RepoMirrors/haproxy
1
0
Fork 0
mirror of http://git.haproxy.org/git/haproxy.git/ synced 2024-12-12 22:44:32 +00:00
Code Issues Packages Projects Releases Wiki Activity
8ed669b12a
haproxy/include/proto/acl.h

225 lines
8.4 KiB
C
Raw Normal View History

[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
/*
[MINOR] acl: add build_acl_cond() to make it easier to add ACLs in config This function automatically builds a rule, considering the if/unless statements, and automatically updates the proxy's acl_requires, the condition's file and line.
2010-01-28 15:48:33 +00:00
* include/proto/acl.h
* This file provides interface definitions for ACL manipulation.
*
MEDIUM: samples: move payload-based fetches and ACLs to their own file The file acl.c is a real mess, it both contains functions to parse and process ACLs, and some sample extraction functions which act on buffers. Some other payload analysers were arbitrarily dispatched to proto_tcp.c. So now we're moving all payload-based fetches and ACLs to payload.c which is capable of extracting data from buffers and rely on everything that is protocol-independant. That way we can safely inflate this file and only use the other ones when some fetches are really specific (eg: HTTP, SSL, ...). As a result of this cleanup, the following new sample fetches became available even if they're not really useful : always_false, always_true, rep_ssl_hello_type, rdp_cookie_cnt, req_len, req_ssl_hello_type, req_ssl_sni, req_ssl_ver, wait_end The function 'acl_fetch_nothing' was wrong and never used anywhere so it was removed. The "rdp_cookie" sample fetch used to have a mandatory argument while it was optional in ACLs, which are supposed to iterate over RDP cookies. So we're making it optional as a fetch too, and it will return the first one.
2013-01-07 20:59:07 +00:00
* Copyright (C) 2000-2013 Willy Tarreau - w@1wt.eu
[MINOR] acl: add build_acl_cond() to make it easier to add ACLs in config This function automatically builds a rule, considering the if/unless statements, and automatically updates the proxy's acl_requires, the condition's file and line.
2010-01-28 15:48:33 +00:00
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation, version 2.1
* exclusively.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/
[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
#ifndef _PROTO_ACL_H
#define _PROTO_ACL_H
#include <common/config.h>
#include <types/acl.h>
REORG: rename "pattern" files They're now called "sample" everywhere to match their description.
2012-04-27 19:52:18 +00:00
#include <proto/sample.h>
[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
/*
* FIXME: we need destructor functions too !
*/
[TESTS] added test-acl.cfg to test some ACL combinations various rules constructions can be tested with this test case.
2008-07-09 14:18:21 +00:00
/* Negate an acl result. This turns (ACL_PAT_FAIL, ACL_PAT_MISS, ACL_PAT_PASS)
* into (ACL_PAT_PASS, ACL_PAT_MISS, ACL_PAT_FAIL).
*/
static inline int acl_neg(int res)
{
return (3 >> res);
}
/* Convert an acl result to a boolean. Only ACL_PAT_PASS returns 1. */
static inline int acl_pass(int res)
{
return (res >> 1);
}
[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
/* Return a pointer to the ACL <name> within the list starting at <head>, or
* NULL if not found.
*/
struct acl *find_acl_by_name(const char *name, struct list *head);
/* Return a pointer to the ACL keyword <kw> within the list starting at <head>,
* or NULL if not found. Note that if <kw> contains an opening parenthesis,
* only the left part of it is checked.
*/
struct acl_keyword *find_acl_kw(const char *kw);
/* Parse an ACL expression starting at <args>[0], and return it.
* Right now, the only accepted syntax is :
* <subject> [<value>...]
*/
MEDIUM: acl: report parsing errors to the caller All parsing errors were known but impossible to return. Now by making use of memprintf(), we're able to build meaningful error messages that the caller can display.
2012-04-27 10:38:15 +00:00
struct acl_expr *parse_acl_expr(const char **args, char **err);
[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
[MEDIUM] Fix memory freeing at exit New functions implemented: - deinit_pollers: called at the end of deinit()) - prune_acl: called via list_for_each_entry_safe Add missing pool_destroy2 calls: - p->hdr_idx_pool - pool2_tree64 Implement all task stopping: - health-check: needs new "struct task" in the struct server - queue processing: queue_mgt - appsess_refresh: appsession_refresh before (idle system): ==6079== LEAK SUMMARY: ==6079== definitely lost: 1,112 bytes in 75 blocks. ==6079== indirectly lost: 53,356 bytes in 2,090 blocks. ==6079== possibly lost: 52 bytes in 1 blocks. ==6079== still reachable: 150,996 bytes in 504 blocks. ==6079== suppressed: 0 bytes in 0 blocks. after (idle system): ==6945== LEAK SUMMARY: ==6945== definitely lost: 7,644 bytes in 137 blocks. ==6945== indirectly lost: 9,913 bytes in 587 blocks. ==6945== possibly lost: 0 bytes in 0 blocks. ==6945== still reachable: 0 bytes in 0 blocks. ==6945== suppressed: 0 bytes in 0 blocks. before (running system for ~2m): ==9343== LEAK SUMMARY: ==9343== definitely lost: 1,112 bytes in 75 blocks. ==9343== indirectly lost: 54,199 bytes in 2,122 blocks. ==9343== possibly lost: 52 bytes in 1 blocks. ==9343== still reachable: 151,128 bytes in 509 blocks. ==9343== suppressed: 0 bytes in 0 blocks. after (running system for ~2m): ==11616== LEAK SUMMARY: ==11616== definitely lost: 7,644 bytes in 137 blocks. ==11616== indirectly lost: 9,981 bytes in 591 blocks. ==11616== possibly lost: 0 bytes in 0 blocks. ==11616== still reachable: 4 bytes in 1 blocks. ==11616== suppressed: 0 bytes in 0 blocks. Still not perfect but significant improvement.
2008-05-29 21:53:44 +00:00
/* Purge everything in the acl <acl>, then return <acl>. */
struct acl *prune_acl(struct acl *acl);
[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
/* Parse an ACL with the name starting at <args>[0], and with a list of already
* known ACLs in <acl>. If the ACL was not in the list, it will be added.
* A pointer to that ACL is returned.
*
* args syntax: <aclname> <acl_expr>
*/
MEDIUM: acl: report parsing errors to the caller All parsing errors were known but impossible to return. Now by making use of memprintf(), we're able to build meaningful error messages that the caller can display.
2012-04-27 10:38:15 +00:00
struct acl *parse_acl(const char **args, struct list *known_acl, char **err);
[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
/* Purge everything in the acl_cond <cond>, then return <cond>. */
struct acl_cond *prune_acl_cond(struct acl_cond *cond);
/* Parse an ACL condition starting at <args>[0], relying on a list of already
* known ACLs passed in <known_acl>. The new condition is returned (or NULL in
* case of low memory). Supports multiple conditions separated by "or".
*/
MEDIUM: acl: report parsing errors to the caller All parsing errors were known but impossible to return. Now by making use of memprintf(), we're able to build meaningful error messages that the caller can display.
2012-04-27 10:38:15 +00:00
struct acl_cond *parse_acl_cond(const char **args, struct list *known_acl, int pol, char **err);
[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
[MINOR] acl: add build_acl_cond() to make it easier to add ACLs in config This function automatically builds a rule, considering the if/unless statements, and automatically updates the proxy's acl_requires, the condition's file and line.
2010-01-28 15:48:33 +00:00
/* Builds an ACL condition starting at the if/unless keyword. The complete
* condition is returned. NULL is returned in case of error or if the first
* word is neither "if" nor "unless". It automatically sets the file name and
* the line number in the condition for better error reporting, and adds the
MEDIUM: acl: report parsing errors to the caller All parsing errors were known but impossible to return. Now by making use of memprintf(), we're able to build meaningful error messages that the caller can display.
2012-04-27 10:38:15 +00:00
* ACL requirements to the proxy's acl_requires. If <err> is not NULL, it will
* be set to an error message upon errors, that the caller will have to free.
[MINOR] acl: add build_acl_cond() to make it easier to add ACLs in config This function automatically builds a rule, considering the if/unless statements, and automatically updates the proxy's acl_requires, the condition's file and line.
2010-01-28 15:48:33 +00:00
*/
MEDIUM: acl: report parsing errors to the caller All parsing errors were known but impossible to return. Now by making use of memprintf(), we're able to build meaningful error messages that the caller can display.
2012-04-27 10:38:15 +00:00
struct acl_cond *build_acl_cond(const char *file, int line, struct proxy *px, const char **args, char **err);
[MINOR] acl: add build_acl_cond() to make it easier to add ACLs in config This function automatically builds a rule, considering the if/unless statements, and automatically updates the proxy's acl_requires, the condition's file and line.
2010-01-28 15:48:33 +00:00
[TESTS] added test-acl.cfg to test some ACL combinations various rules constructions can be tested with this test case.
2008-07-09 14:18:21 +00:00
/* Execute condition <cond> and return either ACL_PAT_FAIL, ACL_PAT_MISS or
* ACL_PAT_PASS depending on the test results. This function only computes the
* condition, it does not apply the polarity required by IF/UNLESS, it's up to
* the caller to do this.
[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
*/
MEDIUM: acl/pattern: use the same direction scheme Patterns were using a bitmask to indicate if request or response was desired in fetch functions and keywords. ACLs were using a bitmask in fetch keywords and a single bit in fetch functions. ACLs were also using an ACL_PARTIAL bit in fetch functions indicating that a non-final fetch was performed, which was an abuse of the existing direction flag. The change now consists in using : - a capabilities field for fetch keywords => SMP_CAP_REQ/RES to indicate if a keyword supports requests, responses, both, etc... - an option field for fetch functions to indicate what the caller expects (request/response, final/non-final) The ACL_PARTIAL bit was reversed to get SMP_OPT_FINAL as it's more explicit to know we're working on a final buffer than on a non-final one. ACL_DIR_* were removed, as well as PATTERN_FETCH_*. L4 fetches were improved to support being called on responses too since they're still available. The <dir> field of all fetch functions was changed to <opt> which is now unsigned. The patch is large but mostly made of cosmetic changes to accomodate this, as almost no logic change happened.
2012-04-25 08:13:36 +00:00
int acl_exec_cond(struct acl_cond *cond, struct proxy *px, struct session *l4, void *l7, unsigned int opt);
[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
[MEDIUM] acl: when possible, report the name and requirements of ACLs in warnings When an ACL is referenced at a wrong place (eg: response during request, layer7 during layer4), try to indicate precisely the name and requirements of this ACL. Only the first faulty ACL is returned. A small change consisting in iterating that way may improve reports : cap = ACL_USE_any_unexpected while ((acl=cond_find_require(cond, cap))) { warning() cap &= ~acl->requires; } This will report the first ACL of each unsupported type. But doing so will mangle the error reporting a lot, so we need to rework error reports first.
2008-07-27 20:02:32 +00:00
/* Reports a pointer to the first ACL used in condition <cond> which requires
* at least one of the USE_FLAGS in <require>. Returns NULL if none matches.
*/
[CLEANUP] config: use warnif_cond_requires_resp() to check for bad ACLs Factor out some repetitive copy-pasted code to check for request ACLs validity.
2010-01-28 16:59:39 +00:00
struct acl *cond_find_require(const struct acl_cond *cond, unsigned int require);
[MEDIUM] acl: when possible, report the name and requirements of ACLs in warnings When an ACL is referenced at a wrong place (eg: response during request, layer7 during layer4), try to indicate precisely the name and requirements of this ACL. Only the first faulty ACL is returned. A small change consisting in iterating that way may improve reports : cap = ACL_USE_any_unexpected while ((acl=cond_find_require(cond, cap))) { warning() cap &= ~acl->requires; } This will report the first ACL of each unsupported type. But doing so will mangle the error reporting a lot, so we need to rework error reports first.
2008-07-27 20:02:32 +00:00
[MINOR] acl: add http_auth and http_auth_group Add two acls to match http auth data: acl <name> http_auth(userlist) acl <name> http_auth_hroup(userlist) group1 group2 (...)
2010-01-29 18:26:18 +00:00
/*
* Find targets for userlist and groups in acl. Function returns the number
* of errors or OK if everything is fine.
*/
int acl_find_targets(struct proxy *p);
[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
/* Return a pointer to the ACL <name> within the list starting at <head>, or
* NULL if not found.
*/
struct acl *find_acl_by_name(const char *name, struct list *head);
/*
* Registers the ACL keyword list <kwl> as a list of valid keywords for next
* parsing sessions.
*/
void acl_register_keywords(struct acl_kw_list *kwl);
/*
* Unregisters the ACL keyword list <kwl> from the list of valid keywords.
*/
void acl_unregister_keywords(struct acl_kw_list *kwl);
MAJOR: acl: make all ACLs reference the fetch function via a sample. ACL fetch functions used to directly reference a fetch function. Now that all ACL fetches have their sample fetches equivalent, we can make ACLs reference a sample fetch keyword instead. In order to simplify the code, a sample keyword name may be NULL if it is the same as the ACL's, which is the most common case. A minor change appeared, http_auth always expects one argument though the ACL allowed it to be missing and reported as such afterwards, so fix the ACL to match this. This is not really a bug.
2013-01-11 14:49:37 +00:00
/* initializes ACLs by resolving the sample fetch names they rely upon.
* Returns 0 on success, otherwise an error.
*/
int init_acl();
[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
/*
*
* The following functions are general purpose ACL matching functions.
*
*/
[MEDIUM] acl: get rid of dummy values in always_true/always_false make use of last change in order to get rid of dummy values in always_true/always_false.
2008-07-20 08:39:22 +00:00
/* ignore the current line */
MEDIUM: acl: extend the pattern parsers to report meaningful errors By passing the error pointer to all ACL parsers, we can make them report useful errors and not simply fail.
2012-04-27 15:52:25 +00:00
int acl_parse_nothing(const char **text, struct acl_pattern *pattern, int *opaque, char **err);
[MEDIUM] acl: get rid of dummy values in always_true/always_false make use of last change in order to get rid of dummy values in always_true/always_false.
2008-07-20 08:39:22 +00:00
[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
/* NB: For two strings to be identical, it is required that their lengths match */
MAJOR: acl: make use of the new sample struct and get rid of acl_test This change is invasive in lines of code but not much in terms of functionalities as it's mainly a replacement of struct acl_test with struct sample.
2012-04-23 14:16:37 +00:00
int acl_match_str(struct sample *smp, struct acl_pattern *pattern);
[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
MINOR: acl: add parse and match primitives to use binary type on ACLs Binary ACL match patterns can now be entered as hex digit strings.
2012-10-17 11:38:19 +00:00
/* NB: For two binary buffers to be identical, it is required that their lengths match */
int acl_match_bin(struct sample *smp, struct acl_pattern *pattern);
MINOR: acl: add new matches for header/path/url length This patch introduces hdr_len, path_len and url_len for matching these respective parts lengths against integers. This can be used to detect abuse or empty headers.
2011-09-16 06:32:32 +00:00
/* Checks that the length of the pattern in <test> is included between min and max */
MAJOR: acl: make use of the new sample struct and get rid of acl_test This change is invasive in lines of code but not much in terms of functionalities as it's mainly a replacement of struct acl_test with struct sample.
2012-04-23 14:16:37 +00:00
int acl_match_len(struct sample *smp, struct acl_pattern *pattern);
MINOR: acl: add new matches for header/path/url length This patch introduces hdr_len, path_len and url_len for matching these respective parts lengths against integers. This can be used to detect abuse or empty headers.
2011-09-16 06:32:32 +00:00
[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
/* Checks that the integer in <test> is included between min and max */
MAJOR: acl: make use of the new sample struct and get rid of acl_test This change is invasive in lines of code but not much in terms of functionalities as it's mainly a replacement of struct acl_test with struct sample.
2012-04-23 14:16:37 +00:00
int acl_match_int(struct sample *smp, struct acl_pattern *pattern);
[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
/* Parse an integer. It is put both in min and max. */
MEDIUM: acl: extend the pattern parsers to report meaningful errors By passing the error pointer to all ACL parsers, we can make them report useful errors and not simply fail.
2012-04-27 15:52:25 +00:00
int acl_parse_int(const char **text, struct acl_pattern *pattern, int *opaque, char **err);
[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
[MINOR] acl: add a new parsing function: parse_dotted_ver This new function supports one major and one minor and makes an int of them. It is very convenient to compare versions (eg: SSL) just as if they were plain integers, as the comparison functions will still be based on integers.
2008-07-15 14:05:33 +00:00
/* Parse an version. It is put both in min and max. */
MEDIUM: acl: extend the pattern parsers to report meaningful errors By passing the error pointer to all ACL parsers, we can make them report useful errors and not simply fail.
2012-04-27 15:52:25 +00:00
int acl_parse_dotted_ver(const char **text, struct acl_pattern *pattern, int *opaque, char **err);
[MINOR] acl: add a new parsing function: parse_dotted_ver This new function supports one major and one minor and makes an int of them. It is very convenient to compare versions (eg: SSL) just as if they were plain integers, as the comparison functions will still be based on integers.
2008-07-15 14:05:33 +00:00
[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
/* Parse a range of integers delimited by either ':' or '-'. If only one
* integer is read, it is set as both min and max.
*/
MEDIUM: acl: extend the pattern parsers to report meaningful errors By passing the error pointer to all ACL parsers, we can make them report useful errors and not simply fail.
2012-04-27 15:52:25 +00:00
int acl_parse_range(const char **text, struct acl_pattern *pattern, int *opaque, char **err);
[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
/* Parse a string. It is allocated and duplicated. */
MEDIUM: acl: extend the pattern parsers to report meaningful errors By passing the error pointer to all ACL parsers, we can make them report useful errors and not simply fail.
2012-04-27 15:52:25 +00:00
int acl_parse_str(const char **text, struct acl_pattern *pattern, int *opaque, char **err);
[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
MINOR: acl: add parse and match primitives to use binary type on ACLs Binary ACL match patterns can now be entered as hex digit strings.
2012-10-17 11:38:19 +00:00
/* Parse a hexa binary definition. It is allocated and duplicated. */
int acl_parse_bin(const char **text, struct acl_pattern *pattern, int *opaque, char **err);
[MINOR] acl: add http_auth and http_auth_group Add two acls to match http auth data: acl <name> http_auth(userlist) acl <name> http_auth_hroup(userlist) group1 group2 (...)
2010-01-29 18:26:18 +00:00
/* Parse and concatenate strings into one. It is allocated and duplicated. */
MEDIUM: acl: extend the pattern parsers to report meaningful errors By passing the error pointer to all ACL parsers, we can make them report useful errors and not simply fail.
2012-04-27 15:52:25 +00:00
int acl_parse_strcat(const char **text, struct acl_pattern *pattern, int *opaque, char **err);
[MINOR] acl: add http_auth and http_auth_group Add two acls to match http auth data: acl <name> http_auth(userlist) acl <name> http_auth_hroup(userlist) group1 group2 (...)
2010-01-29 18:26:18 +00:00
[MINOR] ACL regex matching on the URI ; uri_reg The URI can be matched on regexen now. The upcase/lowcase flag can not be set yet and will soon have to.
2007-05-08 20:45:09 +00:00
/* Parse a regex. It is allocated. */
MEDIUM: acl: extend the pattern parsers to report meaningful errors By passing the error pointer to all ACL parsers, we can make them report useful errors and not simply fail.
2012-04-27 15:52:25 +00:00
int acl_parse_reg(const char **text, struct acl_pattern *pattern, int *opaque, char **err);
[MINOR] ACL regex matching on the URI ; uri_reg The URI can be matched on regexen now. The upcase/lowcase flag can not be set yet and will soon have to.
2007-05-08 20:45:09 +00:00
[MINOR] implement acl_parse_ip and acl_match_ip The ACL can now compare IP addresses. The client's IP address can be checked.
2007-05-08 17:50:09 +00:00
/* Parse an IP address and an optional mask in the form addr[/mask].
* The addr may either be an IPv4 address or a hostname. The mask
* may either be a dotted mask or a number of bits. Returns 1 if OK,
* otherwise 0.
*/
MEDIUM: acl: extend the pattern parsers to report meaningful errors By passing the error pointer to all ACL parsers, we can make them report useful errors and not simply fail.
2012-04-27 15:52:25 +00:00
int acl_parse_ip(const char **text, struct acl_pattern *pattern, int *opaque, char **err);
[MINOR] implement acl_parse_ip and acl_match_ip The ACL can now compare IP addresses. The client's IP address can be checked.
2007-05-08 17:50:09 +00:00
[MEDIUM] acl: get rid of dummy values in always_true/always_false make use of last change in order to get rid of dummy values in always_true/always_false.
2008-07-20 08:39:22 +00:00
/* always return false */
MAJOR: acl: make use of the new sample struct and get rid of acl_test This change is invasive in lines of code but not much in terms of functionalities as it's mainly a replacement of struct acl_test with struct sample.
2012-04-23 14:16:37 +00:00
int acl_match_nothing(struct sample *smp, struct acl_pattern *pattern);
[MEDIUM] acl: get rid of dummy values in always_true/always_false make use of last change in order to get rid of dummy values in always_true/always_false.
2008-07-20 08:39:22 +00:00
[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
/* Checks that the pattern matches the end of the tested string. */
MAJOR: acl: make use of the new sample struct and get rid of acl_test This change is invasive in lines of code but not much in terms of functionalities as it's mainly a replacement of struct acl_test with struct sample.
2012-04-23 14:16:37 +00:00
int acl_match_end(struct sample *smp, struct acl_pattern *pattern);
[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
/* Checks that the pattern matches the beginning of the tested string. */
MAJOR: acl: make use of the new sample struct and get rid of acl_test This change is invasive in lines of code but not much in terms of functionalities as it's mainly a replacement of struct acl_test with struct sample.
2012-04-23 14:16:37 +00:00
int acl_match_beg(struct sample *smp, struct acl_pattern *pattern);
[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
/* Checks that the pattern is included inside the tested string. */
MAJOR: acl: make use of the new sample struct and get rid of acl_test This change is invasive in lines of code but not much in terms of functionalities as it's mainly a replacement of struct acl_test with struct sample.
2012-04-23 14:16:37 +00:00
int acl_match_sub(struct sample *smp, struct acl_pattern *pattern);
[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
/* Checks that the pattern is included inside the tested string, but enclosed
* between slashes or at the beginning or end of the string. Slashes at the
* beginning or end of the pattern are ignored.
*/
MAJOR: acl: make use of the new sample struct and get rid of acl_test This change is invasive in lines of code but not much in terms of functionalities as it's mainly a replacement of struct acl_test with struct sample.
2012-04-23 14:16:37 +00:00
int acl_match_dir(struct sample *smp, struct acl_pattern *pattern);
[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
/* Checks that the pattern is included inside the tested string, but enclosed
* between dots or at the beginning or end of the string. Dots at the beginning
* or end of the pattern are ignored.
*/
MAJOR: acl: make use of the new sample struct and get rid of acl_test This change is invasive in lines of code but not much in terms of functionalities as it's mainly a replacement of struct acl_test with struct sample.
2012-04-23 14:16:37 +00:00
int acl_match_dom(struct sample *smp, struct acl_pattern *pattern);
[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
[MINOR] implement acl_parse_ip and acl_match_ip The ACL can now compare IP addresses. The client's IP address can be checked.
2007-05-08 17:50:09 +00:00
/* Check that the IPv4 address in <test> matches the IP/mask in pattern */
MAJOR: acl: make use of the new sample struct and get rid of acl_test This change is invasive in lines of code but not much in terms of functionalities as it's mainly a replacement of struct acl_test with struct sample.
2012-04-23 14:16:37 +00:00
int acl_match_ip(struct sample *smp, struct acl_pattern *pattern);
[MINOR] implement acl_parse_ip and acl_match_ip The ACL can now compare IP addresses. The client's IP address can be checked.
2007-05-08 17:50:09 +00:00
MEDIUM: get rid of SMP_F_READ_ONLY and SMP_F_MUST_FREE These ones were either unused or improperly used. Some integers were marked read-only, which does not make much sense. Buffers are not read-only, they're "constant" in that they must be kept intact after any possible change.
2012-04-23 17:25:44 +00:00
/* Executes a regex. It temporarily changes the data to add a trailing zero,
* and restores the previous character when leaving.
[MINOR] ACL regex matching on the URI ; uri_reg The URI can be matched on regexen now. The upcase/lowcase flag can not be set yet and will soon have to.
2007-05-08 20:45:09 +00:00
*/
MAJOR: acl: make use of the new sample struct and get rid of acl_test This change is invasive in lines of code but not much in terms of functionalities as it's mainly a replacement of struct acl_test with struct sample.
2012-04-23 14:16:37 +00:00
int acl_match_reg(struct sample *smp, struct acl_pattern *pattern);
[MINOR] ACL regex matching on the URI ; uri_reg The URI can be matched on regexen now. The upcase/lowcase flag can not be set yet and will soon have to.
2007-05-08 20:45:09 +00:00
[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
#endif /* _PROTO_ACL_H */
/*
* Local variables:
* c-indent-level: 8
* c-basic-offset: 8
* End:
*/
Reference in New Issue Copy Permalink