You are viewing a plain text version of this content. The canonical link for it is here.
Posted to github@trafficserver.apache.org by "masaori335 (via GitHub)" <gi...@apache.org> on 2024/06/14 00:54:03 UTC
[PR] Doc: Clarification of ACL filters [trafficserver]
masaori335 opened a new pull request, #11448:
URL: https://github.com/apache/trafficserver/pull/11448
Describe ACL filters with https://github.com/apache/trafficserver/pull/11433. Separated PR to do not block the PR by documentation change.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Doc: Clarification of ACL filters [trafficserver]
Posted by "masaori335 (via GitHub)" <gi...@apache.org>.
masaori335 commented on code in PR #11448:
URL: https://github.com/apache/trafficserver/pull/11448#discussion_r1650467539
##########
doc/admin-guide/files/remap.config.en.rst:
##########
@@ -518,20 +514,95 @@ mapping rules. (It is activated before any mappings and is never
deactivated.) The filter `local_only` will only be applied to the
second mapping.
-Implict IPAllow filter
-======================
+Special Filter and ip_allow Named Filter
+----------------------------------------
+
+If :file:`ip_allow.yaml` has a "deny all" filter, it is treated as a special filter that is applied before remapping for
+optimizaion. To control this for specific remap rules, a named filter called `ip_allow` is pre-defined. This named filter is
+activated implicitly in default. To stop applying the special rule, disable the `ip_allow` filter as shown below.
+
+::
-To allow control of :ref:`IP Allow<ip-allow>` it is treated as an implicitly active and named
-filter. When this filter is active IP Allow checks are done before remap. To prevent this for
-specific remap rules, this filter, named "ip_allow", must be disabled. The common way of doing this
-would be ::
+ # ip_allow.yaml
+ ip_allow:
+ - apply: in
+ ip_addrs: 198.51.100.0/24
+ action: deny
+ method: ALL
+ # remap.config
.deactivatefilter ip_allow
map ...
map ...
.activatefilter ip_allow
-Note this entirely disables IP Allow checks for those remap rules.
+Note this entirely disables :file:`ip_allow.yaml` checks for those remap rules.
+
+Evaluation Order and Matching Policy
+------------------------------------
+
+ATS evaluates multiple ACL filters in the following order:
+
+1. Special "deny all" filter in :file:`ip_allow.yaml`
+2. In-line Filter in :file:`remap.config`
+3. Named Filter in :file:`remap.config`
+4. Filters in :file:`ip_allow.yaml`
+
+When an ACL filter is found, ATS stops processing ACL filters depending on the mathcing policy configured by
+:ts:cv:`proxy.config.url_remap.acl_matching_policy`.
+
+First Explicit Match Wins Policy
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Review Comment:
After I considered naming for a while, I start calling them "Match on IP and Method Policy" and "Match on IP only Policy".
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Doc: Clarification of ACL filters [trafficserver]
Posted by "masaori335 (via GitHub)" <gi...@apache.org>.
masaori335 commented on code in PR #11448:
URL: https://github.com/apache/trafficserver/pull/11448#discussion_r1650210406
##########
doc/admin-guide/files/remap.config.en.rst:
##########
@@ -518,20 +514,95 @@ mapping rules. (It is activated before any mappings and is never
deactivated.) The filter `local_only` will only be applied to the
second mapping.
-Implict IPAllow filter
-======================
+Special Filter and ip_allow Named Filter
+----------------------------------------
+
+If :file:`ip_allow.yaml` has a "deny all" filter, it is treated as a special filter that is applied before remapping for
+optimizaion. To control this for specific remap rules, a named filter called `ip_allow` is pre-defined. This named filter is
+activated implicitly in default. To stop applying the special rule, disable the `ip_allow` filter as shown below.
+
+::
-To allow control of :ref:`IP Allow<ip-allow>` it is treated as an implicitly active and named
-filter. When this filter is active IP Allow checks are done before remap. To prevent this for
-specific remap rules, this filter, named "ip_allow", must be disabled. The common way of doing this
-would be ::
+ # ip_allow.yaml
+ ip_allow:
+ - apply: in
+ ip_addrs: 198.51.100.0/24
+ action: deny
+ method: ALL
+ # remap.config
.deactivatefilter ip_allow
map ...
map ...
.activatefilter ip_allow
-Note this entirely disables IP Allow checks for those remap rules.
+Note this entirely disables :file:`ip_allow.yaml` checks for those remap rules.
+
+Evaluation Order and Matching Policy
+------------------------------------
+
+ATS evaluates multiple ACL filters in the following order:
+
+1. Special "deny all" filter in :file:`ip_allow.yaml`
+2. In-line Filter in :file:`remap.config`
+3. Named Filter in :file:`remap.config`
+4. Filters in :file:`ip_allow.yaml`
+
+When an ACL filter is found, ATS stops processing ACL filters depending on the mathcing policy configured by
+:ts:cv:`proxy.config.url_remap.acl_matching_policy`.
+
+First Explicit Match Wins Policy
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This is the default matching policy. ATS stops processing ACL filters only if an explicit match of IP address and HTTP method is
+found.
+
+::
+
+ # ip_allow.yaml
+ ip_allow:
+ - apply: in
+ ip_addrs: 198.51.100.0/24
+ action: deny
+ method: PUT
+
+ # remap.config
+ .definefilter named-filter-1 @action=deny @method=HEAD
+ .definefilter named-filter-2 @actio==allow @method=POST
+
+ .activatefilter named-filter-1
+ .activatefilter named-filter-2
+
+ map http://www.example.com/ http://internal.example.com/ @action=deny @method=GET
+
+The result of this example is below. The evaluation applied from left to right until explicit match is found.
+
+====== ================ ================ ================ ================ =============
+Method In-line Filter Named Filter 1 Named Filter 2 ip_allow.yaml result
+====== ================ ================ ================ ================ =============
+GET deny (explicit) \- \- \- denied (403)
+HEAD allow (implicit) deny (explicit) \- \- denied (403)
+POST allow (implicit) allow (implicit) allow (explicit) \- allowed (200)
+PUT allow (implicit) allow (implicit) deny (implicit) deny (explicit) denied (403)
+DELETE allow (implicit) allow (implicit) deny (implicit) allow (implicit) allowed (200)
+====== ================ ================ ================ ================ =============
Review Comment:
I tweaked table a bit. PTAL.
##########
doc/admin-guide/files/remap.config.en.rst:
##########
@@ -518,20 +514,95 @@ mapping rules. (It is activated before any mappings and is never
deactivated.) The filter `local_only` will only be applied to the
second mapping.
-Implict IPAllow filter
-======================
+Special Filter and ip_allow Named Filter
+----------------------------------------
+
+If :file:`ip_allow.yaml` has a "deny all" filter, it is treated as a special filter that is applied before remapping for
+optimizaion. To control this for specific remap rules, a named filter called `ip_allow` is pre-defined. This named filter is
+activated implicitly in default. To stop applying the special rule, disable the `ip_allow` filter as shown below.
+
+::
-To allow control of :ref:`IP Allow<ip-allow>` it is treated as an implicitly active and named
-filter. When this filter is active IP Allow checks are done before remap. To prevent this for
-specific remap rules, this filter, named "ip_allow", must be disabled. The common way of doing this
-would be ::
+ # ip_allow.yaml
+ ip_allow:
+ - apply: in
+ ip_addrs: 198.51.100.0/24
+ action: deny
+ method: ALL
+ # remap.config
.deactivatefilter ip_allow
map ...
map ...
.activatefilter ip_allow
-Note this entirely disables IP Allow checks for those remap rules.
+Note this entirely disables :file:`ip_allow.yaml` checks for those remap rules.
+
+Evaluation Order and Matching Policy
+------------------------------------
+
+ATS evaluates multiple ACL filters in the following order:
+
+1. Special "deny all" filter in :file:`ip_allow.yaml`
+2. In-line Filter in :file:`remap.config`
+3. Named Filter in :file:`remap.config`
+4. Filters in :file:`ip_allow.yaml`
+
+When an ACL filter is found, ATS stops processing ACL filters depending on the mathcing policy configured by
+:ts:cv:`proxy.config.url_remap.acl_matching_policy`.
+
+First Explicit Match Wins Policy
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This is the default matching policy. ATS stops processing ACL filters only if an explicit match of IP address and HTTP method is
+found.
+
+::
+
+ # ip_allow.yaml
+ ip_allow:
+ - apply: in
+ ip_addrs: 198.51.100.0/24
+ action: deny
+ method: PUT
+
+ # remap.config
+ .definefilter named-filter-1 @action=deny @method=HEAD
+ .definefilter named-filter-2 @actio==allow @method=POST
+
+ .activatefilter named-filter-1
+ .activatefilter named-filter-2
+
+ map http://www.example.com/ http://internal.example.com/ @action=deny @method=GET
+
+The result of this example is below. The evaluation applied from left to right until explicit match is found.
+
+====== ================ ================ ================ ================ =============
+Method In-line Filter Named Filter 1 Named Filter 2 ip_allow.yaml result
+====== ================ ================ ================ ================ =============
+GET deny (explicit) \- \- \- denied (403)
+HEAD allow (implicit) deny (explicit) \- \- denied (403)
+POST allow (implicit) allow (implicit) allow (explicit) \- allowed (200)
+PUT allow (implicit) allow (implicit) deny (implicit) deny (explicit) denied (403)
+DELETE allow (implicit) allow (implicit) deny (implicit) allow (implicit) allowed (200)
+====== ================ ================ ================ ================ =============
Review Comment:
I tweaked the table a bit. PTAL.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Doc: Clarification of ACL filters [trafficserver]
Posted by "masaori335 (via GitHub)" <gi...@apache.org>.
masaori335 commented on code in PR #11448:
URL: https://github.com/apache/trafficserver/pull/11448#discussion_r1650209377
##########
doc/admin-guide/files/remap.config.en.rst:
##########
@@ -518,20 +514,95 @@ mapping rules. (It is activated before any mappings and is never
deactivated.) The filter `local_only` will only be applied to the
second mapping.
-Implict IPAllow filter
-======================
+Special Filter and ip_allow Named Filter
+----------------------------------------
+
+If :file:`ip_allow.yaml` has a "deny all" filter, it is treated as a special filter that is applied before remapping for
+optimizaion. To control this for specific remap rules, a named filter called `ip_allow` is pre-defined. This named filter is
+activated implicitly in default. To stop applying the special rule, disable the `ip_allow` filter as shown below.
+
+::
-To allow control of :ref:`IP Allow<ip-allow>` it is treated as an implicitly active and named
-filter. When this filter is active IP Allow checks are done before remap. To prevent this for
-specific remap rules, this filter, named "ip_allow", must be disabled. The common way of doing this
-would be ::
+ # ip_allow.yaml
+ ip_allow:
+ - apply: in
+ ip_addrs: 198.51.100.0/24
+ action: deny
+ method: ALL
+ # remap.config
.deactivatefilter ip_allow
map ...
map ...
.activatefilter ip_allow
-Note this entirely disables IP Allow checks for those remap rules.
+Note this entirely disables :file:`ip_allow.yaml` checks for those remap rules.
+
+Evaluation Order and Matching Policy
+------------------------------------
+
+ATS evaluates multiple ACL filters in the following order:
+
+1. Special "deny all" filter in :file:`ip_allow.yaml`
+2. In-line Filter in :file:`remap.config`
+3. Named Filter in :file:`remap.config`
+4. Filters in :file:`ip_allow.yaml`
+
+When an ACL filter is found, ATS stops processing ACL filters depending on the mathcing policy configured by
+:ts:cv:`proxy.config.url_remap.acl_matching_policy`.
+
+First Explicit Match Wins Policy
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This is the default matching policy. ATS stops processing ACL filters only if an explicit match of IP address and HTTP method is
+found.
+
+::
+
+ # ip_allow.yaml
+ ip_allow:
+ - apply: in
+ ip_addrs: 198.51.100.0/24
+ action: deny
+ method: PUT
+
+ # remap.config
+ .definefilter named-filter-1 @action=deny @method=HEAD
+ .definefilter named-filter-2 @actio==allow @method=POST
Review Comment:
Nice catch! Fixed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Doc: Clarification of ACL filters [trafficserver]
Posted by "masaori335 (via GitHub)" <gi...@apache.org>.
masaori335 commented on code in PR #11448:
URL: https://github.com/apache/trafficserver/pull/11448#discussion_r1650212127
##########
doc/admin-guide/files/remap.config.en.rst:
##########
@@ -518,20 +514,95 @@ mapping rules. (It is activated before any mappings and is never
deactivated.) The filter `local_only` will only be applied to the
second mapping.
-Implict IPAllow filter
-======================
+Special Filter and ip_allow Named Filter
+----------------------------------------
+
+If :file:`ip_allow.yaml` has a "deny all" filter, it is treated as a special filter that is applied before remapping for
+optimizaion. To control this for specific remap rules, a named filter called `ip_allow` is pre-defined. This named filter is
+activated implicitly in default. To stop applying the special rule, disable the `ip_allow` filter as shown below.
+
+::
-To allow control of :ref:`IP Allow<ip-allow>` it is treated as an implicitly active and named
-filter. When this filter is active IP Allow checks are done before remap. To prevent this for
-specific remap rules, this filter, named "ip_allow", must be disabled. The common way of doing this
-would be ::
+ # ip_allow.yaml
+ ip_allow:
+ - apply: in
+ ip_addrs: 198.51.100.0/24
+ action: deny
+ method: ALL
+ # remap.config
.deactivatefilter ip_allow
map ...
map ...
.activatefilter ip_allow
-Note this entirely disables IP Allow checks for those remap rules.
+Note this entirely disables :file:`ip_allow.yaml` checks for those remap rules.
+
+Evaluation Order and Matching Policy
+------------------------------------
+
+ATS evaluates multiple ACL filters in the following order:
+
+1. Special "deny all" filter in :file:`ip_allow.yaml`
+2. In-line Filter in :file:`remap.config`
+3. Named Filter in :file:`remap.config`
+4. Filters in :file:`ip_allow.yaml`
+
+When an ACL filter is found, ATS stops processing ACL filters depending on the mathcing policy configured by
+:ts:cv:`proxy.config.url_remap.acl_matching_policy`.
+
+First Explicit Match Wins Policy
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This is the default matching policy. ATS stops processing ACL filters only if an explicit match of IP address and HTTP method is
+found.
+
+::
+
+ # ip_allow.yaml
+ ip_allow:
+ - apply: in
+ ip_addrs: 198.51.100.0/24
+ action: deny
+ method: PUT
+
+ # remap.config
+ .definefilter named-filter-1 @action=deny @method=HEAD
+ .definefilter named-filter-2 @actio==allow @method=POST
+
+ .activatefilter named-filter-1
+ .activatefilter named-filter-2
+
+ map http://www.example.com/ http://internal.example.com/ @action=deny @method=GET
+
+The result of this example is below. The evaluation applied from left to right until explicit match is found.
+
+====== ================ ================ ================ ================ =============
+Method In-line Filter Named Filter 1 Named Filter 2 ip_allow.yaml result
+====== ================ ================ ================ ================ =============
+GET deny (explicit) \- \- \- denied (403)
+HEAD allow (implicit) deny (explicit) \- \- denied (403)
+POST allow (implicit) allow (implicit) allow (explicit) \- allowed (200)
+PUT allow (implicit) allow (implicit) deny (implicit) deny (explicit) denied (403)
+DELETE allow (implicit) allow (implicit) deny (implicit) allow (implicit) allowed (200)
+====== ================ ================ ================ ================ =============
+
+
+First Filter Wins Policy
+~~~~~~~~~~~~~~~~~~~~~~~~
+
+ATS processes the first ACL filter only. This means following ACL filters are never processed.
+
+====== ================ ================ ================ ================ =============
+Method In-line Filter Named Filter 1 Named Filter 2 ip_allow.yaml result
+====== ================ ================ ================ ================ =============
+GET deny (explicit) \- \- \- denied (403)
+HEAD allow (implicit) deny (explicit) \- \- allowed (200)
+POST allow (implicit) \- allow (explicit) \- allowed (200)
+PUT allow (implicit) \- \- deny (explicit) allowed (200)
+DELETE allow (implicit) \- \- \- allowed (200)
+====== ================ ================ ================ ================ =============
Review Comment:
PTAL. I left specified actions in subsequent filters to high light they're ignored.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Doc: Clarification of ACL filters [trafficserver]
Posted by "masaori335 (via GitHub)" <gi...@apache.org>.
masaori335 commented on code in PR #11448:
URL: https://github.com/apache/trafficserver/pull/11448#discussion_r1650213965
##########
doc/admin-guide/files/remap.config.en.rst:
##########
@@ -518,20 +514,95 @@ mapping rules. (It is activated before any mappings and is never
deactivated.) The filter `local_only` will only be applied to the
second mapping.
-Implict IPAllow filter
-======================
+Special Filter and ip_allow Named Filter
+----------------------------------------
+
+If :file:`ip_allow.yaml` has a "deny all" filter, it is treated as a special filter that is applied before remapping for
+optimizaion. To control this for specific remap rules, a named filter called `ip_allow` is pre-defined. This named filter is
+activated implicitly in default. To stop applying the special rule, disable the `ip_allow` filter as shown below.
+
+::
-To allow control of :ref:`IP Allow<ip-allow>` it is treated as an implicitly active and named
-filter. When this filter is active IP Allow checks are done before remap. To prevent this for
-specific remap rules, this filter, named "ip_allow", must be disabled. The common way of doing this
-would be ::
+ # ip_allow.yaml
+ ip_allow:
+ - apply: in
+ ip_addrs: 198.51.100.0/24
+ action: deny
+ method: ALL
+ # remap.config
.deactivatefilter ip_allow
map ...
map ...
.activatefilter ip_allow
-Note this entirely disables IP Allow checks for those remap rules.
+Note this entirely disables :file:`ip_allow.yaml` checks for those remap rules.
+
+Evaluation Order and Matching Policy
+------------------------------------
+
+ATS evaluates multiple ACL filters in the following order:
+
+1. Special "deny all" filter in :file:`ip_allow.yaml`
+2. In-line Filter in :file:`remap.config`
+3. Named Filter in :file:`remap.config`
+4. Filters in :file:`ip_allow.yaml`
+
+When an ACL filter is found, ATS stops processing ACL filters depending on the mathcing policy configured by
+:ts:cv:`proxy.config.url_remap.acl_matching_policy`.
+
+First Explicit Match Wins Policy
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Review Comment:
Beside the naming of the policies, descriptions are clear. I'd use the same example to clarify the differences.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Doc: Clarification of ACL filters [trafficserver]
Posted by "masaori335 (via GitHub)" <gi...@apache.org>.
masaori335 commented on code in PR #11448:
URL: https://github.com/apache/trafficserver/pull/11448#discussion_r1650209192
##########
doc/admin-guide/files/remap.config.en.rst:
##########
@@ -518,20 +514,95 @@ mapping rules. (It is activated before any mappings and is never
deactivated.) The filter `local_only` will only be applied to the
second mapping.
-Implict IPAllow filter
-======================
+Special Filter and ip_allow Named Filter
+----------------------------------------
+
+If :file:`ip_allow.yaml` has a "deny all" filter, it is treated as a special filter that is applied before remapping for
+optimizaion. To control this for specific remap rules, a named filter called `ip_allow` is pre-defined. This named filter is
+activated implicitly in default. To stop applying the special rule, disable the `ip_allow` filter as shown below.
+
+::
-To allow control of :ref:`IP Allow<ip-allow>` it is treated as an implicitly active and named
-filter. When this filter is active IP Allow checks are done before remap. To prevent this for
-specific remap rules, this filter, named "ip_allow", must be disabled. The common way of doing this
-would be ::
+ # ip_allow.yaml
+ ip_allow:
+ - apply: in
+ ip_addrs: 198.51.100.0/24
+ action: deny
+ method: ALL
+ # remap.config
.deactivatefilter ip_allow
map ...
map ...
.activatefilter ip_allow
-Note this entirely disables IP Allow checks for those remap rules.
+Note this entirely disables :file:`ip_allow.yaml` checks for those remap rules.
+
+Evaluation Order and Matching Policy
+------------------------------------
+
+ATS evaluates multiple ACL filters in the following order:
+
+1. Special "deny all" filter in :file:`ip_allow.yaml`
Review Comment:
Add a note at the end of this subsection.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Doc: Clarification of ACL filters [trafficserver]
Posted by "masaori335 (via GitHub)" <gi...@apache.org>.
masaori335 commented on code in PR #11448:
URL: https://github.com/apache/trafficserver/pull/11448#discussion_r1650213965
##########
doc/admin-guide/files/remap.config.en.rst:
##########
@@ -518,20 +514,95 @@ mapping rules. (It is activated before any mappings and is never
deactivated.) The filter `local_only` will only be applied to the
second mapping.
-Implict IPAllow filter
-======================
+Special Filter and ip_allow Named Filter
+----------------------------------------
+
+If :file:`ip_allow.yaml` has a "deny all" filter, it is treated as a special filter that is applied before remapping for
+optimizaion. To control this for specific remap rules, a named filter called `ip_allow` is pre-defined. This named filter is
+activated implicitly in default. To stop applying the special rule, disable the `ip_allow` filter as shown below.
+
+::
-To allow control of :ref:`IP Allow<ip-allow>` it is treated as an implicitly active and named
-filter. When this filter is active IP Allow checks are done before remap. To prevent this for
-specific remap rules, this filter, named "ip_allow", must be disabled. The common way of doing this
-would be ::
+ # ip_allow.yaml
+ ip_allow:
+ - apply: in
+ ip_addrs: 198.51.100.0/24
+ action: deny
+ method: ALL
+ # remap.config
.deactivatefilter ip_allow
map ...
map ...
.activatefilter ip_allow
-Note this entirely disables IP Allow checks for those remap rules.
+Note this entirely disables :file:`ip_allow.yaml` checks for those remap rules.
+
+Evaluation Order and Matching Policy
+------------------------------------
+
+ATS evaluates multiple ACL filters in the following order:
+
+1. Special "deny all" filter in :file:`ip_allow.yaml`
+2. In-line Filter in :file:`remap.config`
+3. Named Filter in :file:`remap.config`
+4. Filters in :file:`ip_allow.yaml`
+
+When an ACL filter is found, ATS stops processing ACL filters depending on the mathcing policy configured by
+:ts:cv:`proxy.config.url_remap.acl_matching_policy`.
+
+First Explicit Match Wins Policy
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Review Comment:
Beside the naming of the policies, descriptions are clear, I added them.
I tweaked example to clarify the differences.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Doc: Clarification of ACL filters [trafficserver]
Posted by "masaori335 (via GitHub)" <gi...@apache.org>.
masaori335 commented on code in PR #11448:
URL: https://github.com/apache/trafficserver/pull/11448#discussion_r1650260910
##########
doc/admin-guide/files/remap.config.en.rst:
##########
@@ -518,20 +514,95 @@ mapping rules. (It is activated before any mappings and is never
deactivated.) The filter `local_only` will only be applied to the
second mapping.
-Implict IPAllow filter
-======================
+Special Filter and ip_allow Named Filter
+----------------------------------------
+
+If :file:`ip_allow.yaml` has a "deny all" filter, it is treated as a special filter that is applied before remapping for
+optimizaion. To control this for specific remap rules, a named filter called `ip_allow` is pre-defined. This named filter is
+activated implicitly in default. To stop applying the special rule, disable the `ip_allow` filter as shown below.
+
+::
-To allow control of :ref:`IP Allow<ip-allow>` it is treated as an implicitly active and named
-filter. When this filter is active IP Allow checks are done before remap. To prevent this for
-specific remap rules, this filter, named "ip_allow", must be disabled. The common way of doing this
-would be ::
+ # ip_allow.yaml
+ ip_allow:
+ - apply: in
+ ip_addrs: 198.51.100.0/24
+ action: deny
+ method: ALL
+ # remap.config
.deactivatefilter ip_allow
map ...
map ...
.activatefilter ip_allow
-Note this entirely disables IP Allow checks for those remap rules.
+Note this entirely disables :file:`ip_allow.yaml` checks for those remap rules.
+
+Evaluation Order and Matching Policy
+------------------------------------
+
+ATS evaluates multiple ACL filters in the following order:
+
+1. Special "deny all" filter in :file:`ip_allow.yaml`
+2. In-line Filter in :file:`remap.config`
+3. Named Filter in :file:`remap.config`
+4. Filters in :file:`ip_allow.yaml`
+
+When an ACL filter is found, ATS stops processing ACL filters depending on the mathcing policy configured by
+:ts:cv:`proxy.config.url_remap.acl_matching_policy`.
+
+First Explicit Match Wins Policy
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This is the default matching policy. ATS stops processing ACL filters only if an explicit match of IP address and HTTP method is
Review Comment:
With Brians's comment, the new description clarifies the absence of `@src_ip` matches with any IP.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Doc: Clarification of ACL filters [trafficserver]
Posted by "zwoop (via GitHub)" <gi...@apache.org>.
zwoop commented on code in PR #11448:
URL: https://github.com/apache/trafficserver/pull/11448#discussion_r1644622963
##########
doc/admin-guide/files/remap.config.en.rst:
##########
@@ -518,20 +514,95 @@ mapping rules. (It is activated before any mappings and is never
deactivated.) The filter `local_only` will only be applied to the
second mapping.
-Implict IPAllow filter
-======================
+Special Filter and ip_allow Named Filter
+----------------------------------------
+
+If :file:`ip_allow.yaml` has a "deny all" filter, it is treated as a special filter that is applied before remapping for
+optimizaion. To control this for specific remap rules, a named filter called `ip_allow` is pre-defined. This named filter is
+activated implicitly in default. To stop applying the special rule, disable the `ip_allow` filter as shown below.
+
+::
-To allow control of :ref:`IP Allow<ip-allow>` it is treated as an implicitly active and named
-filter. When this filter is active IP Allow checks are done before remap. To prevent this for
-specific remap rules, this filter, named "ip_allow", must be disabled. The common way of doing this
-would be ::
+ # ip_allow.yaml
+ ip_allow:
+ - apply: in
+ ip_addrs: 198.51.100.0/24
+ action: deny
+ method: ALL
+ # remap.config
.deactivatefilter ip_allow
map ...
map ...
.activatefilter ip_allow
-Note this entirely disables IP Allow checks for those remap rules.
+Note this entirely disables :file:`ip_allow.yaml` checks for those remap rules.
+
+Evaluation Order and Matching Policy
+------------------------------------
+
+ATS evaluates multiple ACL filters in the following order:
+
+1. Special "deny all" filter in :file:`ip_allow.yaml`
+2. In-line Filter in :file:`remap.config`
+3. Named Filter in :file:`remap.config`
+4. Filters in :file:`ip_allow.yaml`
+
+When an ACL filter is found, ATS stops processing ACL filters depending on the mathcing policy configured by
+:ts:cv:`proxy.config.url_remap.acl_matching_policy`.
+
+First Explicit Match Wins Policy
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This is the default matching policy. ATS stops processing ACL filters only if an explicit match of IP address and HTTP method is
Review Comment:
But it can be an explicit match without an IP right? Like I can match on method only? And that can still match right?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Doc: Clarification of ACL filters [trafficserver]
Posted by "masaori335 (via GitHub)" <gi...@apache.org>.
masaori335 commented on code in PR #11448:
URL: https://github.com/apache/trafficserver/pull/11448#discussion_r1650210406
##########
doc/admin-guide/files/remap.config.en.rst:
##########
@@ -518,20 +514,95 @@ mapping rules. (It is activated before any mappings and is never
deactivated.) The filter `local_only` will only be applied to the
second mapping.
-Implict IPAllow filter
-======================
+Special Filter and ip_allow Named Filter
+----------------------------------------
+
+If :file:`ip_allow.yaml` has a "deny all" filter, it is treated as a special filter that is applied before remapping for
+optimizaion. To control this for specific remap rules, a named filter called `ip_allow` is pre-defined. This named filter is
+activated implicitly in default. To stop applying the special rule, disable the `ip_allow` filter as shown below.
+
+::
-To allow control of :ref:`IP Allow<ip-allow>` it is treated as an implicitly active and named
-filter. When this filter is active IP Allow checks are done before remap. To prevent this for
-specific remap rules, this filter, named "ip_allow", must be disabled. The common way of doing this
-would be ::
+ # ip_allow.yaml
+ ip_allow:
+ - apply: in
+ ip_addrs: 198.51.100.0/24
+ action: deny
+ method: ALL
+ # remap.config
.deactivatefilter ip_allow
map ...
map ...
.activatefilter ip_allow
-Note this entirely disables IP Allow checks for those remap rules.
+Note this entirely disables :file:`ip_allow.yaml` checks for those remap rules.
+
+Evaluation Order and Matching Policy
+------------------------------------
+
+ATS evaluates multiple ACL filters in the following order:
+
+1. Special "deny all" filter in :file:`ip_allow.yaml`
+2. In-line Filter in :file:`remap.config`
+3. Named Filter in :file:`remap.config`
+4. Filters in :file:`ip_allow.yaml`
+
+When an ACL filter is found, ATS stops processing ACL filters depending on the mathcing policy configured by
+:ts:cv:`proxy.config.url_remap.acl_matching_policy`.
+
+First Explicit Match Wins Policy
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This is the default matching policy. ATS stops processing ACL filters only if an explicit match of IP address and HTTP method is
+found.
+
+::
+
+ # ip_allow.yaml
+ ip_allow:
+ - apply: in
+ ip_addrs: 198.51.100.0/24
+ action: deny
+ method: PUT
+
+ # remap.config
+ .definefilter named-filter-1 @action=deny @method=HEAD
+ .definefilter named-filter-2 @actio==allow @method=POST
+
+ .activatefilter named-filter-1
+ .activatefilter named-filter-2
+
+ map http://www.example.com/ http://internal.example.com/ @action=deny @method=GET
+
+The result of this example is below. The evaluation applied from left to right until explicit match is found.
+
+====== ================ ================ ================ ================ =============
+Method In-line Filter Named Filter 1 Named Filter 2 ip_allow.yaml result
+====== ================ ================ ================ ================ =============
+GET deny (explicit) \- \- \- denied (403)
+HEAD allow (implicit) deny (explicit) \- \- denied (403)
+POST allow (implicit) allow (implicit) allow (explicit) \- allowed (200)
+PUT allow (implicit) allow (implicit) deny (implicit) deny (explicit) denied (403)
+DELETE allow (implicit) allow (implicit) deny (implicit) allow (implicit) allowed (200)
+====== ================ ================ ================ ================ =============
Review Comment:
PTAL
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Doc: Clarification of ACL filters [trafficserver]
Posted by "jasmine-nahrain (via GitHub)" <gi...@apache.org>.
jasmine-nahrain commented on code in PR #11448:
URL: https://github.com/apache/trafficserver/pull/11448#discussion_r1650301837
##########
doc/admin-guide/files/remap.config.en.rst:
##########
@@ -518,20 +514,95 @@ mapping rules. (It is activated before any mappings and is never
deactivated.) The filter `local_only` will only be applied to the
second mapping.
-Implict IPAllow filter
-======================
+Special Filter and ip_allow Named Filter
+----------------------------------------
+
+If :file:`ip_allow.yaml` has a "deny all" filter, it is treated as a special filter that is applied before remapping for
+optimizaion. To control this for specific remap rules, a named filter called `ip_allow` is pre-defined. This named filter is
+activated implicitly in default. To stop applying the special rule, disable the `ip_allow` filter as shown below.
+
+::
-To allow control of :ref:`IP Allow<ip-allow>` it is treated as an implicitly active and named
-filter. When this filter is active IP Allow checks are done before remap. To prevent this for
-specific remap rules, this filter, named "ip_allow", must be disabled. The common way of doing this
-would be ::
+ # ip_allow.yaml
+ ip_allow:
+ - apply: in
+ ip_addrs: 198.51.100.0/24
+ action: deny
+ method: ALL
+ # remap.config
.deactivatefilter ip_allow
map ...
map ...
.activatefilter ip_allow
-Note this entirely disables IP Allow checks for those remap rules.
+Note this entirely disables :file:`ip_allow.yaml` checks for those remap rules.
+
+Evaluation Order and Matching Policy
+------------------------------------
+
+ATS evaluates multiple ACL filters in the following order:
+
+1. Special "deny all" filter in :file:`ip_allow.yaml`
+2. In-line Filter in :file:`remap.config`
+3. Named Filter in :file:`remap.config`
+4. Filters in :file:`ip_allow.yaml`
+
+When an ACL filter is found, ATS stops processing ACL filters depending on the mathcing policy configured by
+:ts:cv:`proxy.config.url_remap.acl_matching_policy`.
+
+First Explicit Match Wins Policy
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This is the default matching policy. ATS stops processing ACL filters only if an explicit match of IP address and HTTP method is
Review Comment:
I would suggest keeping the default behaviour the same as 9.x only because the human errors that could occur by changing the default are pretty high. Changing the default would make the assumption administrates will read the new docs thoroughly and update their configs to replicate the same behaviour.
If we implicitly allow methods that are not specified, we are creating behaviour that is not visible to the administrators. They may not think like a software engineer and investigate in a way that any of us would which leaves big gaps of vulnerabilities that could open up.
I think keeping the newer behaviour as an optional enhancement for the right people to try would make more sense. They would be updating their configs knowing the implications of the change rather than just trying to make it all run again.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Doc: Clarification of ACL filters [trafficserver]
Posted by "mattyw (via GitHub)" <gi...@apache.org>.
mattyw commented on code in PR #11448:
URL: https://github.com/apache/trafficserver/pull/11448#discussion_r1642026833
##########
doc/admin-guide/files/remap.config.en.rst:
##########
@@ -518,20 +514,95 @@ mapping rules. (It is activated before any mappings and is never
deactivated.) The filter `local_only` will only be applied to the
second mapping.
-Implict IPAllow filter
-======================
+Special Filter and ip_allow Named Filter
+----------------------------------------
+
+If :file:`ip_allow.yaml` has a "deny all" filter, it is treated as a special filter that is applied before remapping for
+optimizaion. To control this for specific remap rules, a named filter called `ip_allow` is pre-defined. This named filter is
+activated implicitly in default. To stop applying the special rule, disable the `ip_allow` filter as shown below.
+
+::
-To allow control of :ref:`IP Allow<ip-allow>` it is treated as an implicitly active and named
-filter. When this filter is active IP Allow checks are done before remap. To prevent this for
-specific remap rules, this filter, named "ip_allow", must be disabled. The common way of doing this
-would be ::
+ # ip_allow.yaml
+ ip_allow:
+ - apply: in
+ ip_addrs: 198.51.100.0/24
+ action: deny
+ method: ALL
+ # remap.config
.deactivatefilter ip_allow
map ...
map ...
.activatefilter ip_allow
-Note this entirely disables IP Allow checks for those remap rules.
+Note this entirely disables :file:`ip_allow.yaml` checks for those remap rules.
+
+Evaluation Order and Matching Policy
+------------------------------------
+
+ATS evaluates multiple ACL filters in below order.
Review Comment:
```suggestion
ATS evaluates multiple ACL filters in the following order:
```
##########
doc/admin-guide/files/remap.config.en.rst:
##########
@@ -518,20 +514,95 @@ mapping rules. (It is activated before any mappings and is never
deactivated.) The filter `local_only` will only be applied to the
second mapping.
-Implict IPAllow filter
-======================
+Special Filter and ip_allow Named Filter
+----------------------------------------
+
+If :file:`ip_allow.yaml` has a "deny all" filter, it is treated as a special filter that is applied before remapping for
+optimizaion. To control this for specific remap rules, a named filter called `ip_allow` is pre-defined. This named filter is
+activated implicitly in default. To stop applying the special rule, disable the `ip_allow` filter as shown below.
+
+::
-To allow control of :ref:`IP Allow<ip-allow>` it is treated as an implicitly active and named
-filter. When this filter is active IP Allow checks are done before remap. To prevent this for
-specific remap rules, this filter, named "ip_allow", must be disabled. The common way of doing this
-would be ::
+ # ip_allow.yaml
+ ip_allow:
+ - apply: in
+ ip_addrs: 198.51.100.0/24
+ action: deny
+ method: ALL
+ # remap.config
.deactivatefilter ip_allow
map ...
map ...
.activatefilter ip_allow
-Note this entirely disables IP Allow checks for those remap rules.
+Note this entirely disables :file:`ip_allow.yaml` checks for those remap rules.
+
+Evaluation Order and Matching Policy
+------------------------------------
+
+ATS evaluates multiple ACL filters in below order.
+
+1. Special "deny all" filter in :file:`ip_allow.yaml`
+2. In-line Filter in :file:`remap.config`
+3. Named Filter in :file:`remap.config`
+4. Filters in :file:`ip_allow.yaml`
+
+When a ACL filter is found, ATS stop processing ACL filters depending on mathcing policy configured by
Review Comment:
```suggestion
When an ACL filter is found, ATS stops processing ACL filters depending on the matching policy configured by
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Doc: Clarification of ACL filters [trafficserver]
Posted by "zwoop (via GitHub)" <gi...@apache.org>.
zwoop commented on code in PR #11448:
URL: https://github.com/apache/trafficserver/pull/11448#discussion_r1644607530
##########
doc/admin-guide/files/remap.config.en.rst:
##########
@@ -518,20 +514,95 @@ mapping rules. (It is activated before any mappings and is never
deactivated.) The filter `local_only` will only be applied to the
second mapping.
-Implict IPAllow filter
-======================
+Special Filter and ip_allow Named Filter
+----------------------------------------
+
+If :file:`ip_allow.yaml` has a "deny all" filter, it is treated as a special filter that is applied before remapping for
+optimizaion. To control this for specific remap rules, a named filter called `ip_allow` is pre-defined. This named filter is
+activated implicitly in default. To stop applying the special rule, disable the `ip_allow` filter as shown below.
Review Comment:
Should that be "by default" ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org