blob: 92633670e1ca18f1707004aa9c2a9a9b66decfd7 [file] [log] [blame]
Willy Tarreau59f98392012-07-06 14:13:49 +02001/*
2 * Connection management functions
3 *
4 * Copyright 2000-2012 Willy Tarreau <w@1wt.eu>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
Willy Tarreaue1e4a612012-10-05 00:10:55 +020013#include <errno.h>
14
Willy Tarreau4c7e4b72020-05-27 12:58:42 +020015#include <haproxy/api.h>
Willy Tarreau6be78492020-06-05 00:00:29 +020016#include <haproxy/cfgparse.h>
Willy Tarreau7ea393d2020-06-04 18:02:10 +020017#include <haproxy/connection.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020018#include <haproxy/fd.h>
Willy Tarreau762d7a52020-06-04 11:23:07 +020019#include <haproxy/frontend.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020020#include <haproxy/hash.h>
Willy Tarreau36979d92020-06-05 17:27:29 +020021#include <haproxy/log-t.h>
Willy Tarreau7a00efb2020-06-02 17:02:59 +020022#include <haproxy/namespace.h>
Willy Tarreau6131d6a2020-06-02 16:48:09 +020023#include <haproxy/net_helper.h>
Willy Tarreaufc774542020-06-04 17:31:04 +020024#include <haproxy/proto_tcp.h>
Willy Tarreaue6ce10b2020-06-04 15:33:47 +020025#include <haproxy/sample.h>
Willy Tarreau209108d2020-06-04 20:30:20 +020026#include <haproxy/ssl_sock.h>
Willy Tarreau5e539c92020-06-04 20:45:39 +020027#include <haproxy/stream_interface.h>
Emeric Brun46591952012-05-18 15:47:34 +020028
Alexander Liu2a54bb72019-05-22 19:44:48 +080029
Willy Tarreau8ceae722018-11-26 11:58:30 +010030DECLARE_POOL(pool_head_connection, "connection", sizeof(struct connection));
31DECLARE_POOL(pool_head_connstream, "conn_stream", sizeof(struct conn_stream));
Willy Tarreauff5d57b2019-07-17 18:37:02 +020032DECLARE_POOL(pool_head_sockaddr, "sockaddr", sizeof(struct sockaddr_storage));
Geoff Simmons7185b782019-08-27 18:31:16 +020033DECLARE_POOL(pool_head_authority, "authority", PP2_AUTHORITY_MAX);
Willy Tarreau8ceae722018-11-26 11:58:30 +010034
Willy Tarreau4d82bf52020-06-28 00:19:17 +020035struct idle_conns idle_conns[MAX_THREADS] = { };
Willy Tarreau13e14102016-12-22 20:25:26 +010036struct xprt_ops *registered_xprt[XPRT_ENTRIES] = { NULL, };
Willy Tarreauf2943dc2012-10-26 20:10:28 +020037
Christopher Faulet32f61c02018-04-10 14:33:41 +020038/* List head of all known muxes for PROTO */
39struct mux_proto_list mux_proto_list = {
40 .list = LIST_HEAD_INIT(mux_proto_list.list)
Willy Tarreau2386be62017-09-21 19:40:52 +020041};
42
Willy Tarreau119e50e2020-05-22 13:53:29 +020043/* disables sending of proxy-protocol-v2's LOCAL command */
44static int pp2_never_send_local;
45
Olivier Houchard477902b2020-01-22 18:08:48 +010046int conn_create_mux(struct connection *conn)
47{
Olivier Houchard477902b2020-01-22 18:08:48 +010048 if (conn_is_back(conn)) {
49 struct server *srv;
50 struct conn_stream *cs = conn->ctx;
Christopher Faulet14cd3162020-04-16 14:50:06 +020051 struct session *sess = conn->owner;
Olivier Houchard477902b2020-01-22 18:08:48 +010052
53 if (conn->flags & CO_FL_ERROR)
54 goto fail;
Olivier Houcharda8a415d2020-01-23 13:15:14 +010055
Christopher Faulet14cd3162020-04-16 14:50:06 +020056 if (sess && obj_type(sess->origin) == OBJ_TYPE_CHECK) {
Willy Tarreau38b4d2e2020-11-20 17:08:15 +010057 if (conn_install_mux_chk(conn, conn->ctx, sess) < 0)
Christopher Faulet14cd3162020-04-16 14:50:06 +020058 goto fail;
59 }
Willy Tarreau38b4d2e2020-11-20 17:08:15 +010060 else if (conn_install_mux_be(conn, conn->ctx, sess) < 0)
Olivier Houchard477902b2020-01-22 18:08:48 +010061 goto fail;
62 srv = objt_server(conn->target);
Christopher Faulet08016ab2020-07-01 16:10:06 +020063
64 /* If we're doing http-reuse always, and the connection is not
65 * private with available streams (an http2 connection), add it
66 * to the available list, so that others can use it right
67 * away. If the connection is private, add it in the session
68 * server list.
69 */
Christopher Faulet2883fcf2020-07-01 14:59:43 +020070 if (srv && ((srv->proxy->options & PR_O_REUSE_MASK) == PR_O_REUSE_ALWS) &&
Christopher Fauletaa278532020-06-30 14:47:46 +020071 !(conn->flags & CO_FL_PRIVATE) && conn->mux->avail_streams(conn) > 0)
Amaury Denoyellef232cb32021-01-06 16:14:12 +010072 ebmb_insert(&srv->available_conns_tree[tid], &conn->hash_node, sizeof(conn->hash));
Christopher Faulet08016ab2020-07-01 16:10:06 +020073 else if (conn->flags & CO_FL_PRIVATE) {
Ilya Shipitsin6b79f382020-07-23 00:32:55 +050074 /* If it fail now, the same will be done in mux->detach() callback */
Willy Tarreau38b4d2e2020-11-20 17:08:15 +010075 session_add_conn(sess, conn, conn->target);
Christopher Faulet08016ab2020-07-01 16:10:06 +020076 }
Olivier Houchard477902b2020-01-22 18:08:48 +010077 return 0;
78fail:
79 /* let the upper layer know the connection failed */
80 cs->data_cb->wake(cs);
81 return -1;
82 } else
83 return conn_complete_session(conn);
84
85}
86
Willy Tarreauff3e6482015-03-12 23:56:52 +010087/* Send a message over an established connection. It makes use of send() and
88 * returns the same return code and errno. If the socket layer is not ready yet
89 * then -1 is returned and ENOTSOCK is set into errno. If the fd is not marked
90 * as ready, or if EAGAIN or ENOTCONN is returned, then we return 0. It returns
91 * EMSGSIZE if called with a zero length message. The purpose is to simplify
92 * some rare attempts to directly write on the socket from above the connection
93 * (typically send_proxy). In case of EAGAIN, the fd is marked as "cant_send".
94 * It automatically retries on EINTR. Other errors cause the connection to be
95 * marked as in error state. It takes similar arguments as send() except the
Willy Tarreau827fee72020-12-11 15:26:55 +010096 * first one which is the connection instead of the file descriptor. <flags>
97 * only support CO_SFL_MSG_MORE.
Willy Tarreauff3e6482015-03-12 23:56:52 +010098 */
Willy Tarreau827fee72020-12-11 15:26:55 +010099int conn_ctrl_send(struct connection *conn, const void *buf, int len, int flags)
Willy Tarreauff3e6482015-03-12 23:56:52 +0100100{
Willy Tarreau827fee72020-12-11 15:26:55 +0100101 const struct buffer buffer = b_make((char*)buf, len, 0, len);
102 const struct xprt_ops *xprt = xprt_get(XPRT_RAW);
Willy Tarreauff3e6482015-03-12 23:56:52 +0100103 int ret;
104
105 ret = -1;
106 errno = ENOTSOCK;
107
108 if (conn->flags & CO_FL_SOCK_WR_SH)
109 goto fail;
110
111 if (!conn_ctrl_ready(conn))
112 goto fail;
113
114 errno = EMSGSIZE;
115 if (!len)
116 goto fail;
117
Willy Tarreau827fee72020-12-11 15:26:55 +0100118 /* snd_buf() already takes care of updating conn->flags and handling
119 * the FD polling status.
120 */
121 ret = xprt->snd_buf(conn, NULL, &buffer, buffer.data, flags);
122 if (conn->flags & CO_FL_ERROR)
123 ret = -1;
124 return ret;
Willy Tarreauff3e6482015-03-12 23:56:52 +0100125 fail:
126 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH | CO_FL_ERROR;
127 return ret;
128}
129
Willy Tarreau746b0512020-12-11 17:06:11 +0100130/* Called from the upper layer, to unsubscribe <es> from events <event_type>.
131 * The event subscriber <es> is not allowed to change from a previous call as
132 * long as at least one event is still subscribed. The <event_type> must only
133 * be a combination of SUB_RETRY_RECV and SUB_RETRY_SEND. It always returns 0.
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100134 */
135int conn_unsubscribe(struct connection *conn, void *xprt_ctx, int event_type, struct wait_event *es)
Olivier Houchard83a0cd82018-09-28 17:57:58 +0200136{
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100137 BUG_ON(event_type & ~(SUB_RETRY_SEND|SUB_RETRY_RECV));
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100138 BUG_ON(conn->subs && conn->subs != es);
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100139
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100140 es->events &= ~event_type;
141 if (!es->events)
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100142 conn->subs = NULL;
143
Willy Tarreau746b0512020-12-11 17:06:11 +0100144 if (conn_ctrl_ready(conn) && conn->ctrl->ignore_events)
145 conn->ctrl->ignore_events(conn, event_type);
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100146
Olivier Houchard83a0cd82018-09-28 17:57:58 +0200147 return 0;
148}
149
Willy Tarreau7e59c0a2020-02-28 14:24:49 +0100150/* Called from the upper layer, to subscribe <es> to events <event_type>.
151 * The <es> struct is not allowed to differ from the one passed during a
Willy Tarreau746b0512020-12-11 17:06:11 +0100152 * previous call to subscribe(). If the connection's ctrl layer is ready,
153 * the wait_event is immediately woken up and the subcription is cancelled.
154 * It always returns zero.
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100155 */
156int conn_subscribe(struct connection *conn, void *xprt_ctx, int event_type, struct wait_event *es)
Olivier Houchard6ff20392018-07-17 18:46:31 +0200157{
Willy Tarreau746b0512020-12-11 17:06:11 +0100158 int ret = 0;
159
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100160 BUG_ON(event_type & ~(SUB_RETRY_SEND|SUB_RETRY_RECV));
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100161 BUG_ON(conn->subs && conn->subs != es);
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100162
Willy Tarreau7e59c0a2020-02-28 14:24:49 +0100163 if (conn->subs && (conn->subs->events & event_type) == event_type)
164 return 0;
165
Willy Tarreau746b0512020-12-11 17:06:11 +0100166 if (conn_ctrl_ready(conn) && conn->ctrl->check_events) {
167 ret = conn->ctrl->check_events(conn, event_type);
168 if (ret)
169 tasklet_wakeup(es->tasklet);
Willy Tarreaud1d14c32020-02-21 10:34:19 +0100170 }
Willy Tarreau746b0512020-12-11 17:06:11 +0100171
172 es->events = (es->events | event_type) & ~ret;
173 conn->subs = es->events ? es : NULL;
Olivier Houchard83a0cd82018-09-28 17:57:58 +0200174 return 0;
Olivier Houchard6ff20392018-07-17 18:46:31 +0200175}
176
Willy Tarreau2ded48d2020-12-11 16:20:34 +0100177/* Drains possibly pending incoming data on the connection and update the flags
178 * accordingly. This is used to know whether we need to disable lingering on
179 * close. Returns non-zero if it is safe to close without disabling lingering,
180 * otherwise zero. The CO_FL_SOCK_RD_SH flag may also be updated if the incoming
181 * shutdown was reported by the ->drain() function.
Willy Tarreaud85c4852015-03-13 00:40:28 +0100182 */
Willy Tarreau2ded48d2020-12-11 16:20:34 +0100183int conn_ctrl_drain(struct connection *conn)
Willy Tarreaud85c4852015-03-13 00:40:28 +0100184{
Willy Tarreau2ded48d2020-12-11 16:20:34 +0100185 int ret = 0;
Willy Tarreaue215bba2018-08-24 14:31:53 +0200186
Willy Tarreau2ded48d2020-12-11 16:20:34 +0100187 if (!conn_ctrl_ready(conn) || conn->flags & (CO_FL_ERROR | CO_FL_SOCK_RD_SH))
188 ret = 1;
189 else if (conn->ctrl->drain) {
190 ret = conn->ctrl->drain(conn);
191 if (ret)
192 conn->flags |= CO_FL_SOCK_RD_SH;
Willy Tarreaud85c4852015-03-13 00:40:28 +0100193 }
Willy Tarreau2ded48d2020-12-11 16:20:34 +0100194 return ret;
Willy Tarreaud85c4852015-03-13 00:40:28 +0100195}
196
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100197/*
198 * Get data length from tlv
199 */
Tim Duesterhusba837ec2020-03-05 23:11:02 +0100200static inline size_t get_tlv_length(const struct tlv *src)
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100201{
202 return (src->length_hi << 8) | src->length_lo;
203}
204
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200205/* This handshake handler waits a PROXY protocol header at the beginning of the
206 * raw data stream. The header looks like this :
207 *
208 * "PROXY" <SP> PROTO <SP> SRC3 <SP> DST3 <SP> SRC4 <SP> <DST4> "\r\n"
209 *
210 * There must be exactly one space between each field. Fields are :
211 * - PROTO : layer 4 protocol, which must be "TCP4" or "TCP6".
212 * - SRC3 : layer 3 (eg: IP) source address in standard text form
213 * - DST3 : layer 3 (eg: IP) destination address in standard text form
214 * - SRC4 : layer 4 (eg: TCP port) source address in standard text form
215 * - DST4 : layer 4 (eg: TCP port) destination address in standard text form
216 *
217 * This line MUST be at the beginning of the buffer and MUST NOT wrap.
218 *
219 * The header line is small and in all cases smaller than the smallest normal
220 * TCP MSS. So it MUST always be delivered as one segment, which ensures we
221 * can safely use MSG_PEEK and avoid buffering.
222 *
223 * Once the data is fetched, the values are set in the connection's address
224 * fields, and data are removed from the socket's buffer. The function returns
225 * zero if it needs to wait for more data or if it fails, or 1 if it completed
226 * and removed itself.
227 */
228int conn_recv_proxy(struct connection *conn, int flag)
229{
230 char *line, *end;
Willy Tarreau77992672014-06-14 11:06:17 +0200231 struct proxy_hdr_v2 *hdr_v2;
232 const char v2sig[] = PP2_SIGNATURE;
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100233 size_t total_v2_len;
Tim Duesterhusba837ec2020-03-05 23:11:02 +0100234 size_t tlv_offset = 0;
Willy Tarreaub406b872018-08-22 05:20:32 +0200235 int ret;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200236
Willy Tarreau3c728722014-01-23 13:50:42 +0100237 if (!conn_ctrl_ready(conn))
Willy Tarreauf79c8172013-10-21 16:30:56 +0200238 goto fail;
239
Willy Tarreau9b7587a2020-10-15 07:32:10 +0200240 if (!sockaddr_alloc(&conn->src, NULL, 0) || !sockaddr_alloc(&conn->dst, NULL, 0))
Willy Tarreauca79f592019-07-17 19:04:47 +0200241 goto fail;
242
Willy Tarreau585744b2017-08-24 14:31:19 +0200243 if (!fd_recv_ready(conn->handle.fd))
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200244 goto not_ready;
Willy Tarreaufd803bb2014-01-20 15:13:07 +0100245
Willy Tarreau157788c2020-02-11 10:08:05 +0100246 while (1) {
Willy Tarreaub406b872018-08-22 05:20:32 +0200247 ret = recv(conn->handle.fd, trash.area, trash.size, MSG_PEEK);
248 if (ret < 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200249 if (errno == EINTR)
250 continue;
251 if (errno == EAGAIN) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200252 fd_cant_recv(conn->handle.fd);
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200253 goto not_ready;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200254 }
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100255 goto recv_abort;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200256 }
Willy Tarreaub406b872018-08-22 05:20:32 +0200257 trash.data = ret;
Willy Tarreau157788c2020-02-11 10:08:05 +0100258 break;
259 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200260
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200261 if (!trash.data) {
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100262 /* client shutdown */
263 conn->err_code = CO_ER_PRX_EMPTY;
264 goto fail;
265 }
266
Willy Tarreauc192b0a2020-01-23 09:11:58 +0100267 conn->flags &= ~CO_FL_WAIT_L4_CONN;
268
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200269 if (trash.data < 6)
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200270 goto missing;
271
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200272 line = trash.area;
273 end = trash.area + trash.data;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200274
275 /* Decode a possible proxy request, fail early if it does not match */
Willy Tarreau77992672014-06-14 11:06:17 +0200276 if (strncmp(line, "PROXY ", 6) != 0)
277 goto not_v1;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200278
279 line += 6;
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200280 if (trash.data < 9) /* shortest possible line */
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200281 goto missing;
282
David CARLIER42ff05e2016-03-24 09:22:36 +0000283 if (memcmp(line, "TCP4 ", 5) == 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200284 u32 src3, dst3, sport, dport;
285
286 line += 5;
287
288 src3 = inetaddr_host_lim_ret(line, end, &line);
289 if (line == end)
290 goto missing;
291 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100292 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200293
294 dst3 = inetaddr_host_lim_ret(line, end, &line);
295 if (line == end)
296 goto missing;
297 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100298 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200299
300 sport = read_uint((const char **)&line, end);
301 if (line == end)
302 goto missing;
303 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100304 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200305
306 dport = read_uint((const char **)&line, end);
307 if (line > end - 2)
308 goto missing;
309 if (*line++ != '\r')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100310 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200311 if (*line++ != '\n')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100312 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200313
314 /* update the session's addresses and mark them set */
Willy Tarreau226572f2019-07-17 14:46:00 +0200315 ((struct sockaddr_in *)conn->src)->sin_family = AF_INET;
316 ((struct sockaddr_in *)conn->src)->sin_addr.s_addr = htonl(src3);
317 ((struct sockaddr_in *)conn->src)->sin_port = htons(sport);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200318
Willy Tarreau226572f2019-07-17 14:46:00 +0200319 ((struct sockaddr_in *)conn->dst)->sin_family = AF_INET;
320 ((struct sockaddr_in *)conn->dst)->sin_addr.s_addr = htonl(dst3);
321 ((struct sockaddr_in *)conn->dst)->sin_port = htons(dport);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200322 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
323 }
David CARLIER42ff05e2016-03-24 09:22:36 +0000324 else if (memcmp(line, "TCP6 ", 5) == 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200325 u32 sport, dport;
326 char *src_s;
327 char *dst_s, *sport_s, *dport_s;
328 struct in6_addr src3, dst3;
329
330 line += 5;
331
332 src_s = line;
333 dst_s = sport_s = dport_s = NULL;
334 while (1) {
335 if (line > end - 2) {
336 goto missing;
337 }
338 else if (*line == '\r') {
339 *line = 0;
340 line++;
341 if (*line++ != '\n')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100342 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200343 break;
344 }
345
346 if (*line == ' ') {
347 *line = 0;
348 if (!dst_s)
349 dst_s = line + 1;
350 else if (!sport_s)
351 sport_s = line + 1;
352 else if (!dport_s)
353 dport_s = line + 1;
354 }
355 line++;
356 }
357
358 if (!dst_s || !sport_s || !dport_s)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100359 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200360
361 sport = read_uint((const char **)&sport_s,dport_s - 1);
362 if (*sport_s != 0)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100363 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200364
365 dport = read_uint((const char **)&dport_s,line - 2);
366 if (*dport_s != 0)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100367 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200368
369 if (inet_pton(AF_INET6, src_s, (void *)&src3) != 1)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100370 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200371
372 if (inet_pton(AF_INET6, dst_s, (void *)&dst3) != 1)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100373 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200374
375 /* update the session's addresses and mark them set */
Willy Tarreau226572f2019-07-17 14:46:00 +0200376 ((struct sockaddr_in6 *)conn->src)->sin6_family = AF_INET6;
377 memcpy(&((struct sockaddr_in6 *)conn->src)->sin6_addr, &src3, sizeof(struct in6_addr));
378 ((struct sockaddr_in6 *)conn->src)->sin6_port = htons(sport);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200379
Willy Tarreau226572f2019-07-17 14:46:00 +0200380 ((struct sockaddr_in6 *)conn->dst)->sin6_family = AF_INET6;
381 memcpy(&((struct sockaddr_in6 *)conn->dst)->sin6_addr, &dst3, sizeof(struct in6_addr));
382 ((struct sockaddr_in6 *)conn->dst)->sin6_port = htons(dport);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200383 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
384 }
Willy Tarreau4c20d292014-06-14 11:41:36 +0200385 else if (memcmp(line, "UNKNOWN\r\n", 9) == 0) {
386 /* This can be a UNIX socket forwarded by an haproxy upstream */
387 line += 9;
388 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200389 else {
Willy Tarreau4c20d292014-06-14 11:41:36 +0200390 /* The protocol does not match something known (TCP4/TCP6/UNKNOWN) */
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100391 conn->err_code = CO_ER_PRX_BAD_PROTO;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200392 goto fail;
393 }
394
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200395 trash.data = line - trash.area;
Willy Tarreau77992672014-06-14 11:06:17 +0200396 goto eat_header;
397
398 not_v1:
399 /* try PPv2 */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200400 if (trash.data < PP2_HEADER_LEN)
Willy Tarreau77992672014-06-14 11:06:17 +0200401 goto missing;
402
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200403 hdr_v2 = (struct proxy_hdr_v2 *) trash.area;
Willy Tarreau77992672014-06-14 11:06:17 +0200404
405 if (memcmp(hdr_v2->sig, v2sig, PP2_SIGNATURE_LEN) != 0 ||
406 (hdr_v2->ver_cmd & PP2_VERSION_MASK) != PP2_VERSION) {
407 conn->err_code = CO_ER_PRX_NOT_HDR;
408 goto fail;
409 }
410
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100411 total_v2_len = PP2_HEADER_LEN + ntohs(hdr_v2->len);
412 if (trash.data < total_v2_len)
Willy Tarreau77992672014-06-14 11:06:17 +0200413 goto missing;
414
415 switch (hdr_v2->ver_cmd & PP2_CMD_MASK) {
416 case 0x01: /* PROXY command */
417 switch (hdr_v2->fam) {
418 case 0x11: /* TCPv4 */
KOVACS Krisztianefd3aa92014-11-19 10:53:20 +0100419 if (ntohs(hdr_v2->len) < PP2_ADDR_LEN_INET)
420 goto bad_header;
421
Willy Tarreau226572f2019-07-17 14:46:00 +0200422 ((struct sockaddr_in *)conn->src)->sin_family = AF_INET;
423 ((struct sockaddr_in *)conn->src)->sin_addr.s_addr = hdr_v2->addr.ip4.src_addr;
424 ((struct sockaddr_in *)conn->src)->sin_port = hdr_v2->addr.ip4.src_port;
425 ((struct sockaddr_in *)conn->dst)->sin_family = AF_INET;
426 ((struct sockaddr_in *)conn->dst)->sin_addr.s_addr = hdr_v2->addr.ip4.dst_addr;
427 ((struct sockaddr_in *)conn->dst)->sin_port = hdr_v2->addr.ip4.dst_port;
Willy Tarreau77992672014-06-14 11:06:17 +0200428 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
KOVACS Krisztian7209c202015-07-03 14:09:10 +0200429 tlv_offset = PP2_HEADER_LEN + PP2_ADDR_LEN_INET;
Willy Tarreau77992672014-06-14 11:06:17 +0200430 break;
431 case 0x21: /* TCPv6 */
KOVACS Krisztianefd3aa92014-11-19 10:53:20 +0100432 if (ntohs(hdr_v2->len) < PP2_ADDR_LEN_INET6)
433 goto bad_header;
434
Willy Tarreau226572f2019-07-17 14:46:00 +0200435 ((struct sockaddr_in6 *)conn->src)->sin6_family = AF_INET6;
436 memcpy(&((struct sockaddr_in6 *)conn->src)->sin6_addr, hdr_v2->addr.ip6.src_addr, 16);
437 ((struct sockaddr_in6 *)conn->src)->sin6_port = hdr_v2->addr.ip6.src_port;
438 ((struct sockaddr_in6 *)conn->dst)->sin6_family = AF_INET6;
439 memcpy(&((struct sockaddr_in6 *)conn->dst)->sin6_addr, hdr_v2->addr.ip6.dst_addr, 16);
440 ((struct sockaddr_in6 *)conn->dst)->sin6_port = hdr_v2->addr.ip6.dst_port;
Willy Tarreau77992672014-06-14 11:06:17 +0200441 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
KOVACS Krisztian7209c202015-07-03 14:09:10 +0200442 tlv_offset = PP2_HEADER_LEN + PP2_ADDR_LEN_INET6;
Willy Tarreau77992672014-06-14 11:06:17 +0200443 break;
444 }
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100445
446 /* TLV parsing */
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100447 while (tlv_offset < total_v2_len) {
448 struct tlv *tlv_packet;
Tim Duesterhusba837ec2020-03-05 23:11:02 +0100449 size_t tlv_len;
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100450
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100451 /* Verify that we have at least TLV_HEADER_SIZE bytes left */
452 if (tlv_offset + TLV_HEADER_SIZE > total_v2_len)
453 goto bad_header;
454
455 tlv_packet = (struct tlv *) &trash.area[tlv_offset];
456 tlv_len = get_tlv_length(tlv_packet);
457 tlv_offset += tlv_len + TLV_HEADER_SIZE;
458
459 /* Verify that the TLV length does not exceed the total PROXYv2 length */
460 if (tlv_offset > total_v2_len)
461 goto bad_header;
462
463 switch (tlv_packet->type) {
464 case PP2_TYPE_CRC32C: {
465 uint32_t n_crc32c;
466
467 /* Verify that this TLV is exactly 4 bytes long */
468 if (tlv_len != 4)
469 goto bad_header;
470
471 n_crc32c = read_n32(tlv_packet->value);
472 write_n32(tlv_packet->value, 0); // compute with CRC==0
473
474 if (hash_crc32c(trash.area, total_v2_len) != n_crc32c)
475 goto bad_header;
476 break;
477 }
Willy Tarreaue5733232019-05-22 19:24:06 +0200478#ifdef USE_NS
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100479 case PP2_TYPE_NETNS: {
480 const struct netns_entry *ns;
481
482 ns = netns_store_lookup((char*)tlv_packet->value, tlv_len);
483 if (ns)
484 conn->proxy_netns = ns;
485 break;
486 }
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100487#endif
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100488 case PP2_TYPE_AUTHORITY: {
489 if (tlv_len > PP2_AUTHORITY_MAX)
490 goto bad_header;
491 conn->proxy_authority = pool_alloc(pool_head_authority);
492 if (conn->proxy_authority == NULL)
493 goto fail;
494 memcpy(conn->proxy_authority, (const char *)tlv_packet->value, tlv_len);
495 conn->proxy_authority_len = tlv_len;
496 break;
497 }
Tim Duesterhusd1b15b62020-03-13 12:34:23 +0100498 case PP2_TYPE_UNIQUE_ID: {
499 const struct ist tlv = ist2((const char *)tlv_packet->value, tlv_len);
500
501 if (tlv.len > UNIQUEID_LEN)
502 goto bad_header;
Tim Duesterhus2b7f6c22020-03-14 13:07:05 +0100503 conn->proxy_unique_id = ist2(pool_alloc(pool_head_uniqueid), 0);
Tim Duesterhusd1b15b62020-03-13 12:34:23 +0100504 if (!isttest(conn->proxy_unique_id))
505 goto fail;
506 if (istcpy(&conn->proxy_unique_id, tlv, UNIQUEID_LEN) < 0) {
507 /* This is technically unreachable, because we verified above
508 * that the TLV value fits.
509 */
510 goto fail;
511 }
512 break;
513 }
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100514 default:
515 break;
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100516 }
517 }
518
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100519 /* Verify that the PROXYv2 header ends at a TLV boundary.
520 * This is technically unreachable, because the TLV parsing already
521 * verifies that a TLV does not exceed the total length and also
522 * that there is space for a TLV header.
523 */
524 if (tlv_offset != total_v2_len)
525 goto bad_header;
526
Willy Tarreau77992672014-06-14 11:06:17 +0200527 /* unsupported protocol, keep local connection address */
528 break;
529 case 0x00: /* LOCAL command */
530 /* keep local connection address for LOCAL */
531 break;
532 default:
533 goto bad_header; /* not a supported command */
534 }
535
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100536 trash.data = total_v2_len;
Willy Tarreau77992672014-06-14 11:06:17 +0200537 goto eat_header;
538
539 eat_header:
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200540 /* remove the PROXY line from the request. For this we re-read the
541 * exact line at once. If we don't get the exact same result, we
542 * fail.
543 */
Willy Tarreau157788c2020-02-11 10:08:05 +0100544 while (1) {
Tim Duesterhusa8692f32020-03-13 12:34:25 +0100545 ssize_t len2 = recv(conn->handle.fd, trash.area, trash.data, 0);
546
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200547 if (len2 < 0 && errno == EINTR)
548 continue;
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200549 if (len2 != trash.data)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100550 goto recv_abort;
Willy Tarreau157788c2020-02-11 10:08:05 +0100551 break;
552 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200553
554 conn->flags &= ~flag;
Emeric Brun4f603012017-01-05 15:11:44 +0100555 conn->flags |= CO_FL_RCVD_PROXY;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200556 return 1;
557
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200558 not_ready:
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200559 return 0;
560
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200561 missing:
562 /* Missing data. Since we're using MSG_PEEK, we can only poll again if
563 * we have not read anything. Otherwise we need to fail because we won't
564 * be able to poll anymore.
565 */
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100566 conn->err_code = CO_ER_PRX_TRUNCATED;
567 goto fail;
568
569 bad_header:
570 /* This is not a valid proxy protocol header */
571 conn->err_code = CO_ER_PRX_BAD_HDR;
572 goto fail;
573
574 recv_abort:
575 conn->err_code = CO_ER_PRX_ABORT;
Willy Tarreau26f4a042013-12-04 23:44:10 +0100576 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH;
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100577 goto fail;
578
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200579 fail:
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200580 conn->flags |= CO_FL_ERROR;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200581 return 0;
582}
583
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100584/* This handshake handler waits a NetScaler Client IP insertion header
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000585 * at the beginning of the raw data stream. The header format is
586 * described in doc/netscaler-client-ip-insertion-protocol.txt
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100587 *
588 * This line MUST be at the beginning of the buffer and MUST NOT be
589 * fragmented.
590 *
591 * The header line is small and in all cases smaller than the smallest normal
592 * TCP MSS. So it MUST always be delivered as one segment, which ensures we
593 * can safely use MSG_PEEK and avoid buffering.
594 *
595 * Once the data is fetched, the values are set in the connection's address
596 * fields, and data are removed from the socket's buffer. The function returns
597 * zero if it needs to wait for more data or if it fails, or 1 if it completed
598 * and removed itself.
599 */
600int conn_recv_netscaler_cip(struct connection *conn, int flag)
601{
602 char *line;
Bertrand Jacquin7d668f92017-12-13 01:23:39 +0000603 uint32_t hdr_len;
Willy Tarreau0ca24aa2019-03-29 17:35:32 +0100604 uint8_t ip_ver;
Willy Tarreaub406b872018-08-22 05:20:32 +0200605 int ret;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100606
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100607 if (!conn_ctrl_ready(conn))
608 goto fail;
609
Willy Tarreau9b7587a2020-10-15 07:32:10 +0200610 if (!sockaddr_alloc(&conn->src, NULL, 0) || !sockaddr_alloc(&conn->dst, NULL, 0))
Olivier Houchard1a9dbe52020-01-22 15:31:09 +0100611 goto fail;
612
Willy Tarreau585744b2017-08-24 14:31:19 +0200613 if (!fd_recv_ready(conn->handle.fd))
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200614 goto not_ready;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100615
Willy Tarreau157788c2020-02-11 10:08:05 +0100616 while (1) {
Willy Tarreaub406b872018-08-22 05:20:32 +0200617 ret = recv(conn->handle.fd, trash.area, trash.size, MSG_PEEK);
618 if (ret < 0) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100619 if (errno == EINTR)
620 continue;
621 if (errno == EAGAIN) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200622 fd_cant_recv(conn->handle.fd);
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200623 goto not_ready;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100624 }
625 goto recv_abort;
626 }
Willy Tarreaub406b872018-08-22 05:20:32 +0200627 trash.data = ret;
Willy Tarreau157788c2020-02-11 10:08:05 +0100628 break;
629 }
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100630
Willy Tarreauc192b0a2020-01-23 09:11:58 +0100631 conn->flags &= ~CO_FL_WAIT_L4_CONN;
632
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200633 if (!trash.data) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100634 /* client shutdown */
635 conn->err_code = CO_ER_CIP_EMPTY;
636 goto fail;
637 }
638
639 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000640 * CIP magic, header length or
641 * CIP magic, CIP length, CIP type, header length */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200642 if (trash.data < 12)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100643 goto missing;
644
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200645 line = trash.area;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100646
647 /* Decode a possible NetScaler Client IP request, fail early if
648 * it does not match */
Willy Tarreau1ac83af2020-02-25 10:06:49 +0100649 if (ntohl(read_u32(line)) != __objt_listener(conn->target)->bind_conf->ns_cip_magic)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100650 goto bad_magic;
651
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000652 /* Legacy CIP protocol */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200653 if ((trash.area[8] & 0xD0) == 0x40) {
Willy Tarreau1ac83af2020-02-25 10:06:49 +0100654 hdr_len = ntohl(read_u32((line+4)));
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000655 line += 8;
656 }
657 /* Standard CIP protocol */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200658 else if (trash.area[8] == 0x00) {
Willy Tarreau1ac83af2020-02-25 10:06:49 +0100659 hdr_len = ntohs(read_u32((line+10)));
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000660 line += 12;
661 }
662 /* Unknown CIP protocol */
663 else {
664 conn->err_code = CO_ER_CIP_BAD_PROTO;
665 goto fail;
666 }
667
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100668 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000669 * a minimal IP header */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200670 if (trash.data < 20)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100671 goto missing;
672
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100673 /* Get IP version from the first four bits */
Willy Tarreau0ca24aa2019-03-29 17:35:32 +0100674 ip_ver = (*line & 0xf0) >> 4;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100675
Willy Tarreau0ca24aa2019-03-29 17:35:32 +0100676 if (ip_ver == 4) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100677 struct ip *hdr_ip4;
David Carlier3015a2e2016-07-04 22:51:33 +0100678 struct my_tcphdr *hdr_tcp;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100679
680 hdr_ip4 = (struct ip *)line;
681
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200682 if (trash.data < 40 || trash.data < hdr_len) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100683 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin67de5a22017-12-13 01:15:05 +0000684 * IPv4 header, TCP header */
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100685 goto missing;
Bertrand Jacquinb3875912017-12-13 00:58:51 +0000686 }
687 else if (hdr_ip4->ip_p != IPPROTO_TCP) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100688 /* The protocol does not include a TCP header */
689 conn->err_code = CO_ER_CIP_BAD_PROTO;
690 goto fail;
Bertrand Jacquinb3875912017-12-13 00:58:51 +0000691 }
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100692
David Carlier3015a2e2016-07-04 22:51:33 +0100693 hdr_tcp = (struct my_tcphdr *)(line + (hdr_ip4->ip_hl * 4));
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100694
695 /* update the session's addresses and mark them set */
Willy Tarreau226572f2019-07-17 14:46:00 +0200696 ((struct sockaddr_in *)conn->src)->sin_family = AF_INET;
697 ((struct sockaddr_in *)conn->src)->sin_addr.s_addr = hdr_ip4->ip_src.s_addr;
698 ((struct sockaddr_in *)conn->src)->sin_port = hdr_tcp->source;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100699
Willy Tarreau226572f2019-07-17 14:46:00 +0200700 ((struct sockaddr_in *)conn->dst)->sin_family = AF_INET;
701 ((struct sockaddr_in *)conn->dst)->sin_addr.s_addr = hdr_ip4->ip_dst.s_addr;
702 ((struct sockaddr_in *)conn->dst)->sin_port = hdr_tcp->dest;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100703
704 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
705 }
Willy Tarreau0ca24aa2019-03-29 17:35:32 +0100706 else if (ip_ver == 6) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100707 struct ip6_hdr *hdr_ip6;
David Carlier3015a2e2016-07-04 22:51:33 +0100708 struct my_tcphdr *hdr_tcp;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100709
710 hdr_ip6 = (struct ip6_hdr *)line;
711
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200712 if (trash.data < 60 || trash.data < hdr_len) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100713 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin67de5a22017-12-13 01:15:05 +0000714 * IPv6 header, TCP header */
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100715 goto missing;
Bertrand Jacquinb3875912017-12-13 00:58:51 +0000716 }
717 else if (hdr_ip6->ip6_nxt != IPPROTO_TCP) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100718 /* The protocol does not include a TCP header */
719 conn->err_code = CO_ER_CIP_BAD_PROTO;
720 goto fail;
Bertrand Jacquinb3875912017-12-13 00:58:51 +0000721 }
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100722
David Carlier3015a2e2016-07-04 22:51:33 +0100723 hdr_tcp = (struct my_tcphdr *)(line + sizeof(struct ip6_hdr));
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100724
725 /* update the session's addresses and mark them set */
Willy Tarreau226572f2019-07-17 14:46:00 +0200726 ((struct sockaddr_in6 *)conn->src)->sin6_family = AF_INET6;
727 ((struct sockaddr_in6 *)conn->src)->sin6_addr = hdr_ip6->ip6_src;
728 ((struct sockaddr_in6 *)conn->src)->sin6_port = hdr_tcp->source;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100729
Willy Tarreau226572f2019-07-17 14:46:00 +0200730 ((struct sockaddr_in6 *)conn->dst)->sin6_family = AF_INET6;
731 ((struct sockaddr_in6 *)conn->dst)->sin6_addr = hdr_ip6->ip6_dst;
732 ((struct sockaddr_in6 *)conn->dst)->sin6_port = hdr_tcp->dest;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100733
734 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
735 }
736 else {
737 /* The protocol does not match something known (IPv4/IPv6) */
738 conn->err_code = CO_ER_CIP_BAD_PROTO;
739 goto fail;
740 }
741
Bertrand Jacquin7d668f92017-12-13 01:23:39 +0000742 line += hdr_len;
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200743 trash.data = line - trash.area;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100744
745 /* remove the NetScaler Client IP header from the request. For this
746 * we re-read the exact line at once. If we don't get the exact same
747 * result, we fail.
748 */
Willy Tarreau157788c2020-02-11 10:08:05 +0100749 while (1) {
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200750 int len2 = recv(conn->handle.fd, trash.area, trash.data, 0);
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100751 if (len2 < 0 && errno == EINTR)
752 continue;
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200753 if (len2 != trash.data)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100754 goto recv_abort;
Willy Tarreau157788c2020-02-11 10:08:05 +0100755 break;
756 }
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100757
758 conn->flags &= ~flag;
759 return 1;
760
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200761 not_ready:
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200762 return 0;
763
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100764 missing:
765 /* Missing data. Since we're using MSG_PEEK, we can only poll again if
766 * we have not read anything. Otherwise we need to fail because we won't
767 * be able to poll anymore.
768 */
769 conn->err_code = CO_ER_CIP_TRUNCATED;
770 goto fail;
771
772 bad_magic:
773 conn->err_code = CO_ER_CIP_BAD_MAGIC;
774 goto fail;
775
776 recv_abort:
777 conn->err_code = CO_ER_CIP_ABORT;
778 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH;
779 goto fail;
780
781 fail:
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100782 conn->flags |= CO_FL_ERROR;
783 return 0;
784}
785
Alexander Liu2a54bb72019-05-22 19:44:48 +0800786
787int conn_send_socks4_proxy_request(struct connection *conn)
788{
789 struct socks4_request req_line;
790
Alexander Liu2a54bb72019-05-22 19:44:48 +0800791 if (!conn_ctrl_ready(conn))
792 goto out_error;
793
Willy Tarreau226572f2019-07-17 14:46:00 +0200794 if (!conn_get_dst(conn))
795 goto out_error;
796
Alexander Liu2a54bb72019-05-22 19:44:48 +0800797 req_line.version = 0x04;
798 req_line.command = 0x01;
Willy Tarreau226572f2019-07-17 14:46:00 +0200799 req_line.port = get_net_port(conn->dst);
800 req_line.ip = is_inet_addr(conn->dst);
Alexander Liu2a54bb72019-05-22 19:44:48 +0800801 memcpy(req_line.user_id, "HAProxy\0", 8);
802
803 if (conn->send_proxy_ofs > 0) {
804 /*
805 * This is the first call to send the request
806 */
807 conn->send_proxy_ofs = -(int)sizeof(req_line);
808 }
809
810 if (conn->send_proxy_ofs < 0) {
811 int ret = 0;
812
813 /* we are sending the socks4_req_line here. If the data layer
814 * has a pending write, we'll also set MSG_MORE.
815 */
Willy Tarreau827fee72020-12-11 15:26:55 +0100816 ret = conn_ctrl_send(
Alexander Liu2a54bb72019-05-22 19:44:48 +0800817 conn,
818 ((char *)(&req_line)) + (sizeof(req_line)+conn->send_proxy_ofs),
819 -conn->send_proxy_ofs,
Willy Tarreau827fee72020-12-11 15:26:55 +0100820 (conn->subs && conn->subs->events & SUB_RETRY_SEND) ? CO_SFL_MSG_MORE : 0);
Alexander Liu2a54bb72019-05-22 19:44:48 +0800821
822 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Before send remain is [%d], sent [%d]\n",
823 conn->handle.fd, -conn->send_proxy_ofs, ret);
824
825 if (ret < 0) {
826 goto out_error;
827 }
828
829 conn->send_proxy_ofs += ret; /* becomes zero once complete */
830 if (conn->send_proxy_ofs != 0) {
831 goto out_wait;
832 }
833 }
834
835 /* OK we've the whole request sent */
836 conn->flags &= ~CO_FL_SOCKS4_SEND;
Alexander Liu2a54bb72019-05-22 19:44:48 +0800837
838 /* The connection is ready now, simply return and let the connection
839 * handler notify upper layers if needed.
840 */
Willy Tarreauc192b0a2020-01-23 09:11:58 +0100841 conn->flags &= ~CO_FL_WAIT_L4_CONN;
Alexander Liu2a54bb72019-05-22 19:44:48 +0800842
843 if (conn->flags & CO_FL_SEND_PROXY) {
844 /*
845 * Get the send_proxy_ofs ready for the send_proxy due to we are
846 * reusing the "send_proxy_ofs", and SOCKS4 handshake should be done
847 * before sending PROXY Protocol.
848 */
849 conn->send_proxy_ofs = 1;
850 }
851 return 1;
852
853 out_error:
854 /* Write error on the file descriptor */
855 conn->flags |= CO_FL_ERROR;
856 if (conn->err_code == CO_ER_NONE) {
857 conn->err_code = CO_ER_SOCKS4_SEND;
858 }
859 return 0;
860
861 out_wait:
Alexander Liu2a54bb72019-05-22 19:44:48 +0800862 return 0;
863}
864
865int conn_recv_socks4_proxy_response(struct connection *conn)
866{
867 char line[SOCKS4_HS_RSP_LEN];
868 int ret;
869
Alexander Liu2a54bb72019-05-22 19:44:48 +0800870 if (!conn_ctrl_ready(conn))
871 goto fail;
872
873 if (!fd_recv_ready(conn->handle.fd))
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200874 goto not_ready;
Alexander Liu2a54bb72019-05-22 19:44:48 +0800875
Willy Tarreau157788c2020-02-11 10:08:05 +0100876 while (1) {
Alexander Liu2a54bb72019-05-22 19:44:48 +0800877 /* SOCKS4 Proxy will response with 8 bytes, 0x00 | 0x5A | 0x00 0x00 | 0x00 0x00 0x00 0x00
878 * Try to peek into it, before all 8 bytes ready.
879 */
880 ret = recv(conn->handle.fd, line, SOCKS4_HS_RSP_LEN, MSG_PEEK);
881
882 if (ret == 0) {
883 /* the socket has been closed or shutdown for send */
884 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Received ret[%d], errno[%d], looks like the socket has been closed or shutdown for send\n",
885 conn->handle.fd, ret, errno);
886 if (conn->err_code == CO_ER_NONE) {
887 conn->err_code = CO_ER_SOCKS4_RECV;
888 }
889 goto fail;
890 }
891
892 if (ret > 0) {
893 if (ret == SOCKS4_HS_RSP_LEN) {
894 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Received 8 bytes, the response is [%02X|%02X|%02X %02X|%02X %02X %02X %02X]\n",
895 conn->handle.fd, line[0], line[1], line[2], line[3], line[4], line[5], line[6], line[7]);
896 }else{
897 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Received ret[%d], first byte is [%02X], last bye is [%02X]\n", conn->handle.fd, ret, line[0], line[ret-1]);
898 }
899 } else {
900 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Received ret[%d], errno[%d]\n", conn->handle.fd, ret, errno);
901 }
902
903 if (ret < 0) {
904 if (errno == EINTR) {
905 continue;
906 }
907 if (errno == EAGAIN) {
908 fd_cant_recv(conn->handle.fd);
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200909 goto not_ready;
Alexander Liu2a54bb72019-05-22 19:44:48 +0800910 }
911 goto recv_abort;
912 }
Willy Tarreau157788c2020-02-11 10:08:05 +0100913 break;
914 }
Alexander Liu2a54bb72019-05-22 19:44:48 +0800915
Willy Tarreauc192b0a2020-01-23 09:11:58 +0100916 conn->flags &= ~CO_FL_WAIT_L4_CONN;
917
Alexander Liu2a54bb72019-05-22 19:44:48 +0800918 if (ret < SOCKS4_HS_RSP_LEN) {
919 /* Missing data. Since we're using MSG_PEEK, we can only poll again if
920 * we are not able to read enough data.
921 */
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200922 goto not_ready;
Alexander Liu2a54bb72019-05-22 19:44:48 +0800923 }
924
925 /*
926 * Base on the SOCSK4 protocol:
927 *
928 * +----+----+----+----+----+----+----+----+
929 * | VN | CD | DSTPORT | DSTIP |
930 * +----+----+----+----+----+----+----+----+
931 * # of bytes: 1 1 2 4
932 * VN is the version of the reply code and should be 0. CD is the result
933 * code with one of the following values:
934 * 90: request granted
935 * 91: request rejected or failed
Ilya Shipitsince7b00f2020-03-23 22:28:40 +0500936 * 92: request rejected because SOCKS server cannot connect to identd on the client
Alexander Liu2a54bb72019-05-22 19:44:48 +0800937 * 93: request rejected because the client program and identd report different user-ids
938 * The remaining fields are ignored.
939 */
940 if (line[1] != 90) {
941 conn->flags &= ~CO_FL_SOCKS4_RECV;
942
943 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: FAIL, the response is [%02X|%02X|%02X %02X|%02X %02X %02X %02X]\n",
944 conn->handle.fd, line[0], line[1], line[2], line[3], line[4], line[5], line[6], line[7]);
945 if (conn->err_code == CO_ER_NONE) {
946 conn->err_code = CO_ER_SOCKS4_DENY;
947 }
948 goto fail;
949 }
950
951 /* remove the 8 bytes response from the stream */
Willy Tarreau157788c2020-02-11 10:08:05 +0100952 while (1) {
Alexander Liu2a54bb72019-05-22 19:44:48 +0800953 ret = recv(conn->handle.fd, line, SOCKS4_HS_RSP_LEN, 0);
954 if (ret < 0 && errno == EINTR) {
955 continue;
956 }
957 if (ret != SOCKS4_HS_RSP_LEN) {
958 if (conn->err_code == CO_ER_NONE) {
959 conn->err_code = CO_ER_SOCKS4_RECV;
960 }
961 goto fail;
962 }
Willy Tarreau157788c2020-02-11 10:08:05 +0100963 break;
964 }
Alexander Liu2a54bb72019-05-22 19:44:48 +0800965
966 conn->flags &= ~CO_FL_SOCKS4_RECV;
967 return 1;
968
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200969 not_ready:
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200970 return 0;
971
Alexander Liu2a54bb72019-05-22 19:44:48 +0800972 recv_abort:
973 if (conn->err_code == CO_ER_NONE) {
974 conn->err_code = CO_ER_SOCKS4_ABORT;
975 }
976 conn->flags |= (CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH);
977 goto fail;
978
979 fail:
Alexander Liu2a54bb72019-05-22 19:44:48 +0800980 conn->flags |= CO_FL_ERROR;
981 return 0;
982}
983
Ilya Shipitsinca56fce2018-09-15 00:50:05 +0500984/* Note: <remote> is explicitly allowed to be NULL */
Tim Duesterhuscf6e0c82020-03-13 12:34:24 +0100985int make_proxy_line(char *buf, int buf_len, struct server *srv, struct connection *remote, struct stream *strm)
David Safb76832014-05-08 23:42:08 -0400986{
987 int ret = 0;
988
989 if (srv && (srv->pp_opts & SRV_PP_V2)) {
Tim Duesterhuscf6e0c82020-03-13 12:34:24 +0100990 ret = make_proxy_line_v2(buf, buf_len, srv, remote, strm);
David Safb76832014-05-08 23:42:08 -0400991 }
992 else {
Willy Tarreau226572f2019-07-17 14:46:00 +0200993 if (remote && conn_get_src(remote) && conn_get_dst(remote))
994 ret = make_proxy_line_v1(buf, buf_len, remote->src, remote->dst);
David Safb76832014-05-08 23:42:08 -0400995 else
996 ret = make_proxy_line_v1(buf, buf_len, NULL, NULL);
997 }
998
999 return ret;
1000}
1001
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001002/* Makes a PROXY protocol line from the two addresses. The output is sent to
1003 * buffer <buf> for a maximum size of <buf_len> (including the trailing zero).
1004 * It returns the number of bytes composing this line (including the trailing
1005 * LF), or zero in case of failure (eg: not enough space). It supports TCP4,
Willy Tarreau2e1401a2013-10-01 11:41:55 +02001006 * TCP6 and "UNKNOWN" formats. If any of <src> or <dst> is null, UNKNOWN is
1007 * emitted as well.
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001008 */
David Safb76832014-05-08 23:42:08 -04001009int make_proxy_line_v1(char *buf, int buf_len, struct sockaddr_storage *src, struct sockaddr_storage *dst)
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001010{
1011 int ret = 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001012 char * protocol;
1013 char src_str[MAX(INET_ADDRSTRLEN, INET6_ADDRSTRLEN)];
1014 char dst_str[MAX(INET_ADDRSTRLEN, INET6_ADDRSTRLEN)];
1015 in_port_t src_port;
1016 in_port_t dst_port;
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001017
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001018 if ( !src
1019 || !dst
1020 || (src->ss_family != AF_INET && src->ss_family != AF_INET6)
1021 || (dst->ss_family != AF_INET && dst->ss_family != AF_INET6)) {
1022 /* unknown family combination */
1023 ret = snprintf(buf, buf_len, "PROXY UNKNOWN\r\n");
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001024 if (ret >= buf_len)
1025 return 0;
1026
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001027 return ret;
1028 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001029
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001030 /* IPv4 for both src and dst */
1031 if (src->ss_family == AF_INET && dst->ss_family == AF_INET) {
1032 protocol = "TCP4";
1033 if (!inet_ntop(AF_INET, &((struct sockaddr_in *)src)->sin_addr, src_str, sizeof(src_str)))
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001034 return 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001035 src_port = ((struct sockaddr_in *)src)->sin_port;
1036 if (!inet_ntop(AF_INET, &((struct sockaddr_in *)dst)->sin_addr, dst_str, sizeof(dst_str)))
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001037 return 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001038 dst_port = ((struct sockaddr_in *)dst)->sin_port;
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001039 }
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001040 /* IPv6 for at least one of src and dst */
1041 else {
1042 struct in6_addr tmp;
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001043
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001044 protocol = "TCP6";
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001045
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001046 if (src->ss_family == AF_INET) {
1047 /* Convert src to IPv6 */
1048 v4tov6(&tmp, &((struct sockaddr_in *)src)->sin_addr);
1049 src_port = ((struct sockaddr_in *)src)->sin_port;
1050 }
1051 else {
1052 tmp = ((struct sockaddr_in6 *)src)->sin6_addr;
1053 src_port = ((struct sockaddr_in6 *)src)->sin6_port;
1054 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001055
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001056 if (!inet_ntop(AF_INET6, &tmp, src_str, sizeof(src_str)))
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001057 return 0;
1058
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001059 if (dst->ss_family == AF_INET) {
1060 /* Convert dst to IPv6 */
1061 v4tov6(&tmp, &((struct sockaddr_in *)dst)->sin_addr);
1062 dst_port = ((struct sockaddr_in *)dst)->sin_port;
1063 }
1064 else {
1065 tmp = ((struct sockaddr_in6 *)dst)->sin6_addr;
1066 dst_port = ((struct sockaddr_in6 *)dst)->sin6_port;
1067 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001068
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001069 if (!inet_ntop(AF_INET6, &tmp, dst_str, sizeof(dst_str)))
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001070 return 0;
1071 }
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001072
1073 ret = snprintf(buf, buf_len, "PROXY %s %s %s %u %u\r\n", protocol, src_str, dst_str, ntohs(src_port), ntohs(dst_port));
1074 if (ret >= buf_len)
1075 return 0;
1076
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001077 return ret;
1078}
David Safb76832014-05-08 23:42:08 -04001079
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001080static int make_tlv(char *dest, int dest_len, char type, uint16_t length, const char *value)
David Safb76832014-05-08 23:42:08 -04001081{
1082 struct tlv *tlv;
1083
1084 if (!dest || (length + sizeof(*tlv) > dest_len))
1085 return 0;
1086
1087 tlv = (struct tlv *)dest;
1088
1089 tlv->type = type;
1090 tlv->length_hi = length >> 8;
1091 tlv->length_lo = length & 0x00ff;
1092 memcpy(tlv->value, value, length);
1093 return length + sizeof(*tlv);
1094}
David Safb76832014-05-08 23:42:08 -04001095
Ilya Shipitsinca56fce2018-09-15 00:50:05 +05001096/* Note: <remote> is explicitly allowed to be NULL */
Tim Duesterhuscf6e0c82020-03-13 12:34:24 +01001097int make_proxy_line_v2(char *buf, int buf_len, struct server *srv, struct connection *remote, struct stream *strm)
David Safb76832014-05-08 23:42:08 -04001098{
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001099 const char pp2_signature[] = PP2_SIGNATURE;
Emmanuel Hocdet4399c752018-02-05 15:26:43 +01001100 void *tlv_crc32c_p = NULL;
David Safb76832014-05-08 23:42:08 -04001101 int ret = 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001102 struct proxy_hdr_v2 *hdr = (struct proxy_hdr_v2 *)buf;
Vincent Bernat6e615892016-05-18 16:17:44 +02001103 struct sockaddr_storage null_addr = { .ss_family = 0 };
David Safb76832014-05-08 23:42:08 -04001104 struct sockaddr_storage *src = &null_addr;
1105 struct sockaddr_storage *dst = &null_addr;
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001106 const char *value;
1107 int value_len;
David Safb76832014-05-08 23:42:08 -04001108
1109 if (buf_len < PP2_HEADER_LEN)
1110 return 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001111 memcpy(hdr->sig, pp2_signature, PP2_SIGNATURE_LEN);
David Safb76832014-05-08 23:42:08 -04001112
Willy Tarreau226572f2019-07-17 14:46:00 +02001113 if (remote && conn_get_src(remote) && conn_get_dst(remote)) {
1114 src = remote->src;
1115 dst = remote->dst;
David Safb76832014-05-08 23:42:08 -04001116 }
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001117
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001118 /* At least one of src or dst is not of AF_INET or AF_INET6 */
1119 if ( !src
1120 || !dst
Willy Tarreau119e50e2020-05-22 13:53:29 +02001121 || (!pp2_never_send_local && conn_is_back(remote)) // locally initiated connection
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001122 || (src->ss_family != AF_INET && src->ss_family != AF_INET6)
1123 || (dst->ss_family != AF_INET && dst->ss_family != AF_INET6)) {
David Safb76832014-05-08 23:42:08 -04001124 if (buf_len < PP2_HDR_LEN_UNSPEC)
1125 return 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001126 hdr->ver_cmd = PP2_VERSION | PP2_CMD_LOCAL;
1127 hdr->fam = PP2_FAM_UNSPEC | PP2_TRANS_UNSPEC;
David Safb76832014-05-08 23:42:08 -04001128 ret = PP2_HDR_LEN_UNSPEC;
1129 }
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001130 else {
Willy Tarreau02c88032020-04-14 12:54:10 +02001131 hdr->ver_cmd = PP2_VERSION | PP2_CMD_PROXY;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001132 /* IPv4 for both src and dst */
1133 if (src->ss_family == AF_INET && dst->ss_family == AF_INET) {
1134 if (buf_len < PP2_HDR_LEN_INET)
1135 return 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001136 hdr->fam = PP2_FAM_INET | PP2_TRANS_STREAM;
1137 hdr->addr.ip4.src_addr = ((struct sockaddr_in *)src)->sin_addr.s_addr;
1138 hdr->addr.ip4.src_port = ((struct sockaddr_in *)src)->sin_port;
1139 hdr->addr.ip4.dst_addr = ((struct sockaddr_in *)dst)->sin_addr.s_addr;
1140 hdr->addr.ip4.dst_port = ((struct sockaddr_in *)dst)->sin_port;
1141 ret = PP2_HDR_LEN_INET;
1142 }
1143 /* IPv6 for at least one of src and dst */
1144 else {
1145 struct in6_addr tmp;
1146
1147 if (buf_len < PP2_HDR_LEN_INET6)
1148 return 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001149 hdr->fam = PP2_FAM_INET6 | PP2_TRANS_STREAM;
1150 if (src->ss_family == AF_INET) {
1151 v4tov6(&tmp, &((struct sockaddr_in *)src)->sin_addr);
1152 memcpy(hdr->addr.ip6.src_addr, &tmp, 16);
1153 hdr->addr.ip6.src_port = ((struct sockaddr_in *)src)->sin_port;
1154 }
1155 else {
1156 memcpy(hdr->addr.ip6.src_addr, &((struct sockaddr_in6 *)src)->sin6_addr, 16);
1157 hdr->addr.ip6.src_port = ((struct sockaddr_in6 *)src)->sin6_port;
1158 }
1159 if (dst->ss_family == AF_INET) {
1160 v4tov6(&tmp, &((struct sockaddr_in *)dst)->sin_addr);
1161 memcpy(hdr->addr.ip6.dst_addr, &tmp, 16);
William Dauchybd8bf672020-01-26 19:06:39 +01001162 hdr->addr.ip6.dst_port = ((struct sockaddr_in *)dst)->sin_port;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001163 }
1164 else {
1165 memcpy(hdr->addr.ip6.dst_addr, &((struct sockaddr_in6 *)dst)->sin6_addr, 16);
1166 hdr->addr.ip6.dst_port = ((struct sockaddr_in6 *)dst)->sin6_port;
1167 }
1168
1169 ret = PP2_HDR_LEN_INET6;
1170 }
1171 }
David Safb76832014-05-08 23:42:08 -04001172
Emmanuel Hocdet4399c752018-02-05 15:26:43 +01001173 if (srv->pp_opts & SRV_PP_V2_CRC32C) {
1174 uint32_t zero_crc32c = 0;
Tim Duesterhusa8692f32020-03-13 12:34:25 +01001175
Emmanuel Hocdet4399c752018-02-05 15:26:43 +01001176 if ((buf_len - ret) < sizeof(struct tlv))
1177 return 0;
1178 tlv_crc32c_p = (void *)((struct tlv *)&buf[ret])->value;
1179 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_CRC32C, sizeof(zero_crc32c), (const char *)&zero_crc32c);
1180 }
1181
Ilya Shipitsinca56fce2018-09-15 00:50:05 +05001182 if (remote && conn_get_alpn(remote, &value, &value_len)) {
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001183 if ((buf_len - ret) < sizeof(struct tlv))
1184 return 0;
Emmanuel Hocdet571c7ac2017-10-31 18:24:05 +01001185 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_ALPN, value_len, value);
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001186 }
1187
Emmanuel Hocdet253c3b72018-02-01 18:29:59 +01001188 if (srv->pp_opts & SRV_PP_V2_AUTHORITY) {
Emmanuel Hocdet8a4ffa02019-08-29 11:54:51 +02001189 value = NULL;
1190 if (remote && remote->proxy_authority) {
1191 value = remote->proxy_authority;
1192 value_len = remote->proxy_authority_len;
1193 }
1194#ifdef USE_OPENSSL
1195 else {
Jerome Magnin78891c72019-09-02 09:53:41 +02001196 if ((value = ssl_sock_get_sni(remote)))
Emmanuel Hocdet8a4ffa02019-08-29 11:54:51 +02001197 value_len = strlen(value);
1198 }
1199#endif
Emmanuel Hocdet253c3b72018-02-01 18:29:59 +01001200 if (value) {
1201 if ((buf_len - ret) < sizeof(struct tlv))
1202 return 0;
Emmanuel Hocdet8a4ffa02019-08-29 11:54:51 +02001203 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_AUTHORITY, value_len, value);
Emmanuel Hocdet253c3b72018-02-01 18:29:59 +01001204 }
1205 }
1206
Christopher Faulet3ab504f2020-05-26 15:16:01 +02001207 if (strm && (srv->pp_opts & SRV_PP_V2_UNIQUE_ID)) {
Tim Duesterhuscf6e0c82020-03-13 12:34:24 +01001208 struct session* sess = strm_sess(strm);
1209 struct ist unique_id = stream_generate_unique_id(strm, &sess->fe->format_unique_id);
1210
1211 value = unique_id.ptr;
1212 value_len = unique_id.len;
1213
1214 if (value_len >= 0) {
1215 if ((buf_len - ret) < sizeof(struct tlv))
1216 return 0;
1217 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_UNIQUE_ID, value_len, value);
1218 }
1219 }
1220
Emmanuel Hocdet8a4ffa02019-08-29 11:54:51 +02001221#ifdef USE_OPENSSL
David Safb76832014-05-08 23:42:08 -04001222 if (srv->pp_opts & SRV_PP_V2_SSL) {
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001223 struct tlv_ssl *tlv;
1224 int ssl_tlv_len = 0;
Tim Duesterhusa8692f32020-03-13 12:34:25 +01001225
David Safb76832014-05-08 23:42:08 -04001226 if ((buf_len - ret) < sizeof(struct tlv_ssl))
1227 return 0;
1228 tlv = (struct tlv_ssl *)&buf[ret];
1229 memset(tlv, 0, sizeof(struct tlv_ssl));
1230 ssl_tlv_len += sizeof(struct tlv_ssl);
1231 tlv->tlv.type = PP2_TYPE_SSL;
1232 if (ssl_sock_is_ssl(remote)) {
1233 tlv->client |= PP2_CLIENT_SSL;
Emmanuel Hocdet01da5712017-10-13 16:59:49 +02001234 value = ssl_sock_get_proto_version(remote);
David Safb76832014-05-08 23:42:08 -04001235 if (value) {
Emmanuel Hocdet8c0c34b2018-02-28 12:02:14 +01001236 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len-ret-ssl_tlv_len), PP2_SUBTYPE_SSL_VERSION, strlen(value), value);
David Safb76832014-05-08 23:42:08 -04001237 }
Dave McCowan328fb582014-07-30 10:39:13 -04001238 if (ssl_sock_get_cert_used_sess(remote)) {
1239 tlv->client |= PP2_CLIENT_CERT_SESS;
David Safb76832014-05-08 23:42:08 -04001240 tlv->verify = htonl(ssl_sock_get_verify_result(remote));
Dave McCowan328fb582014-07-30 10:39:13 -04001241 if (ssl_sock_get_cert_used_conn(remote))
1242 tlv->client |= PP2_CLIENT_CERT_CONN;
David Safb76832014-05-08 23:42:08 -04001243 }
1244 if (srv->pp_opts & SRV_PP_V2_SSL_CN) {
Willy Tarreau83061a82018-07-13 11:56:34 +02001245 struct buffer *cn_trash = get_trash_chunk();
Willy Tarreau3b9a0c92014-07-19 06:37:33 +02001246 if (ssl_sock_get_remote_common_name(remote, cn_trash) > 0) {
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001247 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_CN,
1248 cn_trash->data,
1249 cn_trash->area);
David Safb76832014-05-08 23:42:08 -04001250 }
1251 }
Emmanuel Hocdetfa8d0f12018-02-01 15:53:52 +01001252 if (srv->pp_opts & SRV_PP_V2_SSL_KEY_ALG) {
Willy Tarreau83061a82018-07-13 11:56:34 +02001253 struct buffer *pkey_trash = get_trash_chunk();
Emmanuel Hocdetfa8d0f12018-02-01 15:53:52 +01001254 if (ssl_sock_get_pkey_algo(remote, pkey_trash) > 0) {
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001255 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_KEY_ALG,
1256 pkey_trash->data,
1257 pkey_trash->area);
Emmanuel Hocdetfa8d0f12018-02-01 15:53:52 +01001258 }
1259 }
1260 if (srv->pp_opts & SRV_PP_V2_SSL_SIG_ALG) {
1261 value = ssl_sock_get_cert_sig(remote);
1262 if (value) {
1263 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_SIG_ALG, strlen(value), value);
1264 }
1265 }
1266 if (srv->pp_opts & SRV_PP_V2_SSL_CIPHER) {
1267 value = ssl_sock_get_cipher_name(remote);
1268 if (value) {
1269 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_CIPHER, strlen(value), value);
1270 }
1271 }
David Safb76832014-05-08 23:42:08 -04001272 }
1273 tlv->tlv.length_hi = (uint16_t)(ssl_tlv_len - sizeof(struct tlv)) >> 8;
1274 tlv->tlv.length_lo = (uint16_t)(ssl_tlv_len - sizeof(struct tlv)) & 0x00ff;
1275 ret += ssl_tlv_len;
1276 }
1277#endif
1278
Willy Tarreaue5733232019-05-22 19:24:06 +02001279#ifdef USE_NS
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001280 if (remote && (remote->proxy_netns)) {
1281 if ((buf_len - ret) < sizeof(struct tlv))
1282 return 0;
Emmanuel Hocdet571c7ac2017-10-31 18:24:05 +01001283 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_NETNS, remote->proxy_netns->name_len, remote->proxy_netns->node.key);
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001284 }
1285#endif
1286
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001287 hdr->len = htons((uint16_t)(ret - PP2_HEADER_LEN));
David Safb76832014-05-08 23:42:08 -04001288
Emmanuel Hocdet4399c752018-02-05 15:26:43 +01001289 if (tlv_crc32c_p) {
1290 write_u32(tlv_crc32c_p, htonl(hash_crc32c(buf, ret)));
1291 }
1292
David Safb76832014-05-08 23:42:08 -04001293 return ret;
1294}
Emeric Brun4f603012017-01-05 15:11:44 +01001295
Willy Tarreau119e50e2020-05-22 13:53:29 +02001296/* returns 0 on success */
1297static int cfg_parse_pp2_never_send_local(char **args, int section_type, struct proxy *curpx,
1298 struct proxy *defpx, const char *file, int line,
1299 char **err)
1300{
1301 if (too_many_args(0, args, err, NULL))
1302 return -1;
1303 pp2_never_send_local = 1;
1304 return 0;
1305}
1306
Willy Tarreau60ca10a2017-08-18 15:26:54 +02001307/* return the major HTTP version as 1 or 2 depending on how the request arrived
1308 * before being processed.
1309 */
1310static int
1311smp_fetch_fc_http_major(const struct arg *args, struct sample *smp, const char *kw, void *private)
1312{
Jérôme Magnin86577422018-12-07 09:03:11 +01001313 struct connection *conn = (kw[0] != 'b') ? objt_conn(smp->sess->origin) :
1314 smp->strm ? cs_conn(objt_cs(smp->strm->si[1].end)) : NULL;
Willy Tarreau60ca10a2017-08-18 15:26:54 +02001315
1316 smp->data.type = SMP_T_SINT;
1317 smp->data.u.sint = (conn && strcmp(conn_get_mux_name(conn), "H2") == 0) ? 2 : 1;
1318 return 1;
1319}
1320
Emeric Brun4f603012017-01-05 15:11:44 +01001321/* fetch if the received connection used a PROXY protocol header */
1322int smp_fetch_fc_rcvd_proxy(const struct arg *args, struct sample *smp, const char *kw, void *private)
1323{
1324 struct connection *conn;
1325
1326 conn = objt_conn(smp->sess->origin);
1327 if (!conn)
1328 return 0;
1329
Willy Tarreau911db9b2020-01-23 16:27:54 +01001330 if (conn->flags & CO_FL_WAIT_XPRT) {
Emeric Brun4f603012017-01-05 15:11:44 +01001331 smp->flags |= SMP_F_MAY_CHANGE;
1332 return 0;
1333 }
1334
1335 smp->flags = 0;
1336 smp->data.type = SMP_T_BOOL;
1337 smp->data.u.sint = (conn->flags & CO_FL_RCVD_PROXY) ? 1 : 0;
1338
1339 return 1;
1340}
1341
Geoff Simmons7185b782019-08-27 18:31:16 +02001342/* fetch the authority TLV from a PROXY protocol header */
1343int smp_fetch_fc_pp_authority(const struct arg *args, struct sample *smp, const char *kw, void *private)
1344{
1345 struct connection *conn;
1346
1347 conn = objt_conn(smp->sess->origin);
1348 if (!conn)
1349 return 0;
1350
Willy Tarreau911db9b2020-01-23 16:27:54 +01001351 if (conn->flags & CO_FL_WAIT_XPRT) {
Geoff Simmons7185b782019-08-27 18:31:16 +02001352 smp->flags |= SMP_F_MAY_CHANGE;
1353 return 0;
1354 }
1355
1356 if (conn->proxy_authority == NULL)
1357 return 0;
1358
1359 smp->flags = 0;
1360 smp->data.type = SMP_T_STR;
1361 smp->data.u.str.area = conn->proxy_authority;
1362 smp->data.u.str.data = conn->proxy_authority_len;
1363
1364 return 1;
1365}
1366
Tim Duesterhusd1b15b62020-03-13 12:34:23 +01001367/* fetch the unique ID TLV from a PROXY protocol header */
1368int smp_fetch_fc_pp_unique_id(const struct arg *args, struct sample *smp, const char *kw, void *private)
1369{
1370 struct connection *conn;
1371
1372 conn = objt_conn(smp->sess->origin);
1373 if (!conn)
1374 return 0;
1375
1376 if (conn->flags & CO_FL_WAIT_XPRT) {
1377 smp->flags |= SMP_F_MAY_CHANGE;
1378 return 0;
1379 }
1380
1381 if (!isttest(conn->proxy_unique_id))
1382 return 0;
1383
1384 smp->flags = 0;
1385 smp->data.type = SMP_T_STR;
1386 smp->data.u.str.area = conn->proxy_unique_id.ptr;
1387 smp->data.u.str.data = conn->proxy_unique_id.len;
1388
1389 return 1;
1390}
1391
Emeric Brun4f603012017-01-05 15:11:44 +01001392/* Note: must not be declared <const> as its list will be overwritten.
1393 * Note: fetches that may return multiple types must be declared as the lowest
1394 * common denominator, the type that can be casted into all other ones. For
1395 * instance v4/v6 must be declared v4.
1396 */
1397static struct sample_fetch_kw_list sample_fetch_keywords = {ILH, {
Willy Tarreau60ca10a2017-08-18 15:26:54 +02001398 { "fc_http_major", smp_fetch_fc_http_major, 0, NULL, SMP_T_SINT, SMP_USE_L4CLI },
Jérôme Magnin86577422018-12-07 09:03:11 +01001399 { "bc_http_major", smp_fetch_fc_http_major, 0, NULL, SMP_T_SINT, SMP_USE_L4SRV },
Emeric Brun4f603012017-01-05 15:11:44 +01001400 { "fc_rcvd_proxy", smp_fetch_fc_rcvd_proxy, 0, NULL, SMP_T_BOOL, SMP_USE_L4CLI },
Geoff Simmons7185b782019-08-27 18:31:16 +02001401 { "fc_pp_authority", smp_fetch_fc_pp_authority, 0, NULL, SMP_T_STR, SMP_USE_L4CLI },
Tim Duesterhusd1b15b62020-03-13 12:34:23 +01001402 { "fc_pp_unique_id", smp_fetch_fc_pp_unique_id, 0, NULL, SMP_T_STR, SMP_USE_L4CLI },
Emeric Brun4f603012017-01-05 15:11:44 +01001403 { /* END */ },
1404}};
1405
Willy Tarreau0108d902018-11-25 19:14:37 +01001406INITCALL1(STG_REGISTER, sample_register_fetches, &sample_fetch_keywords);
Willy Tarreau119e50e2020-05-22 13:53:29 +02001407
1408static struct cfg_kw_list cfg_kws = {ILH, {
1409 { CFG_GLOBAL, "pp2-never-send-local", cfg_parse_pp2_never_send_local },
1410 { /* END */ },
1411}};
1412
1413INITCALL1(STG_REGISTER, cfg_register_keywords, &cfg_kws);
Amaury Denoyelle81c6f762021-01-18 14:57:50 +01001414
Amaury Denoyelle01a287f2021-02-11 16:46:53 +01001415/* private function to handle sockaddr as input for connection hash */
1416static void conn_calculate_hash_sockaddr(const struct sockaddr_storage *ss,
1417 char *buf, size_t *idx,
1418 enum conn_hash_params_t *hash_flags,
1419 enum conn_hash_params_t param_type_addr,
1420 enum conn_hash_params_t param_type_port)
1421{
1422 struct sockaddr_in *addr;
1423 struct sockaddr_in6 *addr6;
1424
1425 switch (ss->ss_family) {
1426 case AF_INET:
1427 addr = (struct sockaddr_in *)ss;
1428
1429 conn_hash_update(buf, idx,
1430 &addr->sin_addr, sizeof(addr->sin_addr),
1431 hash_flags, param_type_addr);
1432
1433 if (addr->sin_port) {
1434 conn_hash_update(buf, idx,
1435 &addr->sin_port, sizeof(addr->sin_port),
1436 hash_flags, param_type_port);
1437 }
1438
1439 break;
1440
1441 case AF_INET6:
1442 addr6 = (struct sockaddr_in6 *)ss;
1443
1444 conn_hash_update(buf, idx,
1445 &addr6->sin6_addr, sizeof(addr6->sin6_addr),
1446 hash_flags, param_type_addr);
1447
1448 if (addr6->sin6_port) {
1449 conn_hash_update(buf, idx,
1450 &addr6->sin6_port, sizeof(addr6->sin6_port),
1451 hash_flags, param_type_port);
1452 }
1453
1454 break;
1455 }
1456}
1457
Amaury Denoyelle81c6f762021-01-18 14:57:50 +01001458XXH64_hash_t conn_calculate_hash(const struct conn_hash_params *params)
1459{
1460 char *buf;
1461 size_t idx = 0;
1462 XXH64_hash_t hash = 0;
1463 enum conn_hash_params_t hash_flags = 0;
1464
1465 buf = trash.area;
1466
Amaury Denoyelle1a58aca2021-01-22 16:47:46 +01001467 conn_hash_update(buf, &idx, &params->srv, sizeof(params->srv), &hash_flags, 0);
1468
Amaury Denoyelle9b626e32021-01-06 17:03:27 +01001469 if (params->sni_prehash) {
1470 conn_hash_update(buf, &idx,
Amaury Denoyelle36441f42021-02-17 16:25:31 +01001471 &params->sni_prehash, sizeof(params->sni_prehash),
Amaury Denoyelle9b626e32021-01-06 17:03:27 +01001472 &hash_flags, CONN_HASH_PARAMS_TYPE_SNI);
1473 }
1474
Amaury Denoyelle01a287f2021-02-11 16:46:53 +01001475 if (params->dst_addr) {
1476 conn_calculate_hash_sockaddr(params->dst_addr,
1477 buf, &idx, &hash_flags,
1478 CONN_HASH_PARAMS_TYPE_DST_ADDR,
1479 CONN_HASH_PARAMS_TYPE_DST_PORT);
1480 }
1481
Amaury Denoyelled10a2002021-02-11 19:45:19 +01001482 if (params->src_addr) {
1483 conn_calculate_hash_sockaddr(params->src_addr,
1484 buf, &idx, &hash_flags,
1485 CONN_HASH_PARAMS_TYPE_SRC_ADDR,
1486 CONN_HASH_PARAMS_TYPE_SRC_PORT);
1487 }
1488
Amaury Denoyelle1921d202021-01-14 10:15:29 +01001489 if (params->proxy_prehash) {
1490 conn_hash_update(buf, &idx,
Amaury Denoyelle36441f42021-02-17 16:25:31 +01001491 &params->proxy_prehash, sizeof(params->proxy_prehash),
Amaury Denoyelle1921d202021-01-14 10:15:29 +01001492 &hash_flags, CONN_HASH_PARAMS_TYPE_PROXY);
1493 }
Amaury Denoyelle01a287f2021-02-11 16:46:53 +01001494
Amaury Denoyelle1921d202021-01-14 10:15:29 +01001495 hash = conn_hash_digest(buf, idx, hash_flags);
Amaury Denoyelle81c6f762021-01-18 14:57:50 +01001496 return hash;
1497}