blob: c394d0f840645fe44f1aba07dafca6495732a596 [file] [log] [blame]
Willy Tarreau59f98392012-07-06 14:13:49 +02001/*
2 * Connection management functions
3 *
4 * Copyright 2000-2012 Willy Tarreau <w@1wt.eu>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
Willy Tarreaue1e4a612012-10-05 00:10:55 +020013#include <errno.h>
14
Willy Tarreau4c7e4b72020-05-27 12:58:42 +020015#include <haproxy/api.h>
Willy Tarreau6be78492020-06-05 00:00:29 +020016#include <haproxy/cfgparse.h>
Willy Tarreau7ea393d2020-06-04 18:02:10 +020017#include <haproxy/connection.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020018#include <haproxy/fd.h>
Willy Tarreau762d7a52020-06-04 11:23:07 +020019#include <haproxy/frontend.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020020#include <haproxy/hash.h>
Willy Tarreau36979d92020-06-05 17:27:29 +020021#include <haproxy/log-t.h>
Willy Tarreau7a00efb2020-06-02 17:02:59 +020022#include <haproxy/namespace.h>
Willy Tarreau6131d6a2020-06-02 16:48:09 +020023#include <haproxy/net_helper.h>
Willy Tarreaufc774542020-06-04 17:31:04 +020024#include <haproxy/proto_tcp.h>
Willy Tarreaue6ce10b2020-06-04 15:33:47 +020025#include <haproxy/sample.h>
Willy Tarreau209108d2020-06-04 20:30:20 +020026#include <haproxy/ssl_sock.h>
Willy Tarreau5e539c92020-06-04 20:45:39 +020027#include <haproxy/stream_interface.h>
Emeric Brun46591952012-05-18 15:47:34 +020028
Alexander Liu2a54bb72019-05-22 19:44:48 +080029
Amaury Denoyelle8990b012021-02-19 15:29:16 +010030DECLARE_POOL(pool_head_connection, "connection", sizeof(struct connection));
31DECLARE_POOL(pool_head_connstream, "conn_stream", sizeof(struct conn_stream));
32DECLARE_POOL(pool_head_conn_hash_node, "conn_hash_node", sizeof(struct conn_hash_node));
33DECLARE_POOL(pool_head_sockaddr, "sockaddr", sizeof(struct sockaddr_storage));
34DECLARE_POOL(pool_head_authority, "authority", PP2_AUTHORITY_MAX);
Willy Tarreau8ceae722018-11-26 11:58:30 +010035
Willy Tarreau4d82bf52020-06-28 00:19:17 +020036struct idle_conns idle_conns[MAX_THREADS] = { };
Willy Tarreau13e14102016-12-22 20:25:26 +010037struct xprt_ops *registered_xprt[XPRT_ENTRIES] = { NULL, };
Willy Tarreauf2943dc2012-10-26 20:10:28 +020038
Christopher Faulet32f61c02018-04-10 14:33:41 +020039/* List head of all known muxes for PROTO */
40struct mux_proto_list mux_proto_list = {
41 .list = LIST_HEAD_INIT(mux_proto_list.list)
Willy Tarreau2386be62017-09-21 19:40:52 +020042};
43
Willy Tarreau119e50e2020-05-22 13:53:29 +020044/* disables sending of proxy-protocol-v2's LOCAL command */
45static int pp2_never_send_local;
46
Olivier Houchard477902b2020-01-22 18:08:48 +010047int conn_create_mux(struct connection *conn)
48{
Olivier Houchard477902b2020-01-22 18:08:48 +010049 if (conn_is_back(conn)) {
50 struct server *srv;
51 struct conn_stream *cs = conn->ctx;
Christopher Faulet14cd3162020-04-16 14:50:06 +020052 struct session *sess = conn->owner;
Olivier Houchard477902b2020-01-22 18:08:48 +010053
54 if (conn->flags & CO_FL_ERROR)
55 goto fail;
Olivier Houcharda8a415d2020-01-23 13:15:14 +010056
Christopher Faulet14cd3162020-04-16 14:50:06 +020057 if (sess && obj_type(sess->origin) == OBJ_TYPE_CHECK) {
Willy Tarreau38b4d2e2020-11-20 17:08:15 +010058 if (conn_install_mux_chk(conn, conn->ctx, sess) < 0)
Christopher Faulet14cd3162020-04-16 14:50:06 +020059 goto fail;
60 }
Willy Tarreau38b4d2e2020-11-20 17:08:15 +010061 else if (conn_install_mux_be(conn, conn->ctx, sess) < 0)
Olivier Houchard477902b2020-01-22 18:08:48 +010062 goto fail;
63 srv = objt_server(conn->target);
Christopher Faulet08016ab2020-07-01 16:10:06 +020064
65 /* If we're doing http-reuse always, and the connection is not
66 * private with available streams (an http2 connection), add it
67 * to the available list, so that others can use it right
68 * away. If the connection is private, add it in the session
69 * server list.
70 */
Christopher Faulet2883fcf2020-07-01 14:59:43 +020071 if (srv && ((srv->proxy->options & PR_O_REUSE_MASK) == PR_O_REUSE_ALWS) &&
Christopher Fauletaa278532020-06-30 14:47:46 +020072 !(conn->flags & CO_FL_PRIVATE) && conn->mux->avail_streams(conn) > 0)
Willy Tarreau430bf4a2021-03-04 09:45:32 +010073 ebmb_insert(&srv->per_thr[tid].avail_conns, &conn->hash_node->node, sizeof(conn->hash_node->hash));
Christopher Faulet08016ab2020-07-01 16:10:06 +020074 else if (conn->flags & CO_FL_PRIVATE) {
Ilya Shipitsin6b79f382020-07-23 00:32:55 +050075 /* If it fail now, the same will be done in mux->detach() callback */
Willy Tarreau38b4d2e2020-11-20 17:08:15 +010076 session_add_conn(sess, conn, conn->target);
Christopher Faulet08016ab2020-07-01 16:10:06 +020077 }
Olivier Houchard477902b2020-01-22 18:08:48 +010078 return 0;
79fail:
80 /* let the upper layer know the connection failed */
81 cs->data_cb->wake(cs);
82 return -1;
83 } else
84 return conn_complete_session(conn);
85
86}
87
Willy Tarreauff3e6482015-03-12 23:56:52 +010088/* Send a message over an established connection. It makes use of send() and
89 * returns the same return code and errno. If the socket layer is not ready yet
90 * then -1 is returned and ENOTSOCK is set into errno. If the fd is not marked
91 * as ready, or if EAGAIN or ENOTCONN is returned, then we return 0. It returns
92 * EMSGSIZE if called with a zero length message. The purpose is to simplify
93 * some rare attempts to directly write on the socket from above the connection
94 * (typically send_proxy). In case of EAGAIN, the fd is marked as "cant_send".
95 * It automatically retries on EINTR. Other errors cause the connection to be
96 * marked as in error state. It takes similar arguments as send() except the
Willy Tarreau827fee72020-12-11 15:26:55 +010097 * first one which is the connection instead of the file descriptor. <flags>
98 * only support CO_SFL_MSG_MORE.
Willy Tarreauff3e6482015-03-12 23:56:52 +010099 */
Willy Tarreau827fee72020-12-11 15:26:55 +0100100int conn_ctrl_send(struct connection *conn, const void *buf, int len, int flags)
Willy Tarreauff3e6482015-03-12 23:56:52 +0100101{
Willy Tarreau827fee72020-12-11 15:26:55 +0100102 const struct buffer buffer = b_make((char*)buf, len, 0, len);
103 const struct xprt_ops *xprt = xprt_get(XPRT_RAW);
Willy Tarreauff3e6482015-03-12 23:56:52 +0100104 int ret;
105
106 ret = -1;
107 errno = ENOTSOCK;
108
109 if (conn->flags & CO_FL_SOCK_WR_SH)
110 goto fail;
111
112 if (!conn_ctrl_ready(conn))
113 goto fail;
114
115 errno = EMSGSIZE;
116 if (!len)
117 goto fail;
118
Willy Tarreau827fee72020-12-11 15:26:55 +0100119 /* snd_buf() already takes care of updating conn->flags and handling
120 * the FD polling status.
121 */
122 ret = xprt->snd_buf(conn, NULL, &buffer, buffer.data, flags);
123 if (conn->flags & CO_FL_ERROR)
124 ret = -1;
125 return ret;
Willy Tarreauff3e6482015-03-12 23:56:52 +0100126 fail:
127 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH | CO_FL_ERROR;
128 return ret;
129}
130
Willy Tarreau746b0512020-12-11 17:06:11 +0100131/* Called from the upper layer, to unsubscribe <es> from events <event_type>.
132 * The event subscriber <es> is not allowed to change from a previous call as
133 * long as at least one event is still subscribed. The <event_type> must only
134 * be a combination of SUB_RETRY_RECV and SUB_RETRY_SEND. It always returns 0.
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100135 */
136int conn_unsubscribe(struct connection *conn, void *xprt_ctx, int event_type, struct wait_event *es)
Olivier Houchard83a0cd82018-09-28 17:57:58 +0200137{
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100138 BUG_ON(event_type & ~(SUB_RETRY_SEND|SUB_RETRY_RECV));
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100139 BUG_ON(conn->subs && conn->subs != es);
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100140
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100141 es->events &= ~event_type;
142 if (!es->events)
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100143 conn->subs = NULL;
144
Willy Tarreau746b0512020-12-11 17:06:11 +0100145 if (conn_ctrl_ready(conn) && conn->ctrl->ignore_events)
146 conn->ctrl->ignore_events(conn, event_type);
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100147
Olivier Houchard83a0cd82018-09-28 17:57:58 +0200148 return 0;
149}
150
Willy Tarreau7e59c0a2020-02-28 14:24:49 +0100151/* Called from the upper layer, to subscribe <es> to events <event_type>.
152 * The <es> struct is not allowed to differ from the one passed during a
Willy Tarreau746b0512020-12-11 17:06:11 +0100153 * previous call to subscribe(). If the connection's ctrl layer is ready,
154 * the wait_event is immediately woken up and the subcription is cancelled.
155 * It always returns zero.
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100156 */
157int conn_subscribe(struct connection *conn, void *xprt_ctx, int event_type, struct wait_event *es)
Olivier Houchard6ff20392018-07-17 18:46:31 +0200158{
Willy Tarreau746b0512020-12-11 17:06:11 +0100159 int ret = 0;
160
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100161 BUG_ON(event_type & ~(SUB_RETRY_SEND|SUB_RETRY_RECV));
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100162 BUG_ON(conn->subs && conn->subs != es);
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100163
Willy Tarreau7e59c0a2020-02-28 14:24:49 +0100164 if (conn->subs && (conn->subs->events & event_type) == event_type)
165 return 0;
166
Willy Tarreau746b0512020-12-11 17:06:11 +0100167 if (conn_ctrl_ready(conn) && conn->ctrl->check_events) {
168 ret = conn->ctrl->check_events(conn, event_type);
169 if (ret)
170 tasklet_wakeup(es->tasklet);
Willy Tarreaud1d14c32020-02-21 10:34:19 +0100171 }
Willy Tarreau746b0512020-12-11 17:06:11 +0100172
173 es->events = (es->events | event_type) & ~ret;
174 conn->subs = es->events ? es : NULL;
Olivier Houchard83a0cd82018-09-28 17:57:58 +0200175 return 0;
Olivier Houchard6ff20392018-07-17 18:46:31 +0200176}
177
Willy Tarreau2ded48d2020-12-11 16:20:34 +0100178/* Drains possibly pending incoming data on the connection and update the flags
179 * accordingly. This is used to know whether we need to disable lingering on
180 * close. Returns non-zero if it is safe to close without disabling lingering,
181 * otherwise zero. The CO_FL_SOCK_RD_SH flag may also be updated if the incoming
182 * shutdown was reported by the ->drain() function.
Willy Tarreaud85c4852015-03-13 00:40:28 +0100183 */
Willy Tarreau2ded48d2020-12-11 16:20:34 +0100184int conn_ctrl_drain(struct connection *conn)
Willy Tarreaud85c4852015-03-13 00:40:28 +0100185{
Willy Tarreau2ded48d2020-12-11 16:20:34 +0100186 int ret = 0;
Willy Tarreaue215bba2018-08-24 14:31:53 +0200187
Willy Tarreau2ded48d2020-12-11 16:20:34 +0100188 if (!conn_ctrl_ready(conn) || conn->flags & (CO_FL_ERROR | CO_FL_SOCK_RD_SH))
189 ret = 1;
190 else if (conn->ctrl->drain) {
191 ret = conn->ctrl->drain(conn);
192 if (ret)
193 conn->flags |= CO_FL_SOCK_RD_SH;
Willy Tarreaud85c4852015-03-13 00:40:28 +0100194 }
Willy Tarreau2ded48d2020-12-11 16:20:34 +0100195 return ret;
Willy Tarreaud85c4852015-03-13 00:40:28 +0100196}
197
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100198/*
199 * Get data length from tlv
200 */
Tim Duesterhusba837ec2020-03-05 23:11:02 +0100201static inline size_t get_tlv_length(const struct tlv *src)
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100202{
203 return (src->length_hi << 8) | src->length_lo;
204}
205
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200206/* This handshake handler waits a PROXY protocol header at the beginning of the
207 * raw data stream. The header looks like this :
208 *
209 * "PROXY" <SP> PROTO <SP> SRC3 <SP> DST3 <SP> SRC4 <SP> <DST4> "\r\n"
210 *
211 * There must be exactly one space between each field. Fields are :
212 * - PROTO : layer 4 protocol, which must be "TCP4" or "TCP6".
213 * - SRC3 : layer 3 (eg: IP) source address in standard text form
214 * - DST3 : layer 3 (eg: IP) destination address in standard text form
215 * - SRC4 : layer 4 (eg: TCP port) source address in standard text form
216 * - DST4 : layer 4 (eg: TCP port) destination address in standard text form
217 *
218 * This line MUST be at the beginning of the buffer and MUST NOT wrap.
219 *
220 * The header line is small and in all cases smaller than the smallest normal
221 * TCP MSS. So it MUST always be delivered as one segment, which ensures we
222 * can safely use MSG_PEEK and avoid buffering.
223 *
224 * Once the data is fetched, the values are set in the connection's address
225 * fields, and data are removed from the socket's buffer. The function returns
226 * zero if it needs to wait for more data or if it fails, or 1 if it completed
227 * and removed itself.
228 */
229int conn_recv_proxy(struct connection *conn, int flag)
230{
231 char *line, *end;
Willy Tarreau77992672014-06-14 11:06:17 +0200232 struct proxy_hdr_v2 *hdr_v2;
233 const char v2sig[] = PP2_SIGNATURE;
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100234 size_t total_v2_len;
Tim Duesterhusba837ec2020-03-05 23:11:02 +0100235 size_t tlv_offset = 0;
Willy Tarreaub406b872018-08-22 05:20:32 +0200236 int ret;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200237
Willy Tarreau3c728722014-01-23 13:50:42 +0100238 if (!conn_ctrl_ready(conn))
Willy Tarreauf79c8172013-10-21 16:30:56 +0200239 goto fail;
240
Willy Tarreau9b7587a2020-10-15 07:32:10 +0200241 if (!sockaddr_alloc(&conn->src, NULL, 0) || !sockaddr_alloc(&conn->dst, NULL, 0))
Willy Tarreauca79f592019-07-17 19:04:47 +0200242 goto fail;
243
Willy Tarreau585744b2017-08-24 14:31:19 +0200244 if (!fd_recv_ready(conn->handle.fd))
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200245 goto not_ready;
Willy Tarreaufd803bb2014-01-20 15:13:07 +0100246
Willy Tarreau157788c2020-02-11 10:08:05 +0100247 while (1) {
Willy Tarreaub406b872018-08-22 05:20:32 +0200248 ret = recv(conn->handle.fd, trash.area, trash.size, MSG_PEEK);
249 if (ret < 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200250 if (errno == EINTR)
251 continue;
252 if (errno == EAGAIN) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200253 fd_cant_recv(conn->handle.fd);
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200254 goto not_ready;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200255 }
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100256 goto recv_abort;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200257 }
Willy Tarreaub406b872018-08-22 05:20:32 +0200258 trash.data = ret;
Willy Tarreau157788c2020-02-11 10:08:05 +0100259 break;
260 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200261
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200262 if (!trash.data) {
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100263 /* client shutdown */
264 conn->err_code = CO_ER_PRX_EMPTY;
265 goto fail;
266 }
267
Willy Tarreauc192b0a2020-01-23 09:11:58 +0100268 conn->flags &= ~CO_FL_WAIT_L4_CONN;
269
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200270 if (trash.data < 6)
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200271 goto missing;
272
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200273 line = trash.area;
274 end = trash.area + trash.data;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200275
276 /* Decode a possible proxy request, fail early if it does not match */
Willy Tarreau77992672014-06-14 11:06:17 +0200277 if (strncmp(line, "PROXY ", 6) != 0)
278 goto not_v1;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200279
280 line += 6;
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200281 if (trash.data < 9) /* shortest possible line */
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200282 goto missing;
283
David CARLIER42ff05e2016-03-24 09:22:36 +0000284 if (memcmp(line, "TCP4 ", 5) == 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200285 u32 src3, dst3, sport, dport;
286
287 line += 5;
288
289 src3 = inetaddr_host_lim_ret(line, end, &line);
290 if (line == end)
291 goto missing;
292 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100293 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200294
295 dst3 = inetaddr_host_lim_ret(line, end, &line);
296 if (line == end)
297 goto missing;
298 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100299 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200300
301 sport = read_uint((const char **)&line, end);
302 if (line == end)
303 goto missing;
304 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100305 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200306
307 dport = read_uint((const char **)&line, end);
308 if (line > end - 2)
309 goto missing;
310 if (*line++ != '\r')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100311 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200312 if (*line++ != '\n')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100313 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200314
315 /* update the session's addresses and mark them set */
Willy Tarreau226572f2019-07-17 14:46:00 +0200316 ((struct sockaddr_in *)conn->src)->sin_family = AF_INET;
317 ((struct sockaddr_in *)conn->src)->sin_addr.s_addr = htonl(src3);
318 ((struct sockaddr_in *)conn->src)->sin_port = htons(sport);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200319
Willy Tarreau226572f2019-07-17 14:46:00 +0200320 ((struct sockaddr_in *)conn->dst)->sin_family = AF_INET;
321 ((struct sockaddr_in *)conn->dst)->sin_addr.s_addr = htonl(dst3);
322 ((struct sockaddr_in *)conn->dst)->sin_port = htons(dport);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200323 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
324 }
David CARLIER42ff05e2016-03-24 09:22:36 +0000325 else if (memcmp(line, "TCP6 ", 5) == 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200326 u32 sport, dport;
327 char *src_s;
328 char *dst_s, *sport_s, *dport_s;
329 struct in6_addr src3, dst3;
330
331 line += 5;
332
333 src_s = line;
334 dst_s = sport_s = dport_s = NULL;
335 while (1) {
336 if (line > end - 2) {
337 goto missing;
338 }
339 else if (*line == '\r') {
340 *line = 0;
341 line++;
342 if (*line++ != '\n')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100343 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200344 break;
345 }
346
347 if (*line == ' ') {
348 *line = 0;
349 if (!dst_s)
350 dst_s = line + 1;
351 else if (!sport_s)
352 sport_s = line + 1;
353 else if (!dport_s)
354 dport_s = line + 1;
355 }
356 line++;
357 }
358
359 if (!dst_s || !sport_s || !dport_s)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100360 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200361
362 sport = read_uint((const char **)&sport_s,dport_s - 1);
363 if (*sport_s != 0)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100364 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200365
366 dport = read_uint((const char **)&dport_s,line - 2);
367 if (*dport_s != 0)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100368 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200369
370 if (inet_pton(AF_INET6, src_s, (void *)&src3) != 1)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100371 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200372
373 if (inet_pton(AF_INET6, dst_s, (void *)&dst3) != 1)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100374 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200375
376 /* update the session's addresses and mark them set */
Willy Tarreau226572f2019-07-17 14:46:00 +0200377 ((struct sockaddr_in6 *)conn->src)->sin6_family = AF_INET6;
378 memcpy(&((struct sockaddr_in6 *)conn->src)->sin6_addr, &src3, sizeof(struct in6_addr));
379 ((struct sockaddr_in6 *)conn->src)->sin6_port = htons(sport);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200380
Willy Tarreau226572f2019-07-17 14:46:00 +0200381 ((struct sockaddr_in6 *)conn->dst)->sin6_family = AF_INET6;
382 memcpy(&((struct sockaddr_in6 *)conn->dst)->sin6_addr, &dst3, sizeof(struct in6_addr));
383 ((struct sockaddr_in6 *)conn->dst)->sin6_port = htons(dport);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200384 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
385 }
Willy Tarreau4c20d292014-06-14 11:41:36 +0200386 else if (memcmp(line, "UNKNOWN\r\n", 9) == 0) {
387 /* This can be a UNIX socket forwarded by an haproxy upstream */
388 line += 9;
389 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200390 else {
Willy Tarreau4c20d292014-06-14 11:41:36 +0200391 /* The protocol does not match something known (TCP4/TCP6/UNKNOWN) */
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100392 conn->err_code = CO_ER_PRX_BAD_PROTO;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200393 goto fail;
394 }
395
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200396 trash.data = line - trash.area;
Willy Tarreau77992672014-06-14 11:06:17 +0200397 goto eat_header;
398
399 not_v1:
400 /* try PPv2 */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200401 if (trash.data < PP2_HEADER_LEN)
Willy Tarreau77992672014-06-14 11:06:17 +0200402 goto missing;
403
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200404 hdr_v2 = (struct proxy_hdr_v2 *) trash.area;
Willy Tarreau77992672014-06-14 11:06:17 +0200405
406 if (memcmp(hdr_v2->sig, v2sig, PP2_SIGNATURE_LEN) != 0 ||
407 (hdr_v2->ver_cmd & PP2_VERSION_MASK) != PP2_VERSION) {
408 conn->err_code = CO_ER_PRX_NOT_HDR;
409 goto fail;
410 }
411
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100412 total_v2_len = PP2_HEADER_LEN + ntohs(hdr_v2->len);
413 if (trash.data < total_v2_len)
Willy Tarreau77992672014-06-14 11:06:17 +0200414 goto missing;
415
416 switch (hdr_v2->ver_cmd & PP2_CMD_MASK) {
417 case 0x01: /* PROXY command */
418 switch (hdr_v2->fam) {
419 case 0x11: /* TCPv4 */
KOVACS Krisztianefd3aa92014-11-19 10:53:20 +0100420 if (ntohs(hdr_v2->len) < PP2_ADDR_LEN_INET)
421 goto bad_header;
422
Willy Tarreau226572f2019-07-17 14:46:00 +0200423 ((struct sockaddr_in *)conn->src)->sin_family = AF_INET;
424 ((struct sockaddr_in *)conn->src)->sin_addr.s_addr = hdr_v2->addr.ip4.src_addr;
425 ((struct sockaddr_in *)conn->src)->sin_port = hdr_v2->addr.ip4.src_port;
426 ((struct sockaddr_in *)conn->dst)->sin_family = AF_INET;
427 ((struct sockaddr_in *)conn->dst)->sin_addr.s_addr = hdr_v2->addr.ip4.dst_addr;
428 ((struct sockaddr_in *)conn->dst)->sin_port = hdr_v2->addr.ip4.dst_port;
Willy Tarreau77992672014-06-14 11:06:17 +0200429 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
KOVACS Krisztian7209c202015-07-03 14:09:10 +0200430 tlv_offset = PP2_HEADER_LEN + PP2_ADDR_LEN_INET;
Willy Tarreau77992672014-06-14 11:06:17 +0200431 break;
432 case 0x21: /* TCPv6 */
KOVACS Krisztianefd3aa92014-11-19 10:53:20 +0100433 if (ntohs(hdr_v2->len) < PP2_ADDR_LEN_INET6)
434 goto bad_header;
435
Willy Tarreau226572f2019-07-17 14:46:00 +0200436 ((struct sockaddr_in6 *)conn->src)->sin6_family = AF_INET6;
437 memcpy(&((struct sockaddr_in6 *)conn->src)->sin6_addr, hdr_v2->addr.ip6.src_addr, 16);
438 ((struct sockaddr_in6 *)conn->src)->sin6_port = hdr_v2->addr.ip6.src_port;
439 ((struct sockaddr_in6 *)conn->dst)->sin6_family = AF_INET6;
440 memcpy(&((struct sockaddr_in6 *)conn->dst)->sin6_addr, hdr_v2->addr.ip6.dst_addr, 16);
441 ((struct sockaddr_in6 *)conn->dst)->sin6_port = hdr_v2->addr.ip6.dst_port;
Willy Tarreau77992672014-06-14 11:06:17 +0200442 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
KOVACS Krisztian7209c202015-07-03 14:09:10 +0200443 tlv_offset = PP2_HEADER_LEN + PP2_ADDR_LEN_INET6;
Willy Tarreau77992672014-06-14 11:06:17 +0200444 break;
445 }
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100446
447 /* TLV parsing */
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100448 while (tlv_offset < total_v2_len) {
449 struct tlv *tlv_packet;
Tim Duesterhusba837ec2020-03-05 23:11:02 +0100450 size_t tlv_len;
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100451
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100452 /* Verify that we have at least TLV_HEADER_SIZE bytes left */
453 if (tlv_offset + TLV_HEADER_SIZE > total_v2_len)
454 goto bad_header;
455
456 tlv_packet = (struct tlv *) &trash.area[tlv_offset];
457 tlv_len = get_tlv_length(tlv_packet);
458 tlv_offset += tlv_len + TLV_HEADER_SIZE;
459
460 /* Verify that the TLV length does not exceed the total PROXYv2 length */
461 if (tlv_offset > total_v2_len)
462 goto bad_header;
463
464 switch (tlv_packet->type) {
465 case PP2_TYPE_CRC32C: {
466 uint32_t n_crc32c;
467
468 /* Verify that this TLV is exactly 4 bytes long */
469 if (tlv_len != 4)
470 goto bad_header;
471
472 n_crc32c = read_n32(tlv_packet->value);
473 write_n32(tlv_packet->value, 0); // compute with CRC==0
474
475 if (hash_crc32c(trash.area, total_v2_len) != n_crc32c)
476 goto bad_header;
477 break;
478 }
Willy Tarreaue5733232019-05-22 19:24:06 +0200479#ifdef USE_NS
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100480 case PP2_TYPE_NETNS: {
481 const struct netns_entry *ns;
482
483 ns = netns_store_lookup((char*)tlv_packet->value, tlv_len);
484 if (ns)
485 conn->proxy_netns = ns;
486 break;
487 }
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100488#endif
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100489 case PP2_TYPE_AUTHORITY: {
490 if (tlv_len > PP2_AUTHORITY_MAX)
491 goto bad_header;
492 conn->proxy_authority = pool_alloc(pool_head_authority);
493 if (conn->proxy_authority == NULL)
494 goto fail;
495 memcpy(conn->proxy_authority, (const char *)tlv_packet->value, tlv_len);
496 conn->proxy_authority_len = tlv_len;
497 break;
498 }
Tim Duesterhusd1b15b62020-03-13 12:34:23 +0100499 case PP2_TYPE_UNIQUE_ID: {
500 const struct ist tlv = ist2((const char *)tlv_packet->value, tlv_len);
501
502 if (tlv.len > UNIQUEID_LEN)
503 goto bad_header;
Tim Duesterhus2b7f6c22020-03-14 13:07:05 +0100504 conn->proxy_unique_id = ist2(pool_alloc(pool_head_uniqueid), 0);
Tim Duesterhusd1b15b62020-03-13 12:34:23 +0100505 if (!isttest(conn->proxy_unique_id))
506 goto fail;
507 if (istcpy(&conn->proxy_unique_id, tlv, UNIQUEID_LEN) < 0) {
508 /* This is technically unreachable, because we verified above
509 * that the TLV value fits.
510 */
511 goto fail;
512 }
513 break;
514 }
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100515 default:
516 break;
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100517 }
518 }
519
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100520 /* Verify that the PROXYv2 header ends at a TLV boundary.
521 * This is technically unreachable, because the TLV parsing already
522 * verifies that a TLV does not exceed the total length and also
523 * that there is space for a TLV header.
524 */
525 if (tlv_offset != total_v2_len)
526 goto bad_header;
527
Willy Tarreau77992672014-06-14 11:06:17 +0200528 /* unsupported protocol, keep local connection address */
529 break;
530 case 0x00: /* LOCAL command */
531 /* keep local connection address for LOCAL */
532 break;
533 default:
534 goto bad_header; /* not a supported command */
535 }
536
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100537 trash.data = total_v2_len;
Willy Tarreau77992672014-06-14 11:06:17 +0200538 goto eat_header;
539
540 eat_header:
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200541 /* remove the PROXY line from the request. For this we re-read the
542 * exact line at once. If we don't get the exact same result, we
543 * fail.
544 */
Willy Tarreau157788c2020-02-11 10:08:05 +0100545 while (1) {
Tim Duesterhusa8692f32020-03-13 12:34:25 +0100546 ssize_t len2 = recv(conn->handle.fd, trash.area, trash.data, 0);
547
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200548 if (len2 < 0 && errno == EINTR)
549 continue;
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200550 if (len2 != trash.data)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100551 goto recv_abort;
Willy Tarreau157788c2020-02-11 10:08:05 +0100552 break;
553 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200554
555 conn->flags &= ~flag;
Emeric Brun4f603012017-01-05 15:11:44 +0100556 conn->flags |= CO_FL_RCVD_PROXY;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200557 return 1;
558
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200559 not_ready:
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200560 return 0;
561
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200562 missing:
563 /* Missing data. Since we're using MSG_PEEK, we can only poll again if
564 * we have not read anything. Otherwise we need to fail because we won't
565 * be able to poll anymore.
566 */
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100567 conn->err_code = CO_ER_PRX_TRUNCATED;
568 goto fail;
569
570 bad_header:
571 /* This is not a valid proxy protocol header */
572 conn->err_code = CO_ER_PRX_BAD_HDR;
573 goto fail;
574
575 recv_abort:
576 conn->err_code = CO_ER_PRX_ABORT;
Willy Tarreau26f4a042013-12-04 23:44:10 +0100577 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH;
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100578 goto fail;
579
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200580 fail:
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200581 conn->flags |= CO_FL_ERROR;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200582 return 0;
583}
584
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100585/* This handshake handler waits a NetScaler Client IP insertion header
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000586 * at the beginning of the raw data stream. The header format is
587 * described in doc/netscaler-client-ip-insertion-protocol.txt
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100588 *
589 * This line MUST be at the beginning of the buffer and MUST NOT be
590 * fragmented.
591 *
592 * The header line is small and in all cases smaller than the smallest normal
593 * TCP MSS. So it MUST always be delivered as one segment, which ensures we
594 * can safely use MSG_PEEK and avoid buffering.
595 *
596 * Once the data is fetched, the values are set in the connection's address
597 * fields, and data are removed from the socket's buffer. The function returns
598 * zero if it needs to wait for more data or if it fails, or 1 if it completed
599 * and removed itself.
600 */
601int conn_recv_netscaler_cip(struct connection *conn, int flag)
602{
603 char *line;
Bertrand Jacquin7d668f92017-12-13 01:23:39 +0000604 uint32_t hdr_len;
Willy Tarreau0ca24aa2019-03-29 17:35:32 +0100605 uint8_t ip_ver;
Willy Tarreaub406b872018-08-22 05:20:32 +0200606 int ret;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100607
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100608 if (!conn_ctrl_ready(conn))
609 goto fail;
610
Willy Tarreau9b7587a2020-10-15 07:32:10 +0200611 if (!sockaddr_alloc(&conn->src, NULL, 0) || !sockaddr_alloc(&conn->dst, NULL, 0))
Olivier Houchard1a9dbe52020-01-22 15:31:09 +0100612 goto fail;
613
Willy Tarreau585744b2017-08-24 14:31:19 +0200614 if (!fd_recv_ready(conn->handle.fd))
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200615 goto not_ready;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100616
Willy Tarreau157788c2020-02-11 10:08:05 +0100617 while (1) {
Willy Tarreaub406b872018-08-22 05:20:32 +0200618 ret = recv(conn->handle.fd, trash.area, trash.size, MSG_PEEK);
619 if (ret < 0) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100620 if (errno == EINTR)
621 continue;
622 if (errno == EAGAIN) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200623 fd_cant_recv(conn->handle.fd);
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200624 goto not_ready;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100625 }
626 goto recv_abort;
627 }
Willy Tarreaub406b872018-08-22 05:20:32 +0200628 trash.data = ret;
Willy Tarreau157788c2020-02-11 10:08:05 +0100629 break;
630 }
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100631
Willy Tarreauc192b0a2020-01-23 09:11:58 +0100632 conn->flags &= ~CO_FL_WAIT_L4_CONN;
633
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200634 if (!trash.data) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100635 /* client shutdown */
636 conn->err_code = CO_ER_CIP_EMPTY;
637 goto fail;
638 }
639
640 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000641 * CIP magic, header length or
642 * CIP magic, CIP length, CIP type, header length */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200643 if (trash.data < 12)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100644 goto missing;
645
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200646 line = trash.area;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100647
648 /* Decode a possible NetScaler Client IP request, fail early if
649 * it does not match */
Willy Tarreau1ac83af2020-02-25 10:06:49 +0100650 if (ntohl(read_u32(line)) != __objt_listener(conn->target)->bind_conf->ns_cip_magic)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100651 goto bad_magic;
652
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000653 /* Legacy CIP protocol */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200654 if ((trash.area[8] & 0xD0) == 0x40) {
Willy Tarreau1ac83af2020-02-25 10:06:49 +0100655 hdr_len = ntohl(read_u32((line+4)));
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000656 line += 8;
657 }
658 /* Standard CIP protocol */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200659 else if (trash.area[8] == 0x00) {
Willy Tarreau1ac83af2020-02-25 10:06:49 +0100660 hdr_len = ntohs(read_u32((line+10)));
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000661 line += 12;
662 }
663 /* Unknown CIP protocol */
664 else {
665 conn->err_code = CO_ER_CIP_BAD_PROTO;
666 goto fail;
667 }
668
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100669 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000670 * a minimal IP header */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200671 if (trash.data < 20)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100672 goto missing;
673
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100674 /* Get IP version from the first four bits */
Willy Tarreau0ca24aa2019-03-29 17:35:32 +0100675 ip_ver = (*line & 0xf0) >> 4;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100676
Willy Tarreau0ca24aa2019-03-29 17:35:32 +0100677 if (ip_ver == 4) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100678 struct ip *hdr_ip4;
David Carlier3015a2e2016-07-04 22:51:33 +0100679 struct my_tcphdr *hdr_tcp;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100680
681 hdr_ip4 = (struct ip *)line;
682
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200683 if (trash.data < 40 || trash.data < hdr_len) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100684 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin67de5a22017-12-13 01:15:05 +0000685 * IPv4 header, TCP header */
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100686 goto missing;
Bertrand Jacquinb3875912017-12-13 00:58:51 +0000687 }
688 else if (hdr_ip4->ip_p != IPPROTO_TCP) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100689 /* The protocol does not include a TCP header */
690 conn->err_code = CO_ER_CIP_BAD_PROTO;
691 goto fail;
Bertrand Jacquinb3875912017-12-13 00:58:51 +0000692 }
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100693
David Carlier3015a2e2016-07-04 22:51:33 +0100694 hdr_tcp = (struct my_tcphdr *)(line + (hdr_ip4->ip_hl * 4));
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100695
696 /* update the session's addresses and mark them set */
Willy Tarreau226572f2019-07-17 14:46:00 +0200697 ((struct sockaddr_in *)conn->src)->sin_family = AF_INET;
698 ((struct sockaddr_in *)conn->src)->sin_addr.s_addr = hdr_ip4->ip_src.s_addr;
699 ((struct sockaddr_in *)conn->src)->sin_port = hdr_tcp->source;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100700
Willy Tarreau226572f2019-07-17 14:46:00 +0200701 ((struct sockaddr_in *)conn->dst)->sin_family = AF_INET;
702 ((struct sockaddr_in *)conn->dst)->sin_addr.s_addr = hdr_ip4->ip_dst.s_addr;
703 ((struct sockaddr_in *)conn->dst)->sin_port = hdr_tcp->dest;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100704
705 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
706 }
Willy Tarreau0ca24aa2019-03-29 17:35:32 +0100707 else if (ip_ver == 6) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100708 struct ip6_hdr *hdr_ip6;
David Carlier3015a2e2016-07-04 22:51:33 +0100709 struct my_tcphdr *hdr_tcp;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100710
711 hdr_ip6 = (struct ip6_hdr *)line;
712
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200713 if (trash.data < 60 || trash.data < hdr_len) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100714 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin67de5a22017-12-13 01:15:05 +0000715 * IPv6 header, TCP header */
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100716 goto missing;
Bertrand Jacquinb3875912017-12-13 00:58:51 +0000717 }
718 else if (hdr_ip6->ip6_nxt != IPPROTO_TCP) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100719 /* The protocol does not include a TCP header */
720 conn->err_code = CO_ER_CIP_BAD_PROTO;
721 goto fail;
Bertrand Jacquinb3875912017-12-13 00:58:51 +0000722 }
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100723
David Carlier3015a2e2016-07-04 22:51:33 +0100724 hdr_tcp = (struct my_tcphdr *)(line + sizeof(struct ip6_hdr));
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100725
726 /* update the session's addresses and mark them set */
Willy Tarreau226572f2019-07-17 14:46:00 +0200727 ((struct sockaddr_in6 *)conn->src)->sin6_family = AF_INET6;
728 ((struct sockaddr_in6 *)conn->src)->sin6_addr = hdr_ip6->ip6_src;
729 ((struct sockaddr_in6 *)conn->src)->sin6_port = hdr_tcp->source;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100730
Willy Tarreau226572f2019-07-17 14:46:00 +0200731 ((struct sockaddr_in6 *)conn->dst)->sin6_family = AF_INET6;
732 ((struct sockaddr_in6 *)conn->dst)->sin6_addr = hdr_ip6->ip6_dst;
733 ((struct sockaddr_in6 *)conn->dst)->sin6_port = hdr_tcp->dest;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100734
735 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
736 }
737 else {
738 /* The protocol does not match something known (IPv4/IPv6) */
739 conn->err_code = CO_ER_CIP_BAD_PROTO;
740 goto fail;
741 }
742
Bertrand Jacquin7d668f92017-12-13 01:23:39 +0000743 line += hdr_len;
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200744 trash.data = line - trash.area;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100745
746 /* remove the NetScaler Client IP header from the request. For this
747 * we re-read the exact line at once. If we don't get the exact same
748 * result, we fail.
749 */
Willy Tarreau157788c2020-02-11 10:08:05 +0100750 while (1) {
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200751 int len2 = recv(conn->handle.fd, trash.area, trash.data, 0);
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100752 if (len2 < 0 && errno == EINTR)
753 continue;
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200754 if (len2 != trash.data)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100755 goto recv_abort;
Willy Tarreau157788c2020-02-11 10:08:05 +0100756 break;
757 }
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100758
759 conn->flags &= ~flag;
760 return 1;
761
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200762 not_ready:
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200763 return 0;
764
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100765 missing:
766 /* Missing data. Since we're using MSG_PEEK, we can only poll again if
767 * we have not read anything. Otherwise we need to fail because we won't
768 * be able to poll anymore.
769 */
770 conn->err_code = CO_ER_CIP_TRUNCATED;
771 goto fail;
772
773 bad_magic:
774 conn->err_code = CO_ER_CIP_BAD_MAGIC;
775 goto fail;
776
777 recv_abort:
778 conn->err_code = CO_ER_CIP_ABORT;
779 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH;
780 goto fail;
781
782 fail:
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100783 conn->flags |= CO_FL_ERROR;
784 return 0;
785}
786
Alexander Liu2a54bb72019-05-22 19:44:48 +0800787
788int conn_send_socks4_proxy_request(struct connection *conn)
789{
790 struct socks4_request req_line;
791
Alexander Liu2a54bb72019-05-22 19:44:48 +0800792 if (!conn_ctrl_ready(conn))
793 goto out_error;
794
Willy Tarreau226572f2019-07-17 14:46:00 +0200795 if (!conn_get_dst(conn))
796 goto out_error;
797
Alexander Liu2a54bb72019-05-22 19:44:48 +0800798 req_line.version = 0x04;
799 req_line.command = 0x01;
Willy Tarreau226572f2019-07-17 14:46:00 +0200800 req_line.port = get_net_port(conn->dst);
801 req_line.ip = is_inet_addr(conn->dst);
Alexander Liu2a54bb72019-05-22 19:44:48 +0800802 memcpy(req_line.user_id, "HAProxy\0", 8);
803
804 if (conn->send_proxy_ofs > 0) {
805 /*
806 * This is the first call to send the request
807 */
808 conn->send_proxy_ofs = -(int)sizeof(req_line);
809 }
810
811 if (conn->send_proxy_ofs < 0) {
812 int ret = 0;
813
814 /* we are sending the socks4_req_line here. If the data layer
815 * has a pending write, we'll also set MSG_MORE.
816 */
Willy Tarreau827fee72020-12-11 15:26:55 +0100817 ret = conn_ctrl_send(
Alexander Liu2a54bb72019-05-22 19:44:48 +0800818 conn,
819 ((char *)(&req_line)) + (sizeof(req_line)+conn->send_proxy_ofs),
820 -conn->send_proxy_ofs,
Willy Tarreau827fee72020-12-11 15:26:55 +0100821 (conn->subs && conn->subs->events & SUB_RETRY_SEND) ? CO_SFL_MSG_MORE : 0);
Alexander Liu2a54bb72019-05-22 19:44:48 +0800822
823 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Before send remain is [%d], sent [%d]\n",
824 conn->handle.fd, -conn->send_proxy_ofs, ret);
825
826 if (ret < 0) {
827 goto out_error;
828 }
829
830 conn->send_proxy_ofs += ret; /* becomes zero once complete */
831 if (conn->send_proxy_ofs != 0) {
832 goto out_wait;
833 }
834 }
835
836 /* OK we've the whole request sent */
837 conn->flags &= ~CO_FL_SOCKS4_SEND;
Alexander Liu2a54bb72019-05-22 19:44:48 +0800838
839 /* The connection is ready now, simply return and let the connection
840 * handler notify upper layers if needed.
841 */
Willy Tarreauc192b0a2020-01-23 09:11:58 +0100842 conn->flags &= ~CO_FL_WAIT_L4_CONN;
Alexander Liu2a54bb72019-05-22 19:44:48 +0800843
844 if (conn->flags & CO_FL_SEND_PROXY) {
845 /*
846 * Get the send_proxy_ofs ready for the send_proxy due to we are
847 * reusing the "send_proxy_ofs", and SOCKS4 handshake should be done
848 * before sending PROXY Protocol.
849 */
850 conn->send_proxy_ofs = 1;
851 }
852 return 1;
853
854 out_error:
855 /* Write error on the file descriptor */
856 conn->flags |= CO_FL_ERROR;
857 if (conn->err_code == CO_ER_NONE) {
858 conn->err_code = CO_ER_SOCKS4_SEND;
859 }
860 return 0;
861
862 out_wait:
Alexander Liu2a54bb72019-05-22 19:44:48 +0800863 return 0;
864}
865
866int conn_recv_socks4_proxy_response(struct connection *conn)
867{
868 char line[SOCKS4_HS_RSP_LEN];
869 int ret;
870
Alexander Liu2a54bb72019-05-22 19:44:48 +0800871 if (!conn_ctrl_ready(conn))
872 goto fail;
873
874 if (!fd_recv_ready(conn->handle.fd))
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200875 goto not_ready;
Alexander Liu2a54bb72019-05-22 19:44:48 +0800876
Willy Tarreau157788c2020-02-11 10:08:05 +0100877 while (1) {
Alexander Liu2a54bb72019-05-22 19:44:48 +0800878 /* SOCKS4 Proxy will response with 8 bytes, 0x00 | 0x5A | 0x00 0x00 | 0x00 0x00 0x00 0x00
879 * Try to peek into it, before all 8 bytes ready.
880 */
881 ret = recv(conn->handle.fd, line, SOCKS4_HS_RSP_LEN, MSG_PEEK);
882
883 if (ret == 0) {
884 /* the socket has been closed or shutdown for send */
885 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Received ret[%d], errno[%d], looks like the socket has been closed or shutdown for send\n",
886 conn->handle.fd, ret, errno);
887 if (conn->err_code == CO_ER_NONE) {
888 conn->err_code = CO_ER_SOCKS4_RECV;
889 }
890 goto fail;
891 }
892
893 if (ret > 0) {
894 if (ret == SOCKS4_HS_RSP_LEN) {
895 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Received 8 bytes, the response is [%02X|%02X|%02X %02X|%02X %02X %02X %02X]\n",
896 conn->handle.fd, line[0], line[1], line[2], line[3], line[4], line[5], line[6], line[7]);
897 }else{
898 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Received ret[%d], first byte is [%02X], last bye is [%02X]\n", conn->handle.fd, ret, line[0], line[ret-1]);
899 }
900 } else {
901 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Received ret[%d], errno[%d]\n", conn->handle.fd, ret, errno);
902 }
903
904 if (ret < 0) {
905 if (errno == EINTR) {
906 continue;
907 }
908 if (errno == EAGAIN) {
909 fd_cant_recv(conn->handle.fd);
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200910 goto not_ready;
Alexander Liu2a54bb72019-05-22 19:44:48 +0800911 }
912 goto recv_abort;
913 }
Willy Tarreau157788c2020-02-11 10:08:05 +0100914 break;
915 }
Alexander Liu2a54bb72019-05-22 19:44:48 +0800916
Willy Tarreauc192b0a2020-01-23 09:11:58 +0100917 conn->flags &= ~CO_FL_WAIT_L4_CONN;
918
Alexander Liu2a54bb72019-05-22 19:44:48 +0800919 if (ret < SOCKS4_HS_RSP_LEN) {
920 /* Missing data. Since we're using MSG_PEEK, we can only poll again if
921 * we are not able to read enough data.
922 */
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200923 goto not_ready;
Alexander Liu2a54bb72019-05-22 19:44:48 +0800924 }
925
926 /*
927 * Base on the SOCSK4 protocol:
928 *
929 * +----+----+----+----+----+----+----+----+
930 * | VN | CD | DSTPORT | DSTIP |
931 * +----+----+----+----+----+----+----+----+
932 * # of bytes: 1 1 2 4
933 * VN is the version of the reply code and should be 0. CD is the result
934 * code with one of the following values:
935 * 90: request granted
936 * 91: request rejected or failed
Ilya Shipitsince7b00f2020-03-23 22:28:40 +0500937 * 92: request rejected because SOCKS server cannot connect to identd on the client
Alexander Liu2a54bb72019-05-22 19:44:48 +0800938 * 93: request rejected because the client program and identd report different user-ids
939 * The remaining fields are ignored.
940 */
941 if (line[1] != 90) {
942 conn->flags &= ~CO_FL_SOCKS4_RECV;
943
944 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: FAIL, the response is [%02X|%02X|%02X %02X|%02X %02X %02X %02X]\n",
945 conn->handle.fd, line[0], line[1], line[2], line[3], line[4], line[5], line[6], line[7]);
946 if (conn->err_code == CO_ER_NONE) {
947 conn->err_code = CO_ER_SOCKS4_DENY;
948 }
949 goto fail;
950 }
951
952 /* remove the 8 bytes response from the stream */
Willy Tarreau157788c2020-02-11 10:08:05 +0100953 while (1) {
Alexander Liu2a54bb72019-05-22 19:44:48 +0800954 ret = recv(conn->handle.fd, line, SOCKS4_HS_RSP_LEN, 0);
955 if (ret < 0 && errno == EINTR) {
956 continue;
957 }
958 if (ret != SOCKS4_HS_RSP_LEN) {
959 if (conn->err_code == CO_ER_NONE) {
960 conn->err_code = CO_ER_SOCKS4_RECV;
961 }
962 goto fail;
963 }
Willy Tarreau157788c2020-02-11 10:08:05 +0100964 break;
965 }
Alexander Liu2a54bb72019-05-22 19:44:48 +0800966
967 conn->flags &= ~CO_FL_SOCKS4_RECV;
968 return 1;
969
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200970 not_ready:
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200971 return 0;
972
Alexander Liu2a54bb72019-05-22 19:44:48 +0800973 recv_abort:
974 if (conn->err_code == CO_ER_NONE) {
975 conn->err_code = CO_ER_SOCKS4_ABORT;
976 }
977 conn->flags |= (CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH);
978 goto fail;
979
980 fail:
Alexander Liu2a54bb72019-05-22 19:44:48 +0800981 conn->flags |= CO_FL_ERROR;
982 return 0;
983}
984
Ilya Shipitsinca56fce2018-09-15 00:50:05 +0500985/* Note: <remote> is explicitly allowed to be NULL */
Tim Duesterhuscf6e0c82020-03-13 12:34:24 +0100986int make_proxy_line(char *buf, int buf_len, struct server *srv, struct connection *remote, struct stream *strm)
David Safb76832014-05-08 23:42:08 -0400987{
988 int ret = 0;
989
990 if (srv && (srv->pp_opts & SRV_PP_V2)) {
Tim Duesterhuscf6e0c82020-03-13 12:34:24 +0100991 ret = make_proxy_line_v2(buf, buf_len, srv, remote, strm);
David Safb76832014-05-08 23:42:08 -0400992 }
993 else {
Willy Tarreau226572f2019-07-17 14:46:00 +0200994 if (remote && conn_get_src(remote) && conn_get_dst(remote))
995 ret = make_proxy_line_v1(buf, buf_len, remote->src, remote->dst);
David Safb76832014-05-08 23:42:08 -0400996 else
997 ret = make_proxy_line_v1(buf, buf_len, NULL, NULL);
998 }
999
1000 return ret;
1001}
1002
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001003/* Makes a PROXY protocol line from the two addresses. The output is sent to
1004 * buffer <buf> for a maximum size of <buf_len> (including the trailing zero).
1005 * It returns the number of bytes composing this line (including the trailing
1006 * LF), or zero in case of failure (eg: not enough space). It supports TCP4,
Willy Tarreau2e1401a2013-10-01 11:41:55 +02001007 * TCP6 and "UNKNOWN" formats. If any of <src> or <dst> is null, UNKNOWN is
1008 * emitted as well.
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001009 */
David Safb76832014-05-08 23:42:08 -04001010int make_proxy_line_v1(char *buf, int buf_len, struct sockaddr_storage *src, struct sockaddr_storage *dst)
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001011{
1012 int ret = 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001013 char * protocol;
1014 char src_str[MAX(INET_ADDRSTRLEN, INET6_ADDRSTRLEN)];
1015 char dst_str[MAX(INET_ADDRSTRLEN, INET6_ADDRSTRLEN)];
1016 in_port_t src_port;
1017 in_port_t dst_port;
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001018
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001019 if ( !src
1020 || !dst
1021 || (src->ss_family != AF_INET && src->ss_family != AF_INET6)
1022 || (dst->ss_family != AF_INET && dst->ss_family != AF_INET6)) {
1023 /* unknown family combination */
1024 ret = snprintf(buf, buf_len, "PROXY UNKNOWN\r\n");
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001025 if (ret >= buf_len)
1026 return 0;
1027
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001028 return ret;
1029 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001030
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001031 /* IPv4 for both src and dst */
1032 if (src->ss_family == AF_INET && dst->ss_family == AF_INET) {
1033 protocol = "TCP4";
1034 if (!inet_ntop(AF_INET, &((struct sockaddr_in *)src)->sin_addr, src_str, sizeof(src_str)))
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001035 return 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001036 src_port = ((struct sockaddr_in *)src)->sin_port;
1037 if (!inet_ntop(AF_INET, &((struct sockaddr_in *)dst)->sin_addr, dst_str, sizeof(dst_str)))
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001038 return 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001039 dst_port = ((struct sockaddr_in *)dst)->sin_port;
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001040 }
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001041 /* IPv6 for at least one of src and dst */
1042 else {
1043 struct in6_addr tmp;
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001044
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001045 protocol = "TCP6";
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001046
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001047 if (src->ss_family == AF_INET) {
1048 /* Convert src to IPv6 */
1049 v4tov6(&tmp, &((struct sockaddr_in *)src)->sin_addr);
1050 src_port = ((struct sockaddr_in *)src)->sin_port;
1051 }
1052 else {
1053 tmp = ((struct sockaddr_in6 *)src)->sin6_addr;
1054 src_port = ((struct sockaddr_in6 *)src)->sin6_port;
1055 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001056
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001057 if (!inet_ntop(AF_INET6, &tmp, src_str, sizeof(src_str)))
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001058 return 0;
1059
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001060 if (dst->ss_family == AF_INET) {
1061 /* Convert dst to IPv6 */
1062 v4tov6(&tmp, &((struct sockaddr_in *)dst)->sin_addr);
1063 dst_port = ((struct sockaddr_in *)dst)->sin_port;
1064 }
1065 else {
1066 tmp = ((struct sockaddr_in6 *)dst)->sin6_addr;
1067 dst_port = ((struct sockaddr_in6 *)dst)->sin6_port;
1068 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001069
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001070 if (!inet_ntop(AF_INET6, &tmp, dst_str, sizeof(dst_str)))
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001071 return 0;
1072 }
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001073
1074 ret = snprintf(buf, buf_len, "PROXY %s %s %s %u %u\r\n", protocol, src_str, dst_str, ntohs(src_port), ntohs(dst_port));
1075 if (ret >= buf_len)
1076 return 0;
1077
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001078 return ret;
1079}
David Safb76832014-05-08 23:42:08 -04001080
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001081static int make_tlv(char *dest, int dest_len, char type, uint16_t length, const char *value)
David Safb76832014-05-08 23:42:08 -04001082{
1083 struct tlv *tlv;
1084
1085 if (!dest || (length + sizeof(*tlv) > dest_len))
1086 return 0;
1087
1088 tlv = (struct tlv *)dest;
1089
1090 tlv->type = type;
1091 tlv->length_hi = length >> 8;
1092 tlv->length_lo = length & 0x00ff;
1093 memcpy(tlv->value, value, length);
1094 return length + sizeof(*tlv);
1095}
David Safb76832014-05-08 23:42:08 -04001096
Ilya Shipitsinca56fce2018-09-15 00:50:05 +05001097/* Note: <remote> is explicitly allowed to be NULL */
Tim Duesterhuscf6e0c82020-03-13 12:34:24 +01001098int make_proxy_line_v2(char *buf, int buf_len, struct server *srv, struct connection *remote, struct stream *strm)
David Safb76832014-05-08 23:42:08 -04001099{
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001100 const char pp2_signature[] = PP2_SIGNATURE;
Emmanuel Hocdet4399c752018-02-05 15:26:43 +01001101 void *tlv_crc32c_p = NULL;
David Safb76832014-05-08 23:42:08 -04001102 int ret = 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001103 struct proxy_hdr_v2 *hdr = (struct proxy_hdr_v2 *)buf;
Vincent Bernat6e615892016-05-18 16:17:44 +02001104 struct sockaddr_storage null_addr = { .ss_family = 0 };
David Safb76832014-05-08 23:42:08 -04001105 struct sockaddr_storage *src = &null_addr;
1106 struct sockaddr_storage *dst = &null_addr;
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001107 const char *value;
1108 int value_len;
David Safb76832014-05-08 23:42:08 -04001109
1110 if (buf_len < PP2_HEADER_LEN)
1111 return 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001112 memcpy(hdr->sig, pp2_signature, PP2_SIGNATURE_LEN);
David Safb76832014-05-08 23:42:08 -04001113
Willy Tarreau226572f2019-07-17 14:46:00 +02001114 if (remote && conn_get_src(remote) && conn_get_dst(remote)) {
1115 src = remote->src;
1116 dst = remote->dst;
David Safb76832014-05-08 23:42:08 -04001117 }
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001118
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001119 /* At least one of src or dst is not of AF_INET or AF_INET6 */
1120 if ( !src
1121 || !dst
Willy Tarreau119e50e2020-05-22 13:53:29 +02001122 || (!pp2_never_send_local && conn_is_back(remote)) // locally initiated connection
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001123 || (src->ss_family != AF_INET && src->ss_family != AF_INET6)
1124 || (dst->ss_family != AF_INET && dst->ss_family != AF_INET6)) {
David Safb76832014-05-08 23:42:08 -04001125 if (buf_len < PP2_HDR_LEN_UNSPEC)
1126 return 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001127 hdr->ver_cmd = PP2_VERSION | PP2_CMD_LOCAL;
1128 hdr->fam = PP2_FAM_UNSPEC | PP2_TRANS_UNSPEC;
David Safb76832014-05-08 23:42:08 -04001129 ret = PP2_HDR_LEN_UNSPEC;
1130 }
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001131 else {
Willy Tarreau02c88032020-04-14 12:54:10 +02001132 hdr->ver_cmd = PP2_VERSION | PP2_CMD_PROXY;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001133 /* IPv4 for both src and dst */
1134 if (src->ss_family == AF_INET && dst->ss_family == AF_INET) {
1135 if (buf_len < PP2_HDR_LEN_INET)
1136 return 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001137 hdr->fam = PP2_FAM_INET | PP2_TRANS_STREAM;
1138 hdr->addr.ip4.src_addr = ((struct sockaddr_in *)src)->sin_addr.s_addr;
1139 hdr->addr.ip4.src_port = ((struct sockaddr_in *)src)->sin_port;
1140 hdr->addr.ip4.dst_addr = ((struct sockaddr_in *)dst)->sin_addr.s_addr;
1141 hdr->addr.ip4.dst_port = ((struct sockaddr_in *)dst)->sin_port;
1142 ret = PP2_HDR_LEN_INET;
1143 }
1144 /* IPv6 for at least one of src and dst */
1145 else {
1146 struct in6_addr tmp;
1147
1148 if (buf_len < PP2_HDR_LEN_INET6)
1149 return 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001150 hdr->fam = PP2_FAM_INET6 | PP2_TRANS_STREAM;
1151 if (src->ss_family == AF_INET) {
1152 v4tov6(&tmp, &((struct sockaddr_in *)src)->sin_addr);
1153 memcpy(hdr->addr.ip6.src_addr, &tmp, 16);
1154 hdr->addr.ip6.src_port = ((struct sockaddr_in *)src)->sin_port;
1155 }
1156 else {
1157 memcpy(hdr->addr.ip6.src_addr, &((struct sockaddr_in6 *)src)->sin6_addr, 16);
1158 hdr->addr.ip6.src_port = ((struct sockaddr_in6 *)src)->sin6_port;
1159 }
1160 if (dst->ss_family == AF_INET) {
1161 v4tov6(&tmp, &((struct sockaddr_in *)dst)->sin_addr);
1162 memcpy(hdr->addr.ip6.dst_addr, &tmp, 16);
William Dauchybd8bf672020-01-26 19:06:39 +01001163 hdr->addr.ip6.dst_port = ((struct sockaddr_in *)dst)->sin_port;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001164 }
1165 else {
1166 memcpy(hdr->addr.ip6.dst_addr, &((struct sockaddr_in6 *)dst)->sin6_addr, 16);
1167 hdr->addr.ip6.dst_port = ((struct sockaddr_in6 *)dst)->sin6_port;
1168 }
1169
1170 ret = PP2_HDR_LEN_INET6;
1171 }
1172 }
David Safb76832014-05-08 23:42:08 -04001173
Emmanuel Hocdet4399c752018-02-05 15:26:43 +01001174 if (srv->pp_opts & SRV_PP_V2_CRC32C) {
1175 uint32_t zero_crc32c = 0;
Tim Duesterhusa8692f32020-03-13 12:34:25 +01001176
Emmanuel Hocdet4399c752018-02-05 15:26:43 +01001177 if ((buf_len - ret) < sizeof(struct tlv))
1178 return 0;
1179 tlv_crc32c_p = (void *)((struct tlv *)&buf[ret])->value;
1180 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_CRC32C, sizeof(zero_crc32c), (const char *)&zero_crc32c);
1181 }
1182
Ilya Shipitsinca56fce2018-09-15 00:50:05 +05001183 if (remote && conn_get_alpn(remote, &value, &value_len)) {
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001184 if ((buf_len - ret) < sizeof(struct tlv))
1185 return 0;
Emmanuel Hocdet571c7ac2017-10-31 18:24:05 +01001186 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_ALPN, value_len, value);
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001187 }
1188
Emmanuel Hocdet253c3b72018-02-01 18:29:59 +01001189 if (srv->pp_opts & SRV_PP_V2_AUTHORITY) {
Emmanuel Hocdet8a4ffa02019-08-29 11:54:51 +02001190 value = NULL;
1191 if (remote && remote->proxy_authority) {
1192 value = remote->proxy_authority;
1193 value_len = remote->proxy_authority_len;
1194 }
1195#ifdef USE_OPENSSL
1196 else {
Jerome Magnin78891c72019-09-02 09:53:41 +02001197 if ((value = ssl_sock_get_sni(remote)))
Emmanuel Hocdet8a4ffa02019-08-29 11:54:51 +02001198 value_len = strlen(value);
1199 }
1200#endif
Emmanuel Hocdet253c3b72018-02-01 18:29:59 +01001201 if (value) {
1202 if ((buf_len - ret) < sizeof(struct tlv))
1203 return 0;
Emmanuel Hocdet8a4ffa02019-08-29 11:54:51 +02001204 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_AUTHORITY, value_len, value);
Emmanuel Hocdet253c3b72018-02-01 18:29:59 +01001205 }
1206 }
1207
Christopher Faulet3ab504f2020-05-26 15:16:01 +02001208 if (strm && (srv->pp_opts & SRV_PP_V2_UNIQUE_ID)) {
Tim Duesterhuscf6e0c82020-03-13 12:34:24 +01001209 struct session* sess = strm_sess(strm);
1210 struct ist unique_id = stream_generate_unique_id(strm, &sess->fe->format_unique_id);
1211
1212 value = unique_id.ptr;
1213 value_len = unique_id.len;
1214
1215 if (value_len >= 0) {
1216 if ((buf_len - ret) < sizeof(struct tlv))
1217 return 0;
1218 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_UNIQUE_ID, value_len, value);
1219 }
1220 }
1221
Emmanuel Hocdet8a4ffa02019-08-29 11:54:51 +02001222#ifdef USE_OPENSSL
David Safb76832014-05-08 23:42:08 -04001223 if (srv->pp_opts & SRV_PP_V2_SSL) {
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001224 struct tlv_ssl *tlv;
1225 int ssl_tlv_len = 0;
Tim Duesterhusa8692f32020-03-13 12:34:25 +01001226
David Safb76832014-05-08 23:42:08 -04001227 if ((buf_len - ret) < sizeof(struct tlv_ssl))
1228 return 0;
1229 tlv = (struct tlv_ssl *)&buf[ret];
1230 memset(tlv, 0, sizeof(struct tlv_ssl));
1231 ssl_tlv_len += sizeof(struct tlv_ssl);
1232 tlv->tlv.type = PP2_TYPE_SSL;
1233 if (ssl_sock_is_ssl(remote)) {
1234 tlv->client |= PP2_CLIENT_SSL;
Emmanuel Hocdet01da5712017-10-13 16:59:49 +02001235 value = ssl_sock_get_proto_version(remote);
David Safb76832014-05-08 23:42:08 -04001236 if (value) {
Emmanuel Hocdet8c0c34b2018-02-28 12:02:14 +01001237 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len-ret-ssl_tlv_len), PP2_SUBTYPE_SSL_VERSION, strlen(value), value);
David Safb76832014-05-08 23:42:08 -04001238 }
Dave McCowan328fb582014-07-30 10:39:13 -04001239 if (ssl_sock_get_cert_used_sess(remote)) {
1240 tlv->client |= PP2_CLIENT_CERT_SESS;
David Safb76832014-05-08 23:42:08 -04001241 tlv->verify = htonl(ssl_sock_get_verify_result(remote));
Dave McCowan328fb582014-07-30 10:39:13 -04001242 if (ssl_sock_get_cert_used_conn(remote))
1243 tlv->client |= PP2_CLIENT_CERT_CONN;
David Safb76832014-05-08 23:42:08 -04001244 }
1245 if (srv->pp_opts & SRV_PP_V2_SSL_CN) {
Willy Tarreau83061a82018-07-13 11:56:34 +02001246 struct buffer *cn_trash = get_trash_chunk();
Willy Tarreau3b9a0c92014-07-19 06:37:33 +02001247 if (ssl_sock_get_remote_common_name(remote, cn_trash) > 0) {
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001248 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_CN,
1249 cn_trash->data,
1250 cn_trash->area);
David Safb76832014-05-08 23:42:08 -04001251 }
1252 }
Emmanuel Hocdetfa8d0f12018-02-01 15:53:52 +01001253 if (srv->pp_opts & SRV_PP_V2_SSL_KEY_ALG) {
Willy Tarreau83061a82018-07-13 11:56:34 +02001254 struct buffer *pkey_trash = get_trash_chunk();
Emmanuel Hocdetfa8d0f12018-02-01 15:53:52 +01001255 if (ssl_sock_get_pkey_algo(remote, pkey_trash) > 0) {
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001256 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_KEY_ALG,
1257 pkey_trash->data,
1258 pkey_trash->area);
Emmanuel Hocdetfa8d0f12018-02-01 15:53:52 +01001259 }
1260 }
1261 if (srv->pp_opts & SRV_PP_V2_SSL_SIG_ALG) {
1262 value = ssl_sock_get_cert_sig(remote);
1263 if (value) {
1264 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_SIG_ALG, strlen(value), value);
1265 }
1266 }
1267 if (srv->pp_opts & SRV_PP_V2_SSL_CIPHER) {
1268 value = ssl_sock_get_cipher_name(remote);
1269 if (value) {
1270 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_CIPHER, strlen(value), value);
1271 }
1272 }
David Safb76832014-05-08 23:42:08 -04001273 }
1274 tlv->tlv.length_hi = (uint16_t)(ssl_tlv_len - sizeof(struct tlv)) >> 8;
1275 tlv->tlv.length_lo = (uint16_t)(ssl_tlv_len - sizeof(struct tlv)) & 0x00ff;
1276 ret += ssl_tlv_len;
1277 }
1278#endif
1279
Willy Tarreaue5733232019-05-22 19:24:06 +02001280#ifdef USE_NS
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001281 if (remote && (remote->proxy_netns)) {
1282 if ((buf_len - ret) < sizeof(struct tlv))
1283 return 0;
Emmanuel Hocdet571c7ac2017-10-31 18:24:05 +01001284 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_NETNS, remote->proxy_netns->name_len, remote->proxy_netns->node.key);
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001285 }
1286#endif
1287
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001288 hdr->len = htons((uint16_t)(ret - PP2_HEADER_LEN));
David Safb76832014-05-08 23:42:08 -04001289
Emmanuel Hocdet4399c752018-02-05 15:26:43 +01001290 if (tlv_crc32c_p) {
1291 write_u32(tlv_crc32c_p, htonl(hash_crc32c(buf, ret)));
1292 }
1293
David Safb76832014-05-08 23:42:08 -04001294 return ret;
1295}
Emeric Brun4f603012017-01-05 15:11:44 +01001296
Willy Tarreau119e50e2020-05-22 13:53:29 +02001297/* returns 0 on success */
1298static int cfg_parse_pp2_never_send_local(char **args, int section_type, struct proxy *curpx,
1299 struct proxy *defpx, const char *file, int line,
1300 char **err)
1301{
1302 if (too_many_args(0, args, err, NULL))
1303 return -1;
1304 pp2_never_send_local = 1;
1305 return 0;
1306}
1307
Willy Tarreau60ca10a2017-08-18 15:26:54 +02001308/* return the major HTTP version as 1 or 2 depending on how the request arrived
1309 * before being processed.
1310 */
1311static int
1312smp_fetch_fc_http_major(const struct arg *args, struct sample *smp, const char *kw, void *private)
1313{
Jérôme Magnin86577422018-12-07 09:03:11 +01001314 struct connection *conn = (kw[0] != 'b') ? objt_conn(smp->sess->origin) :
1315 smp->strm ? cs_conn(objt_cs(smp->strm->si[1].end)) : NULL;
Willy Tarreau60ca10a2017-08-18 15:26:54 +02001316
1317 smp->data.type = SMP_T_SINT;
1318 smp->data.u.sint = (conn && strcmp(conn_get_mux_name(conn), "H2") == 0) ? 2 : 1;
1319 return 1;
1320}
1321
Emeric Brun4f603012017-01-05 15:11:44 +01001322/* fetch if the received connection used a PROXY protocol header */
1323int smp_fetch_fc_rcvd_proxy(const struct arg *args, struct sample *smp, const char *kw, void *private)
1324{
1325 struct connection *conn;
1326
1327 conn = objt_conn(smp->sess->origin);
1328 if (!conn)
1329 return 0;
1330
Willy Tarreau911db9b2020-01-23 16:27:54 +01001331 if (conn->flags & CO_FL_WAIT_XPRT) {
Emeric Brun4f603012017-01-05 15:11:44 +01001332 smp->flags |= SMP_F_MAY_CHANGE;
1333 return 0;
1334 }
1335
1336 smp->flags = 0;
1337 smp->data.type = SMP_T_BOOL;
1338 smp->data.u.sint = (conn->flags & CO_FL_RCVD_PROXY) ? 1 : 0;
1339
1340 return 1;
1341}
1342
Geoff Simmons7185b782019-08-27 18:31:16 +02001343/* fetch the authority TLV from a PROXY protocol header */
1344int smp_fetch_fc_pp_authority(const struct arg *args, struct sample *smp, const char *kw, void *private)
1345{
1346 struct connection *conn;
1347
1348 conn = objt_conn(smp->sess->origin);
1349 if (!conn)
1350 return 0;
1351
Willy Tarreau911db9b2020-01-23 16:27:54 +01001352 if (conn->flags & CO_FL_WAIT_XPRT) {
Geoff Simmons7185b782019-08-27 18:31:16 +02001353 smp->flags |= SMP_F_MAY_CHANGE;
1354 return 0;
1355 }
1356
1357 if (conn->proxy_authority == NULL)
1358 return 0;
1359
1360 smp->flags = 0;
1361 smp->data.type = SMP_T_STR;
1362 smp->data.u.str.area = conn->proxy_authority;
1363 smp->data.u.str.data = conn->proxy_authority_len;
1364
1365 return 1;
1366}
1367
Tim Duesterhusd1b15b62020-03-13 12:34:23 +01001368/* fetch the unique ID TLV from a PROXY protocol header */
1369int smp_fetch_fc_pp_unique_id(const struct arg *args, struct sample *smp, const char *kw, void *private)
1370{
1371 struct connection *conn;
1372
1373 conn = objt_conn(smp->sess->origin);
1374 if (!conn)
1375 return 0;
1376
1377 if (conn->flags & CO_FL_WAIT_XPRT) {
1378 smp->flags |= SMP_F_MAY_CHANGE;
1379 return 0;
1380 }
1381
1382 if (!isttest(conn->proxy_unique_id))
1383 return 0;
1384
1385 smp->flags = 0;
1386 smp->data.type = SMP_T_STR;
1387 smp->data.u.str.area = conn->proxy_unique_id.ptr;
1388 smp->data.u.str.data = conn->proxy_unique_id.len;
1389
1390 return 1;
1391}
1392
Emeric Brun4f603012017-01-05 15:11:44 +01001393/* Note: must not be declared <const> as its list will be overwritten.
1394 * Note: fetches that may return multiple types must be declared as the lowest
1395 * common denominator, the type that can be casted into all other ones. For
1396 * instance v4/v6 must be declared v4.
1397 */
1398static struct sample_fetch_kw_list sample_fetch_keywords = {ILH, {
Willy Tarreau60ca10a2017-08-18 15:26:54 +02001399 { "fc_http_major", smp_fetch_fc_http_major, 0, NULL, SMP_T_SINT, SMP_USE_L4CLI },
Jérôme Magnin86577422018-12-07 09:03:11 +01001400 { "bc_http_major", smp_fetch_fc_http_major, 0, NULL, SMP_T_SINT, SMP_USE_L4SRV },
Emeric Brun4f603012017-01-05 15:11:44 +01001401 { "fc_rcvd_proxy", smp_fetch_fc_rcvd_proxy, 0, NULL, SMP_T_BOOL, SMP_USE_L4CLI },
Geoff Simmons7185b782019-08-27 18:31:16 +02001402 { "fc_pp_authority", smp_fetch_fc_pp_authority, 0, NULL, SMP_T_STR, SMP_USE_L4CLI },
Tim Duesterhusd1b15b62020-03-13 12:34:23 +01001403 { "fc_pp_unique_id", smp_fetch_fc_pp_unique_id, 0, NULL, SMP_T_STR, SMP_USE_L4CLI },
Emeric Brun4f603012017-01-05 15:11:44 +01001404 { /* END */ },
1405}};
1406
Willy Tarreau0108d902018-11-25 19:14:37 +01001407INITCALL1(STG_REGISTER, sample_register_fetches, &sample_fetch_keywords);
Willy Tarreau119e50e2020-05-22 13:53:29 +02001408
1409static struct cfg_kw_list cfg_kws = {ILH, {
1410 { CFG_GLOBAL, "pp2-never-send-local", cfg_parse_pp2_never_send_local },
1411 { /* END */ },
1412}};
1413
1414INITCALL1(STG_REGISTER, cfg_register_keywords, &cfg_kws);
Amaury Denoyelle81c6f762021-01-18 14:57:50 +01001415
Amaury Denoyelle01a287f2021-02-11 16:46:53 +01001416/* private function to handle sockaddr as input for connection hash */
1417static void conn_calculate_hash_sockaddr(const struct sockaddr_storage *ss,
1418 char *buf, size_t *idx,
1419 enum conn_hash_params_t *hash_flags,
1420 enum conn_hash_params_t param_type_addr,
1421 enum conn_hash_params_t param_type_port)
1422{
1423 struct sockaddr_in *addr;
1424 struct sockaddr_in6 *addr6;
1425
1426 switch (ss->ss_family) {
1427 case AF_INET:
1428 addr = (struct sockaddr_in *)ss;
1429
1430 conn_hash_update(buf, idx,
1431 &addr->sin_addr, sizeof(addr->sin_addr),
1432 hash_flags, param_type_addr);
1433
1434 if (addr->sin_port) {
1435 conn_hash_update(buf, idx,
1436 &addr->sin_port, sizeof(addr->sin_port),
1437 hash_flags, param_type_port);
1438 }
1439
1440 break;
1441
1442 case AF_INET6:
1443 addr6 = (struct sockaddr_in6 *)ss;
1444
1445 conn_hash_update(buf, idx,
1446 &addr6->sin6_addr, sizeof(addr6->sin6_addr),
1447 hash_flags, param_type_addr);
1448
1449 if (addr6->sin6_port) {
1450 conn_hash_update(buf, idx,
1451 &addr6->sin6_port, sizeof(addr6->sin6_port),
1452 hash_flags, param_type_port);
1453 }
1454
1455 break;
1456 }
1457}
1458
Amaury Denoyelle81c6f762021-01-18 14:57:50 +01001459XXH64_hash_t conn_calculate_hash(const struct conn_hash_params *params)
1460{
1461 char *buf;
1462 size_t idx = 0;
1463 XXH64_hash_t hash = 0;
1464 enum conn_hash_params_t hash_flags = 0;
1465
1466 buf = trash.area;
1467
Amaury Denoyelle8ede3db2021-03-02 14:38:53 +01001468 conn_hash_update(buf, &idx, &params->target, sizeof(params->target), &hash_flags, 0);
Amaury Denoyelle1a58aca2021-01-22 16:47:46 +01001469
Amaury Denoyelle9b626e32021-01-06 17:03:27 +01001470 if (params->sni_prehash) {
1471 conn_hash_update(buf, &idx,
Amaury Denoyelle36441f42021-02-17 16:25:31 +01001472 &params->sni_prehash, sizeof(params->sni_prehash),
Amaury Denoyelle9b626e32021-01-06 17:03:27 +01001473 &hash_flags, CONN_HASH_PARAMS_TYPE_SNI);
1474 }
1475
Amaury Denoyelle01a287f2021-02-11 16:46:53 +01001476 if (params->dst_addr) {
1477 conn_calculate_hash_sockaddr(params->dst_addr,
1478 buf, &idx, &hash_flags,
1479 CONN_HASH_PARAMS_TYPE_DST_ADDR,
1480 CONN_HASH_PARAMS_TYPE_DST_PORT);
1481 }
1482
Amaury Denoyelled10a2002021-02-11 19:45:19 +01001483 if (params->src_addr) {
1484 conn_calculate_hash_sockaddr(params->src_addr,
1485 buf, &idx, &hash_flags,
1486 CONN_HASH_PARAMS_TYPE_SRC_ADDR,
1487 CONN_HASH_PARAMS_TYPE_SRC_PORT);
1488 }
1489
Amaury Denoyelle1921d202021-01-14 10:15:29 +01001490 if (params->proxy_prehash) {
1491 conn_hash_update(buf, &idx,
Amaury Denoyelle36441f42021-02-17 16:25:31 +01001492 &params->proxy_prehash, sizeof(params->proxy_prehash),
Amaury Denoyelle1921d202021-01-14 10:15:29 +01001493 &hash_flags, CONN_HASH_PARAMS_TYPE_PROXY);
1494 }
Amaury Denoyelle01a287f2021-02-11 16:46:53 +01001495
Amaury Denoyelle1921d202021-01-14 10:15:29 +01001496 hash = conn_hash_digest(buf, idx, hash_flags);
Amaury Denoyelle81c6f762021-01-18 14:57:50 +01001497 return hash;
1498}