Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1 | /* |
| 2 | include/proto/acl.h |
| 3 | This file provides interface definitions for ACL manipulation. |
| 4 | |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 5 | Copyright (C) 2000-2008 Willy Tarreau - w@1wt.eu |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 6 | |
| 7 | This library is free software; you can redistribute it and/or |
| 8 | modify it under the terms of the GNU Lesser General Public |
| 9 | License as published by the Free Software Foundation, version 2.1 |
| 10 | exclusively. |
| 11 | |
| 12 | This library is distributed in the hope that it will be useful, |
| 13 | but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 14 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
| 15 | Lesser General Public License for more details. |
| 16 | |
| 17 | You should have received a copy of the GNU Lesser General Public |
| 18 | License along with this library; if not, write to the Free Software |
| 19 | Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA |
| 20 | */ |
| 21 | |
| 22 | #ifndef _PROTO_ACL_H |
| 23 | #define _PROTO_ACL_H |
| 24 | |
| 25 | #include <common/config.h> |
| 26 | #include <types/acl.h> |
| 27 | |
| 28 | /* |
| 29 | * FIXME: we need destructor functions too ! |
| 30 | */ |
| 31 | |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 32 | /* Negate an acl result. This turns (ACL_PAT_FAIL, ACL_PAT_MISS, ACL_PAT_PASS) |
| 33 | * into (ACL_PAT_PASS, ACL_PAT_MISS, ACL_PAT_FAIL). |
| 34 | */ |
| 35 | static inline int acl_neg(int res) |
| 36 | { |
| 37 | return (3 >> res); |
| 38 | } |
| 39 | |
| 40 | /* Convert an acl result to a boolean. Only ACL_PAT_PASS returns 1. */ |
| 41 | static inline int acl_pass(int res) |
| 42 | { |
| 43 | return (res >> 1); |
| 44 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 45 | |
| 46 | /* Return a pointer to the ACL <name> within the list starting at <head>, or |
| 47 | * NULL if not found. |
| 48 | */ |
| 49 | struct acl *find_acl_by_name(const char *name, struct list *head); |
| 50 | |
| 51 | /* Return a pointer to the ACL keyword <kw> within the list starting at <head>, |
| 52 | * or NULL if not found. Note that if <kw> contains an opening parenthesis, |
| 53 | * only the left part of it is checked. |
| 54 | */ |
| 55 | struct acl_keyword *find_acl_kw(const char *kw); |
| 56 | |
| 57 | /* Parse an ACL expression starting at <args>[0], and return it. |
| 58 | * Right now, the only accepted syntax is : |
| 59 | * <subject> [<value>...] |
| 60 | */ |
| 61 | struct acl_expr *parse_acl_expr(const char **args); |
| 62 | |
Krzysztof Piotr Oledzki | a643baf | 2008-05-29 23:53:44 +0200 | [diff] [blame] | 63 | /* Purge everything in the acl <acl>, then return <acl>. */ |
| 64 | struct acl *prune_acl(struct acl *acl); |
| 65 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 66 | /* Parse an ACL with the name starting at <args>[0], and with a list of already |
| 67 | * known ACLs in <acl>. If the ACL was not in the list, it will be added. |
| 68 | * A pointer to that ACL is returned. |
| 69 | * |
| 70 | * args syntax: <aclname> <acl_expr> |
| 71 | */ |
| 72 | struct acl *parse_acl(const char **args, struct list *known_acl); |
| 73 | |
| 74 | /* Purge everything in the acl_cond <cond>, then return <cond>. */ |
| 75 | struct acl_cond *prune_acl_cond(struct acl_cond *cond); |
| 76 | |
| 77 | /* Parse an ACL condition starting at <args>[0], relying on a list of already |
| 78 | * known ACLs passed in <known_acl>. The new condition is returned (or NULL in |
| 79 | * case of low memory). Supports multiple conditions separated by "or". |
| 80 | */ |
| 81 | struct acl_cond *parse_acl_cond(const char **args, struct list *known_acl, int pol); |
| 82 | |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 83 | /* Execute condition <cond> and return either ACL_PAT_FAIL, ACL_PAT_MISS or |
| 84 | * ACL_PAT_PASS depending on the test results. This function only computes the |
| 85 | * condition, it does not apply the polarity required by IF/UNLESS, it's up to |
| 86 | * the caller to do this. |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 87 | */ |
Willy Tarreau | d41f8d8 | 2007-06-10 10:06:18 +0200 | [diff] [blame] | 88 | int acl_exec_cond(struct acl_cond *cond, struct proxy *px, struct session *l4, void *l7, int dir); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 89 | |
| 90 | /* Return a pointer to the ACL <name> within the list starting at <head>, or |
| 91 | * NULL if not found. |
| 92 | */ |
| 93 | struct acl *find_acl_by_name(const char *name, struct list *head); |
| 94 | |
| 95 | /* |
| 96 | * Registers the ACL keyword list <kwl> as a list of valid keywords for next |
| 97 | * parsing sessions. |
| 98 | */ |
| 99 | void acl_register_keywords(struct acl_kw_list *kwl); |
| 100 | |
| 101 | /* |
| 102 | * Unregisters the ACL keyword list <kwl> from the list of valid keywords. |
| 103 | */ |
| 104 | void acl_unregister_keywords(struct acl_kw_list *kwl); |
| 105 | |
| 106 | |
| 107 | /* |
| 108 | * |
| 109 | * The following functions are general purpose ACL matching functions. |
| 110 | * |
| 111 | */ |
| 112 | |
| 113 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 114 | /* NB: For two strings to be identical, it is required that their lengths match */ |
| 115 | int acl_match_str(struct acl_test *test, struct acl_pattern *pattern); |
| 116 | |
| 117 | /* Checks that the integer in <test> is included between min and max */ |
Willy Tarreau | ae8b796 | 2007-06-09 23:10:04 +0200 | [diff] [blame] | 118 | int acl_match_int(struct acl_test *test, struct acl_pattern *pattern); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 119 | |
| 120 | /* Parse an integer. It is put both in min and max. */ |
Willy Tarreau | ae8b796 | 2007-06-09 23:10:04 +0200 | [diff] [blame] | 121 | int acl_parse_int(const char **text, struct acl_pattern *pattern, int *opaque); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 122 | |
| 123 | /* Parse a range of integers delimited by either ':' or '-'. If only one |
| 124 | * integer is read, it is set as both min and max. |
| 125 | */ |
Willy Tarreau | ae8b796 | 2007-06-09 23:10:04 +0200 | [diff] [blame] | 126 | int acl_parse_range(const char **text, struct acl_pattern *pattern, int *opaque); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 127 | |
| 128 | /* Parse a string. It is allocated and duplicated. */ |
Willy Tarreau | ae8b796 | 2007-06-09 23:10:04 +0200 | [diff] [blame] | 129 | int acl_parse_str(const char **text, struct acl_pattern *pattern, int *opaque); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 130 | |
Willy Tarreau | f3d2598 | 2007-05-08 22:45:09 +0200 | [diff] [blame] | 131 | /* Parse a regex. It is allocated. */ |
Willy Tarreau | ae8b796 | 2007-06-09 23:10:04 +0200 | [diff] [blame] | 132 | int acl_parse_reg(const char **text, struct acl_pattern *pattern, int *opaque); |
Willy Tarreau | f3d2598 | 2007-05-08 22:45:09 +0200 | [diff] [blame] | 133 | |
Willy Tarreau | a67fad9 | 2007-05-08 19:50:09 +0200 | [diff] [blame] | 134 | /* Parse an IP address and an optional mask in the form addr[/mask]. |
| 135 | * The addr may either be an IPv4 address or a hostname. The mask |
| 136 | * may either be a dotted mask or a number of bits. Returns 1 if OK, |
| 137 | * otherwise 0. |
| 138 | */ |
Willy Tarreau | ae8b796 | 2007-06-09 23:10:04 +0200 | [diff] [blame] | 139 | int acl_parse_ip(const char **text, struct acl_pattern *pattern, int *opaque); |
Willy Tarreau | a67fad9 | 2007-05-08 19:50:09 +0200 | [diff] [blame] | 140 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 141 | /* Checks that the pattern matches the end of the tested string. */ |
| 142 | int acl_match_end(struct acl_test *test, struct acl_pattern *pattern); |
| 143 | |
| 144 | /* Checks that the pattern matches the beginning of the tested string. */ |
| 145 | int acl_match_beg(struct acl_test *test, struct acl_pattern *pattern); |
| 146 | |
| 147 | /* Checks that the pattern is included inside the tested string. */ |
| 148 | int acl_match_sub(struct acl_test *test, struct acl_pattern *pattern); |
| 149 | |
| 150 | /* Checks that the pattern is included inside the tested string, but enclosed |
| 151 | * between slashes or at the beginning or end of the string. Slashes at the |
| 152 | * beginning or end of the pattern are ignored. |
| 153 | */ |
| 154 | int acl_match_dir(struct acl_test *test, struct acl_pattern *pattern); |
| 155 | |
| 156 | /* Checks that the pattern is included inside the tested string, but enclosed |
| 157 | * between dots or at the beginning or end of the string. Dots at the beginning |
| 158 | * or end of the pattern are ignored. |
| 159 | */ |
| 160 | int acl_match_dom(struct acl_test *test, struct acl_pattern *pattern); |
| 161 | |
Willy Tarreau | a67fad9 | 2007-05-08 19:50:09 +0200 | [diff] [blame] | 162 | /* Check that the IPv4 address in <test> matches the IP/mask in pattern */ |
| 163 | int acl_match_ip(struct acl_test *test, struct acl_pattern *pattern); |
| 164 | |
Willy Tarreau | f3d2598 | 2007-05-08 22:45:09 +0200 | [diff] [blame] | 165 | /* Executes a regex. It needs to change the data. If it is marked READ_ONLY |
| 166 | * then it will be allocated and duplicated in place so that others may use |
| 167 | * it later on. Note that this is embarrassing because we always try to avoid |
| 168 | * allocating memory at run time. |
| 169 | */ |
| 170 | int acl_match_reg(struct acl_test *test, struct acl_pattern *pattern); |
| 171 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 172 | #endif /* _PROTO_ACL_H */ |
| 173 | |
| 174 | /* |
| 175 | * Local variables: |
| 176 | * c-indent-level: 8 |
| 177 | * c-basic-offset: 8 |
| 178 | * End: |
| 179 | */ |