diff --git a/doc/configuration.txt b/doc/configuration.txt index f54dbd225..ce0888621 100644 --- a/doc/configuration.txt +++ b/doc/configuration.txt @@ -8334,6 +8334,7 @@ from the request, the response or any environmental status. The principle is simple : - extract a data sample from a stream, table or the environment + - optionally apply some format conversion to the extracted sample - apply one or multiple pattern matching methods on this sample - perform actions only when a pattern matches the sample @@ -8347,8 +8348,10 @@ In order to define a test, the "acl" keyword is used. The syntax is : This creates a new ACL or completes an existing one with new tests. Those tests apply to the portion of request/response specified in and may be adjusted with optional flags [flags]. Some criteria also support -an operator which may be specified before the set of values. The values are -of the type supported by the criterion, and are separated by spaces. +an operator which may be specified before the set of values. Optionally some +conversion operators may be applied to the sample, and they will be specified +as a comma-delimited list of keywords just after the first keyword. The values +are of the type supported by the criterion, and are separated by spaces. ACL names must be formed from upper and lower case letters, digits, '-' (dash), '_' (underscore) , '.' (dot) and ':' (colon). ACL names are case-sensitive, @@ -8360,7 +8363,8 @@ performance, they just consume a small amount of memory. The criterion generally is the name of a sample fetch method, or one of its ACL specific declinations. The default test method is implied by the output type of this sample fetch method. The ACL declinations can describe alternate matching -methods of a same sample fetch method. +methods of a same sample fetch method. The sample fetch methods are the only +ones supporting a conversion. Sample fetch methods return data which can be of the following types : - boolean @@ -8369,6 +8373,12 @@ Sample fetch methods return data which can be of the following types : - string - data block +Converters transform any of these data into any of these. For example, some +converters might convert a string to a lower-case string while other ones +would turn a string to an IPv4 address, or apply a netmask to an IP address. +The resulting sample is of the type of the last converter applied to the list, +which defaults to the type of the sample fetch method. + The ACL engine can match these types against patterns of the following types : - boolean - integer or integer range @@ -8476,6 +8486,11 @@ buffer, one would use the following acl : acl script_tag payload(0,500) -m reg -i