blob: 366bb25b56e7ff2417fa0f82dc0397aeec17597a [file] [log] [blame]
Willy Tarreau59f98392012-07-06 14:13:49 +02001/*
2 * Connection management functions
3 *
4 * Copyright 2000-2012 Willy Tarreau <w@1wt.eu>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
Willy Tarreaue1e4a612012-10-05 00:10:55 +020013#include <errno.h>
14
Willy Tarreau4c7e4b72020-05-27 12:58:42 +020015#include <haproxy/api.h>
Willy Tarreau6be78492020-06-05 00:00:29 +020016#include <haproxy/cfgparse.h>
Willy Tarreau7ea393d2020-06-04 18:02:10 +020017#include <haproxy/connection.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020018#include <haproxy/fd.h>
Willy Tarreau762d7a52020-06-04 11:23:07 +020019#include <haproxy/frontend.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020020#include <haproxy/hash.h>
Willy Tarreau36979d92020-06-05 17:27:29 +020021#include <haproxy/log-t.h>
Willy Tarreau7a00efb2020-06-02 17:02:59 +020022#include <haproxy/namespace.h>
Willy Tarreau6131d6a2020-06-02 16:48:09 +020023#include <haproxy/net_helper.h>
Willy Tarreaufc774542020-06-04 17:31:04 +020024#include <haproxy/proto_tcp.h>
Willy Tarreaue6ce10b2020-06-04 15:33:47 +020025#include <haproxy/sample.h>
Willy Tarreau209108d2020-06-04 20:30:20 +020026#include <haproxy/ssl_sock.h>
Willy Tarreau5e539c92020-06-04 20:45:39 +020027#include <haproxy/stream_interface.h>
Emeric Brun46591952012-05-18 15:47:34 +020028
Alexander Liu2a54bb72019-05-22 19:44:48 +080029
Willy Tarreau8ceae722018-11-26 11:58:30 +010030DECLARE_POOL(pool_head_connection, "connection", sizeof(struct connection));
31DECLARE_POOL(pool_head_connstream, "conn_stream", sizeof(struct conn_stream));
Willy Tarreauff5d57b2019-07-17 18:37:02 +020032DECLARE_POOL(pool_head_sockaddr, "sockaddr", sizeof(struct sockaddr_storage));
Geoff Simmons7185b782019-08-27 18:31:16 +020033DECLARE_POOL(pool_head_authority, "authority", PP2_AUTHORITY_MAX);
Willy Tarreau8ceae722018-11-26 11:58:30 +010034
Willy Tarreau4d82bf52020-06-28 00:19:17 +020035struct idle_conns idle_conns[MAX_THREADS] = { };
Willy Tarreau13e14102016-12-22 20:25:26 +010036struct xprt_ops *registered_xprt[XPRT_ENTRIES] = { NULL, };
Willy Tarreauf2943dc2012-10-26 20:10:28 +020037
Christopher Faulet32f61c02018-04-10 14:33:41 +020038/* List head of all known muxes for PROTO */
39struct mux_proto_list mux_proto_list = {
40 .list = LIST_HEAD_INIT(mux_proto_list.list)
Willy Tarreau2386be62017-09-21 19:40:52 +020041};
42
Willy Tarreau119e50e2020-05-22 13:53:29 +020043/* disables sending of proxy-protocol-v2's LOCAL command */
44static int pp2_never_send_local;
45
Olivier Houchard477902b2020-01-22 18:08:48 +010046int conn_create_mux(struct connection *conn)
47{
Olivier Houchard477902b2020-01-22 18:08:48 +010048 if (conn_is_back(conn)) {
49 struct server *srv;
50 struct conn_stream *cs = conn->ctx;
Christopher Faulet14cd3162020-04-16 14:50:06 +020051 struct session *sess = conn->owner;
Olivier Houchard477902b2020-01-22 18:08:48 +010052
53 if (conn->flags & CO_FL_ERROR)
54 goto fail;
Olivier Houcharda8a415d2020-01-23 13:15:14 +010055
Christopher Faulet14cd3162020-04-16 14:50:06 +020056 if (sess && obj_type(sess->origin) == OBJ_TYPE_CHECK) {
Willy Tarreau38b4d2e2020-11-20 17:08:15 +010057 if (conn_install_mux_chk(conn, conn->ctx, sess) < 0)
Christopher Faulet14cd3162020-04-16 14:50:06 +020058 goto fail;
59 }
Willy Tarreau38b4d2e2020-11-20 17:08:15 +010060 else if (conn_install_mux_be(conn, conn->ctx, sess) < 0)
Olivier Houchard477902b2020-01-22 18:08:48 +010061 goto fail;
62 srv = objt_server(conn->target);
Christopher Faulet08016ab2020-07-01 16:10:06 +020063
64 /* If we're doing http-reuse always, and the connection is not
65 * private with available streams (an http2 connection), add it
66 * to the available list, so that others can use it right
67 * away. If the connection is private, add it in the session
68 * server list.
69 */
Christopher Faulet2883fcf2020-07-01 14:59:43 +020070 if (srv && ((srv->proxy->options & PR_O_REUSE_MASK) == PR_O_REUSE_ALWS) &&
Christopher Fauletaa278532020-06-30 14:47:46 +020071 !(conn->flags & CO_FL_PRIVATE) && conn->mux->avail_streams(conn) > 0)
Olivier Houchardf0d4dff2020-03-06 18:12:03 +010072 LIST_ADDQ(&srv->available_conns[tid], mt_list_to_list(&conn->list));
Christopher Faulet08016ab2020-07-01 16:10:06 +020073 else if (conn->flags & CO_FL_PRIVATE) {
Ilya Shipitsin6b79f382020-07-23 00:32:55 +050074 /* If it fail now, the same will be done in mux->detach() callback */
Willy Tarreau38b4d2e2020-11-20 17:08:15 +010075 session_add_conn(sess, conn, conn->target);
Christopher Faulet08016ab2020-07-01 16:10:06 +020076 }
Olivier Houchard477902b2020-01-22 18:08:48 +010077 return 0;
78fail:
79 /* let the upper layer know the connection failed */
80 cs->data_cb->wake(cs);
81 return -1;
82 } else
83 return conn_complete_session(conn);
84
85}
86
Willy Tarreau59f98392012-07-06 14:13:49 +020087/* I/O callback for fd-based connections. It calls the read/write handlers
Willy Tarreau7a798e52016-04-14 11:13:20 +020088 * provided by the connection's sock_ops, which must be valid.
Willy Tarreau59f98392012-07-06 14:13:49 +020089 */
Willy Tarreau7a798e52016-04-14 11:13:20 +020090void conn_fd_handler(int fd)
Willy Tarreau59f98392012-07-06 14:13:49 +020091{
Willy Tarreau80184712012-07-06 14:54:49 +020092 struct connection *conn = fdtab[fd].owner;
Willy Tarreau9e272bf2012-10-03 21:04:48 +020093 unsigned int flags;
Willy Tarreau8de5c4f2020-03-04 17:45:21 +010094 int need_wake = 0;
Willy Tarreau59f98392012-07-06 14:13:49 +020095
Willy Tarreaud80cb4e2018-01-20 19:30:13 +010096 if (unlikely(!conn)) {
97 activity[tid].conn_dead++;
Willy Tarreau7a798e52016-04-14 11:13:20 +020098 return;
Willy Tarreaud80cb4e2018-01-20 19:30:13 +010099 }
Willy Tarreau59f98392012-07-06 14:13:49 +0200100
Willy Tarreau7d281492012-12-16 19:19:13 +0100101 flags = conn->flags & ~CO_FL_ERROR; /* ensure to call the wake handler upon error */
Willy Tarreaud29a0662012-12-10 16:33:38 +0100102
Willy Tarreaub2a7ab02019-12-27 10:54:22 +0100103 if (unlikely(conn->flags & CO_FL_WAIT_L4_CONN) &&
104 ((fd_send_ready(fd) && fd_send_active(fd)) ||
105 (fd_recv_ready(fd) && fd_recv_active(fd)))) {
106 /* Still waiting for a connection to establish and nothing was
107 * attempted yet to probe the connection. this will clear the
108 * CO_FL_WAIT_L4_CONN flag on success.
109 */
110 if (!conn_fd_check(conn))
111 goto leave;
Willy Tarreau8de5c4f2020-03-04 17:45:21 +0100112 need_wake = 1;
Willy Tarreaub2a7ab02019-12-27 10:54:22 +0100113 }
114
Willy Tarreau8081abe2019-11-28 18:08:49 +0100115 if (fd_send_ready(fd) && fd_send_active(fd)) {
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100116 /* force reporting of activity by clearing the previous flags :
117 * we'll have at least ERROR or CONNECTED at the end of an I/O,
118 * both of which will be detected below.
Willy Tarreau9e272bf2012-10-03 21:04:48 +0200119 */
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100120 flags = 0;
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100121 if (conn->subs && conn->subs->events & SUB_RETRY_SEND) {
Willy Tarreau8de5c4f2020-03-04 17:45:21 +0100122 need_wake = 0; // wake will be called after this I/O
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100123 tasklet_wakeup(conn->subs->tasklet);
124 conn->subs->events &= ~SUB_RETRY_SEND;
125 if (!conn->subs->events)
126 conn->subs = NULL;
Willy Tarreau8de5c4f2020-03-04 17:45:21 +0100127 }
Willy Tarreau667fefd2020-03-04 17:22:10 +0100128 fd_stop_send(fd);
Willy Tarreau9e272bf2012-10-03 21:04:48 +0200129 }
Willy Tarreau59f98392012-07-06 14:13:49 +0200130
Willy Tarreau57ec32f2017-04-11 19:59:33 +0200131 /* The data transfer starts here and stops on error and handshakes. Note
132 * that we must absolutely test conn->xprt at each step in case it suddenly
133 * changes due to a quick unexpected close().
134 */
Willy Tarreau8081abe2019-11-28 18:08:49 +0100135 if (fd_recv_ready(fd) && fd_recv_active(fd)) {
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100136 /* force reporting of activity by clearing the previous flags :
137 * we'll have at least ERROR or CONNECTED at the end of an I/O,
138 * both of which will be detected below.
Willy Tarreau9e272bf2012-10-03 21:04:48 +0200139 */
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100140 flags = 0;
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100141 if (conn->subs && conn->subs->events & SUB_RETRY_RECV) {
Willy Tarreau8de5c4f2020-03-04 17:45:21 +0100142 need_wake = 0; // wake will be called after this I/O
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100143 tasklet_wakeup(conn->subs->tasklet);
144 conn->subs->events &= ~SUB_RETRY_RECV;
145 if (!conn->subs->events)
146 conn->subs = NULL;
Willy Tarreau8de5c4f2020-03-04 17:45:21 +0100147 }
Willy Tarreau4cabfc12020-06-17 16:26:22 +0200148 fd_stop_recv(fd);
Willy Tarreau9e272bf2012-10-03 21:04:48 +0200149 }
Willy Tarreau2da156f2012-07-23 15:07:23 +0200150
Willy Tarreau2c6be842012-07-06 17:12:34 +0200151 leave:
Olivier Houchard477902b2020-01-22 18:08:48 +0100152 /* If we don't yet have a mux, that means we were waiting for
Ilya Shipitsince7b00f2020-03-23 22:28:40 +0500153 * information to create one, typically from the ALPN. If we're
Olivier Houchard477902b2020-01-22 18:08:48 +0100154 * done with the handshake, attempt to create one.
Willy Tarreau8e3c6ce2017-08-28 15:46:01 +0200155 */
Willy Tarreau911db9b2020-01-23 16:27:54 +0100156 if (unlikely(!conn->mux) && !(conn->flags & CO_FL_WAIT_XPRT))
Olivier Houchard477902b2020-01-22 18:08:48 +0100157 if (conn_create_mux(conn) < 0)
158 return;
Willy Tarreau8e3c6ce2017-08-28 15:46:01 +0200159
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100160 /* The wake callback is normally used to notify the data layer about
161 * data layer activity (successful send/recv), connection establishment,
162 * shutdown and fatal errors. We need to consider the following
163 * situations to wake up the data layer :
Willy Tarreau0fbc3182019-12-27 14:57:45 +0100164 * - change among the CO_FL_NOTIFY_DONE flags :
165 * SOCK_{RD,WR}_SH, ERROR,
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100166 * - absence of any of {L4,L6}_CONN and CONNECTED, indicating the
167 * end of handshake and transition to CONNECTED
168 * - raise of CONNECTED with HANDSHAKE down
169 * - end of HANDSHAKE with CONNECTED set
170 * - regular data layer activity
171 *
172 * Note that the wake callback is allowed to release the connection and
173 * the fd (and return < 0 in this case).
Willy Tarreau2396c1c2012-10-03 21:12:16 +0200174 */
Willy Tarreau8de5c4f2020-03-04 17:45:21 +0100175 if ((need_wake || ((conn->flags ^ flags) & CO_FL_NOTIFY_DONE) ||
Willy Tarreau911db9b2020-01-23 16:27:54 +0100176 ((flags & CO_FL_WAIT_XPRT) && !(conn->flags & CO_FL_WAIT_XPRT))) &&
Olivier Houchardfe50bfb2019-05-27 12:09:19 +0200177 conn->mux && conn->mux->wake && conn->mux->wake(conn) < 0)
Willy Tarreau7a798e52016-04-14 11:13:20 +0200178 return;
Willy Tarreaufd31e532012-07-23 18:24:25 +0200179
Willy Tarreauf9dabec2012-08-17 17:33:53 +0200180 /* commit polling changes */
181 conn_cond_update_polling(conn);
Willy Tarreau7a798e52016-04-14 11:13:20 +0200182 return;
Willy Tarreau59f98392012-07-06 14:13:49 +0200183}
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200184
Willy Tarreau4970e5a2019-12-27 10:40:21 +0100185/* This is the callback which is set when a connection establishment is pending
186 * and we have nothing to send. It may update the FD polling status to indicate
187 * !READY. It returns 0 if it fails in a fatal way or needs to poll to go
188 * further, otherwise it returns non-zero and removes the CO_FL_WAIT_L4_CONN
189 * flag from the connection's flags. In case of error, it sets CO_FL_ERROR and
190 * leaves the error code in errno.
191 */
192int conn_fd_check(struct connection *conn)
193{
194 struct sockaddr_storage *addr;
195 int fd = conn->handle.fd;
196
197 if (conn->flags & CO_FL_ERROR)
198 return 0;
199
200 if (!conn_ctrl_ready(conn))
201 return 0;
202
203 if (!(conn->flags & CO_FL_WAIT_L4_CONN))
204 return 1; /* strange we were called while ready */
205
206 if (!fd_send_ready(fd))
207 return 0;
208
209 /* Here we have 2 cases :
210 * - modern pollers, able to report ERR/HUP. If these ones return any
211 * of these flags then it's likely a failure, otherwise it possibly
212 * is a success (i.e. there may have been data received just before
213 * the error was reported).
214 * - select, which doesn't report these and with which it's always
215 * necessary either to try connect() again or to check for SO_ERROR.
216 * In order to simplify everything, we double-check using connect() as
217 * soon as we meet either of these delicate situations. Note that
218 * SO_ERROR would clear the error after reporting it!
219 */
220 if (cur_poller.flags & HAP_POLL_F_ERRHUP) {
221 /* modern poller, able to report ERR/HUP */
222 if ((fdtab[fd].ev & (FD_POLL_IN|FD_POLL_ERR|FD_POLL_HUP)) == FD_POLL_IN)
223 goto done;
224 if ((fdtab[fd].ev & (FD_POLL_OUT|FD_POLL_ERR|FD_POLL_HUP)) == FD_POLL_OUT)
225 goto done;
226 if (!(fdtab[fd].ev & (FD_POLL_ERR|FD_POLL_HUP)))
227 goto wait;
228 /* error present, fall through common error check path */
229 }
230
231 /* Use connect() to check the state of the socket. This has the double
232 * advantage of *not* clearing the error (so that health checks can
233 * still use getsockopt(SO_ERROR)) and giving us the following info :
234 * - error
235 * - connecting (EALREADY, EINPROGRESS)
236 * - connected (EISCONN, 0)
237 */
238 addr = conn->dst;
239 if ((conn->flags & CO_FL_SOCKS4) && obj_type(conn->target) == OBJ_TYPE_SERVER)
240 addr = &objt_server(conn->target)->socks4_addr;
241
242 if (connect(fd, (const struct sockaddr *)addr, get_addr_len(addr)) == -1) {
243 if (errno == EALREADY || errno == EINPROGRESS)
244 goto wait;
245
246 if (errno && errno != EISCONN)
247 goto out_error;
248 }
249
250 done:
251 /* The FD is ready now, we'll mark the connection as complete and
252 * forward the event to the transport layer which will notify the
253 * data layer.
254 */
255 conn->flags &= ~CO_FL_WAIT_L4_CONN;
256 fd_may_send(fd);
257 fd_cond_recv(fd);
258 errno = 0; // make health checks happy
259 return 1;
260
261 out_error:
262 /* Write error on the file descriptor. Report it to the connection
263 * and disable polling on this FD.
264 */
265 fdtab[fd].linger_risk = 0;
266 conn->flags |= CO_FL_ERROR | CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH;
Willy Tarreau5d4d1802020-02-21 09:58:29 +0100267 conn_stop_polling(conn);
Willy Tarreau4970e5a2019-12-27 10:40:21 +0100268 return 0;
269
270 wait:
Willy Tarreau4970e5a2019-12-27 10:40:21 +0100271 fd_cant_send(fd);
Willy Tarreaud1d14c32020-02-21 10:34:19 +0100272 fd_want_send(fd);
Willy Tarreau4970e5a2019-12-27 10:40:21 +0100273 return 0;
274}
275
Willy Tarreauff3e6482015-03-12 23:56:52 +0100276/* Send a message over an established connection. It makes use of send() and
277 * returns the same return code and errno. If the socket layer is not ready yet
278 * then -1 is returned and ENOTSOCK is set into errno. If the fd is not marked
279 * as ready, or if EAGAIN or ENOTCONN is returned, then we return 0. It returns
280 * EMSGSIZE if called with a zero length message. The purpose is to simplify
281 * some rare attempts to directly write on the socket from above the connection
282 * (typically send_proxy). In case of EAGAIN, the fd is marked as "cant_send".
283 * It automatically retries on EINTR. Other errors cause the connection to be
284 * marked as in error state. It takes similar arguments as send() except the
285 * first one which is the connection instead of the file descriptor. Note,
286 * MSG_DONTWAIT and MSG_NOSIGNAL are forced on the flags.
287 */
288int conn_sock_send(struct connection *conn, const void *buf, int len, int flags)
289{
290 int ret;
291
292 ret = -1;
293 errno = ENOTSOCK;
294
295 if (conn->flags & CO_FL_SOCK_WR_SH)
296 goto fail;
297
298 if (!conn_ctrl_ready(conn))
299 goto fail;
300
301 errno = EMSGSIZE;
302 if (!len)
303 goto fail;
304
Willy Tarreau585744b2017-08-24 14:31:19 +0200305 if (!fd_send_ready(conn->handle.fd))
Willy Tarreauff3e6482015-03-12 23:56:52 +0100306 goto wait;
307
308 do {
Willy Tarreau585744b2017-08-24 14:31:19 +0200309 ret = send(conn->handle.fd, buf, len, flags | MSG_DONTWAIT | MSG_NOSIGNAL);
Willy Tarreauff3e6482015-03-12 23:56:52 +0100310 } while (ret < 0 && errno == EINTR);
311
312
Willy Tarreauccf3f6d2019-09-05 17:05:05 +0200313 if (ret > 0) {
314 if (conn->flags & CO_FL_WAIT_L4_CONN) {
315 conn->flags &= ~CO_FL_WAIT_L4_CONN;
316 fd_may_send(conn->handle.fd);
317 fd_cond_recv(conn->handle.fd);
318 }
Willy Tarreauff3e6482015-03-12 23:56:52 +0100319 return ret;
Willy Tarreauccf3f6d2019-09-05 17:05:05 +0200320 }
Willy Tarreauff3e6482015-03-12 23:56:52 +0100321
322 if (ret == 0 || errno == EAGAIN || errno == ENOTCONN) {
323 wait:
Willy Tarreau585744b2017-08-24 14:31:19 +0200324 fd_cant_send(conn->handle.fd);
Willy Tarreauff3e6482015-03-12 23:56:52 +0100325 return 0;
326 }
327 fail:
328 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH | CO_FL_ERROR;
329 return ret;
330}
331
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100332/* Called from the upper layer, to subscribe <es> to events <event_type>. The
333 * event subscriber <es> is not allowed to change from a previous call as long
334 * as at least one event is still subscribed. The <event_type> must only be a
335 * combination of SUB_RETRY_RECV and SUB_RETRY_SEND. It always returns 0.
336 */
337int conn_unsubscribe(struct connection *conn, void *xprt_ctx, int event_type, struct wait_event *es)
Olivier Houchard83a0cd82018-09-28 17:57:58 +0200338{
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100339 BUG_ON(event_type & ~(SUB_RETRY_SEND|SUB_RETRY_RECV));
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100340 BUG_ON(conn->subs && conn->subs != es);
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100341
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100342 es->events &= ~event_type;
343 if (!es->events)
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100344 conn->subs = NULL;
345
Willy Tarreaud1d14c32020-02-21 10:34:19 +0100346 if (conn_ctrl_ready(conn)) {
347 if (event_type & SUB_RETRY_RECV)
348 fd_stop_recv(conn->handle.fd);
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100349
Willy Tarreaud1d14c32020-02-21 10:34:19 +0100350 if (event_type & SUB_RETRY_SEND)
351 fd_stop_send(conn->handle.fd);
352 }
Olivier Houchard83a0cd82018-09-28 17:57:58 +0200353 return 0;
354}
355
Willy Tarreau7e59c0a2020-02-28 14:24:49 +0100356/* Called from the upper layer, to subscribe <es> to events <event_type>.
357 * The <es> struct is not allowed to differ from the one passed during a
358 * previous call to subscribe(). If the FD is ready, the wait_event is
359 * immediately woken up and the subcription is cancelled. It always
360 * returns zero.
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100361 */
362int conn_subscribe(struct connection *conn, void *xprt_ctx, int event_type, struct wait_event *es)
Olivier Houchard6ff20392018-07-17 18:46:31 +0200363{
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100364 BUG_ON(event_type & ~(SUB_RETRY_SEND|SUB_RETRY_RECV));
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100365 BUG_ON(conn->subs && conn->subs != es);
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100366
Willy Tarreau7e59c0a2020-02-28 14:24:49 +0100367 if (conn->subs && (conn->subs->events & event_type) == event_type)
368 return 0;
369
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100370 conn->subs = es;
371 es->events |= event_type;
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100372
Willy Tarreaud1d14c32020-02-21 10:34:19 +0100373 if (conn_ctrl_ready(conn)) {
Willy Tarreau7e59c0a2020-02-28 14:24:49 +0100374 if (event_type & SUB_RETRY_RECV) {
375 if (fd_recv_ready(conn->handle.fd)) {
376 tasklet_wakeup(es->tasklet);
377 es->events &= ~SUB_RETRY_RECV;
378 if (!es->events)
379 conn->subs = NULL;
380 }
381 else
382 fd_want_recv(conn->handle.fd);
383 }
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100384
Willy Tarreau7e59c0a2020-02-28 14:24:49 +0100385 if (event_type & SUB_RETRY_SEND) {
386 if (fd_send_ready(conn->handle.fd)) {
387 tasklet_wakeup(es->tasklet);
388 es->events &= ~SUB_RETRY_SEND;
389 if (!es->events)
390 conn->subs = NULL;
391 }
392 else
393 fd_want_send(conn->handle.fd);
394 }
Willy Tarreaud1d14c32020-02-21 10:34:19 +0100395 }
Olivier Houchard83a0cd82018-09-28 17:57:58 +0200396 return 0;
Olivier Houchard6ff20392018-07-17 18:46:31 +0200397}
398
Willy Tarreaud85c4852015-03-13 00:40:28 +0100399/* Drains possibly pending incoming data on the file descriptor attached to the
400 * connection and update the connection's flags accordingly. This is used to
401 * know whether we need to disable lingering on close. Returns non-zero if it
402 * is safe to close without disabling lingering, otherwise zero. The SOCK_RD_SH
403 * flag may also be updated if the incoming shutdown was reported by the drain()
404 * function.
405 */
406int conn_sock_drain(struct connection *conn)
407{
Willy Tarreaue215bba2018-08-24 14:31:53 +0200408 int turns = 2;
409 int len;
410
Willy Tarreaud85c4852015-03-13 00:40:28 +0100411 if (!conn_ctrl_ready(conn))
412 return 1;
413
414 if (conn->flags & (CO_FL_ERROR | CO_FL_SOCK_RD_SH))
415 return 1;
416
Willy Tarreaue215bba2018-08-24 14:31:53 +0200417 if (fdtab[conn->handle.fd].ev & (FD_POLL_ERR|FD_POLL_HUP))
418 goto shut;
Willy Tarreaud85c4852015-03-13 00:40:28 +0100419
Willy Tarreaue215bba2018-08-24 14:31:53 +0200420 if (!fd_recv_ready(conn->handle.fd))
421 return 0;
Willy Tarreaud85c4852015-03-13 00:40:28 +0100422
Willy Tarreaue215bba2018-08-24 14:31:53 +0200423 /* no drain function defined, use the generic one */
424
425 while (turns) {
426#ifdef MSG_TRUNC_CLEARS_INPUT
427 len = recv(conn->handle.fd, NULL, INT_MAX, MSG_DONTWAIT | MSG_NOSIGNAL | MSG_TRUNC);
428 if (len == -1 && errno == EFAULT)
429#endif
430 len = recv(conn->handle.fd, trash.area, trash.size,
431 MSG_DONTWAIT | MSG_NOSIGNAL);
432
433 if (len == 0)
434 goto shut;
435
436 if (len < 0) {
437 if (errno == EAGAIN) {
438 /* connection not closed yet */
439 fd_cant_recv(conn->handle.fd);
440 break;
441 }
442 if (errno == EINTR) /* oops, try again */
443 continue;
444 /* other errors indicate a dead connection, fine. */
445 goto shut;
446 }
447 /* OK we read some data, let's try again once */
448 turns--;
Willy Tarreaud85c4852015-03-13 00:40:28 +0100449 }
450
Willy Tarreaue215bba2018-08-24 14:31:53 +0200451 /* some data are still present, give up */
452 return 0;
453
454 shut:
455 /* we're certain the connection was shut down */
456 fdtab[conn->handle.fd].linger_risk = 0;
Willy Tarreaud85c4852015-03-13 00:40:28 +0100457 conn->flags |= CO_FL_SOCK_RD_SH;
458 return 1;
459}
460
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100461/*
462 * Get data length from tlv
463 */
Tim Duesterhusba837ec2020-03-05 23:11:02 +0100464static inline size_t get_tlv_length(const struct tlv *src)
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100465{
466 return (src->length_hi << 8) | src->length_lo;
467}
468
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200469/* This handshake handler waits a PROXY protocol header at the beginning of the
470 * raw data stream. The header looks like this :
471 *
472 * "PROXY" <SP> PROTO <SP> SRC3 <SP> DST3 <SP> SRC4 <SP> <DST4> "\r\n"
473 *
474 * There must be exactly one space between each field. Fields are :
475 * - PROTO : layer 4 protocol, which must be "TCP4" or "TCP6".
476 * - SRC3 : layer 3 (eg: IP) source address in standard text form
477 * - DST3 : layer 3 (eg: IP) destination address in standard text form
478 * - SRC4 : layer 4 (eg: TCP port) source address in standard text form
479 * - DST4 : layer 4 (eg: TCP port) destination address in standard text form
480 *
481 * This line MUST be at the beginning of the buffer and MUST NOT wrap.
482 *
483 * The header line is small and in all cases smaller than the smallest normal
484 * TCP MSS. So it MUST always be delivered as one segment, which ensures we
485 * can safely use MSG_PEEK and avoid buffering.
486 *
487 * Once the data is fetched, the values are set in the connection's address
488 * fields, and data are removed from the socket's buffer. The function returns
489 * zero if it needs to wait for more data or if it fails, or 1 if it completed
490 * and removed itself.
491 */
492int conn_recv_proxy(struct connection *conn, int flag)
493{
494 char *line, *end;
Willy Tarreau77992672014-06-14 11:06:17 +0200495 struct proxy_hdr_v2 *hdr_v2;
496 const char v2sig[] = PP2_SIGNATURE;
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100497 size_t total_v2_len;
Tim Duesterhusba837ec2020-03-05 23:11:02 +0100498 size_t tlv_offset = 0;
Willy Tarreaub406b872018-08-22 05:20:32 +0200499 int ret;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200500
Willy Tarreau3c728722014-01-23 13:50:42 +0100501 if (!conn_ctrl_ready(conn))
Willy Tarreauf79c8172013-10-21 16:30:56 +0200502 goto fail;
503
Willy Tarreau9b7587a2020-10-15 07:32:10 +0200504 if (!sockaddr_alloc(&conn->src, NULL, 0) || !sockaddr_alloc(&conn->dst, NULL, 0))
Willy Tarreauca79f592019-07-17 19:04:47 +0200505 goto fail;
506
Willy Tarreau585744b2017-08-24 14:31:19 +0200507 if (!fd_recv_ready(conn->handle.fd))
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200508 goto not_ready;
Willy Tarreaufd803bb2014-01-20 15:13:07 +0100509
Willy Tarreau157788c2020-02-11 10:08:05 +0100510 while (1) {
Willy Tarreaub406b872018-08-22 05:20:32 +0200511 ret = recv(conn->handle.fd, trash.area, trash.size, MSG_PEEK);
512 if (ret < 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200513 if (errno == EINTR)
514 continue;
515 if (errno == EAGAIN) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200516 fd_cant_recv(conn->handle.fd);
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200517 goto not_ready;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200518 }
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100519 goto recv_abort;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200520 }
Willy Tarreaub406b872018-08-22 05:20:32 +0200521 trash.data = ret;
Willy Tarreau157788c2020-02-11 10:08:05 +0100522 break;
523 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200524
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200525 if (!trash.data) {
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100526 /* client shutdown */
527 conn->err_code = CO_ER_PRX_EMPTY;
528 goto fail;
529 }
530
Willy Tarreauc192b0a2020-01-23 09:11:58 +0100531 conn->flags &= ~CO_FL_WAIT_L4_CONN;
532
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200533 if (trash.data < 6)
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200534 goto missing;
535
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200536 line = trash.area;
537 end = trash.area + trash.data;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200538
539 /* Decode a possible proxy request, fail early if it does not match */
Willy Tarreau77992672014-06-14 11:06:17 +0200540 if (strncmp(line, "PROXY ", 6) != 0)
541 goto not_v1;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200542
543 line += 6;
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200544 if (trash.data < 9) /* shortest possible line */
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200545 goto missing;
546
David CARLIER42ff05e2016-03-24 09:22:36 +0000547 if (memcmp(line, "TCP4 ", 5) == 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200548 u32 src3, dst3, sport, dport;
549
550 line += 5;
551
552 src3 = inetaddr_host_lim_ret(line, end, &line);
553 if (line == end)
554 goto missing;
555 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100556 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200557
558 dst3 = inetaddr_host_lim_ret(line, end, &line);
559 if (line == end)
560 goto missing;
561 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100562 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200563
564 sport = read_uint((const char **)&line, end);
565 if (line == end)
566 goto missing;
567 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100568 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200569
570 dport = read_uint((const char **)&line, end);
571 if (line > end - 2)
572 goto missing;
573 if (*line++ != '\r')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100574 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200575 if (*line++ != '\n')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100576 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200577
578 /* update the session's addresses and mark them set */
Willy Tarreau226572f2019-07-17 14:46:00 +0200579 ((struct sockaddr_in *)conn->src)->sin_family = AF_INET;
580 ((struct sockaddr_in *)conn->src)->sin_addr.s_addr = htonl(src3);
581 ((struct sockaddr_in *)conn->src)->sin_port = htons(sport);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200582
Willy Tarreau226572f2019-07-17 14:46:00 +0200583 ((struct sockaddr_in *)conn->dst)->sin_family = AF_INET;
584 ((struct sockaddr_in *)conn->dst)->sin_addr.s_addr = htonl(dst3);
585 ((struct sockaddr_in *)conn->dst)->sin_port = htons(dport);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200586 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
587 }
David CARLIER42ff05e2016-03-24 09:22:36 +0000588 else if (memcmp(line, "TCP6 ", 5) == 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200589 u32 sport, dport;
590 char *src_s;
591 char *dst_s, *sport_s, *dport_s;
592 struct in6_addr src3, dst3;
593
594 line += 5;
595
596 src_s = line;
597 dst_s = sport_s = dport_s = NULL;
598 while (1) {
599 if (line > end - 2) {
600 goto missing;
601 }
602 else if (*line == '\r') {
603 *line = 0;
604 line++;
605 if (*line++ != '\n')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100606 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200607 break;
608 }
609
610 if (*line == ' ') {
611 *line = 0;
612 if (!dst_s)
613 dst_s = line + 1;
614 else if (!sport_s)
615 sport_s = line + 1;
616 else if (!dport_s)
617 dport_s = line + 1;
618 }
619 line++;
620 }
621
622 if (!dst_s || !sport_s || !dport_s)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100623 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200624
625 sport = read_uint((const char **)&sport_s,dport_s - 1);
626 if (*sport_s != 0)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100627 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200628
629 dport = read_uint((const char **)&dport_s,line - 2);
630 if (*dport_s != 0)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100631 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200632
633 if (inet_pton(AF_INET6, src_s, (void *)&src3) != 1)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100634 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200635
636 if (inet_pton(AF_INET6, dst_s, (void *)&dst3) != 1)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100637 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200638
639 /* update the session's addresses and mark them set */
Willy Tarreau226572f2019-07-17 14:46:00 +0200640 ((struct sockaddr_in6 *)conn->src)->sin6_family = AF_INET6;
641 memcpy(&((struct sockaddr_in6 *)conn->src)->sin6_addr, &src3, sizeof(struct in6_addr));
642 ((struct sockaddr_in6 *)conn->src)->sin6_port = htons(sport);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200643
Willy Tarreau226572f2019-07-17 14:46:00 +0200644 ((struct sockaddr_in6 *)conn->dst)->sin6_family = AF_INET6;
645 memcpy(&((struct sockaddr_in6 *)conn->dst)->sin6_addr, &dst3, sizeof(struct in6_addr));
646 ((struct sockaddr_in6 *)conn->dst)->sin6_port = htons(dport);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200647 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
648 }
Willy Tarreau4c20d292014-06-14 11:41:36 +0200649 else if (memcmp(line, "UNKNOWN\r\n", 9) == 0) {
650 /* This can be a UNIX socket forwarded by an haproxy upstream */
651 line += 9;
652 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200653 else {
Willy Tarreau4c20d292014-06-14 11:41:36 +0200654 /* The protocol does not match something known (TCP4/TCP6/UNKNOWN) */
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100655 conn->err_code = CO_ER_PRX_BAD_PROTO;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200656 goto fail;
657 }
658
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200659 trash.data = line - trash.area;
Willy Tarreau77992672014-06-14 11:06:17 +0200660 goto eat_header;
661
662 not_v1:
663 /* try PPv2 */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200664 if (trash.data < PP2_HEADER_LEN)
Willy Tarreau77992672014-06-14 11:06:17 +0200665 goto missing;
666
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200667 hdr_v2 = (struct proxy_hdr_v2 *) trash.area;
Willy Tarreau77992672014-06-14 11:06:17 +0200668
669 if (memcmp(hdr_v2->sig, v2sig, PP2_SIGNATURE_LEN) != 0 ||
670 (hdr_v2->ver_cmd & PP2_VERSION_MASK) != PP2_VERSION) {
671 conn->err_code = CO_ER_PRX_NOT_HDR;
672 goto fail;
673 }
674
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100675 total_v2_len = PP2_HEADER_LEN + ntohs(hdr_v2->len);
676 if (trash.data < total_v2_len)
Willy Tarreau77992672014-06-14 11:06:17 +0200677 goto missing;
678
679 switch (hdr_v2->ver_cmd & PP2_CMD_MASK) {
680 case 0x01: /* PROXY command */
681 switch (hdr_v2->fam) {
682 case 0x11: /* TCPv4 */
KOVACS Krisztianefd3aa92014-11-19 10:53:20 +0100683 if (ntohs(hdr_v2->len) < PP2_ADDR_LEN_INET)
684 goto bad_header;
685
Willy Tarreau226572f2019-07-17 14:46:00 +0200686 ((struct sockaddr_in *)conn->src)->sin_family = AF_INET;
687 ((struct sockaddr_in *)conn->src)->sin_addr.s_addr = hdr_v2->addr.ip4.src_addr;
688 ((struct sockaddr_in *)conn->src)->sin_port = hdr_v2->addr.ip4.src_port;
689 ((struct sockaddr_in *)conn->dst)->sin_family = AF_INET;
690 ((struct sockaddr_in *)conn->dst)->sin_addr.s_addr = hdr_v2->addr.ip4.dst_addr;
691 ((struct sockaddr_in *)conn->dst)->sin_port = hdr_v2->addr.ip4.dst_port;
Willy Tarreau77992672014-06-14 11:06:17 +0200692 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
KOVACS Krisztian7209c202015-07-03 14:09:10 +0200693 tlv_offset = PP2_HEADER_LEN + PP2_ADDR_LEN_INET;
Willy Tarreau77992672014-06-14 11:06:17 +0200694 break;
695 case 0x21: /* TCPv6 */
KOVACS Krisztianefd3aa92014-11-19 10:53:20 +0100696 if (ntohs(hdr_v2->len) < PP2_ADDR_LEN_INET6)
697 goto bad_header;
698
Willy Tarreau226572f2019-07-17 14:46:00 +0200699 ((struct sockaddr_in6 *)conn->src)->sin6_family = AF_INET6;
700 memcpy(&((struct sockaddr_in6 *)conn->src)->sin6_addr, hdr_v2->addr.ip6.src_addr, 16);
701 ((struct sockaddr_in6 *)conn->src)->sin6_port = hdr_v2->addr.ip6.src_port;
702 ((struct sockaddr_in6 *)conn->dst)->sin6_family = AF_INET6;
703 memcpy(&((struct sockaddr_in6 *)conn->dst)->sin6_addr, hdr_v2->addr.ip6.dst_addr, 16);
704 ((struct sockaddr_in6 *)conn->dst)->sin6_port = hdr_v2->addr.ip6.dst_port;
Willy Tarreau77992672014-06-14 11:06:17 +0200705 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
KOVACS Krisztian7209c202015-07-03 14:09:10 +0200706 tlv_offset = PP2_HEADER_LEN + PP2_ADDR_LEN_INET6;
Willy Tarreau77992672014-06-14 11:06:17 +0200707 break;
708 }
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100709
710 /* TLV parsing */
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100711 while (tlv_offset < total_v2_len) {
712 struct tlv *tlv_packet;
Tim Duesterhusba837ec2020-03-05 23:11:02 +0100713 size_t tlv_len;
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100714
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100715 /* Verify that we have at least TLV_HEADER_SIZE bytes left */
716 if (tlv_offset + TLV_HEADER_SIZE > total_v2_len)
717 goto bad_header;
718
719 tlv_packet = (struct tlv *) &trash.area[tlv_offset];
720 tlv_len = get_tlv_length(tlv_packet);
721 tlv_offset += tlv_len + TLV_HEADER_SIZE;
722
723 /* Verify that the TLV length does not exceed the total PROXYv2 length */
724 if (tlv_offset > total_v2_len)
725 goto bad_header;
726
727 switch (tlv_packet->type) {
728 case PP2_TYPE_CRC32C: {
729 uint32_t n_crc32c;
730
731 /* Verify that this TLV is exactly 4 bytes long */
732 if (tlv_len != 4)
733 goto bad_header;
734
735 n_crc32c = read_n32(tlv_packet->value);
736 write_n32(tlv_packet->value, 0); // compute with CRC==0
737
738 if (hash_crc32c(trash.area, total_v2_len) != n_crc32c)
739 goto bad_header;
740 break;
741 }
Willy Tarreaue5733232019-05-22 19:24:06 +0200742#ifdef USE_NS
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100743 case PP2_TYPE_NETNS: {
744 const struct netns_entry *ns;
745
746 ns = netns_store_lookup((char*)tlv_packet->value, tlv_len);
747 if (ns)
748 conn->proxy_netns = ns;
749 break;
750 }
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100751#endif
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100752 case PP2_TYPE_AUTHORITY: {
753 if (tlv_len > PP2_AUTHORITY_MAX)
754 goto bad_header;
755 conn->proxy_authority = pool_alloc(pool_head_authority);
756 if (conn->proxy_authority == NULL)
757 goto fail;
758 memcpy(conn->proxy_authority, (const char *)tlv_packet->value, tlv_len);
759 conn->proxy_authority_len = tlv_len;
760 break;
761 }
Tim Duesterhusd1b15b62020-03-13 12:34:23 +0100762 case PP2_TYPE_UNIQUE_ID: {
763 const struct ist tlv = ist2((const char *)tlv_packet->value, tlv_len);
764
765 if (tlv.len > UNIQUEID_LEN)
766 goto bad_header;
Tim Duesterhus2b7f6c22020-03-14 13:07:05 +0100767 conn->proxy_unique_id = ist2(pool_alloc(pool_head_uniqueid), 0);
Tim Duesterhusd1b15b62020-03-13 12:34:23 +0100768 if (!isttest(conn->proxy_unique_id))
769 goto fail;
770 if (istcpy(&conn->proxy_unique_id, tlv, UNIQUEID_LEN) < 0) {
771 /* This is technically unreachable, because we verified above
772 * that the TLV value fits.
773 */
774 goto fail;
775 }
776 break;
777 }
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100778 default:
779 break;
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100780 }
781 }
782
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100783 /* Verify that the PROXYv2 header ends at a TLV boundary.
784 * This is technically unreachable, because the TLV parsing already
785 * verifies that a TLV does not exceed the total length and also
786 * that there is space for a TLV header.
787 */
788 if (tlv_offset != total_v2_len)
789 goto bad_header;
790
Willy Tarreau77992672014-06-14 11:06:17 +0200791 /* unsupported protocol, keep local connection address */
792 break;
793 case 0x00: /* LOCAL command */
794 /* keep local connection address for LOCAL */
795 break;
796 default:
797 goto bad_header; /* not a supported command */
798 }
799
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100800 trash.data = total_v2_len;
Willy Tarreau77992672014-06-14 11:06:17 +0200801 goto eat_header;
802
803 eat_header:
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200804 /* remove the PROXY line from the request. For this we re-read the
805 * exact line at once. If we don't get the exact same result, we
806 * fail.
807 */
Willy Tarreau157788c2020-02-11 10:08:05 +0100808 while (1) {
Tim Duesterhusa8692f32020-03-13 12:34:25 +0100809 ssize_t len2 = recv(conn->handle.fd, trash.area, trash.data, 0);
810
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200811 if (len2 < 0 && errno == EINTR)
812 continue;
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200813 if (len2 != trash.data)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100814 goto recv_abort;
Willy Tarreau157788c2020-02-11 10:08:05 +0100815 break;
816 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200817
818 conn->flags &= ~flag;
Emeric Brun4f603012017-01-05 15:11:44 +0100819 conn->flags |= CO_FL_RCVD_PROXY;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200820 return 1;
821
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200822 not_ready:
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200823 return 0;
824
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200825 missing:
826 /* Missing data. Since we're using MSG_PEEK, we can only poll again if
827 * we have not read anything. Otherwise we need to fail because we won't
828 * be able to poll anymore.
829 */
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100830 conn->err_code = CO_ER_PRX_TRUNCATED;
831 goto fail;
832
833 bad_header:
834 /* This is not a valid proxy protocol header */
835 conn->err_code = CO_ER_PRX_BAD_HDR;
836 goto fail;
837
838 recv_abort:
839 conn->err_code = CO_ER_PRX_ABORT;
Willy Tarreau26f4a042013-12-04 23:44:10 +0100840 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH;
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100841 goto fail;
842
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200843 fail:
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200844 conn->flags |= CO_FL_ERROR;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200845 return 0;
846}
847
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100848/* This handshake handler waits a NetScaler Client IP insertion header
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000849 * at the beginning of the raw data stream. The header format is
850 * described in doc/netscaler-client-ip-insertion-protocol.txt
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100851 *
852 * This line MUST be at the beginning of the buffer and MUST NOT be
853 * fragmented.
854 *
855 * The header line is small and in all cases smaller than the smallest normal
856 * TCP MSS. So it MUST always be delivered as one segment, which ensures we
857 * can safely use MSG_PEEK and avoid buffering.
858 *
859 * Once the data is fetched, the values are set in the connection's address
860 * fields, and data are removed from the socket's buffer. The function returns
861 * zero if it needs to wait for more data or if it fails, or 1 if it completed
862 * and removed itself.
863 */
864int conn_recv_netscaler_cip(struct connection *conn, int flag)
865{
866 char *line;
Bertrand Jacquin7d668f92017-12-13 01:23:39 +0000867 uint32_t hdr_len;
Willy Tarreau0ca24aa2019-03-29 17:35:32 +0100868 uint8_t ip_ver;
Willy Tarreaub406b872018-08-22 05:20:32 +0200869 int ret;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100870
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100871 if (!conn_ctrl_ready(conn))
872 goto fail;
873
Willy Tarreau9b7587a2020-10-15 07:32:10 +0200874 if (!sockaddr_alloc(&conn->src, NULL, 0) || !sockaddr_alloc(&conn->dst, NULL, 0))
Olivier Houchard1a9dbe52020-01-22 15:31:09 +0100875 goto fail;
876
Willy Tarreau585744b2017-08-24 14:31:19 +0200877 if (!fd_recv_ready(conn->handle.fd))
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200878 goto not_ready;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100879
Willy Tarreau157788c2020-02-11 10:08:05 +0100880 while (1) {
Willy Tarreaub406b872018-08-22 05:20:32 +0200881 ret = recv(conn->handle.fd, trash.area, trash.size, MSG_PEEK);
882 if (ret < 0) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100883 if (errno == EINTR)
884 continue;
885 if (errno == EAGAIN) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200886 fd_cant_recv(conn->handle.fd);
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200887 goto not_ready;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100888 }
889 goto recv_abort;
890 }
Willy Tarreaub406b872018-08-22 05:20:32 +0200891 trash.data = ret;
Willy Tarreau157788c2020-02-11 10:08:05 +0100892 break;
893 }
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100894
Willy Tarreauc192b0a2020-01-23 09:11:58 +0100895 conn->flags &= ~CO_FL_WAIT_L4_CONN;
896
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200897 if (!trash.data) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100898 /* client shutdown */
899 conn->err_code = CO_ER_CIP_EMPTY;
900 goto fail;
901 }
902
903 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000904 * CIP magic, header length or
905 * CIP magic, CIP length, CIP type, header length */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200906 if (trash.data < 12)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100907 goto missing;
908
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200909 line = trash.area;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100910
911 /* Decode a possible NetScaler Client IP request, fail early if
912 * it does not match */
Willy Tarreau1ac83af2020-02-25 10:06:49 +0100913 if (ntohl(read_u32(line)) != __objt_listener(conn->target)->bind_conf->ns_cip_magic)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100914 goto bad_magic;
915
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000916 /* Legacy CIP protocol */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200917 if ((trash.area[8] & 0xD0) == 0x40) {
Willy Tarreau1ac83af2020-02-25 10:06:49 +0100918 hdr_len = ntohl(read_u32((line+4)));
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000919 line += 8;
920 }
921 /* Standard CIP protocol */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200922 else if (trash.area[8] == 0x00) {
Willy Tarreau1ac83af2020-02-25 10:06:49 +0100923 hdr_len = ntohs(read_u32((line+10)));
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000924 line += 12;
925 }
926 /* Unknown CIP protocol */
927 else {
928 conn->err_code = CO_ER_CIP_BAD_PROTO;
929 goto fail;
930 }
931
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100932 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000933 * a minimal IP header */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200934 if (trash.data < 20)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100935 goto missing;
936
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100937 /* Get IP version from the first four bits */
Willy Tarreau0ca24aa2019-03-29 17:35:32 +0100938 ip_ver = (*line & 0xf0) >> 4;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100939
Willy Tarreau0ca24aa2019-03-29 17:35:32 +0100940 if (ip_ver == 4) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100941 struct ip *hdr_ip4;
David Carlier3015a2e2016-07-04 22:51:33 +0100942 struct my_tcphdr *hdr_tcp;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100943
944 hdr_ip4 = (struct ip *)line;
945
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200946 if (trash.data < 40 || trash.data < hdr_len) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100947 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin67de5a22017-12-13 01:15:05 +0000948 * IPv4 header, TCP header */
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100949 goto missing;
Bertrand Jacquinb3875912017-12-13 00:58:51 +0000950 }
951 else if (hdr_ip4->ip_p != IPPROTO_TCP) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100952 /* The protocol does not include a TCP header */
953 conn->err_code = CO_ER_CIP_BAD_PROTO;
954 goto fail;
Bertrand Jacquinb3875912017-12-13 00:58:51 +0000955 }
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100956
David Carlier3015a2e2016-07-04 22:51:33 +0100957 hdr_tcp = (struct my_tcphdr *)(line + (hdr_ip4->ip_hl * 4));
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100958
959 /* update the session's addresses and mark them set */
Willy Tarreau226572f2019-07-17 14:46:00 +0200960 ((struct sockaddr_in *)conn->src)->sin_family = AF_INET;
961 ((struct sockaddr_in *)conn->src)->sin_addr.s_addr = hdr_ip4->ip_src.s_addr;
962 ((struct sockaddr_in *)conn->src)->sin_port = hdr_tcp->source;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100963
Willy Tarreau226572f2019-07-17 14:46:00 +0200964 ((struct sockaddr_in *)conn->dst)->sin_family = AF_INET;
965 ((struct sockaddr_in *)conn->dst)->sin_addr.s_addr = hdr_ip4->ip_dst.s_addr;
966 ((struct sockaddr_in *)conn->dst)->sin_port = hdr_tcp->dest;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100967
968 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
969 }
Willy Tarreau0ca24aa2019-03-29 17:35:32 +0100970 else if (ip_ver == 6) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100971 struct ip6_hdr *hdr_ip6;
David Carlier3015a2e2016-07-04 22:51:33 +0100972 struct my_tcphdr *hdr_tcp;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100973
974 hdr_ip6 = (struct ip6_hdr *)line;
975
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200976 if (trash.data < 60 || trash.data < hdr_len) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100977 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin67de5a22017-12-13 01:15:05 +0000978 * IPv6 header, TCP header */
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100979 goto missing;
Bertrand Jacquinb3875912017-12-13 00:58:51 +0000980 }
981 else if (hdr_ip6->ip6_nxt != IPPROTO_TCP) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100982 /* The protocol does not include a TCP header */
983 conn->err_code = CO_ER_CIP_BAD_PROTO;
984 goto fail;
Bertrand Jacquinb3875912017-12-13 00:58:51 +0000985 }
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100986
David Carlier3015a2e2016-07-04 22:51:33 +0100987 hdr_tcp = (struct my_tcphdr *)(line + sizeof(struct ip6_hdr));
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100988
989 /* update the session's addresses and mark them set */
Willy Tarreau226572f2019-07-17 14:46:00 +0200990 ((struct sockaddr_in6 *)conn->src)->sin6_family = AF_INET6;
991 ((struct sockaddr_in6 *)conn->src)->sin6_addr = hdr_ip6->ip6_src;
992 ((struct sockaddr_in6 *)conn->src)->sin6_port = hdr_tcp->source;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100993
Willy Tarreau226572f2019-07-17 14:46:00 +0200994 ((struct sockaddr_in6 *)conn->dst)->sin6_family = AF_INET6;
995 ((struct sockaddr_in6 *)conn->dst)->sin6_addr = hdr_ip6->ip6_dst;
996 ((struct sockaddr_in6 *)conn->dst)->sin6_port = hdr_tcp->dest;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100997
998 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
999 }
1000 else {
1001 /* The protocol does not match something known (IPv4/IPv6) */
1002 conn->err_code = CO_ER_CIP_BAD_PROTO;
1003 goto fail;
1004 }
1005
Bertrand Jacquin7d668f92017-12-13 01:23:39 +00001006 line += hdr_len;
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001007 trash.data = line - trash.area;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001008
1009 /* remove the NetScaler Client IP header from the request. For this
1010 * we re-read the exact line at once. If we don't get the exact same
1011 * result, we fail.
1012 */
Willy Tarreau157788c2020-02-11 10:08:05 +01001013 while (1) {
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001014 int len2 = recv(conn->handle.fd, trash.area, trash.data, 0);
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001015 if (len2 < 0 && errno == EINTR)
1016 continue;
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001017 if (len2 != trash.data)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001018 goto recv_abort;
Willy Tarreau157788c2020-02-11 10:08:05 +01001019 break;
1020 }
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001021
1022 conn->flags &= ~flag;
1023 return 1;
1024
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001025 not_ready:
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001026 return 0;
1027
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001028 missing:
1029 /* Missing data. Since we're using MSG_PEEK, we can only poll again if
1030 * we have not read anything. Otherwise we need to fail because we won't
1031 * be able to poll anymore.
1032 */
1033 conn->err_code = CO_ER_CIP_TRUNCATED;
1034 goto fail;
1035
1036 bad_magic:
1037 conn->err_code = CO_ER_CIP_BAD_MAGIC;
1038 goto fail;
1039
1040 recv_abort:
1041 conn->err_code = CO_ER_CIP_ABORT;
1042 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH;
1043 goto fail;
1044
1045 fail:
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001046 conn->flags |= CO_FL_ERROR;
1047 return 0;
1048}
1049
Alexander Liu2a54bb72019-05-22 19:44:48 +08001050
1051int conn_send_socks4_proxy_request(struct connection *conn)
1052{
1053 struct socks4_request req_line;
1054
Alexander Liu2a54bb72019-05-22 19:44:48 +08001055 if (!conn_ctrl_ready(conn))
1056 goto out_error;
1057
Willy Tarreau226572f2019-07-17 14:46:00 +02001058 if (!conn_get_dst(conn))
1059 goto out_error;
1060
Alexander Liu2a54bb72019-05-22 19:44:48 +08001061 req_line.version = 0x04;
1062 req_line.command = 0x01;
Willy Tarreau226572f2019-07-17 14:46:00 +02001063 req_line.port = get_net_port(conn->dst);
1064 req_line.ip = is_inet_addr(conn->dst);
Alexander Liu2a54bb72019-05-22 19:44:48 +08001065 memcpy(req_line.user_id, "HAProxy\0", 8);
1066
1067 if (conn->send_proxy_ofs > 0) {
1068 /*
1069 * This is the first call to send the request
1070 */
1071 conn->send_proxy_ofs = -(int)sizeof(req_line);
1072 }
1073
1074 if (conn->send_proxy_ofs < 0) {
1075 int ret = 0;
1076
1077 /* we are sending the socks4_req_line here. If the data layer
1078 * has a pending write, we'll also set MSG_MORE.
1079 */
1080 ret = conn_sock_send(
1081 conn,
1082 ((char *)(&req_line)) + (sizeof(req_line)+conn->send_proxy_ofs),
1083 -conn->send_proxy_ofs,
Willy Tarreau19bc2012020-02-21 08:46:19 +01001084 (conn->subs && conn->subs->events & SUB_RETRY_SEND) ? MSG_MORE : 0);
Alexander Liu2a54bb72019-05-22 19:44:48 +08001085
1086 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Before send remain is [%d], sent [%d]\n",
1087 conn->handle.fd, -conn->send_proxy_ofs, ret);
1088
1089 if (ret < 0) {
1090 goto out_error;
1091 }
1092
1093 conn->send_proxy_ofs += ret; /* becomes zero once complete */
1094 if (conn->send_proxy_ofs != 0) {
1095 goto out_wait;
1096 }
1097 }
1098
1099 /* OK we've the whole request sent */
1100 conn->flags &= ~CO_FL_SOCKS4_SEND;
Alexander Liu2a54bb72019-05-22 19:44:48 +08001101
1102 /* The connection is ready now, simply return and let the connection
1103 * handler notify upper layers if needed.
1104 */
Willy Tarreauc192b0a2020-01-23 09:11:58 +01001105 conn->flags &= ~CO_FL_WAIT_L4_CONN;
Alexander Liu2a54bb72019-05-22 19:44:48 +08001106
1107 if (conn->flags & CO_FL_SEND_PROXY) {
1108 /*
1109 * Get the send_proxy_ofs ready for the send_proxy due to we are
1110 * reusing the "send_proxy_ofs", and SOCKS4 handshake should be done
1111 * before sending PROXY Protocol.
1112 */
1113 conn->send_proxy_ofs = 1;
1114 }
1115 return 1;
1116
1117 out_error:
1118 /* Write error on the file descriptor */
1119 conn->flags |= CO_FL_ERROR;
1120 if (conn->err_code == CO_ER_NONE) {
1121 conn->err_code = CO_ER_SOCKS4_SEND;
1122 }
1123 return 0;
1124
1125 out_wait:
Alexander Liu2a54bb72019-05-22 19:44:48 +08001126 return 0;
1127}
1128
1129int conn_recv_socks4_proxy_response(struct connection *conn)
1130{
1131 char line[SOCKS4_HS_RSP_LEN];
1132 int ret;
1133
Alexander Liu2a54bb72019-05-22 19:44:48 +08001134 if (!conn_ctrl_ready(conn))
1135 goto fail;
1136
1137 if (!fd_recv_ready(conn->handle.fd))
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001138 goto not_ready;
Alexander Liu2a54bb72019-05-22 19:44:48 +08001139
Willy Tarreau157788c2020-02-11 10:08:05 +01001140 while (1) {
Alexander Liu2a54bb72019-05-22 19:44:48 +08001141 /* SOCKS4 Proxy will response with 8 bytes, 0x00 | 0x5A | 0x00 0x00 | 0x00 0x00 0x00 0x00
1142 * Try to peek into it, before all 8 bytes ready.
1143 */
1144 ret = recv(conn->handle.fd, line, SOCKS4_HS_RSP_LEN, MSG_PEEK);
1145
1146 if (ret == 0) {
1147 /* the socket has been closed or shutdown for send */
1148 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Received ret[%d], errno[%d], looks like the socket has been closed or shutdown for send\n",
1149 conn->handle.fd, ret, errno);
1150 if (conn->err_code == CO_ER_NONE) {
1151 conn->err_code = CO_ER_SOCKS4_RECV;
1152 }
1153 goto fail;
1154 }
1155
1156 if (ret > 0) {
1157 if (ret == SOCKS4_HS_RSP_LEN) {
1158 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Received 8 bytes, the response is [%02X|%02X|%02X %02X|%02X %02X %02X %02X]\n",
1159 conn->handle.fd, line[0], line[1], line[2], line[3], line[4], line[5], line[6], line[7]);
1160 }else{
1161 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Received ret[%d], first byte is [%02X], last bye is [%02X]\n", conn->handle.fd, ret, line[0], line[ret-1]);
1162 }
1163 } else {
1164 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Received ret[%d], errno[%d]\n", conn->handle.fd, ret, errno);
1165 }
1166
1167 if (ret < 0) {
1168 if (errno == EINTR) {
1169 continue;
1170 }
1171 if (errno == EAGAIN) {
1172 fd_cant_recv(conn->handle.fd);
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001173 goto not_ready;
Alexander Liu2a54bb72019-05-22 19:44:48 +08001174 }
1175 goto recv_abort;
1176 }
Willy Tarreau157788c2020-02-11 10:08:05 +01001177 break;
1178 }
Alexander Liu2a54bb72019-05-22 19:44:48 +08001179
Willy Tarreauc192b0a2020-01-23 09:11:58 +01001180 conn->flags &= ~CO_FL_WAIT_L4_CONN;
1181
Alexander Liu2a54bb72019-05-22 19:44:48 +08001182 if (ret < SOCKS4_HS_RSP_LEN) {
1183 /* Missing data. Since we're using MSG_PEEK, we can only poll again if
1184 * we are not able to read enough data.
1185 */
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001186 goto not_ready;
Alexander Liu2a54bb72019-05-22 19:44:48 +08001187 }
1188
1189 /*
1190 * Base on the SOCSK4 protocol:
1191 *
1192 * +----+----+----+----+----+----+----+----+
1193 * | VN | CD | DSTPORT | DSTIP |
1194 * +----+----+----+----+----+----+----+----+
1195 * # of bytes: 1 1 2 4
1196 * VN is the version of the reply code and should be 0. CD is the result
1197 * code with one of the following values:
1198 * 90: request granted
1199 * 91: request rejected or failed
Ilya Shipitsince7b00f2020-03-23 22:28:40 +05001200 * 92: request rejected because SOCKS server cannot connect to identd on the client
Alexander Liu2a54bb72019-05-22 19:44:48 +08001201 * 93: request rejected because the client program and identd report different user-ids
1202 * The remaining fields are ignored.
1203 */
1204 if (line[1] != 90) {
1205 conn->flags &= ~CO_FL_SOCKS4_RECV;
1206
1207 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: FAIL, the response is [%02X|%02X|%02X %02X|%02X %02X %02X %02X]\n",
1208 conn->handle.fd, line[0], line[1], line[2], line[3], line[4], line[5], line[6], line[7]);
1209 if (conn->err_code == CO_ER_NONE) {
1210 conn->err_code = CO_ER_SOCKS4_DENY;
1211 }
1212 goto fail;
1213 }
1214
1215 /* remove the 8 bytes response from the stream */
Willy Tarreau157788c2020-02-11 10:08:05 +01001216 while (1) {
Alexander Liu2a54bb72019-05-22 19:44:48 +08001217 ret = recv(conn->handle.fd, line, SOCKS4_HS_RSP_LEN, 0);
1218 if (ret < 0 && errno == EINTR) {
1219 continue;
1220 }
1221 if (ret != SOCKS4_HS_RSP_LEN) {
1222 if (conn->err_code == CO_ER_NONE) {
1223 conn->err_code = CO_ER_SOCKS4_RECV;
1224 }
1225 goto fail;
1226 }
Willy Tarreau157788c2020-02-11 10:08:05 +01001227 break;
1228 }
Alexander Liu2a54bb72019-05-22 19:44:48 +08001229
1230 conn->flags &= ~CO_FL_SOCKS4_RECV;
1231 return 1;
1232
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001233 not_ready:
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001234 return 0;
1235
Alexander Liu2a54bb72019-05-22 19:44:48 +08001236 recv_abort:
1237 if (conn->err_code == CO_ER_NONE) {
1238 conn->err_code = CO_ER_SOCKS4_ABORT;
1239 }
1240 conn->flags |= (CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH);
1241 goto fail;
1242
1243 fail:
Alexander Liu2a54bb72019-05-22 19:44:48 +08001244 conn->flags |= CO_FL_ERROR;
1245 return 0;
1246}
1247
Ilya Shipitsinca56fce2018-09-15 00:50:05 +05001248/* Note: <remote> is explicitly allowed to be NULL */
Tim Duesterhuscf6e0c82020-03-13 12:34:24 +01001249int make_proxy_line(char *buf, int buf_len, struct server *srv, struct connection *remote, struct stream *strm)
David Safb76832014-05-08 23:42:08 -04001250{
1251 int ret = 0;
1252
1253 if (srv && (srv->pp_opts & SRV_PP_V2)) {
Tim Duesterhuscf6e0c82020-03-13 12:34:24 +01001254 ret = make_proxy_line_v2(buf, buf_len, srv, remote, strm);
David Safb76832014-05-08 23:42:08 -04001255 }
1256 else {
Willy Tarreau226572f2019-07-17 14:46:00 +02001257 if (remote && conn_get_src(remote) && conn_get_dst(remote))
1258 ret = make_proxy_line_v1(buf, buf_len, remote->src, remote->dst);
David Safb76832014-05-08 23:42:08 -04001259 else
1260 ret = make_proxy_line_v1(buf, buf_len, NULL, NULL);
1261 }
1262
1263 return ret;
1264}
1265
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001266/* Makes a PROXY protocol line from the two addresses. The output is sent to
1267 * buffer <buf> for a maximum size of <buf_len> (including the trailing zero).
1268 * It returns the number of bytes composing this line (including the trailing
1269 * LF), or zero in case of failure (eg: not enough space). It supports TCP4,
Willy Tarreau2e1401a2013-10-01 11:41:55 +02001270 * TCP6 and "UNKNOWN" formats. If any of <src> or <dst> is null, UNKNOWN is
1271 * emitted as well.
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001272 */
David Safb76832014-05-08 23:42:08 -04001273int make_proxy_line_v1(char *buf, int buf_len, struct sockaddr_storage *src, struct sockaddr_storage *dst)
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001274{
1275 int ret = 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001276 char * protocol;
1277 char src_str[MAX(INET_ADDRSTRLEN, INET6_ADDRSTRLEN)];
1278 char dst_str[MAX(INET_ADDRSTRLEN, INET6_ADDRSTRLEN)];
1279 in_port_t src_port;
1280 in_port_t dst_port;
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001281
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001282 if ( !src
1283 || !dst
1284 || (src->ss_family != AF_INET && src->ss_family != AF_INET6)
1285 || (dst->ss_family != AF_INET && dst->ss_family != AF_INET6)) {
1286 /* unknown family combination */
1287 ret = snprintf(buf, buf_len, "PROXY UNKNOWN\r\n");
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001288 if (ret >= buf_len)
1289 return 0;
1290
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001291 return ret;
1292 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001293
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001294 /* IPv4 for both src and dst */
1295 if (src->ss_family == AF_INET && dst->ss_family == AF_INET) {
1296 protocol = "TCP4";
1297 if (!inet_ntop(AF_INET, &((struct sockaddr_in *)src)->sin_addr, src_str, sizeof(src_str)))
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001298 return 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001299 src_port = ((struct sockaddr_in *)src)->sin_port;
1300 if (!inet_ntop(AF_INET, &((struct sockaddr_in *)dst)->sin_addr, dst_str, sizeof(dst_str)))
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001301 return 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001302 dst_port = ((struct sockaddr_in *)dst)->sin_port;
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001303 }
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001304 /* IPv6 for at least one of src and dst */
1305 else {
1306 struct in6_addr tmp;
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001307
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001308 protocol = "TCP6";
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001309
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001310 if (src->ss_family == AF_INET) {
1311 /* Convert src to IPv6 */
1312 v4tov6(&tmp, &((struct sockaddr_in *)src)->sin_addr);
1313 src_port = ((struct sockaddr_in *)src)->sin_port;
1314 }
1315 else {
1316 tmp = ((struct sockaddr_in6 *)src)->sin6_addr;
1317 src_port = ((struct sockaddr_in6 *)src)->sin6_port;
1318 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001319
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001320 if (!inet_ntop(AF_INET6, &tmp, src_str, sizeof(src_str)))
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001321 return 0;
1322
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001323 if (dst->ss_family == AF_INET) {
1324 /* Convert dst to IPv6 */
1325 v4tov6(&tmp, &((struct sockaddr_in *)dst)->sin_addr);
1326 dst_port = ((struct sockaddr_in *)dst)->sin_port;
1327 }
1328 else {
1329 tmp = ((struct sockaddr_in6 *)dst)->sin6_addr;
1330 dst_port = ((struct sockaddr_in6 *)dst)->sin6_port;
1331 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001332
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001333 if (!inet_ntop(AF_INET6, &tmp, dst_str, sizeof(dst_str)))
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001334 return 0;
1335 }
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001336
1337 ret = snprintf(buf, buf_len, "PROXY %s %s %s %u %u\r\n", protocol, src_str, dst_str, ntohs(src_port), ntohs(dst_port));
1338 if (ret >= buf_len)
1339 return 0;
1340
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001341 return ret;
1342}
David Safb76832014-05-08 23:42:08 -04001343
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001344static int make_tlv(char *dest, int dest_len, char type, uint16_t length, const char *value)
David Safb76832014-05-08 23:42:08 -04001345{
1346 struct tlv *tlv;
1347
1348 if (!dest || (length + sizeof(*tlv) > dest_len))
1349 return 0;
1350
1351 tlv = (struct tlv *)dest;
1352
1353 tlv->type = type;
1354 tlv->length_hi = length >> 8;
1355 tlv->length_lo = length & 0x00ff;
1356 memcpy(tlv->value, value, length);
1357 return length + sizeof(*tlv);
1358}
David Safb76832014-05-08 23:42:08 -04001359
Ilya Shipitsinca56fce2018-09-15 00:50:05 +05001360/* Note: <remote> is explicitly allowed to be NULL */
Tim Duesterhuscf6e0c82020-03-13 12:34:24 +01001361int make_proxy_line_v2(char *buf, int buf_len, struct server *srv, struct connection *remote, struct stream *strm)
David Safb76832014-05-08 23:42:08 -04001362{
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001363 const char pp2_signature[] = PP2_SIGNATURE;
Emmanuel Hocdet4399c752018-02-05 15:26:43 +01001364 void *tlv_crc32c_p = NULL;
David Safb76832014-05-08 23:42:08 -04001365 int ret = 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001366 struct proxy_hdr_v2 *hdr = (struct proxy_hdr_v2 *)buf;
Vincent Bernat6e615892016-05-18 16:17:44 +02001367 struct sockaddr_storage null_addr = { .ss_family = 0 };
David Safb76832014-05-08 23:42:08 -04001368 struct sockaddr_storage *src = &null_addr;
1369 struct sockaddr_storage *dst = &null_addr;
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001370 const char *value;
1371 int value_len;
David Safb76832014-05-08 23:42:08 -04001372
1373 if (buf_len < PP2_HEADER_LEN)
1374 return 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001375 memcpy(hdr->sig, pp2_signature, PP2_SIGNATURE_LEN);
David Safb76832014-05-08 23:42:08 -04001376
Willy Tarreau226572f2019-07-17 14:46:00 +02001377 if (remote && conn_get_src(remote) && conn_get_dst(remote)) {
1378 src = remote->src;
1379 dst = remote->dst;
David Safb76832014-05-08 23:42:08 -04001380 }
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001381
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001382 /* At least one of src or dst is not of AF_INET or AF_INET6 */
1383 if ( !src
1384 || !dst
Willy Tarreau119e50e2020-05-22 13:53:29 +02001385 || (!pp2_never_send_local && conn_is_back(remote)) // locally initiated connection
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001386 || (src->ss_family != AF_INET && src->ss_family != AF_INET6)
1387 || (dst->ss_family != AF_INET && dst->ss_family != AF_INET6)) {
David Safb76832014-05-08 23:42:08 -04001388 if (buf_len < PP2_HDR_LEN_UNSPEC)
1389 return 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001390 hdr->ver_cmd = PP2_VERSION | PP2_CMD_LOCAL;
1391 hdr->fam = PP2_FAM_UNSPEC | PP2_TRANS_UNSPEC;
David Safb76832014-05-08 23:42:08 -04001392 ret = PP2_HDR_LEN_UNSPEC;
1393 }
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001394 else {
Willy Tarreau02c88032020-04-14 12:54:10 +02001395 hdr->ver_cmd = PP2_VERSION | PP2_CMD_PROXY;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001396 /* IPv4 for both src and dst */
1397 if (src->ss_family == AF_INET && dst->ss_family == AF_INET) {
1398 if (buf_len < PP2_HDR_LEN_INET)
1399 return 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001400 hdr->fam = PP2_FAM_INET | PP2_TRANS_STREAM;
1401 hdr->addr.ip4.src_addr = ((struct sockaddr_in *)src)->sin_addr.s_addr;
1402 hdr->addr.ip4.src_port = ((struct sockaddr_in *)src)->sin_port;
1403 hdr->addr.ip4.dst_addr = ((struct sockaddr_in *)dst)->sin_addr.s_addr;
1404 hdr->addr.ip4.dst_port = ((struct sockaddr_in *)dst)->sin_port;
1405 ret = PP2_HDR_LEN_INET;
1406 }
1407 /* IPv6 for at least one of src and dst */
1408 else {
1409 struct in6_addr tmp;
1410
1411 if (buf_len < PP2_HDR_LEN_INET6)
1412 return 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001413 hdr->fam = PP2_FAM_INET6 | PP2_TRANS_STREAM;
1414 if (src->ss_family == AF_INET) {
1415 v4tov6(&tmp, &((struct sockaddr_in *)src)->sin_addr);
1416 memcpy(hdr->addr.ip6.src_addr, &tmp, 16);
1417 hdr->addr.ip6.src_port = ((struct sockaddr_in *)src)->sin_port;
1418 }
1419 else {
1420 memcpy(hdr->addr.ip6.src_addr, &((struct sockaddr_in6 *)src)->sin6_addr, 16);
1421 hdr->addr.ip6.src_port = ((struct sockaddr_in6 *)src)->sin6_port;
1422 }
1423 if (dst->ss_family == AF_INET) {
1424 v4tov6(&tmp, &((struct sockaddr_in *)dst)->sin_addr);
1425 memcpy(hdr->addr.ip6.dst_addr, &tmp, 16);
William Dauchybd8bf672020-01-26 19:06:39 +01001426 hdr->addr.ip6.dst_port = ((struct sockaddr_in *)dst)->sin_port;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001427 }
1428 else {
1429 memcpy(hdr->addr.ip6.dst_addr, &((struct sockaddr_in6 *)dst)->sin6_addr, 16);
1430 hdr->addr.ip6.dst_port = ((struct sockaddr_in6 *)dst)->sin6_port;
1431 }
1432
1433 ret = PP2_HDR_LEN_INET6;
1434 }
1435 }
David Safb76832014-05-08 23:42:08 -04001436
Emmanuel Hocdet4399c752018-02-05 15:26:43 +01001437 if (srv->pp_opts & SRV_PP_V2_CRC32C) {
1438 uint32_t zero_crc32c = 0;
Tim Duesterhusa8692f32020-03-13 12:34:25 +01001439
Emmanuel Hocdet4399c752018-02-05 15:26:43 +01001440 if ((buf_len - ret) < sizeof(struct tlv))
1441 return 0;
1442 tlv_crc32c_p = (void *)((struct tlv *)&buf[ret])->value;
1443 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_CRC32C, sizeof(zero_crc32c), (const char *)&zero_crc32c);
1444 }
1445
Ilya Shipitsinca56fce2018-09-15 00:50:05 +05001446 if (remote && conn_get_alpn(remote, &value, &value_len)) {
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001447 if ((buf_len - ret) < sizeof(struct tlv))
1448 return 0;
Emmanuel Hocdet571c7ac2017-10-31 18:24:05 +01001449 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_ALPN, value_len, value);
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001450 }
1451
Emmanuel Hocdet253c3b72018-02-01 18:29:59 +01001452 if (srv->pp_opts & SRV_PP_V2_AUTHORITY) {
Emmanuel Hocdet8a4ffa02019-08-29 11:54:51 +02001453 value = NULL;
1454 if (remote && remote->proxy_authority) {
1455 value = remote->proxy_authority;
1456 value_len = remote->proxy_authority_len;
1457 }
1458#ifdef USE_OPENSSL
1459 else {
Jerome Magnin78891c72019-09-02 09:53:41 +02001460 if ((value = ssl_sock_get_sni(remote)))
Emmanuel Hocdet8a4ffa02019-08-29 11:54:51 +02001461 value_len = strlen(value);
1462 }
1463#endif
Emmanuel Hocdet253c3b72018-02-01 18:29:59 +01001464 if (value) {
1465 if ((buf_len - ret) < sizeof(struct tlv))
1466 return 0;
Emmanuel Hocdet8a4ffa02019-08-29 11:54:51 +02001467 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_AUTHORITY, value_len, value);
Emmanuel Hocdet253c3b72018-02-01 18:29:59 +01001468 }
1469 }
1470
Christopher Faulet3ab504f2020-05-26 15:16:01 +02001471 if (strm && (srv->pp_opts & SRV_PP_V2_UNIQUE_ID)) {
Tim Duesterhuscf6e0c82020-03-13 12:34:24 +01001472 struct session* sess = strm_sess(strm);
1473 struct ist unique_id = stream_generate_unique_id(strm, &sess->fe->format_unique_id);
1474
1475 value = unique_id.ptr;
1476 value_len = unique_id.len;
1477
1478 if (value_len >= 0) {
1479 if ((buf_len - ret) < sizeof(struct tlv))
1480 return 0;
1481 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_UNIQUE_ID, value_len, value);
1482 }
1483 }
1484
Emmanuel Hocdet8a4ffa02019-08-29 11:54:51 +02001485#ifdef USE_OPENSSL
David Safb76832014-05-08 23:42:08 -04001486 if (srv->pp_opts & SRV_PP_V2_SSL) {
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001487 struct tlv_ssl *tlv;
1488 int ssl_tlv_len = 0;
Tim Duesterhusa8692f32020-03-13 12:34:25 +01001489
David Safb76832014-05-08 23:42:08 -04001490 if ((buf_len - ret) < sizeof(struct tlv_ssl))
1491 return 0;
1492 tlv = (struct tlv_ssl *)&buf[ret];
1493 memset(tlv, 0, sizeof(struct tlv_ssl));
1494 ssl_tlv_len += sizeof(struct tlv_ssl);
1495 tlv->tlv.type = PP2_TYPE_SSL;
1496 if (ssl_sock_is_ssl(remote)) {
1497 tlv->client |= PP2_CLIENT_SSL;
Emmanuel Hocdet01da5712017-10-13 16:59:49 +02001498 value = ssl_sock_get_proto_version(remote);
David Safb76832014-05-08 23:42:08 -04001499 if (value) {
Emmanuel Hocdet8c0c34b2018-02-28 12:02:14 +01001500 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len-ret-ssl_tlv_len), PP2_SUBTYPE_SSL_VERSION, strlen(value), value);
David Safb76832014-05-08 23:42:08 -04001501 }
Dave McCowan328fb582014-07-30 10:39:13 -04001502 if (ssl_sock_get_cert_used_sess(remote)) {
1503 tlv->client |= PP2_CLIENT_CERT_SESS;
David Safb76832014-05-08 23:42:08 -04001504 tlv->verify = htonl(ssl_sock_get_verify_result(remote));
Dave McCowan328fb582014-07-30 10:39:13 -04001505 if (ssl_sock_get_cert_used_conn(remote))
1506 tlv->client |= PP2_CLIENT_CERT_CONN;
David Safb76832014-05-08 23:42:08 -04001507 }
1508 if (srv->pp_opts & SRV_PP_V2_SSL_CN) {
Willy Tarreau83061a82018-07-13 11:56:34 +02001509 struct buffer *cn_trash = get_trash_chunk();
Willy Tarreau3b9a0c92014-07-19 06:37:33 +02001510 if (ssl_sock_get_remote_common_name(remote, cn_trash) > 0) {
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001511 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_CN,
1512 cn_trash->data,
1513 cn_trash->area);
David Safb76832014-05-08 23:42:08 -04001514 }
1515 }
Emmanuel Hocdetfa8d0f12018-02-01 15:53:52 +01001516 if (srv->pp_opts & SRV_PP_V2_SSL_KEY_ALG) {
Willy Tarreau83061a82018-07-13 11:56:34 +02001517 struct buffer *pkey_trash = get_trash_chunk();
Emmanuel Hocdetfa8d0f12018-02-01 15:53:52 +01001518 if (ssl_sock_get_pkey_algo(remote, pkey_trash) > 0) {
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001519 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_KEY_ALG,
1520 pkey_trash->data,
1521 pkey_trash->area);
Emmanuel Hocdetfa8d0f12018-02-01 15:53:52 +01001522 }
1523 }
1524 if (srv->pp_opts & SRV_PP_V2_SSL_SIG_ALG) {
1525 value = ssl_sock_get_cert_sig(remote);
1526 if (value) {
1527 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_SIG_ALG, strlen(value), value);
1528 }
1529 }
1530 if (srv->pp_opts & SRV_PP_V2_SSL_CIPHER) {
1531 value = ssl_sock_get_cipher_name(remote);
1532 if (value) {
1533 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_CIPHER, strlen(value), value);
1534 }
1535 }
David Safb76832014-05-08 23:42:08 -04001536 }
1537 tlv->tlv.length_hi = (uint16_t)(ssl_tlv_len - sizeof(struct tlv)) >> 8;
1538 tlv->tlv.length_lo = (uint16_t)(ssl_tlv_len - sizeof(struct tlv)) & 0x00ff;
1539 ret += ssl_tlv_len;
1540 }
1541#endif
1542
Willy Tarreaue5733232019-05-22 19:24:06 +02001543#ifdef USE_NS
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001544 if (remote && (remote->proxy_netns)) {
1545 if ((buf_len - ret) < sizeof(struct tlv))
1546 return 0;
Emmanuel Hocdet571c7ac2017-10-31 18:24:05 +01001547 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_NETNS, remote->proxy_netns->name_len, remote->proxy_netns->node.key);
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001548 }
1549#endif
1550
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001551 hdr->len = htons((uint16_t)(ret - PP2_HEADER_LEN));
David Safb76832014-05-08 23:42:08 -04001552
Emmanuel Hocdet4399c752018-02-05 15:26:43 +01001553 if (tlv_crc32c_p) {
1554 write_u32(tlv_crc32c_p, htonl(hash_crc32c(buf, ret)));
1555 }
1556
David Safb76832014-05-08 23:42:08 -04001557 return ret;
1558}
Emeric Brun4f603012017-01-05 15:11:44 +01001559
Willy Tarreau119e50e2020-05-22 13:53:29 +02001560/* returns 0 on success */
1561static int cfg_parse_pp2_never_send_local(char **args, int section_type, struct proxy *curpx,
1562 struct proxy *defpx, const char *file, int line,
1563 char **err)
1564{
1565 if (too_many_args(0, args, err, NULL))
1566 return -1;
1567 pp2_never_send_local = 1;
1568 return 0;
1569}
1570
Willy Tarreau60ca10a2017-08-18 15:26:54 +02001571/* return the major HTTP version as 1 or 2 depending on how the request arrived
1572 * before being processed.
1573 */
1574static int
1575smp_fetch_fc_http_major(const struct arg *args, struct sample *smp, const char *kw, void *private)
1576{
Jérôme Magnin86577422018-12-07 09:03:11 +01001577 struct connection *conn = (kw[0] != 'b') ? objt_conn(smp->sess->origin) :
1578 smp->strm ? cs_conn(objt_cs(smp->strm->si[1].end)) : NULL;
Willy Tarreau60ca10a2017-08-18 15:26:54 +02001579
1580 smp->data.type = SMP_T_SINT;
1581 smp->data.u.sint = (conn && strcmp(conn_get_mux_name(conn), "H2") == 0) ? 2 : 1;
1582 return 1;
1583}
1584
Emeric Brun4f603012017-01-05 15:11:44 +01001585/* fetch if the received connection used a PROXY protocol header */
1586int smp_fetch_fc_rcvd_proxy(const struct arg *args, struct sample *smp, const char *kw, void *private)
1587{
1588 struct connection *conn;
1589
1590 conn = objt_conn(smp->sess->origin);
1591 if (!conn)
1592 return 0;
1593
Willy Tarreau911db9b2020-01-23 16:27:54 +01001594 if (conn->flags & CO_FL_WAIT_XPRT) {
Emeric Brun4f603012017-01-05 15:11:44 +01001595 smp->flags |= SMP_F_MAY_CHANGE;
1596 return 0;
1597 }
1598
1599 smp->flags = 0;
1600 smp->data.type = SMP_T_BOOL;
1601 smp->data.u.sint = (conn->flags & CO_FL_RCVD_PROXY) ? 1 : 0;
1602
1603 return 1;
1604}
1605
Geoff Simmons7185b782019-08-27 18:31:16 +02001606/* fetch the authority TLV from a PROXY protocol header */
1607int smp_fetch_fc_pp_authority(const struct arg *args, struct sample *smp, const char *kw, void *private)
1608{
1609 struct connection *conn;
1610
1611 conn = objt_conn(smp->sess->origin);
1612 if (!conn)
1613 return 0;
1614
Willy Tarreau911db9b2020-01-23 16:27:54 +01001615 if (conn->flags & CO_FL_WAIT_XPRT) {
Geoff Simmons7185b782019-08-27 18:31:16 +02001616 smp->flags |= SMP_F_MAY_CHANGE;
1617 return 0;
1618 }
1619
1620 if (conn->proxy_authority == NULL)
1621 return 0;
1622
1623 smp->flags = 0;
1624 smp->data.type = SMP_T_STR;
1625 smp->data.u.str.area = conn->proxy_authority;
1626 smp->data.u.str.data = conn->proxy_authority_len;
1627
1628 return 1;
1629}
1630
Tim Duesterhusd1b15b62020-03-13 12:34:23 +01001631/* fetch the unique ID TLV from a PROXY protocol header */
1632int smp_fetch_fc_pp_unique_id(const struct arg *args, struct sample *smp, const char *kw, void *private)
1633{
1634 struct connection *conn;
1635
1636 conn = objt_conn(smp->sess->origin);
1637 if (!conn)
1638 return 0;
1639
1640 if (conn->flags & CO_FL_WAIT_XPRT) {
1641 smp->flags |= SMP_F_MAY_CHANGE;
1642 return 0;
1643 }
1644
1645 if (!isttest(conn->proxy_unique_id))
1646 return 0;
1647
1648 smp->flags = 0;
1649 smp->data.type = SMP_T_STR;
1650 smp->data.u.str.area = conn->proxy_unique_id.ptr;
1651 smp->data.u.str.data = conn->proxy_unique_id.len;
1652
1653 return 1;
1654}
1655
Emeric Brun4f603012017-01-05 15:11:44 +01001656/* Note: must not be declared <const> as its list will be overwritten.
1657 * Note: fetches that may return multiple types must be declared as the lowest
1658 * common denominator, the type that can be casted into all other ones. For
1659 * instance v4/v6 must be declared v4.
1660 */
1661static struct sample_fetch_kw_list sample_fetch_keywords = {ILH, {
Willy Tarreau60ca10a2017-08-18 15:26:54 +02001662 { "fc_http_major", smp_fetch_fc_http_major, 0, NULL, SMP_T_SINT, SMP_USE_L4CLI },
Jérôme Magnin86577422018-12-07 09:03:11 +01001663 { "bc_http_major", smp_fetch_fc_http_major, 0, NULL, SMP_T_SINT, SMP_USE_L4SRV },
Emeric Brun4f603012017-01-05 15:11:44 +01001664 { "fc_rcvd_proxy", smp_fetch_fc_rcvd_proxy, 0, NULL, SMP_T_BOOL, SMP_USE_L4CLI },
Geoff Simmons7185b782019-08-27 18:31:16 +02001665 { "fc_pp_authority", smp_fetch_fc_pp_authority, 0, NULL, SMP_T_STR, SMP_USE_L4CLI },
Tim Duesterhusd1b15b62020-03-13 12:34:23 +01001666 { "fc_pp_unique_id", smp_fetch_fc_pp_unique_id, 0, NULL, SMP_T_STR, SMP_USE_L4CLI },
Emeric Brun4f603012017-01-05 15:11:44 +01001667 { /* END */ },
1668}};
1669
Willy Tarreau0108d902018-11-25 19:14:37 +01001670INITCALL1(STG_REGISTER, sample_register_fetches, &sample_fetch_keywords);
Willy Tarreau119e50e2020-05-22 13:53:29 +02001671
1672static struct cfg_kw_list cfg_kws = {ILH, {
1673 { CFG_GLOBAL, "pp2-never-send-local", cfg_parse_pp2_never_send_local },
1674 { /* END */ },
1675}};
1676
1677INITCALL1(STG_REGISTER, cfg_register_keywords, &cfg_kws);