BUG/MINOR: http-rules: Fix ACLs parsing for http deny rules

The parsing of http deny rules with no argument or only the deny_status argument
is buggy if followed by an ACLs expression (starting with "if" or "unless"
keyword). Instead of using the proxy errorfiles, a dummy error is used. To fix
the bug, the parsing function must also check for "if" or "unless" keyword in
such cases.

This patch should fix the issue #720. No backport is needed.

diff --git a/reg-tests/http-errorfiles/http_errors.vtc b/reg-tests/http-errorfiles/http_errors.vtc
index 7d9f18c3dc175f447979bb7fdbae74e7202a849d..37e08cc8ae3bec5e66d3d3edb1bc53eaaa91ddda 100644 (file)
--- a/reg-tests/http-errorfiles/http_errors.vtc
+++ b/reg-tests/http-errorfiles/http_errors.vtc
@@ -34,7 +34,7 @@ haproxy h1 -conf {
     frontend fe1
         bind "fd@${fe1}"
         http-request deny deny_status 400 if { path /400 }
-        http-request deny deny_status 403 if { path /403 }
+        http-request deny if { path /403 }
         http-request deny deny_status 404 if { path /404 }
         http-request deny deny_status 500 if { path /500 }
 
@@ -43,7 +43,7 @@ haproxy h1 -conf {
         errorfiles errors-1
         errorfile 500  ${testdir}/errors/500.http
         http-request deny deny_status 400 if { path /400 }
-        http-request deny deny_status 403 if { path /403 }
+        http-request deny if { path /403 }
         http-request deny deny_status 404 if { path /404 }
         http-request deny deny_status 500 if { path /500 }
 
@@ -53,7 +53,7 @@ haproxy h1 -conf {
         errorfiles errors-1 500
         errorfiles errors-3 400
         http-request deny deny_status 400 if { path /400 }
-        http-request deny deny_status 403 if { path /403 }
+        http-request deny if { path /403 }
         http-request deny deny_status 404 if { path /404 }
         http-request deny deny_status 500 if { path /500 }
 } -start

diff --git a/src/http_act.c b/src/http_act.c
index 76e6d2b2c9f75fe7fa8d1daf718a11cd2627bbe9..1c7a1d4e6057550760942bf5a9efcbc11875e8b7 100644 (file)
--- a/src/http_act.c
+++ b/src/http_act.c
@@ -855,14 +855,13 @@ static enum act_parse_ret parse_http_deny(const char **args, int *orig_arg, stru
        /* Prepare parsing of log-format strings */
        px->conf.args.ctx = ((rule->from == ACT_F_HTTP_REQ) ? ARGC_HRQ : ARGC_HRS);
 
-       if (!*(args[cur_arg])) {
+       if (!*(args[cur_arg]) || strcmp(args[cur_arg], "if") == 0 || strcmp(args[cur_arg], "unless") == 0) {
                rule->arg.http_reply = http_parse_http_reply((const char *[]){"default-errorfiles", ""}, &arg, px, default_status, err);
                goto end;
        }
 
        if (strcmp(args[cur_arg], "deny_status") == 0) {
-               if (!*(args[cur_arg+2]) ||
-                   (strcmp(args[cur_arg+2], "errorfile") != 0 && strcmp(args[cur_arg+2], "errorfiles") != 0)) {
+               if (!*(args[cur_arg+2]) || strcmp(args[cur_arg+2], "if") == 0 || strcmp(args[cur_arg+2], "unless") == 0) {
                        rule->arg.http_reply = http_parse_http_reply((const char *[]){"status", args[cur_arg+1], "default-errorfiles", ""},
                                                                     &arg, px, default_status, err);
                        *orig_arg += 2;