access_by_lua and satisfy any

aguy · 2015-12-17T19:36:57+00:00

I'm sorry for that, Thank you2015-12-17 3:52 GMT+08:00 Yichun Zhang (agentzh) <age...@gmail.com>:Hello! On Wed, Dec 16, 2015 at 7:35 AM, &#x5468...

access_by_lua and satisfy any

aguy

Hi,

I'm trying to restrict access to a location using access_by_lua, the restriction I want to put in place is basically "whitelisted IP or authenticated user"

But if I put "satisfy any" in the location block, it seems like the access_by_lua directive is not evaluated at all..

the block looks like this :

location / {

access_by_lua_file /etc/nginx/lua/irule.lua;

satisfy any;

allow 127.0.0.1;

allow 172.23.0.0/16;

deny all;

auth_basic "Restricted Access. ";

auth_basic_user_file resources/auth_users.txt;

proxy_pass http://$target;

}

Variable $target is set by lua.

I've seen a mention of something being fixed in version 1.0.11.23, but it's old, and I'm using 1.7.10.2 .

Any idea what is the issue here ?

agentzh

Hello!

On Thu, Dec 17, 2015 at 3:36 AM, Antoine Guy wrote:
> But if I put "satisfy any" in the location block, it seems like the
> access_by_lua directive is not evaluated at all..
>

This looks normal to me since "satisfy any" means the first satisfied
access-phase handler would bypass the remaining access-phase handlers
that haven't run yet. See

    http://nginx.org/en/docs/http/ngx_http_core_module.html#satisfy

Maybe you really need the default "satisfy all" behaviour?

Regards,
-agentzh

Regards,
-agentzh

aguy

Not really, but I could replace it with rewrite_by_lua. Is there a difference with access_by_lua except the phase it runs in ?

On Thursday, December 17, 2015 at 5:56:13 PM UTC+1, agentzh wrote:

Hello!

On Thu, Dec 17, 2015 at 3:36 AM, Antoine Guy wrote:
> But if I put "satisfy any" in the location block, it seems like the
> access_by_lua directive is not evaluated at all..
>

This looks normal to me since "satisfy any" means the first satisfied
access-phase handler would bypass the remaining access-phase handlers
that haven't run yet. See

http://nginx.org/en/docs/http/ngx_http_core_module.html#satisfy

Maybe you really need the default "satisfy all" behaviour?

Regards,
-agentzh

Regards,
-agentzh

agentzh

Hello!

On Fri, Dec 18, 2015 at 4:42 AM, Antoine Guy wrote:
> Not really, but I could replace it with rewrite_by_lua. Is there a
> difference with access_by_lua except the phase it runs in ?
>

Nope.

Regards,
-agentzh