blob: 12e92da1104872307e43449bb6b4eb43642b80e5 [file] [log] [blame]
Willy Tarreaue6b98942007-10-29 01:09:36 +01001/*
2 * AF_INET/AF_INET6 SOCK_STREAM protocol layer (tcp)
3 *
Willy Tarreau1a687942010-05-23 22:40:30 +02004 * Copyright 2000-2010 Willy Tarreau <w@1wt.eu>
Willy Tarreaue6b98942007-10-29 01:09:36 +01005 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
13#include <ctype.h>
14#include <errno.h>
15#include <fcntl.h>
16#include <stdio.h>
17#include <stdlib.h>
18#include <string.h>
19#include <time.h>
20
21#include <sys/param.h>
22#include <sys/socket.h>
23#include <sys/stat.h>
24#include <sys/types.h>
25#include <sys/un.h>
26
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +040027#include <netinet/tcp.h>
28
Willy Tarreaub6866442008-07-14 23:54:42 +020029#include <common/cfgparse.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010030#include <common/compat.h>
31#include <common/config.h>
32#include <common/debug.h>
33#include <common/errors.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010034#include <common/mini-clist.h>
35#include <common/standard.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010036
Willy Tarreaue6b98942007-10-29 01:09:36 +010037#include <types/global.h>
Willy Tarreau9650f372009-08-16 14:02:45 +020038#include <types/server.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010039
40#include <proto/acl.h>
Willy Tarreau9fcb9842012-04-20 14:45:49 +020041#include <proto/arg.h>
Willy Tarreauc7e42382012-08-24 19:22:53 +020042#include <proto/channel.h>
Willy Tarreaud2274c62012-07-06 14:29:45 +020043#include <proto/connection.h>
Willy Tarreaudd2f85e2012-09-02 22:34:23 +020044#include <proto/fd.h>
Willy Tarreaud1d54542012-09-12 22:58:11 +020045#include <proto/listener.h>
Willy Tarreau9650f372009-08-16 14:02:45 +020046#include <proto/log.h>
47#include <proto/port_range.h>
Willy Tarreaud1d54542012-09-12 22:58:11 +020048#include <proto/protocol.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010049#include <proto/proto_tcp.h>
Willy Tarreaub6866442008-07-14 23:54:42 +020050#include <proto/proxy.h>
Willy Tarreaucd3b0942012-04-27 21:52:18 +020051#include <proto/sample.h>
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +020052#include <proto/session.h>
Willy Tarreaua975b8f2010-06-05 19:13:27 +020053#include <proto/stick_table.h>
Willy Tarreaua975b8f2010-06-05 19:13:27 +020054#include <proto/task.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010055
Willy Tarreaue8c66af2008-01-13 18:40:14 +010056#ifdef CONFIG_HAP_CTTPROXY
57#include <import/ip_tproxy.h>
58#endif
59
Emeric Bruncf20bf12010-10-22 16:06:11 +020060static int tcp_bind_listeners(struct protocol *proto, char *errmsg, int errlen);
61static int tcp_bind_listener(struct listener *listener, char *errmsg, int errlen);
Willy Tarreaue6b98942007-10-29 01:09:36 +010062
63/* Note: must not be declared <const> as its list will be overwritten */
64static struct protocol proto_tcpv4 = {
65 .name = "tcpv4",
66 .sock_domain = AF_INET,
67 .sock_type = SOCK_STREAM,
68 .sock_prot = IPPROTO_TCP,
69 .sock_family = AF_INET,
70 .sock_addrlen = sizeof(struct sockaddr_in),
71 .l3_addrlen = 32/8,
Willy Tarreaubbebbbf2012-05-07 21:22:09 +020072 .accept = &listener_accept,
Willy Tarreau26d8c592012-05-07 18:12:14 +020073 .connect = tcp_connect_server,
Emeric Bruncf20bf12010-10-22 16:06:11 +020074 .bind = tcp_bind_listener,
Willy Tarreaue6b98942007-10-29 01:09:36 +010075 .bind_all = tcp_bind_listeners,
76 .unbind_all = unbind_all_listeners,
77 .enable_all = enable_all_listeners,
Willy Tarreau59b94792012-05-11 16:16:40 +020078 .get_src = tcp_get_src,
79 .get_dst = tcp_get_dst,
Willy Tarreaue6b98942007-10-29 01:09:36 +010080 .listeners = LIST_HEAD_INIT(proto_tcpv4.listeners),
81 .nb_listeners = 0,
82};
83
84/* Note: must not be declared <const> as its list will be overwritten */
85static struct protocol proto_tcpv6 = {
86 .name = "tcpv6",
87 .sock_domain = AF_INET6,
88 .sock_type = SOCK_STREAM,
89 .sock_prot = IPPROTO_TCP,
90 .sock_family = AF_INET6,
91 .sock_addrlen = sizeof(struct sockaddr_in6),
92 .l3_addrlen = 128/8,
Willy Tarreaubbebbbf2012-05-07 21:22:09 +020093 .accept = &listener_accept,
Willy Tarreau26d8c592012-05-07 18:12:14 +020094 .connect = tcp_connect_server,
Emeric Bruncf20bf12010-10-22 16:06:11 +020095 .bind = tcp_bind_listener,
Willy Tarreaue6b98942007-10-29 01:09:36 +010096 .bind_all = tcp_bind_listeners,
97 .unbind_all = unbind_all_listeners,
98 .enable_all = enable_all_listeners,
Willy Tarreau59b94792012-05-11 16:16:40 +020099 .get_src = tcp_get_src,
100 .get_dst = tcp_get_dst,
Willy Tarreaue6b98942007-10-29 01:09:36 +0100101 .listeners = LIST_HEAD_INIT(proto_tcpv6.listeners),
102 .nb_listeners = 0,
103};
104
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100105
David du Colombier6f5ccb12011-03-10 22:26:24 +0100106/* Binds ipv4/ipv6 address <local> to socket <fd>, unless <flags> is set, in which
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100107 * case we try to bind <remote>. <flags> is a 2-bit field consisting of :
108 * - 0 : ignore remote address (may even be a NULL pointer)
109 * - 1 : use provided address
110 * - 2 : use provided port
111 * - 3 : use both
112 *
113 * The function supports multiple foreign binding methods :
114 * - linux_tproxy: we directly bind to the foreign address
115 * - cttproxy: we bind to a local address then nat.
116 * The second one can be used as a fallback for the first one.
117 * This function returns 0 when everything's OK, 1 if it could not bind, to the
118 * local address, 2 if it could not bind to the foreign address.
119 */
David du Colombier6f5ccb12011-03-10 22:26:24 +0100120int tcp_bind_socket(int fd, int flags, struct sockaddr_storage *local, struct sockaddr_storage *remote)
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100121{
David du Colombier6f5ccb12011-03-10 22:26:24 +0100122 struct sockaddr_storage bind_addr;
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100123 int foreign_ok = 0;
124 int ret;
125
126#ifdef CONFIG_HAP_LINUX_TPROXY
127 static int ip_transp_working = 1;
David du Colombier65c17962012-07-13 14:34:59 +0200128 static int ip6_transp_working = 1;
129 switch (local->ss_family) {
130 case AF_INET:
131 if (flags && ip_transp_working) {
132 if (setsockopt(fd, SOL_IP, IP_TRANSPARENT, &one, sizeof(one)) == 0
133 || setsockopt(fd, SOL_IP, IP_FREEBIND, &one, sizeof(one)) == 0)
134 foreign_ok = 1;
135 else
136 ip_transp_working = 0;
137 }
138 break;
139 case AF_INET6:
140 if (flags && ip6_transp_working) {
141 if (setsockopt(fd, SOL_IPV6, IPV6_TRANSPARENT, &one, sizeof(one)) == 0)
142 foreign_ok = 1;
143 else
144 ip6_transp_working = 0;
145 }
146 break;
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100147 }
148#endif
149 if (flags) {
150 memset(&bind_addr, 0, sizeof(bind_addr));
Willy Tarreau96dd0792011-04-19 07:20:57 +0200151 bind_addr.ss_family = remote->ss_family;
David du Colombier6f5ccb12011-03-10 22:26:24 +0100152 switch (remote->ss_family) {
153 case AF_INET:
154 if (flags & 1)
155 ((struct sockaddr_in *)&bind_addr)->sin_addr = ((struct sockaddr_in *)remote)->sin_addr;
156 if (flags & 2)
157 ((struct sockaddr_in *)&bind_addr)->sin_port = ((struct sockaddr_in *)remote)->sin_port;
158 break;
159 case AF_INET6:
160 if (flags & 1)
161 ((struct sockaddr_in6 *)&bind_addr)->sin6_addr = ((struct sockaddr_in6 *)remote)->sin6_addr;
162 if (flags & 2)
163 ((struct sockaddr_in6 *)&bind_addr)->sin6_port = ((struct sockaddr_in6 *)remote)->sin6_port;
164 break;
Willy Tarreau5dc1e982011-12-16 21:25:11 +0100165 default:
166 /* we don't want to try to bind to an unknown address family */
167 foreign_ok = 0;
David du Colombier6f5ccb12011-03-10 22:26:24 +0100168 }
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100169 }
170
Simon Hormande072bd2011-06-24 15:11:37 +0900171 setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one));
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100172 if (foreign_ok) {
Willy Tarreau5f2877a2012-10-26 19:57:58 +0200173 if (is_addr(&bind_addr)) {
174 ret = bind(fd, (struct sockaddr *)&bind_addr, get_addr_len(&bind_addr));
175 if (ret < 0)
176 return 2;
177 }
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100178 }
179 else {
Willy Tarreau5f2877a2012-10-26 19:57:58 +0200180 if (is_addr(local)) {
181 ret = bind(fd, (struct sockaddr *)local, get_addr_len(local));
182 if (ret < 0)
183 return 1;
184 }
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100185 }
186
187 if (!flags)
188 return 0;
189
190#ifdef CONFIG_HAP_CTTPROXY
Willy Tarreau6f831b42011-03-20 14:03:54 +0100191 if (!foreign_ok && remote->ss_family == AF_INET) {
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100192 struct in_tproxy itp1, itp2;
193 memset(&itp1, 0, sizeof(itp1));
194
195 itp1.op = TPROXY_ASSIGN;
Willy Tarreau6f831b42011-03-20 14:03:54 +0100196 itp1.v.addr.faddr = ((struct sockaddr_in *)&bind_addr)->sin_addr;
197 itp1.v.addr.fport = ((struct sockaddr_in *)&bind_addr)->sin_port;
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100198
199 /* set connect flag on socket */
200 itp2.op = TPROXY_FLAGS;
201 itp2.v.flags = ITP_CONNECT | ITP_ONCE;
202
203 if (setsockopt(fd, SOL_IP, IP_TPROXY, &itp1, sizeof(itp1)) != -1 &&
204 setsockopt(fd, SOL_IP, IP_TPROXY, &itp2, sizeof(itp2)) != -1) {
205 foreign_ok = 1;
206 }
207 }
208#endif
209 if (!foreign_ok)
210 /* we could not bind to a foreign address */
211 return 2;
212
213 return 0;
214}
Willy Tarreaue6b98942007-10-29 01:09:36 +0100215
Willy Tarreau9650f372009-08-16 14:02:45 +0200216
217/*
Willy Tarreau14f8e862012-08-30 22:23:13 +0200218 * This function initiates a TCP connection establishment to the target assigned
219 * to connection <conn> using (si->{target,addr.to}). A source address may be
220 * pointed to by conn->addr.from in case of transparent proxying. Normal source
221 * bind addresses are still determined locally (due to the possible need of a
222 * source port). conn->target may point either to a valid server or to a backend,
Willy Tarreau3fdb3662012-11-12 00:42:33 +0100223 * depending on conn->target. Only OBJ_TYPE_PROXY and OBJ_TYPE_SERVER are
Willy Tarreauf0837b22012-11-24 10:24:27 +0100224 * supported. The <data> parameter is a boolean indicating whether there are data
225 * waiting for being sent or not, in order to adjust data write polling and on
226 * some platforms, the ability to avoid an empty initial ACK. The <delack> argument
227 * allows the caller to force using a delayed ACK when establishing the connection :
228 * - 0 = no delayed ACK unless data are advertised and backend has tcp-smart-connect
229 * - 1 = delayed ACK if backend has tcp-smart-connect, regardless of data
230 * - 2 = delayed ACK regardless of backend options
Willy Tarreaub1d67742010-03-29 19:36:59 +0200231 *
Willy Tarreau9650f372009-08-16 14:02:45 +0200232 * It can return one of :
233 * - SN_ERR_NONE if everything's OK
234 * - SN_ERR_SRVTO if there are no more servers
235 * - SN_ERR_SRVCL if the connection was refused by the server
236 * - SN_ERR_PRXCOND if the connection has been limited by the proxy (maxconn)
237 * - SN_ERR_RESOURCE if a system resource is lacking (eg: fd limits, ports, ...)
238 * - SN_ERR_INTERNAL for any other purely internal errors
239 * Additionnally, in the case of SN_ERR_RESOURCE, an emergency log will be emitted.
Willy Tarreau6b0a8502012-11-23 08:51:32 +0100240 *
241 * The connection's fd is inserted only when SN_ERR_NONE is returned, otherwise
242 * it's invalid and the caller has nothing to do.
Willy Tarreau9650f372009-08-16 14:02:45 +0200243 */
Willy Tarreauf1536862011-03-03 18:27:32 +0100244
Willy Tarreauf0837b22012-11-24 10:24:27 +0100245int tcp_connect_server(struct connection *conn, int data, int delack)
Willy Tarreau9650f372009-08-16 14:02:45 +0200246{
247 int fd;
Willy Tarreauac825402011-03-04 22:04:29 +0100248 struct server *srv;
249 struct proxy *be;
Willy Tarreaua4380b42012-12-08 22:49:11 +0100250 struct conn_src *src;
Willy Tarreauac825402011-03-04 22:04:29 +0100251
Willy Tarreau3fdb3662012-11-12 00:42:33 +0100252 switch (obj_type(conn->target)) {
253 case OBJ_TYPE_PROXY:
254 be = objt_proxy(conn->target);
Willy Tarreauac825402011-03-04 22:04:29 +0100255 srv = NULL;
256 break;
Willy Tarreau3fdb3662012-11-12 00:42:33 +0100257 case OBJ_TYPE_SERVER:
258 srv = objt_server(conn->target);
Willy Tarreauac825402011-03-04 22:04:29 +0100259 be = srv->proxy;
260 break;
261 default:
262 return SN_ERR_INTERNAL;
263 }
Willy Tarreau9650f372009-08-16 14:02:45 +0200264
Willy Tarreau986a9d22012-08-30 21:11:38 +0200265 if ((fd = conn->t.sock.fd = socket(conn->addr.to.ss_family, SOCK_STREAM, IPPROTO_TCP)) == -1) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200266 qfprintf(stderr, "Cannot get a server socket.\n");
267
268 if (errno == ENFILE)
269 send_log(be, LOG_EMERG,
270 "Proxy %s reached system FD limit at %d. Please check system tunables.\n",
271 be->id, maxfd);
272 else if (errno == EMFILE)
273 send_log(be, LOG_EMERG,
274 "Proxy %s reached process FD limit at %d. Please check 'ulimit-n' and restart.\n",
275 be->id, maxfd);
276 else if (errno == ENOBUFS || errno == ENOMEM)
277 send_log(be, LOG_EMERG,
278 "Proxy %s reached system memory limit at %d sockets. Please check system tunables.\n",
279 be->id, maxfd);
280 /* this is a resource error */
281 return SN_ERR_RESOURCE;
282 }
283
284 if (fd >= global.maxsock) {
285 /* do not log anything there, it's a normal condition when this option
286 * is used to serialize connections to a server !
287 */
288 Alert("socket(): not enough free sockets. Raise -n argument. Giving up.\n");
289 close(fd);
290 return SN_ERR_PRXCOND; /* it is a configuration limit */
291 }
292
293 if ((fcntl(fd, F_SETFL, O_NONBLOCK)==-1) ||
Simon Hormande072bd2011-06-24 15:11:37 +0900294 (setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &one, sizeof(one)) == -1)) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200295 qfprintf(stderr,"Cannot set client socket to non blocking mode.\n");
296 close(fd);
297 return SN_ERR_INTERNAL;
298 }
299
300 if (be->options & PR_O_TCP_SRV_KA)
Simon Hormande072bd2011-06-24 15:11:37 +0900301 setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, &one, sizeof(one));
Willy Tarreau9650f372009-08-16 14:02:45 +0200302
Willy Tarreau9650f372009-08-16 14:02:45 +0200303 /* allow specific binding :
304 * - server-specific at first
305 * - proxy-specific next
306 */
Willy Tarreaua4380b42012-12-08 22:49:11 +0100307 if (srv && srv->conn_src.opts & CO_SRC_BIND)
308 src = &srv->conn_src;
309 else if (be->conn_src.opts & CO_SRC_BIND)
310 src = &be->conn_src;
311 else
312 src = NULL;
313
314 if (src) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200315 int ret, flags = 0;
316
Willy Tarreau5f2877a2012-10-26 19:57:58 +0200317 if (is_addr(&conn->addr.from)) {
Willy Tarreaua4380b42012-12-08 22:49:11 +0100318 switch (src->opts & CO_SRC_TPROXY_MASK) {
Willy Tarreauef9a3602012-12-08 22:29:20 +0100319 case CO_SRC_TPROXY_ADDR:
320 case CO_SRC_TPROXY_CLI:
Willy Tarreau5f2877a2012-10-26 19:57:58 +0200321 flags = 3;
322 break;
Willy Tarreauef9a3602012-12-08 22:29:20 +0100323 case CO_SRC_TPROXY_CIP:
324 case CO_SRC_TPROXY_DYN:
Willy Tarreau5f2877a2012-10-26 19:57:58 +0200325 flags = 1;
326 break;
327 }
Willy Tarreau9650f372009-08-16 14:02:45 +0200328 }
Willy Tarreaub1d67742010-03-29 19:36:59 +0200329
Willy Tarreau9650f372009-08-16 14:02:45 +0200330#ifdef SO_BINDTODEVICE
331 /* Note: this might fail if not CAP_NET_RAW */
Willy Tarreaua4380b42012-12-08 22:49:11 +0100332 if (src->iface_name)
333 setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, src->iface_name, src->iface_len + 1);
Willy Tarreau9650f372009-08-16 14:02:45 +0200334#endif
335
Willy Tarreaua4380b42012-12-08 22:49:11 +0100336 if (src->sport_range) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200337 int attempts = 10; /* should be more than enough to find a spare port */
Willy Tarreaua4380b42012-12-08 22:49:11 +0100338 struct sockaddr_storage sa;
Willy Tarreau9650f372009-08-16 14:02:45 +0200339
340 ret = 1;
Willy Tarreaua4380b42012-12-08 22:49:11 +0100341 sa = src->source_addr;
Willy Tarreau9650f372009-08-16 14:02:45 +0200342
343 do {
344 /* note: in case of retry, we may have to release a previously
345 * allocated port, hence this loop's construct.
346 */
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200347 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
348 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200349
350 if (!attempts)
351 break;
352 attempts--;
353
Willy Tarreaua4380b42012-12-08 22:49:11 +0100354 fdinfo[fd].local_port = port_range_alloc_port(src->sport_range);
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200355 if (!fdinfo[fd].local_port)
Willy Tarreau9650f372009-08-16 14:02:45 +0200356 break;
357
Willy Tarreaua4380b42012-12-08 22:49:11 +0100358 fdinfo[fd].port_range = src->sport_range;
359 set_host_port(&sa, fdinfo[fd].local_port);
Willy Tarreau9650f372009-08-16 14:02:45 +0200360
Willy Tarreaua4380b42012-12-08 22:49:11 +0100361 ret = tcp_bind_socket(fd, flags, &sa, &conn->addr.from);
Willy Tarreau9650f372009-08-16 14:02:45 +0200362 } while (ret != 0); /* binding NOK */
363 }
364 else {
Willy Tarreaua4380b42012-12-08 22:49:11 +0100365 ret = tcp_bind_socket(fd, flags, &src->source_addr, &conn->addr.from);
Willy Tarreau9650f372009-08-16 14:02:45 +0200366 }
367
Willy Tarreaua4380b42012-12-08 22:49:11 +0100368 if (unlikely(ret != 0)) {
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200369 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
370 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200371 close(fd);
372
Willy Tarreau9650f372009-08-16 14:02:45 +0200373 if (ret == 1) {
Willy Tarreaua4380b42012-12-08 22:49:11 +0100374 Alert("Cannot bind to source address before connect() for backend %s. Aborting.\n",
Willy Tarreau9650f372009-08-16 14:02:45 +0200375 be->id);
376 send_log(be, LOG_EMERG,
Willy Tarreaua4380b42012-12-08 22:49:11 +0100377 "Cannot bind to source address before connect() for backend %s.\n",
Willy Tarreau9650f372009-08-16 14:02:45 +0200378 be->id);
379 } else {
Willy Tarreaua4380b42012-12-08 22:49:11 +0100380 Alert("Cannot bind to tproxy source address before connect() for backend %s. Aborting.\n",
Willy Tarreau9650f372009-08-16 14:02:45 +0200381 be->id);
382 send_log(be, LOG_EMERG,
Willy Tarreaua4380b42012-12-08 22:49:11 +0100383 "Cannot bind to tproxy source address before connect() for backend %s.\n",
Willy Tarreau9650f372009-08-16 14:02:45 +0200384 be->id);
385 }
386 return SN_ERR_RESOURCE;
387 }
388 }
389
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400390#if defined(TCP_QUICKACK)
Willy Tarreau9650f372009-08-16 14:02:45 +0200391 /* disabling tcp quick ack now allows the first request to leave the
392 * machine with the first ACK. We only do this if there are pending
Willy Tarreauf0837b22012-11-24 10:24:27 +0100393 * data in the buffer.
Willy Tarreau9650f372009-08-16 14:02:45 +0200394 */
Willy Tarreauf0837b22012-11-24 10:24:27 +0100395 if (delack == 2 || ((delack || data) && (be->options2 & PR_O2_SMARTCON)))
Simon Hormande072bd2011-06-24 15:11:37 +0900396 setsockopt(fd, IPPROTO_TCP, TCP_QUICKACK, &zero, sizeof(zero));
Willy Tarreau9650f372009-08-16 14:02:45 +0200397#endif
398
Willy Tarreaue803de22010-01-21 17:43:04 +0100399 if (global.tune.server_sndbuf)
400 setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &global.tune.server_sndbuf, sizeof(global.tune.server_sndbuf));
401
402 if (global.tune.server_rcvbuf)
403 setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &global.tune.server_rcvbuf, sizeof(global.tune.server_rcvbuf));
404
Willy Tarreau986a9d22012-08-30 21:11:38 +0200405 if ((connect(fd, (struct sockaddr *)&conn->addr.to, get_addr_len(&conn->addr.to)) == -1) &&
Willy Tarreau9650f372009-08-16 14:02:45 +0200406 (errno != EINPROGRESS) && (errno != EALREADY) && (errno != EISCONN)) {
407
Willy Tarreaub1719512012-12-08 23:03:28 +0100408 if (errno == EAGAIN || errno == EADDRINUSE || errno == EADDRNOTAVAIL) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200409 char *msg;
Willy Tarreaub1719512012-12-08 23:03:28 +0100410 if (errno == EAGAIN || errno == EADDRNOTAVAIL)
Willy Tarreau9650f372009-08-16 14:02:45 +0200411 msg = "no free ports";
412 else
413 msg = "local address already in use";
414
Willy Tarreaub1719512012-12-08 23:03:28 +0100415 qfprintf(stderr,"Connect() failed for backend %s: %s.\n", be->id, msg);
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200416 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
417 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200418 close(fd);
Willy Tarreaub1719512012-12-08 23:03:28 +0100419 send_log(be, LOG_ERR, "Connect() failed for backend %s: %s.\n", be->id, msg);
Willy Tarreau9650f372009-08-16 14:02:45 +0200420 return SN_ERR_RESOURCE;
421 } else if (errno == ETIMEDOUT) {
422 //qfprintf(stderr,"Connect(): ETIMEDOUT");
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200423 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
424 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200425 close(fd);
426 return SN_ERR_SRVTO;
427 } else {
428 // (errno == ECONNREFUSED || errno == ENETUNREACH || errno == EACCES || errno == EPERM)
429 //qfprintf(stderr,"Connect(): %d", errno);
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200430 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
431 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200432 close(fd);
433 return SN_ERR_SRVCL;
434 }
435 }
436
Willy Tarreau986a9d22012-08-30 21:11:38 +0200437 fdtab[fd].owner = conn;
Willy Tarreau986a9d22012-08-30 21:11:38 +0200438 conn->flags = CO_FL_WAIT_L4_CONN; /* connection in progress */
Willy Tarreaufc8f1f02012-12-08 18:53:44 +0100439 conn->flags |= CO_FL_ADDR_TO_SET;
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200440
Willy Tarreaud2274c62012-07-06 14:29:45 +0200441 fdtab[fd].iocb = conn_fd_handler;
Willy Tarreau9650f372009-08-16 14:02:45 +0200442 fd_insert(fd);
Willy Tarreau986a9d22012-08-30 21:11:38 +0200443 conn_sock_want_send(conn); /* for connect status */
Willy Tarreau15678ef2012-08-31 13:54:11 +0200444
Willy Tarreauf7bc57c2012-10-03 00:19:48 +0200445 if (conn_xprt_init(conn) < 0) {
Willy Tarreau184636e2012-09-06 14:04:41 +0200446 fd_delete(fd);
Willy Tarreau15678ef2012-08-31 13:54:11 +0200447 return SN_ERR_RESOURCE;
Willy Tarreau184636e2012-09-06 14:04:41 +0200448 }
Willy Tarreau15678ef2012-08-31 13:54:11 +0200449
Willy Tarreau14f8e862012-08-30 22:23:13 +0200450 if (data)
Willy Tarreau986a9d22012-08-30 21:11:38 +0200451 conn_data_want_send(conn); /* prepare to send data if any */
Willy Tarreau9650f372009-08-16 14:02:45 +0200452
Willy Tarreau9650f372009-08-16 14:02:45 +0200453 return SN_ERR_NONE; /* connection is OK */
454}
455
456
Willy Tarreau59b94792012-05-11 16:16:40 +0200457/*
458 * Retrieves the source address for the socket <fd>, with <dir> indicating
459 * if we're a listener (=0) or an initiator (!=0). It returns 0 in case of
460 * success, -1 in case of error. The socket's source address is stored in
461 * <sa> for <salen> bytes.
462 */
463int tcp_get_src(int fd, struct sockaddr *sa, socklen_t salen, int dir)
464{
465 if (dir)
466 return getsockname(fd, sa, &salen);
467 else
468 return getpeername(fd, sa, &salen);
469}
470
471
472/*
473 * Retrieves the original destination address for the socket <fd>, with <dir>
474 * indicating if we're a listener (=0) or an initiator (!=0). In the case of a
475 * listener, if the original destination address was translated, the original
476 * address is retrieved. It returns 0 in case of success, -1 in case of error.
477 * The socket's source address is stored in <sa> for <salen> bytes.
478 */
479int tcp_get_dst(int fd, struct sockaddr *sa, socklen_t salen, int dir)
480{
481 if (dir)
482 return getpeername(fd, sa, &salen);
483#if defined(TPROXY) && defined(SO_ORIGINAL_DST)
484 else if (getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) == 0)
485 return 0;
486#endif
487 else
488 return getsockname(fd, sa, &salen);
489}
490
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200491/* This is the callback which is set when a connection establishment is pending
492 * and we have nothing to send, or if we have an init function we want to call
Willy Tarreauafad0e02012-08-09 14:45:22 +0200493 * once the connection is established. It updates the FD polling status. It
494 * returns 0 if it fails in a fatal way or needs to poll to go further, otherwise
495 * it returns non-zero and removes itself from the connection's flags (the bit is
496 * provided in <flag> by the caller).
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200497 */
Willy Tarreau239d7182012-07-23 18:53:03 +0200498int tcp_connect_probe(struct connection *conn)
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200499{
Willy Tarreau239d7182012-07-23 18:53:03 +0200500 int fd = conn->t.sock.fd;
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200501
Willy Tarreau80184712012-07-06 14:54:49 +0200502 if (conn->flags & CO_FL_ERROR)
Willy Tarreauafad0e02012-08-09 14:45:22 +0200503 return 0;
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200504
Willy Tarreau80184712012-07-06 14:54:49 +0200505 if (!(conn->flags & CO_FL_WAIT_L4_CONN))
Willy Tarreau0b0c0972012-07-23 20:05:00 +0200506 return 1; /* strange we were called while ready */
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200507
Willy Tarreau2da156f2012-07-23 15:07:23 +0200508 /* stop here if we reached the end of data */
509 if ((fdtab[fd].ev & (FD_POLL_IN|FD_POLL_HUP)) == FD_POLL_HUP)
510 goto out_error;
511
Willy Tarreau2c6be842012-07-06 17:12:34 +0200512 /* We have no data to send to check the connection, and
513 * getsockopt() will not inform us whether the connection
514 * is still pending. So we'll reuse connect() to check the
515 * state of the socket. This has the advantage of giving us
516 * the following info :
517 * - error
518 * - connecting (EALREADY, EINPROGRESS)
519 * - connected (EISCONN, 0)
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200520 */
Willy Tarreau986a9d22012-08-30 21:11:38 +0200521 if (connect(fd, (struct sockaddr *)&conn->addr.to, get_addr_len(&conn->addr.to)) < 0) {
Willy Tarreauf9dabec2012-08-17 17:33:53 +0200522 if (errno == EALREADY || errno == EINPROGRESS) {
523 conn_sock_stop_recv(conn);
524 conn_sock_poll_send(conn);
Willy Tarreau0b0c0972012-07-23 20:05:00 +0200525 return 0;
Willy Tarreauf9dabec2012-08-17 17:33:53 +0200526 }
Willy Tarreaua190d592012-05-20 18:35:19 +0200527
Willy Tarreau2c6be842012-07-06 17:12:34 +0200528 if (errno && errno != EISCONN)
Willy Tarreaua190d592012-05-20 18:35:19 +0200529 goto out_error;
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200530
Willy Tarreau2c6be842012-07-06 17:12:34 +0200531 /* otherwise we're connected */
Willy Tarreaua190d592012-05-20 18:35:19 +0200532 }
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200533
Willy Tarreau076be252012-07-06 16:02:29 +0200534 /* The FD is ready now, we'll mark the connection as complete and
Willy Tarreauf7bc57c2012-10-03 00:19:48 +0200535 * forward the event to the transport layer which will notify the
536 * data layer.
Willy Tarreaua190d592012-05-20 18:35:19 +0200537 */
Willy Tarreau80184712012-07-06 14:54:49 +0200538 conn->flags &= ~CO_FL_WAIT_L4_CONN;
Willy Tarreau0b0c0972012-07-23 20:05:00 +0200539 return 1;
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200540
541 out_error:
Willy Tarreau0b0c0972012-07-23 20:05:00 +0200542 /* Write error on the file descriptor. Report it to the connection
543 * and disable polling on this FD.
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200544 */
545
Willy Tarreau80184712012-07-06 14:54:49 +0200546 conn->flags |= CO_FL_ERROR;
Willy Tarreauf9dabec2012-08-17 17:33:53 +0200547 conn_sock_stop_both(conn);
Willy Tarreauafad0e02012-08-09 14:45:22 +0200548 return 0;
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200549}
550
Willy Tarreau59b94792012-05-11 16:16:40 +0200551
Willy Tarreaue6b98942007-10-29 01:09:36 +0100552/* This function tries to bind a TCPv4/v6 listener. It may return a warning or
553 * an error message in <err> if the message is at most <errlen> bytes long
554 * (including '\0'). The return value is composed from ERR_ABORT, ERR_WARN,
555 * ERR_ALERT, ERR_RETRYABLE and ERR_FATAL. ERR_NONE indicates that everything
556 * was alright and that no message was returned. ERR_RETRYABLE means that an
557 * error occurred but that it may vanish after a retry (eg: port in use), and
Aman Guptad94991d2012-04-06 17:39:26 -0700558 * ERR_FATAL indicates a non-fixable error. ERR_WARN and ERR_ALERT do not alter
Willy Tarreaue6b98942007-10-29 01:09:36 +0100559 * the meaning of the error, but just indicate that a message is present which
560 * should be displayed with the respective level. Last, ERR_ABORT indicates
561 * that it's pointless to try to start other listeners. No error message is
562 * returned if errlen is NULL.
563 */
564int tcp_bind_listener(struct listener *listener, char *errmsg, int errlen)
565{
566 __label__ tcp_return, tcp_close_return;
567 int fd, err;
568 const char *msg = NULL;
569
570 /* ensure we never return garbage */
571 if (errmsg && errlen)
572 *errmsg = 0;
573
574 if (listener->state != LI_ASSIGNED)
575 return ERR_NONE; /* already bound */
576
577 err = ERR_NONE;
578
579 if ((fd = socket(listener->addr.ss_family, SOCK_STREAM, IPPROTO_TCP)) == -1) {
580 err |= ERR_RETRYABLE | ERR_ALERT;
581 msg = "cannot create listening socket";
582 goto tcp_return;
583 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100584
Willy Tarreaue6b98942007-10-29 01:09:36 +0100585 if (fd >= global.maxsock) {
586 err |= ERR_FATAL | ERR_ABORT | ERR_ALERT;
587 msg = "not enough free sockets (raise '-n' parameter)";
588 goto tcp_close_return;
589 }
590
Willy Tarreaufb14edc2009-06-14 15:24:37 +0200591 if (fcntl(fd, F_SETFL, O_NONBLOCK) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100592 err |= ERR_FATAL | ERR_ALERT;
593 msg = "cannot make socket non-blocking";
594 goto tcp_close_return;
595 }
596
Simon Hormande072bd2011-06-24 15:11:37 +0900597 if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100598 /* not fatal but should be reported */
599 msg = "cannot do so_reuseaddr";
600 err |= ERR_ALERT;
601 }
602
603 if (listener->options & LI_O_NOLINGER)
Simon Hormande072bd2011-06-24 15:11:37 +0900604 setsockopt(fd, SOL_SOCKET, SO_LINGER, &nolinger, sizeof(struct linger));
Willy Tarreauedcf6682008-11-30 23:15:34 +0100605
Willy Tarreaue6b98942007-10-29 01:09:36 +0100606#ifdef SO_REUSEPORT
607 /* OpenBSD supports this. As it's present in old libc versions of Linux,
608 * it might return an error that we will silently ignore.
609 */
Simon Hormande072bd2011-06-24 15:11:37 +0900610 setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &one, sizeof(one));
Willy Tarreaue6b98942007-10-29 01:09:36 +0100611#endif
Willy Tarreaub1e52e82008-01-13 14:49:51 +0100612#ifdef CONFIG_HAP_LINUX_TPROXY
David du Colombier65c17962012-07-13 14:34:59 +0200613 if (listener->options & LI_O_FOREIGN) {
614 switch (listener->addr.ss_family) {
615 case AF_INET:
616 if ((setsockopt(fd, SOL_IP, IP_TRANSPARENT, &one, sizeof(one)) == -1)
617 && (setsockopt(fd, SOL_IP, IP_FREEBIND, &one, sizeof(one)) == -1)) {
618 msg = "cannot make listening socket transparent";
619 err |= ERR_ALERT;
620 }
621 break;
622 case AF_INET6:
623 if (setsockopt(fd, SOL_IPV6, IPV6_TRANSPARENT, &one, sizeof(one)) == -1) {
624 msg = "cannot make listening socket transparent";
625 err |= ERR_ALERT;
626 }
627 break;
628 }
Willy Tarreaub1e52e82008-01-13 14:49:51 +0100629 }
630#endif
Willy Tarreau5e6e2042009-02-04 17:19:29 +0100631#ifdef SO_BINDTODEVICE
632 /* Note: this might fail if not CAP_NET_RAW */
633 if (listener->interface) {
634 if (setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE,
Willy Tarreau604e8302009-03-06 00:48:23 +0100635 listener->interface, strlen(listener->interface) + 1) == -1) {
Willy Tarreau5e6e2042009-02-04 17:19:29 +0100636 msg = "cannot bind listener to device";
637 err |= ERR_WARN;
638 }
639 }
640#endif
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400641#if defined(TCP_MAXSEG)
Willy Tarreau48a7e722010-12-24 15:26:39 +0100642 if (listener->maxseg > 0) {
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400643 if (setsockopt(fd, IPPROTO_TCP, TCP_MAXSEG,
Willy Tarreaube1b9182009-06-14 18:48:19 +0200644 &listener->maxseg, sizeof(listener->maxseg)) == -1) {
645 msg = "cannot set MSS";
646 err |= ERR_WARN;
647 }
648 }
649#endif
Willy Tarreaucb6cd432009-10-13 07:34:14 +0200650#if defined(TCP_DEFER_ACCEPT)
651 if (listener->options & LI_O_DEF_ACCEPT) {
652 /* defer accept by up to one second */
653 int accept_delay = 1;
654 if (setsockopt(fd, IPPROTO_TCP, TCP_DEFER_ACCEPT, &accept_delay, sizeof(accept_delay)) == -1) {
655 msg = "cannot enable DEFER_ACCEPT";
656 err |= ERR_WARN;
657 }
658 }
659#endif
Willy Tarreau1c862c52012-10-05 16:21:00 +0200660#if defined(TCP_FASTOPEN)
661 if (listener->options & LI_O_TCP_FO) {
662 /* TFO needs a queue length, let's use the configured backlog */
663 int qlen = listener->backlog ? listener->backlog : listener->maxconn;
664 if (setsockopt(fd, IPPROTO_TCP, TCP_FASTOPEN, &qlen, sizeof(qlen)) == -1) {
665 msg = "cannot enable TCP_FASTOPEN";
666 err |= ERR_WARN;
667 }
668 }
669#endif
Willy Tarreau9b6700f2012-11-24 11:55:28 +0100670#if defined(IPV6_V6ONLY)
671 if (listener->options & LI_O_V6ONLY)
672 setsockopt(fd, IPPROTO_IPV6, IPV6_V6ONLY, &one, sizeof(one));
Willy Tarreau77e3af92012-11-24 15:07:23 +0100673 else if (listener->options & LI_O_V4V6)
674 setsockopt(fd, IPPROTO_IPV6, IPV6_V6ONLY, &zero, sizeof(zero));
Willy Tarreau9b6700f2012-11-24 11:55:28 +0100675#endif
676
Willy Tarreaue6b98942007-10-29 01:09:36 +0100677 if (bind(fd, (struct sockaddr *)&listener->addr, listener->proto->sock_addrlen) == -1) {
678 err |= ERR_RETRYABLE | ERR_ALERT;
679 msg = "cannot bind socket";
680 goto tcp_close_return;
681 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100682
Willy Tarreauc73ce2b2008-01-06 10:55:10 +0100683 if (listen(fd, listener->backlog ? listener->backlog : listener->maxconn) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100684 err |= ERR_RETRYABLE | ERR_ALERT;
685 msg = "cannot listen to socket";
686 goto tcp_close_return;
687 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100688
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400689#if defined(TCP_QUICKACK)
Willy Tarreau9ea05a72009-06-14 12:07:01 +0200690 if (listener->options & LI_O_NOQUICKACK)
Simon Hormande072bd2011-06-24 15:11:37 +0900691 setsockopt(fd, IPPROTO_TCP, TCP_QUICKACK, &zero, sizeof(zero));
Willy Tarreau9ea05a72009-06-14 12:07:01 +0200692#endif
693
Willy Tarreaue6b98942007-10-29 01:09:36 +0100694 /* the socket is ready */
695 listener->fd = fd;
696 listener->state = LI_LISTEN;
697
Willy Tarreaueabf3132008-08-29 23:36:51 +0200698 fdtab[fd].owner = listener; /* reference the listener instead of a task */
Willy Tarreauaece46a2012-07-06 12:25:58 +0200699 fdtab[fd].iocb = listener->proto->accept;
Willy Tarreaueb472682010-05-28 18:46:57 +0200700 fd_insert(fd);
701
Willy Tarreaue6b98942007-10-29 01:09:36 +0100702 tcp_return:
Cyril Bonté43ba1b32010-11-01 19:26:01 +0100703 if (msg && errlen) {
704 char pn[INET6_ADDRSTRLEN];
705
Willy Tarreau631f01c2011-09-05 00:36:48 +0200706 addr_to_str(&listener->addr, pn, sizeof(pn));
707 snprintf(errmsg, errlen, "%s [%s:%d]", msg, pn, get_host_port(&listener->addr));
Cyril Bonté43ba1b32010-11-01 19:26:01 +0100708 }
Willy Tarreaue6b98942007-10-29 01:09:36 +0100709 return err;
710
711 tcp_close_return:
712 close(fd);
713 goto tcp_return;
714}
715
716/* This function creates all TCP sockets bound to the protocol entry <proto>.
717 * It is intended to be used as the protocol's bind_all() function.
718 * The sockets will be registered but not added to any fd_set, in order not to
719 * loose them across the fork(). A call to enable_all_listeners() is needed
720 * to complete initialization. The return value is composed from ERR_*.
721 */
Emeric Bruncf20bf12010-10-22 16:06:11 +0200722static int tcp_bind_listeners(struct protocol *proto, char *errmsg, int errlen)
Willy Tarreaue6b98942007-10-29 01:09:36 +0100723{
724 struct listener *listener;
725 int err = ERR_NONE;
726
727 list_for_each_entry(listener, &proto->listeners, proto_list) {
Emeric Bruncf20bf12010-10-22 16:06:11 +0200728 err |= tcp_bind_listener(listener, errmsg, errlen);
729 if (err & ERR_ABORT)
Willy Tarreaue6b98942007-10-29 01:09:36 +0100730 break;
731 }
732
733 return err;
734}
735
736/* Add listener to the list of tcpv4 listeners. The listener's state
737 * is automatically updated from LI_INIT to LI_ASSIGNED. The number of
738 * listeners is updated. This is the function to use to add a new listener.
739 */
740void tcpv4_add_listener(struct listener *listener)
741{
742 if (listener->state != LI_INIT)
743 return;
744 listener->state = LI_ASSIGNED;
745 listener->proto = &proto_tcpv4;
746 LIST_ADDQ(&proto_tcpv4.listeners, &listener->proto_list);
747 proto_tcpv4.nb_listeners++;
748}
749
750/* Add listener to the list of tcpv4 listeners. The listener's state
751 * is automatically updated from LI_INIT to LI_ASSIGNED. The number of
752 * listeners is updated. This is the function to use to add a new listener.
753 */
754void tcpv6_add_listener(struct listener *listener)
755{
756 if (listener->state != LI_INIT)
757 return;
758 listener->state = LI_ASSIGNED;
759 listener->proto = &proto_tcpv6;
760 LIST_ADDQ(&proto_tcpv6.listeners, &listener->proto_list);
761 proto_tcpv6.nb_listeners++;
762}
763
Willy Tarreauedcf6682008-11-30 23:15:34 +0100764/* This function performs the TCP request analysis on the current request. It
765 * returns 1 if the processing can continue on next analysers, or zero if it
766 * needs more data, encounters an error, or wants to immediately abort the
Willy Tarreaufb356202010-08-03 14:02:05 +0200767 * request. It relies on buffers flags, and updates s->req->analysers. The
768 * function may be called for frontend rules and backend rules. It only relies
769 * on the backend pointer so this works for both cases.
Willy Tarreauedcf6682008-11-30 23:15:34 +0100770 */
Willy Tarreau7421efb2012-07-02 15:11:27 +0200771int tcp_inspect_request(struct session *s, struct channel *req, int an_bit)
Willy Tarreauedcf6682008-11-30 23:15:34 +0100772{
773 struct tcp_rule *rule;
Willy Tarreaud1f96522010-08-03 19:34:32 +0200774 struct stksess *ts;
775 struct stktable *t;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100776 int partial;
777
Willy Tarreau02d6cfc2012-03-01 18:19:58 +0100778 DPRINTF(stderr,"[%u] %s: session=%p b=%p, exp(r,w)=%u,%u bf=%08x bh=%d analysers=%02x\n",
Willy Tarreauedcf6682008-11-30 23:15:34 +0100779 now_ms, __FUNCTION__,
780 s,
781 req,
782 req->rex, req->wex,
783 req->flags,
Willy Tarreau9b28e032012-10-12 23:49:43 +0200784 req->buf->i,
Willy Tarreauedcf6682008-11-30 23:15:34 +0100785 req->analysers);
786
Willy Tarreauedcf6682008-11-30 23:15:34 +0100787 /* We don't know whether we have enough data, so must proceed
788 * this way :
789 * - iterate through all rules in their declaration order
790 * - if one rule returns MISS, it means the inspect delay is
791 * not over yet, then return immediately, otherwise consider
792 * it as a non-match.
793 * - if one rule returns OK, then return OK
794 * - if one rule returns KO, then return KO
795 */
796
Willy Tarreau9b28e032012-10-12 23:49:43 +0200797 if ((req->flags & CF_SHUTR) || buffer_full(req->buf, global.tune.maxrewrite) ||
Willy Tarreau3bf1b2b2012-08-27 20:46:07 +0200798 !s->be->tcp_req.inspect_delay || tick_is_expired(req->analyse_exp, now_ms))
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200799 partial = SMP_OPT_FINAL;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100800 else
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200801 partial = 0;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100802
Willy Tarreaufb356202010-08-03 14:02:05 +0200803 list_for_each_entry(rule, &s->be->tcp_req.inspect_rules, list) {
Willy Tarreauedcf6682008-11-30 23:15:34 +0100804 int ret = ACL_PAT_PASS;
805
806 if (rule->cond) {
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200807 ret = acl_exec_cond(rule->cond, s->be, s, &s->txn, SMP_OPT_DIR_REQ | partial);
Willy Tarreauedcf6682008-11-30 23:15:34 +0100808 if (ret == ACL_PAT_MISS) {
Willy Tarreau8263d2b2012-08-28 00:06:31 +0200809 channel_dont_connect(req);
Willy Tarreauedcf6682008-11-30 23:15:34 +0100810 /* just set the request timeout once at the beginning of the request */
Willy Tarreaufb356202010-08-03 14:02:05 +0200811 if (!tick_isset(req->analyse_exp) && s->be->tcp_req.inspect_delay)
812 req->analyse_exp = tick_add_ifset(now_ms, s->be->tcp_req.inspect_delay);
Willy Tarreauedcf6682008-11-30 23:15:34 +0100813 return 0;
814 }
815
816 ret = acl_pass(ret);
817 if (rule->cond->pol == ACL_COND_UNLESS)
818 ret = !ret;
819 }
820
821 if (ret) {
822 /* we have a matching rule. */
823 if (rule->action == TCP_ACT_REJECT) {
Willy Tarreau8263d2b2012-08-28 00:06:31 +0200824 channel_abort(req);
825 channel_abort(s->rep);
Willy Tarreauedcf6682008-11-30 23:15:34 +0100826 req->analysers = 0;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +0200827
Willy Tarreau7d0aaf32011-03-10 23:25:56 +0100828 s->be->be_counters.denied_req++;
829 s->fe->fe_counters.denied_req++;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +0200830 if (s->listener->counters)
Willy Tarreau23968d82010-05-23 23:50:44 +0200831 s->listener->counters->denied_req++;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +0200832
Willy Tarreauedcf6682008-11-30 23:15:34 +0100833 if (!(s->flags & SN_ERR_MASK))
834 s->flags |= SN_ERR_PRXCOND;
835 if (!(s->flags & SN_FINST_MASK))
836 s->flags |= SN_FINST_R;
837 return 0;
838 }
Willy Tarreau20d46a52012-12-09 15:55:40 +0100839 else if ((rule->action == TCP_ACT_TRK_SC1 && !s->stkctr[0].entry) ||
840 (rule->action == TCP_ACT_TRK_SC2 && !s->stkctr[1].entry)) {
Willy Tarreau5d5b5d82012-12-09 12:00:04 +0100841 /* Note: only the first valid tracking parameter of each
842 * applies.
843 */
844 struct stktable_key *key;
845
846 t = rule->act_prm.trk_ctr.table.t;
847 key = stktable_fetch_key(t, s->be, s, &s->txn, SMP_OPT_DIR_REQ|SMP_OPT_FINAL, rule->act_prm.trk_ctr.expr);
848
849 if (key && (ts = stktable_get_entry(t, key))) {
850 if (rule->action == TCP_ACT_TRK_SC1) {
Willy Tarreau20d46a52012-12-09 15:55:40 +0100851 session_track_stkctr(&s->stkctr[0], t, ts);
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200852 if (s->fe != s->be)
853 s->flags |= SN_BE_TRACK_SC1;
Willy Tarreau5d5b5d82012-12-09 12:00:04 +0100854 } else {
Willy Tarreau20d46a52012-12-09 15:55:40 +0100855 session_track_stkctr(&s->stkctr[1], t, ts);
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200856 if (s->fe != s->be)
857 s->flags |= SN_BE_TRACK_SC2;
858 }
Willy Tarreaud1f96522010-08-03 19:34:32 +0200859 }
860 }
861 else {
Willy Tarreauedcf6682008-11-30 23:15:34 +0100862 /* otherwise accept */
Willy Tarreaud1f96522010-08-03 19:34:32 +0200863 break;
864 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100865 }
866 }
867
868 /* if we get there, it means we have no rule which matches, or
869 * we have an explicit accept, so we apply the default accept.
870 */
Willy Tarreau3a816292009-07-07 10:55:49 +0200871 req->analysers &= ~an_bit;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100872 req->analyse_exp = TICK_ETERNITY;
873 return 1;
874}
875
Emeric Brun97679e72010-09-23 17:56:44 +0200876/* This function performs the TCP response analysis on the current response. It
877 * returns 1 if the processing can continue on next analysers, or zero if it
878 * needs more data, encounters an error, or wants to immediately abort the
879 * response. It relies on buffers flags, and updates s->rep->analysers. The
880 * function may be called for backend rules.
881 */
Willy Tarreau7421efb2012-07-02 15:11:27 +0200882int tcp_inspect_response(struct session *s, struct channel *rep, int an_bit)
Emeric Brun97679e72010-09-23 17:56:44 +0200883{
884 struct tcp_rule *rule;
885 int partial;
886
Willy Tarreau02d6cfc2012-03-01 18:19:58 +0100887 DPRINTF(stderr,"[%u] %s: session=%p b=%p, exp(r,w)=%u,%u bf=%08x bh=%d analysers=%02x\n",
Emeric Brun97679e72010-09-23 17:56:44 +0200888 now_ms, __FUNCTION__,
889 s,
890 rep,
891 rep->rex, rep->wex,
892 rep->flags,
Willy Tarreau9b28e032012-10-12 23:49:43 +0200893 rep->buf->i,
Emeric Brun97679e72010-09-23 17:56:44 +0200894 rep->analysers);
895
896 /* We don't know whether we have enough data, so must proceed
897 * this way :
898 * - iterate through all rules in their declaration order
899 * - if one rule returns MISS, it means the inspect delay is
900 * not over yet, then return immediately, otherwise consider
901 * it as a non-match.
902 * - if one rule returns OK, then return OK
903 * - if one rule returns KO, then return KO
904 */
905
Willy Tarreau03cdb7c2012-08-27 23:14:58 +0200906 if (rep->flags & CF_SHUTR || tick_is_expired(rep->analyse_exp, now_ms))
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200907 partial = SMP_OPT_FINAL;
Emeric Brun97679e72010-09-23 17:56:44 +0200908 else
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200909 partial = 0;
Emeric Brun97679e72010-09-23 17:56:44 +0200910
911 list_for_each_entry(rule, &s->be->tcp_rep.inspect_rules, list) {
912 int ret = ACL_PAT_PASS;
913
914 if (rule->cond) {
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200915 ret = acl_exec_cond(rule->cond, s->be, s, &s->txn, SMP_OPT_DIR_RES | partial);
Emeric Brun97679e72010-09-23 17:56:44 +0200916 if (ret == ACL_PAT_MISS) {
917 /* just set the analyser timeout once at the beginning of the response */
918 if (!tick_isset(rep->analyse_exp) && s->be->tcp_rep.inspect_delay)
919 rep->analyse_exp = tick_add_ifset(now_ms, s->be->tcp_rep.inspect_delay);
920 return 0;
921 }
922
923 ret = acl_pass(ret);
924 if (rule->cond->pol == ACL_COND_UNLESS)
925 ret = !ret;
926 }
927
928 if (ret) {
929 /* we have a matching rule. */
930 if (rule->action == TCP_ACT_REJECT) {
Willy Tarreau8263d2b2012-08-28 00:06:31 +0200931 channel_abort(rep);
932 channel_abort(s->req);
Emeric Brun97679e72010-09-23 17:56:44 +0200933 rep->analysers = 0;
934
Willy Tarreau7d0aaf32011-03-10 23:25:56 +0100935 s->be->be_counters.denied_resp++;
936 s->fe->fe_counters.denied_resp++;
Emeric Brun97679e72010-09-23 17:56:44 +0200937 if (s->listener->counters)
938 s->listener->counters->denied_resp++;
939
940 if (!(s->flags & SN_ERR_MASK))
941 s->flags |= SN_ERR_PRXCOND;
942 if (!(s->flags & SN_FINST_MASK))
943 s->flags |= SN_FINST_D;
944 return 0;
945 }
946 else {
947 /* otherwise accept */
948 break;
949 }
950 }
951 }
952
953 /* if we get there, it means we have no rule which matches, or
954 * we have an explicit accept, so we apply the default accept.
955 */
956 rep->analysers &= ~an_bit;
957 rep->analyse_exp = TICK_ETERNITY;
958 return 1;
959}
960
961
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200962/* This function performs the TCP layer4 analysis on the current request. It
963 * returns 0 if a reject rule matches, otherwise 1 if either an accept rule
964 * matches or if no more rule matches. It can only use rules which don't need
965 * any data.
966 */
967int tcp_exec_req_rules(struct session *s)
968{
969 struct tcp_rule *rule;
Willy Tarreauf059a0f2010-08-03 16:29:52 +0200970 struct stksess *ts;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200971 struct stktable *t = NULL;
972 int result = 1;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200973 int ret;
974
975 list_for_each_entry(rule, &s->fe->tcp_req.l4_rules, list) {
976 ret = ACL_PAT_PASS;
977
978 if (rule->cond) {
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200979 ret = acl_exec_cond(rule->cond, s->fe, s, NULL, SMP_OPT_DIR_REQ|SMP_OPT_FINAL);
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200980 ret = acl_pass(ret);
981 if (rule->cond->pol == ACL_COND_UNLESS)
982 ret = !ret;
983 }
984
985 if (ret) {
986 /* we have a matching rule. */
987 if (rule->action == TCP_ACT_REJECT) {
Willy Tarreau7d0aaf32011-03-10 23:25:56 +0100988 s->fe->fe_counters.denied_conn++;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200989 if (s->listener->counters)
Willy Tarreau2799e982010-06-05 15:43:21 +0200990 s->listener->counters->denied_conn++;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200991
992 if (!(s->flags & SN_ERR_MASK))
993 s->flags |= SN_ERR_PRXCOND;
994 if (!(s->flags & SN_FINST_MASK))
995 s->flags |= SN_FINST_R;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200996 result = 0;
997 break;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200998 }
Willy Tarreau20d46a52012-12-09 15:55:40 +0100999 else if ((rule->action == TCP_ACT_TRK_SC1 && !s->stkctr[0].entry) ||
1000 (rule->action == TCP_ACT_TRK_SC2 && !s->stkctr[1].entry)) {
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001001 /* Note: only the first valid tracking parameter of each
1002 * applies.
1003 */
1004 struct stktable_key *key;
1005
1006 t = rule->act_prm.trk_ctr.table.t;
1007 key = stktable_fetch_key(t, s->be, s, &s->txn, SMP_OPT_DIR_REQ|SMP_OPT_FINAL, rule->act_prm.trk_ctr.expr);
1008
1009 if (key && (ts = stktable_get_entry(t, key))) {
1010 if (rule->action == TCP_ACT_TRK_SC1)
Willy Tarreau20d46a52012-12-09 15:55:40 +01001011 session_track_stkctr(&s->stkctr[0], t, ts);
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001012 else
Willy Tarreau20d46a52012-12-09 15:55:40 +01001013 session_track_stkctr(&s->stkctr[1], t, ts);
Willy Tarreauf059a0f2010-08-03 16:29:52 +02001014 }
1015 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001016 else {
1017 /* otherwise it's an accept */
1018 break;
1019 }
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001020 }
1021 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001022 return result;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001023}
1024
Emeric Brun97679e72010-09-23 17:56:44 +02001025/* Parse a tcp-response rule. Return a negative value in case of failure */
1026static int tcp_parse_response_rule(char **args, int arg, int section_type,
1027 struct proxy *curpx, struct proxy *defpx,
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001028 struct tcp_rule *rule, char **err)
Emeric Brun97679e72010-09-23 17:56:44 +02001029{
1030 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001031 memprintf(err, "%s %s is only allowed in 'backend' sections",
1032 args[0], args[1]);
Emeric Brun97679e72010-09-23 17:56:44 +02001033 return -1;
1034 }
1035
1036 if (strcmp(args[arg], "accept") == 0) {
1037 arg++;
1038 rule->action = TCP_ACT_ACCEPT;
1039 }
1040 else if (strcmp(args[arg], "reject") == 0) {
1041 arg++;
1042 rule->action = TCP_ACT_REJECT;
1043 }
1044 else {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001045 memprintf(err,
1046 "'%s %s' expects 'accept' or 'reject' in %s '%s' (got '%s')",
1047 args[0], args[1], proxy_type_str(curpx), curpx->id, args[arg]);
Emeric Brun97679e72010-09-23 17:56:44 +02001048 return -1;
1049 }
1050
1051 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001052 if ((rule->cond = build_acl_cond(NULL, 0, curpx, (const char **)args+arg, err)) == NULL) {
1053 memprintf(err,
1054 "'%s %s %s' : error detected in %s '%s' while parsing '%s' condition : %s",
1055 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg], *err);
Emeric Brun97679e72010-09-23 17:56:44 +02001056 return -1;
1057 }
1058 }
1059 else if (*args[arg]) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001060 memprintf(err,
1061 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (got '%s')",
Emeric Brun97679e72010-09-23 17:56:44 +02001062 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
1063 return -1;
1064 }
1065 return 0;
1066}
1067
1068
1069
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001070/* Parse a tcp-request rule. Return a negative value in case of failure */
1071static int tcp_parse_request_rule(char **args, int arg, int section_type,
1072 struct proxy *curpx, struct proxy *defpx,
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001073 struct tcp_rule *rule, char **err)
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001074{
1075 if (curpx == defpx) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001076 memprintf(err, "%s %s is not allowed in 'defaults' sections",
1077 args[0], args[1]);
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001078 return -1;
1079 }
1080
1081 if (!strcmp(args[arg], "accept")) {
1082 arg++;
1083 rule->action = TCP_ACT_ACCEPT;
1084 }
1085 else if (!strcmp(args[arg], "reject")) {
1086 arg++;
1087 rule->action = TCP_ACT_REJECT;
1088 }
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001089 else if (strcmp(args[arg], "track-sc1") == 0 || strcmp(args[arg], "track-sc2") == 0) {
1090 struct sample_expr *expr;
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001091 int kw = arg;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001092
1093 arg++;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001094
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001095 expr = sample_parse_expr(args, &arg, trash.str, trash.size);
1096 if (!expr) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001097 memprintf(err,
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001098 "'%s %s %s' : %s",
1099 args[0], args[1], args[kw], trash.str);
1100 return -1;
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001101 }
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001102
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001103 if (!(expr->fetch->cap & SMP_CAP_REQ)) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001104 memprintf(err,
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001105 "'%s %s %s' : fetch method '%s' cannot be used on request",
1106 args[0], args[1], args[kw], trash.str);
1107 free(expr);
1108 return -1;
1109 }
1110
1111 /* check if we need to allocate an hdr_idx struct for HTTP parsing */
1112 if (expr->fetch->cap & SMP_CAP_L7)
1113 curpx->acl_requires |= ACL_USE_L7_ANY;
1114
1115 if (strcmp(args[arg], "table") == 0) {
1116 if (!args[arg + 1]) {
1117 memprintf(err,
1118 "'%s %s %s' : missing table name",
1119 args[0], args[1], args[kw]);
1120 free(expr);
1121 return -1;
1122 }
1123 /* we copy the table name for now, it will be resolved later */
1124 rule->act_prm.trk_ctr.table.n = strdup(args[arg + 1]);
1125 arg++;
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001126 }
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001127 rule->act_prm.trk_ctr.expr = expr;
1128
1129 if (args[kw][8] == '1')
1130 rule->action = TCP_ACT_TRK_SC1;
1131 else
1132 rule->action = TCP_ACT_TRK_SC2;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001133 }
1134 else {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001135 memprintf(err,
1136 "'%s %s' expects 'accept', 'reject', 'track-sc1' "
1137 "or 'track-sc2' in %s '%s' (got '%s')",
1138 args[0], args[1], proxy_type_str(curpx), curpx->id, args[arg]);
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001139 return -1;
1140 }
1141
1142 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001143 if ((rule->cond = build_acl_cond(NULL, 0, curpx, (const char **)args+arg, err)) == NULL) {
1144 memprintf(err,
1145 "'%s %s %s' : error detected in %s '%s' while parsing '%s' condition : %s",
1146 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg], *err);
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001147 return -1;
1148 }
1149 }
1150 else if (*args[arg]) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001151 memprintf(err,
1152 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (got '%s')",
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001153 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
1154 return -1;
1155 }
1156 return 0;
1157}
1158
Emeric Brun97679e72010-09-23 17:56:44 +02001159/* This function should be called to parse a line starting with the "tcp-response"
1160 * keyword.
1161 */
1162static int tcp_parse_tcp_rep(char **args, int section_type, struct proxy *curpx,
Willy Tarreau28a47d62012-09-18 20:02:48 +02001163 struct proxy *defpx, const char *file, int line,
1164 char **err)
Emeric Brun97679e72010-09-23 17:56:44 +02001165{
1166 const char *ptr = NULL;
1167 unsigned int val;
Emeric Brun97679e72010-09-23 17:56:44 +02001168 int warn = 0;
1169 int arg;
1170 struct tcp_rule *rule;
1171
1172 if (!*args[1]) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001173 memprintf(err, "missing argument for '%s' in %s '%s'",
1174 args[0], proxy_type_str(curpx), curpx->id);
Emeric Brun97679e72010-09-23 17:56:44 +02001175 return -1;
1176 }
1177
1178 if (strcmp(args[1], "inspect-delay") == 0) {
1179 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001180 memprintf(err, "%s %s is only allowed in 'backend' sections",
1181 args[0], args[1]);
Emeric Brun97679e72010-09-23 17:56:44 +02001182 return -1;
1183 }
1184
1185 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001186 memprintf(err,
1187 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
1188 args[0], args[1], proxy_type_str(curpx), curpx->id);
1189 if (ptr)
1190 memprintf(err, "%s (unexpected character '%c')", *err, *ptr);
Emeric Brun97679e72010-09-23 17:56:44 +02001191 return -1;
1192 }
1193
1194 if (curpx->tcp_rep.inspect_delay) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001195 memprintf(err, "ignoring %s %s (was already defined) in %s '%s'",
1196 args[0], args[1], proxy_type_str(curpx), curpx->id);
Emeric Brun97679e72010-09-23 17:56:44 +02001197 return 1;
1198 }
1199 curpx->tcp_rep.inspect_delay = val;
1200 return 0;
1201 }
1202
Simon Hormande072bd2011-06-24 15:11:37 +09001203 rule = calloc(1, sizeof(*rule));
Emeric Brun97679e72010-09-23 17:56:44 +02001204 LIST_INIT(&rule->list);
1205 arg = 1;
1206
1207 if (strcmp(args[1], "content") == 0) {
1208 arg++;
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001209 if (tcp_parse_response_rule(args, arg, section_type, curpx, defpx, rule, err) < 0)
Emeric Brun97679e72010-09-23 17:56:44 +02001210 goto error;
1211
1212 if (rule->cond && (rule->cond->requires & ACL_USE_L6REQ_VOLATILE)) {
1213 struct acl *acl;
1214 const char *name;
1215
1216 acl = cond_find_require(rule->cond, ACL_USE_L6REQ_VOLATILE);
1217 name = acl ? acl->name : "(unknown)";
1218
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001219 memprintf(err,
1220 "acl '%s' involves some request-only criteria which will be ignored in '%s %s'",
1221 name, args[0], args[1]);
Emeric Brun97679e72010-09-23 17:56:44 +02001222 warn++;
1223 }
1224
1225 LIST_ADDQ(&curpx->tcp_rep.inspect_rules, &rule->list);
1226 }
1227 else {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001228 memprintf(err,
1229 "'%s' expects 'inspect-delay' or 'content' in %s '%s' (got '%s')",
1230 args[0], proxy_type_str(curpx), curpx->id, args[1]);
Emeric Brun97679e72010-09-23 17:56:44 +02001231 goto error;
1232 }
1233
1234 return warn;
1235 error:
1236 free(rule);
1237 return -1;
1238}
1239
1240
Willy Tarreaub6866442008-07-14 23:54:42 +02001241/* This function should be called to parse a line starting with the "tcp-request"
1242 * keyword.
1243 */
1244static int tcp_parse_tcp_req(char **args, int section_type, struct proxy *curpx,
Willy Tarreau28a47d62012-09-18 20:02:48 +02001245 struct proxy *defpx, const char *file, int line,
1246 char **err)
Willy Tarreaub6866442008-07-14 23:54:42 +02001247{
1248 const char *ptr = NULL;
Willy Tarreauc7e961e2008-08-17 17:13:47 +02001249 unsigned int val;
Willy Tarreau1a687942010-05-23 22:40:30 +02001250 int warn = 0;
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001251 int arg;
Willy Tarreau1a687942010-05-23 22:40:30 +02001252 struct tcp_rule *rule;
Willy Tarreaub6866442008-07-14 23:54:42 +02001253
1254 if (!*args[1]) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001255 if (curpx == defpx)
1256 memprintf(err, "missing argument for '%s' in defaults section", args[0]);
1257 else
1258 memprintf(err, "missing argument for '%s' in %s '%s'",
1259 args[0], proxy_type_str(curpx), curpx->id);
Willy Tarreaub6866442008-07-14 23:54:42 +02001260 return -1;
1261 }
1262
1263 if (!strcmp(args[1], "inspect-delay")) {
1264 if (curpx == defpx) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001265 memprintf(err, "%s %s is not allowed in 'defaults' sections",
1266 args[0], args[1]);
Willy Tarreaub6866442008-07-14 23:54:42 +02001267 return -1;
1268 }
1269
Willy Tarreaub6866442008-07-14 23:54:42 +02001270 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001271 memprintf(err,
1272 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
1273 args[0], args[1], proxy_type_str(curpx), curpx->id);
1274 if (ptr)
1275 memprintf(err, "%s (unexpected character '%c')", *err, *ptr);
Willy Tarreaub6866442008-07-14 23:54:42 +02001276 return -1;
1277 }
1278
1279 if (curpx->tcp_req.inspect_delay) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001280 memprintf(err, "ignoring %s %s (was already defined) in %s '%s'",
1281 args[0], args[1], proxy_type_str(curpx), curpx->id);
Willy Tarreaub6866442008-07-14 23:54:42 +02001282 return 1;
1283 }
1284 curpx->tcp_req.inspect_delay = val;
1285 return 0;
1286 }
1287
Simon Hormande072bd2011-06-24 15:11:37 +09001288 rule = calloc(1, sizeof(*rule));
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001289 LIST_INIT(&rule->list);
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001290 arg = 1;
1291
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001292 if (strcmp(args[1], "content") == 0) {
Willy Tarreaud1f96522010-08-03 19:34:32 +02001293 arg++;
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001294 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err) < 0)
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001295 goto error;
Willy Tarreaub6866442008-07-14 23:54:42 +02001296
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001297 if (rule->cond && (rule->cond->requires & ACL_USE_RTR_ANY)) {
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001298 struct acl *acl;
1299 const char *name;
1300
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001301 acl = cond_find_require(rule->cond, ACL_USE_RTR_ANY);
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001302 name = acl ? acl->name : "(unknown)";
1303
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001304 memprintf(err,
1305 "acl '%s' involves some response-only criteria which will be ignored in '%s %s'",
1306 name, args[0], args[1]);
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001307 warn++;
1308 }
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001309
1310 if ((rule->action == TCP_ACT_TRK_SC1 || rule->action == TCP_ACT_TRK_SC2) &&
1311 (rule->act_prm.trk_ctr.expr->fetch->cap & SMP_CAP_RES)) {
1312 memprintf(err,
1313 "fetch '%s' involves some response-only criteria which will be ignored in '%s %s'",
1314 rule->act_prm.trk_ctr.expr->fetch->kw, args[0], args[1]);
1315 warn++;
1316 }
1317
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001318 LIST_ADDQ(&curpx->tcp_req.inspect_rules, &rule->list);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001319 }
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001320 else if (strcmp(args[1], "connection") == 0) {
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001321 arg++;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001322
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001323 if (!(curpx->cap & PR_CAP_FE)) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001324 memprintf(err, "%s %s is not allowed because %s %s is not a frontend",
1325 args[0], args[1], proxy_type_str(curpx), curpx->id);
Simon Horman6c54d8b2011-07-15 13:14:06 +09001326 goto error;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001327 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001328
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001329 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err) < 0)
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001330 goto error;
1331
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001332 if (rule->cond && (rule->cond->requires & (ACL_USE_RTR_ANY|ACL_USE_L6_ANY|ACL_USE_L7_ANY))) {
1333 struct acl *acl;
1334 const char *name;
Willy Tarreauf059a0f2010-08-03 16:29:52 +02001335
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001336 acl = cond_find_require(rule->cond, ACL_USE_RTR_ANY|ACL_USE_L6_ANY|ACL_USE_L7_ANY);
1337 name = acl ? acl->name : "(unknown)";
Willy Tarreauf059a0f2010-08-03 16:29:52 +02001338
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001339 if (acl->requires & (ACL_USE_L6_ANY|ACL_USE_L7_ANY)) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001340 memprintf(err,
1341 "'%s %s' may not reference acl '%s' which makes use of "
1342 "payload in %s '%s'. Please use '%s content' for this.",
1343 args[0], args[1], name, proxy_type_str(curpx), curpx->id, args[0]);
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001344 goto error;
1345 }
1346 if (acl->requires & ACL_USE_RTR_ANY)
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001347 memprintf(err,
1348 "acl '%s' involves some response-only criteria which will be ignored in '%s %s'",
1349 name, args[0], args[1]);
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001350 warn++;
1351 }
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001352
1353 if ((rule->action == TCP_ACT_TRK_SC1 || rule->action == TCP_ACT_TRK_SC2) &&
1354 (rule->act_prm.trk_ctr.expr->fetch->cap & SMP_CAP_RES)) {
1355 memprintf(err,
1356 "fetch '%s' involves some response-only criteria which will be ignored in '%s %s'",
1357 rule->act_prm.trk_ctr.expr->fetch->kw, args[0], args[1]);
1358 warn++;
1359 }
1360
1361 if ((rule->action == TCP_ACT_TRK_SC1 || rule->action == TCP_ACT_TRK_SC2) &&
1362 (rule->act_prm.trk_ctr.expr->fetch->cap & SMP_CAP_L7)) {
1363 memprintf(err,
1364 "fetch '%s' involves some layer7-only criteria which will be ignored in '%s %s'",
1365 rule->act_prm.trk_ctr.expr->fetch->kw, args[0], args[1]);
1366 warn++;
1367 }
1368
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001369 LIST_ADDQ(&curpx->tcp_req.l4_rules, &rule->list);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001370 }
Willy Tarreau1a687942010-05-23 22:40:30 +02001371 else {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001372 if (curpx == defpx)
1373 memprintf(err,
1374 "'%s' expects 'inspect-delay', 'connection', or 'content' in defaults section (got '%s')",
1375 args[0], args[1]);
1376 else
1377 memprintf(err,
1378 "'%s' expects 'inspect-delay', 'connection', or 'content' in %s '%s' (got '%s')",
1379 args[0], args[1], proxy_type_str(curpx), curpx->id);
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001380 goto error;
Willy Tarreau1a687942010-05-23 22:40:30 +02001381 }
1382
Willy Tarreau1a687942010-05-23 22:40:30 +02001383 return warn;
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001384 error:
1385 free(rule);
1386 return -1;
Willy Tarreaub6866442008-07-14 23:54:42 +02001387}
1388
Willy Tarreau645513a2010-05-24 20:55:15 +02001389
1390/************************************************************************/
Willy Tarreau32389b72012-04-23 23:13:20 +02001391/* All supported sample fetch functios must be declared here */
1392/************************************************************************/
1393
1394/* Fetch the request RDP cookie identified in the args, or any cookie if no arg
Willy Tarreau12785782012-04-27 21:37:17 +02001395 * is passed. It is usable both for ACL and for samples. Note: this decoder
Willy Tarreau32389b72012-04-23 23:13:20 +02001396 * only works with non-wrapping data. Accepts either 0 or 1 argument. Argument
1397 * is a string (cookie name), other types will lead to undefined behaviour.
1398 */
1399int
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001400smp_fetch_rdp_cookie(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau32389b72012-04-23 23:13:20 +02001401 const struct arg *args, struct sample *smp)
1402{
1403 int bleft;
1404 const unsigned char *data;
1405
1406 if (!l4 || !l4->req)
1407 return 0;
1408
1409 smp->flags = 0;
1410 smp->type = SMP_T_CSTR;
1411
Willy Tarreau9b28e032012-10-12 23:49:43 +02001412 bleft = l4->req->buf->i;
Willy Tarreau32389b72012-04-23 23:13:20 +02001413 if (bleft <= 11)
1414 goto too_short;
1415
Willy Tarreau9b28e032012-10-12 23:49:43 +02001416 data = (const unsigned char *)l4->req->buf->p + 11;
Willy Tarreau32389b72012-04-23 23:13:20 +02001417 bleft -= 11;
1418
1419 if (bleft <= 7)
1420 goto too_short;
1421
1422 if (strncasecmp((const char *)data, "Cookie:", 7) != 0)
1423 goto not_cookie;
1424
1425 data += 7;
1426 bleft -= 7;
1427
1428 while (bleft > 0 && *data == ' ') {
1429 data++;
1430 bleft--;
1431 }
1432
1433 if (args) {
1434
1435 if (bleft <= args->data.str.len)
1436 goto too_short;
1437
1438 if ((data[args->data.str.len] != '=') ||
1439 strncasecmp(args->data.str.str, (const char *)data, args->data.str.len) != 0)
1440 goto not_cookie;
1441
1442 data += args->data.str.len + 1;
1443 bleft -= args->data.str.len + 1;
1444 } else {
1445 while (bleft > 0 && *data != '=') {
1446 if (*data == '\r' || *data == '\n')
1447 goto not_cookie;
1448 data++;
1449 bleft--;
1450 }
1451
1452 if (bleft < 1)
1453 goto too_short;
1454
1455 if (*data != '=')
1456 goto not_cookie;
1457
1458 data++;
1459 bleft--;
1460 }
1461
1462 /* data points to cookie value */
1463 smp->data.str.str = (char *)data;
1464 smp->data.str.len = 0;
1465
1466 while (bleft > 0 && *data != '\r') {
1467 data++;
1468 bleft--;
1469 }
1470
1471 if (bleft < 2)
1472 goto too_short;
1473
1474 if (data[0] != '\r' || data[1] != '\n')
1475 goto not_cookie;
1476
1477 smp->data.str.len = (char *)data - smp->data.str.str;
1478 smp->flags = SMP_F_VOLATILE;
1479 return 1;
1480
1481 too_short:
1482 smp->flags = SMP_F_MAY_CHANGE;
1483 not_cookie:
1484 return 0;
1485}
1486
Willy Tarreau32389b72012-04-23 23:13:20 +02001487/************************************************************************/
Willy Tarreau645513a2010-05-24 20:55:15 +02001488/* All supported ACL keywords must be declared here. */
1489/************************************************************************/
1490
Willy Tarreau32389b72012-04-23 23:13:20 +02001491/* returns either 1 or 0 depending on whether an RDP cookie is found or not */
1492static int
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001493acl_fetch_rdp_cookie_cnt(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau24e32d82012-04-23 23:55:44 +02001494 const struct arg *args, struct sample *smp)
Willy Tarreau32389b72012-04-23 23:13:20 +02001495{
1496 int ret;
1497
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001498 ret = smp_fetch_rdp_cookie(px, l4, l7, opt, args, smp);
Willy Tarreau32389b72012-04-23 23:13:20 +02001499
1500 if (smp->flags & SMP_F_MAY_CHANGE)
1501 return 0;
1502
1503 smp->flags = SMP_F_VOLATILE;
1504 smp->type = SMP_T_UINT;
1505 smp->data.uint = ret;
1506 return 1;
1507}
1508
1509
Willy Tarreau4a129812012-04-25 17:31:42 +02001510/* fetch the connection's source IPv4/IPv6 address */
Willy Tarreau645513a2010-05-24 20:55:15 +02001511static int
Willy Tarreau4a129812012-04-25 17:31:42 +02001512smp_fetch_src(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau24e32d82012-04-23 23:55:44 +02001513 const struct arg *args, struct sample *smp)
Willy Tarreau645513a2010-05-24 20:55:15 +02001514{
Willy Tarreauf2943dc2012-10-26 20:10:28 +02001515 switch (l4->si[0].conn->addr.from.ss_family) {
Willy Tarreauf4362b32011-12-16 17:49:52 +01001516 case AF_INET:
Willy Tarreauf2943dc2012-10-26 20:10:28 +02001517 smp->data.ipv4 = ((struct sockaddr_in *)&l4->si[0].conn->addr.from)->sin_addr;
Willy Tarreauf853c462012-04-23 18:53:56 +02001518 smp->type = SMP_T_IPV4;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001519 break;
1520 case AF_INET6:
Willy Tarreauf2943dc2012-10-26 20:10:28 +02001521 smp->data.ipv6 = ((struct sockaddr_in6 *)(&l4->si[0].conn->addr.from))->sin6_addr;
Willy Tarreauf853c462012-04-23 18:53:56 +02001522 smp->type = SMP_T_IPV6;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001523 break;
1524 default:
Emeric Brunf769f512010-10-22 17:14:01 +02001525 return 0;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001526 }
Emeric Brunf769f512010-10-22 17:14:01 +02001527
Willy Tarreau37406352012-04-23 16:16:37 +02001528 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001529 return 1;
1530}
1531
Willy Tarreaua5e37562011-12-16 17:06:15 +01001532/* set temp integer to the connection's source port */
Willy Tarreau645513a2010-05-24 20:55:15 +02001533static int
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001534smp_fetch_sport(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau24e32d82012-04-23 23:55:44 +02001535 const struct arg *args, struct sample *smp)
Willy Tarreau645513a2010-05-24 20:55:15 +02001536{
Willy Tarreauf853c462012-04-23 18:53:56 +02001537 smp->type = SMP_T_UINT;
Willy Tarreauf2943dc2012-10-26 20:10:28 +02001538 if (!(smp->data.uint = get_host_port(&l4->si[0].conn->addr.from)))
Emeric Brunf769f512010-10-22 17:14:01 +02001539 return 0;
1540
Willy Tarreau37406352012-04-23 16:16:37 +02001541 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001542 return 1;
1543}
1544
Willy Tarreau4a129812012-04-25 17:31:42 +02001545/* fetch the connection's destination IPv4/IPv6 address */
Willy Tarreau645513a2010-05-24 20:55:15 +02001546static int
Willy Tarreau4a129812012-04-25 17:31:42 +02001547smp_fetch_dst(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau24e32d82012-04-23 23:55:44 +02001548 const struct arg *args, struct sample *smp)
Willy Tarreau645513a2010-05-24 20:55:15 +02001549{
Willy Tarreauf2943dc2012-10-26 20:10:28 +02001550 conn_get_to_addr(l4->si[0].conn);
Willy Tarreau645513a2010-05-24 20:55:15 +02001551
Willy Tarreauf2943dc2012-10-26 20:10:28 +02001552 switch (l4->si[0].conn->addr.to.ss_family) {
Willy Tarreauf4362b32011-12-16 17:49:52 +01001553 case AF_INET:
Willy Tarreauf2943dc2012-10-26 20:10:28 +02001554 smp->data.ipv4 = ((struct sockaddr_in *)&l4->si[0].conn->addr.to)->sin_addr;
Willy Tarreauf853c462012-04-23 18:53:56 +02001555 smp->type = SMP_T_IPV4;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001556 break;
1557 case AF_INET6:
Willy Tarreauf2943dc2012-10-26 20:10:28 +02001558 smp->data.ipv6 = ((struct sockaddr_in6 *)(&l4->si[0].conn->addr.to))->sin6_addr;
Willy Tarreauf853c462012-04-23 18:53:56 +02001559 smp->type = SMP_T_IPV6;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001560 break;
1561 default:
Emeric Brunf769f512010-10-22 17:14:01 +02001562 return 0;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001563 }
Emeric Brunf769f512010-10-22 17:14:01 +02001564
Willy Tarreau37406352012-04-23 16:16:37 +02001565 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001566 return 1;
1567}
1568
Willy Tarreaua5e37562011-12-16 17:06:15 +01001569/* set temp integer to the frontend connexion's destination port */
Willy Tarreau645513a2010-05-24 20:55:15 +02001570static int
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001571smp_fetch_dport(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau24e32d82012-04-23 23:55:44 +02001572 const struct arg *args, struct sample *smp)
Willy Tarreau645513a2010-05-24 20:55:15 +02001573{
Willy Tarreauf2943dc2012-10-26 20:10:28 +02001574 conn_get_to_addr(l4->si[0].conn);
Willy Tarreau645513a2010-05-24 20:55:15 +02001575
Willy Tarreauf853c462012-04-23 18:53:56 +02001576 smp->type = SMP_T_UINT;
Willy Tarreauf2943dc2012-10-26 20:10:28 +02001577 if (!(smp->data.uint = get_host_port(&l4->si[0].conn->addr.to)))
Emeric Brunf769f512010-10-22 17:14:01 +02001578 return 0;
1579
Willy Tarreau37406352012-04-23 16:16:37 +02001580 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001581 return 1;
1582}
1583
1584static int
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001585smp_fetch_payload_lv(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
1586 const struct arg *arg_p, struct sample *smp)
Emericf2d7cae2010-11-05 18:13:50 +01001587{
Willy Tarreau82ea8002012-04-25 19:19:43 +02001588 unsigned int len_offset = arg_p[0].data.uint;
1589 unsigned int len_size = arg_p[1].data.uint;
1590 unsigned int buf_offset;
1591 unsigned int buf_size = 0;
Willy Tarreau697d8502012-10-12 23:53:39 +02001592 struct channel *chn;
Emericf2d7cae2010-11-05 18:13:50 +01001593 int i;
1594
1595 /* Format is (len offset, len size, buf offset) or (len offset, len size) */
1596 /* by default buf offset == len offset + len size */
1597 /* buf offset could be absolute or relative to len offset + len size if prefixed by + or - */
1598
1599 if (!l4)
1600 return 0;
1601
Willy Tarreau697d8502012-10-12 23:53:39 +02001602 chn = ((opt & SMP_OPT_DIR) == SMP_OPT_DIR_RES) ? l4->rep : l4->req;
Emericf2d7cae2010-11-05 18:13:50 +01001603
Willy Tarreau697d8502012-10-12 23:53:39 +02001604 if (!chn)
Emericf2d7cae2010-11-05 18:13:50 +01001605 return 0;
1606
Willy Tarreau9b28e032012-10-12 23:49:43 +02001607 if (len_offset + len_size > chn->buf->i)
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001608 goto too_short;
Emericf2d7cae2010-11-05 18:13:50 +01001609
1610 for (i = 0; i < len_size; i++) {
Willy Tarreau9b28e032012-10-12 23:49:43 +02001611 buf_size = (buf_size << 8) + ((unsigned char *)chn->buf->p)[i + len_offset];
Emericf2d7cae2010-11-05 18:13:50 +01001612 }
1613
Willy Tarreau9fcb9842012-04-20 14:45:49 +02001614 /* buf offset may be implicit, absolute or relative */
1615 buf_offset = len_offset + len_size;
1616 if (arg_p[2].type == ARGT_UINT)
1617 buf_offset = arg_p[2].data.uint;
1618 else if (arg_p[2].type == ARGT_SINT)
1619 buf_offset += arg_p[2].data.sint;
1620
Willy Tarreau9b28e032012-10-12 23:49:43 +02001621 if (!buf_size || buf_size > chn->buf->size || buf_offset + buf_size > chn->buf->size) {
Willy Tarreau82ea8002012-04-25 19:19:43 +02001622 /* will never match */
1623 smp->flags = 0;
1624 return 0;
1625 }
1626
Willy Tarreau9b28e032012-10-12 23:49:43 +02001627 if (buf_offset + buf_size > chn->buf->i)
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001628 goto too_short;
Emericf2d7cae2010-11-05 18:13:50 +01001629
1630 /* init chunk as read only */
Willy Tarreaub8c8f1f2012-04-23 22:38:26 +02001631 smp->type = SMP_T_CBIN;
Willy Tarreau9b28e032012-10-12 23:49:43 +02001632 chunk_initlen(&smp->data.str, chn->buf->p + buf_offset, 0, buf_size);
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001633 smp->flags = SMP_F_VOLATILE;
Emericf2d7cae2010-11-05 18:13:50 +01001634 return 1;
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001635
1636 too_short:
1637 smp->flags = SMP_F_MAY_CHANGE;
1638 return 0;
Emericf2d7cae2010-11-05 18:13:50 +01001639}
1640
1641static int
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001642smp_fetch_payload(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
1643 const struct arg *arg_p, struct sample *smp)
Emericf2d7cae2010-11-05 18:13:50 +01001644{
Willy Tarreau82ea8002012-04-25 19:19:43 +02001645 unsigned int buf_offset = arg_p[0].data.uint;
1646 unsigned int buf_size = arg_p[1].data.uint;
Willy Tarreau697d8502012-10-12 23:53:39 +02001647 struct channel *chn;
Emericf2d7cae2010-11-05 18:13:50 +01001648
1649 if (!l4)
1650 return 0;
1651
Willy Tarreau697d8502012-10-12 23:53:39 +02001652 chn = ((opt & SMP_OPT_DIR) == SMP_OPT_DIR_RES) ? l4->rep : l4->req;
Emericf2d7cae2010-11-05 18:13:50 +01001653
Willy Tarreau697d8502012-10-12 23:53:39 +02001654 if (!chn)
Emericf2d7cae2010-11-05 18:13:50 +01001655 return 0;
Willy Tarreau82ea8002012-04-25 19:19:43 +02001656
Willy Tarreau9b28e032012-10-12 23:49:43 +02001657 if (!buf_size || buf_size > chn->buf->size || buf_offset + buf_size > chn->buf->size) {
Willy Tarreau82ea8002012-04-25 19:19:43 +02001658 /* will never match */
1659 smp->flags = 0;
1660 return 0;
1661 }
Emericf2d7cae2010-11-05 18:13:50 +01001662
Willy Tarreau9b28e032012-10-12 23:49:43 +02001663 if (buf_offset + buf_size > chn->buf->i)
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001664 goto too_short;
Emericf2d7cae2010-11-05 18:13:50 +01001665
1666 /* init chunk as read only */
Willy Tarreaub8c8f1f2012-04-23 22:38:26 +02001667 smp->type = SMP_T_CBIN;
Willy Tarreau9b28e032012-10-12 23:49:43 +02001668 chunk_initlen(&smp->data.str, chn->buf->p + buf_offset, 0, buf_size);
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001669 smp->flags = SMP_F_VOLATILE;
Simon Hormanab814e02011-06-24 14:50:20 +09001670 return 1;
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001671
1672 too_short:
1673 smp->flags = SMP_F_MAY_CHANGE;
1674 return 0;
Simon Hormanab814e02011-06-24 14:50:20 +09001675}
1676
Willy Tarreau21d68a62012-04-20 15:52:36 +02001677/* This function is used to validate the arguments passed to a "payload" fetch
1678 * keyword. This keyword expects two positive integers, with the second one
1679 * being strictly positive. It is assumed that the types are already the correct
1680 * ones. Returns 0 on error, non-zero if OK. If <err_msg> is not NULL, it will be
1681 * filled with a pointer to an error message in case of error, that the caller
1682 * is responsible for freeing. The initial location must either be freeable or
1683 * NULL.
1684 */
1685static int val_payload(struct arg *arg, char **err_msg)
1686{
1687 if (!arg[1].data.uint) {
Willy Tarreaueb6cead2012-09-20 19:43:14 +02001688 memprintf(err_msg, "payload length must be > 0");
Willy Tarreau21d68a62012-04-20 15:52:36 +02001689 return 0;
1690 }
1691 return 1;
1692}
1693
1694/* This function is used to validate the arguments passed to a "payload_lv" fetch
1695 * keyword. This keyword allows two positive integers and an optional signed one,
1696 * with the second one being strictly positive and the third one being greater than
1697 * the opposite of the two others if negative. It is assumed that the types are
1698 * already the correct ones. Returns 0 on error, non-zero if OK. If <err_msg> is
1699 * not NULL, it will be filled with a pointer to an error message in case of
1700 * error, that the caller is responsible for freeing. The initial location must
1701 * either be freeable or NULL.
1702 */
1703static int val_payload_lv(struct arg *arg, char **err_msg)
1704{
1705 if (!arg[1].data.uint) {
Willy Tarreaueb6cead2012-09-20 19:43:14 +02001706 memprintf(err_msg, "payload length must be > 0");
Willy Tarreau21d68a62012-04-20 15:52:36 +02001707 return 0;
1708 }
1709
1710 if (arg[2].type == ARGT_SINT &&
1711 (int)(arg[0].data.uint + arg[1].data.uint + arg[2].data.sint) < 0) {
Willy Tarreaueb6cead2012-09-20 19:43:14 +02001712 memprintf(err_msg, "payload offset too negative");
Willy Tarreau21d68a62012-04-20 15:52:36 +02001713 return 0;
1714 }
1715 return 1;
1716}
1717
Willy Tarreau9b6700f2012-11-24 11:55:28 +01001718#ifdef IPV6_V6ONLY
Willy Tarreau77e3af92012-11-24 15:07:23 +01001719/* parse the "v4v6" bind keyword */
1720static int bind_parse_v4v6(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
1721{
1722 struct listener *l;
1723
1724 list_for_each_entry(l, &conf->listeners, by_bind) {
1725 if (l->addr.ss_family == AF_INET6)
1726 l->options |= LI_O_V4V6;
1727 }
1728
1729 return 0;
1730}
1731
Willy Tarreau9b6700f2012-11-24 11:55:28 +01001732/* parse the "v6only" bind keyword */
1733static int bind_parse_v6only(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
1734{
1735 struct listener *l;
1736
1737 list_for_each_entry(l, &conf->listeners, by_bind) {
1738 if (l->addr.ss_family == AF_INET6)
1739 l->options |= LI_O_V6ONLY;
1740 }
1741
1742 return 0;
1743}
1744#endif
1745
Willy Tarreau44791242012-09-12 23:27:21 +02001746#ifdef CONFIG_HAP_LINUX_TPROXY
1747/* parse the "transparent" bind keyword */
Willy Tarreau4348fad2012-09-20 16:48:07 +02001748static int bind_parse_transparent(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
Willy Tarreau44791242012-09-12 23:27:21 +02001749{
1750 struct listener *l;
1751
Willy Tarreau4348fad2012-09-20 16:48:07 +02001752 list_for_each_entry(l, &conf->listeners, by_bind) {
1753 if (l->addr.ss_family == AF_INET || l->addr.ss_family == AF_INET6)
1754 l->options |= LI_O_FOREIGN;
Willy Tarreau44791242012-09-12 23:27:21 +02001755 }
1756
Willy Tarreau44791242012-09-12 23:27:21 +02001757 return 0;
1758}
1759#endif
1760
1761#ifdef TCP_DEFER_ACCEPT
1762/* parse the "defer-accept" bind keyword */
Willy Tarreau4348fad2012-09-20 16:48:07 +02001763static int bind_parse_defer_accept(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
Willy Tarreau44791242012-09-12 23:27:21 +02001764{
1765 struct listener *l;
1766
Willy Tarreau4348fad2012-09-20 16:48:07 +02001767 list_for_each_entry(l, &conf->listeners, by_bind) {
1768 if (l->addr.ss_family == AF_INET || l->addr.ss_family == AF_INET6)
1769 l->options |= LI_O_DEF_ACCEPT;
Willy Tarreau44791242012-09-12 23:27:21 +02001770 }
1771
Willy Tarreau44791242012-09-12 23:27:21 +02001772 return 0;
1773}
1774#endif
1775
Willy Tarreau1c862c52012-10-05 16:21:00 +02001776#ifdef TCP_FASTOPEN
1777/* parse the "defer-accept" bind keyword */
1778static int bind_parse_tfo(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
1779{
1780 struct listener *l;
1781
1782 list_for_each_entry(l, &conf->listeners, by_bind) {
1783 if (l->addr.ss_family == AF_INET || l->addr.ss_family == AF_INET6)
1784 l->options |= LI_O_TCP_FO;
1785 }
1786
1787 return 0;
1788}
1789#endif
1790
Willy Tarreau44791242012-09-12 23:27:21 +02001791#ifdef TCP_MAXSEG
1792/* parse the "mss" bind keyword */
Willy Tarreau4348fad2012-09-20 16:48:07 +02001793static int bind_parse_mss(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
Willy Tarreau44791242012-09-12 23:27:21 +02001794{
1795 struct listener *l;
1796 int mss;
1797
Willy Tarreau44791242012-09-12 23:27:21 +02001798 if (!*args[cur_arg + 1]) {
Willy Tarreaueb6cead2012-09-20 19:43:14 +02001799 memprintf(err, "'%s' : missing MSS value", args[cur_arg]);
Willy Tarreau44791242012-09-12 23:27:21 +02001800 return ERR_ALERT | ERR_FATAL;
1801 }
1802
1803 mss = atoi(args[cur_arg + 1]);
1804 if (!mss || abs(mss) > 65535) {
Willy Tarreaueb6cead2012-09-20 19:43:14 +02001805 memprintf(err, "'%s' : expects an MSS with and absolute value between 1 and 65535", args[cur_arg]);
Willy Tarreau44791242012-09-12 23:27:21 +02001806 return ERR_ALERT | ERR_FATAL;
1807 }
1808
Willy Tarreau4348fad2012-09-20 16:48:07 +02001809 list_for_each_entry(l, &conf->listeners, by_bind) {
1810 if (l->addr.ss_family == AF_INET || l->addr.ss_family == AF_INET6)
1811 l->maxseg = mss;
1812 }
Willy Tarreau44791242012-09-12 23:27:21 +02001813
1814 return 0;
1815}
1816#endif
1817
1818#ifdef SO_BINDTODEVICE
1819/* parse the "mss" bind keyword */
Willy Tarreau4348fad2012-09-20 16:48:07 +02001820static int bind_parse_interface(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
Willy Tarreau44791242012-09-12 23:27:21 +02001821{
1822 struct listener *l;
1823
Willy Tarreau44791242012-09-12 23:27:21 +02001824 if (!*args[cur_arg + 1]) {
Willy Tarreaueb6cead2012-09-20 19:43:14 +02001825 memprintf(err, "'%s' : missing interface name", args[cur_arg]);
Willy Tarreau44791242012-09-12 23:27:21 +02001826 return ERR_ALERT | ERR_FATAL;
1827 }
1828
Willy Tarreau4348fad2012-09-20 16:48:07 +02001829 list_for_each_entry(l, &conf->listeners, by_bind) {
1830 if (l->addr.ss_family == AF_INET || l->addr.ss_family == AF_INET6)
1831 l->interface = strdup(args[cur_arg + 1]);
1832 }
Willy Tarreau44791242012-09-12 23:27:21 +02001833
1834 global.last_checks |= LSTCHK_NETADM;
1835 return 0;
1836}
1837#endif
1838
Willy Tarreaub6866442008-07-14 23:54:42 +02001839static struct cfg_kw_list cfg_kws = {{ },{
1840 { CFG_LISTEN, "tcp-request", tcp_parse_tcp_req },
Emeric Brun97679e72010-09-23 17:56:44 +02001841 { CFG_LISTEN, "tcp-response", tcp_parse_tcp_rep },
Willy Tarreaub6866442008-07-14 23:54:42 +02001842 { 0, NULL, NULL },
1843}};
1844
Willy Tarreau61612d42012-04-19 18:42:05 +02001845/* Note: must not be declared <const> as its list will be overwritten.
1846 * Please take care of keeping this list alphabetically sorted.
1847 */
Willy Tarreaub6866442008-07-14 23:54:42 +02001848static struct acl_kw_list acl_kws = {{ },{
Willy Tarreau4a129812012-04-25 17:31:42 +02001849 { "dst", acl_parse_ip, smp_fetch_dst, acl_match_ip, ACL_USE_TCP4_PERMANENT|ACL_MAY_LOOKUP, 0 },
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001850 { "dst_port", acl_parse_int, smp_fetch_dport, acl_match_int, ACL_USE_TCP_PERMANENT, 0 },
Willy Tarreau0d5fe142012-04-26 12:24:45 +02001851 { "payload", acl_parse_str, smp_fetch_payload, acl_match_str, ACL_USE_L6REQ_VOLATILE|ACL_MAY_LOOKUP, ARG2(2,UINT,UINT), val_payload },
1852 { "payload_lv", acl_parse_str, smp_fetch_payload_lv, acl_match_str, ACL_USE_L6REQ_VOLATILE|ACL_MAY_LOOKUP, ARG3(2,UINT,UINT,SINT), val_payload_lv },
Willy Tarreau9fb4bc72012-04-24 00:09:26 +02001853 { "req_rdp_cookie", acl_parse_str, smp_fetch_rdp_cookie, acl_match_str, ACL_USE_L6REQ_VOLATILE|ACL_MAY_LOOKUP, ARG1(0,STR) },
Willy Tarreau32389b72012-04-23 23:13:20 +02001854 { "req_rdp_cookie_cnt", acl_parse_int, acl_fetch_rdp_cookie_cnt, acl_match_int, ACL_USE_L6REQ_VOLATILE, ARG1(0,STR) },
Willy Tarreau4a129812012-04-25 17:31:42 +02001855 { "src", acl_parse_ip, smp_fetch_src, acl_match_ip, ACL_USE_TCP4_PERMANENT|ACL_MAY_LOOKUP, 0 },
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001856 { "src_port", acl_parse_int, smp_fetch_sport, acl_match_int, ACL_USE_TCP_PERMANENT, 0 },
Willy Tarreaub6866442008-07-14 23:54:42 +02001857 { NULL, NULL, NULL, NULL },
1858}};
1859
Willy Tarreau4a129812012-04-25 17:31:42 +02001860/* Note: must not be declared <const> as its list will be overwritten.
1861 * Note: fetches that may return multiple types must be declared as the lowest
1862 * common denominator, the type that can be casted into all other ones. For
1863 * instance v4/v6 must be declared v4.
1864 */
Willy Tarreau12785782012-04-27 21:37:17 +02001865static struct sample_fetch_kw_list sample_fetch_keywords = {{ },{
Willy Tarreau4a129812012-04-25 17:31:42 +02001866 { "src", smp_fetch_src, 0, NULL, SMP_T_IPV4, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreau4a129812012-04-25 17:31:42 +02001867 { "dst", smp_fetch_dst, 0, NULL, SMP_T_IPV4, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001868 { "dst_port", smp_fetch_dport, 0, NULL, SMP_T_UINT, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001869 { "payload", smp_fetch_payload, ARG2(2,UINT,UINT), val_payload, SMP_T_CBIN, SMP_CAP_REQ|SMP_CAP_RES },
1870 { "payload_lv", smp_fetch_payload_lv, ARG3(2,UINT,UINT,SINT), val_payload_lv, SMP_T_CBIN, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreaud6281ae2012-04-26 11:23:39 +02001871 { "rdp_cookie", smp_fetch_rdp_cookie, ARG1(1,STR), NULL, SMP_T_CSTR, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001872 { "src_port", smp_fetch_sport, 0, NULL, SMP_T_UINT, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreau9fcb9842012-04-20 14:45:49 +02001873 { NULL, NULL, 0, 0, 0 },
Willy Tarreau645513a2010-05-24 20:55:15 +02001874}};
1875
Willy Tarreau44791242012-09-12 23:27:21 +02001876/************************************************************************/
1877/* All supported bind keywords must be declared here. */
1878/************************************************************************/
1879
1880/* Note: must not be declared <const> as its list will be overwritten.
1881 * Please take care of keeping this list alphabetically sorted, doing so helps
1882 * all code contributors.
1883 * Optional keywords are also declared with a NULL ->parse() function so that
1884 * the config parser can report an appropriate error when a known keyword was
1885 * not enabled.
1886 */
Willy Tarreau51fb7652012-09-18 18:24:39 +02001887static struct bind_kw_list bind_kws = { "TCP", { }, {
Willy Tarreau44791242012-09-12 23:27:21 +02001888#ifdef TCP_DEFER_ACCEPT
1889 { "defer-accept", bind_parse_defer_accept, 0 }, /* wait for some data for 1 second max before doing accept */
1890#endif
1891#ifdef SO_BINDTODEVICE
1892 { "interface", bind_parse_interface, 1 }, /* specifically bind to this interface */
1893#endif
1894#ifdef TCP_MAXSEG
1895 { "mss", bind_parse_mss, 1 }, /* set MSS of listening socket */
1896#endif
Willy Tarreau1c862c52012-10-05 16:21:00 +02001897#ifdef TCP_FASTOPEN
1898 { "tfo", bind_parse_tfo, 0 }, /* enable TCP_FASTOPEN of listening socket */
1899#endif
Willy Tarreau44791242012-09-12 23:27:21 +02001900#ifdef CONFIG_HAP_LINUX_TPROXY
1901 { "transparent", bind_parse_transparent, 0 }, /* transparently bind to the specified addresses */
1902#endif
Willy Tarreau9b6700f2012-11-24 11:55:28 +01001903#ifdef IPV6_V6ONLY
Willy Tarreau77e3af92012-11-24 15:07:23 +01001904 { "v4v6", bind_parse_v4v6, 0 }, /* force socket to bind to IPv4+IPv6 */
Willy Tarreau9b6700f2012-11-24 11:55:28 +01001905 { "v6only", bind_parse_v6only, 0 }, /* force socket to bind to IPv6 only */
1906#endif
Willy Tarreau44791242012-09-12 23:27:21 +02001907 /* the versions with the NULL parse function*/
1908 { "defer-accept", NULL, 0 },
1909 { "interface", NULL, 1 },
1910 { "mss", NULL, 1 },
1911 { "transparent", NULL, 0 },
Willy Tarreau77e3af92012-11-24 15:07:23 +01001912 { "v4v6", NULL, 0 },
Willy Tarreau9b6700f2012-11-24 11:55:28 +01001913 { "v6only", NULL, 0 },
Willy Tarreau44791242012-09-12 23:27:21 +02001914 { NULL, NULL, 0 },
1915}};
1916
Willy Tarreaue6b98942007-10-29 01:09:36 +01001917__attribute__((constructor))
1918static void __tcp_protocol_init(void)
1919{
1920 protocol_register(&proto_tcpv4);
1921 protocol_register(&proto_tcpv6);
Willy Tarreau12785782012-04-27 21:37:17 +02001922 sample_register_fetches(&sample_fetch_keywords);
Willy Tarreaub6866442008-07-14 23:54:42 +02001923 cfg_register_keywords(&cfg_kws);
1924 acl_register_keywords(&acl_kws);
Willy Tarreau44791242012-09-12 23:27:21 +02001925 bind_register_keywords(&bind_kws);
Willy Tarreaue6b98942007-10-29 01:09:36 +01001926}
1927
1928
1929/*
1930 * Local variables:
1931 * c-indent-level: 8
1932 * c-basic-offset: 8
1933 * End:
1934 */