acl：

The use of Access Control Lists (ACL) provides a flexible solution to perform content switching and generally to take decisions based on content extracted from the request, the response or any environmental status.

基于某种检测条件 ,将用户请求或相应的某一类(通常为请求),做访问控制

acl <aclname> <criterion> [flags] [operator] [<value>] ...

    <aclname>：关键字的名称 '-' (dash), '_' (underscore) , '.' (dot) and ':' (colon).ACL names are case-sensitive. 多个acl可以使用一个名称区分大小写

     <criterion>：标准或规范     [flags]： 不区分大小写什么的 选项    [operator] ：运算符

            <value>的类型：

           bool    - boolean 布尔型值             int        - integer or integer range 整数             ip        - IP address / network  ip地址             str        - string (exact, substring, suffix, prefix, subdir, domain) 字符串             - regular expression   正则表达式模式             - hex block    十进制数据块

            <flags>

              -i : ignore case during matching of all subsequent patterns. 不区分大小写

              -m : use a specific pattern matching method 使用特定的模式完成匹配                                 匹配字符串：

                                         (-m str) : 精确匹配

                                      (-m sub) : 子串匹配                                         (-m beg) : 前缀匹配                                         (-m end) :后缀匹配                                         (-m dir) : 以"/"区分匹配    /etc/haproxy/SOME/ 在此种匹配                                           (-m dom) :以"."区分 做匹配

              -n : forbid the DNS resolutions  禁用DNS解析

              -u : force the unique id of the ACL ACL名称不能相同              -- : force end of flags. Useful when a string looks like one of the flags. 当一个字符串看起来像flags时 用来转意               

            [operator] 运算符

                匹配整数值：eq、ge、gt、le、lt

************************************<criterion>*********************************************

acl作为条件时的逻辑关系：默认&&  <criterion>

            - AND (implicit)

            - OR  (explicit with the "or" keyword or the "||" operator)             - Negation with the exclamation mark ("!")例             if invalid_src invalid_port  incalid_src 和incalid_port 都满足             if invalid_src || invalid_port 或者             if ! invalid_src invalid_port  不满足incalid_src 但满足incalid_port   (每个条件必须单独给"!"才是都去非)

 常用的检查标准:

            dst : 匹配目标ip            dst_port : integer 匹配目标prot            src : ip 匹配源ip            src_port : integer 匹配源地址端口         例  acl invalid_src  src  172.16.200.2 匹配目标ip地址  规则名称为invalid_srcpath : string 用户所请求的url      (这里的匹配是 或关系)    This extracts the request's URL path, which starts at the first slash and ends before the question mark (without the host part). 抽取出用户请求的url 的路径 (以"/"开头 "?"之前的内容)                                                                             /path;<params>

            path     : exact string match  精确匹配

            path_beg : prefix match    前侧匹配

            path_dir : subdir match    以"/"匹配            path_dom : domain match 域匹配            path_end : suffix match   后半段匹配            path_len : length match    长度匹配            path_reg : regex match  正则表达式匹配

             path_sub : substring match 子串匹配

        

url : string 整个url匹配相关 

This extracts the request's URL as presented in the request. A typical use is with prefetch-capable caches, and with portals which need to aggregate multiple information from databases and keep them in caches.

            url     : exact string match

            url_beg : prefix match

            url_dir : subdir match            url_dom : domain match            url_end : suffix match            url_len : length match            url_reg : regex match            url_sub : substring match

req.hdr([<name>[,<occ>]]) : string  请求报文的首部做匹配  最后一次

            hdr([<name>[,<occ>]])     : exact string match

            dr_beg([<name>[,<occ>]]) : prefix match            hdr_dir([<name>[,<occ>]]) : subdir match            hdr_dom([<name>[,<occ>]]) : domain match            hdr_end([<name>[,<occ>]]) : suffix match            hdr_len([<name>[,<occ>]]) : length match            hdr_reg([<name>[,<occ>]]) : regex match            hdr_sub([<name>[,<occ>]]) : substring match

示例：

            acl     bad_curl     hdr_sub(User-Agent)    -i     curl   #匹配 报文请求报文首部中子串(hdr_sub) 不区分大小写

            lock if bad_curl

status : integer 检查状态码

 **************************************************************************************

Pre-defined ACLs haproxy内部定义的  aclname和规则

**************************************************************************************

基于ACL的动静分离示例：

        frontend  web *:80 定义前段端口

                acl url_static       path_beg       -i /static /p_w_picpaths /javascript /stylesheets 规则 从首段匹配  aclname=url_static                acl url_static       path_end       -i .jpg .gif .png .css .js .html .txt .htm  规则 从后端匹配    aclname=url_static

                use_backend staticsrvs          if url_static                                        当满足url_static定义的条件式 使用 staticsrvs后端服务器组

                default_backend             appsrvs                                                    默认服务器组为  appsrvs

        backend staticsrvs                                                     定义后端staticsrvs 的主机列表

               balance     roundrobin                                        调度算法是轮询               server      stcsrv1 172.16.100.6:80 check        指明后端服务器stcsrv1 的ip:port 开启健康状态检查

         backend appsrvs                                                      定义后端appsrvs主机列表

              balance     roundrobin                                          调度算法为轮询              server  app1 172.16.100.7:80 check                                server  app1 172.16.100.7:8080 check 

        listen stats                                                                    定义listen

            bind :9091                                                                定义端口            stats enable                                                             开启状态页面  默认/haproxy?status            stats auth admin:admin                                          指明认证时的user:password            stats admin if TRUE                                                当认证条件为真是