From: Willy Tarreau Date: Mon, 21 Sep 2026 20:12:37 +0000 (+0000) Subject: REGTESTS: http-rules: test the run-time ACL and map update actions X-Git-Tag: v3.5-dev8~70 X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=839fafd3582bff649b7a05627b8b8916af8fcf06;p=haproxy.git REGTESTS: http-rules: test the run-time ACL and map update actions The add-acl, del-acl, set-map and del-map actions were not covered at all, nor were the "file@", "opt@" and "virt@" name formats described in section 2.7. The test adds and removes entries from one request and observes them from the next one, on an ACL loaded from a regular file and on three maps designated respectively by a plain file name, by the same name prefixed with "file@" to verify that both reference the same list, by "virt@" which has no file at all, and by "opt@" pointing at a file which does not exist. It also checks that updating an existing key replaces its value instead of duplicating the entry, that the set-map action is usable from the http-after-response rule set, and that the resulting lists are visible from "show acl" and "show map". --- diff --git a/reg-tests/http-rules/acl_map_updates.acl b/reg-tests/http-rules/acl_map_updates.acl new file mode 100644 index 000000000..b08261fd6 --- /dev/null +++ b/reg-tests/http-rules/acl_map_updates.acl @@ -0,0 +1,4 @@ +# ACL entries used by acl_map_updates.vtc. Entries are added to and +# removed from this list at run time but the file itself is never +# modified. +/initial diff --git a/reg-tests/http-rules/acl_map_updates.map b/reg-tests/http-rules/acl_map_updates.map new file mode 100644 index 000000000..72747a8a5 --- /dev/null +++ b/reg-tests/http-rules/acl_map_updates.map @@ -0,0 +1,3 @@ +# Map entries used by acl_map_updates.vtc, referenced both by its plain +# name and through the "file@" prefix. +/initial initial diff --git a/reg-tests/http-rules/acl_map_updates.vtc b/reg-tests/http-rules/acl_map_updates.vtc new file mode 100644 index 000000000..cca3d19db --- /dev/null +++ b/reg-tests/http-rules/acl_map_updates.vtc @@ -0,0 +1,143 @@ +varnishtest "Test the run-time ACL and map update actions" + +# The add-acl, del-acl, set-map and del-map actions had no coverage at +# all. They are checked here on an ACL loaded from a regular file and on +# maps declared with the three name formats of section 2.7: a regular +# file, "file@" which designates the very same list, "virt@" which has no +# file at all, and "opt@" pointing at a file which does not exist. +# +# The updates are performed by one request and observed by the next one. + +feature ignore_unknown_macro + +haproxy h1 -conf { + global + .if feature(THREAD) + thread-groups 1 + .endif + chroot / + + defaults + mode http + timeout connect "${HAPROXY_TEST_TIMEOUT-5s}" + timeout client "${HAPROXY_TEST_TIMEOUT-5s}" + timeout server "${HAPROXY_TEST_TIMEOUT-5s}" + + frontend fe + bind "fd@${fe}" + + # the same list is designated with and without the "file@" prefix + acl known url_param(q) -f "${testdir}/acl_map_updates.acl" + + http-request add-acl("${testdir}/acl_map_updates.acl") %[url_param(add)] if { url_param(add) -m found } + http-request del-acl("${testdir}/acl_map_updates.acl") %[url_param(del)] if { url_param(del) -m found } + + http-request set-map(virt@vmap) %[url_param(key)] "v-%[url_param(val)]" if { url_param(key) -m found } + http-request del-map(virt@vmap) %[url_param(unkey)] if { url_param(unkey) -m found } + + http-request set-map("opt@${testdir}/acl_map_updates-missing.map") %[url_param(key)] "o-%[url_param(val)]" if { url_param(key) -m found } + http-request set-map("file@${testdir}/acl_map_updates.map") %[url_param(key)] "f-%[url_param(val)]" if { url_param(key) -m found } + + # observe the current state of the four lists + http-request set-var(txn.acl) str(yes) if known + http-request set-var(txn.vmap) url_param(q),map(virt@vmap) + http-request set-var(txn.omap) url_param(q),map("opt@${testdir}/acl_map_updates-missing.map") + http-request set-var(txn.fmap) url_param(q),map("file@${testdir}/acl_map_updates.map") + # the plain name and the "file@" form designate the same list + http-request set-var(txn.pmap) url_param(q),map("${testdir}/acl_map_updates.map") + + http-request return status 200 + + # set-map is also usable from the http-after-response rule set + http-after-response set-map(virt@vmap) /aft aft-value if { status 200 } + + http-after-response set-header x-acl "%[var(txn.acl)]" + http-after-response set-header x-vmap "%[var(txn.vmap)]" + http-after-response set-header x-omap "%[var(txn.omap)]" + http-after-response set-header x-fmap "%[var(txn.fmap)]" + http-after-response set-header x-pmap "%[var(txn.pmap)]" +} -start + +client c1 -connect ${h1_fe_sock} { + # initial state: only the entries loaded from the files are present + txreq -url "/?q=/initial" + rxresp + expect resp.status == 200 + expect resp.http.x-acl == "yes" + expect resp.http.x-vmap == "" + expect resp.http.x-omap == "" + expect resp.http.x-fmap == "initial" + expect resp.http.x-pmap == "initial" + + txreq -url "/?q=/added" + rxresp + expect resp.status == 200 + expect resp.http.x-acl == "" + expect resp.http.x-vmap == "" + expect resp.http.x-omap == "" + expect resp.http.x-fmap == "" + expect resp.http.x-pmap == "" + + # add one ACL entry and one entry in each of the three maps + txreq -url "/?add=/added&key=/added&val=1" + rxresp + expect resp.status == 200 + + txreq -url "/?q=/added" + rxresp + expect resp.status == 200 + expect resp.http.x-acl == "yes" + expect resp.http.x-vmap == "v-1" + expect resp.http.x-omap == "o-1" + expect resp.http.x-fmap == "f-1" + expect resp.http.x-pmap == "f-1" + + # the http-after-response rule fed the virtual map as well + txreq -url "/?q=/aft" + rxresp + expect resp.status == 200 + expect resp.http.x-vmap == "aft-value" + + # adding an existing key does not duplicate it, it updates its value + txreq -url "/?add=/added&key=/added&val=2" + rxresp + expect resp.status == 200 + + txreq -url "/?q=/added" + rxresp + expect resp.status == 200 + expect resp.http.x-acl == "yes" + expect resp.http.x-vmap == "v-2" + expect resp.http.x-fmap == "f-2" + + # now remove them again + txreq -url "/?del=/added&unkey=/added" + rxresp + expect resp.status == 200 + + txreq -url "/?q=/added" + rxresp + expect resp.status == 200 + expect resp.http.x-acl == "" + expect resp.http.x-vmap == "" + # only the virtual map entry was removed, the two others remain + expect resp.http.x-omap == "o-2" + expect resp.http.x-fmap == "f-2" + + # the entries loaded from the files are untouched + txreq -url "/?q=/initial" + rxresp + expect resp.status == 200 + expect resp.http.x-acl == "yes" + expect resp.http.x-fmap == "initial" +} -run + +haproxy h1 -cli { + # the run-time updates are visible from the CLI, and the virtual map + # is listed under its full name + send "show map virt@vmap" + expect ~ "0x[0-9a-f]* /aft aft-value" + + send "show acl ${testdir}/acl_map_updates.acl" + expect ~ "0x[0-9a-f]* /initial" +}