Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1 | /* |
| 2 | * ACL management functions. |
| 3 | * |
Willy Tarreau | d4c33c8 | 2013-01-07 21:59:07 +0100 | [diff] [blame] | 4 | * Copyright 2000-2013 Willy Tarreau <w@1wt.eu> |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 5 | * |
| 6 | * This program is free software; you can redistribute it and/or |
| 7 | * modify it under the terms of the GNU General Public License |
| 8 | * as published by the Free Software Foundation; either version |
| 9 | * 2 of the License, or (at your option) any later version. |
| 10 | * |
| 11 | */ |
| 12 | |
Willy Tarreau | ae8b796 | 2007-06-09 23:10:04 +0200 | [diff] [blame] | 13 | #include <ctype.h> |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 14 | #include <stdio.h> |
| 15 | #include <string.h> |
| 16 | |
| 17 | #include <common/config.h> |
| 18 | #include <common/mini-clist.h> |
| 19 | #include <common/standard.h> |
Krzysztof Piotr Oledzki | 8c8bd45 | 2010-01-29 19:29:32 +0100 | [diff] [blame] | 20 | #include <common/uri_auth.h> |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 21 | |
Willy Tarreau | 2b5285d | 2010-05-09 23:45:24 +0200 | [diff] [blame] | 22 | #include <types/global.h> |
| 23 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 24 | #include <proto/acl.h> |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 25 | #include <proto/arg.h> |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 26 | #include <proto/auth.h> |
Willy Tarreau | c7e4238 | 2012-08-24 19:22:53 +0200 | [diff] [blame] | 27 | #include <proto/channel.h> |
Willy Tarreau | 404e8ab | 2009-07-26 19:40:40 +0200 | [diff] [blame] | 28 | #include <proto/log.h> |
Thierry FOURNIER | ed66c29 | 2013-11-28 11:05:19 +0100 | [diff] [blame] | 29 | #include <proto/pattern.h> |
Willy Tarreau | 0b1cd94 | 2010-05-16 22:18:27 +0200 | [diff] [blame] | 30 | #include <proto/proxy.h> |
Willy Tarreau | 8ed669b | 2013-01-11 15:49:37 +0100 | [diff] [blame] | 31 | #include <proto/sample.h> |
Willy Tarreau | d28c353 | 2012-04-19 19:28:33 +0200 | [diff] [blame] | 32 | #include <proto/stick_table.h> |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 33 | |
Willy Tarreau | c426296 | 2010-05-10 23:42:40 +0200 | [diff] [blame] | 34 | #include <ebsttree.h> |
| 35 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 36 | /* List head of all known ACL keywords */ |
| 37 | static struct acl_kw_list acl_keywords = { |
| 38 | .list = LIST_HEAD_INIT(acl_keywords.list) |
| 39 | }; |
| 40 | |
Willy Tarreau | 0cba607 | 2013-11-28 22:21:02 +0100 | [diff] [blame] | 41 | /* input values are 0 or 3, output is the same */ |
Thierry FOURNIER | 1794fdf | 2014-01-17 15:25:13 +0100 | [diff] [blame] | 42 | static inline enum acl_test_res pat2acl(struct pattern *pat) |
Willy Tarreau | 0cba607 | 2013-11-28 22:21:02 +0100 | [diff] [blame] | 43 | { |
Thierry FOURNIER | 1794fdf | 2014-01-17 15:25:13 +0100 | [diff] [blame] | 44 | if (pat) |
| 45 | return ACL_TEST_PASS; |
| 46 | else |
| 47 | return ACL_TEST_FAIL; |
Willy Tarreau | 0cba607 | 2013-11-28 22:21:02 +0100 | [diff] [blame] | 48 | } |
| 49 | |
Willy Tarreau | a590983 | 2007-06-17 20:40:25 +0200 | [diff] [blame] | 50 | /* |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 51 | * Registers the ACL keyword list <kwl> as a list of valid keywords for next |
| 52 | * parsing sessions. |
| 53 | */ |
| 54 | void acl_register_keywords(struct acl_kw_list *kwl) |
| 55 | { |
| 56 | LIST_ADDQ(&acl_keywords.list, &kwl->list); |
| 57 | } |
| 58 | |
| 59 | /* |
| 60 | * Unregisters the ACL keyword list <kwl> from the list of valid keywords. |
| 61 | */ |
| 62 | void acl_unregister_keywords(struct acl_kw_list *kwl) |
| 63 | { |
| 64 | LIST_DEL(&kwl->list); |
| 65 | LIST_INIT(&kwl->list); |
| 66 | } |
| 67 | |
| 68 | /* Return a pointer to the ACL <name> within the list starting at <head>, or |
| 69 | * NULL if not found. |
| 70 | */ |
| 71 | struct acl *find_acl_by_name(const char *name, struct list *head) |
| 72 | { |
| 73 | struct acl *acl; |
| 74 | list_for_each_entry(acl, head, list) { |
| 75 | if (strcmp(acl->name, name) == 0) |
| 76 | return acl; |
| 77 | } |
| 78 | return NULL; |
| 79 | } |
| 80 | |
| 81 | /* Return a pointer to the ACL keyword <kw>, or NULL if not found. Note that if |
Willy Tarreau | 4bfa422 | 2013-12-16 22:01:06 +0100 | [diff] [blame] | 82 | * <kw> contains an opening parenthesis or a comma, only the left part of it is |
| 83 | * checked. |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 84 | */ |
| 85 | struct acl_keyword *find_acl_kw(const char *kw) |
| 86 | { |
| 87 | int index; |
| 88 | const char *kwend; |
| 89 | struct acl_kw_list *kwl; |
| 90 | |
Willy Tarreau | 4bfa422 | 2013-12-16 22:01:06 +0100 | [diff] [blame] | 91 | kwend = kw; |
| 92 | while (*kwend && *kwend != '(' && *kwend != ',') |
| 93 | kwend++; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 94 | |
| 95 | list_for_each_entry(kwl, &acl_keywords.list, list) { |
| 96 | for (index = 0; kwl->kw[index].kw != NULL; index++) { |
| 97 | if ((strncmp(kwl->kw[index].kw, kw, kwend - kw) == 0) && |
| 98 | kwl->kw[index].kw[kwend-kw] == 0) |
| 99 | return &kwl->kw[index]; |
| 100 | } |
| 101 | } |
| 102 | return NULL; |
| 103 | } |
| 104 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 105 | static struct acl_expr *prune_acl_expr(struct acl_expr *expr) |
| 106 | { |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 107 | struct arg *arg; |
| 108 | |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 109 | pattern_prune_expr(&expr->pat); |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 110 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 111 | for (arg = expr->smp->arg_p; arg; arg++) { |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 112 | if (arg->type == ARGT_STOP) |
| 113 | break; |
Willy Tarreau | 496aa01 | 2012-06-01 10:38:29 +0200 | [diff] [blame] | 114 | if (arg->type == ARGT_STR || arg->unresolved) { |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 115 | free(arg->data.str.str); |
| 116 | arg->data.str.str = NULL; |
Willy Tarreau | 496aa01 | 2012-06-01 10:38:29 +0200 | [diff] [blame] | 117 | arg->unresolved = 0; |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 118 | } |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 119 | } |
| 120 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 121 | if (expr->smp->arg_p != empty_arg_list) |
| 122 | free(expr->smp->arg_p); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 123 | return expr; |
| 124 | } |
| 125 | |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 126 | /* Parse an ACL expression starting at <args>[0], and return it. If <err> is |
| 127 | * not NULL, it will be filled with a pointer to an error message in case of |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 128 | * error. This pointer must be freeable or NULL. <al> is an arg_list serving |
| 129 | * as a list head to report missing dependencies. |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 130 | * |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 131 | * Right now, the only accepted syntax is : |
| 132 | * <subject> [<value>...] |
| 133 | */ |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 134 | struct acl_expr *parse_acl_expr(const char **args, char **err, struct arg_list *al) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 135 | { |
Thierry FOURNIER | b9b0846 | 2013-12-13 15:12:32 +0100 | [diff] [blame] | 136 | __label__ out_return, out_free_expr; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 137 | struct acl_expr *expr; |
| 138 | struct acl_keyword *aclkw; |
Thierry FOURNIER | 7148ce6 | 2013-12-06 19:06:43 +0100 | [diff] [blame] | 139 | int patflags; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 140 | const char *arg; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 141 | struct sample_expr *smp = NULL; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 142 | int idx = 0; |
| 143 | char *ckw = NULL; |
| 144 | const char *begw; |
| 145 | const char *endw; |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 146 | const char *endt; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 147 | unsigned long prev_type; |
| 148 | int cur_type; |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 149 | int nbargs; |
Thierry FOURNIER | 511e947 | 2014-01-23 17:40:34 +0100 | [diff] [blame] | 150 | int operator = STD_OP_EQ; |
| 151 | int op; |
| 152 | int contain_colon, have_dot; |
| 153 | const char *dot; |
| 154 | signed long long value, minor; |
| 155 | /* The following buffer contain two numbers, a ':' separator and the final \0. */ |
| 156 | char buffer[NB_LLMAX_STR + 1 + NB_LLMAX_STR + 1]; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 157 | |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 158 | /* First, we look for an ACL keyword. And if we don't find one, then |
| 159 | * we look for a sample fetch expression starting with a sample fetch |
| 160 | * keyword. |
Willy Tarreau | bef91e7 | 2013-03-31 23:14:46 +0200 | [diff] [blame] | 161 | */ |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 162 | |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 163 | al->ctx = ARGC_ACL; // to report errors while resolving args late |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 164 | al->kw = *args; |
| 165 | al->conv = NULL; |
| 166 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 167 | aclkw = find_acl_kw(args[0]); |
Willy Tarreau | 2049092 | 2014-03-17 18:04:27 +0100 | [diff] [blame] | 168 | if (aclkw) { |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 169 | /* OK we have a real ACL keyword */ |
Willy Tarreau | 9987ea9 | 2013-06-11 21:09:06 +0200 | [diff] [blame] | 170 | |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 171 | /* build new sample expression for this ACL */ |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 172 | smp = calloc(1, sizeof(struct sample_expr)); |
| 173 | if (!smp) { |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 174 | memprintf(err, "out of memory when parsing ACL expression"); |
| 175 | goto out_return; |
| 176 | } |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 177 | LIST_INIT(&(smp->conv_exprs)); |
| 178 | smp->fetch = aclkw->smp; |
| 179 | smp->arg_p = empty_arg_list; |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 180 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 181 | /* look for the begining of the subject arguments */ |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 182 | for (arg = args[0]; *arg && *arg != '(' && *arg != ','; arg++); |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 183 | |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 184 | endt = arg; |
| 185 | if (*endt == '(') { |
| 186 | /* look for the end of this term and skip the opening parenthesis */ |
| 187 | endt = ++arg; |
| 188 | while (*endt && *endt != ')') |
| 189 | endt++; |
| 190 | if (*endt != ')') { |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 191 | memprintf(err, "missing closing ')' after arguments to ACL keyword '%s'", aclkw->kw); |
| 192 | goto out_free_smp; |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 193 | } |
| 194 | } |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 195 | |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 196 | /* At this point, we have : |
| 197 | * - args[0] : beginning of the keyword |
| 198 | * - arg : end of the keyword, first character not part of keyword |
| 199 | * nor the opening parenthesis (so first character of args |
| 200 | * if present). |
| 201 | * - endt : end of the term (=arg or last parenthesis if args are present) |
| 202 | */ |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 203 | nbargs = make_arg_list(arg, endt - arg, smp->fetch->arg_mask, &smp->arg_p, |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 204 | err, NULL, NULL, al); |
| 205 | if (nbargs < 0) { |
| 206 | /* note that make_arg_list will have set <err> here */ |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 207 | memprintf(err, "ACL keyword '%s' : %s", aclkw->kw, *err); |
| 208 | goto out_free_smp; |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 209 | } |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 210 | |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 211 | if (!smp->arg_p) { |
| 212 | smp->arg_p = empty_arg_list; |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 213 | } |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 214 | else if (smp->fetch->val_args && !smp->fetch->val_args(smp->arg_p, err)) { |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 215 | /* invalid keyword argument, error must have been |
| 216 | * set by val_args(). |
| 217 | */ |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 218 | memprintf(err, "in argument to '%s', %s", aclkw->kw, *err); |
| 219 | goto out_free_smp; |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 220 | } |
| 221 | arg = endt; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 222 | |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 223 | /* look for the begining of the converters list. Those directly attached |
| 224 | * to the ACL keyword are found just after <arg> which points to the comma. |
| 225 | */ |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 226 | prev_type = smp->fetch->out_type; |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 227 | while (*arg) { |
| 228 | struct sample_conv *conv; |
| 229 | struct sample_conv_expr *conv_expr; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 230 | |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 231 | if (*arg == ')') /* skip last closing parenthesis */ |
| 232 | arg++; |
| 233 | |
| 234 | if (*arg && *arg != ',') { |
| 235 | if (ckw) |
| 236 | memprintf(err, "ACL keyword '%s' : missing comma after conv keyword '%s'.", |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 237 | aclkw->kw, ckw); |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 238 | else |
| 239 | memprintf(err, "ACL keyword '%s' : missing comma after fetch keyword.", |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 240 | aclkw->kw); |
| 241 | goto out_free_smp; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 242 | } |
Willy Tarreau | ae52f06 | 2012-04-26 12:13:35 +0200 | [diff] [blame] | 243 | |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 244 | while (*arg == ',') /* then trailing commas */ |
| 245 | arg++; |
Willy Tarreau | 2e845be | 2012-10-19 19:49:09 +0200 | [diff] [blame] | 246 | |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 247 | begw = arg; /* start of conv keyword */ |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 248 | |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 249 | if (!*begw) |
| 250 | /* none ? end of converters */ |
| 251 | break; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 252 | |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 253 | for (endw = begw; *endw && *endw != '(' && *endw != ','; endw++); |
Willy Tarreau | 9ca6936 | 2013-10-22 19:10:06 +0200 | [diff] [blame] | 254 | |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 255 | free(ckw); |
| 256 | ckw = my_strndup(begw, endw - begw); |
Willy Tarreau | f75d008 | 2013-04-07 21:20:44 +0200 | [diff] [blame] | 257 | |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 258 | conv = find_sample_conv(begw, endw - begw); |
| 259 | if (!conv) { |
| 260 | /* Unknown converter method */ |
| 261 | memprintf(err, "ACL keyword '%s' : unknown conv method '%s'.", |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 262 | aclkw->kw, ckw); |
| 263 | goto out_free_smp; |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 264 | } |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 265 | |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 266 | arg = endw; |
| 267 | if (*arg == '(') { |
| 268 | /* look for the end of this term */ |
| 269 | while (*arg && *arg != ')') |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 270 | arg++; |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 271 | if (*arg != ')') { |
| 272 | memprintf(err, "ACL keyword '%s' : syntax error: missing ')' after conv keyword '%s'.", |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 273 | aclkw->kw, ckw); |
| 274 | goto out_free_smp; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 275 | } |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 276 | } |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 277 | |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 278 | if (conv->in_type >= SMP_TYPES || conv->out_type >= SMP_TYPES) { |
| 279 | memprintf(err, "ACL keyword '%s' : returns type of conv method '%s' is unknown.", |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 280 | aclkw->kw, ckw); |
| 281 | goto out_free_smp; |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 282 | } |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 283 | |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 284 | /* If impossible type conversion */ |
| 285 | if (!sample_casts[prev_type][conv->in_type]) { |
| 286 | memprintf(err, "ACL keyword '%s' : conv method '%s' cannot be applied.", |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 287 | aclkw->kw, ckw); |
| 288 | goto out_free_smp; |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 289 | } |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 290 | |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 291 | prev_type = conv->out_type; |
| 292 | conv_expr = calloc(1, sizeof(struct sample_conv_expr)); |
| 293 | if (!conv_expr) |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 294 | goto out_free_smp; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 295 | |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 296 | LIST_ADDQ(&(smp->conv_exprs), &(conv_expr->list)); |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 297 | conv_expr->conv = conv; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 298 | |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 299 | if (arg != endw) { |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 300 | int err_arg; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 301 | |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 302 | if (!conv->arg_mask) { |
| 303 | memprintf(err, "ACL keyword '%s' : conv method '%s' does not support any args.", |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 304 | aclkw->kw, ckw); |
| 305 | goto out_free_smp; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 306 | } |
| 307 | |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 308 | al->kw = smp->fetch->kw; |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 309 | al->conv = conv_expr->conv->kw; |
Willy Tarreau | adaddc2 | 2013-12-13 01:30:22 +0100 | [diff] [blame] | 310 | if (make_arg_list(endw + 1, arg - endw - 1, conv->arg_mask, &conv_expr->arg_p, err, NULL, &err_arg, al) < 0) { |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 311 | memprintf(err, "ACL keyword '%s' : invalid arg %d in conv method '%s' : %s.", |
Willy Tarreau | adaddc2 | 2013-12-13 01:30:22 +0100 | [diff] [blame] | 312 | aclkw->kw, err_arg+1, ckw, *err); |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 313 | goto out_free_smp; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 314 | } |
| 315 | |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 316 | if (!conv_expr->arg_p) |
| 317 | conv_expr->arg_p = empty_arg_list; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 318 | |
Willy Tarreau | adaddc2 | 2013-12-13 01:30:22 +0100 | [diff] [blame] | 319 | if (conv->val_args && !conv->val_args(conv_expr->arg_p, conv, err)) { |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 320 | memprintf(err, "ACL keyword '%s' : invalid args in conv method '%s' : %s.", |
Willy Tarreau | adaddc2 | 2013-12-13 01:30:22 +0100 | [diff] [blame] | 321 | aclkw->kw, ckw, *err); |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 322 | goto out_free_smp; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 323 | } |
| 324 | } |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 325 | else if (ARGM(conv->arg_mask)) { |
| 326 | memprintf(err, "ACL keyword '%s' : missing args for conv method '%s'.", |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 327 | aclkw->kw, ckw); |
| 328 | goto out_free_smp; |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 329 | } |
Willy Tarreau | 61612d4 | 2012-04-19 18:42:05 +0200 | [diff] [blame] | 330 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 331 | } |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 332 | else { |
| 333 | /* This is not an ACL keyword, so we hope this is a sample fetch |
| 334 | * keyword that we're going to transparently use as an ACL. If |
| 335 | * so, we retrieve a completely parsed expression with args and |
| 336 | * convs already done. |
| 337 | */ |
| 338 | smp = sample_parse_expr((char **)args, &idx, err, al); |
| 339 | if (!smp) { |
| 340 | memprintf(err, "%s in ACL expression '%s'", *err, *args); |
| 341 | goto out_return; |
| 342 | } |
| 343 | } |
| 344 | |
| 345 | expr = (struct acl_expr *)calloc(1, sizeof(*expr)); |
| 346 | if (!expr) { |
| 347 | memprintf(err, "out of memory when parsing ACL expression"); |
| 348 | goto out_return; |
| 349 | } |
| 350 | |
| 351 | pattern_init_expr(&expr->pat); |
| 352 | |
| 353 | expr->kw = aclkw ? aclkw->kw : smp->fetch->kw; |
| 354 | expr->pat.parse = aclkw ? aclkw->parse : NULL; |
Thierry FOURNIER | b9b0846 | 2013-12-13 15:12:32 +0100 | [diff] [blame] | 355 | expr->pat.index = aclkw ? aclkw->index : NULL; |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 356 | expr->pat.match = aclkw ? aclkw->match : NULL; |
| 357 | expr->smp = smp; |
| 358 | smp = NULL; |
| 359 | |
| 360 | if (!expr->pat.parse) { |
| 361 | /* some types can be automatically converted */ |
| 362 | |
| 363 | switch (expr->smp ? expr->smp->fetch->out_type : aclkw->smp->out_type) { |
| 364 | case SMP_T_BOOL: |
| 365 | expr->pat.parse = pat_parse_fcts[PAT_MATCH_BOOL]; |
Thierry FOURNIER | b9b0846 | 2013-12-13 15:12:32 +0100 | [diff] [blame] | 366 | expr->pat.index = pat_index_fcts[PAT_MATCH_BOOL]; |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 367 | expr->pat.match = pat_match_fcts[PAT_MATCH_BOOL]; |
| 368 | break; |
| 369 | case SMP_T_SINT: |
| 370 | case SMP_T_UINT: |
| 371 | expr->pat.parse = pat_parse_fcts[PAT_MATCH_INT]; |
Thierry FOURNIER | b9b0846 | 2013-12-13 15:12:32 +0100 | [diff] [blame] | 372 | expr->pat.index = pat_index_fcts[PAT_MATCH_INT]; |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 373 | expr->pat.match = pat_match_fcts[PAT_MATCH_INT]; |
| 374 | break; |
| 375 | case SMP_T_IPV4: |
| 376 | case SMP_T_IPV6: |
| 377 | expr->pat.parse = pat_parse_fcts[PAT_MATCH_IP]; |
Thierry FOURNIER | b9b0846 | 2013-12-13 15:12:32 +0100 | [diff] [blame] | 378 | expr->pat.index = pat_index_fcts[PAT_MATCH_IP]; |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 379 | expr->pat.match = pat_match_fcts[PAT_MATCH_IP]; |
| 380 | break; |
| 381 | } |
| 382 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 383 | |
Willy Tarreau | 3c3dfd5 | 2013-11-04 18:09:12 +0100 | [diff] [blame] | 384 | /* Additional check to protect against common mistakes */ |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 385 | cur_type = smp_expr_output_type(expr->smp); |
Thierry FOURNIER | d163e1c | 2013-11-28 11:41:23 +0100 | [diff] [blame] | 386 | if (expr->pat.parse && cur_type != SMP_T_BOOL && !*args[1]) { |
Willy Tarreau | 3c3dfd5 | 2013-11-04 18:09:12 +0100 | [diff] [blame] | 387 | Warning("parsing acl keyword '%s' :\n" |
| 388 | " no pattern to match against were provided, so this ACL will never match.\n" |
| 389 | " If this is what you intended, please add '--' to get rid of this warning.\n" |
| 390 | " If you intended to match only for existence, please use '-m found'.\n" |
| 391 | " If you wanted to force an int to match as a bool, please use '-m bool'.\n" |
| 392 | "\n", |
| 393 | args[0]); |
| 394 | } |
| 395 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 396 | args++; |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 397 | |
| 398 | /* check for options before patterns. Supported options are : |
| 399 | * -i : ignore case for all patterns by default |
| 400 | * -f : read patterns from those files |
Willy Tarreau | 5adeda1 | 2013-03-31 22:13:34 +0200 | [diff] [blame] | 401 | * -m : force matching method (must be used before -f) |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 402 | * -- : everything after this is not an option |
| 403 | */ |
| 404 | patflags = 0; |
| 405 | while (**args == '-') { |
| 406 | if ((*args)[1] == 'i') |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 407 | patflags |= PAT_F_IGNORE_CASE; |
Willy Tarreau | 2b5285d | 2010-05-09 23:45:24 +0200 | [diff] [blame] | 408 | else if ((*args)[1] == 'f') { |
Thierry FOURNIER | d163e1c | 2013-11-28 11:41:23 +0100 | [diff] [blame] | 409 | if (!expr->pat.parse) { |
Willy Tarreau | 9987ea9 | 2013-06-11 21:09:06 +0200 | [diff] [blame] | 410 | memprintf(err, "matching method must be specified first (using '-m') when using a sample fetch of this type ('%s')", expr->kw); |
Willy Tarreau | bef91e7 | 2013-03-31 23:14:46 +0200 | [diff] [blame] | 411 | goto out_free_expr; |
| 412 | } |
| 413 | |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 414 | if (!pattern_read_from_file(&expr->pat, args[1], patflags | PAT_F_FROM_FILE, err)) |
Willy Tarreau | 2b5285d | 2010-05-09 23:45:24 +0200 | [diff] [blame] | 415 | goto out_free_expr; |
Willy Tarreau | 5adeda1 | 2013-03-31 22:13:34 +0200 | [diff] [blame] | 416 | args++; |
| 417 | } |
| 418 | else if ((*args)[1] == 'm') { |
| 419 | int idx; |
| 420 | |
Thierry FOURNIER | d163e1c | 2013-11-28 11:41:23 +0100 | [diff] [blame] | 421 | if (!LIST_ISEMPTY(&expr->pat.patterns) || !eb_is_empty(&expr->pat.pattern_tree)) { |
Willy Tarreau | 5adeda1 | 2013-03-31 22:13:34 +0200 | [diff] [blame] | 422 | memprintf(err, "'-m' must only be specified before patterns and files in parsing ACL expression"); |
| 423 | goto out_free_expr; |
| 424 | } |
| 425 | |
Willy Tarreau | 6f8fe31 | 2013-11-28 22:24:25 +0100 | [diff] [blame] | 426 | idx = pat_find_match_name(args[1]); |
Willy Tarreau | 5adeda1 | 2013-03-31 22:13:34 +0200 | [diff] [blame] | 427 | if (idx < 0) { |
| 428 | memprintf(err, "unknown matching method '%s' when parsing ACL expression", args[1]); |
| 429 | goto out_free_expr; |
| 430 | } |
| 431 | |
| 432 | /* Note: -m found is always valid, bool/int are compatible, str/bin/reg/len are compatible */ |
Thierry FOURNIER | e3ded59 | 2013-12-06 15:36:54 +0100 | [diff] [blame] | 433 | if (!sample_casts[cur_type][pat_match_types[idx]]) { |
Willy Tarreau | 93fddf1 | 2013-03-31 22:59:32 +0200 | [diff] [blame] | 434 | memprintf(err, "matching method '%s' cannot be used with fetch keyword '%s'", args[1], expr->kw); |
Willy Tarreau | 5adeda1 | 2013-03-31 22:13:34 +0200 | [diff] [blame] | 435 | goto out_free_expr; |
| 436 | } |
Thierry FOURNIER | e3ded59 | 2013-12-06 15:36:54 +0100 | [diff] [blame] | 437 | expr->pat.parse = pat_parse_fcts[idx]; |
Thierry FOURNIER | b9b0846 | 2013-12-13 15:12:32 +0100 | [diff] [blame] | 438 | expr->pat.index = pat_index_fcts[idx]; |
Thierry FOURNIER | e3ded59 | 2013-12-06 15:36:54 +0100 | [diff] [blame] | 439 | expr->pat.match = pat_match_fcts[idx]; |
Willy Tarreau | 2b5285d | 2010-05-09 23:45:24 +0200 | [diff] [blame] | 440 | args++; |
| 441 | } |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 442 | else if ((*args)[1] == '-') { |
| 443 | args++; |
| 444 | break; |
| 445 | } |
| 446 | else |
| 447 | break; |
| 448 | args++; |
| 449 | } |
| 450 | |
Thierry FOURNIER | d163e1c | 2013-11-28 11:41:23 +0100 | [diff] [blame] | 451 | if (!expr->pat.parse) { |
Willy Tarreau | 9987ea9 | 2013-06-11 21:09:06 +0200 | [diff] [blame] | 452 | memprintf(err, "matching method must be specified first (using '-m') when using a sample fetch of this type ('%s')", expr->kw); |
Willy Tarreau | bef91e7 | 2013-03-31 23:14:46 +0200 | [diff] [blame] | 453 | goto out_free_expr; |
| 454 | } |
| 455 | |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 456 | /* now parse all patterns */ |
Thierry FOURNIER | 511e947 | 2014-01-23 17:40:34 +0100 | [diff] [blame] | 457 | while (**args) { |
| 458 | arg = *args; |
| 459 | |
| 460 | /* Compatibility layer. Each pattern can parse only one string per pattern, |
| 461 | * but the pat_parser_int() and pat_parse_dotted_ver() parsers were need |
| 462 | * optionnaly two operators. The first operator is the match method: eq, |
| 463 | * le, lt, ge and gt. pat_parse_int() and pat_parse_dotted_ver() functions |
| 464 | * can have a compatibility syntax based on ranges: |
| 465 | * |
| 466 | * pat_parse_int(): |
| 467 | * |
| 468 | * "eq x" -> "x" or "x:x" |
| 469 | * "le x" -> ":x" |
| 470 | * "lt x" -> ":y" (with y = x - 1) |
| 471 | * "ge x" -> "x:" |
| 472 | * "gt x" -> "y:" (with y = x + 1) |
| 473 | * |
| 474 | * pat_parse_dotted_ver(): |
| 475 | * |
| 476 | * "eq x.y" -> "x.y" or "x.y:x.y" |
| 477 | * "le x.y" -> ":x.y" |
| 478 | * "lt x.y" -> ":w.z" (with w.z = x.y - 1) |
| 479 | * "ge x.y" -> "x.y:" |
| 480 | * "gt x.y" -> "w.z:" (with w.z = x.y + 1) |
| 481 | * |
| 482 | * If y is not present, assume that is "0". |
| 483 | * |
| 484 | * The syntax eq, le, lt, ge and gt are proper to the acl syntax. The |
| 485 | * following block of code detect the operator, and rewrite each value |
| 486 | * in parsable string. |
| 487 | */ |
| 488 | if (expr->pat.parse == pat_parse_int || |
| 489 | expr->pat.parse == pat_parse_dotted_ver) { |
| 490 | /* Check for operator. If the argument is operator, memorise it and |
| 491 | * continue to the next argument. |
| 492 | */ |
| 493 | op = get_std_op(arg); |
| 494 | if (op != -1) { |
| 495 | operator = op; |
| 496 | args++; |
| 497 | continue; |
| 498 | } |
| 499 | |
| 500 | /* Check if the pattern contain ':' or '-' character. */ |
| 501 | contain_colon = (strchr(arg, ':') || strchr(arg, '-')); |
| 502 | |
| 503 | /* If the pattern contain ':' or '-' character, give it to the parser as is. |
| 504 | * If no contain ':' and operator is STD_OP_EQ, give it to the parser as is. |
| 505 | * In other case, try to convert the value according with the operator. |
| 506 | */ |
| 507 | if (!contain_colon && operator != STD_OP_EQ) { |
| 508 | /* Search '.' separator. */ |
| 509 | dot = strchr(arg, '.'); |
| 510 | if (!dot) { |
| 511 | have_dot = 0; |
| 512 | minor = 0; |
| 513 | dot = arg + strlen(arg); |
| 514 | } |
| 515 | else |
| 516 | have_dot = 1; |
| 517 | |
| 518 | /* convert the integer minor part for the pat_parse_dotted_ver() function. */ |
| 519 | if (expr->pat.parse == pat_parse_dotted_ver && have_dot) { |
| 520 | if (strl2llrc(dot+1, strlen(dot+1), &minor) != 0) { |
| 521 | memprintf(err, "'%s' is neither a number nor a supported operator", arg); |
Thierry FOURNIER | b9b0846 | 2013-12-13 15:12:32 +0100 | [diff] [blame] | 522 | goto out_free_expr; |
Thierry FOURNIER | 511e947 | 2014-01-23 17:40:34 +0100 | [diff] [blame] | 523 | } |
| 524 | if (minor >= 65536) { |
| 525 | memprintf(err, "'%s' contains too large a minor value", arg); |
Thierry FOURNIER | b9b0846 | 2013-12-13 15:12:32 +0100 | [diff] [blame] | 526 | goto out_free_expr; |
Thierry FOURNIER | 511e947 | 2014-01-23 17:40:34 +0100 | [diff] [blame] | 527 | } |
| 528 | } |
| 529 | |
| 530 | /* convert the integer value for the pat_parse_int() function, and the |
| 531 | * integer major part for the pat_parse_dotted_ver() function. |
| 532 | */ |
| 533 | if (strl2llrc(arg, dot - arg, &value) != 0) { |
| 534 | memprintf(err, "'%s' is neither a number nor a supported operator", arg); |
Thierry FOURNIER | b9b0846 | 2013-12-13 15:12:32 +0100 | [diff] [blame] | 535 | goto out_free_expr; |
Thierry FOURNIER | 511e947 | 2014-01-23 17:40:34 +0100 | [diff] [blame] | 536 | } |
| 537 | if (expr->pat.parse == pat_parse_dotted_ver) { |
| 538 | if (value >= 65536) { |
| 539 | memprintf(err, "'%s' contains too large a major value", arg); |
Thierry FOURNIER | b9b0846 | 2013-12-13 15:12:32 +0100 | [diff] [blame] | 540 | goto out_free_expr; |
Thierry FOURNIER | 511e947 | 2014-01-23 17:40:34 +0100 | [diff] [blame] | 541 | } |
| 542 | value = (value << 16) | (minor & 0xffff); |
| 543 | } |
| 544 | |
| 545 | switch (operator) { |
| 546 | |
| 547 | case STD_OP_EQ: /* this case is not possible. */ |
| 548 | memprintf(err, "internal error"); |
Thierry FOURNIER | b9b0846 | 2013-12-13 15:12:32 +0100 | [diff] [blame] | 549 | goto out_free_expr; |
Thierry FOURNIER | 511e947 | 2014-01-23 17:40:34 +0100 | [diff] [blame] | 550 | |
| 551 | case STD_OP_GT: |
| 552 | value++; /* gt = ge + 1 */ |
| 553 | |
| 554 | case STD_OP_GE: |
| 555 | if (expr->pat.parse == pat_parse_int) |
| 556 | snprintf(buffer, NB_LLMAX_STR+NB_LLMAX_STR+2, "%lld:", value); |
| 557 | else |
| 558 | snprintf(buffer, NB_LLMAX_STR+NB_LLMAX_STR+2, "%lld.%lld:", |
| 559 | value >> 16, value & 0xffff); |
| 560 | arg = buffer; |
| 561 | break; |
| 562 | |
| 563 | case STD_OP_LT: |
| 564 | value--; /* lt = le - 1 */ |
| 565 | |
| 566 | case STD_OP_LE: |
| 567 | if (expr->pat.parse == pat_parse_int) |
| 568 | snprintf(buffer, NB_LLMAX_STR+NB_LLMAX_STR+2, ":%lld", value); |
| 569 | else |
| 570 | snprintf(buffer, NB_LLMAX_STR+NB_LLMAX_STR+2, ":%lld.%lld", |
| 571 | value >> 16, value & 0xffff); |
| 572 | arg = buffer; |
| 573 | break; |
| 574 | } |
| 575 | } |
| 576 | } |
| 577 | |
Thierry FOURNIER | b9b0846 | 2013-12-13 15:12:32 +0100 | [diff] [blame] | 578 | if (!pattern_register(&expr->pat, arg, NULL, patflags, err)) |
| 579 | goto out_free_expr; |
Thierry FOURNIER | 511e947 | 2014-01-23 17:40:34 +0100 | [diff] [blame] | 580 | args++; |
| 581 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 582 | |
| 583 | return expr; |
| 584 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 585 | out_free_expr: |
| 586 | prune_acl_expr(expr); |
| 587 | free(expr); |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 588 | free(ckw); |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 589 | out_free_smp: |
| 590 | free(smp); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 591 | out_return: |
| 592 | return NULL; |
| 593 | } |
| 594 | |
Krzysztof Piotr Oledzki | a643baf | 2008-05-29 23:53:44 +0200 | [diff] [blame] | 595 | /* Purge everything in the acl <acl>, then return <acl>. */ |
| 596 | struct acl *prune_acl(struct acl *acl) { |
| 597 | |
| 598 | struct acl_expr *expr, *exprb; |
| 599 | |
| 600 | free(acl->name); |
| 601 | |
| 602 | list_for_each_entry_safe(expr, exprb, &acl->expr, list) { |
| 603 | LIST_DEL(&expr->list); |
| 604 | prune_acl_expr(expr); |
| 605 | free(expr); |
| 606 | } |
| 607 | |
| 608 | return acl; |
| 609 | } |
| 610 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 611 | /* Parse an ACL with the name starting at <args>[0], and with a list of already |
| 612 | * known ACLs in <acl>. If the ACL was not in the list, it will be added. |
Willy Tarreau | 2a56c5e | 2010-03-15 16:13:29 +0100 | [diff] [blame] | 613 | * A pointer to that ACL is returned. If the ACL has an empty name, then it's |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 614 | * an anonymous one and it won't be merged with any other one. If <err> is not |
| 615 | * NULL, it will be filled with an appropriate error. This pointer must be |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 616 | * freeable or NULL. <al> is the arg_list serving as a head for unresolved |
| 617 | * dependencies. |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 618 | * |
| 619 | * args syntax: <aclname> <acl_expr> |
| 620 | */ |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 621 | struct acl *parse_acl(const char **args, struct list *known_acl, char **err, struct arg_list *al) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 622 | { |
| 623 | __label__ out_return, out_free_acl_expr, out_free_name; |
| 624 | struct acl *cur_acl; |
| 625 | struct acl_expr *acl_expr; |
| 626 | char *name; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 627 | const char *pos; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 628 | |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 629 | if (**args && (pos = invalid_char(*args))) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 630 | memprintf(err, "invalid character in ACL name : '%c'", *pos); |
Willy Tarreau | 2e74c3f | 2007-12-02 18:45:09 +0100 | [diff] [blame] | 631 | goto out_return; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 632 | } |
Willy Tarreau | 2e74c3f | 2007-12-02 18:45:09 +0100 | [diff] [blame] | 633 | |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 634 | acl_expr = parse_acl_expr(args + 1, err, al); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 635 | if (!acl_expr) { |
| 636 | /* parse_acl_expr will have filled <err> here */ |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 637 | goto out_return; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 638 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 639 | |
Willy Tarreau | 404e8ab | 2009-07-26 19:40:40 +0200 | [diff] [blame] | 640 | /* Check for args beginning with an opening parenthesis just after the |
| 641 | * subject, as this is almost certainly a typo. Right now we can only |
| 642 | * emit a warning, so let's do so. |
| 643 | */ |
Krzysztof Piotr Oledzki | 4cdd831 | 2009-10-05 00:23:35 +0200 | [diff] [blame] | 644 | if (!strchr(args[1], '(') && *args[2] == '(') |
Willy Tarreau | 404e8ab | 2009-07-26 19:40:40 +0200 | [diff] [blame] | 645 | Warning("parsing acl '%s' :\n" |
| 646 | " matching '%s' for pattern '%s' is likely a mistake and probably\n" |
| 647 | " not what you want. Maybe you need to remove the extraneous space before '('.\n" |
| 648 | " If you are really sure this is not an error, please insert '--' between the\n" |
| 649 | " match and the pattern to make this warning message disappear.\n", |
| 650 | args[0], args[1], args[2]); |
| 651 | |
Willy Tarreau | 2a56c5e | 2010-03-15 16:13:29 +0100 | [diff] [blame] | 652 | if (*args[0]) |
| 653 | cur_acl = find_acl_by_name(args[0], known_acl); |
| 654 | else |
| 655 | cur_acl = NULL; |
| 656 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 657 | if (!cur_acl) { |
| 658 | name = strdup(args[0]); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 659 | if (!name) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 660 | memprintf(err, "out of memory when parsing ACL"); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 661 | goto out_free_acl_expr; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 662 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 663 | cur_acl = (struct acl *)calloc(1, sizeof(*cur_acl)); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 664 | if (cur_acl == NULL) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 665 | memprintf(err, "out of memory when parsing ACL"); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 666 | goto out_free_name; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 667 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 668 | |
| 669 | LIST_INIT(&cur_acl->expr); |
| 670 | LIST_ADDQ(known_acl, &cur_acl->list); |
| 671 | cur_acl->name = name; |
| 672 | } |
| 673 | |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 674 | /* We want to know what features the ACL needs (typically HTTP parsing), |
| 675 | * and where it may be used. If an ACL relies on multiple matches, it is |
| 676 | * OK if at least one of them may match in the context where it is used. |
| 677 | */ |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 678 | cur_acl->use |= acl_expr->smp->fetch->use; |
| 679 | cur_acl->val |= acl_expr->smp->fetch->val; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 680 | LIST_ADDQ(&cur_acl->expr, &acl_expr->list); |
| 681 | return cur_acl; |
| 682 | |
| 683 | out_free_name: |
| 684 | free(name); |
| 685 | out_free_acl_expr: |
| 686 | prune_acl_expr(acl_expr); |
| 687 | free(acl_expr); |
| 688 | out_return: |
| 689 | return NULL; |
| 690 | } |
| 691 | |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 692 | /* Some useful ACLs provided by default. Only those used are allocated. */ |
| 693 | |
| 694 | const struct { |
| 695 | const char *name; |
| 696 | const char *expr[4]; /* put enough for longest expression */ |
| 697 | } default_acl_list[] = { |
Willy Tarreau | 58393e1 | 2008-07-20 10:39:22 +0200 | [diff] [blame] | 698 | { .name = "TRUE", .expr = {"always_true",""}}, |
| 699 | { .name = "FALSE", .expr = {"always_false",""}}, |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 700 | { .name = "LOCALHOST", .expr = {"src","127.0.0.1/8",""}}, |
Willy Tarreau | 2492d5b | 2009-07-11 00:06:00 +0200 | [diff] [blame] | 701 | { .name = "HTTP", .expr = {"req_proto_http",""}}, |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 702 | { .name = "HTTP_1.0", .expr = {"req_ver","1.0",""}}, |
| 703 | { .name = "HTTP_1.1", .expr = {"req_ver","1.1",""}}, |
| 704 | { .name = "METH_CONNECT", .expr = {"method","CONNECT",""}}, |
| 705 | { .name = "METH_GET", .expr = {"method","GET","HEAD",""}}, |
| 706 | { .name = "METH_HEAD", .expr = {"method","HEAD",""}}, |
| 707 | { .name = "METH_OPTIONS", .expr = {"method","OPTIONS",""}}, |
| 708 | { .name = "METH_POST", .expr = {"method","POST",""}}, |
| 709 | { .name = "METH_TRACE", .expr = {"method","TRACE",""}}, |
| 710 | { .name = "HTTP_URL_ABS", .expr = {"url_reg","^[^/:]*://",""}}, |
| 711 | { .name = "HTTP_URL_SLASH", .expr = {"url_beg","/",""}}, |
| 712 | { .name = "HTTP_URL_STAR", .expr = {"url","*",""}}, |
| 713 | { .name = "HTTP_CONTENT", .expr = {"hdr_val(content-length)","gt","0",""}}, |
Emeric Brun | bede3d0 | 2009-06-30 17:54:00 +0200 | [diff] [blame] | 714 | { .name = "RDP_COOKIE", .expr = {"req_rdp_cookie_cnt","gt","0",""}}, |
Willy Tarreau | c631770 | 2008-07-20 09:29:50 +0200 | [diff] [blame] | 715 | { .name = "REQ_CONTENT", .expr = {"req_len","gt","0",""}}, |
Willy Tarreau | b6fb420 | 2008-07-20 11:18:28 +0200 | [diff] [blame] | 716 | { .name = "WAIT_END", .expr = {"wait_end",""}}, |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 717 | { .name = NULL, .expr = {""}} |
| 718 | }; |
| 719 | |
| 720 | /* Find a default ACL from the default_acl list, compile it and return it. |
| 721 | * If the ACL is not found, NULL is returned. In theory, it cannot fail, |
| 722 | * except when default ACLs are broken, in which case it will return NULL. |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 723 | * If <known_acl> is not NULL, the ACL will be queued at its tail. If <err> is |
| 724 | * not NULL, it will be filled with an error message if an error occurs. This |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 725 | * pointer must be freeable or NULL. <al> is an arg_list serving as a list head |
| 726 | * to report missing dependencies. |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 727 | */ |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 728 | static struct acl *find_acl_default(const char *acl_name, struct list *known_acl, |
| 729 | char **err, struct arg_list *al) |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 730 | { |
| 731 | __label__ out_return, out_free_acl_expr, out_free_name; |
| 732 | struct acl *cur_acl; |
| 733 | struct acl_expr *acl_expr; |
| 734 | char *name; |
| 735 | int index; |
| 736 | |
| 737 | for (index = 0; default_acl_list[index].name != NULL; index++) { |
| 738 | if (strcmp(acl_name, default_acl_list[index].name) == 0) |
| 739 | break; |
| 740 | } |
| 741 | |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 742 | if (default_acl_list[index].name == NULL) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 743 | memprintf(err, "no such ACL : '%s'", acl_name); |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 744 | return NULL; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 745 | } |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 746 | |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 747 | acl_expr = parse_acl_expr((const char **)default_acl_list[index].expr, err, al); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 748 | if (!acl_expr) { |
| 749 | /* parse_acl_expr must have filled err here */ |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 750 | goto out_return; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 751 | } |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 752 | |
| 753 | name = strdup(acl_name); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 754 | if (!name) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 755 | memprintf(err, "out of memory when building default ACL '%s'", acl_name); |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 756 | goto out_free_acl_expr; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 757 | } |
| 758 | |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 759 | cur_acl = (struct acl *)calloc(1, sizeof(*cur_acl)); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 760 | if (cur_acl == NULL) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 761 | memprintf(err, "out of memory when building default ACL '%s'", acl_name); |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 762 | goto out_free_name; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 763 | } |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 764 | |
| 765 | cur_acl->name = name; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 766 | cur_acl->use |= acl_expr->smp->fetch->use; |
| 767 | cur_acl->val |= acl_expr->smp->fetch->val; |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 768 | LIST_INIT(&cur_acl->expr); |
| 769 | LIST_ADDQ(&cur_acl->expr, &acl_expr->list); |
| 770 | if (known_acl) |
| 771 | LIST_ADDQ(known_acl, &cur_acl->list); |
| 772 | |
| 773 | return cur_acl; |
| 774 | |
| 775 | out_free_name: |
| 776 | free(name); |
| 777 | out_free_acl_expr: |
| 778 | prune_acl_expr(acl_expr); |
| 779 | free(acl_expr); |
| 780 | out_return: |
| 781 | return NULL; |
| 782 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 783 | |
| 784 | /* Purge everything in the acl_cond <cond>, then return <cond>. */ |
| 785 | struct acl_cond *prune_acl_cond(struct acl_cond *cond) |
| 786 | { |
| 787 | struct acl_term_suite *suite, *tmp_suite; |
| 788 | struct acl_term *term, *tmp_term; |
| 789 | |
| 790 | /* iterate through all term suites and free all terms and all suites */ |
| 791 | list_for_each_entry_safe(suite, tmp_suite, &cond->suites, list) { |
| 792 | list_for_each_entry_safe(term, tmp_term, &suite->terms, list) |
| 793 | free(term); |
| 794 | free(suite); |
| 795 | } |
| 796 | return cond; |
| 797 | } |
| 798 | |
| 799 | /* Parse an ACL condition starting at <args>[0], relying on a list of already |
| 800 | * known ACLs passed in <known_acl>. The new condition is returned (or NULL in |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 801 | * case of low memory). Supports multiple conditions separated by "or". If |
| 802 | * <err> is not NULL, it will be filled with a pointer to an error message in |
| 803 | * case of error, that the caller is responsible for freeing. The initial |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 804 | * location must either be freeable or NULL. The list <al> serves as a list head |
| 805 | * for unresolved dependencies. |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 806 | */ |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 807 | struct acl_cond *parse_acl_cond(const char **args, struct list *known_acl, |
Willy Tarreau | 0cba607 | 2013-11-28 22:21:02 +0100 | [diff] [blame] | 808 | enum acl_cond_pol pol, char **err, struct arg_list *al) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 809 | { |
| 810 | __label__ out_return, out_free_suite, out_free_term; |
Willy Tarreau | 74b98a8 | 2007-06-16 19:35:18 +0200 | [diff] [blame] | 811 | int arg, neg; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 812 | const char *word; |
| 813 | struct acl *cur_acl; |
| 814 | struct acl_term *cur_term; |
| 815 | struct acl_term_suite *cur_suite; |
| 816 | struct acl_cond *cond; |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 817 | unsigned int suite_val; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 818 | |
| 819 | cond = (struct acl_cond *)calloc(1, sizeof(*cond)); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 820 | if (cond == NULL) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 821 | memprintf(err, "out of memory when parsing condition"); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 822 | goto out_return; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 823 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 824 | |
| 825 | LIST_INIT(&cond->list); |
| 826 | LIST_INIT(&cond->suites); |
| 827 | cond->pol = pol; |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 828 | cond->val = 0; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 829 | |
| 830 | cur_suite = NULL; |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 831 | suite_val = ~0U; |
Willy Tarreau | 74b98a8 | 2007-06-16 19:35:18 +0200 | [diff] [blame] | 832 | neg = 0; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 833 | for (arg = 0; *args[arg]; arg++) { |
| 834 | word = args[arg]; |
| 835 | |
| 836 | /* remove as many exclamation marks as we can */ |
| 837 | while (*word == '!') { |
| 838 | neg = !neg; |
| 839 | word++; |
| 840 | } |
| 841 | |
| 842 | /* an empty word is allowed because we cannot force the user to |
| 843 | * always think about not leaving exclamation marks alone. |
| 844 | */ |
| 845 | if (!*word) |
| 846 | continue; |
| 847 | |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 848 | if (strcasecmp(word, "or") == 0 || strcmp(word, "||") == 0) { |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 849 | /* new term suite */ |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 850 | cond->val |= suite_val; |
| 851 | suite_val = ~0U; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 852 | cur_suite = NULL; |
| 853 | neg = 0; |
| 854 | continue; |
| 855 | } |
| 856 | |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 857 | if (strcmp(word, "{") == 0) { |
| 858 | /* we may have a complete ACL expression between two braces, |
| 859 | * find the last one. |
| 860 | */ |
| 861 | int arg_end = arg + 1; |
| 862 | const char **args_new; |
| 863 | |
| 864 | while (*args[arg_end] && strcmp(args[arg_end], "}") != 0) |
| 865 | arg_end++; |
| 866 | |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 867 | if (!*args[arg_end]) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 868 | memprintf(err, "missing closing '}' in condition"); |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 869 | goto out_free_suite; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 870 | } |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 871 | |
| 872 | args_new = calloc(1, (arg_end - arg + 1) * sizeof(*args_new)); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 873 | if (!args_new) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 874 | memprintf(err, "out of memory when parsing condition"); |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 875 | goto out_free_suite; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 876 | } |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 877 | |
Willy Tarreau | 2a56c5e | 2010-03-15 16:13:29 +0100 | [diff] [blame] | 878 | args_new[0] = ""; |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 879 | memcpy(args_new + 1, args + arg + 1, (arg_end - arg) * sizeof(*args_new)); |
| 880 | args_new[arg_end - arg] = ""; |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 881 | cur_acl = parse_acl(args_new, known_acl, err, al); |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 882 | free(args_new); |
| 883 | |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 884 | if (!cur_acl) { |
| 885 | /* note that parse_acl() must have filled <err> here */ |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 886 | goto out_free_suite; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 887 | } |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 888 | word = args[arg + 1]; |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 889 | arg = arg_end; |
| 890 | } |
| 891 | else { |
| 892 | /* search for <word> in the known ACL names. If we do not find |
| 893 | * it, let's look for it in the default ACLs, and if found, add |
| 894 | * it to the list of ACLs of this proxy. This makes it possible |
| 895 | * to override them. |
| 896 | */ |
| 897 | cur_acl = find_acl_by_name(word, known_acl); |
| 898 | if (cur_acl == NULL) { |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 899 | cur_acl = find_acl_default(word, known_acl, err, al); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 900 | if (cur_acl == NULL) { |
| 901 | /* note that find_acl_default() must have filled <err> here */ |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 902 | goto out_free_suite; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 903 | } |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 904 | } |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 905 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 906 | |
| 907 | cur_term = (struct acl_term *)calloc(1, sizeof(*cur_term)); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 908 | if (cur_term == NULL) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 909 | memprintf(err, "out of memory when parsing condition"); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 910 | goto out_free_suite; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 911 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 912 | |
| 913 | cur_term->acl = cur_acl; |
| 914 | cur_term->neg = neg; |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 915 | |
| 916 | /* Here it is a bit complex. The acl_term_suite is a conjunction |
| 917 | * of many terms. It may only be used if all of its terms are |
| 918 | * usable at the same time. So the suite's validity domain is an |
| 919 | * AND between all ACL keywords' ones. But, the global condition |
| 920 | * is valid if at least one term suite is OK. So it's an OR between |
| 921 | * all of their validity domains. We could emit a warning as soon |
| 922 | * as suite_val is null because it means that the last ACL is not |
| 923 | * compatible with the previous ones. Let's remain simple for now. |
| 924 | */ |
| 925 | cond->use |= cur_acl->use; |
| 926 | suite_val &= cur_acl->val; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 927 | |
| 928 | if (!cur_suite) { |
| 929 | cur_suite = (struct acl_term_suite *)calloc(1, sizeof(*cur_suite)); |
Willy Tarreau | f678b7f | 2013-01-24 00:25:39 +0100 | [diff] [blame] | 930 | if (cur_suite == NULL) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 931 | memprintf(err, "out of memory when parsing condition"); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 932 | goto out_free_term; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 933 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 934 | LIST_INIT(&cur_suite->terms); |
| 935 | LIST_ADDQ(&cond->suites, &cur_suite->list); |
| 936 | } |
| 937 | LIST_ADDQ(&cur_suite->terms, &cur_term->list); |
Willy Tarreau | 74b98a8 | 2007-06-16 19:35:18 +0200 | [diff] [blame] | 938 | neg = 0; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 939 | } |
| 940 | |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 941 | cond->val |= suite_val; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 942 | return cond; |
| 943 | |
| 944 | out_free_term: |
| 945 | free(cur_term); |
| 946 | out_free_suite: |
| 947 | prune_acl_cond(cond); |
| 948 | free(cond); |
| 949 | out_return: |
| 950 | return NULL; |
| 951 | } |
| 952 | |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 953 | /* Builds an ACL condition starting at the if/unless keyword. The complete |
| 954 | * condition is returned. NULL is returned in case of error or if the first |
| 955 | * word is neither "if" nor "unless". It automatically sets the file name and |
Willy Tarreau | 25320b2 | 2013-03-24 07:22:08 +0100 | [diff] [blame] | 956 | * the line number in the condition for better error reporting, and sets the |
| 957 | * HTTP intiailization requirements in the proxy. If <err> is not NULL, it will |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 958 | * be filled with a pointer to an error message in case of error, that the |
| 959 | * caller is responsible for freeing. The initial location must either be |
| 960 | * freeable or NULL. |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 961 | */ |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 962 | struct acl_cond *build_acl_cond(const char *file, int line, struct proxy *px, const char **args, char **err) |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 963 | { |
Willy Tarreau | 0cba607 | 2013-11-28 22:21:02 +0100 | [diff] [blame] | 964 | enum acl_cond_pol pol = ACL_COND_NONE; |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 965 | struct acl_cond *cond = NULL; |
| 966 | |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 967 | if (err) |
| 968 | *err = NULL; |
| 969 | |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 970 | if (!strcmp(*args, "if")) { |
| 971 | pol = ACL_COND_IF; |
| 972 | args++; |
| 973 | } |
| 974 | else if (!strcmp(*args, "unless")) { |
| 975 | pol = ACL_COND_UNLESS; |
| 976 | args++; |
| 977 | } |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 978 | else { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 979 | memprintf(err, "conditions must start with either 'if' or 'unless'"); |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 980 | return NULL; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 981 | } |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 982 | |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 983 | cond = parse_acl_cond(args, &px->acl, pol, err, &px->conf.args); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 984 | if (!cond) { |
| 985 | /* note that parse_acl_cond must have filled <err> here */ |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 986 | return NULL; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 987 | } |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 988 | |
| 989 | cond->file = file; |
| 990 | cond->line = line; |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 991 | px->http_needed |= !!(cond->use & SMP_USE_HTTP_ANY); |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 992 | return cond; |
| 993 | } |
| 994 | |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 995 | /* Execute condition <cond> and return either ACL_TEST_FAIL, ACL_TEST_MISS or |
| 996 | * ACL_TEST_PASS depending on the test results. ACL_TEST_MISS may only be |
Willy Tarreau | 32a6f2e | 2012-04-25 10:13:36 +0200 | [diff] [blame] | 997 | * returned if <opt> does not contain SMP_OPT_FINAL, indicating that incomplete |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 998 | * data is being examined. The function automatically sets SMP_OPT_ITERATE. This |
| 999 | * function only computes the condition, it does not apply the polarity required |
| 1000 | * by IF/UNLESS, it's up to the caller to do this using something like this : |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1001 | * |
| 1002 | * res = acl_pass(res); |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 1003 | * if (res == ACL_TEST_MISS) |
Willy Tarreau | b686644 | 2008-07-14 23:54:42 +0200 | [diff] [blame] | 1004 | * return 0; |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1005 | * if (cond->pol == ACL_COND_UNLESS) |
| 1006 | * res = !res; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1007 | */ |
Willy Tarreau | 0cba607 | 2013-11-28 22:21:02 +0100 | [diff] [blame] | 1008 | enum acl_test_res acl_exec_cond(struct acl_cond *cond, struct proxy *px, struct session *l4, void *l7, unsigned int opt) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1009 | { |
| 1010 | __label__ fetch_next; |
| 1011 | struct acl_term_suite *suite; |
| 1012 | struct acl_term *term; |
| 1013 | struct acl_expr *expr; |
| 1014 | struct acl *acl; |
Willy Tarreau | 3740635 | 2012-04-23 16:16:37 +0200 | [diff] [blame] | 1015 | struct sample smp; |
Willy Tarreau | 0cba607 | 2013-11-28 22:21:02 +0100 | [diff] [blame] | 1016 | enum acl_test_res acl_res, suite_res, cond_res; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1017 | |
Willy Tarreau | 7a777ed | 2012-04-26 11:44:02 +0200 | [diff] [blame] | 1018 | /* ACLs are iterated over all values, so let's always set the flag to |
| 1019 | * indicate this to the fetch functions. |
| 1020 | */ |
| 1021 | opt |= SMP_OPT_ITERATE; |
| 1022 | |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1023 | /* We're doing a logical OR between conditions so we initialize to FAIL. |
| 1024 | * The MISS status is propagated down from the suites. |
| 1025 | */ |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 1026 | cond_res = ACL_TEST_FAIL; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1027 | list_for_each_entry(suite, &cond->suites, list) { |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1028 | /* Evaluate condition suite <suite>. We stop at the first term |
Willy Tarreau | 0cba607 | 2013-11-28 22:21:02 +0100 | [diff] [blame] | 1029 | * which returns ACL_TEST_FAIL. The MISS status is still propagated |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1030 | * in case of uncertainty in the result. |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1031 | */ |
| 1032 | |
| 1033 | /* we're doing a logical AND between terms, so we must set the |
| 1034 | * initial value to PASS. |
| 1035 | */ |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 1036 | suite_res = ACL_TEST_PASS; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1037 | list_for_each_entry(term, &suite->terms, list) { |
| 1038 | acl = term->acl; |
| 1039 | |
| 1040 | /* FIXME: use cache ! |
| 1041 | * check acl->cache_idx for this. |
| 1042 | */ |
| 1043 | |
| 1044 | /* ACL result not cached. Let's scan all the expressions |
| 1045 | * and use the first one to match. |
| 1046 | */ |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 1047 | acl_res = ACL_TEST_FAIL; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1048 | list_for_each_entry(expr, &acl->expr, list) { |
Willy Tarreau | d41f8d8 | 2007-06-10 10:06:18 +0200 | [diff] [blame] | 1049 | /* we need to reset context and flags */ |
Willy Tarreau | 3740635 | 2012-04-23 16:16:37 +0200 | [diff] [blame] | 1050 | memset(&smp, 0, sizeof(smp)); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1051 | fetch_next: |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1052 | if (!sample_process(px, l4, l7, opt, expr->smp, &smp)) { |
Willy Tarreau | b686644 | 2008-07-14 23:54:42 +0200 | [diff] [blame] | 1053 | /* maybe we could not fetch because of missing data */ |
Willy Tarreau | 32a6f2e | 2012-04-25 10:13:36 +0200 | [diff] [blame] | 1054 | if (smp.flags & SMP_F_MAY_CHANGE && !(opt & SMP_OPT_FINAL)) |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 1055 | acl_res |= ACL_TEST_MISS; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1056 | continue; |
Willy Tarreau | b686644 | 2008-07-14 23:54:42 +0200 | [diff] [blame] | 1057 | } |
Willy Tarreau | c426296 | 2010-05-10 23:42:40 +0200 | [diff] [blame] | 1058 | |
Thierry FOURNIER | 1794fdf | 2014-01-17 15:25:13 +0100 | [diff] [blame] | 1059 | acl_res |= pat2acl(pattern_exec_match(&expr->pat, &smp, 0)); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1060 | /* |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1061 | * OK now acl_res holds the result of this expression |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 1062 | * as one of ACL_TEST_FAIL, ACL_TEST_MISS or ACL_TEST_PASS. |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1063 | * |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1064 | * Then if (!MISS) we can cache the result, and put |
Willy Tarreau | 3740635 | 2012-04-23 16:16:37 +0200 | [diff] [blame] | 1065 | * (smp.flags & SMP_F_VOLATILE) in the cache flags. |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1066 | * |
| 1067 | * FIXME: implement cache. |
| 1068 | * |
| 1069 | */ |
| 1070 | |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1071 | /* we're ORing these terms, so a single PASS is enough */ |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 1072 | if (acl_res == ACL_TEST_PASS) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1073 | break; |
| 1074 | |
Willy Tarreau | 3740635 | 2012-04-23 16:16:37 +0200 | [diff] [blame] | 1075 | if (smp.flags & SMP_F_NOT_LAST) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1076 | goto fetch_next; |
Willy Tarreau | b686644 | 2008-07-14 23:54:42 +0200 | [diff] [blame] | 1077 | |
| 1078 | /* sometimes we know the fetched data is subject to change |
| 1079 | * later and give another chance for a new match (eg: request |
| 1080 | * size, time, ...) |
| 1081 | */ |
Willy Tarreau | 32a6f2e | 2012-04-25 10:13:36 +0200 | [diff] [blame] | 1082 | if (smp.flags & SMP_F_MAY_CHANGE && !(opt & SMP_OPT_FINAL)) |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 1083 | acl_res |= ACL_TEST_MISS; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1084 | } |
| 1085 | /* |
| 1086 | * Here we have the result of an ACL (cached or not). |
| 1087 | * ACLs are combined, negated or not, to form conditions. |
| 1088 | */ |
| 1089 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1090 | if (term->neg) |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1091 | acl_res = acl_neg(acl_res); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1092 | |
| 1093 | suite_res &= acl_res; |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1094 | |
Willy Tarreau | 79c412b | 2013-10-30 19:30:32 +0100 | [diff] [blame] | 1095 | /* we're ANDing these terms, so a single FAIL or MISS is enough */ |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 1096 | if (suite_res != ACL_TEST_PASS) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1097 | break; |
| 1098 | } |
| 1099 | cond_res |= suite_res; |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1100 | |
| 1101 | /* we're ORing these terms, so a single PASS is enough */ |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 1102 | if (cond_res == ACL_TEST_PASS) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1103 | break; |
| 1104 | } |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1105 | return cond_res; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1106 | } |
| 1107 | |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 1108 | /* Returns a pointer to the first ACL conflicting with usage at place <where> |
| 1109 | * which is one of the SMP_VAL_* bits indicating a check place, or NULL if |
| 1110 | * no conflict is found. Only full conflicts are detected (ACL is not usable). |
| 1111 | * Use the next function to check for useless keywords. |
Willy Tarreau | dd64f8d | 2008-07-27 22:02:32 +0200 | [diff] [blame] | 1112 | */ |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 1113 | const struct acl *acl_cond_conflicts(const struct acl_cond *cond, unsigned int where) |
Willy Tarreau | dd64f8d | 2008-07-27 22:02:32 +0200 | [diff] [blame] | 1114 | { |
| 1115 | struct acl_term_suite *suite; |
| 1116 | struct acl_term *term; |
| 1117 | struct acl *acl; |
| 1118 | |
| 1119 | list_for_each_entry(suite, &cond->suites, list) { |
| 1120 | list_for_each_entry(term, &suite->terms, list) { |
| 1121 | acl = term->acl; |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 1122 | if (!(acl->val & where)) |
Willy Tarreau | dd64f8d | 2008-07-27 22:02:32 +0200 | [diff] [blame] | 1123 | return acl; |
| 1124 | } |
| 1125 | } |
| 1126 | return NULL; |
| 1127 | } |
| 1128 | |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 1129 | /* Returns a pointer to the first ACL and its first keyword to conflict with |
| 1130 | * usage at place <where> which is one of the SMP_VAL_* bits indicating a check |
| 1131 | * place. Returns true if a conflict is found, with <acl> and <kw> set (if non |
| 1132 | * null), or false if not conflict is found. The first useless keyword is |
| 1133 | * returned. |
| 1134 | */ |
Willy Tarreau | 93fddf1 | 2013-03-31 22:59:32 +0200 | [diff] [blame] | 1135 | int acl_cond_kw_conflicts(const struct acl_cond *cond, unsigned int where, struct acl const **acl, char const **kw) |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 1136 | { |
| 1137 | struct acl_term_suite *suite; |
| 1138 | struct acl_term *term; |
| 1139 | struct acl_expr *expr; |
| 1140 | |
| 1141 | list_for_each_entry(suite, &cond->suites, list) { |
| 1142 | list_for_each_entry(term, &suite->terms, list) { |
| 1143 | list_for_each_entry(expr, &term->acl->expr, list) { |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1144 | if (!(expr->smp->fetch->val & where)) { |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 1145 | if (acl) |
| 1146 | *acl = term->acl; |
| 1147 | if (kw) |
| 1148 | *kw = expr->kw; |
| 1149 | return 1; |
| 1150 | } |
| 1151 | } |
| 1152 | } |
| 1153 | } |
| 1154 | return 0; |
| 1155 | } |
| 1156 | |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1157 | /* |
| 1158 | * Find targets for userlist and groups in acl. Function returns the number |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1159 | * of errors or OK if everything is fine. It must be called only once sample |
| 1160 | * fetch arguments have been resolved (after smp_resolve_args()). |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1161 | */ |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1162 | int acl_find_targets(struct proxy *p) |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1163 | { |
| 1164 | |
| 1165 | struct acl *acl; |
| 1166 | struct acl_expr *expr; |
Thierry FOURNIER | 3ead5b9 | 2013-12-13 12:12:18 +0100 | [diff] [blame] | 1167 | struct pattern_list *pattern; |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1168 | int cfgerr = 0; |
| 1169 | |
| 1170 | list_for_each_entry(acl, &p->acl, list) { |
| 1171 | list_for_each_entry(expr, &acl->expr, list) { |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1172 | if (!strcmp(expr->kw, "http_auth_group")) { |
| 1173 | /* Note: the ARGT_USR argument may only have been resolved earlier |
| 1174 | * by smp_resolve_args(). |
| 1175 | */ |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1176 | if (expr->smp->arg_p->unresolved) { |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1177 | Alert("Internal bug in proxy %s: %sacl %s %s() makes use of unresolved userlist '%s'. Please report this.\n", |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1178 | p->id, *acl->name ? "" : "anonymous ", acl->name, expr->kw, expr->smp->arg_p->data.str.str); |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1179 | cfgerr++; |
Willy Tarreau | 496aa01 | 2012-06-01 10:38:29 +0200 | [diff] [blame] | 1180 | continue; |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1181 | } |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1182 | |
Thierry FOURNIER | d163e1c | 2013-11-28 11:41:23 +0100 | [diff] [blame] | 1183 | if (LIST_ISEMPTY(&expr->pat.patterns)) { |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1184 | Alert("proxy %s: acl %s %s(): no groups specified.\n", |
Willy Tarreau | 93fddf1 | 2013-03-31 22:59:32 +0200 | [diff] [blame] | 1185 | p->id, acl->name, expr->kw); |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1186 | cfgerr++; |
| 1187 | continue; |
| 1188 | } |
| 1189 | |
Thierry FOURNIER | 9eec0a6 | 2014-01-22 18:38:02 +0100 | [diff] [blame] | 1190 | /* For each pattern, check if the group exists. */ |
Thierry FOURNIER | d163e1c | 2013-11-28 11:41:23 +0100 | [diff] [blame] | 1191 | list_for_each_entry(pattern, &expr->pat.patterns, list) { |
Thierry FOURNIER | 3ead5b9 | 2013-12-13 12:12:18 +0100 | [diff] [blame] | 1192 | if (!check_group(expr->smp->arg_p->data.usr, pattern->pat.ptr.str)) { |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1193 | Alert("proxy %s: acl %s %s(): invalid group '%s'.\n", |
Thierry FOURNIER | 3ead5b9 | 2013-12-13 12:12:18 +0100 | [diff] [blame] | 1194 | p->id, acl->name, expr->kw, pattern->pat.ptr.str); |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1195 | cfgerr++; |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1196 | } |
| 1197 | } |
| 1198 | } |
| 1199 | } |
| 1200 | } |
| 1201 | |
| 1202 | return cfgerr; |
| 1203 | } |
Willy Tarreau | dd64f8d | 2008-07-27 22:02:32 +0200 | [diff] [blame] | 1204 | |
Willy Tarreau | 8ed669b | 2013-01-11 15:49:37 +0100 | [diff] [blame] | 1205 | /* initializes ACLs by resolving the sample fetch names they rely upon. |
| 1206 | * Returns 0 on success, otherwise an error. |
| 1207 | */ |
| 1208 | int init_acl() |
| 1209 | { |
| 1210 | int err = 0; |
| 1211 | int index; |
| 1212 | const char *name; |
| 1213 | struct acl_kw_list *kwl; |
| 1214 | struct sample_fetch *smp; |
| 1215 | |
| 1216 | list_for_each_entry(kwl, &acl_keywords.list, list) { |
| 1217 | for (index = 0; kwl->kw[index].kw != NULL; index++) { |
| 1218 | name = kwl->kw[index].fetch_kw; |
| 1219 | if (!name) |
| 1220 | name = kwl->kw[index].kw; |
| 1221 | |
| 1222 | smp = find_sample_fetch(name, strlen(name)); |
| 1223 | if (!smp) { |
| 1224 | Alert("Critical internal error: ACL keyword '%s' relies on sample fetch '%s' which was not registered!\n", |
| 1225 | kwl->kw[index].kw, name); |
| 1226 | err++; |
| 1227 | continue; |
| 1228 | } |
| 1229 | kwl->kw[index].smp = smp; |
| 1230 | } |
| 1231 | } |
| 1232 | return err; |
| 1233 | } |
Willy Tarreau | d4c33c8 | 2013-01-07 21:59:07 +0100 | [diff] [blame] | 1234 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1235 | /************************************************************************/ |
Willy Tarreau | d4c33c8 | 2013-01-07 21:59:07 +0100 | [diff] [blame] | 1236 | /* All supported sample and ACL keywords must be declared here. */ |
| 1237 | /************************************************************************/ |
| 1238 | |
| 1239 | /* Note: must not be declared <const> as its list will be overwritten. |
Willy Tarreau | 61612d4 | 2012-04-19 18:42:05 +0200 | [diff] [blame] | 1240 | * Please take care of keeping this list alphabetically sorted. |
| 1241 | */ |
Willy Tarreau | dc13c11 | 2013-06-21 23:16:39 +0200 | [diff] [blame] | 1242 | static struct acl_kw_list acl_kws = {ILH, { |
Willy Tarreau | d4c33c8 | 2013-01-07 21:59:07 +0100 | [diff] [blame] | 1243 | { /* END */ }, |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1244 | }}; |
| 1245 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1246 | __attribute__((constructor)) |
| 1247 | static void __acl_init(void) |
| 1248 | { |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1249 | acl_register_keywords(&acl_kws); |
| 1250 | } |
| 1251 | |
| 1252 | |
| 1253 | /* |
| 1254 | * Local variables: |
| 1255 | * c-indent-level: 8 |
| 1256 | * c-basic-offset: 8 |
| 1257 | * End: |
| 1258 | */ |