blob: c89c2fbcb2f9efdf133903608e3a26bec7f33639 [file] [log] [blame]
Willy Tarreau39713102016-11-25 15:49:32 +01001/*
2 * "tcp" rules processing
3 *
4 * Copyright 2000-2016 Willy Tarreau <w@1wt.eu>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
Willy Tarreaudcc048a2020-06-04 19:11:43 +020012#include <haproxy/acl.h>
Willy Tarreau122eba92020-06-04 10:15:32 +020013#include <haproxy/action.h>
Willy Tarreau4c7e4b72020-05-27 12:58:42 +020014#include <haproxy/api.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020015#include <haproxy/arg-t.h>
Willy Tarreau278161c2020-06-04 11:18:28 +020016#include <haproxy/capture-t.h>
Willy Tarreau6be78492020-06-05 00:00:29 +020017#include <haproxy/cfgparse.h>
Willy Tarreauf1d32c42020-06-04 21:07:02 +020018#include <haproxy/channel.h>
Willy Tarreau7ea393d2020-06-04 18:02:10 +020019#include <haproxy/connection.h>
Willy Tarreauf268ee82020-06-04 17:05:57 +020020#include <haproxy/global.h>
Willy Tarreau853b2972020-05-27 18:01:47 +020021#include <haproxy/list.h>
Willy Tarreauaeed4a82020-06-04 22:01:04 +020022#include <haproxy/log.h>
Willy Tarreaua264d962020-06-04 22:29:18 +020023#include <haproxy/proxy.h>
Willy Tarreaue6ce10b2020-06-04 15:33:47 +020024#include <haproxy/sample.h>
Willy Tarreaudfd3de82020-06-04 23:46:14 +020025#include <haproxy/stick_table.h>
26#include <haproxy/stream-t.h>
Willy Tarreau5e539c92020-06-04 20:45:39 +020027#include <haproxy/stream_interface.h>
Willy Tarreau8b550af2020-06-04 17:42:48 +020028#include <haproxy/tcp_rules.h>
Willy Tarreauc2f7c582020-06-02 18:15:32 +020029#include <haproxy/ticks.h>
Willy Tarreau92b4f132020-06-01 11:05:15 +020030#include <haproxy/time.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020031#include <haproxy/tools.h>
Willy Tarreaudfd3de82020-06-04 23:46:14 +020032#include <haproxy/trace.h>
Willy Tarreau39713102016-11-25 15:49:32 +010033
Willy Tarreau39713102016-11-25 15:49:32 +010034
Christopher Fauleteea8fc72019-11-05 16:18:10 +010035#define TRACE_SOURCE &trace_strm
36
Willy Tarreau39713102016-11-25 15:49:32 +010037/* List head of all known action keywords for "tcp-request connection" */
38struct list tcp_req_conn_keywords = LIST_HEAD_INIT(tcp_req_conn_keywords);
39struct list tcp_req_sess_keywords = LIST_HEAD_INIT(tcp_req_sess_keywords);
40struct list tcp_req_cont_keywords = LIST_HEAD_INIT(tcp_req_cont_keywords);
41struct list tcp_res_cont_keywords = LIST_HEAD_INIT(tcp_res_cont_keywords);
42
43/*
44 * Register keywords.
45 */
46void tcp_req_conn_keywords_register(struct action_kw_list *kw_list)
47{
48 LIST_ADDQ(&tcp_req_conn_keywords, &kw_list->list);
49}
50
51void tcp_req_sess_keywords_register(struct action_kw_list *kw_list)
52{
53 LIST_ADDQ(&tcp_req_sess_keywords, &kw_list->list);
54}
55
56void tcp_req_cont_keywords_register(struct action_kw_list *kw_list)
57{
58 LIST_ADDQ(&tcp_req_cont_keywords, &kw_list->list);
59}
60
61void tcp_res_cont_keywords_register(struct action_kw_list *kw_list)
62{
63 LIST_ADDQ(&tcp_res_cont_keywords, &kw_list->list);
64}
65
66/*
67 * Return the struct tcp_req_action_kw associated to a keyword.
68 */
Thierry Fournier7a71a6d2020-11-28 17:40:24 +010069struct action_kw *tcp_req_conn_action(const char *kw)
Willy Tarreau39713102016-11-25 15:49:32 +010070{
71 return action_lookup(&tcp_req_conn_keywords, kw);
72}
73
Thierry Fournier7a71a6d2020-11-28 17:40:24 +010074struct action_kw *tcp_req_sess_action(const char *kw)
Willy Tarreau39713102016-11-25 15:49:32 +010075{
76 return action_lookup(&tcp_req_sess_keywords, kw);
77}
78
Thierry Fournier7a71a6d2020-11-28 17:40:24 +010079struct action_kw *tcp_req_cont_action(const char *kw)
Willy Tarreau39713102016-11-25 15:49:32 +010080{
81 return action_lookup(&tcp_req_cont_keywords, kw);
82}
83
Thierry Fournier7a71a6d2020-11-28 17:40:24 +010084struct action_kw *tcp_res_cont_action(const char *kw)
Willy Tarreau39713102016-11-25 15:49:32 +010085{
86 return action_lookup(&tcp_res_cont_keywords, kw);
87}
88
89/* This function performs the TCP request analysis on the current request. It
90 * returns 1 if the processing can continue on next analysers, or zero if it
91 * needs more data, encounters an error, or wants to immediately abort the
92 * request. It relies on buffers flags, and updates s->req->analysers. The
93 * function may be called for frontend rules and backend rules. It only relies
94 * on the backend pointer so this works for both cases.
95 */
96int tcp_inspect_request(struct stream *s, struct channel *req, int an_bit)
97{
98 struct session *sess = s->sess;
99 struct act_rule *rule;
Willy Tarreau39713102016-11-25 15:49:32 +0100100 int partial;
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100101 int act_opts = 0;
Willy Tarreau39713102016-11-25 15:49:32 +0100102
Christopher Fauleteea8fc72019-11-05 16:18:10 +0100103 DBG_TRACE_ENTER(STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
Willy Tarreau39713102016-11-25 15:49:32 +0100104
105 /* We don't know whether we have enough data, so must proceed
106 * this way :
107 * - iterate through all rules in their declaration order
108 * - if one rule returns MISS, it means the inspect delay is
109 * not over yet, then return immediately, otherwise consider
110 * it as a non-match.
111 * - if one rule returns OK, then return OK
112 * - if one rule returns KO, then return KO
113 */
114
Willy Tarreau23752332018-06-15 14:54:53 +0200115 if ((req->flags & CF_SHUTR) || channel_full(req, global.tune.maxrewrite) ||
Christopher Faulet2747fbb2020-07-28 11:56:13 +0200116 !s->be->tcp_req.inspect_delay || tick_is_expired(s->rules_exp, now_ms))
Willy Tarreau39713102016-11-25 15:49:32 +0100117 partial = SMP_OPT_FINAL;
118 else
119 partial = 0;
120
121 /* If "the current_rule_list" match the executed rule list, we are in
122 * resume condition. If a resume is needed it is always in the action
123 * and never in the ACL or converters. In this case, we initialise the
124 * current rule, and go to the action execution point.
125 */
126 if (s->current_rule) {
127 rule = s->current_rule;
128 s->current_rule = NULL;
129 if (s->current_rule_list == &s->be->tcp_req.inspect_rules)
130 goto resume_execution;
131 }
132 s->current_rule_list = &s->be->tcp_req.inspect_rules;
133
134 list_for_each_entry(rule, &s->be->tcp_req.inspect_rules, list) {
135 enum acl_test_res ret = ACL_TEST_PASS;
136
137 if (rule->cond) {
138 ret = acl_exec_cond(rule->cond, s->be, sess, s, SMP_OPT_DIR_REQ | partial);
139 if (ret == ACL_TEST_MISS)
140 goto missing_data;
141
142 ret = acl_pass(ret);
143 if (rule->cond->pol == ACL_COND_UNLESS)
144 ret = !ret;
145 }
146
147 if (ret) {
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100148 act_opts |= ACT_OPT_FIRST;
Willy Tarreau39713102016-11-25 15:49:32 +0100149resume_execution:
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100150
151 /* Always call the action function if defined */
152 if (rule->action_ptr) {
153 if (partial & SMP_OPT_FINAL)
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100154 act_opts |= ACT_OPT_FINAL;
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100155
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100156 switch (rule->action_ptr(rule, s->be, s->sess, s, act_opts)) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100157 case ACT_RET_CONT:
158 break;
159 case ACT_RET_STOP:
160 case ACT_RET_DONE:
161 goto end;
162 case ACT_RET_YIELD:
163 s->current_rule = rule;
Christopher Faulet99aaca92020-07-28 11:30:19 +0200164 if (partial & SMP_OPT_FINAL) {
165 send_log(s->be, LOG_WARNING,
166 "Internal error: yield not allowed if the inspect-delay expired "
167 "for the tcp-request content actions.");
168 goto internal;
169 }
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100170 goto missing_data;
171 case ACT_RET_DENY:
172 goto deny;
173 case ACT_RET_ABRT:
174 goto abort;
175 case ACT_RET_ERR:
176 goto internal;
177 case ACT_RET_INV:
178 goto invalid;
179 }
180 continue; /* eval the next rule */
181 }
182
183 /* If not action function defined, check for known actions */
Willy Tarreau39713102016-11-25 15:49:32 +0100184 if (rule->action == ACT_ACTION_ALLOW) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100185 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100186 }
187 else if (rule->action == ACT_ACTION_DENY) {
Christopher Faulet282992e2019-12-16 12:34:31 +0100188 goto deny;
Willy Tarreau39713102016-11-25 15:49:32 +0100189 }
Willy Tarreau39713102016-11-25 15:49:32 +0100190 }
191 }
192
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100193 end:
Willy Tarreau39713102016-11-25 15:49:32 +0100194 /* if we get there, it means we have no rule which matches, or
195 * we have an explicit accept, so we apply the default accept.
196 */
197 req->analysers &= ~an_bit;
Christopher Faulet2747fbb2020-07-28 11:56:13 +0200198 req->analyse_exp = s->rules_exp = TICK_ETERNITY;
Christopher Fauleteea8fc72019-11-05 16:18:10 +0100199 DBG_TRACE_LEAVE(STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
Willy Tarreau39713102016-11-25 15:49:32 +0100200 return 1;
201
202 missing_data:
203 channel_dont_connect(req);
204 /* just set the request timeout once at the beginning of the request */
Christopher Faulet2747fbb2020-07-28 11:56:13 +0200205 if (!tick_isset(s->rules_exp) && s->be->tcp_req.inspect_delay)
206 s->rules_exp = tick_add(now_ms, s->be->tcp_req.inspect_delay);
207 req->analyse_exp = tick_first((tick_is_expired(req->analyse_exp, now_ms) ? 0 : req->analyse_exp), s->rules_exp);
Christopher Fauleteea8fc72019-11-05 16:18:10 +0100208 DBG_TRACE_DEVEL("waiting for more data", STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
Willy Tarreau39713102016-11-25 15:49:32 +0100209 return 0;
210
Christopher Faulet282992e2019-12-16 12:34:31 +0100211 deny:
212 _HA_ATOMIC_ADD(&sess->fe->fe_counters.denied_req, 1);
213 if (sess->listener && sess->listener->counters)
214 _HA_ATOMIC_ADD(&sess->listener->counters->denied_req, 1);
215 goto reject;
216
217 internal:
218 _HA_ATOMIC_ADD(&sess->fe->fe_counters.internal_errors, 1);
219 if (sess->listener && sess->listener->counters)
220 _HA_ATOMIC_ADD(&sess->listener->counters->internal_errors, 1);
221 if (!(s->flags & SF_ERR_MASK))
222 s->flags |= SF_ERR_INTERNAL;
223 goto reject;
224
225 invalid:
226 _HA_ATOMIC_ADD(&sess->fe->fe_counters.failed_req, 1);
227 if (sess->listener && sess->listener->counters)
228 _HA_ATOMIC_ADD(&sess->listener->counters->failed_req, 1);
229
230 reject:
231 si_must_kill_conn(chn_prod(req));
232 channel_abort(req);
233 channel_abort(&s->res);
234
235 abort:
236 req->analysers &= AN_REQ_FLT_END;
237
238 if (!(s->flags & SF_ERR_MASK))
239 s->flags |= SF_ERR_PRXCOND;
240 if (!(s->flags & SF_FINST_MASK))
241 s->flags |= SF_FINST_R;
242 DBG_TRACE_DEVEL("leaving on error|deny|abort", STRM_EV_STRM_ANA|STRM_EV_TCP_ANA|STRM_EV_TCP_ERR, s);
243 return 0;
Willy Tarreau39713102016-11-25 15:49:32 +0100244}
245
246/* This function performs the TCP response analysis on the current response. It
247 * returns 1 if the processing can continue on next analysers, or zero if it
248 * needs more data, encounters an error, or wants to immediately abort the
249 * response. It relies on buffers flags, and updates s->rep->analysers. The
250 * function may be called for backend rules.
251 */
252int tcp_inspect_response(struct stream *s, struct channel *rep, int an_bit)
253{
254 struct session *sess = s->sess;
255 struct act_rule *rule;
256 int partial;
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100257 int act_opts = 0;
Willy Tarreau39713102016-11-25 15:49:32 +0100258
Christopher Fauleteea8fc72019-11-05 16:18:10 +0100259 DBG_TRACE_ENTER(STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
Willy Tarreau39713102016-11-25 15:49:32 +0100260
261 /* We don't know whether we have enough data, so must proceed
262 * this way :
263 * - iterate through all rules in their declaration order
264 * - if one rule returns MISS, it means the inspect delay is
265 * not over yet, then return immediately, otherwise consider
266 * it as a non-match.
267 * - if one rule returns OK, then return OK
268 * - if one rule returns KO, then return KO
269 */
Willy Tarreau55ae1ab2020-06-15 18:08:07 +0200270 if ((rep->flags & CF_SHUTR) || channel_full(rep, global.tune.maxrewrite) ||
Christopher Faulet2747fbb2020-07-28 11:56:13 +0200271 !s->be->tcp_rep.inspect_delay || tick_is_expired(s->rules_exp, now_ms))
Willy Tarreau39713102016-11-25 15:49:32 +0100272 partial = SMP_OPT_FINAL;
273 else
274 partial = 0;
275
276 /* If "the current_rule_list" match the executed rule list, we are in
277 * resume condition. If a resume is needed it is always in the action
278 * and never in the ACL or converters. In this case, we initialise the
279 * current rule, and go to the action execution point.
280 */
281 if (s->current_rule) {
282 rule = s->current_rule;
283 s->current_rule = NULL;
284 if (s->current_rule_list == &s->be->tcp_rep.inspect_rules)
285 goto resume_execution;
286 }
287 s->current_rule_list = &s->be->tcp_rep.inspect_rules;
Christopher Faulet2747fbb2020-07-28 11:56:13 +0200288 s->rules_exp = TICK_ETERNITY;
Willy Tarreau39713102016-11-25 15:49:32 +0100289
290 list_for_each_entry(rule, &s->be->tcp_rep.inspect_rules, list) {
291 enum acl_test_res ret = ACL_TEST_PASS;
292
293 if (rule->cond) {
294 ret = acl_exec_cond(rule->cond, s->be, sess, s, SMP_OPT_DIR_RES | partial);
Christopher Faulet2747fbb2020-07-28 11:56:13 +0200295 if (ret == ACL_TEST_MISS)
296 goto missing_data;
Willy Tarreau39713102016-11-25 15:49:32 +0100297
298 ret = acl_pass(ret);
299 if (rule->cond->pol == ACL_COND_UNLESS)
300 ret = !ret;
301 }
302
303 if (ret) {
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100304 act_opts |= ACT_OPT_FIRST;
Willy Tarreau39713102016-11-25 15:49:32 +0100305resume_execution:
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100306 /* Always call the action function if defined */
307 if (rule->action_ptr) {
308 if (partial & SMP_OPT_FINAL)
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100309 act_opts |= ACT_OPT_FINAL;
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100310
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100311 switch (rule->action_ptr(rule, s->be, s->sess, s, act_opts)) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100312 case ACT_RET_CONT:
313 break;
314 case ACT_RET_STOP:
315 case ACT_RET_DONE:
316 goto end;
317 case ACT_RET_YIELD:
318 s->current_rule = rule;
Christopher Faulet99aaca92020-07-28 11:30:19 +0200319 if (partial & SMP_OPT_FINAL) {
320 send_log(s->be, LOG_WARNING,
321 "Internal error: yield not allowed if the inspect-delay expired "
322 "for the tcp-response content actions.");
323 goto internal;
324 }
Christopher Faulet2747fbb2020-07-28 11:56:13 +0200325 channel_dont_close(rep);
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100326 goto missing_data;
327 case ACT_RET_DENY:
328 goto deny;
329 case ACT_RET_ABRT:
330 goto abort;
331 case ACT_RET_ERR:
332 goto internal;
333 case ACT_RET_INV:
334 goto invalid;
335 }
336 continue; /* eval the next rule */
337 }
338
339 /* If not action function defined, check for known actions */
Willy Tarreau39713102016-11-25 15:49:32 +0100340 if (rule->action == ACT_ACTION_ALLOW) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100341 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100342 }
343 else if (rule->action == ACT_ACTION_DENY) {
Christopher Faulet282992e2019-12-16 12:34:31 +0100344 goto deny;
Willy Tarreau39713102016-11-25 15:49:32 +0100345 }
346 else if (rule->action == ACT_TCP_CLOSE) {
347 chn_prod(rep)->flags |= SI_FL_NOLINGER | SI_FL_NOHALF;
Willy Tarreau0f9cd7b2019-01-31 19:02:43 +0100348 si_must_kill_conn(chn_prod(rep));
Willy Tarreau39713102016-11-25 15:49:32 +0100349 si_shutr(chn_prod(rep));
350 si_shutw(chn_prod(rep));
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100351 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100352 }
353 }
354 }
355
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100356 end:
Willy Tarreau39713102016-11-25 15:49:32 +0100357 /* if we get there, it means we have no rule which matches, or
358 * we have an explicit accept, so we apply the default accept.
359 */
360 rep->analysers &= ~an_bit;
Christopher Faulet2747fbb2020-07-28 11:56:13 +0200361 rep->analyse_exp = s->rules_exp = TICK_ETERNITY;
Christopher Fauleteea8fc72019-11-05 16:18:10 +0100362 DBG_TRACE_LEAVE(STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
Willy Tarreau39713102016-11-25 15:49:32 +0100363 return 1;
Christopher Faulet282992e2019-12-16 12:34:31 +0100364
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100365 missing_data:
Christopher Faulet54f3e182020-07-29 12:00:23 +0200366 /* just set the analyser timeout once at the beginning of the response */
Christopher Faulet2747fbb2020-07-28 11:56:13 +0200367 if (!tick_isset(s->rules_exp) && s->be->tcp_rep.inspect_delay)
368 s->rules_exp = tick_add(now_ms, s->be->tcp_rep.inspect_delay);
369 rep->analyse_exp = tick_first((tick_is_expired(rep->analyse_exp, now_ms) ? 0 : rep->analyse_exp), s->rules_exp);
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100370 DBG_TRACE_DEVEL("waiting for more data", STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
371 return 0;
372
Christopher Faulet282992e2019-12-16 12:34:31 +0100373 deny:
Christopher Fauletcff0f732019-12-16 16:13:44 +0100374 _HA_ATOMIC_ADD(&s->sess->fe->fe_counters.denied_resp, 1);
Christopher Faulet282992e2019-12-16 12:34:31 +0100375 _HA_ATOMIC_ADD(&s->be->be_counters.denied_resp, 1);
Christopher Fauletcff0f732019-12-16 16:13:44 +0100376 if (s->sess->listener->counters)
377 _HA_ATOMIC_ADD(&s->sess->listener->counters->denied_resp, 1);
Christopher Faulet282992e2019-12-16 12:34:31 +0100378 if (objt_server(s->target))
379 _HA_ATOMIC_ADD(&__objt_server(s->target)->counters.denied_resp, 1);
380 goto reject;
381
382 internal:
Christopher Fauletcff0f732019-12-16 16:13:44 +0100383 _HA_ATOMIC_ADD(&s->sess->fe->fe_counters.internal_errors, 1);
Christopher Faulet282992e2019-12-16 12:34:31 +0100384 _HA_ATOMIC_ADD(&s->be->be_counters.internal_errors, 1);
Christopher Fauletcff0f732019-12-16 16:13:44 +0100385 if (s->sess->listener->counters)
386 _HA_ATOMIC_ADD(&s->sess->listener->counters->internal_errors, 1);
Christopher Faulet282992e2019-12-16 12:34:31 +0100387 if (objt_server(s->target))
388 _HA_ATOMIC_ADD(&__objt_server(s->target)->counters.internal_errors, 1);
389 if (!(s->flags & SF_ERR_MASK))
390 s->flags |= SF_ERR_INTERNAL;
391 goto reject;
392
393 invalid:
394 _HA_ATOMIC_ADD(&s->be->be_counters.failed_resp, 1);
395 if (objt_server(s->target))
396 _HA_ATOMIC_ADD(&__objt_server(s->target)->counters.failed_resp, 1);
397
398 reject:
399 si_must_kill_conn(chn_prod(rep));
400 channel_abort(rep);
401 channel_abort(&s->req);
402
403 abort:
Christopher Faulet19dbf2d2020-07-28 11:40:07 +0200404 rep->analysers &= AN_RES_FLT_END;
Christopher Faulet282992e2019-12-16 12:34:31 +0100405
406 if (!(s->flags & SF_ERR_MASK))
407 s->flags |= SF_ERR_PRXCOND;
408 if (!(s->flags & SF_FINST_MASK))
409 s->flags |= SF_FINST_D;
410 DBG_TRACE_DEVEL("leaving on error", STRM_EV_STRM_ANA|STRM_EV_TCP_ANA|STRM_EV_TCP_ERR, s);
411 return 0;
Willy Tarreau39713102016-11-25 15:49:32 +0100412}
413
414
415/* This function performs the TCP layer4 analysis on the current request. It
416 * returns 0 if a reject rule matches, otherwise 1 if either an accept rule
417 * matches or if no more rule matches. It can only use rules which don't need
418 * any data. This only works on connection-based client-facing stream interfaces.
419 */
420int tcp_exec_l4_rules(struct session *sess)
421{
422 struct act_rule *rule;
Willy Tarreau39713102016-11-25 15:49:32 +0100423 struct connection *conn = objt_conn(sess->origin);
424 int result = 1;
425 enum acl_test_res ret;
426
427 if (!conn)
428 return result;
429
430 list_for_each_entry(rule, &sess->fe->tcp_req.l4_rules, list) {
431 ret = ACL_TEST_PASS;
432
433 if (rule->cond) {
434 ret = acl_exec_cond(rule->cond, sess->fe, sess, NULL, SMP_OPT_DIR_REQ|SMP_OPT_FINAL);
435 ret = acl_pass(ret);
436 if (rule->cond->pol == ACL_COND_UNLESS)
437 ret = !ret;
438 }
439
440 if (ret) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100441 /* Always call the action function if defined */
442 if (rule->action_ptr) {
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100443 switch (rule->action_ptr(rule, sess->fe, sess, NULL, ACT_OPT_FINAL | ACT_OPT_FIRST)) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100444 case ACT_RET_YIELD:
445 /* yield is not allowed at this point. If this return code is
446 * used it is a bug, so I prefer to abort the process.
447 */
448 send_log(sess->fe, LOG_WARNING,
449 "Internal error: yield not allowed with tcp-request connection actions.");
450 /* fall through */
451 case ACT_RET_STOP:
452 case ACT_RET_DONE:
453 goto end;
454 case ACT_RET_CONT:
455 break;
456 case ACT_RET_DENY:
457 case ACT_RET_ABRT:
458 case ACT_RET_ERR:
459 case ACT_RET_INV:
460 result = 0;
461 goto end;
462 }
463 continue; /* eval the next rule */
464 }
465
466 /* If not action function defined, check for known actions */
Willy Tarreau39713102016-11-25 15:49:32 +0100467 if (rule->action == ACT_ACTION_ALLOW) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100468 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100469 }
470 else if (rule->action == ACT_ACTION_DENY) {
Olivier Houchard64dbb2d2019-03-08 18:55:10 +0100471 _HA_ATOMIC_ADD(&sess->fe->fe_counters.denied_conn, 1);
Willy Tarreaua12dde02016-12-22 18:14:41 +0100472 if (sess->listener && sess->listener->counters)
Olivier Houchard64dbb2d2019-03-08 18:55:10 +0100473 _HA_ATOMIC_ADD(&sess->listener->counters->denied_conn, 1);
Willy Tarreau39713102016-11-25 15:49:32 +0100474
475 result = 0;
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100476 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100477 }
Willy Tarreau39713102016-11-25 15:49:32 +0100478 else if (rule->action == ACT_TCP_EXPECT_PX) {
Willy Tarreau4450b582020-01-23 15:23:13 +0100479 if (!(conn->flags & CO_FL_HANDSHAKE)) {
Olivier Houchardfe50bfb2019-05-27 12:09:19 +0200480 if (xprt_add_hs(conn) < 0) {
481 result = 0;
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100482 goto end;
Olivier Houchardfe50bfb2019-05-27 12:09:19 +0200483 }
484 }
Willy Tarreau39713102016-11-25 15:49:32 +0100485 conn->flags |= CO_FL_ACCEPT_PROXY;
Willy Tarreau39713102016-11-25 15:49:32 +0100486 }
487 else if (rule->action == ACT_TCP_EXPECT_CIP) {
Willy Tarreau4450b582020-01-23 15:23:13 +0100488 if (!(conn->flags & CO_FL_HANDSHAKE)) {
Olivier Houchardfe50bfb2019-05-27 12:09:19 +0200489 if (xprt_add_hs(conn) < 0) {
490 result = 0;
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100491 goto end;
Olivier Houchardfe50bfb2019-05-27 12:09:19 +0200492 }
493 }
Willy Tarreau39713102016-11-25 15:49:32 +0100494 conn->flags |= CO_FL_ACCEPT_CIP;
Willy Tarreau39713102016-11-25 15:49:32 +0100495 }
Willy Tarreau39713102016-11-25 15:49:32 +0100496 }
497 }
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100498 end:
Willy Tarreau39713102016-11-25 15:49:32 +0100499 return result;
500}
501
502/* This function performs the TCP layer5 analysis on the current request. It
503 * returns 0 if a reject rule matches, otherwise 1 if either an accept rule
504 * matches or if no more rule matches. It can only use rules which don't need
505 * any data. This only works on session-based client-facing stream interfaces.
506 * An example of valid use case is to track a stick-counter on the source
507 * address extracted from the proxy protocol.
508 */
509int tcp_exec_l5_rules(struct session *sess)
510{
511 struct act_rule *rule;
Willy Tarreau39713102016-11-25 15:49:32 +0100512 int result = 1;
513 enum acl_test_res ret;
514
515 list_for_each_entry(rule, &sess->fe->tcp_req.l5_rules, list) {
516 ret = ACL_TEST_PASS;
517
518 if (rule->cond) {
519 ret = acl_exec_cond(rule->cond, sess->fe, sess, NULL, SMP_OPT_DIR_REQ|SMP_OPT_FINAL);
520 ret = acl_pass(ret);
521 if (rule->cond->pol == ACL_COND_UNLESS)
522 ret = !ret;
523 }
524
525 if (ret) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100526 /* Always call the action function if defined */
527 if (rule->action_ptr) {
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100528 switch (rule->action_ptr(rule, sess->fe, sess, NULL, ACT_OPT_FINAL | ACT_OPT_FIRST)) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100529 case ACT_RET_YIELD:
530 /* yield is not allowed at this point. If this return code is
531 * used it is a bug, so I prefer to abort the process.
532 */
533 send_log(sess->fe, LOG_WARNING,
534 "Internal error: yield not allowed with tcp-request session actions.");
535 /* fall through */
536 case ACT_RET_STOP:
537 case ACT_RET_DONE:
538 goto end;
539 case ACT_RET_CONT:
540 break;
541 case ACT_RET_DENY:
542 case ACT_RET_ABRT:
543 case ACT_RET_ERR:
544 case ACT_RET_INV:
545 result = 0;
546 goto end;
547 }
548 continue; /* eval the next rule */
549 }
550
551 /* If not action function defined, check for known actions */
Willy Tarreau39713102016-11-25 15:49:32 +0100552 if (rule->action == ACT_ACTION_ALLOW) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100553 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100554 }
555 else if (rule->action == ACT_ACTION_DENY) {
Olivier Houchard64dbb2d2019-03-08 18:55:10 +0100556 _HA_ATOMIC_ADD(&sess->fe->fe_counters.denied_sess, 1);
Willy Tarreaua12dde02016-12-22 18:14:41 +0100557 if (sess->listener && sess->listener->counters)
Olivier Houchard64dbb2d2019-03-08 18:55:10 +0100558 _HA_ATOMIC_ADD(&sess->listener->counters->denied_sess, 1);
Willy Tarreau39713102016-11-25 15:49:32 +0100559
560 result = 0;
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100561 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100562 }
Willy Tarreau39713102016-11-25 15:49:32 +0100563 }
564 }
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100565 end:
Willy Tarreau39713102016-11-25 15:49:32 +0100566 return result;
567}
568
569/* Parse a tcp-response rule. Return a negative value in case of failure */
570static int tcp_parse_response_rule(char **args, int arg, int section_type,
571 struct proxy *curpx, struct proxy *defpx,
572 struct act_rule *rule, char **err,
573 unsigned int where,
574 const char *file, int line)
575{
576 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
577 memprintf(err, "%s %s is only allowed in 'backend' sections",
578 args[0], args[1]);
579 return -1;
580 }
581
582 if (strcmp(args[arg], "accept") == 0) {
583 arg++;
584 rule->action = ACT_ACTION_ALLOW;
Christopher Faulet245cf792019-12-18 14:58:12 +0100585 rule->flags |= ACT_FLAG_FINAL;
Willy Tarreau39713102016-11-25 15:49:32 +0100586 }
587 else if (strcmp(args[arg], "reject") == 0) {
588 arg++;
589 rule->action = ACT_ACTION_DENY;
Christopher Faulet245cf792019-12-18 14:58:12 +0100590 rule->flags |= ACT_FLAG_FINAL;
Willy Tarreau39713102016-11-25 15:49:32 +0100591 }
592 else if (strcmp(args[arg], "close") == 0) {
593 arg++;
594 rule->action = ACT_TCP_CLOSE;
Christopher Faulet245cf792019-12-18 14:58:12 +0100595 rule->flags |= ACT_FLAG_FINAL;
Willy Tarreau39713102016-11-25 15:49:32 +0100596 }
597 else {
598 struct action_kw *kw;
599 kw = tcp_res_cont_action(args[arg]);
600 if (kw) {
601 arg++;
Willy Tarreau39713102016-11-25 15:49:32 +0100602 rule->kw = kw;
603 if (kw->parse((const char **)args, &arg, curpx, rule, err) == ACT_RET_PRS_ERR)
604 return -1;
605 } else {
606 action_build_list(&tcp_res_cont_keywords, &trash);
607 memprintf(err,
608 "'%s %s' expects 'accept', 'close', 'reject', %s in %s '%s' (got '%s')",
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200609 args[0], args[1], trash.area,
610 proxy_type_str(curpx), curpx->id, args[arg]);
Willy Tarreau39713102016-11-25 15:49:32 +0100611 return -1;
612 }
613 }
614
615 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
Christopher Faulet1b421ea2017-09-22 14:38:56 +0200616 if ((rule->cond = build_acl_cond(file, line, &curpx->acl, curpx, (const char **)args+arg, err)) == NULL) {
Willy Tarreau39713102016-11-25 15:49:32 +0100617 memprintf(err,
618 "'%s %s %s' : error detected in %s '%s' while parsing '%s' condition : %s",
619 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg], *err);
620 return -1;
621 }
622 }
623 else if (*args[arg]) {
624 memprintf(err,
625 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (got '%s')",
626 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
627 return -1;
628 }
629 return 0;
630}
631
Christopher Fauletac98d812019-12-18 09:20:16 +0100632
633/* This function executes a track-sc* actions. On success, it returns
634 * ACT_RET_CONT. If it must yield, it return ACT_RET_YIELD. Otherwsize
635 * ACT_RET_ERR is returned.
636 */
637static enum act_return tcp_action_track_sc(struct act_rule *rule, struct proxy *px,
638 struct session *sess, struct stream *s, int flags)
639{
640 struct stksess *ts;
641 struct stktable *t;
642 struct stktable_key *key;
643 struct sample smp;
644 int opt;
645
Christopher Faulet67307792020-02-10 09:54:49 +0100646 opt = SMP_OPT_DIR_REQ;
Christopher Fauletac98d812019-12-18 09:20:16 +0100647 if (flags & ACT_FLAG_FINAL)
648 opt |= SMP_OPT_FINAL;
Willy Tarreau39713102016-11-25 15:49:32 +0100649
Christopher Fauletac98d812019-12-18 09:20:16 +0100650 t = rule->arg.trk_ctr.table.t;
Christopher Faulet67307792020-02-10 09:54:49 +0100651 if (rule->from == ACT_F_TCP_REQ_CNT) { /* L7 rules: use the stream */
652 if (stkctr_entry(&s->stkctr[rule->action]))
653 goto end;
Christopher Fauletac98d812019-12-18 09:20:16 +0100654
Christopher Faulet67307792020-02-10 09:54:49 +0100655 key = stktable_fetch_key(t, s->be, sess, s, opt, rule->arg.trk_ctr.expr, &smp);
Christopher Fauletac98d812019-12-18 09:20:16 +0100656
Christopher Faulet67307792020-02-10 09:54:49 +0100657 if ((smp.flags & SMP_F_MAY_CHANGE) && !(flags & ACT_FLAG_FINAL))
658 return ACT_RET_YIELD; /* key might appear later */
659
660 if (key && (ts = stktable_get_entry(t, key))) {
661 stream_track_stkctr(&s->stkctr[rule->action], t, ts);
Christopher Fauletac98d812019-12-18 09:20:16 +0100662 stkctr_set_flags(&s->stkctr[rule->action], STKCTR_TRACK_CONTENT);
663 if (sess->fe != s->be)
664 stkctr_set_flags(&s->stkctr[rule->action], STKCTR_TRACK_BACKEND);
665 }
666 }
Christopher Faulet67307792020-02-10 09:54:49 +0100667 else { /* L4/L5 rules: use the session */
668 if (stkctr_entry(&sess->stkctr[rule->action]))
669 goto end;
670
671 key = stktable_fetch_key(t, sess->fe, sess, NULL, opt, rule->arg.trk_ctr.expr, NULL);
672 if (key && (ts = stktable_get_entry(t, key)))
673 stream_track_stkctr(&sess->stkctr[rule->action], t, ts);
674 }
Christopher Fauletac98d812019-12-18 09:20:16 +0100675
676 end:
677 return ACT_RET_CONT;
678}
Willy Tarreau39713102016-11-25 15:49:32 +0100679
Christopher Fauletd73b96d2019-12-19 17:27:03 +0100680/* This function executes a capture actions. It executes a fetch expression,
681 * turns the result into a string and puts it in a capture slot. On success, it
682 * returns ACT_RET_CONT. If it must yield, it return ACT_RET_YIELD. Otherwsize
683 * ACT_RET_ERR is returned.
684 */
685static enum act_return tcp_action_capture(struct act_rule *rule, struct proxy *px,
686 struct session *sess, struct stream *s, int flags)
687{
688 struct sample *key;
689 struct cap_hdr *h = rule->arg.cap.hdr;
690 char **cap = s->req_cap;
691 int len, opt;
692
693 opt = ((rule->from == ACT_F_TCP_REQ_CNT) ? SMP_OPT_DIR_REQ : SMP_OPT_DIR_RES);
694 if (flags & ACT_FLAG_FINAL)
695 opt |= SMP_OPT_FINAL;
696
697 key = sample_fetch_as_type(s->be, sess, s, opt, rule->arg.cap.expr, SMP_T_STR);
698 if (!key)
699 goto end;
700
701 if ((key->flags & SMP_F_MAY_CHANGE) && !(flags & ACT_FLAG_FINAL))
702 return ACT_RET_YIELD; /* key might appear later */
703
704 if (cap[h->index] == NULL) {
705 cap[h->index] = pool_alloc(h->pool);
706 if (cap[h->index] == NULL) /* no more capture memory, ignore error */
707 goto end;
708 }
709
710 len = key->data.u.str.data;
711 if (len > h->len)
712 len = h->len;
713
714 memcpy(cap[h->index], key->data.u.str.area, len);
715 cap[h->index][len] = 0;
716
717 end:
718 return ACT_RET_CONT;
719}
720
Christopher Fauletadfc6e82020-01-14 15:05:33 +0100721static void release_tcp_capture(struct act_rule * rule)
722{
723 release_sample_expr(rule->arg.cap.expr);
724}
725
726
727static void release_tcp_track_sc(struct act_rule * rule)
728{
729 release_sample_expr(rule->arg.trk_ctr.expr);
730}
731
Willy Tarreau39713102016-11-25 15:49:32 +0100732/* Parse a tcp-request rule. Return a negative value in case of failure */
733static int tcp_parse_request_rule(char **args, int arg, int section_type,
734 struct proxy *curpx, struct proxy *defpx,
735 struct act_rule *rule, char **err,
736 unsigned int where, const char *file, int line)
737{
738 if (curpx == defpx) {
739 memprintf(err, "%s %s is not allowed in 'defaults' sections",
740 args[0], args[1]);
741 return -1;
742 }
743
Tim Duesterhuse5ff1412021-01-02 22:31:53 +0100744 if (strcmp(args[arg], "accept") == 0) {
Willy Tarreau39713102016-11-25 15:49:32 +0100745 arg++;
746 rule->action = ACT_ACTION_ALLOW;
Christopher Faulet245cf792019-12-18 14:58:12 +0100747 rule->flags |= ACT_FLAG_FINAL;
Willy Tarreau39713102016-11-25 15:49:32 +0100748 }
Tim Duesterhuse5ff1412021-01-02 22:31:53 +0100749 else if (strcmp(args[arg], "reject") == 0) {
Willy Tarreau39713102016-11-25 15:49:32 +0100750 arg++;
751 rule->action = ACT_ACTION_DENY;
Christopher Faulet245cf792019-12-18 14:58:12 +0100752 rule->flags |= ACT_FLAG_FINAL;
Willy Tarreau39713102016-11-25 15:49:32 +0100753 }
754 else if (strcmp(args[arg], "capture") == 0) {
755 struct sample_expr *expr;
756 struct cap_hdr *hdr;
757 int kw = arg;
758 int len = 0;
759
760 if (!(curpx->cap & PR_CAP_FE)) {
761 memprintf(err,
762 "'%s %s %s' : proxy '%s' has no frontend capability",
763 args[0], args[1], args[kw], curpx->id);
764 return -1;
765 }
766
767 if (!(where & SMP_VAL_FE_REQ_CNT)) {
768 memprintf(err,
769 "'%s %s' is not allowed in '%s %s' rules in %s '%s'",
770 args[arg], args[arg+1], args[0], args[1], proxy_type_str(curpx), curpx->id);
771 return -1;
772 }
773
774 arg++;
775
776 curpx->conf.args.ctx = ARGC_CAP;
Willy Tarreaue3b57bf2020-02-14 16:50:14 +0100777 expr = sample_parse_expr(args, &arg, file, line, err, &curpx->conf.args, NULL);
Willy Tarreau39713102016-11-25 15:49:32 +0100778 if (!expr) {
779 memprintf(err,
780 "'%s %s %s' : %s",
781 args[0], args[1], args[kw], *err);
782 return -1;
783 }
784
785 if (!(expr->fetch->val & where)) {
786 memprintf(err,
787 "'%s %s %s' : fetch method '%s' extracts information from '%s', none of which is available here",
788 args[0], args[1], args[kw], args[arg-1], sample_src_names(expr->fetch->use));
Christopher Fauletfdb6fbf2020-01-14 15:05:56 +0100789 release_sample_expr(expr);
Willy Tarreau39713102016-11-25 15:49:32 +0100790 return -1;
791 }
792
793 if (strcmp(args[arg], "len") == 0) {
794 arg++;
795 if (!args[arg]) {
796 memprintf(err,
797 "'%s %s %s' : missing length value",
798 args[0], args[1], args[kw]);
Christopher Fauletfdb6fbf2020-01-14 15:05:56 +0100799 release_sample_expr(expr);
Willy Tarreau39713102016-11-25 15:49:32 +0100800 return -1;
801 }
802 /* we copy the table name for now, it will be resolved later */
803 len = atoi(args[arg]);
804 if (len <= 0) {
805 memprintf(err,
806 "'%s %s %s' : length must be > 0",
807 args[0], args[1], args[kw]);
Christopher Fauletfdb6fbf2020-01-14 15:05:56 +0100808 release_sample_expr(expr);
Willy Tarreau39713102016-11-25 15:49:32 +0100809 return -1;
810 }
811 arg++;
812 }
813
814 if (!len) {
815 memprintf(err,
816 "'%s %s %s' : a positive 'len' argument is mandatory",
817 args[0], args[1], args[kw]);
818 free(expr);
819 return -1;
820 }
821
822 hdr = calloc(1, sizeof(*hdr));
823 hdr->next = curpx->req_cap;
824 hdr->name = NULL; /* not a header capture */
825 hdr->namelen = 0;
826 hdr->len = len;
827 hdr->pool = create_pool("caphdr", hdr->len + 1, MEM_F_SHARED);
828 hdr->index = curpx->nb_req_cap++;
829
830 curpx->req_cap = hdr;
831 curpx->to_log |= LW_REQHDR;
832
Christopher Faulet711ed6a2019-07-16 14:16:10 +0200833 /* check if we need to allocate an http_txn struct for HTTP parsing */
Willy Tarreau39713102016-11-25 15:49:32 +0100834 curpx->http_needed |= !!(expr->fetch->use & SMP_USE_HTTP_ANY);
835
836 rule->arg.cap.expr = expr;
837 rule->arg.cap.hdr = hdr;
Christopher Fauletd73b96d2019-12-19 17:27:03 +0100838 rule->action = ACT_CUSTOM;
839 rule->action_ptr = tcp_action_capture;
840 rule->check_ptr = check_capture;
Christopher Fauletadfc6e82020-01-14 15:05:33 +0100841 rule->release_ptr = release_tcp_capture;
Willy Tarreau39713102016-11-25 15:49:32 +0100842 }
Frédéric Lécaillea41d5312018-01-29 12:05:07 +0100843 else if (strncmp(args[arg], "track-sc", 8) == 0) {
Willy Tarreau39713102016-11-25 15:49:32 +0100844 struct sample_expr *expr;
845 int kw = arg;
Frédéric Lécaillea41d5312018-01-29 12:05:07 +0100846 unsigned int tsc_num;
847 const char *tsc_num_str;
Willy Tarreau39713102016-11-25 15:49:32 +0100848
849 arg++;
850
Frédéric Lécaillea41d5312018-01-29 12:05:07 +0100851 tsc_num_str = &args[kw][8];
852 if (cfg_parse_track_sc_num(&tsc_num, tsc_num_str, tsc_num_str + strlen(tsc_num_str), err) == -1) {
853 memprintf(err, "'%s %s %s' : %s", args[0], args[1], args[kw], *err);
854 return -1;
855 }
856
Willy Tarreau39713102016-11-25 15:49:32 +0100857 curpx->conf.args.ctx = ARGC_TRK;
Willy Tarreaue3b57bf2020-02-14 16:50:14 +0100858 expr = sample_parse_expr(args, &arg, file, line, err, &curpx->conf.args, NULL);
Willy Tarreau39713102016-11-25 15:49:32 +0100859 if (!expr) {
860 memprintf(err,
861 "'%s %s %s' : %s",
862 args[0], args[1], args[kw], *err);
863 return -1;
864 }
865
866 if (!(expr->fetch->val & where)) {
867 memprintf(err,
868 "'%s %s %s' : fetch method '%s' extracts information from '%s', none of which is available here",
869 args[0], args[1], args[kw], args[arg-1], sample_src_names(expr->fetch->use));
Christopher Fauletfdb6fbf2020-01-14 15:05:56 +0100870 release_sample_expr(expr);
Willy Tarreau39713102016-11-25 15:49:32 +0100871 return -1;
872 }
873
Christopher Faulet711ed6a2019-07-16 14:16:10 +0200874 /* check if we need to allocate an http_txn struct for HTTP parsing */
Willy Tarreau39713102016-11-25 15:49:32 +0100875 curpx->http_needed |= !!(expr->fetch->use & SMP_USE_HTTP_ANY);
876
877 if (strcmp(args[arg], "table") == 0) {
878 arg++;
879 if (!args[arg]) {
880 memprintf(err,
881 "'%s %s %s' : missing table name",
882 args[0], args[1], args[kw]);
Christopher Fauletfdb6fbf2020-01-14 15:05:56 +0100883 release_sample_expr(expr);
Willy Tarreau39713102016-11-25 15:49:32 +0100884 return -1;
885 }
886 /* we copy the table name for now, it will be resolved later */
887 rule->arg.trk_ctr.table.n = strdup(args[arg]);
888 arg++;
889 }
Christopher Fauletac98d812019-12-18 09:20:16 +0100890 rule->action = tsc_num;
Willy Tarreau39713102016-11-25 15:49:32 +0100891 rule->arg.trk_ctr.expr = expr;
Christopher Fauletac98d812019-12-18 09:20:16 +0100892 rule->action_ptr = tcp_action_track_sc;
Christopher Faulet78880fb2017-09-18 14:43:55 +0200893 rule->check_ptr = check_trk_action;
Christopher Fauletadfc6e82020-01-14 15:05:33 +0100894 rule->release_ptr = release_tcp_track_sc;
Willy Tarreau39713102016-11-25 15:49:32 +0100895 }
896 else if (strcmp(args[arg], "expect-proxy") == 0) {
897 if (strcmp(args[arg+1], "layer4") != 0) {
898 memprintf(err,
899 "'%s %s %s' only supports 'layer4' in %s '%s' (got '%s')",
900 args[0], args[1], args[arg], proxy_type_str(curpx), curpx->id, args[arg+1]);
901 return -1;
902 }
903
904 if (!(where & SMP_VAL_FE_CON_ACC)) {
905 memprintf(err,
906 "'%s %s' is not allowed in '%s %s' rules in %s '%s'",
907 args[arg], args[arg+1], args[0], args[1], proxy_type_str(curpx), curpx->id);
908 return -1;
909 }
910
911 arg += 2;
912 rule->action = ACT_TCP_EXPECT_PX;
913 }
914 else if (strcmp(args[arg], "expect-netscaler-cip") == 0) {
915 if (strcmp(args[arg+1], "layer4") != 0) {
916 memprintf(err,
917 "'%s %s %s' only supports 'layer4' in %s '%s' (got '%s')",
918 args[0], args[1], args[arg], proxy_type_str(curpx), curpx->id, args[arg+1]);
919 return -1;
920 }
921
922 if (!(where & SMP_VAL_FE_CON_ACC)) {
923 memprintf(err,
924 "'%s %s' is not allowed in '%s %s' rules in %s '%s'",
925 args[arg], args[arg+1], args[0], args[1], proxy_type_str(curpx), curpx->id);
926 return -1;
927 }
928
929 arg += 2;
930 rule->action = ACT_TCP_EXPECT_CIP;
931 }
932 else {
933 struct action_kw *kw;
934 if (where & SMP_VAL_FE_CON_ACC) {
935 /* L4 */
936 kw = tcp_req_conn_action(args[arg]);
937 rule->kw = kw;
Willy Tarreau39713102016-11-25 15:49:32 +0100938 } else if (where & SMP_VAL_FE_SES_ACC) {
939 /* L5 */
940 kw = tcp_req_sess_action(args[arg]);
941 rule->kw = kw;
Willy Tarreau39713102016-11-25 15:49:32 +0100942 } else {
943 /* L6 */
944 kw = tcp_req_cont_action(args[arg]);
945 rule->kw = kw;
Willy Tarreau39713102016-11-25 15:49:32 +0100946 }
947 if (kw) {
948 arg++;
949 if (kw->parse((const char **)args, &arg, curpx, rule, err) == ACT_RET_PRS_ERR)
950 return -1;
951 } else {
952 if (where & SMP_VAL_FE_CON_ACC)
953 action_build_list(&tcp_req_conn_keywords, &trash);
954 else if (where & SMP_VAL_FE_SES_ACC)
955 action_build_list(&tcp_req_sess_keywords, &trash);
956 else
957 action_build_list(&tcp_req_cont_keywords, &trash);
958 memprintf(err,
959 "'%s %s' expects 'accept', 'reject', 'track-sc0' ... 'track-sc%d', %s "
960 "in %s '%s' (got '%s').\n",
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200961 args[0], args[1], MAX_SESS_STKCTR-1,
962 trash.area, proxy_type_str(curpx),
Willy Tarreau39713102016-11-25 15:49:32 +0100963 curpx->id, args[arg]);
964 return -1;
965 }
966 }
967
968 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
Christopher Faulet1b421ea2017-09-22 14:38:56 +0200969 if ((rule->cond = build_acl_cond(file, line, &curpx->acl, curpx, (const char **)args+arg, err)) == NULL) {
Willy Tarreau39713102016-11-25 15:49:32 +0100970 memprintf(err,
971 "'%s %s %s' : error detected in %s '%s' while parsing '%s' condition : %s",
972 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg], *err);
973 return -1;
974 }
975 }
976 else if (*args[arg]) {
977 memprintf(err,
978 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (got '%s')",
979 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
980 return -1;
981 }
982 return 0;
983}
984
985/* This function should be called to parse a line starting with the "tcp-response"
986 * keyword.
987 */
988static int tcp_parse_tcp_rep(char **args, int section_type, struct proxy *curpx,
989 struct proxy *defpx, const char *file, int line,
990 char **err)
991{
992 const char *ptr = NULL;
993 unsigned int val;
994 int warn = 0;
995 int arg;
996 struct act_rule *rule;
997 unsigned int where;
998 const struct acl *acl;
999 const char *kw;
1000
1001 if (!*args[1]) {
1002 memprintf(err, "missing argument for '%s' in %s '%s'",
1003 args[0], proxy_type_str(curpx), curpx->id);
1004 return -1;
1005 }
1006
1007 if (strcmp(args[1], "inspect-delay") == 0) {
1008 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
1009 memprintf(err, "%s %s is only allowed in 'backend' sections",
1010 args[0], args[1]);
1011 return -1;
1012 }
1013
1014 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
1015 memprintf(err,
1016 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
1017 args[0], args[1], proxy_type_str(curpx), curpx->id);
Willy Tarreau9faebe32019-06-07 19:00:37 +02001018
1019 if (ptr == PARSE_TIME_OVER)
1020 memprintf(err, "%s (timer overflow in '%s', maximum value is 2147483647 ms or ~24.8 days)", *err, args[2]);
1021 else if (ptr == PARSE_TIME_UNDER)
1022 memprintf(err, "%s (timer underflow in '%s', minimum non-null value is 1 ms)", *err, args[2]);
1023 else if (ptr)
Willy Tarreau39713102016-11-25 15:49:32 +01001024 memprintf(err, "%s (unexpected character '%c')", *err, *ptr);
1025 return -1;
1026 }
1027
1028 if (curpx->tcp_rep.inspect_delay) {
1029 memprintf(err, "ignoring %s %s (was already defined) in %s '%s'",
1030 args[0], args[1], proxy_type_str(curpx), curpx->id);
1031 return 1;
1032 }
1033 curpx->tcp_rep.inspect_delay = val;
1034 return 0;
1035 }
1036
1037 rule = calloc(1, sizeof(*rule));
1038 LIST_INIT(&rule->list);
1039 arg = 1;
1040 where = 0;
1041
1042 if (strcmp(args[1], "content") == 0) {
1043 arg++;
1044
1045 if (curpx->cap & PR_CAP_FE)
1046 where |= SMP_VAL_FE_RES_CNT;
1047 if (curpx->cap & PR_CAP_BE)
1048 where |= SMP_VAL_BE_RES_CNT;
Christopher Fauletcb9106b2019-12-19 15:23:17 +01001049 rule->from = ACT_F_TCP_RES_CNT;
Willy Tarreau39713102016-11-25 15:49:32 +01001050 if (tcp_parse_response_rule(args, arg, section_type, curpx, defpx, rule, err, where, file, line) < 0)
1051 goto error;
1052
1053 acl = rule->cond ? acl_cond_conflicts(rule->cond, where) : NULL;
1054 if (acl) {
1055 if (acl->name && *acl->name)
1056 memprintf(err,
1057 "acl '%s' will never match in '%s %s' because it only involves keywords that are incompatible with '%s'",
1058 acl->name, args[0], args[1], sample_ckp_names(where));
1059 else
1060 memprintf(err,
1061 "anonymous acl will never match in '%s %s' because it uses keyword '%s' which is incompatible with '%s'",
1062 args[0], args[1],
1063 LIST_ELEM(acl->expr.n, struct acl_expr *, list)->kw,
1064 sample_ckp_names(where));
1065
1066 warn++;
1067 }
1068 else if (rule->cond && acl_cond_kw_conflicts(rule->cond, where, &acl, &kw)) {
1069 if (acl->name && *acl->name)
1070 memprintf(err,
1071 "acl '%s' involves keyword '%s' which is incompatible with '%s'",
1072 acl->name, kw, sample_ckp_names(where));
1073 else
1074 memprintf(err,
1075 "anonymous acl involves keyword '%s' which is incompatible with '%s'",
1076 kw, sample_ckp_names(where));
1077 warn++;
1078 }
1079
1080 LIST_ADDQ(&curpx->tcp_rep.inspect_rules, &rule->list);
1081 }
1082 else {
1083 memprintf(err,
1084 "'%s' expects 'inspect-delay' or 'content' in %s '%s' (got '%s')",
1085 args[0], proxy_type_str(curpx), curpx->id, args[1]);
1086 goto error;
1087 }
1088
1089 return warn;
1090 error:
1091 free(rule);
1092 return -1;
1093}
1094
1095
1096/* This function should be called to parse a line starting with the "tcp-request"
1097 * keyword.
1098 */
1099static int tcp_parse_tcp_req(char **args, int section_type, struct proxy *curpx,
1100 struct proxy *defpx, const char *file, int line,
1101 char **err)
1102{
1103 const char *ptr = NULL;
1104 unsigned int val;
1105 int warn = 0;
1106 int arg;
1107 struct act_rule *rule;
1108 unsigned int where;
1109 const struct acl *acl;
1110 const char *kw;
1111
1112 if (!*args[1]) {
1113 if (curpx == defpx)
1114 memprintf(err, "missing argument for '%s' in defaults section", args[0]);
1115 else
1116 memprintf(err, "missing argument for '%s' in %s '%s'",
1117 args[0], proxy_type_str(curpx), curpx->id);
1118 return -1;
1119 }
1120
Tim Duesterhuse5ff1412021-01-02 22:31:53 +01001121 if (strcmp(args[1], "inspect-delay") == 0) {
Willy Tarreau39713102016-11-25 15:49:32 +01001122 if (curpx == defpx) {
1123 memprintf(err, "%s %s is not allowed in 'defaults' sections",
1124 args[0], args[1]);
1125 return -1;
1126 }
1127
1128 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
1129 memprintf(err,
1130 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
1131 args[0], args[1], proxy_type_str(curpx), curpx->id);
Willy Tarreau9faebe32019-06-07 19:00:37 +02001132
1133 if (ptr == PARSE_TIME_OVER)
1134 memprintf(err, "%s (timer overflow in '%s', maximum value is 2147483647 ms or ~24.8 days)", *err, args[2]);
1135 else if (ptr == PARSE_TIME_UNDER)
1136 memprintf(err, "%s (timer underflow in '%s', minimum non-null value is 1 ms)", *err, args[2]);
1137 else if (ptr)
Willy Tarreau39713102016-11-25 15:49:32 +01001138 memprintf(err, "%s (unexpected character '%c')", *err, *ptr);
1139 return -1;
1140 }
1141
1142 if (curpx->tcp_req.inspect_delay) {
1143 memprintf(err, "ignoring %s %s (was already defined) in %s '%s'",
1144 args[0], args[1], proxy_type_str(curpx), curpx->id);
1145 return 1;
1146 }
1147 curpx->tcp_req.inspect_delay = val;
1148 return 0;
1149 }
1150
1151 rule = calloc(1, sizeof(*rule));
1152 LIST_INIT(&rule->list);
1153 arg = 1;
1154 where = 0;
1155
1156 if (strcmp(args[1], "content") == 0) {
1157 arg++;
1158
1159 if (curpx->cap & PR_CAP_FE)
1160 where |= SMP_VAL_FE_REQ_CNT;
1161 if (curpx->cap & PR_CAP_BE)
1162 where |= SMP_VAL_BE_REQ_CNT;
Christopher Fauletcb9106b2019-12-19 15:23:17 +01001163 rule->from = ACT_F_TCP_REQ_CNT;
Willy Tarreau39713102016-11-25 15:49:32 +01001164 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, where, file, line) < 0)
1165 goto error;
1166
1167 acl = rule->cond ? acl_cond_conflicts(rule->cond, where) : NULL;
1168 if (acl) {
1169 if (acl->name && *acl->name)
1170 memprintf(err,
1171 "acl '%s' will never match in '%s %s' because it only involves keywords that are incompatible with '%s'",
1172 acl->name, args[0], args[1], sample_ckp_names(where));
1173 else
1174 memprintf(err,
1175 "anonymous acl will never match in '%s %s' because it uses keyword '%s' which is incompatible with '%s'",
1176 args[0], args[1],
1177 LIST_ELEM(acl->expr.n, struct acl_expr *, list)->kw,
1178 sample_ckp_names(where));
1179
1180 warn++;
1181 }
1182 else if (rule->cond && acl_cond_kw_conflicts(rule->cond, where, &acl, &kw)) {
1183 if (acl->name && *acl->name)
1184 memprintf(err,
1185 "acl '%s' involves keyword '%s' which is incompatible with '%s'",
1186 acl->name, kw, sample_ckp_names(where));
1187 else
1188 memprintf(err,
1189 "anonymous acl involves keyword '%s' which is incompatible with '%s'",
1190 kw, sample_ckp_names(where));
1191 warn++;
1192 }
1193
1194 /* the following function directly emits the warning */
1195 warnif_misplaced_tcp_cont(curpx, file, line, args[0]);
1196 LIST_ADDQ(&curpx->tcp_req.inspect_rules, &rule->list);
1197 }
1198 else if (strcmp(args[1], "connection") == 0) {
1199 arg++;
1200
1201 if (!(curpx->cap & PR_CAP_FE)) {
1202 memprintf(err, "%s %s is not allowed because %s %s is not a frontend",
1203 args[0], args[1], proxy_type_str(curpx), curpx->id);
1204 goto error;
1205 }
1206
1207 where |= SMP_VAL_FE_CON_ACC;
Christopher Fauletcb9106b2019-12-19 15:23:17 +01001208 rule->from = ACT_F_TCP_REQ_CON;
Willy Tarreau39713102016-11-25 15:49:32 +01001209 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, where, file, line) < 0)
1210 goto error;
1211
1212 acl = rule->cond ? acl_cond_conflicts(rule->cond, where) : NULL;
1213 if (acl) {
1214 if (acl->name && *acl->name)
1215 memprintf(err,
1216 "acl '%s' will never match in '%s %s' because it only involves keywords that are incompatible with '%s'",
1217 acl->name, args[0], args[1], sample_ckp_names(where));
1218 else
1219 memprintf(err,
1220 "anonymous acl will never match in '%s %s' because it uses keyword '%s' which is incompatible with '%s'",
1221 args[0], args[1],
1222 LIST_ELEM(acl->expr.n, struct acl_expr *, list)->kw,
1223 sample_ckp_names(where));
1224
1225 warn++;
1226 }
1227 else if (rule->cond && acl_cond_kw_conflicts(rule->cond, where, &acl, &kw)) {
1228 if (acl->name && *acl->name)
1229 memprintf(err,
1230 "acl '%s' involves keyword '%s' which is incompatible with '%s'",
1231 acl->name, kw, sample_ckp_names(where));
1232 else
1233 memprintf(err,
1234 "anonymous acl involves keyword '%s' which is incompatible with '%s'",
1235 kw, sample_ckp_names(where));
1236 warn++;
1237 }
1238
1239 /* the following function directly emits the warning */
1240 warnif_misplaced_tcp_conn(curpx, file, line, args[0]);
1241 LIST_ADDQ(&curpx->tcp_req.l4_rules, &rule->list);
1242 }
1243 else if (strcmp(args[1], "session") == 0) {
1244 arg++;
1245
1246 if (!(curpx->cap & PR_CAP_FE)) {
1247 memprintf(err, "%s %s is not allowed because %s %s is not a frontend",
1248 args[0], args[1], proxy_type_str(curpx), curpx->id);
1249 goto error;
1250 }
1251
1252 where |= SMP_VAL_FE_SES_ACC;
Christopher Fauletcb9106b2019-12-19 15:23:17 +01001253 rule->from = ACT_F_TCP_REQ_SES;
Willy Tarreau39713102016-11-25 15:49:32 +01001254 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, where, file, line) < 0)
1255 goto error;
1256
1257 acl = rule->cond ? acl_cond_conflicts(rule->cond, where) : NULL;
1258 if (acl) {
1259 if (acl->name && *acl->name)
1260 memprintf(err,
1261 "acl '%s' will never match in '%s %s' because it only involves keywords that are incompatible with '%s'",
1262 acl->name, args[0], args[1], sample_ckp_names(where));
1263 else
1264 memprintf(err,
1265 "anonymous acl will never match in '%s %s' because it uses keyword '%s' which is incompatible with '%s'",
1266 args[0], args[1],
1267 LIST_ELEM(acl->expr.n, struct acl_expr *, list)->kw,
1268 sample_ckp_names(where));
1269 warn++;
1270 }
1271 else if (rule->cond && acl_cond_kw_conflicts(rule->cond, where, &acl, &kw)) {
1272 if (acl->name && *acl->name)
1273 memprintf(err,
1274 "acl '%s' involves keyword '%s' which is incompatible with '%s'",
1275 acl->name, kw, sample_ckp_names(where));
1276 else
1277 memprintf(err,
1278 "anonymous acl involves keyword '%s' which is incompatible with '%s'",
1279 kw, sample_ckp_names(where));
1280 warn++;
1281 }
1282
1283 /* the following function directly emits the warning */
1284 warnif_misplaced_tcp_sess(curpx, file, line, args[0]);
1285 LIST_ADDQ(&curpx->tcp_req.l5_rules, &rule->list);
1286 }
1287 else {
1288 if (curpx == defpx)
1289 memprintf(err,
1290 "'%s' expects 'inspect-delay', 'connection', or 'content' in defaults section (got '%s')",
1291 args[0], args[1]);
1292 else
1293 memprintf(err,
1294 "'%s' expects 'inspect-delay', 'connection', or 'content' in %s '%s' (got '%s')",
1295 args[0], proxy_type_str(curpx), curpx->id, args[1]);
1296 goto error;
1297 }
1298
1299 return warn;
1300 error:
1301 free(rule);
1302 return -1;
1303}
1304
1305static struct cfg_kw_list cfg_kws = {ILH, {
1306 { CFG_LISTEN, "tcp-request", tcp_parse_tcp_req },
1307 { CFG_LISTEN, "tcp-response", tcp_parse_tcp_rep },
1308 { 0, NULL, NULL },
1309}};
1310
Willy Tarreau0108d902018-11-25 19:14:37 +01001311INITCALL1(STG_REGISTER, cfg_register_keywords, &cfg_kws);
Willy Tarreau39713102016-11-25 15:49:32 +01001312
1313/*
1314 * Local variables:
1315 * c-indent-level: 8
1316 * c-basic-offset: 8
1317 * End:
1318 */