Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1 | /* |
| 2 | * ACL management functions. |
| 3 | * |
Willy Tarreau | d4c33c8 | 2013-01-07 21:59:07 +0100 | [diff] [blame] | 4 | * Copyright 2000-2013 Willy Tarreau <w@1wt.eu> |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 5 | * |
| 6 | * This program is free software; you can redistribute it and/or |
| 7 | * modify it under the terms of the GNU General Public License |
| 8 | * as published by the Free Software Foundation; either version |
| 9 | * 2 of the License, or (at your option) any later version. |
| 10 | * |
| 11 | */ |
| 12 | |
Willy Tarreau | ae8b796 | 2007-06-09 23:10:04 +0200 | [diff] [blame] | 13 | #include <ctype.h> |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 14 | #include <stdio.h> |
| 15 | #include <string.h> |
| 16 | |
| 17 | #include <common/config.h> |
| 18 | #include <common/mini-clist.h> |
| 19 | #include <common/standard.h> |
Krzysztof Piotr Oledzki | 8c8bd45 | 2010-01-29 19:29:32 +0100 | [diff] [blame] | 20 | #include <common/uri_auth.h> |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 21 | |
Willy Tarreau | 2b5285d | 2010-05-09 23:45:24 +0200 | [diff] [blame] | 22 | #include <types/global.h> |
| 23 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 24 | #include <proto/acl.h> |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 25 | #include <proto/arg.h> |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 26 | #include <proto/auth.h> |
Willy Tarreau | c7e4238 | 2012-08-24 19:22:53 +0200 | [diff] [blame] | 27 | #include <proto/channel.h> |
Willy Tarreau | 404e8ab | 2009-07-26 19:40:40 +0200 | [diff] [blame] | 28 | #include <proto/log.h> |
Thierry FOURNIER | ed66c29 | 2013-11-28 11:05:19 +0100 | [diff] [blame] | 29 | #include <proto/pattern.h> |
Willy Tarreau | 0b1cd94 | 2010-05-16 22:18:27 +0200 | [diff] [blame] | 30 | #include <proto/proxy.h> |
Willy Tarreau | 8ed669b | 2013-01-11 15:49:37 +0100 | [diff] [blame] | 31 | #include <proto/sample.h> |
Willy Tarreau | d28c353 | 2012-04-19 19:28:33 +0200 | [diff] [blame] | 32 | #include <proto/stick_table.h> |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 33 | |
Willy Tarreau | c426296 | 2010-05-10 23:42:40 +0200 | [diff] [blame] | 34 | #include <ebsttree.h> |
| 35 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 36 | /* List head of all known ACL keywords */ |
| 37 | static struct acl_kw_list acl_keywords = { |
| 38 | .list = LIST_HEAD_INIT(acl_keywords.list) |
| 39 | }; |
| 40 | |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 41 | /* return the PAT_MATCH_* index for match name "name", or < 0 if not found */ |
Willy Tarreau | 5adeda1 | 2013-03-31 22:13:34 +0200 | [diff] [blame] | 42 | static int acl_find_match_name(const char *name) |
| 43 | { |
| 44 | int i; |
| 45 | |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 46 | for (i = 0; i < PAT_MATCH_NUM; i++) |
| 47 | if (strcmp(name, pat_match_names[i]) == 0) |
Willy Tarreau | 5adeda1 | 2013-03-31 22:13:34 +0200 | [diff] [blame] | 48 | return i; |
| 49 | return -1; |
| 50 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 51 | |
Willy Tarreau | 0cba607 | 2013-11-28 22:21:02 +0100 | [diff] [blame^] | 52 | /* input values are 0 or 3, output is the same */ |
| 53 | static inline enum acl_test_res pat2acl(enum pat_match_res res) |
| 54 | { |
| 55 | return (enum acl_test_res)res; |
| 56 | } |
| 57 | |
Willy Tarreau | a590983 | 2007-06-17 20:40:25 +0200 | [diff] [blame] | 58 | /* |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 59 | * Registers the ACL keyword list <kwl> as a list of valid keywords for next |
| 60 | * parsing sessions. |
| 61 | */ |
| 62 | void acl_register_keywords(struct acl_kw_list *kwl) |
| 63 | { |
| 64 | LIST_ADDQ(&acl_keywords.list, &kwl->list); |
| 65 | } |
| 66 | |
| 67 | /* |
| 68 | * Unregisters the ACL keyword list <kwl> from the list of valid keywords. |
| 69 | */ |
| 70 | void acl_unregister_keywords(struct acl_kw_list *kwl) |
| 71 | { |
| 72 | LIST_DEL(&kwl->list); |
| 73 | LIST_INIT(&kwl->list); |
| 74 | } |
| 75 | |
| 76 | /* Return a pointer to the ACL <name> within the list starting at <head>, or |
| 77 | * NULL if not found. |
| 78 | */ |
| 79 | struct acl *find_acl_by_name(const char *name, struct list *head) |
| 80 | { |
| 81 | struct acl *acl; |
| 82 | list_for_each_entry(acl, head, list) { |
| 83 | if (strcmp(acl->name, name) == 0) |
| 84 | return acl; |
| 85 | } |
| 86 | return NULL; |
| 87 | } |
| 88 | |
| 89 | /* Return a pointer to the ACL keyword <kw>, or NULL if not found. Note that if |
| 90 | * <kw> contains an opening parenthesis, only the left part of it is checked. |
| 91 | */ |
| 92 | struct acl_keyword *find_acl_kw(const char *kw) |
| 93 | { |
| 94 | int index; |
| 95 | const char *kwend; |
| 96 | struct acl_kw_list *kwl; |
| 97 | |
| 98 | kwend = strchr(kw, '('); |
| 99 | if (!kwend) |
| 100 | kwend = kw + strlen(kw); |
| 101 | |
| 102 | list_for_each_entry(kwl, &acl_keywords.list, list) { |
| 103 | for (index = 0; kwl->kw[index].kw != NULL; index++) { |
| 104 | if ((strncmp(kwl->kw[index].kw, kw, kwend - kw) == 0) && |
| 105 | kwl->kw[index].kw[kwend-kw] == 0) |
| 106 | return &kwl->kw[index]; |
| 107 | } |
| 108 | } |
| 109 | return NULL; |
| 110 | } |
| 111 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 112 | static struct acl_expr *prune_acl_expr(struct acl_expr *expr) |
| 113 | { |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 114 | struct arg *arg; |
| 115 | |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 116 | pattern_prune_expr(&expr->pat); |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 117 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 118 | for (arg = expr->smp->arg_p; arg; arg++) { |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 119 | if (arg->type == ARGT_STOP) |
| 120 | break; |
Willy Tarreau | 496aa01 | 2012-06-01 10:38:29 +0200 | [diff] [blame] | 121 | if (arg->type == ARGT_STR || arg->unresolved) { |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 122 | free(arg->data.str.str); |
| 123 | arg->data.str.str = NULL; |
Willy Tarreau | 496aa01 | 2012-06-01 10:38:29 +0200 | [diff] [blame] | 124 | arg->unresolved = 0; |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 125 | } |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 126 | } |
| 127 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 128 | if (expr->smp->arg_p != empty_arg_list) |
| 129 | free(expr->smp->arg_p); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 130 | return expr; |
| 131 | } |
| 132 | |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 133 | /* Parse an ACL expression starting at <args>[0], and return it. If <err> is |
| 134 | * not NULL, it will be filled with a pointer to an error message in case of |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 135 | * error. This pointer must be freeable or NULL. <al> is an arg_list serving |
| 136 | * as a list head to report missing dependencies. |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 137 | * |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 138 | * Right now, the only accepted syntax is : |
| 139 | * <subject> [<value>...] |
| 140 | */ |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 141 | struct acl_expr *parse_acl_expr(const char **args, char **err, struct arg_list *al) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 142 | { |
| 143 | __label__ out_return, out_free_expr, out_free_pattern; |
| 144 | struct acl_expr *expr; |
| 145 | struct acl_keyword *aclkw; |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 146 | struct pattern *pattern; |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 147 | int opaque, patflags; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 148 | const char *arg; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 149 | struct sample_expr *smp = NULL; |
| 150 | const char *p; |
| 151 | int idx = 0; |
| 152 | char *ckw = NULL; |
| 153 | const char *begw; |
| 154 | const char *endw; |
| 155 | unsigned long prev_type; |
| 156 | int cur_type; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 157 | |
Willy Tarreau | bef91e7 | 2013-03-31 23:14:46 +0200 | [diff] [blame] | 158 | /* First, we lookd for an ACL keyword. And if we don't find one, then |
| 159 | * we look for a sample fetch keyword. |
| 160 | */ |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 161 | aclkw = find_acl_kw(args[0]); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 162 | if (!aclkw || !aclkw->parse) { |
Willy Tarreau | bef91e7 | 2013-03-31 23:14:46 +0200 | [diff] [blame] | 163 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 164 | smp = sample_parse_expr((char **)args, &idx, trash.str, trash.size, al); |
Willy Tarreau | bef91e7 | 2013-03-31 23:14:46 +0200 | [diff] [blame] | 165 | |
| 166 | if (!smp) { |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 167 | memprintf(err, "unknown ACL or sample keyword '%s': %s", *args, trash.str); |
Willy Tarreau | bef91e7 | 2013-03-31 23:14:46 +0200 | [diff] [blame] | 168 | goto out_return; |
| 169 | } |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 170 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 171 | |
| 172 | expr = (struct acl_expr *)calloc(1, sizeof(*expr)); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 173 | if (!expr) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 174 | memprintf(err, "out of memory when parsing ACL expression"); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 175 | goto out_return; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 176 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 177 | |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 178 | pattern_init_expr(&expr->pat); |
Thierry FOURNIER | d163e1c | 2013-11-28 11:41:23 +0100 | [diff] [blame] | 179 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 180 | expr->kw = aclkw ? aclkw->kw : smp->fetch->kw; |
Thierry FOURNIER | d163e1c | 2013-11-28 11:41:23 +0100 | [diff] [blame] | 181 | expr->pat.parse = aclkw ? aclkw->parse : NULL; |
| 182 | expr->pat.match = aclkw ? aclkw->match : NULL; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 183 | expr->smp = aclkw ? NULL : smp; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 184 | |
Thierry FOURNIER | d163e1c | 2013-11-28 11:41:23 +0100 | [diff] [blame] | 185 | if (!expr->pat.parse) { |
Willy Tarreau | 9987ea9 | 2013-06-11 21:09:06 +0200 | [diff] [blame] | 186 | /* some types can be automatically converted */ |
| 187 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 188 | switch (expr->smp ? expr->smp->fetch->out_type : aclkw->smp->out_type) { |
Willy Tarreau | 9987ea9 | 2013-06-11 21:09:06 +0200 | [diff] [blame] | 189 | case SMP_T_BOOL: |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 190 | expr->pat.parse = pat_parse_fcts[PAT_MATCH_BOOL]; |
| 191 | expr->pat.match = pat_match_fcts[PAT_MATCH_BOOL]; |
Willy Tarreau | 9987ea9 | 2013-06-11 21:09:06 +0200 | [diff] [blame] | 192 | break; |
| 193 | case SMP_T_SINT: |
| 194 | case SMP_T_UINT: |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 195 | expr->pat.parse = pat_parse_fcts[PAT_MATCH_INT]; |
| 196 | expr->pat.match = pat_match_fcts[PAT_MATCH_INT]; |
Willy Tarreau | 9987ea9 | 2013-06-11 21:09:06 +0200 | [diff] [blame] | 197 | break; |
| 198 | case SMP_T_IPV4: |
| 199 | case SMP_T_IPV6: |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 200 | expr->pat.parse = pat_parse_fcts[PAT_MATCH_IP]; |
| 201 | expr->pat.match = pat_match_fcts[PAT_MATCH_IP]; |
Willy Tarreau | 9987ea9 | 2013-06-11 21:09:06 +0200 | [diff] [blame] | 202 | break; |
| 203 | } |
| 204 | } |
| 205 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 206 | /* now parse the rest of acl only if "find_acl_kw" match */ |
| 207 | if (aclkw) { |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 208 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 209 | /* build new sample expression */ |
| 210 | expr->smp = calloc(1, sizeof(struct sample_expr)); |
| 211 | if (!expr->smp) { |
| 212 | memprintf(err, "out of memory when parsing ACL expression"); |
| 213 | goto out_return; |
| 214 | } |
| 215 | LIST_INIT(&(expr->smp->conv_exprs)); |
| 216 | expr->smp->fetch = aclkw->smp; |
| 217 | expr->smp->arg_p = empty_arg_list; |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 218 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 219 | /* look for the begining of the subject arguments */ |
| 220 | p = strchr(args[0], ','); |
| 221 | arg = strchr(args[0], '('); |
| 222 | if (p && arg && p < arg) |
| 223 | arg = NULL; |
| 224 | |
| 225 | if (expr->smp->fetch->arg_mask) { |
| 226 | int nbargs = 0; |
| 227 | char *end; |
| 228 | |
| 229 | if (arg != NULL) { |
| 230 | /* there are 0 or more arguments in the form "subject(arg[,arg]*)" */ |
| 231 | arg++; |
| 232 | end = strchr(arg, ')'); |
| 233 | if (!end) { |
| 234 | memprintf(err, "missing closing ')' after arguments to ACL keyword '%s'", expr->kw); |
| 235 | goto out_free_expr; |
| 236 | } |
| 237 | |
| 238 | /* Parse the arguments. Note that currently we have no way to |
| 239 | * report parsing errors, hence the NULL in the error pointers. |
| 240 | * An error is also reported if some mandatory arguments are |
| 241 | * missing. We prepare the args list to report unresolved |
| 242 | * dependencies. |
| 243 | */ |
| 244 | al->ctx = ARGC_ACL; |
| 245 | al->kw = expr->kw; |
| 246 | al->conv = NULL; |
| 247 | nbargs = make_arg_list(arg, end - arg, expr->smp->fetch->arg_mask, &expr->smp->arg_p, |
| 248 | err, NULL, NULL, al); |
| 249 | if (nbargs < 0) { |
| 250 | /* note that make_arg_list will have set <err> here */ |
| 251 | memprintf(err, "in argument to '%s', %s", expr->kw, *err); |
| 252 | goto out_free_expr; |
| 253 | } |
| 254 | |
| 255 | if (!expr->smp->arg_p) |
| 256 | expr->smp->arg_p = empty_arg_list; |
| 257 | |
| 258 | if (expr->smp->fetch->val_args && !expr->smp->fetch->val_args(expr->smp->arg_p, err)) { |
| 259 | /* invalid keyword argument, error must have been |
| 260 | * set by val_args(). |
| 261 | */ |
| 262 | memprintf(err, "in argument to '%s', %s", expr->kw, *err); |
| 263 | goto out_free_expr; |
| 264 | } |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 265 | } |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 266 | else if (ARGM(expr->smp->fetch->arg_mask) == 1) { |
| 267 | int type = (expr->smp->fetch->arg_mask >> 4) & 15; |
Willy Tarreau | ae52f06 | 2012-04-26 12:13:35 +0200 | [diff] [blame] | 268 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 269 | /* If a proxy is noted as a mandatory argument, we'll fake |
| 270 | * an empty one so that acl_find_targets() resolves it as |
| 271 | * the current one later. |
| 272 | */ |
| 273 | if (type != ARGT_FE && type != ARGT_BE && type != ARGT_TAB) { |
| 274 | memprintf(err, "ACL keyword '%s' expects %d arguments", expr->kw, ARGM(expr->smp->fetch->arg_mask)); |
| 275 | goto out_free_expr; |
| 276 | } |
Willy Tarreau | 2e845be | 2012-10-19 19:49:09 +0200 | [diff] [blame] | 277 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 278 | /* Build an arg list containing the type as an empty string |
| 279 | * and the usual STOP. |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 280 | */ |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 281 | expr->smp->arg_p = calloc(2, sizeof(*expr->smp->arg_p)); |
| 282 | expr->smp->arg_p[0].type = type; |
| 283 | expr->smp->arg_p[0].unresolved = 1; |
| 284 | expr->smp->arg_p[0].data.str.str = strdup(""); |
| 285 | expr->smp->arg_p[0].data.str.size = 1; |
| 286 | expr->smp->arg_p[0].data.str.len = 0; |
| 287 | |
| 288 | al->ctx = ARGC_ACL; |
| 289 | al->kw = expr->kw; |
| 290 | al->conv = NULL; |
| 291 | arg_list_add(al, &expr->smp->arg_p[0], 0); |
| 292 | |
| 293 | expr->smp->arg_p[1].type = ARGT_STOP; |
| 294 | } |
| 295 | else if (ARGM(expr->smp->fetch->arg_mask)) { |
| 296 | /* there were some mandatory arguments */ |
| 297 | memprintf(err, "ACL keyword '%s' expects %d arguments", expr->kw, ARGM(expr->smp->fetch->arg_mask)); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 298 | goto out_free_expr; |
| 299 | } |
Willy Tarreau | 61612d4 | 2012-04-19 18:42:05 +0200 | [diff] [blame] | 300 | } |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 301 | else { |
| 302 | if (arg ) { |
| 303 | /* no argument expected */ |
| 304 | memprintf(err, "ACL keyword '%s' takes no argument", expr->kw); |
Willy Tarreau | fc2c1fd | 2012-04-19 23:35:54 +0200 | [diff] [blame] | 305 | goto out_free_expr; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 306 | } |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 307 | } |
Willy Tarreau | 9ca6936 | 2013-10-22 19:10:06 +0200 | [diff] [blame] | 308 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 309 | /* Now process the converters if any. We have two supported syntaxes |
| 310 | * for the converters, which can be combined : |
| 311 | * - comma-delimited list of converters just after the keyword and args ; |
| 312 | * - one converter per keyword |
| 313 | * The combination allows to have each keyword being a comma-delimited |
| 314 | * series of converters. |
| 315 | * |
| 316 | * We want to process the former first, then the latter. For this we start |
| 317 | * from the beginning of the supposed place in the exiting conv chain, which |
| 318 | * starts at the last comma (endt). |
| 319 | */ |
Willy Tarreau | f75d008 | 2013-04-07 21:20:44 +0200 | [diff] [blame] | 320 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 321 | /* look for the begining of the converters list */ |
| 322 | arg = strchr(args[0], ','); |
Willy Tarreau | 61612d4 | 2012-04-19 18:42:05 +0200 | [diff] [blame] | 323 | if (arg) { |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 324 | prev_type = expr->smp->fetch->out_type; |
| 325 | while (1) { |
| 326 | struct sample_conv *conv; |
| 327 | struct sample_conv_expr *conv_expr; |
| 328 | |
| 329 | if (*arg == ')') /* skip last closing parenthesis */ |
| 330 | arg++; |
| 331 | |
| 332 | if (*arg && *arg != ',') { |
| 333 | if (ckw) |
| 334 | memprintf(err, "ACL keyword '%s' : missing comma after conv keyword '%s'.", |
| 335 | expr->kw, ckw); |
| 336 | else |
| 337 | memprintf(err, "ACL keyword '%s' : missing comma after fetch keyword.", |
| 338 | expr->kw); |
| 339 | goto out_free_expr; |
| 340 | } |
| 341 | |
| 342 | while (*arg == ',') /* then trailing commas */ |
| 343 | arg++; |
| 344 | |
| 345 | begw = arg; /* start of conv keyword */ |
| 346 | |
| 347 | if (!*begw) |
| 348 | /* none ? end of converters */ |
| 349 | break; |
| 350 | |
| 351 | for (endw = begw; *endw && *endw != '(' && *endw != ','; endw++); |
| 352 | |
| 353 | free(ckw); |
| 354 | ckw = my_strndup(begw, endw - begw); |
| 355 | |
| 356 | conv = find_sample_conv(begw, endw - begw); |
| 357 | if (!conv) { |
| 358 | /* Unknown converter method */ |
| 359 | memprintf(err, "ACL keyword '%s' : unknown conv method '%s'.", |
| 360 | expr->kw, ckw); |
| 361 | goto out_free_expr; |
| 362 | } |
| 363 | |
| 364 | arg = endw; |
| 365 | if (*arg == '(') { |
| 366 | /* look for the end of this term */ |
| 367 | while (*arg && *arg != ')') |
| 368 | arg++; |
| 369 | if (*arg != ')') { |
| 370 | memprintf(err, "ACL keyword '%s' : syntax error: missing ')' after conv keyword '%s'.", |
| 371 | expr->kw, ckw); |
| 372 | goto out_free_expr; |
| 373 | } |
| 374 | } |
| 375 | |
| 376 | if (conv->in_type >= SMP_TYPES || conv->out_type >= SMP_TYPES) { |
| 377 | memprintf(err, "ACL keyword '%s' : returns type of conv method '%s' is unknown.", |
| 378 | expr->kw, ckw); |
| 379 | goto out_free_expr; |
| 380 | } |
| 381 | |
| 382 | /* If impossible type conversion */ |
| 383 | if (!sample_casts[prev_type][conv->in_type]) { |
| 384 | memprintf(err, "ACL keyword '%s' : conv method '%s' cannot be applied.", |
| 385 | expr->kw, ckw); |
| 386 | goto out_free_expr; |
| 387 | } |
| 388 | |
| 389 | prev_type = conv->out_type; |
| 390 | conv_expr = calloc(1, sizeof(struct sample_conv_expr)); |
| 391 | if (!conv_expr) |
| 392 | goto out_free_expr; |
| 393 | |
| 394 | LIST_ADDQ(&(expr->smp->conv_exprs), &(conv_expr->list)); |
| 395 | conv_expr->conv = conv; |
| 396 | |
| 397 | if (arg != endw) { |
| 398 | char *err_msg = NULL; |
| 399 | int err_arg; |
| 400 | |
| 401 | if (!conv->arg_mask) { |
| 402 | memprintf(err, "ACL keyword '%s' : conv method '%s' does not support any args.", |
| 403 | expr->kw, ckw); |
| 404 | goto out_free_expr; |
| 405 | } |
| 406 | |
| 407 | al->kw = expr->smp->fetch->kw; |
| 408 | al->conv = conv_expr->conv->kw; |
| 409 | if (make_arg_list(endw + 1, arg - endw - 1, conv->arg_mask, &conv_expr->arg_p, &err_msg, NULL, &err_arg, al) < 0) { |
| 410 | memprintf(err, "ACL keyword '%s' : invalid arg %d in conv method '%s' : %s.", |
| 411 | expr->kw, err_arg+1, ckw, err_msg); |
| 412 | free(err_msg); |
| 413 | goto out_free_expr; |
| 414 | } |
| 415 | |
| 416 | if (!conv_expr->arg_p) |
| 417 | conv_expr->arg_p = empty_arg_list; |
| 418 | |
Thierry FOURNIER | 9c1d67e | 2013-11-21 13:37:41 +0100 | [diff] [blame] | 419 | if (conv->val_args && !conv->val_args(conv_expr->arg_p, conv, &err_msg)) { |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 420 | memprintf(err, "ACL keyword '%s' : invalid args in conv method '%s' : %s.", |
| 421 | expr->kw, ckw, err_msg); |
| 422 | free(err_msg); |
| 423 | goto out_free_expr; |
| 424 | } |
| 425 | } |
| 426 | else if (ARGM(conv->arg_mask)) { |
| 427 | memprintf(err, "ACL keyword '%s' : missing args for conv method '%s'.", |
| 428 | expr->kw, ckw); |
| 429 | goto out_free_expr; |
| 430 | } |
| 431 | } |
Willy Tarreau | 61612d4 | 2012-04-19 18:42:05 +0200 | [diff] [blame] | 432 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 433 | } |
| 434 | |
Willy Tarreau | 3c3dfd5 | 2013-11-04 18:09:12 +0100 | [diff] [blame] | 435 | /* Additional check to protect against common mistakes */ |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 436 | cur_type = smp_expr_output_type(expr->smp); |
Thierry FOURNIER | d163e1c | 2013-11-28 11:41:23 +0100 | [diff] [blame] | 437 | if (expr->pat.parse && cur_type != SMP_T_BOOL && !*args[1]) { |
Willy Tarreau | 3c3dfd5 | 2013-11-04 18:09:12 +0100 | [diff] [blame] | 438 | Warning("parsing acl keyword '%s' :\n" |
| 439 | " no pattern to match against were provided, so this ACL will never match.\n" |
| 440 | " If this is what you intended, please add '--' to get rid of this warning.\n" |
| 441 | " If you intended to match only for existence, please use '-m found'.\n" |
| 442 | " If you wanted to force an int to match as a bool, please use '-m bool'.\n" |
| 443 | "\n", |
| 444 | args[0]); |
| 445 | } |
| 446 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 447 | args++; |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 448 | |
| 449 | /* check for options before patterns. Supported options are : |
| 450 | * -i : ignore case for all patterns by default |
| 451 | * -f : read patterns from those files |
Willy Tarreau | 5adeda1 | 2013-03-31 22:13:34 +0200 | [diff] [blame] | 452 | * -m : force matching method (must be used before -f) |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 453 | * -- : everything after this is not an option |
| 454 | */ |
| 455 | patflags = 0; |
| 456 | while (**args == '-') { |
| 457 | if ((*args)[1] == 'i') |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 458 | patflags |= PAT_F_IGNORE_CASE; |
Willy Tarreau | 2b5285d | 2010-05-09 23:45:24 +0200 | [diff] [blame] | 459 | else if ((*args)[1] == 'f') { |
Thierry FOURNIER | d163e1c | 2013-11-28 11:41:23 +0100 | [diff] [blame] | 460 | if (!expr->pat.parse) { |
Willy Tarreau | 9987ea9 | 2013-06-11 21:09:06 +0200 | [diff] [blame] | 461 | memprintf(err, "matching method must be specified first (using '-m') when using a sample fetch of this type ('%s')", expr->kw); |
Willy Tarreau | bef91e7 | 2013-03-31 23:14:46 +0200 | [diff] [blame] | 462 | goto out_free_expr; |
| 463 | } |
| 464 | |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 465 | if (!pattern_read_from_file(&expr->pat, args[1], patflags | PAT_F_FROM_FILE, err)) |
Willy Tarreau | 2b5285d | 2010-05-09 23:45:24 +0200 | [diff] [blame] | 466 | goto out_free_expr; |
Willy Tarreau | 5adeda1 | 2013-03-31 22:13:34 +0200 | [diff] [blame] | 467 | args++; |
| 468 | } |
| 469 | else if ((*args)[1] == 'm') { |
| 470 | int idx; |
| 471 | |
Thierry FOURNIER | d163e1c | 2013-11-28 11:41:23 +0100 | [diff] [blame] | 472 | if (!LIST_ISEMPTY(&expr->pat.patterns) || !eb_is_empty(&expr->pat.pattern_tree)) { |
Willy Tarreau | 5adeda1 | 2013-03-31 22:13:34 +0200 | [diff] [blame] | 473 | memprintf(err, "'-m' must only be specified before patterns and files in parsing ACL expression"); |
| 474 | goto out_free_expr; |
| 475 | } |
| 476 | |
| 477 | idx = acl_find_match_name(args[1]); |
| 478 | if (idx < 0) { |
| 479 | memprintf(err, "unknown matching method '%s' when parsing ACL expression", args[1]); |
| 480 | goto out_free_expr; |
| 481 | } |
| 482 | |
| 483 | /* Note: -m found is always valid, bool/int are compatible, str/bin/reg/len are compatible */ |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 484 | if (idx == PAT_MATCH_FOUND || /* -m found */ |
| 485 | ((idx == PAT_MATCH_BOOL || idx == PAT_MATCH_INT) && /* -m bool/int */ |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 486 | (cur_type == SMP_T_BOOL || |
| 487 | cur_type == SMP_T_UINT || |
| 488 | cur_type == SMP_T_SINT)) || |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 489 | (idx == PAT_MATCH_IP && /* -m ip */ |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 490 | (cur_type == SMP_T_IPV4 || |
| 491 | cur_type == SMP_T_IPV6)) || |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 492 | ((idx == PAT_MATCH_BIN || idx == PAT_MATCH_LEN || idx == PAT_MATCH_STR || |
| 493 | idx == PAT_MATCH_BEG || idx == PAT_MATCH_SUB || idx == PAT_MATCH_DIR || |
| 494 | idx == PAT_MATCH_DOM || idx == PAT_MATCH_END || idx == PAT_MATCH_REG) && /* strings */ |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 495 | (cur_type == SMP_T_STR || |
| 496 | cur_type == SMP_T_BIN || |
| 497 | cur_type == SMP_T_CSTR || |
| 498 | cur_type == SMP_T_CBIN))) { |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 499 | expr->pat.parse = pat_parse_fcts[idx]; |
| 500 | expr->pat.match = pat_match_fcts[idx]; |
Willy Tarreau | 5adeda1 | 2013-03-31 22:13:34 +0200 | [diff] [blame] | 501 | } |
| 502 | else { |
Willy Tarreau | 93fddf1 | 2013-03-31 22:59:32 +0200 | [diff] [blame] | 503 | memprintf(err, "matching method '%s' cannot be used with fetch keyword '%s'", args[1], expr->kw); |
Willy Tarreau | 5adeda1 | 2013-03-31 22:13:34 +0200 | [diff] [blame] | 504 | goto out_free_expr; |
| 505 | } |
Willy Tarreau | 2b5285d | 2010-05-09 23:45:24 +0200 | [diff] [blame] | 506 | args++; |
| 507 | } |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 508 | else if ((*args)[1] == '-') { |
| 509 | args++; |
| 510 | break; |
| 511 | } |
| 512 | else |
| 513 | break; |
| 514 | args++; |
| 515 | } |
| 516 | |
Thierry FOURNIER | d163e1c | 2013-11-28 11:41:23 +0100 | [diff] [blame] | 517 | if (!expr->pat.parse) { |
Willy Tarreau | 9987ea9 | 2013-06-11 21:09:06 +0200 | [diff] [blame] | 518 | memprintf(err, "matching method must be specified first (using '-m') when using a sample fetch of this type ('%s')", expr->kw); |
Willy Tarreau | bef91e7 | 2013-03-31 23:14:46 +0200 | [diff] [blame] | 519 | goto out_free_expr; |
| 520 | } |
| 521 | |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 522 | /* now parse all patterns */ |
Willy Tarreau | ae8b796 | 2007-06-09 23:10:04 +0200 | [diff] [blame] | 523 | opaque = 0; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 524 | while (**args) { |
Willy Tarreau | ae8b796 | 2007-06-09 23:10:04 +0200 | [diff] [blame] | 525 | int ret; |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 526 | pattern = (struct pattern *)calloc(1, sizeof(*pattern)); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 527 | if (!pattern) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 528 | memprintf(err, "out of memory when parsing ACL pattern"); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 529 | goto out_free_expr; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 530 | } |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 531 | pattern->flags = patflags; |
| 532 | |
Willy Tarreau | c92ddbc | 2012-04-27 22:10:57 +0200 | [diff] [blame] | 533 | pattern->type = SMP_TYPES; /* unspecified type */ |
Thierry FOURNIER | d163e1c | 2013-11-28 11:41:23 +0100 | [diff] [blame] | 534 | ret = expr->pat.parse(args, pattern, NULL, &opaque, err); |
Willy Tarreau | 7dcb648 | 2012-04-27 17:52:25 +0200 | [diff] [blame] | 535 | if (!ret) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 536 | goto out_free_pattern; |
Willy Tarreau | 7dcb648 | 2012-04-27 17:52:25 +0200 | [diff] [blame] | 537 | |
Thierry FOURNIER | d163e1c | 2013-11-28 11:41:23 +0100 | [diff] [blame] | 538 | LIST_ADDQ(&expr->pat.patterns, &pattern->list); |
Willy Tarreau | ae8b796 | 2007-06-09 23:10:04 +0200 | [diff] [blame] | 539 | args += ret; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 540 | } |
| 541 | |
| 542 | return expr; |
| 543 | |
| 544 | out_free_pattern: |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 545 | pattern_free(pattern); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 546 | out_free_expr: |
| 547 | prune_acl_expr(expr); |
| 548 | free(expr); |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 549 | free(ckw); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 550 | out_return: |
| 551 | return NULL; |
| 552 | } |
| 553 | |
Krzysztof Piotr Oledzki | a643baf | 2008-05-29 23:53:44 +0200 | [diff] [blame] | 554 | /* Purge everything in the acl <acl>, then return <acl>. */ |
| 555 | struct acl *prune_acl(struct acl *acl) { |
| 556 | |
| 557 | struct acl_expr *expr, *exprb; |
| 558 | |
| 559 | free(acl->name); |
| 560 | |
| 561 | list_for_each_entry_safe(expr, exprb, &acl->expr, list) { |
| 562 | LIST_DEL(&expr->list); |
| 563 | prune_acl_expr(expr); |
| 564 | free(expr); |
| 565 | } |
| 566 | |
| 567 | return acl; |
| 568 | } |
| 569 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 570 | /* Parse an ACL with the name starting at <args>[0], and with a list of already |
| 571 | * known ACLs in <acl>. If the ACL was not in the list, it will be added. |
Willy Tarreau | 2a56c5e | 2010-03-15 16:13:29 +0100 | [diff] [blame] | 572 | * A pointer to that ACL is returned. If the ACL has an empty name, then it's |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 573 | * an anonymous one and it won't be merged with any other one. If <err> is not |
| 574 | * NULL, it will be filled with an appropriate error. This pointer must be |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 575 | * freeable or NULL. <al> is the arg_list serving as a head for unresolved |
| 576 | * dependencies. |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 577 | * |
| 578 | * args syntax: <aclname> <acl_expr> |
| 579 | */ |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 580 | struct acl *parse_acl(const char **args, struct list *known_acl, char **err, struct arg_list *al) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 581 | { |
| 582 | __label__ out_return, out_free_acl_expr, out_free_name; |
| 583 | struct acl *cur_acl; |
| 584 | struct acl_expr *acl_expr; |
| 585 | char *name; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 586 | const char *pos; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 587 | |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 588 | if (**args && (pos = invalid_char(*args))) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 589 | memprintf(err, "invalid character in ACL name : '%c'", *pos); |
Willy Tarreau | 2e74c3f | 2007-12-02 18:45:09 +0100 | [diff] [blame] | 590 | goto out_return; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 591 | } |
Willy Tarreau | 2e74c3f | 2007-12-02 18:45:09 +0100 | [diff] [blame] | 592 | |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 593 | acl_expr = parse_acl_expr(args + 1, err, al); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 594 | if (!acl_expr) { |
| 595 | /* parse_acl_expr will have filled <err> here */ |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 596 | goto out_return; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 597 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 598 | |
Willy Tarreau | 404e8ab | 2009-07-26 19:40:40 +0200 | [diff] [blame] | 599 | /* Check for args beginning with an opening parenthesis just after the |
| 600 | * subject, as this is almost certainly a typo. Right now we can only |
| 601 | * emit a warning, so let's do so. |
| 602 | */ |
Krzysztof Piotr Oledzki | 4cdd831 | 2009-10-05 00:23:35 +0200 | [diff] [blame] | 603 | if (!strchr(args[1], '(') && *args[2] == '(') |
Willy Tarreau | 404e8ab | 2009-07-26 19:40:40 +0200 | [diff] [blame] | 604 | Warning("parsing acl '%s' :\n" |
| 605 | " matching '%s' for pattern '%s' is likely a mistake and probably\n" |
| 606 | " not what you want. Maybe you need to remove the extraneous space before '('.\n" |
| 607 | " If you are really sure this is not an error, please insert '--' between the\n" |
| 608 | " match and the pattern to make this warning message disappear.\n", |
| 609 | args[0], args[1], args[2]); |
| 610 | |
Willy Tarreau | 2a56c5e | 2010-03-15 16:13:29 +0100 | [diff] [blame] | 611 | if (*args[0]) |
| 612 | cur_acl = find_acl_by_name(args[0], known_acl); |
| 613 | else |
| 614 | cur_acl = NULL; |
| 615 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 616 | if (!cur_acl) { |
| 617 | name = strdup(args[0]); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 618 | if (!name) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 619 | memprintf(err, "out of memory when parsing ACL"); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 620 | goto out_free_acl_expr; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 621 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 622 | cur_acl = (struct acl *)calloc(1, sizeof(*cur_acl)); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 623 | if (cur_acl == NULL) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 624 | memprintf(err, "out of memory when parsing ACL"); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 625 | goto out_free_name; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 626 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 627 | |
| 628 | LIST_INIT(&cur_acl->expr); |
| 629 | LIST_ADDQ(known_acl, &cur_acl->list); |
| 630 | cur_acl->name = name; |
| 631 | } |
| 632 | |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 633 | /* We want to know what features the ACL needs (typically HTTP parsing), |
| 634 | * and where it may be used. If an ACL relies on multiple matches, it is |
| 635 | * OK if at least one of them may match in the context where it is used. |
| 636 | */ |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 637 | cur_acl->use |= acl_expr->smp->fetch->use; |
| 638 | cur_acl->val |= acl_expr->smp->fetch->val; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 639 | LIST_ADDQ(&cur_acl->expr, &acl_expr->list); |
| 640 | return cur_acl; |
| 641 | |
| 642 | out_free_name: |
| 643 | free(name); |
| 644 | out_free_acl_expr: |
| 645 | prune_acl_expr(acl_expr); |
| 646 | free(acl_expr); |
| 647 | out_return: |
| 648 | return NULL; |
| 649 | } |
| 650 | |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 651 | /* Some useful ACLs provided by default. Only those used are allocated. */ |
| 652 | |
| 653 | const struct { |
| 654 | const char *name; |
| 655 | const char *expr[4]; /* put enough for longest expression */ |
| 656 | } default_acl_list[] = { |
Willy Tarreau | 58393e1 | 2008-07-20 10:39:22 +0200 | [diff] [blame] | 657 | { .name = "TRUE", .expr = {"always_true",""}}, |
| 658 | { .name = "FALSE", .expr = {"always_false",""}}, |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 659 | { .name = "LOCALHOST", .expr = {"src","127.0.0.1/8",""}}, |
Willy Tarreau | 2492d5b | 2009-07-11 00:06:00 +0200 | [diff] [blame] | 660 | { .name = "HTTP", .expr = {"req_proto_http",""}}, |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 661 | { .name = "HTTP_1.0", .expr = {"req_ver","1.0",""}}, |
| 662 | { .name = "HTTP_1.1", .expr = {"req_ver","1.1",""}}, |
| 663 | { .name = "METH_CONNECT", .expr = {"method","CONNECT",""}}, |
| 664 | { .name = "METH_GET", .expr = {"method","GET","HEAD",""}}, |
| 665 | { .name = "METH_HEAD", .expr = {"method","HEAD",""}}, |
| 666 | { .name = "METH_OPTIONS", .expr = {"method","OPTIONS",""}}, |
| 667 | { .name = "METH_POST", .expr = {"method","POST",""}}, |
| 668 | { .name = "METH_TRACE", .expr = {"method","TRACE",""}}, |
| 669 | { .name = "HTTP_URL_ABS", .expr = {"url_reg","^[^/:]*://",""}}, |
| 670 | { .name = "HTTP_URL_SLASH", .expr = {"url_beg","/",""}}, |
| 671 | { .name = "HTTP_URL_STAR", .expr = {"url","*",""}}, |
| 672 | { .name = "HTTP_CONTENT", .expr = {"hdr_val(content-length)","gt","0",""}}, |
Emeric Brun | bede3d0 | 2009-06-30 17:54:00 +0200 | [diff] [blame] | 673 | { .name = "RDP_COOKIE", .expr = {"req_rdp_cookie_cnt","gt","0",""}}, |
Willy Tarreau | c631770 | 2008-07-20 09:29:50 +0200 | [diff] [blame] | 674 | { .name = "REQ_CONTENT", .expr = {"req_len","gt","0",""}}, |
Willy Tarreau | b6fb420 | 2008-07-20 11:18:28 +0200 | [diff] [blame] | 675 | { .name = "WAIT_END", .expr = {"wait_end",""}}, |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 676 | { .name = NULL, .expr = {""}} |
| 677 | }; |
| 678 | |
| 679 | /* Find a default ACL from the default_acl list, compile it and return it. |
| 680 | * If the ACL is not found, NULL is returned. In theory, it cannot fail, |
| 681 | * except when default ACLs are broken, in which case it will return NULL. |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 682 | * If <known_acl> is not NULL, the ACL will be queued at its tail. If <err> is |
| 683 | * not NULL, it will be filled with an error message if an error occurs. This |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 684 | * pointer must be freeable or NULL. <al> is an arg_list serving as a list head |
| 685 | * to report missing dependencies. |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 686 | */ |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 687 | static struct acl *find_acl_default(const char *acl_name, struct list *known_acl, |
| 688 | char **err, struct arg_list *al) |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 689 | { |
| 690 | __label__ out_return, out_free_acl_expr, out_free_name; |
| 691 | struct acl *cur_acl; |
| 692 | struct acl_expr *acl_expr; |
| 693 | char *name; |
| 694 | int index; |
| 695 | |
| 696 | for (index = 0; default_acl_list[index].name != NULL; index++) { |
| 697 | if (strcmp(acl_name, default_acl_list[index].name) == 0) |
| 698 | break; |
| 699 | } |
| 700 | |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 701 | if (default_acl_list[index].name == NULL) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 702 | memprintf(err, "no such ACL : '%s'", acl_name); |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 703 | return NULL; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 704 | } |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 705 | |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 706 | acl_expr = parse_acl_expr((const char **)default_acl_list[index].expr, err, al); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 707 | if (!acl_expr) { |
| 708 | /* parse_acl_expr must have filled err here */ |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 709 | goto out_return; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 710 | } |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 711 | |
| 712 | name = strdup(acl_name); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 713 | if (!name) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 714 | memprintf(err, "out of memory when building default ACL '%s'", acl_name); |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 715 | goto out_free_acl_expr; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 716 | } |
| 717 | |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 718 | cur_acl = (struct acl *)calloc(1, sizeof(*cur_acl)); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 719 | if (cur_acl == NULL) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 720 | memprintf(err, "out of memory when building default ACL '%s'", acl_name); |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 721 | goto out_free_name; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 722 | } |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 723 | |
| 724 | cur_acl->name = name; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 725 | cur_acl->use |= acl_expr->smp->fetch->use; |
| 726 | cur_acl->val |= acl_expr->smp->fetch->val; |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 727 | LIST_INIT(&cur_acl->expr); |
| 728 | LIST_ADDQ(&cur_acl->expr, &acl_expr->list); |
| 729 | if (known_acl) |
| 730 | LIST_ADDQ(known_acl, &cur_acl->list); |
| 731 | |
| 732 | return cur_acl; |
| 733 | |
| 734 | out_free_name: |
| 735 | free(name); |
| 736 | out_free_acl_expr: |
| 737 | prune_acl_expr(acl_expr); |
| 738 | free(acl_expr); |
| 739 | out_return: |
| 740 | return NULL; |
| 741 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 742 | |
| 743 | /* Purge everything in the acl_cond <cond>, then return <cond>. */ |
| 744 | struct acl_cond *prune_acl_cond(struct acl_cond *cond) |
| 745 | { |
| 746 | struct acl_term_suite *suite, *tmp_suite; |
| 747 | struct acl_term *term, *tmp_term; |
| 748 | |
| 749 | /* iterate through all term suites and free all terms and all suites */ |
| 750 | list_for_each_entry_safe(suite, tmp_suite, &cond->suites, list) { |
| 751 | list_for_each_entry_safe(term, tmp_term, &suite->terms, list) |
| 752 | free(term); |
| 753 | free(suite); |
| 754 | } |
| 755 | return cond; |
| 756 | } |
| 757 | |
| 758 | /* Parse an ACL condition starting at <args>[0], relying on a list of already |
| 759 | * known ACLs passed in <known_acl>. The new condition is returned (or NULL in |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 760 | * case of low memory). Supports multiple conditions separated by "or". If |
| 761 | * <err> is not NULL, it will be filled with a pointer to an error message in |
| 762 | * case of error, that the caller is responsible for freeing. The initial |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 763 | * location must either be freeable or NULL. The list <al> serves as a list head |
| 764 | * for unresolved dependencies. |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 765 | */ |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 766 | struct acl_cond *parse_acl_cond(const char **args, struct list *known_acl, |
Willy Tarreau | 0cba607 | 2013-11-28 22:21:02 +0100 | [diff] [blame^] | 767 | enum acl_cond_pol pol, char **err, struct arg_list *al) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 768 | { |
| 769 | __label__ out_return, out_free_suite, out_free_term; |
Willy Tarreau | 74b98a8 | 2007-06-16 19:35:18 +0200 | [diff] [blame] | 770 | int arg, neg; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 771 | const char *word; |
| 772 | struct acl *cur_acl; |
| 773 | struct acl_term *cur_term; |
| 774 | struct acl_term_suite *cur_suite; |
| 775 | struct acl_cond *cond; |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 776 | unsigned int suite_val; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 777 | |
| 778 | cond = (struct acl_cond *)calloc(1, sizeof(*cond)); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 779 | if (cond == NULL) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 780 | memprintf(err, "out of memory when parsing condition"); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 781 | goto out_return; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 782 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 783 | |
| 784 | LIST_INIT(&cond->list); |
| 785 | LIST_INIT(&cond->suites); |
| 786 | cond->pol = pol; |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 787 | cond->val = 0; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 788 | |
| 789 | cur_suite = NULL; |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 790 | suite_val = ~0U; |
Willy Tarreau | 74b98a8 | 2007-06-16 19:35:18 +0200 | [diff] [blame] | 791 | neg = 0; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 792 | for (arg = 0; *args[arg]; arg++) { |
| 793 | word = args[arg]; |
| 794 | |
| 795 | /* remove as many exclamation marks as we can */ |
| 796 | while (*word == '!') { |
| 797 | neg = !neg; |
| 798 | word++; |
| 799 | } |
| 800 | |
| 801 | /* an empty word is allowed because we cannot force the user to |
| 802 | * always think about not leaving exclamation marks alone. |
| 803 | */ |
| 804 | if (!*word) |
| 805 | continue; |
| 806 | |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 807 | if (strcasecmp(word, "or") == 0 || strcmp(word, "||") == 0) { |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 808 | /* new term suite */ |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 809 | cond->val |= suite_val; |
| 810 | suite_val = ~0U; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 811 | cur_suite = NULL; |
| 812 | neg = 0; |
| 813 | continue; |
| 814 | } |
| 815 | |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 816 | if (strcmp(word, "{") == 0) { |
| 817 | /* we may have a complete ACL expression between two braces, |
| 818 | * find the last one. |
| 819 | */ |
| 820 | int arg_end = arg + 1; |
| 821 | const char **args_new; |
| 822 | |
| 823 | while (*args[arg_end] && strcmp(args[arg_end], "}") != 0) |
| 824 | arg_end++; |
| 825 | |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 826 | if (!*args[arg_end]) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 827 | memprintf(err, "missing closing '}' in condition"); |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 828 | goto out_free_suite; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 829 | } |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 830 | |
| 831 | args_new = calloc(1, (arg_end - arg + 1) * sizeof(*args_new)); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 832 | if (!args_new) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 833 | memprintf(err, "out of memory when parsing condition"); |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 834 | goto out_free_suite; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 835 | } |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 836 | |
Willy Tarreau | 2a56c5e | 2010-03-15 16:13:29 +0100 | [diff] [blame] | 837 | args_new[0] = ""; |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 838 | memcpy(args_new + 1, args + arg + 1, (arg_end - arg) * sizeof(*args_new)); |
| 839 | args_new[arg_end - arg] = ""; |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 840 | cur_acl = parse_acl(args_new, known_acl, err, al); |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 841 | free(args_new); |
| 842 | |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 843 | if (!cur_acl) { |
| 844 | /* note that parse_acl() must have filled <err> here */ |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 845 | goto out_free_suite; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 846 | } |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 847 | word = args[arg + 1]; |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 848 | arg = arg_end; |
| 849 | } |
| 850 | else { |
| 851 | /* search for <word> in the known ACL names. If we do not find |
| 852 | * it, let's look for it in the default ACLs, and if found, add |
| 853 | * it to the list of ACLs of this proxy. This makes it possible |
| 854 | * to override them. |
| 855 | */ |
| 856 | cur_acl = find_acl_by_name(word, known_acl); |
| 857 | if (cur_acl == NULL) { |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 858 | cur_acl = find_acl_default(word, known_acl, err, al); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 859 | if (cur_acl == NULL) { |
| 860 | /* note that find_acl_default() must have filled <err> here */ |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 861 | goto out_free_suite; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 862 | } |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 863 | } |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 864 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 865 | |
| 866 | cur_term = (struct acl_term *)calloc(1, sizeof(*cur_term)); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 867 | if (cur_term == NULL) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 868 | memprintf(err, "out of memory when parsing condition"); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 869 | goto out_free_suite; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 870 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 871 | |
| 872 | cur_term->acl = cur_acl; |
| 873 | cur_term->neg = neg; |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 874 | |
| 875 | /* Here it is a bit complex. The acl_term_suite is a conjunction |
| 876 | * of many terms. It may only be used if all of its terms are |
| 877 | * usable at the same time. So the suite's validity domain is an |
| 878 | * AND between all ACL keywords' ones. But, the global condition |
| 879 | * is valid if at least one term suite is OK. So it's an OR between |
| 880 | * all of their validity domains. We could emit a warning as soon |
| 881 | * as suite_val is null because it means that the last ACL is not |
| 882 | * compatible with the previous ones. Let's remain simple for now. |
| 883 | */ |
| 884 | cond->use |= cur_acl->use; |
| 885 | suite_val &= cur_acl->val; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 886 | |
| 887 | if (!cur_suite) { |
| 888 | cur_suite = (struct acl_term_suite *)calloc(1, sizeof(*cur_suite)); |
Willy Tarreau | f678b7f | 2013-01-24 00:25:39 +0100 | [diff] [blame] | 889 | if (cur_suite == NULL) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 890 | memprintf(err, "out of memory when parsing condition"); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 891 | goto out_free_term; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 892 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 893 | LIST_INIT(&cur_suite->terms); |
| 894 | LIST_ADDQ(&cond->suites, &cur_suite->list); |
| 895 | } |
| 896 | LIST_ADDQ(&cur_suite->terms, &cur_term->list); |
Willy Tarreau | 74b98a8 | 2007-06-16 19:35:18 +0200 | [diff] [blame] | 897 | neg = 0; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 898 | } |
| 899 | |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 900 | cond->val |= suite_val; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 901 | return cond; |
| 902 | |
| 903 | out_free_term: |
| 904 | free(cur_term); |
| 905 | out_free_suite: |
| 906 | prune_acl_cond(cond); |
| 907 | free(cond); |
| 908 | out_return: |
| 909 | return NULL; |
| 910 | } |
| 911 | |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 912 | /* Builds an ACL condition starting at the if/unless keyword. The complete |
| 913 | * condition is returned. NULL is returned in case of error or if the first |
| 914 | * word is neither "if" nor "unless". It automatically sets the file name and |
Willy Tarreau | 25320b2 | 2013-03-24 07:22:08 +0100 | [diff] [blame] | 915 | * the line number in the condition for better error reporting, and sets the |
| 916 | * HTTP intiailization requirements in the proxy. If <err> is not NULL, it will |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 917 | * be filled with a pointer to an error message in case of error, that the |
| 918 | * caller is responsible for freeing. The initial location must either be |
| 919 | * freeable or NULL. |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 920 | */ |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 921 | struct acl_cond *build_acl_cond(const char *file, int line, struct proxy *px, const char **args, char **err) |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 922 | { |
Willy Tarreau | 0cba607 | 2013-11-28 22:21:02 +0100 | [diff] [blame^] | 923 | enum acl_cond_pol pol = ACL_COND_NONE; |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 924 | struct acl_cond *cond = NULL; |
| 925 | |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 926 | if (err) |
| 927 | *err = NULL; |
| 928 | |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 929 | if (!strcmp(*args, "if")) { |
| 930 | pol = ACL_COND_IF; |
| 931 | args++; |
| 932 | } |
| 933 | else if (!strcmp(*args, "unless")) { |
| 934 | pol = ACL_COND_UNLESS; |
| 935 | args++; |
| 936 | } |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 937 | else { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 938 | memprintf(err, "conditions must start with either 'if' or 'unless'"); |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 939 | return NULL; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 940 | } |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 941 | |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 942 | cond = parse_acl_cond(args, &px->acl, pol, err, &px->conf.args); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 943 | if (!cond) { |
| 944 | /* note that parse_acl_cond must have filled <err> here */ |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 945 | return NULL; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 946 | } |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 947 | |
| 948 | cond->file = file; |
| 949 | cond->line = line; |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 950 | px->http_needed |= !!(cond->use & SMP_USE_HTTP_ANY); |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 951 | return cond; |
| 952 | } |
| 953 | |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 954 | /* Execute condition <cond> and return either ACL_TEST_FAIL, ACL_TEST_MISS or |
| 955 | * ACL_TEST_PASS depending on the test results. ACL_TEST_MISS may only be |
Willy Tarreau | 32a6f2e | 2012-04-25 10:13:36 +0200 | [diff] [blame] | 956 | * returned if <opt> does not contain SMP_OPT_FINAL, indicating that incomplete |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 957 | * data is being examined. The function automatically sets SMP_OPT_ITERATE. This |
| 958 | * function only computes the condition, it does not apply the polarity required |
| 959 | * by IF/UNLESS, it's up to the caller to do this using something like this : |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 960 | * |
| 961 | * res = acl_pass(res); |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 962 | * if (res == ACL_TEST_MISS) |
Willy Tarreau | b686644 | 2008-07-14 23:54:42 +0200 | [diff] [blame] | 963 | * return 0; |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 964 | * if (cond->pol == ACL_COND_UNLESS) |
| 965 | * res = !res; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 966 | */ |
Willy Tarreau | 0cba607 | 2013-11-28 22:21:02 +0100 | [diff] [blame^] | 967 | enum acl_test_res acl_exec_cond(struct acl_cond *cond, struct proxy *px, struct session *l4, void *l7, unsigned int opt) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 968 | { |
| 969 | __label__ fetch_next; |
| 970 | struct acl_term_suite *suite; |
| 971 | struct acl_term *term; |
| 972 | struct acl_expr *expr; |
| 973 | struct acl *acl; |
Willy Tarreau | 3740635 | 2012-04-23 16:16:37 +0200 | [diff] [blame] | 974 | struct sample smp; |
Willy Tarreau | 0cba607 | 2013-11-28 22:21:02 +0100 | [diff] [blame^] | 975 | enum acl_test_res acl_res, suite_res, cond_res; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 976 | |
Willy Tarreau | 7a777ed | 2012-04-26 11:44:02 +0200 | [diff] [blame] | 977 | /* ACLs are iterated over all values, so let's always set the flag to |
| 978 | * indicate this to the fetch functions. |
| 979 | */ |
| 980 | opt |= SMP_OPT_ITERATE; |
| 981 | |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 982 | /* We're doing a logical OR between conditions so we initialize to FAIL. |
| 983 | * The MISS status is propagated down from the suites. |
| 984 | */ |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 985 | cond_res = ACL_TEST_FAIL; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 986 | list_for_each_entry(suite, &cond->suites, list) { |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 987 | /* Evaluate condition suite <suite>. We stop at the first term |
Willy Tarreau | 0cba607 | 2013-11-28 22:21:02 +0100 | [diff] [blame^] | 988 | * which returns ACL_TEST_FAIL. The MISS status is still propagated |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 989 | * in case of uncertainty in the result. |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 990 | */ |
| 991 | |
| 992 | /* we're doing a logical AND between terms, so we must set the |
| 993 | * initial value to PASS. |
| 994 | */ |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 995 | suite_res = ACL_TEST_PASS; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 996 | list_for_each_entry(term, &suite->terms, list) { |
| 997 | acl = term->acl; |
| 998 | |
| 999 | /* FIXME: use cache ! |
| 1000 | * check acl->cache_idx for this. |
| 1001 | */ |
| 1002 | |
| 1003 | /* ACL result not cached. Let's scan all the expressions |
| 1004 | * and use the first one to match. |
| 1005 | */ |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 1006 | acl_res = ACL_TEST_FAIL; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1007 | list_for_each_entry(expr, &acl->expr, list) { |
Willy Tarreau | d41f8d8 | 2007-06-10 10:06:18 +0200 | [diff] [blame] | 1008 | /* we need to reset context and flags */ |
Willy Tarreau | 3740635 | 2012-04-23 16:16:37 +0200 | [diff] [blame] | 1009 | memset(&smp, 0, sizeof(smp)); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1010 | fetch_next: |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1011 | if (!sample_process(px, l4, l7, opt, expr->smp, &smp)) { |
Willy Tarreau | b686644 | 2008-07-14 23:54:42 +0200 | [diff] [blame] | 1012 | /* maybe we could not fetch because of missing data */ |
Willy Tarreau | 32a6f2e | 2012-04-25 10:13:36 +0200 | [diff] [blame] | 1013 | if (smp.flags & SMP_F_MAY_CHANGE && !(opt & SMP_OPT_FINAL)) |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 1014 | acl_res |= ACL_TEST_MISS; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1015 | continue; |
Willy Tarreau | b686644 | 2008-07-14 23:54:42 +0200 | [diff] [blame] | 1016 | } |
Willy Tarreau | c426296 | 2010-05-10 23:42:40 +0200 | [diff] [blame] | 1017 | |
Willy Tarreau | 0cba607 | 2013-11-28 22:21:02 +0100 | [diff] [blame^] | 1018 | acl_res |= pat2acl(pattern_exec_match(&expr->pat, &smp, NULL)); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1019 | /* |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1020 | * OK now acl_res holds the result of this expression |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 1021 | * as one of ACL_TEST_FAIL, ACL_TEST_MISS or ACL_TEST_PASS. |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1022 | * |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1023 | * Then if (!MISS) we can cache the result, and put |
Willy Tarreau | 3740635 | 2012-04-23 16:16:37 +0200 | [diff] [blame] | 1024 | * (smp.flags & SMP_F_VOLATILE) in the cache flags. |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1025 | * |
| 1026 | * FIXME: implement cache. |
| 1027 | * |
| 1028 | */ |
| 1029 | |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1030 | /* we're ORing these terms, so a single PASS is enough */ |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 1031 | if (acl_res == ACL_TEST_PASS) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1032 | break; |
| 1033 | |
Willy Tarreau | 3740635 | 2012-04-23 16:16:37 +0200 | [diff] [blame] | 1034 | if (smp.flags & SMP_F_NOT_LAST) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1035 | goto fetch_next; |
Willy Tarreau | b686644 | 2008-07-14 23:54:42 +0200 | [diff] [blame] | 1036 | |
| 1037 | /* sometimes we know the fetched data is subject to change |
| 1038 | * later and give another chance for a new match (eg: request |
| 1039 | * size, time, ...) |
| 1040 | */ |
Willy Tarreau | 32a6f2e | 2012-04-25 10:13:36 +0200 | [diff] [blame] | 1041 | if (smp.flags & SMP_F_MAY_CHANGE && !(opt & SMP_OPT_FINAL)) |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 1042 | acl_res |= ACL_TEST_MISS; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1043 | } |
| 1044 | /* |
| 1045 | * Here we have the result of an ACL (cached or not). |
| 1046 | * ACLs are combined, negated or not, to form conditions. |
| 1047 | */ |
| 1048 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1049 | if (term->neg) |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1050 | acl_res = acl_neg(acl_res); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1051 | |
| 1052 | suite_res &= acl_res; |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1053 | |
Willy Tarreau | 79c412b | 2013-10-30 19:30:32 +0100 | [diff] [blame] | 1054 | /* we're ANDing these terms, so a single FAIL or MISS is enough */ |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 1055 | if (suite_res != ACL_TEST_PASS) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1056 | break; |
| 1057 | } |
| 1058 | cond_res |= suite_res; |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1059 | |
| 1060 | /* we're ORing these terms, so a single PASS is enough */ |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 1061 | if (cond_res == ACL_TEST_PASS) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1062 | break; |
| 1063 | } |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1064 | return cond_res; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1065 | } |
| 1066 | |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 1067 | /* Returns a pointer to the first ACL conflicting with usage at place <where> |
| 1068 | * which is one of the SMP_VAL_* bits indicating a check place, or NULL if |
| 1069 | * no conflict is found. Only full conflicts are detected (ACL is not usable). |
| 1070 | * Use the next function to check for useless keywords. |
Willy Tarreau | dd64f8d | 2008-07-27 22:02:32 +0200 | [diff] [blame] | 1071 | */ |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 1072 | const struct acl *acl_cond_conflicts(const struct acl_cond *cond, unsigned int where) |
Willy Tarreau | dd64f8d | 2008-07-27 22:02:32 +0200 | [diff] [blame] | 1073 | { |
| 1074 | struct acl_term_suite *suite; |
| 1075 | struct acl_term *term; |
| 1076 | struct acl *acl; |
| 1077 | |
| 1078 | list_for_each_entry(suite, &cond->suites, list) { |
| 1079 | list_for_each_entry(term, &suite->terms, list) { |
| 1080 | acl = term->acl; |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 1081 | if (!(acl->val & where)) |
Willy Tarreau | dd64f8d | 2008-07-27 22:02:32 +0200 | [diff] [blame] | 1082 | return acl; |
| 1083 | } |
| 1084 | } |
| 1085 | return NULL; |
| 1086 | } |
| 1087 | |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 1088 | /* Returns a pointer to the first ACL and its first keyword to conflict with |
| 1089 | * usage at place <where> which is one of the SMP_VAL_* bits indicating a check |
| 1090 | * place. Returns true if a conflict is found, with <acl> and <kw> set (if non |
| 1091 | * null), or false if not conflict is found. The first useless keyword is |
| 1092 | * returned. |
| 1093 | */ |
Willy Tarreau | 93fddf1 | 2013-03-31 22:59:32 +0200 | [diff] [blame] | 1094 | int acl_cond_kw_conflicts(const struct acl_cond *cond, unsigned int where, struct acl const **acl, char const **kw) |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 1095 | { |
| 1096 | struct acl_term_suite *suite; |
| 1097 | struct acl_term *term; |
| 1098 | struct acl_expr *expr; |
| 1099 | |
| 1100 | list_for_each_entry(suite, &cond->suites, list) { |
| 1101 | list_for_each_entry(term, &suite->terms, list) { |
| 1102 | list_for_each_entry(expr, &term->acl->expr, list) { |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1103 | if (!(expr->smp->fetch->val & where)) { |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 1104 | if (acl) |
| 1105 | *acl = term->acl; |
| 1106 | if (kw) |
| 1107 | *kw = expr->kw; |
| 1108 | return 1; |
| 1109 | } |
| 1110 | } |
| 1111 | } |
| 1112 | } |
| 1113 | return 0; |
| 1114 | } |
| 1115 | |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1116 | /* |
| 1117 | * Find targets for userlist and groups in acl. Function returns the number |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1118 | * of errors or OK if everything is fine. It must be called only once sample |
| 1119 | * fetch arguments have been resolved (after smp_resolve_args()). |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1120 | */ |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1121 | int acl_find_targets(struct proxy *p) |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1122 | { |
| 1123 | |
| 1124 | struct acl *acl; |
| 1125 | struct acl_expr *expr; |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 1126 | struct pattern *pattern; |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1127 | int cfgerr = 0; |
| 1128 | |
| 1129 | list_for_each_entry(acl, &p->acl, list) { |
| 1130 | list_for_each_entry(expr, &acl->expr, list) { |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1131 | if (!strcmp(expr->kw, "http_auth_group")) { |
| 1132 | /* Note: the ARGT_USR argument may only have been resolved earlier |
| 1133 | * by smp_resolve_args(). |
| 1134 | */ |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1135 | if (expr->smp->arg_p->unresolved) { |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1136 | Alert("Internal bug in proxy %s: %sacl %s %s() makes use of unresolved userlist '%s'. Please report this.\n", |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1137 | p->id, *acl->name ? "" : "anonymous ", acl->name, expr->kw, expr->smp->arg_p->data.str.str); |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1138 | cfgerr++; |
Willy Tarreau | 496aa01 | 2012-06-01 10:38:29 +0200 | [diff] [blame] | 1139 | continue; |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1140 | } |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1141 | |
Thierry FOURNIER | d163e1c | 2013-11-28 11:41:23 +0100 | [diff] [blame] | 1142 | if (LIST_ISEMPTY(&expr->pat.patterns)) { |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1143 | Alert("proxy %s: acl %s %s(): no groups specified.\n", |
Willy Tarreau | 93fddf1 | 2013-03-31 22:59:32 +0200 | [diff] [blame] | 1144 | p->id, acl->name, expr->kw); |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1145 | cfgerr++; |
| 1146 | continue; |
| 1147 | } |
| 1148 | |
Thierry FOURNIER | d163e1c | 2013-11-28 11:41:23 +0100 | [diff] [blame] | 1149 | list_for_each_entry(pattern, &expr->pat.patterns, list) { |
Willy Tarreau | 7d1df41 | 2012-11-23 23:47:36 +0100 | [diff] [blame] | 1150 | /* this keyword only has one argument */ |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1151 | pattern->val.group_mask = auth_resolve_groups(expr->smp->arg_p->data.usr, pattern->ptr.str); |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1152 | |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1153 | if (!pattern->val.group_mask) { |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1154 | Alert("proxy %s: acl %s %s(): invalid group '%s'.\n", |
| 1155 | p->id, acl->name, expr->kw, pattern->ptr.str); |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1156 | cfgerr++; |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1157 | } |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1158 | free(pattern->ptr.str); |
| 1159 | pattern->ptr.str = NULL; |
| 1160 | pattern->len = 0; |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1161 | } |
| 1162 | } |
| 1163 | } |
| 1164 | } |
| 1165 | |
| 1166 | return cfgerr; |
| 1167 | } |
Willy Tarreau | dd64f8d | 2008-07-27 22:02:32 +0200 | [diff] [blame] | 1168 | |
Willy Tarreau | 8ed669b | 2013-01-11 15:49:37 +0100 | [diff] [blame] | 1169 | /* initializes ACLs by resolving the sample fetch names they rely upon. |
| 1170 | * Returns 0 on success, otherwise an error. |
| 1171 | */ |
| 1172 | int init_acl() |
| 1173 | { |
| 1174 | int err = 0; |
| 1175 | int index; |
| 1176 | const char *name; |
| 1177 | struct acl_kw_list *kwl; |
| 1178 | struct sample_fetch *smp; |
| 1179 | |
| 1180 | list_for_each_entry(kwl, &acl_keywords.list, list) { |
| 1181 | for (index = 0; kwl->kw[index].kw != NULL; index++) { |
| 1182 | name = kwl->kw[index].fetch_kw; |
| 1183 | if (!name) |
| 1184 | name = kwl->kw[index].kw; |
| 1185 | |
| 1186 | smp = find_sample_fetch(name, strlen(name)); |
| 1187 | if (!smp) { |
| 1188 | Alert("Critical internal error: ACL keyword '%s' relies on sample fetch '%s' which was not registered!\n", |
| 1189 | kwl->kw[index].kw, name); |
| 1190 | err++; |
| 1191 | continue; |
| 1192 | } |
| 1193 | kwl->kw[index].smp = smp; |
| 1194 | } |
| 1195 | } |
| 1196 | return err; |
| 1197 | } |
Willy Tarreau | d4c33c8 | 2013-01-07 21:59:07 +0100 | [diff] [blame] | 1198 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1199 | /************************************************************************/ |
Willy Tarreau | d4c33c8 | 2013-01-07 21:59:07 +0100 | [diff] [blame] | 1200 | /* All supported sample and ACL keywords must be declared here. */ |
| 1201 | /************************************************************************/ |
| 1202 | |
| 1203 | /* Note: must not be declared <const> as its list will be overwritten. |
Willy Tarreau | 61612d4 | 2012-04-19 18:42:05 +0200 | [diff] [blame] | 1204 | * Please take care of keeping this list alphabetically sorted. |
| 1205 | */ |
Willy Tarreau | dc13c11 | 2013-06-21 23:16:39 +0200 | [diff] [blame] | 1206 | static struct acl_kw_list acl_kws = {ILH, { |
Willy Tarreau | d4c33c8 | 2013-01-07 21:59:07 +0100 | [diff] [blame] | 1207 | { /* END */ }, |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1208 | }}; |
| 1209 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1210 | __attribute__((constructor)) |
| 1211 | static void __acl_init(void) |
| 1212 | { |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1213 | acl_register_keywords(&acl_kws); |
| 1214 | } |
| 1215 | |
| 1216 | |
| 1217 | /* |
| 1218 | * Local variables: |
| 1219 | * c-indent-level: 8 |
| 1220 | * c-basic-offset: 8 |
| 1221 | * End: |
| 1222 | */ |