE_TCP6_ANY|ACL_USE_TCP_ANY,
35 [ACL_HOOK_REQ_FE_TCP_CONTENT] = ACL_USE_TCP4_ANY|ACL_USE_TCP6_ANY|ACL_USE_TCP_ANY|ACL_USE_L4REQ_ANY,
36 [ACL_HOOK_REQ_FE_HTTP_IN] = ACL_USE_TCP4_ANY|ACL_USE_TCP6_ANY|ACL_USE_TCP_ANY|ACL_USE_L4REQ_ANY|ACL_USE_L7REQ_ANY|ACL_USE_HDR_ANY,
37 [ACL_HOOK_REQ_FE_SWITCH] = ACL_USE_TCP4_ANY|ACL_USE_TCP6_ANY|ACL_USE_TCP_ANY|ACL_USE_L4REQ_ANY|ACL_USE_L7REQ_ANY|ACL_USE_HDR_ANY,
38 [ACL_HOOK_REQ_BE_TCP_CONTENT] = ACL_USE_TCP4_ANY|ACL_USE_TCP6_ANY|ACL_USE_TCP_ANY|ACL_USE_L4REQ_ANY|ACL_USE_L7REQ_ANY|ACL_USE_HDR_ANY,
39 [ACL_HOOK_REQ_BE_HTTP_IN] = ACL_USE_TCP4_ANY|ACL_USE_TCP6_ANY|ACL_USE_TCP_ANY|ACL_USE_L4REQ_ANY|ACL_USE_L7REQ_ANY|ACL_USE_HDR_ANY,
40 [ACL_HOOK_REQ_BE_SWITCH] = ACL_USE_TCP4_ANY|ACL_USE_TCP6_ANY|ACL_USE_TCP_ANY|ACL_USE_L4REQ_ANY|ACL_USE_L7REQ_ANY|ACL_USE_HDR_ANY,
41 [ACL_HOOK_REQ_FE_HTTP_OUT] = ACL_USE_TCP4_ANY|ACL_USE_TCP6_ANY|ACL_USE_TCP_ANY|ACL_USE_L4REQ_ANY|ACL_USE_L7REQ_ANY|ACL_USE_HDR_ANY,
42 [ACL_HOOK_REQ_BE_HTTP_OUT] = ACL_USE_TCP4_ANY|ACL_USE_TCP6_ANY|ACL_USE_TCP_ANY|ACL_USE_L4REQ_ANY|ACL_USE_L7REQ_ANY|ACL_USE_HDR_ANY,
43
44 [ACL_HOOK_RTR_BE_TCP_CONTENT] = ACL_USE_REQ_PERMANENT|ACL_USE_REQ_CACHEABLE|ACL_USE_L4RTR_ANY,
45 [ACL_HOOK_RTR_BE_HTTP_IN] = ACL_USE_REQ_PERMANENT|ACL_USE_REQ_CACHEABLE|ACL_USE_L4RTR_ANY|ACL_USE_L7RTR_ANY,
46 [ACL_HOOK_RTR_FE_TCP_CONTENT] = ACL_USE_REQ_PERMANENT|ACL_USE_REQ_CACHEABLE|ACL_USE_L4RTR_ANY|ACL_USE_L7RTR_ANY,
47 [ACL_HOOK_RTR_FE_HTTP_IN] = ACL_USE_REQ_PERMANENT|ACL_USE_REQ_CACHEABLE|ACL_USE_L4RTR_ANY|ACL_USE_L7RTR_ANY,
48 [ACL_HOOK_RTR_BE_HTTP_OUT] = ACL_USE_REQ_PERMANENT|ACL_USE_REQ_CACHEABLE|ACL_USE_L4RTR_ANY|ACL_USE_L7RTR_ANY,
49 [ACL_HOOK_RTR_FE_HTTP_OUT] = ACL_USE_REQ_PERMANENT|ACL_USE_REQ_CACHEABLE|ACL_USE_L4RTR_ANY|ACL_USE_L7RTR_ANY,
50};
51
Willy Tarreaua84d3742007-05-07 00:36:48 +020052/* List head of all known ACL keywords */
53static struct acl_kw_list acl_keywords = {
54 .list = LIST_HEAD_INIT(acl_keywords.list)
55};
56
57
Willy Tarreaua5909832007-06-17 20:40:25 +020058/*
59 * These functions are only used for debugging complex configurations.
Willy Tarreaua84d3742007-05-07 00:36:48 +020060 */
Willy Tarreaua5909832007-06-17 20:40:25 +020061
Willy Tarreau58393e12008-07-20 10:39:22 +020062/* force TRUE to be returned at the fetch level */
Willy Tarreaua5909832007-06-17 20:40:25 +020063static int
Willy Tarreau58393e12008-07-20 10:39:22 +020064acl_fetch_true(struct proxy *px, struct session *l4, void *l7, int dir,
65 struct acl_expr *expr, struct acl_test *test)
Willy Tarreaua5909832007-06-17 20:40:25 +020066{
Willy Tarreau58393e12008-07-20 10:39:22 +020067 test->flags |= ACL_TEST_F_SET_RES_PASS;
Willy Tarreaua5909832007-06-17 20:40:25 +020068 return 1;
69}
70
Willy Tarreaub6fb4202008-07-20 11:18:28 +020071/* wait for more data as long as possible, then return TRUE. This should be
72 * used with content inspection.
73 */
74static int
75acl_fetch_wait_end(struct proxy *px, struct session *l4, void *l7, int dir,
76 struct acl_expr *expr, struct acl_test *test)
77{
78 if (dir & ACL_PARTIAL) {
79 test->flags |= ACL_TEST_F_MAY_CHANGE;
80 return 0;
81 }
82 test->flags |= ACL_TEST_F_SET_RES_PASS;
83 return 1;
84}
85
Willy Tarreau58393e12008-07-20 10:39:22 +020086/* force FALSE to be returned at the fetch level */
Willy Tarreaua5909832007-06-17 20:40:25 +020087static int
Willy Tarreau58393e12008-07-20 10:39:22 +020088acl_fetch_false(struct proxy *px, struct session *l4, void *l7, int dir,
89 struct acl_expr *expr, struct acl_test *test)
Willy Tarreaua84d3742007-05-07 00:36:48 +020090{
Willy Tarreau58393e12008-07-20 10:39:22 +020091 test->flags |= ACL_TEST_F_SET_RES_FAIL;
Willy Tarreaua84d3742007-05-07 00:36:48 +020092 return 1;
93}
94
Willy Tarreau58393e12008-07-20 10:39:22 +020095
96/*
97 * These functions are exported and may be used by any other component.
98 */
99
100/* ignore the current line */
101int acl_parse_nothing(const char **text, struct acl_pattern *pattern, int *opaque)
Willy Tarreaua5909832007-06-17 20:40:25 +0200102{
Willy Tarreau58393e12008-07-20 10:39:22 +0200103 return 1;
104}
105
106/* always fake a data retrieval */
107int acl_fetch_nothing(struct proxy *px, struct session *l4, void *l7, int dir,
108 struct acl_expr *expr, struct acl_test *test)
109{
110 return 1;
Willy Tarreaua5909832007-06-17 20:40:25 +0200111}
112
113/* always return false */
Willy Tarreau58393e12008-07-20 10:39:22 +0200114int acl_match_nothing(struct acl_test *test, struct acl_pattern *pattern)
Willy Tarreaua5909832007-06-17 20:40:25 +0200115{
Willy Tarreau11382812008-07-09 16:18:21 +0200116 return ACL_PAT_FAIL;
Willy Tarreaua5909832007-06-17 20:40:25 +0200117}
118
119
Willy Tarreaua84d3742007-05-07 00:36:48 +0200120/* NB: For two strings to be identical, it is required that their lengths match */
121int acl_match_str(struct acl_test *test, struct acl_pattern *pattern)
122{
Willy Tarreauc8d7c962007-06-17 08:20:33 +0200123 int icase;
124
Willy Tarreaua84d3742007-05-07 00:36:48 +0200125 if (pattern->len != test->len)
Willy Tarreau11382812008-07-09 16:18:21 +0200126 return ACL_PAT_FAIL;
Willy Tarreauc8d7c962007-06-17 08:20:33 +0200127
128 icase = pattern->flags & ACL_PAT_F_IGNORE_CASE;
129 if ((icase && strncasecmp(pattern->ptr.str, test->ptr, test->len) == 0) ||
130 (!icase && strncmp(pattern->ptr.str, test->ptr, test->len) == 0))
Willy Tarreau11382812008-07-09 16:18:21 +0200131 return ACL_PAT_PASS;
132 return ACL_PAT_FAIL;
Willy Tarreaua84d3742007-05-07 00:36:48 +0200133}
134
Willy Tarreauc4262962010-05-10 23:42:40 +0200135/* Lookup a string in the expression's pattern tree. The node is returned if it
136 * exists, otherwise NULL.
137 */
138void *acl_lookup_str(struct acl_test *test, struct acl_expr *expr)
139{
140 /* data are stored in a tree */
141 struct ebmb_node *node;
142 char prev;
143
144 /* we may have to force a trailing zero on the test pattern */
145 prev = test->ptr[test->len];
146 if (prev)
147 test->ptr[test->len] = '\0';
148 node = ebst_lookup(&expr->pattern_tree, test->ptr);
149 if (prev)
150 test->ptr[test->len] = prev;
151 return node;
152}
153
Willy Tarreauf3d25982007-05-08 22:45:09 +0200154/* Executes a regex. It needs to change the data. If it is marked READ_ONLY
155 * then it will be allocated and duplicated in place so that others may use
156 * it later on. Note that this is embarrassing because we always try to avoid
157 * allocating memory at run time.
158 */
159int acl_match_reg(struct acl_test *test, struct acl_pattern *pattern)
160{
161 char old_char;
162 int ret;
163
164 if (unlikely(test->flags & ACL_TEST_F_READ_ONLY)) {
165 char *new_str;
166
167 new_str = calloc(1, test->len + 1);
168 if (!new_str)
Willy Tarreau11382812008-07-09 16:18:21 +0200169 return ACL_PAT_FAIL;
Willy Tarreauf3d25982007-05-08 22:45:09 +0200170
171 memcpy(new_str, test->ptr, test->len);
172 new_str[test->len] = 0;
173 if (test->flags & ACL_TEST_F_MUST_FREE)
174 free(test->ptr);
175 test->ptr = new_str;
176 test->flags |= ACL_TEST_F_MUST_FREE;
177 test->flags &= ~ACL_TEST_F_READ_ONLY;
178 }
179
180 old_char = test->ptr[test->len];
181 test->ptr[test->len] = 0;
182
183 if (regexec(pattern->ptr.reg, test->ptr, 0, NULL, 0) == 0)
Willy Tarreau11382812008-07-09 16:18:21 +0200184 ret = ACL_PAT_PASS;
Willy Tarreauf3d25982007-05-08 22:45:09 +0200185 else
Willy Tarreau11382812008-07-09 16:18:21 +0200186 ret = ACL_PAT_FAIL;
Willy Tarreauf3d25982007-05-08 22:45:09 +0200187
188 test->ptr[test->len] = old_char;
189 return ret;
190}
191
Willy Tarreaua84d3742007-05-07 00:36:48 +0200192/* Checks that the pattern matches the beginning of the tested string. */
193int acl_match_beg(struct acl_test *test, struct acl_pattern *pattern)
194{
Willy Tarreauc8d7c962007-06-17 08:20:33 +0200195 int icase;
196
Willy Tarreaua84d3742007-05-07 00:36:48 +0200197 if (pattern->len > test->len)
Willy Tarreau11382812008-07-09 16:18:21 +0200198 return ACL_PAT_FAIL;
Willy Tarreauc8d7c962007-06-17 08:20:33 +0200199
200 icase = pattern->flags & ACL_PAT_F_IGNORE_CASE;
201 if ((icase && strncasecmp(pattern->ptr.str, test->ptr, pattern->len) != 0) ||
202 (!icase && strncmp(pattern->ptr.str, test->ptr, pattern->len) != 0))
Willy Tarreau11382812008-07-09 16:18:21 +0200203 return ACL_PAT_FAIL;
204 return ACL_PAT_PASS;
Willy Tarreaua84d3742007-05-07 00:36:48 +0200205}
206
207/* Checks that the pattern matches the end of the tested string. */
208int acl_match_end(struct acl_test *test, struct acl_pattern *pattern)
209{
Willy Tarreauc8d7c962007-06-17 08:20:33 +0200210 int icase;
211
Willy Tarreaua84d3742007-05-07 00:36:48 +0200212 if (pattern->len > test->len)
Willy Tarreau11382812008-07-09 16:18:21 +0200213 return ACL_PAT_FAIL;
Willy Tarreauc8d7c962007-06-17 08:20:33 +0200214 icase = pattern->flags & ACL_PAT_F_IGNORE_CASE;
215 if ((icase && strncasecmp(pattern->ptr.str, test->ptr + test->len - pattern->len, pattern->len) != 0) ||
216 (!icase && strncmp(pattern->ptr.str, test->ptr + test->len - pattern->len, pattern->len) != 0))
Willy Tarreau11382812008-07-09 16:18:21 +0200217 return ACL_PAT_FAIL;
218 return ACL_PAT_PASS;
Willy Tarreaua84d3742007-05-07 00:36:48 +0200219}
220
221/* Checks that the pattern is included inside the tested string.
222 * NB: Suboptimal, should be rewritten using a Boyer-Moore method.
223 */
224int acl_match_sub(struct acl_test *test, struct acl_pattern *pattern)
225{
Willy Tarreauc8d7c962007-06-17 08:20:33 +0200226 int icase;
Willy Tarreaua84d3742007-05-07 00:36:48 +0200227 char *end;
228 char *c;
229
230 if (pattern->len > test->len)
Willy Tarreau11382812008-07-09 16:18:21 +0200231 return ACL_PAT_FAIL;
Willy Tarreaua84d3742007-05-07 00:36:48 +0200232
233 end = test->ptr + test->len - pattern->len;
Willy Tarreauc8d7c962007-06-17 08:20:33 +0200234 icase = pattern->flags & ACL_PAT_F_IGNORE_CASE;
235 if (icase) {
236 for (c = test->ptr; c <= end; c++) {
237 if (tolower(*c) != tolower(*pattern->ptr.str))
238 continue;
239 if (strncasecmp(pattern->ptr.str, c, pattern->len) == 0)
Willy Tarreau11382812008-07-09 16:18:21 +0200240 return ACL_PAT_PASS;
Willy Tarreauc8d7c962007-06-17 08:20:33 +0200241 }
242 } else {
243 for (c = test->ptr; c <= end; c++) {
244 if (*c != *pattern->ptr.str)
245 continue;
246 if (strncmp(pattern->ptr.str, c, pattern->len) == 0)
Willy Tarreau11382812008-07-09 16:18:21 +0200247 return ACL_PAT_PASS;
Willy Tarreauc8d7c962007-06-17 08:20:33 +0200248 }
Willy Tarreaua84d3742007-05-07 00:36:48 +0200249 }
Willy Tarreau11382812008-07-09 16:18:21 +0200250 return ACL_PAT_FAIL;
Willy Tarreaua84d3742007-05-07 00:36:48 +0200251}
252
253/* This one is used by other real functions. It checks that the pattern is
254 * included inside the tested string, but enclosed between the specified
255 * delimitor, or a '/' or a '?' or at the beginning or end of the string.
Willy Tarreauc8d7c962007-06-17 08:20:33 +0200256 * The delimitor is stripped at the beginning or end of the pattern.
Willy Tarreaua84d3742007-05-07 00:36:48 +0200257 */
258static int match_word(struct acl_test *test, struct acl_pattern *pattern, char delim)
259{
Willy Tarreauc8d7c962007-06-17 08:20:33 +0200260 int may_match, icase;
Willy Tarreaua84d3742007-05-07 00:36:48 +0200261 char *c, *end;
262 char *ps;
263 int pl;
264
265 pl = pattern->len;
266 ps = pattern->ptr.str;
Willy Tarreauc8d7c962007-06-17 08:20:33 +0200267 while (pl > 0 && (*ps == delim || *ps == '/' || *ps == '?')) {
Willy Tarreaua84d3742007-05-07 00:36:48 +0200268 pl--;
269 ps++;
270 }
271
Willy Tarreauc8d7c962007-06-17 08:20:33 +0200272 while (pl > 0 &&
273 (ps[pl - 1] == delim || ps[pl - 1] == '/' || ps[pl - 1] == '?'))
Willy Tarreaua84d3742007-05-07 00:36:48 +0200274 pl--;
275
276 if (pl > test->len)
Willy Tarreau11382812008-07-09 16:18:21 +0200277 return ACL_PAT_FAIL;
Willy Tarreaua84d3742007-05-07 00:36:48 +0200278
279 may_match = 1;
Willy Tarreauc8d7c962007-06-17 08:20:33 +0200280 icase = pattern->flags & ACL_PAT_F_IGNORE_CASE;
Willy Tarreaua84d3742007-05-07 00:36:48 +0200281 end = test->ptr + test->len - pl;
282 for (c = test->ptr; c <= end; c++) {
283 if (*c == '/' || *c == delim || *c == '?') {
284 may_match = 1;
285 continue;
286 }
Willy Tarreaua84d3742007-05-07 00:36:48 +0200287
Willy Tarreauc8d7c962007-06-17 08:20:33 +0200288 if (!may_match)
289 continue;
290
291 if (icase) {
292 if ((tolower(*c) == tolower(*ps)) &&
293 (strncasecmp(ps, c, pl) == 0) &&
294 (c == end || c[pl] == '/' || c[pl] == delim || c[pl] == '?'))
Willy Tarreau11382812008-07-09 16:18:21 +0200295 return ACL_PAT_PASS;
Willy Tarreauc8d7c962007-06-17 08:20:33 +0200296 } else {
297 if ((*c == *ps) &&
298 (strncmp(ps, c, pl) == 0) &&
299 (c == end || c[pl] == '/' || c[pl] == delim || c[pl] == '?'))
Willy Tarreau11382812008-07-09 16:18:21 +0200300 return ACL_PAT_PASS;
Willy Tarreauc8d7c962007-06-17 08:20:33 +0200301 }
Willy Tarreaua84d3742007-05-07 00:36:48 +0200302 may_match = 0;
303 }
Willy Tarreau11382812008-07-09 16:18:21 +0200304 return ACL_PAT_FAIL;
Willy Tarreaua84d3742007-05-07 00:36:48 +0200305}
306
307/* Checks that the pattern is included inside the tested string, but enclosed
308 * between slashes or at the beginning or end of the string. Slashes at the
309 * beginning or end of the pattern are ignored.
310 */
311int acl_match_dir(struct acl_test *test, struct acl_pattern *pattern)
312{
313 return match_word(test, pattern, '/');
314}
315
316/* Checks that the pattern is included inside the tested string, but enclosed
317 * between dots or at the beginning or end of the string. Dots at the beginning
318 * or end of the pattern are ignored.
319 */
320int acl_match_dom(struct acl_test *test, struct acl_pattern *pattern)
321{
322 return match_word(test, pattern, '.');
323}
324
325/* Checks that the integer in <test> is included between min and max */
Willy Tarreauae8b7962007-06-09 23:10:04 +0200326int acl_match_int(struct acl_test *test, struct acl_pattern *pattern)
Willy Tarreaua84d3742007-05-07 00:36:48 +0200327{
Willy Tarreauae8b7962007-06-09 23:10:04 +0200328 if ((!pattern->val.range.min_set || pattern->val.range.min <= test->i) &&
329 (!pattern->val.range.max_set || test->i <= pattern->val.range.max))
Willy Tarreau11382812008-07-09 16:18:21 +0200330 return ACL_PAT_PASS;
331 return ACL_PAT_FAIL;
Willy Tarreaua84d3742007-05-07 00:36:48 +0200332}
333
Willy Tarreaua67fad92007-05-08 19:50:09 +0200334int acl_match_ip(struct acl_test *test, struct acl_pattern *pattern)
335{
336 struct in_addr *s;
337
338 if (test->i != AF_INET)
Willy Tarreau11382812008-07-09 16:18:21 +0200339 return ACL_PAT_FAIL;
Willy Tarreaua67fad92007-05-08 19:50:09 +0200340
341 s = (void *)test->ptr;
342 if (((s->s_addr ^ pattern->val.ipv4.addr.s_addr) & pattern->val.ipv4.mask.s_addr) == 0)
Willy Tarreau11382812008-07-09 16:18:21 +0200343 return ACL_PAT_PASS;
344 return ACL_PAT_FAIL;
Willy Tarreaua67fad92007-05-08 19:50:09 +0200345}
346
Willy Tarreaub337b532010-05-13 20:03:41 +0200347/* Lookup an IPv4 address in the expression's pattern tree using the longest
348 * match method. The node is returned if it exists, otherwise NULL.
349 */
350void *acl_lookup_ip(struct acl_test *test, struct acl_expr *expr)
351{
352 struct in_addr *s;
353
354 if (test->i != AF_INET)
355 return ACL_PAT_FAIL;
356
357 s = (void *)test->ptr;
358
359 return ebmb_lookup_longest(&expr->pattern_tree, &s->s_addr);
360}
361
Willy Tarreaua84d3742007-05-07 00:36:48 +0200362/* Parse a string. It is allocated and duplicated. */
Willy Tarreauae8b7962007-06-09 23:10:04 +0200363int acl_parse_str(const char **text, struct acl_pattern *pattern, int *opaque)
Willy Tarreaua84d3742007-05-07 00:36:48 +0200364{
365 int len;
366
Willy Tarreauae8b7962007-06-09 23:10:04 +0200367 len = strlen(*text);
Willy Tarreauc4262962010-05-10 23:42:40 +0200368
369 if (pattern->flags & ACL_PAT_F_TREE_OK) {
370 /* we're allowed to put the data in a tree whose root is pointed
371 * to by val.tree.
372 */
373 struct ebmb_node *node;
374
375 node = calloc(1, sizeof(*node) + len + 1);
376 if (!node)
377 return 0;
378 memcpy(node->key, *text, len + 1);
379 if (ebst_insert(pattern->val.tree, node) != node)
380 free(node); /* was a duplicate */
381 pattern->flags |= ACL_PAT_F_TREE; /* this pattern now contains a tree */
382 return 1;
383 }
384
Willy Tarreauae8b7962007-06-09 23:10:04 +0200385 pattern->ptr.str = strdup(*text);
Willy Tarreaua84d3742007-05-07 00:36:48 +0200386 if (!pattern->ptr.str)
387 return 0;
388 pattern->len = len;
389 return 1;
390}
391
Krzysztof Piotr Oledzkif9423ae2010-01-29 19:26:18 +0100392/* Parse and concatenate all further strings into one. */
393int
394acl_parse_strcat(const char **text, struct acl_pattern *pattern, int *opaque)
395{
396
397 int len = 0, i;
398 char *s;
399
400 for (i = 0; *text[i]; i++)
401 len += strlen(text[i])+1;
402
403 pattern->ptr.str = s = calloc(1, len);
404 if (!pattern->ptr.str)
405 return 0;
406
407 for (i = 0; *text[i]; i++)
408 s += sprintf(s, i?" %s":"%s", text[i]);
409
410 pattern->len = len;
411
412 return i;
413}
414
Krzysztof Piotr Oledzki8001d612008-05-31 13:53:23 +0200415/* Free data allocated by acl_parse_reg */
416static void acl_free_reg(void *ptr) {
417
418 regfree((regex_t *)ptr);
419}
420
Willy Tarreauf3d25982007-05-08 22:45:09 +0200421/* Parse a regex. It is allocated. */
Willy Tarreauae8b7962007-06-09 23:10:04 +0200422int acl_parse_reg(const char **text, struct acl_pattern *pattern, int *opaque)
Willy Tarreauf3d25982007-05-08 22:45:09 +0200423{
424 regex_t *preg;
Willy Tarreauc8d7c962007-06-17 08:20:33 +0200425 int icase;
Willy Tarreauf3d25982007-05-08 22:45:09 +0200426
427 preg = calloc(1, sizeof(regex_t));
428
429 if (!preg)
430 return 0;
431
Willy Tarreauc8d7c962007-06-17 08:20:33 +0200432 icase = (pattern->flags & ACL_PAT_F_IGNORE_CASE) ? REG_ICASE : 0;
433 if (regcomp(preg, *text, REG_EXTENDED | REG_NOSUB | icase) != 0) {
Willy Tarreauf3d25982007-05-08 22:45:09 +0200434 free(preg);
435 return 0;
436 }
437
438 pattern->ptr.reg = preg;
Krzysztof Piotr Oledzki8001d612008-05-31 13:53:23 +0200439 pattern->freeptrbuf = &acl_free_reg;
Willy Tarreauf3d25982007-05-08 22:45:09 +0200440 return 1;
441}
442
Willy Tarreauae8b7962007-06-09 23:10:04 +0200443/* Parse a range of positive integers delimited by either ':' or '-'. If only
444 * one integer is read, it is set as both min and max. An operator may be
445 * specified as the prefix, among this list of 5 :
446 *
447 * 0:eq, 1:gt, 2:ge, 3:lt, 4:le
448 *
449 * The default operator is "eq". It supports range matching. Ranges are
450 * rejected for other operators. The operator may be changed at any time.
451 * The operator is stored in the 'opaque' argument.
452 *
Willy Tarreaua84d3742007-05-07 00:36:48 +0200453 */
Willy Tarreauae8b7962007-06-09 23:10:04 +0200454int acl_parse_int(const char **text, struct acl_pattern *pattern, int *opaque)
Willy Tarreaua84d3742007-05-07 00:36:48 +0200455{
Willy Tarreauae8b7962007-06-09 23:10:04 +0200456 signed long long i;
457 unsigned int j, last, skip = 0;
458 const char *ptr = *text;
459
460
Willy Tarreau8f8e6452007-06-17 21:51:38 +0200461 while (!isdigit((unsigned char)*ptr)) {
Willy Tarreauae8b7962007-06-09 23:10:04 +0200462 if (strcmp(ptr, "eq") == 0) *opaque = 0;
463 else if (strcmp(ptr, "gt") == 0) *opaque = 1;
464 else if (strcmp(ptr, "ge") == 0) *opaque = 2;
465 else if (strcmp(ptr, "lt") == 0) *opaque = 3;
466 else if (strcmp(ptr, "le") == 0) *opaque = 4;
467 else
468 return 0;
469
470 skip++;
471 ptr = text[skip];
472 }
Willy Tarreaua84d3742007-05-07 00:36:48 +0200473
474 last = i = 0;
475 while (1) {
Willy Tarreauae8b7962007-06-09 23:10:04 +0200476 j = *ptr++;
Willy Tarreaua84d3742007-05-07 00:36:48 +0200477 if ((j == '-' || j == ':') && !last) {
478 last++;
479 pattern->val.range.min = i;
480 i = 0;
481 continue;
482 }
483 j -= '0';
484 if (j > 9)
485 // also catches the terminating zero
486 break;
487 i *= 10;
488 i += j;
489 }
Willy Tarreauae8b7962007-06-09 23:10:04 +0200490
491 if (last && *opaque >= 1 && *opaque <= 4)
492 /* having a range with a min or a max is absurd */
493 return 0;
494
Willy Tarreaua84d3742007-05-07 00:36:48 +0200495 if (!last)
496 pattern->val.range.min = i;
497 pattern->val.range.max = i;
Willy Tarreauae8b7962007-06-09 23:10:04 +0200498
499 switch (*opaque) {
500 case 0: /* eq */
501 pattern->val.range.min_set = 1;
502 pattern->val.range.max_set = 1;
503 break;
504 case 1: /* gt */
505 pattern->val.range.min++; /* gt = ge + 1 */
506 case 2: /* ge */
507 pattern->val.range.min_set = 1;
508 pattern->val.range.max_set = 0;
509 break;
510 case 3: /* lt */
511 pattern->val.range.max--; /* lt = le - 1 */
512 case 4: /* le */
513 pattern->val.range.min_set = 0;
514 pattern->val.range.max_set = 1;
515 break;
516 }
517 return skip + 1;
Willy Tarreaua84d3742007-05-07 00:36:48 +0200518}
519
Willy Tarreau4a26d2f2008-07-15 16:05:33 +0200520/* Parse a range of positive 2-component versions delimited by either ':' or
521 * '-'. The version consists in a major and a minor, both of which must be
522 * smaller than 65536, because internally they will be represented as a 32-bit
523 * integer.
524 * If only one version is read, it is set as both min and max. Just like for
525 * pure integers, an operator may be specified as the prefix, among this list
526 * of 5 :
527 *
528 * 0:eq, 1:gt, 2:ge, 3:lt, 4:le
529 *
530 * The default operator is "eq". It supports range matching. Ranges are
531 * rejected for other operators. The operator may be changed at any time.
532 * The operator is stored in the 'opaque' argument. This allows constructs
533 * such as the following one :
534 *
535 * acl obsolete_ssl ssl_req_proto lt 3
536 * acl unsupported_ssl ssl_req_proto gt 3.1
537 * acl valid_ssl ssl_req_proto 3.0-3.1
538 *
539 */
540int acl_parse_dotted_ver(const char **text, struct acl_pattern *pattern, int *opaque)
541{
542 signed long long i;
543 unsigned int j, last, skip = 0;
544 const char *ptr = *text;
545
546
547 while (!isdigit((unsigned char)*ptr)) {
548 if (strcmp(ptr, "eq") == 0) *opaque = 0;
549 else if (strcmp(ptr, "gt") == 0) *opaque = 1;
550 else if (strcmp(ptr, "ge") == 0) *opaque = 2;
551 else if (strcmp(ptr, "lt") == 0) *opaque = 3;
552 else if (strcmp(ptr, "le") == 0) *opaque = 4;
553 else
554 return 0;
555
556 skip++;
557 ptr = text[skip];
558 }
559
560 last = i = 0;
561 while (1) {
562 j = *ptr++;
563 if (j == '.') {
564 /* minor part */
565 if (i >= 65536)
566 return 0;
567 i <<= 16;
568 continue;
569 }
570 if ((j == '-' || j == ':') && !last) {
571 last++;
572 if (i < 65536)
573 i <<= 16;
574 pattern->val.range.min = i;
575 i = 0;
576 continue;
577 }
578 j -= '0';
579 if (j > 9)
580 // also catches the terminating zero
581 break;
582 i = (i & 0xFFFF0000) + (i & 0xFFFF) * 10;
583 i += j;
584 }
585
586 /* if we only got a major version, let's shift it now */
587 if (i < 65536)
588 i <<= 16;
589
590 if (last && *opaque >= 1 && *opaque <= 4)
591 /* having a range with a min or a max is absurd */
592 return 0;
593
594 if (!last)
595 pattern->val.range.min = i;
596 pattern->val.range.max = i;
597
598 switch (*opaque) {
599 case 0: /* eq */
600 pattern->val.range.min_set = 1;
601 pattern->val.range.max_set = 1;
602 break;
603 case 1: /* gt */
604 pattern->val.range.min++; /* gt = ge + 1 */
605 case 2: /* ge */
606 pattern->val.range.min_set = 1;
607 pattern->val.range.max_set = 0;
608 break;
609 case 3: /* lt */
610 pattern->val.range.max--; /* lt = le - 1 */
611 case 4: /* le */
612 pattern->val.range.min_set = 0;
613 pattern->val.range.max_set = 1;
614 break;
615 }
616 return skip + 1;
617}
618
Willy Tarreaua67fad92007-05-08 19:50:09 +0200619/* Parse an IP address and an optional mask in the form addr[/mask].
620 * The addr may either be an IPv4 address or a hostname. The mask
621 * may either be a dotted mask or a number of bits. Returns 1 if OK,
622 * otherwise 0.
623 */
Willy Tarreauae8b7962007-06-09 23:10:04 +0200624int acl_parse_ip(const char **text, struct acl_pattern *pattern, int *opaque)
Willy Tarreaua67fad92007-05-08 19:50:09 +0200625{
Willy Tarreaub337b532010-05-13 20:03:41 +0200626 struct eb_root *tree = NULL;
627 if (pattern->flags & ACL_PAT_F_TREE_OK)
628 tree = pattern->val.tree;
629
630 if (str2net(*text, &pattern->val.ipv4.addr, &pattern->val.ipv4.mask)) {
631 unsigned int mask = ntohl(pattern->val.ipv4.mask.s_addr);
632 struct ebmb_node *node;
633 /* check if the mask is contiguous so that we can insert the
634 * network into the tree. A continuous mask has only ones on
635 * the left. This means that this mask + its lower bit added
636 * once again is null.
637 */
638 if (mask + (mask & -mask) == 0 && tree) {
639 mask = mask ? 33 - flsnz(mask & -mask) : 0; /* equals cidr value */
640 /* FIXME: insert <addr>/<mask> into the tree here */
641 node = calloc(1, sizeof(*node) + 4); /* reserve 4 bytes for IPv4 address */
642 if (!node)
643 return 0;
644 memcpy(node->key, &pattern->val.ipv4.addr, 4); /* network byte order */
645 node->node.pfx = mask;
646 if (ebmb_insert_prefix(tree, node, 4) != node)
647 free(node); /* was a duplicate */
648 pattern->flags |= ACL_PAT_F_TREE;
649 return 1;
650 }
Willy Tarreauae8b7962007-06-09 23:10:04 +0200651 return 1;
Willy Tarreaub337b532010-05-13 20:03:41 +0200652 }
Willy Tarreauae8b7962007-06-09 23:10:04 +0200653 else
654 return 0;
Willy Tarreaua67fad92007-05-08 19:50:09 +0200655}
656
Willy Tarreaua84d3742007-05-07 00:36:48 +0200657/*
658 * Registers the ACL keyword list <kwl> as a list of valid keywords for next
659 * parsing sessions.
660 */
661void acl_register_keywords(struct acl_kw_list *kwl)
662{
663 LIST_ADDQ(&acl_keywords.list, &kwl->list);
664}
665
666/*
667 * Unregisters the ACL keyword list <kwl> from the list of valid keywords.
668 */
669void acl_unregister_keywords(struct acl_kw_list *kwl)
670{
671 LIST_DEL(&kwl->list);
672 LIST_INIT(&kwl->list);
673}
674
675/* Return a pointer to the ACL <name> within the list starting at <head>, or
676 * NULL if not found.
677 */
678struct acl *find_acl_by_name(const char *name, struct list *head)
679{
680 struct acl *acl;
681 list_for_each_entry(acl, head, list) {
682 if (strcmp(acl->name, name) == 0)
683 return acl;
684 }
685 return NULL;
686}
687
688/* Return a pointer to the ACL keyword <kw>, or NULL if not found. Note that if
689 * <kw> contains an opening parenthesis, only the left part of it is checked.
690 */
691struct acl_keyword *find_acl_kw(const char *kw)
692{
693 int index;
694 const char *kwend;
695 struct acl_kw_list *kwl;
696
697 kwend = strchr(kw, '(');
698 if (!kwend)
699 kwend = kw + strlen(kw);
700
701 list_for_each_entry(kwl, &acl_keywords.list, list) {
702 for (index = 0; kwl->kw[index].kw != NULL; index++) {
703 if ((strncmp(kwl->kw[index].kw, kw, kwend - kw) == 0) &&
704 kwl->kw[index].kw[kwend-kw] == 0)
705 return &kwl->kw[index];
706 }
707 }
708 return NULL;
709}
710
711static void free_pattern(struct acl_pattern *pat)
712{
Krzysztof Piotr Oledzki8001d612008-05-31 13:53:23 +0200713
714 if (pat->ptr.ptr) {
715 if (pat->freeptrbuf)
716 pat->freeptrbuf(pat->ptr.ptr);
717
Willy Tarreaua84d3742007-05-07 00:36:48 +0200718 free(pat->ptr.ptr);
Krzysztof Piotr Oledzki8001d612008-05-31 13:53:23 +0200719 }
720
Willy Tarreaua84d3742007-05-07 00:36:48 +0200721 free(pat);
722}
723
724static void free_pattern_list(struct list *head)
725{
726 struct acl_pattern *pat, *tmp;
727 list_for_each_entry_safe(pat, tmp, head, list)
728 free_pattern(pat);
729}
730
Willy Tarreaue56cda92010-05-11 23:25:05 +0200731static void free_pattern_tree(struct eb_root *root)
732{
733 struct eb_node *node, *next;
734 node = eb_first(root);
735 while (node) {
736 next = eb_next(node);
737 free(node);
738 node = next;
739 }
740}
741
Willy Tarreaua84d3742007-05-07 00:36:48 +0200742static struct acl_expr *prune_acl_expr(struct acl_expr *expr)
743{
744 free_pattern_list(&expr->patterns);
Willy Tarreaue56cda92010-05-11 23:25:05 +0200745 free_pattern_tree(&expr->pattern_tree);
Willy Tarreaua84d3742007-05-07 00:36:48 +0200746 LIST_INIT(&expr->patterns);
Krzysztof Piotr Oledzkif9423ae2010-01-29 19:26:18 +0100747 if (expr->arg_len && expr->arg.str)
Willy Tarreaua84d3742007-05-07 00:36:48 +0200748 free(expr->arg.str);
749 expr->kw->use_cnt--;
750 return expr;
751}
752
Willy Tarreau2b5285d2010-05-09 23:45:24 +0200753static int acl_read_patterns_from_file( struct acl_keyword *aclkw,
754 struct acl_expr *expr,
755 const char *filename, int patflags)
756{
757 FILE *file;
758 char *c;
759 const char *args[2];
760 struct acl_pattern *pattern;
761 int opaque;
762
763 file = fopen(filename, "r");
764 if (!file)
765 return 0;
766
767 /* now parse all patterns. The file may contain only one pattern per
768 * line. If the line contains spaces, they will be part of the pattern.
769 * The pattern stops at the first CR, LF or EOF encountered.
770 */
771 opaque = 0;
Willy Tarreaue56cda92010-05-11 23:25:05 +0200772 pattern = NULL;
Willy Tarreau2b5285d2010-05-09 23:45:24 +0200773 args[1] = "";
774 while (fgets(trash, sizeof(trash), file) != NULL) {
775
776 c = trash;
Willy Tarreau58215a02010-05-13 22:07:43 +0200777
778 /* ignore lines beginning with a dash */
779 if (*c == '#')
780 continue;
781
782 /* strip leading spaces and tabs */
783 while (*c == ' ' || *c == '\t')
784 c++;
785
786 /* empty lines are ignored too */
787 if (!*c)
788 continue;
789
790 args[0] = c;
Willy Tarreau2b5285d2010-05-09 23:45:24 +0200791 while (*c && *c != '\n' && *c != '\r')
792 c++;
793 *c = 0;
794
Willy Tarreaue56cda92010-05-11 23:25:05 +0200795 /* we keep the previous pattern along iterations as long as it's not used */
796 if (!pattern)
797 pattern = (struct acl_pattern *)malloc(sizeof(*pattern));
Willy Tarreau2b5285d2010-05-09 23:45:24 +0200798 if (!pattern)
799 goto out_close;
Willy Tarreaue56cda92010-05-11 23:25:05 +0200800
801 memset(pattern, 0, sizeof(*pattern));
Willy Tarreau2b5285d2010-05-09 23:45:24 +0200802 pattern->flags = patflags;
803
Willy Tarreaue56cda92010-05-11 23:25:05 +0200804 if ((aclkw->requires & ACL_MAY_LOOKUP) && !(pattern->flags & ACL_PAT_F_IGNORE_CASE)) {
805 /* we pre-set the data pointer to the tree's head so that functions
806 * which are able to insert in a tree know where to do that.
807 */
808 pattern->flags |= ACL_PAT_F_TREE_OK;
809 pattern->val.tree = &expr->pattern_tree;
810 }
811
Willy Tarreau2b5285d2010-05-09 23:45:24 +0200812 if (!aclkw->parse(args, pattern, &opaque))
813 goto out_free_pattern;
Willy Tarreaue56cda92010-05-11 23:25:05 +0200814
815 /* if the parser did not feed the tree, let's chain the pattern to the list */
816 if (!(pattern->flags & ACL_PAT_F_TREE)) {
817 LIST_ADDQ(&expr->patterns, &pattern->list);
818 pattern = NULL; /* get a new one */
819 }
Willy Tarreau2b5285d2010-05-09 23:45:24 +0200820 }
Willy Tarreaue56cda92010-05-11 23:25:05 +0200821 if (pattern)
822 free_pattern(pattern);
Willy Tarreau2b5285d2010-05-09 23:45:24 +0200823 return 1;
824
825 out_free_pattern:
826 free_pattern(pattern);
827 out_close:
828 fclose(file);
829 return 0;
830}
831
Willy Tarreaua84d3742007-05-07 00:36:48 +0200832/* Parse an ACL expression starting at <args>[0], and return it.
833 * Right now, the only accepted syntax is :
834 * <subject> [<value>...]
835 */
836struct acl_expr *parse_acl_expr(const char **args)
837{
838 __label__ out_return, out_free_expr, out_free_pattern;
839 struct acl_expr *expr;
840 struct acl_keyword *aclkw;
841 struct acl_pattern *pattern;
Willy Tarreauc8d7c962007-06-17 08:20:33 +0200842 int opaque, patflags;
Willy Tarreaua84d3742007-05-07 00:36:48 +0200843 const char *arg;
844
845 aclkw = find_acl_kw(args[0]);
846 if (!aclkw || !aclkw->parse)
847 goto out_return;
848
849 expr = (struct acl_expr *)calloc(1, sizeof(*expr));
850 if (!expr)
851 goto out_return;
852
853 expr->kw = aclkw;
854 aclkw->use_cnt++;
855 LIST_INIT(&expr->patterns);
Willy Tarreaue56cda92010-05-11 23:25:05 +0200856 expr->pattern_tree = EB_ROOT_UNIQUE;
Willy Tarreaua84d3742007-05-07 00:36:48 +0200857 expr->arg.str = NULL;
Willy Tarreaubb768912007-06-10 11:17:01 +0200858 expr->arg_len = 0;
Willy Tarreaua84d3742007-05-07 00:36:48 +0200859
860 arg = strchr(args[0], '(');
861 if (arg != NULL) {
862 char *end, *arg2;
863 /* there is an argument in the form "subject(arg)" */
864 arg++;
865 end = strchr(arg, ')');
866 if (!end)
867 goto out_free_expr;
Willy Tarreauac778f52010-01-26 19:02:46 +0100868 arg2 = my_strndup(arg, end - arg);
Willy Tarreau1edb1442010-01-27 20:13:38 +0100869 if (!arg2)
Willy Tarreaua84d3742007-05-07 00:36:48 +0200870 goto out_free_expr;
Willy Tarreaubb768912007-06-10 11:17:01 +0200871 expr->arg_len = end - arg;
Willy Tarreaua84d3742007-05-07 00:36:48 +0200872 expr->arg.str = arg2;
873 }
874
Willy Tarreaua84d3742007-05-07 00:36:48 +0200875 args++;
Willy Tarreauc8d7c962007-06-17 08:20:33 +0200876
877 /* check for options before patterns. Supported options are :
878 * -i : ignore case for all patterns by default
879 * -f : read patterns from those files
880 * -- : everything after this is not an option
881 */
882 patflags = 0;
883 while (**args == '-') {
884 if ((*args)[1] == 'i')
885 patflags |= ACL_PAT_F_IGNORE_CASE;
Willy Tarreau2b5285d2010-05-09 23:45:24 +0200886 else if ((*args)[1] == 'f') {
887 if (!acl_read_patterns_from_file(aclkw, expr, args[1], patflags | ACL_PAT_F_FROM_FILE))
888 goto out_free_expr;
889 args++;
890 }
Willy Tarreauc8d7c962007-06-17 08:20:33 +0200891 else if ((*args)[1] == '-') {
892 args++;
893 break;
894 }
895 else
896 break;
897 args++;
898 }
899
900 /* now parse all patterns */
Willy Tarreauae8b7962007-06-09 23:10:04 +0200901 opaque = 0;
Willy Tarreaua84d3742007-05-07 00:36:48 +0200902 while (**args) {
Willy Tarreauae8b7962007-06-09 23:10:04 +0200903 int ret;
Willy Tarreaua84d3742007-05-07 00:36:48 +0200904 pattern = (struct acl_pattern *)calloc(1, sizeof(*pattern));
905 if (!pattern)
906 goto out_free_expr;
Willy Tarreauc8d7c962007-06-17 08:20:33 +0200907 pattern->flags = patflags;
908
Willy Tarreauae8b7962007-06-09 23:10:04 +0200909 ret = aclkw->parse(args, pattern, &opaque);
910 if (!ret)
Willy Tarreaua84d3742007-05-07 00:36:48 +0200911 goto out_free_pattern;
912 LIST_ADDQ(&expr->patterns, &pattern->list);
Willy Tarreauae8b7962007-06-09 23:10:04 +0200913 args += ret;
Willy Tarreaua84d3742007-05-07 00:36:48 +0200914 }
915
916 return expr;
917
918 out_free_pattern:
919 free_pattern(pattern);
920 out_free_expr:
921 prune_acl_expr(expr);
922 free(expr);
923 out_return:
924 return NULL;
925}
926
Krzysztof Piotr Oledzkia643baf2008-05-29 23:53:44 +0200927/* Purge everything in the acl <acl>, then return <acl>. */
928struct acl *prune_acl(struct acl *acl) {
929
930 struct acl_expr *expr, *exprb;
931
932 free(acl->name);
933
934 list_for_each_entry_safe(expr, exprb, &acl->expr, list) {
935 LIST_DEL(&expr->list);
936 prune_acl_expr(expr);
937 free(expr);
938 }
939
940 return acl;
941}
942
Willy Tarreaua84d3742007-05-07 00:36:48 +0200943/* Parse an ACL with the name starting at <args>[0], and with a list of already
944 * known ACLs in <acl>. If the ACL was not in the list, it will be added.
Willy Tarreau2a56c5e2010-03-15 16:13:29 +0100945 * A pointer to that ACL is returned. If the ACL has an empty name, then it's
946 * an anonymous one and it won't be merged with any other one.
Willy Tarreaua84d3742007-05-07 00:36:48 +0200947 *
948 * args syntax: <aclname> <acl_expr>
949 */
950struct acl *parse_acl(const char **args, struct list *known_acl)
951{
952 __label__ out_return, out_free_acl_expr, out_free_name;
953 struct acl *cur_acl;
954 struct acl_expr *acl_expr;
955 char *name;
956
Willy Tarreau2a56c5e2010-03-15 16:13:29 +0100957 if (**args && invalid_char(*args))
Willy Tarreau2e74c3f2007-12-02 18:45:09 +0100958 goto out_return;
959
Willy Tarreaua84d3742007-05-07 00:36:48 +0200960 acl_expr = parse_acl_expr(args + 1);
961 if (!acl_expr)
962 goto out_return;
963
Willy Tarreau404e8ab2009-07-26 19:40:40 +0200964 /* Check for args beginning with an opening parenthesis just after the
965 * subject, as this is almost certainly a typo. Right now we can only
966 * emit a warning, so let's do so.
967 */
Krzysztof Piotr Oledzki4cdd8312009-10-05 00:23:35 +0200968 if (!strchr(args[1], '(') && *args[2] == '(')
Willy Tarreau404e8ab2009-07-26 19:40:40 +0200969 Warning("parsing acl '%s' :\n"
970 " matching '%s' for pattern '%s' is likely a mistake and probably\n"
971 " not what you want. Maybe you need to remove the extraneous space before '('.\n"
972 " If you are really sure this is not an error, please insert '--' between the\n"
973 " match and the pattern to make this warning message disappear.\n",
974 args[0], args[1], args[2]);
975
Willy Tarreau2a56c5e2010-03-15 16:13:29 +0100976 if (*args[0])
977 cur_acl = find_acl_by_name(args[0], known_acl);
978 else
979 cur_acl = NULL;
980
Willy Tarreaua84d3742007-05-07 00:36:48 +0200981 if (!cur_acl) {
982 name = strdup(args[0]);
983 if (!name)
984 goto out_free_acl_expr;
985 cur_acl = (struct acl *)calloc(1, sizeof(*cur_acl));
986 if (cur_acl == NULL)
987 goto out_free_name;
988
989 LIST_INIT(&cur_acl->expr);
990 LIST_ADDQ(known_acl, &cur_acl->list);
991 cur_acl->name = name;
992 }
993
Willy Tarreaua9802632008-07-25 19:13:19 +0200994 cur_acl->requires |= acl_expr->kw->requires;
Willy Tarreaua84d3742007-05-07 00:36:48 +0200995 LIST_ADDQ(&cur_acl->expr, &acl_expr->list);
996 return cur_acl;
997
998 out_free_name:
999 free(name);
1000 out_free_acl_expr:
1001 prune_acl_expr(acl_expr);
1002 free(acl_expr);
1003 out_return:
1004 return NULL;
1005}
1006
Willy Tarreau16fbe822007-06-17 11:54:31 +02001007/* Some useful ACLs provided by default. Only those used are allocated. */
1008
1009const struct {
1010 const char *name;
1011 const char *expr[4]; /* put enough for longest expression */
1012} default_acl_list[] = {
Willy Tarreau58393e12008-07-20 10:39:22 +02001013 { .name = "TRUE", .expr = {"always_true",""}},
1014 { .name = "FALSE", .expr = {"always_false",""}},
Willy Tarreau16fbe822007-06-17 11:54:31 +02001015 { .name = "LOCALHOST", .expr = {"src","127.0.0.1/8",""}},
Willy Tarreau2492d5b2009-07-11 00:06:00 +02001016 { .name = "HTTP", .expr = {"req_proto_http",""}},
Willy Tarreau16fbe822007-06-17 11:54:31 +02001017 { .name = "HTTP_1.0", .expr = {"req_ver","1.0",""}},
1018 { .name = "HTTP_1.1", .expr = {"req_ver","1.1",""}},
1019 { .name = "METH_CONNECT", .expr = {"method","CONNECT",""}},
1020 { .name = "METH_GET", .expr = {"method","GET","HEAD",""}},
1021 { .name = "METH_HEAD", .expr = {"method","HEAD",""}},
1022 { .name = "METH_OPTIONS", .expr = {"method","OPTIONS",""}},
1023 { .name = "METH_POST", .expr = {"method","POST",""}},
1024 { .name = "METH_TRACE", .expr = {"method","TRACE",""}},
1025 { .name = "HTTP_URL_ABS", .expr = {"url_reg","^[^/:]*://",""}},
1026 { .name = "HTTP_URL_SLASH", .expr = {"url_beg","/",""}},
1027 { .name = "HTTP_URL_STAR", .expr = {"url","*",""}},
1028 { .name = "HTTP_CONTENT", .expr = {"hdr_val(content-length)","gt","0",""}},
Emeric Brunbede3d02009-06-30 17:54:00 +02001029 { .name = "RDP_COOKIE", .expr = {"req_rdp_cookie_cnt","gt","0",""}},
Willy Tarreauc6317702008-07-20 09:29:50 +02001030 { .name = "REQ_CONTENT", .expr = {"req_len","gt","0",""}},
Willy Tarreaub6fb4202008-07-20 11:18:28 +02001031 { .name = "WAIT_END", .expr = {"wait_end",""}},
Willy Tarreau16fbe822007-06-17 11:54:31 +02001032 { .name = NULL, .expr = {""}}
1033};
1034
1035/* Find a default ACL from the default_acl list, compile it and return it.
1036 * If the ACL is not found, NULL is returned. In theory, it cannot fail,
1037 * except when default ACLs are broken, in which case it will return NULL.
1038 * If <known_acl> is not NULL, the ACL will be queued at its tail.
1039 */
1040struct acl *find_acl_default(const char *acl_name, struct list *known_acl)
1041{
1042 __label__ out_return, out_free_acl_expr, out_free_name;
1043 struct acl *cur_acl;
1044 struct acl_expr *acl_expr;
1045 char *name;
1046 int index;
1047
1048 for (index = 0; default_acl_list[index].name != NULL; index++) {
1049 if (strcmp(acl_name, default_acl_list[index].name) == 0)
1050 break;
1051 }
1052
1053 if (default_acl_list[index].name == NULL)
1054 return NULL;
1055
1056 acl_expr = parse_acl_expr((const char **)default_acl_list[index].expr);
1057 if (!acl_expr)
1058 goto out_return;
1059
1060 name = strdup(acl_name);
1061 if (!name)
1062 goto out_free_acl_expr;
1063 cur_acl = (struct acl *)calloc(1, sizeof(*cur_acl));
1064 if (cur_acl == NULL)
1065 goto out_free_name;
1066
1067 cur_acl->name = name;
Willy Tarreaua55b7dc2009-07-12 09:21:30 +02001068 cur_acl->requires |= acl_expr->kw->requires;
Willy Tarreau16fbe822007-06-17 11:54:31 +02001069 LIST_INIT(&cur_acl->expr);
1070 LIST_ADDQ(&cur_acl->expr, &acl_expr->list);
1071 if (known_acl)
1072 LIST_ADDQ(known_acl, &cur_acl->list);
1073
1074 return cur_acl;
1075
1076 out_free_name:
1077 free(name);
1078 out_free_acl_expr:
1079 prune_acl_expr(acl_expr);
1080 free(acl_expr);
1081 out_return:
1082 return NULL;
1083}
Willy Tarreaua84d3742007-05-07 00:36:48 +02001084
1085/* Purge everything in the acl_cond <cond>, then return <cond>. */
1086struct acl_cond *prune_acl_cond(struct acl_cond *cond)
1087{
1088 struct acl_term_suite *suite, *tmp_suite;
1089 struct acl_term *term, *tmp_term;
1090
1091 /* iterate through all term suites and free all terms and all suites */
1092 list_for_each_entry_safe(suite, tmp_suite, &cond->suites, list) {
1093 list_for_each_entry_safe(term, tmp_term, &suite->terms, list)
1094 free(term);
1095 free(suite);
1096 }
1097 return cond;
1098}
1099
1100/* Parse an ACL condition starting at <args>[0], relying on a list of already
1101 * known ACLs passed in <known_acl>. The new condition is returned (or NULL in
1102 * case of low memory). Supports multiple conditions separated by "or".
1103 */
1104struct acl_cond *parse_acl_cond(const char **args, struct list *known_acl, int pol)
1105{
1106 __label__ out_return, out_free_suite, out_free_term;
Willy Tarreau74b98a82007-06-16 19:35:18 +02001107 int arg, neg;
Willy Tarreaua84d3742007-05-07 00:36:48 +02001108 const char *word;
1109 struct acl *cur_acl;
1110 struct acl_term *cur_term;
1111 struct acl_term_suite *cur_suite;
1112 struct acl_cond *cond;
1113
1114 cond = (struct acl_cond *)calloc(1, sizeof(*cond));
1115 if (cond == NULL)
1116 goto out_return;
1117
1118 LIST_INIT(&cond->list);
1119 LIST_INIT(&cond->suites);
1120 cond->pol = pol;
1121
1122 cur_suite = NULL;
Willy Tarreau74b98a82007-06-16 19:35:18 +02001123 neg = 0;
Willy Tarreaua84d3742007-05-07 00:36:48 +02001124 for (arg = 0; *args[arg]; arg++) {
1125 word = args[arg];
1126
1127 /* remove as many exclamation marks as we can */
1128 while (*word == '!') {
1129 neg = !neg;
1130 word++;
1131 }
1132
1133 /* an empty word is allowed because we cannot force the user to
1134 * always think about not leaving exclamation marks alone.
1135 */
1136 if (!*word)
1137 continue;
1138
Willy Tarreau16fbe822007-06-17 11:54:31 +02001139 if (strcasecmp(word, "or") == 0 || strcmp(word, "||") == 0) {
Willy Tarreaua84d3742007-05-07 00:36:48 +02001140 /* new term suite */
1141 cur_suite = NULL;
1142 neg = 0;
1143 continue;
1144 }
1145
Willy Tarreau95fa4692010-02-01 13:05:50 +01001146 if (strcmp(word, "{") == 0) {
1147 /* we may have a complete ACL expression between two braces,
1148 * find the last one.
1149 */
1150 int arg_end = arg + 1;
1151 const char **args_new;
1152
1153 while (*args[arg_end] && strcmp(args[arg_end], "}") != 0)
1154 arg_end++;
1155
1156 if (!*args[arg_end])
1157 goto out_free_suite;
1158
1159 args_new = calloc(1, (arg_end - arg + 1) * sizeof(*args_new));
1160 if (!args_new)
1161 goto out_free_suite;
1162
Willy Tarreau2a56c5e2010-03-15 16:13:29 +01001163 args_new[0] = "";
Willy Tarreau95fa4692010-02-01 13:05:50 +01001164 memcpy(args_new + 1, args + arg + 1, (arg_end - arg) * sizeof(*args_new));
1165 args_new[arg_end - arg] = "";
1166 cur_acl = parse_acl(args_new, known_acl);
1167 free(args_new);
1168
1169 if (!cur_acl)
Willy Tarreau16fbe822007-06-17 11:54:31 +02001170 goto out_free_suite;
Willy Tarreau95fa4692010-02-01 13:05:50 +01001171 arg = arg_end;
1172 }
1173 else {
1174 /* search for <word> in the known ACL names. If we do not find
1175 * it, let's look for it in the default ACLs, and if found, add
1176 * it to the list of ACLs of this proxy. This makes it possible
1177 * to override them.
1178 */
1179 cur_acl = find_acl_by_name(word, known_acl);
1180 if (cur_acl == NULL) {
1181 cur_acl = find_acl_default(word, known_acl);
1182 if (cur_acl == NULL)
1183 goto out_free_suite;
1184 }
Willy Tarreau16fbe822007-06-17 11:54:31 +02001185 }
Willy Tarreaua84d3742007-05-07 00:36:48 +02001186
1187 cur_term = (struct acl_term *)calloc(1, sizeof(*cur_term));
1188 if (cur_term == NULL)
1189 goto out_free_suite;
1190
1191 cur_term->acl = cur_acl;
1192 cur_term->neg = neg;
Willy Tarreaua9802632008-07-25 19:13:19 +02001193 cond->requires |= cur_acl->requires;
Willy Tarreaua84d3742007-05-07 00:36:48 +02001194
1195 if (!cur_suite) {
1196 cur_suite = (struct acl_term_suite *)calloc(1, sizeof(*cur_suite));
1197 if (cur_term == NULL)
1198 goto out_free_term;
1199 LIST_INIT(&cur_suite->terms);
1200 LIST_ADDQ(&cond->suites, &cur_suite->list);
1201 }
1202 LIST_ADDQ(&cur_suite->terms, &cur_term->list);
Willy Tarreau74b98a82007-06-16 19:35:18 +02001203 neg = 0;
Willy Tarreaua84d3742007-05-07 00:36:48 +02001204 }
1205
1206 return cond;
1207
1208 out_free_term:
1209 free(cur_term);
1210 out_free_suite:
1211 prune_acl_cond(cond);
1212 free(cond);
1213 out_return:
1214 return NULL;
1215}
1216
Willy Tarreau2bbba412010-01-28 16:48:33 +01001217/* Builds an ACL condition starting at the if/unless keyword. The complete
1218 * condition is returned. NULL is returned in case of error or if the first
1219 * word is neither "if" nor "unless". It automatically sets the file name and
1220 * the line number in the condition for better error reporting, and adds the
1221 * ACL requirements to the proxy's acl_requires.
1222 */
1223struct acl_cond *build_acl_cond(const char *file, int line, struct proxy *px, const char **args)
1224{
1225 int pol = ACL_COND_NONE;
1226 struct acl_cond *cond = NULL;
1227
1228 if (!strcmp(*args, "if")) {
1229 pol = ACL_COND_IF;
1230 args++;
1231 }
1232 else if (!strcmp(*args, "unless")) {
1233 pol = ACL_COND_UNLESS;
1234 args++;
1235 }
1236 else
1237 return NULL;
1238
1239 cond = parse_acl_cond(args, &px->acl, pol);
1240 if (!cond)
1241 return NULL;
1242
1243 cond->file = file;
1244 cond->line = line;
1245 px->acl_requires |= cond->requires;
1246
1247 return cond;
1248}
1249
Willy Tarreau11382812008-07-09 16:18:21 +02001250/* Execute condition <cond> and return either ACL_PAT_FAIL, ACL_PAT_MISS or
Willy Tarreaub6866442008-07-14 23:54:42 +02001251 * ACL_PAT_PASS depending on the test results. ACL_PAT_MISS may only be
1252 * returned if <dir> contains ACL_PARTIAL, indicating that incomplete data
1253 * is being examined.
1254 * This function only computes the condition, it does not apply the polarity
1255 * required by IF/UNLESS, it's up to the caller to do this using something like
1256 * this :
Willy Tarreau11382812008-07-09 16:18:21 +02001257 *
1258 * res = acl_pass(res);
Willy Tarreaub6866442008-07-14 23:54:42 +02001259 * if (res == ACL_PAT_MISS)
1260 * return 0;
Willy Tarreau11382812008-07-09 16:18:21 +02001261 * if (cond->pol == ACL_COND_UNLESS)
1262 * res = !res;
Willy Tarreaua84d3742007-05-07 00:36:48 +02001263 */
Willy Tarreaud41f8d82007-06-10 10:06:18 +02001264int acl_exec_cond(struct acl_cond *cond, struct proxy *px, struct session *l4, void *l7, int dir)
Willy Tarreaua84d3742007-05-07 00:36:48 +02001265{
1266 __label__ fetch_next;
1267 struct acl_term_suite *suite;
1268 struct acl_term *term;
1269 struct acl_expr *expr;
1270 struct acl *acl;
1271 struct acl_pattern *pattern;
1272 struct acl_test test;
Willy Tarreau11382812008-07-09 16:18:21 +02001273 int acl_res, suite_res, cond_res;
Willy Tarreaua84d3742007-05-07 00:36:48 +02001274
Willy Tarreau11382812008-07-09 16:18:21 +02001275 /* We're doing a logical OR between conditions so we initialize to FAIL.
1276 * The MISS status is propagated down from the suites.
1277 */
Willy Tarreaua84d3742007-05-07 00:36:48 +02001278 cond_res = ACL_PAT_FAIL;
1279 list_for_each_entry(suite, &cond->suites, list) {
Willy Tarreau11382812008-07-09 16:18:21 +02001280 /* Evaluate condition suite <suite>. We stop at the first term
1281 * which returns ACL_PAT_FAIL. The MISS status is still propagated
1282 * in case of uncertainty in the result.
Willy Tarreaua84d3742007-05-07 00:36:48 +02001283 */
1284
1285 /* we're doing a logical AND between terms, so we must set the
1286 * initial value to PASS.
1287 */
1288 suite_res = ACL_PAT_PASS;
1289 list_for_each_entry(term, &suite->terms, list) {
1290 acl = term->acl;
1291
1292 /* FIXME: use cache !
1293 * check acl->cache_idx for this.
1294 */
1295
1296 /* ACL result not cached. Let's scan all the expressions
1297 * and use the first one to match.
1298 */
1299 acl_res = ACL_PAT_FAIL;
1300 list_for_each_entry(expr, &acl->expr, list) {
Willy Tarreaud41f8d82007-06-10 10:06:18 +02001301 /* we need to reset context and flags */
1302 memset(&test, 0, sizeof(test));
Willy Tarreaua84d3742007-05-07 00:36:48 +02001303 fetch_next:
Willy Tarreaub6866442008-07-14 23:54:42 +02001304 if (!expr->kw->fetch(px, l4, l7, dir, expr, &test)) {
1305 /* maybe we could not fetch because of missing data */
1306 if (test.flags & ACL_TEST_F_MAY_CHANGE && dir & ACL_PARTIAL)
1307 acl_res |= ACL_PAT_MISS;
Willy Tarreaua84d3742007-05-07 00:36:48 +02001308 continue;
Willy Tarreaub6866442008-07-14 23:54:42 +02001309 }
Willy Tarreaua84d3742007-05-07 00:36:48 +02001310
Willy Tarreaua79534f2008-07-20 10:13:37 +02001311 if (test.flags & ACL_TEST_F_RES_SET) {
1312 if (test.flags & ACL_TEST_F_RES_PASS)
1313 acl_res |= ACL_PAT_PASS;
1314 else
1315 acl_res |= ACL_PAT_FAIL;
1316 }
1317 else {
Willy Tarreau020534d2010-05-16 21:45:45 +02001318 if (!eb_is_empty(&expr->pattern_tree)) {
Willy Tarreauc4262962010-05-10 23:42:40 +02001319 /* a tree is present, let's check what type it is */
1320 if (expr->kw->match == acl_match_str)
1321 acl_res |= acl_lookup_str(&test, expr) ? ACL_PAT_PASS : ACL_PAT_FAIL;
Willy Tarreaub337b532010-05-13 20:03:41 +02001322 else if (expr->kw->match == acl_match_ip)
1323 acl_res |= acl_lookup_ip(&test, expr) ? ACL_PAT_PASS : ACL_PAT_FAIL;
Willy Tarreauc4262962010-05-10 23:42:40 +02001324 }
1325
Willy Tarreaua79534f2008-07-20 10:13:37 +02001326 /* call the match() function for all tests on this value */
1327 list_for_each_entry(pattern, &expr->patterns, list) {
Willy Tarreaua79534f2008-07-20 10:13:37 +02001328 if (acl_res == ACL_PAT_PASS)
1329 break;
Willy Tarreaue56cda92010-05-11 23:25:05 +02001330 acl_res |= expr->kw->match(&test, pattern);
Willy Tarreaua79534f2008-07-20 10:13:37 +02001331 }
Krzysztof Piotr Oledzkid7528e52010-01-29 17:55:53 +01001332
Willy Tarreaue56cda92010-05-11 23:25:05 +02001333 if ((test.flags & ACL_TEST_F_NULL_MATCH) &&
Willy Tarreau020534d2010-05-16 21:45:45 +02001334 LIST_ISEMPTY(&expr->patterns) && eb_is_empty(&expr->pattern_tree))
Krzysztof Piotr Oledzkid7528e52010-01-29 17:55:53 +01001335 acl_res |= expr->kw->match(&test, NULL);
Willy Tarreaua84d3742007-05-07 00:36:48 +02001336 }
1337 /*
Willy Tarreau11382812008-07-09 16:18:21 +02001338 * OK now acl_res holds the result of this expression
1339 * as one of ACL_PAT_FAIL, ACL_PAT_MISS or ACL_PAT_PASS.
Willy Tarreaua84d3742007-05-07 00:36:48 +02001340 *
Willy Tarreau11382812008-07-09 16:18:21 +02001341 * Then if (!MISS) we can cache the result, and put
Willy Tarreaua84d3742007-05-07 00:36:48 +02001342 * (test.flags & ACL_TEST_F_VOLATILE) in the cache flags.
1343 *
1344 * FIXME: implement cache.
1345 *
1346 */
1347
1348 /* now we may have some cleanup to do */
1349 if (test.flags & ACL_TEST_F_MUST_FREE) {
1350 free(test.ptr);
1351 test.len = 0;
1352 }
1353
Willy Tarreau11382812008-07-09 16:18:21 +02001354 /* we're ORing these terms, so a single PASS is enough */
1355 if (acl_res == ACL_PAT_PASS)
Willy Tarreaua84d3742007-05-07 00:36:48 +02001356 break;
1357
Willy Tarreaua84d3742007-05-07 00:36:48 +02001358 if (test.flags & ACL_TEST_F_FETCH_MORE)
1359 goto fetch_next;
Willy Tarreaub6866442008-07-14 23:54:42 +02001360
1361 /* sometimes we know the fetched data is subject to change
1362 * later and give another chance for a new match (eg: request
1363 * size, time, ...)
1364 */
1365 if (test.flags & ACL_TEST_F_MAY_CHANGE && dir & ACL_PARTIAL)
1366 acl_res |= ACL_PAT_MISS;
Willy Tarreaua84d3742007-05-07 00:36:48 +02001367 }
1368 /*
1369 * Here we have the result of an ACL (cached or not).
1370 * ACLs are combined, negated or not, to form conditions.
1371 */
1372
Willy Tarreaua84d3742007-05-07 00:36:48 +02001373 if (term->neg)
Willy Tarreau11382812008-07-09 16:18:21 +02001374 acl_res = acl_neg(acl_res);
Willy Tarreaua84d3742007-05-07 00:36:48 +02001375
1376 suite_res &= acl_res;
Willy Tarreau11382812008-07-09 16:18:21 +02001377
1378 /* we're ANDing these terms, so a single FAIL is enough */
1379 if (suite_res == ACL_PAT_FAIL)
Willy Tarreaua84d3742007-05-07 00:36:48 +02001380 break;
1381 }
1382 cond_res |= suite_res;
Willy Tarreau11382812008-07-09 16:18:21 +02001383
1384 /* we're ORing these terms, so a single PASS is enough */
1385 if (cond_res == ACL_PAT_PASS)
Willy Tarreaua84d3742007-05-07 00:36:48 +02001386 break;
1387 }
Willy Tarreau11382812008-07-09 16:18:21 +02001388 return cond_res;
Willy Tarreaua84d3742007-05-07 00:36:48 +02001389}
1390
1391
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001392/* Reports a pointer to the first ACL used in condition <cond> which requires
1393 * at least one of the USE_FLAGS in <require>. Returns NULL if none matches.
1394 * The construct is almost the same as for acl_exec_cond() since we're walking
1395 * down the ACL tree as well. It is important that the tree is really walked
1396 * through and never cached, because that way, this function can be used as a
1397 * late check.
1398 */
Willy Tarreauf1e98b82010-01-28 17:59:39 +01001399struct acl *cond_find_require(const struct acl_cond *cond, unsigned int require)
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001400{
1401 struct acl_term_suite *suite;
1402 struct acl_term *term;
1403 struct acl *acl;
1404
1405 list_for_each_entry(suite, &cond->suites, list) {
1406 list_for_each_entry(term, &suite->terms, list) {
1407 acl = term->acl;
1408 if (acl->requires & require)
1409 return acl;
1410 }
1411 }
1412 return NULL;
1413}
1414
Krzysztof Piotr Oledzkif9423ae2010-01-29 19:26:18 +01001415/*
1416 * Find targets for userlist and groups in acl. Function returns the number
1417 * of errors or OK if everything is fine.
1418 */
1419int
1420acl_find_targets(struct proxy *p)
1421{
1422
1423 struct acl *acl;
1424 struct acl_expr *expr;
1425 struct acl_pattern *pattern;
1426 struct userlist *ul;
1427 int cfgerr = 0;
1428
1429 list_for_each_entry(acl, &p->acl, list) {
1430 list_for_each_entry(expr, &acl->expr, list) {
1431 if (strstr(expr->kw->kw, "http_auth") == expr->kw->kw) {
1432
1433 if (!expr->arg.str || !*expr->arg.str) {
1434 Alert("proxy %s: acl %s %s(): missing userlist name.\n",
1435 p->id, acl->name, expr->kw->kw);
1436 cfgerr++;
1437 continue;
1438 }
1439
Krzysztof Piotr Oledzki8c8bd452010-01-29 19:29:32 +01001440 if (p->uri_auth && p->uri_auth->userlist &&
1441 !strcmp(p->uri_auth->userlist->name, expr->arg.str))
1442 ul = p->uri_auth->userlist;
1443 else
1444 ul = auth_find_userlist(expr->arg.str);
Krzysztof Piotr Oledzkif9423ae2010-01-29 19:26:18 +01001445
1446 if (!ul) {
1447 Alert("proxy %s: acl %s %s(%s): unable to find userlist.\n",
1448 p->id, acl->name, expr->kw->kw, expr->arg.str);
1449 cfgerr++;
1450 continue;
1451 }
1452
1453 expr->arg_len = 0;
1454 expr->arg.ul = ul;
1455 }
1456
1457
1458 if (!strcmp(expr->kw->kw, "http_auth_group")) {
1459
1460 if (LIST_ISEMPTY(&expr->patterns)) {
1461 Alert("proxy %s: acl %s %s(): no groups specified.\n",
1462 p->id, acl->name, expr->kw->kw);
1463 cfgerr++;
1464 continue;
1465 }
1466
1467 list_for_each_entry(pattern, &expr->patterns, list) {
1468 pattern->val.group_mask = auth_resolve_groups(expr->arg.ul, pattern->ptr.str);
1469
1470 free(pattern->ptr.str);
1471 pattern->ptr.str = NULL;
1472 pattern->len = 0;
1473
1474 if (!pattern->val.group_mask) {
1475 Alert("proxy %s: acl %s %s(): invalid group(s).\n",
1476 p->id, acl->name, expr->kw->kw);
1477 cfgerr++;
1478 continue;
1479 }
1480 }
1481 }
1482 }
1483 }
1484
1485 return cfgerr;
1486}
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001487
Willy Tarreaua84d3742007-05-07 00:36:48 +02001488/************************************************************************/
1489/* All supported keywords must be declared here. */
1490/************************************************************************/
1491
1492/* Note: must not be declared <const> as its list will be overwritten */
1493static struct acl_kw_list acl_kws = {{ },{
Willy Tarreau0ceba5a2008-07-25 19:31:03 +02001494 { "always_true", acl_parse_nothing, acl_fetch_true, acl_match_nothing, ACL_USE_NOTHING },
1495 { "always_false", acl_parse_nothing, acl_fetch_false, acl_match_nothing, ACL_USE_NOTHING },
1496 { "wait_end", acl_parse_nothing, acl_fetch_wait_end, acl_match_nothing, ACL_USE_NOTHING },
Willy Tarreaua84d3742007-05-07 00:36:48 +02001497#if 0
1498 { "time", acl_parse_time, acl_fetch_time, acl_match_time },
1499#endif
1500 { NULL, NULL, NULL, NULL }
1501}};
1502
1503
1504__attribute__((constructor))
1505static void __acl_init(void)
1506{
1507 acl_register_keywords(&acl_kws);
1508}
1509
1510
1511/*
1512 * Local variables:
1513 * c-indent-level: 8
1514 * c-basic-offset: 8
1515 * End:
1516 */