Skip to content

add bypass header config option to maxmind_acl plugin#13160

Open
traeak wants to merge 1 commit into
apache:masterfrom
traeak:maxmind_bypass
Open

add bypass header config option to maxmind_acl plugin#13160
traeak wants to merge 1 commit into
apache:masterfrom
traeak:maxmind_bypass

Conversation

@traeak
Copy link
Copy Markdown
Contributor

@traeak traeak commented May 13, 2026

This adds support to use an optional header and value to bypass running this plugin in the TSRemapDoRemap stage.

maxmind config yaml looks like:

maxmind:
 bypass:
  header: "@BypassMe"
  value: someval

If this option is not provided then the plugin runs as normal in enforcing mode.
'value' is optional. If missing only the presence of the header is checked.a

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds a configurable request-header bypass path to the experimental maxmind_acl remap plugin so selected requests can skip MaxMind ACL evaluation.

Changes:

  • Adds bypass configuration parsing for maxmind.bypass.header and optional value.
  • Checks the configured bypass header during TSRemapDoRemap before ACL evaluation.
  • Documents the new bypass configuration block.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File Description
plugins/experimental/maxmind_acl/mmdb.h Declares bypass configuration state and helper methods.
plugins/experimental/maxmind_acl/mmdb.cc Loads bypass config and implements request-header bypass matching.
plugins/experimental/maxmind_acl/maxmind_acl.cc Skips ACL evaluation when bypass matching succeeds.
doc/admin-guide/plugins/maxmind_acl.en.rst Adds user-facing documentation for bypass configuration.

Comment on lines +565 to +567
// presence-only check
Dbg(dbg_ctl, "check_bypass: bypass header '%s' present", _bypass_header.c_str());
bypassed = true;
Comment on lines +569 to +576
int val_len = 0;
const char *val = TSMimeHdrFieldValueStringGet(mbuf, hdr_loc, field_loc, 0, &val_len);
if (val != nullptr && static_cast<int>(_bypass_header_value.size()) == val_len &&
_bypass_header_value.compare(0, std::string::npos, val, val_len) == 0) {
Dbg(dbg_ctl, "check_bypass: bypass header '%s' matched value '%s'", _bypass_header.c_str(), _bypass_header_value.c_str());
bypassed = true;
} else {
Dbg(dbg_ctl, "check_bypass: bypass header present but value did not match");
return false;
}

TSMLoc field_loc = TSMimeHdrFieldFind(mbuf, hdr_loc, _bypass_header.c_str(), static_cast<int>(_bypass_header.size()));
Comment on lines +121 to +126
An optional ``bypass`` field allows a request to skip all geo checks entirely and pass through
unmodified. If the specified request header is present, the plugin returns immediately without
performing any country, IP, regex, or anonymous evaluation.

``header``
Required sub-key. The name of the HTTP request header to look for, e.g. ``@GcdTaBypassGeo``.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants