On 2009-03-10 at 15:01 -0700, Marc Perkel wrote:
> I'm having trouble understanding the forall/forany. Can I put an ACL in
> for the condition? Do you have an example?
No, you can't put an ACL in.
Okay, another example. This is a long way around, since match_ip takes
a list as the second parameter, but if we assume that it takes a single
block and do checks manually, then to check an IP against
/etc/mail/flat/bogons you might do this; it's a contrived example:
${if forany{<; ${filter{<;${readfile {/etc/mail/flat/bogons}{;}}}{match{$item}{^\\d}}}}{match_ip{$IP_ADDR}{$item}}}
(where $IP_ADDR is a dummy).
Breaking this down but not including backslashes, to leave it readable:
${if forany{<;
${filter{<;
${readfile {/etc/mail/flat/bogons}{;}}
}{
match{$item}{^\\d}
}
}
}
{
match_ip{$IP_ADDR}{$item}
}
}
So, read in the file with ${readfile...}, replacing newlines with
semicolons; this assumes that semicolon does't appear in the file, not
even in comments.
Then pass the results of ${readfile...} through
${filter{LIST}{CONDITION} -- the list is as already given, but we
specify the list separator as ';'. The condition is a normal expansion
condition, but we have the variable $item available to us. For each
item in the LIST, the CONDITION is expanded with $item set to that item.
We match on the regexp "starts with a digit". This is just a crude
filter for getting rid of blank lines, comments, etc. At the current
time, we get:
0.0.0.0/7;2.0.0.0/8;5.0.0.0/8;10.0.0.0/8;14.0.0.0/8;23.0.0.0/8;27.0.0.0/8;31.0.0.0/8;36.0.0.0/7;39.0.0.0/8;42.0.0.0/8;46.0.0.0/8;49.0.0.0/8;50.0.0.0/8;100.0.0.0/6;104.0.0.0/6;127.0.0.0/8;169.254.0.0/16;172.16.0.0/12;175.0.0.0/8;176.0.0.0/7;179.0.0.0/8;180.0.0.0/6;185.0.0.0/8;192.0.2.0/24;192.168.0.0/16;198.18.0.0/15;223.0.0.0/8;224.0.0.0/3
as the current bogons list (6.7, no changes in 6.8).
Then this whole result is used as the LIST input to the expansion
condition forany{LIST}{CONDITION} -- forany yields true if, for any
item in the list, CONDITION evaluates true. Again, the variable $item
holds each item of the LIST in turn.
In forany, we again set the list separator in the following string to be
a semi-colon. We then test $IP_ADDR against $item.
To make this work, either add backslashes at the end of each line, or
use the single-line form I gave at the top. Then replace $IP_ADDR with
whatever variable it is you're actually testing.
-Phil
