18 Commits

Author	SHA1	Message	Date
Willy Tarreau	38d25d2a19	MEDIUM: acl: fix pattern type for payload / payload_lv ... Since commit 0ce3aa0c ("MEDIUM: acl: implement payload and payload_lv"), the payload and payload_lv ACL patterns were declared as strings because at this date there was no support for binary patterns. At this time, these ACLs were not reliably usable due to the binary-to-string cast involved, and because it was not possible to specify the direction of the match. Since recent evolutions, the new fetch methods "req.payload" and "res.payload" have leveraged the ambiguity and were of type "binary", with an implicit ACL mapping of the same type. The doc also states that "payload" is an alias for "req.payload" etc... while these two don't share the same type. Better fix this mess before it's too late. "payload" and "payload_lv" return a binary content, so their ACLs must by default use a binary pattern. That way they behave like their "req." and "res." sisters. This change might break some configs making use of these, but there's almost a zero probability that anyone managed to use them to match exact strings, so in practice the change should be safe.	2014-02-24 19:01:37 +01:00
Thierry FOURNIER	e7054c7177	BUG/MINOR: payload: the patterns of the acl "req.ssl_ver" are no parsed with the good function. ... The fetch "req.ssl_ver" is not declared as explicit acl. If it is used as implicit ACL, the acl engine detect SMP_T_UINT output type and choose to use the default interger parser: pat_parse_int(). This fetch needs the parser pat_parse_dotted_ver(). This patch declare explicit ACL named "req.ssl_ver" that use the good parser function pat_parse_dotted_ver().	2014-01-25 02:50:58 +01:00
Willy Tarreau	b169eba58d	BUG/MEDIUM: http: cook_cnt() forgets to set its output type ... Since comit b805f71 (MEDIUM: sample: let the cast functions set their output type), the output type of a fetch function is automatically considered and passed to the next converter. A bug introduced in 1.5-dev9 with commit f853c46 (MEDIUM: pattern/acl: get rid of temp_pattern in ACLs) was revealed by this last one : the output type remained string instead of UINT, causing the cast function to try to cast the contents and to crash on a NULL deref. Note: this fix was made after a careful review of all fetch functions. A few non-trivial ones had their comments amended to clearly indicate the output type.	2013-12-16 15:21:29 +01:00
Thierry FOURNIER	a65b343eee	MEDIUM: pattern: rename "acl" prefix to "pat" ... This patch just renames functions, types and enums. No code was changed. A significant number of files were touched, especially the ACL arrays, so it is likely that some external patches will not apply anymore. One important thing is that we had to split ACL_PAT_* into two groups : - ACL_TEST_{PASS|MISS|FAIL} - PAT_{MATCH|UNMATCH} A future patch will enforce enums on all these places to avoid confusion.	2013-12-02 23:31:33 +01:00
Thierry FOURNIER	ed66c297c2	REORG: acl/pattern: extract pattern matching from the acl file and create pattern.c ... This patch just moves code without any change. The ACL are just the association between sample and pattern. The pattern contains the match method and the parse method. These two things are different. This patch cleans the code by splitting it.	2013-12-02 23:31:33 +01:00
Willy Tarreau	47e8eba9a7	MINOR: payload: provide the "res.len" fetch method ... This fetch method returns the response buffer len, similarly to req.len for the request. Previously it was only possible to rely on "res.payload(0,size) -m found" to find if at least that amount of data was available, which was a bit tricky.	2013-09-11 23:28:51 +02:00
Willy Tarreau	00f0084752	MINOR: payload: allow the payload sample fetches to retrieve arbitrary lengths ... When using req.payload and res.payload to look up for specific content at an arbitrary location, we're often facing the problem of not knowing the input buffer length. If the length argument is larger than the buffer length, the function did not match, and if they're smaller, there is a risk of not getting the expected content. This is especially true when looking for data in SOAP requests. So let's make some provisions for scanning the whole buffer by specifying a length of 0 bytes. This greatly simplifies the processing of random-sized input data.	2013-08-02 11:07:32 +02:00
Willy Tarreau	cadd8c9ec3	MINOR: payload: split smp_fetch_rdp_cookie() ... This function is also called directly from backend.c, so let's stop building fake args to call it as a sample fetch, and have a lower layer more generic function instead.	2013-08-01 21:17:13 +02:00
Willy Tarreau	ef38c39287	MEDIUM: sample: systematically pass the keyword pointer to the keyword ... We're having a lot of duplicate code just because of minor variants between fetch functions that could be dealt with if the functions had the pointer to the original keyword, so let's pass it as the last argument. An earlier version used to pass a pointer to the sample_fetch element, but this is not the best solution for two reasons : - fetch functions will solely rely on the keyword string - some other smp_fetch_* users do not have the pointer to the original keyword and were forced to pass NULL. So finally we're passing a pointer to the keyword as a const char *, which perfectly fits the original purpose.	2013-08-01 21:17:13 +02:00
Willy Tarreau	dc13c11c1e	BUG/MEDIUM: prevent gcc from moving empty keywords lists into BSS ... Benoit Dolez reported a failure to start haproxy 1.5-dev19. The process would immediately report an internal error with missing fetches from some crap instead of ACL names. The cause is that some versions of gcc seem to trim static structs containing a variable array when moving them to BSS, and only keep the fixed size, which is just a list head for all ACL and sample fetch keywords. This was confirmed at least with gcc 3.4.6. And we can't move these structs to const because they contain a list element which is needed to link all of them together during the parsing. The bug indeed appeared with 1.5-dev19 because it's the first one to have some empty ACL keyword lists. One solution is to impose -fno-zero-initialized-in-bss to everyone but this is not really nice. Another solution consists in ensuring the struct is never empty so that it does not move there. The easy solution consists in having a non-null list head since it's not yet initialized. A new "ILH" list head type was thus created for this purpose : create an Initialized List Head so that gcc cannot move the struct to BSS. This fixes the issue for this version of gcc and does not create any burden for the declarations.	2013-06-21 23:29:02 +02:00
Willy Tarreau	c32484ed35	MEDIUM: acl: remove 15 additional useless ACLs that are equivalent to their fetches ... The following 15 ACLs were missed from previous review, and are not needed either. hdr_cnt, hdr_ip, hdr_val, rep_ssl_hello_type, req_len, req_ssl_hello_type, scook_cnt, scook_val, shdr_cnt, shdr_ip, shdr_val, url_ip, url_port, urlp_val, req_proto_http.	2013-06-12 22:23:40 +02:00
Willy Tarreau	6d4e4e8dd2	MEDIUM: acl: remove a lot of useless ACLs that are equivalent to their fetches ... The following 116 ACLs were removed because they're redundant with their fetch function since last commit which allows the fetch function to be used instead for types BOOL, INT and IP. Most places are now left with an empty ACL keyword list that was not removed so that it's easier to add other ACLs later. always_false, always_true, avg_queue, be_conn, be_id, be_sess_rate, connslots, nbsrv, queue, srv_conn, srv_id, srv_is_up, srv_sess_rate, res.comp, fe_conn, fe_id, fe_sess_rate, dst_conn, so_id, wait_end, http_auth, http_first_req, status, dst, dst_port, src, src_port, sc1_bytes_in_rate, sc1_bytes_out_rate, sc1_clr_gpc0, sc1_conn_cnt, sc1_conn_cur, sc1_conn_rate, sc1_get_gpc0, sc1_gpc0_rate, sc1_http_err_cnt, sc1_http_err_rate, sc1_http_req_cnt, sc1_http_req_rate, sc1_inc_gpc0, sc1_kbytes_in, sc1_kbytes_out, sc1_sess_cnt, sc1_sess_rate, sc1_tracked, sc1_trackers, sc2_bytes_in_rate, sc2_bytes_out_rate, sc2_clr_gpc0, sc2_conn_cnt, sc2_conn_cur, sc2_conn_rate, sc2_get_gpc0, sc2_gpc0_rate, sc2_http_err_cnt, sc2_http_err_rate, sc2_http_req_cnt, sc2_http_req_rate, sc2_inc_gpc0, sc2_kbytes_in, sc2_kbytes_out, sc2_sess_cnt, sc2_sess_rate, sc2_tracked, sc2_trackers, sc3_bytes_in_rate, sc3_bytes_out_rate, sc3_clr_gpc0, sc3_conn_cnt, sc3_conn_cur, sc3_conn_rate, sc3_get_gpc0, sc3_gpc0_rate, sc3_http_err_cnt, sc3_http_err_rate, sc3_http_req_cnt, sc3_http_req_rate, sc3_inc_gpc0, sc3_kbytes_in, sc3_kbytes_out, sc3_sess_cnt, sc3_sess_rate, sc3_tracked, sc3_trackers, src_bytes_in_rate, src_bytes_out_rate, src_clr_gpc0, src_conn_cnt, src_conn_cur, src_conn_rate, src_get_gpc0, src_gpc0_rate, src_http_err_cnt, src_http_err_rate, src_http_req_cnt, src_http_req_rate, src_inc_gpc0, src_kbytes_in, src_kbytes_out, src_sess_cnt, src_sess_rate, src_updt_conn_cnt, table_avl, table_cnt, ssl_c_ca_err, ssl_c_ca_err_depth, ssl_c_err, ssl_c_used, ssl_c_verify, ssl_c_version, ssl_f_version, ssl_fc, ssl_fc_alg_keysize, ssl_fc_has_crt, ssl_fc_has_sni, ssl_fc_use_keysize,	2013-06-11 21:22:58 +02:00
Willy Tarreau	d86e29d2a1	CLEANUP: acl: remove unused references to ACL_USE_* ... Now that acl->requires is not used anymore, we can remove all references to it as well as all ACL_USE_* flags.	2013-04-03 02:13:00 +02:00
Willy Tarreau	fa95734840	MINOR: payload: add new direction-explicit sample fetches ... Similarly to previous commit fixing "hdr" and "cookie" in HTTP, we have to deal with "payload" and "payload_lv" which are request-only for ACLs and req/resp for sample fetches depending on the context, and to a less extent with other req_* and rep_*/rep_* fetches. So let's add explicit "req." and "res." variants and make the ACLs rely on that instead.	2013-04-03 02:12:59 +02:00
Willy Tarreau	9baae63d8d	MAJOR: acl: remove fetch argument validation from the ACL struct ... ACL fetch being inherited from the sample fetch keyword, we don't need anymore to specify what function to use to validate the fetch arguments. Note that the job is still done in the ACL parsing code based on elements from the sample fetch structs.	2013-04-03 02:12:59 +02:00
Willy Tarreau	c48c90dfa5	MAJOR: acl: remove the arg_mask from the ACL definition and use the sample fetch's ... Now that ACLs solely rely on sample fetch functions, make them use the same arg mask. All inconsistencies have been fixed separately prior to this patch, so this patch almost only adds a new pointer indirection and removes all references to ARG*() in the definitions. The parsing is still performed by the ACL code though.	2013-04-03 02:12:58 +02:00
Willy Tarreau	8ed669b12a	MAJOR: acl: make all ACLs reference the fetch function via a sample. ... ACL fetch functions used to directly reference a fetch function. Now that all ACL fetches have their sample fetches equivalent, we can make ACLs reference a sample fetch keyword instead. In order to simplify the code, a sample keyword name may be NULL if it is the same as the ACL's, which is the most common case. A minor change appeared, http_auth always expects one argument though the ACL allowed it to be missing and reported as such afterwards, so fix the ACL to match this. This is not really a bug.	2013-04-03 02:12:58 +02:00
Willy Tarreau	d4c33c8889	MEDIUM: samples: move payload-based fetches and ACLs to their own file ... The file acl.c is a real mess, it both contains functions to parse and process ACLs, and some sample extraction functions which act on buffers. Some other payload analysers were arbitrarily dispatched to proto_tcp.c. So now we're moving all payload-based fetches and ACLs to payload.c which is capable of extracting data from buffers and rely on everything that is protocol-independant. That way we can safely inflate this file and only use the other ones when some fetches are really specific (eg: HTTP, SSL, ...). As a result of this cleanup, the following new sample fetches became available even if they're not really useful : always_false, always_true, rep_ssl_hello_type, rdp_cookie_cnt, req_len, req_ssl_hello_type, req_ssl_sni, req_ssl_ver, wait_end The function 'acl_fetch_nothing' was wrong and never used anywhere so it was removed. The "rdp_cookie" sample fetch used to have a mandatory argument while it was optional in ACLs, which are supposed to iterate over RDP cookies. So we're making it optional as a fetch too, and it will return the first one.	2013-04-03 02:12:57 +02:00