blob: 91228503444e9d1b13d3ff73b2d0237a47d7848d [file] [log] [blame]
Willy Tarreau59f98392012-07-06 14:13:49 +02001/*
2 * Connection management functions
3 *
4 * Copyright 2000-2012 Willy Tarreau <w@1wt.eu>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
Willy Tarreaue1e4a612012-10-05 00:10:55 +020013#include <errno.h>
14
Willy Tarreau59f98392012-07-06 14:13:49 +020015#include <common/compat.h>
16#include <common/config.h>
Willy Tarreau0108d902018-11-25 19:14:37 +010017#include <common/initcall.h>
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +010018#include <common/namespace.h>
Emmanuel Hocdet4399c752018-02-05 15:26:43 +010019#include <common/hash.h>
20#include <common/net_helper.h>
Willy Tarreau59f98392012-07-06 14:13:49 +020021
Willy Tarreauc5788912012-08-24 18:12:41 +020022#include <proto/connection.h>
Willy Tarreaudd2f85e2012-09-02 22:34:23 +020023#include <proto/fd.h>
Willy Tarreau5f1504f2012-10-04 23:55:57 +020024#include <proto/frontend.h>
Willy Tarreau2da156f2012-07-23 15:07:23 +020025#include <proto/proto_tcp.h>
Willy Tarreau2c6be842012-07-06 17:12:34 +020026#include <proto/stream_interface.h>
Emeric Brun4f603012017-01-05 15:11:44 +010027#include <proto/sample.h>
Emeric Brun46591952012-05-18 15:47:34 +020028#include <proto/ssl_sock.h>
Emeric Brun46591952012-05-18 15:47:34 +020029
Alexander Liu2a54bb72019-05-22 19:44:48 +080030#include <common/debug.h>
31
Willy Tarreau8ceae722018-11-26 11:58:30 +010032DECLARE_POOL(pool_head_connection, "connection", sizeof(struct connection));
33DECLARE_POOL(pool_head_connstream, "conn_stream", sizeof(struct conn_stream));
Willy Tarreauff5d57b2019-07-17 18:37:02 +020034DECLARE_POOL(pool_head_sockaddr, "sockaddr", sizeof(struct sockaddr_storage));
Geoff Simmons7185b782019-08-27 18:31:16 +020035DECLARE_POOL(pool_head_authority, "authority", PP2_AUTHORITY_MAX);
Willy Tarreau8ceae722018-11-26 11:58:30 +010036
Willy Tarreau13e14102016-12-22 20:25:26 +010037struct xprt_ops *registered_xprt[XPRT_ENTRIES] = { NULL, };
Willy Tarreauf2943dc2012-10-26 20:10:28 +020038
Christopher Faulet32f61c02018-04-10 14:33:41 +020039/* List head of all known muxes for PROTO */
40struct mux_proto_list mux_proto_list = {
41 .list = LIST_HEAD_INIT(mux_proto_list.list)
Willy Tarreau2386be62017-09-21 19:40:52 +020042};
43
Willy Tarreau59f98392012-07-06 14:13:49 +020044/* I/O callback for fd-based connections. It calls the read/write handlers
Willy Tarreau7a798e52016-04-14 11:13:20 +020045 * provided by the connection's sock_ops, which must be valid.
Willy Tarreau59f98392012-07-06 14:13:49 +020046 */
Willy Tarreau7a798e52016-04-14 11:13:20 +020047void conn_fd_handler(int fd)
Willy Tarreau59f98392012-07-06 14:13:49 +020048{
Willy Tarreau80184712012-07-06 14:54:49 +020049 struct connection *conn = fdtab[fd].owner;
Willy Tarreau9e272bf2012-10-03 21:04:48 +020050 unsigned int flags;
Olivier Houchardaf4021e2018-08-09 13:06:55 +020051 int io_available = 0;
Willy Tarreau59f98392012-07-06 14:13:49 +020052
Willy Tarreaud80cb4e2018-01-20 19:30:13 +010053 if (unlikely(!conn)) {
54 activity[tid].conn_dead++;
Willy Tarreau7a798e52016-04-14 11:13:20 +020055 return;
Willy Tarreaud80cb4e2018-01-20 19:30:13 +010056 }
Willy Tarreau59f98392012-07-06 14:13:49 +020057
Willy Tarreau7d281492012-12-16 19:19:13 +010058 conn_refresh_polling_flags(conn);
Willy Tarreau916e12d2017-10-25 09:22:43 +020059 conn->flags |= CO_FL_WILL_UPDATE;
60
Willy Tarreau7d281492012-12-16 19:19:13 +010061 flags = conn->flags & ~CO_FL_ERROR; /* ensure to call the wake handler upon error */
Willy Tarreaud29a0662012-12-10 16:33:38 +010062
Willy Tarreau8e3c6ce2017-08-28 15:46:01 +020063 /* The connection owner might want to be notified about an end of
64 * handshake indicating the connection is ready, before we proceed with
65 * any data exchange. The callback may fail and cause the connection to
66 * be destroyed, thus we must not use it anymore and should immediately
67 * leave instead. The caller must immediately unregister itself once
68 * called.
Willy Tarreau2542b532012-08-31 16:01:23 +020069 */
Olivier Houchardfe50bfb2019-05-27 12:09:19 +020070 if (!(conn->flags & CO_FL_HANDSHAKE) &&
Olivier Houchardea8dd942019-05-20 14:02:16 +020071 conn->xprt_done_cb && conn->xprt_done_cb(conn) < 0)
Willy Tarreau7a798e52016-04-14 11:13:20 +020072 return;
Willy Tarreau2542b532012-08-31 16:01:23 +020073
Olivier Houchardc3df4502019-06-05 17:07:45 +020074 if (conn->xprt && fd_send_ready(fd)) {
Willy Tarreau3c0cc492017-03-19 07:54:28 +010075 /* force reporting of activity by clearing the previous flags :
76 * we'll have at least ERROR or CONNECTED at the end of an I/O,
77 * both of which will be detected below.
Willy Tarreau9e272bf2012-10-03 21:04:48 +020078 */
Willy Tarreau3c0cc492017-03-19 07:54:28 +010079 flags = 0;
Olivier Houchardfa8aa862018-10-10 18:25:41 +020080 if (conn->send_wait != NULL) {
Willy Tarreau4f6516d2018-12-19 13:59:17 +010081 conn->send_wait->events &= ~SUB_RETRY_SEND;
Willy Tarreau3c39a7d2019-06-14 14:42:29 +020082 tasklet_wakeup(conn->send_wait->tasklet);
Olivier Houchardfa8aa862018-10-10 18:25:41 +020083 conn->send_wait = NULL;
84 } else
85 io_available = 1;
Olivier Houchard53216e72018-10-10 15:46:36 +020086 __conn_xprt_stop_send(conn);
Willy Tarreau9e272bf2012-10-03 21:04:48 +020087 }
Willy Tarreau59f98392012-07-06 14:13:49 +020088
Willy Tarreau57ec32f2017-04-11 19:59:33 +020089 /* The data transfer starts here and stops on error and handshakes. Note
90 * that we must absolutely test conn->xprt at each step in case it suddenly
91 * changes due to a quick unexpected close().
92 */
Olivier Houchardc3df4502019-06-05 17:07:45 +020093 if (conn->xprt && fd_recv_ready(fd)) {
Willy Tarreau3c0cc492017-03-19 07:54:28 +010094 /* force reporting of activity by clearing the previous flags :
95 * we'll have at least ERROR or CONNECTED at the end of an I/O,
96 * both of which will be detected below.
Willy Tarreau9e272bf2012-10-03 21:04:48 +020097 */
Willy Tarreau3c0cc492017-03-19 07:54:28 +010098 flags = 0;
Olivier Houchardfa8aa862018-10-10 18:25:41 +020099 if (conn->recv_wait) {
Willy Tarreau4f6516d2018-12-19 13:59:17 +0100100 conn->recv_wait->events &= ~SUB_RETRY_RECV;
Willy Tarreau3c39a7d2019-06-14 14:42:29 +0200101 tasklet_wakeup(conn->recv_wait->tasklet);
Olivier Houchardfa8aa862018-10-10 18:25:41 +0200102 conn->recv_wait = NULL;
103 } else
104 io_available = 1;
Olivier Houchard53216e72018-10-10 15:46:36 +0200105 __conn_xprt_stop_recv(conn);
Willy Tarreau9e272bf2012-10-03 21:04:48 +0200106 }
Willy Tarreau2da156f2012-07-23 15:07:23 +0200107
Willy Tarreaufd803bb2014-01-20 15:13:07 +0100108 if (unlikely(conn->flags & CO_FL_WAIT_L4_CONN)) {
Willy Tarreauf8deb0c2012-09-01 17:59:22 +0200109 /* still waiting for a connection to establish and nothing was
110 * attempted yet to probe the connection. Then let's retry the
111 * connect().
Willy Tarreau2da156f2012-07-23 15:07:23 +0200112 */
Willy Tarreau239d7182012-07-23 18:53:03 +0200113 if (!tcp_connect_probe(conn))
Willy Tarreauafad0e02012-08-09 14:45:22 +0200114 goto leave;
Willy Tarreau2da156f2012-07-23 15:07:23 +0200115 }
Willy Tarreau2c6be842012-07-06 17:12:34 +0200116 leave:
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100117 /* Verify if the connection just established. */
Willy Tarreau7bf3fa32017-03-14 20:19:29 +0100118 if (unlikely(!(conn->flags & (CO_FL_WAIT_L4_CONN | CO_FL_WAIT_L6_CONN | CO_FL_CONNECTED))))
119 conn->flags |= CO_FL_CONNECTED;
120
Willy Tarreau8e3c6ce2017-08-28 15:46:01 +0200121 /* The connection owner might want to be notified about failures to
122 * complete the handshake. The callback may fail and cause the
123 * connection to be destroyed, thus we must not use it anymore and
124 * should immediately leave instead. The caller must immediately
125 * unregister itself once called.
126 */
127 if (((conn->flags ^ flags) & CO_FL_NOTIFY_DONE) &&
128 conn->xprt_done_cb && conn->xprt_done_cb(conn) < 0)
129 return;
130
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100131 /* The wake callback is normally used to notify the data layer about
132 * data layer activity (successful send/recv), connection establishment,
133 * shutdown and fatal errors. We need to consider the following
134 * situations to wake up the data layer :
135 * - change among the CO_FL_NOTIFY_DATA flags :
136 * {DATA,SOCK}_{RD,WR}_SH, ERROR,
137 * - absence of any of {L4,L6}_CONN and CONNECTED, indicating the
138 * end of handshake and transition to CONNECTED
139 * - raise of CONNECTED with HANDSHAKE down
140 * - end of HANDSHAKE with CONNECTED set
141 * - regular data layer activity
142 *
143 * Note that the wake callback is allowed to release the connection and
144 * the fd (and return < 0 in this case).
Willy Tarreau2396c1c2012-10-03 21:12:16 +0200145 */
Olivier Houchardaf4021e2018-08-09 13:06:55 +0200146 if ((io_available || (((conn->flags ^ flags) & CO_FL_NOTIFY_DATA) ||
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100147 ((flags & (CO_FL_CONNECTED|CO_FL_HANDSHAKE)) != CO_FL_CONNECTED &&
Olivier Houchard910b2bc2018-07-17 18:49:38 +0200148 (conn->flags & (CO_FL_CONNECTED|CO_FL_HANDSHAKE)) == CO_FL_CONNECTED))) &&
Olivier Houchardfe50bfb2019-05-27 12:09:19 +0200149 conn->mux && conn->mux->wake && conn->mux->wake(conn) < 0)
Willy Tarreau7a798e52016-04-14 11:13:20 +0200150 return;
Willy Tarreaufd31e532012-07-23 18:24:25 +0200151
Willy Tarreauf9dabec2012-08-17 17:33:53 +0200152 /* commit polling changes */
Willy Tarreau916e12d2017-10-25 09:22:43 +0200153 conn->flags &= ~CO_FL_WILL_UPDATE;
Willy Tarreauf9dabec2012-08-17 17:33:53 +0200154 conn_cond_update_polling(conn);
Willy Tarreau7a798e52016-04-14 11:13:20 +0200155 return;
Willy Tarreau59f98392012-07-06 14:13:49 +0200156}
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200157
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200158/* Update polling on connection <c>'s file descriptor depending on its current
159 * state as reported in the connection's CO_FL_CURR_* flags, reports of EAGAIN
Olivier Houchard1a0545f2017-09-13 18:30:23 +0200160 * in CO_FL_WAIT_*, and the data layer expectations indicated by CO_FL_XPRT_*.
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200161 * The connection flags are updated with the new flags at the end of the
Willy Tarreau0ffde2c2012-10-04 22:21:15 +0200162 * operation. Polling is totally disabled if an error was reported.
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200163 */
Olivier Houchard1a0545f2017-09-13 18:30:23 +0200164void conn_update_xprt_polling(struct connection *c)
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200165{
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200166 unsigned int f = c->flags;
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200167
Willy Tarreau3c728722014-01-23 13:50:42 +0100168 if (!conn_ctrl_ready(c))
Willy Tarreauf79c8172013-10-21 16:30:56 +0200169 return;
170
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200171 /* update read status if needed */
Olivier Houchard1a0545f2017-09-13 18:30:23 +0200172 if (unlikely((f & (CO_FL_CURR_RD_ENA|CO_FL_XPRT_RD_ENA)) == CO_FL_XPRT_RD_ENA)) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200173 fd_want_recv(c->handle.fd);
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100174 f |= CO_FL_CURR_RD_ENA;
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200175 }
Olivier Houchard1a0545f2017-09-13 18:30:23 +0200176 else if (unlikely((f & (CO_FL_CURR_RD_ENA|CO_FL_XPRT_RD_ENA)) == CO_FL_CURR_RD_ENA)) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200177 fd_stop_recv(c->handle.fd);
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100178 f &= ~CO_FL_CURR_RD_ENA;
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200179 }
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200180
181 /* update write status if needed */
Olivier Houchard1a0545f2017-09-13 18:30:23 +0200182 if (unlikely((f & (CO_FL_CURR_WR_ENA|CO_FL_XPRT_WR_ENA)) == CO_FL_XPRT_WR_ENA)) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200183 fd_want_send(c->handle.fd);
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100184 f |= CO_FL_CURR_WR_ENA;
185 }
Olivier Houchard1a0545f2017-09-13 18:30:23 +0200186 else if (unlikely((f & (CO_FL_CURR_WR_ENA|CO_FL_XPRT_WR_ENA)) == CO_FL_CURR_WR_ENA)) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200187 fd_stop_send(c->handle.fd);
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100188 f &= ~CO_FL_CURR_WR_ENA;
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200189 }
Willy Tarreau310987a2014-01-22 19:46:33 +0100190 c->flags = f;
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200191}
192
Willy Tarreauff3e6482015-03-12 23:56:52 +0100193/* Send a message over an established connection. It makes use of send() and
194 * returns the same return code and errno. If the socket layer is not ready yet
195 * then -1 is returned and ENOTSOCK is set into errno. If the fd is not marked
196 * as ready, or if EAGAIN or ENOTCONN is returned, then we return 0. It returns
197 * EMSGSIZE if called with a zero length message. The purpose is to simplify
198 * some rare attempts to directly write on the socket from above the connection
199 * (typically send_proxy). In case of EAGAIN, the fd is marked as "cant_send".
200 * It automatically retries on EINTR. Other errors cause the connection to be
201 * marked as in error state. It takes similar arguments as send() except the
202 * first one which is the connection instead of the file descriptor. Note,
203 * MSG_DONTWAIT and MSG_NOSIGNAL are forced on the flags.
204 */
205int conn_sock_send(struct connection *conn, const void *buf, int len, int flags)
206{
207 int ret;
208
209 ret = -1;
210 errno = ENOTSOCK;
211
212 if (conn->flags & CO_FL_SOCK_WR_SH)
213 goto fail;
214
215 if (!conn_ctrl_ready(conn))
216 goto fail;
217
218 errno = EMSGSIZE;
219 if (!len)
220 goto fail;
221
Willy Tarreau585744b2017-08-24 14:31:19 +0200222 if (!fd_send_ready(conn->handle.fd))
Willy Tarreauff3e6482015-03-12 23:56:52 +0100223 goto wait;
224
225 do {
Willy Tarreau585744b2017-08-24 14:31:19 +0200226 ret = send(conn->handle.fd, buf, len, flags | MSG_DONTWAIT | MSG_NOSIGNAL);
Willy Tarreauff3e6482015-03-12 23:56:52 +0100227 } while (ret < 0 && errno == EINTR);
228
229
230 if (ret > 0)
231 return ret;
232
233 if (ret == 0 || errno == EAGAIN || errno == ENOTCONN) {
234 wait:
Willy Tarreau585744b2017-08-24 14:31:19 +0200235 fd_cant_send(conn->handle.fd);
Willy Tarreauff3e6482015-03-12 23:56:52 +0100236 return 0;
237 }
238 fail:
239 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH | CO_FL_ERROR;
240 return ret;
241}
242
Olivier Houcharde179d0e2019-03-21 18:27:17 +0100243int conn_unsubscribe(struct connection *conn, void *xprt_ctx, int event_type, void *param)
Olivier Houchard83a0cd82018-09-28 17:57:58 +0200244{
Olivier Houchardfa8aa862018-10-10 18:25:41 +0200245 struct wait_event *sw;
Olivier Houchard83a0cd82018-09-28 17:57:58 +0200246
Willy Tarreau4f6516d2018-12-19 13:59:17 +0100247 if (event_type & SUB_RETRY_RECV) {
Olivier Houchard83a0cd82018-09-28 17:57:58 +0200248 sw = param;
Olivier Houchard35d11682019-05-14 18:02:47 +0200249 BUG_ON(conn->recv_wait != sw);
250 conn->recv_wait = NULL;
251 sw->events &= ~SUB_RETRY_RECV;
Olivier Houchard53216e72018-10-10 15:46:36 +0200252 __conn_xprt_stop_recv(conn);
Olivier Houchard83a0cd82018-09-28 17:57:58 +0200253 }
Willy Tarreau4f6516d2018-12-19 13:59:17 +0100254 if (event_type & SUB_RETRY_SEND) {
Olivier Houchard83a0cd82018-09-28 17:57:58 +0200255 sw = param;
Olivier Houchard35d11682019-05-14 18:02:47 +0200256 BUG_ON(conn->send_wait != sw);
257 conn->send_wait = NULL;
258 sw->events &= ~SUB_RETRY_SEND;
Olivier Houchard53216e72018-10-10 15:46:36 +0200259 __conn_xprt_stop_send(conn);
Olivier Houchard83a0cd82018-09-28 17:57:58 +0200260 }
Olivier Houchard53216e72018-10-10 15:46:36 +0200261 conn_update_xprt_polling(conn);
Olivier Houchard83a0cd82018-09-28 17:57:58 +0200262 return 0;
263}
264
Olivier Houcharde179d0e2019-03-21 18:27:17 +0100265int conn_subscribe(struct connection *conn, void *xprt_ctx, int event_type, void *param)
Olivier Houchard6ff20392018-07-17 18:46:31 +0200266{
Olivier Houchardfa8aa862018-10-10 18:25:41 +0200267 struct wait_event *sw;
Olivier Houchard6ff20392018-07-17 18:46:31 +0200268
Willy Tarreau4f6516d2018-12-19 13:59:17 +0100269 if (event_type & SUB_RETRY_RECV) {
Olivier Houchard4cf7fb12018-08-02 19:23:05 +0200270 sw = param;
Olivier Houchard35d11682019-05-14 18:02:47 +0200271 BUG_ON(conn->recv_wait != NULL || (sw->events & SUB_RETRY_RECV));
272 sw->events |= SUB_RETRY_RECV;
273 conn->recv_wait = sw;
Willy Tarreau4f6516d2018-12-19 13:59:17 +0100274 event_type &= ~SUB_RETRY_RECV;
Olivier Houchard53216e72018-10-10 15:46:36 +0200275 __conn_xprt_want_recv(conn);
Olivier Houchard83a0cd82018-09-28 17:57:58 +0200276 }
Willy Tarreau4f6516d2018-12-19 13:59:17 +0100277 if (event_type & SUB_RETRY_SEND) {
Olivier Houchard6ff20392018-07-17 18:46:31 +0200278 sw = param;
Olivier Houchard35d11682019-05-14 18:02:47 +0200279 BUG_ON(conn->send_wait != NULL || (sw->events & SUB_RETRY_SEND));
280 sw->events |= SUB_RETRY_SEND;
281 conn->send_wait = sw;
Willy Tarreau4f6516d2018-12-19 13:59:17 +0100282 event_type &= ~SUB_RETRY_SEND;
Olivier Houchard53216e72018-10-10 15:46:36 +0200283 __conn_xprt_want_send(conn);
Olivier Houchard6ff20392018-07-17 18:46:31 +0200284 }
Olivier Houchard83a0cd82018-09-28 17:57:58 +0200285 if (event_type != 0)
286 return (-1);
Olivier Houchard53216e72018-10-10 15:46:36 +0200287 conn_update_xprt_polling(conn);
Olivier Houchard83a0cd82018-09-28 17:57:58 +0200288 return 0;
Olivier Houchard6ff20392018-07-17 18:46:31 +0200289}
290
Willy Tarreaud85c4852015-03-13 00:40:28 +0100291/* Drains possibly pending incoming data on the file descriptor attached to the
292 * connection and update the connection's flags accordingly. This is used to
293 * know whether we need to disable lingering on close. Returns non-zero if it
294 * is safe to close without disabling lingering, otherwise zero. The SOCK_RD_SH
295 * flag may also be updated if the incoming shutdown was reported by the drain()
296 * function.
297 */
298int conn_sock_drain(struct connection *conn)
299{
Willy Tarreaue215bba2018-08-24 14:31:53 +0200300 int turns = 2;
301 int len;
302
Willy Tarreaud85c4852015-03-13 00:40:28 +0100303 if (!conn_ctrl_ready(conn))
304 return 1;
305
306 if (conn->flags & (CO_FL_ERROR | CO_FL_SOCK_RD_SH))
307 return 1;
308
Willy Tarreaue215bba2018-08-24 14:31:53 +0200309 if (fdtab[conn->handle.fd].ev & (FD_POLL_ERR|FD_POLL_HUP))
310 goto shut;
Willy Tarreaud85c4852015-03-13 00:40:28 +0100311
Willy Tarreaue215bba2018-08-24 14:31:53 +0200312 if (!fd_recv_ready(conn->handle.fd))
313 return 0;
Willy Tarreaud85c4852015-03-13 00:40:28 +0100314
Willy Tarreaue215bba2018-08-24 14:31:53 +0200315 if (conn->ctrl->drain) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200316 if (conn->ctrl->drain(conn->handle.fd) <= 0)
Willy Tarreaud85c4852015-03-13 00:40:28 +0100317 return 0;
Willy Tarreaue215bba2018-08-24 14:31:53 +0200318 goto shut;
319 }
320
321 /* no drain function defined, use the generic one */
322
323 while (turns) {
324#ifdef MSG_TRUNC_CLEARS_INPUT
325 len = recv(conn->handle.fd, NULL, INT_MAX, MSG_DONTWAIT | MSG_NOSIGNAL | MSG_TRUNC);
326 if (len == -1 && errno == EFAULT)
327#endif
328 len = recv(conn->handle.fd, trash.area, trash.size,
329 MSG_DONTWAIT | MSG_NOSIGNAL);
330
331 if (len == 0)
332 goto shut;
333
334 if (len < 0) {
335 if (errno == EAGAIN) {
336 /* connection not closed yet */
337 fd_cant_recv(conn->handle.fd);
338 break;
339 }
340 if (errno == EINTR) /* oops, try again */
341 continue;
342 /* other errors indicate a dead connection, fine. */
343 goto shut;
344 }
345 /* OK we read some data, let's try again once */
346 turns--;
Willy Tarreaud85c4852015-03-13 00:40:28 +0100347 }
348
Willy Tarreaue215bba2018-08-24 14:31:53 +0200349 /* some data are still present, give up */
350 return 0;
351
352 shut:
353 /* we're certain the connection was shut down */
354 fdtab[conn->handle.fd].linger_risk = 0;
Willy Tarreaud85c4852015-03-13 00:40:28 +0100355 conn->flags |= CO_FL_SOCK_RD_SH;
356 return 1;
357}
358
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100359/*
360 * Get data length from tlv
361 */
362static int get_tlv_length(const struct tlv *src)
363{
364 return (src->length_hi << 8) | src->length_lo;
365}
366
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200367/* This handshake handler waits a PROXY protocol header at the beginning of the
368 * raw data stream. The header looks like this :
369 *
370 * "PROXY" <SP> PROTO <SP> SRC3 <SP> DST3 <SP> SRC4 <SP> <DST4> "\r\n"
371 *
372 * There must be exactly one space between each field. Fields are :
373 * - PROTO : layer 4 protocol, which must be "TCP4" or "TCP6".
374 * - SRC3 : layer 3 (eg: IP) source address in standard text form
375 * - DST3 : layer 3 (eg: IP) destination address in standard text form
376 * - SRC4 : layer 4 (eg: TCP port) source address in standard text form
377 * - DST4 : layer 4 (eg: TCP port) destination address in standard text form
378 *
379 * This line MUST be at the beginning of the buffer and MUST NOT wrap.
380 *
381 * The header line is small and in all cases smaller than the smallest normal
382 * TCP MSS. So it MUST always be delivered as one segment, which ensures we
383 * can safely use MSG_PEEK and avoid buffering.
384 *
385 * Once the data is fetched, the values are set in the connection's address
386 * fields, and data are removed from the socket's buffer. The function returns
387 * zero if it needs to wait for more data or if it fails, or 1 if it completed
388 * and removed itself.
389 */
390int conn_recv_proxy(struct connection *conn, int flag)
391{
392 char *line, *end;
Willy Tarreau77992672014-06-14 11:06:17 +0200393 struct proxy_hdr_v2 *hdr_v2;
394 const char v2sig[] = PP2_SIGNATURE;
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100395 int tlv_length = 0;
KOVACS Krisztian7209c202015-07-03 14:09:10 +0200396 int tlv_offset = 0;
Willy Tarreaub406b872018-08-22 05:20:32 +0200397 int ret;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200398
399 /* we might have been called just after an asynchronous shutr */
400 if (conn->flags & CO_FL_SOCK_RD_SH)
401 goto fail;
402
Willy Tarreau3c728722014-01-23 13:50:42 +0100403 if (!conn_ctrl_ready(conn))
Willy Tarreauf79c8172013-10-21 16:30:56 +0200404 goto fail;
405
Willy Tarreauca79f592019-07-17 19:04:47 +0200406 if (!sockaddr_alloc(&conn->src) || !sockaddr_alloc(&conn->dst))
407 goto fail;
408
Willy Tarreau585744b2017-08-24 14:31:19 +0200409 if (!fd_recv_ready(conn->handle.fd))
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200410 goto not_ready;
Willy Tarreaufd803bb2014-01-20 15:13:07 +0100411
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200412 do {
Willy Tarreaub406b872018-08-22 05:20:32 +0200413 ret = recv(conn->handle.fd, trash.area, trash.size, MSG_PEEK);
414 if (ret < 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200415 if (errno == EINTR)
416 continue;
417 if (errno == EAGAIN) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200418 fd_cant_recv(conn->handle.fd);
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200419 goto not_ready;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200420 }
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100421 goto recv_abort;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200422 }
Willy Tarreaub406b872018-08-22 05:20:32 +0200423 trash.data = ret;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200424 } while (0);
425
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200426 if (!trash.data) {
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100427 /* client shutdown */
428 conn->err_code = CO_ER_PRX_EMPTY;
429 goto fail;
430 }
431
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200432 if (trash.data < 6)
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200433 goto missing;
434
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200435 line = trash.area;
436 end = trash.area + trash.data;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200437
438 /* Decode a possible proxy request, fail early if it does not match */
Willy Tarreau77992672014-06-14 11:06:17 +0200439 if (strncmp(line, "PROXY ", 6) != 0)
440 goto not_v1;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200441
442 line += 6;
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200443 if (trash.data < 9) /* shortest possible line */
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200444 goto missing;
445
David CARLIER42ff05e2016-03-24 09:22:36 +0000446 if (memcmp(line, "TCP4 ", 5) == 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200447 u32 src3, dst3, sport, dport;
448
449 line += 5;
450
451 src3 = inetaddr_host_lim_ret(line, end, &line);
452 if (line == end)
453 goto missing;
454 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100455 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200456
457 dst3 = inetaddr_host_lim_ret(line, end, &line);
458 if (line == end)
459 goto missing;
460 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100461 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200462
463 sport = read_uint((const char **)&line, end);
464 if (line == end)
465 goto missing;
466 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100467 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200468
469 dport = read_uint((const char **)&line, end);
470 if (line > end - 2)
471 goto missing;
472 if (*line++ != '\r')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100473 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200474 if (*line++ != '\n')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100475 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200476
477 /* update the session's addresses and mark them set */
Willy Tarreau226572f2019-07-17 14:46:00 +0200478 ((struct sockaddr_in *)conn->src)->sin_family = AF_INET;
479 ((struct sockaddr_in *)conn->src)->sin_addr.s_addr = htonl(src3);
480 ((struct sockaddr_in *)conn->src)->sin_port = htons(sport);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200481
Willy Tarreau226572f2019-07-17 14:46:00 +0200482 ((struct sockaddr_in *)conn->dst)->sin_family = AF_INET;
483 ((struct sockaddr_in *)conn->dst)->sin_addr.s_addr = htonl(dst3);
484 ((struct sockaddr_in *)conn->dst)->sin_port = htons(dport);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200485 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
486 }
David CARLIER42ff05e2016-03-24 09:22:36 +0000487 else if (memcmp(line, "TCP6 ", 5) == 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200488 u32 sport, dport;
489 char *src_s;
490 char *dst_s, *sport_s, *dport_s;
491 struct in6_addr src3, dst3;
492
493 line += 5;
494
495 src_s = line;
496 dst_s = sport_s = dport_s = NULL;
497 while (1) {
498 if (line > end - 2) {
499 goto missing;
500 }
501 else if (*line == '\r') {
502 *line = 0;
503 line++;
504 if (*line++ != '\n')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100505 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200506 break;
507 }
508
509 if (*line == ' ') {
510 *line = 0;
511 if (!dst_s)
512 dst_s = line + 1;
513 else if (!sport_s)
514 sport_s = line + 1;
515 else if (!dport_s)
516 dport_s = line + 1;
517 }
518 line++;
519 }
520
521 if (!dst_s || !sport_s || !dport_s)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100522 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200523
524 sport = read_uint((const char **)&sport_s,dport_s - 1);
525 if (*sport_s != 0)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100526 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200527
528 dport = read_uint((const char **)&dport_s,line - 2);
529 if (*dport_s != 0)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100530 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200531
532 if (inet_pton(AF_INET6, src_s, (void *)&src3) != 1)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100533 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200534
535 if (inet_pton(AF_INET6, dst_s, (void *)&dst3) != 1)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100536 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200537
538 /* update the session's addresses and mark them set */
Willy Tarreau226572f2019-07-17 14:46:00 +0200539 ((struct sockaddr_in6 *)conn->src)->sin6_family = AF_INET6;
540 memcpy(&((struct sockaddr_in6 *)conn->src)->sin6_addr, &src3, sizeof(struct in6_addr));
541 ((struct sockaddr_in6 *)conn->src)->sin6_port = htons(sport);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200542
Willy Tarreau226572f2019-07-17 14:46:00 +0200543 ((struct sockaddr_in6 *)conn->dst)->sin6_family = AF_INET6;
544 memcpy(&((struct sockaddr_in6 *)conn->dst)->sin6_addr, &dst3, sizeof(struct in6_addr));
545 ((struct sockaddr_in6 *)conn->dst)->sin6_port = htons(dport);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200546 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
547 }
Willy Tarreau4c20d292014-06-14 11:41:36 +0200548 else if (memcmp(line, "UNKNOWN\r\n", 9) == 0) {
549 /* This can be a UNIX socket forwarded by an haproxy upstream */
550 line += 9;
551 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200552 else {
Willy Tarreau4c20d292014-06-14 11:41:36 +0200553 /* The protocol does not match something known (TCP4/TCP6/UNKNOWN) */
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100554 conn->err_code = CO_ER_PRX_BAD_PROTO;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200555 goto fail;
556 }
557
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200558 trash.data = line - trash.area;
Willy Tarreau77992672014-06-14 11:06:17 +0200559 goto eat_header;
560
561 not_v1:
562 /* try PPv2 */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200563 if (trash.data < PP2_HEADER_LEN)
Willy Tarreau77992672014-06-14 11:06:17 +0200564 goto missing;
565
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200566 hdr_v2 = (struct proxy_hdr_v2 *) trash.area;
Willy Tarreau77992672014-06-14 11:06:17 +0200567
568 if (memcmp(hdr_v2->sig, v2sig, PP2_SIGNATURE_LEN) != 0 ||
569 (hdr_v2->ver_cmd & PP2_VERSION_MASK) != PP2_VERSION) {
570 conn->err_code = CO_ER_PRX_NOT_HDR;
571 goto fail;
572 }
573
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200574 if (trash.data < PP2_HEADER_LEN + ntohs(hdr_v2->len))
Willy Tarreau77992672014-06-14 11:06:17 +0200575 goto missing;
576
577 switch (hdr_v2->ver_cmd & PP2_CMD_MASK) {
578 case 0x01: /* PROXY command */
579 switch (hdr_v2->fam) {
580 case 0x11: /* TCPv4 */
KOVACS Krisztianefd3aa92014-11-19 10:53:20 +0100581 if (ntohs(hdr_v2->len) < PP2_ADDR_LEN_INET)
582 goto bad_header;
583
Willy Tarreau226572f2019-07-17 14:46:00 +0200584 ((struct sockaddr_in *)conn->src)->sin_family = AF_INET;
585 ((struct sockaddr_in *)conn->src)->sin_addr.s_addr = hdr_v2->addr.ip4.src_addr;
586 ((struct sockaddr_in *)conn->src)->sin_port = hdr_v2->addr.ip4.src_port;
587 ((struct sockaddr_in *)conn->dst)->sin_family = AF_INET;
588 ((struct sockaddr_in *)conn->dst)->sin_addr.s_addr = hdr_v2->addr.ip4.dst_addr;
589 ((struct sockaddr_in *)conn->dst)->sin_port = hdr_v2->addr.ip4.dst_port;
Willy Tarreau77992672014-06-14 11:06:17 +0200590 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
KOVACS Krisztian7209c202015-07-03 14:09:10 +0200591 tlv_offset = PP2_HEADER_LEN + PP2_ADDR_LEN_INET;
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100592 tlv_length = ntohs(hdr_v2->len) - PP2_ADDR_LEN_INET;
Willy Tarreau77992672014-06-14 11:06:17 +0200593 break;
594 case 0x21: /* TCPv6 */
KOVACS Krisztianefd3aa92014-11-19 10:53:20 +0100595 if (ntohs(hdr_v2->len) < PP2_ADDR_LEN_INET6)
596 goto bad_header;
597
Willy Tarreau226572f2019-07-17 14:46:00 +0200598 ((struct sockaddr_in6 *)conn->src)->sin6_family = AF_INET6;
599 memcpy(&((struct sockaddr_in6 *)conn->src)->sin6_addr, hdr_v2->addr.ip6.src_addr, 16);
600 ((struct sockaddr_in6 *)conn->src)->sin6_port = hdr_v2->addr.ip6.src_port;
601 ((struct sockaddr_in6 *)conn->dst)->sin6_family = AF_INET6;
602 memcpy(&((struct sockaddr_in6 *)conn->dst)->sin6_addr, hdr_v2->addr.ip6.dst_addr, 16);
603 ((struct sockaddr_in6 *)conn->dst)->sin6_port = hdr_v2->addr.ip6.dst_port;
Willy Tarreau77992672014-06-14 11:06:17 +0200604 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
KOVACS Krisztian7209c202015-07-03 14:09:10 +0200605 tlv_offset = PP2_HEADER_LEN + PP2_ADDR_LEN_INET6;
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100606 tlv_length = ntohs(hdr_v2->len) - PP2_ADDR_LEN_INET6;
Willy Tarreau77992672014-06-14 11:06:17 +0200607 break;
608 }
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100609
610 /* TLV parsing */
611 if (tlv_length > 0) {
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200612 while (tlv_offset + TLV_HEADER_SIZE <= trash.data) {
613 const struct tlv *tlv_packet = (struct tlv *) &trash.area[tlv_offset];
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100614 const int tlv_len = get_tlv_length(tlv_packet);
615 tlv_offset += tlv_len + TLV_HEADER_SIZE;
616
617 switch (tlv_packet->type) {
Emmanuel Hocdet115df3e2018-02-05 16:23:23 +0100618 case PP2_TYPE_CRC32C: {
619 void *tlv_crc32c_p = (void *)tlv_packet->value;
620 uint32_t n_crc32c = ntohl(read_u32(tlv_crc32c_p));
621 write_u32(tlv_crc32c_p, 0);
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200622 if (hash_crc32c(trash.area, PP2_HEADER_LEN + ntohs(hdr_v2->len)) != n_crc32c)
Emmanuel Hocdet115df3e2018-02-05 16:23:23 +0100623 goto bad_header;
624 break;
625 }
Willy Tarreaue5733232019-05-22 19:24:06 +0200626#ifdef USE_NS
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100627 case PP2_TYPE_NETNS: {
628 const struct netns_entry *ns;
629 ns = netns_store_lookup((char*)tlv_packet->value, tlv_len);
630 if (ns)
631 conn->proxy_netns = ns;
632 break;
633 }
634#endif
Geoff Simmons7185b782019-08-27 18:31:16 +0200635 case PP2_TYPE_AUTHORITY: {
636 if (tlv_len > PP2_AUTHORITY_MAX)
637 goto bad_header;
638 conn->proxy_authority = pool_alloc(pool_head_authority);
639 if (conn->proxy_authority == NULL)
640 goto fail;
641 memcpy(conn->proxy_authority, (const char *)tlv_packet->value, tlv_len);
642 conn->proxy_authority_len = tlv_len;
643 break;
644 }
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100645 default:
646 break;
647 }
648 }
649 }
650
Willy Tarreau77992672014-06-14 11:06:17 +0200651 /* unsupported protocol, keep local connection address */
652 break;
653 case 0x00: /* LOCAL command */
654 /* keep local connection address for LOCAL */
655 break;
656 default:
657 goto bad_header; /* not a supported command */
658 }
659
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200660 trash.data = PP2_HEADER_LEN + ntohs(hdr_v2->len);
Willy Tarreau77992672014-06-14 11:06:17 +0200661 goto eat_header;
662
663 eat_header:
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200664 /* remove the PROXY line from the request. For this we re-read the
665 * exact line at once. If we don't get the exact same result, we
666 * fail.
667 */
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200668 do {
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200669 int len2 = recv(conn->handle.fd, trash.area, trash.data, 0);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200670 if (len2 < 0 && errno == EINTR)
671 continue;
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200672 if (len2 != trash.data)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100673 goto recv_abort;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200674 } while (0);
675
676 conn->flags &= ~flag;
Emeric Brun4f603012017-01-05 15:11:44 +0100677 conn->flags |= CO_FL_RCVD_PROXY;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200678 return 1;
679
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200680 not_ready:
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200681 return 0;
682
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200683 missing:
684 /* Missing data. Since we're using MSG_PEEK, we can only poll again if
685 * we have not read anything. Otherwise we need to fail because we won't
686 * be able to poll anymore.
687 */
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100688 conn->err_code = CO_ER_PRX_TRUNCATED;
689 goto fail;
690
691 bad_header:
692 /* This is not a valid proxy protocol header */
693 conn->err_code = CO_ER_PRX_BAD_HDR;
694 goto fail;
695
696 recv_abort:
697 conn->err_code = CO_ER_PRX_ABORT;
Willy Tarreau26f4a042013-12-04 23:44:10 +0100698 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH;
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100699 goto fail;
700
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200701 fail:
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200702 conn->flags |= CO_FL_ERROR;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200703 return 0;
704}
705
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100706/* This handshake handler waits a NetScaler Client IP insertion header
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000707 * at the beginning of the raw data stream. The header format is
708 * described in doc/netscaler-client-ip-insertion-protocol.txt
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100709 *
710 * This line MUST be at the beginning of the buffer and MUST NOT be
711 * fragmented.
712 *
713 * The header line is small and in all cases smaller than the smallest normal
714 * TCP MSS. So it MUST always be delivered as one segment, which ensures we
715 * can safely use MSG_PEEK and avoid buffering.
716 *
717 * Once the data is fetched, the values are set in the connection's address
718 * fields, and data are removed from the socket's buffer. The function returns
719 * zero if it needs to wait for more data or if it fails, or 1 if it completed
720 * and removed itself.
721 */
722int conn_recv_netscaler_cip(struct connection *conn, int flag)
723{
724 char *line;
Bertrand Jacquin7d668f92017-12-13 01:23:39 +0000725 uint32_t hdr_len;
Willy Tarreau0ca24aa2019-03-29 17:35:32 +0100726 uint8_t ip_ver;
Willy Tarreaub406b872018-08-22 05:20:32 +0200727 int ret;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100728
729 /* we might have been called just after an asynchronous shutr */
730 if (conn->flags & CO_FL_SOCK_RD_SH)
731 goto fail;
732
733 if (!conn_ctrl_ready(conn))
734 goto fail;
735
Willy Tarreau585744b2017-08-24 14:31:19 +0200736 if (!fd_recv_ready(conn->handle.fd))
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200737 goto not_ready;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100738
739 do {
Willy Tarreaub406b872018-08-22 05:20:32 +0200740 ret = recv(conn->handle.fd, trash.area, trash.size, MSG_PEEK);
741 if (ret < 0) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100742 if (errno == EINTR)
743 continue;
744 if (errno == EAGAIN) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200745 fd_cant_recv(conn->handle.fd);
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200746 goto not_ready;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100747 }
748 goto recv_abort;
749 }
Willy Tarreaub406b872018-08-22 05:20:32 +0200750 trash.data = ret;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100751 } while (0);
752
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200753 if (!trash.data) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100754 /* client shutdown */
755 conn->err_code = CO_ER_CIP_EMPTY;
756 goto fail;
757 }
758
759 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000760 * CIP magic, header length or
761 * CIP magic, CIP length, CIP type, header length */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200762 if (trash.data < 12)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100763 goto missing;
764
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200765 line = trash.area;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100766
767 /* Decode a possible NetScaler Client IP request, fail early if
768 * it does not match */
Willy Tarreau55e0da62018-09-20 11:26:52 +0200769 if (ntohl(*(uint32_t *)line) != __objt_listener(conn->target)->bind_conf->ns_cip_magic)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100770 goto bad_magic;
771
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000772 /* Legacy CIP protocol */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200773 if ((trash.area[8] & 0xD0) == 0x40) {
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000774 hdr_len = ntohl(*(uint32_t *)(line+4));
775 line += 8;
776 }
777 /* Standard CIP protocol */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200778 else if (trash.area[8] == 0x00) {
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000779 hdr_len = ntohs(*(uint32_t *)(line+10));
780 line += 12;
781 }
782 /* Unknown CIP protocol */
783 else {
784 conn->err_code = CO_ER_CIP_BAD_PROTO;
785 goto fail;
786 }
787
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100788 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000789 * a minimal IP header */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200790 if (trash.data < 20)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100791 goto missing;
792
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100793 /* Get IP version from the first four bits */
Willy Tarreau0ca24aa2019-03-29 17:35:32 +0100794 ip_ver = (*line & 0xf0) >> 4;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100795
Willy Tarreau0ca24aa2019-03-29 17:35:32 +0100796 if (ip_ver == 4) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100797 struct ip *hdr_ip4;
David Carlier3015a2e2016-07-04 22:51:33 +0100798 struct my_tcphdr *hdr_tcp;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100799
800 hdr_ip4 = (struct ip *)line;
801
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200802 if (trash.data < 40 || trash.data < hdr_len) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100803 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin67de5a22017-12-13 01:15:05 +0000804 * IPv4 header, TCP header */
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100805 goto missing;
Bertrand Jacquinb3875912017-12-13 00:58:51 +0000806 }
807 else if (hdr_ip4->ip_p != IPPROTO_TCP) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100808 /* The protocol does not include a TCP header */
809 conn->err_code = CO_ER_CIP_BAD_PROTO;
810 goto fail;
Bertrand Jacquinb3875912017-12-13 00:58:51 +0000811 }
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100812
David Carlier3015a2e2016-07-04 22:51:33 +0100813 hdr_tcp = (struct my_tcphdr *)(line + (hdr_ip4->ip_hl * 4));
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100814
815 /* update the session's addresses and mark them set */
Willy Tarreau226572f2019-07-17 14:46:00 +0200816 ((struct sockaddr_in *)conn->src)->sin_family = AF_INET;
817 ((struct sockaddr_in *)conn->src)->sin_addr.s_addr = hdr_ip4->ip_src.s_addr;
818 ((struct sockaddr_in *)conn->src)->sin_port = hdr_tcp->source;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100819
Willy Tarreau226572f2019-07-17 14:46:00 +0200820 ((struct sockaddr_in *)conn->dst)->sin_family = AF_INET;
821 ((struct sockaddr_in *)conn->dst)->sin_addr.s_addr = hdr_ip4->ip_dst.s_addr;
822 ((struct sockaddr_in *)conn->dst)->sin_port = hdr_tcp->dest;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100823
824 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
825 }
Willy Tarreau0ca24aa2019-03-29 17:35:32 +0100826 else if (ip_ver == 6) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100827 struct ip6_hdr *hdr_ip6;
David Carlier3015a2e2016-07-04 22:51:33 +0100828 struct my_tcphdr *hdr_tcp;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100829
830 hdr_ip6 = (struct ip6_hdr *)line;
831
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200832 if (trash.data < 60 || trash.data < hdr_len) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100833 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin67de5a22017-12-13 01:15:05 +0000834 * IPv6 header, TCP header */
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100835 goto missing;
Bertrand Jacquinb3875912017-12-13 00:58:51 +0000836 }
837 else if (hdr_ip6->ip6_nxt != IPPROTO_TCP) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100838 /* The protocol does not include a TCP header */
839 conn->err_code = CO_ER_CIP_BAD_PROTO;
840 goto fail;
Bertrand Jacquinb3875912017-12-13 00:58:51 +0000841 }
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100842
David Carlier3015a2e2016-07-04 22:51:33 +0100843 hdr_tcp = (struct my_tcphdr *)(line + sizeof(struct ip6_hdr));
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100844
845 /* update the session's addresses and mark them set */
Willy Tarreau226572f2019-07-17 14:46:00 +0200846 ((struct sockaddr_in6 *)conn->src)->sin6_family = AF_INET6;
847 ((struct sockaddr_in6 *)conn->src)->sin6_addr = hdr_ip6->ip6_src;
848 ((struct sockaddr_in6 *)conn->src)->sin6_port = hdr_tcp->source;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100849
Willy Tarreau226572f2019-07-17 14:46:00 +0200850 ((struct sockaddr_in6 *)conn->dst)->sin6_family = AF_INET6;
851 ((struct sockaddr_in6 *)conn->dst)->sin6_addr = hdr_ip6->ip6_dst;
852 ((struct sockaddr_in6 *)conn->dst)->sin6_port = hdr_tcp->dest;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100853
854 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
855 }
856 else {
857 /* The protocol does not match something known (IPv4/IPv6) */
858 conn->err_code = CO_ER_CIP_BAD_PROTO;
859 goto fail;
860 }
861
Bertrand Jacquin7d668f92017-12-13 01:23:39 +0000862 line += hdr_len;
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200863 trash.data = line - trash.area;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100864
865 /* remove the NetScaler Client IP header from the request. For this
866 * we re-read the exact line at once. If we don't get the exact same
867 * result, we fail.
868 */
869 do {
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200870 int len2 = recv(conn->handle.fd, trash.area, trash.data, 0);
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100871 if (len2 < 0 && errno == EINTR)
872 continue;
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200873 if (len2 != trash.data)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100874 goto recv_abort;
875 } while (0);
876
877 conn->flags &= ~flag;
878 return 1;
879
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200880 not_ready:
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200881 return 0;
882
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100883 missing:
884 /* Missing data. Since we're using MSG_PEEK, we can only poll again if
885 * we have not read anything. Otherwise we need to fail because we won't
886 * be able to poll anymore.
887 */
888 conn->err_code = CO_ER_CIP_TRUNCATED;
889 goto fail;
890
891 bad_magic:
892 conn->err_code = CO_ER_CIP_BAD_MAGIC;
893 goto fail;
894
895 recv_abort:
896 conn->err_code = CO_ER_CIP_ABORT;
897 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH;
898 goto fail;
899
900 fail:
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100901 conn->flags |= CO_FL_ERROR;
902 return 0;
903}
904
Alexander Liu2a54bb72019-05-22 19:44:48 +0800905
906int conn_send_socks4_proxy_request(struct connection *conn)
907{
908 struct socks4_request req_line;
909
910 /* we might have been called just after an asynchronous shutw */
911 if (conn->flags & CO_FL_SOCK_WR_SH)
912 goto out_error;
913
914 if (!conn_ctrl_ready(conn))
915 goto out_error;
916
Willy Tarreau226572f2019-07-17 14:46:00 +0200917 if (!conn_get_dst(conn))
918 goto out_error;
919
Alexander Liu2a54bb72019-05-22 19:44:48 +0800920 req_line.version = 0x04;
921 req_line.command = 0x01;
Willy Tarreau226572f2019-07-17 14:46:00 +0200922 req_line.port = get_net_port(conn->dst);
923 req_line.ip = is_inet_addr(conn->dst);
Alexander Liu2a54bb72019-05-22 19:44:48 +0800924 memcpy(req_line.user_id, "HAProxy\0", 8);
925
926 if (conn->send_proxy_ofs > 0) {
927 /*
928 * This is the first call to send the request
929 */
930 conn->send_proxy_ofs = -(int)sizeof(req_line);
931 }
932
933 if (conn->send_proxy_ofs < 0) {
934 int ret = 0;
935
936 /* we are sending the socks4_req_line here. If the data layer
937 * has a pending write, we'll also set MSG_MORE.
938 */
939 ret = conn_sock_send(
940 conn,
941 ((char *)(&req_line)) + (sizeof(req_line)+conn->send_proxy_ofs),
942 -conn->send_proxy_ofs,
943 (conn->flags & CO_FL_XPRT_WR_ENA) ? MSG_MORE : 0);
944
945 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Before send remain is [%d], sent [%d]\n",
946 conn->handle.fd, -conn->send_proxy_ofs, ret);
947
948 if (ret < 0) {
949 goto out_error;
950 }
951
952 conn->send_proxy_ofs += ret; /* becomes zero once complete */
953 if (conn->send_proxy_ofs != 0) {
954 goto out_wait;
955 }
956 }
957
958 /* OK we've the whole request sent */
959 conn->flags &= ~CO_FL_SOCKS4_SEND;
Alexander Liu2a54bb72019-05-22 19:44:48 +0800960
961 /* The connection is ready now, simply return and let the connection
962 * handler notify upper layers if needed.
963 */
964 if (conn->flags & CO_FL_WAIT_L4_CONN)
965 conn->flags &= ~CO_FL_WAIT_L4_CONN;
966
967 if (conn->flags & CO_FL_SEND_PROXY) {
968 /*
969 * Get the send_proxy_ofs ready for the send_proxy due to we are
970 * reusing the "send_proxy_ofs", and SOCKS4 handshake should be done
971 * before sending PROXY Protocol.
972 */
973 conn->send_proxy_ofs = 1;
974 }
975 return 1;
976
977 out_error:
978 /* Write error on the file descriptor */
979 conn->flags |= CO_FL_ERROR;
980 if (conn->err_code == CO_ER_NONE) {
981 conn->err_code = CO_ER_SOCKS4_SEND;
982 }
983 return 0;
984
985 out_wait:
Alexander Liu2a54bb72019-05-22 19:44:48 +0800986 return 0;
987}
988
989int conn_recv_socks4_proxy_response(struct connection *conn)
990{
991 char line[SOCKS4_HS_RSP_LEN];
992 int ret;
993
994 /* we might have been called just after an asynchronous shutr */
995 if (conn->flags & CO_FL_SOCK_RD_SH)
996 goto fail;
997
998 if (!conn_ctrl_ready(conn))
999 goto fail;
1000
1001 if (!fd_recv_ready(conn->handle.fd))
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001002 goto not_ready;
Alexander Liu2a54bb72019-05-22 19:44:48 +08001003
1004 do {
1005 /* SOCKS4 Proxy will response with 8 bytes, 0x00 | 0x5A | 0x00 0x00 | 0x00 0x00 0x00 0x00
1006 * Try to peek into it, before all 8 bytes ready.
1007 */
1008 ret = recv(conn->handle.fd, line, SOCKS4_HS_RSP_LEN, MSG_PEEK);
1009
1010 if (ret == 0) {
1011 /* the socket has been closed or shutdown for send */
1012 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Received ret[%d], errno[%d], looks like the socket has been closed or shutdown for send\n",
1013 conn->handle.fd, ret, errno);
1014 if (conn->err_code == CO_ER_NONE) {
1015 conn->err_code = CO_ER_SOCKS4_RECV;
1016 }
1017 goto fail;
1018 }
1019
1020 if (ret > 0) {
1021 if (ret == SOCKS4_HS_RSP_LEN) {
1022 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Received 8 bytes, the response is [%02X|%02X|%02X %02X|%02X %02X %02X %02X]\n",
1023 conn->handle.fd, line[0], line[1], line[2], line[3], line[4], line[5], line[6], line[7]);
1024 }else{
1025 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Received ret[%d], first byte is [%02X], last bye is [%02X]\n", conn->handle.fd, ret, line[0], line[ret-1]);
1026 }
1027 } else {
1028 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Received ret[%d], errno[%d]\n", conn->handle.fd, ret, errno);
1029 }
1030
1031 if (ret < 0) {
1032 if (errno == EINTR) {
1033 continue;
1034 }
1035 if (errno == EAGAIN) {
1036 fd_cant_recv(conn->handle.fd);
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001037 goto not_ready;
Alexander Liu2a54bb72019-05-22 19:44:48 +08001038 }
1039 goto recv_abort;
1040 }
1041 } while (0);
1042
1043 if (ret < SOCKS4_HS_RSP_LEN) {
1044 /* Missing data. Since we're using MSG_PEEK, we can only poll again if
1045 * we are not able to read enough data.
1046 */
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001047 goto not_ready;
Alexander Liu2a54bb72019-05-22 19:44:48 +08001048 }
1049
1050 /*
1051 * Base on the SOCSK4 protocol:
1052 *
1053 * +----+----+----+----+----+----+----+----+
1054 * | VN | CD | DSTPORT | DSTIP |
1055 * +----+----+----+----+----+----+----+----+
1056 * # of bytes: 1 1 2 4
1057 * VN is the version of the reply code and should be 0. CD is the result
1058 * code with one of the following values:
1059 * 90: request granted
1060 * 91: request rejected or failed
1061 * 92: request rejected becasue SOCKS server cannot connect to identd on the client
1062 * 93: request rejected because the client program and identd report different user-ids
1063 * The remaining fields are ignored.
1064 */
1065 if (line[1] != 90) {
1066 conn->flags &= ~CO_FL_SOCKS4_RECV;
1067
1068 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: FAIL, the response is [%02X|%02X|%02X %02X|%02X %02X %02X %02X]\n",
1069 conn->handle.fd, line[0], line[1], line[2], line[3], line[4], line[5], line[6], line[7]);
1070 if (conn->err_code == CO_ER_NONE) {
1071 conn->err_code = CO_ER_SOCKS4_DENY;
1072 }
1073 goto fail;
1074 }
1075
1076 /* remove the 8 bytes response from the stream */
1077 do {
1078 ret = recv(conn->handle.fd, line, SOCKS4_HS_RSP_LEN, 0);
1079 if (ret < 0 && errno == EINTR) {
1080 continue;
1081 }
1082 if (ret != SOCKS4_HS_RSP_LEN) {
1083 if (conn->err_code == CO_ER_NONE) {
1084 conn->err_code = CO_ER_SOCKS4_RECV;
1085 }
1086 goto fail;
1087 }
1088 } while (0);
1089
1090 conn->flags &= ~CO_FL_SOCKS4_RECV;
1091 return 1;
1092
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001093 not_ready:
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001094 return 0;
1095
Alexander Liu2a54bb72019-05-22 19:44:48 +08001096 recv_abort:
1097 if (conn->err_code == CO_ER_NONE) {
1098 conn->err_code = CO_ER_SOCKS4_ABORT;
1099 }
1100 conn->flags |= (CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH);
1101 goto fail;
1102
1103 fail:
Alexander Liu2a54bb72019-05-22 19:44:48 +08001104 conn->flags |= CO_FL_ERROR;
1105 return 0;
1106}
1107
Ilya Shipitsinca56fce2018-09-15 00:50:05 +05001108/* Note: <remote> is explicitly allowed to be NULL */
David Safb76832014-05-08 23:42:08 -04001109int make_proxy_line(char *buf, int buf_len, struct server *srv, struct connection *remote)
1110{
1111 int ret = 0;
1112
1113 if (srv && (srv->pp_opts & SRV_PP_V2)) {
1114 ret = make_proxy_line_v2(buf, buf_len, srv, remote);
1115 }
1116 else {
Willy Tarreau226572f2019-07-17 14:46:00 +02001117 if (remote && conn_get_src(remote) && conn_get_dst(remote))
1118 ret = make_proxy_line_v1(buf, buf_len, remote->src, remote->dst);
David Safb76832014-05-08 23:42:08 -04001119 else
1120 ret = make_proxy_line_v1(buf, buf_len, NULL, NULL);
1121 }
1122
1123 return ret;
1124}
1125
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001126/* Makes a PROXY protocol line from the two addresses. The output is sent to
1127 * buffer <buf> for a maximum size of <buf_len> (including the trailing zero).
1128 * It returns the number of bytes composing this line (including the trailing
1129 * LF), or zero in case of failure (eg: not enough space). It supports TCP4,
Willy Tarreau2e1401a2013-10-01 11:41:55 +02001130 * TCP6 and "UNKNOWN" formats. If any of <src> or <dst> is null, UNKNOWN is
1131 * emitted as well.
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001132 */
David Safb76832014-05-08 23:42:08 -04001133int make_proxy_line_v1(char *buf, int buf_len, struct sockaddr_storage *src, struct sockaddr_storage *dst)
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001134{
1135 int ret = 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001136 char * protocol;
1137 char src_str[MAX(INET_ADDRSTRLEN, INET6_ADDRSTRLEN)];
1138 char dst_str[MAX(INET_ADDRSTRLEN, INET6_ADDRSTRLEN)];
1139 in_port_t src_port;
1140 in_port_t dst_port;
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001141
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001142 if ( !src
1143 || !dst
1144 || (src->ss_family != AF_INET && src->ss_family != AF_INET6)
1145 || (dst->ss_family != AF_INET && dst->ss_family != AF_INET6)) {
1146 /* unknown family combination */
1147 ret = snprintf(buf, buf_len, "PROXY UNKNOWN\r\n");
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001148 if (ret >= buf_len)
1149 return 0;
1150
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001151 return ret;
1152 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001153
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001154 /* IPv4 for both src and dst */
1155 if (src->ss_family == AF_INET && dst->ss_family == AF_INET) {
1156 protocol = "TCP4";
1157 if (!inet_ntop(AF_INET, &((struct sockaddr_in *)src)->sin_addr, src_str, sizeof(src_str)))
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001158 return 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001159 src_port = ((struct sockaddr_in *)src)->sin_port;
1160 if (!inet_ntop(AF_INET, &((struct sockaddr_in *)dst)->sin_addr, dst_str, sizeof(dst_str)))
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001161 return 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001162 dst_port = ((struct sockaddr_in *)dst)->sin_port;
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001163 }
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001164 /* IPv6 for at least one of src and dst */
1165 else {
1166 struct in6_addr tmp;
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001167
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001168 protocol = "TCP6";
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001169
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001170 if (src->ss_family == AF_INET) {
1171 /* Convert src to IPv6 */
1172 v4tov6(&tmp, &((struct sockaddr_in *)src)->sin_addr);
1173 src_port = ((struct sockaddr_in *)src)->sin_port;
1174 }
1175 else {
1176 tmp = ((struct sockaddr_in6 *)src)->sin6_addr;
1177 src_port = ((struct sockaddr_in6 *)src)->sin6_port;
1178 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001179
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001180 if (!inet_ntop(AF_INET6, &tmp, src_str, sizeof(src_str)))
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001181 return 0;
1182
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001183 if (dst->ss_family == AF_INET) {
1184 /* Convert dst to IPv6 */
1185 v4tov6(&tmp, &((struct sockaddr_in *)dst)->sin_addr);
1186 dst_port = ((struct sockaddr_in *)dst)->sin_port;
1187 }
1188 else {
1189 tmp = ((struct sockaddr_in6 *)dst)->sin6_addr;
1190 dst_port = ((struct sockaddr_in6 *)dst)->sin6_port;
1191 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001192
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001193 if (!inet_ntop(AF_INET6, &tmp, dst_str, sizeof(dst_str)))
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001194 return 0;
1195 }
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001196
1197 ret = snprintf(buf, buf_len, "PROXY %s %s %s %u %u\r\n", protocol, src_str, dst_str, ntohs(src_port), ntohs(dst_port));
1198 if (ret >= buf_len)
1199 return 0;
1200
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001201 return ret;
1202}
David Safb76832014-05-08 23:42:08 -04001203
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001204static int make_tlv(char *dest, int dest_len, char type, uint16_t length, const char *value)
David Safb76832014-05-08 23:42:08 -04001205{
1206 struct tlv *tlv;
1207
1208 if (!dest || (length + sizeof(*tlv) > dest_len))
1209 return 0;
1210
1211 tlv = (struct tlv *)dest;
1212
1213 tlv->type = type;
1214 tlv->length_hi = length >> 8;
1215 tlv->length_lo = length & 0x00ff;
1216 memcpy(tlv->value, value, length);
1217 return length + sizeof(*tlv);
1218}
David Safb76832014-05-08 23:42:08 -04001219
Ilya Shipitsinca56fce2018-09-15 00:50:05 +05001220/* Note: <remote> is explicitly allowed to be NULL */
David Safb76832014-05-08 23:42:08 -04001221int make_proxy_line_v2(char *buf, int buf_len, struct server *srv, struct connection *remote)
1222{
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001223 const char pp2_signature[] = PP2_SIGNATURE;
Emmanuel Hocdet4399c752018-02-05 15:26:43 +01001224 void *tlv_crc32c_p = NULL;
David Safb76832014-05-08 23:42:08 -04001225 int ret = 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001226 struct proxy_hdr_v2 *hdr = (struct proxy_hdr_v2 *)buf;
Vincent Bernat6e615892016-05-18 16:17:44 +02001227 struct sockaddr_storage null_addr = { .ss_family = 0 };
David Safb76832014-05-08 23:42:08 -04001228 struct sockaddr_storage *src = &null_addr;
1229 struct sockaddr_storage *dst = &null_addr;
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001230 const char *value;
1231 int value_len;
David Safb76832014-05-08 23:42:08 -04001232
1233 if (buf_len < PP2_HEADER_LEN)
1234 return 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001235 memcpy(hdr->sig, pp2_signature, PP2_SIGNATURE_LEN);
David Safb76832014-05-08 23:42:08 -04001236
Willy Tarreau226572f2019-07-17 14:46:00 +02001237 if (remote && conn_get_src(remote) && conn_get_dst(remote)) {
1238 src = remote->src;
1239 dst = remote->dst;
David Safb76832014-05-08 23:42:08 -04001240 }
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001241
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001242 /* At least one of src or dst is not of AF_INET or AF_INET6 */
1243 if ( !src
1244 || !dst
1245 || (src->ss_family != AF_INET && src->ss_family != AF_INET6)
1246 || (dst->ss_family != AF_INET && dst->ss_family != AF_INET6)) {
David Safb76832014-05-08 23:42:08 -04001247 if (buf_len < PP2_HDR_LEN_UNSPEC)
1248 return 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001249 hdr->ver_cmd = PP2_VERSION | PP2_CMD_LOCAL;
1250 hdr->fam = PP2_FAM_UNSPEC | PP2_TRANS_UNSPEC;
David Safb76832014-05-08 23:42:08 -04001251 ret = PP2_HDR_LEN_UNSPEC;
1252 }
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001253 else {
1254 /* IPv4 for both src and dst */
1255 if (src->ss_family == AF_INET && dst->ss_family == AF_INET) {
1256 if (buf_len < PP2_HDR_LEN_INET)
1257 return 0;
1258 hdr->ver_cmd = PP2_VERSION | PP2_CMD_PROXY;
1259 hdr->fam = PP2_FAM_INET | PP2_TRANS_STREAM;
1260 hdr->addr.ip4.src_addr = ((struct sockaddr_in *)src)->sin_addr.s_addr;
1261 hdr->addr.ip4.src_port = ((struct sockaddr_in *)src)->sin_port;
1262 hdr->addr.ip4.dst_addr = ((struct sockaddr_in *)dst)->sin_addr.s_addr;
1263 hdr->addr.ip4.dst_port = ((struct sockaddr_in *)dst)->sin_port;
1264 ret = PP2_HDR_LEN_INET;
1265 }
1266 /* IPv6 for at least one of src and dst */
1267 else {
1268 struct in6_addr tmp;
1269
1270 if (buf_len < PP2_HDR_LEN_INET6)
1271 return 0;
1272 hdr->ver_cmd = PP2_VERSION | PP2_CMD_PROXY;
1273 hdr->fam = PP2_FAM_INET6 | PP2_TRANS_STREAM;
1274 if (src->ss_family == AF_INET) {
1275 v4tov6(&tmp, &((struct sockaddr_in *)src)->sin_addr);
1276 memcpy(hdr->addr.ip6.src_addr, &tmp, 16);
1277 hdr->addr.ip6.src_port = ((struct sockaddr_in *)src)->sin_port;
1278 }
1279 else {
1280 memcpy(hdr->addr.ip6.src_addr, &((struct sockaddr_in6 *)src)->sin6_addr, 16);
1281 hdr->addr.ip6.src_port = ((struct sockaddr_in6 *)src)->sin6_port;
1282 }
1283 if (dst->ss_family == AF_INET) {
1284 v4tov6(&tmp, &((struct sockaddr_in *)dst)->sin_addr);
1285 memcpy(hdr->addr.ip6.dst_addr, &tmp, 16);
1286 hdr->addr.ip6.src_port = ((struct sockaddr_in *)src)->sin_port;
1287 }
1288 else {
1289 memcpy(hdr->addr.ip6.dst_addr, &((struct sockaddr_in6 *)dst)->sin6_addr, 16);
1290 hdr->addr.ip6.dst_port = ((struct sockaddr_in6 *)dst)->sin6_port;
1291 }
1292
1293 ret = PP2_HDR_LEN_INET6;
1294 }
1295 }
David Safb76832014-05-08 23:42:08 -04001296
Emmanuel Hocdet4399c752018-02-05 15:26:43 +01001297 if (srv->pp_opts & SRV_PP_V2_CRC32C) {
1298 uint32_t zero_crc32c = 0;
1299 if ((buf_len - ret) < sizeof(struct tlv))
1300 return 0;
1301 tlv_crc32c_p = (void *)((struct tlv *)&buf[ret])->value;
1302 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_CRC32C, sizeof(zero_crc32c), (const char *)&zero_crc32c);
1303 }
1304
Ilya Shipitsinca56fce2018-09-15 00:50:05 +05001305 if (remote && conn_get_alpn(remote, &value, &value_len)) {
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001306 if ((buf_len - ret) < sizeof(struct tlv))
1307 return 0;
Emmanuel Hocdet571c7ac2017-10-31 18:24:05 +01001308 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_ALPN, value_len, value);
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001309 }
1310
Emmanuel Hocdet253c3b72018-02-01 18:29:59 +01001311 if (srv->pp_opts & SRV_PP_V2_AUTHORITY) {
Emmanuel Hocdet8a4ffa02019-08-29 11:54:51 +02001312 value = NULL;
1313 if (remote && remote->proxy_authority) {
1314 value = remote->proxy_authority;
1315 value_len = remote->proxy_authority_len;
1316 }
1317#ifdef USE_OPENSSL
1318 else {
Jerome Magnin78891c72019-09-02 09:53:41 +02001319 if ((value = ssl_sock_get_sni(remote)))
Emmanuel Hocdet8a4ffa02019-08-29 11:54:51 +02001320 value_len = strlen(value);
1321 }
1322#endif
Emmanuel Hocdet253c3b72018-02-01 18:29:59 +01001323 if (value) {
1324 if ((buf_len - ret) < sizeof(struct tlv))
1325 return 0;
Emmanuel Hocdet8a4ffa02019-08-29 11:54:51 +02001326 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_AUTHORITY, value_len, value);
Emmanuel Hocdet253c3b72018-02-01 18:29:59 +01001327 }
1328 }
1329
Emmanuel Hocdet8a4ffa02019-08-29 11:54:51 +02001330#ifdef USE_OPENSSL
David Safb76832014-05-08 23:42:08 -04001331 if (srv->pp_opts & SRV_PP_V2_SSL) {
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001332 struct tlv_ssl *tlv;
1333 int ssl_tlv_len = 0;
David Safb76832014-05-08 23:42:08 -04001334 if ((buf_len - ret) < sizeof(struct tlv_ssl))
1335 return 0;
1336 tlv = (struct tlv_ssl *)&buf[ret];
1337 memset(tlv, 0, sizeof(struct tlv_ssl));
1338 ssl_tlv_len += sizeof(struct tlv_ssl);
1339 tlv->tlv.type = PP2_TYPE_SSL;
1340 if (ssl_sock_is_ssl(remote)) {
1341 tlv->client |= PP2_CLIENT_SSL;
Emmanuel Hocdet01da5712017-10-13 16:59:49 +02001342 value = ssl_sock_get_proto_version(remote);
David Safb76832014-05-08 23:42:08 -04001343 if (value) {
Emmanuel Hocdet8c0c34b2018-02-28 12:02:14 +01001344 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len-ret-ssl_tlv_len), PP2_SUBTYPE_SSL_VERSION, strlen(value), value);
David Safb76832014-05-08 23:42:08 -04001345 }
Dave McCowan328fb582014-07-30 10:39:13 -04001346 if (ssl_sock_get_cert_used_sess(remote)) {
1347 tlv->client |= PP2_CLIENT_CERT_SESS;
David Safb76832014-05-08 23:42:08 -04001348 tlv->verify = htonl(ssl_sock_get_verify_result(remote));
Dave McCowan328fb582014-07-30 10:39:13 -04001349 if (ssl_sock_get_cert_used_conn(remote))
1350 tlv->client |= PP2_CLIENT_CERT_CONN;
David Safb76832014-05-08 23:42:08 -04001351 }
1352 if (srv->pp_opts & SRV_PP_V2_SSL_CN) {
Willy Tarreau83061a82018-07-13 11:56:34 +02001353 struct buffer *cn_trash = get_trash_chunk();
Willy Tarreau3b9a0c92014-07-19 06:37:33 +02001354 if (ssl_sock_get_remote_common_name(remote, cn_trash) > 0) {
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001355 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_CN,
1356 cn_trash->data,
1357 cn_trash->area);
David Safb76832014-05-08 23:42:08 -04001358 }
1359 }
Emmanuel Hocdetfa8d0f12018-02-01 15:53:52 +01001360 if (srv->pp_opts & SRV_PP_V2_SSL_KEY_ALG) {
Willy Tarreau83061a82018-07-13 11:56:34 +02001361 struct buffer *pkey_trash = get_trash_chunk();
Emmanuel Hocdetfa8d0f12018-02-01 15:53:52 +01001362 if (ssl_sock_get_pkey_algo(remote, pkey_trash) > 0) {
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001363 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_KEY_ALG,
1364 pkey_trash->data,
1365 pkey_trash->area);
Emmanuel Hocdetfa8d0f12018-02-01 15:53:52 +01001366 }
1367 }
1368 if (srv->pp_opts & SRV_PP_V2_SSL_SIG_ALG) {
1369 value = ssl_sock_get_cert_sig(remote);
1370 if (value) {
1371 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_SIG_ALG, strlen(value), value);
1372 }
1373 }
1374 if (srv->pp_opts & SRV_PP_V2_SSL_CIPHER) {
1375 value = ssl_sock_get_cipher_name(remote);
1376 if (value) {
1377 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_CIPHER, strlen(value), value);
1378 }
1379 }
David Safb76832014-05-08 23:42:08 -04001380 }
1381 tlv->tlv.length_hi = (uint16_t)(ssl_tlv_len - sizeof(struct tlv)) >> 8;
1382 tlv->tlv.length_lo = (uint16_t)(ssl_tlv_len - sizeof(struct tlv)) & 0x00ff;
1383 ret += ssl_tlv_len;
1384 }
1385#endif
1386
Willy Tarreaue5733232019-05-22 19:24:06 +02001387#ifdef USE_NS
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001388 if (remote && (remote->proxy_netns)) {
1389 if ((buf_len - ret) < sizeof(struct tlv))
1390 return 0;
Emmanuel Hocdet571c7ac2017-10-31 18:24:05 +01001391 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_NETNS, remote->proxy_netns->name_len, remote->proxy_netns->node.key);
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001392 }
1393#endif
1394
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001395 hdr->len = htons((uint16_t)(ret - PP2_HEADER_LEN));
David Safb76832014-05-08 23:42:08 -04001396
Emmanuel Hocdet4399c752018-02-05 15:26:43 +01001397 if (tlv_crc32c_p) {
1398 write_u32(tlv_crc32c_p, htonl(hash_crc32c(buf, ret)));
1399 }
1400
David Safb76832014-05-08 23:42:08 -04001401 return ret;
1402}
Emeric Brun4f603012017-01-05 15:11:44 +01001403
Willy Tarreau60ca10a2017-08-18 15:26:54 +02001404/* return the major HTTP version as 1 or 2 depending on how the request arrived
1405 * before being processed.
1406 */
1407static int
1408smp_fetch_fc_http_major(const struct arg *args, struct sample *smp, const char *kw, void *private)
1409{
Jérôme Magnin86577422018-12-07 09:03:11 +01001410 struct connection *conn = (kw[0] != 'b') ? objt_conn(smp->sess->origin) :
1411 smp->strm ? cs_conn(objt_cs(smp->strm->si[1].end)) : NULL;
Willy Tarreau60ca10a2017-08-18 15:26:54 +02001412
1413 smp->data.type = SMP_T_SINT;
1414 smp->data.u.sint = (conn && strcmp(conn_get_mux_name(conn), "H2") == 0) ? 2 : 1;
1415 return 1;
1416}
1417
Emeric Brun4f603012017-01-05 15:11:44 +01001418/* fetch if the received connection used a PROXY protocol header */
1419int smp_fetch_fc_rcvd_proxy(const struct arg *args, struct sample *smp, const char *kw, void *private)
1420{
1421 struct connection *conn;
1422
1423 conn = objt_conn(smp->sess->origin);
1424 if (!conn)
1425 return 0;
1426
1427 if (!(conn->flags & CO_FL_CONNECTED)) {
1428 smp->flags |= SMP_F_MAY_CHANGE;
1429 return 0;
1430 }
1431
1432 smp->flags = 0;
1433 smp->data.type = SMP_T_BOOL;
1434 smp->data.u.sint = (conn->flags & CO_FL_RCVD_PROXY) ? 1 : 0;
1435
1436 return 1;
1437}
1438
Geoff Simmons7185b782019-08-27 18:31:16 +02001439/* fetch the authority TLV from a PROXY protocol header */
1440int smp_fetch_fc_pp_authority(const struct arg *args, struct sample *smp, const char *kw, void *private)
1441{
1442 struct connection *conn;
1443
1444 conn = objt_conn(smp->sess->origin);
1445 if (!conn)
1446 return 0;
1447
1448 if (!(conn->flags & CO_FL_CONNECTED)) {
1449 smp->flags |= SMP_F_MAY_CHANGE;
1450 return 0;
1451 }
1452
1453 if (conn->proxy_authority == NULL)
1454 return 0;
1455
1456 smp->flags = 0;
1457 smp->data.type = SMP_T_STR;
1458 smp->data.u.str.area = conn->proxy_authority;
1459 smp->data.u.str.data = conn->proxy_authority_len;
1460
1461 return 1;
1462}
1463
Emeric Brun4f603012017-01-05 15:11:44 +01001464/* Note: must not be declared <const> as its list will be overwritten.
1465 * Note: fetches that may return multiple types must be declared as the lowest
1466 * common denominator, the type that can be casted into all other ones. For
1467 * instance v4/v6 must be declared v4.
1468 */
1469static struct sample_fetch_kw_list sample_fetch_keywords = {ILH, {
Willy Tarreau60ca10a2017-08-18 15:26:54 +02001470 { "fc_http_major", smp_fetch_fc_http_major, 0, NULL, SMP_T_SINT, SMP_USE_L4CLI },
Jérôme Magnin86577422018-12-07 09:03:11 +01001471 { "bc_http_major", smp_fetch_fc_http_major, 0, NULL, SMP_T_SINT, SMP_USE_L4SRV },
Emeric Brun4f603012017-01-05 15:11:44 +01001472 { "fc_rcvd_proxy", smp_fetch_fc_rcvd_proxy, 0, NULL, SMP_T_BOOL, SMP_USE_L4CLI },
Geoff Simmons7185b782019-08-27 18:31:16 +02001473 { "fc_pp_authority", smp_fetch_fc_pp_authority, 0, NULL, SMP_T_STR, SMP_USE_L4CLI },
Emeric Brun4f603012017-01-05 15:11:44 +01001474 { /* END */ },
1475}};
1476
Willy Tarreau0108d902018-11-25 19:14:37 +01001477INITCALL1(STG_REGISTER, sample_register_fetches, &sample_fetch_keywords);