diff --git a/include/types/pattern.h b/include/types/pattern.h index 3ee18cb6be..c5b19ada1c 100644 --- a/include/types/pattern.h +++ b/include/types/pattern.h @@ -59,6 +59,7 @@ enum { SMP_OPT_DIR_RES = 1, /* direction = response */ SMP_OPT_DIR = (SMP_OPT_DIR_REQ|SMP_OPT_DIR_RES), /* mask to get direction */ SMP_OPT_FINAL = 2, /* final fetch, contents won't change anymore */ + SMP_OPT_ITERATE = 4, /* fetches may be iterated if supported (for ACLs) */ }; /* Flags used to describe fetched samples. MAY_CHANGE indicates that the result diff --git a/src/acl.c b/src/acl.c index 1267ec30b2..8f76286ed0 100644 --- a/src/acl.c +++ b/src/acl.c @@ -1682,7 +1682,7 @@ struct acl_cond *build_acl_cond(const char *file, int line, struct proxy *px, co /* Execute condition and return either ACL_PAT_FAIL, ACL_PAT_MISS or * ACL_PAT_PASS depending on the test results. ACL_PAT_MISS may only be * returned if does not contain SMP_OPT_FINAL, indicating that incomplete - * data is being examined. + * data is being examined. The function automatically sets SMP_OPT_ITERATE. * This function only computes the condition, it does not apply the polarity * required by IF/UNLESS, it's up to the caller to do this using something like * this : @@ -1704,6 +1704,11 @@ int acl_exec_cond(struct acl_cond *cond, struct proxy *px, struct session *l4, v struct sample smp; int acl_res, suite_res, cond_res; + /* ACLs are iterated over all values, so let's always set the flag to + * indicate this to the fetch functions. + */ + opt |= SMP_OPT_ITERATE; + /* We're doing a logical OR between conditions so we initialize to FAIL. * The MISS status is propagated down from the suites. */