fgsch at lodoss
Mar 20, 2012, 6:23 AM
Post #2 of 3
(223 views)
Permalink
|
On Tue, 20 Mar 2012 11:36:40 +0000
"Federico G. Schwindt" <fgsch [at] lodoss> wrote:
> Hi,
>
> The code below adds the function ip to the std vmod allowing to use strings for acl matching.
> I will update the documentation later today.
> Comments?
Updated version with improved test and documentation.
f.-
bin/varnishtest/tests/m00008.vtc | 41 ++++++++++++++++++++++++++++++++
doc/sphinx/reference/vmod_std.rst | 12 +++++++++
lib/libvcl/vcc_acl.c | 4 +++
lib/libvmod_std/vmod.vcc | 1 +
lib/libvmod_std/vmod_std_conversions.c | 23 ++++++++++++++++++
5 files changed, 81 insertions(+), 0 deletions(-)
diff --git a/bin/varnishtest/tests/m00008.vtc b/bin/varnishtest/tests/m00008.vtc
new file mode 100644
index 0000000..23df8b7
--- /dev/null
+++ b/bin/varnishtest/tests/m00008.vtc
@@ -0,0 +1,41 @@
+varnishtest "test vmod_std.ip conversion"
+
+server s1 {
+ rxreq
+ expect req.url == "/"
+ txresp
+
+ rxreq
+ expect req.url == "foo"
+ txresp
+
+ rxreq
+ expect req.url == "foo"
+ txresp
+} -start
+
+varnish v1 -vcl+backend {
+ import std from "${topbuild}/lib/libvmod_std/.libs/libvmod_std.so";
+
+ acl acl1 {
+ "localhost";
+ }
+
+ sub vcl_recv {
+ if (std.ip(req.http.ip) ~ acl1) {
+ set req.url = "/";
+ }
+ return (pass);
+ }
+} -start
+
+client c1 {
+ txreq -url "foo" -hdr "ip: 127.0.0.1"
+ rxresp
+
+ txreq -url "foo" -hdr "ip: unexistent"
+ rxresp
+
+ txreq -url "foo" -hdr "ip: 10.1.2.3"
+ rxresp
+} -run
diff --git a/doc/sphinx/reference/vmod_std.rst b/doc/sphinx/reference/vmod_std.rst
index a1ece16..474e158 100644
--- a/doc/sphinx/reference/vmod_std.rst
+++ b/doc/sphinx/reference/vmod_std.rst
@@ -151,6 +151,18 @@ Example
This will collapse several Cookie: headers into one, long
cookie header.
+ip
+--
+Prototype
+ ip(STRING s)
+Return value
+ IP
+Description
+ Converts the string *s* representing an IP address to a format
+ suitable to match against an ACL.
+ If *s* fails to parse the match will always fail.
+Example
+ if (std.ip(req.http.x-foo) ~ some_acl) { ... }
SEE ALSO
========
diff --git a/lib/libvcl/vcc_acl.c b/lib/libvcl/vcc_acl.c
index e6a1065..a4f3229 100644
--- a/lib/libvcl/vcc_acl.c
+++ b/lib/libvcl/vcc_acl.c
@@ -361,6 +361,10 @@ vcc_acl_emit(const struct vcc *tl, const char *acln, int anon)
c_is_a_silly_language(tl);
Fh(tl, 0, "\n");
+ Fh(tl, 0, "\tif (!p) {\n");
+ Fh(tl, 0, "\t\tVRT_acl_log(sp, \"NO_P %s\");\n", acln);
+ Fh(tl, 0, "\t\treturn(0);\n");
+ Fh(tl, 0, "\t}\n\n");
Fh(tl, 0, "\ta = p;\n");
Fh(tl, 0, "\tVRT_memmove(&fam, a + %zd, sizeof fam);\n",
offsetof(struct sockaddr, sa_family));
diff --git a/lib/libvmod_std/vmod.vcc b/lib/libvmod_std/vmod.vcc
index 0a71e5b..b411cac 100644
--- a/lib/libvmod_std/vmod.vcc
+++ b/lib/libvmod_std/vmod.vcc
@@ -38,3 +38,4 @@ Function STRING author(ENUM { phk, des, kristian, mithrandir })
Function DURATION duration(STRING, DURATION)
Function INT integer(STRING, INT)
Function VOID collect(HEADER)
+Function IP ip(STRING)
diff --git a/lib/libvmod_std/vmod_std_conversions.c b/lib/libvmod_std/vmod_std_conversions.c
index 149be81..aa85717 100644
--- a/lib/libvmod_std/vmod_std_conversions.c
+++ b/lib/libvmod_std/vmod_std_conversions.c
@@ -29,8 +29,11 @@
#include "config.h"
+#include <sys/types.h>
+#include <sys/socket.h>
#include <ctype.h>
#include <math.h>
+#include <netdb.h>
#include <stdlib.h>
#include "cache/cache.h"
@@ -117,3 +120,23 @@ vmod_integer(struct sess *sp, const char *p, int i)
return (r);
}
+
+struct sockaddr_storage * __match_proto__()
+vmod_ip(struct sess *sp, const char *hostname)
+{
+ struct sockaddr_storage *addr;
+ struct addrinfo hint, *res;
+
+ CHECK_OBJ_NOTNULL(sp, SESS_MAGIC);
+
+ memset(&hint, 0, sizeof(hint));
+ hint.ai_family = PF_UNSPEC;
+ hint.ai_socktype = SOCK_STREAM;
+ hint.ai_flags = AI_NUMERICHOST;
+ if (getaddrinfo(hostname, NULL, &hint, &res))
+ return (NULL);
+ addr = (void *)WS_Alloc(sp->req->ws, sizeof *addr);
+ memcpy(addr, res->ai_addr, sizeof *addr);
+ freeaddrinfo(res);
+ return (addr);
+}
_______________________________________________
varnish-dev mailing list
varnish-dev [at] varnish-cache
https://www.varnish-cache.org/lists/mailman/listinfo/varnish-dev
|
