haproxy nested conditions for acl

Question

I need nested ACL conditions

acl route1 hdr_sub(host) -i abc.com hdr_sub(host) -i xyz.com 
acl route2 path_beg /m1
acl route3 path_beg /m2


use backend back1 if route1 (route2 or route3)

// essentially  
route1 AND (route2 OR route3)

to match backends. What would be the correct HA code equivalent to this ?

Stroke

Answer 1

Rules in a single ACL are ORed, so, you can combine the route2 and route3 rules with this:

acl route2 path_beg /m1
acl route2 path_beg /m2

use backend back1 if route1 route2

Conditions also support the || operator, but not parenthetical grouping for precedence, so a b || c means (a and b) or (c), which isn't equivalent to what you want... so if you don't want to combine the ACLs as shown above, you would need this...

use backend back1 if route1 route2 || route1 route3

...which is not exactly intuitive.

Or this:

use backend back1 if route1 route2
use backend back1 if route1 route3

Crankpin

Is there a typo in the first line? Should that say route1 for the name? Or maybe route2 and route3 – Continental

Answer 2

See HA manual Section 7.2. Using ACLs to form conditions

You can declare an ACL to group those two conditions :

acl route2_or_route3 path_beg /m1 /m2

And use it in your rule:

use backend back1 if route1 route2_or_route3

Which means route1 and (route2 or route3).

Conditions in an ACL are grouped by an implicit logical OR.

Conditions in an action rule are grouped by an implicit logical AND.

Pail

please note that the HA manual, which states things quite clearly, uses only the terms path and hosts. There's no such things as "route" which first designates network routes and got overly misused in javascript frameworks documentations instead of url path. Caution is advised with generalization of names, as this makes searches harder. – Pail