blob: dd1898bf925853d260d7930b1a069dca256b0c47 [file] [log] [blame]
Willy Tarreau59f98392012-07-06 14:13:49 +02001/*
2 * Connection management functions
3 *
4 * Copyright 2000-2012 Willy Tarreau <w@1wt.eu>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
Willy Tarreaue1e4a612012-10-05 00:10:55 +020013#include <errno.h>
14
Willy Tarreau930428c2021-10-06 18:27:28 +020015#include <import/ebmbtree.h>
16
Willy Tarreau4c7e4b72020-05-27 12:58:42 +020017#include <haproxy/api.h>
Willy Tarreau6be78492020-06-05 00:00:29 +020018#include <haproxy/cfgparse.h>
Willy Tarreau7ea393d2020-06-04 18:02:10 +020019#include <haproxy/connection.h>
Christopher Faulet1329f2a2021-12-16 17:32:56 +010020#include <haproxy/conn_stream.h>
Christopher Faulet8da67aa2022-03-29 17:53:09 +020021#include <haproxy/cs_utils.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020022#include <haproxy/fd.h>
Willy Tarreau762d7a52020-06-04 11:23:07 +020023#include <haproxy/frontend.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020024#include <haproxy/hash.h>
Willy Tarreauaac777f2021-10-06 18:48:28 +020025#include <haproxy/list.h>
Willy Tarreau36979d92020-06-05 17:27:29 +020026#include <haproxy/log-t.h>
Willy Tarreau7a00efb2020-06-02 17:02:59 +020027#include <haproxy/namespace.h>
Willy Tarreau6131d6a2020-06-02 16:48:09 +020028#include <haproxy/net_helper.h>
Willy Tarreaufc774542020-06-04 17:31:04 +020029#include <haproxy/proto_tcp.h>
Willy Tarreaue6ce10b2020-06-04 15:33:47 +020030#include <haproxy/sample.h>
Christopher Faulet1329f2a2021-12-16 17:32:56 +010031#include <haproxy/session.h>
Christopher Faulet1329f2a2021-12-16 17:32:56 +010032#include <haproxy/ssl_sock.h>
Willy Tarreau908908e2021-05-08 13:07:31 +020033#include <haproxy/tools.h>
Willy Tarreaue5983ff2021-10-06 17:14:49 +020034#include <haproxy/xxhash.h>
Emeric Brun46591952012-05-18 15:47:34 +020035
Alexander Liu2a54bb72019-05-22 19:44:48 +080036
Amaury Denoyelle8990b012021-02-19 15:29:16 +010037DECLARE_POOL(pool_head_connection, "connection", sizeof(struct connection));
Amaury Denoyelle8990b012021-02-19 15:29:16 +010038DECLARE_POOL(pool_head_conn_hash_node, "conn_hash_node", sizeof(struct conn_hash_node));
39DECLARE_POOL(pool_head_sockaddr, "sockaddr", sizeof(struct sockaddr_storage));
40DECLARE_POOL(pool_head_authority, "authority", PP2_AUTHORITY_MAX);
Willy Tarreau8ceae722018-11-26 11:58:30 +010041
Willy Tarreau4d82bf52020-06-28 00:19:17 +020042struct idle_conns idle_conns[MAX_THREADS] = { };
Willy Tarreau13e14102016-12-22 20:25:26 +010043struct xprt_ops *registered_xprt[XPRT_ENTRIES] = { NULL, };
Willy Tarreauf2943dc2012-10-26 20:10:28 +020044
Christopher Faulet32f61c02018-04-10 14:33:41 +020045/* List head of all known muxes for PROTO */
46struct mux_proto_list mux_proto_list = {
47 .list = LIST_HEAD_INIT(mux_proto_list.list)
Willy Tarreau2386be62017-09-21 19:40:52 +020048};
49
Amaury Denoyelled3a88c12021-05-03 10:47:51 +020050struct mux_stopping_data mux_stopping_data[MAX_THREADS];
51
Willy Tarreau119e50e2020-05-22 13:53:29 +020052/* disables sending of proxy-protocol-v2's LOCAL command */
53static int pp2_never_send_local;
54
Willy Tarreau930428c2021-10-06 18:27:28 +020055void conn_delete_from_tree(struct ebmb_node *node)
56{
57 ebmb_delete(node);
Willy Tarreau930428c2021-10-06 18:27:28 +020058}
59
Olivier Houchard477902b2020-01-22 18:08:48 +010060int conn_create_mux(struct connection *conn)
61{
Olivier Houchard477902b2020-01-22 18:08:48 +010062 if (conn_is_back(conn)) {
63 struct server *srv;
64 struct conn_stream *cs = conn->ctx;
Christopher Faulet14cd3162020-04-16 14:50:06 +020065 struct session *sess = conn->owner;
Olivier Houchard477902b2020-01-22 18:08:48 +010066
67 if (conn->flags & CO_FL_ERROR)
68 goto fail;
Olivier Houcharda8a415d2020-01-23 13:15:14 +010069
Christopher Faulet14cd3162020-04-16 14:50:06 +020070 if (sess && obj_type(sess->origin) == OBJ_TYPE_CHECK) {
Willy Tarreau38b4d2e2020-11-20 17:08:15 +010071 if (conn_install_mux_chk(conn, conn->ctx, sess) < 0)
Christopher Faulet14cd3162020-04-16 14:50:06 +020072 goto fail;
73 }
Amaury Denoyelleac03ef22021-10-28 16:36:11 +020074 else if (conn_install_mux_be(conn, conn->ctx, sess, NULL) < 0)
Olivier Houchard477902b2020-01-22 18:08:48 +010075 goto fail;
76 srv = objt_server(conn->target);
Christopher Faulet08016ab2020-07-01 16:10:06 +020077
78 /* If we're doing http-reuse always, and the connection is not
79 * private with available streams (an http2 connection), add it
80 * to the available list, so that others can use it right
81 * away. If the connection is private, add it in the session
82 * server list.
83 */
Christopher Faulet2883fcf2020-07-01 14:59:43 +020084 if (srv && ((srv->proxy->options & PR_O_REUSE_MASK) == PR_O_REUSE_ALWS) &&
Christopher Fauletaa278532020-06-30 14:47:46 +020085 !(conn->flags & CO_FL_PRIVATE) && conn->mux->avail_streams(conn) > 0)
Willy Tarreau430bf4a2021-03-04 09:45:32 +010086 ebmb_insert(&srv->per_thr[tid].avail_conns, &conn->hash_node->node, sizeof(conn->hash_node->hash));
Christopher Faulet08016ab2020-07-01 16:10:06 +020087 else if (conn->flags & CO_FL_PRIVATE) {
Ilya Shipitsin6b79f382020-07-23 00:32:55 +050088 /* If it fail now, the same will be done in mux->detach() callback */
Willy Tarreau38b4d2e2020-11-20 17:08:15 +010089 session_add_conn(sess, conn, conn->target);
Christopher Faulet08016ab2020-07-01 16:10:06 +020090 }
Olivier Houchard477902b2020-01-22 18:08:48 +010091 return 0;
92fail:
93 /* let the upper layer know the connection failed */
94 cs->data_cb->wake(cs);
95 return -1;
96 } else
97 return conn_complete_session(conn);
98
Willy Tarreau930428c2021-10-06 18:27:28 +020099}
100
101/* This is used at the end of the socket IOCB to possibly create the mux if it
102 * was not done yet, or wake it up if flags changed compared to old_flags or if
103 * need_wake insists on this. It returns <0 if the connection was destroyed and
104 * must not be used, >=0 otherwise.
105 */
106int conn_notify_mux(struct connection *conn, int old_flags, int forced_wake)
107{
108 int ret = 0;
109
110 /* If we don't yet have a mux, that means we were waiting for
111 * information to create one, typically from the ALPN. If we're
112 * done with the handshake, attempt to create one.
113 */
114 if (unlikely(!conn->mux) && !(conn->flags & CO_FL_WAIT_XPRT)) {
115 ret = conn_create_mux(conn);
116 if (ret < 0)
117 goto done;
118 }
119
120 /* The wake callback is normally used to notify the data layer about
121 * data layer activity (successful send/recv), connection establishment,
122 * shutdown and fatal errors. We need to consider the following
123 * situations to wake up the data layer :
124 * - change among the CO_FL_NOTIFY_DONE flags :
125 * SOCK_{RD,WR}_SH, ERROR,
126 * - absence of any of {L4,L6}_CONN and CONNECTED, indicating the
127 * end of handshake and transition to CONNECTED
128 * - raise of CONNECTED with HANDSHAKE down
129 * - end of HANDSHAKE with CONNECTED set
130 * - regular data layer activity
131 *
132 * One tricky case is the wake up on read0 or error on an idle
133 * backend connection, that can happen on a connection that is still
134 * polled while at the same moment another thread is about to perform a
135 * takeover. The solution against this is to remove the connection from
136 * the idle list if it was in it, and possibly reinsert it at the end
137 * if the connection remains valid. The cost is non-null (locked tree
138 * removal) but remains low given that this is extremely rarely called.
139 * In any case it's guaranteed by the FD's thread_mask that we're
140 * called from the same thread the connection is queued in.
141 *
142 * Note that the wake callback is allowed to release the connection and
143 * the fd (and return < 0 in this case).
144 */
145 if ((forced_wake ||
146 ((conn->flags ^ old_flags) & CO_FL_NOTIFY_DONE) ||
147 ((old_flags & CO_FL_WAIT_XPRT) && !(conn->flags & CO_FL_WAIT_XPRT))) &&
148 conn->mux && conn->mux->wake) {
149 uint conn_in_list = conn->flags & CO_FL_LIST_MASK;
150 struct server *srv = objt_server(conn->target);
151
152 if (conn_in_list) {
153 HA_SPIN_LOCK(IDLE_CONNS_LOCK, &idle_conns[tid].idle_conns_lock);
154 conn_delete_from_tree(&conn->hash_node->node);
155 HA_SPIN_UNLOCK(IDLE_CONNS_LOCK, &idle_conns[tid].idle_conns_lock);
156 }
157
158 ret = conn->mux->wake(conn);
159 if (ret < 0)
160 goto done;
161
162 if (conn_in_list) {
163 struct eb_root *root = (conn_in_list == CO_FL_SAFE_LIST) ?
164 &srv->per_thr[tid].safe_conns :
165 &srv->per_thr[tid].idle_conns;
166
167 HA_SPIN_LOCK(IDLE_CONNS_LOCK, &idle_conns[tid].idle_conns_lock);
168 ebmb_insert(root, &conn->hash_node->node, sizeof(conn->hash_node->hash));
169 HA_SPIN_UNLOCK(IDLE_CONNS_LOCK, &idle_conns[tid].idle_conns_lock);
170 }
171 }
172 done:
173 return ret;
Olivier Houchard477902b2020-01-22 18:08:48 +0100174}
175
Willy Tarreauaac777f2021-10-06 18:48:28 +0200176/* Change the mux for the connection.
177 * The caller should make sure he's not subscribed to the underlying XPRT.
178 */
179int conn_upgrade_mux_fe(struct connection *conn, void *ctx, struct buffer *buf,
180 struct ist mux_proto, int mode)
181{
182 struct bind_conf *bind_conf = __objt_listener(conn->target)->bind_conf;
183 const struct mux_ops *old_mux, *new_mux;
184 void *old_mux_ctx;
185 const char *alpn_str = NULL;
186 int alpn_len = 0;
187
188 if (!mux_proto.len) {
189 conn_get_alpn(conn, &alpn_str, &alpn_len);
190 mux_proto = ist2(alpn_str, alpn_len);
191 }
192 new_mux = conn_get_best_mux(conn, mux_proto, PROTO_SIDE_FE, mode);
193 old_mux = conn->mux;
194
195 /* No mux found */
196 if (!new_mux)
197 return -1;
198
199 /* Same mux, nothing to do */
200 if (old_mux == new_mux)
201 return 0;
202
203 old_mux_ctx = conn->ctx;
204 conn->mux = new_mux;
205 conn->ctx = ctx;
206 if (new_mux->init(conn, bind_conf->frontend, conn->owner, buf) == -1) {
207 /* The mux upgrade failed, so restore the old mux */
208 conn->ctx = old_mux_ctx;
209 conn->mux = old_mux;
210 return -1;
211 }
212
213 /* The mux was upgraded, destroy the old one */
214 *buf = BUF_NULL;
215 old_mux->destroy(old_mux_ctx);
216 return 0;
217}
218
219/* installs the best mux for incoming connection <conn> using the upper context
220 * <ctx>. If the mux protocol is forced, we use it to find the best
221 * mux. Otherwise we use the ALPN name, if any. Returns < 0 on error.
222 */
223int conn_install_mux_fe(struct connection *conn, void *ctx)
224{
225 struct bind_conf *bind_conf = __objt_listener(conn->target)->bind_conf;
226 const struct mux_ops *mux_ops;
227
228 if (bind_conf->mux_proto)
229 mux_ops = bind_conf->mux_proto->mux;
230 else {
231 struct ist mux_proto;
232 const char *alpn_str = NULL;
233 int alpn_len = 0;
234 int mode;
235
236 if (bind_conf->frontend->mode == PR_MODE_HTTP)
237 mode = PROTO_MODE_HTTP;
238 else
239 mode = PROTO_MODE_TCP;
240
241 conn_get_alpn(conn, &alpn_str, &alpn_len);
242 mux_proto = ist2(alpn_str, alpn_len);
243 mux_ops = conn_get_best_mux(conn, mux_proto, PROTO_SIDE_FE, mode);
244 if (!mux_ops)
245 return -1;
246 }
247 return conn_install_mux(conn, mux_ops, ctx, bind_conf->frontend, conn->owner);
248}
249
250/* installs the best mux for outgoing connection <conn> using the upper context
Amaury Denoyelleac03ef22021-10-28 16:36:11 +0200251 * <ctx>. If the server mux protocol is forced, we use it to find the best mux.
252 * It's also possible to specify an alternative mux protocol <force_mux_ops>,
253 * in which case it will be used instead of the default server mux protocol.
254 *
255 * Returns < 0 on error.
Willy Tarreauaac777f2021-10-06 18:48:28 +0200256 */
Amaury Denoyelleac03ef22021-10-28 16:36:11 +0200257int conn_install_mux_be(struct connection *conn, void *ctx, struct session *sess,
258 const struct mux_ops *force_mux_ops)
Willy Tarreauaac777f2021-10-06 18:48:28 +0200259{
260 struct server *srv = objt_server(conn->target);
261 struct proxy *prx = objt_proxy(conn->target);
262 const struct mux_ops *mux_ops;
263
264 if (srv)
265 prx = srv->proxy;
266
267 if (!prx) // target must be either proxy or server
268 return -1;
269
Amaury Denoyelleac03ef22021-10-28 16:36:11 +0200270 if (srv && srv->mux_proto && likely(!force_mux_ops)) {
Willy Tarreauaac777f2021-10-06 18:48:28 +0200271 mux_ops = srv->mux_proto->mux;
Amaury Denoyelleac03ef22021-10-28 16:36:11 +0200272 }
273 else if (srv && unlikely(force_mux_ops)) {
274 mux_ops = force_mux_ops;
275 }
Willy Tarreauaac777f2021-10-06 18:48:28 +0200276 else {
277 struct ist mux_proto;
278 const char *alpn_str = NULL;
279 int alpn_len = 0;
280 int mode;
281
282 if (prx->mode == PR_MODE_HTTP)
283 mode = PROTO_MODE_HTTP;
284 else
285 mode = PROTO_MODE_TCP;
286
287 conn_get_alpn(conn, &alpn_str, &alpn_len);
288 mux_proto = ist2(alpn_str, alpn_len);
289
290 mux_ops = conn_get_best_mux(conn, mux_proto, PROTO_SIDE_BE, mode);
291 if (!mux_ops)
292 return -1;
293 }
294 return conn_install_mux(conn, mux_ops, ctx, prx, sess);
295}
296
297/* installs the best mux for outgoing connection <conn> for a check using the
298 * upper context <ctx>. If the mux protocol is forced by the check, we use it to
299 * find the best mux. Returns < 0 on error.
300 */
301int conn_install_mux_chk(struct connection *conn, void *ctx, struct session *sess)
302{
303 struct check *check = objt_check(sess->origin);
304 struct server *srv = objt_server(conn->target);
305 struct proxy *prx = objt_proxy(conn->target);
306 const struct mux_ops *mux_ops;
307
308 if (!check) // Check must be defined
309 return -1;
310
311 if (srv)
312 prx = srv->proxy;
313
314 if (!prx) // target must be either proxy or server
315 return -1;
316
317 if (check->mux_proto)
318 mux_ops = check->mux_proto->mux;
319 else {
320 struct ist mux_proto;
321 const char *alpn_str = NULL;
322 int alpn_len = 0;
323 int mode;
324
325 if ((check->tcpcheck_rules->flags & TCPCHK_RULES_PROTO_CHK) == TCPCHK_RULES_HTTP_CHK)
326 mode = PROTO_MODE_HTTP;
327 else
328 mode = PROTO_MODE_TCP;
329
330 conn_get_alpn(conn, &alpn_str, &alpn_len);
331 mux_proto = ist2(alpn_str, alpn_len);
332
333 mux_ops = conn_get_best_mux(conn, mux_proto, PROTO_SIDE_BE, mode);
334 if (!mux_ops)
335 return -1;
336 }
337 return conn_install_mux(conn, mux_ops, ctx, prx, sess);
338}
339
Amaury Denoyelle2454bda2021-10-18 14:32:36 +0200340/* Set the ALPN of connection <conn> to <alpn>. If force is false, <alpn> must
341 * be a subset or identical to the registered protos for the parent SSL_CTX.
342 * In this case <alpn> must be a single protocol value, not a list.
343 *
344 * Returns 0 if ALPN is updated else -1.
345 */
346int conn_update_alpn(struct connection *conn, const struct ist alpn, int force)
347{
348#ifdef TLSEXT_TYPE_application_layer_protocol_negotiation
349 size_t alpn_len = istlen(alpn);
350 char *ctx_alpn_str = NULL;
351 int ctx_alpn_len = 0, found = 0;
352
353 /* if not force, first search if alpn is a subset or identical to the
354 * parent SSL_CTX.
355 */
356 if (!force) {
357 /* retrieve the SSL_CTX according to the connection side. */
358 if (conn_is_back(conn)) {
359 if (obj_type(conn->target) == OBJ_TYPE_SERVER) {
360 struct server *srv = __objt_server(conn->target);
361 ctx_alpn_str = srv->ssl_ctx.alpn_str;
362 ctx_alpn_len = srv->ssl_ctx.alpn_len;
363 }
364 }
365 else {
366 struct session *sess = conn->owner;
367 struct listener *li = sess->listener;
368
Willy Tarreau11ba4042022-05-20 15:56:32 +0200369 if (li->bind_conf && li->bind_conf->options & BC_O_USE_SSL) {
Amaury Denoyelle2454bda2021-10-18 14:32:36 +0200370 ctx_alpn_str = li->bind_conf->ssl_conf.alpn_str;
371 ctx_alpn_len = li->bind_conf->ssl_conf.alpn_len;
372 }
373 }
374
375 if (ctx_alpn_str) {
376 /* search if ALPN is present in SSL_CTX ALPN before
377 * using it.
378 */
379 while (ctx_alpn_len) {
380 /* skip ALPN whose size is not 8 */
381 if (*ctx_alpn_str != alpn_len - 1) {
382 ctx_alpn_len -= *ctx_alpn_str + 1;
383 }
384 else {
385 if (isteqi(ist2(ctx_alpn_str, alpn_len), alpn)) {
386 found = 1;
387 break;
388 }
389 }
390 ctx_alpn_str += *ctx_alpn_str + 1;
391
392 /* This indicates an invalid ALPN formatted
393 * string and should never happen. */
394 BUG_ON(ctx_alpn_len < 0);
395 }
396 }
397 }
398
399 if (found || force) {
400 ssl_sock_set_alpn(conn, (const uchar *)istptr(alpn), istlen(alpn));
401 return 0;
402 }
403
404#endif
405 return -1;
406}
407
Willy Tarreauaac777f2021-10-06 18:48:28 +0200408/* Initializes all required fields for a new connection. Note that it does the
409 * minimum acceptable initialization for a connection that already exists and
410 * is about to be reused. It also leaves the addresses untouched, which makes
411 * it usable across connection retries to reset a connection to a known state.
412 */
413void conn_init(struct connection *conn, void *target)
414{
415 conn->obj_type = OBJ_TYPE_CONN;
416 conn->flags = CO_FL_NONE;
417 conn->mux = NULL;
418 conn->ctx = NULL;
419 conn->owner = NULL;
420 conn->send_proxy_ofs = 0;
421 conn->handle.fd = DEAD_FD_MAGIC;
422 conn->err_code = CO_ER_NONE;
423 conn->target = target;
424 conn->destroy_cb = NULL;
425 conn->proxy_netns = NULL;
426 MT_LIST_INIT(&conn->toremove_list);
427 if (conn_is_back(conn))
428 LIST_INIT(&conn->session_list);
429 else
430 LIST_INIT(&conn->stopping_list);
431 conn->subs = NULL;
432 conn->src = NULL;
433 conn->dst = NULL;
434 conn->proxy_authority = IST_NULL;
435 conn->proxy_unique_id = IST_NULL;
Willy Tarreauaac777f2021-10-06 18:48:28 +0200436 conn->hash_node = NULL;
437 conn->xprt = NULL;
438}
439
440/* Tries to allocate a new connection and initialized its main fields. The
441 * connection is returned on success, NULL on failure. The connection must
442 * be released using pool_free() or conn_free().
443 */
444struct connection *conn_new(void *target)
445{
446 struct connection *conn;
447 struct conn_hash_node *hash_node;
448
449 conn = pool_alloc(pool_head_connection);
450 if (unlikely(!conn))
451 return NULL;
452
453 conn_init(conn, target);
454
455 if (conn_is_back(conn)) {
456 if (obj_type(target) == OBJ_TYPE_SERVER)
457 srv_use_conn(__objt_server(target), conn);
458
459 hash_node = conn_alloc_hash_node(conn);
460 if (unlikely(!hash_node)) {
461 pool_free(pool_head_connection, conn);
462 return NULL;
463 }
464
465 conn->hash_node = hash_node;
466 }
467
468 return conn;
469}
470
471/* Releases a connection previously allocated by conn_new() */
472void conn_free(struct connection *conn)
473{
474 /* If the connection is owned by the session, remove it from its list
475 */
476 if (conn_is_back(conn) && LIST_INLIST(&conn->session_list)) {
477 session_unown_conn(conn->owner, conn);
478 }
479 else if (!(conn->flags & CO_FL_PRIVATE)) {
480 if (obj_type(conn->target) == OBJ_TYPE_SERVER)
481 srv_release_conn(__objt_server(conn->target), conn);
482 }
483
484 /* Remove the conn from toremove_list.
485 *
486 * This is needed to prevent a double-free in case the connection was
487 * already scheduled from cleaning but is freed before via another
488 * call.
489 */
490 MT_LIST_DELETE(&conn->toremove_list);
491
492 sockaddr_free(&conn->src);
493 sockaddr_free(&conn->dst);
494
495 pool_free(pool_head_authority, istptr(conn->proxy_authority));
496 conn->proxy_authority = IST_NULL;
497
498 pool_free(pool_head_uniqueid, istptr(conn->proxy_unique_id));
499 conn->proxy_unique_id = IST_NULL;
500
501 pool_free(pool_head_conn_hash_node, conn->hash_node);
502 conn->hash_node = NULL;
503
Willy Tarreauaac777f2021-10-06 18:48:28 +0200504 conn_force_unsubscribe(conn);
505 pool_free(pool_head_connection, conn);
506}
507
Willy Tarreau8de90c72021-10-06 19:11:10 +0200508struct conn_hash_node *conn_alloc_hash_node(struct connection *conn)
509{
510 struct conn_hash_node *hash_node = NULL;
511
512 hash_node = pool_zalloc(pool_head_conn_hash_node);
513 if (unlikely(!hash_node))
514 return NULL;
515
516 hash_node->conn = conn;
517
518 return hash_node;
519}
520
521/* Allocates a struct sockaddr from the pool if needed, assigns it to *sap and
522 * returns it. If <sap> is NULL, the address is always allocated and returned.
523 * if <sap> is non-null, an address will only be allocated if it points to a
524 * non-null pointer. In this case the allocated address will be assigned there.
525 * If <orig> is non-null and <len> positive, the address in <sa> will be copied
526 * into the allocated address. In both situations the new pointer is returned.
527 */
528struct sockaddr_storage *sockaddr_alloc(struct sockaddr_storage **sap, const struct sockaddr_storage *orig, socklen_t len)
529{
530 struct sockaddr_storage *sa;
531
532 if (sap && *sap)
533 return *sap;
534
535 sa = pool_alloc(pool_head_sockaddr);
536 if (sa && orig && len > 0)
537 memcpy(sa, orig, len);
538 if (sap)
539 *sap = sa;
540 return sa;
541}
542
543/* Releases the struct sockaddr potentially pointed to by <sap> to the pool. It
544 * may be NULL or may point to NULL. If <sap> is not NULL, a NULL is placed
545 * there.
546 */
547void sockaddr_free(struct sockaddr_storage **sap)
548{
549 if (!sap)
550 return;
551 pool_free(pool_head_sockaddr, *sap);
552 *sap = NULL;
553}
554
Willy Tarreauaac777f2021-10-06 18:48:28 +0200555/* Try to add a handshake pseudo-XPRT. If the connection's first XPRT is
556 * raw_sock, then just use the new XPRT as the connection XPRT, otherwise
557 * call the xprt's add_xprt() method.
558 * Returns 0 on success, or non-zero on failure.
559 */
560int xprt_add_hs(struct connection *conn)
561{
562 void *xprt_ctx = NULL;
563 const struct xprt_ops *ops = xprt_get(XPRT_HANDSHAKE);
564 void *nextxprt_ctx = NULL;
565 const struct xprt_ops *nextxprt_ops = NULL;
566
567 if (conn->flags & CO_FL_ERROR)
568 return -1;
569 if (ops->init(conn, &xprt_ctx) < 0)
570 return -1;
571 if (conn->xprt == xprt_get(XPRT_RAW)) {
572 nextxprt_ctx = conn->xprt_ctx;
573 nextxprt_ops = conn->xprt;
574 conn->xprt_ctx = xprt_ctx;
575 conn->xprt = ops;
576 } else {
577 if (conn->xprt->add_xprt(conn, conn->xprt_ctx, xprt_ctx, ops,
578 &nextxprt_ctx, &nextxprt_ops) != 0) {
579 ops->close(conn, xprt_ctx);
580 return -1;
581 }
582 }
583 if (ops->add_xprt(conn, xprt_ctx, nextxprt_ctx, nextxprt_ops, NULL, NULL) != 0) {
584 ops->close(conn, xprt_ctx);
585 return -1;
586 }
587 return 0;
588}
589
590/* returns a human-readable error code for conn->err_code, or NULL if the code
591 * is unknown.
592 */
593const char *conn_err_code_str(struct connection *c)
594{
595 switch (c->err_code) {
596 case CO_ER_NONE: return "Success";
597
598 case CO_ER_CONF_FDLIM: return "Reached configured maxconn value";
599 case CO_ER_PROC_FDLIM: return "Too many sockets on the process";
600 case CO_ER_SYS_FDLIM: return "Too many sockets on the system";
601 case CO_ER_SYS_MEMLIM: return "Out of system buffers";
602 case CO_ER_NOPROTO: return "Protocol or address family not supported";
603 case CO_ER_SOCK_ERR: return "General socket error";
604 case CO_ER_PORT_RANGE: return "Source port range exhausted";
605 case CO_ER_CANT_BIND: return "Can't bind to source address";
606 case CO_ER_FREE_PORTS: return "Out of local source ports on the system";
607 case CO_ER_ADDR_INUSE: return "Local source address already in use";
608
609 case CO_ER_PRX_EMPTY: return "Connection closed while waiting for PROXY protocol header";
610 case CO_ER_PRX_ABORT: return "Connection error while waiting for PROXY protocol header";
611 case CO_ER_PRX_TIMEOUT: return "Timeout while waiting for PROXY protocol header";
612 case CO_ER_PRX_TRUNCATED: return "Truncated PROXY protocol header received";
613 case CO_ER_PRX_NOT_HDR: return "Received something which does not look like a PROXY protocol header";
614 case CO_ER_PRX_BAD_HDR: return "Received an invalid PROXY protocol header";
615 case CO_ER_PRX_BAD_PROTO: return "Received an unhandled protocol in the PROXY protocol header";
616
617 case CO_ER_CIP_EMPTY: return "Connection closed while waiting for NetScaler Client IP header";
618 case CO_ER_CIP_ABORT: return "Connection error while waiting for NetScaler Client IP header";
619 case CO_ER_CIP_TIMEOUT: return "Timeout while waiting for a NetScaler Client IP header";
620 case CO_ER_CIP_TRUNCATED: return "Truncated NetScaler Client IP header received";
621 case CO_ER_CIP_BAD_MAGIC: return "Received an invalid NetScaler Client IP magic number";
622 case CO_ER_CIP_BAD_PROTO: return "Received an unhandled protocol in the NetScaler Client IP header";
623
624 case CO_ER_SSL_EMPTY: return "Connection closed during SSL handshake";
625 case CO_ER_SSL_ABORT: return "Connection error during SSL handshake";
626 case CO_ER_SSL_TIMEOUT: return "Timeout during SSL handshake";
627 case CO_ER_SSL_TOO_MANY: return "Too many SSL connections";
628 case CO_ER_SSL_NO_MEM: return "Out of memory when initializing an SSL connection";
629 case CO_ER_SSL_RENEG: return "Rejected a client-initiated SSL renegotiation attempt";
630 case CO_ER_SSL_CA_FAIL: return "SSL client CA chain cannot be verified";
631 case CO_ER_SSL_CRT_FAIL: return "SSL client certificate not trusted";
632 case CO_ER_SSL_MISMATCH: return "Server presented an SSL certificate different from the configured one";
633 case CO_ER_SSL_MISMATCH_SNI: return "Server presented an SSL certificate different from the expected one";
634 case CO_ER_SSL_HANDSHAKE: return "SSL handshake failure";
635 case CO_ER_SSL_HANDSHAKE_HB: return "SSL handshake failure after heartbeat";
636 case CO_ER_SSL_KILLED_HB: return "Stopped a TLSv1 heartbeat attack (CVE-2014-0160)";
637 case CO_ER_SSL_NO_TARGET: return "Attempt to use SSL on an unknown target (internal error)";
638 case CO_ER_SSL_EARLY_FAILED: return "Server refused early data";
639
640 case CO_ER_SOCKS4_SEND: return "SOCKS4 Proxy write error during handshake";
641 case CO_ER_SOCKS4_RECV: return "SOCKS4 Proxy read error during handshake";
642 case CO_ER_SOCKS4_DENY: return "SOCKS4 Proxy deny the request";
643 case CO_ER_SOCKS4_ABORT: return "SOCKS4 Proxy handshake aborted by server";
644
645 case CO_ERR_SSL_FATAL: return "SSL fatal error";
646 }
647 return NULL;
648}
649
Willy Tarreauff3e6482015-03-12 23:56:52 +0100650/* Send a message over an established connection. It makes use of send() and
651 * returns the same return code and errno. If the socket layer is not ready yet
652 * then -1 is returned and ENOTSOCK is set into errno. If the fd is not marked
653 * as ready, or if EAGAIN or ENOTCONN is returned, then we return 0. It returns
654 * EMSGSIZE if called with a zero length message. The purpose is to simplify
655 * some rare attempts to directly write on the socket from above the connection
656 * (typically send_proxy). In case of EAGAIN, the fd is marked as "cant_send".
657 * It automatically retries on EINTR. Other errors cause the connection to be
658 * marked as in error state. It takes similar arguments as send() except the
Willy Tarreau827fee72020-12-11 15:26:55 +0100659 * first one which is the connection instead of the file descriptor. <flags>
660 * only support CO_SFL_MSG_MORE.
Willy Tarreauff3e6482015-03-12 23:56:52 +0100661 */
Willy Tarreau827fee72020-12-11 15:26:55 +0100662int conn_ctrl_send(struct connection *conn, const void *buf, int len, int flags)
Willy Tarreauff3e6482015-03-12 23:56:52 +0100663{
Willy Tarreau827fee72020-12-11 15:26:55 +0100664 const struct buffer buffer = b_make((char*)buf, len, 0, len);
665 const struct xprt_ops *xprt = xprt_get(XPRT_RAW);
Willy Tarreauff3e6482015-03-12 23:56:52 +0100666 int ret;
667
668 ret = -1;
669 errno = ENOTSOCK;
670
671 if (conn->flags & CO_FL_SOCK_WR_SH)
672 goto fail;
673
674 if (!conn_ctrl_ready(conn))
675 goto fail;
676
677 errno = EMSGSIZE;
678 if (!len)
679 goto fail;
680
Willy Tarreau827fee72020-12-11 15:26:55 +0100681 /* snd_buf() already takes care of updating conn->flags and handling
682 * the FD polling status.
683 */
684 ret = xprt->snd_buf(conn, NULL, &buffer, buffer.data, flags);
685 if (conn->flags & CO_FL_ERROR)
686 ret = -1;
687 return ret;
Willy Tarreauff3e6482015-03-12 23:56:52 +0100688 fail:
689 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH | CO_FL_ERROR;
690 return ret;
691}
692
Willy Tarreau746b0512020-12-11 17:06:11 +0100693/* Called from the upper layer, to unsubscribe <es> from events <event_type>.
694 * The event subscriber <es> is not allowed to change from a previous call as
695 * long as at least one event is still subscribed. The <event_type> must only
696 * be a combination of SUB_RETRY_RECV and SUB_RETRY_SEND. It always returns 0.
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100697 */
698int conn_unsubscribe(struct connection *conn, void *xprt_ctx, int event_type, struct wait_event *es)
Olivier Houchard83a0cd82018-09-28 17:57:58 +0200699{
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100700 BUG_ON(event_type & ~(SUB_RETRY_SEND|SUB_RETRY_RECV));
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100701 BUG_ON(conn->subs && conn->subs != es);
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100702
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100703 es->events &= ~event_type;
704 if (!es->events)
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100705 conn->subs = NULL;
706
Willy Tarreau746b0512020-12-11 17:06:11 +0100707 if (conn_ctrl_ready(conn) && conn->ctrl->ignore_events)
708 conn->ctrl->ignore_events(conn, event_type);
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100709
Olivier Houchard83a0cd82018-09-28 17:57:58 +0200710 return 0;
711}
712
Willy Tarreau7e59c0a2020-02-28 14:24:49 +0100713/* Called from the upper layer, to subscribe <es> to events <event_type>.
714 * The <es> struct is not allowed to differ from the one passed during a
Willy Tarreau746b0512020-12-11 17:06:11 +0100715 * previous call to subscribe(). If the connection's ctrl layer is ready,
716 * the wait_event is immediately woken up and the subcription is cancelled.
717 * It always returns zero.
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100718 */
719int conn_subscribe(struct connection *conn, void *xprt_ctx, int event_type, struct wait_event *es)
Olivier Houchard6ff20392018-07-17 18:46:31 +0200720{
Willy Tarreau746b0512020-12-11 17:06:11 +0100721 int ret = 0;
722
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100723 BUG_ON(event_type & ~(SUB_RETRY_SEND|SUB_RETRY_RECV));
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100724 BUG_ON(conn->subs && conn->subs != es);
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100725
Willy Tarreau7e59c0a2020-02-28 14:24:49 +0100726 if (conn->subs && (conn->subs->events & event_type) == event_type)
727 return 0;
728
Willy Tarreau746b0512020-12-11 17:06:11 +0100729 if (conn_ctrl_ready(conn) && conn->ctrl->check_events) {
730 ret = conn->ctrl->check_events(conn, event_type);
731 if (ret)
732 tasklet_wakeup(es->tasklet);
Willy Tarreaud1d14c32020-02-21 10:34:19 +0100733 }
Willy Tarreau746b0512020-12-11 17:06:11 +0100734
735 es->events = (es->events | event_type) & ~ret;
736 conn->subs = es->events ? es : NULL;
Olivier Houchard83a0cd82018-09-28 17:57:58 +0200737 return 0;
Olivier Houchard6ff20392018-07-17 18:46:31 +0200738}
739
Willy Tarreau2ded48d2020-12-11 16:20:34 +0100740/* Drains possibly pending incoming data on the connection and update the flags
741 * accordingly. This is used to know whether we need to disable lingering on
742 * close. Returns non-zero if it is safe to close without disabling lingering,
743 * otherwise zero. The CO_FL_SOCK_RD_SH flag may also be updated if the incoming
744 * shutdown was reported by the ->drain() function.
Willy Tarreaud85c4852015-03-13 00:40:28 +0100745 */
Willy Tarreau2ded48d2020-12-11 16:20:34 +0100746int conn_ctrl_drain(struct connection *conn)
Willy Tarreaud85c4852015-03-13 00:40:28 +0100747{
Willy Tarreau2ded48d2020-12-11 16:20:34 +0100748 int ret = 0;
Willy Tarreaue215bba2018-08-24 14:31:53 +0200749
Willy Tarreau2ded48d2020-12-11 16:20:34 +0100750 if (!conn_ctrl_ready(conn) || conn->flags & (CO_FL_ERROR | CO_FL_SOCK_RD_SH))
751 ret = 1;
752 else if (conn->ctrl->drain) {
753 ret = conn->ctrl->drain(conn);
754 if (ret)
755 conn->flags |= CO_FL_SOCK_RD_SH;
Willy Tarreaud85c4852015-03-13 00:40:28 +0100756 }
Willy Tarreau2ded48d2020-12-11 16:20:34 +0100757 return ret;
Willy Tarreaud85c4852015-03-13 00:40:28 +0100758}
759
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100760/*
761 * Get data length from tlv
762 */
Tim Duesterhusba837ec2020-03-05 23:11:02 +0100763static inline size_t get_tlv_length(const struct tlv *src)
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100764{
765 return (src->length_hi << 8) | src->length_lo;
766}
767
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200768/* This handshake handler waits a PROXY protocol header at the beginning of the
769 * raw data stream. The header looks like this :
770 *
771 * "PROXY" <SP> PROTO <SP> SRC3 <SP> DST3 <SP> SRC4 <SP> <DST4> "\r\n"
772 *
773 * There must be exactly one space between each field. Fields are :
774 * - PROTO : layer 4 protocol, which must be "TCP4" or "TCP6".
775 * - SRC3 : layer 3 (eg: IP) source address in standard text form
776 * - DST3 : layer 3 (eg: IP) destination address in standard text form
777 * - SRC4 : layer 4 (eg: TCP port) source address in standard text form
778 * - DST4 : layer 4 (eg: TCP port) destination address in standard text form
779 *
780 * This line MUST be at the beginning of the buffer and MUST NOT wrap.
781 *
782 * The header line is small and in all cases smaller than the smallest normal
783 * TCP MSS. So it MUST always be delivered as one segment, which ensures we
784 * can safely use MSG_PEEK and avoid buffering.
785 *
786 * Once the data is fetched, the values are set in the connection's address
787 * fields, and data are removed from the socket's buffer. The function returns
788 * zero if it needs to wait for more data or if it fails, or 1 if it completed
789 * and removed itself.
790 */
791int conn_recv_proxy(struct connection *conn, int flag)
792{
Christopher Fauletc105c922021-10-25 08:17:11 +0200793 struct session *sess = conn->owner;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200794 char *line, *end;
Willy Tarreau77992672014-06-14 11:06:17 +0200795 struct proxy_hdr_v2 *hdr_v2;
796 const char v2sig[] = PP2_SIGNATURE;
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100797 size_t total_v2_len;
Tim Duesterhusba837ec2020-03-05 23:11:02 +0100798 size_t tlv_offset = 0;
Willy Tarreaub406b872018-08-22 05:20:32 +0200799 int ret;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200800
Willy Tarreau3c728722014-01-23 13:50:42 +0100801 if (!conn_ctrl_ready(conn))
Willy Tarreauf79c8172013-10-21 16:30:56 +0200802 goto fail;
803
Willy Tarreau07ecfc52022-04-11 18:07:03 +0200804 BUG_ON(conn->flags & CO_FL_FDLESS);
805
Willy Tarreau585744b2017-08-24 14:31:19 +0200806 if (!fd_recv_ready(conn->handle.fd))
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200807 goto not_ready;
Willy Tarreaufd803bb2014-01-20 15:13:07 +0100808
Willy Tarreau157788c2020-02-11 10:08:05 +0100809 while (1) {
Willy Tarreaub406b872018-08-22 05:20:32 +0200810 ret = recv(conn->handle.fd, trash.area, trash.size, MSG_PEEK);
811 if (ret < 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200812 if (errno == EINTR)
813 continue;
Willy Tarreauacef5e22022-04-25 20:32:15 +0200814 if (errno == EAGAIN || errno == EWOULDBLOCK) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200815 fd_cant_recv(conn->handle.fd);
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200816 goto not_ready;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200817 }
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100818 goto recv_abort;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200819 }
Willy Tarreaub406b872018-08-22 05:20:32 +0200820 trash.data = ret;
Willy Tarreau157788c2020-02-11 10:08:05 +0100821 break;
822 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200823
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200824 if (!trash.data) {
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100825 /* client shutdown */
826 conn->err_code = CO_ER_PRX_EMPTY;
827 goto fail;
828 }
829
Willy Tarreauc192b0a2020-01-23 09:11:58 +0100830 conn->flags &= ~CO_FL_WAIT_L4_CONN;
831
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200832 if (trash.data < 6)
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200833 goto missing;
834
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200835 line = trash.area;
836 end = trash.area + trash.data;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200837
838 /* Decode a possible proxy request, fail early if it does not match */
Willy Tarreau77992672014-06-14 11:06:17 +0200839 if (strncmp(line, "PROXY ", 6) != 0)
840 goto not_v1;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200841
842 line += 6;
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200843 if (trash.data < 9) /* shortest possible line */
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200844 goto missing;
845
David CARLIER42ff05e2016-03-24 09:22:36 +0000846 if (memcmp(line, "TCP4 ", 5) == 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200847 u32 src3, dst3, sport, dport;
848
849 line += 5;
850
851 src3 = inetaddr_host_lim_ret(line, end, &line);
852 if (line == end)
853 goto missing;
854 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100855 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200856
857 dst3 = inetaddr_host_lim_ret(line, end, &line);
858 if (line == end)
859 goto missing;
860 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100861 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200862
863 sport = read_uint((const char **)&line, end);
864 if (line == end)
865 goto missing;
866 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100867 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200868
869 dport = read_uint((const char **)&line, end);
870 if (line > end - 2)
871 goto missing;
872 if (*line++ != '\r')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100873 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200874 if (*line++ != '\n')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100875 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200876
Christopher Fauletc105c922021-10-25 08:17:11 +0200877 if (!sess || !sockaddr_alloc(&sess->src, NULL, 0) || !sockaddr_alloc(&sess->dst, NULL, 0))
878 goto fail;
879
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200880 /* update the session's addresses and mark them set */
Christopher Fauletc105c922021-10-25 08:17:11 +0200881 ((struct sockaddr_in *)sess->src)->sin_family = AF_INET;
882 ((struct sockaddr_in *)sess->src)->sin_addr.s_addr = htonl(src3);
883 ((struct sockaddr_in *)sess->src)->sin_port = htons(sport);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200884
Christopher Fauletc105c922021-10-25 08:17:11 +0200885 ((struct sockaddr_in *)sess->dst)->sin_family = AF_INET;
886 ((struct sockaddr_in *)sess->dst)->sin_addr.s_addr = htonl(dst3);
887 ((struct sockaddr_in *)sess->dst)->sin_port = htons(dport);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200888 }
David CARLIER42ff05e2016-03-24 09:22:36 +0000889 else if (memcmp(line, "TCP6 ", 5) == 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200890 u32 sport, dport;
891 char *src_s;
892 char *dst_s, *sport_s, *dport_s;
893 struct in6_addr src3, dst3;
894
895 line += 5;
896
897 src_s = line;
898 dst_s = sport_s = dport_s = NULL;
899 while (1) {
900 if (line > end - 2) {
901 goto missing;
902 }
903 else if (*line == '\r') {
904 *line = 0;
905 line++;
906 if (*line++ != '\n')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100907 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200908 break;
909 }
910
911 if (*line == ' ') {
912 *line = 0;
913 if (!dst_s)
914 dst_s = line + 1;
915 else if (!sport_s)
916 sport_s = line + 1;
917 else if (!dport_s)
918 dport_s = line + 1;
919 }
920 line++;
921 }
922
923 if (!dst_s || !sport_s || !dport_s)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100924 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200925
926 sport = read_uint((const char **)&sport_s,dport_s - 1);
927 if (*sport_s != 0)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100928 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200929
930 dport = read_uint((const char **)&dport_s,line - 2);
931 if (*dport_s != 0)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100932 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200933
934 if (inet_pton(AF_INET6, src_s, (void *)&src3) != 1)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100935 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200936
937 if (inet_pton(AF_INET6, dst_s, (void *)&dst3) != 1)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100938 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200939
Christopher Fauletc105c922021-10-25 08:17:11 +0200940 if (!sess || !sockaddr_alloc(&sess->src, NULL, 0) || !sockaddr_alloc(&sess->dst, NULL, 0))
941 goto fail;
942
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200943 /* update the session's addresses and mark them set */
Christopher Fauletc105c922021-10-25 08:17:11 +0200944 ((struct sockaddr_in6 *)sess->src)->sin6_family = AF_INET6;
945 memcpy(&((struct sockaddr_in6 *)sess->src)->sin6_addr, &src3, sizeof(struct in6_addr));
946 ((struct sockaddr_in6 *)sess->src)->sin6_port = htons(sport);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200947
Christopher Fauletc105c922021-10-25 08:17:11 +0200948 ((struct sockaddr_in6 *)sess->dst)->sin6_family = AF_INET6;
949 memcpy(&((struct sockaddr_in6 *)sess->dst)->sin6_addr, &dst3, sizeof(struct in6_addr));
950 ((struct sockaddr_in6 *)sess->dst)->sin6_port = htons(dport);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200951 }
Willy Tarreau4c20d292014-06-14 11:41:36 +0200952 else if (memcmp(line, "UNKNOWN\r\n", 9) == 0) {
953 /* This can be a UNIX socket forwarded by an haproxy upstream */
954 line += 9;
955 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200956 else {
Willy Tarreau4c20d292014-06-14 11:41:36 +0200957 /* The protocol does not match something known (TCP4/TCP6/UNKNOWN) */
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100958 conn->err_code = CO_ER_PRX_BAD_PROTO;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200959 goto fail;
960 }
961
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200962 trash.data = line - trash.area;
Willy Tarreau77992672014-06-14 11:06:17 +0200963 goto eat_header;
964
965 not_v1:
966 /* try PPv2 */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200967 if (trash.data < PP2_HEADER_LEN)
Willy Tarreau77992672014-06-14 11:06:17 +0200968 goto missing;
969
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200970 hdr_v2 = (struct proxy_hdr_v2 *) trash.area;
Willy Tarreau77992672014-06-14 11:06:17 +0200971
972 if (memcmp(hdr_v2->sig, v2sig, PP2_SIGNATURE_LEN) != 0 ||
973 (hdr_v2->ver_cmd & PP2_VERSION_MASK) != PP2_VERSION) {
974 conn->err_code = CO_ER_PRX_NOT_HDR;
975 goto fail;
976 }
977
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100978 total_v2_len = PP2_HEADER_LEN + ntohs(hdr_v2->len);
979 if (trash.data < total_v2_len)
Willy Tarreau77992672014-06-14 11:06:17 +0200980 goto missing;
981
982 switch (hdr_v2->ver_cmd & PP2_CMD_MASK) {
983 case 0x01: /* PROXY command */
984 switch (hdr_v2->fam) {
985 case 0x11: /* TCPv4 */
KOVACS Krisztianefd3aa92014-11-19 10:53:20 +0100986 if (ntohs(hdr_v2->len) < PP2_ADDR_LEN_INET)
987 goto bad_header;
988
Christopher Fauletc105c922021-10-25 08:17:11 +0200989 if (!sess || !sockaddr_alloc(&sess->src, NULL, 0) || !sockaddr_alloc(&sess->dst, NULL, 0))
990 goto fail;
991
992 ((struct sockaddr_in *)sess->src)->sin_family = AF_INET;
993 ((struct sockaddr_in *)sess->src)->sin_addr.s_addr = hdr_v2->addr.ip4.src_addr;
994 ((struct sockaddr_in *)sess->src)->sin_port = hdr_v2->addr.ip4.src_port;
995 ((struct sockaddr_in *)sess->dst)->sin_family = AF_INET;
996 ((struct sockaddr_in *)sess->dst)->sin_addr.s_addr = hdr_v2->addr.ip4.dst_addr;
997 ((struct sockaddr_in *)sess->dst)->sin_port = hdr_v2->addr.ip4.dst_port;
KOVACS Krisztian7209c202015-07-03 14:09:10 +0200998 tlv_offset = PP2_HEADER_LEN + PP2_ADDR_LEN_INET;
Willy Tarreau77992672014-06-14 11:06:17 +0200999 break;
1000 case 0x21: /* TCPv6 */
KOVACS Krisztianefd3aa92014-11-19 10:53:20 +01001001 if (ntohs(hdr_v2->len) < PP2_ADDR_LEN_INET6)
1002 goto bad_header;
1003
Christopher Fauletc105c922021-10-25 08:17:11 +02001004 if (!sess || !sockaddr_alloc(&sess->src, NULL, 0) || !sockaddr_alloc(&sess->dst, NULL, 0))
1005 goto fail;
1006
1007 ((struct sockaddr_in6 *)sess->src)->sin6_family = AF_INET6;
1008 memcpy(&((struct sockaddr_in6 *)sess->src)->sin6_addr, hdr_v2->addr.ip6.src_addr, 16);
1009 ((struct sockaddr_in6 *)sess->src)->sin6_port = hdr_v2->addr.ip6.src_port;
1010 ((struct sockaddr_in6 *)sess->dst)->sin6_family = AF_INET6;
1011 memcpy(&((struct sockaddr_in6 *)sess->dst)->sin6_addr, hdr_v2->addr.ip6.dst_addr, 16);
1012 ((struct sockaddr_in6 *)sess->dst)->sin6_port = hdr_v2->addr.ip6.dst_port;
KOVACS Krisztian7209c202015-07-03 14:09:10 +02001013 tlv_offset = PP2_HEADER_LEN + PP2_ADDR_LEN_INET6;
Willy Tarreau77992672014-06-14 11:06:17 +02001014 break;
1015 }
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001016
1017 /* TLV parsing */
Tim Duesterhus488ee7f2020-03-05 22:55:20 +01001018 while (tlv_offset < total_v2_len) {
1019 struct tlv *tlv_packet;
Tim Duesterhus56c176a2021-03-06 20:06:51 +01001020 struct ist tlv;
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001021
Tim Duesterhus488ee7f2020-03-05 22:55:20 +01001022 /* Verify that we have at least TLV_HEADER_SIZE bytes left */
1023 if (tlv_offset + TLV_HEADER_SIZE > total_v2_len)
1024 goto bad_header;
1025
1026 tlv_packet = (struct tlv *) &trash.area[tlv_offset];
Tim Duesterhus56c176a2021-03-06 20:06:51 +01001027 tlv = ist2((const char *)tlv_packet->value, get_tlv_length(tlv_packet));
1028 tlv_offset += istlen(tlv) + TLV_HEADER_SIZE;
Tim Duesterhus488ee7f2020-03-05 22:55:20 +01001029
1030 /* Verify that the TLV length does not exceed the total PROXYv2 length */
1031 if (tlv_offset > total_v2_len)
1032 goto bad_header;
1033
1034 switch (tlv_packet->type) {
1035 case PP2_TYPE_CRC32C: {
1036 uint32_t n_crc32c;
1037
1038 /* Verify that this TLV is exactly 4 bytes long */
Tim Duesterhus56c176a2021-03-06 20:06:51 +01001039 if (istlen(tlv) != 4)
Tim Duesterhus488ee7f2020-03-05 22:55:20 +01001040 goto bad_header;
1041
Tim Duesterhus56c176a2021-03-06 20:06:51 +01001042 n_crc32c = read_n32(istptr(tlv));
1043 write_n32(istptr(tlv), 0); // compute with CRC==0
Tim Duesterhus488ee7f2020-03-05 22:55:20 +01001044
1045 if (hash_crc32c(trash.area, total_v2_len) != n_crc32c)
1046 goto bad_header;
1047 break;
1048 }
Willy Tarreaue5733232019-05-22 19:24:06 +02001049#ifdef USE_NS
Tim Duesterhus488ee7f2020-03-05 22:55:20 +01001050 case PP2_TYPE_NETNS: {
1051 const struct netns_entry *ns;
1052
Tim Duesterhus56c176a2021-03-06 20:06:51 +01001053 ns = netns_store_lookup(istptr(tlv), istlen(tlv));
Tim Duesterhus488ee7f2020-03-05 22:55:20 +01001054 if (ns)
1055 conn->proxy_netns = ns;
1056 break;
1057 }
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001058#endif
Tim Duesterhus488ee7f2020-03-05 22:55:20 +01001059 case PP2_TYPE_AUTHORITY: {
Tim Duesterhus615f81e2021-03-06 20:06:50 +01001060 if (istlen(tlv) > PP2_AUTHORITY_MAX)
Tim Duesterhus488ee7f2020-03-05 22:55:20 +01001061 goto bad_header;
Tim Duesterhus615f81e2021-03-06 20:06:50 +01001062 conn->proxy_authority = ist2(pool_alloc(pool_head_authority), 0);
1063 if (!isttest(conn->proxy_authority))
Tim Duesterhus488ee7f2020-03-05 22:55:20 +01001064 goto fail;
Tim Duesterhus615f81e2021-03-06 20:06:50 +01001065 if (istcpy(&conn->proxy_authority, tlv, PP2_AUTHORITY_MAX) < 0) {
Tim Duesterhusf09af572022-02-25 21:44:26 +01001066 /* This is impossible, because we verified that the TLV value fits. */
1067 my_unreachable();
Tim Duesterhus615f81e2021-03-06 20:06:50 +01001068 goto fail;
1069 }
Tim Duesterhus488ee7f2020-03-05 22:55:20 +01001070 break;
1071 }
Tim Duesterhusd1b15b62020-03-13 12:34:23 +01001072 case PP2_TYPE_UNIQUE_ID: {
Tim Duesterhus002bd772021-03-06 20:06:49 +01001073 if (istlen(tlv) > UNIQUEID_LEN)
Tim Duesterhusd1b15b62020-03-13 12:34:23 +01001074 goto bad_header;
Tim Duesterhus2b7f6c22020-03-14 13:07:05 +01001075 conn->proxy_unique_id = ist2(pool_alloc(pool_head_uniqueid), 0);
Tim Duesterhusd1b15b62020-03-13 12:34:23 +01001076 if (!isttest(conn->proxy_unique_id))
1077 goto fail;
1078 if (istcpy(&conn->proxy_unique_id, tlv, UNIQUEID_LEN) < 0) {
Tim Duesterhusf09af572022-02-25 21:44:26 +01001079 /* This is impossible, because we verified that the TLV value fits. */
1080 my_unreachable();
Tim Duesterhusd1b15b62020-03-13 12:34:23 +01001081 goto fail;
1082 }
1083 break;
1084 }
Tim Duesterhus488ee7f2020-03-05 22:55:20 +01001085 default:
1086 break;
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001087 }
1088 }
1089
Tim Duesterhus488ee7f2020-03-05 22:55:20 +01001090 /* Verify that the PROXYv2 header ends at a TLV boundary.
Tim Duesterhus17e6b732022-02-25 21:44:27 +01001091 * This is can not be true, because the TLV parsing already
1092 * verifies that a TLV does not exceed the total length and
1093 * also that there is space for a TLV header.
Tim Duesterhus488ee7f2020-03-05 22:55:20 +01001094 */
Tim Duesterhus17e6b732022-02-25 21:44:27 +01001095 BUG_ON(tlv_offset != total_v2_len);
Tim Duesterhus488ee7f2020-03-05 22:55:20 +01001096
Willy Tarreau77992672014-06-14 11:06:17 +02001097 /* unsupported protocol, keep local connection address */
1098 break;
1099 case 0x00: /* LOCAL command */
1100 /* keep local connection address for LOCAL */
1101 break;
1102 default:
1103 goto bad_header; /* not a supported command */
1104 }
1105
Tim Duesterhus488ee7f2020-03-05 22:55:20 +01001106 trash.data = total_v2_len;
Willy Tarreau77992672014-06-14 11:06:17 +02001107 goto eat_header;
1108
1109 eat_header:
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001110 /* remove the PROXY line from the request. For this we re-read the
1111 * exact line at once. If we don't get the exact same result, we
1112 * fail.
1113 */
Willy Tarreau157788c2020-02-11 10:08:05 +01001114 while (1) {
Tim Duesterhusa8692f32020-03-13 12:34:25 +01001115 ssize_t len2 = recv(conn->handle.fd, trash.area, trash.data, 0);
1116
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001117 if (len2 < 0 && errno == EINTR)
1118 continue;
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001119 if (len2 != trash.data)
Willy Tarreau8e3bf692012-12-03 15:41:18 +01001120 goto recv_abort;
Willy Tarreau157788c2020-02-11 10:08:05 +01001121 break;
1122 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001123
1124 conn->flags &= ~flag;
Emeric Brun4f603012017-01-05 15:11:44 +01001125 conn->flags |= CO_FL_RCVD_PROXY;
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001126 return 1;
1127
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001128 not_ready:
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001129 return 0;
1130
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001131 missing:
1132 /* Missing data. Since we're using MSG_PEEK, we can only poll again if
1133 * we have not read anything. Otherwise we need to fail because we won't
1134 * be able to poll anymore.
1135 */
Willy Tarreau8e3bf692012-12-03 15:41:18 +01001136 conn->err_code = CO_ER_PRX_TRUNCATED;
1137 goto fail;
1138
1139 bad_header:
1140 /* This is not a valid proxy protocol header */
1141 conn->err_code = CO_ER_PRX_BAD_HDR;
1142 goto fail;
1143
1144 recv_abort:
1145 conn->err_code = CO_ER_PRX_ABORT;
Willy Tarreau26f4a042013-12-04 23:44:10 +01001146 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH;
Willy Tarreau8e3bf692012-12-03 15:41:18 +01001147 goto fail;
1148
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001149 fail:
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001150 conn->flags |= CO_FL_ERROR;
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001151 return 0;
1152}
1153
Christopher Fauletaa91d622022-04-01 13:22:50 +02001154/* This callback is used to send a valid PROXY protocol line to a socket being
1155 * established. It returns 0 if it fails in a fatal way or needs to poll to go
1156 * further, otherwise it returns non-zero and removes itself from the connection's
1157 * flags (the bit is provided in <flag> by the caller). It is designed to be
1158 * called by the connection handler and relies on it to commit polling changes.
1159 * Note that it can emit a PROXY line by relying on the other end's address
Christopher Faulet6b0a0fb2022-04-04 11:29:28 +02001160 * when the connection is attached to a conn-stream, or by resolving the
Christopher Fauletaa91d622022-04-01 13:22:50 +02001161 * local address otherwise (also called a LOCAL line).
1162 */
1163int conn_send_proxy(struct connection *conn, unsigned int flag)
1164{
1165 if (!conn_ctrl_ready(conn))
1166 goto out_error;
1167
1168 /* If we have a PROXY line to send, we'll use this to validate the
1169 * connection, in which case the connection is validated only once
1170 * we've sent the whole proxy line. Otherwise we use connect().
1171 */
1172 if (conn->send_proxy_ofs) {
1173 struct conn_stream *cs;
1174 int ret;
1175
1176 /* If there is no mux attached to the connection, it means the
1177 * connection context is a conn-stream.
1178 */
1179 cs = (conn->mux ? cs_conn_get_first(conn) : conn->ctx);
1180
1181 /* The target server expects a PROXY line to be sent first.
1182 * If the send_proxy_ofs is negative, it corresponds to the
1183 * offset to start sending from then end of the proxy string
1184 * (which is recomputed every time since it's constant). If
1185 * it is positive, it means we have to send from the start.
1186 * We can only send a "normal" PROXY line when the connection
Christopher Faulet6b0a0fb2022-04-04 11:29:28 +02001187 * is attached to a conn-stream. Otherwise we can only
Christopher Fauletaa91d622022-04-01 13:22:50 +02001188 * send a LOCAL line (eg: for use with health checks).
1189 */
1190
1191 if (cs && cs_strm(cs)) {
1192 ret = make_proxy_line(trash.area, trash.size,
1193 objt_server(conn->target),
1194 cs_conn(cs_opposite(cs)),
1195 __cs_strm(cs));
1196 }
1197 else {
1198 /* The target server expects a LOCAL line to be sent first. Retrieving
1199 * local or remote addresses may fail until the connection is established.
1200 */
1201 if (!conn_get_src(conn) || !conn_get_dst(conn))
1202 goto out_wait;
1203
1204 ret = make_proxy_line(trash.area, trash.size,
1205 objt_server(conn->target), conn,
1206 NULL);
1207 }
1208
1209 if (!ret)
1210 goto out_error;
1211
1212 if (conn->send_proxy_ofs > 0)
1213 conn->send_proxy_ofs = -ret; /* first call */
1214
1215 /* we have to send trash from (ret+sp for -sp bytes). If the
1216 * data layer has a pending write, we'll also set MSG_MORE.
1217 */
1218 ret = conn_ctrl_send(conn,
1219 trash.area + ret + conn->send_proxy_ofs,
1220 -conn->send_proxy_ofs,
1221 (conn->subs && conn->subs->events & SUB_RETRY_SEND) ? CO_SFL_MSG_MORE : 0);
1222
1223 if (ret < 0)
1224 goto out_error;
1225
1226 conn->send_proxy_ofs += ret; /* becomes zero once complete */
1227 if (conn->send_proxy_ofs != 0)
1228 goto out_wait;
1229
1230 /* OK we've sent the whole line, we're connected */
1231 }
1232
1233 /* The connection is ready now, simply return and let the connection
1234 * handler notify upper layers if needed.
1235 */
1236 conn->flags &= ~CO_FL_WAIT_L4_CONN;
1237 conn->flags &= ~flag;
1238 return 1;
1239
1240 out_error:
1241 /* Write error on the file descriptor */
1242 conn->flags |= CO_FL_ERROR;
1243 return 0;
1244
1245 out_wait:
1246 return 0;
1247}
1248
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001249/* This handshake handler waits a NetScaler Client IP insertion header
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +00001250 * at the beginning of the raw data stream. The header format is
1251 * described in doc/netscaler-client-ip-insertion-protocol.txt
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001252 *
1253 * This line MUST be at the beginning of the buffer and MUST NOT be
1254 * fragmented.
1255 *
1256 * The header line is small and in all cases smaller than the smallest normal
1257 * TCP MSS. So it MUST always be delivered as one segment, which ensures we
1258 * can safely use MSG_PEEK and avoid buffering.
1259 *
1260 * Once the data is fetched, the values are set in the connection's address
1261 * fields, and data are removed from the socket's buffer. The function returns
1262 * zero if it needs to wait for more data or if it fails, or 1 if it completed
1263 * and removed itself.
1264 */
1265int conn_recv_netscaler_cip(struct connection *conn, int flag)
1266{
Christopher Faulete83e8822021-10-25 08:23:22 +02001267 struct session *sess = conn->owner;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001268 char *line;
Bertrand Jacquin7d668f92017-12-13 01:23:39 +00001269 uint32_t hdr_len;
Willy Tarreau0ca24aa2019-03-29 17:35:32 +01001270 uint8_t ip_ver;
Willy Tarreaub406b872018-08-22 05:20:32 +02001271 int ret;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001272
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001273 if (!conn_ctrl_ready(conn))
1274 goto fail;
1275
Willy Tarreau07ecfc52022-04-11 18:07:03 +02001276 BUG_ON(conn->flags & CO_FL_FDLESS);
1277
Willy Tarreau585744b2017-08-24 14:31:19 +02001278 if (!fd_recv_ready(conn->handle.fd))
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001279 goto not_ready;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001280
Willy Tarreau157788c2020-02-11 10:08:05 +01001281 while (1) {
Willy Tarreaub406b872018-08-22 05:20:32 +02001282 ret = recv(conn->handle.fd, trash.area, trash.size, MSG_PEEK);
1283 if (ret < 0) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001284 if (errno == EINTR)
1285 continue;
Willy Tarreauacef5e22022-04-25 20:32:15 +02001286 if (errno == EAGAIN || errno == EWOULDBLOCK) {
Willy Tarreau585744b2017-08-24 14:31:19 +02001287 fd_cant_recv(conn->handle.fd);
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001288 goto not_ready;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001289 }
1290 goto recv_abort;
1291 }
Willy Tarreaub406b872018-08-22 05:20:32 +02001292 trash.data = ret;
Willy Tarreau157788c2020-02-11 10:08:05 +01001293 break;
1294 }
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001295
Willy Tarreauc192b0a2020-01-23 09:11:58 +01001296 conn->flags &= ~CO_FL_WAIT_L4_CONN;
1297
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001298 if (!trash.data) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001299 /* client shutdown */
1300 conn->err_code = CO_ER_CIP_EMPTY;
1301 goto fail;
1302 }
1303
1304 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +00001305 * CIP magic, header length or
1306 * CIP magic, CIP length, CIP type, header length */
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001307 if (trash.data < 12)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001308 goto missing;
1309
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001310 line = trash.area;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001311
1312 /* Decode a possible NetScaler Client IP request, fail early if
1313 * it does not match */
Willy Tarreau1ac83af2020-02-25 10:06:49 +01001314 if (ntohl(read_u32(line)) != __objt_listener(conn->target)->bind_conf->ns_cip_magic)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001315 goto bad_magic;
1316
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +00001317 /* Legacy CIP protocol */
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001318 if ((trash.area[8] & 0xD0) == 0x40) {
Willy Tarreau1ac83af2020-02-25 10:06:49 +01001319 hdr_len = ntohl(read_u32((line+4)));
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +00001320 line += 8;
1321 }
1322 /* Standard CIP protocol */
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001323 else if (trash.area[8] == 0x00) {
Willy Tarreau1ac83af2020-02-25 10:06:49 +01001324 hdr_len = ntohs(read_u32((line+10)));
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +00001325 line += 12;
1326 }
1327 /* Unknown CIP protocol */
1328 else {
1329 conn->err_code = CO_ER_CIP_BAD_PROTO;
1330 goto fail;
1331 }
1332
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001333 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +00001334 * a minimal IP header */
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001335 if (trash.data < 20)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001336 goto missing;
1337
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001338 /* Get IP version from the first four bits */
Willy Tarreau0ca24aa2019-03-29 17:35:32 +01001339 ip_ver = (*line & 0xf0) >> 4;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001340
Willy Tarreau0ca24aa2019-03-29 17:35:32 +01001341 if (ip_ver == 4) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001342 struct ip *hdr_ip4;
David Carlier3015a2e2016-07-04 22:51:33 +01001343 struct my_tcphdr *hdr_tcp;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001344
1345 hdr_ip4 = (struct ip *)line;
1346
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001347 if (trash.data < 40 || trash.data < hdr_len) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001348 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin67de5a22017-12-13 01:15:05 +00001349 * IPv4 header, TCP header */
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001350 goto missing;
Bertrand Jacquinb3875912017-12-13 00:58:51 +00001351 }
1352 else if (hdr_ip4->ip_p != IPPROTO_TCP) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001353 /* The protocol does not include a TCP header */
1354 conn->err_code = CO_ER_CIP_BAD_PROTO;
1355 goto fail;
Bertrand Jacquinb3875912017-12-13 00:58:51 +00001356 }
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001357
David Carlier3015a2e2016-07-04 22:51:33 +01001358 hdr_tcp = (struct my_tcphdr *)(line + (hdr_ip4->ip_hl * 4));
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001359
Christopher Faulete83e8822021-10-25 08:23:22 +02001360 if (!sess || !sockaddr_alloc(&sess->src, NULL, 0) || !sockaddr_alloc(&sess->dst, NULL, 0))
1361 goto fail;
1362
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001363 /* update the session's addresses and mark them set */
Christopher Faulete83e8822021-10-25 08:23:22 +02001364 ((struct sockaddr_in *)sess->src)->sin_family = AF_INET;
1365 ((struct sockaddr_in *)sess->src)->sin_addr.s_addr = hdr_ip4->ip_src.s_addr;
1366 ((struct sockaddr_in *)sess->src)->sin_port = hdr_tcp->source;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001367
Christopher Faulete83e8822021-10-25 08:23:22 +02001368 ((struct sockaddr_in *)sess->dst)->sin_family = AF_INET;
1369 ((struct sockaddr_in *)sess->dst)->sin_addr.s_addr = hdr_ip4->ip_dst.s_addr;
1370 ((struct sockaddr_in *)sess->dst)->sin_port = hdr_tcp->dest;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001371 }
Willy Tarreau0ca24aa2019-03-29 17:35:32 +01001372 else if (ip_ver == 6) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001373 struct ip6_hdr *hdr_ip6;
David Carlier3015a2e2016-07-04 22:51:33 +01001374 struct my_tcphdr *hdr_tcp;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001375
1376 hdr_ip6 = (struct ip6_hdr *)line;
1377
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001378 if (trash.data < 60 || trash.data < hdr_len) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001379 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin67de5a22017-12-13 01:15:05 +00001380 * IPv6 header, TCP header */
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001381 goto missing;
Bertrand Jacquinb3875912017-12-13 00:58:51 +00001382 }
1383 else if (hdr_ip6->ip6_nxt != IPPROTO_TCP) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001384 /* The protocol does not include a TCP header */
1385 conn->err_code = CO_ER_CIP_BAD_PROTO;
1386 goto fail;
Bertrand Jacquinb3875912017-12-13 00:58:51 +00001387 }
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001388
David Carlier3015a2e2016-07-04 22:51:33 +01001389 hdr_tcp = (struct my_tcphdr *)(line + sizeof(struct ip6_hdr));
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001390
Christopher Faulete83e8822021-10-25 08:23:22 +02001391 if (!sess || !sockaddr_alloc(&sess->src, NULL, 0) || !sockaddr_alloc(&sess->dst, NULL, 0))
1392 goto fail;
1393
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001394 /* update the session's addresses and mark them set */
Christopher Faulete83e8822021-10-25 08:23:22 +02001395 ((struct sockaddr_in6 *)sess->src)->sin6_family = AF_INET6;
1396 ((struct sockaddr_in6 *)sess->src)->sin6_addr = hdr_ip6->ip6_src;
1397 ((struct sockaddr_in6 *)sess->src)->sin6_port = hdr_tcp->source;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001398
Christopher Faulete83e8822021-10-25 08:23:22 +02001399 ((struct sockaddr_in6 *)sess->dst)->sin6_family = AF_INET6;
1400 ((struct sockaddr_in6 *)sess->dst)->sin6_addr = hdr_ip6->ip6_dst;
1401 ((struct sockaddr_in6 *)sess->dst)->sin6_port = hdr_tcp->dest;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001402 }
1403 else {
1404 /* The protocol does not match something known (IPv4/IPv6) */
1405 conn->err_code = CO_ER_CIP_BAD_PROTO;
1406 goto fail;
1407 }
1408
Bertrand Jacquin7d668f92017-12-13 01:23:39 +00001409 line += hdr_len;
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001410 trash.data = line - trash.area;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001411
1412 /* remove the NetScaler Client IP header from the request. For this
1413 * we re-read the exact line at once. If we don't get the exact same
1414 * result, we fail.
1415 */
Willy Tarreau157788c2020-02-11 10:08:05 +01001416 while (1) {
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001417 int len2 = recv(conn->handle.fd, trash.area, trash.data, 0);
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001418 if (len2 < 0 && errno == EINTR)
1419 continue;
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001420 if (len2 != trash.data)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001421 goto recv_abort;
Willy Tarreau157788c2020-02-11 10:08:05 +01001422 break;
1423 }
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001424
1425 conn->flags &= ~flag;
1426 return 1;
1427
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001428 not_ready:
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001429 return 0;
1430
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001431 missing:
1432 /* Missing data. Since we're using MSG_PEEK, we can only poll again if
1433 * we have not read anything. Otherwise we need to fail because we won't
1434 * be able to poll anymore.
1435 */
1436 conn->err_code = CO_ER_CIP_TRUNCATED;
1437 goto fail;
1438
1439 bad_magic:
1440 conn->err_code = CO_ER_CIP_BAD_MAGIC;
1441 goto fail;
1442
1443 recv_abort:
1444 conn->err_code = CO_ER_CIP_ABORT;
1445 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH;
1446 goto fail;
1447
1448 fail:
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001449 conn->flags |= CO_FL_ERROR;
1450 return 0;
1451}
1452
Alexander Liu2a54bb72019-05-22 19:44:48 +08001453
1454int conn_send_socks4_proxy_request(struct connection *conn)
1455{
1456 struct socks4_request req_line;
1457
Alexander Liu2a54bb72019-05-22 19:44:48 +08001458 if (!conn_ctrl_ready(conn))
1459 goto out_error;
1460
Willy Tarreau226572f2019-07-17 14:46:00 +02001461 if (!conn_get_dst(conn))
1462 goto out_error;
1463
Alexander Liu2a54bb72019-05-22 19:44:48 +08001464 req_line.version = 0x04;
1465 req_line.command = 0x01;
Willy Tarreau226572f2019-07-17 14:46:00 +02001466 req_line.port = get_net_port(conn->dst);
1467 req_line.ip = is_inet_addr(conn->dst);
Alexander Liu2a54bb72019-05-22 19:44:48 +08001468 memcpy(req_line.user_id, "HAProxy\0", 8);
1469
1470 if (conn->send_proxy_ofs > 0) {
1471 /*
1472 * This is the first call to send the request
1473 */
1474 conn->send_proxy_ofs = -(int)sizeof(req_line);
1475 }
1476
1477 if (conn->send_proxy_ofs < 0) {
1478 int ret = 0;
1479
1480 /* we are sending the socks4_req_line here. If the data layer
1481 * has a pending write, we'll also set MSG_MORE.
1482 */
Willy Tarreau827fee72020-12-11 15:26:55 +01001483 ret = conn_ctrl_send(
Alexander Liu2a54bb72019-05-22 19:44:48 +08001484 conn,
1485 ((char *)(&req_line)) + (sizeof(req_line)+conn->send_proxy_ofs),
1486 -conn->send_proxy_ofs,
Willy Tarreau827fee72020-12-11 15:26:55 +01001487 (conn->subs && conn->subs->events & SUB_RETRY_SEND) ? CO_SFL_MSG_MORE : 0);
Alexander Liu2a54bb72019-05-22 19:44:48 +08001488
1489 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Before send remain is [%d], sent [%d]\n",
Willy Tarreau0e9c2642022-04-11 18:01:28 +02001490 conn_fd(conn), -conn->send_proxy_ofs, ret);
Alexander Liu2a54bb72019-05-22 19:44:48 +08001491
1492 if (ret < 0) {
1493 goto out_error;
1494 }
1495
1496 conn->send_proxy_ofs += ret; /* becomes zero once complete */
1497 if (conn->send_proxy_ofs != 0) {
1498 goto out_wait;
1499 }
1500 }
1501
1502 /* OK we've the whole request sent */
1503 conn->flags &= ~CO_FL_SOCKS4_SEND;
Alexander Liu2a54bb72019-05-22 19:44:48 +08001504
1505 /* The connection is ready now, simply return and let the connection
1506 * handler notify upper layers if needed.
1507 */
Willy Tarreauc192b0a2020-01-23 09:11:58 +01001508 conn->flags &= ~CO_FL_WAIT_L4_CONN;
Alexander Liu2a54bb72019-05-22 19:44:48 +08001509
1510 if (conn->flags & CO_FL_SEND_PROXY) {
1511 /*
1512 * Get the send_proxy_ofs ready for the send_proxy due to we are
1513 * reusing the "send_proxy_ofs", and SOCKS4 handshake should be done
1514 * before sending PROXY Protocol.
1515 */
1516 conn->send_proxy_ofs = 1;
1517 }
1518 return 1;
1519
1520 out_error:
1521 /* Write error on the file descriptor */
1522 conn->flags |= CO_FL_ERROR;
1523 if (conn->err_code == CO_ER_NONE) {
1524 conn->err_code = CO_ER_SOCKS4_SEND;
1525 }
1526 return 0;
1527
1528 out_wait:
Alexander Liu2a54bb72019-05-22 19:44:48 +08001529 return 0;
1530}
1531
1532int conn_recv_socks4_proxy_response(struct connection *conn)
1533{
1534 char line[SOCKS4_HS_RSP_LEN];
1535 int ret;
1536
Alexander Liu2a54bb72019-05-22 19:44:48 +08001537 if (!conn_ctrl_ready(conn))
1538 goto fail;
1539
Willy Tarreau07ecfc52022-04-11 18:07:03 +02001540 BUG_ON(conn->flags & CO_FL_FDLESS);
1541
Alexander Liu2a54bb72019-05-22 19:44:48 +08001542 if (!fd_recv_ready(conn->handle.fd))
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001543 goto not_ready;
Alexander Liu2a54bb72019-05-22 19:44:48 +08001544
Willy Tarreau157788c2020-02-11 10:08:05 +01001545 while (1) {
Alexander Liu2a54bb72019-05-22 19:44:48 +08001546 /* SOCKS4 Proxy will response with 8 bytes, 0x00 | 0x5A | 0x00 0x00 | 0x00 0x00 0x00 0x00
1547 * Try to peek into it, before all 8 bytes ready.
1548 */
1549 ret = recv(conn->handle.fd, line, SOCKS4_HS_RSP_LEN, MSG_PEEK);
1550
1551 if (ret == 0) {
1552 /* the socket has been closed or shutdown for send */
1553 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Received ret[%d], errno[%d], looks like the socket has been closed or shutdown for send\n",
1554 conn->handle.fd, ret, errno);
1555 if (conn->err_code == CO_ER_NONE) {
1556 conn->err_code = CO_ER_SOCKS4_RECV;
1557 }
1558 goto fail;
1559 }
1560
1561 if (ret > 0) {
1562 if (ret == SOCKS4_HS_RSP_LEN) {
1563 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Received 8 bytes, the response is [%02X|%02X|%02X %02X|%02X %02X %02X %02X]\n",
1564 conn->handle.fd, line[0], line[1], line[2], line[3], line[4], line[5], line[6], line[7]);
1565 }else{
1566 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Received ret[%d], first byte is [%02X], last bye is [%02X]\n", conn->handle.fd, ret, line[0], line[ret-1]);
1567 }
1568 } else {
1569 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Received ret[%d], errno[%d]\n", conn->handle.fd, ret, errno);
1570 }
1571
1572 if (ret < 0) {
1573 if (errno == EINTR) {
1574 continue;
1575 }
Willy Tarreauacef5e22022-04-25 20:32:15 +02001576 if (errno == EAGAIN || errno == EWOULDBLOCK) {
Alexander Liu2a54bb72019-05-22 19:44:48 +08001577 fd_cant_recv(conn->handle.fd);
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001578 goto not_ready;
Alexander Liu2a54bb72019-05-22 19:44:48 +08001579 }
1580 goto recv_abort;
1581 }
Willy Tarreau157788c2020-02-11 10:08:05 +01001582 break;
1583 }
Alexander Liu2a54bb72019-05-22 19:44:48 +08001584
Willy Tarreauc192b0a2020-01-23 09:11:58 +01001585 conn->flags &= ~CO_FL_WAIT_L4_CONN;
1586
Alexander Liu2a54bb72019-05-22 19:44:48 +08001587 if (ret < SOCKS4_HS_RSP_LEN) {
1588 /* Missing data. Since we're using MSG_PEEK, we can only poll again if
1589 * we are not able to read enough data.
1590 */
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001591 goto not_ready;
Alexander Liu2a54bb72019-05-22 19:44:48 +08001592 }
1593
1594 /*
1595 * Base on the SOCSK4 protocol:
1596 *
1597 * +----+----+----+----+----+----+----+----+
1598 * | VN | CD | DSTPORT | DSTIP |
1599 * +----+----+----+----+----+----+----+----+
1600 * # of bytes: 1 1 2 4
1601 * VN is the version of the reply code and should be 0. CD is the result
1602 * code with one of the following values:
1603 * 90: request granted
1604 * 91: request rejected or failed
Ilya Shipitsince7b00f2020-03-23 22:28:40 +05001605 * 92: request rejected because SOCKS server cannot connect to identd on the client
Alexander Liu2a54bb72019-05-22 19:44:48 +08001606 * 93: request rejected because the client program and identd report different user-ids
1607 * The remaining fields are ignored.
1608 */
1609 if (line[1] != 90) {
1610 conn->flags &= ~CO_FL_SOCKS4_RECV;
1611
1612 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: FAIL, the response is [%02X|%02X|%02X %02X|%02X %02X %02X %02X]\n",
1613 conn->handle.fd, line[0], line[1], line[2], line[3], line[4], line[5], line[6], line[7]);
1614 if (conn->err_code == CO_ER_NONE) {
1615 conn->err_code = CO_ER_SOCKS4_DENY;
1616 }
1617 goto fail;
1618 }
1619
1620 /* remove the 8 bytes response from the stream */
Willy Tarreau157788c2020-02-11 10:08:05 +01001621 while (1) {
Alexander Liu2a54bb72019-05-22 19:44:48 +08001622 ret = recv(conn->handle.fd, line, SOCKS4_HS_RSP_LEN, 0);
1623 if (ret < 0 && errno == EINTR) {
1624 continue;
1625 }
1626 if (ret != SOCKS4_HS_RSP_LEN) {
1627 if (conn->err_code == CO_ER_NONE) {
1628 conn->err_code = CO_ER_SOCKS4_RECV;
1629 }
1630 goto fail;
1631 }
Willy Tarreau157788c2020-02-11 10:08:05 +01001632 break;
1633 }
Alexander Liu2a54bb72019-05-22 19:44:48 +08001634
1635 conn->flags &= ~CO_FL_SOCKS4_RECV;
1636 return 1;
1637
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001638 not_ready:
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001639 return 0;
1640
Alexander Liu2a54bb72019-05-22 19:44:48 +08001641 recv_abort:
1642 if (conn->err_code == CO_ER_NONE) {
1643 conn->err_code = CO_ER_SOCKS4_ABORT;
1644 }
1645 conn->flags |= (CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH);
1646 goto fail;
1647
1648 fail:
Alexander Liu2a54bb72019-05-22 19:44:48 +08001649 conn->flags |= CO_FL_ERROR;
1650 return 0;
1651}
1652
Willy Tarreaud318e4e2022-03-02 14:46:45 +01001653/* registers proto mux list <list>. Modifies the list element! */
1654void register_mux_proto(struct mux_proto_list *list)
1655{
1656 LIST_APPEND(&mux_proto_list.list, &list->list);
1657}
1658
Willy Tarreauadd43062022-02-18 11:07:40 +01001659/* Lists the known proto mux on <out>. This function is used by "haproxy -vv"
1660 * and is suitable for early boot just after the "REGISTER" stage because it
1661 * doesn't depend on anything to be already allocated.
1662 */
Willy Tarreaue59b5162021-05-08 14:06:09 +02001663void list_mux_proto(FILE *out)
1664{
1665 struct mux_proto_list *item;
Willy Tarreaue59b5162021-05-08 14:06:09 +02001666 struct ist proto;
1667 char *mode, *side;
Willy Tarreauadd43062022-02-18 11:07:40 +01001668 int done;
Willy Tarreaue59b5162021-05-08 14:06:09 +02001669
1670 fprintf(out, "Available multiplexer protocols :\n"
1671 "(protocols marked as <default> cannot be specified using 'proto' keyword)\n");
1672 list_for_each_entry(item, &mux_proto_list.list, list) {
1673 proto = item->token;
1674
1675 if (item->mode == PROTO_MODE_ANY)
1676 mode = "TCP|HTTP";
1677 else if (item->mode == PROTO_MODE_TCP)
1678 mode = "TCP";
1679 else if (item->mode == PROTO_MODE_HTTP)
1680 mode = "HTTP";
1681 else
1682 mode = "NONE";
1683
1684 if (item->side == PROTO_SIDE_BOTH)
1685 side = "FE|BE";
1686 else if (item->side == PROTO_SIDE_FE)
1687 side = "FE";
1688 else if (item->side == PROTO_SIDE_BE)
1689 side = "BE";
1690 else
1691 side = "NONE";
1692
Willy Tarreaudddfec52022-04-09 11:37:35 +02001693 fprintf(out, " %10s : mode=%-5s side=%-6s mux=%-5s flags=",
Willy Tarreauadd43062022-02-18 11:07:40 +01001694 (proto.len ? proto.ptr : "<default>"), mode, side, item->mux->name);
1695
1696 done = 0;
1697
1698 /* note: the block below could be simplied using macros but for only
1699 * 4 flags it's not worth it.
1700 */
Willy Tarreaue59b5162021-05-08 14:06:09 +02001701 if (item->mux->flags & MX_FL_HTX)
Willy Tarreauadd43062022-02-18 11:07:40 +01001702 done |= fprintf(out, "%sHTX", done ? "|" : "");
1703
Willy Tarreaue59b5162021-05-08 14:06:09 +02001704 if (item->mux->flags & MX_FL_HOL_RISK)
Willy Tarreauadd43062022-02-18 11:07:40 +01001705 done |= fprintf(out, "%sHOL_RISK", done ? "|" : "");
1706
Willy Tarreaue59b5162021-05-08 14:06:09 +02001707 if (item->mux->flags & MX_FL_NO_UPG)
Willy Tarreauadd43062022-02-18 11:07:40 +01001708 done |= fprintf(out, "%sNO_UPG", done ? "|" : "");
Willy Tarreaue59b5162021-05-08 14:06:09 +02001709
Willy Tarreaub5821e12022-04-26 11:54:08 +02001710 if (item->mux->flags & MX_FL_FRAMED)
1711 done |= fprintf(out, "%sFRAMED", done ? "|" : "");
1712
Willy Tarreauadd43062022-02-18 11:07:40 +01001713 fprintf(out, "\n");
Willy Tarreaue59b5162021-05-08 14:06:09 +02001714 }
1715}
1716
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001717/* Makes a PROXY protocol line from the two addresses. The output is sent to
1718 * buffer <buf> for a maximum size of <buf_len> (including the trailing zero).
1719 * It returns the number of bytes composing this line (including the trailing
1720 * LF), or zero in case of failure (eg: not enough space). It supports TCP4,
Willy Tarreau2e1401a2013-10-01 11:41:55 +02001721 * TCP6 and "UNKNOWN" formats. If any of <src> or <dst> is null, UNKNOWN is
1722 * emitted as well.
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001723 */
Christopher Fauletb097aef2021-10-25 08:05:28 +02001724static int make_proxy_line_v1(char *buf, int buf_len, const struct sockaddr_storage *src, const struct sockaddr_storage *dst)
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001725{
1726 int ret = 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001727 char * protocol;
1728 char src_str[MAX(INET_ADDRSTRLEN, INET6_ADDRSTRLEN)];
1729 char dst_str[MAX(INET_ADDRSTRLEN, INET6_ADDRSTRLEN)];
1730 in_port_t src_port;
1731 in_port_t dst_port;
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001732
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001733 if ( !src
1734 || !dst
1735 || (src->ss_family != AF_INET && src->ss_family != AF_INET6)
1736 || (dst->ss_family != AF_INET && dst->ss_family != AF_INET6)) {
1737 /* unknown family combination */
1738 ret = snprintf(buf, buf_len, "PROXY UNKNOWN\r\n");
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001739 if (ret >= buf_len)
1740 return 0;
1741
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001742 return ret;
1743 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001744
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001745 /* IPv4 for both src and dst */
1746 if (src->ss_family == AF_INET && dst->ss_family == AF_INET) {
1747 protocol = "TCP4";
1748 if (!inet_ntop(AF_INET, &((struct sockaddr_in *)src)->sin_addr, src_str, sizeof(src_str)))
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001749 return 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001750 src_port = ((struct sockaddr_in *)src)->sin_port;
1751 if (!inet_ntop(AF_INET, &((struct sockaddr_in *)dst)->sin_addr, dst_str, sizeof(dst_str)))
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001752 return 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001753 dst_port = ((struct sockaddr_in *)dst)->sin_port;
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001754 }
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001755 /* IPv6 for at least one of src and dst */
1756 else {
1757 struct in6_addr tmp;
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001758
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001759 protocol = "TCP6";
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001760
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001761 if (src->ss_family == AF_INET) {
1762 /* Convert src to IPv6 */
1763 v4tov6(&tmp, &((struct sockaddr_in *)src)->sin_addr);
1764 src_port = ((struct sockaddr_in *)src)->sin_port;
1765 }
1766 else {
1767 tmp = ((struct sockaddr_in6 *)src)->sin6_addr;
1768 src_port = ((struct sockaddr_in6 *)src)->sin6_port;
1769 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001770
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001771 if (!inet_ntop(AF_INET6, &tmp, src_str, sizeof(src_str)))
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001772 return 0;
1773
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001774 if (dst->ss_family == AF_INET) {
1775 /* Convert dst to IPv6 */
1776 v4tov6(&tmp, &((struct sockaddr_in *)dst)->sin_addr);
1777 dst_port = ((struct sockaddr_in *)dst)->sin_port;
1778 }
1779 else {
1780 tmp = ((struct sockaddr_in6 *)dst)->sin6_addr;
1781 dst_port = ((struct sockaddr_in6 *)dst)->sin6_port;
1782 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001783
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001784 if (!inet_ntop(AF_INET6, &tmp, dst_str, sizeof(dst_str)))
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001785 return 0;
1786 }
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001787
1788 ret = snprintf(buf, buf_len, "PROXY %s %s %s %u %u\r\n", protocol, src_str, dst_str, ntohs(src_port), ntohs(dst_port));
1789 if (ret >= buf_len)
1790 return 0;
1791
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001792 return ret;
1793}
David Safb76832014-05-08 23:42:08 -04001794
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001795static int make_tlv(char *dest, int dest_len, char type, uint16_t length, const char *value)
David Safb76832014-05-08 23:42:08 -04001796{
1797 struct tlv *tlv;
1798
1799 if (!dest || (length + sizeof(*tlv) > dest_len))
1800 return 0;
1801
1802 tlv = (struct tlv *)dest;
1803
1804 tlv->type = type;
1805 tlv->length_hi = length >> 8;
1806 tlv->length_lo = length & 0x00ff;
1807 memcpy(tlv->value, value, length);
1808 return length + sizeof(*tlv);
1809}
David Safb76832014-05-08 23:42:08 -04001810
Ilya Shipitsinca56fce2018-09-15 00:50:05 +05001811/* Note: <remote> is explicitly allowed to be NULL */
Christopher Faulet4bfce392021-10-22 14:33:59 +02001812static int make_proxy_line_v2(char *buf, int buf_len, struct server *srv, struct connection *remote, struct stream *strm)
David Safb76832014-05-08 23:42:08 -04001813{
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001814 const char pp2_signature[] = PP2_SIGNATURE;
Emmanuel Hocdet4399c752018-02-05 15:26:43 +01001815 void *tlv_crc32c_p = NULL;
David Safb76832014-05-08 23:42:08 -04001816 int ret = 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001817 struct proxy_hdr_v2 *hdr = (struct proxy_hdr_v2 *)buf;
Vincent Bernat6e615892016-05-18 16:17:44 +02001818 struct sockaddr_storage null_addr = { .ss_family = 0 };
Christopher Fauletb097aef2021-10-25 08:05:28 +02001819 const struct sockaddr_storage *src = &null_addr;
1820 const struct sockaddr_storage *dst = &null_addr;
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001821 const char *value;
1822 int value_len;
David Safb76832014-05-08 23:42:08 -04001823
1824 if (buf_len < PP2_HEADER_LEN)
1825 return 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001826 memcpy(hdr->sig, pp2_signature, PP2_SIGNATURE_LEN);
David Safb76832014-05-08 23:42:08 -04001827
Christopher Fauletb097aef2021-10-25 08:05:28 +02001828 if (strm) {
Christopher Faulet8da67aa2022-03-29 17:53:09 +02001829 src = cs_src(strm->csf);
1830 dst = cs_dst(strm->csf);
Christopher Fauletb097aef2021-10-25 08:05:28 +02001831 }
1832 else if (remote && conn_get_src(remote) && conn_get_dst(remote)) {
1833 src = conn_src(remote);
1834 dst = conn_dst(remote);
David Safb76832014-05-08 23:42:08 -04001835 }
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001836
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001837 /* At least one of src or dst is not of AF_INET or AF_INET6 */
1838 if ( !src
1839 || !dst
Willy Tarreau119e50e2020-05-22 13:53:29 +02001840 || (!pp2_never_send_local && conn_is_back(remote)) // locally initiated connection
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001841 || (src->ss_family != AF_INET && src->ss_family != AF_INET6)
1842 || (dst->ss_family != AF_INET && dst->ss_family != AF_INET6)) {
David Safb76832014-05-08 23:42:08 -04001843 if (buf_len < PP2_HDR_LEN_UNSPEC)
1844 return 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001845 hdr->ver_cmd = PP2_VERSION | PP2_CMD_LOCAL;
1846 hdr->fam = PP2_FAM_UNSPEC | PP2_TRANS_UNSPEC;
David Safb76832014-05-08 23:42:08 -04001847 ret = PP2_HDR_LEN_UNSPEC;
1848 }
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001849 else {
Willy Tarreau02c88032020-04-14 12:54:10 +02001850 hdr->ver_cmd = PP2_VERSION | PP2_CMD_PROXY;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001851 /* IPv4 for both src and dst */
1852 if (src->ss_family == AF_INET && dst->ss_family == AF_INET) {
1853 if (buf_len < PP2_HDR_LEN_INET)
1854 return 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001855 hdr->fam = PP2_FAM_INET | PP2_TRANS_STREAM;
1856 hdr->addr.ip4.src_addr = ((struct sockaddr_in *)src)->sin_addr.s_addr;
1857 hdr->addr.ip4.src_port = ((struct sockaddr_in *)src)->sin_port;
1858 hdr->addr.ip4.dst_addr = ((struct sockaddr_in *)dst)->sin_addr.s_addr;
1859 hdr->addr.ip4.dst_port = ((struct sockaddr_in *)dst)->sin_port;
1860 ret = PP2_HDR_LEN_INET;
1861 }
1862 /* IPv6 for at least one of src and dst */
1863 else {
1864 struct in6_addr tmp;
1865
1866 if (buf_len < PP2_HDR_LEN_INET6)
1867 return 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001868 hdr->fam = PP2_FAM_INET6 | PP2_TRANS_STREAM;
1869 if (src->ss_family == AF_INET) {
1870 v4tov6(&tmp, &((struct sockaddr_in *)src)->sin_addr);
1871 memcpy(hdr->addr.ip6.src_addr, &tmp, 16);
1872 hdr->addr.ip6.src_port = ((struct sockaddr_in *)src)->sin_port;
1873 }
1874 else {
1875 memcpy(hdr->addr.ip6.src_addr, &((struct sockaddr_in6 *)src)->sin6_addr, 16);
1876 hdr->addr.ip6.src_port = ((struct sockaddr_in6 *)src)->sin6_port;
1877 }
1878 if (dst->ss_family == AF_INET) {
1879 v4tov6(&tmp, &((struct sockaddr_in *)dst)->sin_addr);
1880 memcpy(hdr->addr.ip6.dst_addr, &tmp, 16);
William Dauchybd8bf672020-01-26 19:06:39 +01001881 hdr->addr.ip6.dst_port = ((struct sockaddr_in *)dst)->sin_port;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001882 }
1883 else {
1884 memcpy(hdr->addr.ip6.dst_addr, &((struct sockaddr_in6 *)dst)->sin6_addr, 16);
1885 hdr->addr.ip6.dst_port = ((struct sockaddr_in6 *)dst)->sin6_port;
1886 }
1887
1888 ret = PP2_HDR_LEN_INET6;
1889 }
1890 }
David Safb76832014-05-08 23:42:08 -04001891
Emmanuel Hocdet4399c752018-02-05 15:26:43 +01001892 if (srv->pp_opts & SRV_PP_V2_CRC32C) {
1893 uint32_t zero_crc32c = 0;
Tim Duesterhusa8692f32020-03-13 12:34:25 +01001894
Emmanuel Hocdet4399c752018-02-05 15:26:43 +01001895 if ((buf_len - ret) < sizeof(struct tlv))
1896 return 0;
1897 tlv_crc32c_p = (void *)((struct tlv *)&buf[ret])->value;
1898 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_CRC32C, sizeof(zero_crc32c), (const char *)&zero_crc32c);
1899 }
1900
Ilya Shipitsinca56fce2018-09-15 00:50:05 +05001901 if (remote && conn_get_alpn(remote, &value, &value_len)) {
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001902 if ((buf_len - ret) < sizeof(struct tlv))
1903 return 0;
Emmanuel Hocdet571c7ac2017-10-31 18:24:05 +01001904 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_ALPN, value_len, value);
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001905 }
1906
Emmanuel Hocdet253c3b72018-02-01 18:29:59 +01001907 if (srv->pp_opts & SRV_PP_V2_AUTHORITY) {
Emmanuel Hocdet8a4ffa02019-08-29 11:54:51 +02001908 value = NULL;
Tim Duesterhus615f81e2021-03-06 20:06:50 +01001909 if (remote && isttest(remote->proxy_authority)) {
1910 value = istptr(remote->proxy_authority);
1911 value_len = istlen(remote->proxy_authority);
Emmanuel Hocdet8a4ffa02019-08-29 11:54:51 +02001912 }
1913#ifdef USE_OPENSSL
1914 else {
Jerome Magnin78891c72019-09-02 09:53:41 +02001915 if ((value = ssl_sock_get_sni(remote)))
Emmanuel Hocdet8a4ffa02019-08-29 11:54:51 +02001916 value_len = strlen(value);
1917 }
1918#endif
Emmanuel Hocdet253c3b72018-02-01 18:29:59 +01001919 if (value) {
1920 if ((buf_len - ret) < sizeof(struct tlv))
1921 return 0;
Emmanuel Hocdet8a4ffa02019-08-29 11:54:51 +02001922 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_AUTHORITY, value_len, value);
Emmanuel Hocdet253c3b72018-02-01 18:29:59 +01001923 }
1924 }
1925
Christopher Faulet3ab504f2020-05-26 15:16:01 +02001926 if (strm && (srv->pp_opts & SRV_PP_V2_UNIQUE_ID)) {
Tim Duesterhuscf6e0c82020-03-13 12:34:24 +01001927 struct session* sess = strm_sess(strm);
1928 struct ist unique_id = stream_generate_unique_id(strm, &sess->fe->format_unique_id);
1929
1930 value = unique_id.ptr;
1931 value_len = unique_id.len;
1932
1933 if (value_len >= 0) {
1934 if ((buf_len - ret) < sizeof(struct tlv))
1935 return 0;
1936 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_UNIQUE_ID, value_len, value);
1937 }
1938 }
1939
Emmanuel Hocdet8a4ffa02019-08-29 11:54:51 +02001940#ifdef USE_OPENSSL
David Safb76832014-05-08 23:42:08 -04001941 if (srv->pp_opts & SRV_PP_V2_SSL) {
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001942 struct tlv_ssl *tlv;
1943 int ssl_tlv_len = 0;
Tim Duesterhusa8692f32020-03-13 12:34:25 +01001944
David Safb76832014-05-08 23:42:08 -04001945 if ((buf_len - ret) < sizeof(struct tlv_ssl))
1946 return 0;
1947 tlv = (struct tlv_ssl *)&buf[ret];
1948 memset(tlv, 0, sizeof(struct tlv_ssl));
1949 ssl_tlv_len += sizeof(struct tlv_ssl);
1950 tlv->tlv.type = PP2_TYPE_SSL;
Willy Tarreau1057bee2021-10-06 11:38:44 +02001951 if (conn_is_ssl(remote)) {
David Safb76832014-05-08 23:42:08 -04001952 tlv->client |= PP2_CLIENT_SSL;
Emmanuel Hocdet01da5712017-10-13 16:59:49 +02001953 value = ssl_sock_get_proto_version(remote);
David Safb76832014-05-08 23:42:08 -04001954 if (value) {
Emmanuel Hocdet8c0c34b2018-02-28 12:02:14 +01001955 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len-ret-ssl_tlv_len), PP2_SUBTYPE_SSL_VERSION, strlen(value), value);
David Safb76832014-05-08 23:42:08 -04001956 }
Dave McCowan328fb582014-07-30 10:39:13 -04001957 if (ssl_sock_get_cert_used_sess(remote)) {
1958 tlv->client |= PP2_CLIENT_CERT_SESS;
David Safb76832014-05-08 23:42:08 -04001959 tlv->verify = htonl(ssl_sock_get_verify_result(remote));
Dave McCowan328fb582014-07-30 10:39:13 -04001960 if (ssl_sock_get_cert_used_conn(remote))
1961 tlv->client |= PP2_CLIENT_CERT_CONN;
David Safb76832014-05-08 23:42:08 -04001962 }
1963 if (srv->pp_opts & SRV_PP_V2_SSL_CN) {
Willy Tarreau83061a82018-07-13 11:56:34 +02001964 struct buffer *cn_trash = get_trash_chunk();
Willy Tarreau3b9a0c92014-07-19 06:37:33 +02001965 if (ssl_sock_get_remote_common_name(remote, cn_trash) > 0) {
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001966 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_CN,
1967 cn_trash->data,
1968 cn_trash->area);
David Safb76832014-05-08 23:42:08 -04001969 }
1970 }
Emmanuel Hocdetfa8d0f12018-02-01 15:53:52 +01001971 if (srv->pp_opts & SRV_PP_V2_SSL_KEY_ALG) {
Willy Tarreau83061a82018-07-13 11:56:34 +02001972 struct buffer *pkey_trash = get_trash_chunk();
Emmanuel Hocdetfa8d0f12018-02-01 15:53:52 +01001973 if (ssl_sock_get_pkey_algo(remote, pkey_trash) > 0) {
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001974 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_KEY_ALG,
1975 pkey_trash->data,
1976 pkey_trash->area);
Emmanuel Hocdetfa8d0f12018-02-01 15:53:52 +01001977 }
1978 }
1979 if (srv->pp_opts & SRV_PP_V2_SSL_SIG_ALG) {
1980 value = ssl_sock_get_cert_sig(remote);
1981 if (value) {
1982 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_SIG_ALG, strlen(value), value);
1983 }
1984 }
1985 if (srv->pp_opts & SRV_PP_V2_SSL_CIPHER) {
1986 value = ssl_sock_get_cipher_name(remote);
1987 if (value) {
1988 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_CIPHER, strlen(value), value);
1989 }
1990 }
David Safb76832014-05-08 23:42:08 -04001991 }
1992 tlv->tlv.length_hi = (uint16_t)(ssl_tlv_len - sizeof(struct tlv)) >> 8;
1993 tlv->tlv.length_lo = (uint16_t)(ssl_tlv_len - sizeof(struct tlv)) & 0x00ff;
1994 ret += ssl_tlv_len;
1995 }
1996#endif
1997
Willy Tarreaue5733232019-05-22 19:24:06 +02001998#ifdef USE_NS
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001999 if (remote && (remote->proxy_netns)) {
2000 if ((buf_len - ret) < sizeof(struct tlv))
2001 return 0;
Emmanuel Hocdet571c7ac2017-10-31 18:24:05 +01002002 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_NETNS, remote->proxy_netns->name_len, remote->proxy_netns->node.key);
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01002003 }
2004#endif
2005
Willy Tarreau8fccfa22014-06-14 08:28:06 +02002006 hdr->len = htons((uint16_t)(ret - PP2_HEADER_LEN));
David Safb76832014-05-08 23:42:08 -04002007
Emmanuel Hocdet4399c752018-02-05 15:26:43 +01002008 if (tlv_crc32c_p) {
2009 write_u32(tlv_crc32c_p, htonl(hash_crc32c(buf, ret)));
2010 }
2011
David Safb76832014-05-08 23:42:08 -04002012 return ret;
2013}
Emeric Brun4f603012017-01-05 15:11:44 +01002014
Christopher Faulet4bfce392021-10-22 14:33:59 +02002015/* Note: <remote> is explicitly allowed to be NULL */
2016int make_proxy_line(char *buf, int buf_len, struct server *srv, struct connection *remote, struct stream *strm)
2017{
2018 int ret = 0;
2019
2020 if (srv && (srv->pp_opts & SRV_PP_V2)) {
2021 ret = make_proxy_line_v2(buf, buf_len, srv, remote, strm);
2022 }
2023 else {
Christopher Fauletb097aef2021-10-25 08:05:28 +02002024 const struct sockaddr_storage *src = NULL;
2025 const struct sockaddr_storage *dst = NULL;
2026
2027 if (strm) {
Christopher Faulet8da67aa2022-03-29 17:53:09 +02002028 src = cs_src(strm->csf);
2029 dst = cs_dst(strm->csf);
Christopher Fauletb097aef2021-10-25 08:05:28 +02002030 }
2031 else if (remote && conn_get_src(remote) && conn_get_dst(remote)) {
2032 src = conn_src(remote);
2033 dst = conn_dst(remote);
2034 }
2035
2036 if (src && dst)
2037 ret = make_proxy_line_v1(buf, buf_len, src, dst);
Christopher Faulet4bfce392021-10-22 14:33:59 +02002038 else
2039 ret = make_proxy_line_v1(buf, buf_len, NULL, NULL);
2040 }
2041
2042 return ret;
2043}
2044
Willy Tarreau119e50e2020-05-22 13:53:29 +02002045/* returns 0 on success */
2046static int cfg_parse_pp2_never_send_local(char **args, int section_type, struct proxy *curpx,
Willy Tarreau01825162021-03-09 09:53:46 +01002047 const struct proxy *defpx, const char *file, int line,
Willy Tarreau119e50e2020-05-22 13:53:29 +02002048 char **err)
2049{
2050 if (too_many_args(0, args, err, NULL))
2051 return -1;
2052 pp2_never_send_local = 1;
2053 return 0;
2054}
2055
Willy Tarreaud943a042021-06-16 17:35:20 +02002056/* extracts some info from the connection and appends them to buffer <buf>. The
2057 * connection's pointer, its direction, target (fe/be/srv), xprt/ctrl, source
2058 * when set, destination when set, are printed in a compact human-readable format
2059 * fitting on a single line. This is handy to complete traces or debug output.
2060 * It is permitted to pass a NULL conn pointer. The number of characters emitted
2061 * is returned. A prefix <pfx> might be prepended before the first field if not
2062 * NULL.
2063 */
2064int conn_append_debug_info(struct buffer *buf, const struct connection *conn, const char *pfx)
2065{
2066 const struct listener *li;
2067 const struct server *sv;
2068 const struct proxy *px;
2069 char addr[40];
2070 int old_len = buf->data;
2071
2072 if (!conn)
2073 return 0;
2074
2075 chunk_appendf(buf, "%sconn=%p(%s)", pfx ? pfx : "", conn, conn_is_back(conn) ? "OUT" : "IN");
2076
2077 if ((li = objt_listener(conn->target)))
2078 chunk_appendf(buf, " fe=%s", li->bind_conf->frontend->id);
2079 else if ((sv = objt_server(conn->target)))
2080 chunk_appendf(buf, " sv=%s/%s", sv->proxy->id, sv->id);
2081 else if ((px = objt_proxy(conn->target)))
2082 chunk_appendf(buf, " be=%s", px->id);
2083
2084 chunk_appendf(buf, " %s/%s", conn_get_xprt_name(conn), conn_get_ctrl_name(conn));
2085
Willy Tarreau030b3e62022-05-02 17:47:46 +02002086 if (conn->src && addr_to_str(conn->src, addr, sizeof(addr)))
Willy Tarreaud943a042021-06-16 17:35:20 +02002087 chunk_appendf(buf, " src=%s:%d", addr, get_host_port(conn->src));
2088
Willy Tarreau030b3e62022-05-02 17:47:46 +02002089 if (conn->dst && addr_to_str(conn->dst, addr, sizeof(addr)))
Willy Tarreaud943a042021-06-16 17:35:20 +02002090 chunk_appendf(buf, " dst=%s:%d", addr, get_host_port(conn->dst));
2091
2092 return buf->data - old_len;
2093}
2094
Willy Tarreau60ca10a2017-08-18 15:26:54 +02002095/* return the major HTTP version as 1 or 2 depending on how the request arrived
2096 * before being processed.
Christopher Fauletf4dd9ae2021-04-14 15:40:30 +02002097 *
2098 * WARNING: Should be updated if a new major HTTP version is added.
Willy Tarreau60ca10a2017-08-18 15:26:54 +02002099 */
2100static int
2101smp_fetch_fc_http_major(const struct arg *args, struct sample *smp, const char *kw, void *private)
2102{
Christopher Faulet242f8ce2021-04-14 15:46:49 +02002103 struct connection *conn = NULL;
2104
2105 if (obj_type(smp->sess->origin) == OBJ_TYPE_CHECK)
2106 conn = (kw[0] == 'b') ? cs_conn(__objt_check(smp->sess->origin)->cs) : NULL;
2107 else
2108 conn = (kw[0] != 'b') ? objt_conn(smp->sess->origin) :
Christopher Faulet95a61e82021-12-22 14:22:03 +01002109 smp->strm ? cs_conn(smp->strm->csb) : NULL;
Willy Tarreau60ca10a2017-08-18 15:26:54 +02002110
Christopher Fauletf4dd9ae2021-04-14 15:40:30 +02002111 /* No connection or a connection with a RAW muxx */
2112 if (!conn || (conn->mux && !(conn->mux->flags & MX_FL_HTX)))
2113 return 0;
2114
2115 /* No mux install, this may change */
2116 if (!conn->mux) {
2117 smp->flags |= SMP_F_MAY_CHANGE;
2118 return 0;
2119 }
2120
Willy Tarreau60ca10a2017-08-18 15:26:54 +02002121 smp->data.type = SMP_T_SINT;
Christopher Fauletf4dd9ae2021-04-14 15:40:30 +02002122 smp->data.u.sint = (strcmp(conn_get_mux_name(conn), "H2") == 0) ? 2 : 1;
Willy Tarreau60ca10a2017-08-18 15:26:54 +02002123 return 1;
2124}
2125
Emeric Brun4f603012017-01-05 15:11:44 +01002126/* fetch if the received connection used a PROXY protocol header */
2127int smp_fetch_fc_rcvd_proxy(const struct arg *args, struct sample *smp, const char *kw, void *private)
2128{
2129 struct connection *conn;
2130
2131 conn = objt_conn(smp->sess->origin);
2132 if (!conn)
2133 return 0;
2134
Willy Tarreau911db9b2020-01-23 16:27:54 +01002135 if (conn->flags & CO_FL_WAIT_XPRT) {
Emeric Brun4f603012017-01-05 15:11:44 +01002136 smp->flags |= SMP_F_MAY_CHANGE;
2137 return 0;
2138 }
2139
2140 smp->flags = 0;
2141 smp->data.type = SMP_T_BOOL;
2142 smp->data.u.sint = (conn->flags & CO_FL_RCVD_PROXY) ? 1 : 0;
2143
2144 return 1;
2145}
2146
Geoff Simmons7185b782019-08-27 18:31:16 +02002147/* fetch the authority TLV from a PROXY protocol header */
2148int smp_fetch_fc_pp_authority(const struct arg *args, struct sample *smp, const char *kw, void *private)
2149{
2150 struct connection *conn;
2151
2152 conn = objt_conn(smp->sess->origin);
2153 if (!conn)
2154 return 0;
2155
Willy Tarreau911db9b2020-01-23 16:27:54 +01002156 if (conn->flags & CO_FL_WAIT_XPRT) {
Geoff Simmons7185b782019-08-27 18:31:16 +02002157 smp->flags |= SMP_F_MAY_CHANGE;
2158 return 0;
2159 }
2160
Tim Duesterhus615f81e2021-03-06 20:06:50 +01002161 if (!isttest(conn->proxy_authority))
Geoff Simmons7185b782019-08-27 18:31:16 +02002162 return 0;
2163
2164 smp->flags = 0;
2165 smp->data.type = SMP_T_STR;
Tim Duesterhus615f81e2021-03-06 20:06:50 +01002166 smp->data.u.str.area = istptr(conn->proxy_authority);
2167 smp->data.u.str.data = istlen(conn->proxy_authority);
Geoff Simmons7185b782019-08-27 18:31:16 +02002168
2169 return 1;
2170}
2171
Tim Duesterhusd1b15b62020-03-13 12:34:23 +01002172/* fetch the unique ID TLV from a PROXY protocol header */
2173int smp_fetch_fc_pp_unique_id(const struct arg *args, struct sample *smp, const char *kw, void *private)
2174{
2175 struct connection *conn;
2176
2177 conn = objt_conn(smp->sess->origin);
2178 if (!conn)
2179 return 0;
2180
2181 if (conn->flags & CO_FL_WAIT_XPRT) {
2182 smp->flags |= SMP_F_MAY_CHANGE;
2183 return 0;
2184 }
2185
2186 if (!isttest(conn->proxy_unique_id))
2187 return 0;
2188
2189 smp->flags = 0;
2190 smp->data.type = SMP_T_STR;
Tim Duesterhus002bd772021-03-06 20:06:49 +01002191 smp->data.u.str.area = istptr(conn->proxy_unique_id);
2192 smp->data.u.str.data = istlen(conn->proxy_unique_id);
Tim Duesterhusd1b15b62020-03-13 12:34:23 +01002193
2194 return 1;
2195}
2196
Remi Tricot-Le Breton3d2093a2021-07-29 09:45:49 +02002197/* fetch the error code of a connection */
Willy Tarreau6f749762021-11-05 17:07:03 +01002198int smp_fetch_fc_err(const struct arg *args, struct sample *smp, const char *kw, void *private)
Remi Tricot-Le Breton3d2093a2021-07-29 09:45:49 +02002199{
2200 struct connection *conn;
2201
Remi Tricot-Le Breton942c1672021-09-01 15:52:15 +02002202 if (obj_type(smp->sess->origin) == OBJ_TYPE_CHECK)
2203 conn = (kw[0] == 'b') ? cs_conn(__objt_check(smp->sess->origin)->cs) : NULL;
2204 else
2205 conn = (kw[0] != 'b') ? objt_conn(smp->sess->origin) :
Christopher Faulet95a61e82021-12-22 14:22:03 +01002206 smp->strm ? cs_conn(smp->strm->csb) : NULL;
Remi Tricot-Le Breton942c1672021-09-01 15:52:15 +02002207
Remi Tricot-Le Breton3d2093a2021-07-29 09:45:49 +02002208 if (!conn)
2209 return 0;
2210
2211 if (conn->flags & CO_FL_WAIT_XPRT && !conn->err_code) {
2212 smp->flags |= SMP_F_MAY_CHANGE;
2213 return 0;
2214 }
2215
2216 smp->flags = 0;
2217 smp->data.type = SMP_T_SINT;
2218 smp->data.u.sint = (unsigned long long int)conn->err_code;
2219
2220 return 1;
2221}
2222
2223/* fetch a string representation of the error code of a connection */
Willy Tarreau6f749762021-11-05 17:07:03 +01002224int smp_fetch_fc_err_str(const struct arg *args, struct sample *smp, const char *kw, void *private)
Remi Tricot-Le Breton3d2093a2021-07-29 09:45:49 +02002225{
2226 struct connection *conn;
2227 const char *err_code_str;
2228
Remi Tricot-Le Breton942c1672021-09-01 15:52:15 +02002229 if (obj_type(smp->sess->origin) == OBJ_TYPE_CHECK)
2230 conn = (kw[0] == 'b') ? cs_conn(__objt_check(smp->sess->origin)->cs) : NULL;
2231 else
2232 conn = (kw[0] != 'b') ? objt_conn(smp->sess->origin) :
Christopher Faulet95a61e82021-12-22 14:22:03 +01002233 smp->strm ? cs_conn(smp->strm->csb) : NULL;
Remi Tricot-Le Breton942c1672021-09-01 15:52:15 +02002234
Remi Tricot-Le Breton3d2093a2021-07-29 09:45:49 +02002235 if (!conn)
2236 return 0;
2237
2238 if (conn->flags & CO_FL_WAIT_XPRT && !conn->err_code) {
2239 smp->flags |= SMP_F_MAY_CHANGE;
2240 return 0;
2241 }
2242
2243 err_code_str = conn_err_code_str(conn);
2244
2245 if (!err_code_str)
2246 return 0;
2247
2248 smp->flags = 0;
2249 smp->data.type = SMP_T_STR;
2250 smp->data.u.str.area = (char*)err_code_str;
2251 smp->data.u.str.data = strlen(err_code_str);
2252
2253 return 1;
2254}
2255
Emeric Brun4f603012017-01-05 15:11:44 +01002256/* Note: must not be declared <const> as its list will be overwritten.
2257 * Note: fetches that may return multiple types must be declared as the lowest
2258 * common denominator, the type that can be casted into all other ones. For
2259 * instance v4/v6 must be declared v4.
2260 */
2261static struct sample_fetch_kw_list sample_fetch_keywords = {ILH, {
Willy Tarreau6f749762021-11-05 17:07:03 +01002262 { "bc_err", smp_fetch_fc_err, 0, NULL, SMP_T_SINT, SMP_USE_L4SRV },
2263 { "bc_err_str", smp_fetch_fc_err_str, 0, NULL, SMP_T_STR, SMP_USE_L4SRV },
Jérôme Magnin86577422018-12-07 09:03:11 +01002264 { "bc_http_major", smp_fetch_fc_http_major, 0, NULL, SMP_T_SINT, SMP_USE_L4SRV },
Willy Tarreau6f749762021-11-05 17:07:03 +01002265 { "fc_err", smp_fetch_fc_err, 0, NULL, SMP_T_SINT, SMP_USE_L4CLI },
2266 { "fc_err_str", smp_fetch_fc_err_str, 0, NULL, SMP_T_STR, SMP_USE_L4CLI },
2267 { "fc_http_major", smp_fetch_fc_http_major, 0, NULL, SMP_T_SINT, SMP_USE_L4CLI },
Emeric Brun4f603012017-01-05 15:11:44 +01002268 { "fc_rcvd_proxy", smp_fetch_fc_rcvd_proxy, 0, NULL, SMP_T_BOOL, SMP_USE_L4CLI },
Geoff Simmons7185b782019-08-27 18:31:16 +02002269 { "fc_pp_authority", smp_fetch_fc_pp_authority, 0, NULL, SMP_T_STR, SMP_USE_L4CLI },
Tim Duesterhusd1b15b62020-03-13 12:34:23 +01002270 { "fc_pp_unique_id", smp_fetch_fc_pp_unique_id, 0, NULL, SMP_T_STR, SMP_USE_L4CLI },
Emeric Brun4f603012017-01-05 15:11:44 +01002271 { /* END */ },
2272}};
2273
Willy Tarreau0108d902018-11-25 19:14:37 +01002274INITCALL1(STG_REGISTER, sample_register_fetches, &sample_fetch_keywords);
Willy Tarreau119e50e2020-05-22 13:53:29 +02002275
2276static struct cfg_kw_list cfg_kws = {ILH, {
2277 { CFG_GLOBAL, "pp2-never-send-local", cfg_parse_pp2_never_send_local },
2278 { /* END */ },
2279}};
2280
2281INITCALL1(STG_REGISTER, cfg_register_keywords, &cfg_kws);
Amaury Denoyelle81c6f762021-01-18 14:57:50 +01002282
Amaury Denoyelle01a287f2021-02-11 16:46:53 +01002283/* private function to handle sockaddr as input for connection hash */
2284static void conn_calculate_hash_sockaddr(const struct sockaddr_storage *ss,
2285 char *buf, size_t *idx,
2286 enum conn_hash_params_t *hash_flags,
2287 enum conn_hash_params_t param_type_addr,
2288 enum conn_hash_params_t param_type_port)
2289{
2290 struct sockaddr_in *addr;
2291 struct sockaddr_in6 *addr6;
2292
2293 switch (ss->ss_family) {
2294 case AF_INET:
2295 addr = (struct sockaddr_in *)ss;
2296
2297 conn_hash_update(buf, idx,
2298 &addr->sin_addr, sizeof(addr->sin_addr),
2299 hash_flags, param_type_addr);
2300
2301 if (addr->sin_port) {
2302 conn_hash_update(buf, idx,
2303 &addr->sin_port, sizeof(addr->sin_port),
2304 hash_flags, param_type_port);
2305 }
2306
2307 break;
2308
2309 case AF_INET6:
2310 addr6 = (struct sockaddr_in6 *)ss;
2311
2312 conn_hash_update(buf, idx,
2313 &addr6->sin6_addr, sizeof(addr6->sin6_addr),
2314 hash_flags, param_type_addr);
2315
2316 if (addr6->sin6_port) {
2317 conn_hash_update(buf, idx,
2318 &addr6->sin6_port, sizeof(addr6->sin6_port),
2319 hash_flags, param_type_port);
2320 }
2321
2322 break;
2323 }
2324}
2325
Willy Tarreaue5983ff2021-10-06 17:14:49 +02002326/* Generate the hash of a connection with params as input
2327 * Each non-null field of params is taken into account for the hash calcul.
2328 */
2329uint64_t conn_hash_prehash(char *buf, size_t size)
2330{
2331 return XXH64(buf, size, 0);
2332}
2333
2334/* Append <data> into <buf> at <idx> offset in preparation for connection hash
2335 * calcul. <idx> is incremented beyond data <size>. In the same time, <flags>
2336 * are updated with <type> for the hash header.
2337 */
2338void conn_hash_update(char *buf, size_t *idx,
2339 const void *data, size_t size,
2340 enum conn_hash_params_t *flags,
2341 enum conn_hash_params_t type)
2342{
2343 memcpy(&buf[*idx], data, size);
2344 *idx += size;
2345 *flags |= type;
2346}
2347
2348uint64_t conn_hash_digest(char *buf, size_t bufsize,
2349 enum conn_hash_params_t flags)
2350{
2351 const uint64_t flags_u64 = (uint64_t)flags;
2352 const uint64_t hash = XXH64(buf, bufsize, 0);
2353
2354 return (flags_u64 << CONN_HASH_PAYLOAD_LEN) | CONN_HASH_GET_PAYLOAD(hash);
2355}
2356
Willy Tarreaufd21c6c2021-10-06 17:09:41 +02002357uint64_t conn_calculate_hash(const struct conn_hash_params *params)
Amaury Denoyelle81c6f762021-01-18 14:57:50 +01002358{
2359 char *buf;
2360 size_t idx = 0;
Willy Tarreaufd21c6c2021-10-06 17:09:41 +02002361 uint64_t hash = 0;
Amaury Denoyelle81c6f762021-01-18 14:57:50 +01002362 enum conn_hash_params_t hash_flags = 0;
2363
2364 buf = trash.area;
2365
Amaury Denoyelle8ede3db2021-03-02 14:38:53 +01002366 conn_hash_update(buf, &idx, &params->target, sizeof(params->target), &hash_flags, 0);
Amaury Denoyelle1a58aca2021-01-22 16:47:46 +01002367
Amaury Denoyelle9b626e32021-01-06 17:03:27 +01002368 if (params->sni_prehash) {
2369 conn_hash_update(buf, &idx,
Amaury Denoyelle36441f42021-02-17 16:25:31 +01002370 &params->sni_prehash, sizeof(params->sni_prehash),
Amaury Denoyelle9b626e32021-01-06 17:03:27 +01002371 &hash_flags, CONN_HASH_PARAMS_TYPE_SNI);
2372 }
2373
Amaury Denoyelle01a287f2021-02-11 16:46:53 +01002374 if (params->dst_addr) {
2375 conn_calculate_hash_sockaddr(params->dst_addr,
2376 buf, &idx, &hash_flags,
2377 CONN_HASH_PARAMS_TYPE_DST_ADDR,
2378 CONN_HASH_PARAMS_TYPE_DST_PORT);
2379 }
2380
Amaury Denoyelled10a2002021-02-11 19:45:19 +01002381 if (params->src_addr) {
2382 conn_calculate_hash_sockaddr(params->src_addr,
2383 buf, &idx, &hash_flags,
2384 CONN_HASH_PARAMS_TYPE_SRC_ADDR,
2385 CONN_HASH_PARAMS_TYPE_SRC_PORT);
2386 }
2387
Amaury Denoyelle1921d202021-01-14 10:15:29 +01002388 if (params->proxy_prehash) {
2389 conn_hash_update(buf, &idx,
Amaury Denoyelle36441f42021-02-17 16:25:31 +01002390 &params->proxy_prehash, sizeof(params->proxy_prehash),
Amaury Denoyelle1921d202021-01-14 10:15:29 +01002391 &hash_flags, CONN_HASH_PARAMS_TYPE_PROXY);
2392 }
Amaury Denoyelle01a287f2021-02-11 16:46:53 +01002393
Amaury Denoyelle1921d202021-01-14 10:15:29 +01002394 hash = conn_hash_digest(buf, idx, hash_flags);
Amaury Denoyelle81c6f762021-01-18 14:57:50 +01002395 return hash;
2396}
Amaury Denoyelle48372932021-09-16 12:15:12 +02002397
2398/* Handler of the task of mux_stopping_data.
2399 * Called on soft-stop.
2400 */
2401static struct task *mux_stopping_process(struct task *t, void *ctx, unsigned int state)
2402{
2403 struct connection *conn, *back;
2404
2405 list_for_each_entry_safe(conn, back, &mux_stopping_data[tid].list, stopping_list) {
2406 if (conn->mux && conn->mux->wake)
2407 conn->mux->wake(conn);
2408 }
2409
2410 return t;
2411}
2412
2413static int allocate_mux_cleanup(void)
2414{
2415 /* allocates the thread bound mux_stopping_data task */
Willy Tarreaubeeabf52021-10-01 18:23:30 +02002416 mux_stopping_data[tid].task = task_new_here();
Amaury Denoyelle48372932021-09-16 12:15:12 +02002417 if (!mux_stopping_data[tid].task) {
2418 ha_alert("Failed to allocate the task for connection cleanup on thread %d.\n", tid);
2419 return 0;
2420 }
2421
2422 mux_stopping_data[tid].task->process = mux_stopping_process;
2423 LIST_INIT(&mux_stopping_data[tid].list);
2424
2425 return 1;
2426}
2427REGISTER_PER_THREAD_ALLOC(allocate_mux_cleanup);
2428
2429static int deallocate_mux_cleanup(void)
2430{
2431 task_destroy(mux_stopping_data[tid].task);
2432 return 1;
2433}
2434REGISTER_PER_THREAD_FREE(deallocate_mux_cleanup);
Willy Tarreaufaafe4b2022-04-27 18:53:07 +02002435
2436static void deinit_idle_conns(void)
2437{
2438 int i;
2439
2440 for (i = 0; i < global.nbthread; i++) {
2441 if (idle_conns[i].cleanup_task)
2442 task_destroy(idle_conns[i].cleanup_task);
2443 }
2444}
2445REGISTER_POST_DEINIT(deinit_idle_conns);