RepoMirrors
/
haproxy
mirror of http://git.haproxy.org/git/haproxy.git/
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
haproxy/include/proto/acl.h

156 lines
5.9 KiB
C
Raw Normal View History

[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
/*
[MINOR] acl: add build_acl_cond() to make it easier to add ACLs in config This function automatically builds a rule, considering the if/unless statements, and automatically updates the proxy's acl_requires, the condition's file and line.
2010-01-28 15:48:33 +00:00
* include/proto/acl.h
* This file provides interface definitions for ACL manipulation.
*
MEDIUM: samples: move payload-based fetches and ACLs to their own file The file acl.c is a real mess, it both contains functions to parse and process ACLs, and some sample extraction functions which act on buffers. Some other payload analysers were arbitrarily dispatched to proto_tcp.c. So now we're moving all payload-based fetches and ACLs to payload.c which is capable of extracting data from buffers and rely on everything that is protocol-independant. That way we can safely inflate this file and only use the other ones when some fetches are really specific (eg: HTTP, SSL, ...). As a result of this cleanup, the following new sample fetches became available even if they're not really useful : always_false, always_true, rep_ssl_hello_type, rdp_cookie_cnt, req_len, req_ssl_hello_type, req_ssl_sni, req_ssl_ver, wait_end The function 'acl_fetch_nothing' was wrong and never used anywhere so it was removed. The "rdp_cookie" sample fetch used to have a mandatory argument while it was optional in ACLs, which are supposed to iterate over RDP cookies. So we're making it optional as a fetch too, and it will return the first one.
2013-01-07 20:59:07 +00:00
* Copyright (C) 2000-2013 Willy Tarreau - w@1wt.eu
[MINOR] acl: add build_acl_cond() to make it easier to add ACLs in config This function automatically builds a rule, considering the if/unless statements, and automatically updates the proxy's acl_requires, the condition's file and line.
2010-01-28 15:48:33 +00:00
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation, version 2.1
* exclusively.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/
[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
#ifndef _PROTO_ACL_H
#define _PROTO_ACL_H
#include <common/config.h>
#include <types/acl.h>
REORG: rename "pattern" files They're now called "sample" everywhere to match their description.
2012-04-27 19:52:18 +00:00
#include <proto/sample.h>
[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
/*
* FIXME: we need destructor functions too !
*/
MEDIUM: pattern: rename "acl" prefix to "pat" This patch just renames functions, types and enums. No code was changed. A significant number of files were touched, especially the ACL arrays, so it is likely that some external patches will not apply anymore. One important thing is that we had to split ACL_PAT_* into two groups : - ACL_TEST_{PASS|MISS|FAIL} - PAT_{MATCH|UNMATCH} A future patch will enforce enums on all these places to avoid confusion.
2013-11-28 17:22:00 +00:00
/* Negate an acl result. This turns (ACL_MATCH_FAIL, ACL_MATCH_MISS,
* ACL_MATCH_PASS) into (ACL_MATCH_PASS, ACL_MATCH_MISS, ACL_MATCH_FAIL).
[TESTS] added test-acl.cfg to test some ACL combinations various rules constructions can be tested with this test case.
2008-07-09 14:18:21 +00:00
*/
MINOR: acl/pattern: use types different from int to clarify who does what. We now have the following enums and all related functions return them and consume them : enum pat_match_res { PAT_NOMATCH = 0, /* sample didn't match any pattern */ PAT_MATCH = 3, /* sample matched at least one pattern */ }; enum acl_test_res { ACL_TEST_FAIL = 0, /* test failed */ ACL_TEST_MISS = 1, /* test may pass with more info */ ACL_TEST_PASS = 3, /* test passed */ }; enum acl_cond_pol { ACL_COND_NONE, /* no polarity set yet */ ACL_COND_IF, /* positive condition (after 'if') */ ACL_COND_UNLESS, /* negative condition (after 'unless') */ }; It's just in order to avoid doubts when reading some code.
2013-11-28 21:21:02 +00:00
static inline enum acl_test_res acl_neg(enum acl_test_res res)
[TESTS] added test-acl.cfg to test some ACL combinations various rules constructions can be tested with this test case.
2008-07-09 14:18:21 +00:00
{
return (3 >> res);
}
MEDIUM: pattern: rename "acl" prefix to "pat" This patch just renames functions, types and enums. No code was changed. A significant number of files were touched, especially the ACL arrays, so it is likely that some external patches will not apply anymore. One important thing is that we had to split ACL_PAT_* into two groups : - ACL_TEST_{PASS|MISS|FAIL} - PAT_{MATCH|UNMATCH} A future patch will enforce enums on all these places to avoid confusion.
2013-11-28 17:22:00 +00:00
/* Convert an acl result to a boolean. Only ACL_MATCH_PASS returns 1. */
MINOR: acl/pattern: use types different from int to clarify who does what. We now have the following enums and all related functions return them and consume them : enum pat_match_res { PAT_NOMATCH = 0, /* sample didn't match any pattern */ PAT_MATCH = 3, /* sample matched at least one pattern */ }; enum acl_test_res { ACL_TEST_FAIL = 0, /* test failed */ ACL_TEST_MISS = 1, /* test may pass with more info */ ACL_TEST_PASS = 3, /* test passed */ }; enum acl_cond_pol { ACL_COND_NONE, /* no polarity set yet */ ACL_COND_IF, /* positive condition (after 'if') */ ACL_COND_UNLESS, /* negative condition (after 'unless') */ }; It's just in order to avoid doubts when reading some code.
2013-11-28 21:21:02 +00:00
static inline int acl_pass(enum acl_test_res res)
[TESTS] added test-acl.cfg to test some ACL combinations various rules constructions can be tested with this test case.
2008-07-09 14:18:21 +00:00
{
return (res >> 1);
}
[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
/* Return a pointer to the ACL <name> within the list starting at <head>, or
* NULL if not found.
*/
struct acl *find_acl_by_name(const char *name, struct list *head);
/* Return a pointer to the ACL keyword <kw> within the list starting at <head>,
* or NULL if not found. Note that if <kw> contains an opening parenthesis,
* only the left part of it is checked.
*/
struct acl_keyword *find_acl_kw(const char *kw);
/* Parse an ACL expression starting at <args>[0], and return it.
* Right now, the only accepted syntax is :
* <subject> [<value>...]
*/
MINOR: pattern: store configuration reference for each acl or map pattern. This patch permit to add reference for each pattern reference. This is useful to identify the acl listed.
2014-02-11 02:31:34 +00:00
struct acl_expr *parse_acl_expr(const char **args, char **err, struct arg_list *al, const char *file, int line);
[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
[MEDIUM] Fix memory freeing at exit New functions implemented: - deinit_pollers: called at the end of deinit()) - prune_acl: called via list_for_each_entry_safe Add missing pool_destroy2 calls: - p->hdr_idx_pool - pool2_tree64 Implement all task stopping: - health-check: needs new "struct task" in the struct server - queue processing: queue_mgt - appsess_refresh: appsession_refresh before (idle system): ==6079== LEAK SUMMARY: ==6079== definitely lost: 1,112 bytes in 75 blocks. ==6079== indirectly lost: 53,356 bytes in 2,090 blocks. ==6079== possibly lost: 52 bytes in 1 blocks. ==6079== still reachable: 150,996 bytes in 504 blocks. ==6079== suppressed: 0 bytes in 0 blocks. after (idle system): ==6945== LEAK SUMMARY: ==6945== definitely lost: 7,644 bytes in 137 blocks. ==6945== indirectly lost: 9,913 bytes in 587 blocks. ==6945== possibly lost: 0 bytes in 0 blocks. ==6945== still reachable: 0 bytes in 0 blocks. ==6945== suppressed: 0 bytes in 0 blocks. before (running system for ~2m): ==9343== LEAK SUMMARY: ==9343== definitely lost: 1,112 bytes in 75 blocks. ==9343== indirectly lost: 54,199 bytes in 2,122 blocks. ==9343== possibly lost: 52 bytes in 1 blocks. ==9343== still reachable: 151,128 bytes in 509 blocks. ==9343== suppressed: 0 bytes in 0 blocks. after (running system for ~2m): ==11616== LEAK SUMMARY: ==11616== definitely lost: 7,644 bytes in 137 blocks. ==11616== indirectly lost: 9,981 bytes in 591 blocks. ==11616== possibly lost: 0 bytes in 0 blocks. ==11616== still reachable: 4 bytes in 1 blocks. ==11616== suppressed: 0 bytes in 0 blocks. Still not perfect but significant improvement.
2008-05-29 21:53:44 +00:00
/* Purge everything in the acl <acl>, then return <acl>. */
struct acl *prune_acl(struct acl *acl);
[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
/* Parse an ACL with the name starting at <args>[0], and with a list of already
* known ACLs in <acl>. If the ACL was not in the list, it will be added.
* A pointer to that ACL is returned.
*
* args syntax: <aclname> <acl_expr>
*/
MINOR: pattern: store configuration reference for each acl or map pattern. This patch permit to add reference for each pattern reference. This is useful to identify the acl listed.
2014-02-11 02:31:34 +00:00
struct acl *parse_acl(const char **args, struct list *known_acl, char **err, struct arg_list *al, const char *file, int line);
[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
/* Purge everything in the acl_cond <cond>, then return <cond>. */
struct acl_cond *prune_acl_cond(struct acl_cond *cond);
/* Parse an ACL condition starting at <args>[0], relying on a list of already
* known ACLs passed in <known_acl>. The new condition is returned (or NULL in
* case of low memory). Supports multiple conditions separated by "or".
*/
MINOR: acl/pattern: use types different from int to clarify who does what. We now have the following enums and all related functions return them and consume them : enum pat_match_res { PAT_NOMATCH = 0, /* sample didn't match any pattern */ PAT_MATCH = 3, /* sample matched at least one pattern */ }; enum acl_test_res { ACL_TEST_FAIL = 0, /* test failed */ ACL_TEST_MISS = 1, /* test may pass with more info */ ACL_TEST_PASS = 3, /* test passed */ }; enum acl_cond_pol { ACL_COND_NONE, /* no polarity set yet */ ACL_COND_IF, /* positive condition (after 'if') */ ACL_COND_UNLESS, /* negative condition (after 'unless') */ }; It's just in order to avoid doubts when reading some code.
2013-11-28 21:21:02 +00:00
struct acl_cond *parse_acl_cond(const char **args, struct list *known_acl,
MINOR: pattern: store configuration reference for each acl or map pattern. This patch permit to add reference for each pattern reference. This is useful to identify the acl listed.
2014-02-11 02:31:34 +00:00
enum acl_cond_pol pol, char **err, struct arg_list *al,
const char *file, int line);
[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
[MINOR] acl: add build_acl_cond() to make it easier to add ACLs in config This function automatically builds a rule, considering the if/unless statements, and automatically updates the proxy's acl_requires, the condition's file and line.
2010-01-28 15:48:33 +00:00
/* Builds an ACL condition starting at the if/unless keyword. The complete
* condition is returned. NULL is returned in case of error or if the first
* word is neither "if" nor "unless". It automatically sets the file name and
MEDIUM: proxy: remove acl_requires and just keep a flag "http_needed" Proxy's acl_requires was a copy of all bits taken from ACLs, but we'll get rid of ACL flags and only rely on sample fetches soon. The proxy's acl_requires was only used to allocate an HTTP context when needed, and was even forced in HTTP mode. So better have a flag which exactly says what it's supposed to be used for.
2013-03-24 06:22:08 +00:00
* the line number in the condition for better error reporting, and sets the
* HTTP initialization requirements in the proxy. If <err> is not NULL, it will
MEDIUM: acl: report parsing errors to the caller All parsing errors were known but impossible to return. Now by making use of memprintf(), we're able to build meaningful error messages that the caller can display.
2012-04-27 10:38:15 +00:00
* be set to an error message upon errors, that the caller will have to free.
[MINOR] acl: add build_acl_cond() to make it easier to add ACLs in config This function automatically builds a rule, considering the if/unless statements, and automatically updates the proxy's acl_requires, the condition's file and line.
2010-01-28 15:48:33 +00:00
*/
MINOR: acl: Pass the ACLs as an explicit parameter of build_acl_cond So it is possible to use anothers ACLs to build ACL conditions than those of proxies.
2017-09-22 12:38:56 +00:00
struct acl_cond *build_acl_cond(const char *file, int line, struct list *known_acl,
struct proxy *px, const char **args, char **err);
[MINOR] acl: add build_acl_cond() to make it easier to add ACLs in config This function automatically builds a rule, considering the if/unless statements, and automatically updates the proxy's acl_requires, the condition's file and line.
2010-01-28 15:48:33 +00:00
MEDIUM: pattern: rename "acl" prefix to "pat" This patch just renames functions, types and enums. No code was changed. A significant number of files were touched, especially the ACL arrays, so it is likely that some external patches will not apply anymore. One important thing is that we had to split ACL_PAT_* into two groups : - ACL_TEST_{PASS|MISS|FAIL} - PAT_{MATCH|UNMATCH} A future patch will enforce enums on all these places to avoid confusion.
2013-11-28 17:22:00 +00:00
/* Execute condition <cond> and return either ACL_TEST_FAIL, ACL_TEST_MISS or
* ACL_TEST_PASS depending on the test results. ACL_TEST_MISS may only be
* returned if <opt> does not contain SMP_OPT_FINAL, indicating that incomplete
* data is being examined. The function automatically sets SMP_OPT_ITERATE. This
* function only computes the condition, it does not apply the polarity required
* by IF/UNLESS, it's up to the caller to do this.
[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
*/
MAJOR: sample: pass a pointer to the session to each sample fetch function Many such function need a session, and till now they used to dereference the stream. Once we remove the stream from the embryonic session, this will not be possible anymore. So as of now, sample fetch functions will be called with this : - sess = NULL, strm = NULL : never - sess = valid, strm = NULL : tcp-req connection - sess = valid, strm = valid, strm->txn = NULL : tcp-req content - sess = valid, strm = valid, strm->txn = valid : http-req / http-res
2015-04-03 23:47:55 +00:00
enum acl_test_res acl_exec_cond(struct acl_cond *cond, struct proxy *px, struct session *sess, struct stream *strm, unsigned int opt);
[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
MAJOR: acl: convert all ACL requires to SMP use+val instead of ->requires The ACLs now use the fetch's ->use and ->val to decide upon compatibility between the place where they are used and where the information are fetched. The code is capable of reporting warnings about very fine incompatibilities between certain fetches and an exact usage location, so it is expected that some new warnings will be emitted on some existing configurations. Two degrees of detection are provided : - detecting ACLs that never match - detecting keywords that are ignored All tests show that this seems to work well, though bugs are still possible.
2013-03-25 07:12:18 +00:00
/* Returns a pointer to the first ACL conflicting with usage at place <where>
* which is one of the SMP_VAL_* bits indicating a check place, or NULL if
* no conflict is found. Only full conflicts are detected (ACL is not usable).
* Use the next function to check for useless keywords.
[MEDIUM] acl: when possible, report the name and requirements of ACLs in warnings When an ACL is referenced at a wrong place (eg: response during request, layer7 during layer4), try to indicate precisely the name and requirements of this ACL. Only the first faulty ACL is returned. A small change consisting in iterating that way may improve reports : cap = ACL_USE_any_unexpected while ((acl=cond_find_require(cond, cap))) { warning() cap &= ~acl->requires; } This will report the first ACL of each unsupported type. But doing so will mangle the error reporting a lot, so we need to rework error reports first.
2008-07-27 20:02:32 +00:00
*/
MAJOR: acl: convert all ACL requires to SMP use+val instead of ->requires The ACLs now use the fetch's ->use and ->val to decide upon compatibility between the place where they are used and where the information are fetched. The code is capable of reporting warnings about very fine incompatibilities between certain fetches and an exact usage location, so it is expected that some new warnings will be emitted on some existing configurations. Two degrees of detection are provided : - detecting ACLs that never match - detecting keywords that are ignored All tests show that this seems to work well, though bugs are still possible.
2013-03-25 07:12:18 +00:00
const struct acl *acl_cond_conflicts(const struct acl_cond *cond, unsigned int where);
/* Returns a pointer to the first ACL and its first keyword to conflict with
* usage at place <where> which is one of the SMP_VAL_* bits indicating a check
* place. Returns true if a conflict is found, with <acl> and <kw> set (if non
* null), or false if not conflict is found. The first useless keyword is
* returned.
*/
MEDIUM: acl: have a pointer to the keyword name in acl_expr The acl_expr struct used to hold a pointer to the ACL keyword. But since we now have all the relevant pointers, we don't need that anymore, we just need the pointer to the keyword as a string in order to return warnings and error messages. So let's change this in order to remove the dependency on the acl_keyword struct from acl_expr. During this change, acl_cond_kw_conflicts() used to return a pointer to an ACL keyword but had to be changed to return a const char* for the same reason.
2013-03-31 20:59:32 +00:00
int acl_cond_kw_conflicts(const struct acl_cond *cond, unsigned int where, struct acl const **acl, char const **kw);
[MEDIUM] acl: when possible, report the name and requirements of ACLs in warnings When an ACL is referenced at a wrong place (eg: response during request, layer7 during layer4), try to indicate precisely the name and requirements of this ACL. Only the first faulty ACL is returned. A small change consisting in iterating that way may improve reports : cap = ACL_USE_any_unexpected while ((acl=cond_find_require(cond, cap))) { warning() cap &= ~acl->requires; } This will report the first ACL of each unsupported type. But doing so will mangle the error reporting a lot, so we need to rework error reports first.
2008-07-27 20:02:32 +00:00
[MINOR] acl: add http_auth and http_auth_group Add two acls to match http auth data: acl <name> http_auth(userlist) acl <name> http_auth_hroup(userlist) group1 group2 (...)
2010-01-29 18:26:18 +00:00
/*
* Find targets for userlist and groups in acl. Function returns the number
* of errors or OK if everything is fine.
*/
int acl_find_targets(struct proxy *p);
[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
/* Return a pointer to the ACL <name> within the list starting at <head>, or
* NULL if not found.
*/
struct acl *find_acl_by_name(const char *name, struct list *head);
/*
* Registers the ACL keyword list <kwl> as a list of valid keywords for next
* parsing sessions.
*/
void acl_register_keywords(struct acl_kw_list *kwl);
/*
* Unregisters the ACL keyword list <kwl> from the list of valid keywords.
*/
void acl_unregister_keywords(struct acl_kw_list *kwl);
MAJOR: acl: make all ACLs reference the fetch function via a sample. ACL fetch functions used to directly reference a fetch function. Now that all ACL fetches have their sample fetches equivalent, we can make ACLs reference a sample fetch keyword instead. In order to simplify the code, a sample keyword name may be NULL if it is the same as the ACL's, which is the most common case. A minor change appeared, http_auth always expects one argument though the ACL allowed it to be missing and reported as such afterwards, so fix the ACL to match this. This is not really a bug.
2013-01-11 14:49:37 +00:00
/* initializes ACLs by resolving the sample fetch names they rely upon.
* Returns 0 on success, otherwise an error.
*/
int init_acl();
[MAJOR] new framework for generic ACL support This framework offers all other subsystems the ability to register ACL matching criteria. Some generic matching functions are already provided. Others will come soon and the framework shall evolve.
2007-05-06 22:36:48 +00:00
#endif /* _PROTO_ACL_H */
/*
* Local variables:
* c-indent-level: 8
* c-basic-offset: 8
* End:
*/