blob: 42e4ff3e43ac80de898c78f72195d56ed81f7033 [file] [log] [blame]
Willy Tarreau39713102016-11-25 15:49:32 +01001/*
2 * "tcp" rules processing
3 *
4 * Copyright 2000-2016 Willy Tarreau <w@1wt.eu>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
Willy Tarreaudcc048a2020-06-04 19:11:43 +020012#include <haproxy/acl.h>
Willy Tarreau122eba92020-06-04 10:15:32 +020013#include <haproxy/action.h>
Willy Tarreau4c7e4b72020-05-27 12:58:42 +020014#include <haproxy/api.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020015#include <haproxy/arg-t.h>
Willy Tarreau278161c2020-06-04 11:18:28 +020016#include <haproxy/capture-t.h>
Willy Tarreau6be78492020-06-05 00:00:29 +020017#include <haproxy/cfgparse.h>
Willy Tarreauf1d32c42020-06-04 21:07:02 +020018#include <haproxy/channel.h>
Willy Tarreau7ea393d2020-06-04 18:02:10 +020019#include <haproxy/connection.h>
Willy Tarreauf268ee82020-06-04 17:05:57 +020020#include <haproxy/global.h>
Willy Tarreau853b2972020-05-27 18:01:47 +020021#include <haproxy/list.h>
Willy Tarreauaeed4a82020-06-04 22:01:04 +020022#include <haproxy/log.h>
Willy Tarreaua264d962020-06-04 22:29:18 +020023#include <haproxy/proxy.h>
Willy Tarreaue6ce10b2020-06-04 15:33:47 +020024#include <haproxy/sample.h>
Willy Tarreaudfd3de82020-06-04 23:46:14 +020025#include <haproxy/stick_table.h>
26#include <haproxy/stream-t.h>
Willy Tarreau5e539c92020-06-04 20:45:39 +020027#include <haproxy/stream_interface.h>
Willy Tarreau8b550af2020-06-04 17:42:48 +020028#include <haproxy/tcp_rules.h>
Willy Tarreauc2f7c582020-06-02 18:15:32 +020029#include <haproxy/ticks.h>
Willy Tarreau92b4f132020-06-01 11:05:15 +020030#include <haproxy/time.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020031#include <haproxy/tools.h>
Willy Tarreaudfd3de82020-06-04 23:46:14 +020032#include <haproxy/trace.h>
Willy Tarreau39713102016-11-25 15:49:32 +010033
Willy Tarreau39713102016-11-25 15:49:32 +010034
Christopher Fauleteea8fc72019-11-05 16:18:10 +010035#define TRACE_SOURCE &trace_strm
36
Willy Tarreau39713102016-11-25 15:49:32 +010037/* List head of all known action keywords for "tcp-request connection" */
38struct list tcp_req_conn_keywords = LIST_HEAD_INIT(tcp_req_conn_keywords);
39struct list tcp_req_sess_keywords = LIST_HEAD_INIT(tcp_req_sess_keywords);
40struct list tcp_req_cont_keywords = LIST_HEAD_INIT(tcp_req_cont_keywords);
41struct list tcp_res_cont_keywords = LIST_HEAD_INIT(tcp_res_cont_keywords);
42
43/*
44 * Register keywords.
45 */
46void tcp_req_conn_keywords_register(struct action_kw_list *kw_list)
47{
Willy Tarreau2b718102021-04-21 07:32:39 +020048 LIST_APPEND(&tcp_req_conn_keywords, &kw_list->list);
Willy Tarreau39713102016-11-25 15:49:32 +010049}
50
51void tcp_req_sess_keywords_register(struct action_kw_list *kw_list)
52{
Willy Tarreau2b718102021-04-21 07:32:39 +020053 LIST_APPEND(&tcp_req_sess_keywords, &kw_list->list);
Willy Tarreau39713102016-11-25 15:49:32 +010054}
55
56void tcp_req_cont_keywords_register(struct action_kw_list *kw_list)
57{
Willy Tarreau2b718102021-04-21 07:32:39 +020058 LIST_APPEND(&tcp_req_cont_keywords, &kw_list->list);
Willy Tarreau39713102016-11-25 15:49:32 +010059}
60
61void tcp_res_cont_keywords_register(struct action_kw_list *kw_list)
62{
Willy Tarreau2b718102021-04-21 07:32:39 +020063 LIST_APPEND(&tcp_res_cont_keywords, &kw_list->list);
Willy Tarreau39713102016-11-25 15:49:32 +010064}
65
66/*
67 * Return the struct tcp_req_action_kw associated to a keyword.
68 */
Thierry Fournier7a71a6d2020-11-28 17:40:24 +010069struct action_kw *tcp_req_conn_action(const char *kw)
Willy Tarreau39713102016-11-25 15:49:32 +010070{
71 return action_lookup(&tcp_req_conn_keywords, kw);
72}
73
Thierry Fournier7a71a6d2020-11-28 17:40:24 +010074struct action_kw *tcp_req_sess_action(const char *kw)
Willy Tarreau39713102016-11-25 15:49:32 +010075{
76 return action_lookup(&tcp_req_sess_keywords, kw);
77}
78
Thierry Fournier7a71a6d2020-11-28 17:40:24 +010079struct action_kw *tcp_req_cont_action(const char *kw)
Willy Tarreau39713102016-11-25 15:49:32 +010080{
81 return action_lookup(&tcp_req_cont_keywords, kw);
82}
83
Thierry Fournier7a71a6d2020-11-28 17:40:24 +010084struct action_kw *tcp_res_cont_action(const char *kw)
Willy Tarreau39713102016-11-25 15:49:32 +010085{
86 return action_lookup(&tcp_res_cont_keywords, kw);
87}
88
89/* This function performs the TCP request analysis on the current request. It
90 * returns 1 if the processing can continue on next analysers, or zero if it
91 * needs more data, encounters an error, or wants to immediately abort the
92 * request. It relies on buffers flags, and updates s->req->analysers. The
93 * function may be called for frontend rules and backend rules. It only relies
94 * on the backend pointer so this works for both cases.
95 */
96int tcp_inspect_request(struct stream *s, struct channel *req, int an_bit)
97{
98 struct session *sess = s->sess;
99 struct act_rule *rule;
Willy Tarreau39713102016-11-25 15:49:32 +0100100 int partial;
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100101 int act_opts = 0;
Willy Tarreau39713102016-11-25 15:49:32 +0100102
Christopher Fauleteea8fc72019-11-05 16:18:10 +0100103 DBG_TRACE_ENTER(STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
Willy Tarreau39713102016-11-25 15:49:32 +0100104
105 /* We don't know whether we have enough data, so must proceed
106 * this way :
107 * - iterate through all rules in their declaration order
108 * - if one rule returns MISS, it means the inspect delay is
109 * not over yet, then return immediately, otherwise consider
110 * it as a non-match.
111 * - if one rule returns OK, then return OK
112 * - if one rule returns KO, then return KO
113 */
114
Christopher Fauletfc553c92021-09-30 14:56:30 +0200115 if ((req->flags & (CF_EOI|CF_SHUTR|CF_READ_ERROR)) || channel_full(req, global.tune.maxrewrite) ||
Christopher Faulet59df8122021-09-23 14:46:32 +0200116 si_rx_blocked_room(chn_prod(req)) ||
Christopher Faulet398f2b32022-06-10 16:48:47 +0200117 !s->be->tcp_req.inspect_delay || tick_is_expired(s->rules_exp, now_ms)) {
Willy Tarreau39713102016-11-25 15:49:32 +0100118 partial = SMP_OPT_FINAL;
Christopher Faulet398f2b32022-06-10 16:48:47 +0200119 /* Action may yield while the inspect_delay is not expired and there is no read error */
120 if ((req->flags & CF_READ_ERROR) || !s->be->tcp_req.inspect_delay || tick_is_expired(s->rules_exp, now_ms))
121 act_opts |= ACT_OPT_FINAL;
122 }
Willy Tarreau39713102016-11-25 15:49:32 +0100123 else
124 partial = 0;
125
126 /* If "the current_rule_list" match the executed rule list, we are in
127 * resume condition. If a resume is needed it is always in the action
128 * and never in the ACL or converters. In this case, we initialise the
129 * current rule, and go to the action execution point.
130 */
131 if (s->current_rule) {
132 rule = s->current_rule;
133 s->current_rule = NULL;
134 if (s->current_rule_list == &s->be->tcp_req.inspect_rules)
135 goto resume_execution;
136 }
137 s->current_rule_list = &s->be->tcp_req.inspect_rules;
138
139 list_for_each_entry(rule, &s->be->tcp_req.inspect_rules, list) {
140 enum acl_test_res ret = ACL_TEST_PASS;
141
142 if (rule->cond) {
143 ret = acl_exec_cond(rule->cond, s->be, sess, s, SMP_OPT_DIR_REQ | partial);
144 if (ret == ACL_TEST_MISS)
145 goto missing_data;
146
147 ret = acl_pass(ret);
148 if (rule->cond->pol == ACL_COND_UNLESS)
149 ret = !ret;
150 }
151
152 if (ret) {
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100153 act_opts |= ACT_OPT_FIRST;
Willy Tarreau39713102016-11-25 15:49:32 +0100154resume_execution:
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100155 /* Always call the action function if defined */
156 if (rule->action_ptr) {
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100157 switch (rule->action_ptr(rule, s->be, s->sess, s, act_opts)) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100158 case ACT_RET_CONT:
159 break;
160 case ACT_RET_STOP:
161 case ACT_RET_DONE:
162 goto end;
163 case ACT_RET_YIELD:
164 s->current_rule = rule;
Christopher Faulet398f2b32022-06-10 16:48:47 +0200165 if (act_opts & ACT_OPT_FINAL) {
Christopher Faulet99aaca92020-07-28 11:30:19 +0200166 send_log(s->be, LOG_WARNING,
167 "Internal error: yield not allowed if the inspect-delay expired "
168 "for the tcp-request content actions.");
169 goto internal;
170 }
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100171 goto missing_data;
172 case ACT_RET_DENY:
173 goto deny;
174 case ACT_RET_ABRT:
175 goto abort;
176 case ACT_RET_ERR:
177 goto internal;
178 case ACT_RET_INV:
179 goto invalid;
180 }
181 continue; /* eval the next rule */
182 }
183
184 /* If not action function defined, check for known actions */
Willy Tarreau39713102016-11-25 15:49:32 +0100185 if (rule->action == ACT_ACTION_ALLOW) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100186 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100187 }
188 else if (rule->action == ACT_ACTION_DENY) {
Christopher Faulet282992e2019-12-16 12:34:31 +0100189 goto deny;
Willy Tarreau39713102016-11-25 15:49:32 +0100190 }
Willy Tarreau39713102016-11-25 15:49:32 +0100191 }
192 }
193
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100194 end:
Willy Tarreau39713102016-11-25 15:49:32 +0100195 /* if we get there, it means we have no rule which matches, or
196 * we have an explicit accept, so we apply the default accept.
197 */
198 req->analysers &= ~an_bit;
Christopher Faulet2747fbb2020-07-28 11:56:13 +0200199 req->analyse_exp = s->rules_exp = TICK_ETERNITY;
Christopher Fauleteea8fc72019-11-05 16:18:10 +0100200 DBG_TRACE_LEAVE(STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
Willy Tarreau39713102016-11-25 15:49:32 +0100201 return 1;
202
203 missing_data:
204 channel_dont_connect(req);
205 /* just set the request timeout once at the beginning of the request */
Christopher Faulet2747fbb2020-07-28 11:56:13 +0200206 if (!tick_isset(s->rules_exp) && s->be->tcp_req.inspect_delay)
207 s->rules_exp = tick_add(now_ms, s->be->tcp_req.inspect_delay);
208 req->analyse_exp = tick_first((tick_is_expired(req->analyse_exp, now_ms) ? 0 : req->analyse_exp), s->rules_exp);
Christopher Fauleteea8fc72019-11-05 16:18:10 +0100209 DBG_TRACE_DEVEL("waiting for more data", STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
Willy Tarreau39713102016-11-25 15:49:32 +0100210 return 0;
211
Christopher Faulet282992e2019-12-16 12:34:31 +0100212 deny:
Willy Tarreau4781b152021-04-06 13:53:36 +0200213 _HA_ATOMIC_INC(&sess->fe->fe_counters.denied_req);
Christopher Faulet282992e2019-12-16 12:34:31 +0100214 if (sess->listener && sess->listener->counters)
Willy Tarreau4781b152021-04-06 13:53:36 +0200215 _HA_ATOMIC_INC(&sess->listener->counters->denied_req);
Christopher Faulet282992e2019-12-16 12:34:31 +0100216 goto reject;
217
218 internal:
Willy Tarreau4781b152021-04-06 13:53:36 +0200219 _HA_ATOMIC_INC(&sess->fe->fe_counters.internal_errors);
Christopher Faulet282992e2019-12-16 12:34:31 +0100220 if (sess->listener && sess->listener->counters)
Willy Tarreau4781b152021-04-06 13:53:36 +0200221 _HA_ATOMIC_INC(&sess->listener->counters->internal_errors);
Christopher Faulet282992e2019-12-16 12:34:31 +0100222 if (!(s->flags & SF_ERR_MASK))
223 s->flags |= SF_ERR_INTERNAL;
224 goto reject;
225
226 invalid:
Willy Tarreau4781b152021-04-06 13:53:36 +0200227 _HA_ATOMIC_INC(&sess->fe->fe_counters.failed_req);
Christopher Faulet282992e2019-12-16 12:34:31 +0100228 if (sess->listener && sess->listener->counters)
Willy Tarreau4781b152021-04-06 13:53:36 +0200229 _HA_ATOMIC_INC(&sess->listener->counters->failed_req);
Christopher Faulet282992e2019-12-16 12:34:31 +0100230
231 reject:
232 si_must_kill_conn(chn_prod(req));
233 channel_abort(req);
234 channel_abort(&s->res);
235
236 abort:
237 req->analysers &= AN_REQ_FLT_END;
238
239 if (!(s->flags & SF_ERR_MASK))
240 s->flags |= SF_ERR_PRXCOND;
241 if (!(s->flags & SF_FINST_MASK))
242 s->flags |= SF_FINST_R;
243 DBG_TRACE_DEVEL("leaving on error|deny|abort", STRM_EV_STRM_ANA|STRM_EV_TCP_ANA|STRM_EV_TCP_ERR, s);
244 return 0;
Willy Tarreau39713102016-11-25 15:49:32 +0100245}
246
247/* This function performs the TCP response analysis on the current response. It
248 * returns 1 if the processing can continue on next analysers, or zero if it
249 * needs more data, encounters an error, or wants to immediately abort the
250 * response. It relies on buffers flags, and updates s->rep->analysers. The
251 * function may be called for backend rules.
252 */
253int tcp_inspect_response(struct stream *s, struct channel *rep, int an_bit)
254{
255 struct session *sess = s->sess;
256 struct act_rule *rule;
257 int partial;
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100258 int act_opts = 0;
Willy Tarreau39713102016-11-25 15:49:32 +0100259
Christopher Fauleteea8fc72019-11-05 16:18:10 +0100260 DBG_TRACE_ENTER(STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
Willy Tarreau39713102016-11-25 15:49:32 +0100261
262 /* We don't know whether we have enough data, so must proceed
263 * this way :
264 * - iterate through all rules in their declaration order
265 * - if one rule returns MISS, it means the inspect delay is
266 * not over yet, then return immediately, otherwise consider
267 * it as a non-match.
268 * - if one rule returns OK, then return OK
269 * - if one rule returns KO, then return KO
270 */
Christopher Fauletfc553c92021-09-30 14:56:30 +0200271 if ((rep->flags & (CF_EOI|CF_SHUTR|CF_READ_ERROR)) || channel_full(rep, global.tune.maxrewrite) ||
Christopher Faulet59df8122021-09-23 14:46:32 +0200272 si_rx_blocked_room(chn_prod(rep)) ||
Christopher Faulet398f2b32022-06-10 16:48:47 +0200273 !s->be->tcp_rep.inspect_delay || tick_is_expired(s->rules_exp, now_ms)) {
Willy Tarreau39713102016-11-25 15:49:32 +0100274 partial = SMP_OPT_FINAL;
Christopher Faulet398f2b32022-06-10 16:48:47 +0200275 /* Action may yield while the inspect_delay is not expired and there is no read error */
276 if ((rep->flags & CF_READ_ERROR) || !s->be->tcp_rep.inspect_delay || tick_is_expired(s->rules_exp, now_ms))
277 act_opts |= ACT_OPT_FINAL;
278 }
Willy Tarreau39713102016-11-25 15:49:32 +0100279 else
280 partial = 0;
281
282 /* If "the current_rule_list" match the executed rule list, we are in
283 * resume condition. If a resume is needed it is always in the action
284 * and never in the ACL or converters. In this case, we initialise the
285 * current rule, and go to the action execution point.
286 */
287 if (s->current_rule) {
288 rule = s->current_rule;
289 s->current_rule = NULL;
290 if (s->current_rule_list == &s->be->tcp_rep.inspect_rules)
291 goto resume_execution;
292 }
293 s->current_rule_list = &s->be->tcp_rep.inspect_rules;
Christopher Faulet2747fbb2020-07-28 11:56:13 +0200294 s->rules_exp = TICK_ETERNITY;
Willy Tarreau39713102016-11-25 15:49:32 +0100295
296 list_for_each_entry(rule, &s->be->tcp_rep.inspect_rules, list) {
297 enum acl_test_res ret = ACL_TEST_PASS;
298
299 if (rule->cond) {
300 ret = acl_exec_cond(rule->cond, s->be, sess, s, SMP_OPT_DIR_RES | partial);
Christopher Faulet2747fbb2020-07-28 11:56:13 +0200301 if (ret == ACL_TEST_MISS)
302 goto missing_data;
Willy Tarreau39713102016-11-25 15:49:32 +0100303
304 ret = acl_pass(ret);
305 if (rule->cond->pol == ACL_COND_UNLESS)
306 ret = !ret;
307 }
308
309 if (ret) {
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100310 act_opts |= ACT_OPT_FIRST;
Willy Tarreau39713102016-11-25 15:49:32 +0100311resume_execution:
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100312 /* Always call the action function if defined */
313 if (rule->action_ptr) {
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100314 switch (rule->action_ptr(rule, s->be, s->sess, s, act_opts)) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100315 case ACT_RET_CONT:
316 break;
317 case ACT_RET_STOP:
318 case ACT_RET_DONE:
319 goto end;
320 case ACT_RET_YIELD:
321 s->current_rule = rule;
Christopher Faulet398f2b32022-06-10 16:48:47 +0200322 if (act_opts & ACT_OPT_FINAL) {
Christopher Faulet99aaca92020-07-28 11:30:19 +0200323 send_log(s->be, LOG_WARNING,
324 "Internal error: yield not allowed if the inspect-delay expired "
325 "for the tcp-response content actions.");
326 goto internal;
327 }
Christopher Faulet2747fbb2020-07-28 11:56:13 +0200328 channel_dont_close(rep);
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100329 goto missing_data;
330 case ACT_RET_DENY:
331 goto deny;
332 case ACT_RET_ABRT:
333 goto abort;
334 case ACT_RET_ERR:
335 goto internal;
336 case ACT_RET_INV:
337 goto invalid;
338 }
339 continue; /* eval the next rule */
340 }
341
342 /* If not action function defined, check for known actions */
Willy Tarreau39713102016-11-25 15:49:32 +0100343 if (rule->action == ACT_ACTION_ALLOW) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100344 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100345 }
346 else if (rule->action == ACT_ACTION_DENY) {
Christopher Faulet282992e2019-12-16 12:34:31 +0100347 goto deny;
Willy Tarreau39713102016-11-25 15:49:32 +0100348 }
349 else if (rule->action == ACT_TCP_CLOSE) {
350 chn_prod(rep)->flags |= SI_FL_NOLINGER | SI_FL_NOHALF;
Willy Tarreau0f9cd7b2019-01-31 19:02:43 +0100351 si_must_kill_conn(chn_prod(rep));
Willy Tarreau39713102016-11-25 15:49:32 +0100352 si_shutr(chn_prod(rep));
353 si_shutw(chn_prod(rep));
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100354 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100355 }
356 }
357 }
358
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100359 end:
Willy Tarreau39713102016-11-25 15:49:32 +0100360 /* if we get there, it means we have no rule which matches, or
361 * we have an explicit accept, so we apply the default accept.
362 */
363 rep->analysers &= ~an_bit;
Christopher Faulet2747fbb2020-07-28 11:56:13 +0200364 rep->analyse_exp = s->rules_exp = TICK_ETERNITY;
Christopher Fauleteea8fc72019-11-05 16:18:10 +0100365 DBG_TRACE_LEAVE(STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
Willy Tarreau39713102016-11-25 15:49:32 +0100366 return 1;
Christopher Faulet282992e2019-12-16 12:34:31 +0100367
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100368 missing_data:
Christopher Faulet54f3e182020-07-29 12:00:23 +0200369 /* just set the analyser timeout once at the beginning of the response */
Christopher Faulet2747fbb2020-07-28 11:56:13 +0200370 if (!tick_isset(s->rules_exp) && s->be->tcp_rep.inspect_delay)
371 s->rules_exp = tick_add(now_ms, s->be->tcp_rep.inspect_delay);
372 rep->analyse_exp = tick_first((tick_is_expired(rep->analyse_exp, now_ms) ? 0 : rep->analyse_exp), s->rules_exp);
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100373 DBG_TRACE_DEVEL("waiting for more data", STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
374 return 0;
375
Christopher Faulet282992e2019-12-16 12:34:31 +0100376 deny:
Willy Tarreau4781b152021-04-06 13:53:36 +0200377 _HA_ATOMIC_INC(&s->sess->fe->fe_counters.denied_resp);
378 _HA_ATOMIC_INC(&s->be->be_counters.denied_resp);
William Lallemand36119de2021-03-08 15:26:48 +0100379 if (s->sess->listener && s->sess->listener->counters)
Willy Tarreau4781b152021-04-06 13:53:36 +0200380 _HA_ATOMIC_INC(&s->sess->listener->counters->denied_resp);
Christopher Faulet282992e2019-12-16 12:34:31 +0100381 if (objt_server(s->target))
Willy Tarreau4781b152021-04-06 13:53:36 +0200382 _HA_ATOMIC_INC(&__objt_server(s->target)->counters.denied_resp);
Christopher Faulet282992e2019-12-16 12:34:31 +0100383 goto reject;
384
385 internal:
Willy Tarreau4781b152021-04-06 13:53:36 +0200386 _HA_ATOMIC_INC(&s->sess->fe->fe_counters.internal_errors);
387 _HA_ATOMIC_INC(&s->be->be_counters.internal_errors);
William Lallemand36119de2021-03-08 15:26:48 +0100388 if (s->sess->listener && s->sess->listener->counters)
Willy Tarreau4781b152021-04-06 13:53:36 +0200389 _HA_ATOMIC_INC(&s->sess->listener->counters->internal_errors);
Christopher Faulet282992e2019-12-16 12:34:31 +0100390 if (objt_server(s->target))
Willy Tarreau4781b152021-04-06 13:53:36 +0200391 _HA_ATOMIC_INC(&__objt_server(s->target)->counters.internal_errors);
Christopher Faulet282992e2019-12-16 12:34:31 +0100392 if (!(s->flags & SF_ERR_MASK))
393 s->flags |= SF_ERR_INTERNAL;
394 goto reject;
395
396 invalid:
Willy Tarreau4781b152021-04-06 13:53:36 +0200397 _HA_ATOMIC_INC(&s->be->be_counters.failed_resp);
Christopher Faulet282992e2019-12-16 12:34:31 +0100398 if (objt_server(s->target))
Willy Tarreau4781b152021-04-06 13:53:36 +0200399 _HA_ATOMIC_INC(&__objt_server(s->target)->counters.failed_resp);
Christopher Faulet282992e2019-12-16 12:34:31 +0100400
401 reject:
402 si_must_kill_conn(chn_prod(rep));
403 channel_abort(rep);
404 channel_abort(&s->req);
405
406 abort:
Christopher Faulet19dbf2d2020-07-28 11:40:07 +0200407 rep->analysers &= AN_RES_FLT_END;
Christopher Faulet282992e2019-12-16 12:34:31 +0100408
409 if (!(s->flags & SF_ERR_MASK))
410 s->flags |= SF_ERR_PRXCOND;
411 if (!(s->flags & SF_FINST_MASK))
412 s->flags |= SF_FINST_D;
413 DBG_TRACE_DEVEL("leaving on error", STRM_EV_STRM_ANA|STRM_EV_TCP_ANA|STRM_EV_TCP_ERR, s);
414 return 0;
Willy Tarreau39713102016-11-25 15:49:32 +0100415}
416
417
418/* This function performs the TCP layer4 analysis on the current request. It
419 * returns 0 if a reject rule matches, otherwise 1 if either an accept rule
420 * matches or if no more rule matches. It can only use rules which don't need
421 * any data. This only works on connection-based client-facing stream interfaces.
422 */
423int tcp_exec_l4_rules(struct session *sess)
424{
425 struct act_rule *rule;
Willy Tarreau39713102016-11-25 15:49:32 +0100426 struct connection *conn = objt_conn(sess->origin);
427 int result = 1;
428 enum acl_test_res ret;
429
430 if (!conn)
431 return result;
432
433 list_for_each_entry(rule, &sess->fe->tcp_req.l4_rules, list) {
434 ret = ACL_TEST_PASS;
435
436 if (rule->cond) {
437 ret = acl_exec_cond(rule->cond, sess->fe, sess, NULL, SMP_OPT_DIR_REQ|SMP_OPT_FINAL);
438 ret = acl_pass(ret);
439 if (rule->cond->pol == ACL_COND_UNLESS)
440 ret = !ret;
441 }
442
443 if (ret) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100444 /* Always call the action function if defined */
445 if (rule->action_ptr) {
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100446 switch (rule->action_ptr(rule, sess->fe, sess, NULL, ACT_OPT_FINAL | ACT_OPT_FIRST)) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100447 case ACT_RET_YIELD:
448 /* yield is not allowed at this point. If this return code is
449 * used it is a bug, so I prefer to abort the process.
450 */
451 send_log(sess->fe, LOG_WARNING,
452 "Internal error: yield not allowed with tcp-request connection actions.");
453 /* fall through */
454 case ACT_RET_STOP:
455 case ACT_RET_DONE:
456 goto end;
457 case ACT_RET_CONT:
458 break;
459 case ACT_RET_DENY:
460 case ACT_RET_ABRT:
461 case ACT_RET_ERR:
462 case ACT_RET_INV:
463 result = 0;
464 goto end;
465 }
466 continue; /* eval the next rule */
467 }
468
469 /* If not action function defined, check for known actions */
Willy Tarreau39713102016-11-25 15:49:32 +0100470 if (rule->action == ACT_ACTION_ALLOW) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100471 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100472 }
473 else if (rule->action == ACT_ACTION_DENY) {
Willy Tarreau4781b152021-04-06 13:53:36 +0200474 _HA_ATOMIC_INC(&sess->fe->fe_counters.denied_conn);
Willy Tarreaua12dde02016-12-22 18:14:41 +0100475 if (sess->listener && sess->listener->counters)
Willy Tarreau4781b152021-04-06 13:53:36 +0200476 _HA_ATOMIC_INC(&sess->listener->counters->denied_conn);
Willy Tarreau39713102016-11-25 15:49:32 +0100477
478 result = 0;
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100479 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100480 }
Willy Tarreau39713102016-11-25 15:49:32 +0100481 else if (rule->action == ACT_TCP_EXPECT_PX) {
Willy Tarreau4450b582020-01-23 15:23:13 +0100482 if (!(conn->flags & CO_FL_HANDSHAKE)) {
Olivier Houchardfe50bfb2019-05-27 12:09:19 +0200483 if (xprt_add_hs(conn) < 0) {
484 result = 0;
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100485 goto end;
Olivier Houchardfe50bfb2019-05-27 12:09:19 +0200486 }
487 }
Willy Tarreau39713102016-11-25 15:49:32 +0100488 conn->flags |= CO_FL_ACCEPT_PROXY;
Willy Tarreau39713102016-11-25 15:49:32 +0100489 }
490 else if (rule->action == ACT_TCP_EXPECT_CIP) {
Willy Tarreau4450b582020-01-23 15:23:13 +0100491 if (!(conn->flags & CO_FL_HANDSHAKE)) {
Olivier Houchardfe50bfb2019-05-27 12:09:19 +0200492 if (xprt_add_hs(conn) < 0) {
493 result = 0;
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100494 goto end;
Olivier Houchardfe50bfb2019-05-27 12:09:19 +0200495 }
496 }
Willy Tarreau39713102016-11-25 15:49:32 +0100497 conn->flags |= CO_FL_ACCEPT_CIP;
Willy Tarreau39713102016-11-25 15:49:32 +0100498 }
Willy Tarreau39713102016-11-25 15:49:32 +0100499 }
500 }
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100501 end:
Willy Tarreau39713102016-11-25 15:49:32 +0100502 return result;
503}
504
505/* This function performs the TCP layer5 analysis on the current request. It
506 * returns 0 if a reject rule matches, otherwise 1 if either an accept rule
507 * matches or if no more rule matches. It can only use rules which don't need
508 * any data. This only works on session-based client-facing stream interfaces.
509 * An example of valid use case is to track a stick-counter on the source
510 * address extracted from the proxy protocol.
511 */
512int tcp_exec_l5_rules(struct session *sess)
513{
514 struct act_rule *rule;
Willy Tarreau39713102016-11-25 15:49:32 +0100515 int result = 1;
516 enum acl_test_res ret;
517
518 list_for_each_entry(rule, &sess->fe->tcp_req.l5_rules, list) {
519 ret = ACL_TEST_PASS;
520
521 if (rule->cond) {
522 ret = acl_exec_cond(rule->cond, sess->fe, sess, NULL, SMP_OPT_DIR_REQ|SMP_OPT_FINAL);
523 ret = acl_pass(ret);
524 if (rule->cond->pol == ACL_COND_UNLESS)
525 ret = !ret;
526 }
527
528 if (ret) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100529 /* Always call the action function if defined */
530 if (rule->action_ptr) {
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100531 switch (rule->action_ptr(rule, sess->fe, sess, NULL, ACT_OPT_FINAL | ACT_OPT_FIRST)) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100532 case ACT_RET_YIELD:
533 /* yield is not allowed at this point. If this return code is
534 * used it is a bug, so I prefer to abort the process.
535 */
536 send_log(sess->fe, LOG_WARNING,
537 "Internal error: yield not allowed with tcp-request session actions.");
538 /* fall through */
539 case ACT_RET_STOP:
540 case ACT_RET_DONE:
541 goto end;
542 case ACT_RET_CONT:
543 break;
544 case ACT_RET_DENY:
545 case ACT_RET_ABRT:
546 case ACT_RET_ERR:
547 case ACT_RET_INV:
548 result = 0;
549 goto end;
550 }
551 continue; /* eval the next rule */
552 }
553
554 /* If not action function defined, check for known actions */
Willy Tarreau39713102016-11-25 15:49:32 +0100555 if (rule->action == ACT_ACTION_ALLOW) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100556 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100557 }
558 else if (rule->action == ACT_ACTION_DENY) {
Willy Tarreau4781b152021-04-06 13:53:36 +0200559 _HA_ATOMIC_INC(&sess->fe->fe_counters.denied_sess);
Willy Tarreaua12dde02016-12-22 18:14:41 +0100560 if (sess->listener && sess->listener->counters)
Willy Tarreau4781b152021-04-06 13:53:36 +0200561 _HA_ATOMIC_INC(&sess->listener->counters->denied_sess);
Willy Tarreau39713102016-11-25 15:49:32 +0100562
563 result = 0;
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100564 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100565 }
Willy Tarreau39713102016-11-25 15:49:32 +0100566 }
567 }
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100568 end:
Willy Tarreau39713102016-11-25 15:49:32 +0100569 return result;
570}
571
572/* Parse a tcp-response rule. Return a negative value in case of failure */
573static int tcp_parse_response_rule(char **args, int arg, int section_type,
Willy Tarreau01825162021-03-09 09:53:46 +0100574 struct proxy *curpx, const struct proxy *defpx,
Willy Tarreau39713102016-11-25 15:49:32 +0100575 struct act_rule *rule, char **err,
576 unsigned int where,
577 const char *file, int line)
578{
579 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
580 memprintf(err, "%s %s is only allowed in 'backend' sections",
581 args[0], args[1]);
582 return -1;
583 }
584
585 if (strcmp(args[arg], "accept") == 0) {
586 arg++;
587 rule->action = ACT_ACTION_ALLOW;
Christopher Faulet245cf792019-12-18 14:58:12 +0100588 rule->flags |= ACT_FLAG_FINAL;
Willy Tarreau39713102016-11-25 15:49:32 +0100589 }
590 else if (strcmp(args[arg], "reject") == 0) {
591 arg++;
592 rule->action = ACT_ACTION_DENY;
Christopher Faulet245cf792019-12-18 14:58:12 +0100593 rule->flags |= ACT_FLAG_FINAL;
Willy Tarreau39713102016-11-25 15:49:32 +0100594 }
595 else if (strcmp(args[arg], "close") == 0) {
596 arg++;
597 rule->action = ACT_TCP_CLOSE;
Christopher Faulet245cf792019-12-18 14:58:12 +0100598 rule->flags |= ACT_FLAG_FINAL;
Willy Tarreau39713102016-11-25 15:49:32 +0100599 }
600 else {
601 struct action_kw *kw;
602 kw = tcp_res_cont_action(args[arg]);
603 if (kw) {
604 arg++;
Willy Tarreau39713102016-11-25 15:49:32 +0100605 rule->kw = kw;
606 if (kw->parse((const char **)args, &arg, curpx, rule, err) == ACT_RET_PRS_ERR)
607 return -1;
608 } else {
Willy Tarreaudb67b0e2021-03-12 13:46:10 +0100609 const char *extra[] = { "accept", "reject", "close", NULL };
610 const char *best = action_suggest(args[arg], &tcp_res_cont_keywords, extra);
611
Willy Tarreau39713102016-11-25 15:49:32 +0100612 action_build_list(&tcp_res_cont_keywords, &trash);
613 memprintf(err,
Willy Tarreaudb67b0e2021-03-12 13:46:10 +0100614 "'%s %s' expects 'accept', 'close', 'reject', %s in %s '%s' (got '%s').%s%s%s",
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200615 args[0], args[1], trash.area,
Willy Tarreaudb67b0e2021-03-12 13:46:10 +0100616 proxy_type_str(curpx), curpx->id, args[arg],
617 best ? " Did you mean '" : "",
618 best ? best : "",
619 best ? "' maybe ?" : "");
Willy Tarreau39713102016-11-25 15:49:32 +0100620 return -1;
621 }
622 }
623
624 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
Christopher Faulet1b421ea2017-09-22 14:38:56 +0200625 if ((rule->cond = build_acl_cond(file, line, &curpx->acl, curpx, (const char **)args+arg, err)) == NULL) {
Willy Tarreau39713102016-11-25 15:49:32 +0100626 memprintf(err,
627 "'%s %s %s' : error detected in %s '%s' while parsing '%s' condition : %s",
628 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg], *err);
629 return -1;
630 }
631 }
632 else if (*args[arg]) {
633 memprintf(err,
634 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (got '%s')",
635 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
636 return -1;
637 }
638 return 0;
639}
640
Christopher Fauletac98d812019-12-18 09:20:16 +0100641
642/* This function executes a track-sc* actions. On success, it returns
643 * ACT_RET_CONT. If it must yield, it return ACT_RET_YIELD. Otherwsize
644 * ACT_RET_ERR is returned.
645 */
646static enum act_return tcp_action_track_sc(struct act_rule *rule, struct proxy *px,
647 struct session *sess, struct stream *s, int flags)
648{
649 struct stksess *ts;
650 struct stktable *t;
651 struct stktable_key *key;
652 struct sample smp;
653 int opt;
654
Christopher Faulet67307792020-02-10 09:54:49 +0100655 opt = SMP_OPT_DIR_REQ;
Christopher Fauletac98d812019-12-18 09:20:16 +0100656 if (flags & ACT_FLAG_FINAL)
657 opt |= SMP_OPT_FINAL;
Willy Tarreau39713102016-11-25 15:49:32 +0100658
Christopher Fauletac98d812019-12-18 09:20:16 +0100659 t = rule->arg.trk_ctr.table.t;
Christopher Faulet67307792020-02-10 09:54:49 +0100660 if (rule->from == ACT_F_TCP_REQ_CNT) { /* L7 rules: use the stream */
661 if (stkctr_entry(&s->stkctr[rule->action]))
662 goto end;
Christopher Fauletac98d812019-12-18 09:20:16 +0100663
Christopher Faulet67307792020-02-10 09:54:49 +0100664 key = stktable_fetch_key(t, s->be, sess, s, opt, rule->arg.trk_ctr.expr, &smp);
Christopher Fauletac98d812019-12-18 09:20:16 +0100665
Christopher Faulet67307792020-02-10 09:54:49 +0100666 if ((smp.flags & SMP_F_MAY_CHANGE) && !(flags & ACT_FLAG_FINAL))
667 return ACT_RET_YIELD; /* key might appear later */
668
669 if (key && (ts = stktable_get_entry(t, key))) {
670 stream_track_stkctr(&s->stkctr[rule->action], t, ts);
Christopher Fauletac98d812019-12-18 09:20:16 +0100671 stkctr_set_flags(&s->stkctr[rule->action], STKCTR_TRACK_CONTENT);
672 if (sess->fe != s->be)
673 stkctr_set_flags(&s->stkctr[rule->action], STKCTR_TRACK_BACKEND);
674 }
675 }
Christopher Faulet67307792020-02-10 09:54:49 +0100676 else { /* L4/L5 rules: use the session */
677 if (stkctr_entry(&sess->stkctr[rule->action]))
678 goto end;
679
680 key = stktable_fetch_key(t, sess->fe, sess, NULL, opt, rule->arg.trk_ctr.expr, NULL);
681 if (key && (ts = stktable_get_entry(t, key)))
682 stream_track_stkctr(&sess->stkctr[rule->action], t, ts);
683 }
Christopher Fauletac98d812019-12-18 09:20:16 +0100684
685 end:
686 return ACT_RET_CONT;
687}
Willy Tarreau39713102016-11-25 15:49:32 +0100688
Christopher Fauletd73b96d2019-12-19 17:27:03 +0100689/* This function executes a capture actions. It executes a fetch expression,
690 * turns the result into a string and puts it in a capture slot. On success, it
691 * returns ACT_RET_CONT. If it must yield, it return ACT_RET_YIELD. Otherwsize
692 * ACT_RET_ERR is returned.
693 */
694static enum act_return tcp_action_capture(struct act_rule *rule, struct proxy *px,
695 struct session *sess, struct stream *s, int flags)
696{
697 struct sample *key;
698 struct cap_hdr *h = rule->arg.cap.hdr;
699 char **cap = s->req_cap;
700 int len, opt;
701
702 opt = ((rule->from == ACT_F_TCP_REQ_CNT) ? SMP_OPT_DIR_REQ : SMP_OPT_DIR_RES);
703 if (flags & ACT_FLAG_FINAL)
704 opt |= SMP_OPT_FINAL;
705
706 key = sample_fetch_as_type(s->be, sess, s, opt, rule->arg.cap.expr, SMP_T_STR);
707 if (!key)
708 goto end;
709
710 if ((key->flags & SMP_F_MAY_CHANGE) && !(flags & ACT_FLAG_FINAL))
711 return ACT_RET_YIELD; /* key might appear later */
712
713 if (cap[h->index] == NULL) {
714 cap[h->index] = pool_alloc(h->pool);
715 if (cap[h->index] == NULL) /* no more capture memory, ignore error */
716 goto end;
717 }
718
719 len = key->data.u.str.data;
720 if (len > h->len)
721 len = h->len;
722
723 memcpy(cap[h->index], key->data.u.str.area, len);
724 cap[h->index][len] = 0;
725
726 end:
727 return ACT_RET_CONT;
728}
729
Christopher Fauletadfc6e82020-01-14 15:05:33 +0100730static void release_tcp_capture(struct act_rule * rule)
731{
732 release_sample_expr(rule->arg.cap.expr);
733}
734
735
736static void release_tcp_track_sc(struct act_rule * rule)
737{
738 release_sample_expr(rule->arg.trk_ctr.expr);
739}
740
Willy Tarreau39713102016-11-25 15:49:32 +0100741/* Parse a tcp-request rule. Return a negative value in case of failure */
742static int tcp_parse_request_rule(char **args, int arg, int section_type,
Willy Tarreau01825162021-03-09 09:53:46 +0100743 struct proxy *curpx, const struct proxy *defpx,
Willy Tarreau39713102016-11-25 15:49:32 +0100744 struct act_rule *rule, char **err,
745 unsigned int where, const char *file, int line)
746{
747 if (curpx == defpx) {
748 memprintf(err, "%s %s is not allowed in 'defaults' sections",
749 args[0], args[1]);
750 return -1;
751 }
752
Tim Duesterhuse5ff1412021-01-02 22:31:53 +0100753 if (strcmp(args[arg], "accept") == 0) {
Willy Tarreau39713102016-11-25 15:49:32 +0100754 arg++;
755 rule->action = ACT_ACTION_ALLOW;
Christopher Faulet245cf792019-12-18 14:58:12 +0100756 rule->flags |= ACT_FLAG_FINAL;
Willy Tarreau39713102016-11-25 15:49:32 +0100757 }
Tim Duesterhuse5ff1412021-01-02 22:31:53 +0100758 else if (strcmp(args[arg], "reject") == 0) {
Willy Tarreau39713102016-11-25 15:49:32 +0100759 arg++;
760 rule->action = ACT_ACTION_DENY;
Christopher Faulet245cf792019-12-18 14:58:12 +0100761 rule->flags |= ACT_FLAG_FINAL;
Willy Tarreau39713102016-11-25 15:49:32 +0100762 }
763 else if (strcmp(args[arg], "capture") == 0) {
764 struct sample_expr *expr;
765 struct cap_hdr *hdr;
766 int kw = arg;
767 int len = 0;
768
769 if (!(curpx->cap & PR_CAP_FE)) {
770 memprintf(err,
771 "'%s %s %s' : proxy '%s' has no frontend capability",
772 args[0], args[1], args[kw], curpx->id);
773 return -1;
774 }
775
776 if (!(where & SMP_VAL_FE_REQ_CNT)) {
777 memprintf(err,
778 "'%s %s' is not allowed in '%s %s' rules in %s '%s'",
779 args[arg], args[arg+1], args[0], args[1], proxy_type_str(curpx), curpx->id);
780 return -1;
781 }
782
783 arg++;
784
785 curpx->conf.args.ctx = ARGC_CAP;
Willy Tarreaue3b57bf2020-02-14 16:50:14 +0100786 expr = sample_parse_expr(args, &arg, file, line, err, &curpx->conf.args, NULL);
Willy Tarreau39713102016-11-25 15:49:32 +0100787 if (!expr) {
788 memprintf(err,
789 "'%s %s %s' : %s",
790 args[0], args[1], args[kw], *err);
791 return -1;
792 }
793
794 if (!(expr->fetch->val & where)) {
795 memprintf(err,
796 "'%s %s %s' : fetch method '%s' extracts information from '%s', none of which is available here",
797 args[0], args[1], args[kw], args[arg-1], sample_src_names(expr->fetch->use));
Christopher Fauletfdb6fbf2020-01-14 15:05:56 +0100798 release_sample_expr(expr);
Willy Tarreau39713102016-11-25 15:49:32 +0100799 return -1;
800 }
801
802 if (strcmp(args[arg], "len") == 0) {
803 arg++;
804 if (!args[arg]) {
805 memprintf(err,
806 "'%s %s %s' : missing length value",
807 args[0], args[1], args[kw]);
Christopher Fauletfdb6fbf2020-01-14 15:05:56 +0100808 release_sample_expr(expr);
Willy Tarreau39713102016-11-25 15:49:32 +0100809 return -1;
810 }
811 /* we copy the table name for now, it will be resolved later */
812 len = atoi(args[arg]);
813 if (len <= 0) {
814 memprintf(err,
815 "'%s %s %s' : length must be > 0",
816 args[0], args[1], args[kw]);
Christopher Fauletfdb6fbf2020-01-14 15:05:56 +0100817 release_sample_expr(expr);
Willy Tarreau39713102016-11-25 15:49:32 +0100818 return -1;
819 }
820 arg++;
821 }
822
823 if (!len) {
824 memprintf(err,
825 "'%s %s %s' : a positive 'len' argument is mandatory",
826 args[0], args[1], args[kw]);
827 free(expr);
828 return -1;
829 }
830
831 hdr = calloc(1, sizeof(*hdr));
Remi Tricot-Le Breton31d170c2021-05-17 10:08:16 +0200832 if (!hdr) {
833 memprintf(err, "parsing [%s:%d] : out of memory", file, line);
834 release_sample_expr(expr);
835 return -1;
836 }
Willy Tarreau39713102016-11-25 15:49:32 +0100837 hdr->next = curpx->req_cap;
838 hdr->name = NULL; /* not a header capture */
839 hdr->namelen = 0;
840 hdr->len = len;
841 hdr->pool = create_pool("caphdr", hdr->len + 1, MEM_F_SHARED);
842 hdr->index = curpx->nb_req_cap++;
843
844 curpx->req_cap = hdr;
845 curpx->to_log |= LW_REQHDR;
846
Christopher Faulet711ed6a2019-07-16 14:16:10 +0200847 /* check if we need to allocate an http_txn struct for HTTP parsing */
Willy Tarreau39713102016-11-25 15:49:32 +0100848 curpx->http_needed |= !!(expr->fetch->use & SMP_USE_HTTP_ANY);
849
850 rule->arg.cap.expr = expr;
851 rule->arg.cap.hdr = hdr;
Christopher Fauletd73b96d2019-12-19 17:27:03 +0100852 rule->action = ACT_CUSTOM;
853 rule->action_ptr = tcp_action_capture;
854 rule->check_ptr = check_capture;
Christopher Fauletadfc6e82020-01-14 15:05:33 +0100855 rule->release_ptr = release_tcp_capture;
Willy Tarreau39713102016-11-25 15:49:32 +0100856 }
Frédéric Lécaillea41d5312018-01-29 12:05:07 +0100857 else if (strncmp(args[arg], "track-sc", 8) == 0) {
Willy Tarreau39713102016-11-25 15:49:32 +0100858 struct sample_expr *expr;
859 int kw = arg;
Frédéric Lécaillea41d5312018-01-29 12:05:07 +0100860 unsigned int tsc_num;
861 const char *tsc_num_str;
Willy Tarreau39713102016-11-25 15:49:32 +0100862
863 arg++;
864
Frédéric Lécaillea41d5312018-01-29 12:05:07 +0100865 tsc_num_str = &args[kw][8];
866 if (cfg_parse_track_sc_num(&tsc_num, tsc_num_str, tsc_num_str + strlen(tsc_num_str), err) == -1) {
867 memprintf(err, "'%s %s %s' : %s", args[0], args[1], args[kw], *err);
868 return -1;
869 }
870
Willy Tarreau39713102016-11-25 15:49:32 +0100871 curpx->conf.args.ctx = ARGC_TRK;
Willy Tarreaue3b57bf2020-02-14 16:50:14 +0100872 expr = sample_parse_expr(args, &arg, file, line, err, &curpx->conf.args, NULL);
Willy Tarreau39713102016-11-25 15:49:32 +0100873 if (!expr) {
874 memprintf(err,
875 "'%s %s %s' : %s",
876 args[0], args[1], args[kw], *err);
877 return -1;
878 }
879
880 if (!(expr->fetch->val & where)) {
881 memprintf(err,
882 "'%s %s %s' : fetch method '%s' extracts information from '%s', none of which is available here",
883 args[0], args[1], args[kw], args[arg-1], sample_src_names(expr->fetch->use));
Christopher Fauletfdb6fbf2020-01-14 15:05:56 +0100884 release_sample_expr(expr);
Willy Tarreau39713102016-11-25 15:49:32 +0100885 return -1;
886 }
887
Christopher Faulet711ed6a2019-07-16 14:16:10 +0200888 /* check if we need to allocate an http_txn struct for HTTP parsing */
Willy Tarreau39713102016-11-25 15:49:32 +0100889 curpx->http_needed |= !!(expr->fetch->use & SMP_USE_HTTP_ANY);
890
891 if (strcmp(args[arg], "table") == 0) {
892 arg++;
893 if (!args[arg]) {
894 memprintf(err,
895 "'%s %s %s' : missing table name",
896 args[0], args[1], args[kw]);
Christopher Fauletfdb6fbf2020-01-14 15:05:56 +0100897 release_sample_expr(expr);
Willy Tarreau39713102016-11-25 15:49:32 +0100898 return -1;
899 }
900 /* we copy the table name for now, it will be resolved later */
901 rule->arg.trk_ctr.table.n = strdup(args[arg]);
902 arg++;
903 }
Christopher Fauletac98d812019-12-18 09:20:16 +0100904 rule->action = tsc_num;
Willy Tarreau39713102016-11-25 15:49:32 +0100905 rule->arg.trk_ctr.expr = expr;
Christopher Fauletac98d812019-12-18 09:20:16 +0100906 rule->action_ptr = tcp_action_track_sc;
Christopher Faulet78880fb2017-09-18 14:43:55 +0200907 rule->check_ptr = check_trk_action;
Christopher Fauletadfc6e82020-01-14 15:05:33 +0100908 rule->release_ptr = release_tcp_track_sc;
Willy Tarreau39713102016-11-25 15:49:32 +0100909 }
910 else if (strcmp(args[arg], "expect-proxy") == 0) {
911 if (strcmp(args[arg+1], "layer4") != 0) {
912 memprintf(err,
913 "'%s %s %s' only supports 'layer4' in %s '%s' (got '%s')",
914 args[0], args[1], args[arg], proxy_type_str(curpx), curpx->id, args[arg+1]);
915 return -1;
916 }
917
918 if (!(where & SMP_VAL_FE_CON_ACC)) {
919 memprintf(err,
920 "'%s %s' is not allowed in '%s %s' rules in %s '%s'",
921 args[arg], args[arg+1], args[0], args[1], proxy_type_str(curpx), curpx->id);
922 return -1;
923 }
924
925 arg += 2;
926 rule->action = ACT_TCP_EXPECT_PX;
927 }
928 else if (strcmp(args[arg], "expect-netscaler-cip") == 0) {
929 if (strcmp(args[arg+1], "layer4") != 0) {
930 memprintf(err,
931 "'%s %s %s' only supports 'layer4' in %s '%s' (got '%s')",
932 args[0], args[1], args[arg], proxy_type_str(curpx), curpx->id, args[arg+1]);
933 return -1;
934 }
935
936 if (!(where & SMP_VAL_FE_CON_ACC)) {
937 memprintf(err,
938 "'%s %s' is not allowed in '%s %s' rules in %s '%s'",
939 args[arg], args[arg+1], args[0], args[1], proxy_type_str(curpx), curpx->id);
940 return -1;
941 }
942
943 arg += 2;
944 rule->action = ACT_TCP_EXPECT_CIP;
945 }
946 else {
947 struct action_kw *kw;
948 if (where & SMP_VAL_FE_CON_ACC) {
949 /* L4 */
950 kw = tcp_req_conn_action(args[arg]);
951 rule->kw = kw;
Willy Tarreau39713102016-11-25 15:49:32 +0100952 } else if (where & SMP_VAL_FE_SES_ACC) {
953 /* L5 */
954 kw = tcp_req_sess_action(args[arg]);
955 rule->kw = kw;
Willy Tarreau39713102016-11-25 15:49:32 +0100956 } else {
957 /* L6 */
958 kw = tcp_req_cont_action(args[arg]);
959 rule->kw = kw;
Willy Tarreau39713102016-11-25 15:49:32 +0100960 }
961 if (kw) {
962 arg++;
963 if (kw->parse((const char **)args, &arg, curpx, rule, err) == ACT_RET_PRS_ERR)
964 return -1;
965 } else {
Christopher Fauleta561ffb2021-03-19 08:53:26 +0100966 const char *extra[] = { "accept", "reject", "capture", "track-sc", "expect-proxy", "expect-netscaler-cip", NULL };
Willy Tarreaudb67b0e2021-03-12 13:46:10 +0100967 const char *best = NULL;
968
969
970 if (where & SMP_VAL_FE_CON_ACC) {
Willy Tarreau39713102016-11-25 15:49:32 +0100971 action_build_list(&tcp_req_conn_keywords, &trash);
Willy Tarreaudb67b0e2021-03-12 13:46:10 +0100972 best = action_suggest(args[arg], &tcp_req_conn_keywords, extra);
973 }
974 else if (where & SMP_VAL_FE_SES_ACC) {
Willy Tarreau39713102016-11-25 15:49:32 +0100975 action_build_list(&tcp_req_sess_keywords, &trash);
Willy Tarreaudb67b0e2021-03-12 13:46:10 +0100976 best = action_suggest(args[arg], &tcp_req_sess_keywords, extra);
977 }
978 else {
Willy Tarreau39713102016-11-25 15:49:32 +0100979 action_build_list(&tcp_req_cont_keywords, &trash);
Willy Tarreaudb67b0e2021-03-12 13:46:10 +0100980 best = action_suggest(args[arg], &tcp_req_cont_keywords, extra);
981 }
982
Willy Tarreau39713102016-11-25 15:49:32 +0100983 memprintf(err,
Christopher Fauleta561ffb2021-03-19 08:53:26 +0100984 "'%s %s' expects 'accept', 'reject', 'capture', 'expect-proxy', 'expect-netscaler-cip', 'track-sc0' ... 'track-sc%d', %s "
Willy Tarreaudb67b0e2021-03-12 13:46:10 +0100985 "in %s '%s' (got '%s').%s%s%s\n",
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200986 args[0], args[1], MAX_SESS_STKCTR-1,
987 trash.area, proxy_type_str(curpx),
Willy Tarreaudb67b0e2021-03-12 13:46:10 +0100988 curpx->id, args[arg],
989 best ? " Did you mean '" : "",
990 best ? best : "",
991 best ? "' maybe ?" : "");
Willy Tarreau39713102016-11-25 15:49:32 +0100992 return -1;
993 }
994 }
995
996 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
Christopher Faulet1b421ea2017-09-22 14:38:56 +0200997 if ((rule->cond = build_acl_cond(file, line, &curpx->acl, curpx, (const char **)args+arg, err)) == NULL) {
Willy Tarreau39713102016-11-25 15:49:32 +0100998 memprintf(err,
999 "'%s %s %s' : error detected in %s '%s' while parsing '%s' condition : %s",
1000 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg], *err);
1001 return -1;
1002 }
1003 }
1004 else if (*args[arg]) {
1005 memprintf(err,
1006 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (got '%s')",
1007 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
1008 return -1;
1009 }
1010 return 0;
1011}
1012
1013/* This function should be called to parse a line starting with the "tcp-response"
1014 * keyword.
1015 */
1016static int tcp_parse_tcp_rep(char **args, int section_type, struct proxy *curpx,
Willy Tarreau01825162021-03-09 09:53:46 +01001017 const struct proxy *defpx, const char *file, int line,
Willy Tarreau39713102016-11-25 15:49:32 +01001018 char **err)
1019{
1020 const char *ptr = NULL;
1021 unsigned int val;
1022 int warn = 0;
1023 int arg;
1024 struct act_rule *rule;
1025 unsigned int where;
1026 const struct acl *acl;
1027 const char *kw;
1028
1029 if (!*args[1]) {
1030 memprintf(err, "missing argument for '%s' in %s '%s'",
1031 args[0], proxy_type_str(curpx), curpx->id);
1032 return -1;
1033 }
1034
1035 if (strcmp(args[1], "inspect-delay") == 0) {
1036 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
1037 memprintf(err, "%s %s is only allowed in 'backend' sections",
1038 args[0], args[1]);
1039 return -1;
1040 }
1041
1042 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
1043 memprintf(err,
1044 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
1045 args[0], args[1], proxy_type_str(curpx), curpx->id);
Willy Tarreau9faebe32019-06-07 19:00:37 +02001046
1047 if (ptr == PARSE_TIME_OVER)
1048 memprintf(err, "%s (timer overflow in '%s', maximum value is 2147483647 ms or ~24.8 days)", *err, args[2]);
1049 else if (ptr == PARSE_TIME_UNDER)
1050 memprintf(err, "%s (timer underflow in '%s', minimum non-null value is 1 ms)", *err, args[2]);
1051 else if (ptr)
Willy Tarreau39713102016-11-25 15:49:32 +01001052 memprintf(err, "%s (unexpected character '%c')", *err, *ptr);
1053 return -1;
1054 }
1055
1056 if (curpx->tcp_rep.inspect_delay) {
1057 memprintf(err, "ignoring %s %s (was already defined) in %s '%s'",
1058 args[0], args[1], proxy_type_str(curpx), curpx->id);
1059 return 1;
1060 }
1061 curpx->tcp_rep.inspect_delay = val;
1062 return 0;
1063 }
1064
1065 rule = calloc(1, sizeof(*rule));
Remi Tricot-Le Breton8f86a292021-05-12 18:24:18 +02001066 if (!rule) {
1067 memprintf(err, "parsing [%s:%d] : out of memory", file, line);
1068 return -1;
1069 }
Willy Tarreau39713102016-11-25 15:49:32 +01001070 LIST_INIT(&rule->list);
1071 arg = 1;
1072 where = 0;
1073
1074 if (strcmp(args[1], "content") == 0) {
1075 arg++;
1076
1077 if (curpx->cap & PR_CAP_FE)
1078 where |= SMP_VAL_FE_RES_CNT;
1079 if (curpx->cap & PR_CAP_BE)
1080 where |= SMP_VAL_BE_RES_CNT;
Christopher Fauletcb9106b2019-12-19 15:23:17 +01001081 rule->from = ACT_F_TCP_RES_CNT;
Willy Tarreau39713102016-11-25 15:49:32 +01001082 if (tcp_parse_response_rule(args, arg, section_type, curpx, defpx, rule, err, where, file, line) < 0)
1083 goto error;
1084
1085 acl = rule->cond ? acl_cond_conflicts(rule->cond, where) : NULL;
1086 if (acl) {
1087 if (acl->name && *acl->name)
1088 memprintf(err,
1089 "acl '%s' will never match in '%s %s' because it only involves keywords that are incompatible with '%s'",
1090 acl->name, args[0], args[1], sample_ckp_names(where));
1091 else
1092 memprintf(err,
1093 "anonymous acl will never match in '%s %s' because it uses keyword '%s' which is incompatible with '%s'",
1094 args[0], args[1],
1095 LIST_ELEM(acl->expr.n, struct acl_expr *, list)->kw,
1096 sample_ckp_names(where));
1097
1098 warn++;
1099 }
1100 else if (rule->cond && acl_cond_kw_conflicts(rule->cond, where, &acl, &kw)) {
1101 if (acl->name && *acl->name)
1102 memprintf(err,
1103 "acl '%s' involves keyword '%s' which is incompatible with '%s'",
1104 acl->name, kw, sample_ckp_names(where));
1105 else
1106 memprintf(err,
1107 "anonymous acl involves keyword '%s' which is incompatible with '%s'",
1108 kw, sample_ckp_names(where));
1109 warn++;
1110 }
1111
Willy Tarreau2b718102021-04-21 07:32:39 +02001112 LIST_APPEND(&curpx->tcp_rep.inspect_rules, &rule->list);
Willy Tarreau39713102016-11-25 15:49:32 +01001113 }
1114 else {
1115 memprintf(err,
1116 "'%s' expects 'inspect-delay' or 'content' in %s '%s' (got '%s')",
1117 args[0], proxy_type_str(curpx), curpx->id, args[1]);
1118 goto error;
1119 }
1120
1121 return warn;
1122 error:
1123 free(rule);
1124 return -1;
1125}
1126
1127
1128/* This function should be called to parse a line starting with the "tcp-request"
1129 * keyword.
1130 */
1131static int tcp_parse_tcp_req(char **args, int section_type, struct proxy *curpx,
Willy Tarreau01825162021-03-09 09:53:46 +01001132 const struct proxy *defpx, const char *file, int line,
Willy Tarreau39713102016-11-25 15:49:32 +01001133 char **err)
1134{
1135 const char *ptr = NULL;
1136 unsigned int val;
1137 int warn = 0;
1138 int arg;
1139 struct act_rule *rule;
1140 unsigned int where;
1141 const struct acl *acl;
1142 const char *kw;
1143
1144 if (!*args[1]) {
1145 if (curpx == defpx)
1146 memprintf(err, "missing argument for '%s' in defaults section", args[0]);
1147 else
1148 memprintf(err, "missing argument for '%s' in %s '%s'",
1149 args[0], proxy_type_str(curpx), curpx->id);
1150 return -1;
1151 }
1152
Tim Duesterhuse5ff1412021-01-02 22:31:53 +01001153 if (strcmp(args[1], "inspect-delay") == 0) {
Willy Tarreau39713102016-11-25 15:49:32 +01001154 if (curpx == defpx) {
1155 memprintf(err, "%s %s is not allowed in 'defaults' sections",
1156 args[0], args[1]);
1157 return -1;
1158 }
1159
1160 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
1161 memprintf(err,
1162 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
1163 args[0], args[1], proxy_type_str(curpx), curpx->id);
Willy Tarreau9faebe32019-06-07 19:00:37 +02001164
1165 if (ptr == PARSE_TIME_OVER)
1166 memprintf(err, "%s (timer overflow in '%s', maximum value is 2147483647 ms or ~24.8 days)", *err, args[2]);
1167 else if (ptr == PARSE_TIME_UNDER)
1168 memprintf(err, "%s (timer underflow in '%s', minimum non-null value is 1 ms)", *err, args[2]);
1169 else if (ptr)
Willy Tarreau39713102016-11-25 15:49:32 +01001170 memprintf(err, "%s (unexpected character '%c')", *err, *ptr);
1171 return -1;
1172 }
1173
1174 if (curpx->tcp_req.inspect_delay) {
1175 memprintf(err, "ignoring %s %s (was already defined) in %s '%s'",
1176 args[0], args[1], proxy_type_str(curpx), curpx->id);
1177 return 1;
1178 }
1179 curpx->tcp_req.inspect_delay = val;
1180 return 0;
1181 }
1182
1183 rule = calloc(1, sizeof(*rule));
Remi Tricot-Le Breton8f86a292021-05-12 18:24:18 +02001184 if (!rule) {
1185 memprintf(err, "parsing [%s:%d] : out of memory", file, line);
1186 return -1;
1187 }
Willy Tarreau39713102016-11-25 15:49:32 +01001188 LIST_INIT(&rule->list);
1189 arg = 1;
1190 where = 0;
1191
1192 if (strcmp(args[1], "content") == 0) {
1193 arg++;
1194
1195 if (curpx->cap & PR_CAP_FE)
1196 where |= SMP_VAL_FE_REQ_CNT;
1197 if (curpx->cap & PR_CAP_BE)
1198 where |= SMP_VAL_BE_REQ_CNT;
Christopher Fauletcb9106b2019-12-19 15:23:17 +01001199 rule->from = ACT_F_TCP_REQ_CNT;
Willy Tarreau39713102016-11-25 15:49:32 +01001200 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, where, file, line) < 0)
1201 goto error;
1202
1203 acl = rule->cond ? acl_cond_conflicts(rule->cond, where) : NULL;
1204 if (acl) {
1205 if (acl->name && *acl->name)
1206 memprintf(err,
1207 "acl '%s' will never match in '%s %s' because it only involves keywords that are incompatible with '%s'",
1208 acl->name, args[0], args[1], sample_ckp_names(where));
1209 else
1210 memprintf(err,
1211 "anonymous acl will never match in '%s %s' because it uses keyword '%s' which is incompatible with '%s'",
1212 args[0], args[1],
1213 LIST_ELEM(acl->expr.n, struct acl_expr *, list)->kw,
1214 sample_ckp_names(where));
1215
1216 warn++;
1217 }
1218 else if (rule->cond && acl_cond_kw_conflicts(rule->cond, where, &acl, &kw)) {
1219 if (acl->name && *acl->name)
1220 memprintf(err,
1221 "acl '%s' involves keyword '%s' which is incompatible with '%s'",
1222 acl->name, kw, sample_ckp_names(where));
1223 else
1224 memprintf(err,
1225 "anonymous acl involves keyword '%s' which is incompatible with '%s'",
1226 kw, sample_ckp_names(where));
1227 warn++;
1228 }
1229
1230 /* the following function directly emits the warning */
1231 warnif_misplaced_tcp_cont(curpx, file, line, args[0]);
Willy Tarreau2b718102021-04-21 07:32:39 +02001232 LIST_APPEND(&curpx->tcp_req.inspect_rules, &rule->list);
Willy Tarreau39713102016-11-25 15:49:32 +01001233 }
1234 else if (strcmp(args[1], "connection") == 0) {
1235 arg++;
1236
1237 if (!(curpx->cap & PR_CAP_FE)) {
1238 memprintf(err, "%s %s is not allowed because %s %s is not a frontend",
1239 args[0], args[1], proxy_type_str(curpx), curpx->id);
1240 goto error;
1241 }
1242
1243 where |= SMP_VAL_FE_CON_ACC;
Christopher Fauletcb9106b2019-12-19 15:23:17 +01001244 rule->from = ACT_F_TCP_REQ_CON;
Willy Tarreau39713102016-11-25 15:49:32 +01001245 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, where, file, line) < 0)
1246 goto error;
1247
1248 acl = rule->cond ? acl_cond_conflicts(rule->cond, where) : NULL;
1249 if (acl) {
1250 if (acl->name && *acl->name)
1251 memprintf(err,
1252 "acl '%s' will never match in '%s %s' because it only involves keywords that are incompatible with '%s'",
1253 acl->name, args[0], args[1], sample_ckp_names(where));
1254 else
1255 memprintf(err,
1256 "anonymous acl will never match in '%s %s' because it uses keyword '%s' which is incompatible with '%s'",
1257 args[0], args[1],
1258 LIST_ELEM(acl->expr.n, struct acl_expr *, list)->kw,
1259 sample_ckp_names(where));
1260
1261 warn++;
1262 }
1263 else if (rule->cond && acl_cond_kw_conflicts(rule->cond, where, &acl, &kw)) {
1264 if (acl->name && *acl->name)
1265 memprintf(err,
1266 "acl '%s' involves keyword '%s' which is incompatible with '%s'",
1267 acl->name, kw, sample_ckp_names(where));
1268 else
1269 memprintf(err,
1270 "anonymous acl involves keyword '%s' which is incompatible with '%s'",
1271 kw, sample_ckp_names(where));
1272 warn++;
1273 }
1274
1275 /* the following function directly emits the warning */
1276 warnif_misplaced_tcp_conn(curpx, file, line, args[0]);
Willy Tarreau2b718102021-04-21 07:32:39 +02001277 LIST_APPEND(&curpx->tcp_req.l4_rules, &rule->list);
Willy Tarreau39713102016-11-25 15:49:32 +01001278 }
1279 else if (strcmp(args[1], "session") == 0) {
1280 arg++;
1281
1282 if (!(curpx->cap & PR_CAP_FE)) {
1283 memprintf(err, "%s %s is not allowed because %s %s is not a frontend",
1284 args[0], args[1], proxy_type_str(curpx), curpx->id);
1285 goto error;
1286 }
1287
1288 where |= SMP_VAL_FE_SES_ACC;
Christopher Fauletcb9106b2019-12-19 15:23:17 +01001289 rule->from = ACT_F_TCP_REQ_SES;
Willy Tarreau39713102016-11-25 15:49:32 +01001290 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, where, file, line) < 0)
1291 goto error;
1292
1293 acl = rule->cond ? acl_cond_conflicts(rule->cond, where) : NULL;
1294 if (acl) {
1295 if (acl->name && *acl->name)
1296 memprintf(err,
1297 "acl '%s' will never match in '%s %s' because it only involves keywords that are incompatible with '%s'",
1298 acl->name, args[0], args[1], sample_ckp_names(where));
1299 else
1300 memprintf(err,
1301 "anonymous acl will never match in '%s %s' because it uses keyword '%s' which is incompatible with '%s'",
1302 args[0], args[1],
1303 LIST_ELEM(acl->expr.n, struct acl_expr *, list)->kw,
1304 sample_ckp_names(where));
1305 warn++;
1306 }
1307 else if (rule->cond && acl_cond_kw_conflicts(rule->cond, where, &acl, &kw)) {
1308 if (acl->name && *acl->name)
1309 memprintf(err,
1310 "acl '%s' involves keyword '%s' which is incompatible with '%s'",
1311 acl->name, kw, sample_ckp_names(where));
1312 else
1313 memprintf(err,
1314 "anonymous acl involves keyword '%s' which is incompatible with '%s'",
1315 kw, sample_ckp_names(where));
1316 warn++;
1317 }
1318
1319 /* the following function directly emits the warning */
1320 warnif_misplaced_tcp_sess(curpx, file, line, args[0]);
Willy Tarreau2b718102021-04-21 07:32:39 +02001321 LIST_APPEND(&curpx->tcp_req.l5_rules, &rule->list);
Willy Tarreau39713102016-11-25 15:49:32 +01001322 }
1323 else {
1324 if (curpx == defpx)
1325 memprintf(err,
1326 "'%s' expects 'inspect-delay', 'connection', or 'content' in defaults section (got '%s')",
1327 args[0], args[1]);
1328 else
1329 memprintf(err,
1330 "'%s' expects 'inspect-delay', 'connection', or 'content' in %s '%s' (got '%s')",
1331 args[0], proxy_type_str(curpx), curpx->id, args[1]);
1332 goto error;
1333 }
1334
1335 return warn;
1336 error:
1337 free(rule);
1338 return -1;
1339}
1340
1341static struct cfg_kw_list cfg_kws = {ILH, {
1342 { CFG_LISTEN, "tcp-request", tcp_parse_tcp_req },
1343 { CFG_LISTEN, "tcp-response", tcp_parse_tcp_rep },
1344 { 0, NULL, NULL },
1345}};
1346
Willy Tarreau0108d902018-11-25 19:14:37 +01001347INITCALL1(STG_REGISTER, cfg_register_keywords, &cfg_kws);
Willy Tarreau39713102016-11-25 15:49:32 +01001348
1349/*
1350 * Local variables:
1351 * c-indent-level: 8
1352 * c-basic-offset: 8
1353 * End:
1354 */