blob: 7c3258cc3195b1e9777f9f97c979a82ae409c227 [file] [log] [blame]
Willy Tarreaue6b98942007-10-29 01:09:36 +01001/*
2 * AF_INET/AF_INET6 SOCK_STREAM protocol layer (tcp)
3 *
Willy Tarreau1a687942010-05-23 22:40:30 +02004 * Copyright 2000-2010 Willy Tarreau <w@1wt.eu>
Willy Tarreaue6b98942007-10-29 01:09:36 +01005 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
13#include <ctype.h>
14#include <errno.h>
15#include <fcntl.h>
16#include <stdio.h>
17#include <stdlib.h>
18#include <string.h>
19#include <time.h>
20
21#include <sys/param.h>
22#include <sys/socket.h>
23#include <sys/stat.h>
24#include <sys/types.h>
25#include <sys/un.h>
26
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +040027#include <netinet/tcp.h>
28
Willy Tarreaub6866442008-07-14 23:54:42 +020029#include <common/cfgparse.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010030#include <common/compat.h>
31#include <common/config.h>
32#include <common/debug.h>
33#include <common/errors.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010034#include <common/mini-clist.h>
35#include <common/standard.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010036
Willy Tarreaue6b98942007-10-29 01:09:36 +010037#include <types/global.h>
Willy Tarreau9650f372009-08-16 14:02:45 +020038#include <types/server.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010039
40#include <proto/acl.h>
Willy Tarreau9fcb9842012-04-20 14:45:49 +020041#include <proto/arg.h>
Willy Tarreauc7e42382012-08-24 19:22:53 +020042#include <proto/channel.h>
Willy Tarreaud2274c62012-07-06 14:29:45 +020043#include <proto/connection.h>
Willy Tarreaudd2f85e2012-09-02 22:34:23 +020044#include <proto/fd.h>
Willy Tarreaud1d54542012-09-12 22:58:11 +020045#include <proto/listener.h>
Willy Tarreau9650f372009-08-16 14:02:45 +020046#include <proto/log.h>
47#include <proto/port_range.h>
Willy Tarreaud1d54542012-09-12 22:58:11 +020048#include <proto/protocol.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010049#include <proto/proto_tcp.h>
Willy Tarreaub6866442008-07-14 23:54:42 +020050#include <proto/proxy.h>
Willy Tarreaucd3b0942012-04-27 21:52:18 +020051#include <proto/sample.h>
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +020052#include <proto/session.h>
Willy Tarreaua975b8f2010-06-05 19:13:27 +020053#include <proto/stick_table.h>
Willy Tarreaua975b8f2010-06-05 19:13:27 +020054#include <proto/task.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010055
Willy Tarreaue8c66af2008-01-13 18:40:14 +010056#ifdef CONFIG_HAP_CTTPROXY
57#include <import/ip_tproxy.h>
58#endif
59
Emeric Bruncf20bf12010-10-22 16:06:11 +020060static int tcp_bind_listeners(struct protocol *proto, char *errmsg, int errlen);
61static int tcp_bind_listener(struct listener *listener, char *errmsg, int errlen);
Willy Tarreaue6b98942007-10-29 01:09:36 +010062
63/* Note: must not be declared <const> as its list will be overwritten */
64static struct protocol proto_tcpv4 = {
65 .name = "tcpv4",
66 .sock_domain = AF_INET,
67 .sock_type = SOCK_STREAM,
68 .sock_prot = IPPROTO_TCP,
69 .sock_family = AF_INET,
70 .sock_addrlen = sizeof(struct sockaddr_in),
71 .l3_addrlen = 32/8,
Willy Tarreaubbebbbf2012-05-07 21:22:09 +020072 .accept = &listener_accept,
Willy Tarreau26d8c592012-05-07 18:12:14 +020073 .connect = tcp_connect_server,
Emeric Bruncf20bf12010-10-22 16:06:11 +020074 .bind = tcp_bind_listener,
Willy Tarreaue6b98942007-10-29 01:09:36 +010075 .bind_all = tcp_bind_listeners,
76 .unbind_all = unbind_all_listeners,
77 .enable_all = enable_all_listeners,
Willy Tarreau59b94792012-05-11 16:16:40 +020078 .get_src = tcp_get_src,
79 .get_dst = tcp_get_dst,
Willy Tarreaue6b98942007-10-29 01:09:36 +010080 .listeners = LIST_HEAD_INIT(proto_tcpv4.listeners),
81 .nb_listeners = 0,
82};
83
84/* Note: must not be declared <const> as its list will be overwritten */
85static struct protocol proto_tcpv6 = {
86 .name = "tcpv6",
87 .sock_domain = AF_INET6,
88 .sock_type = SOCK_STREAM,
89 .sock_prot = IPPROTO_TCP,
90 .sock_family = AF_INET6,
91 .sock_addrlen = sizeof(struct sockaddr_in6),
92 .l3_addrlen = 128/8,
Willy Tarreaubbebbbf2012-05-07 21:22:09 +020093 .accept = &listener_accept,
Willy Tarreau26d8c592012-05-07 18:12:14 +020094 .connect = tcp_connect_server,
Emeric Bruncf20bf12010-10-22 16:06:11 +020095 .bind = tcp_bind_listener,
Willy Tarreaue6b98942007-10-29 01:09:36 +010096 .bind_all = tcp_bind_listeners,
97 .unbind_all = unbind_all_listeners,
98 .enable_all = enable_all_listeners,
Willy Tarreau59b94792012-05-11 16:16:40 +020099 .get_src = tcp_get_src,
100 .get_dst = tcp_get_dst,
Willy Tarreaue6b98942007-10-29 01:09:36 +0100101 .listeners = LIST_HEAD_INIT(proto_tcpv6.listeners),
102 .nb_listeners = 0,
103};
104
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100105
David du Colombier6f5ccb12011-03-10 22:26:24 +0100106/* Binds ipv4/ipv6 address <local> to socket <fd>, unless <flags> is set, in which
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100107 * case we try to bind <remote>. <flags> is a 2-bit field consisting of :
108 * - 0 : ignore remote address (may even be a NULL pointer)
109 * - 1 : use provided address
110 * - 2 : use provided port
111 * - 3 : use both
112 *
113 * The function supports multiple foreign binding methods :
114 * - linux_tproxy: we directly bind to the foreign address
115 * - cttproxy: we bind to a local address then nat.
116 * The second one can be used as a fallback for the first one.
117 * This function returns 0 when everything's OK, 1 if it could not bind, to the
118 * local address, 2 if it could not bind to the foreign address.
119 */
David du Colombier6f5ccb12011-03-10 22:26:24 +0100120int tcp_bind_socket(int fd, int flags, struct sockaddr_storage *local, struct sockaddr_storage *remote)
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100121{
David du Colombier6f5ccb12011-03-10 22:26:24 +0100122 struct sockaddr_storage bind_addr;
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100123 int foreign_ok = 0;
124 int ret;
125
126#ifdef CONFIG_HAP_LINUX_TPROXY
127 static int ip_transp_working = 1;
David du Colombier65c17962012-07-13 14:34:59 +0200128 static int ip6_transp_working = 1;
129 switch (local->ss_family) {
130 case AF_INET:
131 if (flags && ip_transp_working) {
132 if (setsockopt(fd, SOL_IP, IP_TRANSPARENT, &one, sizeof(one)) == 0
133 || setsockopt(fd, SOL_IP, IP_FREEBIND, &one, sizeof(one)) == 0)
134 foreign_ok = 1;
135 else
136 ip_transp_working = 0;
137 }
138 break;
139 case AF_INET6:
140 if (flags && ip6_transp_working) {
141 if (setsockopt(fd, SOL_IPV6, IPV6_TRANSPARENT, &one, sizeof(one)) == 0)
142 foreign_ok = 1;
143 else
144 ip6_transp_working = 0;
145 }
146 break;
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100147 }
148#endif
149 if (flags) {
150 memset(&bind_addr, 0, sizeof(bind_addr));
Willy Tarreau96dd0792011-04-19 07:20:57 +0200151 bind_addr.ss_family = remote->ss_family;
David du Colombier6f5ccb12011-03-10 22:26:24 +0100152 switch (remote->ss_family) {
153 case AF_INET:
154 if (flags & 1)
155 ((struct sockaddr_in *)&bind_addr)->sin_addr = ((struct sockaddr_in *)remote)->sin_addr;
156 if (flags & 2)
157 ((struct sockaddr_in *)&bind_addr)->sin_port = ((struct sockaddr_in *)remote)->sin_port;
158 break;
159 case AF_INET6:
160 if (flags & 1)
161 ((struct sockaddr_in6 *)&bind_addr)->sin6_addr = ((struct sockaddr_in6 *)remote)->sin6_addr;
162 if (flags & 2)
163 ((struct sockaddr_in6 *)&bind_addr)->sin6_port = ((struct sockaddr_in6 *)remote)->sin6_port;
164 break;
Willy Tarreau5dc1e982011-12-16 21:25:11 +0100165 default:
166 /* we don't want to try to bind to an unknown address family */
167 foreign_ok = 0;
David du Colombier6f5ccb12011-03-10 22:26:24 +0100168 }
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100169 }
170
Simon Hormande072bd2011-06-24 15:11:37 +0900171 setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one));
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100172 if (foreign_ok) {
Willy Tarreau1b4b7ce2011-04-05 16:56:50 +0200173 ret = bind(fd, (struct sockaddr *)&bind_addr, get_addr_len(&bind_addr));
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100174 if (ret < 0)
175 return 2;
176 }
177 else {
Willy Tarreau1b4b7ce2011-04-05 16:56:50 +0200178 ret = bind(fd, (struct sockaddr *)local, get_addr_len(local));
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100179 if (ret < 0)
180 return 1;
181 }
182
183 if (!flags)
184 return 0;
185
186#ifdef CONFIG_HAP_CTTPROXY
Willy Tarreau6f831b42011-03-20 14:03:54 +0100187 if (!foreign_ok && remote->ss_family == AF_INET) {
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100188 struct in_tproxy itp1, itp2;
189 memset(&itp1, 0, sizeof(itp1));
190
191 itp1.op = TPROXY_ASSIGN;
Willy Tarreau6f831b42011-03-20 14:03:54 +0100192 itp1.v.addr.faddr = ((struct sockaddr_in *)&bind_addr)->sin_addr;
193 itp1.v.addr.fport = ((struct sockaddr_in *)&bind_addr)->sin_port;
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100194
195 /* set connect flag on socket */
196 itp2.op = TPROXY_FLAGS;
197 itp2.v.flags = ITP_CONNECT | ITP_ONCE;
198
199 if (setsockopt(fd, SOL_IP, IP_TPROXY, &itp1, sizeof(itp1)) != -1 &&
200 setsockopt(fd, SOL_IP, IP_TPROXY, &itp2, sizeof(itp2)) != -1) {
201 foreign_ok = 1;
202 }
203 }
204#endif
205 if (!foreign_ok)
206 /* we could not bind to a foreign address */
207 return 2;
208
209 return 0;
210}
Willy Tarreaue6b98942007-10-29 01:09:36 +0100211
Willy Tarreau9650f372009-08-16 14:02:45 +0200212
213/*
Willy Tarreau14f8e862012-08-30 22:23:13 +0200214 * This function initiates a TCP connection establishment to the target assigned
215 * to connection <conn> using (si->{target,addr.to}). A source address may be
216 * pointed to by conn->addr.from in case of transparent proxying. Normal source
217 * bind addresses are still determined locally (due to the possible need of a
218 * source port). conn->target may point either to a valid server or to a backend,
219 * depending on conn->target.type. Only TARG_TYPE_PROXY and TARG_TYPE_SERVER are
220 * supported. The <data> parameter is a boolean indicating whether there are data
221 * waiting for being sent or not, in order to adjust data write polling and on
222 * some platforms, the ability to avoid an empty initial ACK.
Willy Tarreaub1d67742010-03-29 19:36:59 +0200223 *
Willy Tarreau9650f372009-08-16 14:02:45 +0200224 * It can return one of :
225 * - SN_ERR_NONE if everything's OK
226 * - SN_ERR_SRVTO if there are no more servers
227 * - SN_ERR_SRVCL if the connection was refused by the server
228 * - SN_ERR_PRXCOND if the connection has been limited by the proxy (maxconn)
229 * - SN_ERR_RESOURCE if a system resource is lacking (eg: fd limits, ports, ...)
230 * - SN_ERR_INTERNAL for any other purely internal errors
231 * Additionnally, in the case of SN_ERR_RESOURCE, an emergency log will be emitted.
232 */
Willy Tarreauf1536862011-03-03 18:27:32 +0100233
Willy Tarreau14f8e862012-08-30 22:23:13 +0200234int tcp_connect_server(struct connection *conn, int data)
Willy Tarreau9650f372009-08-16 14:02:45 +0200235{
236 int fd;
Willy Tarreauac825402011-03-04 22:04:29 +0100237 struct server *srv;
238 struct proxy *be;
239
Willy Tarreau986a9d22012-08-30 21:11:38 +0200240 switch (conn->target.type) {
Willy Tarreauac825402011-03-04 22:04:29 +0100241 case TARG_TYPE_PROXY:
Willy Tarreau986a9d22012-08-30 21:11:38 +0200242 be = conn->target.ptr.p;
Willy Tarreauac825402011-03-04 22:04:29 +0100243 srv = NULL;
244 break;
245 case TARG_TYPE_SERVER:
Willy Tarreau986a9d22012-08-30 21:11:38 +0200246 srv = conn->target.ptr.s;
Willy Tarreauac825402011-03-04 22:04:29 +0100247 be = srv->proxy;
248 break;
249 default:
250 return SN_ERR_INTERNAL;
251 }
Willy Tarreau9650f372009-08-16 14:02:45 +0200252
Willy Tarreau986a9d22012-08-30 21:11:38 +0200253 if ((fd = conn->t.sock.fd = socket(conn->addr.to.ss_family, SOCK_STREAM, IPPROTO_TCP)) == -1) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200254 qfprintf(stderr, "Cannot get a server socket.\n");
255
256 if (errno == ENFILE)
257 send_log(be, LOG_EMERG,
258 "Proxy %s reached system FD limit at %d. Please check system tunables.\n",
259 be->id, maxfd);
260 else if (errno == EMFILE)
261 send_log(be, LOG_EMERG,
262 "Proxy %s reached process FD limit at %d. Please check 'ulimit-n' and restart.\n",
263 be->id, maxfd);
264 else if (errno == ENOBUFS || errno == ENOMEM)
265 send_log(be, LOG_EMERG,
266 "Proxy %s reached system memory limit at %d sockets. Please check system tunables.\n",
267 be->id, maxfd);
268 /* this is a resource error */
269 return SN_ERR_RESOURCE;
270 }
271
272 if (fd >= global.maxsock) {
273 /* do not log anything there, it's a normal condition when this option
274 * is used to serialize connections to a server !
275 */
276 Alert("socket(): not enough free sockets. Raise -n argument. Giving up.\n");
277 close(fd);
278 return SN_ERR_PRXCOND; /* it is a configuration limit */
279 }
280
281 if ((fcntl(fd, F_SETFL, O_NONBLOCK)==-1) ||
Simon Hormande072bd2011-06-24 15:11:37 +0900282 (setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &one, sizeof(one)) == -1)) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200283 qfprintf(stderr,"Cannot set client socket to non blocking mode.\n");
284 close(fd);
285 return SN_ERR_INTERNAL;
286 }
287
288 if (be->options & PR_O_TCP_SRV_KA)
Simon Hormande072bd2011-06-24 15:11:37 +0900289 setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, &one, sizeof(one));
Willy Tarreau9650f372009-08-16 14:02:45 +0200290
Willy Tarreau9650f372009-08-16 14:02:45 +0200291 /* allow specific binding :
292 * - server-specific at first
293 * - proxy-specific next
294 */
295 if (srv != NULL && srv->state & SRV_BIND_SRC) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200296 int ret, flags = 0;
297
Willy Tarreau9650f372009-08-16 14:02:45 +0200298 switch (srv->state & SRV_TPROXY_MASK) {
299 case SRV_TPROXY_ADDR:
Willy Tarreau9650f372009-08-16 14:02:45 +0200300 case SRV_TPROXY_CLI:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200301 flags = 3;
302 break;
Willy Tarreau9650f372009-08-16 14:02:45 +0200303 case SRV_TPROXY_CIP:
Willy Tarreau090466c2009-09-07 11:51:47 +0200304 case SRV_TPROXY_DYN:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200305 flags = 1;
Willy Tarreau9650f372009-08-16 14:02:45 +0200306 break;
307 }
Willy Tarreaub1d67742010-03-29 19:36:59 +0200308
Willy Tarreau9650f372009-08-16 14:02:45 +0200309#ifdef SO_BINDTODEVICE
310 /* Note: this might fail if not CAP_NET_RAW */
311 if (srv->iface_name)
312 setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, srv->iface_name, srv->iface_len + 1);
313#endif
314
315 if (srv->sport_range) {
316 int attempts = 10; /* should be more than enough to find a spare port */
David du Colombier6f5ccb12011-03-10 22:26:24 +0100317 struct sockaddr_storage src;
Willy Tarreau9650f372009-08-16 14:02:45 +0200318
319 ret = 1;
320 src = srv->source_addr;
321
322 do {
323 /* note: in case of retry, we may have to release a previously
324 * allocated port, hence this loop's construct.
325 */
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200326 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
327 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200328
329 if (!attempts)
330 break;
331 attempts--;
332
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200333 fdinfo[fd].local_port = port_range_alloc_port(srv->sport_range);
334 if (!fdinfo[fd].local_port)
Willy Tarreau9650f372009-08-16 14:02:45 +0200335 break;
336
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200337 fdinfo[fd].port_range = srv->sport_range;
Willy Tarreau86ad42c2011-08-27 12:29:07 +0200338 set_host_port(&src, fdinfo[fd].local_port);
Willy Tarreau9650f372009-08-16 14:02:45 +0200339
Willy Tarreau986a9d22012-08-30 21:11:38 +0200340 ret = tcp_bind_socket(fd, flags, &src, &conn->addr.from);
Willy Tarreau9650f372009-08-16 14:02:45 +0200341 } while (ret != 0); /* binding NOK */
342 }
343 else {
Willy Tarreau986a9d22012-08-30 21:11:38 +0200344 ret = tcp_bind_socket(fd, flags, &srv->source_addr, &conn->addr.from);
Willy Tarreau9650f372009-08-16 14:02:45 +0200345 }
346
347 if (ret) {
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200348 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
349 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200350 close(fd);
351
352 if (ret == 1) {
353 Alert("Cannot bind to source address before connect() for server %s/%s. Aborting.\n",
354 be->id, srv->id);
355 send_log(be, LOG_EMERG,
356 "Cannot bind to source address before connect() for server %s/%s.\n",
357 be->id, srv->id);
358 } else {
359 Alert("Cannot bind to tproxy source address before connect() for server %s/%s. Aborting.\n",
360 be->id, srv->id);
361 send_log(be, LOG_EMERG,
362 "Cannot bind to tproxy source address before connect() for server %s/%s.\n",
363 be->id, srv->id);
364 }
365 return SN_ERR_RESOURCE;
366 }
367 }
368 else if (be->options & PR_O_BIND_SRC) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200369 int ret, flags = 0;
370
Willy Tarreau9650f372009-08-16 14:02:45 +0200371 switch (be->options & PR_O_TPXY_MASK) {
372 case PR_O_TPXY_ADDR:
Willy Tarreau9650f372009-08-16 14:02:45 +0200373 case PR_O_TPXY_CLI:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200374 flags = 3;
375 break;
Willy Tarreau9650f372009-08-16 14:02:45 +0200376 case PR_O_TPXY_CIP:
Willy Tarreau090466c2009-09-07 11:51:47 +0200377 case PR_O_TPXY_DYN:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200378 flags = 1;
Willy Tarreau9650f372009-08-16 14:02:45 +0200379 break;
380 }
Willy Tarreaub1d67742010-03-29 19:36:59 +0200381
Willy Tarreau9650f372009-08-16 14:02:45 +0200382#ifdef SO_BINDTODEVICE
383 /* Note: this might fail if not CAP_NET_RAW */
384 if (be->iface_name)
385 setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, be->iface_name, be->iface_len + 1);
386#endif
Willy Tarreau986a9d22012-08-30 21:11:38 +0200387 ret = tcp_bind_socket(fd, flags, &be->source_addr, &conn->addr.from);
Willy Tarreau9650f372009-08-16 14:02:45 +0200388 if (ret) {
389 close(fd);
390 if (ret == 1) {
391 Alert("Cannot bind to source address before connect() for proxy %s. Aborting.\n",
392 be->id);
393 send_log(be, LOG_EMERG,
394 "Cannot bind to source address before connect() for proxy %s.\n",
395 be->id);
396 } else {
397 Alert("Cannot bind to tproxy source address before connect() for proxy %s. Aborting.\n",
398 be->id);
399 send_log(be, LOG_EMERG,
400 "Cannot bind to tproxy source address before connect() for proxy %s.\n",
401 be->id);
402 }
403 return SN_ERR_RESOURCE;
404 }
405 }
406
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400407#if defined(TCP_QUICKACK)
Willy Tarreau9650f372009-08-16 14:02:45 +0200408 /* disabling tcp quick ack now allows the first request to leave the
409 * machine with the first ACK. We only do this if there are pending
410 * data in the buffer.
411 */
Willy Tarreau14f8e862012-08-30 22:23:13 +0200412 if ((be->options2 & PR_O2_SMARTCON) && data)
Simon Hormande072bd2011-06-24 15:11:37 +0900413 setsockopt(fd, IPPROTO_TCP, TCP_QUICKACK, &zero, sizeof(zero));
Willy Tarreau9650f372009-08-16 14:02:45 +0200414#endif
415
Willy Tarreaue803de22010-01-21 17:43:04 +0100416 if (global.tune.server_sndbuf)
417 setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &global.tune.server_sndbuf, sizeof(global.tune.server_sndbuf));
418
419 if (global.tune.server_rcvbuf)
420 setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &global.tune.server_rcvbuf, sizeof(global.tune.server_rcvbuf));
421
Willy Tarreau986a9d22012-08-30 21:11:38 +0200422 if ((connect(fd, (struct sockaddr *)&conn->addr.to, get_addr_len(&conn->addr.to)) == -1) &&
Willy Tarreau9650f372009-08-16 14:02:45 +0200423 (errno != EINPROGRESS) && (errno != EALREADY) && (errno != EISCONN)) {
424
425 if (errno == EAGAIN || errno == EADDRINUSE) {
426 char *msg;
427 if (errno == EAGAIN) /* no free ports left, try again later */
428 msg = "no free ports";
429 else
430 msg = "local address already in use";
431
432 qfprintf(stderr,"Cannot connect: %s.\n",msg);
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200433 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
434 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200435 close(fd);
436 send_log(be, LOG_EMERG,
437 "Connect() failed for server %s/%s: %s.\n",
438 be->id, srv->id, msg);
439 return SN_ERR_RESOURCE;
440 } else if (errno == ETIMEDOUT) {
441 //qfprintf(stderr,"Connect(): ETIMEDOUT");
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200442 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
443 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200444 close(fd);
445 return SN_ERR_SRVTO;
446 } else {
447 // (errno == ECONNREFUSED || errno == ENETUNREACH || errno == EACCES || errno == EPERM)
448 //qfprintf(stderr,"Connect(): %d", errno);
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200449 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
450 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200451 close(fd);
452 return SN_ERR_SRVCL;
453 }
454 }
455
Willy Tarreau986a9d22012-08-30 21:11:38 +0200456 fdtab[fd].owner = conn;
Willy Tarreau986a9d22012-08-30 21:11:38 +0200457 conn->flags = CO_FL_WAIT_L4_CONN; /* connection in progress */
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200458
Willy Tarreaud2274c62012-07-06 14:29:45 +0200459 fdtab[fd].iocb = conn_fd_handler;
Willy Tarreau9650f372009-08-16 14:02:45 +0200460 fd_insert(fd);
Willy Tarreau986a9d22012-08-30 21:11:38 +0200461 conn_sock_want_send(conn); /* for connect status */
Willy Tarreau15678ef2012-08-31 13:54:11 +0200462
Willy Tarreau184636e2012-09-06 14:04:41 +0200463 if (conn_data_init(conn) < 0) {
464 fd_delete(fd);
Willy Tarreau15678ef2012-08-31 13:54:11 +0200465 return SN_ERR_RESOURCE;
Willy Tarreau184636e2012-09-06 14:04:41 +0200466 }
Willy Tarreau15678ef2012-08-31 13:54:11 +0200467
Willy Tarreau14f8e862012-08-30 22:23:13 +0200468 if (data)
Willy Tarreau986a9d22012-08-30 21:11:38 +0200469 conn_data_want_send(conn); /* prepare to send data if any */
Willy Tarreau9650f372009-08-16 14:02:45 +0200470
Willy Tarreau9650f372009-08-16 14:02:45 +0200471 return SN_ERR_NONE; /* connection is OK */
472}
473
474
Willy Tarreau59b94792012-05-11 16:16:40 +0200475/*
476 * Retrieves the source address for the socket <fd>, with <dir> indicating
477 * if we're a listener (=0) or an initiator (!=0). It returns 0 in case of
478 * success, -1 in case of error. The socket's source address is stored in
479 * <sa> for <salen> bytes.
480 */
481int tcp_get_src(int fd, struct sockaddr *sa, socklen_t salen, int dir)
482{
483 if (dir)
484 return getsockname(fd, sa, &salen);
485 else
486 return getpeername(fd, sa, &salen);
487}
488
489
490/*
491 * Retrieves the original destination address for the socket <fd>, with <dir>
492 * indicating if we're a listener (=0) or an initiator (!=0). In the case of a
493 * listener, if the original destination address was translated, the original
494 * address is retrieved. It returns 0 in case of success, -1 in case of error.
495 * The socket's source address is stored in <sa> for <salen> bytes.
496 */
497int tcp_get_dst(int fd, struct sockaddr *sa, socklen_t salen, int dir)
498{
499 if (dir)
500 return getpeername(fd, sa, &salen);
501#if defined(TPROXY) && defined(SO_ORIGINAL_DST)
502 else if (getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) == 0)
503 return 0;
504#endif
505 else
506 return getsockname(fd, sa, &salen);
507}
508
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200509/* This is the callback which is set when a connection establishment is pending
510 * and we have nothing to send, or if we have an init function we want to call
Willy Tarreauafad0e02012-08-09 14:45:22 +0200511 * once the connection is established. It updates the FD polling status. It
512 * returns 0 if it fails in a fatal way or needs to poll to go further, otherwise
513 * it returns non-zero and removes itself from the connection's flags (the bit is
514 * provided in <flag> by the caller).
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200515 */
Willy Tarreau239d7182012-07-23 18:53:03 +0200516int tcp_connect_probe(struct connection *conn)
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200517{
Willy Tarreau239d7182012-07-23 18:53:03 +0200518 int fd = conn->t.sock.fd;
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200519
Willy Tarreau80184712012-07-06 14:54:49 +0200520 if (conn->flags & CO_FL_ERROR)
Willy Tarreauafad0e02012-08-09 14:45:22 +0200521 return 0;
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200522
Willy Tarreau80184712012-07-06 14:54:49 +0200523 if (!(conn->flags & CO_FL_WAIT_L4_CONN))
Willy Tarreau0b0c0972012-07-23 20:05:00 +0200524 return 1; /* strange we were called while ready */
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200525
Willy Tarreau2da156f2012-07-23 15:07:23 +0200526 /* stop here if we reached the end of data */
527 if ((fdtab[fd].ev & (FD_POLL_IN|FD_POLL_HUP)) == FD_POLL_HUP)
528 goto out_error;
529
Willy Tarreau2c6be842012-07-06 17:12:34 +0200530 /* We have no data to send to check the connection, and
531 * getsockopt() will not inform us whether the connection
532 * is still pending. So we'll reuse connect() to check the
533 * state of the socket. This has the advantage of giving us
534 * the following info :
535 * - error
536 * - connecting (EALREADY, EINPROGRESS)
537 * - connected (EISCONN, 0)
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200538 */
Willy Tarreau986a9d22012-08-30 21:11:38 +0200539 if (connect(fd, (struct sockaddr *)&conn->addr.to, get_addr_len(&conn->addr.to)) < 0) {
Willy Tarreauf9dabec2012-08-17 17:33:53 +0200540 if (errno == EALREADY || errno == EINPROGRESS) {
541 conn_sock_stop_recv(conn);
542 conn_sock_poll_send(conn);
Willy Tarreau0b0c0972012-07-23 20:05:00 +0200543 return 0;
Willy Tarreauf9dabec2012-08-17 17:33:53 +0200544 }
Willy Tarreaua190d592012-05-20 18:35:19 +0200545
Willy Tarreau2c6be842012-07-06 17:12:34 +0200546 if (errno && errno != EISCONN)
Willy Tarreaua190d592012-05-20 18:35:19 +0200547 goto out_error;
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200548
Willy Tarreau2c6be842012-07-06 17:12:34 +0200549 /* otherwise we're connected */
Willy Tarreaua190d592012-05-20 18:35:19 +0200550 }
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200551
Willy Tarreau076be252012-07-06 16:02:29 +0200552 /* The FD is ready now, we'll mark the connection as complete and
553 * forward the event to the data layer which will update the stream
554 * interface flags.
Willy Tarreaua190d592012-05-20 18:35:19 +0200555 */
Willy Tarreau80184712012-07-06 14:54:49 +0200556 conn->flags &= ~CO_FL_WAIT_L4_CONN;
Willy Tarreau0b0c0972012-07-23 20:05:00 +0200557 return 1;
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200558
559 out_error:
Willy Tarreau0b0c0972012-07-23 20:05:00 +0200560 /* Write error on the file descriptor. Report it to the connection
561 * and disable polling on this FD.
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200562 */
563
Willy Tarreau80184712012-07-06 14:54:49 +0200564 conn->flags |= CO_FL_ERROR;
Willy Tarreauf9dabec2012-08-17 17:33:53 +0200565 conn_sock_stop_both(conn);
Willy Tarreauafad0e02012-08-09 14:45:22 +0200566 return 0;
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200567}
568
Willy Tarreau59b94792012-05-11 16:16:40 +0200569
Willy Tarreaue6b98942007-10-29 01:09:36 +0100570/* This function tries to bind a TCPv4/v6 listener. It may return a warning or
571 * an error message in <err> if the message is at most <errlen> bytes long
572 * (including '\0'). The return value is composed from ERR_ABORT, ERR_WARN,
573 * ERR_ALERT, ERR_RETRYABLE and ERR_FATAL. ERR_NONE indicates that everything
574 * was alright and that no message was returned. ERR_RETRYABLE means that an
575 * error occurred but that it may vanish after a retry (eg: port in use), and
Aman Guptad94991d2012-04-06 17:39:26 -0700576 * ERR_FATAL indicates a non-fixable error. ERR_WARN and ERR_ALERT do not alter
Willy Tarreaue6b98942007-10-29 01:09:36 +0100577 * the meaning of the error, but just indicate that a message is present which
578 * should be displayed with the respective level. Last, ERR_ABORT indicates
579 * that it's pointless to try to start other listeners. No error message is
580 * returned if errlen is NULL.
581 */
582int tcp_bind_listener(struct listener *listener, char *errmsg, int errlen)
583{
584 __label__ tcp_return, tcp_close_return;
585 int fd, err;
586 const char *msg = NULL;
587
588 /* ensure we never return garbage */
589 if (errmsg && errlen)
590 *errmsg = 0;
591
592 if (listener->state != LI_ASSIGNED)
593 return ERR_NONE; /* already bound */
594
595 err = ERR_NONE;
596
597 if ((fd = socket(listener->addr.ss_family, SOCK_STREAM, IPPROTO_TCP)) == -1) {
598 err |= ERR_RETRYABLE | ERR_ALERT;
599 msg = "cannot create listening socket";
600 goto tcp_return;
601 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100602
Willy Tarreaue6b98942007-10-29 01:09:36 +0100603 if (fd >= global.maxsock) {
604 err |= ERR_FATAL | ERR_ABORT | ERR_ALERT;
605 msg = "not enough free sockets (raise '-n' parameter)";
606 goto tcp_close_return;
607 }
608
Willy Tarreaufb14edc2009-06-14 15:24:37 +0200609 if (fcntl(fd, F_SETFL, O_NONBLOCK) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100610 err |= ERR_FATAL | ERR_ALERT;
611 msg = "cannot make socket non-blocking";
612 goto tcp_close_return;
613 }
614
Simon Hormande072bd2011-06-24 15:11:37 +0900615 if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100616 /* not fatal but should be reported */
617 msg = "cannot do so_reuseaddr";
618 err |= ERR_ALERT;
619 }
620
621 if (listener->options & LI_O_NOLINGER)
Simon Hormande072bd2011-06-24 15:11:37 +0900622 setsockopt(fd, SOL_SOCKET, SO_LINGER, &nolinger, sizeof(struct linger));
Willy Tarreauedcf6682008-11-30 23:15:34 +0100623
Willy Tarreaue6b98942007-10-29 01:09:36 +0100624#ifdef SO_REUSEPORT
625 /* OpenBSD supports this. As it's present in old libc versions of Linux,
626 * it might return an error that we will silently ignore.
627 */
Simon Hormande072bd2011-06-24 15:11:37 +0900628 setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &one, sizeof(one));
Willy Tarreaue6b98942007-10-29 01:09:36 +0100629#endif
Willy Tarreaub1e52e82008-01-13 14:49:51 +0100630#ifdef CONFIG_HAP_LINUX_TPROXY
David du Colombier65c17962012-07-13 14:34:59 +0200631 if (listener->options & LI_O_FOREIGN) {
632 switch (listener->addr.ss_family) {
633 case AF_INET:
634 if ((setsockopt(fd, SOL_IP, IP_TRANSPARENT, &one, sizeof(one)) == -1)
635 && (setsockopt(fd, SOL_IP, IP_FREEBIND, &one, sizeof(one)) == -1)) {
636 msg = "cannot make listening socket transparent";
637 err |= ERR_ALERT;
638 }
639 break;
640 case AF_INET6:
641 if (setsockopt(fd, SOL_IPV6, IPV6_TRANSPARENT, &one, sizeof(one)) == -1) {
642 msg = "cannot make listening socket transparent";
643 err |= ERR_ALERT;
644 }
645 break;
646 }
Willy Tarreaub1e52e82008-01-13 14:49:51 +0100647 }
648#endif
Willy Tarreau5e6e2042009-02-04 17:19:29 +0100649#ifdef SO_BINDTODEVICE
650 /* Note: this might fail if not CAP_NET_RAW */
651 if (listener->interface) {
652 if (setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE,
Willy Tarreau604e8302009-03-06 00:48:23 +0100653 listener->interface, strlen(listener->interface) + 1) == -1) {
Willy Tarreau5e6e2042009-02-04 17:19:29 +0100654 msg = "cannot bind listener to device";
655 err |= ERR_WARN;
656 }
657 }
658#endif
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400659#if defined(TCP_MAXSEG)
Willy Tarreau48a7e722010-12-24 15:26:39 +0100660 if (listener->maxseg > 0) {
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400661 if (setsockopt(fd, IPPROTO_TCP, TCP_MAXSEG,
Willy Tarreaube1b9182009-06-14 18:48:19 +0200662 &listener->maxseg, sizeof(listener->maxseg)) == -1) {
663 msg = "cannot set MSS";
664 err |= ERR_WARN;
665 }
666 }
667#endif
Willy Tarreaucb6cd432009-10-13 07:34:14 +0200668#if defined(TCP_DEFER_ACCEPT)
669 if (listener->options & LI_O_DEF_ACCEPT) {
670 /* defer accept by up to one second */
671 int accept_delay = 1;
672 if (setsockopt(fd, IPPROTO_TCP, TCP_DEFER_ACCEPT, &accept_delay, sizeof(accept_delay)) == -1) {
673 msg = "cannot enable DEFER_ACCEPT";
674 err |= ERR_WARN;
675 }
676 }
677#endif
Willy Tarreaue6b98942007-10-29 01:09:36 +0100678 if (bind(fd, (struct sockaddr *)&listener->addr, listener->proto->sock_addrlen) == -1) {
679 err |= ERR_RETRYABLE | ERR_ALERT;
680 msg = "cannot bind socket";
681 goto tcp_close_return;
682 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100683
Willy Tarreauc73ce2b2008-01-06 10:55:10 +0100684 if (listen(fd, listener->backlog ? listener->backlog : listener->maxconn) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100685 err |= ERR_RETRYABLE | ERR_ALERT;
686 msg = "cannot listen to socket";
687 goto tcp_close_return;
688 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100689
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400690#if defined(TCP_QUICKACK)
Willy Tarreau9ea05a72009-06-14 12:07:01 +0200691 if (listener->options & LI_O_NOQUICKACK)
Simon Hormande072bd2011-06-24 15:11:37 +0900692 setsockopt(fd, IPPROTO_TCP, TCP_QUICKACK, &zero, sizeof(zero));
Willy Tarreau9ea05a72009-06-14 12:07:01 +0200693#endif
694
Willy Tarreaue6b98942007-10-29 01:09:36 +0100695 /* the socket is ready */
696 listener->fd = fd;
697 listener->state = LI_LISTEN;
698
Willy Tarreaueabf3132008-08-29 23:36:51 +0200699 fdtab[fd].owner = listener; /* reference the listener instead of a task */
Willy Tarreauaece46a2012-07-06 12:25:58 +0200700 fdtab[fd].iocb = listener->proto->accept;
Willy Tarreaueb472682010-05-28 18:46:57 +0200701 fd_insert(fd);
702
Willy Tarreaue6b98942007-10-29 01:09:36 +0100703 tcp_return:
Cyril Bonté43ba1b32010-11-01 19:26:01 +0100704 if (msg && errlen) {
705 char pn[INET6_ADDRSTRLEN];
706
Willy Tarreau631f01c2011-09-05 00:36:48 +0200707 addr_to_str(&listener->addr, pn, sizeof(pn));
708 snprintf(errmsg, errlen, "%s [%s:%d]", msg, pn, get_host_port(&listener->addr));
Cyril Bonté43ba1b32010-11-01 19:26:01 +0100709 }
Willy Tarreaue6b98942007-10-29 01:09:36 +0100710 return err;
711
712 tcp_close_return:
713 close(fd);
714 goto tcp_return;
715}
716
717/* This function creates all TCP sockets bound to the protocol entry <proto>.
718 * It is intended to be used as the protocol's bind_all() function.
719 * The sockets will be registered but not added to any fd_set, in order not to
720 * loose them across the fork(). A call to enable_all_listeners() is needed
721 * to complete initialization. The return value is composed from ERR_*.
722 */
Emeric Bruncf20bf12010-10-22 16:06:11 +0200723static int tcp_bind_listeners(struct protocol *proto, char *errmsg, int errlen)
Willy Tarreaue6b98942007-10-29 01:09:36 +0100724{
725 struct listener *listener;
726 int err = ERR_NONE;
727
728 list_for_each_entry(listener, &proto->listeners, proto_list) {
Emeric Bruncf20bf12010-10-22 16:06:11 +0200729 err |= tcp_bind_listener(listener, errmsg, errlen);
730 if (err & ERR_ABORT)
Willy Tarreaue6b98942007-10-29 01:09:36 +0100731 break;
732 }
733
734 return err;
735}
736
737/* Add listener to the list of tcpv4 listeners. The listener's state
738 * is automatically updated from LI_INIT to LI_ASSIGNED. The number of
739 * listeners is updated. This is the function to use to add a new listener.
740 */
741void tcpv4_add_listener(struct listener *listener)
742{
743 if (listener->state != LI_INIT)
744 return;
745 listener->state = LI_ASSIGNED;
746 listener->proto = &proto_tcpv4;
747 LIST_ADDQ(&proto_tcpv4.listeners, &listener->proto_list);
748 proto_tcpv4.nb_listeners++;
749}
750
751/* Add listener to the list of tcpv4 listeners. The listener's state
752 * is automatically updated from LI_INIT to LI_ASSIGNED. The number of
753 * listeners is updated. This is the function to use to add a new listener.
754 */
755void tcpv6_add_listener(struct listener *listener)
756{
757 if (listener->state != LI_INIT)
758 return;
759 listener->state = LI_ASSIGNED;
760 listener->proto = &proto_tcpv6;
761 LIST_ADDQ(&proto_tcpv6.listeners, &listener->proto_list);
762 proto_tcpv6.nb_listeners++;
763}
764
Willy Tarreauedcf6682008-11-30 23:15:34 +0100765/* This function performs the TCP request analysis on the current request. It
766 * returns 1 if the processing can continue on next analysers, or zero if it
767 * needs more data, encounters an error, or wants to immediately abort the
Willy Tarreaufb356202010-08-03 14:02:05 +0200768 * request. It relies on buffers flags, and updates s->req->analysers. The
769 * function may be called for frontend rules and backend rules. It only relies
770 * on the backend pointer so this works for both cases.
Willy Tarreauedcf6682008-11-30 23:15:34 +0100771 */
Willy Tarreau7421efb2012-07-02 15:11:27 +0200772int tcp_inspect_request(struct session *s, struct channel *req, int an_bit)
Willy Tarreauedcf6682008-11-30 23:15:34 +0100773{
774 struct tcp_rule *rule;
Willy Tarreaud1f96522010-08-03 19:34:32 +0200775 struct stksess *ts;
776 struct stktable *t;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100777 int partial;
778
Willy Tarreau02d6cfc2012-03-01 18:19:58 +0100779 DPRINTF(stderr,"[%u] %s: session=%p b=%p, exp(r,w)=%u,%u bf=%08x bh=%d analysers=%02x\n",
Willy Tarreauedcf6682008-11-30 23:15:34 +0100780 now_ms, __FUNCTION__,
781 s,
782 req,
783 req->rex, req->wex,
784 req->flags,
Cyril Bonté3aaba442012-09-23 14:19:12 +0200785 req->buf.i,
Willy Tarreauedcf6682008-11-30 23:15:34 +0100786 req->analysers);
787
Willy Tarreauedcf6682008-11-30 23:15:34 +0100788 /* We don't know whether we have enough data, so must proceed
789 * this way :
790 * - iterate through all rules in their declaration order
791 * - if one rule returns MISS, it means the inspect delay is
792 * not over yet, then return immediately, otherwise consider
793 * it as a non-match.
794 * - if one rule returns OK, then return OK
795 * - if one rule returns KO, then return KO
796 */
797
Willy Tarreau03cdb7c2012-08-27 23:14:58 +0200798 if ((req->flags & CF_SHUTR) || buffer_full(&req->buf, global.tune.maxrewrite) ||
Willy Tarreau3bf1b2b2012-08-27 20:46:07 +0200799 !s->be->tcp_req.inspect_delay || tick_is_expired(req->analyse_exp, now_ms))
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200800 partial = SMP_OPT_FINAL;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100801 else
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200802 partial = 0;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100803
Willy Tarreaufb356202010-08-03 14:02:05 +0200804 list_for_each_entry(rule, &s->be->tcp_req.inspect_rules, list) {
Willy Tarreauedcf6682008-11-30 23:15:34 +0100805 int ret = ACL_PAT_PASS;
806
807 if (rule->cond) {
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200808 ret = acl_exec_cond(rule->cond, s->be, s, &s->txn, SMP_OPT_DIR_REQ | partial);
Willy Tarreauedcf6682008-11-30 23:15:34 +0100809 if (ret == ACL_PAT_MISS) {
Willy Tarreau8263d2b2012-08-28 00:06:31 +0200810 channel_dont_connect(req);
Willy Tarreauedcf6682008-11-30 23:15:34 +0100811 /* just set the request timeout once at the beginning of the request */
Willy Tarreaufb356202010-08-03 14:02:05 +0200812 if (!tick_isset(req->analyse_exp) && s->be->tcp_req.inspect_delay)
813 req->analyse_exp = tick_add_ifset(now_ms, s->be->tcp_req.inspect_delay);
Willy Tarreauedcf6682008-11-30 23:15:34 +0100814 return 0;
815 }
816
817 ret = acl_pass(ret);
818 if (rule->cond->pol == ACL_COND_UNLESS)
819 ret = !ret;
820 }
821
822 if (ret) {
823 /* we have a matching rule. */
824 if (rule->action == TCP_ACT_REJECT) {
Willy Tarreau8263d2b2012-08-28 00:06:31 +0200825 channel_abort(req);
826 channel_abort(s->rep);
Willy Tarreauedcf6682008-11-30 23:15:34 +0100827 req->analysers = 0;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +0200828
Willy Tarreau7d0aaf32011-03-10 23:25:56 +0100829 s->be->be_counters.denied_req++;
830 s->fe->fe_counters.denied_req++;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +0200831 if (s->listener->counters)
Willy Tarreau23968d82010-05-23 23:50:44 +0200832 s->listener->counters->denied_req++;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +0200833
Willy Tarreauedcf6682008-11-30 23:15:34 +0100834 if (!(s->flags & SN_ERR_MASK))
835 s->flags |= SN_ERR_PRXCOND;
836 if (!(s->flags & SN_FINST_MASK))
837 s->flags |= SN_FINST_R;
838 return 0;
839 }
Willy Tarreau56123282010-08-06 19:06:56 +0200840 else if (rule->action == TCP_ACT_TRK_SC1) {
841 if (!s->stkctr1_entry) {
842 /* only the first valid track-sc1 directive applies.
Willy Tarreaud1f96522010-08-03 19:34:32 +0200843 * Also, note that right now we can only track SRC so we
844 * don't check how to get the key, but later we may need
845 * to consider rule->act_prm->trk_ctr.type.
846 */
847 t = rule->act_prm.trk_ctr.table.t;
Willy Tarreau64ee4912012-08-30 22:59:48 +0200848 ts = stktable_get_entry(t, addr_to_stktable_key(&s->si[0].conn.addr.from));
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200849 if (ts) {
Willy Tarreau56123282010-08-06 19:06:56 +0200850 session_track_stkctr1(s, t, ts);
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200851 if (s->fe != s->be)
852 s->flags |= SN_BE_TRACK_SC1;
853 }
Willy Tarreaud1f96522010-08-03 19:34:32 +0200854 }
855 }
Willy Tarreau56123282010-08-06 19:06:56 +0200856 else if (rule->action == TCP_ACT_TRK_SC2) {
857 if (!s->stkctr2_entry) {
858 /* only the first valid track-sc2 directive applies.
Willy Tarreaud1f96522010-08-03 19:34:32 +0200859 * Also, note that right now we can only track SRC so we
860 * don't check how to get the key, but later we may need
861 * to consider rule->act_prm->trk_ctr.type.
862 */
863 t = rule->act_prm.trk_ctr.table.t;
Willy Tarreau64ee4912012-08-30 22:59:48 +0200864 ts = stktable_get_entry(t, addr_to_stktable_key(&s->si[0].conn.addr.from));
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200865 if (ts) {
Willy Tarreau56123282010-08-06 19:06:56 +0200866 session_track_stkctr2(s, t, ts);
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200867 if (s->fe != s->be)
868 s->flags |= SN_BE_TRACK_SC2;
869 }
Willy Tarreaud1f96522010-08-03 19:34:32 +0200870 }
871 }
872 else {
Willy Tarreauedcf6682008-11-30 23:15:34 +0100873 /* otherwise accept */
Willy Tarreaud1f96522010-08-03 19:34:32 +0200874 break;
875 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100876 }
877 }
878
879 /* if we get there, it means we have no rule which matches, or
880 * we have an explicit accept, so we apply the default accept.
881 */
Willy Tarreau3a816292009-07-07 10:55:49 +0200882 req->analysers &= ~an_bit;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100883 req->analyse_exp = TICK_ETERNITY;
884 return 1;
885}
886
Emeric Brun97679e72010-09-23 17:56:44 +0200887/* This function performs the TCP response analysis on the current response. It
888 * returns 1 if the processing can continue on next analysers, or zero if it
889 * needs more data, encounters an error, or wants to immediately abort the
890 * response. It relies on buffers flags, and updates s->rep->analysers. The
891 * function may be called for backend rules.
892 */
Willy Tarreau7421efb2012-07-02 15:11:27 +0200893int tcp_inspect_response(struct session *s, struct channel *rep, int an_bit)
Emeric Brun97679e72010-09-23 17:56:44 +0200894{
895 struct tcp_rule *rule;
896 int partial;
897
Willy Tarreau02d6cfc2012-03-01 18:19:58 +0100898 DPRINTF(stderr,"[%u] %s: session=%p b=%p, exp(r,w)=%u,%u bf=%08x bh=%d analysers=%02x\n",
Emeric Brun97679e72010-09-23 17:56:44 +0200899 now_ms, __FUNCTION__,
900 s,
901 rep,
902 rep->rex, rep->wex,
903 rep->flags,
Cyril Bonté3aaba442012-09-23 14:19:12 +0200904 rep->buf.i,
Emeric Brun97679e72010-09-23 17:56:44 +0200905 rep->analysers);
906
907 /* We don't know whether we have enough data, so must proceed
908 * this way :
909 * - iterate through all rules in their declaration order
910 * - if one rule returns MISS, it means the inspect delay is
911 * not over yet, then return immediately, otherwise consider
912 * it as a non-match.
913 * - if one rule returns OK, then return OK
914 * - if one rule returns KO, then return KO
915 */
916
Willy Tarreau03cdb7c2012-08-27 23:14:58 +0200917 if (rep->flags & CF_SHUTR || tick_is_expired(rep->analyse_exp, now_ms))
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200918 partial = SMP_OPT_FINAL;
Emeric Brun97679e72010-09-23 17:56:44 +0200919 else
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200920 partial = 0;
Emeric Brun97679e72010-09-23 17:56:44 +0200921
922 list_for_each_entry(rule, &s->be->tcp_rep.inspect_rules, list) {
923 int ret = ACL_PAT_PASS;
924
925 if (rule->cond) {
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200926 ret = acl_exec_cond(rule->cond, s->be, s, &s->txn, SMP_OPT_DIR_RES | partial);
Emeric Brun97679e72010-09-23 17:56:44 +0200927 if (ret == ACL_PAT_MISS) {
928 /* just set the analyser timeout once at the beginning of the response */
929 if (!tick_isset(rep->analyse_exp) && s->be->tcp_rep.inspect_delay)
930 rep->analyse_exp = tick_add_ifset(now_ms, s->be->tcp_rep.inspect_delay);
931 return 0;
932 }
933
934 ret = acl_pass(ret);
935 if (rule->cond->pol == ACL_COND_UNLESS)
936 ret = !ret;
937 }
938
939 if (ret) {
940 /* we have a matching rule. */
941 if (rule->action == TCP_ACT_REJECT) {
Willy Tarreau8263d2b2012-08-28 00:06:31 +0200942 channel_abort(rep);
943 channel_abort(s->req);
Emeric Brun97679e72010-09-23 17:56:44 +0200944 rep->analysers = 0;
945
Willy Tarreau7d0aaf32011-03-10 23:25:56 +0100946 s->be->be_counters.denied_resp++;
947 s->fe->fe_counters.denied_resp++;
Emeric Brun97679e72010-09-23 17:56:44 +0200948 if (s->listener->counters)
949 s->listener->counters->denied_resp++;
950
951 if (!(s->flags & SN_ERR_MASK))
952 s->flags |= SN_ERR_PRXCOND;
953 if (!(s->flags & SN_FINST_MASK))
954 s->flags |= SN_FINST_D;
955 return 0;
956 }
957 else {
958 /* otherwise accept */
959 break;
960 }
961 }
962 }
963
964 /* if we get there, it means we have no rule which matches, or
965 * we have an explicit accept, so we apply the default accept.
966 */
967 rep->analysers &= ~an_bit;
968 rep->analyse_exp = TICK_ETERNITY;
969 return 1;
970}
971
972
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200973/* This function performs the TCP layer4 analysis on the current request. It
974 * returns 0 if a reject rule matches, otherwise 1 if either an accept rule
975 * matches or if no more rule matches. It can only use rules which don't need
976 * any data.
977 */
978int tcp_exec_req_rules(struct session *s)
979{
980 struct tcp_rule *rule;
Willy Tarreauf059a0f2010-08-03 16:29:52 +0200981 struct stksess *ts;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200982 struct stktable *t = NULL;
983 int result = 1;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200984 int ret;
985
986 list_for_each_entry(rule, &s->fe->tcp_req.l4_rules, list) {
987 ret = ACL_PAT_PASS;
988
989 if (rule->cond) {
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200990 ret = acl_exec_cond(rule->cond, s->fe, s, NULL, SMP_OPT_DIR_REQ|SMP_OPT_FINAL);
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200991 ret = acl_pass(ret);
992 if (rule->cond->pol == ACL_COND_UNLESS)
993 ret = !ret;
994 }
995
996 if (ret) {
997 /* we have a matching rule. */
998 if (rule->action == TCP_ACT_REJECT) {
Willy Tarreau7d0aaf32011-03-10 23:25:56 +0100999 s->fe->fe_counters.denied_conn++;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001000 if (s->listener->counters)
Willy Tarreau2799e982010-06-05 15:43:21 +02001001 s->listener->counters->denied_conn++;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001002
1003 if (!(s->flags & SN_ERR_MASK))
1004 s->flags |= SN_ERR_PRXCOND;
1005 if (!(s->flags & SN_FINST_MASK))
1006 s->flags |= SN_FINST_R;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001007 result = 0;
1008 break;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001009 }
Willy Tarreau56123282010-08-06 19:06:56 +02001010 else if (rule->action == TCP_ACT_TRK_SC1) {
1011 if (!s->stkctr1_entry) {
1012 /* only the first valid track-sc1 directive applies.
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001013 * Also, note that right now we can only track SRC so we
1014 * don't check how to get the key, but later we may need
1015 * to consider rule->act_prm->trk_ctr.type.
1016 */
1017 t = rule->act_prm.trk_ctr.table.t;
Willy Tarreau64ee4912012-08-30 22:59:48 +02001018 ts = stktable_get_entry(t, addr_to_stktable_key(&s->si[0].conn.addr.from));
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001019 if (ts)
Willy Tarreau56123282010-08-06 19:06:56 +02001020 session_track_stkctr1(s, t, ts);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001021 }
1022 }
Willy Tarreau56123282010-08-06 19:06:56 +02001023 else if (rule->action == TCP_ACT_TRK_SC2) {
1024 if (!s->stkctr2_entry) {
1025 /* only the first valid track-sc2 directive applies.
Willy Tarreauf059a0f2010-08-03 16:29:52 +02001026 * Also, note that right now we can only track SRC so we
1027 * don't check how to get the key, but later we may need
1028 * to consider rule->act_prm->trk_ctr.type.
1029 */
1030 t = rule->act_prm.trk_ctr.table.t;
Willy Tarreau64ee4912012-08-30 22:59:48 +02001031 ts = stktable_get_entry(t, addr_to_stktable_key(&s->si[0].conn.addr.from));
Willy Tarreauf059a0f2010-08-03 16:29:52 +02001032 if (ts)
Willy Tarreau56123282010-08-06 19:06:56 +02001033 session_track_stkctr2(s, t, ts);
Willy Tarreauf059a0f2010-08-03 16:29:52 +02001034 }
1035 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001036 else {
1037 /* otherwise it's an accept */
1038 break;
1039 }
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001040 }
1041 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001042 return result;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001043}
1044
Emeric Brun97679e72010-09-23 17:56:44 +02001045/* Parse a tcp-response rule. Return a negative value in case of failure */
1046static int tcp_parse_response_rule(char **args, int arg, int section_type,
1047 struct proxy *curpx, struct proxy *defpx,
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001048 struct tcp_rule *rule, char **err)
Emeric Brun97679e72010-09-23 17:56:44 +02001049{
1050 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001051 memprintf(err, "%s %s is only allowed in 'backend' sections",
1052 args[0], args[1]);
Emeric Brun97679e72010-09-23 17:56:44 +02001053 return -1;
1054 }
1055
1056 if (strcmp(args[arg], "accept") == 0) {
1057 arg++;
1058 rule->action = TCP_ACT_ACCEPT;
1059 }
1060 else if (strcmp(args[arg], "reject") == 0) {
1061 arg++;
1062 rule->action = TCP_ACT_REJECT;
1063 }
1064 else {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001065 memprintf(err,
1066 "'%s %s' expects 'accept' or 'reject' in %s '%s' (got '%s')",
1067 args[0], args[1], proxy_type_str(curpx), curpx->id, args[arg]);
Emeric Brun97679e72010-09-23 17:56:44 +02001068 return -1;
1069 }
1070
1071 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001072 if ((rule->cond = build_acl_cond(NULL, 0, curpx, (const char **)args+arg, err)) == NULL) {
1073 memprintf(err,
1074 "'%s %s %s' : error detected in %s '%s' while parsing '%s' condition : %s",
1075 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg], *err);
Emeric Brun97679e72010-09-23 17:56:44 +02001076 return -1;
1077 }
1078 }
1079 else if (*args[arg]) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001080 memprintf(err,
1081 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (got '%s')",
Emeric Brun97679e72010-09-23 17:56:44 +02001082 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
1083 return -1;
1084 }
1085 return 0;
1086}
1087
1088
1089
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001090/* Parse a tcp-request rule. Return a negative value in case of failure */
1091static int tcp_parse_request_rule(char **args, int arg, int section_type,
1092 struct proxy *curpx, struct proxy *defpx,
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001093 struct tcp_rule *rule, char **err)
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001094{
1095 if (curpx == defpx) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001096 memprintf(err, "%s %s is not allowed in 'defaults' sections",
1097 args[0], args[1]);
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001098 return -1;
1099 }
1100
1101 if (!strcmp(args[arg], "accept")) {
1102 arg++;
1103 rule->action = TCP_ACT_ACCEPT;
1104 }
1105 else if (!strcmp(args[arg], "reject")) {
1106 arg++;
1107 rule->action = TCP_ACT_REJECT;
1108 }
Willy Tarreau56123282010-08-06 19:06:56 +02001109 else if (strcmp(args[arg], "track-sc1") == 0) {
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001110 int ret;
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001111 int kw = arg;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001112
1113 arg++;
1114 ret = parse_track_counters(args, &arg, section_type, curpx,
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001115 &rule->act_prm.trk_ctr, defpx, err);
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001116
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001117 if (ret < 0) { /* nb: warnings are not handled yet */
1118 memprintf(err,
1119 "'%s %s %s' : %s in %s '%s'",
1120 args[0], args[1], args[kw], *err, proxy_type_str(curpx), curpx->id);
1121 return ret;
1122 }
Willy Tarreau56123282010-08-06 19:06:56 +02001123 rule->action = TCP_ACT_TRK_SC1;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001124 }
Willy Tarreau56123282010-08-06 19:06:56 +02001125 else if (strcmp(args[arg], "track-sc2") == 0) {
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001126 int ret;
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001127 int kw = arg;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001128
1129 arg++;
1130 ret = parse_track_counters(args, &arg, section_type, curpx,
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001131 &rule->act_prm.trk_ctr, defpx, err);
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001132
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001133 if (ret < 0) { /* nb: warnings are not handled yet */
1134 memprintf(err,
1135 "'%s %s %s' : %s in %s '%s'",
1136 args[0], args[1], args[kw], *err, proxy_type_str(curpx), curpx->id);
1137 return ret;
1138 }
Willy Tarreau56123282010-08-06 19:06:56 +02001139 rule->action = TCP_ACT_TRK_SC2;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001140 }
1141 else {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001142 memprintf(err,
1143 "'%s %s' expects 'accept', 'reject', 'track-sc1' "
1144 "or 'track-sc2' in %s '%s' (got '%s')",
1145 args[0], args[1], proxy_type_str(curpx), curpx->id, args[arg]);
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001146 return -1;
1147 }
1148
1149 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001150 if ((rule->cond = build_acl_cond(NULL, 0, curpx, (const char **)args+arg, err)) == NULL) {
1151 memprintf(err,
1152 "'%s %s %s' : error detected in %s '%s' while parsing '%s' condition : %s",
1153 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg], *err);
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001154 return -1;
1155 }
1156 }
1157 else if (*args[arg]) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001158 memprintf(err,
1159 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (got '%s')",
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001160 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
1161 return -1;
1162 }
1163 return 0;
1164}
1165
Emeric Brun97679e72010-09-23 17:56:44 +02001166/* This function should be called to parse a line starting with the "tcp-response"
1167 * keyword.
1168 */
1169static int tcp_parse_tcp_rep(char **args, int section_type, struct proxy *curpx,
Willy Tarreau28a47d62012-09-18 20:02:48 +02001170 struct proxy *defpx, const char *file, int line,
1171 char **err)
Emeric Brun97679e72010-09-23 17:56:44 +02001172{
1173 const char *ptr = NULL;
1174 unsigned int val;
Emeric Brun97679e72010-09-23 17:56:44 +02001175 int warn = 0;
1176 int arg;
1177 struct tcp_rule *rule;
1178
1179 if (!*args[1]) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001180 memprintf(err, "missing argument for '%s' in %s '%s'",
1181 args[0], proxy_type_str(curpx), curpx->id);
Emeric Brun97679e72010-09-23 17:56:44 +02001182 return -1;
1183 }
1184
1185 if (strcmp(args[1], "inspect-delay") == 0) {
1186 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001187 memprintf(err, "%s %s is only allowed in 'backend' sections",
1188 args[0], args[1]);
Emeric Brun97679e72010-09-23 17:56:44 +02001189 return -1;
1190 }
1191
1192 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001193 memprintf(err,
1194 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
1195 args[0], args[1], proxy_type_str(curpx), curpx->id);
1196 if (ptr)
1197 memprintf(err, "%s (unexpected character '%c')", *err, *ptr);
Emeric Brun97679e72010-09-23 17:56:44 +02001198 return -1;
1199 }
1200
1201 if (curpx->tcp_rep.inspect_delay) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001202 memprintf(err, "ignoring %s %s (was already defined) in %s '%s'",
1203 args[0], args[1], proxy_type_str(curpx), curpx->id);
Emeric Brun97679e72010-09-23 17:56:44 +02001204 return 1;
1205 }
1206 curpx->tcp_rep.inspect_delay = val;
1207 return 0;
1208 }
1209
Simon Hormande072bd2011-06-24 15:11:37 +09001210 rule = calloc(1, sizeof(*rule));
Emeric Brun97679e72010-09-23 17:56:44 +02001211 LIST_INIT(&rule->list);
1212 arg = 1;
1213
1214 if (strcmp(args[1], "content") == 0) {
1215 arg++;
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001216 if (tcp_parse_response_rule(args, arg, section_type, curpx, defpx, rule, err) < 0)
Emeric Brun97679e72010-09-23 17:56:44 +02001217 goto error;
1218
1219 if (rule->cond && (rule->cond->requires & ACL_USE_L6REQ_VOLATILE)) {
1220 struct acl *acl;
1221 const char *name;
1222
1223 acl = cond_find_require(rule->cond, ACL_USE_L6REQ_VOLATILE);
1224 name = acl ? acl->name : "(unknown)";
1225
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001226 memprintf(err,
1227 "acl '%s' involves some request-only criteria which will be ignored in '%s %s'",
1228 name, args[0], args[1]);
Emeric Brun97679e72010-09-23 17:56:44 +02001229 warn++;
1230 }
1231
1232 LIST_ADDQ(&curpx->tcp_rep.inspect_rules, &rule->list);
1233 }
1234 else {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001235 memprintf(err,
1236 "'%s' expects 'inspect-delay' or 'content' in %s '%s' (got '%s')",
1237 args[0], proxy_type_str(curpx), curpx->id, args[1]);
Emeric Brun97679e72010-09-23 17:56:44 +02001238 goto error;
1239 }
1240
1241 return warn;
1242 error:
1243 free(rule);
1244 return -1;
1245}
1246
1247
Willy Tarreaub6866442008-07-14 23:54:42 +02001248/* This function should be called to parse a line starting with the "tcp-request"
1249 * keyword.
1250 */
1251static int tcp_parse_tcp_req(char **args, int section_type, struct proxy *curpx,
Willy Tarreau28a47d62012-09-18 20:02:48 +02001252 struct proxy *defpx, const char *file, int line,
1253 char **err)
Willy Tarreaub6866442008-07-14 23:54:42 +02001254{
1255 const char *ptr = NULL;
Willy Tarreauc7e961e2008-08-17 17:13:47 +02001256 unsigned int val;
Willy Tarreau1a687942010-05-23 22:40:30 +02001257 int warn = 0;
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001258 int arg;
Willy Tarreau1a687942010-05-23 22:40:30 +02001259 struct tcp_rule *rule;
Willy Tarreaub6866442008-07-14 23:54:42 +02001260
1261 if (!*args[1]) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001262 if (curpx == defpx)
1263 memprintf(err, "missing argument for '%s' in defaults section", args[0]);
1264 else
1265 memprintf(err, "missing argument for '%s' in %s '%s'",
1266 args[0], proxy_type_str(curpx), curpx->id);
Willy Tarreaub6866442008-07-14 23:54:42 +02001267 return -1;
1268 }
1269
1270 if (!strcmp(args[1], "inspect-delay")) {
1271 if (curpx == defpx) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001272 memprintf(err, "%s %s is not allowed in 'defaults' sections",
1273 args[0], args[1]);
Willy Tarreaub6866442008-07-14 23:54:42 +02001274 return -1;
1275 }
1276
Willy Tarreaub6866442008-07-14 23:54:42 +02001277 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001278 memprintf(err,
1279 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
1280 args[0], args[1], proxy_type_str(curpx), curpx->id);
1281 if (ptr)
1282 memprintf(err, "%s (unexpected character '%c')", *err, *ptr);
Willy Tarreaub6866442008-07-14 23:54:42 +02001283 return -1;
1284 }
1285
1286 if (curpx->tcp_req.inspect_delay) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001287 memprintf(err, "ignoring %s %s (was already defined) in %s '%s'",
1288 args[0], args[1], proxy_type_str(curpx), curpx->id);
Willy Tarreaub6866442008-07-14 23:54:42 +02001289 return 1;
1290 }
1291 curpx->tcp_req.inspect_delay = val;
1292 return 0;
1293 }
1294
Simon Hormande072bd2011-06-24 15:11:37 +09001295 rule = calloc(1, sizeof(*rule));
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001296 LIST_INIT(&rule->list);
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001297 arg = 1;
1298
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001299 if (strcmp(args[1], "content") == 0) {
Willy Tarreaud1f96522010-08-03 19:34:32 +02001300 arg++;
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001301 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err) < 0)
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001302 goto error;
Willy Tarreaub6866442008-07-14 23:54:42 +02001303
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001304 if (rule->cond && (rule->cond->requires & ACL_USE_RTR_ANY)) {
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001305 struct acl *acl;
1306 const char *name;
1307
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001308 acl = cond_find_require(rule->cond, ACL_USE_RTR_ANY);
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001309 name = acl ? acl->name : "(unknown)";
1310
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001311 memprintf(err,
1312 "acl '%s' involves some response-only criteria which will be ignored in '%s %s'",
1313 name, args[0], args[1]);
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001314 warn++;
1315 }
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001316 LIST_ADDQ(&curpx->tcp_req.inspect_rules, &rule->list);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001317 }
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001318 else if (strcmp(args[1], "connection") == 0) {
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001319 arg++;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001320
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001321 if (!(curpx->cap & PR_CAP_FE)) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001322 memprintf(err, "%s %s is not allowed because %s %s is not a frontend",
1323 args[0], args[1], proxy_type_str(curpx), curpx->id);
Simon Horman6c54d8b2011-07-15 13:14:06 +09001324 goto error;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001325 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001326
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001327 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err) < 0)
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001328 goto error;
1329
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001330 if (rule->cond && (rule->cond->requires & (ACL_USE_RTR_ANY|ACL_USE_L6_ANY|ACL_USE_L7_ANY))) {
1331 struct acl *acl;
1332 const char *name;
Willy Tarreauf059a0f2010-08-03 16:29:52 +02001333
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001334 acl = cond_find_require(rule->cond, ACL_USE_RTR_ANY|ACL_USE_L6_ANY|ACL_USE_L7_ANY);
1335 name = acl ? acl->name : "(unknown)";
Willy Tarreauf059a0f2010-08-03 16:29:52 +02001336
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001337 if (acl->requires & (ACL_USE_L6_ANY|ACL_USE_L7_ANY)) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001338 memprintf(err,
1339 "'%s %s' may not reference acl '%s' which makes use of "
1340 "payload in %s '%s'. Please use '%s content' for this.",
1341 args[0], args[1], name, proxy_type_str(curpx), curpx->id, args[0]);
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001342 goto error;
1343 }
1344 if (acl->requires & ACL_USE_RTR_ANY)
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001345 memprintf(err,
1346 "acl '%s' involves some response-only criteria which will be ignored in '%s %s'",
1347 name, args[0], args[1]);
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001348 warn++;
1349 }
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001350 LIST_ADDQ(&curpx->tcp_req.l4_rules, &rule->list);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001351 }
Willy Tarreau1a687942010-05-23 22:40:30 +02001352 else {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001353 if (curpx == defpx)
1354 memprintf(err,
1355 "'%s' expects 'inspect-delay', 'connection', or 'content' in defaults section (got '%s')",
1356 args[0], args[1]);
1357 else
1358 memprintf(err,
1359 "'%s' expects 'inspect-delay', 'connection', or 'content' in %s '%s' (got '%s')",
1360 args[0], args[1], proxy_type_str(curpx), curpx->id);
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001361 goto error;
Willy Tarreau1a687942010-05-23 22:40:30 +02001362 }
1363
Willy Tarreau1a687942010-05-23 22:40:30 +02001364 return warn;
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001365 error:
1366 free(rule);
1367 return -1;
Willy Tarreaub6866442008-07-14 23:54:42 +02001368}
1369
Willy Tarreau645513a2010-05-24 20:55:15 +02001370
1371/************************************************************************/
Willy Tarreau32389b72012-04-23 23:13:20 +02001372/* All supported sample fetch functios must be declared here */
1373/************************************************************************/
1374
1375/* Fetch the request RDP cookie identified in the args, or any cookie if no arg
Willy Tarreau12785782012-04-27 21:37:17 +02001376 * is passed. It is usable both for ACL and for samples. Note: this decoder
Willy Tarreau32389b72012-04-23 23:13:20 +02001377 * only works with non-wrapping data. Accepts either 0 or 1 argument. Argument
1378 * is a string (cookie name), other types will lead to undefined behaviour.
1379 */
1380int
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001381smp_fetch_rdp_cookie(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau32389b72012-04-23 23:13:20 +02001382 const struct arg *args, struct sample *smp)
1383{
1384 int bleft;
1385 const unsigned char *data;
1386
1387 if (!l4 || !l4->req)
1388 return 0;
1389
1390 smp->flags = 0;
1391 smp->type = SMP_T_CSTR;
1392
Willy Tarreau572bf902012-07-02 17:01:20 +02001393 bleft = l4->req->buf.i;
Willy Tarreau32389b72012-04-23 23:13:20 +02001394 if (bleft <= 11)
1395 goto too_short;
1396
Willy Tarreau572bf902012-07-02 17:01:20 +02001397 data = (const unsigned char *)l4->req->buf.p + 11;
Willy Tarreau32389b72012-04-23 23:13:20 +02001398 bleft -= 11;
1399
1400 if (bleft <= 7)
1401 goto too_short;
1402
1403 if (strncasecmp((const char *)data, "Cookie:", 7) != 0)
1404 goto not_cookie;
1405
1406 data += 7;
1407 bleft -= 7;
1408
1409 while (bleft > 0 && *data == ' ') {
1410 data++;
1411 bleft--;
1412 }
1413
1414 if (args) {
1415
1416 if (bleft <= args->data.str.len)
1417 goto too_short;
1418
1419 if ((data[args->data.str.len] != '=') ||
1420 strncasecmp(args->data.str.str, (const char *)data, args->data.str.len) != 0)
1421 goto not_cookie;
1422
1423 data += args->data.str.len + 1;
1424 bleft -= args->data.str.len + 1;
1425 } else {
1426 while (bleft > 0 && *data != '=') {
1427 if (*data == '\r' || *data == '\n')
1428 goto not_cookie;
1429 data++;
1430 bleft--;
1431 }
1432
1433 if (bleft < 1)
1434 goto too_short;
1435
1436 if (*data != '=')
1437 goto not_cookie;
1438
1439 data++;
1440 bleft--;
1441 }
1442
1443 /* data points to cookie value */
1444 smp->data.str.str = (char *)data;
1445 smp->data.str.len = 0;
1446
1447 while (bleft > 0 && *data != '\r') {
1448 data++;
1449 bleft--;
1450 }
1451
1452 if (bleft < 2)
1453 goto too_short;
1454
1455 if (data[0] != '\r' || data[1] != '\n')
1456 goto not_cookie;
1457
1458 smp->data.str.len = (char *)data - smp->data.str.str;
1459 smp->flags = SMP_F_VOLATILE;
1460 return 1;
1461
1462 too_short:
1463 smp->flags = SMP_F_MAY_CHANGE;
1464 not_cookie:
1465 return 0;
1466}
1467
Willy Tarreau32389b72012-04-23 23:13:20 +02001468/************************************************************************/
Willy Tarreau645513a2010-05-24 20:55:15 +02001469/* All supported ACL keywords must be declared here. */
1470/************************************************************************/
1471
Willy Tarreau32389b72012-04-23 23:13:20 +02001472/* returns either 1 or 0 depending on whether an RDP cookie is found or not */
1473static int
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001474acl_fetch_rdp_cookie_cnt(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau24e32d82012-04-23 23:55:44 +02001475 const struct arg *args, struct sample *smp)
Willy Tarreau32389b72012-04-23 23:13:20 +02001476{
1477 int ret;
1478
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001479 ret = smp_fetch_rdp_cookie(px, l4, l7, opt, args, smp);
Willy Tarreau32389b72012-04-23 23:13:20 +02001480
1481 if (smp->flags & SMP_F_MAY_CHANGE)
1482 return 0;
1483
1484 smp->flags = SMP_F_VOLATILE;
1485 smp->type = SMP_T_UINT;
1486 smp->data.uint = ret;
1487 return 1;
1488}
1489
1490
Willy Tarreau4a129812012-04-25 17:31:42 +02001491/* fetch the connection's source IPv4/IPv6 address */
Willy Tarreau645513a2010-05-24 20:55:15 +02001492static int
Willy Tarreau4a129812012-04-25 17:31:42 +02001493smp_fetch_src(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau24e32d82012-04-23 23:55:44 +02001494 const struct arg *args, struct sample *smp)
Willy Tarreau645513a2010-05-24 20:55:15 +02001495{
Willy Tarreau986a9d22012-08-30 21:11:38 +02001496 switch (l4->si[0].conn.addr.from.ss_family) {
Willy Tarreauf4362b32011-12-16 17:49:52 +01001497 case AF_INET:
Willy Tarreau986a9d22012-08-30 21:11:38 +02001498 smp->data.ipv4 = ((struct sockaddr_in *)&l4->si[0].conn.addr.from)->sin_addr;
Willy Tarreauf853c462012-04-23 18:53:56 +02001499 smp->type = SMP_T_IPV4;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001500 break;
1501 case AF_INET6:
Willy Tarreau986a9d22012-08-30 21:11:38 +02001502 smp->data.ipv6 = ((struct sockaddr_in6 *)(&l4->si[0].conn.addr.from))->sin6_addr;
Willy Tarreauf853c462012-04-23 18:53:56 +02001503 smp->type = SMP_T_IPV6;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001504 break;
1505 default:
Emeric Brunf769f512010-10-22 17:14:01 +02001506 return 0;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001507 }
Emeric Brunf769f512010-10-22 17:14:01 +02001508
Willy Tarreau37406352012-04-23 16:16:37 +02001509 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001510 return 1;
1511}
1512
Willy Tarreaua5e37562011-12-16 17:06:15 +01001513/* set temp integer to the connection's source port */
Willy Tarreau645513a2010-05-24 20:55:15 +02001514static int
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001515smp_fetch_sport(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau24e32d82012-04-23 23:55:44 +02001516 const struct arg *args, struct sample *smp)
Willy Tarreau645513a2010-05-24 20:55:15 +02001517{
Willy Tarreauf853c462012-04-23 18:53:56 +02001518 smp->type = SMP_T_UINT;
Willy Tarreau986a9d22012-08-30 21:11:38 +02001519 if (!(smp->data.uint = get_host_port(&l4->si[0].conn.addr.from)))
Emeric Brunf769f512010-10-22 17:14:01 +02001520 return 0;
1521
Willy Tarreau37406352012-04-23 16:16:37 +02001522 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001523 return 1;
1524}
1525
Willy Tarreau4a129812012-04-25 17:31:42 +02001526/* fetch the connection's destination IPv4/IPv6 address */
Willy Tarreau645513a2010-05-24 20:55:15 +02001527static int
Willy Tarreau4a129812012-04-25 17:31:42 +02001528smp_fetch_dst(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau24e32d82012-04-23 23:55:44 +02001529 const struct arg *args, struct sample *smp)
Willy Tarreau645513a2010-05-24 20:55:15 +02001530{
Willy Tarreau986a9d22012-08-30 21:11:38 +02001531 conn_get_to_addr(&l4->si[0].conn);
Willy Tarreau645513a2010-05-24 20:55:15 +02001532
Willy Tarreau986a9d22012-08-30 21:11:38 +02001533 switch (l4->si[0].conn.addr.to.ss_family) {
Willy Tarreauf4362b32011-12-16 17:49:52 +01001534 case AF_INET:
Willy Tarreau986a9d22012-08-30 21:11:38 +02001535 smp->data.ipv4 = ((struct sockaddr_in *)&l4->si[0].conn.addr.to)->sin_addr;
Willy Tarreauf853c462012-04-23 18:53:56 +02001536 smp->type = SMP_T_IPV4;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001537 break;
1538 case AF_INET6:
Willy Tarreau986a9d22012-08-30 21:11:38 +02001539 smp->data.ipv6 = ((struct sockaddr_in6 *)(&l4->si[0].conn.addr.to))->sin6_addr;
Willy Tarreauf853c462012-04-23 18:53:56 +02001540 smp->type = SMP_T_IPV6;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001541 break;
1542 default:
Emeric Brunf769f512010-10-22 17:14:01 +02001543 return 0;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001544 }
Emeric Brunf769f512010-10-22 17:14:01 +02001545
Willy Tarreau37406352012-04-23 16:16:37 +02001546 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001547 return 1;
1548}
1549
Willy Tarreaua5e37562011-12-16 17:06:15 +01001550/* set temp integer to the frontend connexion's destination port */
Willy Tarreau645513a2010-05-24 20:55:15 +02001551static int
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001552smp_fetch_dport(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau24e32d82012-04-23 23:55:44 +02001553 const struct arg *args, struct sample *smp)
Willy Tarreau645513a2010-05-24 20:55:15 +02001554{
Willy Tarreau986a9d22012-08-30 21:11:38 +02001555 conn_get_to_addr(&l4->si[0].conn);
Willy Tarreau645513a2010-05-24 20:55:15 +02001556
Willy Tarreauf853c462012-04-23 18:53:56 +02001557 smp->type = SMP_T_UINT;
Willy Tarreau986a9d22012-08-30 21:11:38 +02001558 if (!(smp->data.uint = get_host_port(&l4->si[0].conn.addr.to)))
Emeric Brunf769f512010-10-22 17:14:01 +02001559 return 0;
1560
Willy Tarreau37406352012-04-23 16:16:37 +02001561 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001562 return 1;
1563}
1564
1565static int
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001566smp_fetch_payload_lv(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
1567 const struct arg *arg_p, struct sample *smp)
Emericf2d7cae2010-11-05 18:13:50 +01001568{
Willy Tarreau82ea8002012-04-25 19:19:43 +02001569 unsigned int len_offset = arg_p[0].data.uint;
1570 unsigned int len_size = arg_p[1].data.uint;
1571 unsigned int buf_offset;
1572 unsigned int buf_size = 0;
Willy Tarreau7421efb2012-07-02 15:11:27 +02001573 struct channel *b;
Emericf2d7cae2010-11-05 18:13:50 +01001574 int i;
1575
1576 /* Format is (len offset, len size, buf offset) or (len offset, len size) */
1577 /* by default buf offset == len offset + len size */
1578 /* buf offset could be absolute or relative to len offset + len size if prefixed by + or - */
1579
1580 if (!l4)
1581 return 0;
1582
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001583 b = ((opt & SMP_OPT_DIR) == SMP_OPT_DIR_RES) ? l4->rep : l4->req;
Emericf2d7cae2010-11-05 18:13:50 +01001584
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001585 if (!b)
Emericf2d7cae2010-11-05 18:13:50 +01001586 return 0;
1587
Willy Tarreau572bf902012-07-02 17:01:20 +02001588 if (len_offset + len_size > b->buf.i)
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001589 goto too_short;
Emericf2d7cae2010-11-05 18:13:50 +01001590
1591 for (i = 0; i < len_size; i++) {
Willy Tarreau572bf902012-07-02 17:01:20 +02001592 buf_size = (buf_size << 8) + ((unsigned char *)b->buf.p)[i + len_offset];
Emericf2d7cae2010-11-05 18:13:50 +01001593 }
1594
Willy Tarreau9fcb9842012-04-20 14:45:49 +02001595 /* buf offset may be implicit, absolute or relative */
1596 buf_offset = len_offset + len_size;
1597 if (arg_p[2].type == ARGT_UINT)
1598 buf_offset = arg_p[2].data.uint;
1599 else if (arg_p[2].type == ARGT_SINT)
1600 buf_offset += arg_p[2].data.sint;
1601
Willy Tarreau572bf902012-07-02 17:01:20 +02001602 if (!buf_size || buf_size > b->buf.size || buf_offset + buf_size > b->buf.size) {
Willy Tarreau82ea8002012-04-25 19:19:43 +02001603 /* will never match */
1604 smp->flags = 0;
1605 return 0;
1606 }
1607
Willy Tarreau572bf902012-07-02 17:01:20 +02001608 if (buf_offset + buf_size > b->buf.i)
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001609 goto too_short;
Emericf2d7cae2010-11-05 18:13:50 +01001610
1611 /* init chunk as read only */
Willy Tarreaub8c8f1f2012-04-23 22:38:26 +02001612 smp->type = SMP_T_CBIN;
Willy Tarreau572bf902012-07-02 17:01:20 +02001613 chunk_initlen(&smp->data.str, b->buf.p + buf_offset, 0, buf_size);
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001614 smp->flags = SMP_F_VOLATILE;
Emericf2d7cae2010-11-05 18:13:50 +01001615 return 1;
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001616
1617 too_short:
1618 smp->flags = SMP_F_MAY_CHANGE;
1619 return 0;
Emericf2d7cae2010-11-05 18:13:50 +01001620}
1621
1622static int
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001623smp_fetch_payload(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
1624 const struct arg *arg_p, struct sample *smp)
Emericf2d7cae2010-11-05 18:13:50 +01001625{
Willy Tarreau82ea8002012-04-25 19:19:43 +02001626 unsigned int buf_offset = arg_p[0].data.uint;
1627 unsigned int buf_size = arg_p[1].data.uint;
Willy Tarreau7421efb2012-07-02 15:11:27 +02001628 struct channel *b;
Emericf2d7cae2010-11-05 18:13:50 +01001629
1630 if (!l4)
1631 return 0;
1632
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001633 b = ((opt & SMP_OPT_DIR) == SMP_OPT_DIR_RES) ? l4->rep : l4->req;
Emericf2d7cae2010-11-05 18:13:50 +01001634
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001635 if (!b)
Emericf2d7cae2010-11-05 18:13:50 +01001636 return 0;
Willy Tarreau82ea8002012-04-25 19:19:43 +02001637
Willy Tarreau572bf902012-07-02 17:01:20 +02001638 if (!buf_size || buf_size > b->buf.size || buf_offset + buf_size > b->buf.size) {
Willy Tarreau82ea8002012-04-25 19:19:43 +02001639 /* will never match */
1640 smp->flags = 0;
1641 return 0;
1642 }
Emericf2d7cae2010-11-05 18:13:50 +01001643
Willy Tarreau572bf902012-07-02 17:01:20 +02001644 if (buf_offset + buf_size > b->buf.i)
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001645 goto too_short;
Emericf2d7cae2010-11-05 18:13:50 +01001646
1647 /* init chunk as read only */
Willy Tarreaub8c8f1f2012-04-23 22:38:26 +02001648 smp->type = SMP_T_CBIN;
Willy Tarreau572bf902012-07-02 17:01:20 +02001649 chunk_initlen(&smp->data.str, b->buf.p + buf_offset, 0, buf_size);
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001650 smp->flags = SMP_F_VOLATILE;
Simon Hormanab814e02011-06-24 14:50:20 +09001651 return 1;
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001652
1653 too_short:
1654 smp->flags = SMP_F_MAY_CHANGE;
1655 return 0;
Simon Hormanab814e02011-06-24 14:50:20 +09001656}
1657
Willy Tarreau21d68a62012-04-20 15:52:36 +02001658/* This function is used to validate the arguments passed to a "payload" fetch
1659 * keyword. This keyword expects two positive integers, with the second one
1660 * being strictly positive. It is assumed that the types are already the correct
1661 * ones. Returns 0 on error, non-zero if OK. If <err_msg> is not NULL, it will be
1662 * filled with a pointer to an error message in case of error, that the caller
1663 * is responsible for freeing. The initial location must either be freeable or
1664 * NULL.
1665 */
1666static int val_payload(struct arg *arg, char **err_msg)
1667{
1668 if (!arg[1].data.uint) {
Willy Tarreaueb6cead2012-09-20 19:43:14 +02001669 memprintf(err_msg, "payload length must be > 0");
Willy Tarreau21d68a62012-04-20 15:52:36 +02001670 return 0;
1671 }
1672 return 1;
1673}
1674
1675/* This function is used to validate the arguments passed to a "payload_lv" fetch
1676 * keyword. This keyword allows two positive integers and an optional signed one,
1677 * with the second one being strictly positive and the third one being greater than
1678 * the opposite of the two others if negative. It is assumed that the types are
1679 * already the correct ones. Returns 0 on error, non-zero if OK. If <err_msg> is
1680 * not NULL, it will be filled with a pointer to an error message in case of
1681 * error, that the caller is responsible for freeing. The initial location must
1682 * either be freeable or NULL.
1683 */
1684static int val_payload_lv(struct arg *arg, char **err_msg)
1685{
1686 if (!arg[1].data.uint) {
Willy Tarreaueb6cead2012-09-20 19:43:14 +02001687 memprintf(err_msg, "payload length must be > 0");
Willy Tarreau21d68a62012-04-20 15:52:36 +02001688 return 0;
1689 }
1690
1691 if (arg[2].type == ARGT_SINT &&
1692 (int)(arg[0].data.uint + arg[1].data.uint + arg[2].data.sint) < 0) {
Willy Tarreaueb6cead2012-09-20 19:43:14 +02001693 memprintf(err_msg, "payload offset too negative");
Willy Tarreau21d68a62012-04-20 15:52:36 +02001694 return 0;
1695 }
1696 return 1;
1697}
1698
Willy Tarreau44791242012-09-12 23:27:21 +02001699#ifdef CONFIG_HAP_LINUX_TPROXY
1700/* parse the "transparent" bind keyword */
Willy Tarreau4348fad2012-09-20 16:48:07 +02001701static int bind_parse_transparent(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
Willy Tarreau44791242012-09-12 23:27:21 +02001702{
1703 struct listener *l;
1704
Willy Tarreau4348fad2012-09-20 16:48:07 +02001705 list_for_each_entry(l, &conf->listeners, by_bind) {
1706 if (l->addr.ss_family == AF_INET || l->addr.ss_family == AF_INET6)
1707 l->options |= LI_O_FOREIGN;
Willy Tarreau44791242012-09-12 23:27:21 +02001708 }
1709
Willy Tarreau44791242012-09-12 23:27:21 +02001710 return 0;
1711}
1712#endif
1713
1714#ifdef TCP_DEFER_ACCEPT
1715/* parse the "defer-accept" bind keyword */
Willy Tarreau4348fad2012-09-20 16:48:07 +02001716static int bind_parse_defer_accept(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
Willy Tarreau44791242012-09-12 23:27:21 +02001717{
1718 struct listener *l;
1719
Willy Tarreau4348fad2012-09-20 16:48:07 +02001720 list_for_each_entry(l, &conf->listeners, by_bind) {
1721 if (l->addr.ss_family == AF_INET || l->addr.ss_family == AF_INET6)
1722 l->options |= LI_O_DEF_ACCEPT;
Willy Tarreau44791242012-09-12 23:27:21 +02001723 }
1724
Willy Tarreau44791242012-09-12 23:27:21 +02001725 return 0;
1726}
1727#endif
1728
1729#ifdef TCP_MAXSEG
1730/* parse the "mss" bind keyword */
Willy Tarreau4348fad2012-09-20 16:48:07 +02001731static int bind_parse_mss(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
Willy Tarreau44791242012-09-12 23:27:21 +02001732{
1733 struct listener *l;
1734 int mss;
1735
Willy Tarreau44791242012-09-12 23:27:21 +02001736 if (!*args[cur_arg + 1]) {
Willy Tarreaueb6cead2012-09-20 19:43:14 +02001737 memprintf(err, "'%s' : missing MSS value", args[cur_arg]);
Willy Tarreau44791242012-09-12 23:27:21 +02001738 return ERR_ALERT | ERR_FATAL;
1739 }
1740
1741 mss = atoi(args[cur_arg + 1]);
1742 if (!mss || abs(mss) > 65535) {
Willy Tarreaueb6cead2012-09-20 19:43:14 +02001743 memprintf(err, "'%s' : expects an MSS with and absolute value between 1 and 65535", args[cur_arg]);
Willy Tarreau44791242012-09-12 23:27:21 +02001744 return ERR_ALERT | ERR_FATAL;
1745 }
1746
Willy Tarreau4348fad2012-09-20 16:48:07 +02001747 list_for_each_entry(l, &conf->listeners, by_bind) {
1748 if (l->addr.ss_family == AF_INET || l->addr.ss_family == AF_INET6)
1749 l->maxseg = mss;
1750 }
Willy Tarreau44791242012-09-12 23:27:21 +02001751
1752 return 0;
1753}
1754#endif
1755
1756#ifdef SO_BINDTODEVICE
1757/* parse the "mss" bind keyword */
Willy Tarreau4348fad2012-09-20 16:48:07 +02001758static int bind_parse_interface(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
Willy Tarreau44791242012-09-12 23:27:21 +02001759{
1760 struct listener *l;
1761
Willy Tarreau44791242012-09-12 23:27:21 +02001762 if (!*args[cur_arg + 1]) {
Willy Tarreaueb6cead2012-09-20 19:43:14 +02001763 memprintf(err, "'%s' : missing interface name", args[cur_arg]);
Willy Tarreau44791242012-09-12 23:27:21 +02001764 return ERR_ALERT | ERR_FATAL;
1765 }
1766
Willy Tarreau4348fad2012-09-20 16:48:07 +02001767 list_for_each_entry(l, &conf->listeners, by_bind) {
1768 if (l->addr.ss_family == AF_INET || l->addr.ss_family == AF_INET6)
1769 l->interface = strdup(args[cur_arg + 1]);
1770 }
Willy Tarreau44791242012-09-12 23:27:21 +02001771
1772 global.last_checks |= LSTCHK_NETADM;
1773 return 0;
1774}
1775#endif
1776
Willy Tarreaub6866442008-07-14 23:54:42 +02001777static struct cfg_kw_list cfg_kws = {{ },{
1778 { CFG_LISTEN, "tcp-request", tcp_parse_tcp_req },
Emeric Brun97679e72010-09-23 17:56:44 +02001779 { CFG_LISTEN, "tcp-response", tcp_parse_tcp_rep },
Willy Tarreaub6866442008-07-14 23:54:42 +02001780 { 0, NULL, NULL },
1781}};
1782
Willy Tarreau61612d42012-04-19 18:42:05 +02001783/* Note: must not be declared <const> as its list will be overwritten.
1784 * Please take care of keeping this list alphabetically sorted.
1785 */
Willy Tarreaub6866442008-07-14 23:54:42 +02001786static struct acl_kw_list acl_kws = {{ },{
Willy Tarreau4a129812012-04-25 17:31:42 +02001787 { "dst", acl_parse_ip, smp_fetch_dst, acl_match_ip, ACL_USE_TCP4_PERMANENT|ACL_MAY_LOOKUP, 0 },
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001788 { "dst_port", acl_parse_int, smp_fetch_dport, acl_match_int, ACL_USE_TCP_PERMANENT, 0 },
Willy Tarreau0d5fe142012-04-26 12:24:45 +02001789 { "payload", acl_parse_str, smp_fetch_payload, acl_match_str, ACL_USE_L6REQ_VOLATILE|ACL_MAY_LOOKUP, ARG2(2,UINT,UINT), val_payload },
1790 { "payload_lv", acl_parse_str, smp_fetch_payload_lv, acl_match_str, ACL_USE_L6REQ_VOLATILE|ACL_MAY_LOOKUP, ARG3(2,UINT,UINT,SINT), val_payload_lv },
Willy Tarreau9fb4bc72012-04-24 00:09:26 +02001791 { "req_rdp_cookie", acl_parse_str, smp_fetch_rdp_cookie, acl_match_str, ACL_USE_L6REQ_VOLATILE|ACL_MAY_LOOKUP, ARG1(0,STR) },
Willy Tarreau32389b72012-04-23 23:13:20 +02001792 { "req_rdp_cookie_cnt", acl_parse_int, acl_fetch_rdp_cookie_cnt, acl_match_int, ACL_USE_L6REQ_VOLATILE, ARG1(0,STR) },
Willy Tarreau4a129812012-04-25 17:31:42 +02001793 { "src", acl_parse_ip, smp_fetch_src, acl_match_ip, ACL_USE_TCP4_PERMANENT|ACL_MAY_LOOKUP, 0 },
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001794 { "src_port", acl_parse_int, smp_fetch_sport, acl_match_int, ACL_USE_TCP_PERMANENT, 0 },
Willy Tarreaub6866442008-07-14 23:54:42 +02001795 { NULL, NULL, NULL, NULL },
1796}};
1797
Willy Tarreau4a129812012-04-25 17:31:42 +02001798/* Note: must not be declared <const> as its list will be overwritten.
1799 * Note: fetches that may return multiple types must be declared as the lowest
1800 * common denominator, the type that can be casted into all other ones. For
1801 * instance v4/v6 must be declared v4.
1802 */
Willy Tarreau12785782012-04-27 21:37:17 +02001803static struct sample_fetch_kw_list sample_fetch_keywords = {{ },{
Willy Tarreau4a129812012-04-25 17:31:42 +02001804 { "src", smp_fetch_src, 0, NULL, SMP_T_IPV4, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreau4a129812012-04-25 17:31:42 +02001805 { "dst", smp_fetch_dst, 0, NULL, SMP_T_IPV4, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001806 { "dst_port", smp_fetch_dport, 0, NULL, SMP_T_UINT, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001807 { "payload", smp_fetch_payload, ARG2(2,UINT,UINT), val_payload, SMP_T_CBIN, SMP_CAP_REQ|SMP_CAP_RES },
1808 { "payload_lv", smp_fetch_payload_lv, ARG3(2,UINT,UINT,SINT), val_payload_lv, SMP_T_CBIN, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreaud6281ae2012-04-26 11:23:39 +02001809 { "rdp_cookie", smp_fetch_rdp_cookie, ARG1(1,STR), NULL, SMP_T_CSTR, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001810 { "src_port", smp_fetch_sport, 0, NULL, SMP_T_UINT, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreau9fcb9842012-04-20 14:45:49 +02001811 { NULL, NULL, 0, 0, 0 },
Willy Tarreau645513a2010-05-24 20:55:15 +02001812}};
1813
Willy Tarreau44791242012-09-12 23:27:21 +02001814/************************************************************************/
1815/* All supported bind keywords must be declared here. */
1816/************************************************************************/
1817
1818/* Note: must not be declared <const> as its list will be overwritten.
1819 * Please take care of keeping this list alphabetically sorted, doing so helps
1820 * all code contributors.
1821 * Optional keywords are also declared with a NULL ->parse() function so that
1822 * the config parser can report an appropriate error when a known keyword was
1823 * not enabled.
1824 */
Willy Tarreau51fb7652012-09-18 18:24:39 +02001825static struct bind_kw_list bind_kws = { "TCP", { }, {
Willy Tarreau44791242012-09-12 23:27:21 +02001826#ifdef TCP_DEFER_ACCEPT
1827 { "defer-accept", bind_parse_defer_accept, 0 }, /* wait for some data for 1 second max before doing accept */
1828#endif
1829#ifdef SO_BINDTODEVICE
1830 { "interface", bind_parse_interface, 1 }, /* specifically bind to this interface */
1831#endif
1832#ifdef TCP_MAXSEG
1833 { "mss", bind_parse_mss, 1 }, /* set MSS of listening socket */
1834#endif
1835#ifdef CONFIG_HAP_LINUX_TPROXY
1836 { "transparent", bind_parse_transparent, 0 }, /* transparently bind to the specified addresses */
1837#endif
1838 /* the versions with the NULL parse function*/
1839 { "defer-accept", NULL, 0 },
1840 { "interface", NULL, 1 },
1841 { "mss", NULL, 1 },
1842 { "transparent", NULL, 0 },
1843 { NULL, NULL, 0 },
1844}};
1845
Willy Tarreaue6b98942007-10-29 01:09:36 +01001846__attribute__((constructor))
1847static void __tcp_protocol_init(void)
1848{
1849 protocol_register(&proto_tcpv4);
1850 protocol_register(&proto_tcpv6);
Willy Tarreau12785782012-04-27 21:37:17 +02001851 sample_register_fetches(&sample_fetch_keywords);
Willy Tarreaub6866442008-07-14 23:54:42 +02001852 cfg_register_keywords(&cfg_kws);
1853 acl_register_keywords(&acl_kws);
Willy Tarreau44791242012-09-12 23:27:21 +02001854 bind_register_keywords(&bind_kws);
Willy Tarreaue6b98942007-10-29 01:09:36 +01001855}
1856
1857
1858/*
1859 * Local variables:
1860 * c-indent-level: 8
1861 * c-basic-offset: 8
1862 * End:
1863 */