You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@trafficserver.apache.org by zw...@apache.org on 2018/02/28 17:31:53 UTC
[trafficserver] branch 7.1.x updated (79f1c02 -> 06f5af8)
This is an automated email from the ASF dual-hosted git repository.
zwoop pushed a change to branch 7.1.x
in repository https://gitbox.apache.org/repos/asf/trafficserver.git.
from 79f1c02 Doc for overridable client cert filename
new 363405e Proper support fort he %{URL:<qual>} conditions
new 05d734c Return 400 if there is whitespace after the field name and before the colon
new 0ed047f Doc for ATS client tls configuration
new fdb98bc Fix the expression for checking file descriptor
new e6dfda3 Adds better sanity checks around the method IX
new 06f5af8 Added a first cut of a .spec file, losely based on the Fedora repos
The 6 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
doc/admin-guide/files/records.config.en.rst | 17 ++
doc/admin-guide/plugins/header_rewrite.en.rst | 13 +-
iocore/hostdb/P_RefCountCacheSerializer.h | 2 +-
plugins/header_rewrite/conditions.cc | 76 ++++++---
proxy/hdrs/HdrTest.cc | 2 +-
proxy/hdrs/MIME.cc | 11 +-
proxy/http/remap/UrlRewrite.cc | 2 +-
.../headers/{hsts.200.gold => syntax.200.gold} | 5 +-
tests/gold_tests/headers/syntax.400.gold | 4 +
.../headers/{hsts.test.py => syntax.test.py} | 31 ++--
tools/package/trafficserver.spec | 185 +++++++++++++++++++++
11 files changed, 300 insertions(+), 48 deletions(-)
copy tests/gold_tests/headers/{hsts.200.gold => syntax.200.gold} (56%)
create mode 100644 tests/gold_tests/headers/syntax.400.gold
copy tests/gold_tests/headers/{hsts.test.py => syntax.test.py} (73%)
create mode 100755 tools/package/trafficserver.spec
--
To stop receiving notification emails like this one, please contact
zwoop@apache.org.
[trafficserver] 06/06: Added a first cut of a .spec file,
losely based on the Fedora repos
Posted by zw...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
zwoop pushed a commit to branch 7.1.x
in repository https://gitbox.apache.org/repos/asf/trafficserver.git
commit 06f5af8738e068c04878998e0aca14bdeca1e400
Author: Leif Hedstrom <zw...@apache.org>
AuthorDate: Tue Feb 27 13:50:03 2018 -0700
Added a first cut of a .spec file, losely based on the Fedora repos
(cherry picked from commit afa100c46decb473e00dd7814d6ffed9788ad45d)
---
tools/package/trafficserver.spec | 185 +++++++++++++++++++++++++++++++++++++++
1 file changed, 185 insertions(+)
diff --git a/tools/package/trafficserver.spec b/tools/package/trafficserver.spec
new file mode 100755
index 0000000..5385c0a
--- /dev/null
+++ b/tools/package/trafficserver.spec
@@ -0,0 +1,185 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# I had to disable this on RHEL7, because libunwind is not properly built for -fPIE it seems
+%if %{?fedora}0 > 0 || %{?rhel}0 >= 80
+%define _hardened_build 1
+%endif
+
+Summary: Apache Traffi Server, a reverse, forward and transparent HTTP proxy cache
+Name: trafficserver
+Version: 7.1.2
+Release: 3%{?dist}
+License: Apache Software License 2.0 (AL2)
+Group: System Environment/Daemons
+URL: https://trafficserver.apache.org/
+
+Source0: http://www.apache.org/dist/%{name}/%{name}-%{version}.tar.bz2
+
+BuildRequires: expat-devel hwloc-devel openssl-devel pcre-devel tcl-devel zlib-devel xz-devel
+BuildRequires: libcurl-devel ncurses-devel
+BuildRequires: gcc gcc-c++ perl-ExtUtils-MakeMaker
+BuildRequires: libcap-devel
+
+Requires: expat hwloc openssl pcre tcl zlib xz libcurl ncurses pkgconfig
+Requires: libcap
+
+# Can't seem to use libunwind on RHEL7 or older
+%if %{?fedora}0 > 0 || %{?rhel}0 >= 80
+BuildRequires: libunwind-devel
+%else
+%define DISABLE_UNWIND "--disable-unwind"
+%endif
+
+%if %{?fedora}0 > 0 || %{?rhel}0 >= 70
+Requires: systemd
+Requires(postun): systemd
+%else
+Requires: initscripts
+%endif
+
+%description
+Apache Traffic Server is an OpenSource HTTP / HTTPS / HTTP/2 / QUIC reverse,
+forward and transparent proxy and cache.
+
+%package devel
+Summary: Apache Traffic Server devel package
+Group: Development/Libraries
+Requires: trafficserver = %{version}-%{release}
+
+%description devel
+Include files and various tools for ATS developers.
+
+%package perl
+Summary: ATS management Perl bindings
+Group: Development/Libraries
+Requires: trafficserver = %{version}-%{release}
+
+%description perl
+This package contains some Perl APIs for talking to the ATS management port.
+
+%prep
+
+%setup -q
+
+%build
+%configure \
+ --enable-layout=Gentoo \
+ --libdir=%{_libdir}/trafficserver \
+ --libexecdir=%{_libdir}/trafficserver/plugins \
+ --sysconfdir=%{_sysconfdir}/trafficserver \
+ --enable-experimental-plugins \
+ --with-user=ats --with-group=ats \
+ %{DISABLE_UNWIND} \
+ --disable-silent-rules
+
+make %{?_smp_mflags} V=1
+
+%install
+rm -rf %{buildroot}
+make DESTDIR=%{buildroot} install
+
+%if %{?fedora}0 > 0 || %{?rhel}0 >= 70
+mkdir -p %{buildroot}/lib/systemd/system
+cp rc/trafficserver.service %{buildroot}/lib/systemd/system
+%else
+mkdir -p %{buildroot}/etc/init.d
+mv %{buildroot}%{_bindir}/trafficserver %{buildroot}/etc/init.d
+%endif
+
+# Remove libtool archives and static libs
+find %{buildroot} -type f -name "*.la" -delete
+find %{buildroot} -type f -name "*.a" -delete
+find %{buildroot} -type f -name "*.pod" -delete
+find %{buildroot} -type f -name "*.in" -delete
+find %{buildroot} -type f -name ".packlist" -delete
+
+# ToDo: Why is the Perl stuff ending up in the wrong place ??
+mkdir -p %{buildroot}%{_datadir}/perl5
+mv %{buildroot}/usr/lib/perl5/* %{buildroot}%{_datadir}/perl5
+
+mkdir -p %{buildroot}/run/trafficserver
+
+mkdir -p %{buildroot}%{_datadir}/pkgconfig
+mv %{buildroot}%{_libdir}/trafficserver/pkgconfig/trafficserver.pc %{buildroot}%{_datadir}/pkgconfig
+
+%post
+/sbin/ldconfig
+%if %{?fedora}0 > 0 || %{?rhel}0 >= 70
+%systemd_post trafficserver.service
+%endif
+
+# These UID/GIDs are retained from the upstream Fedora .spec, not sure if there's a registry for these?
+%pre
+getent group ats >/dev/null || groupadd -r ats -g 176 &>/dev/null
+getent passwd ats >/dev/null || useradd -r -u 176 -g ats -d / -s /sbin/nologin -c "Apache Traffic Server" ats &>/dev/null
+
+%preun
+%if %{?fedora}0 > 0 || %{?rhel}0 >= 70
+%systemd_preun trafficserver.service
+%endif
+
+%postun
+/sbin/ldconfig
+
+%if %{?fedora}0 > 0 || %{?rhel}0 >= 70
+%systemd_postun_with_restart trafficserver.service
+%endif
+
+%files
+%defattr(-, root, root, -)
+%{!?_licensedir:%global license %%doc}
+%license LICENSE
+%doc README CHANGELOG* NOTICE STATUS
+%attr(0755, ats, ats) %dir /etc/trafficserver
+%config(noreplace) /etc/trafficserver/*
+%{_bindir}/traffic*
+%{_bindir}/tspush
+%dir %{_libdir}/trafficserver
+%dir %{_libdir}/trafficserver/plugins
+%{_libdir}/trafficserver/libts*.so*
+%{_libdir}/trafficserver/libats*.so*
+%{_libdir}/trafficserver/plugins/*.so
+
+%if %{?fedora}0 > 0 || %{?rhel}0 >= 70
+/lib/systemd/system/trafficserver.service
+%else
+%config(noreplace) /etc/init.d/trafficserver
+%endif
+
+%attr(0755, ats, ats) %dir /var/log/trafficserver
+%attr(0755, ats, ats) %dir /run/trafficserver
+%attr(0755, ats, ats) %dir /var/cache/trafficserver
+
+%files perl
+%defattr(-,root,root,-)
+%{_mandir}/man3/*
+%{_datadir}/perl5/Apache/*
+
+%files devel
+%defattr(-,root,root,-)
+%{_bindir}/tsxs
+%{_includedir}/ts
+%{_includedir}/atscppapi
+%{_datadir}/pkgconfig/trafficserver.pc
+
+%changelog
+* Tue Dec 19 2017 Leif Hedstrom <zw...@apache.org> - 7.1.2-1
+- Cleanup for 7.1.x, and various other changes. This needs more work
+ upstream though, since I'm finding issues.
+- Losely based on ideas from the Fedora .spec
--
To stop receiving notification emails like this one, please contact
zwoop@apache.org.
[trafficserver] 03/06: Doc for ATS client tls configuration
Posted by zw...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
zwoop pushed a commit to branch 7.1.x
in repository https://gitbox.apache.org/repos/asf/trafficserver.git
commit 0ed047f266534f61f0e291a04293bdc9fd1d665a
Author: Persia Aziz <pe...@yahoo-inc.com>
AuthorDate: Tue Feb 27 16:04:12 2018 -0600
Doc for ATS client tls configuration
(cherry picked from commit 95b703a9fa44ce131a6fc4c6afe7df3426e0ee5d)
---
doc/admin-guide/files/records.config.en.rst | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/doc/admin-guide/files/records.config.en.rst b/doc/admin-guide/files/records.config.en.rst
index 1609a8a..ffe2065 100644
--- a/doc/admin-guide/files/records.config.en.rst
+++ b/doc/admin-guide/files/records.config.en.rst
@@ -3270,6 +3270,23 @@ Client-Related Configuration
Specifies the location of the certificate authority file against
which the origin server will be verified.
+.. ts:cv:: CONFIG proxy.config.ssl.client.SSLv3 INT 0
+
+ Enables (``1``) or disables (``0``) SSLv3 in the ATS client context. Disabled by default
+
+.. ts:cv:: CONFIG proxy.config.ssl.client.TLSv1 INT 1
+
+ Enables (``1``) or disables (``0``) TLSv1 in the ATS client context. If not specified, enabled by default
+
+.. ts:cv:: CONFIG proxy.config.ssl.client.TLSv1_1 INT 1
+
+ Enables (``1``) or disables (``0``) TLSv1_1 in the ATS client context. If not specified, enabled by default
+
+.. ts:cv:: CONFIG proxy.config.ssl.client.TLSv1_2 INT 1
+
+ Enables (``1``) or disables (``0``) TLSv1_2 in the ATS client context. If not specified, enabled by default
+
+
OCSP Stapling Configuration
===========================
--
To stop receiving notification emails like this one, please contact
zwoop@apache.org.
[trafficserver] 04/06: Fix the expression for checking file
descriptor
Posted by zw...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
zwoop pushed a commit to branch 7.1.x
in repository https://gitbox.apache.org/repos/asf/trafficserver.git
commit fdb98bcbda715b706549c2a1cbc0f86e7c6e7e75
Author: Persia Aziz <pe...@yahoo-inc.com>
AuthorDate: Tue Feb 27 14:49:10 2018 -0600
Fix the expression for checking file descriptor
(cherry picked from commit 9fc730be02f229228fdde23c13bf0365c07d9d47)
---
iocore/hostdb/P_RefCountCacheSerializer.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/iocore/hostdb/P_RefCountCacheSerializer.h b/iocore/hostdb/P_RefCountCacheSerializer.h
index 853fd4e..bd11f5c 100644
--- a/iocore/hostdb/P_RefCountCacheSerializer.h
+++ b/iocore/hostdb/P_RefCountCacheSerializer.h
@@ -228,7 +228,7 @@ int
RefCountCacheSerializer<C>::initialize_storage(int /* event */, Event *e)
{
this->fd = socketManager.open(this->tmp_filename.c_str(), O_TRUNC | O_RDWR | O_CREAT, 0644); // TODO: configurable perms
- if (this->fd == -1) {
+ if (this->fd < 0) {
Warning("Unable to create temporary file %s, unable to persist hostdb: %s", this->tmp_filename.c_str(), strerror(errno));
delete this;
return EVENT_DONE;
--
To stop receiving notification emails like this one, please contact
zwoop@apache.org.
[trafficserver] 02/06: Return 400 if there is whitespace after the
field name and before the colon
Posted by zw...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
zwoop pushed a commit to branch 7.1.x
in repository https://gitbox.apache.org/repos/asf/trafficserver.git
commit 05d734c773900dd589480ff07572c0d7db7c3d44
Author: Bryan Call <bc...@apache.org>
AuthorDate: Fri Feb 23 14:48:53 2018 -0800
Return 400 if there is whitespace after the field name and before the
colon
(cherry picked from commit 08512deb11a610ae7084ce678b19bd637e30b3e1)
---
proxy/hdrs/HdrTest.cc | 2 +-
proxy/hdrs/MIME.cc | 11 ++++-
tests/gold_tests/headers/syntax.200.gold | 6 +++
tests/gold_tests/headers/syntax.400.gold | 4 ++
tests/gold_tests/headers/syntax.test.py | 84 ++++++++++++++++++++++++++++++++
5 files changed, 104 insertions(+), 3 deletions(-)
diff --git a/proxy/hdrs/HdrTest.cc b/proxy/hdrs/HdrTest.cc
index eaa98e7..c355b00 100644
--- a/proxy/hdrs/HdrTest.cc
+++ b/proxy/hdrs/HdrTest.cc
@@ -496,7 +496,7 @@ HdrTest::test_mime()
"continuation: part1\r\n"
" part2\r\n"
"scooby: doo\r\n"
- "scooby : doo\r\n"
+ " scooby: doo\r\n"
"bar: foo\r\n"
"\r\n",
};
diff --git a/proxy/hdrs/MIME.cc b/proxy/hdrs/MIME.cc
index 1e0e567..38e5c06 100644
--- a/proxy/hdrs/MIME.cc
+++ b/proxy/hdrs/MIME.cc
@@ -2613,8 +2613,15 @@ mime_parser_parse(MIMEParser *parser, HdrHeap *heap, MIMEHdrImpl *mh, const char
continue; // toss away garbage line
}
field_name_last = colon - 1;
- while ((field_name_last >= field_name_first) && is_ws(*field_name_last)) {
- --field_name_last;
+ // RFC7230 section 3.2.4:
+ // No whitespace is allowed between the header field-name and colon. In
+ // the past, differences in the handling of such whitespace have led to
+ // security vulnerabilities in request routing and response handling. A
+ // server MUST reject any received request message that contains
+ // whitespace between a header field-name and colon with a response code
+ // of 400 (Bad Request).
+ if ((field_name_last >= field_name_first) && is_ws(*field_name_last)) {
+ return PARSE_RESULT_ERROR;
}
// find value first
diff --git a/tests/gold_tests/headers/syntax.200.gold b/tests/gold_tests/headers/syntax.200.gold
new file mode 100644
index 0000000..3b224e6
--- /dev/null
+++ b/tests/gold_tests/headers/syntax.200.gold
@@ -0,0 +1,6 @@
+HTTP/1.1 200 OK
+Date: ``
+Age: 0
+Transfer-Encoding: chunked
+Connection: keep-alive
+Server: ``
diff --git a/tests/gold_tests/headers/syntax.400.gold b/tests/gold_tests/headers/syntax.400.gold
new file mode 100644
index 0000000..b2502a6
--- /dev/null
+++ b/tests/gold_tests/headers/syntax.400.gold
@@ -0,0 +1,4 @@
+HTTP/1.1 400 Invalid HTTP Request
+Date: ``
+Connection: keep-alive
+Server: ``
diff --git a/tests/gold_tests/headers/syntax.test.py b/tests/gold_tests/headers/syntax.test.py
new file mode 100644
index 0000000..e38b97e
--- /dev/null
+++ b/tests/gold_tests/headers/syntax.test.py
@@ -0,0 +1,84 @@
+'''
+Test whitespace between field name and colon in the header
+'''
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import os
+Test.Summary = '''
+Test whitespace between field name and colon in the header
+'''
+
+# Needs Curl
+Test.SkipUnless(
+ Condition.HasProgram("curl", "Curl need to be installed on system for this test to work")
+)
+Test.ContinueOnFail = True
+
+# Define default ATS
+ts = Test.MakeATSProcess("ts", select_ports=False)
+server = Test.MakeOriginServer("server")
+
+#**testname is required**
+testName = ""
+request_header = {"headers": "GET / HTTP/1.1\r\nHost: www.example.com\r\n\r\n", "timestamp": "1469733493.993", "body": ""}
+response_header = {"headers": "HTTP/1.1 200 OK\r\nConnection: close\r\n\r\n", "timestamp": "1469733493.993", "body": ""}
+server.addResponse("sessionlog.json", request_header, response_header)
+
+# ATS Configuration
+ts.addSSLfile("../remap/ssl/server.pem")
+ts.addSSLfile("../remap/ssl/server.key")
+
+ts.Variables.ssl_port = 4443
+ts.Disk.records_config.update({
+ 'proxy.config.diags.debug.enabled': 1,
+ 'proxy.config.diags.debug.tags': 'ssl',
+ 'proxy.config.ssl.server.cert.path': '{0}'.format(ts.Variables.SSLDir),
+ 'proxy.config.ssl.server.private_key.path': '{0}'.format(ts.Variables.SSLDir),
+ 'proxy.config.http.server_ports': '{0} {1}:ssl'.format(ts.Variables.port, ts.Variables.ssl_port),
+})
+
+ts.Disk.remap_config.AddLine(
+ 'map http://www.example.com http://127.0.0.1:{0}'.format(server.Variables.Port)
+)
+
+ts.Disk.ssl_multicert_config.AddLine(
+ 'dest_ip=* ssl_cert_name=server.pem ssl_key_name=server.key'
+)
+
+# Test 1 - 200 Response
+tr = Test.AddTestRun()
+tr.Processes.Default.StartBefore(server)
+tr.Processes.Default.StartBefore(Test.Processes.ts)
+tr.Processes.Default.StartBefore(Test.Processes.ts, ready=When.PortOpen(ts.Variables.ssl_port))
+tr.Processes.Default.Command = 'curl -s -D - -v --ipv4 --http1.1 -H " foo: bar" -H "Host: www.example.com" http://localhost:8080/'
+tr.Processes.Default.ReturnCode = 0
+tr.Processes.Default.Streams.stdout = "syntax.200.gold"
+tr.StillRunningAfter = ts
+
+# Test 2 - 400 Response
+tr = Test.AddTestRun()
+tr.Processes.Default.Command = 'curl -s -D - -v --ipv4 --http1.1 -H "foo : bar" -H "Host: www.example.com" http://localhost:8080/'
+tr.Processes.Default.ReturnCode = 0
+tr.Processes.Default.Streams.stdout = "syntax.400.gold"
+tr.StillRunningAfter = ts
+
+# Test 3 - 400 Response
+tr = Test.AddTestRun()
+tr.Processes.Default.Command = 'curl -s -D - -v --ipv4 --http1.1 -H "foo : bar" -H "Host: www.example.com" http://localhost:8080/'
+tr.Processes.Default.ReturnCode = 0
+tr.Processes.Default.Streams.stdout = "syntax.400.gold"
+tr.StillRunningAfter = ts
--
To stop receiving notification emails like this one, please contact
zwoop@apache.org.
[trafficserver] 05/06: Adds better sanity checks around the method
IX
Posted by zw...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
zwoop pushed a commit to branch 7.1.x
in repository https://gitbox.apache.org/repos/asf/trafficserver.git
commit e6dfda305acf85250861ecfa14a7bd6bb2fad5c3
Author: Leif Hedstrom <zw...@apache.org>
AuthorDate: Tue Feb 27 19:34:10 2018 -0700
Adds better sanity checks around the method IX
(cherry picked from commit e7517f393e97f405ce655736ff3f2b2ea6910717)
---
proxy/http/remap/UrlRewrite.cc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/proxy/http/remap/UrlRewrite.cc b/proxy/http/remap/UrlRewrite.cc
index 40d78ac..fe3da9e 100644
--- a/proxy/http/remap/UrlRewrite.cc
+++ b/proxy/http/remap/UrlRewrite.cc
@@ -404,7 +404,7 @@ UrlRewrite::PerformACLFiltering(HttpTransact::State *s, url_mapping *map)
bool match = true;
if (rp->method_restriction_enabled) {
- if (method_wksidx != -1) {
+ if (method_wksidx >= 0 && method_wksidx < HTTP_WKSIDX_METHODS_CNT) {
match = rp->standard_method_lookup[method_wksidx];
} else if (!rp->nonstandard_methods.empty()) {
match = false;
--
To stop receiving notification emails like this one, please contact
zwoop@apache.org.
[trafficserver] 01/06: Proper support fort he %{URL:}
conditions
Posted by zw...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
zwoop pushed a commit to branch 7.1.x
in repository https://gitbox.apache.org/repos/asf/trafficserver.git
commit 363405e6cd07419208fb22b8cb36d59051296aae
Author: Leif Hedstrom <zw...@apache.org>
AuthorDate: Thu Apr 20 12:50:53 2017 -0600
Proper support fort he %{URL:<qual>} conditions
This was never properly, or completely, implemented. This makes sure that
the URL conditions works as both conditions and values. Supported qualifiers
are e.g.
cond %{SEND_RESPONSE_HDR_HOOK} [AND]
cond %{CLIENT-URL:SCHEME} =http
set-header X-Url %{CLIENT-URL}
set-header X-Url-Scheme %{CLIENT-URL:SCHEME}
set-header X-Url-Host %{CLIENT-URL:HOST}
set-header X-Url-Port %{CLIENT-URL:PORT}
set-header X-Url-Path %{CLIENT-URL:PATH}
set-header X-Url-Query %{CLIENT-URL:QUERY}
set-header X-Url-Matrix %{CLIENT-URL:MATRIX}
(cherry picked from commit 8fe3dd266d05d21b2e5bec5f6d914e8eac75e2ac)
Conflicts:
doc/admin-guide/plugins/header_rewrite.en.rst
plugins/header_rewrite/conditions.cc
---
doc/admin-guide/plugins/header_rewrite.en.rst | 13 ++++-
plugins/header_rewrite/conditions.cc | 76 +++++++++++++++++++--------
2 files changed, 65 insertions(+), 24 deletions(-)
diff --git a/doc/admin-guide/plugins/header_rewrite.en.rst b/doc/admin-guide/plugins/header_rewrite.en.rst
index 7c10ca5..bfab99d 100644
--- a/doc/admin-guide/plugins/header_rewrite.en.rst
+++ b/doc/admin-guide/plugins/header_rewrite.en.rst
@@ -349,6 +349,10 @@ first).
Refer to `Requests vs. Responses`_ for more information on determining the
context in which the transaction's URL is evaluated.
+This condition is *deprecated* as of ATS v7.1.x, please use e.g. %{URL:PATH}
+or %{CLIENT-URL:PATH} instead.
+
+
QUERY
~~~~~
::
@@ -359,6 +363,10 @@ The query parameters, if any, of the transaction. Refer to `Requests vs.
Responses`_ for more information on determining the context in which the
transaction's URL is evaluated.
+This condition is *deprecated* as of ATS v7.1.x, please use e.g. %{URL:QUERY}
+or %{CLIENT-URL:QUERY} instead.
+
+
RANDOM
~~~~~~
::
@@ -417,14 +425,15 @@ URL
~~~
::
- cond %{URL:option} <operand>
+ cond %{URL:<part>} <operand>
The complete URL of the current transaction. This will automatically choose the
most relevant URL depending upon the hook context in which the condition is
being evaluated.
Refer to `Requests vs. Responses`_ for more information on determining the
-context in which the transaction's URL is evaluated.
+context in which the transaction's URL is evaluated. The ``<part>`` may be
+specified according to the options documented in `URL Parts`_.
Condition Operands
------------------
diff --git a/plugins/header_rewrite/conditions.cc b/plugins/header_rewrite/conditions.cc
index 4b57dba..d72bfbd 100644
--- a/plugins/header_rewrite/conditions.cc
+++ b/plugins/header_rewrite/conditions.cc
@@ -62,10 +62,7 @@ ConditionStatus::eval(const Resources &res)
void
ConditionStatus::append_value(std::string &s, const Resources &res)
{
- std::ostringstream oss;
-
- oss << res.resp_status;
- s += oss.str();
+ s += std::to_string(res.resp_status);
TSDebug(PLUGIN_NAME, "Appending STATUS(%d) to evaluation value -> %s", res.resp_status, s.c_str());
}
@@ -231,7 +228,7 @@ ConditionHeader::append_value(std::string &s, const Resources &res)
s.append(value, len);
// multiple headers with the same name must be semantically the same as one value which is comma separated
if (next_field_loc) {
- s.append(",");
+ s += ',';
}
TSHandleMLocRelease(bufp, hdr_loc, field_loc);
field_loc = next_field_loc;
@@ -348,17 +345,10 @@ ConditionUrl::set_qualifier(const std::string &q)
}
void
-ConditionUrl::append_value(std::string & /* s ATS_UNUSED */, const Resources & /* res ATS_UNUSED */)
-{
-}
-
-bool
-ConditionUrl::eval(const Resources &res)
+ConditionUrl::append_value(std::string &s, const Resources &res)
{
- TSDebug(PLUGIN_NAME, "ConditionUrl::eval");
TSMLoc url = nullptr;
TSMBuffer bufp = nullptr;
- std::string s;
if (res._rri != nullptr) {
// called at the remap hook
@@ -375,7 +365,7 @@ ConditionUrl::eval(const Resources &res)
url = res._rri->mapToUrl;
} else {
TSError("[header_rewrite] Invalid option value");
- return false;
+ return;
}
} else {
TSMLoc hdr_loc = nullptr;
@@ -387,21 +377,63 @@ ConditionUrl::eval(const Resources &res)
hdr_loc = res.hdr_loc;
} else {
TSError("[header_rewrite] Rule not supported at this hook");
- return false;
+ return;
}
if (TSHttpHdrUrlGet(bufp, hdr_loc, &url) != TS_SUCCESS) {
TSError("[header_rewrite] Error getting the URL");
- return false;
+ return;
}
}
- if (_url_qual == URL_QUAL_HOST) {
- int host_len = 0;
- const char *host = TSUrlHostGet(bufp, url, &host_len);
- s.append(host, host_len);
- TSDebug(PLUGIN_NAME, " Host to match is: %.*s", host_len, host);
+ int i;
+ const char *q_str;
+
+ switch (_url_qual) {
+ case URL_QUAL_HOST:
+ q_str = TSUrlHostGet(bufp, url, &i);
+ s.append(q_str, i);
+ TSDebug(PLUGIN_NAME, " Host to match is: %.*s", i, q_str);
+ break;
+ case URL_QUAL_PORT:
+ i = TSUrlPortGet(bufp, url);
+ s.append(std::to_string(i));
+ TSDebug(PLUGIN_NAME, " Port to match is: %d", i);
+ break;
+ case URL_QUAL_PATH:
+ q_str = TSUrlPathGet(bufp, url, &i);
+ s.append(q_str, i);
+ TSDebug(PLUGIN_NAME, " Path to match is: %.*s", i, q_str);
+ break;
+ case URL_QUAL_QUERY:
+ q_str = TSUrlHttpQueryGet(bufp, url, &i);
+ s.append(q_str, i);
+ TSDebug(PLUGIN_NAME, " Query parameters to match is: %.*s", i, q_str);
+ break;
+ case URL_QUAL_MATRIX:
+ q_str = TSUrlHttpParamsGet(bufp, url, &i);
+ s.append(q_str, i);
+ TSDebug(PLUGIN_NAME, " Matrix parameters to match is: %.*s", i, q_str);
+ break;
+ case URL_QUAL_SCHEME:
+ q_str = TSUrlSchemeGet(bufp, url, &i);
+ s.append(q_str, i);
+ TSDebug(PLUGIN_NAME, " Scheme to match is: %.*s", i, q_str);
+ break;
+ case URL_QUAL_URL:
+ case URL_QUAL_NONE:
+ q_str = TSUrlStringGet(bufp, url, &i);
+ s.append(q_str, i);
+ TSDebug(PLUGIN_NAME, " URL to match is: %.*s", i, q_str);
+ break;
}
+}
+bool
+ConditionUrl::eval(const Resources &res)
+{
+ std::string s;
+
+ append_value(s, res);
return static_cast<const Matchers<std::string> *>(_matcher)->test(s);
}
@@ -577,7 +609,7 @@ ConditionClientIp::append_value(std::string &s, const Resources &res)
char ip[INET6_ADDRSTRLEN];
if (getIP(TSHttpTxnClientAddrGet(res.txnp), ip)) {
- s.append(ip);
+ s += ip;
}
}
--
To stop receiving notification emails like this one, please contact
zwoop@apache.org.