From: Willy Tarreau <w@1wt.eu>
Date: Wed, 11 Nov 2026 11:05:02 +0000 (+0200)
Subject: MINOR: http-rules: accept "no-warn" before the condition of access control rules
X-Git-Tag: v3.5-dev12~10
X-Git-Url: https://git.kaiwu.me/ngx_http_flv_module.html?a=commitdiff_plain;h=3cb0f18eddf54b7142669e64edeaaa03f7e6cb45;p=haproxy.git

MINOR: http-rules: accept "no-warn" before the condition of access control rules

The http-request actions marked with KWF_ACCESS_CTRL (auth, deny, reject,
silent-drop, tarpit) now accept the "no-warn" keyword placed right before
"if" or "unless". It is removed from the arguments before the action's
parser is called so that the parsers don't have to know about it. It is
only looked up for these actions so that it cannot be confused with an
argument value of another action (e.g. a header value).

It has no effect for now. It will be used to exclude a rule from the
upcoming report of conditions relying on aliasable contents. It comes
separately so that it can be backported to stable versions along with
the previous commit (KWF_ACCESS_CTRL), allowing configurations which
use it to still parse after a rollback, and so that the reg-tests can
be updated before the report is introduced.
---

diff --git a/src/http_rules.c b/src/http_rules.c
index 05801b1f3..a980fa976 100644
--- a/src/http_rules.c
+++ b/src/http_rules.c
@@ -109,6 +109,25 @@ struct act_rule *parse_http_req_cond(const char **args, const char *file, int li
 		/* try in the module list */
 		rule->kw = custom;
 
+		if (custom->flags & KWF_ACCESS_CTRL) {
+			/* access control actions support "no-warn" right before
+			 * the condition to indicate that the rule is known not to
+			 * be reliable by itself. We remove it from the list so
+			 * that the action's parser doesn't have to deal with it.
+			 */
+			for (; *args[cur_arg]; cur_arg++) {
+				if (strcmp(args[cur_arg], "if") == 0 || strcmp(args[cur_arg], "unless") == 0)
+					break;
+			}
+
+			if (*args[cur_arg] && strcmp(args[cur_arg - 1], "no-warn") == 0) {
+				for (cur_arg--; *args[cur_arg + 1]; cur_arg++)
+					args[cur_arg] = args[cur_arg + 1];
+				args[cur_arg] = args[cur_arg + 1];
+			}
+			cur_arg = 1;
+		}
+
 		if (custom->flags & KWF_EXPERIMENTAL) {
 			if (!experimental_directives_allowed) {
 				ha_alert("parsing [%s:%d] : '%s' action is experimental, must be allowed via a global 'expose-experimental-directives'\n",