Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1 | /* |
| 2 | * ACL management functions. |
| 3 | * |
Willy Tarreau | d4c33c8 | 2013-01-07 21:59:07 +0100 | [diff] [blame] | 4 | * Copyright 2000-2013 Willy Tarreau <w@1wt.eu> |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 5 | * |
| 6 | * This program is free software; you can redistribute it and/or |
| 7 | * modify it under the terms of the GNU General Public License |
| 8 | * as published by the Free Software Foundation; either version |
| 9 | * 2 of the License, or (at your option) any later version. |
| 10 | * |
| 11 | */ |
| 12 | |
Willy Tarreau | ae8b796 | 2007-06-09 23:10:04 +0200 | [diff] [blame] | 13 | #include <ctype.h> |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 14 | #include <stdio.h> |
| 15 | #include <string.h> |
| 16 | |
| 17 | #include <common/config.h> |
| 18 | #include <common/mini-clist.h> |
| 19 | #include <common/standard.h> |
Krzysztof Piotr Oledzki | 8c8bd45 | 2010-01-29 19:29:32 +0100 | [diff] [blame] | 20 | #include <common/uri_auth.h> |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 21 | |
Willy Tarreau | 2b5285d | 2010-05-09 23:45:24 +0200 | [diff] [blame] | 22 | #include <types/global.h> |
| 23 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 24 | #include <proto/acl.h> |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 25 | #include <proto/arg.h> |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 26 | #include <proto/auth.h> |
Willy Tarreau | c7e4238 | 2012-08-24 19:22:53 +0200 | [diff] [blame] | 27 | #include <proto/channel.h> |
Willy Tarreau | 404e8ab | 2009-07-26 19:40:40 +0200 | [diff] [blame] | 28 | #include <proto/log.h> |
Willy Tarreau | 0b1cd94 | 2010-05-16 22:18:27 +0200 | [diff] [blame] | 29 | #include <proto/proxy.h> |
Willy Tarreau | 8ed669b | 2013-01-11 15:49:37 +0100 | [diff] [blame] | 30 | #include <proto/sample.h> |
Willy Tarreau | d28c353 | 2012-04-19 19:28:33 +0200 | [diff] [blame] | 31 | #include <proto/stick_table.h> |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 32 | |
Willy Tarreau | c426296 | 2010-05-10 23:42:40 +0200 | [diff] [blame] | 33 | #include <ebsttree.h> |
| 34 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 35 | /* List head of all known ACL keywords */ |
| 36 | static struct acl_kw_list acl_keywords = { |
| 37 | .list = LIST_HEAD_INIT(acl_keywords.list) |
| 38 | }; |
| 39 | |
Thierry FOURNIER | 319e495 | 2013-11-22 17:25:35 +0100 | [diff] [blame] | 40 | char *acl_match_names[ACL_MATCH_NUM] = { |
Willy Tarreau | 5adeda1 | 2013-03-31 22:13:34 +0200 | [diff] [blame] | 41 | [ACL_MATCH_FOUND] = "found", |
| 42 | [ACL_MATCH_BOOL] = "bool", |
| 43 | [ACL_MATCH_INT] = "int", |
| 44 | [ACL_MATCH_IP] = "ip", |
| 45 | [ACL_MATCH_BIN] = "bin", |
| 46 | [ACL_MATCH_LEN] = "len", |
| 47 | [ACL_MATCH_STR] = "str", |
| 48 | [ACL_MATCH_BEG] = "beg", |
| 49 | [ACL_MATCH_SUB] = "sub", |
| 50 | [ACL_MATCH_DIR] = "dir", |
| 51 | [ACL_MATCH_DOM] = "dom", |
| 52 | [ACL_MATCH_END] = "end", |
| 53 | [ACL_MATCH_REG] = "reg", |
| 54 | }; |
| 55 | |
Thierry FOURNIER | 319e495 | 2013-11-22 17:25:35 +0100 | [diff] [blame] | 56 | int (*acl_parse_fcts[ACL_MATCH_NUM])(const char **, struct acl_pattern *, int *, char **) = { |
Willy Tarreau | 5adeda1 | 2013-03-31 22:13:34 +0200 | [diff] [blame] | 57 | [ACL_MATCH_FOUND] = acl_parse_nothing, |
| 58 | [ACL_MATCH_BOOL] = acl_parse_nothing, |
| 59 | [ACL_MATCH_INT] = acl_parse_int, |
| 60 | [ACL_MATCH_IP] = acl_parse_ip, |
| 61 | [ACL_MATCH_BIN] = acl_parse_bin, |
| 62 | [ACL_MATCH_LEN] = acl_parse_int, |
| 63 | [ACL_MATCH_STR] = acl_parse_str, |
| 64 | [ACL_MATCH_BEG] = acl_parse_str, |
| 65 | [ACL_MATCH_SUB] = acl_parse_str, |
| 66 | [ACL_MATCH_DIR] = acl_parse_str, |
| 67 | [ACL_MATCH_DOM] = acl_parse_str, |
| 68 | [ACL_MATCH_END] = acl_parse_str, |
| 69 | [ACL_MATCH_REG] = acl_parse_reg, |
| 70 | }; |
| 71 | |
Thierry FOURNIER | 319e495 | 2013-11-22 17:25:35 +0100 | [diff] [blame] | 72 | int (*acl_match_fcts[ACL_MATCH_NUM])(struct sample *, struct acl_pattern *) = { |
Willy Tarreau | 5adeda1 | 2013-03-31 22:13:34 +0200 | [diff] [blame] | 73 | [ACL_MATCH_FOUND] = NULL, |
| 74 | [ACL_MATCH_BOOL] = acl_match_nothing, |
| 75 | [ACL_MATCH_INT] = acl_match_int, |
| 76 | [ACL_MATCH_IP] = acl_match_ip, |
| 77 | [ACL_MATCH_BIN] = acl_match_bin, |
| 78 | [ACL_MATCH_LEN] = acl_match_len, |
| 79 | [ACL_MATCH_STR] = acl_match_str, |
| 80 | [ACL_MATCH_BEG] = acl_match_beg, |
| 81 | [ACL_MATCH_SUB] = acl_match_sub, |
| 82 | [ACL_MATCH_DIR] = acl_match_dir, |
| 83 | [ACL_MATCH_DOM] = acl_match_dom, |
| 84 | [ACL_MATCH_END] = acl_match_end, |
| 85 | [ACL_MATCH_REG] = acl_match_reg, |
| 86 | }; |
| 87 | |
| 88 | /* return the ACL_MATCH_* index for match name "name", or < 0 if not found */ |
| 89 | static int acl_find_match_name(const char *name) |
| 90 | { |
| 91 | int i; |
| 92 | |
| 93 | for (i = 0; i < ACL_MATCH_NUM; i++) |
| 94 | if (strcmp(name, acl_match_names[i]) == 0) |
| 95 | return i; |
| 96 | return -1; |
| 97 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 98 | |
Willy Tarreau | a590983 | 2007-06-17 20:40:25 +0200 | [diff] [blame] | 99 | /* |
Willy Tarreau | 58393e1 | 2008-07-20 10:39:22 +0200 | [diff] [blame] | 100 | * These functions are exported and may be used by any other component. |
| 101 | */ |
| 102 | |
| 103 | /* ignore the current line */ |
Willy Tarreau | 7dcb648 | 2012-04-27 17:52:25 +0200 | [diff] [blame] | 104 | int acl_parse_nothing(const char **text, struct acl_pattern *pattern, int *opaque, char **err) |
Willy Tarreau | a590983 | 2007-06-17 20:40:25 +0200 | [diff] [blame] | 105 | { |
Willy Tarreau | 58393e1 | 2008-07-20 10:39:22 +0200 | [diff] [blame] | 106 | return 1; |
| 107 | } |
| 108 | |
Willy Tarreau | a590983 | 2007-06-17 20:40:25 +0200 | [diff] [blame] | 109 | /* always return false */ |
Willy Tarreau | 3740635 | 2012-04-23 16:16:37 +0200 | [diff] [blame] | 110 | int acl_match_nothing(struct sample *smp, struct acl_pattern *pattern) |
Willy Tarreau | a590983 | 2007-06-17 20:40:25 +0200 | [diff] [blame] | 111 | { |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 112 | return ACL_PAT_FAIL; |
Willy Tarreau | a590983 | 2007-06-17 20:40:25 +0200 | [diff] [blame] | 113 | } |
| 114 | |
| 115 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 116 | /* NB: For two strings to be identical, it is required that their lengths match */ |
Willy Tarreau | 3740635 | 2012-04-23 16:16:37 +0200 | [diff] [blame] | 117 | int acl_match_str(struct sample *smp, struct acl_pattern *pattern) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 118 | { |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 119 | int icase; |
| 120 | |
Willy Tarreau | f853c46 | 2012-04-23 18:53:56 +0200 | [diff] [blame] | 121 | if (pattern->len != smp->data.str.len) |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 122 | return ACL_PAT_FAIL; |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 123 | |
| 124 | icase = pattern->flags & ACL_PAT_F_IGNORE_CASE; |
Willy Tarreau | f853c46 | 2012-04-23 18:53:56 +0200 | [diff] [blame] | 125 | if ((icase && strncasecmp(pattern->ptr.str, smp->data.str.str, smp->data.str.len) == 0) || |
| 126 | (!icase && strncmp(pattern->ptr.str, smp->data.str.str, smp->data.str.len) == 0)) |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 127 | return ACL_PAT_PASS; |
| 128 | return ACL_PAT_FAIL; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 129 | } |
| 130 | |
Emeric Brun | 07ca496 | 2012-10-17 13:38:19 +0200 | [diff] [blame] | 131 | /* NB: For two binaries buf to be identical, it is required that their lengths match */ |
| 132 | int acl_match_bin(struct sample *smp, struct acl_pattern *pattern) |
| 133 | { |
| 134 | if (pattern->len != smp->data.str.len) |
| 135 | return ACL_PAT_FAIL; |
| 136 | |
| 137 | if (memcmp(pattern->ptr.str, smp->data.str.str, smp->data.str.len) == 0) |
| 138 | return ACL_PAT_PASS; |
| 139 | return ACL_PAT_FAIL; |
| 140 | } |
| 141 | |
Willy Tarreau | c426296 | 2010-05-10 23:42:40 +0200 | [diff] [blame] | 142 | /* Lookup a string in the expression's pattern tree. The node is returned if it |
| 143 | * exists, otherwise NULL. |
| 144 | */ |
Willy Tarreau | 3740635 | 2012-04-23 16:16:37 +0200 | [diff] [blame] | 145 | static void *acl_lookup_str(struct sample *smp, struct acl_expr *expr) |
Willy Tarreau | c426296 | 2010-05-10 23:42:40 +0200 | [diff] [blame] | 146 | { |
| 147 | /* data are stored in a tree */ |
| 148 | struct ebmb_node *node; |
| 149 | char prev; |
| 150 | |
| 151 | /* we may have to force a trailing zero on the test pattern */ |
Willy Tarreau | f853c46 | 2012-04-23 18:53:56 +0200 | [diff] [blame] | 152 | prev = smp->data.str.str[smp->data.str.len]; |
Willy Tarreau | c426296 | 2010-05-10 23:42:40 +0200 | [diff] [blame] | 153 | if (prev) |
Willy Tarreau | f853c46 | 2012-04-23 18:53:56 +0200 | [diff] [blame] | 154 | smp->data.str.str[smp->data.str.len] = '\0'; |
| 155 | node = ebst_lookup(&expr->pattern_tree, smp->data.str.str); |
Willy Tarreau | c426296 | 2010-05-10 23:42:40 +0200 | [diff] [blame] | 156 | if (prev) |
Willy Tarreau | f853c46 | 2012-04-23 18:53:56 +0200 | [diff] [blame] | 157 | smp->data.str.str[smp->data.str.len] = prev; |
Willy Tarreau | c426296 | 2010-05-10 23:42:40 +0200 | [diff] [blame] | 158 | return node; |
| 159 | } |
| 160 | |
Willy Tarreau | 21e5b0e | 2012-04-23 19:25:44 +0200 | [diff] [blame] | 161 | /* Executes a regex. It temporarily changes the data to add a trailing zero, |
| 162 | * and restores the previous character when leaving. |
Willy Tarreau | f3d2598 | 2007-05-08 22:45:09 +0200 | [diff] [blame] | 163 | */ |
Willy Tarreau | 3740635 | 2012-04-23 16:16:37 +0200 | [diff] [blame] | 164 | int acl_match_reg(struct sample *smp, struct acl_pattern *pattern) |
Willy Tarreau | f3d2598 | 2007-05-08 22:45:09 +0200 | [diff] [blame] | 165 | { |
Hiroaki Nakamura | 7035132 | 2013-01-13 15:00:42 +0900 | [diff] [blame] | 166 | if (regex_exec(pattern->ptr.reg, smp->data.str.str, smp->data.str.len) == 0) |
Thierry FOURNIER | ef37a66 | 2013-10-15 13:41:44 +0200 | [diff] [blame] | 167 | return ACL_PAT_PASS; |
| 168 | return ACL_PAT_FAIL; |
Willy Tarreau | f3d2598 | 2007-05-08 22:45:09 +0200 | [diff] [blame] | 169 | } |
| 170 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 171 | /* Checks that the pattern matches the beginning of the tested string. */ |
Willy Tarreau | 3740635 | 2012-04-23 16:16:37 +0200 | [diff] [blame] | 172 | int acl_match_beg(struct sample *smp, struct acl_pattern *pattern) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 173 | { |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 174 | int icase; |
| 175 | |
Willy Tarreau | f853c46 | 2012-04-23 18:53:56 +0200 | [diff] [blame] | 176 | if (pattern->len > smp->data.str.len) |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 177 | return ACL_PAT_FAIL; |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 178 | |
| 179 | icase = pattern->flags & ACL_PAT_F_IGNORE_CASE; |
Willy Tarreau | f853c46 | 2012-04-23 18:53:56 +0200 | [diff] [blame] | 180 | if ((icase && strncasecmp(pattern->ptr.str, smp->data.str.str, pattern->len) != 0) || |
| 181 | (!icase && strncmp(pattern->ptr.str, smp->data.str.str, pattern->len) != 0)) |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 182 | return ACL_PAT_FAIL; |
| 183 | return ACL_PAT_PASS; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 184 | } |
| 185 | |
| 186 | /* Checks that the pattern matches the end of the tested string. */ |
Willy Tarreau | 3740635 | 2012-04-23 16:16:37 +0200 | [diff] [blame] | 187 | int acl_match_end(struct sample *smp, struct acl_pattern *pattern) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 188 | { |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 189 | int icase; |
| 190 | |
Willy Tarreau | f853c46 | 2012-04-23 18:53:56 +0200 | [diff] [blame] | 191 | if (pattern->len > smp->data.str.len) |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 192 | return ACL_PAT_FAIL; |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 193 | icase = pattern->flags & ACL_PAT_F_IGNORE_CASE; |
Willy Tarreau | f853c46 | 2012-04-23 18:53:56 +0200 | [diff] [blame] | 194 | if ((icase && strncasecmp(pattern->ptr.str, smp->data.str.str + smp->data.str.len - pattern->len, pattern->len) != 0) || |
| 195 | (!icase && strncmp(pattern->ptr.str, smp->data.str.str + smp->data.str.len - pattern->len, pattern->len) != 0)) |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 196 | return ACL_PAT_FAIL; |
| 197 | return ACL_PAT_PASS; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 198 | } |
| 199 | |
| 200 | /* Checks that the pattern is included inside the tested string. |
| 201 | * NB: Suboptimal, should be rewritten using a Boyer-Moore method. |
| 202 | */ |
Willy Tarreau | 3740635 | 2012-04-23 16:16:37 +0200 | [diff] [blame] | 203 | int acl_match_sub(struct sample *smp, struct acl_pattern *pattern) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 204 | { |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 205 | int icase; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 206 | char *end; |
| 207 | char *c; |
| 208 | |
Willy Tarreau | f853c46 | 2012-04-23 18:53:56 +0200 | [diff] [blame] | 209 | if (pattern->len > smp->data.str.len) |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 210 | return ACL_PAT_FAIL; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 211 | |
Willy Tarreau | f853c46 | 2012-04-23 18:53:56 +0200 | [diff] [blame] | 212 | end = smp->data.str.str + smp->data.str.len - pattern->len; |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 213 | icase = pattern->flags & ACL_PAT_F_IGNORE_CASE; |
| 214 | if (icase) { |
Willy Tarreau | f853c46 | 2012-04-23 18:53:56 +0200 | [diff] [blame] | 215 | for (c = smp->data.str.str; c <= end; c++) { |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 216 | if (tolower(*c) != tolower(*pattern->ptr.str)) |
| 217 | continue; |
| 218 | if (strncasecmp(pattern->ptr.str, c, pattern->len) == 0) |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 219 | return ACL_PAT_PASS; |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 220 | } |
| 221 | } else { |
Willy Tarreau | f853c46 | 2012-04-23 18:53:56 +0200 | [diff] [blame] | 222 | for (c = smp->data.str.str; c <= end; c++) { |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 223 | if (*c != *pattern->ptr.str) |
| 224 | continue; |
| 225 | if (strncmp(pattern->ptr.str, c, pattern->len) == 0) |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 226 | return ACL_PAT_PASS; |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 227 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 228 | } |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 229 | return ACL_PAT_FAIL; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 230 | } |
| 231 | |
Finn Arne Gangstad | e8c7ecc | 2011-09-09 16:09:50 +0200 | [diff] [blame] | 232 | /* Background: Fast way to find a zero byte in a word |
| 233 | * http://graphics.stanford.edu/~seander/bithacks.html#ZeroInWord |
| 234 | * hasZeroByte = (v - 0x01010101UL) & ~v & 0x80808080UL; |
| 235 | * |
| 236 | * To look for 4 different byte values, xor the word with those bytes and |
| 237 | * then check for zero bytes: |
| 238 | * |
| 239 | * v = (((unsigned char)c * 0x1010101U) ^ delimiter) |
| 240 | * where <delimiter> is the 4 byte values to look for (as an uint) |
| 241 | * and <c> is the character that is being tested |
| 242 | */ |
| 243 | static inline unsigned int is_delimiter(unsigned char c, unsigned int mask) |
| 244 | { |
| 245 | mask ^= (c * 0x01010101); /* propagate the char to all 4 bytes */ |
| 246 | return (mask - 0x01010101) & ~mask & 0x80808080U; |
| 247 | } |
| 248 | |
| 249 | static inline unsigned int make_4delim(unsigned char d1, unsigned char d2, unsigned char d3, unsigned char d4) |
| 250 | { |
| 251 | return d1 << 24 | d2 << 16 | d3 << 8 | d4; |
| 252 | } |
| 253 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 254 | /* This one is used by other real functions. It checks that the pattern is |
| 255 | * included inside the tested string, but enclosed between the specified |
Finn Arne Gangstad | e8c7ecc | 2011-09-09 16:09:50 +0200 | [diff] [blame] | 256 | * delimiters or at the beginning or end of the string. The delimiters are |
| 257 | * provided as an unsigned int made by make_4delim() and match up to 4 different |
| 258 | * delimiters. Delimiters are stripped at the beginning and end of the pattern. |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 259 | */ |
Willy Tarreau | 3740635 | 2012-04-23 16:16:37 +0200 | [diff] [blame] | 260 | static int match_word(struct sample *smp, struct acl_pattern *pattern, unsigned int delimiters) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 261 | { |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 262 | int may_match, icase; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 263 | char *c, *end; |
| 264 | char *ps; |
| 265 | int pl; |
| 266 | |
| 267 | pl = pattern->len; |
| 268 | ps = pattern->ptr.str; |
Finn Arne Gangstad | e8c7ecc | 2011-09-09 16:09:50 +0200 | [diff] [blame] | 269 | |
| 270 | while (pl > 0 && is_delimiter(*ps, delimiters)) { |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 271 | pl--; |
| 272 | ps++; |
| 273 | } |
| 274 | |
Finn Arne Gangstad | e8c7ecc | 2011-09-09 16:09:50 +0200 | [diff] [blame] | 275 | while (pl > 0 && is_delimiter(ps[pl - 1], delimiters)) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 276 | pl--; |
| 277 | |
Willy Tarreau | f853c46 | 2012-04-23 18:53:56 +0200 | [diff] [blame] | 278 | if (pl > smp->data.str.len) |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 279 | return ACL_PAT_FAIL; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 280 | |
| 281 | may_match = 1; |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 282 | icase = pattern->flags & ACL_PAT_F_IGNORE_CASE; |
Willy Tarreau | f853c46 | 2012-04-23 18:53:56 +0200 | [diff] [blame] | 283 | end = smp->data.str.str + smp->data.str.len - pl; |
| 284 | for (c = smp->data.str.str; c <= end; c++) { |
Finn Arne Gangstad | e8c7ecc | 2011-09-09 16:09:50 +0200 | [diff] [blame] | 285 | if (is_delimiter(*c, delimiters)) { |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 286 | may_match = 1; |
| 287 | continue; |
| 288 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 289 | |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 290 | if (!may_match) |
| 291 | continue; |
| 292 | |
| 293 | if (icase) { |
| 294 | if ((tolower(*c) == tolower(*ps)) && |
| 295 | (strncasecmp(ps, c, pl) == 0) && |
Finn Arne Gangstad | e8c7ecc | 2011-09-09 16:09:50 +0200 | [diff] [blame] | 296 | (c == end || is_delimiter(c[pl], delimiters))) |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 297 | return ACL_PAT_PASS; |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 298 | } else { |
| 299 | if ((*c == *ps) && |
| 300 | (strncmp(ps, c, pl) == 0) && |
Finn Arne Gangstad | e8c7ecc | 2011-09-09 16:09:50 +0200 | [diff] [blame] | 301 | (c == end || is_delimiter(c[pl], delimiters))) |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 302 | return ACL_PAT_PASS; |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 303 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 304 | may_match = 0; |
| 305 | } |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 306 | return ACL_PAT_FAIL; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 307 | } |
| 308 | |
| 309 | /* Checks that the pattern is included inside the tested string, but enclosed |
Finn Arne Gangstad | e8c7ecc | 2011-09-09 16:09:50 +0200 | [diff] [blame] | 310 | * between the delimiters '?' or '/' or at the beginning or end of the string. |
| 311 | * Delimiters at the beginning or end of the pattern are ignored. |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 312 | */ |
Willy Tarreau | 3740635 | 2012-04-23 16:16:37 +0200 | [diff] [blame] | 313 | int acl_match_dir(struct sample *smp, struct acl_pattern *pattern) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 314 | { |
Willy Tarreau | 3740635 | 2012-04-23 16:16:37 +0200 | [diff] [blame] | 315 | return match_word(smp, pattern, make_4delim('/', '?', '?', '?')); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 316 | } |
| 317 | |
| 318 | /* Checks that the pattern is included inside the tested string, but enclosed |
Finn Arne Gangstad | e8c7ecc | 2011-09-09 16:09:50 +0200 | [diff] [blame] | 319 | * between the delmiters '/', '?', '.' or ":" or at the beginning or end of |
| 320 | * the string. Delimiters at the beginning or end of the pattern are ignored. |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 321 | */ |
Willy Tarreau | 3740635 | 2012-04-23 16:16:37 +0200 | [diff] [blame] | 322 | int acl_match_dom(struct sample *smp, struct acl_pattern *pattern) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 323 | { |
Willy Tarreau | 3740635 | 2012-04-23 16:16:37 +0200 | [diff] [blame] | 324 | return match_word(smp, pattern, make_4delim('/', '?', '.', ':')); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 325 | } |
| 326 | |
| 327 | /* Checks that the integer in <test> is included between min and max */ |
Willy Tarreau | 3740635 | 2012-04-23 16:16:37 +0200 | [diff] [blame] | 328 | int acl_match_int(struct sample *smp, struct acl_pattern *pattern) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 329 | { |
Willy Tarreau | f853c46 | 2012-04-23 18:53:56 +0200 | [diff] [blame] | 330 | if ((!pattern->val.range.min_set || pattern->val.range.min <= smp->data.uint) && |
| 331 | (!pattern->val.range.max_set || smp->data.uint <= pattern->val.range.max)) |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 332 | return ACL_PAT_PASS; |
| 333 | return ACL_PAT_FAIL; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 334 | } |
| 335 | |
Willy Tarreau | 0e69854 | 2011-09-16 08:32:32 +0200 | [diff] [blame] | 336 | /* Checks that the length of the pattern in <test> is included between min and max */ |
Willy Tarreau | 3740635 | 2012-04-23 16:16:37 +0200 | [diff] [blame] | 337 | int acl_match_len(struct sample *smp, struct acl_pattern *pattern) |
Willy Tarreau | 0e69854 | 2011-09-16 08:32:32 +0200 | [diff] [blame] | 338 | { |
Willy Tarreau | f853c46 | 2012-04-23 18:53:56 +0200 | [diff] [blame] | 339 | if ((!pattern->val.range.min_set || pattern->val.range.min <= smp->data.str.len) && |
| 340 | (!pattern->val.range.max_set || smp->data.str.len <= pattern->val.range.max)) |
Willy Tarreau | 0e69854 | 2011-09-16 08:32:32 +0200 | [diff] [blame] | 341 | return ACL_PAT_PASS; |
| 342 | return ACL_PAT_FAIL; |
| 343 | } |
| 344 | |
Willy Tarreau | 3740635 | 2012-04-23 16:16:37 +0200 | [diff] [blame] | 345 | int acl_match_ip(struct sample *smp, struct acl_pattern *pattern) |
Willy Tarreau | a67fad9 | 2007-05-08 19:50:09 +0200 | [diff] [blame] | 346 | { |
Willy Tarreau | ceb4ac9 | 2012-04-28 00:41:46 +0200 | [diff] [blame] | 347 | unsigned int v4; /* in network byte order */ |
| 348 | struct in6_addr *v6; |
| 349 | int bits, pos; |
| 350 | struct in6_addr tmp6; |
Willy Tarreau | a67fad9 | 2007-05-08 19:50:09 +0200 | [diff] [blame] | 351 | |
Willy Tarreau | ceb4ac9 | 2012-04-28 00:41:46 +0200 | [diff] [blame] | 352 | if (pattern->type == SMP_T_IPV4) { |
| 353 | if (smp->type == SMP_T_IPV4) { |
| 354 | v4 = smp->data.ipv4.s_addr; |
| 355 | } |
| 356 | else if (smp->type == SMP_T_IPV6) { |
| 357 | /* v4 match on a V6 sample. We want to check at least for |
| 358 | * the following forms : |
| 359 | * - ::ffff:ip:v4 (ipv4 mapped) |
| 360 | * - ::0000:ip:v4 (old ipv4 mapped) |
| 361 | * - 2002:ip:v4:: (6to4) |
| 362 | */ |
| 363 | if (*(uint32_t*)&smp->data.ipv6.s6_addr[0] == 0 && |
| 364 | *(uint32_t*)&smp->data.ipv6.s6_addr[4] == 0 && |
| 365 | (*(uint32_t*)&smp->data.ipv6.s6_addr[8] == 0 || |
| 366 | *(uint32_t*)&smp->data.ipv6.s6_addr[8] == htonl(0xFFFF))) { |
| 367 | v4 = *(uint32_t*)&smp->data.ipv6.s6_addr[12]; |
| 368 | } |
| 369 | else if (*(uint16_t*)&smp->data.ipv6.s6_addr[0] == htons(0x2002)) { |
| 370 | v4 = htonl((ntohs(*(uint16_t*)&smp->data.ipv6.s6_addr[2]) << 16) + |
| 371 | ntohs(*(uint16_t*)&smp->data.ipv6.s6_addr[4])); |
| 372 | } |
| 373 | else |
| 374 | return ACL_PAT_FAIL; |
| 375 | } |
| 376 | else |
| 377 | return ACL_PAT_FAIL; |
Willy Tarreau | a67fad9 | 2007-05-08 19:50:09 +0200 | [diff] [blame] | 378 | |
Willy Tarreau | ceb4ac9 | 2012-04-28 00:41:46 +0200 | [diff] [blame] | 379 | if (((v4 ^ pattern->val.ipv4.addr.s_addr) & pattern->val.ipv4.mask.s_addr) == 0) |
| 380 | return ACL_PAT_PASS; |
| 381 | else |
| 382 | return ACL_PAT_FAIL; |
| 383 | } |
| 384 | else if (pattern->type == SMP_T_IPV6) { |
| 385 | if (smp->type == SMP_T_IPV4) { |
| 386 | /* Convert the IPv4 sample address to IPv4 with the |
| 387 | * mapping method using the ::ffff: prefix. |
| 388 | */ |
| 389 | memset(&tmp6, 0, 10); |
| 390 | *(uint16_t*)&tmp6.s6_addr[10] = htons(0xffff); |
| 391 | *(uint32_t*)&tmp6.s6_addr[12] = smp->data.ipv4.s_addr; |
| 392 | v6 = &tmp6; |
| 393 | } |
| 394 | else if (smp->type == SMP_T_IPV6) { |
| 395 | v6 = &smp->data.ipv6; |
| 396 | } |
| 397 | else { |
| 398 | return ACL_PAT_FAIL; |
| 399 | } |
| 400 | |
| 401 | bits = pattern->val.ipv6.mask; |
| 402 | for (pos = 0; bits > 0; pos += 4, bits -= 32) { |
| 403 | v4 = *(uint32_t*)&v6->s6_addr[pos] ^ *(uint32_t*)&pattern->val.ipv6.addr.s6_addr[pos]; |
| 404 | if (bits < 32) |
Cyril Bonté | 4c01beb | 2012-10-23 21:28:31 +0200 | [diff] [blame] | 405 | v4 &= htonl((~0U) << (32-bits)); |
Willy Tarreau | ceb4ac9 | 2012-04-28 00:41:46 +0200 | [diff] [blame] | 406 | if (v4) |
| 407 | return ACL_PAT_FAIL; |
| 408 | } |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 409 | return ACL_PAT_PASS; |
Willy Tarreau | ceb4ac9 | 2012-04-28 00:41:46 +0200 | [diff] [blame] | 410 | } |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 411 | return ACL_PAT_FAIL; |
Willy Tarreau | a67fad9 | 2007-05-08 19:50:09 +0200 | [diff] [blame] | 412 | } |
| 413 | |
Willy Tarreau | b337b53 | 2010-05-13 20:03:41 +0200 | [diff] [blame] | 414 | /* Lookup an IPv4 address in the expression's pattern tree using the longest |
| 415 | * match method. The node is returned if it exists, otherwise NULL. |
| 416 | */ |
Willy Tarreau | 3740635 | 2012-04-23 16:16:37 +0200 | [diff] [blame] | 417 | static void *acl_lookup_ip(struct sample *smp, struct acl_expr *expr) |
Willy Tarreau | b337b53 | 2010-05-13 20:03:41 +0200 | [diff] [blame] | 418 | { |
| 419 | struct in_addr *s; |
| 420 | |
Willy Tarreau | f853c46 | 2012-04-23 18:53:56 +0200 | [diff] [blame] | 421 | if (smp->type != SMP_T_IPV4) |
Willy Tarreau | b337b53 | 2010-05-13 20:03:41 +0200 | [diff] [blame] | 422 | return ACL_PAT_FAIL; |
| 423 | |
Willy Tarreau | f853c46 | 2012-04-23 18:53:56 +0200 | [diff] [blame] | 424 | s = &smp->data.ipv4; |
Willy Tarreau | b337b53 | 2010-05-13 20:03:41 +0200 | [diff] [blame] | 425 | return ebmb_lookup_longest(&expr->pattern_tree, &s->s_addr); |
| 426 | } |
| 427 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 428 | /* Parse a string. It is allocated and duplicated. */ |
Willy Tarreau | 7dcb648 | 2012-04-27 17:52:25 +0200 | [diff] [blame] | 429 | int acl_parse_str(const char **text, struct acl_pattern *pattern, int *opaque, char **err) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 430 | { |
| 431 | int len; |
| 432 | |
Willy Tarreau | ae8b796 | 2007-06-09 23:10:04 +0200 | [diff] [blame] | 433 | len = strlen(*text); |
Willy Tarreau | c92ddbc | 2012-04-27 22:10:57 +0200 | [diff] [blame] | 434 | pattern->type = SMP_T_CSTR; |
Willy Tarreau | c426296 | 2010-05-10 23:42:40 +0200 | [diff] [blame] | 435 | |
| 436 | if (pattern->flags & ACL_PAT_F_TREE_OK) { |
| 437 | /* we're allowed to put the data in a tree whose root is pointed |
| 438 | * to by val.tree. |
| 439 | */ |
| 440 | struct ebmb_node *node; |
| 441 | |
| 442 | node = calloc(1, sizeof(*node) + len + 1); |
Willy Tarreau | 7dcb648 | 2012-04-27 17:52:25 +0200 | [diff] [blame] | 443 | if (!node) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 444 | memprintf(err, "out of memory while loading string pattern"); |
Willy Tarreau | c426296 | 2010-05-10 23:42:40 +0200 | [diff] [blame] | 445 | return 0; |
Willy Tarreau | 7dcb648 | 2012-04-27 17:52:25 +0200 | [diff] [blame] | 446 | } |
Willy Tarreau | c426296 | 2010-05-10 23:42:40 +0200 | [diff] [blame] | 447 | memcpy(node->key, *text, len + 1); |
| 448 | if (ebst_insert(pattern->val.tree, node) != node) |
| 449 | free(node); /* was a duplicate */ |
| 450 | pattern->flags |= ACL_PAT_F_TREE; /* this pattern now contains a tree */ |
| 451 | return 1; |
| 452 | } |
| 453 | |
Willy Tarreau | ae8b796 | 2007-06-09 23:10:04 +0200 | [diff] [blame] | 454 | pattern->ptr.str = strdup(*text); |
Willy Tarreau | 7dcb648 | 2012-04-27 17:52:25 +0200 | [diff] [blame] | 455 | if (!pattern->ptr.str) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 456 | memprintf(err, "out of memory while loading string pattern"); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 457 | return 0; |
Willy Tarreau | 7dcb648 | 2012-04-27 17:52:25 +0200 | [diff] [blame] | 458 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 459 | pattern->len = len; |
| 460 | return 1; |
| 461 | } |
| 462 | |
Emeric Brun | 07ca496 | 2012-10-17 13:38:19 +0200 | [diff] [blame] | 463 | /* Parse a binary written in hexa. It is allocated. */ |
| 464 | int acl_parse_bin(const char **text, struct acl_pattern *pattern, int *opaque, char **err) |
| 465 | { |
| 466 | int len; |
| 467 | const char *p = *text; |
| 468 | int i,j; |
| 469 | |
| 470 | len = strlen(p); |
| 471 | if (len%2) { |
| 472 | memprintf(err, "an even number of hex digit is expected"); |
| 473 | return 0; |
| 474 | } |
| 475 | |
| 476 | pattern->type = SMP_T_CBIN; |
| 477 | pattern->len = len >> 1; |
| 478 | pattern->ptr.str = malloc(pattern->len); |
| 479 | if (!pattern->ptr.str) { |
| 480 | memprintf(err, "out of memory while loading string pattern"); |
| 481 | return 0; |
| 482 | } |
| 483 | |
| 484 | i = j = 0; |
| 485 | while (j < pattern->len) { |
| 486 | if (!ishex(p[i++])) |
| 487 | goto bad_input; |
| 488 | if (!ishex(p[i++])) |
| 489 | goto bad_input; |
| 490 | pattern->ptr.str[j++] = (hex2i(p[i-2]) << 4) + hex2i(p[i-1]); |
| 491 | } |
| 492 | return 1; |
| 493 | |
| 494 | bad_input: |
| 495 | memprintf(err, "an hex digit is expected (found '%c')", p[i-1]); |
| 496 | free(pattern->ptr.str); |
| 497 | return 0; |
| 498 | } |
| 499 | |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 500 | /* Parse and concatenate all further strings into one. */ |
| 501 | int |
Willy Tarreau | 7dcb648 | 2012-04-27 17:52:25 +0200 | [diff] [blame] | 502 | acl_parse_strcat(const char **text, struct acl_pattern *pattern, int *opaque, char **err) |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 503 | { |
| 504 | |
| 505 | int len = 0, i; |
| 506 | char *s; |
| 507 | |
| 508 | for (i = 0; *text[i]; i++) |
| 509 | len += strlen(text[i])+1; |
| 510 | |
Willy Tarreau | c92ddbc | 2012-04-27 22:10:57 +0200 | [diff] [blame] | 511 | pattern->type = SMP_T_CSTR; |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 512 | pattern->ptr.str = s = calloc(1, len); |
Willy Tarreau | 7dcb648 | 2012-04-27 17:52:25 +0200 | [diff] [blame] | 513 | if (!pattern->ptr.str) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 514 | memprintf(err, "out of memory while loading pattern"); |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 515 | return 0; |
Willy Tarreau | 7dcb648 | 2012-04-27 17:52:25 +0200 | [diff] [blame] | 516 | } |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 517 | |
| 518 | for (i = 0; *text[i]; i++) |
| 519 | s += sprintf(s, i?" %s":"%s", text[i]); |
| 520 | |
| 521 | pattern->len = len; |
| 522 | |
| 523 | return i; |
| 524 | } |
| 525 | |
Krzysztof Piotr Oledzki | 8001d61 | 2008-05-31 13:53:23 +0200 | [diff] [blame] | 526 | /* Free data allocated by acl_parse_reg */ |
Willy Tarreau | 3740635 | 2012-04-23 16:16:37 +0200 | [diff] [blame] | 527 | static void acl_free_reg(void *ptr) |
| 528 | { |
Hiroaki Nakamura | 7035132 | 2013-01-13 15:00:42 +0900 | [diff] [blame] | 529 | regex_free(ptr); |
Krzysztof Piotr Oledzki | 8001d61 | 2008-05-31 13:53:23 +0200 | [diff] [blame] | 530 | } |
| 531 | |
Willy Tarreau | f3d2598 | 2007-05-08 22:45:09 +0200 | [diff] [blame] | 532 | /* Parse a regex. It is allocated. */ |
Willy Tarreau | 7dcb648 | 2012-04-27 17:52:25 +0200 | [diff] [blame] | 533 | int acl_parse_reg(const char **text, struct acl_pattern *pattern, int *opaque, char **err) |
Willy Tarreau | f3d2598 | 2007-05-08 22:45:09 +0200 | [diff] [blame] | 534 | { |
Hiroaki Nakamura | 7035132 | 2013-01-13 15:00:42 +0900 | [diff] [blame] | 535 | regex *preg; |
Willy Tarreau | f3d2598 | 2007-05-08 22:45:09 +0200 | [diff] [blame] | 536 | |
Hiroaki Nakamura | 7035132 | 2013-01-13 15:00:42 +0900 | [diff] [blame] | 537 | preg = calloc(1, sizeof(*preg)); |
Willy Tarreau | f3d2598 | 2007-05-08 22:45:09 +0200 | [diff] [blame] | 538 | |
Willy Tarreau | 7dcb648 | 2012-04-27 17:52:25 +0200 | [diff] [blame] | 539 | if (!preg) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 540 | memprintf(err, "out of memory while loading pattern"); |
Willy Tarreau | f3d2598 | 2007-05-08 22:45:09 +0200 | [diff] [blame] | 541 | return 0; |
Willy Tarreau | 7dcb648 | 2012-04-27 17:52:25 +0200 | [diff] [blame] | 542 | } |
Willy Tarreau | f3d2598 | 2007-05-08 22:45:09 +0200 | [diff] [blame] | 543 | |
Thierry FOURNIER | ed5a4ae | 2013-10-14 14:07:36 +0200 | [diff] [blame] | 544 | if (!regex_comp(*text, preg, !(pattern->flags & ACL_PAT_F_IGNORE_CASE), 0, err)) { |
Hiroaki Nakamura | 7035132 | 2013-01-13 15:00:42 +0900 | [diff] [blame] | 545 | free(preg); |
Hiroaki Nakamura | 7035132 | 2013-01-13 15:00:42 +0900 | [diff] [blame] | 546 | return 0; |
| 547 | } |
| 548 | |
Willy Tarreau | f3d2598 | 2007-05-08 22:45:09 +0200 | [diff] [blame] | 549 | pattern->ptr.reg = preg; |
Krzysztof Piotr Oledzki | 8001d61 | 2008-05-31 13:53:23 +0200 | [diff] [blame] | 550 | pattern->freeptrbuf = &acl_free_reg; |
Willy Tarreau | f3d2598 | 2007-05-08 22:45:09 +0200 | [diff] [blame] | 551 | return 1; |
| 552 | } |
| 553 | |
Willy Tarreau | ae8b796 | 2007-06-09 23:10:04 +0200 | [diff] [blame] | 554 | /* Parse a range of positive integers delimited by either ':' or '-'. If only |
| 555 | * one integer is read, it is set as both min and max. An operator may be |
| 556 | * specified as the prefix, among this list of 5 : |
| 557 | * |
| 558 | * 0:eq, 1:gt, 2:ge, 3:lt, 4:le |
| 559 | * |
| 560 | * The default operator is "eq". It supports range matching. Ranges are |
| 561 | * rejected for other operators. The operator may be changed at any time. |
| 562 | * The operator is stored in the 'opaque' argument. |
| 563 | * |
Willy Tarreau | 7dcb648 | 2012-04-27 17:52:25 +0200 | [diff] [blame] | 564 | * If err is non-NULL, an error message will be returned there on errors and |
| 565 | * the caller will have to free it. |
| 566 | * |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 567 | */ |
Willy Tarreau | 7dcb648 | 2012-04-27 17:52:25 +0200 | [diff] [blame] | 568 | int acl_parse_int(const char **text, struct acl_pattern *pattern, int *opaque, char **err) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 569 | { |
Willy Tarreau | ae8b796 | 2007-06-09 23:10:04 +0200 | [diff] [blame] | 570 | signed long long i; |
| 571 | unsigned int j, last, skip = 0; |
| 572 | const char *ptr = *text; |
| 573 | |
Willy Tarreau | c92ddbc | 2012-04-27 22:10:57 +0200 | [diff] [blame] | 574 | pattern->type = SMP_T_UINT; |
Willy Tarreau | 8f8e645 | 2007-06-17 21:51:38 +0200 | [diff] [blame] | 575 | while (!isdigit((unsigned char)*ptr)) { |
Willy Tarreau | 1c7cc5b | 2010-07-18 10:46:33 +0200 | [diff] [blame] | 576 | switch (get_std_op(ptr)) { |
| 577 | case STD_OP_EQ: *opaque = 0; break; |
| 578 | case STD_OP_GT: *opaque = 1; break; |
| 579 | case STD_OP_GE: *opaque = 2; break; |
| 580 | case STD_OP_LT: *opaque = 3; break; |
| 581 | case STD_OP_LE: *opaque = 4; break; |
| 582 | default: |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 583 | memprintf(err, "'%s' is neither a number nor a supported operator", ptr); |
Willy Tarreau | ae8b796 | 2007-06-09 23:10:04 +0200 | [diff] [blame] | 584 | return 0; |
Willy Tarreau | 1c7cc5b | 2010-07-18 10:46:33 +0200 | [diff] [blame] | 585 | } |
Willy Tarreau | ae8b796 | 2007-06-09 23:10:04 +0200 | [diff] [blame] | 586 | |
| 587 | skip++; |
| 588 | ptr = text[skip]; |
| 589 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 590 | |
| 591 | last = i = 0; |
| 592 | while (1) { |
Willy Tarreau | ae8b796 | 2007-06-09 23:10:04 +0200 | [diff] [blame] | 593 | j = *ptr++; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 594 | if ((j == '-' || j == ':') && !last) { |
| 595 | last++; |
| 596 | pattern->val.range.min = i; |
| 597 | i = 0; |
| 598 | continue; |
| 599 | } |
| 600 | j -= '0'; |
| 601 | if (j > 9) |
| 602 | // also catches the terminating zero |
| 603 | break; |
| 604 | i *= 10; |
| 605 | i += j; |
| 606 | } |
Willy Tarreau | ae8b796 | 2007-06-09 23:10:04 +0200 | [diff] [blame] | 607 | |
Willy Tarreau | 7dcb648 | 2012-04-27 17:52:25 +0200 | [diff] [blame] | 608 | if (last && *opaque >= 1 && *opaque <= 4) { |
Willy Tarreau | ae8b796 | 2007-06-09 23:10:04 +0200 | [diff] [blame] | 609 | /* having a range with a min or a max is absurd */ |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 610 | memprintf(err, "integer range '%s' specified with a comparison operator", text[skip]); |
Willy Tarreau | ae8b796 | 2007-06-09 23:10:04 +0200 | [diff] [blame] | 611 | return 0; |
Willy Tarreau | 7dcb648 | 2012-04-27 17:52:25 +0200 | [diff] [blame] | 612 | } |
Willy Tarreau | ae8b796 | 2007-06-09 23:10:04 +0200 | [diff] [blame] | 613 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 614 | if (!last) |
| 615 | pattern->val.range.min = i; |
| 616 | pattern->val.range.max = i; |
Willy Tarreau | ae8b796 | 2007-06-09 23:10:04 +0200 | [diff] [blame] | 617 | |
| 618 | switch (*opaque) { |
| 619 | case 0: /* eq */ |
| 620 | pattern->val.range.min_set = 1; |
| 621 | pattern->val.range.max_set = 1; |
| 622 | break; |
| 623 | case 1: /* gt */ |
| 624 | pattern->val.range.min++; /* gt = ge + 1 */ |
| 625 | case 2: /* ge */ |
| 626 | pattern->val.range.min_set = 1; |
| 627 | pattern->val.range.max_set = 0; |
| 628 | break; |
| 629 | case 3: /* lt */ |
| 630 | pattern->val.range.max--; /* lt = le - 1 */ |
| 631 | case 4: /* le */ |
| 632 | pattern->val.range.min_set = 0; |
| 633 | pattern->val.range.max_set = 1; |
| 634 | break; |
| 635 | } |
| 636 | return skip + 1; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 637 | } |
| 638 | |
Willy Tarreau | 4a26d2f | 2008-07-15 16:05:33 +0200 | [diff] [blame] | 639 | /* Parse a range of positive 2-component versions delimited by either ':' or |
| 640 | * '-'. The version consists in a major and a minor, both of which must be |
| 641 | * smaller than 65536, because internally they will be represented as a 32-bit |
| 642 | * integer. |
| 643 | * If only one version is read, it is set as both min and max. Just like for |
| 644 | * pure integers, an operator may be specified as the prefix, among this list |
| 645 | * of 5 : |
| 646 | * |
| 647 | * 0:eq, 1:gt, 2:ge, 3:lt, 4:le |
| 648 | * |
| 649 | * The default operator is "eq". It supports range matching. Ranges are |
| 650 | * rejected for other operators. The operator may be changed at any time. |
| 651 | * The operator is stored in the 'opaque' argument. This allows constructs |
| 652 | * such as the following one : |
| 653 | * |
| 654 | * acl obsolete_ssl ssl_req_proto lt 3 |
| 655 | * acl unsupported_ssl ssl_req_proto gt 3.1 |
| 656 | * acl valid_ssl ssl_req_proto 3.0-3.1 |
| 657 | * |
| 658 | */ |
Willy Tarreau | 7dcb648 | 2012-04-27 17:52:25 +0200 | [diff] [blame] | 659 | int acl_parse_dotted_ver(const char **text, struct acl_pattern *pattern, int *opaque, char **err) |
Willy Tarreau | 4a26d2f | 2008-07-15 16:05:33 +0200 | [diff] [blame] | 660 | { |
| 661 | signed long long i; |
| 662 | unsigned int j, last, skip = 0; |
| 663 | const char *ptr = *text; |
| 664 | |
| 665 | |
| 666 | while (!isdigit((unsigned char)*ptr)) { |
Willy Tarreau | 1c7cc5b | 2010-07-18 10:46:33 +0200 | [diff] [blame] | 667 | switch (get_std_op(ptr)) { |
| 668 | case STD_OP_EQ: *opaque = 0; break; |
| 669 | case STD_OP_GT: *opaque = 1; break; |
| 670 | case STD_OP_GE: *opaque = 2; break; |
| 671 | case STD_OP_LT: *opaque = 3; break; |
| 672 | case STD_OP_LE: *opaque = 4; break; |
| 673 | default: |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 674 | memprintf(err, "'%s' is neither a number nor a supported operator", ptr); |
Willy Tarreau | 4a26d2f | 2008-07-15 16:05:33 +0200 | [diff] [blame] | 675 | return 0; |
Willy Tarreau | 1c7cc5b | 2010-07-18 10:46:33 +0200 | [diff] [blame] | 676 | } |
Willy Tarreau | 4a26d2f | 2008-07-15 16:05:33 +0200 | [diff] [blame] | 677 | |
| 678 | skip++; |
| 679 | ptr = text[skip]; |
| 680 | } |
| 681 | |
| 682 | last = i = 0; |
| 683 | while (1) { |
| 684 | j = *ptr++; |
| 685 | if (j == '.') { |
| 686 | /* minor part */ |
| 687 | if (i >= 65536) |
| 688 | return 0; |
| 689 | i <<= 16; |
| 690 | continue; |
| 691 | } |
| 692 | if ((j == '-' || j == ':') && !last) { |
| 693 | last++; |
| 694 | if (i < 65536) |
| 695 | i <<= 16; |
| 696 | pattern->val.range.min = i; |
| 697 | i = 0; |
| 698 | continue; |
| 699 | } |
| 700 | j -= '0'; |
| 701 | if (j > 9) |
| 702 | // also catches the terminating zero |
| 703 | break; |
| 704 | i = (i & 0xFFFF0000) + (i & 0xFFFF) * 10; |
| 705 | i += j; |
| 706 | } |
| 707 | |
| 708 | /* if we only got a major version, let's shift it now */ |
| 709 | if (i < 65536) |
| 710 | i <<= 16; |
| 711 | |
Willy Tarreau | 7dcb648 | 2012-04-27 17:52:25 +0200 | [diff] [blame] | 712 | if (last && *opaque >= 1 && *opaque <= 4) { |
Willy Tarreau | 4a26d2f | 2008-07-15 16:05:33 +0200 | [diff] [blame] | 713 | /* having a range with a min or a max is absurd */ |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 714 | memprintf(err, "version range '%s' specified with a comparison operator", text[skip]); |
Willy Tarreau | 4a26d2f | 2008-07-15 16:05:33 +0200 | [diff] [blame] | 715 | return 0; |
Willy Tarreau | 7dcb648 | 2012-04-27 17:52:25 +0200 | [diff] [blame] | 716 | } |
Willy Tarreau | 4a26d2f | 2008-07-15 16:05:33 +0200 | [diff] [blame] | 717 | |
| 718 | if (!last) |
| 719 | pattern->val.range.min = i; |
| 720 | pattern->val.range.max = i; |
| 721 | |
| 722 | switch (*opaque) { |
| 723 | case 0: /* eq */ |
| 724 | pattern->val.range.min_set = 1; |
| 725 | pattern->val.range.max_set = 1; |
| 726 | break; |
| 727 | case 1: /* gt */ |
| 728 | pattern->val.range.min++; /* gt = ge + 1 */ |
| 729 | case 2: /* ge */ |
| 730 | pattern->val.range.min_set = 1; |
| 731 | pattern->val.range.max_set = 0; |
| 732 | break; |
| 733 | case 3: /* lt */ |
| 734 | pattern->val.range.max--; /* lt = le - 1 */ |
| 735 | case 4: /* le */ |
| 736 | pattern->val.range.min_set = 0; |
| 737 | pattern->val.range.max_set = 1; |
| 738 | break; |
| 739 | } |
| 740 | return skip + 1; |
| 741 | } |
| 742 | |
Willy Tarreau | a67fad9 | 2007-05-08 19:50:09 +0200 | [diff] [blame] | 743 | /* Parse an IP address and an optional mask in the form addr[/mask]. |
| 744 | * The addr may either be an IPv4 address or a hostname. The mask |
| 745 | * may either be a dotted mask or a number of bits. Returns 1 if OK, |
Willy Tarreau | c92ddbc | 2012-04-27 22:10:57 +0200 | [diff] [blame] | 746 | * otherwise 0. NOTE: IP address patterns are typed (IPV4/IPV6). |
Willy Tarreau | a67fad9 | 2007-05-08 19:50:09 +0200 | [diff] [blame] | 747 | */ |
Willy Tarreau | 7dcb648 | 2012-04-27 17:52:25 +0200 | [diff] [blame] | 748 | int acl_parse_ip(const char **text, struct acl_pattern *pattern, int *opaque, char **err) |
Willy Tarreau | a67fad9 | 2007-05-08 19:50:09 +0200 | [diff] [blame] | 749 | { |
Willy Tarreau | b337b53 | 2010-05-13 20:03:41 +0200 | [diff] [blame] | 750 | struct eb_root *tree = NULL; |
| 751 | if (pattern->flags & ACL_PAT_F_TREE_OK) |
| 752 | tree = pattern->val.tree; |
| 753 | |
| 754 | if (str2net(*text, &pattern->val.ipv4.addr, &pattern->val.ipv4.mask)) { |
| 755 | unsigned int mask = ntohl(pattern->val.ipv4.mask.s_addr); |
| 756 | struct ebmb_node *node; |
| 757 | /* check if the mask is contiguous so that we can insert the |
| 758 | * network into the tree. A continuous mask has only ones on |
| 759 | * the left. This means that this mask + its lower bit added |
| 760 | * once again is null. |
| 761 | */ |
Willy Tarreau | ceb4ac9 | 2012-04-28 00:41:46 +0200 | [diff] [blame] | 762 | pattern->type = SMP_T_IPV4; |
Willy Tarreau | b337b53 | 2010-05-13 20:03:41 +0200 | [diff] [blame] | 763 | if (mask + (mask & -mask) == 0 && tree) { |
| 764 | mask = mask ? 33 - flsnz(mask & -mask) : 0; /* equals cidr value */ |
| 765 | /* FIXME: insert <addr>/<mask> into the tree here */ |
| 766 | node = calloc(1, sizeof(*node) + 4); /* reserve 4 bytes for IPv4 address */ |
Willy Tarreau | 7dcb648 | 2012-04-27 17:52:25 +0200 | [diff] [blame] | 767 | if (!node) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 768 | memprintf(err, "out of memory while loading IPv4 pattern"); |
Willy Tarreau | b337b53 | 2010-05-13 20:03:41 +0200 | [diff] [blame] | 769 | return 0; |
Willy Tarreau | 7dcb648 | 2012-04-27 17:52:25 +0200 | [diff] [blame] | 770 | } |
Willy Tarreau | b337b53 | 2010-05-13 20:03:41 +0200 | [diff] [blame] | 771 | memcpy(node->key, &pattern->val.ipv4.addr, 4); /* network byte order */ |
| 772 | node->node.pfx = mask; |
| 773 | if (ebmb_insert_prefix(tree, node, 4) != node) |
| 774 | free(node); /* was a duplicate */ |
| 775 | pattern->flags |= ACL_PAT_F_TREE; |
| 776 | return 1; |
| 777 | } |
Willy Tarreau | ae8b796 | 2007-06-09 23:10:04 +0200 | [diff] [blame] | 778 | return 1; |
Willy Tarreau | b337b53 | 2010-05-13 20:03:41 +0200 | [diff] [blame] | 779 | } |
Willy Tarreau | ceb4ac9 | 2012-04-28 00:41:46 +0200 | [diff] [blame] | 780 | else if (str62net(*text, &pattern->val.ipv6.addr, &pattern->val.ipv6.mask)) { |
| 781 | /* no tree support right now */ |
| 782 | pattern->type = SMP_T_IPV6; |
| 783 | return 1; |
| 784 | } |
Willy Tarreau | 7dcb648 | 2012-04-27 17:52:25 +0200 | [diff] [blame] | 785 | else { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 786 | memprintf(err, "'%s' is not a valid IPv4 or IPv6 address", *text); |
Willy Tarreau | ae8b796 | 2007-06-09 23:10:04 +0200 | [diff] [blame] | 787 | return 0; |
Willy Tarreau | 7dcb648 | 2012-04-27 17:52:25 +0200 | [diff] [blame] | 788 | } |
Willy Tarreau | a67fad9 | 2007-05-08 19:50:09 +0200 | [diff] [blame] | 789 | } |
| 790 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 791 | /* |
| 792 | * Registers the ACL keyword list <kwl> as a list of valid keywords for next |
| 793 | * parsing sessions. |
| 794 | */ |
| 795 | void acl_register_keywords(struct acl_kw_list *kwl) |
| 796 | { |
| 797 | LIST_ADDQ(&acl_keywords.list, &kwl->list); |
| 798 | } |
| 799 | |
| 800 | /* |
| 801 | * Unregisters the ACL keyword list <kwl> from the list of valid keywords. |
| 802 | */ |
| 803 | void acl_unregister_keywords(struct acl_kw_list *kwl) |
| 804 | { |
| 805 | LIST_DEL(&kwl->list); |
| 806 | LIST_INIT(&kwl->list); |
| 807 | } |
| 808 | |
| 809 | /* Return a pointer to the ACL <name> within the list starting at <head>, or |
| 810 | * NULL if not found. |
| 811 | */ |
| 812 | struct acl *find_acl_by_name(const char *name, struct list *head) |
| 813 | { |
| 814 | struct acl *acl; |
| 815 | list_for_each_entry(acl, head, list) { |
| 816 | if (strcmp(acl->name, name) == 0) |
| 817 | return acl; |
| 818 | } |
| 819 | return NULL; |
| 820 | } |
| 821 | |
| 822 | /* Return a pointer to the ACL keyword <kw>, or NULL if not found. Note that if |
| 823 | * <kw> contains an opening parenthesis, only the left part of it is checked. |
| 824 | */ |
| 825 | struct acl_keyword *find_acl_kw(const char *kw) |
| 826 | { |
| 827 | int index; |
| 828 | const char *kwend; |
| 829 | struct acl_kw_list *kwl; |
| 830 | |
| 831 | kwend = strchr(kw, '('); |
| 832 | if (!kwend) |
| 833 | kwend = kw + strlen(kw); |
| 834 | |
| 835 | list_for_each_entry(kwl, &acl_keywords.list, list) { |
| 836 | for (index = 0; kwl->kw[index].kw != NULL; index++) { |
| 837 | if ((strncmp(kwl->kw[index].kw, kw, kwend - kw) == 0) && |
| 838 | kwl->kw[index].kw[kwend-kw] == 0) |
| 839 | return &kwl->kw[index]; |
| 840 | } |
| 841 | } |
| 842 | return NULL; |
| 843 | } |
| 844 | |
Willy Tarreau | dfd7fca | 2011-03-09 07:27:02 +0100 | [diff] [blame] | 845 | /* NB: does nothing if <pat> is NULL */ |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 846 | static void free_pattern(struct acl_pattern *pat) |
| 847 | { |
Willy Tarreau | dfd7fca | 2011-03-09 07:27:02 +0100 | [diff] [blame] | 848 | if (!pat) |
| 849 | return; |
Krzysztof Piotr Oledzki | 8001d61 | 2008-05-31 13:53:23 +0200 | [diff] [blame] | 850 | |
| 851 | if (pat->ptr.ptr) { |
| 852 | if (pat->freeptrbuf) |
| 853 | pat->freeptrbuf(pat->ptr.ptr); |
| 854 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 855 | free(pat->ptr.ptr); |
Krzysztof Piotr Oledzki | 8001d61 | 2008-05-31 13:53:23 +0200 | [diff] [blame] | 856 | } |
| 857 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 858 | free(pat); |
| 859 | } |
| 860 | |
| 861 | static void free_pattern_list(struct list *head) |
| 862 | { |
| 863 | struct acl_pattern *pat, *tmp; |
| 864 | list_for_each_entry_safe(pat, tmp, head, list) |
| 865 | free_pattern(pat); |
| 866 | } |
| 867 | |
Willy Tarreau | e56cda9 | 2010-05-11 23:25:05 +0200 | [diff] [blame] | 868 | static void free_pattern_tree(struct eb_root *root) |
| 869 | { |
| 870 | struct eb_node *node, *next; |
| 871 | node = eb_first(root); |
| 872 | while (node) { |
| 873 | next = eb_next(node); |
Willy Tarreau | 60eccc1 | 2013-11-14 16:00:12 +0100 | [diff] [blame] | 874 | eb_delete(node); |
Willy Tarreau | e56cda9 | 2010-05-11 23:25:05 +0200 | [diff] [blame] | 875 | free(node); |
| 876 | node = next; |
| 877 | } |
| 878 | } |
| 879 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 880 | static struct acl_expr *prune_acl_expr(struct acl_expr *expr) |
| 881 | { |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 882 | struct arg *arg; |
| 883 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 884 | free_pattern_list(&expr->patterns); |
Willy Tarreau | e56cda9 | 2010-05-11 23:25:05 +0200 | [diff] [blame] | 885 | free_pattern_tree(&expr->pattern_tree); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 886 | LIST_INIT(&expr->patterns); |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 887 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 888 | for (arg = expr->smp->arg_p; arg; arg++) { |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 889 | if (arg->type == ARGT_STOP) |
| 890 | break; |
Willy Tarreau | 496aa01 | 2012-06-01 10:38:29 +0200 | [diff] [blame] | 891 | if (arg->type == ARGT_STR || arg->unresolved) { |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 892 | free(arg->data.str.str); |
| 893 | arg->data.str.str = NULL; |
Willy Tarreau | 496aa01 | 2012-06-01 10:38:29 +0200 | [diff] [blame] | 894 | arg->unresolved = 0; |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 895 | } |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 896 | } |
| 897 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 898 | if (expr->smp->arg_p != empty_arg_list) |
| 899 | free(expr->smp->arg_p); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 900 | return expr; |
| 901 | } |
| 902 | |
Thierry FOURNIER | 3a103c5 | 2013-11-22 17:33:27 +0100 | [diff] [blame] | 903 | /* return 1 if the process is ok |
| 904 | * return -1 if the parser fail. The err message is filled. |
| 905 | * return -2 if out of memory |
| 906 | */ |
| 907 | int acl_register_pattern(struct acl_expr *expr, char *text, |
| 908 | struct acl_pattern **pattern, |
| 909 | int patflags, char **err) |
| 910 | { |
| 911 | const char *args[2]; |
| 912 | int opaque = 0; |
| 913 | |
| 914 | args[0] = text; |
| 915 | args[1] = ""; |
| 916 | |
| 917 | /* we keep the previous pattern along iterations as long as it's not used */ |
| 918 | if (!*pattern) |
| 919 | *pattern = (struct acl_pattern *)malloc(sizeof(**pattern)); |
| 920 | if (!*pattern) |
| 921 | return -1; |
| 922 | |
| 923 | memset(*pattern, 0, sizeof(**pattern)); |
| 924 | (*pattern)->flags = patflags; |
| 925 | |
| 926 | if (!((*pattern)->flags & ACL_PAT_F_IGNORE_CASE) && |
| 927 | (expr->match == acl_match_str || expr->match == acl_match_ip)) { |
| 928 | /* we pre-set the data pointer to the tree's head so that functions |
| 929 | * which are able to insert in a tree know where to do that. |
| 930 | */ |
| 931 | (*pattern)->flags |= ACL_PAT_F_TREE_OK; |
| 932 | (*pattern)->val.tree = &expr->pattern_tree; |
| 933 | } |
| 934 | |
| 935 | (*pattern)->type = SMP_TYPES; /* unspecified type by default */ |
| 936 | if (!expr->parse(args, *pattern, &opaque, err)) |
| 937 | return -1; |
| 938 | |
| 939 | /* if the parser did not feed the tree, let's chain the pattern to the list */ |
| 940 | if (!((*pattern)->flags & ACL_PAT_F_TREE)) { |
| 941 | LIST_ADDQ(&expr->patterns, &(*pattern)->list); |
| 942 | *pattern = NULL; /* get a new one */ |
| 943 | } |
| 944 | |
| 945 | return 1; |
| 946 | } |
Willy Tarreau | 08ad0b3 | 2012-04-27 17:25:24 +0200 | [diff] [blame] | 947 | |
| 948 | /* Reads patterns from a file. If <err_msg> is non-NULL, an error message will |
| 949 | * be returned there on errors and the caller will have to free it. |
| 950 | */ |
Willy Tarreau | d76a98a | 2013-03-31 18:34:33 +0200 | [diff] [blame] | 951 | static int acl_read_patterns_from_file(struct acl_expr *expr, |
| 952 | const char *filename, int patflags, |
| 953 | char **err) |
Willy Tarreau | 2b5285d | 2010-05-09 23:45:24 +0200 | [diff] [blame] | 954 | { |
| 955 | FILE *file; |
| 956 | char *c; |
Thierry FOURNIER | 3a103c5 | 2013-11-22 17:33:27 +0100 | [diff] [blame] | 957 | char *arg; |
Willy Tarreau | 2b5285d | 2010-05-09 23:45:24 +0200 | [diff] [blame] | 958 | struct acl_pattern *pattern; |
Willy Tarreau | 6a8097f | 2011-02-26 15:14:15 +0100 | [diff] [blame] | 959 | int ret = 0; |
Willy Tarreau | 08ad0b3 | 2012-04-27 17:25:24 +0200 | [diff] [blame] | 960 | int line = 0; |
Thierry FOURNIER | 3a103c5 | 2013-11-22 17:33:27 +0100 | [diff] [blame] | 961 | int code; |
Willy Tarreau | 2b5285d | 2010-05-09 23:45:24 +0200 | [diff] [blame] | 962 | |
| 963 | file = fopen(filename, "r"); |
Willy Tarreau | 08ad0b3 | 2012-04-27 17:25:24 +0200 | [diff] [blame] | 964 | if (!file) { |
| 965 | memprintf(err, "failed to open pattern file <%s>", filename); |
Willy Tarreau | 2b5285d | 2010-05-09 23:45:24 +0200 | [diff] [blame] | 966 | return 0; |
Willy Tarreau | 08ad0b3 | 2012-04-27 17:25:24 +0200 | [diff] [blame] | 967 | } |
Willy Tarreau | 2b5285d | 2010-05-09 23:45:24 +0200 | [diff] [blame] | 968 | |
| 969 | /* now parse all patterns. The file may contain only one pattern per |
| 970 | * line. If the line contains spaces, they will be part of the pattern. |
| 971 | * The pattern stops at the first CR, LF or EOF encountered. |
| 972 | */ |
Willy Tarreau | e56cda9 | 2010-05-11 23:25:05 +0200 | [diff] [blame] | 973 | pattern = NULL; |
Willy Tarreau | 19d14ef | 2012-10-29 16:51:55 +0100 | [diff] [blame] | 974 | while (fgets(trash.str, trash.size, file) != NULL) { |
Willy Tarreau | 08ad0b3 | 2012-04-27 17:25:24 +0200 | [diff] [blame] | 975 | line++; |
Willy Tarreau | 19d14ef | 2012-10-29 16:51:55 +0100 | [diff] [blame] | 976 | c = trash.str; |
Willy Tarreau | 58215a0 | 2010-05-13 22:07:43 +0200 | [diff] [blame] | 977 | |
| 978 | /* ignore lines beginning with a dash */ |
| 979 | if (*c == '#') |
| 980 | continue; |
| 981 | |
| 982 | /* strip leading spaces and tabs */ |
| 983 | while (*c == ' ' || *c == '\t') |
| 984 | c++; |
| 985 | |
Willy Tarreau | 58215a0 | 2010-05-13 22:07:43 +0200 | [diff] [blame] | 986 | |
Thierry FOURNIER | 3a103c5 | 2013-11-22 17:33:27 +0100 | [diff] [blame] | 987 | arg = c; |
Willy Tarreau | 2b5285d | 2010-05-09 23:45:24 +0200 | [diff] [blame] | 988 | while (*c && *c != '\n' && *c != '\r') |
| 989 | c++; |
| 990 | *c = 0; |
| 991 | |
Willy Tarreau | 5109196 | 2011-01-03 21:04:10 +0100 | [diff] [blame] | 992 | /* empty lines are ignored too */ |
Thierry FOURNIER | 3a103c5 | 2013-11-22 17:33:27 +0100 | [diff] [blame] | 993 | if (c == arg) |
Willy Tarreau | 5109196 | 2011-01-03 21:04:10 +0100 | [diff] [blame] | 994 | continue; |
| 995 | |
Thierry FOURNIER | 3a103c5 | 2013-11-22 17:33:27 +0100 | [diff] [blame] | 996 | code = acl_register_pattern(expr, arg, &pattern, patflags, err); |
| 997 | if (code == -2) { |
Willy Tarreau | 08ad0b3 | 2012-04-27 17:25:24 +0200 | [diff] [blame] | 998 | memprintf(err, "out of memory when loading patterns from file <%s>", filename); |
Willy Tarreau | 2b5285d | 2010-05-09 23:45:24 +0200 | [diff] [blame] | 999 | goto out_close; |
Willy Tarreau | 08ad0b3 | 2012-04-27 17:25:24 +0200 | [diff] [blame] | 1000 | } |
Thierry FOURNIER | 3a103c5 | 2013-11-22 17:33:27 +0100 | [diff] [blame] | 1001 | else if (code < 0) { |
| 1002 | memprintf(err, "%s when loading patterns from file <%s>", *err, filename); |
Willy Tarreau | 2b5285d | 2010-05-09 23:45:24 +0200 | [diff] [blame] | 1003 | goto out_free_pattern; |
Willy Tarreau | e56cda9 | 2010-05-11 23:25:05 +0200 | [diff] [blame] | 1004 | } |
Willy Tarreau | 2b5285d | 2010-05-09 23:45:24 +0200 | [diff] [blame] | 1005 | } |
Willy Tarreau | 6a8097f | 2011-02-26 15:14:15 +0100 | [diff] [blame] | 1006 | |
| 1007 | ret = 1; /* success */ |
Willy Tarreau | 2b5285d | 2010-05-09 23:45:24 +0200 | [diff] [blame] | 1008 | |
| 1009 | out_free_pattern: |
| 1010 | free_pattern(pattern); |
| 1011 | out_close: |
| 1012 | fclose(file); |
Willy Tarreau | 6a8097f | 2011-02-26 15:14:15 +0100 | [diff] [blame] | 1013 | return ret; |
Willy Tarreau | 2b5285d | 2010-05-09 23:45:24 +0200 | [diff] [blame] | 1014 | } |
| 1015 | |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1016 | /* Parse an ACL expression starting at <args>[0], and return it. If <err> is |
| 1017 | * not NULL, it will be filled with a pointer to an error message in case of |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1018 | * error. This pointer must be freeable or NULL. <al> is an arg_list serving |
| 1019 | * as a list head to report missing dependencies. |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1020 | * |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1021 | * Right now, the only accepted syntax is : |
| 1022 | * <subject> [<value>...] |
| 1023 | */ |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1024 | struct acl_expr *parse_acl_expr(const char **args, char **err, struct arg_list *al) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1025 | { |
| 1026 | __label__ out_return, out_free_expr, out_free_pattern; |
| 1027 | struct acl_expr *expr; |
| 1028 | struct acl_keyword *aclkw; |
| 1029 | struct acl_pattern *pattern; |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 1030 | int opaque, patflags; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1031 | const char *arg; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1032 | struct sample_expr *smp = NULL; |
| 1033 | const char *p; |
| 1034 | int idx = 0; |
| 1035 | char *ckw = NULL; |
| 1036 | const char *begw; |
| 1037 | const char *endw; |
| 1038 | unsigned long prev_type; |
| 1039 | int cur_type; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1040 | |
Willy Tarreau | bef91e7 | 2013-03-31 23:14:46 +0200 | [diff] [blame] | 1041 | /* First, we lookd for an ACL keyword. And if we don't find one, then |
| 1042 | * we look for a sample fetch keyword. |
| 1043 | */ |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1044 | aclkw = find_acl_kw(args[0]); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1045 | if (!aclkw || !aclkw->parse) { |
Willy Tarreau | bef91e7 | 2013-03-31 23:14:46 +0200 | [diff] [blame] | 1046 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1047 | smp = sample_parse_expr((char **)args, &idx, trash.str, trash.size, al); |
Willy Tarreau | bef91e7 | 2013-03-31 23:14:46 +0200 | [diff] [blame] | 1048 | |
| 1049 | if (!smp) { |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1050 | memprintf(err, "unknown ACL or sample keyword '%s': %s", *args, trash.str); |
Willy Tarreau | bef91e7 | 2013-03-31 23:14:46 +0200 | [diff] [blame] | 1051 | goto out_return; |
| 1052 | } |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1053 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1054 | |
| 1055 | expr = (struct acl_expr *)calloc(1, sizeof(*expr)); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1056 | if (!expr) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 1057 | memprintf(err, "out of memory when parsing ACL expression"); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1058 | goto out_return; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1059 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1060 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1061 | expr->kw = aclkw ? aclkw->kw : smp->fetch->kw; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1062 | LIST_INIT(&expr->patterns); |
Willy Tarreau | e56cda9 | 2010-05-11 23:25:05 +0200 | [diff] [blame] | 1063 | expr->pattern_tree = EB_ROOT_UNIQUE; |
Willy Tarreau | bef91e7 | 2013-03-31 23:14:46 +0200 | [diff] [blame] | 1064 | expr->parse = aclkw ? aclkw->parse : NULL; |
| 1065 | expr->match = aclkw ? aclkw->match : NULL; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1066 | expr->smp = aclkw ? NULL : smp; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1067 | |
Willy Tarreau | 9987ea9 | 2013-06-11 21:09:06 +0200 | [diff] [blame] | 1068 | if (!expr->parse) { |
| 1069 | /* some types can be automatically converted */ |
| 1070 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1071 | switch (expr->smp ? expr->smp->fetch->out_type : aclkw->smp->out_type) { |
Willy Tarreau | 9987ea9 | 2013-06-11 21:09:06 +0200 | [diff] [blame] | 1072 | case SMP_T_BOOL: |
| 1073 | expr->parse = acl_parse_fcts[ACL_MATCH_BOOL]; |
| 1074 | expr->match = acl_match_fcts[ACL_MATCH_BOOL]; |
| 1075 | break; |
| 1076 | case SMP_T_SINT: |
| 1077 | case SMP_T_UINT: |
| 1078 | expr->parse = acl_parse_fcts[ACL_MATCH_INT]; |
| 1079 | expr->match = acl_match_fcts[ACL_MATCH_INT]; |
| 1080 | break; |
| 1081 | case SMP_T_IPV4: |
| 1082 | case SMP_T_IPV6: |
| 1083 | expr->parse = acl_parse_fcts[ACL_MATCH_IP]; |
| 1084 | expr->match = acl_match_fcts[ACL_MATCH_IP]; |
| 1085 | break; |
| 1086 | } |
| 1087 | } |
| 1088 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1089 | /* now parse the rest of acl only if "find_acl_kw" match */ |
| 1090 | if (aclkw) { |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 1091 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1092 | /* build new sample expression */ |
| 1093 | expr->smp = calloc(1, sizeof(struct sample_expr)); |
| 1094 | if (!expr->smp) { |
| 1095 | memprintf(err, "out of memory when parsing ACL expression"); |
| 1096 | goto out_return; |
| 1097 | } |
| 1098 | LIST_INIT(&(expr->smp->conv_exprs)); |
| 1099 | expr->smp->fetch = aclkw->smp; |
| 1100 | expr->smp->arg_p = empty_arg_list; |
Willy Tarreau | 34db108 | 2012-04-19 17:16:54 +0200 | [diff] [blame] | 1101 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1102 | /* look for the begining of the subject arguments */ |
| 1103 | p = strchr(args[0], ','); |
| 1104 | arg = strchr(args[0], '('); |
| 1105 | if (p && arg && p < arg) |
| 1106 | arg = NULL; |
| 1107 | |
| 1108 | if (expr->smp->fetch->arg_mask) { |
| 1109 | int nbargs = 0; |
| 1110 | char *end; |
| 1111 | |
| 1112 | if (arg != NULL) { |
| 1113 | /* there are 0 or more arguments in the form "subject(arg[,arg]*)" */ |
| 1114 | arg++; |
| 1115 | end = strchr(arg, ')'); |
| 1116 | if (!end) { |
| 1117 | memprintf(err, "missing closing ')' after arguments to ACL keyword '%s'", expr->kw); |
| 1118 | goto out_free_expr; |
| 1119 | } |
| 1120 | |
| 1121 | /* Parse the arguments. Note that currently we have no way to |
| 1122 | * report parsing errors, hence the NULL in the error pointers. |
| 1123 | * An error is also reported if some mandatory arguments are |
| 1124 | * missing. We prepare the args list to report unresolved |
| 1125 | * dependencies. |
| 1126 | */ |
| 1127 | al->ctx = ARGC_ACL; |
| 1128 | al->kw = expr->kw; |
| 1129 | al->conv = NULL; |
| 1130 | nbargs = make_arg_list(arg, end - arg, expr->smp->fetch->arg_mask, &expr->smp->arg_p, |
| 1131 | err, NULL, NULL, al); |
| 1132 | if (nbargs < 0) { |
| 1133 | /* note that make_arg_list will have set <err> here */ |
| 1134 | memprintf(err, "in argument to '%s', %s", expr->kw, *err); |
| 1135 | goto out_free_expr; |
| 1136 | } |
| 1137 | |
| 1138 | if (!expr->smp->arg_p) |
| 1139 | expr->smp->arg_p = empty_arg_list; |
| 1140 | |
| 1141 | if (expr->smp->fetch->val_args && !expr->smp->fetch->val_args(expr->smp->arg_p, err)) { |
| 1142 | /* invalid keyword argument, error must have been |
| 1143 | * set by val_args(). |
| 1144 | */ |
| 1145 | memprintf(err, "in argument to '%s', %s", expr->kw, *err); |
| 1146 | goto out_free_expr; |
| 1147 | } |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1148 | } |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1149 | else if (ARGM(expr->smp->fetch->arg_mask) == 1) { |
| 1150 | int type = (expr->smp->fetch->arg_mask >> 4) & 15; |
Willy Tarreau | ae52f06 | 2012-04-26 12:13:35 +0200 | [diff] [blame] | 1151 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1152 | /* If a proxy is noted as a mandatory argument, we'll fake |
| 1153 | * an empty one so that acl_find_targets() resolves it as |
| 1154 | * the current one later. |
| 1155 | */ |
| 1156 | if (type != ARGT_FE && type != ARGT_BE && type != ARGT_TAB) { |
| 1157 | memprintf(err, "ACL keyword '%s' expects %d arguments", expr->kw, ARGM(expr->smp->fetch->arg_mask)); |
| 1158 | goto out_free_expr; |
| 1159 | } |
Willy Tarreau | 2e845be | 2012-10-19 19:49:09 +0200 | [diff] [blame] | 1160 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1161 | /* Build an arg list containing the type as an empty string |
| 1162 | * and the usual STOP. |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1163 | */ |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1164 | expr->smp->arg_p = calloc(2, sizeof(*expr->smp->arg_p)); |
| 1165 | expr->smp->arg_p[0].type = type; |
| 1166 | expr->smp->arg_p[0].unresolved = 1; |
| 1167 | expr->smp->arg_p[0].data.str.str = strdup(""); |
| 1168 | expr->smp->arg_p[0].data.str.size = 1; |
| 1169 | expr->smp->arg_p[0].data.str.len = 0; |
| 1170 | |
| 1171 | al->ctx = ARGC_ACL; |
| 1172 | al->kw = expr->kw; |
| 1173 | al->conv = NULL; |
| 1174 | arg_list_add(al, &expr->smp->arg_p[0], 0); |
| 1175 | |
| 1176 | expr->smp->arg_p[1].type = ARGT_STOP; |
| 1177 | } |
| 1178 | else if (ARGM(expr->smp->fetch->arg_mask)) { |
| 1179 | /* there were some mandatory arguments */ |
| 1180 | memprintf(err, "ACL keyword '%s' expects %d arguments", expr->kw, ARGM(expr->smp->fetch->arg_mask)); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1181 | goto out_free_expr; |
| 1182 | } |
Willy Tarreau | 61612d4 | 2012-04-19 18:42:05 +0200 | [diff] [blame] | 1183 | } |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1184 | else { |
| 1185 | if (arg ) { |
| 1186 | /* no argument expected */ |
| 1187 | memprintf(err, "ACL keyword '%s' takes no argument", expr->kw); |
Willy Tarreau | fc2c1fd | 2012-04-19 23:35:54 +0200 | [diff] [blame] | 1188 | goto out_free_expr; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1189 | } |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1190 | } |
Willy Tarreau | 9ca6936 | 2013-10-22 19:10:06 +0200 | [diff] [blame] | 1191 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1192 | /* Now process the converters if any. We have two supported syntaxes |
| 1193 | * for the converters, which can be combined : |
| 1194 | * - comma-delimited list of converters just after the keyword and args ; |
| 1195 | * - one converter per keyword |
| 1196 | * The combination allows to have each keyword being a comma-delimited |
| 1197 | * series of converters. |
| 1198 | * |
| 1199 | * We want to process the former first, then the latter. For this we start |
| 1200 | * from the beginning of the supposed place in the exiting conv chain, which |
| 1201 | * starts at the last comma (endt). |
| 1202 | */ |
Willy Tarreau | f75d008 | 2013-04-07 21:20:44 +0200 | [diff] [blame] | 1203 | |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1204 | /* look for the begining of the converters list */ |
| 1205 | arg = strchr(args[0], ','); |
Willy Tarreau | 61612d4 | 2012-04-19 18:42:05 +0200 | [diff] [blame] | 1206 | if (arg) { |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1207 | prev_type = expr->smp->fetch->out_type; |
| 1208 | while (1) { |
| 1209 | struct sample_conv *conv; |
| 1210 | struct sample_conv_expr *conv_expr; |
| 1211 | |
| 1212 | if (*arg == ')') /* skip last closing parenthesis */ |
| 1213 | arg++; |
| 1214 | |
| 1215 | if (*arg && *arg != ',') { |
| 1216 | if (ckw) |
| 1217 | memprintf(err, "ACL keyword '%s' : missing comma after conv keyword '%s'.", |
| 1218 | expr->kw, ckw); |
| 1219 | else |
| 1220 | memprintf(err, "ACL keyword '%s' : missing comma after fetch keyword.", |
| 1221 | expr->kw); |
| 1222 | goto out_free_expr; |
| 1223 | } |
| 1224 | |
| 1225 | while (*arg == ',') /* then trailing commas */ |
| 1226 | arg++; |
| 1227 | |
| 1228 | begw = arg; /* start of conv keyword */ |
| 1229 | |
| 1230 | if (!*begw) |
| 1231 | /* none ? end of converters */ |
| 1232 | break; |
| 1233 | |
| 1234 | for (endw = begw; *endw && *endw != '(' && *endw != ','; endw++); |
| 1235 | |
| 1236 | free(ckw); |
| 1237 | ckw = my_strndup(begw, endw - begw); |
| 1238 | |
| 1239 | conv = find_sample_conv(begw, endw - begw); |
| 1240 | if (!conv) { |
| 1241 | /* Unknown converter method */ |
| 1242 | memprintf(err, "ACL keyword '%s' : unknown conv method '%s'.", |
| 1243 | expr->kw, ckw); |
| 1244 | goto out_free_expr; |
| 1245 | } |
| 1246 | |
| 1247 | arg = endw; |
| 1248 | if (*arg == '(') { |
| 1249 | /* look for the end of this term */ |
| 1250 | while (*arg && *arg != ')') |
| 1251 | arg++; |
| 1252 | if (*arg != ')') { |
| 1253 | memprintf(err, "ACL keyword '%s' : syntax error: missing ')' after conv keyword '%s'.", |
| 1254 | expr->kw, ckw); |
| 1255 | goto out_free_expr; |
| 1256 | } |
| 1257 | } |
| 1258 | |
| 1259 | if (conv->in_type >= SMP_TYPES || conv->out_type >= SMP_TYPES) { |
| 1260 | memprintf(err, "ACL keyword '%s' : returns type of conv method '%s' is unknown.", |
| 1261 | expr->kw, ckw); |
| 1262 | goto out_free_expr; |
| 1263 | } |
| 1264 | |
| 1265 | /* If impossible type conversion */ |
| 1266 | if (!sample_casts[prev_type][conv->in_type]) { |
| 1267 | memprintf(err, "ACL keyword '%s' : conv method '%s' cannot be applied.", |
| 1268 | expr->kw, ckw); |
| 1269 | goto out_free_expr; |
| 1270 | } |
| 1271 | |
| 1272 | prev_type = conv->out_type; |
| 1273 | conv_expr = calloc(1, sizeof(struct sample_conv_expr)); |
| 1274 | if (!conv_expr) |
| 1275 | goto out_free_expr; |
| 1276 | |
| 1277 | LIST_ADDQ(&(expr->smp->conv_exprs), &(conv_expr->list)); |
| 1278 | conv_expr->conv = conv; |
| 1279 | |
| 1280 | if (arg != endw) { |
| 1281 | char *err_msg = NULL; |
| 1282 | int err_arg; |
| 1283 | |
| 1284 | if (!conv->arg_mask) { |
| 1285 | memprintf(err, "ACL keyword '%s' : conv method '%s' does not support any args.", |
| 1286 | expr->kw, ckw); |
| 1287 | goto out_free_expr; |
| 1288 | } |
| 1289 | |
| 1290 | al->kw = expr->smp->fetch->kw; |
| 1291 | al->conv = conv_expr->conv->kw; |
| 1292 | if (make_arg_list(endw + 1, arg - endw - 1, conv->arg_mask, &conv_expr->arg_p, &err_msg, NULL, &err_arg, al) < 0) { |
| 1293 | memprintf(err, "ACL keyword '%s' : invalid arg %d in conv method '%s' : %s.", |
| 1294 | expr->kw, err_arg+1, ckw, err_msg); |
| 1295 | free(err_msg); |
| 1296 | goto out_free_expr; |
| 1297 | } |
| 1298 | |
| 1299 | if (!conv_expr->arg_p) |
| 1300 | conv_expr->arg_p = empty_arg_list; |
| 1301 | |
Thierry FOURNIER | 9c1d67e | 2013-11-21 13:37:41 +0100 | [diff] [blame] | 1302 | if (conv->val_args && !conv->val_args(conv_expr->arg_p, conv, &err_msg)) { |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1303 | memprintf(err, "ACL keyword '%s' : invalid args in conv method '%s' : %s.", |
| 1304 | expr->kw, ckw, err_msg); |
| 1305 | free(err_msg); |
| 1306 | goto out_free_expr; |
| 1307 | } |
| 1308 | } |
| 1309 | else if (ARGM(conv->arg_mask)) { |
| 1310 | memprintf(err, "ACL keyword '%s' : missing args for conv method '%s'.", |
| 1311 | expr->kw, ckw); |
| 1312 | goto out_free_expr; |
| 1313 | } |
| 1314 | } |
Willy Tarreau | 61612d4 | 2012-04-19 18:42:05 +0200 | [diff] [blame] | 1315 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1316 | } |
| 1317 | |
Willy Tarreau | 3c3dfd5 | 2013-11-04 18:09:12 +0100 | [diff] [blame] | 1318 | /* Additional check to protect against common mistakes */ |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1319 | cur_type = smp_expr_output_type(expr->smp); |
| 1320 | if (expr->parse && cur_type != SMP_T_BOOL && !*args[1]) { |
Willy Tarreau | 3c3dfd5 | 2013-11-04 18:09:12 +0100 | [diff] [blame] | 1321 | Warning("parsing acl keyword '%s' :\n" |
| 1322 | " no pattern to match against were provided, so this ACL will never match.\n" |
| 1323 | " If this is what you intended, please add '--' to get rid of this warning.\n" |
| 1324 | " If you intended to match only for existence, please use '-m found'.\n" |
| 1325 | " If you wanted to force an int to match as a bool, please use '-m bool'.\n" |
| 1326 | "\n", |
| 1327 | args[0]); |
| 1328 | } |
| 1329 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1330 | args++; |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 1331 | |
| 1332 | /* check for options before patterns. Supported options are : |
| 1333 | * -i : ignore case for all patterns by default |
| 1334 | * -f : read patterns from those files |
Willy Tarreau | 5adeda1 | 2013-03-31 22:13:34 +0200 | [diff] [blame] | 1335 | * -m : force matching method (must be used before -f) |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 1336 | * -- : everything after this is not an option |
| 1337 | */ |
| 1338 | patflags = 0; |
| 1339 | while (**args == '-') { |
| 1340 | if ((*args)[1] == 'i') |
| 1341 | patflags |= ACL_PAT_F_IGNORE_CASE; |
Willy Tarreau | 2b5285d | 2010-05-09 23:45:24 +0200 | [diff] [blame] | 1342 | else if ((*args)[1] == 'f') { |
Willy Tarreau | bef91e7 | 2013-03-31 23:14:46 +0200 | [diff] [blame] | 1343 | if (!expr->parse) { |
Willy Tarreau | 9987ea9 | 2013-06-11 21:09:06 +0200 | [diff] [blame] | 1344 | memprintf(err, "matching method must be specified first (using '-m') when using a sample fetch of this type ('%s')", expr->kw); |
Willy Tarreau | bef91e7 | 2013-03-31 23:14:46 +0200 | [diff] [blame] | 1345 | goto out_free_expr; |
| 1346 | } |
| 1347 | |
Willy Tarreau | d76a98a | 2013-03-31 18:34:33 +0200 | [diff] [blame] | 1348 | if (!acl_read_patterns_from_file(expr, args[1], patflags | ACL_PAT_F_FROM_FILE, err)) |
Willy Tarreau | 2b5285d | 2010-05-09 23:45:24 +0200 | [diff] [blame] | 1349 | goto out_free_expr; |
Willy Tarreau | 5adeda1 | 2013-03-31 22:13:34 +0200 | [diff] [blame] | 1350 | args++; |
| 1351 | } |
| 1352 | else if ((*args)[1] == 'm') { |
| 1353 | int idx; |
| 1354 | |
| 1355 | if (!LIST_ISEMPTY(&expr->patterns) || !eb_is_empty(&expr->pattern_tree)) { |
| 1356 | memprintf(err, "'-m' must only be specified before patterns and files in parsing ACL expression"); |
| 1357 | goto out_free_expr; |
| 1358 | } |
| 1359 | |
| 1360 | idx = acl_find_match_name(args[1]); |
| 1361 | if (idx < 0) { |
| 1362 | memprintf(err, "unknown matching method '%s' when parsing ACL expression", args[1]); |
| 1363 | goto out_free_expr; |
| 1364 | } |
| 1365 | |
| 1366 | /* Note: -m found is always valid, bool/int are compatible, str/bin/reg/len are compatible */ |
| 1367 | if (idx == ACL_MATCH_FOUND || /* -m found */ |
| 1368 | ((idx == ACL_MATCH_BOOL || idx == ACL_MATCH_INT) && /* -m bool/int */ |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1369 | (cur_type == SMP_T_BOOL || |
| 1370 | cur_type == SMP_T_UINT || |
| 1371 | cur_type == SMP_T_SINT)) || |
Willy Tarreau | 5adeda1 | 2013-03-31 22:13:34 +0200 | [diff] [blame] | 1372 | (idx == ACL_MATCH_IP && /* -m ip */ |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1373 | (cur_type == SMP_T_IPV4 || |
| 1374 | cur_type == SMP_T_IPV6)) || |
Willy Tarreau | 5adeda1 | 2013-03-31 22:13:34 +0200 | [diff] [blame] | 1375 | ((idx == ACL_MATCH_BIN || idx == ACL_MATCH_LEN || idx == ACL_MATCH_STR || |
| 1376 | idx == ACL_MATCH_BEG || idx == ACL_MATCH_SUB || idx == ACL_MATCH_DIR || |
| 1377 | idx == ACL_MATCH_DOM || idx == ACL_MATCH_END || idx == ACL_MATCH_REG) && /* strings */ |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1378 | (cur_type == SMP_T_STR || |
| 1379 | cur_type == SMP_T_BIN || |
| 1380 | cur_type == SMP_T_CSTR || |
| 1381 | cur_type == SMP_T_CBIN))) { |
Willy Tarreau | 5adeda1 | 2013-03-31 22:13:34 +0200 | [diff] [blame] | 1382 | expr->parse = acl_parse_fcts[idx]; |
| 1383 | expr->match = acl_match_fcts[idx]; |
| 1384 | } |
| 1385 | else { |
Willy Tarreau | 93fddf1 | 2013-03-31 22:59:32 +0200 | [diff] [blame] | 1386 | memprintf(err, "matching method '%s' cannot be used with fetch keyword '%s'", args[1], expr->kw); |
Willy Tarreau | 5adeda1 | 2013-03-31 22:13:34 +0200 | [diff] [blame] | 1387 | goto out_free_expr; |
| 1388 | } |
Willy Tarreau | 2b5285d | 2010-05-09 23:45:24 +0200 | [diff] [blame] | 1389 | args++; |
| 1390 | } |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 1391 | else if ((*args)[1] == '-') { |
| 1392 | args++; |
| 1393 | break; |
| 1394 | } |
| 1395 | else |
| 1396 | break; |
| 1397 | args++; |
| 1398 | } |
| 1399 | |
Willy Tarreau | bef91e7 | 2013-03-31 23:14:46 +0200 | [diff] [blame] | 1400 | if (!expr->parse) { |
Willy Tarreau | 9987ea9 | 2013-06-11 21:09:06 +0200 | [diff] [blame] | 1401 | memprintf(err, "matching method must be specified first (using '-m') when using a sample fetch of this type ('%s')", expr->kw); |
Willy Tarreau | bef91e7 | 2013-03-31 23:14:46 +0200 | [diff] [blame] | 1402 | goto out_free_expr; |
| 1403 | } |
| 1404 | |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 1405 | /* now parse all patterns */ |
Willy Tarreau | ae8b796 | 2007-06-09 23:10:04 +0200 | [diff] [blame] | 1406 | opaque = 0; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1407 | while (**args) { |
Willy Tarreau | ae8b796 | 2007-06-09 23:10:04 +0200 | [diff] [blame] | 1408 | int ret; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1409 | pattern = (struct acl_pattern *)calloc(1, sizeof(*pattern)); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1410 | if (!pattern) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 1411 | memprintf(err, "out of memory when parsing ACL pattern"); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1412 | goto out_free_expr; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1413 | } |
Willy Tarreau | c8d7c96 | 2007-06-17 08:20:33 +0200 | [diff] [blame] | 1414 | pattern->flags = patflags; |
| 1415 | |
Willy Tarreau | c92ddbc | 2012-04-27 22:10:57 +0200 | [diff] [blame] | 1416 | pattern->type = SMP_TYPES; /* unspecified type */ |
Willy Tarreau | d76a98a | 2013-03-31 18:34:33 +0200 | [diff] [blame] | 1417 | ret = expr->parse(args, pattern, &opaque, err); |
Willy Tarreau | 7dcb648 | 2012-04-27 17:52:25 +0200 | [diff] [blame] | 1418 | if (!ret) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1419 | goto out_free_pattern; |
Willy Tarreau | 7dcb648 | 2012-04-27 17:52:25 +0200 | [diff] [blame] | 1420 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1421 | LIST_ADDQ(&expr->patterns, &pattern->list); |
Willy Tarreau | ae8b796 | 2007-06-09 23:10:04 +0200 | [diff] [blame] | 1422 | args += ret; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1423 | } |
| 1424 | |
| 1425 | return expr; |
| 1426 | |
| 1427 | out_free_pattern: |
| 1428 | free_pattern(pattern); |
| 1429 | out_free_expr: |
| 1430 | prune_acl_expr(expr); |
| 1431 | free(expr); |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1432 | free(ckw); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1433 | out_return: |
| 1434 | return NULL; |
| 1435 | } |
| 1436 | |
Krzysztof Piotr Oledzki | a643baf | 2008-05-29 23:53:44 +0200 | [diff] [blame] | 1437 | /* Purge everything in the acl <acl>, then return <acl>. */ |
| 1438 | struct acl *prune_acl(struct acl *acl) { |
| 1439 | |
| 1440 | struct acl_expr *expr, *exprb; |
| 1441 | |
| 1442 | free(acl->name); |
| 1443 | |
| 1444 | list_for_each_entry_safe(expr, exprb, &acl->expr, list) { |
| 1445 | LIST_DEL(&expr->list); |
| 1446 | prune_acl_expr(expr); |
| 1447 | free(expr); |
| 1448 | } |
| 1449 | |
| 1450 | return acl; |
| 1451 | } |
| 1452 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1453 | /* Parse an ACL with the name starting at <args>[0], and with a list of already |
| 1454 | * known ACLs in <acl>. If the ACL was not in the list, it will be added. |
Willy Tarreau | 2a56c5e | 2010-03-15 16:13:29 +0100 | [diff] [blame] | 1455 | * A pointer to that ACL is returned. If the ACL has an empty name, then it's |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1456 | * an anonymous one and it won't be merged with any other one. If <err> is not |
| 1457 | * NULL, it will be filled with an appropriate error. This pointer must be |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1458 | * freeable or NULL. <al> is the arg_list serving as a head for unresolved |
| 1459 | * dependencies. |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1460 | * |
| 1461 | * args syntax: <aclname> <acl_expr> |
| 1462 | */ |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1463 | struct acl *parse_acl(const char **args, struct list *known_acl, char **err, struct arg_list *al) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1464 | { |
| 1465 | __label__ out_return, out_free_acl_expr, out_free_name; |
| 1466 | struct acl *cur_acl; |
| 1467 | struct acl_expr *acl_expr; |
| 1468 | char *name; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1469 | const char *pos; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1470 | |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1471 | if (**args && (pos = invalid_char(*args))) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 1472 | memprintf(err, "invalid character in ACL name : '%c'", *pos); |
Willy Tarreau | 2e74c3f | 2007-12-02 18:45:09 +0100 | [diff] [blame] | 1473 | goto out_return; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1474 | } |
Willy Tarreau | 2e74c3f | 2007-12-02 18:45:09 +0100 | [diff] [blame] | 1475 | |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1476 | acl_expr = parse_acl_expr(args + 1, err, al); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1477 | if (!acl_expr) { |
| 1478 | /* parse_acl_expr will have filled <err> here */ |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1479 | goto out_return; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1480 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1481 | |
Willy Tarreau | 404e8ab | 2009-07-26 19:40:40 +0200 | [diff] [blame] | 1482 | /* Check for args beginning with an opening parenthesis just after the |
| 1483 | * subject, as this is almost certainly a typo. Right now we can only |
| 1484 | * emit a warning, so let's do so. |
| 1485 | */ |
Krzysztof Piotr Oledzki | 4cdd831 | 2009-10-05 00:23:35 +0200 | [diff] [blame] | 1486 | if (!strchr(args[1], '(') && *args[2] == '(') |
Willy Tarreau | 404e8ab | 2009-07-26 19:40:40 +0200 | [diff] [blame] | 1487 | Warning("parsing acl '%s' :\n" |
| 1488 | " matching '%s' for pattern '%s' is likely a mistake and probably\n" |
| 1489 | " not what you want. Maybe you need to remove the extraneous space before '('.\n" |
| 1490 | " If you are really sure this is not an error, please insert '--' between the\n" |
| 1491 | " match and the pattern to make this warning message disappear.\n", |
| 1492 | args[0], args[1], args[2]); |
| 1493 | |
Willy Tarreau | 2a56c5e | 2010-03-15 16:13:29 +0100 | [diff] [blame] | 1494 | if (*args[0]) |
| 1495 | cur_acl = find_acl_by_name(args[0], known_acl); |
| 1496 | else |
| 1497 | cur_acl = NULL; |
| 1498 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1499 | if (!cur_acl) { |
| 1500 | name = strdup(args[0]); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1501 | if (!name) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 1502 | memprintf(err, "out of memory when parsing ACL"); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1503 | goto out_free_acl_expr; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1504 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1505 | cur_acl = (struct acl *)calloc(1, sizeof(*cur_acl)); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1506 | if (cur_acl == NULL) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 1507 | memprintf(err, "out of memory when parsing ACL"); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1508 | goto out_free_name; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1509 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1510 | |
| 1511 | LIST_INIT(&cur_acl->expr); |
| 1512 | LIST_ADDQ(known_acl, &cur_acl->list); |
| 1513 | cur_acl->name = name; |
| 1514 | } |
| 1515 | |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 1516 | /* We want to know what features the ACL needs (typically HTTP parsing), |
| 1517 | * and where it may be used. If an ACL relies on multiple matches, it is |
| 1518 | * OK if at least one of them may match in the context where it is used. |
| 1519 | */ |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1520 | cur_acl->use |= acl_expr->smp->fetch->use; |
| 1521 | cur_acl->val |= acl_expr->smp->fetch->val; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1522 | LIST_ADDQ(&cur_acl->expr, &acl_expr->list); |
| 1523 | return cur_acl; |
| 1524 | |
| 1525 | out_free_name: |
| 1526 | free(name); |
| 1527 | out_free_acl_expr: |
| 1528 | prune_acl_expr(acl_expr); |
| 1529 | free(acl_expr); |
| 1530 | out_return: |
| 1531 | return NULL; |
| 1532 | } |
| 1533 | |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 1534 | /* Some useful ACLs provided by default. Only those used are allocated. */ |
| 1535 | |
| 1536 | const struct { |
| 1537 | const char *name; |
| 1538 | const char *expr[4]; /* put enough for longest expression */ |
| 1539 | } default_acl_list[] = { |
Willy Tarreau | 58393e1 | 2008-07-20 10:39:22 +0200 | [diff] [blame] | 1540 | { .name = "TRUE", .expr = {"always_true",""}}, |
| 1541 | { .name = "FALSE", .expr = {"always_false",""}}, |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 1542 | { .name = "LOCALHOST", .expr = {"src","127.0.0.1/8",""}}, |
Willy Tarreau | 2492d5b | 2009-07-11 00:06:00 +0200 | [diff] [blame] | 1543 | { .name = "HTTP", .expr = {"req_proto_http",""}}, |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 1544 | { .name = "HTTP_1.0", .expr = {"req_ver","1.0",""}}, |
| 1545 | { .name = "HTTP_1.1", .expr = {"req_ver","1.1",""}}, |
| 1546 | { .name = "METH_CONNECT", .expr = {"method","CONNECT",""}}, |
| 1547 | { .name = "METH_GET", .expr = {"method","GET","HEAD",""}}, |
| 1548 | { .name = "METH_HEAD", .expr = {"method","HEAD",""}}, |
| 1549 | { .name = "METH_OPTIONS", .expr = {"method","OPTIONS",""}}, |
| 1550 | { .name = "METH_POST", .expr = {"method","POST",""}}, |
| 1551 | { .name = "METH_TRACE", .expr = {"method","TRACE",""}}, |
| 1552 | { .name = "HTTP_URL_ABS", .expr = {"url_reg","^[^/:]*://",""}}, |
| 1553 | { .name = "HTTP_URL_SLASH", .expr = {"url_beg","/",""}}, |
| 1554 | { .name = "HTTP_URL_STAR", .expr = {"url","*",""}}, |
| 1555 | { .name = "HTTP_CONTENT", .expr = {"hdr_val(content-length)","gt","0",""}}, |
Emeric Brun | bede3d0 | 2009-06-30 17:54:00 +0200 | [diff] [blame] | 1556 | { .name = "RDP_COOKIE", .expr = {"req_rdp_cookie_cnt","gt","0",""}}, |
Willy Tarreau | c631770 | 2008-07-20 09:29:50 +0200 | [diff] [blame] | 1557 | { .name = "REQ_CONTENT", .expr = {"req_len","gt","0",""}}, |
Willy Tarreau | b6fb420 | 2008-07-20 11:18:28 +0200 | [diff] [blame] | 1558 | { .name = "WAIT_END", .expr = {"wait_end",""}}, |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 1559 | { .name = NULL, .expr = {""}} |
| 1560 | }; |
| 1561 | |
| 1562 | /* Find a default ACL from the default_acl list, compile it and return it. |
| 1563 | * If the ACL is not found, NULL is returned. In theory, it cannot fail, |
| 1564 | * except when default ACLs are broken, in which case it will return NULL. |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1565 | * If <known_acl> is not NULL, the ACL will be queued at its tail. If <err> is |
| 1566 | * not NULL, it will be filled with an error message if an error occurs. This |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1567 | * pointer must be freeable or NULL. <al> is an arg_list serving as a list head |
| 1568 | * to report missing dependencies. |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 1569 | */ |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1570 | static struct acl *find_acl_default(const char *acl_name, struct list *known_acl, |
| 1571 | char **err, struct arg_list *al) |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 1572 | { |
| 1573 | __label__ out_return, out_free_acl_expr, out_free_name; |
| 1574 | struct acl *cur_acl; |
| 1575 | struct acl_expr *acl_expr; |
| 1576 | char *name; |
| 1577 | int index; |
| 1578 | |
| 1579 | for (index = 0; default_acl_list[index].name != NULL; index++) { |
| 1580 | if (strcmp(acl_name, default_acl_list[index].name) == 0) |
| 1581 | break; |
| 1582 | } |
| 1583 | |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1584 | if (default_acl_list[index].name == NULL) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 1585 | memprintf(err, "no such ACL : '%s'", acl_name); |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 1586 | return NULL; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1587 | } |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 1588 | |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1589 | acl_expr = parse_acl_expr((const char **)default_acl_list[index].expr, err, al); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1590 | if (!acl_expr) { |
| 1591 | /* parse_acl_expr must have filled err here */ |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 1592 | goto out_return; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1593 | } |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 1594 | |
| 1595 | name = strdup(acl_name); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1596 | if (!name) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 1597 | memprintf(err, "out of memory when building default ACL '%s'", acl_name); |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 1598 | goto out_free_acl_expr; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1599 | } |
| 1600 | |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 1601 | cur_acl = (struct acl *)calloc(1, sizeof(*cur_acl)); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1602 | if (cur_acl == NULL) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 1603 | memprintf(err, "out of memory when building default ACL '%s'", acl_name); |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 1604 | goto out_free_name; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1605 | } |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 1606 | |
| 1607 | cur_acl->name = name; |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1608 | cur_acl->use |= acl_expr->smp->fetch->use; |
| 1609 | cur_acl->val |= acl_expr->smp->fetch->val; |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 1610 | LIST_INIT(&cur_acl->expr); |
| 1611 | LIST_ADDQ(&cur_acl->expr, &acl_expr->list); |
| 1612 | if (known_acl) |
| 1613 | LIST_ADDQ(known_acl, &cur_acl->list); |
| 1614 | |
| 1615 | return cur_acl; |
| 1616 | |
| 1617 | out_free_name: |
| 1618 | free(name); |
| 1619 | out_free_acl_expr: |
| 1620 | prune_acl_expr(acl_expr); |
| 1621 | free(acl_expr); |
| 1622 | out_return: |
| 1623 | return NULL; |
| 1624 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1625 | |
| 1626 | /* Purge everything in the acl_cond <cond>, then return <cond>. */ |
| 1627 | struct acl_cond *prune_acl_cond(struct acl_cond *cond) |
| 1628 | { |
| 1629 | struct acl_term_suite *suite, *tmp_suite; |
| 1630 | struct acl_term *term, *tmp_term; |
| 1631 | |
| 1632 | /* iterate through all term suites and free all terms and all suites */ |
| 1633 | list_for_each_entry_safe(suite, tmp_suite, &cond->suites, list) { |
| 1634 | list_for_each_entry_safe(term, tmp_term, &suite->terms, list) |
| 1635 | free(term); |
| 1636 | free(suite); |
| 1637 | } |
| 1638 | return cond; |
| 1639 | } |
| 1640 | |
| 1641 | /* Parse an ACL condition starting at <args>[0], relying on a list of already |
| 1642 | * known ACLs passed in <known_acl>. The new condition is returned (or NULL in |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1643 | * case of low memory). Supports multiple conditions separated by "or". If |
| 1644 | * <err> is not NULL, it will be filled with a pointer to an error message in |
| 1645 | * case of error, that the caller is responsible for freeing. The initial |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1646 | * location must either be freeable or NULL. The list <al> serves as a list head |
| 1647 | * for unresolved dependencies. |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1648 | */ |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1649 | struct acl_cond *parse_acl_cond(const char **args, struct list *known_acl, |
| 1650 | int pol, char **err, struct arg_list *al) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1651 | { |
| 1652 | __label__ out_return, out_free_suite, out_free_term; |
Willy Tarreau | 74b98a8 | 2007-06-16 19:35:18 +0200 | [diff] [blame] | 1653 | int arg, neg; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1654 | const char *word; |
| 1655 | struct acl *cur_acl; |
| 1656 | struct acl_term *cur_term; |
| 1657 | struct acl_term_suite *cur_suite; |
| 1658 | struct acl_cond *cond; |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 1659 | unsigned int suite_val; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1660 | |
| 1661 | cond = (struct acl_cond *)calloc(1, sizeof(*cond)); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1662 | if (cond == NULL) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 1663 | memprintf(err, "out of memory when parsing condition"); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1664 | goto out_return; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1665 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1666 | |
| 1667 | LIST_INIT(&cond->list); |
| 1668 | LIST_INIT(&cond->suites); |
| 1669 | cond->pol = pol; |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 1670 | cond->val = 0; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1671 | |
| 1672 | cur_suite = NULL; |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 1673 | suite_val = ~0U; |
Willy Tarreau | 74b98a8 | 2007-06-16 19:35:18 +0200 | [diff] [blame] | 1674 | neg = 0; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1675 | for (arg = 0; *args[arg]; arg++) { |
| 1676 | word = args[arg]; |
| 1677 | |
| 1678 | /* remove as many exclamation marks as we can */ |
| 1679 | while (*word == '!') { |
| 1680 | neg = !neg; |
| 1681 | word++; |
| 1682 | } |
| 1683 | |
| 1684 | /* an empty word is allowed because we cannot force the user to |
| 1685 | * always think about not leaving exclamation marks alone. |
| 1686 | */ |
| 1687 | if (!*word) |
| 1688 | continue; |
| 1689 | |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 1690 | if (strcasecmp(word, "or") == 0 || strcmp(word, "||") == 0) { |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1691 | /* new term suite */ |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 1692 | cond->val |= suite_val; |
| 1693 | suite_val = ~0U; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1694 | cur_suite = NULL; |
| 1695 | neg = 0; |
| 1696 | continue; |
| 1697 | } |
| 1698 | |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 1699 | if (strcmp(word, "{") == 0) { |
| 1700 | /* we may have a complete ACL expression between two braces, |
| 1701 | * find the last one. |
| 1702 | */ |
| 1703 | int arg_end = arg + 1; |
| 1704 | const char **args_new; |
| 1705 | |
| 1706 | while (*args[arg_end] && strcmp(args[arg_end], "}") != 0) |
| 1707 | arg_end++; |
| 1708 | |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1709 | if (!*args[arg_end]) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 1710 | memprintf(err, "missing closing '}' in condition"); |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 1711 | goto out_free_suite; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1712 | } |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 1713 | |
| 1714 | args_new = calloc(1, (arg_end - arg + 1) * sizeof(*args_new)); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1715 | if (!args_new) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 1716 | memprintf(err, "out of memory when parsing condition"); |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 1717 | goto out_free_suite; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1718 | } |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 1719 | |
Willy Tarreau | 2a56c5e | 2010-03-15 16:13:29 +0100 | [diff] [blame] | 1720 | args_new[0] = ""; |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 1721 | memcpy(args_new + 1, args + arg + 1, (arg_end - arg) * sizeof(*args_new)); |
| 1722 | args_new[arg_end - arg] = ""; |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1723 | cur_acl = parse_acl(args_new, known_acl, err, al); |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 1724 | free(args_new); |
| 1725 | |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1726 | if (!cur_acl) { |
| 1727 | /* note that parse_acl() must have filled <err> here */ |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 1728 | goto out_free_suite; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1729 | } |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 1730 | word = args[arg + 1]; |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 1731 | arg = arg_end; |
| 1732 | } |
| 1733 | else { |
| 1734 | /* search for <word> in the known ACL names. If we do not find |
| 1735 | * it, let's look for it in the default ACLs, and if found, add |
| 1736 | * it to the list of ACLs of this proxy. This makes it possible |
| 1737 | * to override them. |
| 1738 | */ |
| 1739 | cur_acl = find_acl_by_name(word, known_acl); |
| 1740 | if (cur_acl == NULL) { |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1741 | cur_acl = find_acl_default(word, known_acl, err, al); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1742 | if (cur_acl == NULL) { |
| 1743 | /* note that find_acl_default() must have filled <err> here */ |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 1744 | goto out_free_suite; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1745 | } |
Willy Tarreau | 95fa469 | 2010-02-01 13:05:50 +0100 | [diff] [blame] | 1746 | } |
Willy Tarreau | 16fbe82 | 2007-06-17 11:54:31 +0200 | [diff] [blame] | 1747 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1748 | |
| 1749 | cur_term = (struct acl_term *)calloc(1, sizeof(*cur_term)); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1750 | if (cur_term == NULL) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 1751 | memprintf(err, "out of memory when parsing condition"); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1752 | goto out_free_suite; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1753 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1754 | |
| 1755 | cur_term->acl = cur_acl; |
| 1756 | cur_term->neg = neg; |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 1757 | |
| 1758 | /* Here it is a bit complex. The acl_term_suite is a conjunction |
| 1759 | * of many terms. It may only be used if all of its terms are |
| 1760 | * usable at the same time. So the suite's validity domain is an |
| 1761 | * AND between all ACL keywords' ones. But, the global condition |
| 1762 | * is valid if at least one term suite is OK. So it's an OR between |
| 1763 | * all of their validity domains. We could emit a warning as soon |
| 1764 | * as suite_val is null because it means that the last ACL is not |
| 1765 | * compatible with the previous ones. Let's remain simple for now. |
| 1766 | */ |
| 1767 | cond->use |= cur_acl->use; |
| 1768 | suite_val &= cur_acl->val; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1769 | |
| 1770 | if (!cur_suite) { |
| 1771 | cur_suite = (struct acl_term_suite *)calloc(1, sizeof(*cur_suite)); |
Willy Tarreau | f678b7f | 2013-01-24 00:25:39 +0100 | [diff] [blame] | 1772 | if (cur_suite == NULL) { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 1773 | memprintf(err, "out of memory when parsing condition"); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1774 | goto out_free_term; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1775 | } |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1776 | LIST_INIT(&cur_suite->terms); |
| 1777 | LIST_ADDQ(&cond->suites, &cur_suite->list); |
| 1778 | } |
| 1779 | LIST_ADDQ(&cur_suite->terms, &cur_term->list); |
Willy Tarreau | 74b98a8 | 2007-06-16 19:35:18 +0200 | [diff] [blame] | 1780 | neg = 0; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1781 | } |
| 1782 | |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 1783 | cond->val |= suite_val; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1784 | return cond; |
| 1785 | |
| 1786 | out_free_term: |
| 1787 | free(cur_term); |
| 1788 | out_free_suite: |
| 1789 | prune_acl_cond(cond); |
| 1790 | free(cond); |
| 1791 | out_return: |
| 1792 | return NULL; |
| 1793 | } |
| 1794 | |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 1795 | /* Builds an ACL condition starting at the if/unless keyword. The complete |
| 1796 | * condition is returned. NULL is returned in case of error or if the first |
| 1797 | * word is neither "if" nor "unless". It automatically sets the file name and |
Willy Tarreau | 25320b2 | 2013-03-24 07:22:08 +0100 | [diff] [blame] | 1798 | * the line number in the condition for better error reporting, and sets the |
| 1799 | * HTTP intiailization requirements in the proxy. If <err> is not NULL, it will |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1800 | * be filled with a pointer to an error message in case of error, that the |
| 1801 | * caller is responsible for freeing. The initial location must either be |
| 1802 | * freeable or NULL. |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 1803 | */ |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1804 | struct acl_cond *build_acl_cond(const char *file, int line, struct proxy *px, const char **args, char **err) |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 1805 | { |
| 1806 | int pol = ACL_COND_NONE; |
| 1807 | struct acl_cond *cond = NULL; |
| 1808 | |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1809 | if (err) |
| 1810 | *err = NULL; |
| 1811 | |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 1812 | if (!strcmp(*args, "if")) { |
| 1813 | pol = ACL_COND_IF; |
| 1814 | args++; |
| 1815 | } |
| 1816 | else if (!strcmp(*args, "unless")) { |
| 1817 | pol = ACL_COND_UNLESS; |
| 1818 | args++; |
| 1819 | } |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1820 | else { |
Willy Tarreau | eb6cead | 2012-09-20 19:43:14 +0200 | [diff] [blame] | 1821 | memprintf(err, "conditions must start with either 'if' or 'unless'"); |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 1822 | return NULL; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1823 | } |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 1824 | |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 1825 | cond = parse_acl_cond(args, &px->acl, pol, err, &px->conf.args); |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1826 | if (!cond) { |
| 1827 | /* note that parse_acl_cond must have filled <err> here */ |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 1828 | return NULL; |
Willy Tarreau | b7451bb | 2012-04-27 12:38:15 +0200 | [diff] [blame] | 1829 | } |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 1830 | |
| 1831 | cond->file = file; |
| 1832 | cond->line = line; |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 1833 | px->http_needed |= !!(cond->use & SMP_USE_HTTP_ANY); |
Willy Tarreau | 2bbba41 | 2010-01-28 16:48:33 +0100 | [diff] [blame] | 1834 | return cond; |
| 1835 | } |
| 1836 | |
Thierry FOURNIER | 29d47b8 | 2013-11-22 18:03:42 +0100 | [diff] [blame] | 1837 | /* This function execute the match part of the acl. |
| 1838 | * it return ACL_PAT_FAIL, ACL_PAT_MISS or ACL_PAT_PASS |
| 1839 | */ |
| 1840 | inline int acl_exec_match(struct acl_expr *expr, struct sample *smp) |
| 1841 | { |
| 1842 | int acl_res = ACL_PAT_FAIL; |
| 1843 | struct acl_pattern *pattern; |
| 1844 | |
| 1845 | if (expr->match == acl_match_nothing) { |
| 1846 | if (smp->data.uint) |
| 1847 | acl_res |= ACL_PAT_PASS; |
| 1848 | else |
| 1849 | acl_res |= ACL_PAT_FAIL; |
| 1850 | } |
| 1851 | else if (!expr->match) { |
| 1852 | /* just check for existence */ |
| 1853 | acl_res |= ACL_PAT_PASS; |
| 1854 | } |
| 1855 | else { |
| 1856 | if (!eb_is_empty(&expr->pattern_tree)) { |
| 1857 | /* a tree is present, let's check what type it is */ |
| 1858 | if (expr->match == acl_match_str) |
| 1859 | acl_res |= acl_lookup_str(smp, expr) ? ACL_PAT_PASS : ACL_PAT_FAIL; |
| 1860 | else if (expr->match == acl_match_ip) |
| 1861 | acl_res |= acl_lookup_ip(smp, expr) ? ACL_PAT_PASS : ACL_PAT_FAIL; |
| 1862 | } |
| 1863 | |
| 1864 | /* call the match() function for all tests on this value */ |
| 1865 | list_for_each_entry(pattern, &expr->patterns, list) { |
| 1866 | if (acl_res == ACL_PAT_PASS) |
| 1867 | break; |
| 1868 | acl_res |= expr->match(smp, pattern); |
| 1869 | } |
| 1870 | } |
| 1871 | |
| 1872 | return acl_res; |
| 1873 | } |
| 1874 | |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1875 | /* Execute condition <cond> and return either ACL_PAT_FAIL, ACL_PAT_MISS or |
Willy Tarreau | b686644 | 2008-07-14 23:54:42 +0200 | [diff] [blame] | 1876 | * ACL_PAT_PASS depending on the test results. ACL_PAT_MISS may only be |
Willy Tarreau | 32a6f2e | 2012-04-25 10:13:36 +0200 | [diff] [blame] | 1877 | * returned if <opt> does not contain SMP_OPT_FINAL, indicating that incomplete |
Willy Tarreau | 7a777ed | 2012-04-26 11:44:02 +0200 | [diff] [blame] | 1878 | * data is being examined. The function automatically sets SMP_OPT_ITERATE. |
Willy Tarreau | b686644 | 2008-07-14 23:54:42 +0200 | [diff] [blame] | 1879 | * This function only computes the condition, it does not apply the polarity |
| 1880 | * required by IF/UNLESS, it's up to the caller to do this using something like |
| 1881 | * this : |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1882 | * |
| 1883 | * res = acl_pass(res); |
Willy Tarreau | b686644 | 2008-07-14 23:54:42 +0200 | [diff] [blame] | 1884 | * if (res == ACL_PAT_MISS) |
| 1885 | * return 0; |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1886 | * if (cond->pol == ACL_COND_UNLESS) |
| 1887 | * res = !res; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1888 | */ |
Willy Tarreau | 32a6f2e | 2012-04-25 10:13:36 +0200 | [diff] [blame] | 1889 | int acl_exec_cond(struct acl_cond *cond, struct proxy *px, struct session *l4, void *l7, unsigned int opt) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1890 | { |
| 1891 | __label__ fetch_next; |
| 1892 | struct acl_term_suite *suite; |
| 1893 | struct acl_term *term; |
| 1894 | struct acl_expr *expr; |
| 1895 | struct acl *acl; |
Willy Tarreau | 3740635 | 2012-04-23 16:16:37 +0200 | [diff] [blame] | 1896 | struct sample smp; |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1897 | int acl_res, suite_res, cond_res; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1898 | |
Willy Tarreau | 7a777ed | 2012-04-26 11:44:02 +0200 | [diff] [blame] | 1899 | /* ACLs are iterated over all values, so let's always set the flag to |
| 1900 | * indicate this to the fetch functions. |
| 1901 | */ |
| 1902 | opt |= SMP_OPT_ITERATE; |
| 1903 | |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1904 | /* We're doing a logical OR between conditions so we initialize to FAIL. |
| 1905 | * The MISS status is propagated down from the suites. |
| 1906 | */ |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1907 | cond_res = ACL_PAT_FAIL; |
| 1908 | list_for_each_entry(suite, &cond->suites, list) { |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1909 | /* Evaluate condition suite <suite>. We stop at the first term |
| 1910 | * which returns ACL_PAT_FAIL. The MISS status is still propagated |
| 1911 | * in case of uncertainty in the result. |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1912 | */ |
| 1913 | |
| 1914 | /* we're doing a logical AND between terms, so we must set the |
| 1915 | * initial value to PASS. |
| 1916 | */ |
| 1917 | suite_res = ACL_PAT_PASS; |
| 1918 | list_for_each_entry(term, &suite->terms, list) { |
| 1919 | acl = term->acl; |
| 1920 | |
| 1921 | /* FIXME: use cache ! |
| 1922 | * check acl->cache_idx for this. |
| 1923 | */ |
| 1924 | |
| 1925 | /* ACL result not cached. Let's scan all the expressions |
| 1926 | * and use the first one to match. |
| 1927 | */ |
| 1928 | acl_res = ACL_PAT_FAIL; |
| 1929 | list_for_each_entry(expr, &acl->expr, list) { |
Willy Tarreau | d41f8d8 | 2007-06-10 10:06:18 +0200 | [diff] [blame] | 1930 | /* we need to reset context and flags */ |
Willy Tarreau | 3740635 | 2012-04-23 16:16:37 +0200 | [diff] [blame] | 1931 | memset(&smp, 0, sizeof(smp)); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1932 | fetch_next: |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 1933 | if (!sample_process(px, l4, l7, opt, expr->smp, &smp)) { |
Willy Tarreau | b686644 | 2008-07-14 23:54:42 +0200 | [diff] [blame] | 1934 | /* maybe we could not fetch because of missing data */ |
Willy Tarreau | 32a6f2e | 2012-04-25 10:13:36 +0200 | [diff] [blame] | 1935 | if (smp.flags & SMP_F_MAY_CHANGE && !(opt & SMP_OPT_FINAL)) |
Willy Tarreau | b686644 | 2008-07-14 23:54:42 +0200 | [diff] [blame] | 1936 | acl_res |= ACL_PAT_MISS; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1937 | continue; |
Willy Tarreau | b686644 | 2008-07-14 23:54:42 +0200 | [diff] [blame] | 1938 | } |
Willy Tarreau | c426296 | 2010-05-10 23:42:40 +0200 | [diff] [blame] | 1939 | |
Thierry FOURNIER | 29d47b8 | 2013-11-22 18:03:42 +0100 | [diff] [blame] | 1940 | acl_res |= acl_exec_match(expr, &smp); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1941 | /* |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1942 | * OK now acl_res holds the result of this expression |
| 1943 | * as one of ACL_PAT_FAIL, ACL_PAT_MISS or ACL_PAT_PASS. |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1944 | * |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1945 | * Then if (!MISS) we can cache the result, and put |
Willy Tarreau | 3740635 | 2012-04-23 16:16:37 +0200 | [diff] [blame] | 1946 | * (smp.flags & SMP_F_VOLATILE) in the cache flags. |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1947 | * |
| 1948 | * FIXME: implement cache. |
| 1949 | * |
| 1950 | */ |
| 1951 | |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1952 | /* we're ORing these terms, so a single PASS is enough */ |
| 1953 | if (acl_res == ACL_PAT_PASS) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1954 | break; |
| 1955 | |
Willy Tarreau | 3740635 | 2012-04-23 16:16:37 +0200 | [diff] [blame] | 1956 | if (smp.flags & SMP_F_NOT_LAST) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1957 | goto fetch_next; |
Willy Tarreau | b686644 | 2008-07-14 23:54:42 +0200 | [diff] [blame] | 1958 | |
| 1959 | /* sometimes we know the fetched data is subject to change |
| 1960 | * later and give another chance for a new match (eg: request |
| 1961 | * size, time, ...) |
| 1962 | */ |
Willy Tarreau | 32a6f2e | 2012-04-25 10:13:36 +0200 | [diff] [blame] | 1963 | if (smp.flags & SMP_F_MAY_CHANGE && !(opt & SMP_OPT_FINAL)) |
Willy Tarreau | b686644 | 2008-07-14 23:54:42 +0200 | [diff] [blame] | 1964 | acl_res |= ACL_PAT_MISS; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1965 | } |
| 1966 | /* |
| 1967 | * Here we have the result of an ACL (cached or not). |
| 1968 | * ACLs are combined, negated or not, to form conditions. |
| 1969 | */ |
| 1970 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1971 | if (term->neg) |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1972 | acl_res = acl_neg(acl_res); |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1973 | |
| 1974 | suite_res &= acl_res; |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1975 | |
Willy Tarreau | 79c412b | 2013-10-30 19:30:32 +0100 | [diff] [blame] | 1976 | /* we're ANDing these terms, so a single FAIL or MISS is enough */ |
| 1977 | if (suite_res != ACL_PAT_PASS) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1978 | break; |
| 1979 | } |
| 1980 | cond_res |= suite_res; |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1981 | |
| 1982 | /* we're ORing these terms, so a single PASS is enough */ |
| 1983 | if (cond_res == ACL_PAT_PASS) |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1984 | break; |
| 1985 | } |
Willy Tarreau | 1138281 | 2008-07-09 16:18:21 +0200 | [diff] [blame] | 1986 | return cond_res; |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 1987 | } |
| 1988 | |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 1989 | /* Returns a pointer to the first ACL conflicting with usage at place <where> |
| 1990 | * which is one of the SMP_VAL_* bits indicating a check place, or NULL if |
| 1991 | * no conflict is found. Only full conflicts are detected (ACL is not usable). |
| 1992 | * Use the next function to check for useless keywords. |
Willy Tarreau | dd64f8d | 2008-07-27 22:02:32 +0200 | [diff] [blame] | 1993 | */ |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 1994 | const struct acl *acl_cond_conflicts(const struct acl_cond *cond, unsigned int where) |
Willy Tarreau | dd64f8d | 2008-07-27 22:02:32 +0200 | [diff] [blame] | 1995 | { |
| 1996 | struct acl_term_suite *suite; |
| 1997 | struct acl_term *term; |
| 1998 | struct acl *acl; |
| 1999 | |
| 2000 | list_for_each_entry(suite, &cond->suites, list) { |
| 2001 | list_for_each_entry(term, &suite->terms, list) { |
| 2002 | acl = term->acl; |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 2003 | if (!(acl->val & where)) |
Willy Tarreau | dd64f8d | 2008-07-27 22:02:32 +0200 | [diff] [blame] | 2004 | return acl; |
| 2005 | } |
| 2006 | } |
| 2007 | return NULL; |
| 2008 | } |
| 2009 | |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 2010 | /* Returns a pointer to the first ACL and its first keyword to conflict with |
| 2011 | * usage at place <where> which is one of the SMP_VAL_* bits indicating a check |
| 2012 | * place. Returns true if a conflict is found, with <acl> and <kw> set (if non |
| 2013 | * null), or false if not conflict is found. The first useless keyword is |
| 2014 | * returned. |
| 2015 | */ |
Willy Tarreau | 93fddf1 | 2013-03-31 22:59:32 +0200 | [diff] [blame] | 2016 | int acl_cond_kw_conflicts(const struct acl_cond *cond, unsigned int where, struct acl const **acl, char const **kw) |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 2017 | { |
| 2018 | struct acl_term_suite *suite; |
| 2019 | struct acl_term *term; |
| 2020 | struct acl_expr *expr; |
| 2021 | |
| 2022 | list_for_each_entry(suite, &cond->suites, list) { |
| 2023 | list_for_each_entry(term, &suite->terms, list) { |
| 2024 | list_for_each_entry(expr, &term->acl->expr, list) { |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 2025 | if (!(expr->smp->fetch->val & where)) { |
Willy Tarreau | a91d0a5 | 2013-03-25 08:12:18 +0100 | [diff] [blame] | 2026 | if (acl) |
| 2027 | *acl = term->acl; |
| 2028 | if (kw) |
| 2029 | *kw = expr->kw; |
| 2030 | return 1; |
| 2031 | } |
| 2032 | } |
| 2033 | } |
| 2034 | } |
| 2035 | return 0; |
| 2036 | } |
| 2037 | |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 2038 | /* |
| 2039 | * Find targets for userlist and groups in acl. Function returns the number |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 2040 | * of errors or OK if everything is fine. It must be called only once sample |
| 2041 | * fetch arguments have been resolved (after smp_resolve_args()). |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 2042 | */ |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 2043 | int acl_find_targets(struct proxy *p) |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 2044 | { |
| 2045 | |
| 2046 | struct acl *acl; |
| 2047 | struct acl_expr *expr; |
| 2048 | struct acl_pattern *pattern; |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 2049 | int cfgerr = 0; |
| 2050 | |
| 2051 | list_for_each_entry(acl, &p->acl, list) { |
| 2052 | list_for_each_entry(expr, &acl->expr, list) { |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 2053 | if (!strcmp(expr->kw, "http_auth_group")) { |
| 2054 | /* Note: the ARGT_USR argument may only have been resolved earlier |
| 2055 | * by smp_resolve_args(). |
| 2056 | */ |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 2057 | if (expr->smp->arg_p->unresolved) { |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 2058 | Alert("Internal bug in proxy %s: %sacl %s %s() makes use of unresolved userlist '%s'. Please report this.\n", |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 2059 | p->id, *acl->name ? "" : "anonymous ", acl->name, expr->kw, expr->smp->arg_p->data.str.str); |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 2060 | cfgerr++; |
Willy Tarreau | 496aa01 | 2012-06-01 10:38:29 +0200 | [diff] [blame] | 2061 | continue; |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 2062 | } |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 2063 | |
| 2064 | if (LIST_ISEMPTY(&expr->patterns)) { |
| 2065 | Alert("proxy %s: acl %s %s(): no groups specified.\n", |
Willy Tarreau | 93fddf1 | 2013-03-31 22:59:32 +0200 | [diff] [blame] | 2066 | p->id, acl->name, expr->kw); |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 2067 | cfgerr++; |
| 2068 | continue; |
| 2069 | } |
| 2070 | |
| 2071 | list_for_each_entry(pattern, &expr->patterns, list) { |
Willy Tarreau | 7d1df41 | 2012-11-23 23:47:36 +0100 | [diff] [blame] | 2072 | /* this keyword only has one argument */ |
Thierry FOURNIER | 348971e | 2013-11-21 10:50:10 +0100 | [diff] [blame] | 2073 | pattern->val.group_mask = auth_resolve_groups(expr->smp->arg_p->data.usr, pattern->ptr.str); |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 2074 | |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 2075 | if (!pattern->val.group_mask) { |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 2076 | Alert("proxy %s: acl %s %s(): invalid group '%s'.\n", |
| 2077 | p->id, acl->name, expr->kw, pattern->ptr.str); |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 2078 | cfgerr++; |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 2079 | } |
Willy Tarreau | a4312fa | 2013-04-02 16:34:32 +0200 | [diff] [blame] | 2080 | free(pattern->ptr.str); |
| 2081 | pattern->ptr.str = NULL; |
| 2082 | pattern->len = 0; |
Krzysztof Piotr Oledzki | f9423ae | 2010-01-29 19:26:18 +0100 | [diff] [blame] | 2083 | } |
| 2084 | } |
| 2085 | } |
| 2086 | } |
| 2087 | |
| 2088 | return cfgerr; |
| 2089 | } |
Willy Tarreau | dd64f8d | 2008-07-27 22:02:32 +0200 | [diff] [blame] | 2090 | |
Willy Tarreau | 8ed669b | 2013-01-11 15:49:37 +0100 | [diff] [blame] | 2091 | /* initializes ACLs by resolving the sample fetch names they rely upon. |
| 2092 | * Returns 0 on success, otherwise an error. |
| 2093 | */ |
| 2094 | int init_acl() |
| 2095 | { |
| 2096 | int err = 0; |
| 2097 | int index; |
| 2098 | const char *name; |
| 2099 | struct acl_kw_list *kwl; |
| 2100 | struct sample_fetch *smp; |
| 2101 | |
| 2102 | list_for_each_entry(kwl, &acl_keywords.list, list) { |
| 2103 | for (index = 0; kwl->kw[index].kw != NULL; index++) { |
| 2104 | name = kwl->kw[index].fetch_kw; |
| 2105 | if (!name) |
| 2106 | name = kwl->kw[index].kw; |
| 2107 | |
| 2108 | smp = find_sample_fetch(name, strlen(name)); |
| 2109 | if (!smp) { |
| 2110 | Alert("Critical internal error: ACL keyword '%s' relies on sample fetch '%s' which was not registered!\n", |
| 2111 | kwl->kw[index].kw, name); |
| 2112 | err++; |
| 2113 | continue; |
| 2114 | } |
| 2115 | kwl->kw[index].smp = smp; |
| 2116 | } |
| 2117 | } |
| 2118 | return err; |
| 2119 | } |
Willy Tarreau | d4c33c8 | 2013-01-07 21:59:07 +0100 | [diff] [blame] | 2120 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 2121 | /************************************************************************/ |
Willy Tarreau | d4c33c8 | 2013-01-07 21:59:07 +0100 | [diff] [blame] | 2122 | /* All supported sample and ACL keywords must be declared here. */ |
| 2123 | /************************************************************************/ |
| 2124 | |
| 2125 | /* Note: must not be declared <const> as its list will be overwritten. |
Willy Tarreau | 61612d4 | 2012-04-19 18:42:05 +0200 | [diff] [blame] | 2126 | * Please take care of keeping this list alphabetically sorted. |
| 2127 | */ |
Willy Tarreau | dc13c11 | 2013-06-21 23:16:39 +0200 | [diff] [blame] | 2128 | static struct acl_kw_list acl_kws = {ILH, { |
Willy Tarreau | d4c33c8 | 2013-01-07 21:59:07 +0100 | [diff] [blame] | 2129 | { /* END */ }, |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 2130 | }}; |
| 2131 | |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 2132 | __attribute__((constructor)) |
| 2133 | static void __acl_init(void) |
| 2134 | { |
Willy Tarreau | a84d374 | 2007-05-07 00:36:48 +0200 | [diff] [blame] | 2135 | acl_register_keywords(&acl_kws); |
| 2136 | } |
| 2137 | |
| 2138 | |
| 2139 | /* |
| 2140 | * Local variables: |
| 2141 | * c-indent-level: 8 |
| 2142 | * c-basic-offset: 8 |
| 2143 | * End: |
| 2144 | */ |