Merge lp:~wgrant/charms/precise/squid-forwardproxy/auth_list-deny into lp:~canonical-launchpad-branches/charms/precise/squid-forwardproxy/trunk

[William Grant]

Allow auth_list to specify inverted matches and deny entries.

Allow auth_list to specify inverted matches and deny entries.

The syntax is slightly awkward in order to maintain backward compatibility, but it's not too bad. A key in an auth dict can be prefixed with "!" to invert the http_access match, and a special "http_access" key can be used to emit an "http_access deny" rather than the previously hardcoded "http_access allow". "http_access" still defaults to "allow" if it is omitted.

[Kit Randel (blr)]

One trivial thing, otherwise looks fine.

review: Approve

[lp:~wgrant/charms/precise/squid-forwardproxy/auth_list-deny]

31. By William Grant on 2015-08-12

Spacing.

=== modified file 'config.yaml'
--- config.yaml	2013-01-22 12:45:52 +0000
+++ config.yaml	2015-08-12 06:04:10 +0000
@@ -75,6 +75,6 @@
     default: ''
     description: >
       YAML-formatted list of squid auth dictionaries.  For example:
-      '[{dstdomain: [www.ubuntu.com], src: [1.2.3.4, 5.6.7.0/24]}, {url_regex: ["https?://[^/]+[.]internal(/.*)?"], src: [192.168.0.0/16]}]'
+      '[{dstdomain: [www.ubuntu.com], src: [1.2.3.4, 5.6.7.0/24]}, {"!port": [80], http_access: deny}, {url_regex: ["https?://[^/]+[.]internal(/.*)?"], src: [192.168.0.0/16]}]'
       NOTE: you can use the following oneliner to verify your YAML string:
             python -c 'import yaml;import sys;print yaml.dump(yaml.load(sys.argv[1]))' '<string>'

=== modified file 'hooks/hooks.py'
--- hooks/hooks.py	2015-07-30 06:40:10 +0000
+++ hooks/hooks.py	2015-08-12 06:04:10 +0000
@@ -229,7 +229,51 @@
     if config_data['auth_list']:
         auth_list = yaml.load(config_data['auth_list'])
     else:
-        auth_list = {}
+        auth_list = []
+
+    # Process auth_list into acl and http_access directives.
+    #
+    # Each dict in auth_list specifies a set of acl directives and an
+    # http_access directive that refers to them. The dict maps acl types
+    # to multiple values. A type may be prefixed with ! to invert the
+    # match. The special "http_access" key decides whether to allow or
+    # deny, defaulting to "allow".
+    #
+    # This:
+    #  [{"src": ["10.0.0.0/8"], "!dst": ["192.168.0.0/24"],
+    #    "http_access": "deny"},
+    #   {"src": ["10.0.0.0/8"], "dstdomain": ["example.com", "a.example.com"]}
+    #   ]
+    #
+    # Turns into this:
+    #  acl l1_src src 10.0.0.0/8
+    #  acl l1n_dst dst 192.168.0.0/24
+    #  http_access deny l1_src !l1n_dst
+    #  acl l2_src src 10.0.0.0/8
+    #  acl l2_dstdomain example.com
+    #  acl l2_dstdomain a.example.com
+    #  http_access allow l2_src l2_dstdomain
+    acls_and_access = []
+    for idx, combined in enumerate(auth_list):
+        acls = {}
+        aclspecs = []
+        for type, vals in combined.items():
+            if type == 'http_access':
+                continue
+            if type.startswith('!'):
+                inverted = True
+                type = type[1:]
+            else:
+                inverted = False
+            name = 'l%d%s_%s' % (idx + 1, 'n' if inverted else '', type)
+            acls[name] = (type, vals)
+            aclspecs.append('%s%s' % ('!' if inverted else '', name))
+        # http_access defaults to allow if it's not specified.
+        access = {
+            'http_access': combined.get('http_access', 'allow'),
+            'acls': aclspecs,
+            }
+        acls_and_access.append((acls, access))
 
     config_data['cache_l1'] = int(math.ceil(math.sqrt(
         int(config_data['cache_size_mb']) * 1024 / (16 *
@@ -241,7 +285,7 @@
             'config': config_data,
             'relations': relations,
             'refresh_patterns': refresh_patterns,
-            'auth_list': auth_list,
+            'acls_and_access': acls_and_access,
         }
         squid3_config.write(utils.render_template('main_config.template',
                                                   templ_vars))

=== modified file 'templates/main_config.template'
--- templates/main_config.template	2013-01-22 12:45:52 +0000
+++ templates/main_config.template	2015-08-12 06:04:10 +0000
@@ -37,14 +37,14 @@
 {% endfor -%}
 refresh_pattern .               30      20%     4320
 
-{% for auth in auth_list -%}
+{% for acls, access in acls_and_access -%}
 {% set idx = loop.index -%}
-{% for auth_name in auth.keys() -%} 
-{% for auth_val  in auth[auth_name] -%}
-acl l{{idx}}_{{ auth_name }} {{auth_name}} {{ auth_val }}
-{% endfor -%}
-{% endfor -%}
-http_access allow {% for auth_name in auth.keys() -%} l{{idx}}_{{auth_name}} {% endfor %}
+{% for acl_name, (acl_type, acl_vals) in acls.items() -%} 
+{% for acl_val in acl_vals -%}
+acl {{ acl_name }} {{ acl_type }} {{ acl_val }}
+{% endfor -%}
+{% endfor -%}
+http_access {{ access['http_access'] }} {% for acl_spec in access['acls'] -%} {{ acl_spec }} {% endfor %}
 {% endfor %}
 
 {% for relid in relations.keys() -%}