blob: c671ed940d895949d94647d3d89df5fb2f8b0bfe [file] [log] [blame]
Willy Tarreau39713102016-11-25 15:49:32 +01001/*
2 * "tcp" rules processing
3 *
4 * Copyright 2000-2016 Willy Tarreau <w@1wt.eu>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
Willy Tarreaudcc048a2020-06-04 19:11:43 +020012#include <haproxy/acl.h>
Willy Tarreau122eba92020-06-04 10:15:32 +020013#include <haproxy/action.h>
Willy Tarreau4c7e4b72020-05-27 12:58:42 +020014#include <haproxy/api.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020015#include <haproxy/arg-t.h>
Willy Tarreau278161c2020-06-04 11:18:28 +020016#include <haproxy/capture-t.h>
Willy Tarreau6be78492020-06-05 00:00:29 +020017#include <haproxy/cfgparse.h>
Willy Tarreauf1d32c42020-06-04 21:07:02 +020018#include <haproxy/channel.h>
Willy Tarreau7ea393d2020-06-04 18:02:10 +020019#include <haproxy/connection.h>
Willy Tarreauf268ee82020-06-04 17:05:57 +020020#include <haproxy/global.h>
Willy Tarreau853b2972020-05-27 18:01:47 +020021#include <haproxy/list.h>
Willy Tarreauaeed4a82020-06-04 22:01:04 +020022#include <haproxy/log.h>
Willy Tarreaua264d962020-06-04 22:29:18 +020023#include <haproxy/proxy.h>
Willy Tarreaue6ce10b2020-06-04 15:33:47 +020024#include <haproxy/sample.h>
Willy Tarreaudfd3de82020-06-04 23:46:14 +020025#include <haproxy/stick_table.h>
26#include <haproxy/stream-t.h>
Willy Tarreau5e539c92020-06-04 20:45:39 +020027#include <haproxy/stream_interface.h>
Willy Tarreau8b550af2020-06-04 17:42:48 +020028#include <haproxy/tcp_rules.h>
Willy Tarreauc2f7c582020-06-02 18:15:32 +020029#include <haproxy/ticks.h>
Willy Tarreau92b4f132020-06-01 11:05:15 +020030#include <haproxy/time.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020031#include <haproxy/tools.h>
Willy Tarreaudfd3de82020-06-04 23:46:14 +020032#include <haproxy/trace.h>
Willy Tarreau39713102016-11-25 15:49:32 +010033
Willy Tarreau39713102016-11-25 15:49:32 +010034
Christopher Fauleteea8fc72019-11-05 16:18:10 +010035#define TRACE_SOURCE &trace_strm
36
Willy Tarreau39713102016-11-25 15:49:32 +010037/* List head of all known action keywords for "tcp-request connection" */
38struct list tcp_req_conn_keywords = LIST_HEAD_INIT(tcp_req_conn_keywords);
39struct list tcp_req_sess_keywords = LIST_HEAD_INIT(tcp_req_sess_keywords);
40struct list tcp_req_cont_keywords = LIST_HEAD_INIT(tcp_req_cont_keywords);
41struct list tcp_res_cont_keywords = LIST_HEAD_INIT(tcp_res_cont_keywords);
42
43/*
44 * Register keywords.
45 */
46void tcp_req_conn_keywords_register(struct action_kw_list *kw_list)
47{
48 LIST_ADDQ(&tcp_req_conn_keywords, &kw_list->list);
49}
50
51void tcp_req_sess_keywords_register(struct action_kw_list *kw_list)
52{
53 LIST_ADDQ(&tcp_req_sess_keywords, &kw_list->list);
54}
55
56void tcp_req_cont_keywords_register(struct action_kw_list *kw_list)
57{
58 LIST_ADDQ(&tcp_req_cont_keywords, &kw_list->list);
59}
60
61void tcp_res_cont_keywords_register(struct action_kw_list *kw_list)
62{
63 LIST_ADDQ(&tcp_res_cont_keywords, &kw_list->list);
64}
65
66/*
67 * Return the struct tcp_req_action_kw associated to a keyword.
68 */
Thierry Fournierab93f7c2020-11-28 17:40:24 +010069struct action_kw *tcp_req_conn_action(const char *kw)
Willy Tarreau39713102016-11-25 15:49:32 +010070{
71 return action_lookup(&tcp_req_conn_keywords, kw);
72}
73
Thierry Fournierab93f7c2020-11-28 17:40:24 +010074struct action_kw *tcp_req_sess_action(const char *kw)
Willy Tarreau39713102016-11-25 15:49:32 +010075{
76 return action_lookup(&tcp_req_sess_keywords, kw);
77}
78
Thierry Fournierab93f7c2020-11-28 17:40:24 +010079struct action_kw *tcp_req_cont_action(const char *kw)
Willy Tarreau39713102016-11-25 15:49:32 +010080{
81 return action_lookup(&tcp_req_cont_keywords, kw);
82}
83
Thierry Fournierab93f7c2020-11-28 17:40:24 +010084struct action_kw *tcp_res_cont_action(const char *kw)
Willy Tarreau39713102016-11-25 15:49:32 +010085{
86 return action_lookup(&tcp_res_cont_keywords, kw);
87}
88
89/* This function performs the TCP request analysis on the current request. It
90 * returns 1 if the processing can continue on next analysers, or zero if it
91 * needs more data, encounters an error, or wants to immediately abort the
92 * request. It relies on buffers flags, and updates s->req->analysers. The
93 * function may be called for frontend rules and backend rules. It only relies
94 * on the backend pointer so this works for both cases.
95 */
96int tcp_inspect_request(struct stream *s, struct channel *req, int an_bit)
97{
98 struct session *sess = s->sess;
99 struct act_rule *rule;
Willy Tarreau39713102016-11-25 15:49:32 +0100100 int partial;
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100101 int act_opts = 0;
Willy Tarreau39713102016-11-25 15:49:32 +0100102
Christopher Fauleteea8fc72019-11-05 16:18:10 +0100103 DBG_TRACE_ENTER(STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
Willy Tarreau39713102016-11-25 15:49:32 +0100104
105 /* We don't know whether we have enough data, so must proceed
106 * this way :
107 * - iterate through all rules in their declaration order
108 * - if one rule returns MISS, it means the inspect delay is
109 * not over yet, then return immediately, otherwise consider
110 * it as a non-match.
111 * - if one rule returns OK, then return OK
112 * - if one rule returns KO, then return KO
113 */
114
Willy Tarreau23752332018-06-15 14:54:53 +0200115 if ((req->flags & CF_SHUTR) || channel_full(req, global.tune.maxrewrite) ||
Christopher Faulet2747fbb2020-07-28 11:56:13 +0200116 !s->be->tcp_req.inspect_delay || tick_is_expired(s->rules_exp, now_ms))
Willy Tarreau39713102016-11-25 15:49:32 +0100117 partial = SMP_OPT_FINAL;
118 else
119 partial = 0;
120
121 /* If "the current_rule_list" match the executed rule list, we are in
122 * resume condition. If a resume is needed it is always in the action
123 * and never in the ACL or converters. In this case, we initialise the
124 * current rule, and go to the action execution point.
125 */
126 if (s->current_rule) {
127 rule = s->current_rule;
128 s->current_rule = NULL;
129 if (s->current_rule_list == &s->be->tcp_req.inspect_rules)
130 goto resume_execution;
131 }
132 s->current_rule_list = &s->be->tcp_req.inspect_rules;
133
134 list_for_each_entry(rule, &s->be->tcp_req.inspect_rules, list) {
135 enum acl_test_res ret = ACL_TEST_PASS;
136
137 if (rule->cond) {
138 ret = acl_exec_cond(rule->cond, s->be, sess, s, SMP_OPT_DIR_REQ | partial);
139 if (ret == ACL_TEST_MISS)
140 goto missing_data;
141
142 ret = acl_pass(ret);
143 if (rule->cond->pol == ACL_COND_UNLESS)
144 ret = !ret;
145 }
146
147 if (ret) {
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100148 act_opts |= ACT_OPT_FIRST;
Willy Tarreau39713102016-11-25 15:49:32 +0100149resume_execution:
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100150
151 /* Always call the action function if defined */
152 if (rule->action_ptr) {
153 if (partial & SMP_OPT_FINAL)
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100154 act_opts |= ACT_OPT_FINAL;
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100155
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100156 switch (rule->action_ptr(rule, s->be, s->sess, s, act_opts)) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100157 case ACT_RET_CONT:
158 break;
159 case ACT_RET_STOP:
160 case ACT_RET_DONE:
161 goto end;
162 case ACT_RET_YIELD:
163 s->current_rule = rule;
Christopher Faulet99aaca92020-07-28 11:30:19 +0200164 if (partial & SMP_OPT_FINAL) {
165 send_log(s->be, LOG_WARNING,
166 "Internal error: yield not allowed if the inspect-delay expired "
167 "for the tcp-request content actions.");
168 goto internal;
169 }
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100170 goto missing_data;
171 case ACT_RET_DENY:
172 goto deny;
173 case ACT_RET_ABRT:
174 goto abort;
175 case ACT_RET_ERR:
176 goto internal;
177 case ACT_RET_INV:
178 goto invalid;
179 }
180 continue; /* eval the next rule */
181 }
182
183 /* If not action function defined, check for known actions */
Willy Tarreau39713102016-11-25 15:49:32 +0100184 if (rule->action == ACT_ACTION_ALLOW) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100185 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100186 }
187 else if (rule->action == ACT_ACTION_DENY) {
Christopher Faulet282992e2019-12-16 12:34:31 +0100188 goto deny;
Willy Tarreau39713102016-11-25 15:49:32 +0100189 }
Willy Tarreau39713102016-11-25 15:49:32 +0100190 }
191 }
192
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100193 end:
Willy Tarreau39713102016-11-25 15:49:32 +0100194 /* if we get there, it means we have no rule which matches, or
195 * we have an explicit accept, so we apply the default accept.
196 */
197 req->analysers &= ~an_bit;
Christopher Faulet2747fbb2020-07-28 11:56:13 +0200198 req->analyse_exp = s->rules_exp = TICK_ETERNITY;
Christopher Fauleteea8fc72019-11-05 16:18:10 +0100199 DBG_TRACE_LEAVE(STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
Willy Tarreau39713102016-11-25 15:49:32 +0100200 return 1;
201
202 missing_data:
203 channel_dont_connect(req);
204 /* just set the request timeout once at the beginning of the request */
Christopher Faulet2747fbb2020-07-28 11:56:13 +0200205 if (!tick_isset(s->rules_exp) && s->be->tcp_req.inspect_delay)
206 s->rules_exp = tick_add(now_ms, s->be->tcp_req.inspect_delay);
207 req->analyse_exp = tick_first((tick_is_expired(req->analyse_exp, now_ms) ? 0 : req->analyse_exp), s->rules_exp);
Christopher Fauleteea8fc72019-11-05 16:18:10 +0100208 DBG_TRACE_DEVEL("waiting for more data", STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
Willy Tarreau39713102016-11-25 15:49:32 +0100209 return 0;
210
Christopher Faulet282992e2019-12-16 12:34:31 +0100211 deny:
212 _HA_ATOMIC_ADD(&sess->fe->fe_counters.denied_req, 1);
213 if (sess->listener && sess->listener->counters)
214 _HA_ATOMIC_ADD(&sess->listener->counters->denied_req, 1);
215 goto reject;
216
217 internal:
218 _HA_ATOMIC_ADD(&sess->fe->fe_counters.internal_errors, 1);
219 if (sess->listener && sess->listener->counters)
220 _HA_ATOMIC_ADD(&sess->listener->counters->internal_errors, 1);
221 if (!(s->flags & SF_ERR_MASK))
222 s->flags |= SF_ERR_INTERNAL;
223 goto reject;
224
225 invalid:
226 _HA_ATOMIC_ADD(&sess->fe->fe_counters.failed_req, 1);
227 if (sess->listener && sess->listener->counters)
228 _HA_ATOMIC_ADD(&sess->listener->counters->failed_req, 1);
229
230 reject:
231 si_must_kill_conn(chn_prod(req));
232 channel_abort(req);
233 channel_abort(&s->res);
234
235 abort:
236 req->analysers &= AN_REQ_FLT_END;
237
238 if (!(s->flags & SF_ERR_MASK))
239 s->flags |= SF_ERR_PRXCOND;
240 if (!(s->flags & SF_FINST_MASK))
241 s->flags |= SF_FINST_R;
242 DBG_TRACE_DEVEL("leaving on error|deny|abort", STRM_EV_STRM_ANA|STRM_EV_TCP_ANA|STRM_EV_TCP_ERR, s);
243 return 0;
Willy Tarreau39713102016-11-25 15:49:32 +0100244}
245
246/* This function performs the TCP response analysis on the current response. It
247 * returns 1 if the processing can continue on next analysers, or zero if it
248 * needs more data, encounters an error, or wants to immediately abort the
249 * response. It relies on buffers flags, and updates s->rep->analysers. The
250 * function may be called for backend rules.
251 */
252int tcp_inspect_response(struct stream *s, struct channel *rep, int an_bit)
253{
254 struct session *sess = s->sess;
255 struct act_rule *rule;
256 int partial;
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100257 int act_opts = 0;
Willy Tarreau39713102016-11-25 15:49:32 +0100258
Christopher Fauleteea8fc72019-11-05 16:18:10 +0100259 DBG_TRACE_ENTER(STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
Willy Tarreau39713102016-11-25 15:49:32 +0100260
261 /* We don't know whether we have enough data, so must proceed
262 * this way :
263 * - iterate through all rules in their declaration order
264 * - if one rule returns MISS, it means the inspect delay is
265 * not over yet, then return immediately, otherwise consider
266 * it as a non-match.
267 * - if one rule returns OK, then return OK
268 * - if one rule returns KO, then return KO
269 */
Willy Tarreau55ae1ab2020-06-15 18:08:07 +0200270 if ((rep->flags & CF_SHUTR) || channel_full(rep, global.tune.maxrewrite) ||
Christopher Faulet2747fbb2020-07-28 11:56:13 +0200271 !s->be->tcp_rep.inspect_delay || tick_is_expired(s->rules_exp, now_ms))
Willy Tarreau39713102016-11-25 15:49:32 +0100272 partial = SMP_OPT_FINAL;
273 else
274 partial = 0;
275
276 /* If "the current_rule_list" match the executed rule list, we are in
277 * resume condition. If a resume is needed it is always in the action
278 * and never in the ACL or converters. In this case, we initialise the
279 * current rule, and go to the action execution point.
280 */
281 if (s->current_rule) {
282 rule = s->current_rule;
283 s->current_rule = NULL;
284 if (s->current_rule_list == &s->be->tcp_rep.inspect_rules)
285 goto resume_execution;
286 }
287 s->current_rule_list = &s->be->tcp_rep.inspect_rules;
Christopher Faulet2747fbb2020-07-28 11:56:13 +0200288 s->rules_exp = TICK_ETERNITY;
Willy Tarreau39713102016-11-25 15:49:32 +0100289
290 list_for_each_entry(rule, &s->be->tcp_rep.inspect_rules, list) {
291 enum acl_test_res ret = ACL_TEST_PASS;
292
293 if (rule->cond) {
294 ret = acl_exec_cond(rule->cond, s->be, sess, s, SMP_OPT_DIR_RES | partial);
Christopher Faulet2747fbb2020-07-28 11:56:13 +0200295 if (ret == ACL_TEST_MISS)
296 goto missing_data;
Willy Tarreau39713102016-11-25 15:49:32 +0100297
298 ret = acl_pass(ret);
299 if (rule->cond->pol == ACL_COND_UNLESS)
300 ret = !ret;
301 }
302
303 if (ret) {
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100304 act_opts |= ACT_OPT_FIRST;
Willy Tarreau39713102016-11-25 15:49:32 +0100305resume_execution:
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100306 /* Always call the action function if defined */
307 if (rule->action_ptr) {
308 if (partial & SMP_OPT_FINAL)
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100309 act_opts |= ACT_OPT_FINAL;
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100310
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100311 switch (rule->action_ptr(rule, s->be, s->sess, s, act_opts)) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100312 case ACT_RET_CONT:
313 break;
314 case ACT_RET_STOP:
315 case ACT_RET_DONE:
316 goto end;
317 case ACT_RET_YIELD:
318 s->current_rule = rule;
Christopher Faulet99aaca92020-07-28 11:30:19 +0200319 if (partial & SMP_OPT_FINAL) {
320 send_log(s->be, LOG_WARNING,
321 "Internal error: yield not allowed if the inspect-delay expired "
322 "for the tcp-response content actions.");
323 goto internal;
324 }
Christopher Faulet2747fbb2020-07-28 11:56:13 +0200325 channel_dont_close(rep);
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100326 goto missing_data;
327 case ACT_RET_DENY:
328 goto deny;
329 case ACT_RET_ABRT:
330 goto abort;
331 case ACT_RET_ERR:
332 goto internal;
333 case ACT_RET_INV:
334 goto invalid;
335 }
336 continue; /* eval the next rule */
337 }
338
339 /* If not action function defined, check for known actions */
Willy Tarreau39713102016-11-25 15:49:32 +0100340 if (rule->action == ACT_ACTION_ALLOW) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100341 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100342 }
343 else if (rule->action == ACT_ACTION_DENY) {
Christopher Faulet282992e2019-12-16 12:34:31 +0100344 goto deny;
Willy Tarreau39713102016-11-25 15:49:32 +0100345 }
346 else if (rule->action == ACT_TCP_CLOSE) {
347 chn_prod(rep)->flags |= SI_FL_NOLINGER | SI_FL_NOHALF;
Willy Tarreau0f9cd7b2019-01-31 19:02:43 +0100348 si_must_kill_conn(chn_prod(rep));
Willy Tarreau39713102016-11-25 15:49:32 +0100349 si_shutr(chn_prod(rep));
350 si_shutw(chn_prod(rep));
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100351 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100352 }
353 }
354 }
355
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100356 end:
Willy Tarreau39713102016-11-25 15:49:32 +0100357 /* if we get there, it means we have no rule which matches, or
358 * we have an explicit accept, so we apply the default accept.
359 */
360 rep->analysers &= ~an_bit;
Christopher Faulet2747fbb2020-07-28 11:56:13 +0200361 rep->analyse_exp = s->rules_exp = TICK_ETERNITY;
Christopher Fauleteea8fc72019-11-05 16:18:10 +0100362 DBG_TRACE_LEAVE(STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
Willy Tarreau39713102016-11-25 15:49:32 +0100363 return 1;
Christopher Faulet282992e2019-12-16 12:34:31 +0100364
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100365 missing_data:
Christopher Faulet54f3e182020-07-29 12:00:23 +0200366 /* just set the analyser timeout once at the beginning of the response */
Christopher Faulet2747fbb2020-07-28 11:56:13 +0200367 if (!tick_isset(s->rules_exp) && s->be->tcp_rep.inspect_delay)
368 s->rules_exp = tick_add(now_ms, s->be->tcp_rep.inspect_delay);
369 rep->analyse_exp = tick_first((tick_is_expired(rep->analyse_exp, now_ms) ? 0 : rep->analyse_exp), s->rules_exp);
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100370 DBG_TRACE_DEVEL("waiting for more data", STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
371 return 0;
372
Christopher Faulet282992e2019-12-16 12:34:31 +0100373 deny:
Christopher Fauletcff0f732019-12-16 16:13:44 +0100374 _HA_ATOMIC_ADD(&s->sess->fe->fe_counters.denied_resp, 1);
Christopher Faulet282992e2019-12-16 12:34:31 +0100375 _HA_ATOMIC_ADD(&s->be->be_counters.denied_resp, 1);
William Lallemand656730d2021-03-08 15:26:48 +0100376 if (s->sess->listener && s->sess->listener->counters)
Christopher Fauletcff0f732019-12-16 16:13:44 +0100377 _HA_ATOMIC_ADD(&s->sess->listener->counters->denied_resp, 1);
Christopher Faulet282992e2019-12-16 12:34:31 +0100378 if (objt_server(s->target))
379 _HA_ATOMIC_ADD(&__objt_server(s->target)->counters.denied_resp, 1);
380 goto reject;
381
382 internal:
Christopher Fauletcff0f732019-12-16 16:13:44 +0100383 _HA_ATOMIC_ADD(&s->sess->fe->fe_counters.internal_errors, 1);
Christopher Faulet282992e2019-12-16 12:34:31 +0100384 _HA_ATOMIC_ADD(&s->be->be_counters.internal_errors, 1);
William Lallemand656730d2021-03-08 15:26:48 +0100385 if (s->sess->listener && s->sess->listener->counters)
Christopher Fauletcff0f732019-12-16 16:13:44 +0100386 _HA_ATOMIC_ADD(&s->sess->listener->counters->internal_errors, 1);
Christopher Faulet282992e2019-12-16 12:34:31 +0100387 if (objt_server(s->target))
388 _HA_ATOMIC_ADD(&__objt_server(s->target)->counters.internal_errors, 1);
389 if (!(s->flags & SF_ERR_MASK))
390 s->flags |= SF_ERR_INTERNAL;
391 goto reject;
392
393 invalid:
394 _HA_ATOMIC_ADD(&s->be->be_counters.failed_resp, 1);
395 if (objt_server(s->target))
396 _HA_ATOMIC_ADD(&__objt_server(s->target)->counters.failed_resp, 1);
397
398 reject:
399 si_must_kill_conn(chn_prod(rep));
400 channel_abort(rep);
401 channel_abort(&s->req);
402
403 abort:
Christopher Faulet19dbf2d2020-07-28 11:40:07 +0200404 rep->analysers &= AN_RES_FLT_END;
Christopher Faulet282992e2019-12-16 12:34:31 +0100405
406 if (!(s->flags & SF_ERR_MASK))
407 s->flags |= SF_ERR_PRXCOND;
408 if (!(s->flags & SF_FINST_MASK))
409 s->flags |= SF_FINST_D;
410 DBG_TRACE_DEVEL("leaving on error", STRM_EV_STRM_ANA|STRM_EV_TCP_ANA|STRM_EV_TCP_ERR, s);
411 return 0;
Willy Tarreau39713102016-11-25 15:49:32 +0100412}
413
414
415/* This function performs the TCP layer4 analysis on the current request. It
416 * returns 0 if a reject rule matches, otherwise 1 if either an accept rule
417 * matches or if no more rule matches. It can only use rules which don't need
418 * any data. This only works on connection-based client-facing stream interfaces.
419 */
420int tcp_exec_l4_rules(struct session *sess)
421{
422 struct act_rule *rule;
Willy Tarreau39713102016-11-25 15:49:32 +0100423 struct connection *conn = objt_conn(sess->origin);
424 int result = 1;
425 enum acl_test_res ret;
426
427 if (!conn)
428 return result;
429
430 list_for_each_entry(rule, &sess->fe->tcp_req.l4_rules, list) {
431 ret = ACL_TEST_PASS;
432
433 if (rule->cond) {
434 ret = acl_exec_cond(rule->cond, sess->fe, sess, NULL, SMP_OPT_DIR_REQ|SMP_OPT_FINAL);
435 ret = acl_pass(ret);
436 if (rule->cond->pol == ACL_COND_UNLESS)
437 ret = !ret;
438 }
439
440 if (ret) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100441 /* Always call the action function if defined */
442 if (rule->action_ptr) {
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100443 switch (rule->action_ptr(rule, sess->fe, sess, NULL, ACT_OPT_FINAL | ACT_OPT_FIRST)) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100444 case ACT_RET_YIELD:
445 /* yield is not allowed at this point. If this return code is
446 * used it is a bug, so I prefer to abort the process.
447 */
448 send_log(sess->fe, LOG_WARNING,
449 "Internal error: yield not allowed with tcp-request connection actions.");
450 /* fall through */
451 case ACT_RET_STOP:
452 case ACT_RET_DONE:
453 goto end;
454 case ACT_RET_CONT:
455 break;
456 case ACT_RET_DENY:
457 case ACT_RET_ABRT:
458 case ACT_RET_ERR:
459 case ACT_RET_INV:
460 result = 0;
461 goto end;
462 }
463 continue; /* eval the next rule */
464 }
465
466 /* If not action function defined, check for known actions */
Willy Tarreau39713102016-11-25 15:49:32 +0100467 if (rule->action == ACT_ACTION_ALLOW) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100468 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100469 }
470 else if (rule->action == ACT_ACTION_DENY) {
Olivier Houchard64dbb2d2019-03-08 18:55:10 +0100471 _HA_ATOMIC_ADD(&sess->fe->fe_counters.denied_conn, 1);
Willy Tarreaua12dde02016-12-22 18:14:41 +0100472 if (sess->listener && sess->listener->counters)
Olivier Houchard64dbb2d2019-03-08 18:55:10 +0100473 _HA_ATOMIC_ADD(&sess->listener->counters->denied_conn, 1);
Willy Tarreau39713102016-11-25 15:49:32 +0100474
475 result = 0;
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100476 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100477 }
Willy Tarreau39713102016-11-25 15:49:32 +0100478 else if (rule->action == ACT_TCP_EXPECT_PX) {
Willy Tarreau4450b582020-01-23 15:23:13 +0100479 if (!(conn->flags & CO_FL_HANDSHAKE)) {
Olivier Houchardfe50bfb2019-05-27 12:09:19 +0200480 if (xprt_add_hs(conn) < 0) {
481 result = 0;
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100482 goto end;
Olivier Houchardfe50bfb2019-05-27 12:09:19 +0200483 }
484 }
Willy Tarreau39713102016-11-25 15:49:32 +0100485 conn->flags |= CO_FL_ACCEPT_PROXY;
Willy Tarreau39713102016-11-25 15:49:32 +0100486 }
487 else if (rule->action == ACT_TCP_EXPECT_CIP) {
Willy Tarreau4450b582020-01-23 15:23:13 +0100488 if (!(conn->flags & CO_FL_HANDSHAKE)) {
Olivier Houchardfe50bfb2019-05-27 12:09:19 +0200489 if (xprt_add_hs(conn) < 0) {
490 result = 0;
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100491 goto end;
Olivier Houchardfe50bfb2019-05-27 12:09:19 +0200492 }
493 }
Willy Tarreau39713102016-11-25 15:49:32 +0100494 conn->flags |= CO_FL_ACCEPT_CIP;
Willy Tarreau39713102016-11-25 15:49:32 +0100495 }
Willy Tarreau39713102016-11-25 15:49:32 +0100496 }
497 }
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100498 end:
Willy Tarreau39713102016-11-25 15:49:32 +0100499 return result;
500}
501
502/* This function performs the TCP layer5 analysis on the current request. It
503 * returns 0 if a reject rule matches, otherwise 1 if either an accept rule
504 * matches or if no more rule matches. It can only use rules which don't need
505 * any data. This only works on session-based client-facing stream interfaces.
506 * An example of valid use case is to track a stick-counter on the source
507 * address extracted from the proxy protocol.
508 */
509int tcp_exec_l5_rules(struct session *sess)
510{
511 struct act_rule *rule;
Willy Tarreau39713102016-11-25 15:49:32 +0100512 int result = 1;
513 enum acl_test_res ret;
514
515 list_for_each_entry(rule, &sess->fe->tcp_req.l5_rules, list) {
516 ret = ACL_TEST_PASS;
517
518 if (rule->cond) {
519 ret = acl_exec_cond(rule->cond, sess->fe, sess, NULL, SMP_OPT_DIR_REQ|SMP_OPT_FINAL);
520 ret = acl_pass(ret);
521 if (rule->cond->pol == ACL_COND_UNLESS)
522 ret = !ret;
523 }
524
525 if (ret) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100526 /* Always call the action function if defined */
527 if (rule->action_ptr) {
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100528 switch (rule->action_ptr(rule, sess->fe, sess, NULL, ACT_OPT_FINAL | ACT_OPT_FIRST)) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100529 case ACT_RET_YIELD:
530 /* yield is not allowed at this point. If this return code is
531 * used it is a bug, so I prefer to abort the process.
532 */
533 send_log(sess->fe, LOG_WARNING,
534 "Internal error: yield not allowed with tcp-request session actions.");
535 /* fall through */
536 case ACT_RET_STOP:
537 case ACT_RET_DONE:
538 goto end;
539 case ACT_RET_CONT:
540 break;
541 case ACT_RET_DENY:
542 case ACT_RET_ABRT:
543 case ACT_RET_ERR:
544 case ACT_RET_INV:
545 result = 0;
546 goto end;
547 }
548 continue; /* eval the next rule */
549 }
550
551 /* If not action function defined, check for known actions */
Willy Tarreau39713102016-11-25 15:49:32 +0100552 if (rule->action == ACT_ACTION_ALLOW) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100553 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100554 }
555 else if (rule->action == ACT_ACTION_DENY) {
Olivier Houchard64dbb2d2019-03-08 18:55:10 +0100556 _HA_ATOMIC_ADD(&sess->fe->fe_counters.denied_sess, 1);
Willy Tarreaua12dde02016-12-22 18:14:41 +0100557 if (sess->listener && sess->listener->counters)
Olivier Houchard64dbb2d2019-03-08 18:55:10 +0100558 _HA_ATOMIC_ADD(&sess->listener->counters->denied_sess, 1);
Willy Tarreau39713102016-11-25 15:49:32 +0100559
560 result = 0;
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100561 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100562 }
Willy Tarreau39713102016-11-25 15:49:32 +0100563 }
564 }
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100565 end:
Willy Tarreau39713102016-11-25 15:49:32 +0100566 return result;
567}
568
569/* Parse a tcp-response rule. Return a negative value in case of failure */
570static int tcp_parse_response_rule(char **args, int arg, int section_type,
571 struct proxy *curpx, struct proxy *defpx,
572 struct act_rule *rule, char **err,
573 unsigned int where,
574 const char *file, int line)
575{
576 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
577 memprintf(err, "%s %s is only allowed in 'backend' sections",
578 args[0], args[1]);
579 return -1;
580 }
581
582 if (strcmp(args[arg], "accept") == 0) {
583 arg++;
584 rule->action = ACT_ACTION_ALLOW;
Christopher Faulet245cf792019-12-18 14:58:12 +0100585 rule->flags |= ACT_FLAG_FINAL;
Willy Tarreau39713102016-11-25 15:49:32 +0100586 }
587 else if (strcmp(args[arg], "reject") == 0) {
588 arg++;
589 rule->action = ACT_ACTION_DENY;
Christopher Faulet245cf792019-12-18 14:58:12 +0100590 rule->flags |= ACT_FLAG_FINAL;
Willy Tarreau39713102016-11-25 15:49:32 +0100591 }
592 else if (strcmp(args[arg], "close") == 0) {
593 arg++;
594 rule->action = ACT_TCP_CLOSE;
Christopher Faulet245cf792019-12-18 14:58:12 +0100595 rule->flags |= ACT_FLAG_FINAL;
Willy Tarreau39713102016-11-25 15:49:32 +0100596 }
597 else {
598 struct action_kw *kw;
599 kw = tcp_res_cont_action(args[arg]);
600 if (kw) {
601 arg++;
Willy Tarreau39713102016-11-25 15:49:32 +0100602 rule->kw = kw;
603 if (kw->parse((const char **)args, &arg, curpx, rule, err) == ACT_RET_PRS_ERR)
604 return -1;
605 } else {
606 action_build_list(&tcp_res_cont_keywords, &trash);
607 memprintf(err,
608 "'%s %s' expects 'accept', 'close', 'reject', %s in %s '%s' (got '%s')",
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200609 args[0], args[1], trash.area,
610 proxy_type_str(curpx), curpx->id, args[arg]);
Willy Tarreau39713102016-11-25 15:49:32 +0100611 return -1;
612 }
613 }
614
615 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
Christopher Faulet1b421ea2017-09-22 14:38:56 +0200616 if ((rule->cond = build_acl_cond(file, line, &curpx->acl, curpx, (const char **)args+arg, err)) == NULL) {
Willy Tarreau39713102016-11-25 15:49:32 +0100617 memprintf(err,
618 "'%s %s %s' : error detected in %s '%s' while parsing '%s' condition : %s",
619 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg], *err);
620 return -1;
621 }
622 }
623 else if (*args[arg]) {
624 memprintf(err,
625 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (got '%s')",
626 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
627 return -1;
628 }
629 return 0;
630}
631
Christopher Fauletac98d812019-12-18 09:20:16 +0100632
633/* This function executes a track-sc* actions. On success, it returns
634 * ACT_RET_CONT. If it must yield, it return ACT_RET_YIELD. Otherwsize
635 * ACT_RET_ERR is returned.
636 */
637static enum act_return tcp_action_track_sc(struct act_rule *rule, struct proxy *px,
638 struct session *sess, struct stream *s, int flags)
639{
640 struct stksess *ts;
641 struct stktable *t;
642 struct stktable_key *key;
643 struct sample smp;
644 int opt;
645
Christopher Faulet67307792020-02-10 09:54:49 +0100646 opt = SMP_OPT_DIR_REQ;
Christopher Fauletac98d812019-12-18 09:20:16 +0100647 if (flags & ACT_FLAG_FINAL)
648 opt |= SMP_OPT_FINAL;
Willy Tarreau39713102016-11-25 15:49:32 +0100649
Christopher Fauletac98d812019-12-18 09:20:16 +0100650 t = rule->arg.trk_ctr.table.t;
Christopher Faulet67307792020-02-10 09:54:49 +0100651 if (rule->from == ACT_F_TCP_REQ_CNT) { /* L7 rules: use the stream */
652 if (stkctr_entry(&s->stkctr[rule->action]))
653 goto end;
Christopher Fauletac98d812019-12-18 09:20:16 +0100654
Christopher Faulet67307792020-02-10 09:54:49 +0100655 key = stktable_fetch_key(t, s->be, sess, s, opt, rule->arg.trk_ctr.expr, &smp);
Christopher Fauletac98d812019-12-18 09:20:16 +0100656
Christopher Faulet67307792020-02-10 09:54:49 +0100657 if ((smp.flags & SMP_F_MAY_CHANGE) && !(flags & ACT_FLAG_FINAL))
658 return ACT_RET_YIELD; /* key might appear later */
659
660 if (key && (ts = stktable_get_entry(t, key))) {
661 stream_track_stkctr(&s->stkctr[rule->action], t, ts);
Christopher Fauletac98d812019-12-18 09:20:16 +0100662 stkctr_set_flags(&s->stkctr[rule->action], STKCTR_TRACK_CONTENT);
663 if (sess->fe != s->be)
664 stkctr_set_flags(&s->stkctr[rule->action], STKCTR_TRACK_BACKEND);
665 }
666 }
Christopher Faulet67307792020-02-10 09:54:49 +0100667 else { /* L4/L5 rules: use the session */
668 if (stkctr_entry(&sess->stkctr[rule->action]))
669 goto end;
670
671 key = stktable_fetch_key(t, sess->fe, sess, NULL, opt, rule->arg.trk_ctr.expr, NULL);
672 if (key && (ts = stktable_get_entry(t, key)))
673 stream_track_stkctr(&sess->stkctr[rule->action], t, ts);
674 }
Christopher Fauletac98d812019-12-18 09:20:16 +0100675
676 end:
677 return ACT_RET_CONT;
678}
Willy Tarreau39713102016-11-25 15:49:32 +0100679
Christopher Fauletd73b96d2019-12-19 17:27:03 +0100680/* This function executes a capture actions. It executes a fetch expression,
681 * turns the result into a string and puts it in a capture slot. On success, it
682 * returns ACT_RET_CONT. If it must yield, it return ACT_RET_YIELD. Otherwsize
683 * ACT_RET_ERR is returned.
684 */
685static enum act_return tcp_action_capture(struct act_rule *rule, struct proxy *px,
686 struct session *sess, struct stream *s, int flags)
687{
688 struct sample *key;
689 struct cap_hdr *h = rule->arg.cap.hdr;
690 char **cap = s->req_cap;
691 int len, opt;
692
693 opt = ((rule->from == ACT_F_TCP_REQ_CNT) ? SMP_OPT_DIR_REQ : SMP_OPT_DIR_RES);
694 if (flags & ACT_FLAG_FINAL)
695 opt |= SMP_OPT_FINAL;
696
697 key = sample_fetch_as_type(s->be, sess, s, opt, rule->arg.cap.expr, SMP_T_STR);
698 if (!key)
699 goto end;
700
701 if ((key->flags & SMP_F_MAY_CHANGE) && !(flags & ACT_FLAG_FINAL))
702 return ACT_RET_YIELD; /* key might appear later */
703
704 if (cap[h->index] == NULL) {
705 cap[h->index] = pool_alloc(h->pool);
706 if (cap[h->index] == NULL) /* no more capture memory, ignore error */
707 goto end;
708 }
709
710 len = key->data.u.str.data;
711 if (len > h->len)
712 len = h->len;
713
714 memcpy(cap[h->index], key->data.u.str.area, len);
715 cap[h->index][len] = 0;
716
717 end:
718 return ACT_RET_CONT;
719}
720
Christopher Fauletadfc6e82020-01-14 15:05:33 +0100721static void release_tcp_capture(struct act_rule * rule)
722{
723 release_sample_expr(rule->arg.cap.expr);
724}
725
726
727static void release_tcp_track_sc(struct act_rule * rule)
728{
729 release_sample_expr(rule->arg.trk_ctr.expr);
730}
731
Willy Tarreau39713102016-11-25 15:49:32 +0100732/* Parse a tcp-request rule. Return a negative value in case of failure */
733static int tcp_parse_request_rule(char **args, int arg, int section_type,
734 struct proxy *curpx, struct proxy *defpx,
735 struct act_rule *rule, char **err,
736 unsigned int where, const char *file, int line)
737{
738 if (curpx == defpx) {
739 memprintf(err, "%s %s is not allowed in 'defaults' sections",
740 args[0], args[1]);
741 return -1;
742 }
743
744 if (!strcmp(args[arg], "accept")) {
745 arg++;
746 rule->action = ACT_ACTION_ALLOW;
Christopher Faulet245cf792019-12-18 14:58:12 +0100747 rule->flags |= ACT_FLAG_FINAL;
Willy Tarreau39713102016-11-25 15:49:32 +0100748 }
749 else if (!strcmp(args[arg], "reject")) {
750 arg++;
751 rule->action = ACT_ACTION_DENY;
Christopher Faulet245cf792019-12-18 14:58:12 +0100752 rule->flags |= ACT_FLAG_FINAL;
Willy Tarreau39713102016-11-25 15:49:32 +0100753 }
754 else if (strcmp(args[arg], "capture") == 0) {
755 struct sample_expr *expr;
756 struct cap_hdr *hdr;
757 int kw = arg;
758 int len = 0;
759
760 if (!(curpx->cap & PR_CAP_FE)) {
761 memprintf(err,
762 "'%s %s %s' : proxy '%s' has no frontend capability",
763 args[0], args[1], args[kw], curpx->id);
764 return -1;
765 }
766
767 if (!(where & SMP_VAL_FE_REQ_CNT)) {
768 memprintf(err,
769 "'%s %s' is not allowed in '%s %s' rules in %s '%s'",
770 args[arg], args[arg+1], args[0], args[1], proxy_type_str(curpx), curpx->id);
771 return -1;
772 }
773
774 arg++;
775
776 curpx->conf.args.ctx = ARGC_CAP;
Willy Tarreaue3b57bf2020-02-14 16:50:14 +0100777 expr = sample_parse_expr(args, &arg, file, line, err, &curpx->conf.args, NULL);
Willy Tarreau39713102016-11-25 15:49:32 +0100778 if (!expr) {
779 memprintf(err,
780 "'%s %s %s' : %s",
781 args[0], args[1], args[kw], *err);
782 return -1;
783 }
784
785 if (!(expr->fetch->val & where)) {
786 memprintf(err,
787 "'%s %s %s' : fetch method '%s' extracts information from '%s', none of which is available here",
788 args[0], args[1], args[kw], args[arg-1], sample_src_names(expr->fetch->use));
Christopher Fauletfdb6fbf2020-01-14 15:05:56 +0100789 release_sample_expr(expr);
Willy Tarreau39713102016-11-25 15:49:32 +0100790 return -1;
791 }
792
793 if (strcmp(args[arg], "len") == 0) {
794 arg++;
795 if (!args[arg]) {
796 memprintf(err,
797 "'%s %s %s' : missing length value",
798 args[0], args[1], args[kw]);
Christopher Fauletfdb6fbf2020-01-14 15:05:56 +0100799 release_sample_expr(expr);
Willy Tarreau39713102016-11-25 15:49:32 +0100800 return -1;
801 }
802 /* we copy the table name for now, it will be resolved later */
803 len = atoi(args[arg]);
804 if (len <= 0) {
805 memprintf(err,
806 "'%s %s %s' : length must be > 0",
807 args[0], args[1], args[kw]);
Christopher Fauletfdb6fbf2020-01-14 15:05:56 +0100808 release_sample_expr(expr);
Willy Tarreau39713102016-11-25 15:49:32 +0100809 return -1;
810 }
811 arg++;
812 }
813
814 if (!len) {
815 memprintf(err,
816 "'%s %s %s' : a positive 'len' argument is mandatory",
817 args[0], args[1], args[kw]);
818 free(expr);
819 return -1;
820 }
821
822 hdr = calloc(1, sizeof(*hdr));
Remi Tricot-Le Bretond9bb0522021-05-17 10:08:16 +0200823 if (!hdr) {
824 memprintf(err, "parsing [%s:%d] : out of memory", file, line);
825 release_sample_expr(expr);
826 return -1;
827 }
Willy Tarreau39713102016-11-25 15:49:32 +0100828 hdr->next = curpx->req_cap;
829 hdr->name = NULL; /* not a header capture */
830 hdr->namelen = 0;
831 hdr->len = len;
832 hdr->pool = create_pool("caphdr", hdr->len + 1, MEM_F_SHARED);
833 hdr->index = curpx->nb_req_cap++;
834
835 curpx->req_cap = hdr;
836 curpx->to_log |= LW_REQHDR;
837
Christopher Faulet711ed6a2019-07-16 14:16:10 +0200838 /* check if we need to allocate an http_txn struct for HTTP parsing */
Willy Tarreau39713102016-11-25 15:49:32 +0100839 curpx->http_needed |= !!(expr->fetch->use & SMP_USE_HTTP_ANY);
840
841 rule->arg.cap.expr = expr;
842 rule->arg.cap.hdr = hdr;
Christopher Fauletd73b96d2019-12-19 17:27:03 +0100843 rule->action = ACT_CUSTOM;
844 rule->action_ptr = tcp_action_capture;
845 rule->check_ptr = check_capture;
Christopher Fauletadfc6e82020-01-14 15:05:33 +0100846 rule->release_ptr = release_tcp_capture;
Willy Tarreau39713102016-11-25 15:49:32 +0100847 }
Frédéric Lécaillea41d5312018-01-29 12:05:07 +0100848 else if (strncmp(args[arg], "track-sc", 8) == 0) {
Willy Tarreau39713102016-11-25 15:49:32 +0100849 struct sample_expr *expr;
850 int kw = arg;
Frédéric Lécaillea41d5312018-01-29 12:05:07 +0100851 unsigned int tsc_num;
852 const char *tsc_num_str;
Willy Tarreau39713102016-11-25 15:49:32 +0100853
854 arg++;
855
Frédéric Lécaillea41d5312018-01-29 12:05:07 +0100856 tsc_num_str = &args[kw][8];
857 if (cfg_parse_track_sc_num(&tsc_num, tsc_num_str, tsc_num_str + strlen(tsc_num_str), err) == -1) {
858 memprintf(err, "'%s %s %s' : %s", args[0], args[1], args[kw], *err);
859 return -1;
860 }
861
Willy Tarreau39713102016-11-25 15:49:32 +0100862 curpx->conf.args.ctx = ARGC_TRK;
Willy Tarreaue3b57bf2020-02-14 16:50:14 +0100863 expr = sample_parse_expr(args, &arg, file, line, err, &curpx->conf.args, NULL);
Willy Tarreau39713102016-11-25 15:49:32 +0100864 if (!expr) {
865 memprintf(err,
866 "'%s %s %s' : %s",
867 args[0], args[1], args[kw], *err);
868 return -1;
869 }
870
871 if (!(expr->fetch->val & where)) {
872 memprintf(err,
873 "'%s %s %s' : fetch method '%s' extracts information from '%s', none of which is available here",
874 args[0], args[1], args[kw], args[arg-1], sample_src_names(expr->fetch->use));
Christopher Fauletfdb6fbf2020-01-14 15:05:56 +0100875 release_sample_expr(expr);
Willy Tarreau39713102016-11-25 15:49:32 +0100876 return -1;
877 }
878
Christopher Faulet711ed6a2019-07-16 14:16:10 +0200879 /* check if we need to allocate an http_txn struct for HTTP parsing */
Willy Tarreau39713102016-11-25 15:49:32 +0100880 curpx->http_needed |= !!(expr->fetch->use & SMP_USE_HTTP_ANY);
881
882 if (strcmp(args[arg], "table") == 0) {
883 arg++;
884 if (!args[arg]) {
885 memprintf(err,
886 "'%s %s %s' : missing table name",
887 args[0], args[1], args[kw]);
Christopher Fauletfdb6fbf2020-01-14 15:05:56 +0100888 release_sample_expr(expr);
Willy Tarreau39713102016-11-25 15:49:32 +0100889 return -1;
890 }
891 /* we copy the table name for now, it will be resolved later */
892 rule->arg.trk_ctr.table.n = strdup(args[arg]);
893 arg++;
894 }
Christopher Fauletac98d812019-12-18 09:20:16 +0100895 rule->action = tsc_num;
Willy Tarreau39713102016-11-25 15:49:32 +0100896 rule->arg.trk_ctr.expr = expr;
Christopher Fauletac98d812019-12-18 09:20:16 +0100897 rule->action_ptr = tcp_action_track_sc;
Christopher Faulet78880fb2017-09-18 14:43:55 +0200898 rule->check_ptr = check_trk_action;
Christopher Fauletadfc6e82020-01-14 15:05:33 +0100899 rule->release_ptr = release_tcp_track_sc;
Willy Tarreau39713102016-11-25 15:49:32 +0100900 }
901 else if (strcmp(args[arg], "expect-proxy") == 0) {
902 if (strcmp(args[arg+1], "layer4") != 0) {
903 memprintf(err,
904 "'%s %s %s' only supports 'layer4' in %s '%s' (got '%s')",
905 args[0], args[1], args[arg], proxy_type_str(curpx), curpx->id, args[arg+1]);
906 return -1;
907 }
908
909 if (!(where & SMP_VAL_FE_CON_ACC)) {
910 memprintf(err,
911 "'%s %s' is not allowed in '%s %s' rules in %s '%s'",
912 args[arg], args[arg+1], args[0], args[1], proxy_type_str(curpx), curpx->id);
913 return -1;
914 }
915
916 arg += 2;
917 rule->action = ACT_TCP_EXPECT_PX;
918 }
919 else if (strcmp(args[arg], "expect-netscaler-cip") == 0) {
920 if (strcmp(args[arg+1], "layer4") != 0) {
921 memprintf(err,
922 "'%s %s %s' only supports 'layer4' in %s '%s' (got '%s')",
923 args[0], args[1], args[arg], proxy_type_str(curpx), curpx->id, args[arg+1]);
924 return -1;
925 }
926
927 if (!(where & SMP_VAL_FE_CON_ACC)) {
928 memprintf(err,
929 "'%s %s' is not allowed in '%s %s' rules in %s '%s'",
930 args[arg], args[arg+1], args[0], args[1], proxy_type_str(curpx), curpx->id);
931 return -1;
932 }
933
934 arg += 2;
935 rule->action = ACT_TCP_EXPECT_CIP;
936 }
937 else {
938 struct action_kw *kw;
939 if (where & SMP_VAL_FE_CON_ACC) {
940 /* L4 */
941 kw = tcp_req_conn_action(args[arg]);
942 rule->kw = kw;
Willy Tarreau39713102016-11-25 15:49:32 +0100943 } else if (where & SMP_VAL_FE_SES_ACC) {
944 /* L5 */
945 kw = tcp_req_sess_action(args[arg]);
946 rule->kw = kw;
Willy Tarreau39713102016-11-25 15:49:32 +0100947 } else {
948 /* L6 */
949 kw = tcp_req_cont_action(args[arg]);
950 rule->kw = kw;
Willy Tarreau39713102016-11-25 15:49:32 +0100951 }
952 if (kw) {
953 arg++;
954 if (kw->parse((const char **)args, &arg, curpx, rule, err) == ACT_RET_PRS_ERR)
955 return -1;
956 } else {
957 if (where & SMP_VAL_FE_CON_ACC)
958 action_build_list(&tcp_req_conn_keywords, &trash);
959 else if (where & SMP_VAL_FE_SES_ACC)
960 action_build_list(&tcp_req_sess_keywords, &trash);
961 else
962 action_build_list(&tcp_req_cont_keywords, &trash);
963 memprintf(err,
Willy Tarreau58348482021-03-12 13:42:43 +0100964 "'%s %s' expects 'accept', 'reject', 'capture', 'expect-proxy', 'expect-netscaler-ip', 'track-sc0' ... 'track-sc%d', %s "
Willy Tarreau39713102016-11-25 15:49:32 +0100965 "in %s '%s' (got '%s').\n",
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200966 args[0], args[1], MAX_SESS_STKCTR-1,
967 trash.area, proxy_type_str(curpx),
Willy Tarreau39713102016-11-25 15:49:32 +0100968 curpx->id, args[arg]);
969 return -1;
970 }
971 }
972
973 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
Christopher Faulet1b421ea2017-09-22 14:38:56 +0200974 if ((rule->cond = build_acl_cond(file, line, &curpx->acl, curpx, (const char **)args+arg, err)) == NULL) {
Willy Tarreau39713102016-11-25 15:49:32 +0100975 memprintf(err,
976 "'%s %s %s' : error detected in %s '%s' while parsing '%s' condition : %s",
977 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg], *err);
978 return -1;
979 }
980 }
981 else if (*args[arg]) {
982 memprintf(err,
983 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (got '%s')",
984 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
985 return -1;
986 }
987 return 0;
988}
989
990/* This function should be called to parse a line starting with the "tcp-response"
991 * keyword.
992 */
993static int tcp_parse_tcp_rep(char **args, int section_type, struct proxy *curpx,
994 struct proxy *defpx, const char *file, int line,
995 char **err)
996{
997 const char *ptr = NULL;
998 unsigned int val;
999 int warn = 0;
1000 int arg;
1001 struct act_rule *rule;
1002 unsigned int where;
1003 const struct acl *acl;
1004 const char *kw;
1005
1006 if (!*args[1]) {
1007 memprintf(err, "missing argument for '%s' in %s '%s'",
1008 args[0], proxy_type_str(curpx), curpx->id);
1009 return -1;
1010 }
1011
1012 if (strcmp(args[1], "inspect-delay") == 0) {
1013 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
1014 memprintf(err, "%s %s is only allowed in 'backend' sections",
1015 args[0], args[1]);
1016 return -1;
1017 }
1018
1019 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
1020 memprintf(err,
1021 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
1022 args[0], args[1], proxy_type_str(curpx), curpx->id);
Willy Tarreau9faebe32019-06-07 19:00:37 +02001023
1024 if (ptr == PARSE_TIME_OVER)
1025 memprintf(err, "%s (timer overflow in '%s', maximum value is 2147483647 ms or ~24.8 days)", *err, args[2]);
1026 else if (ptr == PARSE_TIME_UNDER)
1027 memprintf(err, "%s (timer underflow in '%s', minimum non-null value is 1 ms)", *err, args[2]);
1028 else if (ptr)
Willy Tarreau39713102016-11-25 15:49:32 +01001029 memprintf(err, "%s (unexpected character '%c')", *err, *ptr);
1030 return -1;
1031 }
1032
1033 if (curpx->tcp_rep.inspect_delay) {
1034 memprintf(err, "ignoring %s %s (was already defined) in %s '%s'",
1035 args[0], args[1], proxy_type_str(curpx), curpx->id);
1036 return 1;
1037 }
1038 curpx->tcp_rep.inspect_delay = val;
1039 return 0;
1040 }
1041
1042 rule = calloc(1, sizeof(*rule));
Remi Tricot-Le Bretoneb267922021-05-12 18:24:18 +02001043 if (!rule) {
1044 memprintf(err, "parsing [%s:%d] : out of memory", file, line);
1045 return -1;
1046 }
Willy Tarreau39713102016-11-25 15:49:32 +01001047 LIST_INIT(&rule->list);
1048 arg = 1;
1049 where = 0;
1050
1051 if (strcmp(args[1], "content") == 0) {
1052 arg++;
1053
1054 if (curpx->cap & PR_CAP_FE)
1055 where |= SMP_VAL_FE_RES_CNT;
1056 if (curpx->cap & PR_CAP_BE)
1057 where |= SMP_VAL_BE_RES_CNT;
Christopher Fauletcb9106b2019-12-19 15:23:17 +01001058 rule->from = ACT_F_TCP_RES_CNT;
Willy Tarreau39713102016-11-25 15:49:32 +01001059 if (tcp_parse_response_rule(args, arg, section_type, curpx, defpx, rule, err, where, file, line) < 0)
1060 goto error;
1061
1062 acl = rule->cond ? acl_cond_conflicts(rule->cond, where) : NULL;
1063 if (acl) {
1064 if (acl->name && *acl->name)
1065 memprintf(err,
1066 "acl '%s' will never match in '%s %s' because it only involves keywords that are incompatible with '%s'",
1067 acl->name, args[0], args[1], sample_ckp_names(where));
1068 else
1069 memprintf(err,
1070 "anonymous acl will never match in '%s %s' because it uses keyword '%s' which is incompatible with '%s'",
1071 args[0], args[1],
1072 LIST_ELEM(acl->expr.n, struct acl_expr *, list)->kw,
1073 sample_ckp_names(where));
1074
1075 warn++;
1076 }
1077 else if (rule->cond && acl_cond_kw_conflicts(rule->cond, where, &acl, &kw)) {
1078 if (acl->name && *acl->name)
1079 memprintf(err,
1080 "acl '%s' involves keyword '%s' which is incompatible with '%s'",
1081 acl->name, kw, sample_ckp_names(where));
1082 else
1083 memprintf(err,
1084 "anonymous acl involves keyword '%s' which is incompatible with '%s'",
1085 kw, sample_ckp_names(where));
1086 warn++;
1087 }
1088
1089 LIST_ADDQ(&curpx->tcp_rep.inspect_rules, &rule->list);
1090 }
1091 else {
1092 memprintf(err,
1093 "'%s' expects 'inspect-delay' or 'content' in %s '%s' (got '%s')",
1094 args[0], proxy_type_str(curpx), curpx->id, args[1]);
1095 goto error;
1096 }
1097
1098 return warn;
1099 error:
1100 free(rule);
1101 return -1;
1102}
1103
1104
1105/* This function should be called to parse a line starting with the "tcp-request"
1106 * keyword.
1107 */
1108static int tcp_parse_tcp_req(char **args, int section_type, struct proxy *curpx,
1109 struct proxy *defpx, const char *file, int line,
1110 char **err)
1111{
1112 const char *ptr = NULL;
1113 unsigned int val;
1114 int warn = 0;
1115 int arg;
1116 struct act_rule *rule;
1117 unsigned int where;
1118 const struct acl *acl;
1119 const char *kw;
1120
1121 if (!*args[1]) {
1122 if (curpx == defpx)
1123 memprintf(err, "missing argument for '%s' in defaults section", args[0]);
1124 else
1125 memprintf(err, "missing argument for '%s' in %s '%s'",
1126 args[0], proxy_type_str(curpx), curpx->id);
1127 return -1;
1128 }
1129
1130 if (!strcmp(args[1], "inspect-delay")) {
1131 if (curpx == defpx) {
1132 memprintf(err, "%s %s is not allowed in 'defaults' sections",
1133 args[0], args[1]);
1134 return -1;
1135 }
1136
1137 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
1138 memprintf(err,
1139 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
1140 args[0], args[1], proxy_type_str(curpx), curpx->id);
Willy Tarreau9faebe32019-06-07 19:00:37 +02001141
1142 if (ptr == PARSE_TIME_OVER)
1143 memprintf(err, "%s (timer overflow in '%s', maximum value is 2147483647 ms or ~24.8 days)", *err, args[2]);
1144 else if (ptr == PARSE_TIME_UNDER)
1145 memprintf(err, "%s (timer underflow in '%s', minimum non-null value is 1 ms)", *err, args[2]);
1146 else if (ptr)
Willy Tarreau39713102016-11-25 15:49:32 +01001147 memprintf(err, "%s (unexpected character '%c')", *err, *ptr);
1148 return -1;
1149 }
1150
1151 if (curpx->tcp_req.inspect_delay) {
1152 memprintf(err, "ignoring %s %s (was already defined) in %s '%s'",
1153 args[0], args[1], proxy_type_str(curpx), curpx->id);
1154 return 1;
1155 }
1156 curpx->tcp_req.inspect_delay = val;
1157 return 0;
1158 }
1159
1160 rule = calloc(1, sizeof(*rule));
Remi Tricot-Le Bretoneb267922021-05-12 18:24:18 +02001161 if (!rule) {
1162 memprintf(err, "parsing [%s:%d] : out of memory", file, line);
1163 return -1;
1164 }
Willy Tarreau39713102016-11-25 15:49:32 +01001165 LIST_INIT(&rule->list);
1166 arg = 1;
1167 where = 0;
1168
1169 if (strcmp(args[1], "content") == 0) {
1170 arg++;
1171
1172 if (curpx->cap & PR_CAP_FE)
1173 where |= SMP_VAL_FE_REQ_CNT;
1174 if (curpx->cap & PR_CAP_BE)
1175 where |= SMP_VAL_BE_REQ_CNT;
Christopher Fauletcb9106b2019-12-19 15:23:17 +01001176 rule->from = ACT_F_TCP_REQ_CNT;
Willy Tarreau39713102016-11-25 15:49:32 +01001177 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, where, file, line) < 0)
1178 goto error;
1179
1180 acl = rule->cond ? acl_cond_conflicts(rule->cond, where) : NULL;
1181 if (acl) {
1182 if (acl->name && *acl->name)
1183 memprintf(err,
1184 "acl '%s' will never match in '%s %s' because it only involves keywords that are incompatible with '%s'",
1185 acl->name, args[0], args[1], sample_ckp_names(where));
1186 else
1187 memprintf(err,
1188 "anonymous acl will never match in '%s %s' because it uses keyword '%s' which is incompatible with '%s'",
1189 args[0], args[1],
1190 LIST_ELEM(acl->expr.n, struct acl_expr *, list)->kw,
1191 sample_ckp_names(where));
1192
1193 warn++;
1194 }
1195 else if (rule->cond && acl_cond_kw_conflicts(rule->cond, where, &acl, &kw)) {
1196 if (acl->name && *acl->name)
1197 memprintf(err,
1198 "acl '%s' involves keyword '%s' which is incompatible with '%s'",
1199 acl->name, kw, sample_ckp_names(where));
1200 else
1201 memprintf(err,
1202 "anonymous acl involves keyword '%s' which is incompatible with '%s'",
1203 kw, sample_ckp_names(where));
1204 warn++;
1205 }
1206
1207 /* the following function directly emits the warning */
1208 warnif_misplaced_tcp_cont(curpx, file, line, args[0]);
1209 LIST_ADDQ(&curpx->tcp_req.inspect_rules, &rule->list);
1210 }
1211 else if (strcmp(args[1], "connection") == 0) {
1212 arg++;
1213
1214 if (!(curpx->cap & PR_CAP_FE)) {
1215 memprintf(err, "%s %s is not allowed because %s %s is not a frontend",
1216 args[0], args[1], proxy_type_str(curpx), curpx->id);
1217 goto error;
1218 }
1219
1220 where |= SMP_VAL_FE_CON_ACC;
Christopher Fauletcb9106b2019-12-19 15:23:17 +01001221 rule->from = ACT_F_TCP_REQ_CON;
Willy Tarreau39713102016-11-25 15:49:32 +01001222 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, where, file, line) < 0)
1223 goto error;
1224
1225 acl = rule->cond ? acl_cond_conflicts(rule->cond, where) : NULL;
1226 if (acl) {
1227 if (acl->name && *acl->name)
1228 memprintf(err,
1229 "acl '%s' will never match in '%s %s' because it only involves keywords that are incompatible with '%s'",
1230 acl->name, args[0], args[1], sample_ckp_names(where));
1231 else
1232 memprintf(err,
1233 "anonymous acl will never match in '%s %s' because it uses keyword '%s' which is incompatible with '%s'",
1234 args[0], args[1],
1235 LIST_ELEM(acl->expr.n, struct acl_expr *, list)->kw,
1236 sample_ckp_names(where));
1237
1238 warn++;
1239 }
1240 else if (rule->cond && acl_cond_kw_conflicts(rule->cond, where, &acl, &kw)) {
1241 if (acl->name && *acl->name)
1242 memprintf(err,
1243 "acl '%s' involves keyword '%s' which is incompatible with '%s'",
1244 acl->name, kw, sample_ckp_names(where));
1245 else
1246 memprintf(err,
1247 "anonymous acl involves keyword '%s' which is incompatible with '%s'",
1248 kw, sample_ckp_names(where));
1249 warn++;
1250 }
1251
1252 /* the following function directly emits the warning */
1253 warnif_misplaced_tcp_conn(curpx, file, line, args[0]);
1254 LIST_ADDQ(&curpx->tcp_req.l4_rules, &rule->list);
1255 }
1256 else if (strcmp(args[1], "session") == 0) {
1257 arg++;
1258
1259 if (!(curpx->cap & PR_CAP_FE)) {
1260 memprintf(err, "%s %s is not allowed because %s %s is not a frontend",
1261 args[0], args[1], proxy_type_str(curpx), curpx->id);
1262 goto error;
1263 }
1264
1265 where |= SMP_VAL_FE_SES_ACC;
Christopher Fauletcb9106b2019-12-19 15:23:17 +01001266 rule->from = ACT_F_TCP_REQ_SES;
Willy Tarreau39713102016-11-25 15:49:32 +01001267 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, where, file, line) < 0)
1268 goto error;
1269
1270 acl = rule->cond ? acl_cond_conflicts(rule->cond, where) : NULL;
1271 if (acl) {
1272 if (acl->name && *acl->name)
1273 memprintf(err,
1274 "acl '%s' will never match in '%s %s' because it only involves keywords that are incompatible with '%s'",
1275 acl->name, args[0], args[1], sample_ckp_names(where));
1276 else
1277 memprintf(err,
1278 "anonymous acl will never match in '%s %s' because it uses keyword '%s' which is incompatible with '%s'",
1279 args[0], args[1],
1280 LIST_ELEM(acl->expr.n, struct acl_expr *, list)->kw,
1281 sample_ckp_names(where));
1282 warn++;
1283 }
1284 else if (rule->cond && acl_cond_kw_conflicts(rule->cond, where, &acl, &kw)) {
1285 if (acl->name && *acl->name)
1286 memprintf(err,
1287 "acl '%s' involves keyword '%s' which is incompatible with '%s'",
1288 acl->name, kw, sample_ckp_names(where));
1289 else
1290 memprintf(err,
1291 "anonymous acl involves keyword '%s' which is incompatible with '%s'",
1292 kw, sample_ckp_names(where));
1293 warn++;
1294 }
1295
1296 /* the following function directly emits the warning */
1297 warnif_misplaced_tcp_sess(curpx, file, line, args[0]);
1298 LIST_ADDQ(&curpx->tcp_req.l5_rules, &rule->list);
1299 }
1300 else {
1301 if (curpx == defpx)
1302 memprintf(err,
1303 "'%s' expects 'inspect-delay', 'connection', or 'content' in defaults section (got '%s')",
1304 args[0], args[1]);
1305 else
1306 memprintf(err,
1307 "'%s' expects 'inspect-delay', 'connection', or 'content' in %s '%s' (got '%s')",
1308 args[0], proxy_type_str(curpx), curpx->id, args[1]);
1309 goto error;
1310 }
1311
1312 return warn;
1313 error:
1314 free(rule);
1315 return -1;
1316}
1317
1318static struct cfg_kw_list cfg_kws = {ILH, {
1319 { CFG_LISTEN, "tcp-request", tcp_parse_tcp_req },
1320 { CFG_LISTEN, "tcp-response", tcp_parse_tcp_rep },
1321 { 0, NULL, NULL },
1322}};
1323
Willy Tarreau0108d902018-11-25 19:14:37 +01001324INITCALL1(STG_REGISTER, cfg_register_keywords, &cfg_kws);
Willy Tarreau39713102016-11-25 15:49:32 +01001325
1326/*
1327 * Local variables:
1328 * c-indent-level: 8
1329 * c-basic-offset: 8
1330 * End:
1331 */