Change remap ACL matching policy to 'Match on IP and Method'

apache / trafficserver

Apache Traffic Server™ is a fast, scalable and extensible HTTP/1.1 and HTTP/2 compliant caching proxy server.

https://trafficserver.apache.org/

Apache License 2.0

1.74k stars 782 forks source link

Change remap ACL matching policy to 'Match on IP and Method' #11433

Closed masaori335 closed 2 days ago

masaori335 commented 3 weeks ago

Introduce a new config proxy.config.url_remap.acl_matching_policy to change the behavior of remap ACL filters.

0 (default) employs the "first explicit match wins" policy, this means ATS continue processing ACL filters if it's implicit match and stop processing only if it's explicit match.
1 employs "first any match wins" policy, this means the first ACL filter is used if it exists. Please note that action is flipped for implicit matches.

For AuTest

Tests in the remap_acl.test.py configured to use "first any match wins" policy to minimize change for now.
remap_acl_2.test.py covers all cases. ( I grabbed code from #11421 )

If all we agree with this approach, I'll add docs and cleanup AuTests.

Co-authored-by: @mattyw

JosiahWI commented 3 weeks ago

The AuTest ja3_fingerprint failed and LSan detected a leak in the magick plugin.

JosiahWI commented 3 weeks ago

LSan detected a leak in the magick plugin.

masaori335 commented 3 weeks ago

Now, AuTest covers many cases but it takes time.

time ./autest.sh --ats-bin /opt/ats-asf-master-work-4-debug/bin -f remap_acl_2
Python 3.6 or newer detected!
python3-dev/devel detected!
pipenv detected!
Using the pre-existing virtual environment.
Environment config finished. Running AuTest...
Running Test remap_acl_2:........................................................................................ Passed

Generating Report: --------------
Total of 1 test
  Unknown: 0
  Exception: 0
  Failed: 0
  Warning: 0
  Skipped: 0
  Passed: 1
./autest.sh --ats-bin /opt/ats-asf-master-work-4-debug/bin -f remap_acl_2  58.48s user 68.75s system 19% cpu 11:09.22 total

JosiahWI commented 2 weeks ago

       File "/home/jenkins/workspace/Github_Builds/autest/src/tests/gold_tests/remap/remap_acl.test.py", line 358, in <module>
         from deactivate_ip_allow import all_deactivate_ip_allow_tests
     ModuleNotFoundError: No module named 'deactivate_ip_allow'

masaori335 commented 2 weeks ago

@JosiahWI right. we merged our test cases in to current remap_acl.test.py, but somehow import path is not working on the ci. ( it worked on local )

We'll check it, but if needed we'll separate AuTest and land ATS core change first.

masaori335 commented 2 weeks ago

It's all green! Ready for review. We found the autest.sh is generated by autest.sh.in.

masaori335 commented 1 week ago

@bneradt Thanks for review. I addressed what you pointed out. Please check it out.

cmcfarlen commented 22 hours ago

Cherry-picked to v10.0.x