Remap ACL changes for 10#11033
Merged
bneradt merged 3 commits intoapache:masterfrom Feb 11, 2024
Merged
Conversation
bneradt
force-pushed
the
remap_acl_changes_for_10
branch
3 times, most recently
from
66aa325 to
2bcadc6
Compare
If a user specifies an @action=allow remap.config ACL rule, then the implication is that requests with methods not in the allow list would be denied. Before this patch, allow ACL rules would just never deny. This fixes that behavior so that allow ACL rules that match on IP but not on method deny.
This switches the order of how ACls are processed. Before this patch, defined rules were matched before remap ACL lines. Then ip_allow.yaml rules were run. This does two things: 1. Make remap.config ACL lines run before defined names. 2. If an ACL rule matches, it turns off ip_allow.yaml processing since a rule was already matched. This will likely obviate the need for a lot of uses of `.deactivatefilter ip_allow` since a matched rule will turn off ip_allow.yaml processing.
bneradt
force-pushed
the
remap_acl_changes_for_10
branch
2 times, most recently
from
86b4755 to
17168c2
Compare
bneradt
force-pushed
the
remap_acl_changes_for_10
branch
from
17168c2 to
f4b98d7
Compare
zwoop
approved these changes
Feb 10, 2024
bryancall
added a commit
to bryancall/trafficserver
that referenced
this pull request
Aug 12, 2024
Documentation for these PRs: apache#10910 - Change default C++ standard to 20 apache#11033 - Remap ACL changes for 10 apache#11045 - Deprecate the support for NPN apache#11171 - Remove symbols with prefix INKUDP from plugin API
This was referenced Aug 12, 2024
bryancall
added a commit
that referenced
this pull request
Aug 15, 2024
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This continues in the vein of #9631 by implementing the following ACL changes for ATS 10 which makes remap.config ACLs behave more similarly to ip_allow.yaml:
@action=allowto deny transactions that are not in the allow list. Transactions with non-allowed methods simply didn't match the rule before, so they were not denied. This seems like a bug to me.