RepoMirrors/haproxy
1
0
Fork 0
mirror of http://git.haproxy.org/git/haproxy.git/ synced 2025-05-02 07:48:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

BUG/MINOR: http-ana: Apply stop to the current section for http-response rules

Browse Source 
A TCP/HTTP action can stop the rules evaluation. However, it should be
applied on the current section only. For instance, for http-requests rules,
an "allow" on a frontend must stop evaluation of rules defined in this
frontend. But the backend rules, if any, must still be evaluated.

For http-response rulesets, according the configuration manual, the same
must be true. Only "allow" action is concerned. However, since the
beginning, this action stops evaluation of all remaining rules, not only
those of the current section.

This patch may be backported to all supported versions. But it is not so
critical because the bug exists since a while. I doubt it will break any
existing configuration because the current behavior is
counterintuitive.
This commit is contained in:
Christopher Faulet 2021-11-09 16:33:25 +01:00
parent 15ae22c02c
commit 46f46df300
2 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
reg-tests/http-rules/h1or2_to_h1c.vtc
View File

@ -160,6 +160,8 @@ haproxy h1 -conf {
http-response set-header sl1-crc "%[res.fhdr(sl1),crc32]"
http-response set-header sl2-crc "%[res.fhdr(sl2),crc32]"
http-response set-header hdr-crc "%[res.fhdr(hdr),crc32]"
http-response allow
http-response deny # must not be evaluated
server s1 ${s1_addr}:${s1_port}
} -start

2
src/http_ana.c
View File

@ -1815,7 +1815,7 @@ int http_process_res_common(struct stream *s, struct channel *rep, int an_bit, s
while (1) {
/* evaluate http-response rules */
if (ret == HTTP_RULE_RES_CONT) {
if (ret == HTTP_RULE_RES_CONT || ret == HTTP_RULE_RES_STOP) {
struct list *def_rules, *rules;
def_rules = ((cur_proxy->defpx && (cur_proxy == s->be || cur_proxy->defpx != s->be->defpx)) ? &cur_proxy->defpx->http_res_rules : NULL);