One check was missing for the 'polarity' of the test. Now 'unless'
works. BTW, 'unless' provides a nice way to perform one-line auth :
acl valid-user http_auth(user-list)
http-request auth unless valid-user
continue;
/* check condition, but only if attached */
- if (req_acl->cond)
- ret = acl_exec_cond(req_acl->cond, px, s, txn, ACL_DIR_REQ);
+ if (!req_acl->cond)
+ continue;
+
+ ret = acl_exec_cond(req_acl->cond, px, s, txn, ACL_DIR_REQ);
+ ret = acl_pass(ret);
+ if (req_acl->cond->pol == ACL_COND_UNLESS)
+ ret = !ret;
if (ret) {
req_acl_final = req_acl;