Function TSRemapDoRemap

plugins/experimental/access_control/plugin.cc:570–626

* @brief Remap and sets up access control based on whether access control is required, failed, etc. * * @param instance plugin instance pointer * @param txn transaction handle * @param rri remap request info pointer * @return TSREMAP_NO_REMAP (access validation = success) * TSREMAP_DID_REMAP (access validation = failure and rejection of failed requests is configured) */

 * TSREMAP_DID_REMAP (access validation = failure and rejection of failed requests is configured)
 */
TSRemapStatus
TSRemapDoRemap(void *instance, TSHttpTxn txnp, TSRemapRequestInfo *rri)
{
  TSRemapStatus        remapStatus = TSREMAP_NO_REMAP;
  AccessControlConfig *config      = static_cast<AccessControlConfig *>(instance);

  if (nullptr != config) {
    /* Plugin is designed to be used only with TLS, check the scheme */
    int         schemeLen = 0;
    const char *scheme    = TSUrlSchemeGet(rri->requestBufp, rri->requestUrl, &schemeLen);
    if (nullptr != scheme) {
      if (/* strlen("https") */ 5 == schemeLen && 0 == strncmp(scheme, "https", schemeLen)) {
        AccessControlDebug("validate the access token");

        String      reqPath;
        int         pathLen = 0;
        const char *path    = TSUrlPathGet(rri->requestBufp, rri->requestUrl, &pathLen);
        if (nullptr != path && 0 < pathLen) {
          reqPath.assign(path, pathLen);
        }
        /* Check if any of the uri-path multi-pattern matched and if yes enforce access control. */
        String filename;
        String pattern;
        if (config->_uriPathScope.empty()) {
          /* Scope match enforce access control */
          AccessControlDebug("no plugin scope specified, enforcing access control");
          remapStatus = enforceAccessControl(txnp, rri, config);
        } else {
          if (true == config->_uriPathScope.matchAll(reqPath, filename, pattern)) {
            AccessControlDebug("matched plugin scope enforcing access control for path %s", reqPath.c_str());

            /* Scope match enforce access control */
            remapStatus = enforceAccessControl(txnp, rri, config);
          } else {
            AccessControlDebug("not matching plugin scope (file: %s, pattern %s), skipping access control for path '%s'",
                               filename.c_str(), pattern.c_str(), reqPath.c_str());
          }
        }
      } else {
        TSHttpTxnStatusSet(txnp, config->_invalidRequest);
        AccessControlDebug("https is the only allowed scheme (plugin should be used only with TLS)");
        remapStatus = TSREMAP_DID_REMAP;
      }
    } else {
      TSHttpTxnStatusSet(txnp, config->_internalError);
      AccessControlError("failed to get request uri-scheme");
      remapStatus = TSREMAP_DID_REMAP;
    }
  } else {
    /* Something is terribly wrong, we cannot get the configuration */
    TSHttpTxnStatusSet(txnp, TS_HTTP_STATUS_INTERNAL_SERVER_ERROR);
    AccessControlError("configuration unavailable");
    remapStatus = TSREMAP_DID_REMAP;
  }

  return remapStatus;
}