blob: 488d7370e299367a55cf0955cdf3bcfc2764da95 [file] [log] [blame]
Willy Tarreaue6b98942007-10-29 01:09:36 +01001/*
2 * AF_INET/AF_INET6 SOCK_STREAM protocol layer (tcp)
3 *
Willy Tarreau1a687942010-05-23 22:40:30 +02004 * Copyright 2000-2010 Willy Tarreau <w@1wt.eu>
Willy Tarreaue6b98942007-10-29 01:09:36 +01005 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
13#include <ctype.h>
14#include <errno.h>
15#include <fcntl.h>
16#include <stdio.h>
17#include <stdlib.h>
18#include <string.h>
19#include <time.h>
20
21#include <sys/param.h>
22#include <sys/socket.h>
23#include <sys/stat.h>
24#include <sys/types.h>
25#include <sys/un.h>
26
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +040027#include <netinet/tcp.h>
28
Willy Tarreaub6866442008-07-14 23:54:42 +020029#include <common/cfgparse.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010030#include <common/compat.h>
31#include <common/config.h>
32#include <common/debug.h>
33#include <common/errors.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010034#include <common/mini-clist.h>
35#include <common/standard.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010036
Willy Tarreaue6b98942007-10-29 01:09:36 +010037#include <types/global.h>
Willy Tarreau9650f372009-08-16 14:02:45 +020038#include <types/server.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010039
40#include <proto/acl.h>
Willy Tarreau9fcb9842012-04-20 14:45:49 +020041#include <proto/arg.h>
Willy Tarreauc7e42382012-08-24 19:22:53 +020042#include <proto/channel.h>
Willy Tarreaud2274c62012-07-06 14:29:45 +020043#include <proto/connection.h>
Willy Tarreau9650f372009-08-16 14:02:45 +020044#include <proto/log.h>
45#include <proto/port_range.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010046#include <proto/protocols.h>
47#include <proto/proto_tcp.h>
Willy Tarreaub6866442008-07-14 23:54:42 +020048#include <proto/proxy.h>
Willy Tarreaucd3b0942012-04-27 21:52:18 +020049#include <proto/sample.h>
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +020050#include <proto/session.h>
Willy Tarreaua975b8f2010-06-05 19:13:27 +020051#include <proto/stick_table.h>
Willy Tarreau59b94792012-05-11 16:16:40 +020052#include <proto/stream_interface.h>
Willy Tarreaua975b8f2010-06-05 19:13:27 +020053#include <proto/task.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010054
Willy Tarreaue8c66af2008-01-13 18:40:14 +010055#ifdef CONFIG_HAP_CTTPROXY
56#include <import/ip_tproxy.h>
57#endif
58
Emeric Bruncf20bf12010-10-22 16:06:11 +020059static int tcp_bind_listeners(struct protocol *proto, char *errmsg, int errlen);
60static int tcp_bind_listener(struct listener *listener, char *errmsg, int errlen);
Willy Tarreaue6b98942007-10-29 01:09:36 +010061
62/* Note: must not be declared <const> as its list will be overwritten */
63static struct protocol proto_tcpv4 = {
64 .name = "tcpv4",
65 .sock_domain = AF_INET,
66 .sock_type = SOCK_STREAM,
67 .sock_prot = IPPROTO_TCP,
68 .sock_family = AF_INET,
69 .sock_addrlen = sizeof(struct sockaddr_in),
70 .l3_addrlen = 32/8,
Willy Tarreaubbebbbf2012-05-07 21:22:09 +020071 .accept = &listener_accept,
Willy Tarreau26d8c592012-05-07 18:12:14 +020072 .connect = tcp_connect_server,
Emeric Bruncf20bf12010-10-22 16:06:11 +020073 .bind = tcp_bind_listener,
Willy Tarreaue6b98942007-10-29 01:09:36 +010074 .bind_all = tcp_bind_listeners,
75 .unbind_all = unbind_all_listeners,
76 .enable_all = enable_all_listeners,
Willy Tarreau59b94792012-05-11 16:16:40 +020077 .get_src = tcp_get_src,
78 .get_dst = tcp_get_dst,
Willy Tarreaue6b98942007-10-29 01:09:36 +010079 .listeners = LIST_HEAD_INIT(proto_tcpv4.listeners),
80 .nb_listeners = 0,
81};
82
83/* Note: must not be declared <const> as its list will be overwritten */
84static struct protocol proto_tcpv6 = {
85 .name = "tcpv6",
86 .sock_domain = AF_INET6,
87 .sock_type = SOCK_STREAM,
88 .sock_prot = IPPROTO_TCP,
89 .sock_family = AF_INET6,
90 .sock_addrlen = sizeof(struct sockaddr_in6),
91 .l3_addrlen = 128/8,
Willy Tarreaubbebbbf2012-05-07 21:22:09 +020092 .accept = &listener_accept,
Willy Tarreau26d8c592012-05-07 18:12:14 +020093 .connect = tcp_connect_server,
Emeric Bruncf20bf12010-10-22 16:06:11 +020094 .bind = tcp_bind_listener,
Willy Tarreaue6b98942007-10-29 01:09:36 +010095 .bind_all = tcp_bind_listeners,
96 .unbind_all = unbind_all_listeners,
97 .enable_all = enable_all_listeners,
Willy Tarreau59b94792012-05-11 16:16:40 +020098 .get_src = tcp_get_src,
99 .get_dst = tcp_get_dst,
Willy Tarreaue6b98942007-10-29 01:09:36 +0100100 .listeners = LIST_HEAD_INIT(proto_tcpv6.listeners),
101 .nb_listeners = 0,
102};
103
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100104
David du Colombier6f5ccb12011-03-10 22:26:24 +0100105/* Binds ipv4/ipv6 address <local> to socket <fd>, unless <flags> is set, in which
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100106 * case we try to bind <remote>. <flags> is a 2-bit field consisting of :
107 * - 0 : ignore remote address (may even be a NULL pointer)
108 * - 1 : use provided address
109 * - 2 : use provided port
110 * - 3 : use both
111 *
112 * The function supports multiple foreign binding methods :
113 * - linux_tproxy: we directly bind to the foreign address
114 * - cttproxy: we bind to a local address then nat.
115 * The second one can be used as a fallback for the first one.
116 * This function returns 0 when everything's OK, 1 if it could not bind, to the
117 * local address, 2 if it could not bind to the foreign address.
118 */
David du Colombier6f5ccb12011-03-10 22:26:24 +0100119int tcp_bind_socket(int fd, int flags, struct sockaddr_storage *local, struct sockaddr_storage *remote)
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100120{
David du Colombier6f5ccb12011-03-10 22:26:24 +0100121 struct sockaddr_storage bind_addr;
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100122 int foreign_ok = 0;
123 int ret;
124
125#ifdef CONFIG_HAP_LINUX_TPROXY
126 static int ip_transp_working = 1;
David du Colombier65c17962012-07-13 14:34:59 +0200127 static int ip6_transp_working = 1;
128 switch (local->ss_family) {
129 case AF_INET:
130 if (flags && ip_transp_working) {
131 if (setsockopt(fd, SOL_IP, IP_TRANSPARENT, &one, sizeof(one)) == 0
132 || setsockopt(fd, SOL_IP, IP_FREEBIND, &one, sizeof(one)) == 0)
133 foreign_ok = 1;
134 else
135 ip_transp_working = 0;
136 }
137 break;
138 case AF_INET6:
139 if (flags && ip6_transp_working) {
140 if (setsockopt(fd, SOL_IPV6, IPV6_TRANSPARENT, &one, sizeof(one)) == 0)
141 foreign_ok = 1;
142 else
143 ip6_transp_working = 0;
144 }
145 break;
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100146 }
147#endif
148 if (flags) {
149 memset(&bind_addr, 0, sizeof(bind_addr));
Willy Tarreau96dd0792011-04-19 07:20:57 +0200150 bind_addr.ss_family = remote->ss_family;
David du Colombier6f5ccb12011-03-10 22:26:24 +0100151 switch (remote->ss_family) {
152 case AF_INET:
153 if (flags & 1)
154 ((struct sockaddr_in *)&bind_addr)->sin_addr = ((struct sockaddr_in *)remote)->sin_addr;
155 if (flags & 2)
156 ((struct sockaddr_in *)&bind_addr)->sin_port = ((struct sockaddr_in *)remote)->sin_port;
157 break;
158 case AF_INET6:
159 if (flags & 1)
160 ((struct sockaddr_in6 *)&bind_addr)->sin6_addr = ((struct sockaddr_in6 *)remote)->sin6_addr;
161 if (flags & 2)
162 ((struct sockaddr_in6 *)&bind_addr)->sin6_port = ((struct sockaddr_in6 *)remote)->sin6_port;
163 break;
Willy Tarreau5dc1e982011-12-16 21:25:11 +0100164 default:
165 /* we don't want to try to bind to an unknown address family */
166 foreign_ok = 0;
David du Colombier6f5ccb12011-03-10 22:26:24 +0100167 }
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100168 }
169
Simon Hormande072bd2011-06-24 15:11:37 +0900170 setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one));
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100171 if (foreign_ok) {
Willy Tarreau1b4b7ce2011-04-05 16:56:50 +0200172 ret = bind(fd, (struct sockaddr *)&bind_addr, get_addr_len(&bind_addr));
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100173 if (ret < 0)
174 return 2;
175 }
176 else {
Willy Tarreau1b4b7ce2011-04-05 16:56:50 +0200177 ret = bind(fd, (struct sockaddr *)local, get_addr_len(local));
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100178 if (ret < 0)
179 return 1;
180 }
181
182 if (!flags)
183 return 0;
184
185#ifdef CONFIG_HAP_CTTPROXY
Willy Tarreau6f831b42011-03-20 14:03:54 +0100186 if (!foreign_ok && remote->ss_family == AF_INET) {
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100187 struct in_tproxy itp1, itp2;
188 memset(&itp1, 0, sizeof(itp1));
189
190 itp1.op = TPROXY_ASSIGN;
Willy Tarreau6f831b42011-03-20 14:03:54 +0100191 itp1.v.addr.faddr = ((struct sockaddr_in *)&bind_addr)->sin_addr;
192 itp1.v.addr.fport = ((struct sockaddr_in *)&bind_addr)->sin_port;
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100193
194 /* set connect flag on socket */
195 itp2.op = TPROXY_FLAGS;
196 itp2.v.flags = ITP_CONNECT | ITP_ONCE;
197
198 if (setsockopt(fd, SOL_IP, IP_TPROXY, &itp1, sizeof(itp1)) != -1 &&
199 setsockopt(fd, SOL_IP, IP_TPROXY, &itp2, sizeof(itp2)) != -1) {
200 foreign_ok = 1;
201 }
202 }
203#endif
204 if (!foreign_ok)
205 /* we could not bind to a foreign address */
206 return 2;
207
208 return 0;
209}
Willy Tarreaue6b98942007-10-29 01:09:36 +0100210
Willy Tarreau9650f372009-08-16 14:02:45 +0200211
212/*
Willy Tarreauac825402011-03-04 22:04:29 +0100213 * This function initiates a connection to the target assigned to this session
Willy Tarreau6471afb2011-09-23 10:54:59 +0200214 * (si->{target,addr.to}). A source address may be pointed to by si->addr.from
Willy Tarreauac825402011-03-04 22:04:29 +0100215 * in case of transparent proxying. Normal source bind addresses are still
216 * determined locally (due to the possible need of a source port).
217 * si->target may point either to a valid server or to a backend, depending
218 * on si->target.type. Only TARG_TYPE_PROXY and TARG_TYPE_SERVER are supported.
Willy Tarreaub1d67742010-03-29 19:36:59 +0200219 *
Willy Tarreau9650f372009-08-16 14:02:45 +0200220 * It can return one of :
221 * - SN_ERR_NONE if everything's OK
222 * - SN_ERR_SRVTO if there are no more servers
223 * - SN_ERR_SRVCL if the connection was refused by the server
224 * - SN_ERR_PRXCOND if the connection has been limited by the proxy (maxconn)
225 * - SN_ERR_RESOURCE if a system resource is lacking (eg: fd limits, ports, ...)
226 * - SN_ERR_INTERNAL for any other purely internal errors
227 * Additionnally, in the case of SN_ERR_RESOURCE, an emergency log will be emitted.
228 */
Willy Tarreauf1536862011-03-03 18:27:32 +0100229
David du Colombier6f5ccb12011-03-10 22:26:24 +0100230int tcp_connect_server(struct stream_interface *si)
Willy Tarreau9650f372009-08-16 14:02:45 +0200231{
232 int fd;
Willy Tarreauac825402011-03-04 22:04:29 +0100233 struct server *srv;
234 struct proxy *be;
235
236 switch (si->target.type) {
237 case TARG_TYPE_PROXY:
238 be = si->target.ptr.p;
239 srv = NULL;
240 break;
241 case TARG_TYPE_SERVER:
242 srv = si->target.ptr.s;
243 be = srv->proxy;
244 break;
245 default:
246 return SN_ERR_INTERNAL;
247 }
Willy Tarreau9650f372009-08-16 14:02:45 +0200248
Willy Tarreaufb7508a2012-05-21 16:47:54 +0200249 if ((fd = si->conn.t.sock.fd = socket(si->addr.to.ss_family, SOCK_STREAM, IPPROTO_TCP)) == -1) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200250 qfprintf(stderr, "Cannot get a server socket.\n");
251
252 if (errno == ENFILE)
253 send_log(be, LOG_EMERG,
254 "Proxy %s reached system FD limit at %d. Please check system tunables.\n",
255 be->id, maxfd);
256 else if (errno == EMFILE)
257 send_log(be, LOG_EMERG,
258 "Proxy %s reached process FD limit at %d. Please check 'ulimit-n' and restart.\n",
259 be->id, maxfd);
260 else if (errno == ENOBUFS || errno == ENOMEM)
261 send_log(be, LOG_EMERG,
262 "Proxy %s reached system memory limit at %d sockets. Please check system tunables.\n",
263 be->id, maxfd);
264 /* this is a resource error */
265 return SN_ERR_RESOURCE;
266 }
267
268 if (fd >= global.maxsock) {
269 /* do not log anything there, it's a normal condition when this option
270 * is used to serialize connections to a server !
271 */
272 Alert("socket(): not enough free sockets. Raise -n argument. Giving up.\n");
273 close(fd);
274 return SN_ERR_PRXCOND; /* it is a configuration limit */
275 }
276
277 if ((fcntl(fd, F_SETFL, O_NONBLOCK)==-1) ||
Simon Hormande072bd2011-06-24 15:11:37 +0900278 (setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &one, sizeof(one)) == -1)) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200279 qfprintf(stderr,"Cannot set client socket to non blocking mode.\n");
280 close(fd);
281 return SN_ERR_INTERNAL;
282 }
283
284 if (be->options & PR_O_TCP_SRV_KA)
Simon Hormande072bd2011-06-24 15:11:37 +0900285 setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, &one, sizeof(one));
Willy Tarreau9650f372009-08-16 14:02:45 +0200286
287 if (be->options & PR_O_TCP_NOLING)
Willy Tarreauf6f82252011-11-30 18:02:24 +0100288 si->flags |= SI_FL_NOLINGER;
Willy Tarreau9650f372009-08-16 14:02:45 +0200289
290 /* allow specific binding :
291 * - server-specific at first
292 * - proxy-specific next
293 */
294 if (srv != NULL && srv->state & SRV_BIND_SRC) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200295 int ret, flags = 0;
296
Willy Tarreau9650f372009-08-16 14:02:45 +0200297 switch (srv->state & SRV_TPROXY_MASK) {
298 case SRV_TPROXY_ADDR:
Willy Tarreau9650f372009-08-16 14:02:45 +0200299 case SRV_TPROXY_CLI:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200300 flags = 3;
301 break;
Willy Tarreau9650f372009-08-16 14:02:45 +0200302 case SRV_TPROXY_CIP:
Willy Tarreau090466c2009-09-07 11:51:47 +0200303 case SRV_TPROXY_DYN:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200304 flags = 1;
Willy Tarreau9650f372009-08-16 14:02:45 +0200305 break;
306 }
Willy Tarreaub1d67742010-03-29 19:36:59 +0200307
Willy Tarreau9650f372009-08-16 14:02:45 +0200308#ifdef SO_BINDTODEVICE
309 /* Note: this might fail if not CAP_NET_RAW */
310 if (srv->iface_name)
311 setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, srv->iface_name, srv->iface_len + 1);
312#endif
313
314 if (srv->sport_range) {
315 int attempts = 10; /* should be more than enough to find a spare port */
David du Colombier6f5ccb12011-03-10 22:26:24 +0100316 struct sockaddr_storage src;
Willy Tarreau9650f372009-08-16 14:02:45 +0200317
318 ret = 1;
319 src = srv->source_addr;
320
321 do {
322 /* note: in case of retry, we may have to release a previously
323 * allocated port, hence this loop's construct.
324 */
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200325 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
326 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200327
328 if (!attempts)
329 break;
330 attempts--;
331
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200332 fdinfo[fd].local_port = port_range_alloc_port(srv->sport_range);
333 if (!fdinfo[fd].local_port)
Willy Tarreau9650f372009-08-16 14:02:45 +0200334 break;
335
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200336 fdinfo[fd].port_range = srv->sport_range;
Willy Tarreau86ad42c2011-08-27 12:29:07 +0200337 set_host_port(&src, fdinfo[fd].local_port);
Willy Tarreau9650f372009-08-16 14:02:45 +0200338
Willy Tarreau6471afb2011-09-23 10:54:59 +0200339 ret = tcp_bind_socket(fd, flags, &src, &si->addr.from);
Willy Tarreau9650f372009-08-16 14:02:45 +0200340 } while (ret != 0); /* binding NOK */
341 }
342 else {
Willy Tarreau6471afb2011-09-23 10:54:59 +0200343 ret = tcp_bind_socket(fd, flags, &srv->source_addr, &si->addr.from);
Willy Tarreau9650f372009-08-16 14:02:45 +0200344 }
345
346 if (ret) {
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200347 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
348 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200349 close(fd);
350
351 if (ret == 1) {
352 Alert("Cannot bind to source address before connect() for server %s/%s. Aborting.\n",
353 be->id, srv->id);
354 send_log(be, LOG_EMERG,
355 "Cannot bind to source address before connect() for server %s/%s.\n",
356 be->id, srv->id);
357 } else {
358 Alert("Cannot bind to tproxy source address before connect() for server %s/%s. Aborting.\n",
359 be->id, srv->id);
360 send_log(be, LOG_EMERG,
361 "Cannot bind to tproxy source address before connect() for server %s/%s.\n",
362 be->id, srv->id);
363 }
364 return SN_ERR_RESOURCE;
365 }
366 }
367 else if (be->options & PR_O_BIND_SRC) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200368 int ret, flags = 0;
369
Willy Tarreau9650f372009-08-16 14:02:45 +0200370 switch (be->options & PR_O_TPXY_MASK) {
371 case PR_O_TPXY_ADDR:
Willy Tarreau9650f372009-08-16 14:02:45 +0200372 case PR_O_TPXY_CLI:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200373 flags = 3;
374 break;
Willy Tarreau9650f372009-08-16 14:02:45 +0200375 case PR_O_TPXY_CIP:
Willy Tarreau090466c2009-09-07 11:51:47 +0200376 case PR_O_TPXY_DYN:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200377 flags = 1;
Willy Tarreau9650f372009-08-16 14:02:45 +0200378 break;
379 }
Willy Tarreaub1d67742010-03-29 19:36:59 +0200380
Willy Tarreau9650f372009-08-16 14:02:45 +0200381#ifdef SO_BINDTODEVICE
382 /* Note: this might fail if not CAP_NET_RAW */
383 if (be->iface_name)
384 setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, be->iface_name, be->iface_len + 1);
385#endif
Willy Tarreau6471afb2011-09-23 10:54:59 +0200386 ret = tcp_bind_socket(fd, flags, &be->source_addr, &si->addr.from);
Willy Tarreau9650f372009-08-16 14:02:45 +0200387 if (ret) {
388 close(fd);
389 if (ret == 1) {
390 Alert("Cannot bind to source address before connect() for proxy %s. Aborting.\n",
391 be->id);
392 send_log(be, LOG_EMERG,
393 "Cannot bind to source address before connect() for proxy %s.\n",
394 be->id);
395 } else {
396 Alert("Cannot bind to tproxy source address before connect() for proxy %s. Aborting.\n",
397 be->id);
398 send_log(be, LOG_EMERG,
399 "Cannot bind to tproxy source address before connect() for proxy %s.\n",
400 be->id);
401 }
402 return SN_ERR_RESOURCE;
403 }
404 }
405
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400406#if defined(TCP_QUICKACK)
Willy Tarreau9650f372009-08-16 14:02:45 +0200407 /* disabling tcp quick ack now allows the first request to leave the
408 * machine with the first ACK. We only do this if there are pending
409 * data in the buffer.
410 */
Willy Tarreau572bf902012-07-02 17:01:20 +0200411 if ((be->options2 & PR_O2_SMARTCON) && si->ob->buf.o)
Simon Hormande072bd2011-06-24 15:11:37 +0900412 setsockopt(fd, IPPROTO_TCP, TCP_QUICKACK, &zero, sizeof(zero));
Willy Tarreau9650f372009-08-16 14:02:45 +0200413#endif
414
Willy Tarreaue803de22010-01-21 17:43:04 +0100415 if (global.tune.server_sndbuf)
416 setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &global.tune.server_sndbuf, sizeof(global.tune.server_sndbuf));
417
418 if (global.tune.server_rcvbuf)
419 setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &global.tune.server_rcvbuf, sizeof(global.tune.server_rcvbuf));
420
Willy Tarreau9b061e32012-04-07 18:03:52 +0200421 si->flags &= ~SI_FL_FROM_SET;
Willy Tarreau96596ae2012-06-08 22:57:36 +0200422
423 si->conn.peeraddr = (struct sockaddr *)&si->addr.to;
424 si->conn.peerlen = get_addr_len(&si->addr.to);
425
426 if ((connect(fd, si->conn.peeraddr, si->conn.peerlen) == -1) &&
Willy Tarreau9650f372009-08-16 14:02:45 +0200427 (errno != EINPROGRESS) && (errno != EALREADY) && (errno != EISCONN)) {
428
429 if (errno == EAGAIN || errno == EADDRINUSE) {
430 char *msg;
431 if (errno == EAGAIN) /* no free ports left, try again later */
432 msg = "no free ports";
433 else
434 msg = "local address already in use";
435
436 qfprintf(stderr,"Cannot connect: %s.\n",msg);
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200437 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
438 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200439 close(fd);
440 send_log(be, LOG_EMERG,
441 "Connect() failed for server %s/%s: %s.\n",
442 be->id, srv->id, msg);
443 return SN_ERR_RESOURCE;
444 } else if (errno == ETIMEDOUT) {
445 //qfprintf(stderr,"Connect(): ETIMEDOUT");
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200446 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
447 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200448 close(fd);
449 return SN_ERR_SRVTO;
450 } else {
451 // (errno == ECONNREFUSED || errno == ENETUNREACH || errno == EACCES || errno == EPERM)
452 //qfprintf(stderr,"Connect(): %d", errno);
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200453 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
454 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200455 close(fd);
456 return SN_ERR_SRVCL;
457 }
458 }
459
William Lallemandb7ff6a32012-03-02 14:35:21 +0100460 /* needs src ip/port for logging */
Willy Tarreau9b061e32012-04-07 18:03:52 +0200461 if (si->flags & SI_FL_SRC_ADDR)
Willy Tarreau59b94792012-05-11 16:16:40 +0200462 si_get_from_addr(si);
William Lallemandb7ff6a32012-03-02 14:35:21 +0100463
Willy Tarreau80184712012-07-06 14:54:49 +0200464 fdtab[fd].owner = &si->conn;
Willy Tarreau9650f372009-08-16 14:02:45 +0200465 fdtab[fd].flags = FD_FL_TCP | FD_FL_TCP_NODELAY;
Willy Tarreau505e34a2012-07-06 10:17:53 +0200466 si->conn.flags = CO_FL_WAIT_L4_CONN; /* connection in progress */
Willy Tarreaufd31e532012-07-23 18:24:25 +0200467 si->conn.flags |= CO_FL_NOTIFY_SI; /* we're on a stream_interface */
Willy Tarreau9650f372009-08-16 14:02:45 +0200468
Willy Tarreau076be252012-07-06 16:02:29 +0200469 /* Prepare to send a few handshakes related to the on-wire protocol. */
Willy Tarreau2c6be842012-07-06 17:12:34 +0200470 if (si->send_proxy_ofs)
471 si->conn.flags |= CO_FL_SI_SEND_PROXY;
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200472
Willy Tarreaud2274c62012-07-06 14:29:45 +0200473 fdtab[fd].iocb = conn_fd_handler;
Willy Tarreau9650f372009-08-16 14:02:45 +0200474 fd_insert(fd);
Willy Tarreauf9dabec2012-08-17 17:33:53 +0200475 conn_sock_want_send(&si->conn); /* for connect status */
Willy Tarreau8e21bb92012-08-24 22:40:29 +0200476 if (!channel_is_empty(si->ob))
Willy Tarreauf9dabec2012-08-17 17:33:53 +0200477 conn_data_want_send(&si->conn); /* prepare to send data if any */
Willy Tarreau9650f372009-08-16 14:02:45 +0200478
479 si->state = SI_ST_CON;
Willy Tarreau96199b12012-08-24 00:46:52 +0200480 if (si->conn.data->rcv_pipe && si->conn.data->snd_pipe)
481 si->flags |= SI_FL_CAP_SPLTCP; /* TCP supports splicing */
Willy Tarreau9650f372009-08-16 14:02:45 +0200482 si->exp = tick_add_ifset(now_ms, be->timeout.connect);
483
484 return SN_ERR_NONE; /* connection is OK */
485}
486
487
Willy Tarreau59b94792012-05-11 16:16:40 +0200488/*
489 * Retrieves the source address for the socket <fd>, with <dir> indicating
490 * if we're a listener (=0) or an initiator (!=0). It returns 0 in case of
491 * success, -1 in case of error. The socket's source address is stored in
492 * <sa> for <salen> bytes.
493 */
494int tcp_get_src(int fd, struct sockaddr *sa, socklen_t salen, int dir)
495{
496 if (dir)
497 return getsockname(fd, sa, &salen);
498 else
499 return getpeername(fd, sa, &salen);
500}
501
502
503/*
504 * Retrieves the original destination address for the socket <fd>, with <dir>
505 * indicating if we're a listener (=0) or an initiator (!=0). In the case of a
506 * listener, if the original destination address was translated, the original
507 * address is retrieved. It returns 0 in case of success, -1 in case of error.
508 * The socket's source address is stored in <sa> for <salen> bytes.
509 */
510int tcp_get_dst(int fd, struct sockaddr *sa, socklen_t salen, int dir)
511{
512 if (dir)
513 return getpeername(fd, sa, &salen);
514#if defined(TPROXY) && defined(SO_ORIGINAL_DST)
515 else if (getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) == 0)
516 return 0;
517#endif
518 else
519 return getsockname(fd, sa, &salen);
520}
521
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200522/* This is the callback which is set when a connection establishment is pending
523 * and we have nothing to send, or if we have an init function we want to call
Willy Tarreauafad0e02012-08-09 14:45:22 +0200524 * once the connection is established. It updates the FD polling status. It
525 * returns 0 if it fails in a fatal way or needs to poll to go further, otherwise
526 * it returns non-zero and removes itself from the connection's flags (the bit is
527 * provided in <flag> by the caller).
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200528 */
Willy Tarreau239d7182012-07-23 18:53:03 +0200529int tcp_connect_probe(struct connection *conn)
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200530{
Willy Tarreau239d7182012-07-23 18:53:03 +0200531 int fd = conn->t.sock.fd;
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200532
Willy Tarreau80184712012-07-06 14:54:49 +0200533 if (conn->flags & CO_FL_ERROR)
Willy Tarreauafad0e02012-08-09 14:45:22 +0200534 return 0;
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200535
Willy Tarreau80184712012-07-06 14:54:49 +0200536 if (!(conn->flags & CO_FL_WAIT_L4_CONN))
Willy Tarreau0b0c0972012-07-23 20:05:00 +0200537 return 1; /* strange we were called while ready */
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200538
Willy Tarreau2da156f2012-07-23 15:07:23 +0200539 /* stop here if we reached the end of data */
540 if ((fdtab[fd].ev & (FD_POLL_IN|FD_POLL_HUP)) == FD_POLL_HUP)
541 goto out_error;
542
Willy Tarreau2c6be842012-07-06 17:12:34 +0200543 /* We have no data to send to check the connection, and
544 * getsockopt() will not inform us whether the connection
545 * is still pending. So we'll reuse connect() to check the
546 * state of the socket. This has the advantage of giving us
547 * the following info :
548 * - error
549 * - connecting (EALREADY, EINPROGRESS)
550 * - connected (EISCONN, 0)
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200551 */
Willy Tarreau2c6be842012-07-06 17:12:34 +0200552 if ((connect(fd, conn->peeraddr, conn->peerlen) < 0)) {
Willy Tarreauf9dabec2012-08-17 17:33:53 +0200553 if (errno == EALREADY || errno == EINPROGRESS) {
554 conn_sock_stop_recv(conn);
555 conn_sock_poll_send(conn);
Willy Tarreau0b0c0972012-07-23 20:05:00 +0200556 return 0;
Willy Tarreauf9dabec2012-08-17 17:33:53 +0200557 }
Willy Tarreaua190d592012-05-20 18:35:19 +0200558
Willy Tarreau2c6be842012-07-06 17:12:34 +0200559 if (errno && errno != EISCONN)
Willy Tarreaua190d592012-05-20 18:35:19 +0200560 goto out_error;
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200561
Willy Tarreau2c6be842012-07-06 17:12:34 +0200562 /* otherwise we're connected */
Willy Tarreaua190d592012-05-20 18:35:19 +0200563 }
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200564
Willy Tarreau076be252012-07-06 16:02:29 +0200565 /* The FD is ready now, we'll mark the connection as complete and
566 * forward the event to the data layer which will update the stream
567 * interface flags.
Willy Tarreaua190d592012-05-20 18:35:19 +0200568 */
Willy Tarreau80184712012-07-06 14:54:49 +0200569 conn->flags &= ~CO_FL_WAIT_L4_CONN;
Willy Tarreau0b0c0972012-07-23 20:05:00 +0200570 return 1;
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200571
572 out_error:
Willy Tarreau0b0c0972012-07-23 20:05:00 +0200573 /* Write error on the file descriptor. Report it to the connection
574 * and disable polling on this FD.
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200575 */
576
Willy Tarreau80184712012-07-06 14:54:49 +0200577 conn->flags |= CO_FL_ERROR;
Willy Tarreauf9dabec2012-08-17 17:33:53 +0200578 conn_sock_stop_both(conn);
Willy Tarreauafad0e02012-08-09 14:45:22 +0200579 return 0;
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200580}
581
Willy Tarreau59b94792012-05-11 16:16:40 +0200582
Willy Tarreaue6b98942007-10-29 01:09:36 +0100583/* This function tries to bind a TCPv4/v6 listener. It may return a warning or
584 * an error message in <err> if the message is at most <errlen> bytes long
585 * (including '\0'). The return value is composed from ERR_ABORT, ERR_WARN,
586 * ERR_ALERT, ERR_RETRYABLE and ERR_FATAL. ERR_NONE indicates that everything
587 * was alright and that no message was returned. ERR_RETRYABLE means that an
588 * error occurred but that it may vanish after a retry (eg: port in use), and
Aman Guptad94991d2012-04-06 17:39:26 -0700589 * ERR_FATAL indicates a non-fixable error. ERR_WARN and ERR_ALERT do not alter
Willy Tarreaue6b98942007-10-29 01:09:36 +0100590 * the meaning of the error, but just indicate that a message is present which
591 * should be displayed with the respective level. Last, ERR_ABORT indicates
592 * that it's pointless to try to start other listeners. No error message is
593 * returned if errlen is NULL.
594 */
595int tcp_bind_listener(struct listener *listener, char *errmsg, int errlen)
596{
597 __label__ tcp_return, tcp_close_return;
598 int fd, err;
599 const char *msg = NULL;
600
601 /* ensure we never return garbage */
602 if (errmsg && errlen)
603 *errmsg = 0;
604
605 if (listener->state != LI_ASSIGNED)
606 return ERR_NONE; /* already bound */
607
608 err = ERR_NONE;
609
610 if ((fd = socket(listener->addr.ss_family, SOCK_STREAM, IPPROTO_TCP)) == -1) {
611 err |= ERR_RETRYABLE | ERR_ALERT;
612 msg = "cannot create listening socket";
613 goto tcp_return;
614 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100615
Willy Tarreaue6b98942007-10-29 01:09:36 +0100616 if (fd >= global.maxsock) {
617 err |= ERR_FATAL | ERR_ABORT | ERR_ALERT;
618 msg = "not enough free sockets (raise '-n' parameter)";
619 goto tcp_close_return;
620 }
621
Willy Tarreaufb14edc2009-06-14 15:24:37 +0200622 if (fcntl(fd, F_SETFL, O_NONBLOCK) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100623 err |= ERR_FATAL | ERR_ALERT;
624 msg = "cannot make socket non-blocking";
625 goto tcp_close_return;
626 }
627
Simon Hormande072bd2011-06-24 15:11:37 +0900628 if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100629 /* not fatal but should be reported */
630 msg = "cannot do so_reuseaddr";
631 err |= ERR_ALERT;
632 }
633
634 if (listener->options & LI_O_NOLINGER)
Simon Hormande072bd2011-06-24 15:11:37 +0900635 setsockopt(fd, SOL_SOCKET, SO_LINGER, &nolinger, sizeof(struct linger));
Willy Tarreauedcf6682008-11-30 23:15:34 +0100636
Willy Tarreaue6b98942007-10-29 01:09:36 +0100637#ifdef SO_REUSEPORT
638 /* OpenBSD supports this. As it's present in old libc versions of Linux,
639 * it might return an error that we will silently ignore.
640 */
Simon Hormande072bd2011-06-24 15:11:37 +0900641 setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &one, sizeof(one));
Willy Tarreaue6b98942007-10-29 01:09:36 +0100642#endif
Willy Tarreaub1e52e82008-01-13 14:49:51 +0100643#ifdef CONFIG_HAP_LINUX_TPROXY
David du Colombier65c17962012-07-13 14:34:59 +0200644 if (listener->options & LI_O_FOREIGN) {
645 switch (listener->addr.ss_family) {
646 case AF_INET:
647 if ((setsockopt(fd, SOL_IP, IP_TRANSPARENT, &one, sizeof(one)) == -1)
648 && (setsockopt(fd, SOL_IP, IP_FREEBIND, &one, sizeof(one)) == -1)) {
649 msg = "cannot make listening socket transparent";
650 err |= ERR_ALERT;
651 }
652 break;
653 case AF_INET6:
654 if (setsockopt(fd, SOL_IPV6, IPV6_TRANSPARENT, &one, sizeof(one)) == -1) {
655 msg = "cannot make listening socket transparent";
656 err |= ERR_ALERT;
657 }
658 break;
659 }
Willy Tarreaub1e52e82008-01-13 14:49:51 +0100660 }
661#endif
Willy Tarreau5e6e2042009-02-04 17:19:29 +0100662#ifdef SO_BINDTODEVICE
663 /* Note: this might fail if not CAP_NET_RAW */
664 if (listener->interface) {
665 if (setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE,
Willy Tarreau604e8302009-03-06 00:48:23 +0100666 listener->interface, strlen(listener->interface) + 1) == -1) {
Willy Tarreau5e6e2042009-02-04 17:19:29 +0100667 msg = "cannot bind listener to device";
668 err |= ERR_WARN;
669 }
670 }
671#endif
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400672#if defined(TCP_MAXSEG)
Willy Tarreau48a7e722010-12-24 15:26:39 +0100673 if (listener->maxseg > 0) {
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400674 if (setsockopt(fd, IPPROTO_TCP, TCP_MAXSEG,
Willy Tarreaube1b9182009-06-14 18:48:19 +0200675 &listener->maxseg, sizeof(listener->maxseg)) == -1) {
676 msg = "cannot set MSS";
677 err |= ERR_WARN;
678 }
679 }
680#endif
Willy Tarreaucb6cd432009-10-13 07:34:14 +0200681#if defined(TCP_DEFER_ACCEPT)
682 if (listener->options & LI_O_DEF_ACCEPT) {
683 /* defer accept by up to one second */
684 int accept_delay = 1;
685 if (setsockopt(fd, IPPROTO_TCP, TCP_DEFER_ACCEPT, &accept_delay, sizeof(accept_delay)) == -1) {
686 msg = "cannot enable DEFER_ACCEPT";
687 err |= ERR_WARN;
688 }
689 }
690#endif
Willy Tarreaue6b98942007-10-29 01:09:36 +0100691 if (bind(fd, (struct sockaddr *)&listener->addr, listener->proto->sock_addrlen) == -1) {
692 err |= ERR_RETRYABLE | ERR_ALERT;
693 msg = "cannot bind socket";
694 goto tcp_close_return;
695 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100696
Willy Tarreauc73ce2b2008-01-06 10:55:10 +0100697 if (listen(fd, listener->backlog ? listener->backlog : listener->maxconn) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100698 err |= ERR_RETRYABLE | ERR_ALERT;
699 msg = "cannot listen to socket";
700 goto tcp_close_return;
701 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100702
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400703#if defined(TCP_QUICKACK)
Willy Tarreau9ea05a72009-06-14 12:07:01 +0200704 if (listener->options & LI_O_NOQUICKACK)
Simon Hormande072bd2011-06-24 15:11:37 +0900705 setsockopt(fd, IPPROTO_TCP, TCP_QUICKACK, &zero, sizeof(zero));
Willy Tarreau9ea05a72009-06-14 12:07:01 +0200706#endif
707
Willy Tarreaue6b98942007-10-29 01:09:36 +0100708 /* the socket is ready */
709 listener->fd = fd;
710 listener->state = LI_LISTEN;
711
Willy Tarreaueabf3132008-08-29 23:36:51 +0200712 fdtab[fd].owner = listener; /* reference the listener instead of a task */
Willy Tarreaueb472682010-05-28 18:46:57 +0200713 fdtab[fd].flags = FD_FL_TCP | ((listener->options & LI_O_NOLINGER) ? FD_FL_TCP_NOLING : 0);
Willy Tarreauaece46a2012-07-06 12:25:58 +0200714 fdtab[fd].iocb = listener->proto->accept;
Willy Tarreaueb472682010-05-28 18:46:57 +0200715 fd_insert(fd);
716
Willy Tarreaue6b98942007-10-29 01:09:36 +0100717 tcp_return:
Cyril Bonté43ba1b32010-11-01 19:26:01 +0100718 if (msg && errlen) {
719 char pn[INET6_ADDRSTRLEN];
720
Willy Tarreau631f01c2011-09-05 00:36:48 +0200721 addr_to_str(&listener->addr, pn, sizeof(pn));
722 snprintf(errmsg, errlen, "%s [%s:%d]", msg, pn, get_host_port(&listener->addr));
Cyril Bonté43ba1b32010-11-01 19:26:01 +0100723 }
Willy Tarreaue6b98942007-10-29 01:09:36 +0100724 return err;
725
726 tcp_close_return:
727 close(fd);
728 goto tcp_return;
729}
730
731/* This function creates all TCP sockets bound to the protocol entry <proto>.
732 * It is intended to be used as the protocol's bind_all() function.
733 * The sockets will be registered but not added to any fd_set, in order not to
734 * loose them across the fork(). A call to enable_all_listeners() is needed
735 * to complete initialization. The return value is composed from ERR_*.
736 */
Emeric Bruncf20bf12010-10-22 16:06:11 +0200737static int tcp_bind_listeners(struct protocol *proto, char *errmsg, int errlen)
Willy Tarreaue6b98942007-10-29 01:09:36 +0100738{
739 struct listener *listener;
740 int err = ERR_NONE;
741
742 list_for_each_entry(listener, &proto->listeners, proto_list) {
Emeric Bruncf20bf12010-10-22 16:06:11 +0200743 err |= tcp_bind_listener(listener, errmsg, errlen);
744 if (err & ERR_ABORT)
Willy Tarreaue6b98942007-10-29 01:09:36 +0100745 break;
746 }
747
748 return err;
749}
750
751/* Add listener to the list of tcpv4 listeners. The listener's state
752 * is automatically updated from LI_INIT to LI_ASSIGNED. The number of
753 * listeners is updated. This is the function to use to add a new listener.
754 */
755void tcpv4_add_listener(struct listener *listener)
756{
757 if (listener->state != LI_INIT)
758 return;
759 listener->state = LI_ASSIGNED;
760 listener->proto = &proto_tcpv4;
761 LIST_ADDQ(&proto_tcpv4.listeners, &listener->proto_list);
762 proto_tcpv4.nb_listeners++;
763}
764
765/* Add listener to the list of tcpv4 listeners. The listener's state
766 * is automatically updated from LI_INIT to LI_ASSIGNED. The number of
767 * listeners is updated. This is the function to use to add a new listener.
768 */
769void tcpv6_add_listener(struct listener *listener)
770{
771 if (listener->state != LI_INIT)
772 return;
773 listener->state = LI_ASSIGNED;
774 listener->proto = &proto_tcpv6;
775 LIST_ADDQ(&proto_tcpv6.listeners, &listener->proto_list);
776 proto_tcpv6.nb_listeners++;
777}
778
Willy Tarreauedcf6682008-11-30 23:15:34 +0100779/* This function performs the TCP request analysis on the current request. It
780 * returns 1 if the processing can continue on next analysers, or zero if it
781 * needs more data, encounters an error, or wants to immediately abort the
Willy Tarreaufb356202010-08-03 14:02:05 +0200782 * request. It relies on buffers flags, and updates s->req->analysers. The
783 * function may be called for frontend rules and backend rules. It only relies
784 * on the backend pointer so this works for both cases.
Willy Tarreauedcf6682008-11-30 23:15:34 +0100785 */
Willy Tarreau7421efb2012-07-02 15:11:27 +0200786int tcp_inspect_request(struct session *s, struct channel *req, int an_bit)
Willy Tarreauedcf6682008-11-30 23:15:34 +0100787{
788 struct tcp_rule *rule;
Willy Tarreaud1f96522010-08-03 19:34:32 +0200789 struct stksess *ts;
790 struct stktable *t;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100791 int partial;
792
Willy Tarreau02d6cfc2012-03-01 18:19:58 +0100793 DPRINTF(stderr,"[%u] %s: session=%p b=%p, exp(r,w)=%u,%u bf=%08x bh=%d analysers=%02x\n",
Willy Tarreauedcf6682008-11-30 23:15:34 +0100794 now_ms, __FUNCTION__,
795 s,
796 req,
797 req->rex, req->wex,
798 req->flags,
Willy Tarreau02d6cfc2012-03-01 18:19:58 +0100799 req->i,
Willy Tarreauedcf6682008-11-30 23:15:34 +0100800 req->analysers);
801
Willy Tarreauedcf6682008-11-30 23:15:34 +0100802 /* We don't know whether we have enough data, so must proceed
803 * this way :
804 * - iterate through all rules in their declaration order
805 * - if one rule returns MISS, it means the inspect delay is
806 * not over yet, then return immediately, otherwise consider
807 * it as a non-match.
808 * - if one rule returns OK, then return OK
809 * - if one rule returns KO, then return KO
810 */
811
Willy Tarreaub824b002010-09-29 16:36:16 +0200812 if (req->flags & (BF_SHUTR|BF_FULL) || !s->be->tcp_req.inspect_delay || tick_is_expired(req->analyse_exp, now_ms))
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200813 partial = SMP_OPT_FINAL;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100814 else
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200815 partial = 0;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100816
Willy Tarreaufb356202010-08-03 14:02:05 +0200817 list_for_each_entry(rule, &s->be->tcp_req.inspect_rules, list) {
Willy Tarreauedcf6682008-11-30 23:15:34 +0100818 int ret = ACL_PAT_PASS;
819
820 if (rule->cond) {
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200821 ret = acl_exec_cond(rule->cond, s->be, s, &s->txn, SMP_OPT_DIR_REQ | partial);
Willy Tarreauedcf6682008-11-30 23:15:34 +0100822 if (ret == ACL_PAT_MISS) {
Willy Tarreau520d95e2009-09-19 21:04:57 +0200823 buffer_dont_connect(req);
Willy Tarreauedcf6682008-11-30 23:15:34 +0100824 /* just set the request timeout once at the beginning of the request */
Willy Tarreaufb356202010-08-03 14:02:05 +0200825 if (!tick_isset(req->analyse_exp) && s->be->tcp_req.inspect_delay)
826 req->analyse_exp = tick_add_ifset(now_ms, s->be->tcp_req.inspect_delay);
Willy Tarreauedcf6682008-11-30 23:15:34 +0100827 return 0;
828 }
829
830 ret = acl_pass(ret);
831 if (rule->cond->pol == ACL_COND_UNLESS)
832 ret = !ret;
833 }
834
835 if (ret) {
836 /* we have a matching rule. */
837 if (rule->action == TCP_ACT_REJECT) {
838 buffer_abort(req);
839 buffer_abort(s->rep);
840 req->analysers = 0;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +0200841
Willy Tarreau7d0aaf32011-03-10 23:25:56 +0100842 s->be->be_counters.denied_req++;
843 s->fe->fe_counters.denied_req++;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +0200844 if (s->listener->counters)
Willy Tarreau23968d82010-05-23 23:50:44 +0200845 s->listener->counters->denied_req++;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +0200846
Willy Tarreauedcf6682008-11-30 23:15:34 +0100847 if (!(s->flags & SN_ERR_MASK))
848 s->flags |= SN_ERR_PRXCOND;
849 if (!(s->flags & SN_FINST_MASK))
850 s->flags |= SN_FINST_R;
851 return 0;
852 }
Willy Tarreau56123282010-08-06 19:06:56 +0200853 else if (rule->action == TCP_ACT_TRK_SC1) {
854 if (!s->stkctr1_entry) {
855 /* only the first valid track-sc1 directive applies.
Willy Tarreaud1f96522010-08-03 19:34:32 +0200856 * Also, note that right now we can only track SRC so we
857 * don't check how to get the key, but later we may need
858 * to consider rule->act_prm->trk_ctr.type.
859 */
860 t = rule->act_prm.trk_ctr.table.t;
David du Colombier4f92d322011-03-24 11:09:31 +0100861 ts = stktable_get_entry(t, tcp_src_to_stktable_key(s));
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200862 if (ts) {
Willy Tarreau56123282010-08-06 19:06:56 +0200863 session_track_stkctr1(s, t, ts);
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200864 if (s->fe != s->be)
865 s->flags |= SN_BE_TRACK_SC1;
866 }
Willy Tarreaud1f96522010-08-03 19:34:32 +0200867 }
868 }
Willy Tarreau56123282010-08-06 19:06:56 +0200869 else if (rule->action == TCP_ACT_TRK_SC2) {
870 if (!s->stkctr2_entry) {
871 /* only the first valid track-sc2 directive applies.
Willy Tarreaud1f96522010-08-03 19:34:32 +0200872 * Also, note that right now we can only track SRC so we
873 * don't check how to get the key, but later we may need
874 * to consider rule->act_prm->trk_ctr.type.
875 */
876 t = rule->act_prm.trk_ctr.table.t;
David du Colombier4f92d322011-03-24 11:09:31 +0100877 ts = stktable_get_entry(t, tcp_src_to_stktable_key(s));
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200878 if (ts) {
Willy Tarreau56123282010-08-06 19:06:56 +0200879 session_track_stkctr2(s, t, ts);
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200880 if (s->fe != s->be)
881 s->flags |= SN_BE_TRACK_SC2;
882 }
Willy Tarreaud1f96522010-08-03 19:34:32 +0200883 }
884 }
885 else {
Willy Tarreauedcf6682008-11-30 23:15:34 +0100886 /* otherwise accept */
Willy Tarreaud1f96522010-08-03 19:34:32 +0200887 break;
888 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100889 }
890 }
891
892 /* if we get there, it means we have no rule which matches, or
893 * we have an explicit accept, so we apply the default accept.
894 */
Willy Tarreau3a816292009-07-07 10:55:49 +0200895 req->analysers &= ~an_bit;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100896 req->analyse_exp = TICK_ETERNITY;
897 return 1;
898}
899
Emeric Brun97679e72010-09-23 17:56:44 +0200900/* This function performs the TCP response analysis on the current response. It
901 * returns 1 if the processing can continue on next analysers, or zero if it
902 * needs more data, encounters an error, or wants to immediately abort the
903 * response. It relies on buffers flags, and updates s->rep->analysers. The
904 * function may be called for backend rules.
905 */
Willy Tarreau7421efb2012-07-02 15:11:27 +0200906int tcp_inspect_response(struct session *s, struct channel *rep, int an_bit)
Emeric Brun97679e72010-09-23 17:56:44 +0200907{
908 struct tcp_rule *rule;
909 int partial;
910
Willy Tarreau02d6cfc2012-03-01 18:19:58 +0100911 DPRINTF(stderr,"[%u] %s: session=%p b=%p, exp(r,w)=%u,%u bf=%08x bh=%d analysers=%02x\n",
Emeric Brun97679e72010-09-23 17:56:44 +0200912 now_ms, __FUNCTION__,
913 s,
914 rep,
915 rep->rex, rep->wex,
916 rep->flags,
Willy Tarreau02d6cfc2012-03-01 18:19:58 +0100917 rep->i,
Emeric Brun97679e72010-09-23 17:56:44 +0200918 rep->analysers);
919
920 /* We don't know whether we have enough data, so must proceed
921 * this way :
922 * - iterate through all rules in their declaration order
923 * - if one rule returns MISS, it means the inspect delay is
924 * not over yet, then return immediately, otherwise consider
925 * it as a non-match.
926 * - if one rule returns OK, then return OK
927 * - if one rule returns KO, then return KO
928 */
929
930 if (rep->flags & BF_SHUTR || tick_is_expired(rep->analyse_exp, now_ms))
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200931 partial = SMP_OPT_FINAL;
Emeric Brun97679e72010-09-23 17:56:44 +0200932 else
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200933 partial = 0;
Emeric Brun97679e72010-09-23 17:56:44 +0200934
935 list_for_each_entry(rule, &s->be->tcp_rep.inspect_rules, list) {
936 int ret = ACL_PAT_PASS;
937
938 if (rule->cond) {
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200939 ret = acl_exec_cond(rule->cond, s->be, s, &s->txn, SMP_OPT_DIR_RES | partial);
Emeric Brun97679e72010-09-23 17:56:44 +0200940 if (ret == ACL_PAT_MISS) {
941 /* just set the analyser timeout once at the beginning of the response */
942 if (!tick_isset(rep->analyse_exp) && s->be->tcp_rep.inspect_delay)
943 rep->analyse_exp = tick_add_ifset(now_ms, s->be->tcp_rep.inspect_delay);
944 return 0;
945 }
946
947 ret = acl_pass(ret);
948 if (rule->cond->pol == ACL_COND_UNLESS)
949 ret = !ret;
950 }
951
952 if (ret) {
953 /* we have a matching rule. */
954 if (rule->action == TCP_ACT_REJECT) {
955 buffer_abort(rep);
956 buffer_abort(s->req);
957 rep->analysers = 0;
958
Willy Tarreau7d0aaf32011-03-10 23:25:56 +0100959 s->be->be_counters.denied_resp++;
960 s->fe->fe_counters.denied_resp++;
Emeric Brun97679e72010-09-23 17:56:44 +0200961 if (s->listener->counters)
962 s->listener->counters->denied_resp++;
963
964 if (!(s->flags & SN_ERR_MASK))
965 s->flags |= SN_ERR_PRXCOND;
966 if (!(s->flags & SN_FINST_MASK))
967 s->flags |= SN_FINST_D;
968 return 0;
969 }
970 else {
971 /* otherwise accept */
972 break;
973 }
974 }
975 }
976
977 /* if we get there, it means we have no rule which matches, or
978 * we have an explicit accept, so we apply the default accept.
979 */
980 rep->analysers &= ~an_bit;
981 rep->analyse_exp = TICK_ETERNITY;
982 return 1;
983}
984
985
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200986/* This function performs the TCP layer4 analysis on the current request. It
987 * returns 0 if a reject rule matches, otherwise 1 if either an accept rule
988 * matches or if no more rule matches. It can only use rules which don't need
989 * any data.
990 */
991int tcp_exec_req_rules(struct session *s)
992{
993 struct tcp_rule *rule;
Willy Tarreauf059a0f2010-08-03 16:29:52 +0200994 struct stksess *ts;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200995 struct stktable *t = NULL;
996 int result = 1;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200997 int ret;
998
999 list_for_each_entry(rule, &s->fe->tcp_req.l4_rules, list) {
1000 ret = ACL_PAT_PASS;
1001
1002 if (rule->cond) {
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001003 ret = acl_exec_cond(rule->cond, s->fe, s, NULL, SMP_OPT_DIR_REQ|SMP_OPT_FINAL);
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001004 ret = acl_pass(ret);
1005 if (rule->cond->pol == ACL_COND_UNLESS)
1006 ret = !ret;
1007 }
1008
1009 if (ret) {
1010 /* we have a matching rule. */
1011 if (rule->action == TCP_ACT_REJECT) {
Willy Tarreau7d0aaf32011-03-10 23:25:56 +01001012 s->fe->fe_counters.denied_conn++;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001013 if (s->listener->counters)
Willy Tarreau2799e982010-06-05 15:43:21 +02001014 s->listener->counters->denied_conn++;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001015
1016 if (!(s->flags & SN_ERR_MASK))
1017 s->flags |= SN_ERR_PRXCOND;
1018 if (!(s->flags & SN_FINST_MASK))
1019 s->flags |= SN_FINST_R;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001020 result = 0;
1021 break;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001022 }
Willy Tarreau56123282010-08-06 19:06:56 +02001023 else if (rule->action == TCP_ACT_TRK_SC1) {
1024 if (!s->stkctr1_entry) {
1025 /* only the first valid track-sc1 directive applies.
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001026 * Also, note that right now we can only track SRC so we
1027 * don't check how to get the key, but later we may need
1028 * to consider rule->act_prm->trk_ctr.type.
1029 */
1030 t = rule->act_prm.trk_ctr.table.t;
David du Colombier4f92d322011-03-24 11:09:31 +01001031 ts = stktable_get_entry(t, tcp_src_to_stktable_key(s));
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001032 if (ts)
Willy Tarreau56123282010-08-06 19:06:56 +02001033 session_track_stkctr1(s, t, ts);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001034 }
1035 }
Willy Tarreau56123282010-08-06 19:06:56 +02001036 else if (rule->action == TCP_ACT_TRK_SC2) {
1037 if (!s->stkctr2_entry) {
1038 /* only the first valid track-sc2 directive applies.
Willy Tarreauf059a0f2010-08-03 16:29:52 +02001039 * Also, note that right now we can only track SRC so we
1040 * don't check how to get the key, but later we may need
1041 * to consider rule->act_prm->trk_ctr.type.
1042 */
1043 t = rule->act_prm.trk_ctr.table.t;
David du Colombier4f92d322011-03-24 11:09:31 +01001044 ts = stktable_get_entry(t, tcp_src_to_stktable_key(s));
Willy Tarreauf059a0f2010-08-03 16:29:52 +02001045 if (ts)
Willy Tarreau56123282010-08-06 19:06:56 +02001046 session_track_stkctr2(s, t, ts);
Willy Tarreauf059a0f2010-08-03 16:29:52 +02001047 }
1048 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001049 else {
1050 /* otherwise it's an accept */
1051 break;
1052 }
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001053 }
1054 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001055 return result;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001056}
1057
Emeric Brun97679e72010-09-23 17:56:44 +02001058/* Parse a tcp-response rule. Return a negative value in case of failure */
1059static int tcp_parse_response_rule(char **args, int arg, int section_type,
1060 struct proxy *curpx, struct proxy *defpx,
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001061 struct tcp_rule *rule, char **err)
Emeric Brun97679e72010-09-23 17:56:44 +02001062{
1063 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001064 memprintf(err, "%s %s is only allowed in 'backend' sections",
1065 args[0], args[1]);
Emeric Brun97679e72010-09-23 17:56:44 +02001066 return -1;
1067 }
1068
1069 if (strcmp(args[arg], "accept") == 0) {
1070 arg++;
1071 rule->action = TCP_ACT_ACCEPT;
1072 }
1073 else if (strcmp(args[arg], "reject") == 0) {
1074 arg++;
1075 rule->action = TCP_ACT_REJECT;
1076 }
1077 else {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001078 memprintf(err,
1079 "'%s %s' expects 'accept' or 'reject' in %s '%s' (got '%s')",
1080 args[0], args[1], proxy_type_str(curpx), curpx->id, args[arg]);
Emeric Brun97679e72010-09-23 17:56:44 +02001081 return -1;
1082 }
1083
1084 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001085 if ((rule->cond = build_acl_cond(NULL, 0, curpx, (const char **)args+arg, err)) == NULL) {
1086 memprintf(err,
1087 "'%s %s %s' : error detected in %s '%s' while parsing '%s' condition : %s",
1088 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg], *err);
Emeric Brun97679e72010-09-23 17:56:44 +02001089 return -1;
1090 }
1091 }
1092 else if (*args[arg]) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001093 memprintf(err,
1094 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (got '%s')",
Emeric Brun97679e72010-09-23 17:56:44 +02001095 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
1096 return -1;
1097 }
1098 return 0;
1099}
1100
1101
1102
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001103/* Parse a tcp-request rule. Return a negative value in case of failure */
1104static int tcp_parse_request_rule(char **args, int arg, int section_type,
1105 struct proxy *curpx, struct proxy *defpx,
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001106 struct tcp_rule *rule, char **err)
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001107{
1108 if (curpx == defpx) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001109 memprintf(err, "%s %s is not allowed in 'defaults' sections",
1110 args[0], args[1]);
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001111 return -1;
1112 }
1113
1114 if (!strcmp(args[arg], "accept")) {
1115 arg++;
1116 rule->action = TCP_ACT_ACCEPT;
1117 }
1118 else if (!strcmp(args[arg], "reject")) {
1119 arg++;
1120 rule->action = TCP_ACT_REJECT;
1121 }
Willy Tarreau56123282010-08-06 19:06:56 +02001122 else if (strcmp(args[arg], "track-sc1") == 0) {
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001123 int ret;
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001124 int kw = arg;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001125
1126 arg++;
1127 ret = parse_track_counters(args, &arg, section_type, curpx,
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001128 &rule->act_prm.trk_ctr, defpx, err);
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001129
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001130 if (ret < 0) { /* nb: warnings are not handled yet */
1131 memprintf(err,
1132 "'%s %s %s' : %s in %s '%s'",
1133 args[0], args[1], args[kw], *err, proxy_type_str(curpx), curpx->id);
1134 return ret;
1135 }
Willy Tarreau56123282010-08-06 19:06:56 +02001136 rule->action = TCP_ACT_TRK_SC1;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001137 }
Willy Tarreau56123282010-08-06 19:06:56 +02001138 else if (strcmp(args[arg], "track-sc2") == 0) {
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001139 int ret;
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001140 int kw = arg;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001141
1142 arg++;
1143 ret = parse_track_counters(args, &arg, section_type, curpx,
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001144 &rule->act_prm.trk_ctr, defpx, err);
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001145
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001146 if (ret < 0) { /* nb: warnings are not handled yet */
1147 memprintf(err,
1148 "'%s %s %s' : %s in %s '%s'",
1149 args[0], args[1], args[kw], *err, proxy_type_str(curpx), curpx->id);
1150 return ret;
1151 }
Willy Tarreau56123282010-08-06 19:06:56 +02001152 rule->action = TCP_ACT_TRK_SC2;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001153 }
1154 else {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001155 memprintf(err,
1156 "'%s %s' expects 'accept', 'reject', 'track-sc1' "
1157 "or 'track-sc2' in %s '%s' (got '%s')",
1158 args[0], args[1], proxy_type_str(curpx), curpx->id, args[arg]);
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001159 return -1;
1160 }
1161
1162 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001163 if ((rule->cond = build_acl_cond(NULL, 0, curpx, (const char **)args+arg, err)) == NULL) {
1164 memprintf(err,
1165 "'%s %s %s' : error detected in %s '%s' while parsing '%s' condition : %s",
1166 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg], *err);
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001167 return -1;
1168 }
1169 }
1170 else if (*args[arg]) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001171 memprintf(err,
1172 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (got '%s')",
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001173 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
1174 return -1;
1175 }
1176 return 0;
1177}
1178
Emeric Brun97679e72010-09-23 17:56:44 +02001179/* This function should be called to parse a line starting with the "tcp-response"
1180 * keyword.
1181 */
1182static int tcp_parse_tcp_rep(char **args, int section_type, struct proxy *curpx,
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001183 struct proxy *defpx, char **err)
Emeric Brun97679e72010-09-23 17:56:44 +02001184{
1185 const char *ptr = NULL;
1186 unsigned int val;
Emeric Brun97679e72010-09-23 17:56:44 +02001187 int warn = 0;
1188 int arg;
1189 struct tcp_rule *rule;
1190
1191 if (!*args[1]) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001192 memprintf(err, "missing argument for '%s' in %s '%s'",
1193 args[0], proxy_type_str(curpx), curpx->id);
Emeric Brun97679e72010-09-23 17:56:44 +02001194 return -1;
1195 }
1196
1197 if (strcmp(args[1], "inspect-delay") == 0) {
1198 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001199 memprintf(err, "%s %s is only allowed in 'backend' sections",
1200 args[0], args[1]);
Emeric Brun97679e72010-09-23 17:56:44 +02001201 return -1;
1202 }
1203
1204 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001205 memprintf(err,
1206 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
1207 args[0], args[1], proxy_type_str(curpx), curpx->id);
1208 if (ptr)
1209 memprintf(err, "%s (unexpected character '%c')", *err, *ptr);
Emeric Brun97679e72010-09-23 17:56:44 +02001210 return -1;
1211 }
1212
1213 if (curpx->tcp_rep.inspect_delay) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001214 memprintf(err, "ignoring %s %s (was already defined) in %s '%s'",
1215 args[0], args[1], proxy_type_str(curpx), curpx->id);
Emeric Brun97679e72010-09-23 17:56:44 +02001216 return 1;
1217 }
1218 curpx->tcp_rep.inspect_delay = val;
1219 return 0;
1220 }
1221
Simon Hormande072bd2011-06-24 15:11:37 +09001222 rule = calloc(1, sizeof(*rule));
Emeric Brun97679e72010-09-23 17:56:44 +02001223 LIST_INIT(&rule->list);
1224 arg = 1;
1225
1226 if (strcmp(args[1], "content") == 0) {
1227 arg++;
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001228 if (tcp_parse_response_rule(args, arg, section_type, curpx, defpx, rule, err) < 0)
Emeric Brun97679e72010-09-23 17:56:44 +02001229 goto error;
1230
1231 if (rule->cond && (rule->cond->requires & ACL_USE_L6REQ_VOLATILE)) {
1232 struct acl *acl;
1233 const char *name;
1234
1235 acl = cond_find_require(rule->cond, ACL_USE_L6REQ_VOLATILE);
1236 name = acl ? acl->name : "(unknown)";
1237
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001238 memprintf(err,
1239 "acl '%s' involves some request-only criteria which will be ignored in '%s %s'",
1240 name, args[0], args[1]);
Emeric Brun97679e72010-09-23 17:56:44 +02001241 warn++;
1242 }
1243
1244 LIST_ADDQ(&curpx->tcp_rep.inspect_rules, &rule->list);
1245 }
1246 else {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001247 memprintf(err,
1248 "'%s' expects 'inspect-delay' or 'content' in %s '%s' (got '%s')",
1249 args[0], proxy_type_str(curpx), curpx->id, args[1]);
Emeric Brun97679e72010-09-23 17:56:44 +02001250 goto error;
1251 }
1252
1253 return warn;
1254 error:
1255 free(rule);
1256 return -1;
1257}
1258
1259
Willy Tarreaub6866442008-07-14 23:54:42 +02001260/* This function should be called to parse a line starting with the "tcp-request"
1261 * keyword.
1262 */
1263static int tcp_parse_tcp_req(char **args, int section_type, struct proxy *curpx,
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001264 struct proxy *defpx, char **err)
Willy Tarreaub6866442008-07-14 23:54:42 +02001265{
1266 const char *ptr = NULL;
Willy Tarreauc7e961e2008-08-17 17:13:47 +02001267 unsigned int val;
Willy Tarreau1a687942010-05-23 22:40:30 +02001268 int warn = 0;
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001269 int arg;
Willy Tarreau1a687942010-05-23 22:40:30 +02001270 struct tcp_rule *rule;
Willy Tarreaub6866442008-07-14 23:54:42 +02001271
1272 if (!*args[1]) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001273 if (curpx == defpx)
1274 memprintf(err, "missing argument for '%s' in defaults section", args[0]);
1275 else
1276 memprintf(err, "missing argument for '%s' in %s '%s'",
1277 args[0], proxy_type_str(curpx), curpx->id);
Willy Tarreaub6866442008-07-14 23:54:42 +02001278 return -1;
1279 }
1280
1281 if (!strcmp(args[1], "inspect-delay")) {
1282 if (curpx == defpx) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001283 memprintf(err, "%s %s is not allowed in 'defaults' sections",
1284 args[0], args[1]);
Willy Tarreaub6866442008-07-14 23:54:42 +02001285 return -1;
1286 }
1287
Willy Tarreaub6866442008-07-14 23:54:42 +02001288 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001289 memprintf(err,
1290 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
1291 args[0], args[1], proxy_type_str(curpx), curpx->id);
1292 if (ptr)
1293 memprintf(err, "%s (unexpected character '%c')", *err, *ptr);
Willy Tarreaub6866442008-07-14 23:54:42 +02001294 return -1;
1295 }
1296
1297 if (curpx->tcp_req.inspect_delay) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001298 memprintf(err, "ignoring %s %s (was already defined) in %s '%s'",
1299 args[0], args[1], proxy_type_str(curpx), curpx->id);
Willy Tarreaub6866442008-07-14 23:54:42 +02001300 return 1;
1301 }
1302 curpx->tcp_req.inspect_delay = val;
1303 return 0;
1304 }
1305
Simon Hormande072bd2011-06-24 15:11:37 +09001306 rule = calloc(1, sizeof(*rule));
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001307 LIST_INIT(&rule->list);
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001308 arg = 1;
1309
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001310 if (strcmp(args[1], "content") == 0) {
Willy Tarreaud1f96522010-08-03 19:34:32 +02001311 arg++;
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001312 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err) < 0)
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001313 goto error;
Willy Tarreaub6866442008-07-14 23:54:42 +02001314
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001315 if (rule->cond && (rule->cond->requires & ACL_USE_RTR_ANY)) {
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001316 struct acl *acl;
1317 const char *name;
1318
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001319 acl = cond_find_require(rule->cond, ACL_USE_RTR_ANY);
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001320 name = acl ? acl->name : "(unknown)";
1321
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001322 memprintf(err,
1323 "acl '%s' involves some response-only criteria which will be ignored in '%s %s'",
1324 name, args[0], args[1]);
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001325 warn++;
1326 }
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001327 LIST_ADDQ(&curpx->tcp_req.inspect_rules, &rule->list);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001328 }
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001329 else if (strcmp(args[1], "connection") == 0) {
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001330 arg++;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001331
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001332 if (!(curpx->cap & PR_CAP_FE)) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001333 memprintf(err, "%s %s is not allowed because %s %s is not a frontend",
1334 args[0], args[1], proxy_type_str(curpx), curpx->id);
Simon Horman6c54d8b2011-07-15 13:14:06 +09001335 goto error;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001336 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001337
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001338 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err) < 0)
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001339 goto error;
1340
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001341 if (rule->cond && (rule->cond->requires & (ACL_USE_RTR_ANY|ACL_USE_L6_ANY|ACL_USE_L7_ANY))) {
1342 struct acl *acl;
1343 const char *name;
Willy Tarreauf059a0f2010-08-03 16:29:52 +02001344
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001345 acl = cond_find_require(rule->cond, ACL_USE_RTR_ANY|ACL_USE_L6_ANY|ACL_USE_L7_ANY);
1346 name = acl ? acl->name : "(unknown)";
Willy Tarreauf059a0f2010-08-03 16:29:52 +02001347
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001348 if (acl->requires & (ACL_USE_L6_ANY|ACL_USE_L7_ANY)) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001349 memprintf(err,
1350 "'%s %s' may not reference acl '%s' which makes use of "
1351 "payload in %s '%s'. Please use '%s content' for this.",
1352 args[0], args[1], name, proxy_type_str(curpx), curpx->id, args[0]);
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001353 goto error;
1354 }
1355 if (acl->requires & ACL_USE_RTR_ANY)
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001356 memprintf(err,
1357 "acl '%s' involves some response-only criteria which will be ignored in '%s %s'",
1358 name, args[0], args[1]);
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001359 warn++;
1360 }
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001361 LIST_ADDQ(&curpx->tcp_req.l4_rules, &rule->list);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001362 }
Willy Tarreau1a687942010-05-23 22:40:30 +02001363 else {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001364 if (curpx == defpx)
1365 memprintf(err,
1366 "'%s' expects 'inspect-delay', 'connection', or 'content' in defaults section (got '%s')",
1367 args[0], args[1]);
1368 else
1369 memprintf(err,
1370 "'%s' expects 'inspect-delay', 'connection', or 'content' in %s '%s' (got '%s')",
1371 args[0], args[1], proxy_type_str(curpx), curpx->id);
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001372 goto error;
Willy Tarreau1a687942010-05-23 22:40:30 +02001373 }
1374
Willy Tarreau1a687942010-05-23 22:40:30 +02001375 return warn;
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001376 error:
1377 free(rule);
1378 return -1;
Willy Tarreaub6866442008-07-14 23:54:42 +02001379}
1380
Willy Tarreau645513a2010-05-24 20:55:15 +02001381
1382/************************************************************************/
Willy Tarreau32389b72012-04-23 23:13:20 +02001383/* All supported sample fetch functios must be declared here */
1384/************************************************************************/
1385
1386/* Fetch the request RDP cookie identified in the args, or any cookie if no arg
Willy Tarreau12785782012-04-27 21:37:17 +02001387 * is passed. It is usable both for ACL and for samples. Note: this decoder
Willy Tarreau32389b72012-04-23 23:13:20 +02001388 * only works with non-wrapping data. Accepts either 0 or 1 argument. Argument
1389 * is a string (cookie name), other types will lead to undefined behaviour.
1390 */
1391int
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001392smp_fetch_rdp_cookie(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau32389b72012-04-23 23:13:20 +02001393 const struct arg *args, struct sample *smp)
1394{
1395 int bleft;
1396 const unsigned char *data;
1397
1398 if (!l4 || !l4->req)
1399 return 0;
1400
1401 smp->flags = 0;
1402 smp->type = SMP_T_CSTR;
1403
Willy Tarreau572bf902012-07-02 17:01:20 +02001404 bleft = l4->req->buf.i;
Willy Tarreau32389b72012-04-23 23:13:20 +02001405 if (bleft <= 11)
1406 goto too_short;
1407
Willy Tarreau572bf902012-07-02 17:01:20 +02001408 data = (const unsigned char *)l4->req->buf.p + 11;
Willy Tarreau32389b72012-04-23 23:13:20 +02001409 bleft -= 11;
1410
1411 if (bleft <= 7)
1412 goto too_short;
1413
1414 if (strncasecmp((const char *)data, "Cookie:", 7) != 0)
1415 goto not_cookie;
1416
1417 data += 7;
1418 bleft -= 7;
1419
1420 while (bleft > 0 && *data == ' ') {
1421 data++;
1422 bleft--;
1423 }
1424
1425 if (args) {
1426
1427 if (bleft <= args->data.str.len)
1428 goto too_short;
1429
1430 if ((data[args->data.str.len] != '=') ||
1431 strncasecmp(args->data.str.str, (const char *)data, args->data.str.len) != 0)
1432 goto not_cookie;
1433
1434 data += args->data.str.len + 1;
1435 bleft -= args->data.str.len + 1;
1436 } else {
1437 while (bleft > 0 && *data != '=') {
1438 if (*data == '\r' || *data == '\n')
1439 goto not_cookie;
1440 data++;
1441 bleft--;
1442 }
1443
1444 if (bleft < 1)
1445 goto too_short;
1446
1447 if (*data != '=')
1448 goto not_cookie;
1449
1450 data++;
1451 bleft--;
1452 }
1453
1454 /* data points to cookie value */
1455 smp->data.str.str = (char *)data;
1456 smp->data.str.len = 0;
1457
1458 while (bleft > 0 && *data != '\r') {
1459 data++;
1460 bleft--;
1461 }
1462
1463 if (bleft < 2)
1464 goto too_short;
1465
1466 if (data[0] != '\r' || data[1] != '\n')
1467 goto not_cookie;
1468
1469 smp->data.str.len = (char *)data - smp->data.str.str;
1470 smp->flags = SMP_F_VOLATILE;
1471 return 1;
1472
1473 too_short:
1474 smp->flags = SMP_F_MAY_CHANGE;
1475 not_cookie:
1476 return 0;
1477}
1478
Willy Tarreau32389b72012-04-23 23:13:20 +02001479/************************************************************************/
Willy Tarreau645513a2010-05-24 20:55:15 +02001480/* All supported ACL keywords must be declared here. */
1481/************************************************************************/
1482
Willy Tarreau32389b72012-04-23 23:13:20 +02001483/* returns either 1 or 0 depending on whether an RDP cookie is found or not */
1484static int
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001485acl_fetch_rdp_cookie_cnt(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau24e32d82012-04-23 23:55:44 +02001486 const struct arg *args, struct sample *smp)
Willy Tarreau32389b72012-04-23 23:13:20 +02001487{
1488 int ret;
1489
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001490 ret = smp_fetch_rdp_cookie(px, l4, l7, opt, args, smp);
Willy Tarreau32389b72012-04-23 23:13:20 +02001491
1492 if (smp->flags & SMP_F_MAY_CHANGE)
1493 return 0;
1494
1495 smp->flags = SMP_F_VOLATILE;
1496 smp->type = SMP_T_UINT;
1497 smp->data.uint = ret;
1498 return 1;
1499}
1500
1501
Willy Tarreau4a129812012-04-25 17:31:42 +02001502/* fetch the connection's source IPv4/IPv6 address */
Willy Tarreau645513a2010-05-24 20:55:15 +02001503static int
Willy Tarreau4a129812012-04-25 17:31:42 +02001504smp_fetch_src(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau24e32d82012-04-23 23:55:44 +02001505 const struct arg *args, struct sample *smp)
Willy Tarreau645513a2010-05-24 20:55:15 +02001506{
Willy Tarreauf4362b32011-12-16 17:49:52 +01001507 switch (l4->si[0].addr.from.ss_family) {
1508 case AF_INET:
Willy Tarreauf853c462012-04-23 18:53:56 +02001509 smp->data.ipv4 = ((struct sockaddr_in *)&l4->si[0].addr.from)->sin_addr;
1510 smp->type = SMP_T_IPV4;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001511 break;
1512 case AF_INET6:
Willy Tarreauf853c462012-04-23 18:53:56 +02001513 smp->data.ipv6 = ((struct sockaddr_in6 *)(&l4->si[0].addr.from))->sin6_addr;
1514 smp->type = SMP_T_IPV6;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001515 break;
1516 default:
Emeric Brunf769f512010-10-22 17:14:01 +02001517 return 0;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001518 }
Emeric Brunf769f512010-10-22 17:14:01 +02001519
Willy Tarreau37406352012-04-23 16:16:37 +02001520 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001521 return 1;
1522}
1523
Willy Tarreaua5e37562011-12-16 17:06:15 +01001524/* set temp integer to the connection's source port */
Willy Tarreau645513a2010-05-24 20:55:15 +02001525static int
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001526smp_fetch_sport(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau24e32d82012-04-23 23:55:44 +02001527 const struct arg *args, struct sample *smp)
Willy Tarreau645513a2010-05-24 20:55:15 +02001528{
Willy Tarreauf853c462012-04-23 18:53:56 +02001529 smp->type = SMP_T_UINT;
1530 if (!(smp->data.uint = get_host_port(&l4->si[0].addr.from)))
Emeric Brunf769f512010-10-22 17:14:01 +02001531 return 0;
1532
Willy Tarreau37406352012-04-23 16:16:37 +02001533 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001534 return 1;
1535}
1536
Willy Tarreau4a129812012-04-25 17:31:42 +02001537/* fetch the connection's destination IPv4/IPv6 address */
Willy Tarreau645513a2010-05-24 20:55:15 +02001538static int
Willy Tarreau4a129812012-04-25 17:31:42 +02001539smp_fetch_dst(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau24e32d82012-04-23 23:55:44 +02001540 const struct arg *args, struct sample *smp)
Willy Tarreau645513a2010-05-24 20:55:15 +02001541{
Willy Tarreau59b94792012-05-11 16:16:40 +02001542 si_get_to_addr(&l4->si[0]);
Willy Tarreau645513a2010-05-24 20:55:15 +02001543
Willy Tarreauf4362b32011-12-16 17:49:52 +01001544 switch (l4->si[0].addr.to.ss_family) {
1545 case AF_INET:
Willy Tarreauf853c462012-04-23 18:53:56 +02001546 smp->data.ipv4 = ((struct sockaddr_in *)&l4->si[0].addr.to)->sin_addr;
1547 smp->type = SMP_T_IPV4;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001548 break;
1549 case AF_INET6:
Willy Tarreauf853c462012-04-23 18:53:56 +02001550 smp->data.ipv6 = ((struct sockaddr_in6 *)(&l4->si[0].addr.to))->sin6_addr;
1551 smp->type = SMP_T_IPV6;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001552 break;
1553 default:
Emeric Brunf769f512010-10-22 17:14:01 +02001554 return 0;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001555 }
Emeric Brunf769f512010-10-22 17:14:01 +02001556
Willy Tarreau37406352012-04-23 16:16:37 +02001557 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001558 return 1;
1559}
1560
Willy Tarreaua5e37562011-12-16 17:06:15 +01001561/* set temp integer to the frontend connexion's destination port */
Willy Tarreau645513a2010-05-24 20:55:15 +02001562static int
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001563smp_fetch_dport(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau24e32d82012-04-23 23:55:44 +02001564 const struct arg *args, struct sample *smp)
Willy Tarreau645513a2010-05-24 20:55:15 +02001565{
Willy Tarreau59b94792012-05-11 16:16:40 +02001566 si_get_to_addr(&l4->si[0]);
Willy Tarreau645513a2010-05-24 20:55:15 +02001567
Willy Tarreauf853c462012-04-23 18:53:56 +02001568 smp->type = SMP_T_UINT;
1569 if (!(smp->data.uint = get_host_port(&l4->si[0].addr.to)))
Emeric Brunf769f512010-10-22 17:14:01 +02001570 return 0;
1571
Willy Tarreau37406352012-04-23 16:16:37 +02001572 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001573 return 1;
1574}
1575
1576static int
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001577smp_fetch_payload_lv(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
1578 const struct arg *arg_p, struct sample *smp)
Emericf2d7cae2010-11-05 18:13:50 +01001579{
Willy Tarreau82ea8002012-04-25 19:19:43 +02001580 unsigned int len_offset = arg_p[0].data.uint;
1581 unsigned int len_size = arg_p[1].data.uint;
1582 unsigned int buf_offset;
1583 unsigned int buf_size = 0;
Willy Tarreau7421efb2012-07-02 15:11:27 +02001584 struct channel *b;
Emericf2d7cae2010-11-05 18:13:50 +01001585 int i;
1586
1587 /* Format is (len offset, len size, buf offset) or (len offset, len size) */
1588 /* by default buf offset == len offset + len size */
1589 /* buf offset could be absolute or relative to len offset + len size if prefixed by + or - */
1590
1591 if (!l4)
1592 return 0;
1593
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001594 b = ((opt & SMP_OPT_DIR) == SMP_OPT_DIR_RES) ? l4->rep : l4->req;
Emericf2d7cae2010-11-05 18:13:50 +01001595
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001596 if (!b)
Emericf2d7cae2010-11-05 18:13:50 +01001597 return 0;
1598
Willy Tarreau572bf902012-07-02 17:01:20 +02001599 if (len_offset + len_size > b->buf.i)
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001600 goto too_short;
Emericf2d7cae2010-11-05 18:13:50 +01001601
1602 for (i = 0; i < len_size; i++) {
Willy Tarreau572bf902012-07-02 17:01:20 +02001603 buf_size = (buf_size << 8) + ((unsigned char *)b->buf.p)[i + len_offset];
Emericf2d7cae2010-11-05 18:13:50 +01001604 }
1605
Willy Tarreau9fcb9842012-04-20 14:45:49 +02001606 /* buf offset may be implicit, absolute or relative */
1607 buf_offset = len_offset + len_size;
1608 if (arg_p[2].type == ARGT_UINT)
1609 buf_offset = arg_p[2].data.uint;
1610 else if (arg_p[2].type == ARGT_SINT)
1611 buf_offset += arg_p[2].data.sint;
1612
Willy Tarreau572bf902012-07-02 17:01:20 +02001613 if (!buf_size || buf_size > b->buf.size || buf_offset + buf_size > b->buf.size) {
Willy Tarreau82ea8002012-04-25 19:19:43 +02001614 /* will never match */
1615 smp->flags = 0;
1616 return 0;
1617 }
1618
Willy Tarreau572bf902012-07-02 17:01:20 +02001619 if (buf_offset + buf_size > b->buf.i)
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001620 goto too_short;
Emericf2d7cae2010-11-05 18:13:50 +01001621
1622 /* init chunk as read only */
Willy Tarreaub8c8f1f2012-04-23 22:38:26 +02001623 smp->type = SMP_T_CBIN;
Willy Tarreau572bf902012-07-02 17:01:20 +02001624 chunk_initlen(&smp->data.str, b->buf.p + buf_offset, 0, buf_size);
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001625 smp->flags = SMP_F_VOLATILE;
Emericf2d7cae2010-11-05 18:13:50 +01001626 return 1;
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001627
1628 too_short:
1629 smp->flags = SMP_F_MAY_CHANGE;
1630 return 0;
Emericf2d7cae2010-11-05 18:13:50 +01001631}
1632
1633static int
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001634smp_fetch_payload(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
1635 const struct arg *arg_p, struct sample *smp)
Emericf2d7cae2010-11-05 18:13:50 +01001636{
Willy Tarreau82ea8002012-04-25 19:19:43 +02001637 unsigned int buf_offset = arg_p[0].data.uint;
1638 unsigned int buf_size = arg_p[1].data.uint;
Willy Tarreau7421efb2012-07-02 15:11:27 +02001639 struct channel *b;
Emericf2d7cae2010-11-05 18:13:50 +01001640
1641 if (!l4)
1642 return 0;
1643
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001644 b = ((opt & SMP_OPT_DIR) == SMP_OPT_DIR_RES) ? l4->rep : l4->req;
Emericf2d7cae2010-11-05 18:13:50 +01001645
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001646 if (!b)
Emericf2d7cae2010-11-05 18:13:50 +01001647 return 0;
Willy Tarreau82ea8002012-04-25 19:19:43 +02001648
Willy Tarreau572bf902012-07-02 17:01:20 +02001649 if (!buf_size || buf_size > b->buf.size || buf_offset + buf_size > b->buf.size) {
Willy Tarreau82ea8002012-04-25 19:19:43 +02001650 /* will never match */
1651 smp->flags = 0;
1652 return 0;
1653 }
Emericf2d7cae2010-11-05 18:13:50 +01001654
Willy Tarreau572bf902012-07-02 17:01:20 +02001655 if (buf_offset + buf_size > b->buf.i)
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001656 goto too_short;
Emericf2d7cae2010-11-05 18:13:50 +01001657
1658 /* init chunk as read only */
Willy Tarreaub8c8f1f2012-04-23 22:38:26 +02001659 smp->type = SMP_T_CBIN;
Willy Tarreau572bf902012-07-02 17:01:20 +02001660 chunk_initlen(&smp->data.str, b->buf.p + buf_offset, 0, buf_size);
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001661 smp->flags = SMP_F_VOLATILE;
Simon Hormanab814e02011-06-24 14:50:20 +09001662 return 1;
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001663
1664 too_short:
1665 smp->flags = SMP_F_MAY_CHANGE;
1666 return 0;
Simon Hormanab814e02011-06-24 14:50:20 +09001667}
1668
Willy Tarreau21d68a62012-04-20 15:52:36 +02001669/* This function is used to validate the arguments passed to a "payload" fetch
1670 * keyword. This keyword expects two positive integers, with the second one
1671 * being strictly positive. It is assumed that the types are already the correct
1672 * ones. Returns 0 on error, non-zero if OK. If <err_msg> is not NULL, it will be
1673 * filled with a pointer to an error message in case of error, that the caller
1674 * is responsible for freeing. The initial location must either be freeable or
1675 * NULL.
1676 */
1677static int val_payload(struct arg *arg, char **err_msg)
1678{
1679 if (!arg[1].data.uint) {
1680 if (err_msg)
1681 memprintf(err_msg, "payload length must be > 0");
1682 return 0;
1683 }
1684 return 1;
1685}
1686
1687/* This function is used to validate the arguments passed to a "payload_lv" fetch
1688 * keyword. This keyword allows two positive integers and an optional signed one,
1689 * with the second one being strictly positive and the third one being greater than
1690 * the opposite of the two others if negative. It is assumed that the types are
1691 * already the correct ones. Returns 0 on error, non-zero if OK. If <err_msg> is
1692 * not NULL, it will be filled with a pointer to an error message in case of
1693 * error, that the caller is responsible for freeing. The initial location must
1694 * either be freeable or NULL.
1695 */
1696static int val_payload_lv(struct arg *arg, char **err_msg)
1697{
1698 if (!arg[1].data.uint) {
1699 if (err_msg)
1700 memprintf(err_msg, "payload length must be > 0");
1701 return 0;
1702 }
1703
1704 if (arg[2].type == ARGT_SINT &&
1705 (int)(arg[0].data.uint + arg[1].data.uint + arg[2].data.sint) < 0) {
1706 if (err_msg)
1707 memprintf(err_msg, "payload offset too negative");
1708 return 0;
1709 }
1710 return 1;
1711}
1712
Willy Tarreaub6866442008-07-14 23:54:42 +02001713static struct cfg_kw_list cfg_kws = {{ },{
1714 { CFG_LISTEN, "tcp-request", tcp_parse_tcp_req },
Emeric Brun97679e72010-09-23 17:56:44 +02001715 { CFG_LISTEN, "tcp-response", tcp_parse_tcp_rep },
Willy Tarreaub6866442008-07-14 23:54:42 +02001716 { 0, NULL, NULL },
1717}};
1718
Willy Tarreau61612d42012-04-19 18:42:05 +02001719/* Note: must not be declared <const> as its list will be overwritten.
1720 * Please take care of keeping this list alphabetically sorted.
1721 */
Willy Tarreaub6866442008-07-14 23:54:42 +02001722static struct acl_kw_list acl_kws = {{ },{
Willy Tarreau4a129812012-04-25 17:31:42 +02001723 { "dst", acl_parse_ip, smp_fetch_dst, acl_match_ip, ACL_USE_TCP4_PERMANENT|ACL_MAY_LOOKUP, 0 },
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001724 { "dst_port", acl_parse_int, smp_fetch_dport, acl_match_int, ACL_USE_TCP_PERMANENT, 0 },
Willy Tarreau0d5fe142012-04-26 12:24:45 +02001725 { "payload", acl_parse_str, smp_fetch_payload, acl_match_str, ACL_USE_L6REQ_VOLATILE|ACL_MAY_LOOKUP, ARG2(2,UINT,UINT), val_payload },
1726 { "payload_lv", acl_parse_str, smp_fetch_payload_lv, acl_match_str, ACL_USE_L6REQ_VOLATILE|ACL_MAY_LOOKUP, ARG3(2,UINT,UINT,SINT), val_payload_lv },
Willy Tarreau9fb4bc72012-04-24 00:09:26 +02001727 { "req_rdp_cookie", acl_parse_str, smp_fetch_rdp_cookie, acl_match_str, ACL_USE_L6REQ_VOLATILE|ACL_MAY_LOOKUP, ARG1(0,STR) },
Willy Tarreau32389b72012-04-23 23:13:20 +02001728 { "req_rdp_cookie_cnt", acl_parse_int, acl_fetch_rdp_cookie_cnt, acl_match_int, ACL_USE_L6REQ_VOLATILE, ARG1(0,STR) },
Willy Tarreau4a129812012-04-25 17:31:42 +02001729 { "src", acl_parse_ip, smp_fetch_src, acl_match_ip, ACL_USE_TCP4_PERMANENT|ACL_MAY_LOOKUP, 0 },
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001730 { "src_port", acl_parse_int, smp_fetch_sport, acl_match_int, ACL_USE_TCP_PERMANENT, 0 },
Willy Tarreaub6866442008-07-14 23:54:42 +02001731 { NULL, NULL, NULL, NULL },
1732}};
1733
Willy Tarreau4a129812012-04-25 17:31:42 +02001734/* Note: must not be declared <const> as its list will be overwritten.
1735 * Note: fetches that may return multiple types must be declared as the lowest
1736 * common denominator, the type that can be casted into all other ones. For
1737 * instance v4/v6 must be declared v4.
1738 */
Willy Tarreau12785782012-04-27 21:37:17 +02001739static struct sample_fetch_kw_list sample_fetch_keywords = {{ },{
Willy Tarreau4a129812012-04-25 17:31:42 +02001740 { "src", smp_fetch_src, 0, NULL, SMP_T_IPV4, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreau4a129812012-04-25 17:31:42 +02001741 { "dst", smp_fetch_dst, 0, NULL, SMP_T_IPV4, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001742 { "dst_port", smp_fetch_dport, 0, NULL, SMP_T_UINT, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001743 { "payload", smp_fetch_payload, ARG2(2,UINT,UINT), val_payload, SMP_T_CBIN, SMP_CAP_REQ|SMP_CAP_RES },
1744 { "payload_lv", smp_fetch_payload_lv, ARG3(2,UINT,UINT,SINT), val_payload_lv, SMP_T_CBIN, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreaud6281ae2012-04-26 11:23:39 +02001745 { "rdp_cookie", smp_fetch_rdp_cookie, ARG1(1,STR), NULL, SMP_T_CSTR, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001746 { "src_port", smp_fetch_sport, 0, NULL, SMP_T_UINT, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreau9fcb9842012-04-20 14:45:49 +02001747 { NULL, NULL, 0, 0, 0 },
Willy Tarreau645513a2010-05-24 20:55:15 +02001748}};
1749
Willy Tarreaue6b98942007-10-29 01:09:36 +01001750__attribute__((constructor))
1751static void __tcp_protocol_init(void)
1752{
1753 protocol_register(&proto_tcpv4);
1754 protocol_register(&proto_tcpv6);
Willy Tarreau12785782012-04-27 21:37:17 +02001755 sample_register_fetches(&sample_fetch_keywords);
Willy Tarreaub6866442008-07-14 23:54:42 +02001756 cfg_register_keywords(&cfg_kws);
1757 acl_register_keywords(&acl_kws);
Willy Tarreaue6b98942007-10-29 01:09:36 +01001758}
1759
1760
1761/*
1762 * Local variables:
1763 * c-indent-level: 8
1764 * c-basic-offset: 8
1765 * End:
1766 */