blob: c1ec2664e48c06a08b80956786202265c4d6a15d [file] [log] [blame]
Willy Tarreau59f98392012-07-06 14:13:49 +02001/*
2 * Connection management functions
3 *
4 * Copyright 2000-2012 Willy Tarreau <w@1wt.eu>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
Willy Tarreaue1e4a612012-10-05 00:10:55 +020013#include <errno.h>
14
Willy Tarreau59f98392012-07-06 14:13:49 +020015#include <common/compat.h>
16#include <common/config.h>
Willy Tarreau0108d902018-11-25 19:14:37 +010017#include <common/initcall.h>
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +010018#include <common/namespace.h>
Emmanuel Hocdet4399c752018-02-05 15:26:43 +010019#include <common/hash.h>
20#include <common/net_helper.h>
Willy Tarreau59f98392012-07-06 14:13:49 +020021
Willy Tarreauc5788912012-08-24 18:12:41 +020022#include <proto/connection.h>
Willy Tarreaudd2f85e2012-09-02 22:34:23 +020023#include <proto/fd.h>
Willy Tarreau5f1504f2012-10-04 23:55:57 +020024#include <proto/frontend.h>
Willy Tarreau2da156f2012-07-23 15:07:23 +020025#include <proto/proto_tcp.h>
Willy Tarreau2c6be842012-07-06 17:12:34 +020026#include <proto/stream_interface.h>
Emeric Brun4f603012017-01-05 15:11:44 +010027#include <proto/sample.h>
Emeric Brun46591952012-05-18 15:47:34 +020028#include <proto/ssl_sock.h>
Emeric Brun46591952012-05-18 15:47:34 +020029
Alexander Liu2a54bb72019-05-22 19:44:48 +080030#include <common/debug.h>
31
Willy Tarreau8ceae722018-11-26 11:58:30 +010032DECLARE_POOL(pool_head_connection, "connection", sizeof(struct connection));
33DECLARE_POOL(pool_head_connstream, "conn_stream", sizeof(struct conn_stream));
Willy Tarreauff5d57b2019-07-17 18:37:02 +020034DECLARE_POOL(pool_head_sockaddr, "sockaddr", sizeof(struct sockaddr_storage));
Geoff Simmons7185b782019-08-27 18:31:16 +020035DECLARE_POOL(pool_head_authority, "authority", PP2_AUTHORITY_MAX);
Willy Tarreau8ceae722018-11-26 11:58:30 +010036
Willy Tarreau13e14102016-12-22 20:25:26 +010037struct xprt_ops *registered_xprt[XPRT_ENTRIES] = { NULL, };
Willy Tarreauf2943dc2012-10-26 20:10:28 +020038
Christopher Faulet32f61c02018-04-10 14:33:41 +020039/* List head of all known muxes for PROTO */
40struct mux_proto_list mux_proto_list = {
41 .list = LIST_HEAD_INIT(mux_proto_list.list)
Willy Tarreau2386be62017-09-21 19:40:52 +020042};
43
Olivier Houchard477902b2020-01-22 18:08:48 +010044int conn_create_mux(struct connection *conn)
45{
Olivier Houchard477902b2020-01-22 18:08:48 +010046 if (conn_is_back(conn)) {
47 struct server *srv;
48 struct conn_stream *cs = conn->ctx;
49
50 if (conn->flags & CO_FL_ERROR)
51 goto fail;
Olivier Houcharda8a415d2020-01-23 13:15:14 +010052
Olivier Houchard477902b2020-01-22 18:08:48 +010053 if (conn_install_mux_be(conn, conn->ctx, conn->owner) < 0)
54 goto fail;
55 srv = objt_server(conn->target);
56 if (srv && ((srv->proxy->options & PR_O_REUSE_MASK) != PR_O_REUSE_NEVR) &&
57 conn->mux->avail_streams(conn) > 0)
58 LIST_ADD(&srv->idle_conns[tid], &conn->list);
59 return 0;
60fail:
61 /* let the upper layer know the connection failed */
62 cs->data_cb->wake(cs);
63 return -1;
64 } else
65 return conn_complete_session(conn);
66
67}
68
Willy Tarreau59f98392012-07-06 14:13:49 +020069/* I/O callback for fd-based connections. It calls the read/write handlers
Willy Tarreau7a798e52016-04-14 11:13:20 +020070 * provided by the connection's sock_ops, which must be valid.
Willy Tarreau59f98392012-07-06 14:13:49 +020071 */
Willy Tarreau7a798e52016-04-14 11:13:20 +020072void conn_fd_handler(int fd)
Willy Tarreau59f98392012-07-06 14:13:49 +020073{
Willy Tarreau80184712012-07-06 14:54:49 +020074 struct connection *conn = fdtab[fd].owner;
Willy Tarreau9e272bf2012-10-03 21:04:48 +020075 unsigned int flags;
Willy Tarreau8de5c4f2020-03-04 17:45:21 +010076 int need_wake = 0;
Willy Tarreau59f98392012-07-06 14:13:49 +020077
Willy Tarreaud80cb4e2018-01-20 19:30:13 +010078 if (unlikely(!conn)) {
79 activity[tid].conn_dead++;
Willy Tarreau7a798e52016-04-14 11:13:20 +020080 return;
Willy Tarreaud80cb4e2018-01-20 19:30:13 +010081 }
Willy Tarreau59f98392012-07-06 14:13:49 +020082
Willy Tarreau7d281492012-12-16 19:19:13 +010083 flags = conn->flags & ~CO_FL_ERROR; /* ensure to call the wake handler upon error */
Willy Tarreaud29a0662012-12-10 16:33:38 +010084
Willy Tarreaub2a7ab02019-12-27 10:54:22 +010085 if (unlikely(conn->flags & CO_FL_WAIT_L4_CONN) &&
86 ((fd_send_ready(fd) && fd_send_active(fd)) ||
87 (fd_recv_ready(fd) && fd_recv_active(fd)))) {
88 /* Still waiting for a connection to establish and nothing was
89 * attempted yet to probe the connection. this will clear the
90 * CO_FL_WAIT_L4_CONN flag on success.
91 */
92 if (!conn_fd_check(conn))
93 goto leave;
Willy Tarreau8de5c4f2020-03-04 17:45:21 +010094 need_wake = 1;
Willy Tarreaub2a7ab02019-12-27 10:54:22 +010095 }
96
Willy Tarreau8081abe2019-11-28 18:08:49 +010097 if (fd_send_ready(fd) && fd_send_active(fd)) {
Willy Tarreau3c0cc492017-03-19 07:54:28 +010098 /* force reporting of activity by clearing the previous flags :
99 * we'll have at least ERROR or CONNECTED at the end of an I/O,
100 * both of which will be detected below.
Willy Tarreau9e272bf2012-10-03 21:04:48 +0200101 */
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100102 flags = 0;
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100103 if (conn->subs && conn->subs->events & SUB_RETRY_SEND) {
Willy Tarreau8de5c4f2020-03-04 17:45:21 +0100104 need_wake = 0; // wake will be called after this I/O
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100105 tasklet_wakeup(conn->subs->tasklet);
106 conn->subs->events &= ~SUB_RETRY_SEND;
107 if (!conn->subs->events)
108 conn->subs = NULL;
Willy Tarreau8de5c4f2020-03-04 17:45:21 +0100109 }
Willy Tarreau667fefd2020-03-04 17:22:10 +0100110 fd_stop_send(fd);
Willy Tarreau9e272bf2012-10-03 21:04:48 +0200111 }
Willy Tarreau59f98392012-07-06 14:13:49 +0200112
Willy Tarreau57ec32f2017-04-11 19:59:33 +0200113 /* The data transfer starts here and stops on error and handshakes. Note
114 * that we must absolutely test conn->xprt at each step in case it suddenly
115 * changes due to a quick unexpected close().
116 */
Willy Tarreau8081abe2019-11-28 18:08:49 +0100117 if (fd_recv_ready(fd) && fd_recv_active(fd)) {
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100118 /* force reporting of activity by clearing the previous flags :
119 * we'll have at least ERROR or CONNECTED at the end of an I/O,
120 * both of which will be detected below.
Willy Tarreau9e272bf2012-10-03 21:04:48 +0200121 */
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100122 flags = 0;
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100123 if (conn->subs && conn->subs->events & SUB_RETRY_RECV) {
Willy Tarreau8de5c4f2020-03-04 17:45:21 +0100124 need_wake = 0; // wake will be called after this I/O
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100125 tasklet_wakeup(conn->subs->tasklet);
126 conn->subs->events &= ~SUB_RETRY_RECV;
127 if (!conn->subs->events)
128 conn->subs = NULL;
Willy Tarreau8de5c4f2020-03-04 17:45:21 +0100129 }
Willy Tarreau6f95f6e2020-03-04 18:33:19 +0100130 else if (tasks_run_queue_cur >= 16*global.tune.runqueue_depth) {
131 /* In order to save syscalls especially with epoll, we
132 * prefer *not* to disable receiving and instead let
133 * the handler do its job. But if the run queue becomes
134 * high, the excess of events may cause extra wakeups
135 * and in this case we'd rather flow-control ourselves.
136 */
137 fd_stop_recv(fd);
138 }
Willy Tarreau9e272bf2012-10-03 21:04:48 +0200139 }
Willy Tarreau2da156f2012-07-23 15:07:23 +0200140
Willy Tarreau2c6be842012-07-06 17:12:34 +0200141 leave:
Olivier Houchard477902b2020-01-22 18:08:48 +0100142 /* If we don't yet have a mux, that means we were waiting for
143 * informations to create one, typically from the ALPN. If we're
144 * done with the handshake, attempt to create one.
Willy Tarreau8e3c6ce2017-08-28 15:46:01 +0200145 */
Willy Tarreau911db9b2020-01-23 16:27:54 +0100146 if (unlikely(!conn->mux) && !(conn->flags & CO_FL_WAIT_XPRT))
Olivier Houchard477902b2020-01-22 18:08:48 +0100147 if (conn_create_mux(conn) < 0)
148 return;
Willy Tarreau8e3c6ce2017-08-28 15:46:01 +0200149
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100150 /* The wake callback is normally used to notify the data layer about
151 * data layer activity (successful send/recv), connection establishment,
152 * shutdown and fatal errors. We need to consider the following
153 * situations to wake up the data layer :
Willy Tarreau0fbc3182019-12-27 14:57:45 +0100154 * - change among the CO_FL_NOTIFY_DONE flags :
155 * SOCK_{RD,WR}_SH, ERROR,
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100156 * - absence of any of {L4,L6}_CONN and CONNECTED, indicating the
157 * end of handshake and transition to CONNECTED
158 * - raise of CONNECTED with HANDSHAKE down
159 * - end of HANDSHAKE with CONNECTED set
160 * - regular data layer activity
161 *
162 * Note that the wake callback is allowed to release the connection and
163 * the fd (and return < 0 in this case).
Willy Tarreau2396c1c2012-10-03 21:12:16 +0200164 */
Willy Tarreau8de5c4f2020-03-04 17:45:21 +0100165 if ((need_wake || ((conn->flags ^ flags) & CO_FL_NOTIFY_DONE) ||
Willy Tarreau911db9b2020-01-23 16:27:54 +0100166 ((flags & CO_FL_WAIT_XPRT) && !(conn->flags & CO_FL_WAIT_XPRT))) &&
Olivier Houchardfe50bfb2019-05-27 12:09:19 +0200167 conn->mux && conn->mux->wake && conn->mux->wake(conn) < 0)
Willy Tarreau7a798e52016-04-14 11:13:20 +0200168 return;
Willy Tarreaufd31e532012-07-23 18:24:25 +0200169
Willy Tarreauf9dabec2012-08-17 17:33:53 +0200170 /* commit polling changes */
171 conn_cond_update_polling(conn);
Willy Tarreau7a798e52016-04-14 11:13:20 +0200172 return;
Willy Tarreau59f98392012-07-06 14:13:49 +0200173}
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200174
Willy Tarreau4970e5a2019-12-27 10:40:21 +0100175/* This is the callback which is set when a connection establishment is pending
176 * and we have nothing to send. It may update the FD polling status to indicate
177 * !READY. It returns 0 if it fails in a fatal way or needs to poll to go
178 * further, otherwise it returns non-zero and removes the CO_FL_WAIT_L4_CONN
179 * flag from the connection's flags. In case of error, it sets CO_FL_ERROR and
180 * leaves the error code in errno.
181 */
182int conn_fd_check(struct connection *conn)
183{
184 struct sockaddr_storage *addr;
185 int fd = conn->handle.fd;
186
187 if (conn->flags & CO_FL_ERROR)
188 return 0;
189
190 if (!conn_ctrl_ready(conn))
191 return 0;
192
193 if (!(conn->flags & CO_FL_WAIT_L4_CONN))
194 return 1; /* strange we were called while ready */
195
196 if (!fd_send_ready(fd))
197 return 0;
198
199 /* Here we have 2 cases :
200 * - modern pollers, able to report ERR/HUP. If these ones return any
201 * of these flags then it's likely a failure, otherwise it possibly
202 * is a success (i.e. there may have been data received just before
203 * the error was reported).
204 * - select, which doesn't report these and with which it's always
205 * necessary either to try connect() again or to check for SO_ERROR.
206 * In order to simplify everything, we double-check using connect() as
207 * soon as we meet either of these delicate situations. Note that
208 * SO_ERROR would clear the error after reporting it!
209 */
210 if (cur_poller.flags & HAP_POLL_F_ERRHUP) {
211 /* modern poller, able to report ERR/HUP */
212 if ((fdtab[fd].ev & (FD_POLL_IN|FD_POLL_ERR|FD_POLL_HUP)) == FD_POLL_IN)
213 goto done;
214 if ((fdtab[fd].ev & (FD_POLL_OUT|FD_POLL_ERR|FD_POLL_HUP)) == FD_POLL_OUT)
215 goto done;
216 if (!(fdtab[fd].ev & (FD_POLL_ERR|FD_POLL_HUP)))
217 goto wait;
218 /* error present, fall through common error check path */
219 }
220
221 /* Use connect() to check the state of the socket. This has the double
222 * advantage of *not* clearing the error (so that health checks can
223 * still use getsockopt(SO_ERROR)) and giving us the following info :
224 * - error
225 * - connecting (EALREADY, EINPROGRESS)
226 * - connected (EISCONN, 0)
227 */
228 addr = conn->dst;
229 if ((conn->flags & CO_FL_SOCKS4) && obj_type(conn->target) == OBJ_TYPE_SERVER)
230 addr = &objt_server(conn->target)->socks4_addr;
231
232 if (connect(fd, (const struct sockaddr *)addr, get_addr_len(addr)) == -1) {
233 if (errno == EALREADY || errno == EINPROGRESS)
234 goto wait;
235
236 if (errno && errno != EISCONN)
237 goto out_error;
238 }
239
240 done:
241 /* The FD is ready now, we'll mark the connection as complete and
242 * forward the event to the transport layer which will notify the
243 * data layer.
244 */
245 conn->flags &= ~CO_FL_WAIT_L4_CONN;
246 fd_may_send(fd);
247 fd_cond_recv(fd);
248 errno = 0; // make health checks happy
249 return 1;
250
251 out_error:
252 /* Write error on the file descriptor. Report it to the connection
253 * and disable polling on this FD.
254 */
255 fdtab[fd].linger_risk = 0;
256 conn->flags |= CO_FL_ERROR | CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH;
Willy Tarreau5d4d1802020-02-21 09:58:29 +0100257 conn_stop_polling(conn);
Willy Tarreau4970e5a2019-12-27 10:40:21 +0100258 return 0;
259
260 wait:
Willy Tarreau4970e5a2019-12-27 10:40:21 +0100261 fd_cant_send(fd);
Willy Tarreaud1d14c32020-02-21 10:34:19 +0100262 fd_want_send(fd);
Willy Tarreau4970e5a2019-12-27 10:40:21 +0100263 return 0;
264}
265
Willy Tarreauff3e6482015-03-12 23:56:52 +0100266/* Send a message over an established connection. It makes use of send() and
267 * returns the same return code and errno. If the socket layer is not ready yet
268 * then -1 is returned and ENOTSOCK is set into errno. If the fd is not marked
269 * as ready, or if EAGAIN or ENOTCONN is returned, then we return 0. It returns
270 * EMSGSIZE if called with a zero length message. The purpose is to simplify
271 * some rare attempts to directly write on the socket from above the connection
272 * (typically send_proxy). In case of EAGAIN, the fd is marked as "cant_send".
273 * It automatically retries on EINTR. Other errors cause the connection to be
274 * marked as in error state. It takes similar arguments as send() except the
275 * first one which is the connection instead of the file descriptor. Note,
276 * MSG_DONTWAIT and MSG_NOSIGNAL are forced on the flags.
277 */
278int conn_sock_send(struct connection *conn, const void *buf, int len, int flags)
279{
280 int ret;
281
282 ret = -1;
283 errno = ENOTSOCK;
284
285 if (conn->flags & CO_FL_SOCK_WR_SH)
286 goto fail;
287
288 if (!conn_ctrl_ready(conn))
289 goto fail;
290
291 errno = EMSGSIZE;
292 if (!len)
293 goto fail;
294
Willy Tarreau585744b2017-08-24 14:31:19 +0200295 if (!fd_send_ready(conn->handle.fd))
Willy Tarreauff3e6482015-03-12 23:56:52 +0100296 goto wait;
297
298 do {
Willy Tarreau585744b2017-08-24 14:31:19 +0200299 ret = send(conn->handle.fd, buf, len, flags | MSG_DONTWAIT | MSG_NOSIGNAL);
Willy Tarreauff3e6482015-03-12 23:56:52 +0100300 } while (ret < 0 && errno == EINTR);
301
302
Willy Tarreauccf3f6d2019-09-05 17:05:05 +0200303 if (ret > 0) {
304 if (conn->flags & CO_FL_WAIT_L4_CONN) {
305 conn->flags &= ~CO_FL_WAIT_L4_CONN;
306 fd_may_send(conn->handle.fd);
307 fd_cond_recv(conn->handle.fd);
308 }
Willy Tarreauff3e6482015-03-12 23:56:52 +0100309 return ret;
Willy Tarreauccf3f6d2019-09-05 17:05:05 +0200310 }
Willy Tarreauff3e6482015-03-12 23:56:52 +0100311
312 if (ret == 0 || errno == EAGAIN || errno == ENOTCONN) {
313 wait:
Willy Tarreau585744b2017-08-24 14:31:19 +0200314 fd_cant_send(conn->handle.fd);
Willy Tarreauff3e6482015-03-12 23:56:52 +0100315 return 0;
316 }
317 fail:
318 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH | CO_FL_ERROR;
319 return ret;
320}
321
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100322/* Called from the upper layer, to subscribe <es> to events <event_type>. The
323 * event subscriber <es> is not allowed to change from a previous call as long
324 * as at least one event is still subscribed. The <event_type> must only be a
325 * combination of SUB_RETRY_RECV and SUB_RETRY_SEND. It always returns 0.
326 */
327int conn_unsubscribe(struct connection *conn, void *xprt_ctx, int event_type, struct wait_event *es)
Olivier Houchard83a0cd82018-09-28 17:57:58 +0200328{
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100329 BUG_ON(event_type & ~(SUB_RETRY_SEND|SUB_RETRY_RECV));
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100330 BUG_ON(conn->subs && conn->subs != es);
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100331
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100332 es->events &= ~event_type;
333 if (!es->events)
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100334 conn->subs = NULL;
335
Willy Tarreaud1d14c32020-02-21 10:34:19 +0100336 if (conn_ctrl_ready(conn)) {
337 if (event_type & SUB_RETRY_RECV)
338 fd_stop_recv(conn->handle.fd);
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100339
Willy Tarreaud1d14c32020-02-21 10:34:19 +0100340 if (event_type & SUB_RETRY_SEND)
341 fd_stop_send(conn->handle.fd);
342 }
Olivier Houchard83a0cd82018-09-28 17:57:58 +0200343 return 0;
344}
345
Willy Tarreau7e59c0a2020-02-28 14:24:49 +0100346/* Called from the upper layer, to subscribe <es> to events <event_type>.
347 * The <es> struct is not allowed to differ from the one passed during a
348 * previous call to subscribe(). If the FD is ready, the wait_event is
349 * immediately woken up and the subcription is cancelled. It always
350 * returns zero.
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100351 */
352int conn_subscribe(struct connection *conn, void *xprt_ctx, int event_type, struct wait_event *es)
Olivier Houchard6ff20392018-07-17 18:46:31 +0200353{
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100354 BUG_ON(event_type & ~(SUB_RETRY_SEND|SUB_RETRY_RECV));
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100355 BUG_ON(conn->subs && conn->subs != es);
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100356
Willy Tarreau7e59c0a2020-02-28 14:24:49 +0100357 if (conn->subs && (conn->subs->events & event_type) == event_type)
358 return 0;
359
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100360 conn->subs = es;
361 es->events |= event_type;
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100362
Willy Tarreaud1d14c32020-02-21 10:34:19 +0100363 if (conn_ctrl_ready(conn)) {
Willy Tarreau7e59c0a2020-02-28 14:24:49 +0100364 if (event_type & SUB_RETRY_RECV) {
365 if (fd_recv_ready(conn->handle.fd)) {
366 tasklet_wakeup(es->tasklet);
367 es->events &= ~SUB_RETRY_RECV;
368 if (!es->events)
369 conn->subs = NULL;
370 }
371 else
372 fd_want_recv(conn->handle.fd);
373 }
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100374
Willy Tarreau7e59c0a2020-02-28 14:24:49 +0100375 if (event_type & SUB_RETRY_SEND) {
376 if (fd_send_ready(conn->handle.fd)) {
377 tasklet_wakeup(es->tasklet);
378 es->events &= ~SUB_RETRY_SEND;
379 if (!es->events)
380 conn->subs = NULL;
381 }
382 else
383 fd_want_send(conn->handle.fd);
384 }
Willy Tarreaud1d14c32020-02-21 10:34:19 +0100385 }
Olivier Houchard83a0cd82018-09-28 17:57:58 +0200386 return 0;
Olivier Houchard6ff20392018-07-17 18:46:31 +0200387}
388
Willy Tarreaud85c4852015-03-13 00:40:28 +0100389/* Drains possibly pending incoming data on the file descriptor attached to the
390 * connection and update the connection's flags accordingly. This is used to
391 * know whether we need to disable lingering on close. Returns non-zero if it
392 * is safe to close without disabling lingering, otherwise zero. The SOCK_RD_SH
393 * flag may also be updated if the incoming shutdown was reported by the drain()
394 * function.
395 */
396int conn_sock_drain(struct connection *conn)
397{
Willy Tarreaue215bba2018-08-24 14:31:53 +0200398 int turns = 2;
399 int len;
400
Willy Tarreaud85c4852015-03-13 00:40:28 +0100401 if (!conn_ctrl_ready(conn))
402 return 1;
403
404 if (conn->flags & (CO_FL_ERROR | CO_FL_SOCK_RD_SH))
405 return 1;
406
Willy Tarreaue215bba2018-08-24 14:31:53 +0200407 if (fdtab[conn->handle.fd].ev & (FD_POLL_ERR|FD_POLL_HUP))
408 goto shut;
Willy Tarreaud85c4852015-03-13 00:40:28 +0100409
Willy Tarreaue215bba2018-08-24 14:31:53 +0200410 if (!fd_recv_ready(conn->handle.fd))
411 return 0;
Willy Tarreaud85c4852015-03-13 00:40:28 +0100412
Willy Tarreaue215bba2018-08-24 14:31:53 +0200413 if (conn->ctrl->drain) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200414 if (conn->ctrl->drain(conn->handle.fd) <= 0)
Willy Tarreaud85c4852015-03-13 00:40:28 +0100415 return 0;
Willy Tarreaue215bba2018-08-24 14:31:53 +0200416 goto shut;
417 }
418
419 /* no drain function defined, use the generic one */
420
421 while (turns) {
422#ifdef MSG_TRUNC_CLEARS_INPUT
423 len = recv(conn->handle.fd, NULL, INT_MAX, MSG_DONTWAIT | MSG_NOSIGNAL | MSG_TRUNC);
424 if (len == -1 && errno == EFAULT)
425#endif
426 len = recv(conn->handle.fd, trash.area, trash.size,
427 MSG_DONTWAIT | MSG_NOSIGNAL);
428
429 if (len == 0)
430 goto shut;
431
432 if (len < 0) {
433 if (errno == EAGAIN) {
434 /* connection not closed yet */
435 fd_cant_recv(conn->handle.fd);
436 break;
437 }
438 if (errno == EINTR) /* oops, try again */
439 continue;
440 /* other errors indicate a dead connection, fine. */
441 goto shut;
442 }
443 /* OK we read some data, let's try again once */
444 turns--;
Willy Tarreaud85c4852015-03-13 00:40:28 +0100445 }
446
Willy Tarreaue215bba2018-08-24 14:31:53 +0200447 /* some data are still present, give up */
448 return 0;
449
450 shut:
451 /* we're certain the connection was shut down */
452 fdtab[conn->handle.fd].linger_risk = 0;
Willy Tarreaud85c4852015-03-13 00:40:28 +0100453 conn->flags |= CO_FL_SOCK_RD_SH;
454 return 1;
455}
456
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100457/*
458 * Get data length from tlv
459 */
Tim Duesterhusba837ec2020-03-05 23:11:02 +0100460static inline size_t get_tlv_length(const struct tlv *src)
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100461{
462 return (src->length_hi << 8) | src->length_lo;
463}
464
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200465/* This handshake handler waits a PROXY protocol header at the beginning of the
466 * raw data stream. The header looks like this :
467 *
468 * "PROXY" <SP> PROTO <SP> SRC3 <SP> DST3 <SP> SRC4 <SP> <DST4> "\r\n"
469 *
470 * There must be exactly one space between each field. Fields are :
471 * - PROTO : layer 4 protocol, which must be "TCP4" or "TCP6".
472 * - SRC3 : layer 3 (eg: IP) source address in standard text form
473 * - DST3 : layer 3 (eg: IP) destination address in standard text form
474 * - SRC4 : layer 4 (eg: TCP port) source address in standard text form
475 * - DST4 : layer 4 (eg: TCP port) destination address in standard text form
476 *
477 * This line MUST be at the beginning of the buffer and MUST NOT wrap.
478 *
479 * The header line is small and in all cases smaller than the smallest normal
480 * TCP MSS. So it MUST always be delivered as one segment, which ensures we
481 * can safely use MSG_PEEK and avoid buffering.
482 *
483 * Once the data is fetched, the values are set in the connection's address
484 * fields, and data are removed from the socket's buffer. The function returns
485 * zero if it needs to wait for more data or if it fails, or 1 if it completed
486 * and removed itself.
487 */
488int conn_recv_proxy(struct connection *conn, int flag)
489{
490 char *line, *end;
Willy Tarreau77992672014-06-14 11:06:17 +0200491 struct proxy_hdr_v2 *hdr_v2;
492 const char v2sig[] = PP2_SIGNATURE;
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100493 size_t total_v2_len;
Tim Duesterhusba837ec2020-03-05 23:11:02 +0100494 size_t tlv_offset = 0;
Willy Tarreaub406b872018-08-22 05:20:32 +0200495 int ret;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200496
Willy Tarreau3c728722014-01-23 13:50:42 +0100497 if (!conn_ctrl_ready(conn))
Willy Tarreauf79c8172013-10-21 16:30:56 +0200498 goto fail;
499
Willy Tarreauca79f592019-07-17 19:04:47 +0200500 if (!sockaddr_alloc(&conn->src) || !sockaddr_alloc(&conn->dst))
501 goto fail;
502
Willy Tarreau585744b2017-08-24 14:31:19 +0200503 if (!fd_recv_ready(conn->handle.fd))
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200504 goto not_ready;
Willy Tarreaufd803bb2014-01-20 15:13:07 +0100505
Willy Tarreau157788c2020-02-11 10:08:05 +0100506 while (1) {
Willy Tarreaub406b872018-08-22 05:20:32 +0200507 ret = recv(conn->handle.fd, trash.area, trash.size, MSG_PEEK);
508 if (ret < 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200509 if (errno == EINTR)
510 continue;
511 if (errno == EAGAIN) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200512 fd_cant_recv(conn->handle.fd);
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200513 goto not_ready;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200514 }
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100515 goto recv_abort;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200516 }
Willy Tarreaub406b872018-08-22 05:20:32 +0200517 trash.data = ret;
Willy Tarreau157788c2020-02-11 10:08:05 +0100518 break;
519 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200520
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200521 if (!trash.data) {
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100522 /* client shutdown */
523 conn->err_code = CO_ER_PRX_EMPTY;
524 goto fail;
525 }
526
Willy Tarreauc192b0a2020-01-23 09:11:58 +0100527 conn->flags &= ~CO_FL_WAIT_L4_CONN;
528
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200529 if (trash.data < 6)
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200530 goto missing;
531
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200532 line = trash.area;
533 end = trash.area + trash.data;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200534
535 /* Decode a possible proxy request, fail early if it does not match */
Willy Tarreau77992672014-06-14 11:06:17 +0200536 if (strncmp(line, "PROXY ", 6) != 0)
537 goto not_v1;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200538
539 line += 6;
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200540 if (trash.data < 9) /* shortest possible line */
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200541 goto missing;
542
David CARLIER42ff05e2016-03-24 09:22:36 +0000543 if (memcmp(line, "TCP4 ", 5) == 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200544 u32 src3, dst3, sport, dport;
545
546 line += 5;
547
548 src3 = inetaddr_host_lim_ret(line, end, &line);
549 if (line == end)
550 goto missing;
551 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100552 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200553
554 dst3 = inetaddr_host_lim_ret(line, end, &line);
555 if (line == end)
556 goto missing;
557 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100558 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200559
560 sport = read_uint((const char **)&line, end);
561 if (line == end)
562 goto missing;
563 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100564 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200565
566 dport = read_uint((const char **)&line, end);
567 if (line > end - 2)
568 goto missing;
569 if (*line++ != '\r')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100570 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200571 if (*line++ != '\n')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100572 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200573
574 /* update the session's addresses and mark them set */
Willy Tarreau226572f2019-07-17 14:46:00 +0200575 ((struct sockaddr_in *)conn->src)->sin_family = AF_INET;
576 ((struct sockaddr_in *)conn->src)->sin_addr.s_addr = htonl(src3);
577 ((struct sockaddr_in *)conn->src)->sin_port = htons(sport);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200578
Willy Tarreau226572f2019-07-17 14:46:00 +0200579 ((struct sockaddr_in *)conn->dst)->sin_family = AF_INET;
580 ((struct sockaddr_in *)conn->dst)->sin_addr.s_addr = htonl(dst3);
581 ((struct sockaddr_in *)conn->dst)->sin_port = htons(dport);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200582 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
583 }
David CARLIER42ff05e2016-03-24 09:22:36 +0000584 else if (memcmp(line, "TCP6 ", 5) == 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200585 u32 sport, dport;
586 char *src_s;
587 char *dst_s, *sport_s, *dport_s;
588 struct in6_addr src3, dst3;
589
590 line += 5;
591
592 src_s = line;
593 dst_s = sport_s = dport_s = NULL;
594 while (1) {
595 if (line > end - 2) {
596 goto missing;
597 }
598 else if (*line == '\r') {
599 *line = 0;
600 line++;
601 if (*line++ != '\n')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100602 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200603 break;
604 }
605
606 if (*line == ' ') {
607 *line = 0;
608 if (!dst_s)
609 dst_s = line + 1;
610 else if (!sport_s)
611 sport_s = line + 1;
612 else if (!dport_s)
613 dport_s = line + 1;
614 }
615 line++;
616 }
617
618 if (!dst_s || !sport_s || !dport_s)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100619 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200620
621 sport = read_uint((const char **)&sport_s,dport_s - 1);
622 if (*sport_s != 0)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100623 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200624
625 dport = read_uint((const char **)&dport_s,line - 2);
626 if (*dport_s != 0)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100627 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200628
629 if (inet_pton(AF_INET6, src_s, (void *)&src3) != 1)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100630 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200631
632 if (inet_pton(AF_INET6, dst_s, (void *)&dst3) != 1)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100633 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200634
635 /* update the session's addresses and mark them set */
Willy Tarreau226572f2019-07-17 14:46:00 +0200636 ((struct sockaddr_in6 *)conn->src)->sin6_family = AF_INET6;
637 memcpy(&((struct sockaddr_in6 *)conn->src)->sin6_addr, &src3, sizeof(struct in6_addr));
638 ((struct sockaddr_in6 *)conn->src)->sin6_port = htons(sport);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200639
Willy Tarreau226572f2019-07-17 14:46:00 +0200640 ((struct sockaddr_in6 *)conn->dst)->sin6_family = AF_INET6;
641 memcpy(&((struct sockaddr_in6 *)conn->dst)->sin6_addr, &dst3, sizeof(struct in6_addr));
642 ((struct sockaddr_in6 *)conn->dst)->sin6_port = htons(dport);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200643 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
644 }
Willy Tarreau4c20d292014-06-14 11:41:36 +0200645 else if (memcmp(line, "UNKNOWN\r\n", 9) == 0) {
646 /* This can be a UNIX socket forwarded by an haproxy upstream */
647 line += 9;
648 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200649 else {
Willy Tarreau4c20d292014-06-14 11:41:36 +0200650 /* The protocol does not match something known (TCP4/TCP6/UNKNOWN) */
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100651 conn->err_code = CO_ER_PRX_BAD_PROTO;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200652 goto fail;
653 }
654
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200655 trash.data = line - trash.area;
Willy Tarreau77992672014-06-14 11:06:17 +0200656 goto eat_header;
657
658 not_v1:
659 /* try PPv2 */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200660 if (trash.data < PP2_HEADER_LEN)
Willy Tarreau77992672014-06-14 11:06:17 +0200661 goto missing;
662
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200663 hdr_v2 = (struct proxy_hdr_v2 *) trash.area;
Willy Tarreau77992672014-06-14 11:06:17 +0200664
665 if (memcmp(hdr_v2->sig, v2sig, PP2_SIGNATURE_LEN) != 0 ||
666 (hdr_v2->ver_cmd & PP2_VERSION_MASK) != PP2_VERSION) {
667 conn->err_code = CO_ER_PRX_NOT_HDR;
668 goto fail;
669 }
670
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100671 total_v2_len = PP2_HEADER_LEN + ntohs(hdr_v2->len);
672 if (trash.data < total_v2_len)
Willy Tarreau77992672014-06-14 11:06:17 +0200673 goto missing;
674
675 switch (hdr_v2->ver_cmd & PP2_CMD_MASK) {
676 case 0x01: /* PROXY command */
677 switch (hdr_v2->fam) {
678 case 0x11: /* TCPv4 */
KOVACS Krisztianefd3aa92014-11-19 10:53:20 +0100679 if (ntohs(hdr_v2->len) < PP2_ADDR_LEN_INET)
680 goto bad_header;
681
Willy Tarreau226572f2019-07-17 14:46:00 +0200682 ((struct sockaddr_in *)conn->src)->sin_family = AF_INET;
683 ((struct sockaddr_in *)conn->src)->sin_addr.s_addr = hdr_v2->addr.ip4.src_addr;
684 ((struct sockaddr_in *)conn->src)->sin_port = hdr_v2->addr.ip4.src_port;
685 ((struct sockaddr_in *)conn->dst)->sin_family = AF_INET;
686 ((struct sockaddr_in *)conn->dst)->sin_addr.s_addr = hdr_v2->addr.ip4.dst_addr;
687 ((struct sockaddr_in *)conn->dst)->sin_port = hdr_v2->addr.ip4.dst_port;
Willy Tarreau77992672014-06-14 11:06:17 +0200688 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
KOVACS Krisztian7209c202015-07-03 14:09:10 +0200689 tlv_offset = PP2_HEADER_LEN + PP2_ADDR_LEN_INET;
Willy Tarreau77992672014-06-14 11:06:17 +0200690 break;
691 case 0x21: /* TCPv6 */
KOVACS Krisztianefd3aa92014-11-19 10:53:20 +0100692 if (ntohs(hdr_v2->len) < PP2_ADDR_LEN_INET6)
693 goto bad_header;
694
Willy Tarreau226572f2019-07-17 14:46:00 +0200695 ((struct sockaddr_in6 *)conn->src)->sin6_family = AF_INET6;
696 memcpy(&((struct sockaddr_in6 *)conn->src)->sin6_addr, hdr_v2->addr.ip6.src_addr, 16);
697 ((struct sockaddr_in6 *)conn->src)->sin6_port = hdr_v2->addr.ip6.src_port;
698 ((struct sockaddr_in6 *)conn->dst)->sin6_family = AF_INET6;
699 memcpy(&((struct sockaddr_in6 *)conn->dst)->sin6_addr, hdr_v2->addr.ip6.dst_addr, 16);
700 ((struct sockaddr_in6 *)conn->dst)->sin6_port = hdr_v2->addr.ip6.dst_port;
Willy Tarreau77992672014-06-14 11:06:17 +0200701 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
KOVACS Krisztian7209c202015-07-03 14:09:10 +0200702 tlv_offset = PP2_HEADER_LEN + PP2_ADDR_LEN_INET6;
Willy Tarreau77992672014-06-14 11:06:17 +0200703 break;
704 }
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100705
706 /* TLV parsing */
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100707 while (tlv_offset < total_v2_len) {
708 struct tlv *tlv_packet;
Tim Duesterhusba837ec2020-03-05 23:11:02 +0100709 size_t tlv_len;
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100710
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100711 /* Verify that we have at least TLV_HEADER_SIZE bytes left */
712 if (tlv_offset + TLV_HEADER_SIZE > total_v2_len)
713 goto bad_header;
714
715 tlv_packet = (struct tlv *) &trash.area[tlv_offset];
716 tlv_len = get_tlv_length(tlv_packet);
717 tlv_offset += tlv_len + TLV_HEADER_SIZE;
718
719 /* Verify that the TLV length does not exceed the total PROXYv2 length */
720 if (tlv_offset > total_v2_len)
721 goto bad_header;
722
723 switch (tlv_packet->type) {
724 case PP2_TYPE_CRC32C: {
725 uint32_t n_crc32c;
726
727 /* Verify that this TLV is exactly 4 bytes long */
728 if (tlv_len != 4)
729 goto bad_header;
730
731 n_crc32c = read_n32(tlv_packet->value);
732 write_n32(tlv_packet->value, 0); // compute with CRC==0
733
734 if (hash_crc32c(trash.area, total_v2_len) != n_crc32c)
735 goto bad_header;
736 break;
737 }
Willy Tarreaue5733232019-05-22 19:24:06 +0200738#ifdef USE_NS
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100739 case PP2_TYPE_NETNS: {
740 const struct netns_entry *ns;
741
742 ns = netns_store_lookup((char*)tlv_packet->value, tlv_len);
743 if (ns)
744 conn->proxy_netns = ns;
745 break;
746 }
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100747#endif
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100748 case PP2_TYPE_AUTHORITY: {
749 if (tlv_len > PP2_AUTHORITY_MAX)
750 goto bad_header;
751 conn->proxy_authority = pool_alloc(pool_head_authority);
752 if (conn->proxy_authority == NULL)
753 goto fail;
754 memcpy(conn->proxy_authority, (const char *)tlv_packet->value, tlv_len);
755 conn->proxy_authority_len = tlv_len;
756 break;
757 }
Tim Duesterhusd1b15b62020-03-13 12:34:23 +0100758 case PP2_TYPE_UNIQUE_ID: {
759 const struct ist tlv = ist2((const char *)tlv_packet->value, tlv_len);
760
761 if (tlv.len > UNIQUEID_LEN)
762 goto bad_header;
763 conn->proxy_unique_id.ptr = pool_alloc(pool_head_uniqueid);
764 if (!isttest(conn->proxy_unique_id))
765 goto fail;
766 if (istcpy(&conn->proxy_unique_id, tlv, UNIQUEID_LEN) < 0) {
767 /* This is technically unreachable, because we verified above
768 * that the TLV value fits.
769 */
770 goto fail;
771 }
772 break;
773 }
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100774 default:
775 break;
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100776 }
777 }
778
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100779 /* Verify that the PROXYv2 header ends at a TLV boundary.
780 * This is technically unreachable, because the TLV parsing already
781 * verifies that a TLV does not exceed the total length and also
782 * that there is space for a TLV header.
783 */
784 if (tlv_offset != total_v2_len)
785 goto bad_header;
786
Willy Tarreau77992672014-06-14 11:06:17 +0200787 /* unsupported protocol, keep local connection address */
788 break;
789 case 0x00: /* LOCAL command */
790 /* keep local connection address for LOCAL */
791 break;
792 default:
793 goto bad_header; /* not a supported command */
794 }
795
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100796 trash.data = total_v2_len;
Willy Tarreau77992672014-06-14 11:06:17 +0200797 goto eat_header;
798
799 eat_header:
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200800 /* remove the PROXY line from the request. For this we re-read the
801 * exact line at once. If we don't get the exact same result, we
802 * fail.
803 */
Willy Tarreau157788c2020-02-11 10:08:05 +0100804 while (1) {
Tim Duesterhusa8692f32020-03-13 12:34:25 +0100805 ssize_t len2 = recv(conn->handle.fd, trash.area, trash.data, 0);
806
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200807 if (len2 < 0 && errno == EINTR)
808 continue;
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200809 if (len2 != trash.data)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100810 goto recv_abort;
Willy Tarreau157788c2020-02-11 10:08:05 +0100811 break;
812 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200813
814 conn->flags &= ~flag;
Emeric Brun4f603012017-01-05 15:11:44 +0100815 conn->flags |= CO_FL_RCVD_PROXY;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200816 return 1;
817
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200818 not_ready:
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200819 return 0;
820
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200821 missing:
822 /* Missing data. Since we're using MSG_PEEK, we can only poll again if
823 * we have not read anything. Otherwise we need to fail because we won't
824 * be able to poll anymore.
825 */
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100826 conn->err_code = CO_ER_PRX_TRUNCATED;
827 goto fail;
828
829 bad_header:
830 /* This is not a valid proxy protocol header */
831 conn->err_code = CO_ER_PRX_BAD_HDR;
832 goto fail;
833
834 recv_abort:
835 conn->err_code = CO_ER_PRX_ABORT;
Willy Tarreau26f4a042013-12-04 23:44:10 +0100836 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH;
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100837 goto fail;
838
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200839 fail:
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200840 conn->flags |= CO_FL_ERROR;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200841 return 0;
842}
843
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100844/* This handshake handler waits a NetScaler Client IP insertion header
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000845 * at the beginning of the raw data stream. The header format is
846 * described in doc/netscaler-client-ip-insertion-protocol.txt
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100847 *
848 * This line MUST be at the beginning of the buffer and MUST NOT be
849 * fragmented.
850 *
851 * The header line is small and in all cases smaller than the smallest normal
852 * TCP MSS. So it MUST always be delivered as one segment, which ensures we
853 * can safely use MSG_PEEK and avoid buffering.
854 *
855 * Once the data is fetched, the values are set in the connection's address
856 * fields, and data are removed from the socket's buffer. The function returns
857 * zero if it needs to wait for more data or if it fails, or 1 if it completed
858 * and removed itself.
859 */
860int conn_recv_netscaler_cip(struct connection *conn, int flag)
861{
862 char *line;
Bertrand Jacquin7d668f92017-12-13 01:23:39 +0000863 uint32_t hdr_len;
Willy Tarreau0ca24aa2019-03-29 17:35:32 +0100864 uint8_t ip_ver;
Willy Tarreaub406b872018-08-22 05:20:32 +0200865 int ret;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100866
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100867 if (!conn_ctrl_ready(conn))
868 goto fail;
869
Olivier Houchard1a9dbe52020-01-22 15:31:09 +0100870 if (!sockaddr_alloc(&conn->src) || !sockaddr_alloc(&conn->dst))
871 goto fail;
872
Willy Tarreau585744b2017-08-24 14:31:19 +0200873 if (!fd_recv_ready(conn->handle.fd))
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200874 goto not_ready;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100875
Willy Tarreau157788c2020-02-11 10:08:05 +0100876 while (1) {
Willy Tarreaub406b872018-08-22 05:20:32 +0200877 ret = recv(conn->handle.fd, trash.area, trash.size, MSG_PEEK);
878 if (ret < 0) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100879 if (errno == EINTR)
880 continue;
881 if (errno == EAGAIN) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200882 fd_cant_recv(conn->handle.fd);
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200883 goto not_ready;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100884 }
885 goto recv_abort;
886 }
Willy Tarreaub406b872018-08-22 05:20:32 +0200887 trash.data = ret;
Willy Tarreau157788c2020-02-11 10:08:05 +0100888 break;
889 }
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100890
Willy Tarreauc192b0a2020-01-23 09:11:58 +0100891 conn->flags &= ~CO_FL_WAIT_L4_CONN;
892
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200893 if (!trash.data) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100894 /* client shutdown */
895 conn->err_code = CO_ER_CIP_EMPTY;
896 goto fail;
897 }
898
899 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000900 * CIP magic, header length or
901 * CIP magic, CIP length, CIP type, header length */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200902 if (trash.data < 12)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100903 goto missing;
904
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200905 line = trash.area;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100906
907 /* Decode a possible NetScaler Client IP request, fail early if
908 * it does not match */
Willy Tarreau1ac83af2020-02-25 10:06:49 +0100909 if (ntohl(read_u32(line)) != __objt_listener(conn->target)->bind_conf->ns_cip_magic)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100910 goto bad_magic;
911
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000912 /* Legacy CIP protocol */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200913 if ((trash.area[8] & 0xD0) == 0x40) {
Willy Tarreau1ac83af2020-02-25 10:06:49 +0100914 hdr_len = ntohl(read_u32((line+4)));
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000915 line += 8;
916 }
917 /* Standard CIP protocol */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200918 else if (trash.area[8] == 0x00) {
Willy Tarreau1ac83af2020-02-25 10:06:49 +0100919 hdr_len = ntohs(read_u32((line+10)));
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000920 line += 12;
921 }
922 /* Unknown CIP protocol */
923 else {
924 conn->err_code = CO_ER_CIP_BAD_PROTO;
925 goto fail;
926 }
927
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100928 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000929 * a minimal IP header */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200930 if (trash.data < 20)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100931 goto missing;
932
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100933 /* Get IP version from the first four bits */
Willy Tarreau0ca24aa2019-03-29 17:35:32 +0100934 ip_ver = (*line & 0xf0) >> 4;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100935
Willy Tarreau0ca24aa2019-03-29 17:35:32 +0100936 if (ip_ver == 4) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100937 struct ip *hdr_ip4;
David Carlier3015a2e2016-07-04 22:51:33 +0100938 struct my_tcphdr *hdr_tcp;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100939
940 hdr_ip4 = (struct ip *)line;
941
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200942 if (trash.data < 40 || trash.data < hdr_len) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100943 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin67de5a22017-12-13 01:15:05 +0000944 * IPv4 header, TCP header */
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100945 goto missing;
Bertrand Jacquinb3875912017-12-13 00:58:51 +0000946 }
947 else if (hdr_ip4->ip_p != IPPROTO_TCP) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100948 /* The protocol does not include a TCP header */
949 conn->err_code = CO_ER_CIP_BAD_PROTO;
950 goto fail;
Bertrand Jacquinb3875912017-12-13 00:58:51 +0000951 }
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100952
David Carlier3015a2e2016-07-04 22:51:33 +0100953 hdr_tcp = (struct my_tcphdr *)(line + (hdr_ip4->ip_hl * 4));
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100954
955 /* update the session's addresses and mark them set */
Willy Tarreau226572f2019-07-17 14:46:00 +0200956 ((struct sockaddr_in *)conn->src)->sin_family = AF_INET;
957 ((struct sockaddr_in *)conn->src)->sin_addr.s_addr = hdr_ip4->ip_src.s_addr;
958 ((struct sockaddr_in *)conn->src)->sin_port = hdr_tcp->source;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100959
Willy Tarreau226572f2019-07-17 14:46:00 +0200960 ((struct sockaddr_in *)conn->dst)->sin_family = AF_INET;
961 ((struct sockaddr_in *)conn->dst)->sin_addr.s_addr = hdr_ip4->ip_dst.s_addr;
962 ((struct sockaddr_in *)conn->dst)->sin_port = hdr_tcp->dest;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100963
964 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
965 }
Willy Tarreau0ca24aa2019-03-29 17:35:32 +0100966 else if (ip_ver == 6) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100967 struct ip6_hdr *hdr_ip6;
David Carlier3015a2e2016-07-04 22:51:33 +0100968 struct my_tcphdr *hdr_tcp;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100969
970 hdr_ip6 = (struct ip6_hdr *)line;
971
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200972 if (trash.data < 60 || trash.data < hdr_len) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100973 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin67de5a22017-12-13 01:15:05 +0000974 * IPv6 header, TCP header */
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100975 goto missing;
Bertrand Jacquinb3875912017-12-13 00:58:51 +0000976 }
977 else if (hdr_ip6->ip6_nxt != IPPROTO_TCP) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100978 /* The protocol does not include a TCP header */
979 conn->err_code = CO_ER_CIP_BAD_PROTO;
980 goto fail;
Bertrand Jacquinb3875912017-12-13 00:58:51 +0000981 }
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100982
David Carlier3015a2e2016-07-04 22:51:33 +0100983 hdr_tcp = (struct my_tcphdr *)(line + sizeof(struct ip6_hdr));
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100984
985 /* update the session's addresses and mark them set */
Willy Tarreau226572f2019-07-17 14:46:00 +0200986 ((struct sockaddr_in6 *)conn->src)->sin6_family = AF_INET6;
987 ((struct sockaddr_in6 *)conn->src)->sin6_addr = hdr_ip6->ip6_src;
988 ((struct sockaddr_in6 *)conn->src)->sin6_port = hdr_tcp->source;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100989
Willy Tarreau226572f2019-07-17 14:46:00 +0200990 ((struct sockaddr_in6 *)conn->dst)->sin6_family = AF_INET6;
991 ((struct sockaddr_in6 *)conn->dst)->sin6_addr = hdr_ip6->ip6_dst;
992 ((struct sockaddr_in6 *)conn->dst)->sin6_port = hdr_tcp->dest;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100993
994 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
995 }
996 else {
997 /* The protocol does not match something known (IPv4/IPv6) */
998 conn->err_code = CO_ER_CIP_BAD_PROTO;
999 goto fail;
1000 }
1001
Bertrand Jacquin7d668f92017-12-13 01:23:39 +00001002 line += hdr_len;
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001003 trash.data = line - trash.area;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001004
1005 /* remove the NetScaler Client IP header from the request. For this
1006 * we re-read the exact line at once. If we don't get the exact same
1007 * result, we fail.
1008 */
Willy Tarreau157788c2020-02-11 10:08:05 +01001009 while (1) {
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001010 int len2 = recv(conn->handle.fd, trash.area, trash.data, 0);
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001011 if (len2 < 0 && errno == EINTR)
1012 continue;
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001013 if (len2 != trash.data)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001014 goto recv_abort;
Willy Tarreau157788c2020-02-11 10:08:05 +01001015 break;
1016 }
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001017
1018 conn->flags &= ~flag;
1019 return 1;
1020
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001021 not_ready:
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001022 return 0;
1023
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001024 missing:
1025 /* Missing data. Since we're using MSG_PEEK, we can only poll again if
1026 * we have not read anything. Otherwise we need to fail because we won't
1027 * be able to poll anymore.
1028 */
1029 conn->err_code = CO_ER_CIP_TRUNCATED;
1030 goto fail;
1031
1032 bad_magic:
1033 conn->err_code = CO_ER_CIP_BAD_MAGIC;
1034 goto fail;
1035
1036 recv_abort:
1037 conn->err_code = CO_ER_CIP_ABORT;
1038 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH;
1039 goto fail;
1040
1041 fail:
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001042 conn->flags |= CO_FL_ERROR;
1043 return 0;
1044}
1045
Alexander Liu2a54bb72019-05-22 19:44:48 +08001046
1047int conn_send_socks4_proxy_request(struct connection *conn)
1048{
1049 struct socks4_request req_line;
1050
Alexander Liu2a54bb72019-05-22 19:44:48 +08001051 if (!conn_ctrl_ready(conn))
1052 goto out_error;
1053
Willy Tarreau226572f2019-07-17 14:46:00 +02001054 if (!conn_get_dst(conn))
1055 goto out_error;
1056
Alexander Liu2a54bb72019-05-22 19:44:48 +08001057 req_line.version = 0x04;
1058 req_line.command = 0x01;
Willy Tarreau226572f2019-07-17 14:46:00 +02001059 req_line.port = get_net_port(conn->dst);
1060 req_line.ip = is_inet_addr(conn->dst);
Alexander Liu2a54bb72019-05-22 19:44:48 +08001061 memcpy(req_line.user_id, "HAProxy\0", 8);
1062
1063 if (conn->send_proxy_ofs > 0) {
1064 /*
1065 * This is the first call to send the request
1066 */
1067 conn->send_proxy_ofs = -(int)sizeof(req_line);
1068 }
1069
1070 if (conn->send_proxy_ofs < 0) {
1071 int ret = 0;
1072
1073 /* we are sending the socks4_req_line here. If the data layer
1074 * has a pending write, we'll also set MSG_MORE.
1075 */
1076 ret = conn_sock_send(
1077 conn,
1078 ((char *)(&req_line)) + (sizeof(req_line)+conn->send_proxy_ofs),
1079 -conn->send_proxy_ofs,
Willy Tarreau19bc2012020-02-21 08:46:19 +01001080 (conn->subs && conn->subs->events & SUB_RETRY_SEND) ? MSG_MORE : 0);
Alexander Liu2a54bb72019-05-22 19:44:48 +08001081
1082 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Before send remain is [%d], sent [%d]\n",
1083 conn->handle.fd, -conn->send_proxy_ofs, ret);
1084
1085 if (ret < 0) {
1086 goto out_error;
1087 }
1088
1089 conn->send_proxy_ofs += ret; /* becomes zero once complete */
1090 if (conn->send_proxy_ofs != 0) {
1091 goto out_wait;
1092 }
1093 }
1094
1095 /* OK we've the whole request sent */
1096 conn->flags &= ~CO_FL_SOCKS4_SEND;
Alexander Liu2a54bb72019-05-22 19:44:48 +08001097
1098 /* The connection is ready now, simply return and let the connection
1099 * handler notify upper layers if needed.
1100 */
Willy Tarreauc192b0a2020-01-23 09:11:58 +01001101 conn->flags &= ~CO_FL_WAIT_L4_CONN;
Alexander Liu2a54bb72019-05-22 19:44:48 +08001102
1103 if (conn->flags & CO_FL_SEND_PROXY) {
1104 /*
1105 * Get the send_proxy_ofs ready for the send_proxy due to we are
1106 * reusing the "send_proxy_ofs", and SOCKS4 handshake should be done
1107 * before sending PROXY Protocol.
1108 */
1109 conn->send_proxy_ofs = 1;
1110 }
1111 return 1;
1112
1113 out_error:
1114 /* Write error on the file descriptor */
1115 conn->flags |= CO_FL_ERROR;
1116 if (conn->err_code == CO_ER_NONE) {
1117 conn->err_code = CO_ER_SOCKS4_SEND;
1118 }
1119 return 0;
1120
1121 out_wait:
Alexander Liu2a54bb72019-05-22 19:44:48 +08001122 return 0;
1123}
1124
1125int conn_recv_socks4_proxy_response(struct connection *conn)
1126{
1127 char line[SOCKS4_HS_RSP_LEN];
1128 int ret;
1129
Alexander Liu2a54bb72019-05-22 19:44:48 +08001130 if (!conn_ctrl_ready(conn))
1131 goto fail;
1132
1133 if (!fd_recv_ready(conn->handle.fd))
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001134 goto not_ready;
Alexander Liu2a54bb72019-05-22 19:44:48 +08001135
Willy Tarreau157788c2020-02-11 10:08:05 +01001136 while (1) {
Alexander Liu2a54bb72019-05-22 19:44:48 +08001137 /* SOCKS4 Proxy will response with 8 bytes, 0x00 | 0x5A | 0x00 0x00 | 0x00 0x00 0x00 0x00
1138 * Try to peek into it, before all 8 bytes ready.
1139 */
1140 ret = recv(conn->handle.fd, line, SOCKS4_HS_RSP_LEN, MSG_PEEK);
1141
1142 if (ret == 0) {
1143 /* the socket has been closed or shutdown for send */
1144 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Received ret[%d], errno[%d], looks like the socket has been closed or shutdown for send\n",
1145 conn->handle.fd, ret, errno);
1146 if (conn->err_code == CO_ER_NONE) {
1147 conn->err_code = CO_ER_SOCKS4_RECV;
1148 }
1149 goto fail;
1150 }
1151
1152 if (ret > 0) {
1153 if (ret == SOCKS4_HS_RSP_LEN) {
1154 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Received 8 bytes, the response is [%02X|%02X|%02X %02X|%02X %02X %02X %02X]\n",
1155 conn->handle.fd, line[0], line[1], line[2], line[3], line[4], line[5], line[6], line[7]);
1156 }else{
1157 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Received ret[%d], first byte is [%02X], last bye is [%02X]\n", conn->handle.fd, ret, line[0], line[ret-1]);
1158 }
1159 } else {
1160 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Received ret[%d], errno[%d]\n", conn->handle.fd, ret, errno);
1161 }
1162
1163 if (ret < 0) {
1164 if (errno == EINTR) {
1165 continue;
1166 }
1167 if (errno == EAGAIN) {
1168 fd_cant_recv(conn->handle.fd);
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001169 goto not_ready;
Alexander Liu2a54bb72019-05-22 19:44:48 +08001170 }
1171 goto recv_abort;
1172 }
Willy Tarreau157788c2020-02-11 10:08:05 +01001173 break;
1174 }
Alexander Liu2a54bb72019-05-22 19:44:48 +08001175
Willy Tarreauc192b0a2020-01-23 09:11:58 +01001176 conn->flags &= ~CO_FL_WAIT_L4_CONN;
1177
Alexander Liu2a54bb72019-05-22 19:44:48 +08001178 if (ret < SOCKS4_HS_RSP_LEN) {
1179 /* Missing data. Since we're using MSG_PEEK, we can only poll again if
1180 * we are not able to read enough data.
1181 */
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001182 goto not_ready;
Alexander Liu2a54bb72019-05-22 19:44:48 +08001183 }
1184
1185 /*
1186 * Base on the SOCSK4 protocol:
1187 *
1188 * +----+----+----+----+----+----+----+----+
1189 * | VN | CD | DSTPORT | DSTIP |
1190 * +----+----+----+----+----+----+----+----+
1191 * # of bytes: 1 1 2 4
1192 * VN is the version of the reply code and should be 0. CD is the result
1193 * code with one of the following values:
1194 * 90: request granted
1195 * 91: request rejected or failed
1196 * 92: request rejected becasue SOCKS server cannot connect to identd on the client
1197 * 93: request rejected because the client program and identd report different user-ids
1198 * The remaining fields are ignored.
1199 */
1200 if (line[1] != 90) {
1201 conn->flags &= ~CO_FL_SOCKS4_RECV;
1202
1203 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: FAIL, the response is [%02X|%02X|%02X %02X|%02X %02X %02X %02X]\n",
1204 conn->handle.fd, line[0], line[1], line[2], line[3], line[4], line[5], line[6], line[7]);
1205 if (conn->err_code == CO_ER_NONE) {
1206 conn->err_code = CO_ER_SOCKS4_DENY;
1207 }
1208 goto fail;
1209 }
1210
1211 /* remove the 8 bytes response from the stream */
Willy Tarreau157788c2020-02-11 10:08:05 +01001212 while (1) {
Alexander Liu2a54bb72019-05-22 19:44:48 +08001213 ret = recv(conn->handle.fd, line, SOCKS4_HS_RSP_LEN, 0);
1214 if (ret < 0 && errno == EINTR) {
1215 continue;
1216 }
1217 if (ret != SOCKS4_HS_RSP_LEN) {
1218 if (conn->err_code == CO_ER_NONE) {
1219 conn->err_code = CO_ER_SOCKS4_RECV;
1220 }
1221 goto fail;
1222 }
Willy Tarreau157788c2020-02-11 10:08:05 +01001223 break;
1224 }
Alexander Liu2a54bb72019-05-22 19:44:48 +08001225
1226 conn->flags &= ~CO_FL_SOCKS4_RECV;
1227 return 1;
1228
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001229 not_ready:
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001230 return 0;
1231
Alexander Liu2a54bb72019-05-22 19:44:48 +08001232 recv_abort:
1233 if (conn->err_code == CO_ER_NONE) {
1234 conn->err_code = CO_ER_SOCKS4_ABORT;
1235 }
1236 conn->flags |= (CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH);
1237 goto fail;
1238
1239 fail:
Alexander Liu2a54bb72019-05-22 19:44:48 +08001240 conn->flags |= CO_FL_ERROR;
1241 return 0;
1242}
1243
Ilya Shipitsinca56fce2018-09-15 00:50:05 +05001244/* Note: <remote> is explicitly allowed to be NULL */
Tim Duesterhuscf6e0c82020-03-13 12:34:24 +01001245int make_proxy_line(char *buf, int buf_len, struct server *srv, struct connection *remote, struct stream *strm)
David Safb76832014-05-08 23:42:08 -04001246{
1247 int ret = 0;
1248
1249 if (srv && (srv->pp_opts & SRV_PP_V2)) {
Tim Duesterhuscf6e0c82020-03-13 12:34:24 +01001250 ret = make_proxy_line_v2(buf, buf_len, srv, remote, strm);
David Safb76832014-05-08 23:42:08 -04001251 }
1252 else {
Willy Tarreau226572f2019-07-17 14:46:00 +02001253 if (remote && conn_get_src(remote) && conn_get_dst(remote))
1254 ret = make_proxy_line_v1(buf, buf_len, remote->src, remote->dst);
David Safb76832014-05-08 23:42:08 -04001255 else
1256 ret = make_proxy_line_v1(buf, buf_len, NULL, NULL);
1257 }
1258
1259 return ret;
1260}
1261
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001262/* Makes a PROXY protocol line from the two addresses. The output is sent to
1263 * buffer <buf> for a maximum size of <buf_len> (including the trailing zero).
1264 * It returns the number of bytes composing this line (including the trailing
1265 * LF), or zero in case of failure (eg: not enough space). It supports TCP4,
Willy Tarreau2e1401a2013-10-01 11:41:55 +02001266 * TCP6 and "UNKNOWN" formats. If any of <src> or <dst> is null, UNKNOWN is
1267 * emitted as well.
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001268 */
David Safb76832014-05-08 23:42:08 -04001269int make_proxy_line_v1(char *buf, int buf_len, struct sockaddr_storage *src, struct sockaddr_storage *dst)
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001270{
1271 int ret = 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001272 char * protocol;
1273 char src_str[MAX(INET_ADDRSTRLEN, INET6_ADDRSTRLEN)];
1274 char dst_str[MAX(INET_ADDRSTRLEN, INET6_ADDRSTRLEN)];
1275 in_port_t src_port;
1276 in_port_t dst_port;
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001277
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001278 if ( !src
1279 || !dst
1280 || (src->ss_family != AF_INET && src->ss_family != AF_INET6)
1281 || (dst->ss_family != AF_INET && dst->ss_family != AF_INET6)) {
1282 /* unknown family combination */
1283 ret = snprintf(buf, buf_len, "PROXY UNKNOWN\r\n");
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001284 if (ret >= buf_len)
1285 return 0;
1286
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001287 return ret;
1288 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001289
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001290 /* IPv4 for both src and dst */
1291 if (src->ss_family == AF_INET && dst->ss_family == AF_INET) {
1292 protocol = "TCP4";
1293 if (!inet_ntop(AF_INET, &((struct sockaddr_in *)src)->sin_addr, src_str, sizeof(src_str)))
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001294 return 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001295 src_port = ((struct sockaddr_in *)src)->sin_port;
1296 if (!inet_ntop(AF_INET, &((struct sockaddr_in *)dst)->sin_addr, dst_str, sizeof(dst_str)))
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001297 return 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001298 dst_port = ((struct sockaddr_in *)dst)->sin_port;
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001299 }
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001300 /* IPv6 for at least one of src and dst */
1301 else {
1302 struct in6_addr tmp;
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001303
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001304 protocol = "TCP6";
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001305
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001306 if (src->ss_family == AF_INET) {
1307 /* Convert src to IPv6 */
1308 v4tov6(&tmp, &((struct sockaddr_in *)src)->sin_addr);
1309 src_port = ((struct sockaddr_in *)src)->sin_port;
1310 }
1311 else {
1312 tmp = ((struct sockaddr_in6 *)src)->sin6_addr;
1313 src_port = ((struct sockaddr_in6 *)src)->sin6_port;
1314 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001315
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001316 if (!inet_ntop(AF_INET6, &tmp, src_str, sizeof(src_str)))
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001317 return 0;
1318
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001319 if (dst->ss_family == AF_INET) {
1320 /* Convert dst to IPv6 */
1321 v4tov6(&tmp, &((struct sockaddr_in *)dst)->sin_addr);
1322 dst_port = ((struct sockaddr_in *)dst)->sin_port;
1323 }
1324 else {
1325 tmp = ((struct sockaddr_in6 *)dst)->sin6_addr;
1326 dst_port = ((struct sockaddr_in6 *)dst)->sin6_port;
1327 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001328
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001329 if (!inet_ntop(AF_INET6, &tmp, dst_str, sizeof(dst_str)))
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001330 return 0;
1331 }
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001332
1333 ret = snprintf(buf, buf_len, "PROXY %s %s %s %u %u\r\n", protocol, src_str, dst_str, ntohs(src_port), ntohs(dst_port));
1334 if (ret >= buf_len)
1335 return 0;
1336
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001337 return ret;
1338}
David Safb76832014-05-08 23:42:08 -04001339
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001340static int make_tlv(char *dest, int dest_len, char type, uint16_t length, const char *value)
David Safb76832014-05-08 23:42:08 -04001341{
1342 struct tlv *tlv;
1343
1344 if (!dest || (length + sizeof(*tlv) > dest_len))
1345 return 0;
1346
1347 tlv = (struct tlv *)dest;
1348
1349 tlv->type = type;
1350 tlv->length_hi = length >> 8;
1351 tlv->length_lo = length & 0x00ff;
1352 memcpy(tlv->value, value, length);
1353 return length + sizeof(*tlv);
1354}
David Safb76832014-05-08 23:42:08 -04001355
Ilya Shipitsinca56fce2018-09-15 00:50:05 +05001356/* Note: <remote> is explicitly allowed to be NULL */
Tim Duesterhuscf6e0c82020-03-13 12:34:24 +01001357int make_proxy_line_v2(char *buf, int buf_len, struct server *srv, struct connection *remote, struct stream *strm)
David Safb76832014-05-08 23:42:08 -04001358{
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001359 const char pp2_signature[] = PP2_SIGNATURE;
Emmanuel Hocdet4399c752018-02-05 15:26:43 +01001360 void *tlv_crc32c_p = NULL;
David Safb76832014-05-08 23:42:08 -04001361 int ret = 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001362 struct proxy_hdr_v2 *hdr = (struct proxy_hdr_v2 *)buf;
Vincent Bernat6e615892016-05-18 16:17:44 +02001363 struct sockaddr_storage null_addr = { .ss_family = 0 };
David Safb76832014-05-08 23:42:08 -04001364 struct sockaddr_storage *src = &null_addr;
1365 struct sockaddr_storage *dst = &null_addr;
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001366 const char *value;
1367 int value_len;
David Safb76832014-05-08 23:42:08 -04001368
1369 if (buf_len < PP2_HEADER_LEN)
1370 return 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001371 memcpy(hdr->sig, pp2_signature, PP2_SIGNATURE_LEN);
David Safb76832014-05-08 23:42:08 -04001372
Willy Tarreau226572f2019-07-17 14:46:00 +02001373 if (remote && conn_get_src(remote) && conn_get_dst(remote)) {
1374 src = remote->src;
1375 dst = remote->dst;
David Safb76832014-05-08 23:42:08 -04001376 }
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001377
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001378 /* At least one of src or dst is not of AF_INET or AF_INET6 */
1379 if ( !src
1380 || !dst
1381 || (src->ss_family != AF_INET && src->ss_family != AF_INET6)
1382 || (dst->ss_family != AF_INET && dst->ss_family != AF_INET6)) {
David Safb76832014-05-08 23:42:08 -04001383 if (buf_len < PP2_HDR_LEN_UNSPEC)
1384 return 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001385 hdr->ver_cmd = PP2_VERSION | PP2_CMD_LOCAL;
1386 hdr->fam = PP2_FAM_UNSPEC | PP2_TRANS_UNSPEC;
David Safb76832014-05-08 23:42:08 -04001387 ret = PP2_HDR_LEN_UNSPEC;
1388 }
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001389 else {
Willy Tarreau7f263912020-02-19 15:10:00 +01001390 /* Note: due to historic compatibility with V1 which required
1391 * to send "PROXY" with local addresses for local connections,
1392 * we can end up here with the remote in fact being our outgoing
1393 * connection. We still want to send real addresses and LOCAL on
1394 * it.
1395 */
1396 hdr->ver_cmd = PP2_VERSION;
1397 hdr->ver_cmd |= conn_is_back(remote) ? PP2_CMD_LOCAL : PP2_CMD_PROXY;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001398 /* IPv4 for both src and dst */
1399 if (src->ss_family == AF_INET && dst->ss_family == AF_INET) {
1400 if (buf_len < PP2_HDR_LEN_INET)
1401 return 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001402 hdr->fam = PP2_FAM_INET | PP2_TRANS_STREAM;
1403 hdr->addr.ip4.src_addr = ((struct sockaddr_in *)src)->sin_addr.s_addr;
1404 hdr->addr.ip4.src_port = ((struct sockaddr_in *)src)->sin_port;
1405 hdr->addr.ip4.dst_addr = ((struct sockaddr_in *)dst)->sin_addr.s_addr;
1406 hdr->addr.ip4.dst_port = ((struct sockaddr_in *)dst)->sin_port;
1407 ret = PP2_HDR_LEN_INET;
1408 }
1409 /* IPv6 for at least one of src and dst */
1410 else {
1411 struct in6_addr tmp;
1412
1413 if (buf_len < PP2_HDR_LEN_INET6)
1414 return 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001415 hdr->fam = PP2_FAM_INET6 | PP2_TRANS_STREAM;
1416 if (src->ss_family == AF_INET) {
1417 v4tov6(&tmp, &((struct sockaddr_in *)src)->sin_addr);
1418 memcpy(hdr->addr.ip6.src_addr, &tmp, 16);
1419 hdr->addr.ip6.src_port = ((struct sockaddr_in *)src)->sin_port;
1420 }
1421 else {
1422 memcpy(hdr->addr.ip6.src_addr, &((struct sockaddr_in6 *)src)->sin6_addr, 16);
1423 hdr->addr.ip6.src_port = ((struct sockaddr_in6 *)src)->sin6_port;
1424 }
1425 if (dst->ss_family == AF_INET) {
1426 v4tov6(&tmp, &((struct sockaddr_in *)dst)->sin_addr);
1427 memcpy(hdr->addr.ip6.dst_addr, &tmp, 16);
William Dauchybd8bf672020-01-26 19:06:39 +01001428 hdr->addr.ip6.dst_port = ((struct sockaddr_in *)dst)->sin_port;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001429 }
1430 else {
1431 memcpy(hdr->addr.ip6.dst_addr, &((struct sockaddr_in6 *)dst)->sin6_addr, 16);
1432 hdr->addr.ip6.dst_port = ((struct sockaddr_in6 *)dst)->sin6_port;
1433 }
1434
1435 ret = PP2_HDR_LEN_INET6;
1436 }
1437 }
David Safb76832014-05-08 23:42:08 -04001438
Emmanuel Hocdet4399c752018-02-05 15:26:43 +01001439 if (srv->pp_opts & SRV_PP_V2_CRC32C) {
1440 uint32_t zero_crc32c = 0;
Tim Duesterhusa8692f32020-03-13 12:34:25 +01001441
Emmanuel Hocdet4399c752018-02-05 15:26:43 +01001442 if ((buf_len - ret) < sizeof(struct tlv))
1443 return 0;
1444 tlv_crc32c_p = (void *)((struct tlv *)&buf[ret])->value;
1445 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_CRC32C, sizeof(zero_crc32c), (const char *)&zero_crc32c);
1446 }
1447
Ilya Shipitsinca56fce2018-09-15 00:50:05 +05001448 if (remote && conn_get_alpn(remote, &value, &value_len)) {
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001449 if ((buf_len - ret) < sizeof(struct tlv))
1450 return 0;
Emmanuel Hocdet571c7ac2017-10-31 18:24:05 +01001451 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_ALPN, value_len, value);
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001452 }
1453
Emmanuel Hocdet253c3b72018-02-01 18:29:59 +01001454 if (srv->pp_opts & SRV_PP_V2_AUTHORITY) {
Emmanuel Hocdet8a4ffa02019-08-29 11:54:51 +02001455 value = NULL;
1456 if (remote && remote->proxy_authority) {
1457 value = remote->proxy_authority;
1458 value_len = remote->proxy_authority_len;
1459 }
1460#ifdef USE_OPENSSL
1461 else {
Jerome Magnin78891c72019-09-02 09:53:41 +02001462 if ((value = ssl_sock_get_sni(remote)))
Emmanuel Hocdet8a4ffa02019-08-29 11:54:51 +02001463 value_len = strlen(value);
1464 }
1465#endif
Emmanuel Hocdet253c3b72018-02-01 18:29:59 +01001466 if (value) {
1467 if ((buf_len - ret) < sizeof(struct tlv))
1468 return 0;
Emmanuel Hocdet8a4ffa02019-08-29 11:54:51 +02001469 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_AUTHORITY, value_len, value);
Emmanuel Hocdet253c3b72018-02-01 18:29:59 +01001470 }
1471 }
1472
Tim Duesterhuscf6e0c82020-03-13 12:34:24 +01001473 if (srv->pp_opts & SRV_PP_V2_UNIQUE_ID) {
1474 struct session* sess = strm_sess(strm);
1475 struct ist unique_id = stream_generate_unique_id(strm, &sess->fe->format_unique_id);
1476
1477 value = unique_id.ptr;
1478 value_len = unique_id.len;
1479
1480 if (value_len >= 0) {
1481 if ((buf_len - ret) < sizeof(struct tlv))
1482 return 0;
1483 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_UNIQUE_ID, value_len, value);
1484 }
1485 }
1486
Emmanuel Hocdet8a4ffa02019-08-29 11:54:51 +02001487#ifdef USE_OPENSSL
David Safb76832014-05-08 23:42:08 -04001488 if (srv->pp_opts & SRV_PP_V2_SSL) {
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001489 struct tlv_ssl *tlv;
1490 int ssl_tlv_len = 0;
Tim Duesterhusa8692f32020-03-13 12:34:25 +01001491
David Safb76832014-05-08 23:42:08 -04001492 if ((buf_len - ret) < sizeof(struct tlv_ssl))
1493 return 0;
1494 tlv = (struct tlv_ssl *)&buf[ret];
1495 memset(tlv, 0, sizeof(struct tlv_ssl));
1496 ssl_tlv_len += sizeof(struct tlv_ssl);
1497 tlv->tlv.type = PP2_TYPE_SSL;
1498 if (ssl_sock_is_ssl(remote)) {
1499 tlv->client |= PP2_CLIENT_SSL;
Emmanuel Hocdet01da5712017-10-13 16:59:49 +02001500 value = ssl_sock_get_proto_version(remote);
David Safb76832014-05-08 23:42:08 -04001501 if (value) {
Emmanuel Hocdet8c0c34b2018-02-28 12:02:14 +01001502 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len-ret-ssl_tlv_len), PP2_SUBTYPE_SSL_VERSION, strlen(value), value);
David Safb76832014-05-08 23:42:08 -04001503 }
Dave McCowan328fb582014-07-30 10:39:13 -04001504 if (ssl_sock_get_cert_used_sess(remote)) {
1505 tlv->client |= PP2_CLIENT_CERT_SESS;
David Safb76832014-05-08 23:42:08 -04001506 tlv->verify = htonl(ssl_sock_get_verify_result(remote));
Dave McCowan328fb582014-07-30 10:39:13 -04001507 if (ssl_sock_get_cert_used_conn(remote))
1508 tlv->client |= PP2_CLIENT_CERT_CONN;
David Safb76832014-05-08 23:42:08 -04001509 }
1510 if (srv->pp_opts & SRV_PP_V2_SSL_CN) {
Willy Tarreau83061a82018-07-13 11:56:34 +02001511 struct buffer *cn_trash = get_trash_chunk();
Willy Tarreau3b9a0c92014-07-19 06:37:33 +02001512 if (ssl_sock_get_remote_common_name(remote, cn_trash) > 0) {
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001513 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_CN,
1514 cn_trash->data,
1515 cn_trash->area);
David Safb76832014-05-08 23:42:08 -04001516 }
1517 }
Emmanuel Hocdetfa8d0f12018-02-01 15:53:52 +01001518 if (srv->pp_opts & SRV_PP_V2_SSL_KEY_ALG) {
Willy Tarreau83061a82018-07-13 11:56:34 +02001519 struct buffer *pkey_trash = get_trash_chunk();
Emmanuel Hocdetfa8d0f12018-02-01 15:53:52 +01001520 if (ssl_sock_get_pkey_algo(remote, pkey_trash) > 0) {
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001521 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_KEY_ALG,
1522 pkey_trash->data,
1523 pkey_trash->area);
Emmanuel Hocdetfa8d0f12018-02-01 15:53:52 +01001524 }
1525 }
1526 if (srv->pp_opts & SRV_PP_V2_SSL_SIG_ALG) {
1527 value = ssl_sock_get_cert_sig(remote);
1528 if (value) {
1529 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_SIG_ALG, strlen(value), value);
1530 }
1531 }
1532 if (srv->pp_opts & SRV_PP_V2_SSL_CIPHER) {
1533 value = ssl_sock_get_cipher_name(remote);
1534 if (value) {
1535 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_CIPHER, strlen(value), value);
1536 }
1537 }
David Safb76832014-05-08 23:42:08 -04001538 }
1539 tlv->tlv.length_hi = (uint16_t)(ssl_tlv_len - sizeof(struct tlv)) >> 8;
1540 tlv->tlv.length_lo = (uint16_t)(ssl_tlv_len - sizeof(struct tlv)) & 0x00ff;
1541 ret += ssl_tlv_len;
1542 }
1543#endif
1544
Willy Tarreaue5733232019-05-22 19:24:06 +02001545#ifdef USE_NS
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001546 if (remote && (remote->proxy_netns)) {
1547 if ((buf_len - ret) < sizeof(struct tlv))
1548 return 0;
Emmanuel Hocdet571c7ac2017-10-31 18:24:05 +01001549 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_NETNS, remote->proxy_netns->name_len, remote->proxy_netns->node.key);
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001550 }
1551#endif
1552
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001553 hdr->len = htons((uint16_t)(ret - PP2_HEADER_LEN));
David Safb76832014-05-08 23:42:08 -04001554
Emmanuel Hocdet4399c752018-02-05 15:26:43 +01001555 if (tlv_crc32c_p) {
1556 write_u32(tlv_crc32c_p, htonl(hash_crc32c(buf, ret)));
1557 }
1558
David Safb76832014-05-08 23:42:08 -04001559 return ret;
1560}
Emeric Brun4f603012017-01-05 15:11:44 +01001561
Willy Tarreau60ca10a2017-08-18 15:26:54 +02001562/* return the major HTTP version as 1 or 2 depending on how the request arrived
1563 * before being processed.
1564 */
1565static int
1566smp_fetch_fc_http_major(const struct arg *args, struct sample *smp, const char *kw, void *private)
1567{
Jérôme Magnin86577422018-12-07 09:03:11 +01001568 struct connection *conn = (kw[0] != 'b') ? objt_conn(smp->sess->origin) :
1569 smp->strm ? cs_conn(objt_cs(smp->strm->si[1].end)) : NULL;
Willy Tarreau60ca10a2017-08-18 15:26:54 +02001570
1571 smp->data.type = SMP_T_SINT;
1572 smp->data.u.sint = (conn && strcmp(conn_get_mux_name(conn), "H2") == 0) ? 2 : 1;
1573 return 1;
1574}
1575
Emeric Brun4f603012017-01-05 15:11:44 +01001576/* fetch if the received connection used a PROXY protocol header */
1577int smp_fetch_fc_rcvd_proxy(const struct arg *args, struct sample *smp, const char *kw, void *private)
1578{
1579 struct connection *conn;
1580
1581 conn = objt_conn(smp->sess->origin);
1582 if (!conn)
1583 return 0;
1584
Willy Tarreau911db9b2020-01-23 16:27:54 +01001585 if (conn->flags & CO_FL_WAIT_XPRT) {
Emeric Brun4f603012017-01-05 15:11:44 +01001586 smp->flags |= SMP_F_MAY_CHANGE;
1587 return 0;
1588 }
1589
1590 smp->flags = 0;
1591 smp->data.type = SMP_T_BOOL;
1592 smp->data.u.sint = (conn->flags & CO_FL_RCVD_PROXY) ? 1 : 0;
1593
1594 return 1;
1595}
1596
Geoff Simmons7185b782019-08-27 18:31:16 +02001597/* fetch the authority TLV from a PROXY protocol header */
1598int smp_fetch_fc_pp_authority(const struct arg *args, struct sample *smp, const char *kw, void *private)
1599{
1600 struct connection *conn;
1601
1602 conn = objt_conn(smp->sess->origin);
1603 if (!conn)
1604 return 0;
1605
Willy Tarreau911db9b2020-01-23 16:27:54 +01001606 if (conn->flags & CO_FL_WAIT_XPRT) {
Geoff Simmons7185b782019-08-27 18:31:16 +02001607 smp->flags |= SMP_F_MAY_CHANGE;
1608 return 0;
1609 }
1610
1611 if (conn->proxy_authority == NULL)
1612 return 0;
1613
1614 smp->flags = 0;
1615 smp->data.type = SMP_T_STR;
1616 smp->data.u.str.area = conn->proxy_authority;
1617 smp->data.u.str.data = conn->proxy_authority_len;
1618
1619 return 1;
1620}
1621
Tim Duesterhusd1b15b62020-03-13 12:34:23 +01001622/* fetch the unique ID TLV from a PROXY protocol header */
1623int smp_fetch_fc_pp_unique_id(const struct arg *args, struct sample *smp, const char *kw, void *private)
1624{
1625 struct connection *conn;
1626
1627 conn = objt_conn(smp->sess->origin);
1628 if (!conn)
1629 return 0;
1630
1631 if (conn->flags & CO_FL_WAIT_XPRT) {
1632 smp->flags |= SMP_F_MAY_CHANGE;
1633 return 0;
1634 }
1635
1636 if (!isttest(conn->proxy_unique_id))
1637 return 0;
1638
1639 smp->flags = 0;
1640 smp->data.type = SMP_T_STR;
1641 smp->data.u.str.area = conn->proxy_unique_id.ptr;
1642 smp->data.u.str.data = conn->proxy_unique_id.len;
1643
1644 return 1;
1645}
1646
Emeric Brun4f603012017-01-05 15:11:44 +01001647/* Note: must not be declared <const> as its list will be overwritten.
1648 * Note: fetches that may return multiple types must be declared as the lowest
1649 * common denominator, the type that can be casted into all other ones. For
1650 * instance v4/v6 must be declared v4.
1651 */
1652static struct sample_fetch_kw_list sample_fetch_keywords = {ILH, {
Willy Tarreau60ca10a2017-08-18 15:26:54 +02001653 { "fc_http_major", smp_fetch_fc_http_major, 0, NULL, SMP_T_SINT, SMP_USE_L4CLI },
Jérôme Magnin86577422018-12-07 09:03:11 +01001654 { "bc_http_major", smp_fetch_fc_http_major, 0, NULL, SMP_T_SINT, SMP_USE_L4SRV },
Emeric Brun4f603012017-01-05 15:11:44 +01001655 { "fc_rcvd_proxy", smp_fetch_fc_rcvd_proxy, 0, NULL, SMP_T_BOOL, SMP_USE_L4CLI },
Geoff Simmons7185b782019-08-27 18:31:16 +02001656 { "fc_pp_authority", smp_fetch_fc_pp_authority, 0, NULL, SMP_T_STR, SMP_USE_L4CLI },
Tim Duesterhusd1b15b62020-03-13 12:34:23 +01001657 { "fc_pp_unique_id", smp_fetch_fc_pp_unique_id, 0, NULL, SMP_T_STR, SMP_USE_L4CLI },
Emeric Brun4f603012017-01-05 15:11:44 +01001658 { /* END */ },
1659}};
1660
Willy Tarreau0108d902018-11-25 19:14:37 +01001661INITCALL1(STG_REGISTER, sample_register_fetches, &sample_fetch_keywords);