blob: 65c4fdad379e3af349ced64fa3423b17414f742e [file] [log] [blame]
Willy Tarreaue6b98942007-10-29 01:09:36 +01001/*
2 * AF_INET/AF_INET6 SOCK_STREAM protocol layer (tcp)
3 *
Willy Tarreaud4c33c82013-01-07 21:59:07 +01004 * Copyright 2000-2013 Willy Tarreau <w@1wt.eu>
Willy Tarreaue6b98942007-10-29 01:09:36 +01005 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
13#include <ctype.h>
14#include <errno.h>
15#include <fcntl.h>
16#include <stdio.h>
17#include <stdlib.h>
18#include <string.h>
19#include <time.h>
20
21#include <sys/param.h>
22#include <sys/socket.h>
23#include <sys/stat.h>
24#include <sys/types.h>
25#include <sys/un.h>
26
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +040027#include <netinet/tcp.h>
28
Willy Tarreaub6866442008-07-14 23:54:42 +020029#include <common/cfgparse.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010030#include <common/compat.h>
31#include <common/config.h>
32#include <common/debug.h>
33#include <common/errors.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010034#include <common/mini-clist.h>
35#include <common/standard.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010036
Willy Tarreaue6b98942007-10-29 01:09:36 +010037#include <types/global.h>
Willy Tarreau18bf01e2014-06-13 16:18:52 +020038#include <types/capture.h>
Willy Tarreau9650f372009-08-16 14:02:45 +020039#include <types/server.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010040
41#include <proto/acl.h>
Willy Tarreau9fcb9842012-04-20 14:45:49 +020042#include <proto/arg.h>
Willy Tarreauc7e42382012-08-24 19:22:53 +020043#include <proto/channel.h>
Willy Tarreaud2274c62012-07-06 14:29:45 +020044#include <proto/connection.h>
Willy Tarreaudd2f85e2012-09-02 22:34:23 +020045#include <proto/fd.h>
Willy Tarreaud1d54542012-09-12 22:58:11 +020046#include <proto/listener.h>
Willy Tarreau9650f372009-08-16 14:02:45 +020047#include <proto/log.h>
48#include <proto/port_range.h>
Willy Tarreaud1d54542012-09-12 22:58:11 +020049#include <proto/protocol.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010050#include <proto/proto_tcp.h>
Willy Tarreaub6866442008-07-14 23:54:42 +020051#include <proto/proxy.h>
Willy Tarreaucd3b0942012-04-27 21:52:18 +020052#include <proto/sample.h>
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +020053#include <proto/session.h>
Willy Tarreaua975b8f2010-06-05 19:13:27 +020054#include <proto/stick_table.h>
Willy Tarreaucc1e04b2013-09-11 23:20:29 +020055#include <proto/stream_interface.h>
Willy Tarreaua975b8f2010-06-05 19:13:27 +020056#include <proto/task.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010057
Willy Tarreaue8c66af2008-01-13 18:40:14 +010058#ifdef CONFIG_HAP_CTTPROXY
59#include <import/ip_tproxy.h>
60#endif
61
Emeric Bruncf20bf12010-10-22 16:06:11 +020062static int tcp_bind_listeners(struct protocol *proto, char *errmsg, int errlen);
63static int tcp_bind_listener(struct listener *listener, char *errmsg, int errlen);
Willy Tarreaue6b98942007-10-29 01:09:36 +010064
65/* Note: must not be declared <const> as its list will be overwritten */
66static struct protocol proto_tcpv4 = {
67 .name = "tcpv4",
68 .sock_domain = AF_INET,
69 .sock_type = SOCK_STREAM,
70 .sock_prot = IPPROTO_TCP,
71 .sock_family = AF_INET,
72 .sock_addrlen = sizeof(struct sockaddr_in),
73 .l3_addrlen = 32/8,
Willy Tarreaubbebbbf2012-05-07 21:22:09 +020074 .accept = &listener_accept,
Willy Tarreau26d8c592012-05-07 18:12:14 +020075 .connect = tcp_connect_server,
Emeric Bruncf20bf12010-10-22 16:06:11 +020076 .bind = tcp_bind_listener,
Willy Tarreaue6b98942007-10-29 01:09:36 +010077 .bind_all = tcp_bind_listeners,
78 .unbind_all = unbind_all_listeners,
79 .enable_all = enable_all_listeners,
Willy Tarreau59b94792012-05-11 16:16:40 +020080 .get_src = tcp_get_src,
81 .get_dst = tcp_get_dst,
Willy Tarreau2b57cb82013-06-10 19:56:38 +020082 .drain = tcp_drain,
Willy Tarreaue6b98942007-10-29 01:09:36 +010083 .listeners = LIST_HEAD_INIT(proto_tcpv4.listeners),
84 .nb_listeners = 0,
85};
86
87/* Note: must not be declared <const> as its list will be overwritten */
88static struct protocol proto_tcpv6 = {
89 .name = "tcpv6",
90 .sock_domain = AF_INET6,
91 .sock_type = SOCK_STREAM,
92 .sock_prot = IPPROTO_TCP,
93 .sock_family = AF_INET6,
94 .sock_addrlen = sizeof(struct sockaddr_in6),
95 .l3_addrlen = 128/8,
Willy Tarreaubbebbbf2012-05-07 21:22:09 +020096 .accept = &listener_accept,
Willy Tarreau26d8c592012-05-07 18:12:14 +020097 .connect = tcp_connect_server,
Emeric Bruncf20bf12010-10-22 16:06:11 +020098 .bind = tcp_bind_listener,
Willy Tarreaue6b98942007-10-29 01:09:36 +010099 .bind_all = tcp_bind_listeners,
100 .unbind_all = unbind_all_listeners,
101 .enable_all = enable_all_listeners,
Willy Tarreau59b94792012-05-11 16:16:40 +0200102 .get_src = tcp_get_src,
103 .get_dst = tcp_get_dst,
Willy Tarreau2b57cb82013-06-10 19:56:38 +0200104 .drain = tcp_drain,
Willy Tarreaue6b98942007-10-29 01:09:36 +0100105 .listeners = LIST_HEAD_INIT(proto_tcpv6.listeners),
106 .nb_listeners = 0,
107};
108
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100109
David du Colombier6f5ccb12011-03-10 22:26:24 +0100110/* Binds ipv4/ipv6 address <local> to socket <fd>, unless <flags> is set, in which
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100111 * case we try to bind <remote>. <flags> is a 2-bit field consisting of :
112 * - 0 : ignore remote address (may even be a NULL pointer)
113 * - 1 : use provided address
114 * - 2 : use provided port
115 * - 3 : use both
116 *
117 * The function supports multiple foreign binding methods :
118 * - linux_tproxy: we directly bind to the foreign address
119 * - cttproxy: we bind to a local address then nat.
120 * The second one can be used as a fallback for the first one.
121 * This function returns 0 when everything's OK, 1 if it could not bind, to the
122 * local address, 2 if it could not bind to the foreign address.
123 */
David du Colombier6f5ccb12011-03-10 22:26:24 +0100124int tcp_bind_socket(int fd, int flags, struct sockaddr_storage *local, struct sockaddr_storage *remote)
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100125{
David du Colombier6f5ccb12011-03-10 22:26:24 +0100126 struct sockaddr_storage bind_addr;
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100127 int foreign_ok = 0;
128 int ret;
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100129 static int ip_transp_working = 1;
David du Colombier65c17962012-07-13 14:34:59 +0200130 static int ip6_transp_working = 1;
Pieter Baauwd551fb52013-05-08 22:49:23 +0200131
David du Colombier65c17962012-07-13 14:34:59 +0200132 switch (local->ss_family) {
133 case AF_INET:
134 if (flags && ip_transp_working) {
Pieter Baauwd551fb52013-05-08 22:49:23 +0200135 /* This deserves some explanation. Some platforms will support
136 * multiple combinations of certain methods, so we try the
137 * supported ones until one succeeds.
138 */
139 if (0
140#if defined(IP_TRANSPARENT)
141 || (setsockopt(fd, SOL_IP, IP_TRANSPARENT, &one, sizeof(one)) == 0)
142#endif
143#if defined(IP_FREEBIND)
144 || (setsockopt(fd, SOL_IP, IP_FREEBIND, &one, sizeof(one)) == 0)
145#endif
Pieter Baauwff30b662013-05-08 23:22:39 +0200146#if defined(IP_BINDANY)
147 || (setsockopt(fd, IPPROTO_IP, IP_BINDANY, &one, sizeof(one)) == 0)
148#endif
Pieter Baauw1eb75922013-05-08 23:30:23 +0200149#if defined(SO_BINDANY)
150 || (setsockopt(fd, SOL_SOCKET, SO_BINDANY, &one, sizeof(one)) == 0)
151#endif
Pieter Baauwd551fb52013-05-08 22:49:23 +0200152 )
David du Colombier65c17962012-07-13 14:34:59 +0200153 foreign_ok = 1;
154 else
155 ip_transp_working = 0;
156 }
157 break;
158 case AF_INET6:
159 if (flags && ip6_transp_working) {
Pieter Baauwd551fb52013-05-08 22:49:23 +0200160 if (0
161#if defined(IPV6_TRANSPARENT)
162 || (setsockopt(fd, SOL_IPV6, IPV6_TRANSPARENT, &one, sizeof(one)) == 0)
163#endif
Lukas Tribus7640e722014-03-03 21:10:51 +0100164#if defined(IP_FREEBIND)
165 || (setsockopt(fd, SOL_IP, IP_FREEBIND, &one, sizeof(one)) == 0)
166#endif
Pieter Baauwff30b662013-05-08 23:22:39 +0200167#if defined(IPV6_BINDANY)
168 || (setsockopt(fd, IPPROTO_IPV6, IPV6_BINDANY, &one, sizeof(one)) == 0)
169#endif
Pieter Baauw1eb75922013-05-08 23:30:23 +0200170#if defined(SO_BINDANY)
171 || (setsockopt(fd, SOL_SOCKET, SO_BINDANY, &one, sizeof(one)) == 0)
172#endif
Pieter Baauwd551fb52013-05-08 22:49:23 +0200173 )
David du Colombier65c17962012-07-13 14:34:59 +0200174 foreign_ok = 1;
175 else
176 ip6_transp_working = 0;
177 }
178 break;
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100179 }
Pieter Baauwd551fb52013-05-08 22:49:23 +0200180
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100181 if (flags) {
182 memset(&bind_addr, 0, sizeof(bind_addr));
Willy Tarreau96dd0792011-04-19 07:20:57 +0200183 bind_addr.ss_family = remote->ss_family;
David du Colombier6f5ccb12011-03-10 22:26:24 +0100184 switch (remote->ss_family) {
185 case AF_INET:
186 if (flags & 1)
187 ((struct sockaddr_in *)&bind_addr)->sin_addr = ((struct sockaddr_in *)remote)->sin_addr;
188 if (flags & 2)
189 ((struct sockaddr_in *)&bind_addr)->sin_port = ((struct sockaddr_in *)remote)->sin_port;
190 break;
191 case AF_INET6:
192 if (flags & 1)
193 ((struct sockaddr_in6 *)&bind_addr)->sin6_addr = ((struct sockaddr_in6 *)remote)->sin6_addr;
194 if (flags & 2)
195 ((struct sockaddr_in6 *)&bind_addr)->sin6_port = ((struct sockaddr_in6 *)remote)->sin6_port;
196 break;
Willy Tarreau5dc1e982011-12-16 21:25:11 +0100197 default:
198 /* we don't want to try to bind to an unknown address family */
199 foreign_ok = 0;
David du Colombier6f5ccb12011-03-10 22:26:24 +0100200 }
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100201 }
202
Simon Hormande072bd2011-06-24 15:11:37 +0900203 setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one));
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100204 if (foreign_ok) {
Willy Tarreau9cf8d3f2014-05-09 22:56:10 +0200205 if (is_inet_addr(&bind_addr)) {
Willy Tarreau5f2877a2012-10-26 19:57:58 +0200206 ret = bind(fd, (struct sockaddr *)&bind_addr, get_addr_len(&bind_addr));
207 if (ret < 0)
208 return 2;
209 }
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100210 }
211 else {
Willy Tarreau9cf8d3f2014-05-09 22:56:10 +0200212 if (is_inet_addr(local)) {
Willy Tarreau5f2877a2012-10-26 19:57:58 +0200213 ret = bind(fd, (struct sockaddr *)local, get_addr_len(local));
214 if (ret < 0)
215 return 1;
216 }
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100217 }
218
219 if (!flags)
220 return 0;
221
222#ifdef CONFIG_HAP_CTTPROXY
Willy Tarreau6f831b42011-03-20 14:03:54 +0100223 if (!foreign_ok && remote->ss_family == AF_INET) {
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100224 struct in_tproxy itp1, itp2;
225 memset(&itp1, 0, sizeof(itp1));
226
227 itp1.op = TPROXY_ASSIGN;
Willy Tarreau6f831b42011-03-20 14:03:54 +0100228 itp1.v.addr.faddr = ((struct sockaddr_in *)&bind_addr)->sin_addr;
229 itp1.v.addr.fport = ((struct sockaddr_in *)&bind_addr)->sin_port;
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100230
231 /* set connect flag on socket */
232 itp2.op = TPROXY_FLAGS;
233 itp2.v.flags = ITP_CONNECT | ITP_ONCE;
234
235 if (setsockopt(fd, SOL_IP, IP_TPROXY, &itp1, sizeof(itp1)) != -1 &&
236 setsockopt(fd, SOL_IP, IP_TPROXY, &itp2, sizeof(itp2)) != -1) {
237 foreign_ok = 1;
238 }
239 }
240#endif
241 if (!foreign_ok)
242 /* we could not bind to a foreign address */
243 return 2;
244
245 return 0;
246}
Willy Tarreaue6b98942007-10-29 01:09:36 +0100247
Willy Tarreau9650f372009-08-16 14:02:45 +0200248
249/*
Willy Tarreau14f8e862012-08-30 22:23:13 +0200250 * This function initiates a TCP connection establishment to the target assigned
251 * to connection <conn> using (si->{target,addr.to}). A source address may be
252 * pointed to by conn->addr.from in case of transparent proxying. Normal source
253 * bind addresses are still determined locally (due to the possible need of a
254 * source port). conn->target may point either to a valid server or to a backend,
Willy Tarreau3fdb3662012-11-12 00:42:33 +0100255 * depending on conn->target. Only OBJ_TYPE_PROXY and OBJ_TYPE_SERVER are
Willy Tarreauf0837b22012-11-24 10:24:27 +0100256 * supported. The <data> parameter is a boolean indicating whether there are data
257 * waiting for being sent or not, in order to adjust data write polling and on
258 * some platforms, the ability to avoid an empty initial ACK. The <delack> argument
259 * allows the caller to force using a delayed ACK when establishing the connection :
260 * - 0 = no delayed ACK unless data are advertised and backend has tcp-smart-connect
261 * - 1 = delayed ACK if backend has tcp-smart-connect, regardless of data
262 * - 2 = delayed ACK regardless of backend options
Willy Tarreaub1d67742010-03-29 19:36:59 +0200263 *
Willy Tarreau1ec74bf2013-10-24 21:45:00 +0200264 * Note that a pending send_proxy message accounts for data.
265 *
Willy Tarreau9650f372009-08-16 14:02:45 +0200266 * It can return one of :
267 * - SN_ERR_NONE if everything's OK
268 * - SN_ERR_SRVTO if there are no more servers
269 * - SN_ERR_SRVCL if the connection was refused by the server
270 * - SN_ERR_PRXCOND if the connection has been limited by the proxy (maxconn)
271 * - SN_ERR_RESOURCE if a system resource is lacking (eg: fd limits, ports, ...)
272 * - SN_ERR_INTERNAL for any other purely internal errors
273 * Additionnally, in the case of SN_ERR_RESOURCE, an emergency log will be emitted.
Willy Tarreau6b0a8502012-11-23 08:51:32 +0100274 *
275 * The connection's fd is inserted only when SN_ERR_NONE is returned, otherwise
276 * it's invalid and the caller has nothing to do.
Willy Tarreau9650f372009-08-16 14:02:45 +0200277 */
Willy Tarreauf1536862011-03-03 18:27:32 +0100278
Willy Tarreauf0837b22012-11-24 10:24:27 +0100279int tcp_connect_server(struct connection *conn, int data, int delack)
Willy Tarreau9650f372009-08-16 14:02:45 +0200280{
281 int fd;
Willy Tarreauac825402011-03-04 22:04:29 +0100282 struct server *srv;
283 struct proxy *be;
Willy Tarreaua4380b42012-12-08 22:49:11 +0100284 struct conn_src *src;
Willy Tarreauac825402011-03-04 22:04:29 +0100285
Willy Tarreau9ce70132014-01-24 16:08:19 +0100286 conn->flags = CO_FL_WAIT_L4_CONN; /* connection in progress */
287
Willy Tarreau3fdb3662012-11-12 00:42:33 +0100288 switch (obj_type(conn->target)) {
289 case OBJ_TYPE_PROXY:
290 be = objt_proxy(conn->target);
Willy Tarreauac825402011-03-04 22:04:29 +0100291 srv = NULL;
292 break;
Willy Tarreau3fdb3662012-11-12 00:42:33 +0100293 case OBJ_TYPE_SERVER:
294 srv = objt_server(conn->target);
Willy Tarreauac825402011-03-04 22:04:29 +0100295 be = srv->proxy;
296 break;
297 default:
Willy Tarreau9ce70132014-01-24 16:08:19 +0100298 conn->flags |= CO_FL_ERROR;
Willy Tarreauac825402011-03-04 22:04:29 +0100299 return SN_ERR_INTERNAL;
300 }
Willy Tarreau9650f372009-08-16 14:02:45 +0200301
Willy Tarreau986a9d22012-08-30 21:11:38 +0200302 if ((fd = conn->t.sock.fd = socket(conn->addr.to.ss_family, SOCK_STREAM, IPPROTO_TCP)) == -1) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200303 qfprintf(stderr, "Cannot get a server socket.\n");
304
Willy Tarreau9ce70132014-01-24 16:08:19 +0100305 if (errno == ENFILE) {
306 conn->err_code = CO_ER_SYS_FDLIM;
Willy Tarreau9650f372009-08-16 14:02:45 +0200307 send_log(be, LOG_EMERG,
308 "Proxy %s reached system FD limit at %d. Please check system tunables.\n",
309 be->id, maxfd);
Willy Tarreau9ce70132014-01-24 16:08:19 +0100310 }
311 else if (errno == EMFILE) {
312 conn->err_code = CO_ER_PROC_FDLIM;
Willy Tarreau9650f372009-08-16 14:02:45 +0200313 send_log(be, LOG_EMERG,
314 "Proxy %s reached process FD limit at %d. Please check 'ulimit-n' and restart.\n",
315 be->id, maxfd);
Willy Tarreau9ce70132014-01-24 16:08:19 +0100316 }
317 else if (errno == ENOBUFS || errno == ENOMEM) {
318 conn->err_code = CO_ER_SYS_MEMLIM;
Willy Tarreau9650f372009-08-16 14:02:45 +0200319 send_log(be, LOG_EMERG,
320 "Proxy %s reached system memory limit at %d sockets. Please check system tunables.\n",
321 be->id, maxfd);
Willy Tarreau9ce70132014-01-24 16:08:19 +0100322 }
323 else if (errno == EAFNOSUPPORT || errno == EPROTONOSUPPORT) {
324 conn->err_code = CO_ER_NOPROTO;
325 }
326 else
327 conn->err_code = CO_ER_SOCK_ERR;
328
Willy Tarreau9650f372009-08-16 14:02:45 +0200329 /* this is a resource error */
Willy Tarreau9ce70132014-01-24 16:08:19 +0100330 conn->flags |= CO_FL_ERROR;
Willy Tarreau9650f372009-08-16 14:02:45 +0200331 return SN_ERR_RESOURCE;
332 }
333
334 if (fd >= global.maxsock) {
335 /* do not log anything there, it's a normal condition when this option
336 * is used to serialize connections to a server !
337 */
338 Alert("socket(): not enough free sockets. Raise -n argument. Giving up.\n");
339 close(fd);
Willy Tarreau9ce70132014-01-24 16:08:19 +0100340 conn->err_code = CO_ER_CONF_FDLIM;
341 conn->flags |= CO_FL_ERROR;
Willy Tarreau9650f372009-08-16 14:02:45 +0200342 return SN_ERR_PRXCOND; /* it is a configuration limit */
343 }
344
345 if ((fcntl(fd, F_SETFL, O_NONBLOCK)==-1) ||
Simon Hormande072bd2011-06-24 15:11:37 +0900346 (setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &one, sizeof(one)) == -1)) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200347 qfprintf(stderr,"Cannot set client socket to non blocking mode.\n");
348 close(fd);
Willy Tarreau9ce70132014-01-24 16:08:19 +0100349 conn->err_code = CO_ER_SOCK_ERR;
350 conn->flags |= CO_FL_ERROR;
Willy Tarreau9650f372009-08-16 14:02:45 +0200351 return SN_ERR_INTERNAL;
352 }
353
354 if (be->options & PR_O_TCP_SRV_KA)
Simon Hormande072bd2011-06-24 15:11:37 +0900355 setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, &one, sizeof(one));
Willy Tarreau9650f372009-08-16 14:02:45 +0200356
Willy Tarreau9650f372009-08-16 14:02:45 +0200357 /* allow specific binding :
358 * - server-specific at first
359 * - proxy-specific next
360 */
Willy Tarreaua4380b42012-12-08 22:49:11 +0100361 if (srv && srv->conn_src.opts & CO_SRC_BIND)
362 src = &srv->conn_src;
363 else if (be->conn_src.opts & CO_SRC_BIND)
364 src = &be->conn_src;
365 else
366 src = NULL;
367
368 if (src) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200369 int ret, flags = 0;
370
Willy Tarreau9cf8d3f2014-05-09 22:56:10 +0200371 if (is_inet_addr(&conn->addr.from)) {
Willy Tarreaua4380b42012-12-08 22:49:11 +0100372 switch (src->opts & CO_SRC_TPROXY_MASK) {
Willy Tarreauef9a3602012-12-08 22:29:20 +0100373 case CO_SRC_TPROXY_ADDR:
374 case CO_SRC_TPROXY_CLI:
Willy Tarreau5f2877a2012-10-26 19:57:58 +0200375 flags = 3;
376 break;
Willy Tarreauef9a3602012-12-08 22:29:20 +0100377 case CO_SRC_TPROXY_CIP:
378 case CO_SRC_TPROXY_DYN:
Willy Tarreau5f2877a2012-10-26 19:57:58 +0200379 flags = 1;
380 break;
381 }
Willy Tarreau9650f372009-08-16 14:02:45 +0200382 }
Willy Tarreaub1d67742010-03-29 19:36:59 +0200383
Willy Tarreau9650f372009-08-16 14:02:45 +0200384#ifdef SO_BINDTODEVICE
385 /* Note: this might fail if not CAP_NET_RAW */
Willy Tarreaua4380b42012-12-08 22:49:11 +0100386 if (src->iface_name)
387 setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, src->iface_name, src->iface_len + 1);
Willy Tarreau9650f372009-08-16 14:02:45 +0200388#endif
389
Willy Tarreaua4380b42012-12-08 22:49:11 +0100390 if (src->sport_range) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200391 int attempts = 10; /* should be more than enough to find a spare port */
Willy Tarreaua4380b42012-12-08 22:49:11 +0100392 struct sockaddr_storage sa;
Willy Tarreau9650f372009-08-16 14:02:45 +0200393
394 ret = 1;
Willy Tarreaua4380b42012-12-08 22:49:11 +0100395 sa = src->source_addr;
Willy Tarreau9650f372009-08-16 14:02:45 +0200396
397 do {
398 /* note: in case of retry, we may have to release a previously
399 * allocated port, hence this loop's construct.
400 */
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200401 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
402 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200403
404 if (!attempts)
405 break;
406 attempts--;
407
Willy Tarreaua4380b42012-12-08 22:49:11 +0100408 fdinfo[fd].local_port = port_range_alloc_port(src->sport_range);
Willy Tarreau9ce70132014-01-24 16:08:19 +0100409 if (!fdinfo[fd].local_port) {
410 conn->err_code = CO_ER_PORT_RANGE;
Willy Tarreau9650f372009-08-16 14:02:45 +0200411 break;
Willy Tarreau9ce70132014-01-24 16:08:19 +0100412 }
Willy Tarreau9650f372009-08-16 14:02:45 +0200413
Willy Tarreaua4380b42012-12-08 22:49:11 +0100414 fdinfo[fd].port_range = src->sport_range;
415 set_host_port(&sa, fdinfo[fd].local_port);
Willy Tarreau9650f372009-08-16 14:02:45 +0200416
Willy Tarreaua4380b42012-12-08 22:49:11 +0100417 ret = tcp_bind_socket(fd, flags, &sa, &conn->addr.from);
Willy Tarreau9ce70132014-01-24 16:08:19 +0100418 if (ret != 0)
419 conn->err_code = CO_ER_CANT_BIND;
Willy Tarreau9650f372009-08-16 14:02:45 +0200420 } while (ret != 0); /* binding NOK */
421 }
422 else {
Willy Tarreaua4380b42012-12-08 22:49:11 +0100423 ret = tcp_bind_socket(fd, flags, &src->source_addr, &conn->addr.from);
Willy Tarreau9ce70132014-01-24 16:08:19 +0100424 if (ret != 0)
425 conn->err_code = CO_ER_CANT_BIND;
Willy Tarreau9650f372009-08-16 14:02:45 +0200426 }
427
Willy Tarreaua4380b42012-12-08 22:49:11 +0100428 if (unlikely(ret != 0)) {
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200429 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
430 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200431 close(fd);
432
Willy Tarreau9650f372009-08-16 14:02:45 +0200433 if (ret == 1) {
Willy Tarreaua4380b42012-12-08 22:49:11 +0100434 Alert("Cannot bind to source address before connect() for backend %s. Aborting.\n",
Willy Tarreau9650f372009-08-16 14:02:45 +0200435 be->id);
436 send_log(be, LOG_EMERG,
Willy Tarreaua4380b42012-12-08 22:49:11 +0100437 "Cannot bind to source address before connect() for backend %s.\n",
Willy Tarreau9650f372009-08-16 14:02:45 +0200438 be->id);
439 } else {
Willy Tarreaua4380b42012-12-08 22:49:11 +0100440 Alert("Cannot bind to tproxy source address before connect() for backend %s. Aborting.\n",
Willy Tarreau9650f372009-08-16 14:02:45 +0200441 be->id);
442 send_log(be, LOG_EMERG,
Willy Tarreaua4380b42012-12-08 22:49:11 +0100443 "Cannot bind to tproxy source address before connect() for backend %s.\n",
Willy Tarreau9650f372009-08-16 14:02:45 +0200444 be->id);
445 }
Willy Tarreau9ce70132014-01-24 16:08:19 +0100446 conn->flags |= CO_FL_ERROR;
Willy Tarreau9650f372009-08-16 14:02:45 +0200447 return SN_ERR_RESOURCE;
448 }
449 }
450
Willy Tarreau1ec74bf2013-10-24 21:45:00 +0200451 /* if a send_proxy is there, there are data */
452 data |= conn->send_proxy_ofs;
453
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400454#if defined(TCP_QUICKACK)
Willy Tarreau9650f372009-08-16 14:02:45 +0200455 /* disabling tcp quick ack now allows the first request to leave the
456 * machine with the first ACK. We only do this if there are pending
Willy Tarreauf0837b22012-11-24 10:24:27 +0100457 * data in the buffer.
Willy Tarreau9650f372009-08-16 14:02:45 +0200458 */
Willy Tarreauf0837b22012-11-24 10:24:27 +0100459 if (delack == 2 || ((delack || data) && (be->options2 & PR_O2_SMARTCON)))
Simon Hormande072bd2011-06-24 15:11:37 +0900460 setsockopt(fd, IPPROTO_TCP, TCP_QUICKACK, &zero, sizeof(zero));
Willy Tarreau9650f372009-08-16 14:02:45 +0200461#endif
462
Willy Tarreaue803de22010-01-21 17:43:04 +0100463 if (global.tune.server_sndbuf)
464 setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &global.tune.server_sndbuf, sizeof(global.tune.server_sndbuf));
465
466 if (global.tune.server_rcvbuf)
467 setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &global.tune.server_rcvbuf, sizeof(global.tune.server_rcvbuf));
468
Willy Tarreau986a9d22012-08-30 21:11:38 +0200469 if ((connect(fd, (struct sockaddr *)&conn->addr.to, get_addr_len(&conn->addr.to)) == -1) &&
Willy Tarreau9650f372009-08-16 14:02:45 +0200470 (errno != EINPROGRESS) && (errno != EALREADY) && (errno != EISCONN)) {
471
Willy Tarreaub1719512012-12-08 23:03:28 +0100472 if (errno == EAGAIN || errno == EADDRINUSE || errno == EADDRNOTAVAIL) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200473 char *msg;
Willy Tarreau9ce70132014-01-24 16:08:19 +0100474 if (errno == EAGAIN || errno == EADDRNOTAVAIL) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200475 msg = "no free ports";
Willy Tarreau9ce70132014-01-24 16:08:19 +0100476 conn->err_code = CO_ER_FREE_PORTS;
477 }
478 else {
Willy Tarreau9650f372009-08-16 14:02:45 +0200479 msg = "local address already in use";
Willy Tarreau9ce70132014-01-24 16:08:19 +0100480 conn->err_code = CO_ER_ADDR_INUSE;
481 }
Willy Tarreau9650f372009-08-16 14:02:45 +0200482
Willy Tarreaub1719512012-12-08 23:03:28 +0100483 qfprintf(stderr,"Connect() failed for backend %s: %s.\n", be->id, msg);
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200484 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
485 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200486 close(fd);
Willy Tarreaub1719512012-12-08 23:03:28 +0100487 send_log(be, LOG_ERR, "Connect() failed for backend %s: %s.\n", be->id, msg);
Willy Tarreau9ce70132014-01-24 16:08:19 +0100488 conn->flags |= CO_FL_ERROR;
Willy Tarreau9650f372009-08-16 14:02:45 +0200489 return SN_ERR_RESOURCE;
490 } else if (errno == ETIMEDOUT) {
491 //qfprintf(stderr,"Connect(): ETIMEDOUT");
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200492 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
493 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200494 close(fd);
Willy Tarreau9ce70132014-01-24 16:08:19 +0100495 conn->err_code = CO_ER_SOCK_ERR;
496 conn->flags |= CO_FL_ERROR;
Willy Tarreau9650f372009-08-16 14:02:45 +0200497 return SN_ERR_SRVTO;
498 } else {
499 // (errno == ECONNREFUSED || errno == ENETUNREACH || errno == EACCES || errno == EPERM)
500 //qfprintf(stderr,"Connect(): %d", errno);
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200501 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
502 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200503 close(fd);
Willy Tarreau9ce70132014-01-24 16:08:19 +0100504 conn->err_code = CO_ER_SOCK_ERR;
505 conn->flags |= CO_FL_ERROR;
Willy Tarreau9650f372009-08-16 14:02:45 +0200506 return SN_ERR_SRVCL;
507 }
508 }
509
Willy Tarreaufc8f1f02012-12-08 18:53:44 +0100510 conn->flags |= CO_FL_ADDR_TO_SET;
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200511
Willy Tarreau1ec74bf2013-10-24 21:45:00 +0200512 /* Prepare to send a few handshakes related to the on-wire protocol. */
513 if (conn->send_proxy_ofs)
Willy Tarreau57cd3e42013-10-24 22:01:26 +0200514 conn->flags |= CO_FL_SEND_PROXY;
Willy Tarreau1ec74bf2013-10-24 21:45:00 +0200515
Willy Tarreauf79c8172013-10-21 16:30:56 +0200516 conn_ctrl_init(conn); /* registers the FD */
Willy Tarreauad38ace2013-12-15 14:19:38 +0100517 fdtab[fd].linger_risk = 1; /* close hard if needed */
Willy Tarreau986a9d22012-08-30 21:11:38 +0200518 conn_sock_want_send(conn); /* for connect status */
Willy Tarreau15678ef2012-08-31 13:54:11 +0200519
Willy Tarreauf7bc57c2012-10-03 00:19:48 +0200520 if (conn_xprt_init(conn) < 0) {
Willy Tarreauf79c8172013-10-21 16:30:56 +0200521 conn_force_close(conn);
Willy Tarreau9ce70132014-01-24 16:08:19 +0100522 conn->flags |= CO_FL_ERROR;
Willy Tarreau15678ef2012-08-31 13:54:11 +0200523 return SN_ERR_RESOURCE;
Willy Tarreau184636e2012-09-06 14:04:41 +0200524 }
Willy Tarreau15678ef2012-08-31 13:54:11 +0200525
Willy Tarreau14f8e862012-08-30 22:23:13 +0200526 if (data)
Willy Tarreau986a9d22012-08-30 21:11:38 +0200527 conn_data_want_send(conn); /* prepare to send data if any */
Willy Tarreau9650f372009-08-16 14:02:45 +0200528
Willy Tarreau9650f372009-08-16 14:02:45 +0200529 return SN_ERR_NONE; /* connection is OK */
530}
531
532
Willy Tarreau59b94792012-05-11 16:16:40 +0200533/*
534 * Retrieves the source address for the socket <fd>, with <dir> indicating
535 * if we're a listener (=0) or an initiator (!=0). It returns 0 in case of
536 * success, -1 in case of error. The socket's source address is stored in
537 * <sa> for <salen> bytes.
538 */
539int tcp_get_src(int fd, struct sockaddr *sa, socklen_t salen, int dir)
540{
541 if (dir)
542 return getsockname(fd, sa, &salen);
543 else
544 return getpeername(fd, sa, &salen);
545}
546
547
548/*
549 * Retrieves the original destination address for the socket <fd>, with <dir>
550 * indicating if we're a listener (=0) or an initiator (!=0). In the case of a
551 * listener, if the original destination address was translated, the original
552 * address is retrieved. It returns 0 in case of success, -1 in case of error.
553 * The socket's source address is stored in <sa> for <salen> bytes.
554 */
555int tcp_get_dst(int fd, struct sockaddr *sa, socklen_t salen, int dir)
556{
557 if (dir)
558 return getpeername(fd, sa, &salen);
559#if defined(TPROXY) && defined(SO_ORIGINAL_DST)
560 else if (getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) == 0)
561 return 0;
562#endif
563 else
564 return getsockname(fd, sa, &salen);
565}
566
Willy Tarreau2b57cb82013-06-10 19:56:38 +0200567/* Tries to drain any pending incoming data from the socket to reach the
Willy Tarreau7f4bcc32014-01-20 11:26:12 +0100568 * receive shutdown. Returns positive if the shutdown was found, negative
569 * if EAGAIN was hit, otherwise zero. This is useful to decide whether we
570 * can close a connection cleanly are we must kill it hard.
Willy Tarreau2b57cb82013-06-10 19:56:38 +0200571 */
572int tcp_drain(int fd)
573{
574 int turns = 2;
575 int len;
576
577 while (turns) {
578#ifdef MSG_TRUNC_CLEARS_INPUT
579 len = recv(fd, NULL, INT_MAX, MSG_DONTWAIT | MSG_NOSIGNAL | MSG_TRUNC);
580 if (len == -1 && errno == EFAULT)
581#endif
582 len = recv(fd, trash.str, trash.size, MSG_DONTWAIT | MSG_NOSIGNAL);
583
Willy Tarreau3bd3e572014-01-20 11:56:37 +0100584 if (len == 0) {
585 /* cool, shutdown received */
586 fdtab[fd].linger_risk = 0;
Willy Tarreau2b57cb82013-06-10 19:56:38 +0200587 return 1;
Willy Tarreau3bd3e572014-01-20 11:56:37 +0100588 }
Willy Tarreau2b57cb82013-06-10 19:56:38 +0200589
590 if (len < 0) {
Willy Tarreauf817e9f2014-01-10 16:58:45 +0100591 if (errno == EAGAIN) {
592 /* connection not closed yet */
593 fd_cant_recv(fd);
Willy Tarreau7f4bcc32014-01-20 11:26:12 +0100594 return -1;
Willy Tarreauf817e9f2014-01-10 16:58:45 +0100595 }
Willy Tarreau2b57cb82013-06-10 19:56:38 +0200596 if (errno == EINTR) /* oops, try again */
597 continue;
598 /* other errors indicate a dead connection, fine. */
Willy Tarreau3bd3e572014-01-20 11:56:37 +0100599 fdtab[fd].linger_risk = 0;
Willy Tarreau2b57cb82013-06-10 19:56:38 +0200600 return 1;
601 }
602 /* OK we read some data, let's try again once */
603 turns--;
604 }
605 /* some data are still present, give up */
606 return 0;
607}
608
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200609/* This is the callback which is set when a connection establishment is pending
Willy Tarreauf12a20e2013-12-04 16:11:04 +0100610 * and we have nothing to send. It updates the FD polling status. It returns 0
611 * if it fails in a fatal way or needs to poll to go further, otherwise it
612 * returns non-zero and removes the CO_FL_WAIT_L4_CONN flag from the connection's
613 * flags. In case of error, it sets CO_FL_ERROR and leaves the error code in
614 * errno. The error checking is done in two passes in order to limit the number
615 * of syscalls in the normal case :
616 * - if POLL_ERR was reported by the poller, we check for a pending error on
617 * the socket before proceeding. If found, it's assigned to errno so that
618 * upper layers can see it.
619 * - otherwise connect() is used to check the connection state again, since
620 * the getsockopt return cannot reliably be used to know if the connection
621 * is still pending or ready. This one may often return an error as well,
622 * since we don't always have POLL_ERR (eg: OSX or cached events).
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200623 */
Willy Tarreau239d7182012-07-23 18:53:03 +0200624int tcp_connect_probe(struct connection *conn)
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200625{
Willy Tarreau239d7182012-07-23 18:53:03 +0200626 int fd = conn->t.sock.fd;
Willy Tarreauf12a20e2013-12-04 16:11:04 +0100627 socklen_t lskerr;
628 int skerr;
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200629
Willy Tarreau80184712012-07-06 14:54:49 +0200630 if (conn->flags & CO_FL_ERROR)
Willy Tarreauafad0e02012-08-09 14:45:22 +0200631 return 0;
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200632
Willy Tarreau3c728722014-01-23 13:50:42 +0100633 if (!conn_ctrl_ready(conn))
Willy Tarreauf79c8172013-10-21 16:30:56 +0200634 return 0;
635
Willy Tarreau80184712012-07-06 14:54:49 +0200636 if (!(conn->flags & CO_FL_WAIT_L4_CONN))
Willy Tarreau0b0c0972012-07-23 20:05:00 +0200637 return 1; /* strange we were called while ready */
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200638
Willy Tarreaufd803bb2014-01-20 15:13:07 +0100639 if (!fd_send_ready(fd))
640 return 0;
641
Willy Tarreauf12a20e2013-12-04 16:11:04 +0100642 /* we might be the first witness of FD_POLL_ERR. Note that FD_POLL_HUP
643 * without FD_POLL_IN also indicates a hangup without input data meaning
644 * there was no connection.
645 */
646 if (fdtab[fd].ev & FD_POLL_ERR ||
647 (fdtab[fd].ev & (FD_POLL_IN|FD_POLL_HUP)) == FD_POLL_HUP) {
648 skerr = 0;
649 lskerr = sizeof(skerr);
650 getsockopt(fd, SOL_SOCKET, SO_ERROR, &skerr, &lskerr);
651 errno = skerr;
652 if (errno == EAGAIN)
653 errno = 0;
654 if (errno)
655 goto out_error;
656 }
Willy Tarreau2da156f2012-07-23 15:07:23 +0200657
Willy Tarreauf12a20e2013-12-04 16:11:04 +0100658 /* Use connect() to check the state of the socket. This has the
659 * advantage of giving us the following info :
Willy Tarreau2c6be842012-07-06 17:12:34 +0200660 * - error
661 * - connecting (EALREADY, EINPROGRESS)
662 * - connected (EISCONN, 0)
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200663 */
Willy Tarreau986a9d22012-08-30 21:11:38 +0200664 if (connect(fd, (struct sockaddr *)&conn->addr.to, get_addr_len(&conn->addr.to)) < 0) {
Willy Tarreauf9dabec2012-08-17 17:33:53 +0200665 if (errno == EALREADY || errno == EINPROGRESS) {
Willy Tarreaud486ef52012-12-10 17:03:52 +0100666 __conn_sock_stop_recv(conn);
Willy Tarreaue1f50c42014-01-22 20:02:06 +0100667 fd_cant_send(fd);
Willy Tarreau0b0c0972012-07-23 20:05:00 +0200668 return 0;
Willy Tarreauf9dabec2012-08-17 17:33:53 +0200669 }
Willy Tarreaua190d592012-05-20 18:35:19 +0200670
Willy Tarreau2c6be842012-07-06 17:12:34 +0200671 if (errno && errno != EISCONN)
Willy Tarreaua190d592012-05-20 18:35:19 +0200672 goto out_error;
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200673
Willy Tarreau2c6be842012-07-06 17:12:34 +0200674 /* otherwise we're connected */
Willy Tarreaua190d592012-05-20 18:35:19 +0200675 }
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200676
Willy Tarreau076be252012-07-06 16:02:29 +0200677 /* The FD is ready now, we'll mark the connection as complete and
Willy Tarreauf7bc57c2012-10-03 00:19:48 +0200678 * forward the event to the transport layer which will notify the
679 * data layer.
Willy Tarreaua190d592012-05-20 18:35:19 +0200680 */
Willy Tarreau80184712012-07-06 14:54:49 +0200681 conn->flags &= ~CO_FL_WAIT_L4_CONN;
Willy Tarreau0b0c0972012-07-23 20:05:00 +0200682 return 1;
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200683
684 out_error:
Willy Tarreau0b0c0972012-07-23 20:05:00 +0200685 /* Write error on the file descriptor. Report it to the connection
686 * and disable polling on this FD.
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200687 */
Willy Tarreau3bd3e572014-01-20 11:56:37 +0100688 fdtab[fd].linger_risk = 0;
Willy Tarreau26f4a042013-12-04 23:44:10 +0100689 conn->flags |= CO_FL_ERROR | CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH;
Willy Tarreaud486ef52012-12-10 17:03:52 +0100690 __conn_sock_stop_both(conn);
Willy Tarreauafad0e02012-08-09 14:45:22 +0200691 return 0;
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200692}
693
Willy Tarreau59b94792012-05-11 16:16:40 +0200694
Willy Tarreaue6b98942007-10-29 01:09:36 +0100695/* This function tries to bind a TCPv4/v6 listener. It may return a warning or
Willy Tarreau8ab505b2013-01-24 01:41:38 +0100696 * an error message in <errmsg> if the message is at most <errlen> bytes long
697 * (including '\0'). Note that <errmsg> may be NULL if <errlen> is also zero.
698 * The return value is composed from ERR_ABORT, ERR_WARN,
Willy Tarreaue6b98942007-10-29 01:09:36 +0100699 * ERR_ALERT, ERR_RETRYABLE and ERR_FATAL. ERR_NONE indicates that everything
700 * was alright and that no message was returned. ERR_RETRYABLE means that an
701 * error occurred but that it may vanish after a retry (eg: port in use), and
Aman Guptad94991d2012-04-06 17:39:26 -0700702 * ERR_FATAL indicates a non-fixable error. ERR_WARN and ERR_ALERT do not alter
Willy Tarreaue6b98942007-10-29 01:09:36 +0100703 * the meaning of the error, but just indicate that a message is present which
704 * should be displayed with the respective level. Last, ERR_ABORT indicates
705 * that it's pointless to try to start other listeners. No error message is
706 * returned if errlen is NULL.
707 */
708int tcp_bind_listener(struct listener *listener, char *errmsg, int errlen)
709{
710 __label__ tcp_return, tcp_close_return;
711 int fd, err;
Willy Tarreau40aa0702013-03-10 23:51:38 +0100712 int ext, ready;
713 socklen_t ready_len;
Willy Tarreaue6b98942007-10-29 01:09:36 +0100714 const char *msg = NULL;
715
716 /* ensure we never return garbage */
Willy Tarreau8ab505b2013-01-24 01:41:38 +0100717 if (errlen)
Willy Tarreaue6b98942007-10-29 01:09:36 +0100718 *errmsg = 0;
719
720 if (listener->state != LI_ASSIGNED)
721 return ERR_NONE; /* already bound */
722
723 err = ERR_NONE;
724
Willy Tarreau40aa0702013-03-10 23:51:38 +0100725 /* if the listener already has an fd assigned, then we were offered the
726 * fd by an external process (most likely the parent), and we don't want
727 * to create a new socket. However we still want to set a few flags on
728 * the socket.
729 */
730 fd = listener->fd;
731 ext = (fd >= 0);
732
733 if (!ext && (fd = socket(listener->addr.ss_family, SOCK_STREAM, IPPROTO_TCP)) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100734 err |= ERR_RETRYABLE | ERR_ALERT;
735 msg = "cannot create listening socket";
736 goto tcp_return;
737 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100738
Willy Tarreaue6b98942007-10-29 01:09:36 +0100739 if (fd >= global.maxsock) {
740 err |= ERR_FATAL | ERR_ABORT | ERR_ALERT;
741 msg = "not enough free sockets (raise '-n' parameter)";
742 goto tcp_close_return;
743 }
744
Willy Tarreaufb14edc2009-06-14 15:24:37 +0200745 if (fcntl(fd, F_SETFL, O_NONBLOCK) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100746 err |= ERR_FATAL | ERR_ALERT;
747 msg = "cannot make socket non-blocking";
748 goto tcp_close_return;
749 }
750
Willy Tarreau40aa0702013-03-10 23:51:38 +0100751 if (!ext && setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100752 /* not fatal but should be reported */
753 msg = "cannot do so_reuseaddr";
754 err |= ERR_ALERT;
755 }
756
757 if (listener->options & LI_O_NOLINGER)
Simon Hormande072bd2011-06-24 15:11:37 +0900758 setsockopt(fd, SOL_SOCKET, SO_LINGER, &nolinger, sizeof(struct linger));
Willy Tarreauedcf6682008-11-30 23:15:34 +0100759
Willy Tarreaue6b98942007-10-29 01:09:36 +0100760#ifdef SO_REUSEPORT
761 /* OpenBSD supports this. As it's present in old libc versions of Linux,
762 * it might return an error that we will silently ignore.
763 */
Willy Tarreau40aa0702013-03-10 23:51:38 +0100764 if (!ext)
765 setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &one, sizeof(one));
Willy Tarreaue6b98942007-10-29 01:09:36 +0100766#endif
Pieter Baauwd551fb52013-05-08 22:49:23 +0200767
Willy Tarreau40aa0702013-03-10 23:51:38 +0100768 if (!ext && (listener->options & LI_O_FOREIGN)) {
David du Colombier65c17962012-07-13 14:34:59 +0200769 switch (listener->addr.ss_family) {
770 case AF_INET:
Pieter Baauwd551fb52013-05-08 22:49:23 +0200771 if (1
772#if defined(IP_TRANSPARENT)
773 && (setsockopt(fd, SOL_IP, IP_TRANSPARENT, &one, sizeof(one)) == -1)
774#endif
775#if defined(IP_FREEBIND)
776 && (setsockopt(fd, SOL_IP, IP_FREEBIND, &one, sizeof(one)) == -1)
777#endif
Pieter Baauwff30b662013-05-08 23:22:39 +0200778#if defined(IP_BINDANY)
779 && (setsockopt(fd, IPPROTO_IP, IP_BINDANY, &one, sizeof(one)) == -1)
780#endif
Pieter Baauw1eb75922013-05-08 23:30:23 +0200781#if defined(SO_BINDANY)
782 && (setsockopt(fd, SOL_SOCKET, SO_BINDANY, &one, sizeof(one)) == -1)
783#endif
Pieter Baauwd551fb52013-05-08 22:49:23 +0200784 ) {
David du Colombier65c17962012-07-13 14:34:59 +0200785 msg = "cannot make listening socket transparent";
786 err |= ERR_ALERT;
787 }
788 break;
789 case AF_INET6:
Pieter Baauwd551fb52013-05-08 22:49:23 +0200790 if (1
791#if defined(IPV6_TRANSPARENT)
792 && (setsockopt(fd, SOL_IPV6, IPV6_TRANSPARENT, &one, sizeof(one)) == -1)
793#endif
Lukas Tribus7640e722014-03-03 21:10:51 +0100794#if defined(IP_FREEBIND)
795 && (setsockopt(fd, SOL_IP, IP_FREEBIND, &one, sizeof(one)) == -1)
796#endif
Pieter Baauwff30b662013-05-08 23:22:39 +0200797#if defined(IPV6_BINDANY)
798 && (setsockopt(fd, IPPROTO_IPV6, IPV6_BINDANY, &one, sizeof(one)) == -1)
799#endif
Pieter Baauw1eb75922013-05-08 23:30:23 +0200800#if defined(SO_BINDANY)
801 && (setsockopt(fd, SOL_SOCKET, SO_BINDANY, &one, sizeof(one)) == -1)
802#endif
Pieter Baauwd551fb52013-05-08 22:49:23 +0200803 ) {
David du Colombier65c17962012-07-13 14:34:59 +0200804 msg = "cannot make listening socket transparent";
805 err |= ERR_ALERT;
806 }
807 break;
808 }
Willy Tarreaub1e52e82008-01-13 14:49:51 +0100809 }
Pieter Baauwd551fb52013-05-08 22:49:23 +0200810
Willy Tarreau5e6e2042009-02-04 17:19:29 +0100811#ifdef SO_BINDTODEVICE
812 /* Note: this might fail if not CAP_NET_RAW */
Willy Tarreau40aa0702013-03-10 23:51:38 +0100813 if (!ext && listener->interface) {
Willy Tarreau5e6e2042009-02-04 17:19:29 +0100814 if (setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE,
Willy Tarreau604e8302009-03-06 00:48:23 +0100815 listener->interface, strlen(listener->interface) + 1) == -1) {
Willy Tarreau5e6e2042009-02-04 17:19:29 +0100816 msg = "cannot bind listener to device";
817 err |= ERR_WARN;
818 }
819 }
820#endif
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400821#if defined(TCP_MAXSEG)
Willy Tarreau48a7e722010-12-24 15:26:39 +0100822 if (listener->maxseg > 0) {
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400823 if (setsockopt(fd, IPPROTO_TCP, TCP_MAXSEG,
Willy Tarreaube1b9182009-06-14 18:48:19 +0200824 &listener->maxseg, sizeof(listener->maxseg)) == -1) {
825 msg = "cannot set MSS";
826 err |= ERR_WARN;
827 }
828 }
829#endif
Willy Tarreaucb6cd432009-10-13 07:34:14 +0200830#if defined(TCP_DEFER_ACCEPT)
831 if (listener->options & LI_O_DEF_ACCEPT) {
832 /* defer accept by up to one second */
833 int accept_delay = 1;
834 if (setsockopt(fd, IPPROTO_TCP, TCP_DEFER_ACCEPT, &accept_delay, sizeof(accept_delay)) == -1) {
835 msg = "cannot enable DEFER_ACCEPT";
836 err |= ERR_WARN;
837 }
838 }
839#endif
Willy Tarreau1c862c52012-10-05 16:21:00 +0200840#if defined(TCP_FASTOPEN)
841 if (listener->options & LI_O_TCP_FO) {
842 /* TFO needs a queue length, let's use the configured backlog */
843 int qlen = listener->backlog ? listener->backlog : listener->maxconn;
844 if (setsockopt(fd, IPPROTO_TCP, TCP_FASTOPEN, &qlen, sizeof(qlen)) == -1) {
845 msg = "cannot enable TCP_FASTOPEN";
846 err |= ERR_WARN;
847 }
848 }
849#endif
Willy Tarreau9b6700f2012-11-24 11:55:28 +0100850#if defined(IPV6_V6ONLY)
851 if (listener->options & LI_O_V6ONLY)
852 setsockopt(fd, IPPROTO_IPV6, IPV6_V6ONLY, &one, sizeof(one));
Willy Tarreau77e3af92012-11-24 15:07:23 +0100853 else if (listener->options & LI_O_V4V6)
854 setsockopt(fd, IPPROTO_IPV6, IPV6_V6ONLY, &zero, sizeof(zero));
Willy Tarreau9b6700f2012-11-24 11:55:28 +0100855#endif
856
Willy Tarreau40aa0702013-03-10 23:51:38 +0100857 if (!ext && bind(fd, (struct sockaddr *)&listener->addr, listener->proto->sock_addrlen) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100858 err |= ERR_RETRYABLE | ERR_ALERT;
859 msg = "cannot bind socket";
860 goto tcp_close_return;
861 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100862
Willy Tarreau40aa0702013-03-10 23:51:38 +0100863 ready = 0;
864 ready_len = sizeof(ready);
865 if (getsockopt(fd, SOL_SOCKET, SO_ACCEPTCONN, &ready, &ready_len) == -1)
866 ready = 0;
867
868 if (!(ext && ready) && /* only listen if not already done by external process */
869 listen(fd, listener->backlog ? listener->backlog : listener->maxconn) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100870 err |= ERR_RETRYABLE | ERR_ALERT;
871 msg = "cannot listen to socket";
872 goto tcp_close_return;
873 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100874
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400875#if defined(TCP_QUICKACK)
Willy Tarreau9ea05a72009-06-14 12:07:01 +0200876 if (listener->options & LI_O_NOQUICKACK)
Simon Hormande072bd2011-06-24 15:11:37 +0900877 setsockopt(fd, IPPROTO_TCP, TCP_QUICKACK, &zero, sizeof(zero));
Willy Tarreau9ea05a72009-06-14 12:07:01 +0200878#endif
879
Willy Tarreaue6b98942007-10-29 01:09:36 +0100880 /* the socket is ready */
881 listener->fd = fd;
882 listener->state = LI_LISTEN;
883
Willy Tarreaueabf3132008-08-29 23:36:51 +0200884 fdtab[fd].owner = listener; /* reference the listener instead of a task */
Willy Tarreauaece46a2012-07-06 12:25:58 +0200885 fdtab[fd].iocb = listener->proto->accept;
Willy Tarreaueb472682010-05-28 18:46:57 +0200886 fd_insert(fd);
887
Willy Tarreaue6b98942007-10-29 01:09:36 +0100888 tcp_return:
Cyril Bonté43ba1b32010-11-01 19:26:01 +0100889 if (msg && errlen) {
890 char pn[INET6_ADDRSTRLEN];
891
Willy Tarreau631f01c2011-09-05 00:36:48 +0200892 addr_to_str(&listener->addr, pn, sizeof(pn));
893 snprintf(errmsg, errlen, "%s [%s:%d]", msg, pn, get_host_port(&listener->addr));
Cyril Bonté43ba1b32010-11-01 19:26:01 +0100894 }
Willy Tarreaue6b98942007-10-29 01:09:36 +0100895 return err;
896
897 tcp_close_return:
898 close(fd);
899 goto tcp_return;
900}
901
902/* This function creates all TCP sockets bound to the protocol entry <proto>.
903 * It is intended to be used as the protocol's bind_all() function.
904 * The sockets will be registered but not added to any fd_set, in order not to
905 * loose them across the fork(). A call to enable_all_listeners() is needed
906 * to complete initialization. The return value is composed from ERR_*.
907 */
Emeric Bruncf20bf12010-10-22 16:06:11 +0200908static int tcp_bind_listeners(struct protocol *proto, char *errmsg, int errlen)
Willy Tarreaue6b98942007-10-29 01:09:36 +0100909{
910 struct listener *listener;
911 int err = ERR_NONE;
912
913 list_for_each_entry(listener, &proto->listeners, proto_list) {
Emeric Bruncf20bf12010-10-22 16:06:11 +0200914 err |= tcp_bind_listener(listener, errmsg, errlen);
915 if (err & ERR_ABORT)
Willy Tarreaue6b98942007-10-29 01:09:36 +0100916 break;
917 }
918
919 return err;
920}
921
922/* Add listener to the list of tcpv4 listeners. The listener's state
923 * is automatically updated from LI_INIT to LI_ASSIGNED. The number of
924 * listeners is updated. This is the function to use to add a new listener.
925 */
926void tcpv4_add_listener(struct listener *listener)
927{
928 if (listener->state != LI_INIT)
929 return;
930 listener->state = LI_ASSIGNED;
931 listener->proto = &proto_tcpv4;
932 LIST_ADDQ(&proto_tcpv4.listeners, &listener->proto_list);
933 proto_tcpv4.nb_listeners++;
934}
935
936/* Add listener to the list of tcpv4 listeners. The listener's state
937 * is automatically updated from LI_INIT to LI_ASSIGNED. The number of
938 * listeners is updated. This is the function to use to add a new listener.
939 */
940void tcpv6_add_listener(struct listener *listener)
941{
942 if (listener->state != LI_INIT)
943 return;
944 listener->state = LI_ASSIGNED;
945 listener->proto = &proto_tcpv6;
946 LIST_ADDQ(&proto_tcpv6.listeners, &listener->proto_list);
947 proto_tcpv6.nb_listeners++;
948}
949
Willy Tarreauedcf6682008-11-30 23:15:34 +0100950/* This function performs the TCP request analysis on the current request. It
951 * returns 1 if the processing can continue on next analysers, or zero if it
952 * needs more data, encounters an error, or wants to immediately abort the
Willy Tarreaufb356202010-08-03 14:02:05 +0200953 * request. It relies on buffers flags, and updates s->req->analysers. The
954 * function may be called for frontend rules and backend rules. It only relies
955 * on the backend pointer so this works for both cases.
Willy Tarreauedcf6682008-11-30 23:15:34 +0100956 */
Willy Tarreau7421efb2012-07-02 15:11:27 +0200957int tcp_inspect_request(struct session *s, struct channel *req, int an_bit)
Willy Tarreauedcf6682008-11-30 23:15:34 +0100958{
959 struct tcp_rule *rule;
Willy Tarreaud1f96522010-08-03 19:34:32 +0200960 struct stksess *ts;
961 struct stktable *t;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100962 int partial;
963
Willy Tarreau02d6cfc2012-03-01 18:19:58 +0100964 DPRINTF(stderr,"[%u] %s: session=%p b=%p, exp(r,w)=%u,%u bf=%08x bh=%d analysers=%02x\n",
Willy Tarreauedcf6682008-11-30 23:15:34 +0100965 now_ms, __FUNCTION__,
966 s,
967 req,
968 req->rex, req->wex,
969 req->flags,
Willy Tarreau9b28e032012-10-12 23:49:43 +0200970 req->buf->i,
Willy Tarreauedcf6682008-11-30 23:15:34 +0100971 req->analysers);
972
Willy Tarreauedcf6682008-11-30 23:15:34 +0100973 /* We don't know whether we have enough data, so must proceed
974 * this way :
975 * - iterate through all rules in their declaration order
976 * - if one rule returns MISS, it means the inspect delay is
977 * not over yet, then return immediately, otherwise consider
978 * it as a non-match.
979 * - if one rule returns OK, then return OK
980 * - if one rule returns KO, then return KO
981 */
982
Willy Tarreau9b28e032012-10-12 23:49:43 +0200983 if ((req->flags & CF_SHUTR) || buffer_full(req->buf, global.tune.maxrewrite) ||
Willy Tarreau3bf1b2b2012-08-27 20:46:07 +0200984 !s->be->tcp_req.inspect_delay || tick_is_expired(req->analyse_exp, now_ms))
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200985 partial = SMP_OPT_FINAL;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100986 else
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200987 partial = 0;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100988
Willy Tarreaufb356202010-08-03 14:02:05 +0200989 list_for_each_entry(rule, &s->be->tcp_req.inspect_rules, list) {
Willy Tarreau0cba6072013-11-28 22:21:02 +0100990 enum acl_test_res ret = ACL_TEST_PASS;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100991
992 if (rule->cond) {
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200993 ret = acl_exec_cond(rule->cond, s->be, s, &s->txn, SMP_OPT_DIR_REQ | partial);
Willy Tarreau18bf01e2014-06-13 16:18:52 +0200994 if (ret == ACL_TEST_MISS)
995 goto missing_data;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100996
997 ret = acl_pass(ret);
998 if (rule->cond->pol == ACL_COND_UNLESS)
999 ret = !ret;
1000 }
1001
1002 if (ret) {
1003 /* we have a matching rule. */
1004 if (rule->action == TCP_ACT_REJECT) {
Willy Tarreau8263d2b2012-08-28 00:06:31 +02001005 channel_abort(req);
1006 channel_abort(s->rep);
Willy Tarreauedcf6682008-11-30 23:15:34 +01001007 req->analysers = 0;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +02001008
Willy Tarreau7d0aaf32011-03-10 23:25:56 +01001009 s->be->be_counters.denied_req++;
1010 s->fe->fe_counters.denied_req++;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +02001011 if (s->listener->counters)
Willy Tarreau23968d82010-05-23 23:50:44 +02001012 s->listener->counters->denied_req++;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +02001013
Willy Tarreauedcf6682008-11-30 23:15:34 +01001014 if (!(s->flags & SN_ERR_MASK))
1015 s->flags |= SN_ERR_PRXCOND;
1016 if (!(s->flags & SN_FINST_MASK))
1017 s->flags |= SN_FINST_R;
1018 return 0;
1019 }
Willy Tarreau44778ad2013-10-30 19:24:00 +01001020 else if (rule->action >= TCP_ACT_TRK_SC0 && rule->action <= TCP_ACT_TRK_SCMAX) {
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001021 /* Note: only the first valid tracking parameter of each
1022 * applies.
1023 */
1024 struct stktable_key *key;
1025
Willy Tarreaucc08d2c2014-01-28 23:18:23 +01001026 if (stkctr_entry(&s->stkctr[tcp_trk_idx(rule->action)]))
Willy Tarreau44778ad2013-10-30 19:24:00 +01001027 continue;
1028
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001029 t = rule->act_prm.trk_ctr.table.t;
1030 key = stktable_fetch_key(t, s->be, s, &s->txn, SMP_OPT_DIR_REQ|SMP_OPT_FINAL, rule->act_prm.trk_ctr.expr);
1031
1032 if (key && (ts = stktable_get_entry(t, key))) {
Willy Tarreaud5ca9ab2013-05-28 17:40:25 +02001033 session_track_stkctr(&s->stkctr[tcp_trk_idx(rule->action)], t, ts);
Willy Tarreaucc08d2c2014-01-28 23:18:23 +01001034 stkctr_set_flags(&s->stkctr[tcp_trk_idx(rule->action)], STKCTR_TRACK_CONTENT);
Willy Tarreaud5ca9ab2013-05-28 17:40:25 +02001035 if (s->fe != s->be)
Willy Tarreaucc08d2c2014-01-28 23:18:23 +01001036 stkctr_set_flags(&s->stkctr[tcp_trk_idx(rule->action)], STKCTR_TRACK_BACKEND);
Willy Tarreaud1f96522010-08-03 19:34:32 +02001037 }
1038 }
Willy Tarreau18bf01e2014-06-13 16:18:52 +02001039 else if (rule->action == TCP_ACT_CAPTURE) {
1040 struct sample *key;
1041 struct cap_hdr *h = rule->act_prm.cap.hdr;
1042 char **cap = s->txn.req.cap;
1043 int len;
1044
1045 key = sample_fetch_string(s->be, s, &s->txn, SMP_OPT_DIR_REQ | partial, rule->act_prm.cap.expr);
1046 if (!key)
1047 continue;
1048
1049 if (key->flags & SMP_F_MAY_CHANGE)
1050 goto missing_data;
1051
1052 if (cap[h->index] == NULL)
1053 cap[h->index] = pool_alloc2(h->pool);
1054
1055 if (cap[h->index] == NULL) /* no more capture memory */
1056 continue;
1057
1058 len = key->data.str.len;
1059 if (len > h->len)
1060 len = h->len;
1061
1062 memcpy(cap[h->index], key->data.str.str, len);
1063 cap[h->index][len] = 0;
1064 }
Willy Tarreaud1f96522010-08-03 19:34:32 +02001065 else {
Willy Tarreauedcf6682008-11-30 23:15:34 +01001066 /* otherwise accept */
Willy Tarreaud1f96522010-08-03 19:34:32 +02001067 break;
1068 }
Willy Tarreauedcf6682008-11-30 23:15:34 +01001069 }
1070 }
1071
1072 /* if we get there, it means we have no rule which matches, or
1073 * we have an explicit accept, so we apply the default accept.
1074 */
Willy Tarreau3a816292009-07-07 10:55:49 +02001075 req->analysers &= ~an_bit;
Willy Tarreauedcf6682008-11-30 23:15:34 +01001076 req->analyse_exp = TICK_ETERNITY;
1077 return 1;
Willy Tarreau18bf01e2014-06-13 16:18:52 +02001078
1079 missing_data:
1080 channel_dont_connect(req);
1081 /* just set the request timeout once at the beginning of the request */
1082 if (!tick_isset(req->analyse_exp) && s->be->tcp_req.inspect_delay)
1083 req->analyse_exp = tick_add(now_ms, s->be->tcp_req.inspect_delay);
1084 return 0;
1085
Willy Tarreauedcf6682008-11-30 23:15:34 +01001086}
1087
Emeric Brun97679e72010-09-23 17:56:44 +02001088/* This function performs the TCP response analysis on the current response. It
1089 * returns 1 if the processing can continue on next analysers, or zero if it
1090 * needs more data, encounters an error, or wants to immediately abort the
1091 * response. It relies on buffers flags, and updates s->rep->analysers. The
1092 * function may be called for backend rules.
1093 */
Willy Tarreau7421efb2012-07-02 15:11:27 +02001094int tcp_inspect_response(struct session *s, struct channel *rep, int an_bit)
Emeric Brun97679e72010-09-23 17:56:44 +02001095{
1096 struct tcp_rule *rule;
1097 int partial;
1098
Willy Tarreau02d6cfc2012-03-01 18:19:58 +01001099 DPRINTF(stderr,"[%u] %s: session=%p b=%p, exp(r,w)=%u,%u bf=%08x bh=%d analysers=%02x\n",
Emeric Brun97679e72010-09-23 17:56:44 +02001100 now_ms, __FUNCTION__,
1101 s,
1102 rep,
1103 rep->rex, rep->wex,
1104 rep->flags,
Willy Tarreau9b28e032012-10-12 23:49:43 +02001105 rep->buf->i,
Emeric Brun97679e72010-09-23 17:56:44 +02001106 rep->analysers);
1107
1108 /* We don't know whether we have enough data, so must proceed
1109 * this way :
1110 * - iterate through all rules in their declaration order
1111 * - if one rule returns MISS, it means the inspect delay is
1112 * not over yet, then return immediately, otherwise consider
1113 * it as a non-match.
1114 * - if one rule returns OK, then return OK
1115 * - if one rule returns KO, then return KO
1116 */
1117
Willy Tarreau03cdb7c2012-08-27 23:14:58 +02001118 if (rep->flags & CF_SHUTR || tick_is_expired(rep->analyse_exp, now_ms))
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001119 partial = SMP_OPT_FINAL;
Emeric Brun97679e72010-09-23 17:56:44 +02001120 else
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001121 partial = 0;
Emeric Brun97679e72010-09-23 17:56:44 +02001122
1123 list_for_each_entry(rule, &s->be->tcp_rep.inspect_rules, list) {
Willy Tarreau0cba6072013-11-28 22:21:02 +01001124 enum acl_test_res ret = ACL_TEST_PASS;
Emeric Brun97679e72010-09-23 17:56:44 +02001125
1126 if (rule->cond) {
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001127 ret = acl_exec_cond(rule->cond, s->be, s, &s->txn, SMP_OPT_DIR_RES | partial);
Thierry FOURNIERa65b3432013-11-28 18:22:00 +01001128 if (ret == ACL_TEST_MISS) {
Emeric Brun97679e72010-09-23 17:56:44 +02001129 /* just set the analyser timeout once at the beginning of the response */
1130 if (!tick_isset(rep->analyse_exp) && s->be->tcp_rep.inspect_delay)
Willy Tarreau0bb166b2013-11-04 15:56:53 +01001131 rep->analyse_exp = tick_add(now_ms, s->be->tcp_rep.inspect_delay);
Emeric Brun97679e72010-09-23 17:56:44 +02001132 return 0;
1133 }
1134
1135 ret = acl_pass(ret);
1136 if (rule->cond->pol == ACL_COND_UNLESS)
1137 ret = !ret;
1138 }
1139
1140 if (ret) {
1141 /* we have a matching rule. */
1142 if (rule->action == TCP_ACT_REJECT) {
Willy Tarreau8263d2b2012-08-28 00:06:31 +02001143 channel_abort(rep);
1144 channel_abort(s->req);
Emeric Brun97679e72010-09-23 17:56:44 +02001145 rep->analysers = 0;
1146
Willy Tarreau7d0aaf32011-03-10 23:25:56 +01001147 s->be->be_counters.denied_resp++;
1148 s->fe->fe_counters.denied_resp++;
Emeric Brun97679e72010-09-23 17:56:44 +02001149 if (s->listener->counters)
1150 s->listener->counters->denied_resp++;
1151
1152 if (!(s->flags & SN_ERR_MASK))
1153 s->flags |= SN_ERR_PRXCOND;
1154 if (!(s->flags & SN_FINST_MASK))
1155 s->flags |= SN_FINST_D;
1156 return 0;
1157 }
Willy Tarreaucc1e04b2013-09-11 23:20:29 +02001158 else if (rule->action == TCP_ACT_CLOSE) {
1159 rep->prod->flags |= SI_FL_NOLINGER | SI_FL_NOHALF;
1160 si_shutr(rep->prod);
1161 si_shutw(rep->prod);
1162 break;
1163 }
Emeric Brun97679e72010-09-23 17:56:44 +02001164 else {
1165 /* otherwise accept */
1166 break;
1167 }
1168 }
1169 }
1170
1171 /* if we get there, it means we have no rule which matches, or
1172 * we have an explicit accept, so we apply the default accept.
1173 */
1174 rep->analysers &= ~an_bit;
1175 rep->analyse_exp = TICK_ETERNITY;
1176 return 1;
1177}
1178
1179
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001180/* This function performs the TCP layer4 analysis on the current request. It
1181 * returns 0 if a reject rule matches, otherwise 1 if either an accept rule
1182 * matches or if no more rule matches. It can only use rules which don't need
Willy Tarreaub363a1f2013-10-01 10:45:07 +02001183 * any data. This only works on connection-based client-facing stream interfaces.
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001184 */
1185int tcp_exec_req_rules(struct session *s)
1186{
1187 struct tcp_rule *rule;
Willy Tarreauf059a0f2010-08-03 16:29:52 +02001188 struct stksess *ts;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001189 struct stktable *t = NULL;
Willy Tarreaub363a1f2013-10-01 10:45:07 +02001190 struct connection *conn = objt_conn(s->si[0].end);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001191 int result = 1;
Willy Tarreau0cba6072013-11-28 22:21:02 +01001192 enum acl_test_res ret;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001193
Willy Tarreaub363a1f2013-10-01 10:45:07 +02001194 if (!conn)
1195 return result;
1196
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001197 list_for_each_entry(rule, &s->fe->tcp_req.l4_rules, list) {
Thierry FOURNIERa65b3432013-11-28 18:22:00 +01001198 ret = ACL_TEST_PASS;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001199
1200 if (rule->cond) {
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001201 ret = acl_exec_cond(rule->cond, s->fe, s, NULL, SMP_OPT_DIR_REQ|SMP_OPT_FINAL);
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001202 ret = acl_pass(ret);
1203 if (rule->cond->pol == ACL_COND_UNLESS)
1204 ret = !ret;
1205 }
1206
1207 if (ret) {
1208 /* we have a matching rule. */
1209 if (rule->action == TCP_ACT_REJECT) {
Willy Tarreau7d0aaf32011-03-10 23:25:56 +01001210 s->fe->fe_counters.denied_conn++;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001211 if (s->listener->counters)
Willy Tarreau2799e982010-06-05 15:43:21 +02001212 s->listener->counters->denied_conn++;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001213
1214 if (!(s->flags & SN_ERR_MASK))
1215 s->flags |= SN_ERR_PRXCOND;
1216 if (!(s->flags & SN_FINST_MASK))
1217 s->flags |= SN_FINST_R;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001218 result = 0;
1219 break;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001220 }
Willy Tarreau44778ad2013-10-30 19:24:00 +01001221 else if (rule->action >= TCP_ACT_TRK_SC0 && rule->action <= TCP_ACT_TRK_SCMAX) {
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001222 /* Note: only the first valid tracking parameter of each
1223 * applies.
1224 */
1225 struct stktable_key *key;
1226
Willy Tarreaucc08d2c2014-01-28 23:18:23 +01001227 if (stkctr_entry(&s->stkctr[tcp_trk_idx(rule->action)]))
Willy Tarreau44778ad2013-10-30 19:24:00 +01001228 continue;
1229
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001230 t = rule->act_prm.trk_ctr.table.t;
1231 key = stktable_fetch_key(t, s->be, s, &s->txn, SMP_OPT_DIR_REQ|SMP_OPT_FINAL, rule->act_prm.trk_ctr.expr);
1232
Willy Tarreaud5ca9ab2013-05-28 17:40:25 +02001233 if (key && (ts = stktable_get_entry(t, key)))
1234 session_track_stkctr(&s->stkctr[tcp_trk_idx(rule->action)], t, ts);
Willy Tarreauf059a0f2010-08-03 16:29:52 +02001235 }
Willy Tarreau4f0d9192013-06-11 20:40:55 +02001236 else if (rule->action == TCP_ACT_EXPECT_PX) {
Willy Tarreaub363a1f2013-10-01 10:45:07 +02001237 conn->flags |= CO_FL_ACCEPT_PROXY;
1238 conn_sock_want_recv(conn);
Willy Tarreau4f0d9192013-06-11 20:40:55 +02001239 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001240 else {
1241 /* otherwise it's an accept */
1242 break;
1243 }
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001244 }
1245 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001246 return result;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001247}
1248
Emeric Brun97679e72010-09-23 17:56:44 +02001249/* Parse a tcp-response rule. Return a negative value in case of failure */
1250static int tcp_parse_response_rule(char **args, int arg, int section_type,
Thierry FOURNIER0d6ba512014-02-11 03:31:34 +01001251 struct proxy *curpx, struct proxy *defpx,
1252 struct tcp_rule *rule, char **err,
1253 unsigned int where,
1254 const char *file, int line)
Emeric Brun97679e72010-09-23 17:56:44 +02001255{
1256 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001257 memprintf(err, "%s %s is only allowed in 'backend' sections",
1258 args[0], args[1]);
Emeric Brun97679e72010-09-23 17:56:44 +02001259 return -1;
1260 }
1261
1262 if (strcmp(args[arg], "accept") == 0) {
1263 arg++;
1264 rule->action = TCP_ACT_ACCEPT;
1265 }
1266 else if (strcmp(args[arg], "reject") == 0) {
1267 arg++;
1268 rule->action = TCP_ACT_REJECT;
1269 }
Willy Tarreaucc1e04b2013-09-11 23:20:29 +02001270 else if (strcmp(args[arg], "close") == 0) {
1271 arg++;
1272 rule->action = TCP_ACT_CLOSE;
1273 }
Emeric Brun97679e72010-09-23 17:56:44 +02001274 else {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001275 memprintf(err,
Willy Tarreaucc1e04b2013-09-11 23:20:29 +02001276 "'%s %s' expects 'accept', 'close' or 'reject' in %s '%s' (got '%s')",
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001277 args[0], args[1], proxy_type_str(curpx), curpx->id, args[arg]);
Emeric Brun97679e72010-09-23 17:56:44 +02001278 return -1;
1279 }
1280
1281 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
Thierry FOURNIER0d6ba512014-02-11 03:31:34 +01001282 if ((rule->cond = build_acl_cond(file, line, curpx, (const char **)args+arg, err)) == NULL) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001283 memprintf(err,
1284 "'%s %s %s' : error detected in %s '%s' while parsing '%s' condition : %s",
1285 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg], *err);
Emeric Brun97679e72010-09-23 17:56:44 +02001286 return -1;
1287 }
1288 }
1289 else if (*args[arg]) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001290 memprintf(err,
1291 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (got '%s')",
Emeric Brun97679e72010-09-23 17:56:44 +02001292 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
1293 return -1;
1294 }
1295 return 0;
1296}
1297
1298
1299
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001300/* Parse a tcp-request rule. Return a negative value in case of failure */
1301static int tcp_parse_request_rule(char **args, int arg, int section_type,
Willy Tarreau80aca902013-01-07 15:42:20 +01001302 struct proxy *curpx, struct proxy *defpx,
1303 struct tcp_rule *rule, char **err,
Thierry FOURNIER0d6ba512014-02-11 03:31:34 +01001304 unsigned int where, const char *file, int line)
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001305{
1306 if (curpx == defpx) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001307 memprintf(err, "%s %s is not allowed in 'defaults' sections",
1308 args[0], args[1]);
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001309 return -1;
1310 }
1311
1312 if (!strcmp(args[arg], "accept")) {
1313 arg++;
1314 rule->action = TCP_ACT_ACCEPT;
1315 }
1316 else if (!strcmp(args[arg], "reject")) {
1317 arg++;
1318 rule->action = TCP_ACT_REJECT;
1319 }
Willy Tarreau18bf01e2014-06-13 16:18:52 +02001320 else if (strcmp(args[arg], "capture") == 0) {
1321 struct sample_expr *expr;
1322 struct cap_hdr *hdr;
1323 int kw = arg;
1324 int len = 0;
1325
1326 if (!(curpx->cap & PR_CAP_FE)) {
1327 memprintf(err,
1328 "'%s %s %s' : proxy '%s' has no frontend capability",
1329 args[0], args[1], args[kw], curpx->id);
1330 return -1;
1331 }
1332
1333 if (!(where & SMP_VAL_FE_REQ_CNT)) {
1334 memprintf(err,
1335 "'%s %s' is not allowed in '%s %s' rules in %s '%s'",
1336 args[arg], args[arg+1], args[0], args[1], proxy_type_str(curpx), curpx->id);
1337 return -1;
1338 }
1339
1340 arg++;
1341
1342 curpx->conf.args.ctx = ARGC_CAP;
1343 expr = sample_parse_expr(args, &arg, file, line, err, &curpx->conf.args);
1344 if (!expr) {
1345 memprintf(err,
1346 "'%s %s %s' : %s",
1347 args[0], args[1], args[kw], *err);
1348 return -1;
1349 }
1350
1351 if (!(expr->fetch->val & where)) {
1352 memprintf(err,
1353 "'%s %s %s' : fetch method '%s' extracts information from '%s', none of which is available here",
1354 args[0], args[1], args[kw], args[arg-1], sample_src_names(expr->fetch->use));
1355 free(expr);
1356 return -1;
1357 }
1358
1359 if (strcmp(args[arg], "len") == 0) {
1360 arg++;
1361 if (!args[arg]) {
1362 memprintf(err,
1363 "'%s %s %s' : missing length value",
1364 args[0], args[1], args[kw]);
1365 free(expr);
1366 return -1;
1367 }
1368 /* we copy the table name for now, it will be resolved later */
1369 len = atoi(args[arg]);
1370 if (len <= 0) {
1371 memprintf(err,
1372 "'%s %s %s' : length must be > 0",
1373 args[0], args[1], args[kw]);
1374 free(expr);
1375 return -1;
1376 }
1377 arg++;
1378 }
1379
1380 if (!len) {
1381 memprintf(err,
1382 "'%s %s %s' : a positive 'len' argument is mandatory",
1383 args[0], args[1], args[kw]);
1384 free(expr);
1385 return -1;
1386 }
1387
1388 hdr = calloc(sizeof(struct cap_hdr), 1);
1389 hdr->next = curpx->req_cap;
1390 hdr->name = NULL; /* not a header capture */
1391 hdr->namelen = 0;
1392 hdr->len = len;
1393 hdr->pool = create_pool("caphdr", hdr->len + 1, MEM_F_SHARED);
1394 hdr->index = curpx->nb_req_cap++;
1395
1396 curpx->req_cap = hdr;
1397 curpx->to_log |= LW_REQHDR;
1398
1399 /* check if we need to allocate an hdr_idx struct for HTTP parsing */
1400 curpx->http_needed |= !!(expr->fetch->use & SMP_USE_HTTP_ANY);
1401
1402 rule->act_prm.cap.expr = expr;
1403 rule->act_prm.cap.hdr = hdr;
1404 rule->action = TCP_ACT_CAPTURE;
1405 }
Willy Tarreaub4c84932013-07-23 19:15:30 +02001406 else if (strncmp(args[arg], "track-sc", 8) == 0 &&
1407 args[arg][9] == '\0' && args[arg][8] >= '0' &&
1408 args[arg][8] <= '0' + MAX_SESS_STKCTR) { /* track-sc 0..9 */
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001409 struct sample_expr *expr;
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001410 int kw = arg;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001411
1412 arg++;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001413
Willy Tarreaua4312fa2013-04-02 16:34:32 +02001414 curpx->conf.args.ctx = ARGC_TRK;
Thierry FOURNIEReeaa9512014-02-11 14:00:19 +01001415 expr = sample_parse_expr(args, &arg, file, line, err, &curpx->conf.args);
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001416 if (!expr) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001417 memprintf(err,
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001418 "'%s %s %s' : %s",
Willy Tarreau975c1782013-12-12 23:16:54 +01001419 args[0], args[1], args[kw], *err);
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001420 return -1;
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001421 }
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001422
Willy Tarreau80aca902013-01-07 15:42:20 +01001423 if (!(expr->fetch->val & where)) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001424 memprintf(err,
Willy Tarreau80aca902013-01-07 15:42:20 +01001425 "'%s %s %s' : fetch method '%s' extracts information from '%s', none of which is available here",
Willy Tarreau33c60de2013-04-12 08:26:32 +02001426 args[0], args[1], args[kw], args[arg-1], sample_src_names(expr->fetch->use));
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001427 free(expr);
1428 return -1;
1429 }
1430
1431 /* check if we need to allocate an hdr_idx struct for HTTP parsing */
Willy Tarreau25320b22013-03-24 07:22:08 +01001432 curpx->http_needed |= !!(expr->fetch->use & SMP_USE_HTTP_ANY);
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001433
1434 if (strcmp(args[arg], "table") == 0) {
Willy Tarreau598718a2012-12-09 16:57:27 +01001435 arg++;
1436 if (!args[arg]) {
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001437 memprintf(err,
1438 "'%s %s %s' : missing table name",
1439 args[0], args[1], args[kw]);
1440 free(expr);
1441 return -1;
1442 }
1443 /* we copy the table name for now, it will be resolved later */
Willy Tarreau598718a2012-12-09 16:57:27 +01001444 rule->act_prm.trk_ctr.table.n = strdup(args[arg]);
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001445 arg++;
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001446 }
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001447 rule->act_prm.trk_ctr.expr = expr;
Willy Tarreaube4a3ef2013-06-17 15:04:07 +02001448 rule->action = TCP_ACT_TRK_SC0 + args[kw][8] - '0';
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001449 }
Willy Tarreau4f0d9192013-06-11 20:40:55 +02001450 else if (strcmp(args[arg], "expect-proxy") == 0) {
1451 if (strcmp(args[arg+1], "layer4") != 0) {
1452 memprintf(err,
1453 "'%s %s %s' only supports 'layer4' in %s '%s' (got '%s')",
1454 args[0], args[1], args[arg], proxy_type_str(curpx), curpx->id, args[arg+1]);
1455 return -1;
1456 }
1457
1458 if (!(where & SMP_VAL_FE_CON_ACC)) {
1459 memprintf(err,
1460 "'%s %s' is not allowed in '%s %s' rules in %s '%s'",
1461 args[arg], args[arg+1], args[0], args[1], proxy_type_str(curpx), curpx->id);
1462 return -1;
1463 }
1464
1465 arg += 2;
1466 rule->action = TCP_ACT_EXPECT_PX;
1467 }
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001468 else {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001469 memprintf(err,
Willy Tarreaub4c84932013-07-23 19:15:30 +02001470 "'%s %s' expects 'accept', 'reject', 'track-sc0' ... 'track-sc%d' "
1471 " in %s '%s' (got '%s')",
1472 args[0], args[1], MAX_SESS_STKCTR, proxy_type_str(curpx), curpx->id, args[arg]);
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001473 return -1;
1474 }
1475
1476 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
Thierry FOURNIER0d6ba512014-02-11 03:31:34 +01001477 if ((rule->cond = build_acl_cond(file, line, curpx, (const char **)args+arg, err)) == NULL) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001478 memprintf(err,
1479 "'%s %s %s' : error detected in %s '%s' while parsing '%s' condition : %s",
1480 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg], *err);
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001481 return -1;
1482 }
1483 }
1484 else if (*args[arg]) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001485 memprintf(err,
1486 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (got '%s')",
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001487 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
1488 return -1;
1489 }
1490 return 0;
1491}
1492
Emeric Brun97679e72010-09-23 17:56:44 +02001493/* This function should be called to parse a line starting with the "tcp-response"
1494 * keyword.
1495 */
1496static int tcp_parse_tcp_rep(char **args, int section_type, struct proxy *curpx,
Willy Tarreau28a47d62012-09-18 20:02:48 +02001497 struct proxy *defpx, const char *file, int line,
1498 char **err)
Emeric Brun97679e72010-09-23 17:56:44 +02001499{
1500 const char *ptr = NULL;
1501 unsigned int val;
Emeric Brun97679e72010-09-23 17:56:44 +02001502 int warn = 0;
1503 int arg;
1504 struct tcp_rule *rule;
Willy Tarreau80aca902013-01-07 15:42:20 +01001505 unsigned int where;
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001506 const struct acl *acl;
Willy Tarreau93fddf12013-03-31 22:59:32 +02001507 const char *kw;
Emeric Brun97679e72010-09-23 17:56:44 +02001508
1509 if (!*args[1]) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001510 memprintf(err, "missing argument for '%s' in %s '%s'",
1511 args[0], proxy_type_str(curpx), curpx->id);
Emeric Brun97679e72010-09-23 17:56:44 +02001512 return -1;
1513 }
1514
1515 if (strcmp(args[1], "inspect-delay") == 0) {
1516 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001517 memprintf(err, "%s %s is only allowed in 'backend' sections",
1518 args[0], args[1]);
Emeric Brun97679e72010-09-23 17:56:44 +02001519 return -1;
1520 }
1521
1522 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001523 memprintf(err,
1524 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
1525 args[0], args[1], proxy_type_str(curpx), curpx->id);
1526 if (ptr)
1527 memprintf(err, "%s (unexpected character '%c')", *err, *ptr);
Emeric Brun97679e72010-09-23 17:56:44 +02001528 return -1;
1529 }
1530
1531 if (curpx->tcp_rep.inspect_delay) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001532 memprintf(err, "ignoring %s %s (was already defined) in %s '%s'",
1533 args[0], args[1], proxy_type_str(curpx), curpx->id);
Emeric Brun97679e72010-09-23 17:56:44 +02001534 return 1;
1535 }
1536 curpx->tcp_rep.inspect_delay = val;
1537 return 0;
1538 }
1539
Simon Hormande072bd2011-06-24 15:11:37 +09001540 rule = calloc(1, sizeof(*rule));
Emeric Brun97679e72010-09-23 17:56:44 +02001541 LIST_INIT(&rule->list);
1542 arg = 1;
Willy Tarreau80aca902013-01-07 15:42:20 +01001543 where = 0;
Emeric Brun97679e72010-09-23 17:56:44 +02001544
1545 if (strcmp(args[1], "content") == 0) {
1546 arg++;
Willy Tarreau80aca902013-01-07 15:42:20 +01001547
1548 if (curpx->cap & PR_CAP_FE)
1549 where |= SMP_VAL_FE_RES_CNT;
1550 if (curpx->cap & PR_CAP_BE)
1551 where |= SMP_VAL_BE_RES_CNT;
1552
Thierry FOURNIER0d6ba512014-02-11 03:31:34 +01001553 if (tcp_parse_response_rule(args, arg, section_type, curpx, defpx, rule, err, where, file, line) < 0)
Emeric Brun97679e72010-09-23 17:56:44 +02001554 goto error;
1555
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001556 acl = rule->cond ? acl_cond_conflicts(rule->cond, where) : NULL;
1557 if (acl) {
1558 if (acl->name && *acl->name)
1559 memprintf(err,
1560 "acl '%s' will never match in '%s %s' because it only involves keywords that are incompatible with '%s'",
1561 acl->name, args[0], args[1], sample_ckp_names(where));
1562 else
1563 memprintf(err,
1564 "anonymous acl will never match in '%s %s' because it uses keyword '%s' which is incompatible with '%s'",
1565 args[0], args[1],
Willy Tarreau93fddf12013-03-31 22:59:32 +02001566 LIST_ELEM(acl->expr.n, struct acl_expr *, list)->kw,
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001567 sample_ckp_names(where));
Emeric Brun97679e72010-09-23 17:56:44 +02001568
Emeric Brun97679e72010-09-23 17:56:44 +02001569 warn++;
1570 }
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001571 else if (rule->cond && acl_cond_kw_conflicts(rule->cond, where, &acl, &kw)) {
1572 if (acl->name && *acl->name)
1573 memprintf(err,
1574 "acl '%s' involves keyword '%s' which is incompatible with '%s'",
Willy Tarreau93fddf12013-03-31 22:59:32 +02001575 acl->name, kw, sample_ckp_names(where));
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001576 else
1577 memprintf(err,
1578 "anonymous acl involves keyword '%s' which is incompatible with '%s'",
Willy Tarreau93fddf12013-03-31 22:59:32 +02001579 kw, sample_ckp_names(where));
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001580 warn++;
1581 }
Emeric Brun97679e72010-09-23 17:56:44 +02001582
1583 LIST_ADDQ(&curpx->tcp_rep.inspect_rules, &rule->list);
1584 }
1585 else {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001586 memprintf(err,
1587 "'%s' expects 'inspect-delay' or 'content' in %s '%s' (got '%s')",
1588 args[0], proxy_type_str(curpx), curpx->id, args[1]);
Emeric Brun97679e72010-09-23 17:56:44 +02001589 goto error;
1590 }
1591
1592 return warn;
1593 error:
1594 free(rule);
1595 return -1;
1596}
1597
1598
Willy Tarreaub6866442008-07-14 23:54:42 +02001599/* This function should be called to parse a line starting with the "tcp-request"
1600 * keyword.
1601 */
1602static int tcp_parse_tcp_req(char **args, int section_type, struct proxy *curpx,
Willy Tarreau28a47d62012-09-18 20:02:48 +02001603 struct proxy *defpx, const char *file, int line,
1604 char **err)
Willy Tarreaub6866442008-07-14 23:54:42 +02001605{
1606 const char *ptr = NULL;
Willy Tarreauc7e961e2008-08-17 17:13:47 +02001607 unsigned int val;
Willy Tarreau1a687942010-05-23 22:40:30 +02001608 int warn = 0;
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001609 int arg;
Willy Tarreau1a687942010-05-23 22:40:30 +02001610 struct tcp_rule *rule;
Willy Tarreau80aca902013-01-07 15:42:20 +01001611 unsigned int where;
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001612 const struct acl *acl;
Willy Tarreau93fddf12013-03-31 22:59:32 +02001613 const char *kw;
Willy Tarreaub6866442008-07-14 23:54:42 +02001614
1615 if (!*args[1]) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001616 if (curpx == defpx)
1617 memprintf(err, "missing argument for '%s' in defaults section", args[0]);
1618 else
1619 memprintf(err, "missing argument for '%s' in %s '%s'",
1620 args[0], proxy_type_str(curpx), curpx->id);
Willy Tarreaub6866442008-07-14 23:54:42 +02001621 return -1;
1622 }
1623
1624 if (!strcmp(args[1], "inspect-delay")) {
1625 if (curpx == defpx) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001626 memprintf(err, "%s %s is not allowed in 'defaults' sections",
1627 args[0], args[1]);
Willy Tarreaub6866442008-07-14 23:54:42 +02001628 return -1;
1629 }
1630
Willy Tarreaub6866442008-07-14 23:54:42 +02001631 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001632 memprintf(err,
1633 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
1634 args[0], args[1], proxy_type_str(curpx), curpx->id);
1635 if (ptr)
1636 memprintf(err, "%s (unexpected character '%c')", *err, *ptr);
Willy Tarreaub6866442008-07-14 23:54:42 +02001637 return -1;
1638 }
1639
1640 if (curpx->tcp_req.inspect_delay) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001641 memprintf(err, "ignoring %s %s (was already defined) in %s '%s'",
1642 args[0], args[1], proxy_type_str(curpx), curpx->id);
Willy Tarreaub6866442008-07-14 23:54:42 +02001643 return 1;
1644 }
1645 curpx->tcp_req.inspect_delay = val;
1646 return 0;
1647 }
1648
Simon Hormande072bd2011-06-24 15:11:37 +09001649 rule = calloc(1, sizeof(*rule));
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001650 LIST_INIT(&rule->list);
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001651 arg = 1;
Willy Tarreau80aca902013-01-07 15:42:20 +01001652 where = 0;
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001653
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001654 if (strcmp(args[1], "content") == 0) {
Willy Tarreaud1f96522010-08-03 19:34:32 +02001655 arg++;
Willy Tarreau80aca902013-01-07 15:42:20 +01001656
1657 if (curpx->cap & PR_CAP_FE)
1658 where |= SMP_VAL_FE_REQ_CNT;
1659 if (curpx->cap & PR_CAP_BE)
1660 where |= SMP_VAL_BE_REQ_CNT;
1661
Thierry FOURNIER0d6ba512014-02-11 03:31:34 +01001662 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, where, file, line) < 0)
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001663 goto error;
Willy Tarreaub6866442008-07-14 23:54:42 +02001664
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001665 acl = rule->cond ? acl_cond_conflicts(rule->cond, where) : NULL;
1666 if (acl) {
1667 if (acl->name && *acl->name)
1668 memprintf(err,
1669 "acl '%s' will never match in '%s %s' because it only involves keywords that are incompatible with '%s'",
1670 acl->name, args[0], args[1], sample_ckp_names(where));
1671 else
1672 memprintf(err,
1673 "anonymous acl will never match in '%s %s' because it uses keyword '%s' which is incompatible with '%s'",
1674 args[0], args[1],
Willy Tarreau93fddf12013-03-31 22:59:32 +02001675 LIST_ELEM(acl->expr.n, struct acl_expr *, list)->kw,
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001676 sample_ckp_names(where));
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001677
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001678 warn++;
1679 }
1680 else if (rule->cond && acl_cond_kw_conflicts(rule->cond, where, &acl, &kw)) {
1681 if (acl->name && *acl->name)
1682 memprintf(err,
1683 "acl '%s' involves keyword '%s' which is incompatible with '%s'",
Willy Tarreau93fddf12013-03-31 22:59:32 +02001684 acl->name, kw, sample_ckp_names(where));
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001685 else
1686 memprintf(err,
1687 "anonymous acl involves keyword '%s' which is incompatible with '%s'",
Willy Tarreau93fddf12013-03-31 22:59:32 +02001688 kw, sample_ckp_names(where));
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001689 warn++;
1690 }
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001691
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001692 LIST_ADDQ(&curpx->tcp_req.inspect_rules, &rule->list);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001693 }
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001694 else if (strcmp(args[1], "connection") == 0) {
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001695 arg++;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001696
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001697 if (!(curpx->cap & PR_CAP_FE)) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001698 memprintf(err, "%s %s is not allowed because %s %s is not a frontend",
1699 args[0], args[1], proxy_type_str(curpx), curpx->id);
Simon Horman6c54d8b2011-07-15 13:14:06 +09001700 goto error;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001701 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001702
Willy Tarreau80aca902013-01-07 15:42:20 +01001703 where |= SMP_VAL_FE_CON_ACC;
1704
Thierry FOURNIER0d6ba512014-02-11 03:31:34 +01001705 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, where, file, line) < 0)
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001706 goto error;
1707
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001708 acl = rule->cond ? acl_cond_conflicts(rule->cond, where) : NULL;
1709 if (acl) {
1710 if (acl->name && *acl->name)
1711 memprintf(err,
1712 "acl '%s' will never match in '%s %s' because it only involves keywords that are incompatible with '%s'",
1713 acl->name, args[0], args[1], sample_ckp_names(where));
1714 else
1715 memprintf(err,
1716 "anonymous acl will never match in '%s %s' because it uses keyword '%s' which is incompatible with '%s'",
1717 args[0], args[1],
Willy Tarreau93fddf12013-03-31 22:59:32 +02001718 LIST_ELEM(acl->expr.n, struct acl_expr *, list)->kw,
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001719 sample_ckp_names(where));
Willy Tarreauf059a0f2010-08-03 16:29:52 +02001720
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001721 warn++;
1722 }
1723 else if (rule->cond && acl_cond_kw_conflicts(rule->cond, where, &acl, &kw)) {
1724 if (acl->name && *acl->name)
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001725 memprintf(err,
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001726 "acl '%s' involves keyword '%s' which is incompatible with '%s'",
Willy Tarreau93fddf12013-03-31 22:59:32 +02001727 acl->name, kw, sample_ckp_names(where));
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001728 else
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001729 memprintf(err,
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001730 "anonymous acl involves keyword '%s' which is incompatible with '%s'",
Willy Tarreau93fddf12013-03-31 22:59:32 +02001731 kw, sample_ckp_names(where));
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001732 warn++;
1733 }
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001734
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001735 LIST_ADDQ(&curpx->tcp_req.l4_rules, &rule->list);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001736 }
Willy Tarreau1a687942010-05-23 22:40:30 +02001737 else {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001738 if (curpx == defpx)
1739 memprintf(err,
1740 "'%s' expects 'inspect-delay', 'connection', or 'content' in defaults section (got '%s')",
1741 args[0], args[1]);
1742 else
1743 memprintf(err,
1744 "'%s' expects 'inspect-delay', 'connection', or 'content' in %s '%s' (got '%s')",
Willy Tarreaudeaec2f2013-04-10 16:31:11 +02001745 args[0], proxy_type_str(curpx), curpx->id, args[1]);
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001746 goto error;
Willy Tarreau1a687942010-05-23 22:40:30 +02001747 }
1748
Willy Tarreau1a687942010-05-23 22:40:30 +02001749 return warn;
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001750 error:
1751 free(rule);
1752 return -1;
Willy Tarreaub6866442008-07-14 23:54:42 +02001753}
1754
Willy Tarreau645513a2010-05-24 20:55:15 +02001755
1756/************************************************************************/
Willy Tarreaud4c33c82013-01-07 21:59:07 +01001757/* All supported sample fetch functions must be declared here */
Willy Tarreau32389b72012-04-23 23:13:20 +02001758/************************************************************************/
1759
Willy Tarreau4a129812012-04-25 17:31:42 +02001760/* fetch the connection's source IPv4/IPv6 address */
Willy Tarreau645513a2010-05-24 20:55:15 +02001761static int
Willy Tarreau4a129812012-04-25 17:31:42 +02001762smp_fetch_src(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreauef38c392013-07-22 16:29:32 +02001763 const struct arg *args, struct sample *smp, const char *kw)
Willy Tarreau645513a2010-05-24 20:55:15 +02001764{
Willy Tarreaub363a1f2013-10-01 10:45:07 +02001765 struct connection *cli_conn = objt_conn(l4->si[0].end);
1766
1767 if (!cli_conn)
1768 return 0;
1769
1770 switch (cli_conn->addr.from.ss_family) {
Willy Tarreauf4362b32011-12-16 17:49:52 +01001771 case AF_INET:
Willy Tarreaub363a1f2013-10-01 10:45:07 +02001772 smp->data.ipv4 = ((struct sockaddr_in *)&cli_conn->addr.from)->sin_addr;
Willy Tarreauf853c462012-04-23 18:53:56 +02001773 smp->type = SMP_T_IPV4;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001774 break;
1775 case AF_INET6:
Willy Tarreaub363a1f2013-10-01 10:45:07 +02001776 smp->data.ipv6 = ((struct sockaddr_in6 *)&cli_conn->addr.from)->sin6_addr;
Willy Tarreauf853c462012-04-23 18:53:56 +02001777 smp->type = SMP_T_IPV6;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001778 break;
1779 default:
Emeric Brunf769f512010-10-22 17:14:01 +02001780 return 0;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001781 }
Emeric Brunf769f512010-10-22 17:14:01 +02001782
Willy Tarreau37406352012-04-23 16:16:37 +02001783 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001784 return 1;
1785}
1786
Willy Tarreaua5e37562011-12-16 17:06:15 +01001787/* set temp integer to the connection's source port */
Willy Tarreau645513a2010-05-24 20:55:15 +02001788static int
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001789smp_fetch_sport(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreauef38c392013-07-22 16:29:32 +02001790 const struct arg *args, struct sample *smp, const char *kw)
Willy Tarreau645513a2010-05-24 20:55:15 +02001791{
Willy Tarreaub363a1f2013-10-01 10:45:07 +02001792 struct connection *cli_conn = objt_conn(l4->si[0].end);
1793
1794 if (!cli_conn)
1795 return 0;
1796
Willy Tarreauf853c462012-04-23 18:53:56 +02001797 smp->type = SMP_T_UINT;
Willy Tarreaub363a1f2013-10-01 10:45:07 +02001798 if (!(smp->data.uint = get_host_port(&cli_conn->addr.from)))
Emeric Brunf769f512010-10-22 17:14:01 +02001799 return 0;
1800
Willy Tarreau37406352012-04-23 16:16:37 +02001801 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001802 return 1;
1803}
1804
Willy Tarreau4a129812012-04-25 17:31:42 +02001805/* fetch the connection's destination IPv4/IPv6 address */
Willy Tarreau645513a2010-05-24 20:55:15 +02001806static int
Willy Tarreau4a129812012-04-25 17:31:42 +02001807smp_fetch_dst(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreauef38c392013-07-22 16:29:32 +02001808 const struct arg *args, struct sample *smp, const char *kw)
Willy Tarreau645513a2010-05-24 20:55:15 +02001809{
Willy Tarreaub363a1f2013-10-01 10:45:07 +02001810 struct connection *cli_conn = objt_conn(l4->si[0].end);
Willy Tarreau645513a2010-05-24 20:55:15 +02001811
Willy Tarreaub363a1f2013-10-01 10:45:07 +02001812 if (!cli_conn)
1813 return 0;
1814
1815 conn_get_to_addr(cli_conn);
1816
1817 switch (cli_conn->addr.to.ss_family) {
Willy Tarreauf4362b32011-12-16 17:49:52 +01001818 case AF_INET:
Willy Tarreaub363a1f2013-10-01 10:45:07 +02001819 smp->data.ipv4 = ((struct sockaddr_in *)&cli_conn->addr.to)->sin_addr;
Willy Tarreauf853c462012-04-23 18:53:56 +02001820 smp->type = SMP_T_IPV4;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001821 break;
1822 case AF_INET6:
Willy Tarreaub363a1f2013-10-01 10:45:07 +02001823 smp->data.ipv6 = ((struct sockaddr_in6 *)&cli_conn->addr.to)->sin6_addr;
Willy Tarreauf853c462012-04-23 18:53:56 +02001824 smp->type = SMP_T_IPV6;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001825 break;
1826 default:
Emeric Brunf769f512010-10-22 17:14:01 +02001827 return 0;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001828 }
Emeric Brunf769f512010-10-22 17:14:01 +02001829
Willy Tarreau37406352012-04-23 16:16:37 +02001830 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001831 return 1;
1832}
1833
Willy Tarreaua5e37562011-12-16 17:06:15 +01001834/* set temp integer to the frontend connexion's destination port */
Willy Tarreau645513a2010-05-24 20:55:15 +02001835static int
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001836smp_fetch_dport(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreauef38c392013-07-22 16:29:32 +02001837 const struct arg *args, struct sample *smp, const char *kw)
Willy Tarreau645513a2010-05-24 20:55:15 +02001838{
Willy Tarreaub363a1f2013-10-01 10:45:07 +02001839 struct connection *cli_conn = objt_conn(l4->si[0].end);
1840
1841 if (!cli_conn)
1842 return 0;
1843
1844 conn_get_to_addr(cli_conn);
Willy Tarreau645513a2010-05-24 20:55:15 +02001845
Willy Tarreauf853c462012-04-23 18:53:56 +02001846 smp->type = SMP_T_UINT;
Willy Tarreaub363a1f2013-10-01 10:45:07 +02001847 if (!(smp->data.uint = get_host_port(&cli_conn->addr.to)))
Emeric Brunf769f512010-10-22 17:14:01 +02001848 return 0;
1849
Willy Tarreau37406352012-04-23 16:16:37 +02001850 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001851 return 1;
Emericf2d7cae2010-11-05 18:13:50 +01001852}
1853
Willy Tarreau9b6700f2012-11-24 11:55:28 +01001854#ifdef IPV6_V6ONLY
Willy Tarreau77e3af92012-11-24 15:07:23 +01001855/* parse the "v4v6" bind keyword */
1856static int bind_parse_v4v6(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
1857{
1858 struct listener *l;
1859
1860 list_for_each_entry(l, &conf->listeners, by_bind) {
1861 if (l->addr.ss_family == AF_INET6)
1862 l->options |= LI_O_V4V6;
1863 }
1864
1865 return 0;
1866}
1867
Willy Tarreau9b6700f2012-11-24 11:55:28 +01001868/* parse the "v6only" bind keyword */
1869static int bind_parse_v6only(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
1870{
1871 struct listener *l;
1872
1873 list_for_each_entry(l, &conf->listeners, by_bind) {
1874 if (l->addr.ss_family == AF_INET6)
1875 l->options |= LI_O_V6ONLY;
1876 }
1877
1878 return 0;
1879}
1880#endif
1881
Pieter Baauwd551fb52013-05-08 22:49:23 +02001882#ifdef CONFIG_HAP_TRANSPARENT
Willy Tarreau44791242012-09-12 23:27:21 +02001883/* parse the "transparent" bind keyword */
Willy Tarreau4348fad2012-09-20 16:48:07 +02001884static int bind_parse_transparent(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
Willy Tarreau44791242012-09-12 23:27:21 +02001885{
1886 struct listener *l;
1887
Willy Tarreau4348fad2012-09-20 16:48:07 +02001888 list_for_each_entry(l, &conf->listeners, by_bind) {
1889 if (l->addr.ss_family == AF_INET || l->addr.ss_family == AF_INET6)
1890 l->options |= LI_O_FOREIGN;
Willy Tarreau44791242012-09-12 23:27:21 +02001891 }
1892
Willy Tarreau44791242012-09-12 23:27:21 +02001893 return 0;
1894}
1895#endif
1896
1897#ifdef TCP_DEFER_ACCEPT
1898/* parse the "defer-accept" bind keyword */
Willy Tarreau4348fad2012-09-20 16:48:07 +02001899static int bind_parse_defer_accept(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
Willy Tarreau44791242012-09-12 23:27:21 +02001900{
1901 struct listener *l;
1902
Willy Tarreau4348fad2012-09-20 16:48:07 +02001903 list_for_each_entry(l, &conf->listeners, by_bind) {
1904 if (l->addr.ss_family == AF_INET || l->addr.ss_family == AF_INET6)
1905 l->options |= LI_O_DEF_ACCEPT;
Willy Tarreau44791242012-09-12 23:27:21 +02001906 }
1907
Willy Tarreau44791242012-09-12 23:27:21 +02001908 return 0;
1909}
1910#endif
1911
Willy Tarreau1c862c52012-10-05 16:21:00 +02001912#ifdef TCP_FASTOPEN
Lukas Tribus0defb902013-02-13 23:35:39 +01001913/* parse the "tfo" bind keyword */
Willy Tarreau1c862c52012-10-05 16:21:00 +02001914static int bind_parse_tfo(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
1915{
1916 struct listener *l;
1917
1918 list_for_each_entry(l, &conf->listeners, by_bind) {
1919 if (l->addr.ss_family == AF_INET || l->addr.ss_family == AF_INET6)
1920 l->options |= LI_O_TCP_FO;
1921 }
1922
1923 return 0;
1924}
1925#endif
1926
Willy Tarreau44791242012-09-12 23:27:21 +02001927#ifdef TCP_MAXSEG
1928/* parse the "mss" bind keyword */
Willy Tarreau4348fad2012-09-20 16:48:07 +02001929static int bind_parse_mss(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
Willy Tarreau44791242012-09-12 23:27:21 +02001930{
1931 struct listener *l;
1932 int mss;
1933
Willy Tarreau44791242012-09-12 23:27:21 +02001934 if (!*args[cur_arg + 1]) {
Willy Tarreaueb6cead2012-09-20 19:43:14 +02001935 memprintf(err, "'%s' : missing MSS value", args[cur_arg]);
Willy Tarreau44791242012-09-12 23:27:21 +02001936 return ERR_ALERT | ERR_FATAL;
1937 }
1938
1939 mss = atoi(args[cur_arg + 1]);
1940 if (!mss || abs(mss) > 65535) {
Willy Tarreaueb6cead2012-09-20 19:43:14 +02001941 memprintf(err, "'%s' : expects an MSS with and absolute value between 1 and 65535", args[cur_arg]);
Willy Tarreau44791242012-09-12 23:27:21 +02001942 return ERR_ALERT | ERR_FATAL;
1943 }
1944
Willy Tarreau4348fad2012-09-20 16:48:07 +02001945 list_for_each_entry(l, &conf->listeners, by_bind) {
1946 if (l->addr.ss_family == AF_INET || l->addr.ss_family == AF_INET6)
1947 l->maxseg = mss;
1948 }
Willy Tarreau44791242012-09-12 23:27:21 +02001949
1950 return 0;
1951}
1952#endif
1953
1954#ifdef SO_BINDTODEVICE
1955/* parse the "mss" bind keyword */
Willy Tarreau4348fad2012-09-20 16:48:07 +02001956static int bind_parse_interface(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
Willy Tarreau44791242012-09-12 23:27:21 +02001957{
1958 struct listener *l;
1959
Willy Tarreau44791242012-09-12 23:27:21 +02001960 if (!*args[cur_arg + 1]) {
Willy Tarreaueb6cead2012-09-20 19:43:14 +02001961 memprintf(err, "'%s' : missing interface name", args[cur_arg]);
Willy Tarreau44791242012-09-12 23:27:21 +02001962 return ERR_ALERT | ERR_FATAL;
1963 }
1964
Willy Tarreau4348fad2012-09-20 16:48:07 +02001965 list_for_each_entry(l, &conf->listeners, by_bind) {
1966 if (l->addr.ss_family == AF_INET || l->addr.ss_family == AF_INET6)
1967 l->interface = strdup(args[cur_arg + 1]);
1968 }
Willy Tarreau44791242012-09-12 23:27:21 +02001969
1970 global.last_checks |= LSTCHK_NETADM;
1971 return 0;
1972}
1973#endif
1974
Willy Tarreaudc13c112013-06-21 23:16:39 +02001975static struct cfg_kw_list cfg_kws = {ILH, {
Willy Tarreaud4c33c82013-01-07 21:59:07 +01001976 { CFG_LISTEN, "tcp-request", tcp_parse_tcp_req },
Emeric Brun97679e72010-09-23 17:56:44 +02001977 { CFG_LISTEN, "tcp-response", tcp_parse_tcp_rep },
Willy Tarreaub6866442008-07-14 23:54:42 +02001978 { 0, NULL, NULL },
1979}};
1980
Willy Tarreaud4c33c82013-01-07 21:59:07 +01001981
Willy Tarreau61612d42012-04-19 18:42:05 +02001982/* Note: must not be declared <const> as its list will be overwritten.
1983 * Please take care of keeping this list alphabetically sorted.
1984 */
Willy Tarreaudc13c112013-06-21 23:16:39 +02001985static struct acl_kw_list acl_kws = {ILH, {
Willy Tarreaud4c33c82013-01-07 21:59:07 +01001986 { /* END */ },
Willy Tarreaub6866442008-07-14 23:54:42 +02001987}};
1988
Willy Tarreaud4c33c82013-01-07 21:59:07 +01001989
Willy Tarreau4a129812012-04-25 17:31:42 +02001990/* Note: must not be declared <const> as its list will be overwritten.
1991 * Note: fetches that may return multiple types must be declared as the lowest
1992 * common denominator, the type that can be casted into all other ones. For
1993 * instance v4/v6 must be declared v4.
1994 */
Willy Tarreaudc13c112013-06-21 23:16:39 +02001995static struct sample_fetch_kw_list sample_fetch_keywords = {ILH, {
Willy Tarreaud4c33c82013-01-07 21:59:07 +01001996 { "dst", smp_fetch_dst, 0, NULL, SMP_T_IPV4, SMP_USE_L4CLI },
1997 { "dst_port", smp_fetch_dport, 0, NULL, SMP_T_UINT, SMP_USE_L4CLI },
1998 { "src", smp_fetch_src, 0, NULL, SMP_T_IPV4, SMP_USE_L4CLI },
1999 { "src_port", smp_fetch_sport, 0, NULL, SMP_T_UINT, SMP_USE_L4CLI },
2000 { /* END */ },
Willy Tarreau645513a2010-05-24 20:55:15 +02002001}};
2002
Willy Tarreau44791242012-09-12 23:27:21 +02002003/************************************************************************/
2004/* All supported bind keywords must be declared here. */
2005/************************************************************************/
2006
2007/* Note: must not be declared <const> as its list will be overwritten.
2008 * Please take care of keeping this list alphabetically sorted, doing so helps
2009 * all code contributors.
2010 * Optional keywords are also declared with a NULL ->parse() function so that
2011 * the config parser can report an appropriate error when a known keyword was
2012 * not enabled.
2013 */
Willy Tarreau51fb7652012-09-18 18:24:39 +02002014static struct bind_kw_list bind_kws = { "TCP", { }, {
Willy Tarreau44791242012-09-12 23:27:21 +02002015#ifdef TCP_DEFER_ACCEPT
2016 { "defer-accept", bind_parse_defer_accept, 0 }, /* wait for some data for 1 second max before doing accept */
2017#endif
2018#ifdef SO_BINDTODEVICE
2019 { "interface", bind_parse_interface, 1 }, /* specifically bind to this interface */
2020#endif
2021#ifdef TCP_MAXSEG
2022 { "mss", bind_parse_mss, 1 }, /* set MSS of listening socket */
2023#endif
Willy Tarreau1c862c52012-10-05 16:21:00 +02002024#ifdef TCP_FASTOPEN
2025 { "tfo", bind_parse_tfo, 0 }, /* enable TCP_FASTOPEN of listening socket */
2026#endif
Pieter Baauwd551fb52013-05-08 22:49:23 +02002027#ifdef CONFIG_HAP_TRANSPARENT
Willy Tarreau44791242012-09-12 23:27:21 +02002028 { "transparent", bind_parse_transparent, 0 }, /* transparently bind to the specified addresses */
2029#endif
Willy Tarreau9b6700f2012-11-24 11:55:28 +01002030#ifdef IPV6_V6ONLY
Willy Tarreau77e3af92012-11-24 15:07:23 +01002031 { "v4v6", bind_parse_v4v6, 0 }, /* force socket to bind to IPv4+IPv6 */
Willy Tarreau9b6700f2012-11-24 11:55:28 +01002032 { "v6only", bind_parse_v6only, 0 }, /* force socket to bind to IPv6 only */
2033#endif
Willy Tarreau44791242012-09-12 23:27:21 +02002034 /* the versions with the NULL parse function*/
2035 { "defer-accept", NULL, 0 },
2036 { "interface", NULL, 1 },
2037 { "mss", NULL, 1 },
2038 { "transparent", NULL, 0 },
Willy Tarreau77e3af92012-11-24 15:07:23 +01002039 { "v4v6", NULL, 0 },
Willy Tarreau9b6700f2012-11-24 11:55:28 +01002040 { "v6only", NULL, 0 },
Willy Tarreau44791242012-09-12 23:27:21 +02002041 { NULL, NULL, 0 },
2042}};
2043
Willy Tarreaue6b98942007-10-29 01:09:36 +01002044__attribute__((constructor))
2045static void __tcp_protocol_init(void)
2046{
2047 protocol_register(&proto_tcpv4);
2048 protocol_register(&proto_tcpv6);
Willy Tarreau12785782012-04-27 21:37:17 +02002049 sample_register_fetches(&sample_fetch_keywords);
Willy Tarreaub6866442008-07-14 23:54:42 +02002050 cfg_register_keywords(&cfg_kws);
2051 acl_register_keywords(&acl_kws);
Willy Tarreau44791242012-09-12 23:27:21 +02002052 bind_register_keywords(&bind_kws);
Willy Tarreaue6b98942007-10-29 01:09:36 +01002053}
2054
2055
2056/*
2057 * Local variables:
2058 * c-indent-level: 8
2059 * c-basic-offset: 8
2060 * End:
2061 */