Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1 | /* |
| 2 | * ACL management functions. |
| 3 | * |
Willy Tarreau | d4c33c8 | 2013-01-07 21:59:07 +0100 | [diff] [blame] | 4 | * Copyright 2000-2013 Willy Tarreau <w@1wt.eu> |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 5 | * |
| 6 | * This program is free software; you can redistribute it and/or |
| 7 | * modify it under the terms of the GNU General Public License |
| 8 | * as published by the Free Software Foundation; either version |
| 9 | * 2 of the License, or (at your option) any later version. |
| 10 | * |
| 11 | */ |
| 12 | |
Willy Tarreau | ae8b796 | 2007-06-09 23:10:04 +0200 | [diff] [blame] | 13 | #include <ctype.h> |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 14 | #include <stdio.h> |
| 15 | #include <string.h> |
| 16 | |
| 17 | #include <common/config.h> |
| 18 | #include <common/mini-clist.h> |
| 19 | #include <common/standard.h> |
Krzysztof Piotr Oledzki | 8c8bd45 | 2010-01-29 19:29:32 +0100 | [diff] [blame] | 20 | #include <common/uri_auth.h> |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 21 | |
Willy Tarreau | 2b5285d | 2010-05-09 23:45:24 +0200 | [diff] [blame] | 22 | #include <types/global.h> |
| 23 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 24 | #include <proto/acl.h> |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 25 | #include <proto/arg.h> |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 26 | #include <proto/auth.h> |
Willy Tarreau | c7e4238 | 2012-08-24 19:22:53 +0200 | [diff] [blame] | 27 | #include <proto/channel.h> |
Willy Tarreau | 404e8ab | 2009-07-26 19:40:40 +0200 | [diff] [blame] | 28 | #include <proto/log.h> |
Thierry FOURNIER | ed66c29 | 2013-11-28 11:05:19 +0100 | [diff] [blame] | 29 | #include <proto/pattern.h> |
Willy Tarreau | 0b1cd94 | 2010-05-16 22:18:27 +0200 | [diff] [blame] | 30 | #include <proto/proxy.h> |
Willy Tarreau | 8ed669b | 2013-01-11 15:49:37 +0100 | [diff] [blame] | 31 | #include <proto/sample.h> |
Willy Tarreau | d28c353 | 2012-04-19 19:28:33 +0200 | [diff] [blame] | 32 | #include <proto/stick_table.h> |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 33 | |
Willy Tarreau | c426296 | 2010-05-10 23:42:40 +0200 | [diff] [blame] | 34 | #include <ebsttree.h> |
| 35 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 36 | /* List head of all known ACL keywords */ |
| 37 | static struct acl_kw_list acl_keywords = { |
| 38 | .list = LIST_HEAD_INIT(acl_keywords.list) |
| 39 | }; |
| 40 | |
Willy Tarreau | 0cba607 | 2013-11-28 22:21:02 +0100 | [diff] [blame] | 41 | /* input values are 0 or 3, output is the same */ |
| 42 | static inline enum acl_test_res pat2acl(enum pat_match_res res) |
| 43 | { |
| 44 | return (enum acl_test_res)res; |
| 45 | } |
| 46 | |
Willy Tarreau | a590983 | 2007-06-17 20:40:25 +0200 | [diff] [blame] | 47 | /* |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 48 | * Registers the ACL keyword list <kwl> as a list of valid keywords for next |
| 49 | * parsing sessions. |
| 50 | */ |
| 51 | void acl_register_keywords(struct acl_kw_list *kwl) |
| 52 | { |
| 53 | LIST_ADDQ(&acl_keywords.list, &kwl->list); |
| 54 | } |
| 55 | |
| 56 | /* |
| 57 | * Unregisters the ACL keyword list <kwl> from the list of valid keywords. |
| 58 | */ |
| 59 | void acl_unregister_keywords(struct acl_kw_list *kwl) |
| 60 | { |
| 61 | LIST_DEL(&kwl->list); |
| 62 | LIST_INIT(&kwl->list); |
| 63 | } |
| 64 | |
| 65 | /* Return a pointer to the ACL <name> within the list starting at <head>, or |
| 66 | * NULL if not found. |
| 67 | */ |
| 68 | struct acl *find_acl_by_name(const char *name, struct list *head) |
| 69 | { |
| 70 | struct acl *acl; |
| 71 | list_for_each_entry(acl, head, list) { |
| 72 | if (strcmp(acl->name, name) == 0) |
| 73 | return acl; |
| 74 | } |
| 75 | return NULL; |
| 76 | } |
| 77 | |
| 78 | /* Return a pointer to the ACL keyword <kw>, or NULL if not found. Note that if |
Willy Tarreau | 4bfa422 | 2013-12-16 22:01:06 +0100 | [diff] [blame] | 79 | * <kw> contains an opening parenthesis or a comma, only the left part of it is |
| 80 | * checked. |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 81 | */ |
| 82 | struct acl_keyword *find_acl_kw(const char *kw) |
| 83 | { |
| 84 | int index; |
| 85 | const char *kwend; |
| 86 | struct acl_kw_list *kwl; |
| 87 | |
Willy Tarreau | 4bfa422 | 2013-12-16 22:01:06 +0100 | [diff] [blame] | 88 | kwend = kw; |
| 89 | while (*kwend && *kwend != '(' && *kwend != ',') |
| 90 | kwend++; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 91 | |
| 92 | list_for_each_entry(kwl, &acl_keywords.list, list) { |
| 93 | for (index = 0; kwl->kw[index].kw != NULL; index++) { |
| 94 | if ((strncmp(kwl->kw[index].kw, kw, kwend - kw) == 0) && |
| 95 | kwl->kw[index].kw[kwend-kw] == 0) |
| 96 | return &kwl->kw[index]; |
| 97 | } |
| 98 | } |
| 99 | return NULL; |
| 100 | } |
| 101 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 102 | static struct acl_expr *prune_acl_expr(struct acl_expr *expr) |
| 103 | { |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 104 | struct arg *arg; |
| 105 | |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 106 | pattern_prune_expr(&expr->pat); |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 107 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 108 | for (arg = expr->smp->arg_p; arg; arg++) { |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 109 | if (arg->type == ARGT_STOP) |
| 110 | break; |
Willy Tarreau | 496aa01 | 2012-06-01 10:38:29 +0200 | [diff] [blame] | 111 | if (arg->type == ARGT_STR || arg->unresolved) { |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 112 | free(arg->data.str.str); |
| 113 | arg->data.str.str = NULL; |
Willy Tarreau | 496aa01 | 2012-06-01 10:38:29 +0200 | [diff] [blame] | 114 | arg->unresolved = 0; |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 115 | } |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 116 | } |
| 117 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 118 | if (expr->smp->arg_p != empty_arg_list) |
| 119 | free(expr->smp->arg_p); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 120 | return expr; |
| 121 | } |
| 122 | |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 123 | /* Parse an ACL expression starting at <args>[0], and return it. If <err> is |
| 124 | * not NULL, it will be filled with a pointer to an error message in case of |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 125 | * error. This pointer must be freeable or NULL. <al> is an arg_list serving |
| 126 | * as a list head to report missing dependencies. |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 127 | * |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 128 | * Right now, the only accepted syntax is : |
| 129 | * <subject> [<value>...] |
| 130 | */ |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 131 | struct acl_expr *parse_acl_expr(const char **args, char **err, struct arg_list *al) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 132 | { |
| 133 | __label__ out_return, out_free_expr, out_free_pattern; |
| 134 | struct acl_expr *expr; |
| 135 | struct acl_keyword *aclkw; |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 136 | struct pattern *pattern; |
Thierry FOURNIER | 7148ce6 | 2013-12-06 19:06:43 +0100 | [diff] [blame] | 137 | int patflags; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 138 | const char *arg; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 139 | struct sample_expr *smp = NULL; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 140 | int idx = 0; |
| 141 | char *ckw = NULL; |
| 142 | const char *begw; |
| 143 | const char *endw; |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 144 | const char *endt; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 145 | unsigned long prev_type; |
| 146 | int cur_type; |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 147 | int nbargs; |
Thierry FOURNIER | 511e947 | 2014-01-23 17:40:34 +0100 | [diff] [blame] | 148 | int operator = STD_OP_EQ; |
| 149 | int op; |
| 150 | int contain_colon, have_dot; |
| 151 | const char *dot; |
| 152 | signed long long value, minor; |
| 153 | /* The following buffer contain two numbers, a ':' separator and the final \0. */ |
| 154 | char buffer[NB_LLMAX_STR + 1 + NB_LLMAX_STR + 1]; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 155 | |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 156 | /* First, we look for an ACL keyword. And if we don't find one, then |
| 157 | * we look for a sample fetch expression starting with a sample fetch |
| 158 | * keyword. |
Willy Tarreau | bef91e7 | 2013-03-31 23:14:46 +0200 | [diff] [blame] | 159 | */ |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 160 | |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 161 | al->ctx = ARGC_ACL; // to report errors while resolving args late |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 162 | al->kw = *args; |
| 163 | al->conv = NULL; |
| 164 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 165 | aclkw = find_acl_kw(args[0]); |
Willy Tarreau | 2049092 | 2014-03-17 18:04:27 +0100 | [diff] [blame] | 166 | if (aclkw) { |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 167 | /* OK we have a real ACL keyword */ |
Willy Tarreau | 9987ea9 | 2013-06-11 21:09:06 +0200 | [diff] [blame] | 168 | |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 169 | /* build new sample expression for this ACL */ |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 170 | smp = calloc(1, sizeof(struct sample_expr)); |
| 171 | if (!smp) { |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 172 | memprintf(err, "out of memory when parsing ACL expression"); |
| 173 | goto out_return; |
| 174 | } |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 175 | LIST_INIT(&(smp->conv_exprs)); |
| 176 | smp->fetch = aclkw->smp; |
| 177 | smp->arg_p = empty_arg_list; |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 178 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 179 | /* look for the begining of the subject arguments */ |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 180 | for (arg = args[0]; *arg && *arg != '(' && *arg != ','; arg++); |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 181 | |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 182 | endt = arg; |
| 183 | if (*endt == '(') { |
| 184 | /* look for the end of this term and skip the opening parenthesis */ |
| 185 | endt = ++arg; |
| 186 | while (*endt && *endt != ')') |
| 187 | endt++; |
| 188 | if (*endt != ')') { |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 189 | memprintf(err, "missing closing ')' after arguments to ACL keyword '%s'", aclkw->kw); |
| 190 | goto out_free_smp; |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 191 | } |
| 192 | } |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 193 | |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 194 | /* At this point, we have : |
| 195 | * - args[0] : beginning of the keyword |
| 196 | * - arg : end of the keyword, first character not part of keyword |
| 197 | * nor the opening parenthesis (so first character of args |
| 198 | * if present). |
| 199 | * - endt : end of the term (=arg or last parenthesis if args are present) |
| 200 | */ |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 201 | nbargs = make_arg_list(arg, endt - arg, smp->fetch->arg_mask, &smp->arg_p, |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 202 | err, NULL, NULL, al); |
| 203 | if (nbargs < 0) { |
| 204 | /* note that make_arg_list will have set <err> here */ |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 205 | memprintf(err, "ACL keyword '%s' : %s", aclkw->kw, *err); |
| 206 | goto out_free_smp; |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 207 | } |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 208 | |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 209 | if (!smp->arg_p) { |
| 210 | smp->arg_p = empty_arg_list; |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 211 | } |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 212 | else if (smp->fetch->val_args && !smp->fetch->val_args(smp->arg_p, err)) { |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 213 | /* invalid keyword argument, error must have been |
| 214 | * set by val_args(). |
| 215 | */ |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 216 | memprintf(err, "in argument to '%s', %s", aclkw->kw, *err); |
| 217 | goto out_free_smp; |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 218 | } |
| 219 | arg = endt; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 220 | |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 221 | /* look for the begining of the converters list. Those directly attached |
| 222 | * to the ACL keyword are found just after <arg> which points to the comma. |
| 223 | */ |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 224 | prev_type = smp->fetch->out_type; |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 225 | while (*arg) { |
| 226 | struct sample_conv *conv; |
| 227 | struct sample_conv_expr *conv_expr; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 228 | |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 229 | if (*arg == ')') /* skip last closing parenthesis */ |
| 230 | arg++; |
| 231 | |
| 232 | if (*arg && *arg != ',') { |
| 233 | if (ckw) |
| 234 | memprintf(err, "ACL keyword '%s' : missing comma after conv keyword '%s'.", |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 235 | aclkw->kw, ckw); |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 236 | else |
| 237 | memprintf(err, "ACL keyword '%s' : missing comma after fetch keyword.", |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 238 | aclkw->kw); |
| 239 | goto out_free_smp; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 240 | } |
Willy Tarreau | ae52f06 | 2012-04-26 12:13:35 +0200 | [diff] [blame] | 241 | |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 242 | while (*arg == ',') /* then trailing commas */ |
| 243 | arg++; |
Willy Tarreau | 2e845be | 2012-10-19 19:49:09 +0200 | [diff] [blame] | 244 | |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 245 | begw = arg; /* start of conv keyword */ |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 246 | |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 247 | if (!*begw) |
| 248 | /* none ? end of converters */ |
| 249 | break; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 250 | |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 251 | for (endw = begw; *endw && *endw != '(' && *endw != ','; endw++); |
Willy Tarreau | 9ca6936 | 2013-10-22 19:10:06 +0200 | [diff] [blame] | 252 | |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 253 | free(ckw); |
| 254 | ckw = my_strndup(begw, endw - begw); |
Willy Tarreau | f75d008 | 2013-04-07 21:20:44 +0200 | [diff] [blame] | 255 | |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 256 | conv = find_sample_conv(begw, endw - begw); |
| 257 | if (!conv) { |
| 258 | /* Unknown converter method */ |
| 259 | memprintf(err, "ACL keyword '%s' : unknown conv method '%s'.", |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 260 | aclkw->kw, ckw); |
| 261 | goto out_free_smp; |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 262 | } |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 263 | |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 264 | arg = endw; |
| 265 | if (*arg == '(') { |
| 266 | /* look for the end of this term */ |
| 267 | while (*arg && *arg != ')') |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 268 | arg++; |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 269 | if (*arg != ')') { |
| 270 | memprintf(err, "ACL keyword '%s' : syntax error: missing ')' after conv keyword '%s'.", |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 271 | aclkw->kw, ckw); |
| 272 | goto out_free_smp; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 273 | } |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 274 | } |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 275 | |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 276 | if (conv->in_type >= SMP_TYPES || conv->out_type >= SMP_TYPES) { |
| 277 | memprintf(err, "ACL keyword '%s' : returns type of conv method '%s' is unknown.", |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 278 | aclkw->kw, ckw); |
| 279 | goto out_free_smp; |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 280 | } |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 281 | |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 282 | /* If impossible type conversion */ |
| 283 | if (!sample_casts[prev_type][conv->in_type]) { |
| 284 | memprintf(err, "ACL keyword '%s' : conv method '%s' cannot be applied.", |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 285 | aclkw->kw, ckw); |
| 286 | goto out_free_smp; |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 287 | } |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 288 | |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 289 | prev_type = conv->out_type; |
| 290 | conv_expr = calloc(1, sizeof(struct sample_conv_expr)); |
| 291 | if (!conv_expr) |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 292 | goto out_free_smp; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 293 | |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 294 | LIST_ADDQ(&(smp->conv_exprs), &(conv_expr->list)); |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 295 | conv_expr->conv = conv; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 296 | |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 297 | if (arg != endw) { |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 298 | int err_arg; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 299 | |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 300 | if (!conv->arg_mask) { |
| 301 | memprintf(err, "ACL keyword '%s' : conv method '%s' does not support any args.", |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 302 | aclkw->kw, ckw); |
| 303 | goto out_free_smp; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 304 | } |
| 305 | |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 306 | al->kw = smp->fetch->kw; |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 307 | al->conv = conv_expr->conv->kw; |
Willy Tarreau | adaddc2 | 2013-12-13 01:30:22 +0100 | [diff] [blame] | 308 | if (make_arg_list(endw + 1, arg - endw - 1, conv->arg_mask, &conv_expr->arg_p, err, NULL, &err_arg, al) < 0) { |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 309 | memprintf(err, "ACL keyword '%s' : invalid arg %d in conv method '%s' : %s.", |
Willy Tarreau | adaddc2 | 2013-12-13 01:30:22 +0100 | [diff] [blame] | 310 | aclkw->kw, err_arg+1, ckw, *err); |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 311 | goto out_free_smp; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 312 | } |
| 313 | |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 314 | if (!conv_expr->arg_p) |
| 315 | conv_expr->arg_p = empty_arg_list; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 316 | |
Willy Tarreau | adaddc2 | 2013-12-13 01:30:22 +0100 | [diff] [blame] | 317 | if (conv->val_args && !conv->val_args(conv_expr->arg_p, conv, err)) { |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 318 | memprintf(err, "ACL keyword '%s' : invalid args in conv method '%s' : %s.", |
Willy Tarreau | adaddc2 | 2013-12-13 01:30:22 +0100 | [diff] [blame] | 319 | aclkw->kw, ckw, *err); |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 320 | goto out_free_smp; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 321 | } |
| 322 | } |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 323 | else if (ARGM(conv->arg_mask)) { |
| 324 | memprintf(err, "ACL keyword '%s' : missing args for conv method '%s'.", |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 325 | aclkw->kw, ckw); |
| 326 | goto out_free_smp; |
Willy Tarreau | 131b466 | 2013-12-13 01:08:36 +0100 | [diff] [blame] | 327 | } |
Willy Tarreau | 61612d4 | 2012-04-19 18:42:05 +0200 | [diff] [blame] | 328 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 329 | } |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 330 | else { |
| 331 | /* This is not an ACL keyword, so we hope this is a sample fetch |
| 332 | * keyword that we're going to transparently use as an ACL. If |
| 333 | * so, we retrieve a completely parsed expression with args and |
| 334 | * convs already done. |
| 335 | */ |
| 336 | smp = sample_parse_expr((char **)args, &idx, err, al); |
| 337 | if (!smp) { |
| 338 | memprintf(err, "%s in ACL expression '%s'", *err, *args); |
| 339 | goto out_return; |
| 340 | } |
| 341 | } |
| 342 | |
| 343 | expr = (struct acl_expr *)calloc(1, sizeof(*expr)); |
| 344 | if (!expr) { |
| 345 | memprintf(err, "out of memory when parsing ACL expression"); |
| 346 | goto out_return; |
| 347 | } |
| 348 | |
| 349 | pattern_init_expr(&expr->pat); |
| 350 | |
| 351 | expr->kw = aclkw ? aclkw->kw : smp->fetch->kw; |
| 352 | expr->pat.parse = aclkw ? aclkw->parse : NULL; |
| 353 | expr->pat.match = aclkw ? aclkw->match : NULL; |
| 354 | expr->smp = smp; |
| 355 | smp = NULL; |
| 356 | |
| 357 | if (!expr->pat.parse) { |
| 358 | /* some types can be automatically converted */ |
| 359 | |
| 360 | switch (expr->smp ? expr->smp->fetch->out_type : aclkw->smp->out_type) { |
| 361 | case SMP_T_BOOL: |
| 362 | expr->pat.parse = pat_parse_fcts[PAT_MATCH_BOOL]; |
| 363 | expr->pat.match = pat_match_fcts[PAT_MATCH_BOOL]; |
| 364 | break; |
| 365 | case SMP_T_SINT: |
| 366 | case SMP_T_UINT: |
| 367 | expr->pat.parse = pat_parse_fcts[PAT_MATCH_INT]; |
| 368 | expr->pat.match = pat_match_fcts[PAT_MATCH_INT]; |
| 369 | break; |
| 370 | case SMP_T_IPV4: |
| 371 | case SMP_T_IPV6: |
| 372 | expr->pat.parse = pat_parse_fcts[PAT_MATCH_IP]; |
| 373 | expr->pat.match = pat_match_fcts[PAT_MATCH_IP]; |
| 374 | break; |
| 375 | } |
| 376 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 377 | |
Willy Tarreau | 3c3dfd5 | 2013-11-04 18:09:12 +0100 | [diff] [blame] | 378 | /* Additional check to protect against common mistakes */ |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 379 | cur_type = smp_expr_output_type(expr->smp); |
Thierry FOURNIER | d163e1c | 2013-11-28 11:41:23 +0100 | [diff] [blame] | 380 | if (expr->pat.parse && cur_type != SMP_T_BOOL && !*args[1]) { |
Willy Tarreau | 3c3dfd5 | 2013-11-04 18:09:12 +0100 | [diff] [blame] | 381 | Warning("parsing acl keyword '%s' :\n" |
| 382 | " no pattern to match against were provided, so this ACL will never match.\n" |
| 383 | " If this is what you intended, please add '--' to get rid of this warning.\n" |
| 384 | " If you intended to match only for existence, please use '-m found'.\n" |
| 385 | " If you wanted to force an int to match as a bool, please use '-m bool'.\n" |
| 386 | "\n", |
| 387 | args[0]); |
| 388 | } |
| 389 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 390 | args++; |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 391 | |
| 392 | /* check for options before patterns. Supported options are : |
| 393 | * -i : ignore case for all patterns by default |
| 394 | * -f : read patterns from those files |
Willy Tarreau | 5adeda1 | 2013-03-31 22:13:34 +0200 | [diff] [blame] | 395 | * -m : force matching method (must be used before -f) |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 396 | * -- : everything after this is not an option |
| 397 | */ |
| 398 | patflags = 0; |
| 399 | while (**args == '-') { |
| 400 | if ((*args)[1] == 'i') |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 401 | patflags |= PAT_F_IGNORE_CASE; |
Willy Tarreau | 2b5285d | 2010-05-09 23:45:24 +0200 | [diff] [blame] | 402 | else if ((*args)[1] == 'f') { |
Thierry FOURNIER | d163e1c | 2013-11-28 11:41:23 +0100 | [diff] [blame] | 403 | if (!expr->pat.parse) { |
Willy Tarreau | 9987ea9 | 2013-06-11 21:09:06 +0200 | [diff] [blame] | 404 | memprintf(err, "matching method must be specified first (using '-m') when using a sample fetch of this type ('%s')", expr->kw); |
Willy Tarreau | bef91e7 | 2013-03-31 23:14:46 +0200 | [diff] [blame] | 405 | goto out_free_expr; |
| 406 | } |
| 407 | |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 408 | if (!pattern_read_from_file(&expr->pat, args[1], patflags | PAT_F_FROM_FILE, err)) |
Willy Tarreau | 2b5285d | 2010-05-09 23:45:24 +0200 | [diff] [blame] | 409 | goto out_free_expr; |
Willy Tarreau | 5adeda1 | 2013-03-31 22:13:34 +0200 | [diff] [blame] | 410 | args++; |
| 411 | } |
| 412 | else if ((*args)[1] == 'm') { |
| 413 | int idx; |
| 414 | |
Thierry FOURNIER | d163e1c | 2013-11-28 11:41:23 +0100 | [diff] [blame] | 415 | if (!LIST_ISEMPTY(&expr->pat.patterns) || !eb_is_empty(&expr->pat.pattern_tree)) { |
Willy Tarreau | 5adeda1 | 2013-03-31 22:13:34 +0200 | [diff] [blame] | 416 | memprintf(err, "'-m' must only be specified before patterns and files in parsing ACL expression"); |
| 417 | goto out_free_expr; |
| 418 | } |
| 419 | |
Willy Tarreau | 6f8fe31 | 2013-11-28 22:24:25 +0100 | [diff] [blame] | 420 | idx = pat_find_match_name(args[1]); |
Willy Tarreau | 5adeda1 | 2013-03-31 22:13:34 +0200 | [diff] [blame] | 421 | if (idx < 0) { |
| 422 | memprintf(err, "unknown matching method '%s' when parsing ACL expression", args[1]); |
| 423 | goto out_free_expr; |
| 424 | } |
| 425 | |
| 426 | /* Note: -m found is always valid, bool/int are compatible, str/bin/reg/len are compatible */ |
Thierry FOURNIER | e3ded59 | 2013-12-06 15:36:54 +0100 | [diff] [blame] | 427 | if (!sample_casts[cur_type][pat_match_types[idx]]) { |
Willy Tarreau | 93fddf1 | 2013-03-31 22:59:32 +0200 | [diff] [blame] | 428 | memprintf(err, "matching method '%s' cannot be used with fetch keyword '%s'", args[1], expr->kw); |
Willy Tarreau | 5adeda1 | 2013-03-31 22:13:34 +0200 | [diff] [blame] | 429 | goto out_free_expr; |
| 430 | } |
Thierry FOURNIER | e3ded59 | 2013-12-06 15:36:54 +0100 | [diff] [blame] | 431 | expr->pat.parse = pat_parse_fcts[idx]; |
| 432 | expr->pat.match = pat_match_fcts[idx]; |
Willy Tarreau | 2b5285d | 2010-05-09 23:45:24 +0200 | [diff] [blame] | 433 | args++; |
| 434 | } |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 435 | else if ((*args)[1] == '-') { |
| 436 | args++; |
| 437 | break; |
| 438 | } |
| 439 | else |
| 440 | break; |
| 441 | args++; |
| 442 | } |
| 443 | |
Thierry FOURNIER | d163e1c | 2013-11-28 11:41:23 +0100 | [diff] [blame] | 444 | if (!expr->pat.parse) { |
Willy Tarreau | 9987ea9 | 2013-06-11 21:09:06 +0200 | [diff] [blame] | 445 | memprintf(err, "matching method must be specified first (using '-m') when using a sample fetch of this type ('%s')", expr->kw); |
Willy Tarreau | bef91e7 | 2013-03-31 23:14:46 +0200 | [diff] [blame] | 446 | goto out_free_expr; |
| 447 | } |
| 448 | |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 449 | /* now parse all patterns */ |
Thierry FOURNIER | 7148ce6 | 2013-12-06 19:06:43 +0100 | [diff] [blame] | 450 | pattern = NULL; |
Thierry FOURNIER | 511e947 | 2014-01-23 17:40:34 +0100 | [diff] [blame] | 451 | while (**args) { |
| 452 | arg = *args; |
| 453 | |
| 454 | /* Compatibility layer. Each pattern can parse only one string per pattern, |
| 455 | * but the pat_parser_int() and pat_parse_dotted_ver() parsers were need |
| 456 | * optionnaly two operators. The first operator is the match method: eq, |
| 457 | * le, lt, ge and gt. pat_parse_int() and pat_parse_dotted_ver() functions |
| 458 | * can have a compatibility syntax based on ranges: |
| 459 | * |
| 460 | * pat_parse_int(): |
| 461 | * |
| 462 | * "eq x" -> "x" or "x:x" |
| 463 | * "le x" -> ":x" |
| 464 | * "lt x" -> ":y" (with y = x - 1) |
| 465 | * "ge x" -> "x:" |
| 466 | * "gt x" -> "y:" (with y = x + 1) |
| 467 | * |
| 468 | * pat_parse_dotted_ver(): |
| 469 | * |
| 470 | * "eq x.y" -> "x.y" or "x.y:x.y" |
| 471 | * "le x.y" -> ":x.y" |
| 472 | * "lt x.y" -> ":w.z" (with w.z = x.y - 1) |
| 473 | * "ge x.y" -> "x.y:" |
| 474 | * "gt x.y" -> "w.z:" (with w.z = x.y + 1) |
| 475 | * |
| 476 | * If y is not present, assume that is "0". |
| 477 | * |
| 478 | * The syntax eq, le, lt, ge and gt are proper to the acl syntax. The |
| 479 | * following block of code detect the operator, and rewrite each value |
| 480 | * in parsable string. |
| 481 | */ |
| 482 | if (expr->pat.parse == pat_parse_int || |
| 483 | expr->pat.parse == pat_parse_dotted_ver) { |
| 484 | /* Check for operator. If the argument is operator, memorise it and |
| 485 | * continue to the next argument. |
| 486 | */ |
| 487 | op = get_std_op(arg); |
| 488 | if (op != -1) { |
| 489 | operator = op; |
| 490 | args++; |
| 491 | continue; |
| 492 | } |
| 493 | |
| 494 | /* Check if the pattern contain ':' or '-' character. */ |
| 495 | contain_colon = (strchr(arg, ':') || strchr(arg, '-')); |
| 496 | |
| 497 | /* If the pattern contain ':' or '-' character, give it to the parser as is. |
| 498 | * If no contain ':' and operator is STD_OP_EQ, give it to the parser as is. |
| 499 | * In other case, try to convert the value according with the operator. |
| 500 | */ |
| 501 | if (!contain_colon && operator != STD_OP_EQ) { |
| 502 | /* Search '.' separator. */ |
| 503 | dot = strchr(arg, '.'); |
| 504 | if (!dot) { |
| 505 | have_dot = 0; |
| 506 | minor = 0; |
| 507 | dot = arg + strlen(arg); |
| 508 | } |
| 509 | else |
| 510 | have_dot = 1; |
| 511 | |
| 512 | /* convert the integer minor part for the pat_parse_dotted_ver() function. */ |
| 513 | if (expr->pat.parse == pat_parse_dotted_ver && have_dot) { |
| 514 | if (strl2llrc(dot+1, strlen(dot+1), &minor) != 0) { |
| 515 | memprintf(err, "'%s' is neither a number nor a supported operator", arg); |
| 516 | goto out_free_pattern; |
| 517 | } |
| 518 | if (minor >= 65536) { |
| 519 | memprintf(err, "'%s' contains too large a minor value", arg); |
| 520 | goto out_free_pattern; |
| 521 | } |
| 522 | } |
| 523 | |
| 524 | /* convert the integer value for the pat_parse_int() function, and the |
| 525 | * integer major part for the pat_parse_dotted_ver() function. |
| 526 | */ |
| 527 | if (strl2llrc(arg, dot - arg, &value) != 0) { |
| 528 | memprintf(err, "'%s' is neither a number nor a supported operator", arg); |
| 529 | goto out_free_pattern; |
| 530 | } |
| 531 | if (expr->pat.parse == pat_parse_dotted_ver) { |
| 532 | if (value >= 65536) { |
| 533 | memprintf(err, "'%s' contains too large a major value", arg); |
| 534 | goto out_free_pattern; |
| 535 | } |
| 536 | value = (value << 16) | (minor & 0xffff); |
| 537 | } |
| 538 | |
| 539 | switch (operator) { |
| 540 | |
| 541 | case STD_OP_EQ: /* this case is not possible. */ |
| 542 | memprintf(err, "internal error"); |
| 543 | goto out_free_pattern; |
| 544 | |
| 545 | case STD_OP_GT: |
| 546 | value++; /* gt = ge + 1 */ |
| 547 | |
| 548 | case STD_OP_GE: |
| 549 | if (expr->pat.parse == pat_parse_int) |
| 550 | snprintf(buffer, NB_LLMAX_STR+NB_LLMAX_STR+2, "%lld:", value); |
| 551 | else |
| 552 | snprintf(buffer, NB_LLMAX_STR+NB_LLMAX_STR+2, "%lld.%lld:", |
| 553 | value >> 16, value & 0xffff); |
| 554 | arg = buffer; |
| 555 | break; |
| 556 | |
| 557 | case STD_OP_LT: |
| 558 | value--; /* lt = le - 1 */ |
| 559 | |
| 560 | case STD_OP_LE: |
| 561 | if (expr->pat.parse == pat_parse_int) |
| 562 | snprintf(buffer, NB_LLMAX_STR+NB_LLMAX_STR+2, ":%lld", value); |
| 563 | else |
| 564 | snprintf(buffer, NB_LLMAX_STR+NB_LLMAX_STR+2, ":%lld.%lld", |
| 565 | value >> 16, value & 0xffff); |
| 566 | arg = buffer; |
| 567 | break; |
| 568 | } |
| 569 | } |
| 570 | } |
| 571 | |
Thierry FOURNIER | 972028f | 2014-01-23 17:53:31 +0100 | [diff] [blame^] | 572 | if (!pattern_register(&expr->pat, arg, NULL, &pattern, patflags, err)) |
Thierry FOURNIER | 511e947 | 2014-01-23 17:40:34 +0100 | [diff] [blame] | 573 | goto out_free_pattern; |
| 574 | args++; |
| 575 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 576 | |
| 577 | return expr; |
| 578 | |
| 579 | out_free_pattern: |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 580 | pattern_free(pattern); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 581 | out_free_expr: |
| 582 | prune_acl_expr(expr); |
| 583 | free(expr); |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 584 | free(ckw); |
Willy Tarreau | c37a3c7 | 2013-12-13 01:24:09 +0100 | [diff] [blame] | 585 | out_free_smp: |
| 586 | free(smp); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 587 | out_return: |
| 588 | return NULL; |
| 589 | } |
| 590 | |
Krzysztof Piotr Oledzki | a643baf | 2008-05-29 23:53:44 +0200 | [diff] [blame] | 591 | /* Purge everything in the acl <acl>, then return <acl>. */ |
| 592 | struct acl *prune_acl(struct acl *acl) { |
| 593 | |
| 594 | struct acl_expr *expr, *exprb; |
| 595 | |
| 596 | free(acl->name); |
| 597 | |
| 598 | list_for_each_entry_safe(expr, exprb, &acl->expr, list) { |
| 599 | LIST_DEL(&expr->list); |
| 600 | prune_acl_expr(expr); |
| 601 | free(expr); |
| 602 | } |
| 603 | |
| 604 | return acl; |
| 605 | } |
| 606 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 607 | /* Parse an ACL with the name starting at <args>[0], and with a list of already |
| 608 | * known ACLs in <acl>. If the ACL was not in the list, it will be added. |
Willy Tarreau | 2a56c5e | 2010-03-15 16:13:29 +0100 | [diff] [blame] | 609 | * A pointer to that ACL is returned. If the ACL has an empty name, then it's |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 610 | * an anonymous one and it won't be merged with any other one. If <err> is not |
| 611 | * NULL, it will be filled with an appropriate error. This pointer must be |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 612 | * freeable or NULL. <al> is the arg_list serving as a head for unresolved |
| 613 | * dependencies. |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 614 | * |
| 615 | * args syntax: <aclname> <acl_expr> |
| 616 | */ |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 617 | struct acl *parse_acl(const char **args, struct list *known_acl, char **err, struct arg_list *al) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 618 | { |
| 619 | __label__ out_return, out_free_acl_expr, out_free_name; |
| 620 | struct acl *cur_acl; |
| 621 | struct acl_expr *acl_expr; |
| 622 | char *name; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 623 | const char *pos; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 624 | |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 625 | if (**args && (pos = invalid_char(*args))) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 626 | memprintf(err, "invalid character in ACL name : '%c'", *pos); |
Willy Tarreau | 2e74c3f | 2007-12-02 18:45:09 +0100 | [diff] [blame] | 627 | goto out_return; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 628 | } |
Willy Tarreau | 2e74c3f | 2007-12-02 18:45:09 +0100 | [diff] [blame] | 629 | |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 630 | acl_expr = parse_acl_expr(args + 1, err, al); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 631 | if (!acl_expr) { |
| 632 | /* parse_acl_expr will have filled <err> here */ |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 633 | goto out_return; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 634 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 635 | |
Willy Tarreau | 404e8ab | 2009-07-26 19:40:40 +0200 | [diff] [blame] | 636 | /* Check for args beginning with an opening parenthesis just after the |
| 637 | * subject, as this is almost certainly a typo. Right now we can only |
| 638 | * emit a warning, so let's do so. |
| 639 | */ |
Krzysztof Piotr Oledzki | 4cdd831 | 2009-10-05 00:23:35 +0200 | [diff] [blame] | 640 | if (!strchr(args[1], '(') && *args[2] == '(') |
Willy Tarreau | 404e8ab | 2009-07-26 19:40:40 +0200 | [diff] [blame] | 641 | Warning("parsing acl '%s' :\n" |
| 642 | " matching '%s' for pattern '%s' is likely a mistake and probably\n" |
| 643 | " not what you want. Maybe you need to remove the extraneous space before '('.\n" |
| 644 | " If you are really sure this is not an error, please insert '--' between the\n" |
| 645 | " match and the pattern to make this warning message disappear.\n", |
| 646 | args[0], args[1], args[2]); |
| 647 | |
Willy Tarreau | 2a56c5e | 2010-03-15 16:13:29 +0100 | [diff] [blame] | 648 | if (*args[0]) |
| 649 | cur_acl = find_acl_by_name(args[0], known_acl); |
| 650 | else |
| 651 | cur_acl = NULL; |
| 652 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 653 | if (!cur_acl) { |
| 654 | name = strdup(args[0]); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 655 | if (!name) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 656 | memprintf(err, "out of memory when parsing ACL"); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 657 | goto out_free_acl_expr; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 658 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 659 | cur_acl = (struct acl *)calloc(1, sizeof(*cur_acl)); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 660 | if (cur_acl == NULL) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 661 | memprintf(err, "out of memory when parsing ACL"); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 662 | goto out_free_name; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 663 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 664 | |
| 665 | LIST_INIT(&cur_acl->expr); |
| 666 | LIST_ADDQ(known_acl, &cur_acl->list); |
| 667 | cur_acl->name = name; |
| 668 | } |
| 669 | |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 670 | /* We want to know what features the ACL needs (typically HTTP parsing), |
| 671 | * and where it may be used. If an ACL relies on multiple matches, it is |
| 672 | * OK if at least one of them may match in the context where it is used. |
| 673 | */ |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 674 | cur_acl->use |= acl_expr->smp->fetch->use; |
| 675 | cur_acl->val |= acl_expr->smp->fetch->val; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 676 | LIST_ADDQ(&cur_acl->expr, &acl_expr->list); |
| 677 | return cur_acl; |
| 678 | |
| 679 | out_free_name: |
| 680 | free(name); |
| 681 | out_free_acl_expr: |
| 682 | prune_acl_expr(acl_expr); |
| 683 | free(acl_expr); |
| 684 | out_return: |
| 685 | return NULL; |
| 686 | } |
| 687 | |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 688 | /* Some useful ACLs provided by default. Only those used are allocated. */ |
| 689 | |
| 690 | const struct { |
| 691 | const char *name; |
| 692 | const char *expr[4]; /* put enough for longest expression */ |
| 693 | } default_acl_list[] = { |
Willy Tarreau | 58393e1 | 2008-07-20 10:39:22 +0200 | [diff] [blame] | 694 | { .name = "TRUE", .expr = {"always_true",""}}, |
| 695 | { .name = "FALSE", .expr = {"always_false",""}}, |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 696 | { .name = "LOCALHOST", .expr = {"src","127.0.0.1/8",""}}, |
Willy Tarreau | 2492d5b | 2009-07-11 00:06:00 +0200 | [diff] [blame] | 697 | { .name = "HTTP", .expr = {"req_proto_http",""}}, |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 698 | { .name = "HTTP_1.0", .expr = {"req_ver","1.0",""}}, |
| 699 | { .name = "HTTP_1.1", .expr = {"req_ver","1.1",""}}, |
| 700 | { .name = "METH_CONNECT", .expr = {"method","CONNECT",""}}, |
| 701 | { .name = "METH_GET", .expr = {"method","GET","HEAD",""}}, |
| 702 | { .name = "METH_HEAD", .expr = {"method","HEAD",""}}, |
| 703 | { .name = "METH_OPTIONS", .expr = {"method","OPTIONS",""}}, |
| 704 | { .name = "METH_POST", .expr = {"method","POST",""}}, |
| 705 | { .name = "METH_TRACE", .expr = {"method","TRACE",""}}, |
| 706 | { .name = "HTTP_URL_ABS", .expr = {"url_reg","^[^/:]*://",""}}, |
| 707 | { .name = "HTTP_URL_SLASH", .expr = {"url_beg","/",""}}, |
| 708 | { .name = "HTTP_URL_STAR", .expr = {"url","*",""}}, |
| 709 | { .name = "HTTP_CONTENT", .expr = {"hdr_val(content-length)","gt","0",""}}, |
Emeric Brun | bede3d0 | 2009-06-30 17:54:00 +0200 | [diff] [blame] | 710 | { .name = "RDP_COOKIE", .expr = {"req_rdp_cookie_cnt","gt","0",""}}, |
Willy Tarreau | c631770 | 2008-07-20 09:29:50 +0200 | [diff] [blame] | 711 | { .name = "REQ_CONTENT", .expr = {"req_len","gt","0",""}}, |
Willy Tarreau | b6fb420 | 2008-07-20 11:18:28 +0200 | [diff] [blame] | 712 | { .name = "WAIT_END", .expr = {"wait_end",""}}, |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 713 | { .name = NULL, .expr = {""}} |
| 714 | }; |
| 715 | |
| 716 | /* Find a default ACL from the default_acl list, compile it and return it. |
| 717 | * If the ACL is not found, NULL is returned. In theory, it cannot fail, |
| 718 | * except when default ACLs are broken, in which case it will return NULL. |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 719 | * If <known_acl> is not NULL, the ACL will be queued at its tail. If <err> is |
| 720 | * not NULL, it will be filled with an error message if an error occurs. This |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 721 | * pointer must be freeable or NULL. <al> is an arg_list serving as a list head |
| 722 | * to report missing dependencies. |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 723 | */ |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 724 | static struct acl *find_acl_default(const char *acl_name, struct list *known_acl, |
| 725 | char **err, struct arg_list *al) |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 726 | { |
| 727 | __label__ out_return, out_free_acl_expr, out_free_name; |
| 728 | struct acl *cur_acl; |
| 729 | struct acl_expr *acl_expr; |
| 730 | char *name; |
| 731 | int index; |
| 732 | |
| 733 | for (index = 0; default_acl_list[index].name != NULL; index++) { |
| 734 | if (strcmp(acl_name, default_acl_list[index].name) == 0) |
| 735 | break; |
| 736 | } |
| 737 | |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 738 | if (default_acl_list[index].name == NULL) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 739 | memprintf(err, "no such ACL : '%s'", acl_name); |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 740 | return NULL; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 741 | } |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 742 | |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 743 | acl_expr = parse_acl_expr((const char **)default_acl_list[index].expr, err, al); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 744 | if (!acl_expr) { |
| 745 | /* parse_acl_expr must have filled err here */ |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 746 | goto out_return; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 747 | } |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 748 | |
| 749 | name = strdup(acl_name); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 750 | if (!name) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 751 | memprintf(err, "out of memory when building default ACL '%s'", acl_name); |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 752 | goto out_free_acl_expr; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 753 | } |
| 754 | |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 755 | cur_acl = (struct acl *)calloc(1, sizeof(*cur_acl)); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 756 | if (cur_acl == NULL) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 757 | memprintf(err, "out of memory when building default ACL '%s'", acl_name); |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 758 | goto out_free_name; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 759 | } |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 760 | |
| 761 | cur_acl->name = name; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 762 | cur_acl->use |= acl_expr->smp->fetch->use; |
| 763 | cur_acl->val |= acl_expr->smp->fetch->val; |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 764 | LIST_INIT(&cur_acl->expr); |
| 765 | LIST_ADDQ(&cur_acl->expr, &acl_expr->list); |
| 766 | if (known_acl) |
| 767 | LIST_ADDQ(known_acl, &cur_acl->list); |
| 768 | |
| 769 | return cur_acl; |
| 770 | |
| 771 | out_free_name: |
| 772 | free(name); |
| 773 | out_free_acl_expr: |
| 774 | prune_acl_expr(acl_expr); |
| 775 | free(acl_expr); |
| 776 | out_return: |
| 777 | return NULL; |
| 778 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 779 | |
| 780 | /* Purge everything in the acl_cond <cond>, then return <cond>. */ |
| 781 | struct acl_cond *prune_acl_cond(struct acl_cond *cond) |
| 782 | { |
| 783 | struct acl_term_suite *suite, *tmp_suite; |
| 784 | struct acl_term *term, *tmp_term; |
| 785 | |
| 786 | /* iterate through all term suites and free all terms and all suites */ |
| 787 | list_for_each_entry_safe(suite, tmp_suite, &cond->suites, list) { |
| 788 | list_for_each_entry_safe(term, tmp_term, &suite->terms, list) |
| 789 | free(term); |
| 790 | free(suite); |
| 791 | } |
| 792 | return cond; |
| 793 | } |
| 794 | |
| 795 | /* Parse an ACL condition starting at <args>[0], relying on a list of already |
| 796 | * known ACLs passed in <known_acl>. The new condition is returned (or NULL in |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 797 | * case of low memory). Supports multiple conditions separated by "or". If |
| 798 | * <err> is not NULL, it will be filled with a pointer to an error message in |
| 799 | * case of error, that the caller is responsible for freeing. The initial |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 800 | * location must either be freeable or NULL. The list <al> serves as a list head |
| 801 | * for unresolved dependencies. |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 802 | */ |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 803 | struct acl_cond *parse_acl_cond(const char **args, struct list *known_acl, |
Willy Tarreau | 0cba607 | 2013-11-28 22:21:02 +0100 | [diff] [blame] | 804 | enum acl_cond_pol pol, char **err, struct arg_list *al) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 805 | { |
| 806 | __label__ out_return, out_free_suite, out_free_term; |
Willy Tarreau | 74b98a8 | 2007-06-16 19:35:18 +0200 | [diff] [blame] | 807 | int arg, neg; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 808 | const char *word; |
| 809 | struct acl *cur_acl; |
| 810 | struct acl_term *cur_term; |
| 811 | struct acl_term_suite *cur_suite; |
| 812 | struct acl_cond *cond; |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 813 | unsigned int suite_val; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 814 | |
| 815 | cond = (struct acl_cond *)calloc(1, sizeof(*cond)); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 816 | if (cond == NULL) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 817 | memprintf(err, "out of memory when parsing condition"); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 818 | goto out_return; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 819 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 820 | |
| 821 | LIST_INIT(&cond->list); |
| 822 | LIST_INIT(&cond->suites); |
| 823 | cond->pol = pol; |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 824 | cond->val = 0; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 825 | |
| 826 | cur_suite = NULL; |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 827 | suite_val = ~0U; |
Willy Tarreau | 74b98a8 | 2007-06-16 19:35:18 +0200 | [diff] [blame] | 828 | neg = 0; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 829 | for (arg = 0; *args[arg]; arg++) { |
| 830 | word = args[arg]; |
| 831 | |
| 832 | /* remove as many exclamation marks as we can */ |
| 833 | while (*word == '!') { |
| 834 | neg = !neg; |
| 835 | word++; |
| 836 | } |
| 837 | |
| 838 | /* an empty word is allowed because we cannot force the user to |
| 839 | * always think about not leaving exclamation marks alone. |
| 840 | */ |
| 841 | if (!*word) |
| 842 | continue; |
| 843 | |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 844 | if (strcasecmp(word, "or") == 0 || strcmp(word, "||") == 0) { |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 845 | /* new term suite */ |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 846 | cond->val |= suite_val; |
| 847 | suite_val = ~0U; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 848 | cur_suite = NULL; |
| 849 | neg = 0; |
| 850 | continue; |
| 851 | } |
| 852 | |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 853 | if (strcmp(word, "{") == 0) { |
| 854 | /* we may have a complete ACL expression between two braces, |
| 855 | * find the last one. |
| 856 | */ |
| 857 | int arg_end = arg + 1; |
| 858 | const char **args_new; |
| 859 | |
| 860 | while (*args[arg_end] && strcmp(args[arg_end], "}") != 0) |
| 861 | arg_end++; |
| 862 | |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 863 | if (!*args[arg_end]) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 864 | memprintf(err, "missing closing '}' in condition"); |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 865 | goto out_free_suite; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 866 | } |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 867 | |
| 868 | args_new = calloc(1, (arg_end - arg + 1) * sizeof(*args_new)); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 869 | if (!args_new) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 870 | memprintf(err, "out of memory when parsing condition"); |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 871 | goto out_free_suite; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 872 | } |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 873 | |
Willy Tarreau | 2a56c5e | 2010-03-15 16:13:29 +0100 | [diff] [blame] | 874 | args_new[0] = ""; |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 875 | memcpy(args_new + 1, args + arg + 1, (arg_end - arg) * sizeof(*args_new)); |
| 876 | args_new[arg_end - arg] = ""; |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 877 | cur_acl = parse_acl(args_new, known_acl, err, al); |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 878 | free(args_new); |
| 879 | |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 880 | if (!cur_acl) { |
| 881 | /* note that parse_acl() must have filled <err> here */ |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 882 | goto out_free_suite; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 883 | } |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 884 | word = args[arg + 1]; |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 885 | arg = arg_end; |
| 886 | } |
| 887 | else { |
| 888 | /* search for <word> in the known ACL names. If we do not find |
| 889 | * it, let's look for it in the default ACLs, and if found, add |
| 890 | * it to the list of ACLs of this proxy. This makes it possible |
| 891 | * to override them. |
| 892 | */ |
| 893 | cur_acl = find_acl_by_name(word, known_acl); |
| 894 | if (cur_acl == NULL) { |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 895 | cur_acl = find_acl_default(word, known_acl, err, al); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 896 | if (cur_acl == NULL) { |
| 897 | /* note that find_acl_default() must have filled <err> here */ |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 898 | goto out_free_suite; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 899 | } |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 900 | } |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 901 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 902 | |
| 903 | cur_term = (struct acl_term *)calloc(1, sizeof(*cur_term)); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 904 | if (cur_term == NULL) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 905 | memprintf(err, "out of memory when parsing condition"); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 906 | goto out_free_suite; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 907 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 908 | |
| 909 | cur_term->acl = cur_acl; |
| 910 | cur_term->neg = neg; |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 911 | |
| 912 | /* Here it is a bit complex. The acl_term_suite is a conjunction |
| 913 | * of many terms. It may only be used if all of its terms are |
| 914 | * usable at the same time. So the suite's validity domain is an |
| 915 | * AND between all ACL keywords' ones. But, the global condition |
| 916 | * is valid if at least one term suite is OK. So it's an OR between |
| 917 | * all of their validity domains. We could emit a warning as soon |
| 918 | * as suite_val is null because it means that the last ACL is not |
| 919 | * compatible with the previous ones. Let's remain simple for now. |
| 920 | */ |
| 921 | cond->use |= cur_acl->use; |
| 922 | suite_val &= cur_acl->val; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 923 | |
| 924 | if (!cur_suite) { |
| 925 | cur_suite = (struct acl_term_suite *)calloc(1, sizeof(*cur_suite)); |
Willy Tarreau | f678b7f | 2013-01-24 00:25:39 +0100 | [diff] [blame] | 926 | if (cur_suite == NULL) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 927 | memprintf(err, "out of memory when parsing condition"); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 928 | goto out_free_term; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 929 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 930 | LIST_INIT(&cur_suite->terms); |
| 931 | LIST_ADDQ(&cond->suites, &cur_suite->list); |
| 932 | } |
| 933 | LIST_ADDQ(&cur_suite->terms, &cur_term->list); |
Willy Tarreau | 74b98a8 | 2007-06-16 19:35:18 +0200 | [diff] [blame] | 934 | neg = 0; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 935 | } |
| 936 | |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 937 | cond->val |= suite_val; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 938 | return cond; |
| 939 | |
| 940 | out_free_term: |
| 941 | free(cur_term); |
| 942 | out_free_suite: |
| 943 | prune_acl_cond(cond); |
| 944 | free(cond); |
| 945 | out_return: |
| 946 | return NULL; |
| 947 | } |
| 948 | |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 949 | /* Builds an ACL condition starting at the if/unless keyword. The complete |
| 950 | * condition is returned. NULL is returned in case of error or if the first |
| 951 | * word is neither "if" nor "unless". It automatically sets the file name and |
Willy Tarreau | 25320b2 | 2013-03-24 07:22:08 +0100 | [diff] [blame] | 952 | * the line number in the condition for better error reporting, and sets the |
| 953 | * HTTP intiailization requirements in the proxy. If <err> is not NULL, it will |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 954 | * be filled with a pointer to an error message in case of error, that the |
| 955 | * caller is responsible for freeing. The initial location must either be |
| 956 | * freeable or NULL. |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 957 | */ |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 958 | struct acl_cond *build_acl_cond(const char *file, int line, struct proxy *px, const char **args, char **err) |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 959 | { |
Willy Tarreau | 0cba607 | 2013-11-28 22:21:02 +0100 | [diff] [blame] | 960 | enum acl_cond_pol pol = ACL_COND_NONE; |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 961 | struct acl_cond *cond = NULL; |
| 962 | |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 963 | if (err) |
| 964 | *err = NULL; |
| 965 | |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 966 | if (!strcmp(*args, "if")) { |
| 967 | pol = ACL_COND_IF; |
| 968 | args++; |
| 969 | } |
| 970 | else if (!strcmp(*args, "unless")) { |
| 971 | pol = ACL_COND_UNLESS; |
| 972 | args++; |
| 973 | } |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 974 | else { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 975 | memprintf(err, "conditions must start with either 'if' or 'unless'"); |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 976 | return NULL; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 977 | } |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 978 | |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 979 | cond = parse_acl_cond(args, &px->acl, pol, err, &px->conf.args); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 980 | if (!cond) { |
| 981 | /* note that parse_acl_cond must have filled <err> here */ |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 982 | return NULL; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 983 | } |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 984 | |
| 985 | cond->file = file; |
| 986 | cond->line = line; |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 987 | px->http_needed |= !!(cond->use & SMP_USE_HTTP_ANY); |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 988 | return cond; |
| 989 | } |
| 990 | |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 991 | /* Execute condition <cond> and return either ACL_TEST_FAIL, ACL_TEST_MISS or |
| 992 | * ACL_TEST_PASS depending on the test results. ACL_TEST_MISS may only be |
Willy Tarreau | 32a6f2e | 2012-04-25 10:13:36 +0200 | [diff] [blame] | 993 | * returned if <opt> does not contain SMP_OPT_FINAL, indicating that incomplete |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 994 | * data is being examined. The function automatically sets SMP_OPT_ITERATE. This |
| 995 | * function only computes the condition, it does not apply the polarity required |
| 996 | * by IF/UNLESS, it's up to the caller to do this using something like this : |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 997 | * |
| 998 | * res = acl_pass(res); |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 999 | * if (res == ACL_TEST_MISS) |
Willy Tarreau | b686644 | 2008-07-14 23:54:42 +0200 | [diff] [blame] | 1000 | * return 0; |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1001 | * if (cond->pol == ACL_COND_UNLESS) |
| 1002 | * res = !res; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1003 | */ |
Willy Tarreau | 0cba607 | 2013-11-28 22:21:02 +0100 | [diff] [blame] | 1004 | enum acl_test_res acl_exec_cond(struct acl_cond *cond, struct proxy *px, struct session *l4, void *l7, unsigned int opt) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1005 | { |
| 1006 | __label__ fetch_next; |
| 1007 | struct acl_term_suite *suite; |
| 1008 | struct acl_term *term; |
| 1009 | struct acl_expr *expr; |
| 1010 | struct acl *acl; |
Willy Tarreau | 3740635 | 2012-04-23 16:16:37 +0200 | [diff] [blame] | 1011 | struct sample smp; |
Willy Tarreau | 0cba607 | 2013-11-28 22:21:02 +0100 | [diff] [blame] | 1012 | enum acl_test_res acl_res, suite_res, cond_res; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1013 | |
Willy Tarreau | 7a777ed | 2012-04-26 11:44:02 +0200 | [diff] [blame] | 1014 | /* ACLs are iterated over all values, so let's always set the flag to |
| 1015 | * indicate this to the fetch functions. |
| 1016 | */ |
| 1017 | opt |= SMP_OPT_ITERATE; |
| 1018 | |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1019 | /* We're doing a logical OR between conditions so we initialize to FAIL. |
| 1020 | * The MISS status is propagated down from the suites. |
| 1021 | */ |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 1022 | cond_res = ACL_TEST_FAIL; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1023 | list_for_each_entry(suite, &cond->suites, list) { |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1024 | /* Evaluate condition suite <suite>. We stop at the first term |
Willy Tarreau | 0cba607 | 2013-11-28 22:21:02 +0100 | [diff] [blame] | 1025 | * which returns ACL_TEST_FAIL. The MISS status is still propagated |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1026 | * in case of uncertainty in the result. |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1027 | */ |
| 1028 | |
| 1029 | /* we're doing a logical AND between terms, so we must set the |
| 1030 | * initial value to PASS. |
| 1031 | */ |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 1032 | suite_res = ACL_TEST_PASS; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1033 | list_for_each_entry(term, &suite->terms, list) { |
| 1034 | acl = term->acl; |
| 1035 | |
| 1036 | /* FIXME: use cache ! |
| 1037 | * check acl->cache_idx for this. |
| 1038 | */ |
| 1039 | |
| 1040 | /* ACL result not cached. Let's scan all the expressions |
| 1041 | * and use the first one to match. |
| 1042 | */ |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 1043 | acl_res = ACL_TEST_FAIL; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1044 | list_for_each_entry(expr, &acl->expr, list) { |
Willy Tarreau | d41f8d8 | 2007-06-10 10:06:18 +0200 | [diff] [blame] | 1045 | /* we need to reset context and flags */ |
Willy Tarreau | 3740635 | 2012-04-23 16:16:37 +0200 | [diff] [blame] | 1046 | memset(&smp, 0, sizeof(smp)); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1047 | fetch_next: |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1048 | if (!sample_process(px, l4, l7, opt, expr->smp, &smp)) { |
Willy Tarreau | b686644 | 2008-07-14 23:54:42 +0200 | [diff] [blame] | 1049 | /* maybe we could not fetch because of missing data */ |
Willy Tarreau | 32a6f2e | 2012-04-25 10:13:36 +0200 | [diff] [blame] | 1050 | if (smp.flags & SMP_F_MAY_CHANGE && !(opt & SMP_OPT_FINAL)) |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 1051 | acl_res |= ACL_TEST_MISS; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1052 | continue; |
Willy Tarreau | b686644 | 2008-07-14 23:54:42 +0200 | [diff] [blame] | 1053 | } |
Willy Tarreau | c426296 | 2010-05-10 23:42:40 +0200 | [diff] [blame] | 1054 | |
Thierry FOURNIER | 7609064 | 2013-12-10 15:03:38 +0100 | [diff] [blame] | 1055 | acl_res |= pat2acl(pattern_exec_match(&expr->pat, &smp, NULL, NULL, NULL)); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1056 | /* |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1057 | * OK now acl_res holds the result of this expression |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 1058 | * as one of ACL_TEST_FAIL, ACL_TEST_MISS or ACL_TEST_PASS. |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1059 | * |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1060 | * Then if (!MISS) we can cache the result, and put |
Willy Tarreau | 3740635 | 2012-04-23 16:16:37 +0200 | [diff] [blame] | 1061 | * (smp.flags & SMP_F_VOLATILE) in the cache flags. |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1062 | * |
| 1063 | * FIXME: implement cache. |
| 1064 | * |
| 1065 | */ |
| 1066 | |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1067 | /* we're ORing these terms, so a single PASS is enough */ |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 1068 | if (acl_res == ACL_TEST_PASS) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1069 | break; |
| 1070 | |
Willy Tarreau | 3740635 | 2012-04-23 16:16:37 +0200 | [diff] [blame] | 1071 | if (smp.flags & SMP_F_NOT_LAST) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1072 | goto fetch_next; |
Willy Tarreau | b686644 | 2008-07-14 23:54:42 +0200 | [diff] [blame] | 1073 | |
| 1074 | /* sometimes we know the fetched data is subject to change |
| 1075 | * later and give another chance for a new match (eg: request |
| 1076 | * size, time, ...) |
| 1077 | */ |
Willy Tarreau | 32a6f2e | 2012-04-25 10:13:36 +0200 | [diff] [blame] | 1078 | if (smp.flags & SMP_F_MAY_CHANGE && !(opt & SMP_OPT_FINAL)) |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 1079 | acl_res |= ACL_TEST_MISS; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1080 | } |
| 1081 | /* |
| 1082 | * Here we have the result of an ACL (cached or not). |
| 1083 | * ACLs are combined, negated or not, to form conditions. |
| 1084 | */ |
| 1085 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1086 | if (term->neg) |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1087 | acl_res = acl_neg(acl_res); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1088 | |
| 1089 | suite_res &= acl_res; |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1090 | |
Willy Tarreau | 79c412b | 2013-10-30 19:30:32 +0100 | [diff] [blame] | 1091 | /* we're ANDing these terms, so a single FAIL or MISS is enough */ |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 1092 | if (suite_res != ACL_TEST_PASS) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1093 | break; |
| 1094 | } |
| 1095 | cond_res |= suite_res; |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1096 | |
| 1097 | /* we're ORing these terms, so a single PASS is enough */ |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 1098 | if (cond_res == ACL_TEST_PASS) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1099 | break; |
| 1100 | } |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1101 | return cond_res; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1102 | } |
| 1103 | |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 1104 | /* Returns a pointer to the first ACL conflicting with usage at place <where> |
| 1105 | * which is one of the SMP_VAL_* bits indicating a check place, or NULL if |
| 1106 | * no conflict is found. Only full conflicts are detected (ACL is not usable). |
| 1107 | * Use the next function to check for useless keywords. |
Willy Tarreau | dd64f8d | 2008-07-27 22:02:32 +0200 | [diff] [blame] | 1108 | */ |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 1109 | const struct acl *acl_cond_conflicts(const struct acl_cond *cond, unsigned int where) |
Willy Tarreau | dd64f8d | 2008-07-27 22:02:32 +0200 | [diff] [blame] | 1110 | { |
| 1111 | struct acl_term_suite *suite; |
| 1112 | struct acl_term *term; |
| 1113 | struct acl *acl; |
| 1114 | |
| 1115 | list_for_each_entry(suite, &cond->suites, list) { |
| 1116 | list_for_each_entry(term, &suite->terms, list) { |
| 1117 | acl = term->acl; |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 1118 | if (!(acl->val & where)) |
Willy Tarreau | dd64f8d | 2008-07-27 22:02:32 +0200 | [diff] [blame] | 1119 | return acl; |
| 1120 | } |
| 1121 | } |
| 1122 | return NULL; |
| 1123 | } |
| 1124 | |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 1125 | /* Returns a pointer to the first ACL and its first keyword to conflict with |
| 1126 | * usage at place <where> which is one of the SMP_VAL_* bits indicating a check |
| 1127 | * place. Returns true if a conflict is found, with <acl> and <kw> set (if non |
| 1128 | * null), or false if not conflict is found. The first useless keyword is |
| 1129 | * returned. |
| 1130 | */ |
Willy Tarreau | 93fddf1 | 2013-03-31 22:59:32 +0200 | [diff] [blame] | 1131 | int acl_cond_kw_conflicts(const struct acl_cond *cond, unsigned int where, struct acl const **acl, char const **kw) |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 1132 | { |
| 1133 | struct acl_term_suite *suite; |
| 1134 | struct acl_term *term; |
| 1135 | struct acl_expr *expr; |
| 1136 | |
| 1137 | list_for_each_entry(suite, &cond->suites, list) { |
| 1138 | list_for_each_entry(term, &suite->terms, list) { |
| 1139 | list_for_each_entry(expr, &term->acl->expr, list) { |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1140 | if (!(expr->smp->fetch->val & where)) { |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 1141 | if (acl) |
| 1142 | *acl = term->acl; |
| 1143 | if (kw) |
| 1144 | *kw = expr->kw; |
| 1145 | return 1; |
| 1146 | } |
| 1147 | } |
| 1148 | } |
| 1149 | } |
| 1150 | return 0; |
| 1151 | } |
| 1152 | |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1153 | /* |
| 1154 | * Find targets for userlist and groups in acl. Function returns the number |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1155 | * of errors or OK if everything is fine. It must be called only once sample |
| 1156 | * fetch arguments have been resolved (after smp_resolve_args()). |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1157 | */ |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1158 | int acl_find_targets(struct proxy *p) |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1159 | { |
| 1160 | |
| 1161 | struct acl *acl; |
| 1162 | struct acl_expr *expr; |
Thierry FOURNIER | a65b343 | 2013-11-28 18:22:00 +0100 | [diff] [blame] | 1163 | struct pattern *pattern; |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1164 | int cfgerr = 0; |
| 1165 | |
| 1166 | list_for_each_entry(acl, &p->acl, list) { |
| 1167 | list_for_each_entry(expr, &acl->expr, list) { |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1168 | if (!strcmp(expr->kw, "http_auth_group")) { |
| 1169 | /* Note: the ARGT_USR argument may only have been resolved earlier |
| 1170 | * by smp_resolve_args(). |
| 1171 | */ |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1172 | if (expr->smp->arg_p->unresolved) { |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1173 | Alert("Internal bug in proxy %s: %sacl %s %s() makes use of unresolved userlist '%s'. Please report this.\n", |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1174 | p->id, *acl->name ? "" : "anonymous ", acl->name, expr->kw, expr->smp->arg_p->data.str.str); |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1175 | cfgerr++; |
Willy Tarreau | 496aa01 | 2012-06-01 10:38:29 +0200 | [diff] [blame] | 1176 | continue; |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1177 | } |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1178 | |
Thierry FOURNIER | d163e1c | 2013-11-28 11:41:23 +0100 | [diff] [blame] | 1179 | if (LIST_ISEMPTY(&expr->pat.patterns)) { |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1180 | Alert("proxy %s: acl %s %s(): no groups specified.\n", |
Willy Tarreau | 93fddf1 | 2013-03-31 22:59:32 +0200 | [diff] [blame] | 1181 | p->id, acl->name, expr->kw); |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1182 | cfgerr++; |
| 1183 | continue; |
| 1184 | } |
| 1185 | |
Thierry FOURNIER | 9eec0a6 | 2014-01-22 18:38:02 +0100 | [diff] [blame] | 1186 | /* For each pattern, check if the group exists. */ |
Thierry FOURNIER | d163e1c | 2013-11-28 11:41:23 +0100 | [diff] [blame] | 1187 | list_for_each_entry(pattern, &expr->pat.patterns, list) { |
Thierry FOURNIER | 9eec0a6 | 2014-01-22 18:38:02 +0100 | [diff] [blame] | 1188 | if (!check_group(expr->smp->arg_p->data.usr, pattern->ptr.str)) { |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1189 | Alert("proxy %s: acl %s %s(): invalid group '%s'.\n", |
| 1190 | p->id, acl->name, expr->kw, pattern->ptr.str); |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1191 | cfgerr++; |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 1192 | } |
| 1193 | } |
| 1194 | } |
| 1195 | } |
| 1196 | } |
| 1197 | |
| 1198 | return cfgerr; |
| 1199 | } |
Willy Tarreau | dd64f8d | 2008-07-27 22:02:32 +0200 | [diff] [blame] | 1200 | |
Willy Tarreau | 8ed669b | 2013-01-11 15:49:37 +0100 | [diff] [blame] | 1201 | /* initializes ACLs by resolving the sample fetch names they rely upon. |
| 1202 | * Returns 0 on success, otherwise an error. |
| 1203 | */ |
| 1204 | int init_acl() |
| 1205 | { |
| 1206 | int err = 0; |
| 1207 | int index; |
| 1208 | const char *name; |
| 1209 | struct acl_kw_list *kwl; |
| 1210 | struct sample_fetch *smp; |
| 1211 | |
| 1212 | list_for_each_entry(kwl, &acl_keywords.list, list) { |
| 1213 | for (index = 0; kwl->kw[index].kw != NULL; index++) { |
| 1214 | name = kwl->kw[index].fetch_kw; |
| 1215 | if (!name) |
| 1216 | name = kwl->kw[index].kw; |
| 1217 | |
| 1218 | smp = find_sample_fetch(name, strlen(name)); |
| 1219 | if (!smp) { |
| 1220 | Alert("Critical internal error: ACL keyword '%s' relies on sample fetch '%s' which was not registered!\n", |
| 1221 | kwl->kw[index].kw, name); |
| 1222 | err++; |
| 1223 | continue; |
| 1224 | } |
| 1225 | kwl->kw[index].smp = smp; |
| 1226 | } |
| 1227 | } |
| 1228 | return err; |
| 1229 | } |
Willy Tarreau | d4c33c8 | 2013-01-07 21:59:07 +0100 | [diff] [blame] | 1230 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1231 | /************************************************************************/ |
Willy Tarreau | d4c33c8 | 2013-01-07 21:59:07 +0100 | [diff] [blame] | 1232 | /* All supported sample and ACL keywords must be declared here. */ |
| 1233 | /************************************************************************/ |
| 1234 | |
| 1235 | /* Note: must not be declared <const> as its list will be overwritten. |
Willy Tarreau | 61612d4 | 2012-04-19 18:42:05 +0200 | [diff] [blame] | 1236 | * Please take care of keeping this list alphabetically sorted. |
| 1237 | */ |
Willy Tarreau | dc13c11 | 2013-06-21 23:16:39 +0200 | [diff] [blame] | 1238 | static struct acl_kw_list acl_kws = {ILH, { |
Willy Tarreau | d4c33c8 | 2013-01-07 21:59:07 +0100 | [diff] [blame] | 1239 | { /* END */ }, |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1240 | }}; |
| 1241 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1242 | __attribute__((constructor)) |
| 1243 | static void __acl_init(void) |
| 1244 | { |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1245 | acl_register_keywords(&acl_kws); |
| 1246 | } |
| 1247 | |
| 1248 | |
| 1249 | /* |
| 1250 | * Local variables: |
| 1251 | * c-indent-level: 8 |
| 1252 | * c-basic-offset: 8 |
| 1253 | * End: |
| 1254 | */ |