blob: 57160e711da4e9e987c862527e555c4d7ade38ed [file] [log] [blame]
Willy Tarreau59f98392012-07-06 14:13:49 +02001/*
2 * Connection management functions
3 *
4 * Copyright 2000-2012 Willy Tarreau <w@1wt.eu>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
Willy Tarreaue1e4a612012-10-05 00:10:55 +020013#include <errno.h>
14
Willy Tarreau4c7e4b72020-05-27 12:58:42 +020015#include <haproxy/api.h>
Willy Tarreau6be78492020-06-05 00:00:29 +020016#include <haproxy/cfgparse.h>
Willy Tarreau7ea393d2020-06-04 18:02:10 +020017#include <haproxy/connection.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020018#include <haproxy/fd.h>
Willy Tarreau762d7a52020-06-04 11:23:07 +020019#include <haproxy/frontend.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020020#include <haproxy/hash.h>
Willy Tarreau36979d92020-06-05 17:27:29 +020021#include <haproxy/log-t.h>
Willy Tarreau7a00efb2020-06-02 17:02:59 +020022#include <haproxy/namespace.h>
Willy Tarreau6131d6a2020-06-02 16:48:09 +020023#include <haproxy/net_helper.h>
Willy Tarreaufc774542020-06-04 17:31:04 +020024#include <haproxy/proto_tcp.h>
Willy Tarreaue6ce10b2020-06-04 15:33:47 +020025#include <haproxy/sample.h>
Willy Tarreau209108d2020-06-04 20:30:20 +020026#include <haproxy/ssl_sock.h>
Willy Tarreau5e539c92020-06-04 20:45:39 +020027#include <haproxy/stream_interface.h>
Emeric Brun46591952012-05-18 15:47:34 +020028
Alexander Liu2a54bb72019-05-22 19:44:48 +080029
Willy Tarreau8ceae722018-11-26 11:58:30 +010030DECLARE_POOL(pool_head_connection, "connection", sizeof(struct connection));
31DECLARE_POOL(pool_head_connstream, "conn_stream", sizeof(struct conn_stream));
Willy Tarreauff5d57b2019-07-17 18:37:02 +020032DECLARE_POOL(pool_head_sockaddr, "sockaddr", sizeof(struct sockaddr_storage));
Geoff Simmons7185b782019-08-27 18:31:16 +020033DECLARE_POOL(pool_head_authority, "authority", PP2_AUTHORITY_MAX);
Willy Tarreau8ceae722018-11-26 11:58:30 +010034
Willy Tarreau4d82bf52020-06-28 00:19:17 +020035struct idle_conns idle_conns[MAX_THREADS] = { };
Willy Tarreau13e14102016-12-22 20:25:26 +010036struct xprt_ops *registered_xprt[XPRT_ENTRIES] = { NULL, };
Willy Tarreauf2943dc2012-10-26 20:10:28 +020037
Christopher Faulet32f61c02018-04-10 14:33:41 +020038/* List head of all known muxes for PROTO */
39struct mux_proto_list mux_proto_list = {
40 .list = LIST_HEAD_INIT(mux_proto_list.list)
Willy Tarreau2386be62017-09-21 19:40:52 +020041};
42
Willy Tarreau119e50e2020-05-22 13:53:29 +020043/* disables sending of proxy-protocol-v2's LOCAL command */
44static int pp2_never_send_local;
45
Olivier Houchard477902b2020-01-22 18:08:48 +010046int conn_create_mux(struct connection *conn)
47{
Olivier Houchard477902b2020-01-22 18:08:48 +010048 if (conn_is_back(conn)) {
49 struct server *srv;
50 struct conn_stream *cs = conn->ctx;
Christopher Faulet14cd3162020-04-16 14:50:06 +020051 struct session *sess = conn->owner;
Olivier Houchard477902b2020-01-22 18:08:48 +010052
53 if (conn->flags & CO_FL_ERROR)
54 goto fail;
Olivier Houcharda8a415d2020-01-23 13:15:14 +010055
Christopher Faulet14cd3162020-04-16 14:50:06 +020056 if (sess && obj_type(sess->origin) == OBJ_TYPE_CHECK) {
57 if (conn_install_mux_chk(conn, conn->ctx, conn->owner) < 0)
58 goto fail;
59 }
60 else if (conn_install_mux_be(conn, conn->ctx, conn->owner) < 0)
Olivier Houchard477902b2020-01-22 18:08:48 +010061 goto fail;
62 srv = objt_server(conn->target);
Christopher Faulet08016ab2020-07-01 16:10:06 +020063
64 /* If we're doing http-reuse always, and the connection is not
65 * private with available streams (an http2 connection), add it
66 * to the available list, so that others can use it right
67 * away. If the connection is private, add it in the session
68 * server list.
69 */
Christopher Faulet2883fcf2020-07-01 14:59:43 +020070 if (srv && ((srv->proxy->options & PR_O_REUSE_MASK) == PR_O_REUSE_ALWS) &&
Christopher Fauletaa278532020-06-30 14:47:46 +020071 !(conn->flags & CO_FL_PRIVATE) && conn->mux->avail_streams(conn) > 0)
Olivier Houchardf0d4dff2020-03-06 18:12:03 +010072 LIST_ADDQ(&srv->available_conns[tid], mt_list_to_list(&conn->list));
Christopher Faulet08016ab2020-07-01 16:10:06 +020073 else if (conn->flags & CO_FL_PRIVATE) {
74 /* If it fail now, the same will be done in mux->detach() callack */
75 session_add_conn(conn->owner, conn, conn->target);
76 }
Olivier Houchard477902b2020-01-22 18:08:48 +010077 return 0;
78fail:
79 /* let the upper layer know the connection failed */
80 cs->data_cb->wake(cs);
81 return -1;
82 } else
83 return conn_complete_session(conn);
84
85}
86
Willy Tarreau59f98392012-07-06 14:13:49 +020087/* I/O callback for fd-based connections. It calls the read/write handlers
Willy Tarreau7a798e52016-04-14 11:13:20 +020088 * provided by the connection's sock_ops, which must be valid.
Willy Tarreau59f98392012-07-06 14:13:49 +020089 */
Willy Tarreau7a798e52016-04-14 11:13:20 +020090void conn_fd_handler(int fd)
Willy Tarreau59f98392012-07-06 14:13:49 +020091{
Willy Tarreau80184712012-07-06 14:54:49 +020092 struct connection *conn = fdtab[fd].owner;
Willy Tarreau9e272bf2012-10-03 21:04:48 +020093 unsigned int flags;
Willy Tarreau8de5c4f2020-03-04 17:45:21 +010094 int need_wake = 0;
Willy Tarreau59f98392012-07-06 14:13:49 +020095
Willy Tarreaud80cb4e2018-01-20 19:30:13 +010096 if (unlikely(!conn)) {
97 activity[tid].conn_dead++;
Willy Tarreau7a798e52016-04-14 11:13:20 +020098 return;
Willy Tarreaud80cb4e2018-01-20 19:30:13 +010099 }
Willy Tarreau59f98392012-07-06 14:13:49 +0200100
Willy Tarreau7d281492012-12-16 19:19:13 +0100101 flags = conn->flags & ~CO_FL_ERROR; /* ensure to call the wake handler upon error */
Willy Tarreaud29a0662012-12-10 16:33:38 +0100102
Willy Tarreaub2a7ab02019-12-27 10:54:22 +0100103 if (unlikely(conn->flags & CO_FL_WAIT_L4_CONN) &&
104 ((fd_send_ready(fd) && fd_send_active(fd)) ||
105 (fd_recv_ready(fd) && fd_recv_active(fd)))) {
106 /* Still waiting for a connection to establish and nothing was
107 * attempted yet to probe the connection. this will clear the
108 * CO_FL_WAIT_L4_CONN flag on success.
109 */
110 if (!conn_fd_check(conn))
111 goto leave;
Willy Tarreau8de5c4f2020-03-04 17:45:21 +0100112 need_wake = 1;
Willy Tarreaub2a7ab02019-12-27 10:54:22 +0100113 }
114
Willy Tarreau8081abe2019-11-28 18:08:49 +0100115 if (fd_send_ready(fd) && fd_send_active(fd)) {
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100116 /* force reporting of activity by clearing the previous flags :
117 * we'll have at least ERROR or CONNECTED at the end of an I/O,
118 * both of which will be detected below.
Willy Tarreau9e272bf2012-10-03 21:04:48 +0200119 */
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100120 flags = 0;
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100121 if (conn->subs && conn->subs->events & SUB_RETRY_SEND) {
Willy Tarreau8de5c4f2020-03-04 17:45:21 +0100122 need_wake = 0; // wake will be called after this I/O
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100123 tasklet_wakeup(conn->subs->tasklet);
124 conn->subs->events &= ~SUB_RETRY_SEND;
125 if (!conn->subs->events)
126 conn->subs = NULL;
Willy Tarreau8de5c4f2020-03-04 17:45:21 +0100127 }
Willy Tarreau667fefd2020-03-04 17:22:10 +0100128 fd_stop_send(fd);
Willy Tarreau9e272bf2012-10-03 21:04:48 +0200129 }
Willy Tarreau59f98392012-07-06 14:13:49 +0200130
Willy Tarreau57ec32f2017-04-11 19:59:33 +0200131 /* The data transfer starts here and stops on error and handshakes. Note
132 * that we must absolutely test conn->xprt at each step in case it suddenly
133 * changes due to a quick unexpected close().
134 */
Willy Tarreau8081abe2019-11-28 18:08:49 +0100135 if (fd_recv_ready(fd) && fd_recv_active(fd)) {
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100136 /* force reporting of activity by clearing the previous flags :
137 * we'll have at least ERROR or CONNECTED at the end of an I/O,
138 * both of which will be detected below.
Willy Tarreau9e272bf2012-10-03 21:04:48 +0200139 */
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100140 flags = 0;
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100141 if (conn->subs && conn->subs->events & SUB_RETRY_RECV) {
Willy Tarreau8de5c4f2020-03-04 17:45:21 +0100142 need_wake = 0; // wake will be called after this I/O
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100143 tasklet_wakeup(conn->subs->tasklet);
144 conn->subs->events &= ~SUB_RETRY_RECV;
145 if (!conn->subs->events)
146 conn->subs = NULL;
Willy Tarreau8de5c4f2020-03-04 17:45:21 +0100147 }
Willy Tarreau4cabfc12020-06-17 16:26:22 +0200148 fd_stop_recv(fd);
Willy Tarreau9e272bf2012-10-03 21:04:48 +0200149 }
Willy Tarreau2da156f2012-07-23 15:07:23 +0200150
Willy Tarreau2c6be842012-07-06 17:12:34 +0200151 leave:
Olivier Houchard477902b2020-01-22 18:08:48 +0100152 /* If we don't yet have a mux, that means we were waiting for
Ilya Shipitsince7b00f2020-03-23 22:28:40 +0500153 * information to create one, typically from the ALPN. If we're
Olivier Houchard477902b2020-01-22 18:08:48 +0100154 * done with the handshake, attempt to create one.
Willy Tarreau8e3c6ce2017-08-28 15:46:01 +0200155 */
Willy Tarreau911db9b2020-01-23 16:27:54 +0100156 if (unlikely(!conn->mux) && !(conn->flags & CO_FL_WAIT_XPRT))
Olivier Houchard477902b2020-01-22 18:08:48 +0100157 if (conn_create_mux(conn) < 0)
158 return;
Willy Tarreau8e3c6ce2017-08-28 15:46:01 +0200159
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100160 /* The wake callback is normally used to notify the data layer about
161 * data layer activity (successful send/recv), connection establishment,
162 * shutdown and fatal errors. We need to consider the following
163 * situations to wake up the data layer :
Willy Tarreau0fbc3182019-12-27 14:57:45 +0100164 * - change among the CO_FL_NOTIFY_DONE flags :
165 * SOCK_{RD,WR}_SH, ERROR,
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100166 * - absence of any of {L4,L6}_CONN and CONNECTED, indicating the
167 * end of handshake and transition to CONNECTED
168 * - raise of CONNECTED with HANDSHAKE down
169 * - end of HANDSHAKE with CONNECTED set
170 * - regular data layer activity
171 *
172 * Note that the wake callback is allowed to release the connection and
173 * the fd (and return < 0 in this case).
Willy Tarreau2396c1c2012-10-03 21:12:16 +0200174 */
Willy Tarreau8de5c4f2020-03-04 17:45:21 +0100175 if ((need_wake || ((conn->flags ^ flags) & CO_FL_NOTIFY_DONE) ||
Willy Tarreau911db9b2020-01-23 16:27:54 +0100176 ((flags & CO_FL_WAIT_XPRT) && !(conn->flags & CO_FL_WAIT_XPRT))) &&
Olivier Houchardfe50bfb2019-05-27 12:09:19 +0200177 conn->mux && conn->mux->wake && conn->mux->wake(conn) < 0)
Willy Tarreau7a798e52016-04-14 11:13:20 +0200178 return;
Willy Tarreaufd31e532012-07-23 18:24:25 +0200179
Willy Tarreauf9dabec2012-08-17 17:33:53 +0200180 /* commit polling changes */
181 conn_cond_update_polling(conn);
Willy Tarreau7a798e52016-04-14 11:13:20 +0200182 return;
Willy Tarreau59f98392012-07-06 14:13:49 +0200183}
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200184
Willy Tarreau4970e5a2019-12-27 10:40:21 +0100185/* This is the callback which is set when a connection establishment is pending
186 * and we have nothing to send. It may update the FD polling status to indicate
187 * !READY. It returns 0 if it fails in a fatal way or needs to poll to go
188 * further, otherwise it returns non-zero and removes the CO_FL_WAIT_L4_CONN
189 * flag from the connection's flags. In case of error, it sets CO_FL_ERROR and
190 * leaves the error code in errno.
191 */
192int conn_fd_check(struct connection *conn)
193{
194 struct sockaddr_storage *addr;
195 int fd = conn->handle.fd;
196
197 if (conn->flags & CO_FL_ERROR)
198 return 0;
199
200 if (!conn_ctrl_ready(conn))
201 return 0;
202
203 if (!(conn->flags & CO_FL_WAIT_L4_CONN))
204 return 1; /* strange we were called while ready */
205
206 if (!fd_send_ready(fd))
207 return 0;
208
209 /* Here we have 2 cases :
210 * - modern pollers, able to report ERR/HUP. If these ones return any
211 * of these flags then it's likely a failure, otherwise it possibly
212 * is a success (i.e. there may have been data received just before
213 * the error was reported).
214 * - select, which doesn't report these and with which it's always
215 * necessary either to try connect() again or to check for SO_ERROR.
216 * In order to simplify everything, we double-check using connect() as
217 * soon as we meet either of these delicate situations. Note that
218 * SO_ERROR would clear the error after reporting it!
219 */
220 if (cur_poller.flags & HAP_POLL_F_ERRHUP) {
221 /* modern poller, able to report ERR/HUP */
222 if ((fdtab[fd].ev & (FD_POLL_IN|FD_POLL_ERR|FD_POLL_HUP)) == FD_POLL_IN)
223 goto done;
224 if ((fdtab[fd].ev & (FD_POLL_OUT|FD_POLL_ERR|FD_POLL_HUP)) == FD_POLL_OUT)
225 goto done;
226 if (!(fdtab[fd].ev & (FD_POLL_ERR|FD_POLL_HUP)))
227 goto wait;
228 /* error present, fall through common error check path */
229 }
230
231 /* Use connect() to check the state of the socket. This has the double
232 * advantage of *not* clearing the error (so that health checks can
233 * still use getsockopt(SO_ERROR)) and giving us the following info :
234 * - error
235 * - connecting (EALREADY, EINPROGRESS)
236 * - connected (EISCONN, 0)
237 */
238 addr = conn->dst;
239 if ((conn->flags & CO_FL_SOCKS4) && obj_type(conn->target) == OBJ_TYPE_SERVER)
240 addr = &objt_server(conn->target)->socks4_addr;
241
242 if (connect(fd, (const struct sockaddr *)addr, get_addr_len(addr)) == -1) {
243 if (errno == EALREADY || errno == EINPROGRESS)
244 goto wait;
245
246 if (errno && errno != EISCONN)
247 goto out_error;
248 }
249
250 done:
251 /* The FD is ready now, we'll mark the connection as complete and
252 * forward the event to the transport layer which will notify the
253 * data layer.
254 */
255 conn->flags &= ~CO_FL_WAIT_L4_CONN;
256 fd_may_send(fd);
257 fd_cond_recv(fd);
258 errno = 0; // make health checks happy
259 return 1;
260
261 out_error:
262 /* Write error on the file descriptor. Report it to the connection
263 * and disable polling on this FD.
264 */
265 fdtab[fd].linger_risk = 0;
266 conn->flags |= CO_FL_ERROR | CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH;
Willy Tarreau5d4d1802020-02-21 09:58:29 +0100267 conn_stop_polling(conn);
Willy Tarreau4970e5a2019-12-27 10:40:21 +0100268 return 0;
269
270 wait:
Willy Tarreau4970e5a2019-12-27 10:40:21 +0100271 fd_cant_send(fd);
Willy Tarreaud1d14c32020-02-21 10:34:19 +0100272 fd_want_send(fd);
Willy Tarreau4970e5a2019-12-27 10:40:21 +0100273 return 0;
274}
275
Willy Tarreauff3e6482015-03-12 23:56:52 +0100276/* Send a message over an established connection. It makes use of send() and
277 * returns the same return code and errno. If the socket layer is not ready yet
278 * then -1 is returned and ENOTSOCK is set into errno. If the fd is not marked
279 * as ready, or if EAGAIN or ENOTCONN is returned, then we return 0. It returns
280 * EMSGSIZE if called with a zero length message. The purpose is to simplify
281 * some rare attempts to directly write on the socket from above the connection
282 * (typically send_proxy). In case of EAGAIN, the fd is marked as "cant_send".
283 * It automatically retries on EINTR. Other errors cause the connection to be
284 * marked as in error state. It takes similar arguments as send() except the
285 * first one which is the connection instead of the file descriptor. Note,
286 * MSG_DONTWAIT and MSG_NOSIGNAL are forced on the flags.
287 */
288int conn_sock_send(struct connection *conn, const void *buf, int len, int flags)
289{
290 int ret;
291
292 ret = -1;
293 errno = ENOTSOCK;
294
295 if (conn->flags & CO_FL_SOCK_WR_SH)
296 goto fail;
297
298 if (!conn_ctrl_ready(conn))
299 goto fail;
300
301 errno = EMSGSIZE;
302 if (!len)
303 goto fail;
304
Willy Tarreau585744b2017-08-24 14:31:19 +0200305 if (!fd_send_ready(conn->handle.fd))
Willy Tarreauff3e6482015-03-12 23:56:52 +0100306 goto wait;
307
308 do {
Willy Tarreau585744b2017-08-24 14:31:19 +0200309 ret = send(conn->handle.fd, buf, len, flags | MSG_DONTWAIT | MSG_NOSIGNAL);
Willy Tarreauff3e6482015-03-12 23:56:52 +0100310 } while (ret < 0 && errno == EINTR);
311
312
Willy Tarreauccf3f6d2019-09-05 17:05:05 +0200313 if (ret > 0) {
314 if (conn->flags & CO_FL_WAIT_L4_CONN) {
315 conn->flags &= ~CO_FL_WAIT_L4_CONN;
316 fd_may_send(conn->handle.fd);
317 fd_cond_recv(conn->handle.fd);
318 }
Willy Tarreauff3e6482015-03-12 23:56:52 +0100319 return ret;
Willy Tarreauccf3f6d2019-09-05 17:05:05 +0200320 }
Willy Tarreauff3e6482015-03-12 23:56:52 +0100321
322 if (ret == 0 || errno == EAGAIN || errno == ENOTCONN) {
323 wait:
Willy Tarreau585744b2017-08-24 14:31:19 +0200324 fd_cant_send(conn->handle.fd);
Willy Tarreauff3e6482015-03-12 23:56:52 +0100325 return 0;
326 }
327 fail:
328 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH | CO_FL_ERROR;
329 return ret;
330}
331
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100332/* Called from the upper layer, to subscribe <es> to events <event_type>. The
333 * event subscriber <es> is not allowed to change from a previous call as long
334 * as at least one event is still subscribed. The <event_type> must only be a
335 * combination of SUB_RETRY_RECV and SUB_RETRY_SEND. It always returns 0.
336 */
337int conn_unsubscribe(struct connection *conn, void *xprt_ctx, int event_type, struct wait_event *es)
Olivier Houchard83a0cd82018-09-28 17:57:58 +0200338{
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100339 BUG_ON(event_type & ~(SUB_RETRY_SEND|SUB_RETRY_RECV));
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100340 BUG_ON(conn->subs && conn->subs != es);
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100341
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100342 es->events &= ~event_type;
343 if (!es->events)
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100344 conn->subs = NULL;
345
Willy Tarreaud1d14c32020-02-21 10:34:19 +0100346 if (conn_ctrl_ready(conn)) {
347 if (event_type & SUB_RETRY_RECV)
348 fd_stop_recv(conn->handle.fd);
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100349
Willy Tarreaud1d14c32020-02-21 10:34:19 +0100350 if (event_type & SUB_RETRY_SEND)
351 fd_stop_send(conn->handle.fd);
352 }
Olivier Houchard83a0cd82018-09-28 17:57:58 +0200353 return 0;
354}
355
Willy Tarreau7e59c0a2020-02-28 14:24:49 +0100356/* Called from the upper layer, to subscribe <es> to events <event_type>.
357 * The <es> struct is not allowed to differ from the one passed during a
358 * previous call to subscribe(). If the FD is ready, the wait_event is
359 * immediately woken up and the subcription is cancelled. It always
360 * returns zero.
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100361 */
362int conn_subscribe(struct connection *conn, void *xprt_ctx, int event_type, struct wait_event *es)
Olivier Houchard6ff20392018-07-17 18:46:31 +0200363{
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100364 BUG_ON(event_type & ~(SUB_RETRY_SEND|SUB_RETRY_RECV));
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100365 BUG_ON(conn->subs && conn->subs != es);
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100366
Willy Tarreau7e59c0a2020-02-28 14:24:49 +0100367 if (conn->subs && (conn->subs->events & event_type) == event_type)
368 return 0;
369
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100370 conn->subs = es;
371 es->events |= event_type;
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100372
Willy Tarreaud1d14c32020-02-21 10:34:19 +0100373 if (conn_ctrl_ready(conn)) {
Willy Tarreau7e59c0a2020-02-28 14:24:49 +0100374 if (event_type & SUB_RETRY_RECV) {
375 if (fd_recv_ready(conn->handle.fd)) {
376 tasklet_wakeup(es->tasklet);
377 es->events &= ~SUB_RETRY_RECV;
378 if (!es->events)
379 conn->subs = NULL;
380 }
381 else
382 fd_want_recv(conn->handle.fd);
383 }
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100384
Willy Tarreau7e59c0a2020-02-28 14:24:49 +0100385 if (event_type & SUB_RETRY_SEND) {
386 if (fd_send_ready(conn->handle.fd)) {
387 tasklet_wakeup(es->tasklet);
388 es->events &= ~SUB_RETRY_SEND;
389 if (!es->events)
390 conn->subs = NULL;
391 }
392 else
393 fd_want_send(conn->handle.fd);
394 }
Willy Tarreaud1d14c32020-02-21 10:34:19 +0100395 }
Olivier Houchard83a0cd82018-09-28 17:57:58 +0200396 return 0;
Olivier Houchard6ff20392018-07-17 18:46:31 +0200397}
398
Willy Tarreaud85c4852015-03-13 00:40:28 +0100399/* Drains possibly pending incoming data on the file descriptor attached to the
400 * connection and update the connection's flags accordingly. This is used to
401 * know whether we need to disable lingering on close. Returns non-zero if it
402 * is safe to close without disabling lingering, otherwise zero. The SOCK_RD_SH
403 * flag may also be updated if the incoming shutdown was reported by the drain()
404 * function.
405 */
406int conn_sock_drain(struct connection *conn)
407{
Willy Tarreaue215bba2018-08-24 14:31:53 +0200408 int turns = 2;
409 int len;
410
Willy Tarreaud85c4852015-03-13 00:40:28 +0100411 if (!conn_ctrl_ready(conn))
412 return 1;
413
414 if (conn->flags & (CO_FL_ERROR | CO_FL_SOCK_RD_SH))
415 return 1;
416
Willy Tarreaue215bba2018-08-24 14:31:53 +0200417 if (fdtab[conn->handle.fd].ev & (FD_POLL_ERR|FD_POLL_HUP))
418 goto shut;
Willy Tarreaud85c4852015-03-13 00:40:28 +0100419
Willy Tarreaue215bba2018-08-24 14:31:53 +0200420 if (!fd_recv_ready(conn->handle.fd))
421 return 0;
Willy Tarreaud85c4852015-03-13 00:40:28 +0100422
Willy Tarreaue215bba2018-08-24 14:31:53 +0200423 if (conn->ctrl->drain) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200424 if (conn->ctrl->drain(conn->handle.fd) <= 0)
Willy Tarreaud85c4852015-03-13 00:40:28 +0100425 return 0;
Willy Tarreaue215bba2018-08-24 14:31:53 +0200426 goto shut;
427 }
428
429 /* no drain function defined, use the generic one */
430
431 while (turns) {
432#ifdef MSG_TRUNC_CLEARS_INPUT
433 len = recv(conn->handle.fd, NULL, INT_MAX, MSG_DONTWAIT | MSG_NOSIGNAL | MSG_TRUNC);
434 if (len == -1 && errno == EFAULT)
435#endif
436 len = recv(conn->handle.fd, trash.area, trash.size,
437 MSG_DONTWAIT | MSG_NOSIGNAL);
438
439 if (len == 0)
440 goto shut;
441
442 if (len < 0) {
443 if (errno == EAGAIN) {
444 /* connection not closed yet */
445 fd_cant_recv(conn->handle.fd);
446 break;
447 }
448 if (errno == EINTR) /* oops, try again */
449 continue;
450 /* other errors indicate a dead connection, fine. */
451 goto shut;
452 }
453 /* OK we read some data, let's try again once */
454 turns--;
Willy Tarreaud85c4852015-03-13 00:40:28 +0100455 }
456
Willy Tarreaue215bba2018-08-24 14:31:53 +0200457 /* some data are still present, give up */
458 return 0;
459
460 shut:
461 /* we're certain the connection was shut down */
462 fdtab[conn->handle.fd].linger_risk = 0;
Willy Tarreaud85c4852015-03-13 00:40:28 +0100463 conn->flags |= CO_FL_SOCK_RD_SH;
464 return 1;
465}
466
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100467/*
468 * Get data length from tlv
469 */
Tim Duesterhusba837ec2020-03-05 23:11:02 +0100470static inline size_t get_tlv_length(const struct tlv *src)
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100471{
472 return (src->length_hi << 8) | src->length_lo;
473}
474
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200475/* This handshake handler waits a PROXY protocol header at the beginning of the
476 * raw data stream. The header looks like this :
477 *
478 * "PROXY" <SP> PROTO <SP> SRC3 <SP> DST3 <SP> SRC4 <SP> <DST4> "\r\n"
479 *
480 * There must be exactly one space between each field. Fields are :
481 * - PROTO : layer 4 protocol, which must be "TCP4" or "TCP6".
482 * - SRC3 : layer 3 (eg: IP) source address in standard text form
483 * - DST3 : layer 3 (eg: IP) destination address in standard text form
484 * - SRC4 : layer 4 (eg: TCP port) source address in standard text form
485 * - DST4 : layer 4 (eg: TCP port) destination address in standard text form
486 *
487 * This line MUST be at the beginning of the buffer and MUST NOT wrap.
488 *
489 * The header line is small and in all cases smaller than the smallest normal
490 * TCP MSS. So it MUST always be delivered as one segment, which ensures we
491 * can safely use MSG_PEEK and avoid buffering.
492 *
493 * Once the data is fetched, the values are set in the connection's address
494 * fields, and data are removed from the socket's buffer. The function returns
495 * zero if it needs to wait for more data or if it fails, or 1 if it completed
496 * and removed itself.
497 */
498int conn_recv_proxy(struct connection *conn, int flag)
499{
500 char *line, *end;
Willy Tarreau77992672014-06-14 11:06:17 +0200501 struct proxy_hdr_v2 *hdr_v2;
502 const char v2sig[] = PP2_SIGNATURE;
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100503 size_t total_v2_len;
Tim Duesterhusba837ec2020-03-05 23:11:02 +0100504 size_t tlv_offset = 0;
Willy Tarreaub406b872018-08-22 05:20:32 +0200505 int ret;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200506
Willy Tarreau3c728722014-01-23 13:50:42 +0100507 if (!conn_ctrl_ready(conn))
Willy Tarreauf79c8172013-10-21 16:30:56 +0200508 goto fail;
509
Willy Tarreauca79f592019-07-17 19:04:47 +0200510 if (!sockaddr_alloc(&conn->src) || !sockaddr_alloc(&conn->dst))
511 goto fail;
512
Willy Tarreau585744b2017-08-24 14:31:19 +0200513 if (!fd_recv_ready(conn->handle.fd))
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200514 goto not_ready;
Willy Tarreaufd803bb2014-01-20 15:13:07 +0100515
Willy Tarreau157788c2020-02-11 10:08:05 +0100516 while (1) {
Willy Tarreaub406b872018-08-22 05:20:32 +0200517 ret = recv(conn->handle.fd, trash.area, trash.size, MSG_PEEK);
518 if (ret < 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200519 if (errno == EINTR)
520 continue;
521 if (errno == EAGAIN) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200522 fd_cant_recv(conn->handle.fd);
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200523 goto not_ready;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200524 }
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100525 goto recv_abort;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200526 }
Willy Tarreaub406b872018-08-22 05:20:32 +0200527 trash.data = ret;
Willy Tarreau157788c2020-02-11 10:08:05 +0100528 break;
529 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200530
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200531 if (!trash.data) {
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100532 /* client shutdown */
533 conn->err_code = CO_ER_PRX_EMPTY;
534 goto fail;
535 }
536
Willy Tarreauc192b0a2020-01-23 09:11:58 +0100537 conn->flags &= ~CO_FL_WAIT_L4_CONN;
538
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200539 if (trash.data < 6)
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200540 goto missing;
541
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200542 line = trash.area;
543 end = trash.area + trash.data;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200544
545 /* Decode a possible proxy request, fail early if it does not match */
Willy Tarreau77992672014-06-14 11:06:17 +0200546 if (strncmp(line, "PROXY ", 6) != 0)
547 goto not_v1;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200548
549 line += 6;
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200550 if (trash.data < 9) /* shortest possible line */
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200551 goto missing;
552
David CARLIER42ff05e2016-03-24 09:22:36 +0000553 if (memcmp(line, "TCP4 ", 5) == 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200554 u32 src3, dst3, sport, dport;
555
556 line += 5;
557
558 src3 = inetaddr_host_lim_ret(line, end, &line);
559 if (line == end)
560 goto missing;
561 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100562 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200563
564 dst3 = inetaddr_host_lim_ret(line, end, &line);
565 if (line == end)
566 goto missing;
567 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100568 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200569
570 sport = read_uint((const char **)&line, end);
571 if (line == end)
572 goto missing;
573 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100574 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200575
576 dport = read_uint((const char **)&line, end);
577 if (line > end - 2)
578 goto missing;
579 if (*line++ != '\r')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100580 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200581 if (*line++ != '\n')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100582 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200583
584 /* update the session's addresses and mark them set */
Willy Tarreau226572f2019-07-17 14:46:00 +0200585 ((struct sockaddr_in *)conn->src)->sin_family = AF_INET;
586 ((struct sockaddr_in *)conn->src)->sin_addr.s_addr = htonl(src3);
587 ((struct sockaddr_in *)conn->src)->sin_port = htons(sport);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200588
Willy Tarreau226572f2019-07-17 14:46:00 +0200589 ((struct sockaddr_in *)conn->dst)->sin_family = AF_INET;
590 ((struct sockaddr_in *)conn->dst)->sin_addr.s_addr = htonl(dst3);
591 ((struct sockaddr_in *)conn->dst)->sin_port = htons(dport);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200592 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
593 }
David CARLIER42ff05e2016-03-24 09:22:36 +0000594 else if (memcmp(line, "TCP6 ", 5) == 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200595 u32 sport, dport;
596 char *src_s;
597 char *dst_s, *sport_s, *dport_s;
598 struct in6_addr src3, dst3;
599
600 line += 5;
601
602 src_s = line;
603 dst_s = sport_s = dport_s = NULL;
604 while (1) {
605 if (line > end - 2) {
606 goto missing;
607 }
608 else if (*line == '\r') {
609 *line = 0;
610 line++;
611 if (*line++ != '\n')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100612 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200613 break;
614 }
615
616 if (*line == ' ') {
617 *line = 0;
618 if (!dst_s)
619 dst_s = line + 1;
620 else if (!sport_s)
621 sport_s = line + 1;
622 else if (!dport_s)
623 dport_s = line + 1;
624 }
625 line++;
626 }
627
628 if (!dst_s || !sport_s || !dport_s)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100629 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200630
631 sport = read_uint((const char **)&sport_s,dport_s - 1);
632 if (*sport_s != 0)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100633 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200634
635 dport = read_uint((const char **)&dport_s,line - 2);
636 if (*dport_s != 0)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100637 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200638
639 if (inet_pton(AF_INET6, src_s, (void *)&src3) != 1)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100640 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200641
642 if (inet_pton(AF_INET6, dst_s, (void *)&dst3) != 1)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100643 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200644
645 /* update the session's addresses and mark them set */
Willy Tarreau226572f2019-07-17 14:46:00 +0200646 ((struct sockaddr_in6 *)conn->src)->sin6_family = AF_INET6;
647 memcpy(&((struct sockaddr_in6 *)conn->src)->sin6_addr, &src3, sizeof(struct in6_addr));
648 ((struct sockaddr_in6 *)conn->src)->sin6_port = htons(sport);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200649
Willy Tarreau226572f2019-07-17 14:46:00 +0200650 ((struct sockaddr_in6 *)conn->dst)->sin6_family = AF_INET6;
651 memcpy(&((struct sockaddr_in6 *)conn->dst)->sin6_addr, &dst3, sizeof(struct in6_addr));
652 ((struct sockaddr_in6 *)conn->dst)->sin6_port = htons(dport);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200653 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
654 }
Willy Tarreau4c20d292014-06-14 11:41:36 +0200655 else if (memcmp(line, "UNKNOWN\r\n", 9) == 0) {
656 /* This can be a UNIX socket forwarded by an haproxy upstream */
657 line += 9;
658 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200659 else {
Willy Tarreau4c20d292014-06-14 11:41:36 +0200660 /* The protocol does not match something known (TCP4/TCP6/UNKNOWN) */
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100661 conn->err_code = CO_ER_PRX_BAD_PROTO;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200662 goto fail;
663 }
664
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200665 trash.data = line - trash.area;
Willy Tarreau77992672014-06-14 11:06:17 +0200666 goto eat_header;
667
668 not_v1:
669 /* try PPv2 */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200670 if (trash.data < PP2_HEADER_LEN)
Willy Tarreau77992672014-06-14 11:06:17 +0200671 goto missing;
672
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200673 hdr_v2 = (struct proxy_hdr_v2 *) trash.area;
Willy Tarreau77992672014-06-14 11:06:17 +0200674
675 if (memcmp(hdr_v2->sig, v2sig, PP2_SIGNATURE_LEN) != 0 ||
676 (hdr_v2->ver_cmd & PP2_VERSION_MASK) != PP2_VERSION) {
677 conn->err_code = CO_ER_PRX_NOT_HDR;
678 goto fail;
679 }
680
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100681 total_v2_len = PP2_HEADER_LEN + ntohs(hdr_v2->len);
682 if (trash.data < total_v2_len)
Willy Tarreau77992672014-06-14 11:06:17 +0200683 goto missing;
684
685 switch (hdr_v2->ver_cmd & PP2_CMD_MASK) {
686 case 0x01: /* PROXY command */
687 switch (hdr_v2->fam) {
688 case 0x11: /* TCPv4 */
KOVACS Krisztianefd3aa92014-11-19 10:53:20 +0100689 if (ntohs(hdr_v2->len) < PP2_ADDR_LEN_INET)
690 goto bad_header;
691
Willy Tarreau226572f2019-07-17 14:46:00 +0200692 ((struct sockaddr_in *)conn->src)->sin_family = AF_INET;
693 ((struct sockaddr_in *)conn->src)->sin_addr.s_addr = hdr_v2->addr.ip4.src_addr;
694 ((struct sockaddr_in *)conn->src)->sin_port = hdr_v2->addr.ip4.src_port;
695 ((struct sockaddr_in *)conn->dst)->sin_family = AF_INET;
696 ((struct sockaddr_in *)conn->dst)->sin_addr.s_addr = hdr_v2->addr.ip4.dst_addr;
697 ((struct sockaddr_in *)conn->dst)->sin_port = hdr_v2->addr.ip4.dst_port;
Willy Tarreau77992672014-06-14 11:06:17 +0200698 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
KOVACS Krisztian7209c202015-07-03 14:09:10 +0200699 tlv_offset = PP2_HEADER_LEN + PP2_ADDR_LEN_INET;
Willy Tarreau77992672014-06-14 11:06:17 +0200700 break;
701 case 0x21: /* TCPv6 */
KOVACS Krisztianefd3aa92014-11-19 10:53:20 +0100702 if (ntohs(hdr_v2->len) < PP2_ADDR_LEN_INET6)
703 goto bad_header;
704
Willy Tarreau226572f2019-07-17 14:46:00 +0200705 ((struct sockaddr_in6 *)conn->src)->sin6_family = AF_INET6;
706 memcpy(&((struct sockaddr_in6 *)conn->src)->sin6_addr, hdr_v2->addr.ip6.src_addr, 16);
707 ((struct sockaddr_in6 *)conn->src)->sin6_port = hdr_v2->addr.ip6.src_port;
708 ((struct sockaddr_in6 *)conn->dst)->sin6_family = AF_INET6;
709 memcpy(&((struct sockaddr_in6 *)conn->dst)->sin6_addr, hdr_v2->addr.ip6.dst_addr, 16);
710 ((struct sockaddr_in6 *)conn->dst)->sin6_port = hdr_v2->addr.ip6.dst_port;
Willy Tarreau77992672014-06-14 11:06:17 +0200711 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
KOVACS Krisztian7209c202015-07-03 14:09:10 +0200712 tlv_offset = PP2_HEADER_LEN + PP2_ADDR_LEN_INET6;
Willy Tarreau77992672014-06-14 11:06:17 +0200713 break;
714 }
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100715
716 /* TLV parsing */
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100717 while (tlv_offset < total_v2_len) {
718 struct tlv *tlv_packet;
Tim Duesterhusba837ec2020-03-05 23:11:02 +0100719 size_t tlv_len;
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100720
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100721 /* Verify that we have at least TLV_HEADER_SIZE bytes left */
722 if (tlv_offset + TLV_HEADER_SIZE > total_v2_len)
723 goto bad_header;
724
725 tlv_packet = (struct tlv *) &trash.area[tlv_offset];
726 tlv_len = get_tlv_length(tlv_packet);
727 tlv_offset += tlv_len + TLV_HEADER_SIZE;
728
729 /* Verify that the TLV length does not exceed the total PROXYv2 length */
730 if (tlv_offset > total_v2_len)
731 goto bad_header;
732
733 switch (tlv_packet->type) {
734 case PP2_TYPE_CRC32C: {
735 uint32_t n_crc32c;
736
737 /* Verify that this TLV is exactly 4 bytes long */
738 if (tlv_len != 4)
739 goto bad_header;
740
741 n_crc32c = read_n32(tlv_packet->value);
742 write_n32(tlv_packet->value, 0); // compute with CRC==0
743
744 if (hash_crc32c(trash.area, total_v2_len) != n_crc32c)
745 goto bad_header;
746 break;
747 }
Willy Tarreaue5733232019-05-22 19:24:06 +0200748#ifdef USE_NS
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100749 case PP2_TYPE_NETNS: {
750 const struct netns_entry *ns;
751
752 ns = netns_store_lookup((char*)tlv_packet->value, tlv_len);
753 if (ns)
754 conn->proxy_netns = ns;
755 break;
756 }
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100757#endif
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100758 case PP2_TYPE_AUTHORITY: {
759 if (tlv_len > PP2_AUTHORITY_MAX)
760 goto bad_header;
761 conn->proxy_authority = pool_alloc(pool_head_authority);
762 if (conn->proxy_authority == NULL)
763 goto fail;
764 memcpy(conn->proxy_authority, (const char *)tlv_packet->value, tlv_len);
765 conn->proxy_authority_len = tlv_len;
766 break;
767 }
Tim Duesterhusd1b15b62020-03-13 12:34:23 +0100768 case PP2_TYPE_UNIQUE_ID: {
769 const struct ist tlv = ist2((const char *)tlv_packet->value, tlv_len);
770
771 if (tlv.len > UNIQUEID_LEN)
772 goto bad_header;
Tim Duesterhus2b7f6c22020-03-14 13:07:05 +0100773 conn->proxy_unique_id = ist2(pool_alloc(pool_head_uniqueid), 0);
Tim Duesterhusd1b15b62020-03-13 12:34:23 +0100774 if (!isttest(conn->proxy_unique_id))
775 goto fail;
776 if (istcpy(&conn->proxy_unique_id, tlv, UNIQUEID_LEN) < 0) {
777 /* This is technically unreachable, because we verified above
778 * that the TLV value fits.
779 */
780 goto fail;
781 }
782 break;
783 }
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100784 default:
785 break;
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100786 }
787 }
788
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100789 /* Verify that the PROXYv2 header ends at a TLV boundary.
790 * This is technically unreachable, because the TLV parsing already
791 * verifies that a TLV does not exceed the total length and also
792 * that there is space for a TLV header.
793 */
794 if (tlv_offset != total_v2_len)
795 goto bad_header;
796
Willy Tarreau77992672014-06-14 11:06:17 +0200797 /* unsupported protocol, keep local connection address */
798 break;
799 case 0x00: /* LOCAL command */
800 /* keep local connection address for LOCAL */
801 break;
802 default:
803 goto bad_header; /* not a supported command */
804 }
805
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100806 trash.data = total_v2_len;
Willy Tarreau77992672014-06-14 11:06:17 +0200807 goto eat_header;
808
809 eat_header:
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200810 /* remove the PROXY line from the request. For this we re-read the
811 * exact line at once. If we don't get the exact same result, we
812 * fail.
813 */
Willy Tarreau157788c2020-02-11 10:08:05 +0100814 while (1) {
Tim Duesterhusa8692f32020-03-13 12:34:25 +0100815 ssize_t len2 = recv(conn->handle.fd, trash.area, trash.data, 0);
816
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200817 if (len2 < 0 && errno == EINTR)
818 continue;
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200819 if (len2 != trash.data)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100820 goto recv_abort;
Willy Tarreau157788c2020-02-11 10:08:05 +0100821 break;
822 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200823
824 conn->flags &= ~flag;
Emeric Brun4f603012017-01-05 15:11:44 +0100825 conn->flags |= CO_FL_RCVD_PROXY;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200826 return 1;
827
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200828 not_ready:
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200829 return 0;
830
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200831 missing:
832 /* Missing data. Since we're using MSG_PEEK, we can only poll again if
833 * we have not read anything. Otherwise we need to fail because we won't
834 * be able to poll anymore.
835 */
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100836 conn->err_code = CO_ER_PRX_TRUNCATED;
837 goto fail;
838
839 bad_header:
840 /* This is not a valid proxy protocol header */
841 conn->err_code = CO_ER_PRX_BAD_HDR;
842 goto fail;
843
844 recv_abort:
845 conn->err_code = CO_ER_PRX_ABORT;
Willy Tarreau26f4a042013-12-04 23:44:10 +0100846 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH;
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100847 goto fail;
848
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200849 fail:
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200850 conn->flags |= CO_FL_ERROR;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200851 return 0;
852}
853
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100854/* This handshake handler waits a NetScaler Client IP insertion header
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000855 * at the beginning of the raw data stream. The header format is
856 * described in doc/netscaler-client-ip-insertion-protocol.txt
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100857 *
858 * This line MUST be at the beginning of the buffer and MUST NOT be
859 * fragmented.
860 *
861 * The header line is small and in all cases smaller than the smallest normal
862 * TCP MSS. So it MUST always be delivered as one segment, which ensures we
863 * can safely use MSG_PEEK and avoid buffering.
864 *
865 * Once the data is fetched, the values are set in the connection's address
866 * fields, and data are removed from the socket's buffer. The function returns
867 * zero if it needs to wait for more data or if it fails, or 1 if it completed
868 * and removed itself.
869 */
870int conn_recv_netscaler_cip(struct connection *conn, int flag)
871{
872 char *line;
Bertrand Jacquin7d668f92017-12-13 01:23:39 +0000873 uint32_t hdr_len;
Willy Tarreau0ca24aa2019-03-29 17:35:32 +0100874 uint8_t ip_ver;
Willy Tarreaub406b872018-08-22 05:20:32 +0200875 int ret;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100876
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100877 if (!conn_ctrl_ready(conn))
878 goto fail;
879
Olivier Houchard1a9dbe52020-01-22 15:31:09 +0100880 if (!sockaddr_alloc(&conn->src) || !sockaddr_alloc(&conn->dst))
881 goto fail;
882
Willy Tarreau585744b2017-08-24 14:31:19 +0200883 if (!fd_recv_ready(conn->handle.fd))
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200884 goto not_ready;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100885
Willy Tarreau157788c2020-02-11 10:08:05 +0100886 while (1) {
Willy Tarreaub406b872018-08-22 05:20:32 +0200887 ret = recv(conn->handle.fd, trash.area, trash.size, MSG_PEEK);
888 if (ret < 0) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100889 if (errno == EINTR)
890 continue;
891 if (errno == EAGAIN) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200892 fd_cant_recv(conn->handle.fd);
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200893 goto not_ready;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100894 }
895 goto recv_abort;
896 }
Willy Tarreaub406b872018-08-22 05:20:32 +0200897 trash.data = ret;
Willy Tarreau157788c2020-02-11 10:08:05 +0100898 break;
899 }
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100900
Willy Tarreauc192b0a2020-01-23 09:11:58 +0100901 conn->flags &= ~CO_FL_WAIT_L4_CONN;
902
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200903 if (!trash.data) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100904 /* client shutdown */
905 conn->err_code = CO_ER_CIP_EMPTY;
906 goto fail;
907 }
908
909 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000910 * CIP magic, header length or
911 * CIP magic, CIP length, CIP type, header length */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200912 if (trash.data < 12)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100913 goto missing;
914
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200915 line = trash.area;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100916
917 /* Decode a possible NetScaler Client IP request, fail early if
918 * it does not match */
Willy Tarreau1ac83af2020-02-25 10:06:49 +0100919 if (ntohl(read_u32(line)) != __objt_listener(conn->target)->bind_conf->ns_cip_magic)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100920 goto bad_magic;
921
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000922 /* Legacy CIP protocol */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200923 if ((trash.area[8] & 0xD0) == 0x40) {
Willy Tarreau1ac83af2020-02-25 10:06:49 +0100924 hdr_len = ntohl(read_u32((line+4)));
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000925 line += 8;
926 }
927 /* Standard CIP protocol */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200928 else if (trash.area[8] == 0x00) {
Willy Tarreau1ac83af2020-02-25 10:06:49 +0100929 hdr_len = ntohs(read_u32((line+10)));
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000930 line += 12;
931 }
932 /* Unknown CIP protocol */
933 else {
934 conn->err_code = CO_ER_CIP_BAD_PROTO;
935 goto fail;
936 }
937
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100938 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000939 * a minimal IP header */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200940 if (trash.data < 20)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100941 goto missing;
942
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100943 /* Get IP version from the first four bits */
Willy Tarreau0ca24aa2019-03-29 17:35:32 +0100944 ip_ver = (*line & 0xf0) >> 4;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100945
Willy Tarreau0ca24aa2019-03-29 17:35:32 +0100946 if (ip_ver == 4) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100947 struct ip *hdr_ip4;
David Carlier3015a2e2016-07-04 22:51:33 +0100948 struct my_tcphdr *hdr_tcp;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100949
950 hdr_ip4 = (struct ip *)line;
951
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200952 if (trash.data < 40 || trash.data < hdr_len) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100953 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin67de5a22017-12-13 01:15:05 +0000954 * IPv4 header, TCP header */
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100955 goto missing;
Bertrand Jacquinb3875912017-12-13 00:58:51 +0000956 }
957 else if (hdr_ip4->ip_p != IPPROTO_TCP) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100958 /* The protocol does not include a TCP header */
959 conn->err_code = CO_ER_CIP_BAD_PROTO;
960 goto fail;
Bertrand Jacquinb3875912017-12-13 00:58:51 +0000961 }
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100962
David Carlier3015a2e2016-07-04 22:51:33 +0100963 hdr_tcp = (struct my_tcphdr *)(line + (hdr_ip4->ip_hl * 4));
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100964
965 /* update the session's addresses and mark them set */
Willy Tarreau226572f2019-07-17 14:46:00 +0200966 ((struct sockaddr_in *)conn->src)->sin_family = AF_INET;
967 ((struct sockaddr_in *)conn->src)->sin_addr.s_addr = hdr_ip4->ip_src.s_addr;
968 ((struct sockaddr_in *)conn->src)->sin_port = hdr_tcp->source;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100969
Willy Tarreau226572f2019-07-17 14:46:00 +0200970 ((struct sockaddr_in *)conn->dst)->sin_family = AF_INET;
971 ((struct sockaddr_in *)conn->dst)->sin_addr.s_addr = hdr_ip4->ip_dst.s_addr;
972 ((struct sockaddr_in *)conn->dst)->sin_port = hdr_tcp->dest;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100973
974 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
975 }
Willy Tarreau0ca24aa2019-03-29 17:35:32 +0100976 else if (ip_ver == 6) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100977 struct ip6_hdr *hdr_ip6;
David Carlier3015a2e2016-07-04 22:51:33 +0100978 struct my_tcphdr *hdr_tcp;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100979
980 hdr_ip6 = (struct ip6_hdr *)line;
981
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200982 if (trash.data < 60 || trash.data < hdr_len) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100983 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin67de5a22017-12-13 01:15:05 +0000984 * IPv6 header, TCP header */
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100985 goto missing;
Bertrand Jacquinb3875912017-12-13 00:58:51 +0000986 }
987 else if (hdr_ip6->ip6_nxt != IPPROTO_TCP) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100988 /* The protocol does not include a TCP header */
989 conn->err_code = CO_ER_CIP_BAD_PROTO;
990 goto fail;
Bertrand Jacquinb3875912017-12-13 00:58:51 +0000991 }
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100992
David Carlier3015a2e2016-07-04 22:51:33 +0100993 hdr_tcp = (struct my_tcphdr *)(line + sizeof(struct ip6_hdr));
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100994
995 /* update the session's addresses and mark them set */
Willy Tarreau226572f2019-07-17 14:46:00 +0200996 ((struct sockaddr_in6 *)conn->src)->sin6_family = AF_INET6;
997 ((struct sockaddr_in6 *)conn->src)->sin6_addr = hdr_ip6->ip6_src;
998 ((struct sockaddr_in6 *)conn->src)->sin6_port = hdr_tcp->source;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100999
Willy Tarreau226572f2019-07-17 14:46:00 +02001000 ((struct sockaddr_in6 *)conn->dst)->sin6_family = AF_INET6;
1001 ((struct sockaddr_in6 *)conn->dst)->sin6_addr = hdr_ip6->ip6_dst;
1002 ((struct sockaddr_in6 *)conn->dst)->sin6_port = hdr_tcp->dest;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001003
1004 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
1005 }
1006 else {
1007 /* The protocol does not match something known (IPv4/IPv6) */
1008 conn->err_code = CO_ER_CIP_BAD_PROTO;
1009 goto fail;
1010 }
1011
Bertrand Jacquin7d668f92017-12-13 01:23:39 +00001012 line += hdr_len;
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001013 trash.data = line - trash.area;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001014
1015 /* remove the NetScaler Client IP header from the request. For this
1016 * we re-read the exact line at once. If we don't get the exact same
1017 * result, we fail.
1018 */
Willy Tarreau157788c2020-02-11 10:08:05 +01001019 while (1) {
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001020 int len2 = recv(conn->handle.fd, trash.area, trash.data, 0);
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001021 if (len2 < 0 && errno == EINTR)
1022 continue;
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001023 if (len2 != trash.data)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001024 goto recv_abort;
Willy Tarreau157788c2020-02-11 10:08:05 +01001025 break;
1026 }
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001027
1028 conn->flags &= ~flag;
1029 return 1;
1030
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001031 not_ready:
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001032 return 0;
1033
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001034 missing:
1035 /* Missing data. Since we're using MSG_PEEK, we can only poll again if
1036 * we have not read anything. Otherwise we need to fail because we won't
1037 * be able to poll anymore.
1038 */
1039 conn->err_code = CO_ER_CIP_TRUNCATED;
1040 goto fail;
1041
1042 bad_magic:
1043 conn->err_code = CO_ER_CIP_BAD_MAGIC;
1044 goto fail;
1045
1046 recv_abort:
1047 conn->err_code = CO_ER_CIP_ABORT;
1048 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH;
1049 goto fail;
1050
1051 fail:
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001052 conn->flags |= CO_FL_ERROR;
1053 return 0;
1054}
1055
Alexander Liu2a54bb72019-05-22 19:44:48 +08001056
1057int conn_send_socks4_proxy_request(struct connection *conn)
1058{
1059 struct socks4_request req_line;
1060
Alexander Liu2a54bb72019-05-22 19:44:48 +08001061 if (!conn_ctrl_ready(conn))
1062 goto out_error;
1063
Willy Tarreau226572f2019-07-17 14:46:00 +02001064 if (!conn_get_dst(conn))
1065 goto out_error;
1066
Alexander Liu2a54bb72019-05-22 19:44:48 +08001067 req_line.version = 0x04;
1068 req_line.command = 0x01;
Willy Tarreau226572f2019-07-17 14:46:00 +02001069 req_line.port = get_net_port(conn->dst);
1070 req_line.ip = is_inet_addr(conn->dst);
Alexander Liu2a54bb72019-05-22 19:44:48 +08001071 memcpy(req_line.user_id, "HAProxy\0", 8);
1072
1073 if (conn->send_proxy_ofs > 0) {
1074 /*
1075 * This is the first call to send the request
1076 */
1077 conn->send_proxy_ofs = -(int)sizeof(req_line);
1078 }
1079
1080 if (conn->send_proxy_ofs < 0) {
1081 int ret = 0;
1082
1083 /* we are sending the socks4_req_line here. If the data layer
1084 * has a pending write, we'll also set MSG_MORE.
1085 */
1086 ret = conn_sock_send(
1087 conn,
1088 ((char *)(&req_line)) + (sizeof(req_line)+conn->send_proxy_ofs),
1089 -conn->send_proxy_ofs,
Willy Tarreau19bc2012020-02-21 08:46:19 +01001090 (conn->subs && conn->subs->events & SUB_RETRY_SEND) ? MSG_MORE : 0);
Alexander Liu2a54bb72019-05-22 19:44:48 +08001091
1092 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Before send remain is [%d], sent [%d]\n",
1093 conn->handle.fd, -conn->send_proxy_ofs, ret);
1094
1095 if (ret < 0) {
1096 goto out_error;
1097 }
1098
1099 conn->send_proxy_ofs += ret; /* becomes zero once complete */
1100 if (conn->send_proxy_ofs != 0) {
1101 goto out_wait;
1102 }
1103 }
1104
1105 /* OK we've the whole request sent */
1106 conn->flags &= ~CO_FL_SOCKS4_SEND;
Alexander Liu2a54bb72019-05-22 19:44:48 +08001107
1108 /* The connection is ready now, simply return and let the connection
1109 * handler notify upper layers if needed.
1110 */
Willy Tarreauc192b0a2020-01-23 09:11:58 +01001111 conn->flags &= ~CO_FL_WAIT_L4_CONN;
Alexander Liu2a54bb72019-05-22 19:44:48 +08001112
1113 if (conn->flags & CO_FL_SEND_PROXY) {
1114 /*
1115 * Get the send_proxy_ofs ready for the send_proxy due to we are
1116 * reusing the "send_proxy_ofs", and SOCKS4 handshake should be done
1117 * before sending PROXY Protocol.
1118 */
1119 conn->send_proxy_ofs = 1;
1120 }
1121 return 1;
1122
1123 out_error:
1124 /* Write error on the file descriptor */
1125 conn->flags |= CO_FL_ERROR;
1126 if (conn->err_code == CO_ER_NONE) {
1127 conn->err_code = CO_ER_SOCKS4_SEND;
1128 }
1129 return 0;
1130
1131 out_wait:
Alexander Liu2a54bb72019-05-22 19:44:48 +08001132 return 0;
1133}
1134
1135int conn_recv_socks4_proxy_response(struct connection *conn)
1136{
1137 char line[SOCKS4_HS_RSP_LEN];
1138 int ret;
1139
Alexander Liu2a54bb72019-05-22 19:44:48 +08001140 if (!conn_ctrl_ready(conn))
1141 goto fail;
1142
1143 if (!fd_recv_ready(conn->handle.fd))
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001144 goto not_ready;
Alexander Liu2a54bb72019-05-22 19:44:48 +08001145
Willy Tarreau157788c2020-02-11 10:08:05 +01001146 while (1) {
Alexander Liu2a54bb72019-05-22 19:44:48 +08001147 /* SOCKS4 Proxy will response with 8 bytes, 0x00 | 0x5A | 0x00 0x00 | 0x00 0x00 0x00 0x00
1148 * Try to peek into it, before all 8 bytes ready.
1149 */
1150 ret = recv(conn->handle.fd, line, SOCKS4_HS_RSP_LEN, MSG_PEEK);
1151
1152 if (ret == 0) {
1153 /* the socket has been closed or shutdown for send */
1154 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Received ret[%d], errno[%d], looks like the socket has been closed or shutdown for send\n",
1155 conn->handle.fd, ret, errno);
1156 if (conn->err_code == CO_ER_NONE) {
1157 conn->err_code = CO_ER_SOCKS4_RECV;
1158 }
1159 goto fail;
1160 }
1161
1162 if (ret > 0) {
1163 if (ret == SOCKS4_HS_RSP_LEN) {
1164 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Received 8 bytes, the response is [%02X|%02X|%02X %02X|%02X %02X %02X %02X]\n",
1165 conn->handle.fd, line[0], line[1], line[2], line[3], line[4], line[5], line[6], line[7]);
1166 }else{
1167 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Received ret[%d], first byte is [%02X], last bye is [%02X]\n", conn->handle.fd, ret, line[0], line[ret-1]);
1168 }
1169 } else {
1170 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Received ret[%d], errno[%d]\n", conn->handle.fd, ret, errno);
1171 }
1172
1173 if (ret < 0) {
1174 if (errno == EINTR) {
1175 continue;
1176 }
1177 if (errno == EAGAIN) {
1178 fd_cant_recv(conn->handle.fd);
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001179 goto not_ready;
Alexander Liu2a54bb72019-05-22 19:44:48 +08001180 }
1181 goto recv_abort;
1182 }
Willy Tarreau157788c2020-02-11 10:08:05 +01001183 break;
1184 }
Alexander Liu2a54bb72019-05-22 19:44:48 +08001185
Willy Tarreauc192b0a2020-01-23 09:11:58 +01001186 conn->flags &= ~CO_FL_WAIT_L4_CONN;
1187
Alexander Liu2a54bb72019-05-22 19:44:48 +08001188 if (ret < SOCKS4_HS_RSP_LEN) {
1189 /* Missing data. Since we're using MSG_PEEK, we can only poll again if
1190 * we are not able to read enough data.
1191 */
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001192 goto not_ready;
Alexander Liu2a54bb72019-05-22 19:44:48 +08001193 }
1194
1195 /*
1196 * Base on the SOCSK4 protocol:
1197 *
1198 * +----+----+----+----+----+----+----+----+
1199 * | VN | CD | DSTPORT | DSTIP |
1200 * +----+----+----+----+----+----+----+----+
1201 * # of bytes: 1 1 2 4
1202 * VN is the version of the reply code and should be 0. CD is the result
1203 * code with one of the following values:
1204 * 90: request granted
1205 * 91: request rejected or failed
Ilya Shipitsince7b00f2020-03-23 22:28:40 +05001206 * 92: request rejected because SOCKS server cannot connect to identd on the client
Alexander Liu2a54bb72019-05-22 19:44:48 +08001207 * 93: request rejected because the client program and identd report different user-ids
1208 * The remaining fields are ignored.
1209 */
1210 if (line[1] != 90) {
1211 conn->flags &= ~CO_FL_SOCKS4_RECV;
1212
1213 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: FAIL, the response is [%02X|%02X|%02X %02X|%02X %02X %02X %02X]\n",
1214 conn->handle.fd, line[0], line[1], line[2], line[3], line[4], line[5], line[6], line[7]);
1215 if (conn->err_code == CO_ER_NONE) {
1216 conn->err_code = CO_ER_SOCKS4_DENY;
1217 }
1218 goto fail;
1219 }
1220
1221 /* remove the 8 bytes response from the stream */
Willy Tarreau157788c2020-02-11 10:08:05 +01001222 while (1) {
Alexander Liu2a54bb72019-05-22 19:44:48 +08001223 ret = recv(conn->handle.fd, line, SOCKS4_HS_RSP_LEN, 0);
1224 if (ret < 0 && errno == EINTR) {
1225 continue;
1226 }
1227 if (ret != SOCKS4_HS_RSP_LEN) {
1228 if (conn->err_code == CO_ER_NONE) {
1229 conn->err_code = CO_ER_SOCKS4_RECV;
1230 }
1231 goto fail;
1232 }
Willy Tarreau157788c2020-02-11 10:08:05 +01001233 break;
1234 }
Alexander Liu2a54bb72019-05-22 19:44:48 +08001235
1236 conn->flags &= ~CO_FL_SOCKS4_RECV;
1237 return 1;
1238
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001239 not_ready:
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001240 return 0;
1241
Alexander Liu2a54bb72019-05-22 19:44:48 +08001242 recv_abort:
1243 if (conn->err_code == CO_ER_NONE) {
1244 conn->err_code = CO_ER_SOCKS4_ABORT;
1245 }
1246 conn->flags |= (CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH);
1247 goto fail;
1248
1249 fail:
Alexander Liu2a54bb72019-05-22 19:44:48 +08001250 conn->flags |= CO_FL_ERROR;
1251 return 0;
1252}
1253
Ilya Shipitsinca56fce2018-09-15 00:50:05 +05001254/* Note: <remote> is explicitly allowed to be NULL */
Tim Duesterhuscf6e0c82020-03-13 12:34:24 +01001255int make_proxy_line(char *buf, int buf_len, struct server *srv, struct connection *remote, struct stream *strm)
David Safb76832014-05-08 23:42:08 -04001256{
1257 int ret = 0;
1258
1259 if (srv && (srv->pp_opts & SRV_PP_V2)) {
Tim Duesterhuscf6e0c82020-03-13 12:34:24 +01001260 ret = make_proxy_line_v2(buf, buf_len, srv, remote, strm);
David Safb76832014-05-08 23:42:08 -04001261 }
1262 else {
Willy Tarreau226572f2019-07-17 14:46:00 +02001263 if (remote && conn_get_src(remote) && conn_get_dst(remote))
1264 ret = make_proxy_line_v1(buf, buf_len, remote->src, remote->dst);
David Safb76832014-05-08 23:42:08 -04001265 else
1266 ret = make_proxy_line_v1(buf, buf_len, NULL, NULL);
1267 }
1268
1269 return ret;
1270}
1271
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001272/* Makes a PROXY protocol line from the two addresses. The output is sent to
1273 * buffer <buf> for a maximum size of <buf_len> (including the trailing zero).
1274 * It returns the number of bytes composing this line (including the trailing
1275 * LF), or zero in case of failure (eg: not enough space). It supports TCP4,
Willy Tarreau2e1401a2013-10-01 11:41:55 +02001276 * TCP6 and "UNKNOWN" formats. If any of <src> or <dst> is null, UNKNOWN is
1277 * emitted as well.
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001278 */
David Safb76832014-05-08 23:42:08 -04001279int make_proxy_line_v1(char *buf, int buf_len, struct sockaddr_storage *src, struct sockaddr_storage *dst)
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001280{
1281 int ret = 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001282 char * protocol;
1283 char src_str[MAX(INET_ADDRSTRLEN, INET6_ADDRSTRLEN)];
1284 char dst_str[MAX(INET_ADDRSTRLEN, INET6_ADDRSTRLEN)];
1285 in_port_t src_port;
1286 in_port_t dst_port;
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001287
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001288 if ( !src
1289 || !dst
1290 || (src->ss_family != AF_INET && src->ss_family != AF_INET6)
1291 || (dst->ss_family != AF_INET && dst->ss_family != AF_INET6)) {
1292 /* unknown family combination */
1293 ret = snprintf(buf, buf_len, "PROXY UNKNOWN\r\n");
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001294 if (ret >= buf_len)
1295 return 0;
1296
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001297 return ret;
1298 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001299
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001300 /* IPv4 for both src and dst */
1301 if (src->ss_family == AF_INET && dst->ss_family == AF_INET) {
1302 protocol = "TCP4";
1303 if (!inet_ntop(AF_INET, &((struct sockaddr_in *)src)->sin_addr, src_str, sizeof(src_str)))
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001304 return 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001305 src_port = ((struct sockaddr_in *)src)->sin_port;
1306 if (!inet_ntop(AF_INET, &((struct sockaddr_in *)dst)->sin_addr, dst_str, sizeof(dst_str)))
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001307 return 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001308 dst_port = ((struct sockaddr_in *)dst)->sin_port;
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001309 }
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001310 /* IPv6 for at least one of src and dst */
1311 else {
1312 struct in6_addr tmp;
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001313
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001314 protocol = "TCP6";
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001315
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001316 if (src->ss_family == AF_INET) {
1317 /* Convert src to IPv6 */
1318 v4tov6(&tmp, &((struct sockaddr_in *)src)->sin_addr);
1319 src_port = ((struct sockaddr_in *)src)->sin_port;
1320 }
1321 else {
1322 tmp = ((struct sockaddr_in6 *)src)->sin6_addr;
1323 src_port = ((struct sockaddr_in6 *)src)->sin6_port;
1324 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001325
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001326 if (!inet_ntop(AF_INET6, &tmp, src_str, sizeof(src_str)))
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001327 return 0;
1328
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001329 if (dst->ss_family == AF_INET) {
1330 /* Convert dst to IPv6 */
1331 v4tov6(&tmp, &((struct sockaddr_in *)dst)->sin_addr);
1332 dst_port = ((struct sockaddr_in *)dst)->sin_port;
1333 }
1334 else {
1335 tmp = ((struct sockaddr_in6 *)dst)->sin6_addr;
1336 dst_port = ((struct sockaddr_in6 *)dst)->sin6_port;
1337 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001338
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001339 if (!inet_ntop(AF_INET6, &tmp, dst_str, sizeof(dst_str)))
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001340 return 0;
1341 }
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001342
1343 ret = snprintf(buf, buf_len, "PROXY %s %s %s %u %u\r\n", protocol, src_str, dst_str, ntohs(src_port), ntohs(dst_port));
1344 if (ret >= buf_len)
1345 return 0;
1346
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001347 return ret;
1348}
David Safb76832014-05-08 23:42:08 -04001349
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001350static int make_tlv(char *dest, int dest_len, char type, uint16_t length, const char *value)
David Safb76832014-05-08 23:42:08 -04001351{
1352 struct tlv *tlv;
1353
1354 if (!dest || (length + sizeof(*tlv) > dest_len))
1355 return 0;
1356
1357 tlv = (struct tlv *)dest;
1358
1359 tlv->type = type;
1360 tlv->length_hi = length >> 8;
1361 tlv->length_lo = length & 0x00ff;
1362 memcpy(tlv->value, value, length);
1363 return length + sizeof(*tlv);
1364}
David Safb76832014-05-08 23:42:08 -04001365
Ilya Shipitsinca56fce2018-09-15 00:50:05 +05001366/* Note: <remote> is explicitly allowed to be NULL */
Tim Duesterhuscf6e0c82020-03-13 12:34:24 +01001367int make_proxy_line_v2(char *buf, int buf_len, struct server *srv, struct connection *remote, struct stream *strm)
David Safb76832014-05-08 23:42:08 -04001368{
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001369 const char pp2_signature[] = PP2_SIGNATURE;
Emmanuel Hocdet4399c752018-02-05 15:26:43 +01001370 void *tlv_crc32c_p = NULL;
David Safb76832014-05-08 23:42:08 -04001371 int ret = 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001372 struct proxy_hdr_v2 *hdr = (struct proxy_hdr_v2 *)buf;
Vincent Bernat6e615892016-05-18 16:17:44 +02001373 struct sockaddr_storage null_addr = { .ss_family = 0 };
David Safb76832014-05-08 23:42:08 -04001374 struct sockaddr_storage *src = &null_addr;
1375 struct sockaddr_storage *dst = &null_addr;
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001376 const char *value;
1377 int value_len;
David Safb76832014-05-08 23:42:08 -04001378
1379 if (buf_len < PP2_HEADER_LEN)
1380 return 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001381 memcpy(hdr->sig, pp2_signature, PP2_SIGNATURE_LEN);
David Safb76832014-05-08 23:42:08 -04001382
Willy Tarreau226572f2019-07-17 14:46:00 +02001383 if (remote && conn_get_src(remote) && conn_get_dst(remote)) {
1384 src = remote->src;
1385 dst = remote->dst;
David Safb76832014-05-08 23:42:08 -04001386 }
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001387
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001388 /* At least one of src or dst is not of AF_INET or AF_INET6 */
1389 if ( !src
1390 || !dst
Willy Tarreau119e50e2020-05-22 13:53:29 +02001391 || (!pp2_never_send_local && conn_is_back(remote)) // locally initiated connection
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001392 || (src->ss_family != AF_INET && src->ss_family != AF_INET6)
1393 || (dst->ss_family != AF_INET && dst->ss_family != AF_INET6)) {
David Safb76832014-05-08 23:42:08 -04001394 if (buf_len < PP2_HDR_LEN_UNSPEC)
1395 return 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001396 hdr->ver_cmd = PP2_VERSION | PP2_CMD_LOCAL;
1397 hdr->fam = PP2_FAM_UNSPEC | PP2_TRANS_UNSPEC;
David Safb76832014-05-08 23:42:08 -04001398 ret = PP2_HDR_LEN_UNSPEC;
1399 }
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001400 else {
Willy Tarreau02c88032020-04-14 12:54:10 +02001401 hdr->ver_cmd = PP2_VERSION | PP2_CMD_PROXY;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001402 /* IPv4 for both src and dst */
1403 if (src->ss_family == AF_INET && dst->ss_family == AF_INET) {
1404 if (buf_len < PP2_HDR_LEN_INET)
1405 return 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001406 hdr->fam = PP2_FAM_INET | PP2_TRANS_STREAM;
1407 hdr->addr.ip4.src_addr = ((struct sockaddr_in *)src)->sin_addr.s_addr;
1408 hdr->addr.ip4.src_port = ((struct sockaddr_in *)src)->sin_port;
1409 hdr->addr.ip4.dst_addr = ((struct sockaddr_in *)dst)->sin_addr.s_addr;
1410 hdr->addr.ip4.dst_port = ((struct sockaddr_in *)dst)->sin_port;
1411 ret = PP2_HDR_LEN_INET;
1412 }
1413 /* IPv6 for at least one of src and dst */
1414 else {
1415 struct in6_addr tmp;
1416
1417 if (buf_len < PP2_HDR_LEN_INET6)
1418 return 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001419 hdr->fam = PP2_FAM_INET6 | PP2_TRANS_STREAM;
1420 if (src->ss_family == AF_INET) {
1421 v4tov6(&tmp, &((struct sockaddr_in *)src)->sin_addr);
1422 memcpy(hdr->addr.ip6.src_addr, &tmp, 16);
1423 hdr->addr.ip6.src_port = ((struct sockaddr_in *)src)->sin_port;
1424 }
1425 else {
1426 memcpy(hdr->addr.ip6.src_addr, &((struct sockaddr_in6 *)src)->sin6_addr, 16);
1427 hdr->addr.ip6.src_port = ((struct sockaddr_in6 *)src)->sin6_port;
1428 }
1429 if (dst->ss_family == AF_INET) {
1430 v4tov6(&tmp, &((struct sockaddr_in *)dst)->sin_addr);
1431 memcpy(hdr->addr.ip6.dst_addr, &tmp, 16);
William Dauchybd8bf672020-01-26 19:06:39 +01001432 hdr->addr.ip6.dst_port = ((struct sockaddr_in *)dst)->sin_port;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001433 }
1434 else {
1435 memcpy(hdr->addr.ip6.dst_addr, &((struct sockaddr_in6 *)dst)->sin6_addr, 16);
1436 hdr->addr.ip6.dst_port = ((struct sockaddr_in6 *)dst)->sin6_port;
1437 }
1438
1439 ret = PP2_HDR_LEN_INET6;
1440 }
1441 }
David Safb76832014-05-08 23:42:08 -04001442
Emmanuel Hocdet4399c752018-02-05 15:26:43 +01001443 if (srv->pp_opts & SRV_PP_V2_CRC32C) {
1444 uint32_t zero_crc32c = 0;
Tim Duesterhusa8692f32020-03-13 12:34:25 +01001445
Emmanuel Hocdet4399c752018-02-05 15:26:43 +01001446 if ((buf_len - ret) < sizeof(struct tlv))
1447 return 0;
1448 tlv_crc32c_p = (void *)((struct tlv *)&buf[ret])->value;
1449 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_CRC32C, sizeof(zero_crc32c), (const char *)&zero_crc32c);
1450 }
1451
Ilya Shipitsinca56fce2018-09-15 00:50:05 +05001452 if (remote && conn_get_alpn(remote, &value, &value_len)) {
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001453 if ((buf_len - ret) < sizeof(struct tlv))
1454 return 0;
Emmanuel Hocdet571c7ac2017-10-31 18:24:05 +01001455 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_ALPN, value_len, value);
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001456 }
1457
Emmanuel Hocdet253c3b72018-02-01 18:29:59 +01001458 if (srv->pp_opts & SRV_PP_V2_AUTHORITY) {
Emmanuel Hocdet8a4ffa02019-08-29 11:54:51 +02001459 value = NULL;
1460 if (remote && remote->proxy_authority) {
1461 value = remote->proxy_authority;
1462 value_len = remote->proxy_authority_len;
1463 }
1464#ifdef USE_OPENSSL
1465 else {
Jerome Magnin78891c72019-09-02 09:53:41 +02001466 if ((value = ssl_sock_get_sni(remote)))
Emmanuel Hocdet8a4ffa02019-08-29 11:54:51 +02001467 value_len = strlen(value);
1468 }
1469#endif
Emmanuel Hocdet253c3b72018-02-01 18:29:59 +01001470 if (value) {
1471 if ((buf_len - ret) < sizeof(struct tlv))
1472 return 0;
Emmanuel Hocdet8a4ffa02019-08-29 11:54:51 +02001473 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_AUTHORITY, value_len, value);
Emmanuel Hocdet253c3b72018-02-01 18:29:59 +01001474 }
1475 }
1476
Christopher Faulet3ab504f2020-05-26 15:16:01 +02001477 if (strm && (srv->pp_opts & SRV_PP_V2_UNIQUE_ID)) {
Tim Duesterhuscf6e0c82020-03-13 12:34:24 +01001478 struct session* sess = strm_sess(strm);
1479 struct ist unique_id = stream_generate_unique_id(strm, &sess->fe->format_unique_id);
1480
1481 value = unique_id.ptr;
1482 value_len = unique_id.len;
1483
1484 if (value_len >= 0) {
1485 if ((buf_len - ret) < sizeof(struct tlv))
1486 return 0;
1487 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_UNIQUE_ID, value_len, value);
1488 }
1489 }
1490
Emmanuel Hocdet8a4ffa02019-08-29 11:54:51 +02001491#ifdef USE_OPENSSL
David Safb76832014-05-08 23:42:08 -04001492 if (srv->pp_opts & SRV_PP_V2_SSL) {
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001493 struct tlv_ssl *tlv;
1494 int ssl_tlv_len = 0;
Tim Duesterhusa8692f32020-03-13 12:34:25 +01001495
David Safb76832014-05-08 23:42:08 -04001496 if ((buf_len - ret) < sizeof(struct tlv_ssl))
1497 return 0;
1498 tlv = (struct tlv_ssl *)&buf[ret];
1499 memset(tlv, 0, sizeof(struct tlv_ssl));
1500 ssl_tlv_len += sizeof(struct tlv_ssl);
1501 tlv->tlv.type = PP2_TYPE_SSL;
1502 if (ssl_sock_is_ssl(remote)) {
1503 tlv->client |= PP2_CLIENT_SSL;
Emmanuel Hocdet01da5712017-10-13 16:59:49 +02001504 value = ssl_sock_get_proto_version(remote);
David Safb76832014-05-08 23:42:08 -04001505 if (value) {
Emmanuel Hocdet8c0c34b2018-02-28 12:02:14 +01001506 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len-ret-ssl_tlv_len), PP2_SUBTYPE_SSL_VERSION, strlen(value), value);
David Safb76832014-05-08 23:42:08 -04001507 }
Dave McCowan328fb582014-07-30 10:39:13 -04001508 if (ssl_sock_get_cert_used_sess(remote)) {
1509 tlv->client |= PP2_CLIENT_CERT_SESS;
David Safb76832014-05-08 23:42:08 -04001510 tlv->verify = htonl(ssl_sock_get_verify_result(remote));
Dave McCowan328fb582014-07-30 10:39:13 -04001511 if (ssl_sock_get_cert_used_conn(remote))
1512 tlv->client |= PP2_CLIENT_CERT_CONN;
David Safb76832014-05-08 23:42:08 -04001513 }
1514 if (srv->pp_opts & SRV_PP_V2_SSL_CN) {
Willy Tarreau83061a82018-07-13 11:56:34 +02001515 struct buffer *cn_trash = get_trash_chunk();
Willy Tarreau3b9a0c92014-07-19 06:37:33 +02001516 if (ssl_sock_get_remote_common_name(remote, cn_trash) > 0) {
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001517 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_CN,
1518 cn_trash->data,
1519 cn_trash->area);
David Safb76832014-05-08 23:42:08 -04001520 }
1521 }
Emmanuel Hocdetfa8d0f12018-02-01 15:53:52 +01001522 if (srv->pp_opts & SRV_PP_V2_SSL_KEY_ALG) {
Willy Tarreau83061a82018-07-13 11:56:34 +02001523 struct buffer *pkey_trash = get_trash_chunk();
Emmanuel Hocdetfa8d0f12018-02-01 15:53:52 +01001524 if (ssl_sock_get_pkey_algo(remote, pkey_trash) > 0) {
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001525 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_KEY_ALG,
1526 pkey_trash->data,
1527 pkey_trash->area);
Emmanuel Hocdetfa8d0f12018-02-01 15:53:52 +01001528 }
1529 }
1530 if (srv->pp_opts & SRV_PP_V2_SSL_SIG_ALG) {
1531 value = ssl_sock_get_cert_sig(remote);
1532 if (value) {
1533 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_SIG_ALG, strlen(value), value);
1534 }
1535 }
1536 if (srv->pp_opts & SRV_PP_V2_SSL_CIPHER) {
1537 value = ssl_sock_get_cipher_name(remote);
1538 if (value) {
1539 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_CIPHER, strlen(value), value);
1540 }
1541 }
David Safb76832014-05-08 23:42:08 -04001542 }
1543 tlv->tlv.length_hi = (uint16_t)(ssl_tlv_len - sizeof(struct tlv)) >> 8;
1544 tlv->tlv.length_lo = (uint16_t)(ssl_tlv_len - sizeof(struct tlv)) & 0x00ff;
1545 ret += ssl_tlv_len;
1546 }
1547#endif
1548
Willy Tarreaue5733232019-05-22 19:24:06 +02001549#ifdef USE_NS
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001550 if (remote && (remote->proxy_netns)) {
1551 if ((buf_len - ret) < sizeof(struct tlv))
1552 return 0;
Emmanuel Hocdet571c7ac2017-10-31 18:24:05 +01001553 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_NETNS, remote->proxy_netns->name_len, remote->proxy_netns->node.key);
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001554 }
1555#endif
1556
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001557 hdr->len = htons((uint16_t)(ret - PP2_HEADER_LEN));
David Safb76832014-05-08 23:42:08 -04001558
Emmanuel Hocdet4399c752018-02-05 15:26:43 +01001559 if (tlv_crc32c_p) {
1560 write_u32(tlv_crc32c_p, htonl(hash_crc32c(buf, ret)));
1561 }
1562
David Safb76832014-05-08 23:42:08 -04001563 return ret;
1564}
Emeric Brun4f603012017-01-05 15:11:44 +01001565
Willy Tarreau119e50e2020-05-22 13:53:29 +02001566/* returns 0 on success */
1567static int cfg_parse_pp2_never_send_local(char **args, int section_type, struct proxy *curpx,
1568 struct proxy *defpx, const char *file, int line,
1569 char **err)
1570{
1571 if (too_many_args(0, args, err, NULL))
1572 return -1;
1573 pp2_never_send_local = 1;
1574 return 0;
1575}
1576
Willy Tarreau60ca10a2017-08-18 15:26:54 +02001577/* return the major HTTP version as 1 or 2 depending on how the request arrived
1578 * before being processed.
1579 */
1580static int
1581smp_fetch_fc_http_major(const struct arg *args, struct sample *smp, const char *kw, void *private)
1582{
Jérôme Magnin86577422018-12-07 09:03:11 +01001583 struct connection *conn = (kw[0] != 'b') ? objt_conn(smp->sess->origin) :
1584 smp->strm ? cs_conn(objt_cs(smp->strm->si[1].end)) : NULL;
Willy Tarreau60ca10a2017-08-18 15:26:54 +02001585
1586 smp->data.type = SMP_T_SINT;
1587 smp->data.u.sint = (conn && strcmp(conn_get_mux_name(conn), "H2") == 0) ? 2 : 1;
1588 return 1;
1589}
1590
Emeric Brun4f603012017-01-05 15:11:44 +01001591/* fetch if the received connection used a PROXY protocol header */
1592int smp_fetch_fc_rcvd_proxy(const struct arg *args, struct sample *smp, const char *kw, void *private)
1593{
1594 struct connection *conn;
1595
1596 conn = objt_conn(smp->sess->origin);
1597 if (!conn)
1598 return 0;
1599
Willy Tarreau911db9b2020-01-23 16:27:54 +01001600 if (conn->flags & CO_FL_WAIT_XPRT) {
Emeric Brun4f603012017-01-05 15:11:44 +01001601 smp->flags |= SMP_F_MAY_CHANGE;
1602 return 0;
1603 }
1604
1605 smp->flags = 0;
1606 smp->data.type = SMP_T_BOOL;
1607 smp->data.u.sint = (conn->flags & CO_FL_RCVD_PROXY) ? 1 : 0;
1608
1609 return 1;
1610}
1611
Geoff Simmons7185b782019-08-27 18:31:16 +02001612/* fetch the authority TLV from a PROXY protocol header */
1613int smp_fetch_fc_pp_authority(const struct arg *args, struct sample *smp, const char *kw, void *private)
1614{
1615 struct connection *conn;
1616
1617 conn = objt_conn(smp->sess->origin);
1618 if (!conn)
1619 return 0;
1620
Willy Tarreau911db9b2020-01-23 16:27:54 +01001621 if (conn->flags & CO_FL_WAIT_XPRT) {
Geoff Simmons7185b782019-08-27 18:31:16 +02001622 smp->flags |= SMP_F_MAY_CHANGE;
1623 return 0;
1624 }
1625
1626 if (conn->proxy_authority == NULL)
1627 return 0;
1628
1629 smp->flags = 0;
1630 smp->data.type = SMP_T_STR;
1631 smp->data.u.str.area = conn->proxy_authority;
1632 smp->data.u.str.data = conn->proxy_authority_len;
1633
1634 return 1;
1635}
1636
Tim Duesterhusd1b15b62020-03-13 12:34:23 +01001637/* fetch the unique ID TLV from a PROXY protocol header */
1638int smp_fetch_fc_pp_unique_id(const struct arg *args, struct sample *smp, const char *kw, void *private)
1639{
1640 struct connection *conn;
1641
1642 conn = objt_conn(smp->sess->origin);
1643 if (!conn)
1644 return 0;
1645
1646 if (conn->flags & CO_FL_WAIT_XPRT) {
1647 smp->flags |= SMP_F_MAY_CHANGE;
1648 return 0;
1649 }
1650
1651 if (!isttest(conn->proxy_unique_id))
1652 return 0;
1653
1654 smp->flags = 0;
1655 smp->data.type = SMP_T_STR;
1656 smp->data.u.str.area = conn->proxy_unique_id.ptr;
1657 smp->data.u.str.data = conn->proxy_unique_id.len;
1658
1659 return 1;
1660}
1661
Emeric Brun4f603012017-01-05 15:11:44 +01001662/* Note: must not be declared <const> as its list will be overwritten.
1663 * Note: fetches that may return multiple types must be declared as the lowest
1664 * common denominator, the type that can be casted into all other ones. For
1665 * instance v4/v6 must be declared v4.
1666 */
1667static struct sample_fetch_kw_list sample_fetch_keywords = {ILH, {
Willy Tarreau60ca10a2017-08-18 15:26:54 +02001668 { "fc_http_major", smp_fetch_fc_http_major, 0, NULL, SMP_T_SINT, SMP_USE_L4CLI },
Jérôme Magnin86577422018-12-07 09:03:11 +01001669 { "bc_http_major", smp_fetch_fc_http_major, 0, NULL, SMP_T_SINT, SMP_USE_L4SRV },
Emeric Brun4f603012017-01-05 15:11:44 +01001670 { "fc_rcvd_proxy", smp_fetch_fc_rcvd_proxy, 0, NULL, SMP_T_BOOL, SMP_USE_L4CLI },
Geoff Simmons7185b782019-08-27 18:31:16 +02001671 { "fc_pp_authority", smp_fetch_fc_pp_authority, 0, NULL, SMP_T_STR, SMP_USE_L4CLI },
Tim Duesterhusd1b15b62020-03-13 12:34:23 +01001672 { "fc_pp_unique_id", smp_fetch_fc_pp_unique_id, 0, NULL, SMP_T_STR, SMP_USE_L4CLI },
Emeric Brun4f603012017-01-05 15:11:44 +01001673 { /* END */ },
1674}};
1675
Willy Tarreau0108d902018-11-25 19:14:37 +01001676INITCALL1(STG_REGISTER, sample_register_fetches, &sample_fetch_keywords);
Willy Tarreau119e50e2020-05-22 13:53:29 +02001677
1678static struct cfg_kw_list cfg_kws = {ILH, {
1679 { CFG_GLOBAL, "pp2-never-send-local", cfg_parse_pp2_never_send_local },
1680 { /* END */ },
1681}};
1682
1683INITCALL1(STG_REGISTER, cfg_register_keywords, &cfg_kws);