diff --git a/include/common/uri_auth.h b/include/common/uri_auth.h
index bffd694d6..906cb2c94 100644
--- a/include/common/uri_auth.h
+++ b/include/common/uri_auth.h
@@ -43,6 +43,7 @@ struct uri_auth {
struct stat_scope *scope; /* linked list of authorized proxies */
struct userlist *userlist; /* private userlist to emulate legacy "stats auth user:password" */
struct list req_acl; /* http stats ACL: allow/deny/auth */
+ struct list admin_rules; /* 'stats admin' rules (chained) */
struct uri_auth *next; /* Used at deinit() to build a list of unique elements */
};
@@ -61,6 +62,12 @@ struct uri_auth {
#endif
+struct stats_admin_rule {
+ struct list list; /* list linked to from the proxy */
+ struct acl_cond *cond; /* acl condition to meet */
+};
+
+
/* Various functions used to set the fields during the configuration parsing.
* Please that all those function can initialize the root entry in order not to
* force the user to respect a certain order in the configuration file.
diff --git a/include/proto/dumpstats.h b/include/proto/dumpstats.h
index 7038f469e..9cf5eec40 100644
--- a/include/proto/dumpstats.h
+++ b/include/proto/dumpstats.h
@@ -33,6 +33,7 @@
#define STAT_SHOW_INFO 0x00000004 /* dump the info part */
#define STAT_HIDE_DOWN 0x00000008 /* hide 'down' servers in the stats page */
#define STAT_NO_REFRESH 0x00000010 /* do not automatically refresh the stats page */
+#define STAT_ADMIN 0x00000020 /* indicate a stats admin level */
#define STAT_BOUND 0x00800000 /* bound statistics to selected proxies/types/services */
#define STATS_TYPE_FE 0
@@ -58,6 +59,7 @@
#define STAT_STATUS_DONE "DONE" /* the action is successful */
#define STAT_STATUS_NONE "NONE" /* nothing happened (no action chosen or servers state didn't change) */
#define STAT_STATUS_EXCD "EXCD" /* an error occured becayse the buffer couldn't store all data */
+#define STAT_STATUS_DENY "DENY" /* action denied */
int stats_accept(struct session *s);
diff --git a/src/cfgparse.c b/src/cfgparse.c
index ef2d9ca10..d1ffa371a 100644
--- a/src/cfgparse.c
+++ b/src/cfgparse.c
@@ -2533,6 +2533,40 @@ int cfg_parse_listen(const char *file, int linenum, char **args, int kwm)
if (!*args[1]) {
goto stats_error_parsing;
+ } else if (!strcmp(args[1], "admin")) {
+ struct stats_admin_rule *rule;
+
+ if (curproxy == &defproxy) {
+ Alert("parsing [%s:%d]: '%s %s' not allowed in 'defaults' section.\n", file, linenum, args[0], args[1]);
+ err_code |= ERR_ALERT | ERR_FATAL;
+ goto out;
+ }
+
+ if (!stats_check_init_uri_auth(&curproxy->uri_auth)) {
+ Alert("parsing [%s:%d]: out of memory.\n", file, linenum);
+ err_code |= ERR_ALERT | ERR_ABORT;
+ goto out;
+ }
+
+ if (strcmp(args[2], "if") != 0 && strcmp(args[2], "unless") != 0) {
+ Alert("parsing [%s:%d] : '%s %s' requires either 'if' or 'unless' followed by a condition.\n",
+ file, linenum, args[0], args[1]);
+ err_code |= ERR_ALERT | ERR_FATAL;
+ goto out;
+ }
+ if ((cond = build_acl_cond(file, linenum, curproxy, (const char **)args + 2)) == NULL) {
+ Alert("parsing [%s:%d] : error detected while parsing a '%s %s' rule.\n",
+ file, linenum, args[0], args[1]);
+ err_code |= ERR_ALERT | ERR_FATAL;
+ goto out;
+ }
+
+ err_code |= warnif_cond_requires_resp(cond, file, linenum);
+
+ rule = (struct stats_admin_rule *)calloc(1, sizeof(*rule));
+ rule->cond = cond;
+ LIST_INIT(&rule->list);
+ LIST_ADDQ(&curproxy->uri_auth->admin_rules, &rule->list);
} else if (!strcmp(args[1], "uri")) {
if (*(args[2]) == 0) {
Alert("parsing [%s:%d] : 'uri' needs an URI prefix.\n", file, linenum);
@@ -2695,7 +2729,7 @@ int cfg_parse_listen(const char *file, int linenum, char **args, int kwm)
}
} else {
stats_error_parsing:
- Alert("parsing [%s:%d]: %s '%s', expects 'uri', 'realm', 'auth', 'scope', 'enable', 'hide-version', 'show-node', 'show-desc' or 'show-legends'.\n",
+ Alert("parsing [%s:%d]: %s '%s', expects 'admin', 'uri', 'realm', 'auth', 'scope', 'enable', 'hide-version', 'show-node', 'show-desc' or 'show-legends'.\n",
file, linenum, *args[1]?"unknown stats parameter":"missing keyword in", args[*args[1]?1:0]);
err_code |= ERR_ALERT | ERR_FATAL;
goto out;
diff --git a/src/dumpstats.c b/src/dumpstats.c
index 5195d8c1e..f0d6c83f5 100644
--- a/src/dumpstats.c
+++ b/src/dumpstats.c
@@ -1514,6 +1514,13 @@ int stats_dump_http(struct session *s, struct buffer *rep, struct uri_auth *uri)
"You should retry with less servers at a time."
"\n", uri->uri_prefix);
}
+ else if (strcmp(s->data_ctx.stats.st_code, STAT_STATUS_DENY) == 0) {
+ chunk_printf(&msg,
+ ""
+ "
[X] "
+ "
Action denied."
+ "
"
@@ -1624,7 +1631,7 @@ int stats_dump_proxy(struct session *s, struct proxy *px, struct uri_auth *uri)
case DATA_ST_PX_TH:
if (!(s->data_ctx.stats.flags & STAT_FMT_CSV)) {
- if (px->cap & PR_CAP_BE && px->srv) {
+ if (px->cap & PR_CAP_BE && px->srv && (s->data_ctx.stats.flags & STAT_ADMIN)) {
/* A form to enable/disable this proxy servers */
chunk_printf(&msg,
"