blob: afe881cd9b5ebcb9305d2f69a9b6580548cc713d [file] [log] [blame]
Willy Tarreau59f98392012-07-06 14:13:49 +02001/*
2 * Connection management functions
3 *
4 * Copyright 2000-2012 Willy Tarreau <w@1wt.eu>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
Willy Tarreaue1e4a612012-10-05 00:10:55 +020013#include <errno.h>
14
Willy Tarreau4c7e4b72020-05-27 12:58:42 +020015#include <haproxy/api.h>
Willy Tarreau119e50e2020-05-22 13:53:29 +020016#include <common/cfgparse.h>
Willy Tarreau762d7a52020-06-04 11:23:07 +020017#include <haproxy/frontend.h>
Willy Tarreau7a00efb2020-06-02 17:02:59 +020018#include <haproxy/namespace.h>
Willy Tarreau8d366972020-05-27 16:10:29 +020019#include <haproxy/hash.h>
Willy Tarreau6131d6a2020-06-02 16:48:09 +020020#include <haproxy/net_helper.h>
Willy Tarreau59f98392012-07-06 14:13:49 +020021
Willy Tarreauc5788912012-08-24 18:12:41 +020022#include <proto/connection.h>
Willy Tarreau0f6ffd62020-06-03 19:33:00 +020023#include <haproxy/fd.h>
Willy Tarreau2da156f2012-07-23 15:07:23 +020024#include <proto/proto_tcp.h>
Willy Tarreau2c6be842012-07-06 17:12:34 +020025#include <proto/stream_interface.h>
Emeric Brun4f603012017-01-05 15:11:44 +010026#include <proto/sample.h>
Emeric Brun46591952012-05-18 15:47:34 +020027#include <proto/ssl_sock.h>
Emeric Brun46591952012-05-18 15:47:34 +020028
Alexander Liu2a54bb72019-05-22 19:44:48 +080029
Willy Tarreau8ceae722018-11-26 11:58:30 +010030DECLARE_POOL(pool_head_connection, "connection", sizeof(struct connection));
31DECLARE_POOL(pool_head_connstream, "conn_stream", sizeof(struct conn_stream));
Willy Tarreauff5d57b2019-07-17 18:37:02 +020032DECLARE_POOL(pool_head_sockaddr, "sockaddr", sizeof(struct sockaddr_storage));
Geoff Simmons7185b782019-08-27 18:31:16 +020033DECLARE_POOL(pool_head_authority, "authority", PP2_AUTHORITY_MAX);
Willy Tarreau8ceae722018-11-26 11:58:30 +010034
Willy Tarreau13e14102016-12-22 20:25:26 +010035struct xprt_ops *registered_xprt[XPRT_ENTRIES] = { NULL, };
Willy Tarreauf2943dc2012-10-26 20:10:28 +020036
Christopher Faulet32f61c02018-04-10 14:33:41 +020037/* List head of all known muxes for PROTO */
38struct mux_proto_list mux_proto_list = {
39 .list = LIST_HEAD_INIT(mux_proto_list.list)
Willy Tarreau2386be62017-09-21 19:40:52 +020040};
41
Willy Tarreau119e50e2020-05-22 13:53:29 +020042/* disables sending of proxy-protocol-v2's LOCAL command */
43static int pp2_never_send_local;
44
Olivier Houchard477902b2020-01-22 18:08:48 +010045int conn_create_mux(struct connection *conn)
46{
Olivier Houchard477902b2020-01-22 18:08:48 +010047 if (conn_is_back(conn)) {
48 struct server *srv;
49 struct conn_stream *cs = conn->ctx;
Christopher Faulet14cd3162020-04-16 14:50:06 +020050 struct session *sess = conn->owner;
Olivier Houchard477902b2020-01-22 18:08:48 +010051
52 if (conn->flags & CO_FL_ERROR)
53 goto fail;
Olivier Houcharda8a415d2020-01-23 13:15:14 +010054
Christopher Faulet14cd3162020-04-16 14:50:06 +020055 if (sess && obj_type(sess->origin) == OBJ_TYPE_CHECK) {
56 if (conn_install_mux_chk(conn, conn->ctx, conn->owner) < 0)
57 goto fail;
58 }
59 else if (conn_install_mux_be(conn, conn->ctx, conn->owner) < 0)
Olivier Houchard477902b2020-01-22 18:08:48 +010060 goto fail;
61 srv = objt_server(conn->target);
62 if (srv && ((srv->proxy->options & PR_O_REUSE_MASK) != PR_O_REUSE_NEVR) &&
63 conn->mux->avail_streams(conn) > 0)
Olivier Houchardf0d4dff2020-03-06 18:12:03 +010064 LIST_ADDQ(&srv->available_conns[tid], mt_list_to_list(&conn->list));
Olivier Houchard477902b2020-01-22 18:08:48 +010065 return 0;
66fail:
67 /* let the upper layer know the connection failed */
68 cs->data_cb->wake(cs);
69 return -1;
70 } else
71 return conn_complete_session(conn);
72
73}
74
Willy Tarreau59f98392012-07-06 14:13:49 +020075/* I/O callback for fd-based connections. It calls the read/write handlers
Willy Tarreau7a798e52016-04-14 11:13:20 +020076 * provided by the connection's sock_ops, which must be valid.
Willy Tarreau59f98392012-07-06 14:13:49 +020077 */
Willy Tarreau7a798e52016-04-14 11:13:20 +020078void conn_fd_handler(int fd)
Willy Tarreau59f98392012-07-06 14:13:49 +020079{
Willy Tarreau80184712012-07-06 14:54:49 +020080 struct connection *conn = fdtab[fd].owner;
Willy Tarreau9e272bf2012-10-03 21:04:48 +020081 unsigned int flags;
Willy Tarreau8de5c4f2020-03-04 17:45:21 +010082 int need_wake = 0;
Willy Tarreau59f98392012-07-06 14:13:49 +020083
Willy Tarreaud80cb4e2018-01-20 19:30:13 +010084 if (unlikely(!conn)) {
85 activity[tid].conn_dead++;
Willy Tarreau7a798e52016-04-14 11:13:20 +020086 return;
Willy Tarreaud80cb4e2018-01-20 19:30:13 +010087 }
Willy Tarreau59f98392012-07-06 14:13:49 +020088
Willy Tarreau7d281492012-12-16 19:19:13 +010089 flags = conn->flags & ~CO_FL_ERROR; /* ensure to call the wake handler upon error */
Willy Tarreaud29a0662012-12-10 16:33:38 +010090
Willy Tarreaub2a7ab02019-12-27 10:54:22 +010091 if (unlikely(conn->flags & CO_FL_WAIT_L4_CONN) &&
92 ((fd_send_ready(fd) && fd_send_active(fd)) ||
93 (fd_recv_ready(fd) && fd_recv_active(fd)))) {
94 /* Still waiting for a connection to establish and nothing was
95 * attempted yet to probe the connection. this will clear the
96 * CO_FL_WAIT_L4_CONN flag on success.
97 */
98 if (!conn_fd_check(conn))
99 goto leave;
Willy Tarreau8de5c4f2020-03-04 17:45:21 +0100100 need_wake = 1;
Willy Tarreaub2a7ab02019-12-27 10:54:22 +0100101 }
102
Willy Tarreau8081abe2019-11-28 18:08:49 +0100103 if (fd_send_ready(fd) && fd_send_active(fd)) {
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100104 /* force reporting of activity by clearing the previous flags :
105 * we'll have at least ERROR or CONNECTED at the end of an I/O,
106 * both of which will be detected below.
Willy Tarreau9e272bf2012-10-03 21:04:48 +0200107 */
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100108 flags = 0;
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100109 if (conn->subs && conn->subs->events & SUB_RETRY_SEND) {
Willy Tarreau8de5c4f2020-03-04 17:45:21 +0100110 need_wake = 0; // wake will be called after this I/O
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100111 tasklet_wakeup(conn->subs->tasklet);
112 conn->subs->events &= ~SUB_RETRY_SEND;
113 if (!conn->subs->events)
114 conn->subs = NULL;
Willy Tarreau8de5c4f2020-03-04 17:45:21 +0100115 }
Willy Tarreau667fefd2020-03-04 17:22:10 +0100116 fd_stop_send(fd);
Willy Tarreau9e272bf2012-10-03 21:04:48 +0200117 }
Willy Tarreau59f98392012-07-06 14:13:49 +0200118
Willy Tarreau57ec32f2017-04-11 19:59:33 +0200119 /* The data transfer starts here and stops on error and handshakes. Note
120 * that we must absolutely test conn->xprt at each step in case it suddenly
121 * changes due to a quick unexpected close().
122 */
Willy Tarreau8081abe2019-11-28 18:08:49 +0100123 if (fd_recv_ready(fd) && fd_recv_active(fd)) {
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100124 /* force reporting of activity by clearing the previous flags :
125 * we'll have at least ERROR or CONNECTED at the end of an I/O,
126 * both of which will be detected below.
Willy Tarreau9e272bf2012-10-03 21:04:48 +0200127 */
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100128 flags = 0;
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100129 if (conn->subs && conn->subs->events & SUB_RETRY_RECV) {
Willy Tarreau8de5c4f2020-03-04 17:45:21 +0100130 need_wake = 0; // wake will be called after this I/O
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100131 tasklet_wakeup(conn->subs->tasklet);
132 conn->subs->events &= ~SUB_RETRY_RECV;
133 if (!conn->subs->events)
134 conn->subs = NULL;
Willy Tarreau8de5c4f2020-03-04 17:45:21 +0100135 }
Willy Tarreau6f95f6e2020-03-04 18:33:19 +0100136 else if (tasks_run_queue_cur >= 16*global.tune.runqueue_depth) {
137 /* In order to save syscalls especially with epoll, we
138 * prefer *not* to disable receiving and instead let
139 * the handler do its job. But if the run queue becomes
140 * high, the excess of events may cause extra wakeups
141 * and in this case we'd rather flow-control ourselves.
142 */
143 fd_stop_recv(fd);
144 }
Willy Tarreau9e272bf2012-10-03 21:04:48 +0200145 }
Willy Tarreau2da156f2012-07-23 15:07:23 +0200146
Willy Tarreau2c6be842012-07-06 17:12:34 +0200147 leave:
Olivier Houchard477902b2020-01-22 18:08:48 +0100148 /* If we don't yet have a mux, that means we were waiting for
Ilya Shipitsince7b00f2020-03-23 22:28:40 +0500149 * information to create one, typically from the ALPN. If we're
Olivier Houchard477902b2020-01-22 18:08:48 +0100150 * done with the handshake, attempt to create one.
Willy Tarreau8e3c6ce2017-08-28 15:46:01 +0200151 */
Willy Tarreau911db9b2020-01-23 16:27:54 +0100152 if (unlikely(!conn->mux) && !(conn->flags & CO_FL_WAIT_XPRT))
Olivier Houchard477902b2020-01-22 18:08:48 +0100153 if (conn_create_mux(conn) < 0)
154 return;
Willy Tarreau8e3c6ce2017-08-28 15:46:01 +0200155
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100156 /* The wake callback is normally used to notify the data layer about
157 * data layer activity (successful send/recv), connection establishment,
158 * shutdown and fatal errors. We need to consider the following
159 * situations to wake up the data layer :
Willy Tarreau0fbc3182019-12-27 14:57:45 +0100160 * - change among the CO_FL_NOTIFY_DONE flags :
161 * SOCK_{RD,WR}_SH, ERROR,
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100162 * - absence of any of {L4,L6}_CONN and CONNECTED, indicating the
163 * end of handshake and transition to CONNECTED
164 * - raise of CONNECTED with HANDSHAKE down
165 * - end of HANDSHAKE with CONNECTED set
166 * - regular data layer activity
167 *
168 * Note that the wake callback is allowed to release the connection and
169 * the fd (and return < 0 in this case).
Willy Tarreau2396c1c2012-10-03 21:12:16 +0200170 */
Willy Tarreau8de5c4f2020-03-04 17:45:21 +0100171 if ((need_wake || ((conn->flags ^ flags) & CO_FL_NOTIFY_DONE) ||
Willy Tarreau911db9b2020-01-23 16:27:54 +0100172 ((flags & CO_FL_WAIT_XPRT) && !(conn->flags & CO_FL_WAIT_XPRT))) &&
Olivier Houchardfe50bfb2019-05-27 12:09:19 +0200173 conn->mux && conn->mux->wake && conn->mux->wake(conn) < 0)
Willy Tarreau7a798e52016-04-14 11:13:20 +0200174 return;
Willy Tarreaufd31e532012-07-23 18:24:25 +0200175
Willy Tarreauf9dabec2012-08-17 17:33:53 +0200176 /* commit polling changes */
177 conn_cond_update_polling(conn);
Willy Tarreau7a798e52016-04-14 11:13:20 +0200178 return;
Willy Tarreau59f98392012-07-06 14:13:49 +0200179}
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200180
Willy Tarreau4970e5a2019-12-27 10:40:21 +0100181/* This is the callback which is set when a connection establishment is pending
182 * and we have nothing to send. It may update the FD polling status to indicate
183 * !READY. It returns 0 if it fails in a fatal way or needs to poll to go
184 * further, otherwise it returns non-zero and removes the CO_FL_WAIT_L4_CONN
185 * flag from the connection's flags. In case of error, it sets CO_FL_ERROR and
186 * leaves the error code in errno.
187 */
188int conn_fd_check(struct connection *conn)
189{
190 struct sockaddr_storage *addr;
191 int fd = conn->handle.fd;
192
193 if (conn->flags & CO_FL_ERROR)
194 return 0;
195
196 if (!conn_ctrl_ready(conn))
197 return 0;
198
199 if (!(conn->flags & CO_FL_WAIT_L4_CONN))
200 return 1; /* strange we were called while ready */
201
202 if (!fd_send_ready(fd))
203 return 0;
204
205 /* Here we have 2 cases :
206 * - modern pollers, able to report ERR/HUP. If these ones return any
207 * of these flags then it's likely a failure, otherwise it possibly
208 * is a success (i.e. there may have been data received just before
209 * the error was reported).
210 * - select, which doesn't report these and with which it's always
211 * necessary either to try connect() again or to check for SO_ERROR.
212 * In order to simplify everything, we double-check using connect() as
213 * soon as we meet either of these delicate situations. Note that
214 * SO_ERROR would clear the error after reporting it!
215 */
216 if (cur_poller.flags & HAP_POLL_F_ERRHUP) {
217 /* modern poller, able to report ERR/HUP */
218 if ((fdtab[fd].ev & (FD_POLL_IN|FD_POLL_ERR|FD_POLL_HUP)) == FD_POLL_IN)
219 goto done;
220 if ((fdtab[fd].ev & (FD_POLL_OUT|FD_POLL_ERR|FD_POLL_HUP)) == FD_POLL_OUT)
221 goto done;
222 if (!(fdtab[fd].ev & (FD_POLL_ERR|FD_POLL_HUP)))
223 goto wait;
224 /* error present, fall through common error check path */
225 }
226
227 /* Use connect() to check the state of the socket. This has the double
228 * advantage of *not* clearing the error (so that health checks can
229 * still use getsockopt(SO_ERROR)) and giving us the following info :
230 * - error
231 * - connecting (EALREADY, EINPROGRESS)
232 * - connected (EISCONN, 0)
233 */
234 addr = conn->dst;
235 if ((conn->flags & CO_FL_SOCKS4) && obj_type(conn->target) == OBJ_TYPE_SERVER)
236 addr = &objt_server(conn->target)->socks4_addr;
237
238 if (connect(fd, (const struct sockaddr *)addr, get_addr_len(addr)) == -1) {
239 if (errno == EALREADY || errno == EINPROGRESS)
240 goto wait;
241
242 if (errno && errno != EISCONN)
243 goto out_error;
244 }
245
246 done:
247 /* The FD is ready now, we'll mark the connection as complete and
248 * forward the event to the transport layer which will notify the
249 * data layer.
250 */
251 conn->flags &= ~CO_FL_WAIT_L4_CONN;
252 fd_may_send(fd);
253 fd_cond_recv(fd);
254 errno = 0; // make health checks happy
255 return 1;
256
257 out_error:
258 /* Write error on the file descriptor. Report it to the connection
259 * and disable polling on this FD.
260 */
261 fdtab[fd].linger_risk = 0;
262 conn->flags |= CO_FL_ERROR | CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH;
Willy Tarreau5d4d1802020-02-21 09:58:29 +0100263 conn_stop_polling(conn);
Willy Tarreau4970e5a2019-12-27 10:40:21 +0100264 return 0;
265
266 wait:
Willy Tarreau4970e5a2019-12-27 10:40:21 +0100267 fd_cant_send(fd);
Willy Tarreaud1d14c32020-02-21 10:34:19 +0100268 fd_want_send(fd);
Willy Tarreau4970e5a2019-12-27 10:40:21 +0100269 return 0;
270}
271
Willy Tarreauff3e6482015-03-12 23:56:52 +0100272/* Send a message over an established connection. It makes use of send() and
273 * returns the same return code and errno. If the socket layer is not ready yet
274 * then -1 is returned and ENOTSOCK is set into errno. If the fd is not marked
275 * as ready, or if EAGAIN or ENOTCONN is returned, then we return 0. It returns
276 * EMSGSIZE if called with a zero length message. The purpose is to simplify
277 * some rare attempts to directly write on the socket from above the connection
278 * (typically send_proxy). In case of EAGAIN, the fd is marked as "cant_send".
279 * It automatically retries on EINTR. Other errors cause the connection to be
280 * marked as in error state. It takes similar arguments as send() except the
281 * first one which is the connection instead of the file descriptor. Note,
282 * MSG_DONTWAIT and MSG_NOSIGNAL are forced on the flags.
283 */
284int conn_sock_send(struct connection *conn, const void *buf, int len, int flags)
285{
286 int ret;
287
288 ret = -1;
289 errno = ENOTSOCK;
290
291 if (conn->flags & CO_FL_SOCK_WR_SH)
292 goto fail;
293
294 if (!conn_ctrl_ready(conn))
295 goto fail;
296
297 errno = EMSGSIZE;
298 if (!len)
299 goto fail;
300
Willy Tarreau585744b2017-08-24 14:31:19 +0200301 if (!fd_send_ready(conn->handle.fd))
Willy Tarreauff3e6482015-03-12 23:56:52 +0100302 goto wait;
303
304 do {
Willy Tarreau585744b2017-08-24 14:31:19 +0200305 ret = send(conn->handle.fd, buf, len, flags | MSG_DONTWAIT | MSG_NOSIGNAL);
Willy Tarreauff3e6482015-03-12 23:56:52 +0100306 } while (ret < 0 && errno == EINTR);
307
308
Willy Tarreauccf3f6d2019-09-05 17:05:05 +0200309 if (ret > 0) {
310 if (conn->flags & CO_FL_WAIT_L4_CONN) {
311 conn->flags &= ~CO_FL_WAIT_L4_CONN;
312 fd_may_send(conn->handle.fd);
313 fd_cond_recv(conn->handle.fd);
314 }
Willy Tarreauff3e6482015-03-12 23:56:52 +0100315 return ret;
Willy Tarreauccf3f6d2019-09-05 17:05:05 +0200316 }
Willy Tarreauff3e6482015-03-12 23:56:52 +0100317
318 if (ret == 0 || errno == EAGAIN || errno == ENOTCONN) {
319 wait:
Willy Tarreau585744b2017-08-24 14:31:19 +0200320 fd_cant_send(conn->handle.fd);
Willy Tarreauff3e6482015-03-12 23:56:52 +0100321 return 0;
322 }
323 fail:
324 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH | CO_FL_ERROR;
325 return ret;
326}
327
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100328/* Called from the upper layer, to subscribe <es> to events <event_type>. The
329 * event subscriber <es> is not allowed to change from a previous call as long
330 * as at least one event is still subscribed. The <event_type> must only be a
331 * combination of SUB_RETRY_RECV and SUB_RETRY_SEND. It always returns 0.
332 */
333int conn_unsubscribe(struct connection *conn, void *xprt_ctx, int event_type, struct wait_event *es)
Olivier Houchard83a0cd82018-09-28 17:57:58 +0200334{
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100335 BUG_ON(event_type & ~(SUB_RETRY_SEND|SUB_RETRY_RECV));
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100336 BUG_ON(conn->subs && conn->subs != es);
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100337
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100338 es->events &= ~event_type;
339 if (!es->events)
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100340 conn->subs = NULL;
341
Willy Tarreaud1d14c32020-02-21 10:34:19 +0100342 if (conn_ctrl_ready(conn)) {
343 if (event_type & SUB_RETRY_RECV)
344 fd_stop_recv(conn->handle.fd);
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100345
Willy Tarreaud1d14c32020-02-21 10:34:19 +0100346 if (event_type & SUB_RETRY_SEND)
347 fd_stop_send(conn->handle.fd);
348 }
Olivier Houchard83a0cd82018-09-28 17:57:58 +0200349 return 0;
350}
351
Willy Tarreau7e59c0a2020-02-28 14:24:49 +0100352/* Called from the upper layer, to subscribe <es> to events <event_type>.
353 * The <es> struct is not allowed to differ from the one passed during a
354 * previous call to subscribe(). If the FD is ready, the wait_event is
355 * immediately woken up and the subcription is cancelled. It always
356 * returns zero.
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100357 */
358int conn_subscribe(struct connection *conn, void *xprt_ctx, int event_type, struct wait_event *es)
Olivier Houchard6ff20392018-07-17 18:46:31 +0200359{
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100360 BUG_ON(event_type & ~(SUB_RETRY_SEND|SUB_RETRY_RECV));
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100361 BUG_ON(conn->subs && conn->subs != es);
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100362
Willy Tarreau7e59c0a2020-02-28 14:24:49 +0100363 if (conn->subs && (conn->subs->events & event_type) == event_type)
364 return 0;
365
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100366 conn->subs = es;
367 es->events |= event_type;
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100368
Willy Tarreaud1d14c32020-02-21 10:34:19 +0100369 if (conn_ctrl_ready(conn)) {
Willy Tarreau7e59c0a2020-02-28 14:24:49 +0100370 if (event_type & SUB_RETRY_RECV) {
371 if (fd_recv_ready(conn->handle.fd)) {
372 tasklet_wakeup(es->tasklet);
373 es->events &= ~SUB_RETRY_RECV;
374 if (!es->events)
375 conn->subs = NULL;
376 }
377 else
378 fd_want_recv(conn->handle.fd);
379 }
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100380
Willy Tarreau7e59c0a2020-02-28 14:24:49 +0100381 if (event_type & SUB_RETRY_SEND) {
382 if (fd_send_ready(conn->handle.fd)) {
383 tasklet_wakeup(es->tasklet);
384 es->events &= ~SUB_RETRY_SEND;
385 if (!es->events)
386 conn->subs = NULL;
387 }
388 else
389 fd_want_send(conn->handle.fd);
390 }
Willy Tarreaud1d14c32020-02-21 10:34:19 +0100391 }
Olivier Houchard83a0cd82018-09-28 17:57:58 +0200392 return 0;
Olivier Houchard6ff20392018-07-17 18:46:31 +0200393}
394
Willy Tarreaud85c4852015-03-13 00:40:28 +0100395/* Drains possibly pending incoming data on the file descriptor attached to the
396 * connection and update the connection's flags accordingly. This is used to
397 * know whether we need to disable lingering on close. Returns non-zero if it
398 * is safe to close without disabling lingering, otherwise zero. The SOCK_RD_SH
399 * flag may also be updated if the incoming shutdown was reported by the drain()
400 * function.
401 */
402int conn_sock_drain(struct connection *conn)
403{
Willy Tarreaue215bba2018-08-24 14:31:53 +0200404 int turns = 2;
405 int len;
406
Willy Tarreaud85c4852015-03-13 00:40:28 +0100407 if (!conn_ctrl_ready(conn))
408 return 1;
409
410 if (conn->flags & (CO_FL_ERROR | CO_FL_SOCK_RD_SH))
411 return 1;
412
Willy Tarreaue215bba2018-08-24 14:31:53 +0200413 if (fdtab[conn->handle.fd].ev & (FD_POLL_ERR|FD_POLL_HUP))
414 goto shut;
Willy Tarreaud85c4852015-03-13 00:40:28 +0100415
Willy Tarreaue215bba2018-08-24 14:31:53 +0200416 if (!fd_recv_ready(conn->handle.fd))
417 return 0;
Willy Tarreaud85c4852015-03-13 00:40:28 +0100418
Willy Tarreaue215bba2018-08-24 14:31:53 +0200419 if (conn->ctrl->drain) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200420 if (conn->ctrl->drain(conn->handle.fd) <= 0)
Willy Tarreaud85c4852015-03-13 00:40:28 +0100421 return 0;
Willy Tarreaue215bba2018-08-24 14:31:53 +0200422 goto shut;
423 }
424
425 /* no drain function defined, use the generic one */
426
427 while (turns) {
428#ifdef MSG_TRUNC_CLEARS_INPUT
429 len = recv(conn->handle.fd, NULL, INT_MAX, MSG_DONTWAIT | MSG_NOSIGNAL | MSG_TRUNC);
430 if (len == -1 && errno == EFAULT)
431#endif
432 len = recv(conn->handle.fd, trash.area, trash.size,
433 MSG_DONTWAIT | MSG_NOSIGNAL);
434
435 if (len == 0)
436 goto shut;
437
438 if (len < 0) {
439 if (errno == EAGAIN) {
440 /* connection not closed yet */
441 fd_cant_recv(conn->handle.fd);
442 break;
443 }
444 if (errno == EINTR) /* oops, try again */
445 continue;
446 /* other errors indicate a dead connection, fine. */
447 goto shut;
448 }
449 /* OK we read some data, let's try again once */
450 turns--;
Willy Tarreaud85c4852015-03-13 00:40:28 +0100451 }
452
Willy Tarreaue215bba2018-08-24 14:31:53 +0200453 /* some data are still present, give up */
454 return 0;
455
456 shut:
457 /* we're certain the connection was shut down */
458 fdtab[conn->handle.fd].linger_risk = 0;
Willy Tarreaud85c4852015-03-13 00:40:28 +0100459 conn->flags |= CO_FL_SOCK_RD_SH;
460 return 1;
461}
462
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100463/*
464 * Get data length from tlv
465 */
Tim Duesterhusba837ec2020-03-05 23:11:02 +0100466static inline size_t get_tlv_length(const struct tlv *src)
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100467{
468 return (src->length_hi << 8) | src->length_lo;
469}
470
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200471/* This handshake handler waits a PROXY protocol header at the beginning of the
472 * raw data stream. The header looks like this :
473 *
474 * "PROXY" <SP> PROTO <SP> SRC3 <SP> DST3 <SP> SRC4 <SP> <DST4> "\r\n"
475 *
476 * There must be exactly one space between each field. Fields are :
477 * - PROTO : layer 4 protocol, which must be "TCP4" or "TCP6".
478 * - SRC3 : layer 3 (eg: IP) source address in standard text form
479 * - DST3 : layer 3 (eg: IP) destination address in standard text form
480 * - SRC4 : layer 4 (eg: TCP port) source address in standard text form
481 * - DST4 : layer 4 (eg: TCP port) destination address in standard text form
482 *
483 * This line MUST be at the beginning of the buffer and MUST NOT wrap.
484 *
485 * The header line is small and in all cases smaller than the smallest normal
486 * TCP MSS. So it MUST always be delivered as one segment, which ensures we
487 * can safely use MSG_PEEK and avoid buffering.
488 *
489 * Once the data is fetched, the values are set in the connection's address
490 * fields, and data are removed from the socket's buffer. The function returns
491 * zero if it needs to wait for more data or if it fails, or 1 if it completed
492 * and removed itself.
493 */
494int conn_recv_proxy(struct connection *conn, int flag)
495{
496 char *line, *end;
Willy Tarreau77992672014-06-14 11:06:17 +0200497 struct proxy_hdr_v2 *hdr_v2;
498 const char v2sig[] = PP2_SIGNATURE;
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100499 size_t total_v2_len;
Tim Duesterhusba837ec2020-03-05 23:11:02 +0100500 size_t tlv_offset = 0;
Willy Tarreaub406b872018-08-22 05:20:32 +0200501 int ret;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200502
Willy Tarreau3c728722014-01-23 13:50:42 +0100503 if (!conn_ctrl_ready(conn))
Willy Tarreauf79c8172013-10-21 16:30:56 +0200504 goto fail;
505
Willy Tarreauca79f592019-07-17 19:04:47 +0200506 if (!sockaddr_alloc(&conn->src) || !sockaddr_alloc(&conn->dst))
507 goto fail;
508
Willy Tarreau585744b2017-08-24 14:31:19 +0200509 if (!fd_recv_ready(conn->handle.fd))
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200510 goto not_ready;
Willy Tarreaufd803bb2014-01-20 15:13:07 +0100511
Willy Tarreau157788c2020-02-11 10:08:05 +0100512 while (1) {
Willy Tarreaub406b872018-08-22 05:20:32 +0200513 ret = recv(conn->handle.fd, trash.area, trash.size, MSG_PEEK);
514 if (ret < 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200515 if (errno == EINTR)
516 continue;
517 if (errno == EAGAIN) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200518 fd_cant_recv(conn->handle.fd);
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200519 goto not_ready;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200520 }
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100521 goto recv_abort;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200522 }
Willy Tarreaub406b872018-08-22 05:20:32 +0200523 trash.data = ret;
Willy Tarreau157788c2020-02-11 10:08:05 +0100524 break;
525 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200526
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200527 if (!trash.data) {
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100528 /* client shutdown */
529 conn->err_code = CO_ER_PRX_EMPTY;
530 goto fail;
531 }
532
Willy Tarreauc192b0a2020-01-23 09:11:58 +0100533 conn->flags &= ~CO_FL_WAIT_L4_CONN;
534
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200535 if (trash.data < 6)
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200536 goto missing;
537
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200538 line = trash.area;
539 end = trash.area + trash.data;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200540
541 /* Decode a possible proxy request, fail early if it does not match */
Willy Tarreau77992672014-06-14 11:06:17 +0200542 if (strncmp(line, "PROXY ", 6) != 0)
543 goto not_v1;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200544
545 line += 6;
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200546 if (trash.data < 9) /* shortest possible line */
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200547 goto missing;
548
David CARLIER42ff05e2016-03-24 09:22:36 +0000549 if (memcmp(line, "TCP4 ", 5) == 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200550 u32 src3, dst3, sport, dport;
551
552 line += 5;
553
554 src3 = inetaddr_host_lim_ret(line, end, &line);
555 if (line == end)
556 goto missing;
557 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100558 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200559
560 dst3 = inetaddr_host_lim_ret(line, end, &line);
561 if (line == end)
562 goto missing;
563 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100564 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200565
566 sport = read_uint((const char **)&line, end);
567 if (line == end)
568 goto missing;
569 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100570 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200571
572 dport = read_uint((const char **)&line, end);
573 if (line > end - 2)
574 goto missing;
575 if (*line++ != '\r')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100576 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200577 if (*line++ != '\n')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100578 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200579
580 /* update the session's addresses and mark them set */
Willy Tarreau226572f2019-07-17 14:46:00 +0200581 ((struct sockaddr_in *)conn->src)->sin_family = AF_INET;
582 ((struct sockaddr_in *)conn->src)->sin_addr.s_addr = htonl(src3);
583 ((struct sockaddr_in *)conn->src)->sin_port = htons(sport);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200584
Willy Tarreau226572f2019-07-17 14:46:00 +0200585 ((struct sockaddr_in *)conn->dst)->sin_family = AF_INET;
586 ((struct sockaddr_in *)conn->dst)->sin_addr.s_addr = htonl(dst3);
587 ((struct sockaddr_in *)conn->dst)->sin_port = htons(dport);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200588 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
589 }
David CARLIER42ff05e2016-03-24 09:22:36 +0000590 else if (memcmp(line, "TCP6 ", 5) == 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200591 u32 sport, dport;
592 char *src_s;
593 char *dst_s, *sport_s, *dport_s;
594 struct in6_addr src3, dst3;
595
596 line += 5;
597
598 src_s = line;
599 dst_s = sport_s = dport_s = NULL;
600 while (1) {
601 if (line > end - 2) {
602 goto missing;
603 }
604 else if (*line == '\r') {
605 *line = 0;
606 line++;
607 if (*line++ != '\n')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100608 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200609 break;
610 }
611
612 if (*line == ' ') {
613 *line = 0;
614 if (!dst_s)
615 dst_s = line + 1;
616 else if (!sport_s)
617 sport_s = line + 1;
618 else if (!dport_s)
619 dport_s = line + 1;
620 }
621 line++;
622 }
623
624 if (!dst_s || !sport_s || !dport_s)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100625 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200626
627 sport = read_uint((const char **)&sport_s,dport_s - 1);
628 if (*sport_s != 0)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100629 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200630
631 dport = read_uint((const char **)&dport_s,line - 2);
632 if (*dport_s != 0)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100633 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200634
635 if (inet_pton(AF_INET6, src_s, (void *)&src3) != 1)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100636 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200637
638 if (inet_pton(AF_INET6, dst_s, (void *)&dst3) != 1)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100639 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200640
641 /* update the session's addresses and mark them set */
Willy Tarreau226572f2019-07-17 14:46:00 +0200642 ((struct sockaddr_in6 *)conn->src)->sin6_family = AF_INET6;
643 memcpy(&((struct sockaddr_in6 *)conn->src)->sin6_addr, &src3, sizeof(struct in6_addr));
644 ((struct sockaddr_in6 *)conn->src)->sin6_port = htons(sport);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200645
Willy Tarreau226572f2019-07-17 14:46:00 +0200646 ((struct sockaddr_in6 *)conn->dst)->sin6_family = AF_INET6;
647 memcpy(&((struct sockaddr_in6 *)conn->dst)->sin6_addr, &dst3, sizeof(struct in6_addr));
648 ((struct sockaddr_in6 *)conn->dst)->sin6_port = htons(dport);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200649 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
650 }
Willy Tarreau4c20d292014-06-14 11:41:36 +0200651 else if (memcmp(line, "UNKNOWN\r\n", 9) == 0) {
652 /* This can be a UNIX socket forwarded by an haproxy upstream */
653 line += 9;
654 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200655 else {
Willy Tarreau4c20d292014-06-14 11:41:36 +0200656 /* The protocol does not match something known (TCP4/TCP6/UNKNOWN) */
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100657 conn->err_code = CO_ER_PRX_BAD_PROTO;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200658 goto fail;
659 }
660
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200661 trash.data = line - trash.area;
Willy Tarreau77992672014-06-14 11:06:17 +0200662 goto eat_header;
663
664 not_v1:
665 /* try PPv2 */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200666 if (trash.data < PP2_HEADER_LEN)
Willy Tarreau77992672014-06-14 11:06:17 +0200667 goto missing;
668
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200669 hdr_v2 = (struct proxy_hdr_v2 *) trash.area;
Willy Tarreau77992672014-06-14 11:06:17 +0200670
671 if (memcmp(hdr_v2->sig, v2sig, PP2_SIGNATURE_LEN) != 0 ||
672 (hdr_v2->ver_cmd & PP2_VERSION_MASK) != PP2_VERSION) {
673 conn->err_code = CO_ER_PRX_NOT_HDR;
674 goto fail;
675 }
676
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100677 total_v2_len = PP2_HEADER_LEN + ntohs(hdr_v2->len);
678 if (trash.data < total_v2_len)
Willy Tarreau77992672014-06-14 11:06:17 +0200679 goto missing;
680
681 switch (hdr_v2->ver_cmd & PP2_CMD_MASK) {
682 case 0x01: /* PROXY command */
683 switch (hdr_v2->fam) {
684 case 0x11: /* TCPv4 */
KOVACS Krisztianefd3aa92014-11-19 10:53:20 +0100685 if (ntohs(hdr_v2->len) < PP2_ADDR_LEN_INET)
686 goto bad_header;
687
Willy Tarreau226572f2019-07-17 14:46:00 +0200688 ((struct sockaddr_in *)conn->src)->sin_family = AF_INET;
689 ((struct sockaddr_in *)conn->src)->sin_addr.s_addr = hdr_v2->addr.ip4.src_addr;
690 ((struct sockaddr_in *)conn->src)->sin_port = hdr_v2->addr.ip4.src_port;
691 ((struct sockaddr_in *)conn->dst)->sin_family = AF_INET;
692 ((struct sockaddr_in *)conn->dst)->sin_addr.s_addr = hdr_v2->addr.ip4.dst_addr;
693 ((struct sockaddr_in *)conn->dst)->sin_port = hdr_v2->addr.ip4.dst_port;
Willy Tarreau77992672014-06-14 11:06:17 +0200694 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
KOVACS Krisztian7209c202015-07-03 14:09:10 +0200695 tlv_offset = PP2_HEADER_LEN + PP2_ADDR_LEN_INET;
Willy Tarreau77992672014-06-14 11:06:17 +0200696 break;
697 case 0x21: /* TCPv6 */
KOVACS Krisztianefd3aa92014-11-19 10:53:20 +0100698 if (ntohs(hdr_v2->len) < PP2_ADDR_LEN_INET6)
699 goto bad_header;
700
Willy Tarreau226572f2019-07-17 14:46:00 +0200701 ((struct sockaddr_in6 *)conn->src)->sin6_family = AF_INET6;
702 memcpy(&((struct sockaddr_in6 *)conn->src)->sin6_addr, hdr_v2->addr.ip6.src_addr, 16);
703 ((struct sockaddr_in6 *)conn->src)->sin6_port = hdr_v2->addr.ip6.src_port;
704 ((struct sockaddr_in6 *)conn->dst)->sin6_family = AF_INET6;
705 memcpy(&((struct sockaddr_in6 *)conn->dst)->sin6_addr, hdr_v2->addr.ip6.dst_addr, 16);
706 ((struct sockaddr_in6 *)conn->dst)->sin6_port = hdr_v2->addr.ip6.dst_port;
Willy Tarreau77992672014-06-14 11:06:17 +0200707 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
KOVACS Krisztian7209c202015-07-03 14:09:10 +0200708 tlv_offset = PP2_HEADER_LEN + PP2_ADDR_LEN_INET6;
Willy Tarreau77992672014-06-14 11:06:17 +0200709 break;
710 }
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100711
712 /* TLV parsing */
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100713 while (tlv_offset < total_v2_len) {
714 struct tlv *tlv_packet;
Tim Duesterhusba837ec2020-03-05 23:11:02 +0100715 size_t tlv_len;
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100716
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100717 /* Verify that we have at least TLV_HEADER_SIZE bytes left */
718 if (tlv_offset + TLV_HEADER_SIZE > total_v2_len)
719 goto bad_header;
720
721 tlv_packet = (struct tlv *) &trash.area[tlv_offset];
722 tlv_len = get_tlv_length(tlv_packet);
723 tlv_offset += tlv_len + TLV_HEADER_SIZE;
724
725 /* Verify that the TLV length does not exceed the total PROXYv2 length */
726 if (tlv_offset > total_v2_len)
727 goto bad_header;
728
729 switch (tlv_packet->type) {
730 case PP2_TYPE_CRC32C: {
731 uint32_t n_crc32c;
732
733 /* Verify that this TLV is exactly 4 bytes long */
734 if (tlv_len != 4)
735 goto bad_header;
736
737 n_crc32c = read_n32(tlv_packet->value);
738 write_n32(tlv_packet->value, 0); // compute with CRC==0
739
740 if (hash_crc32c(trash.area, total_v2_len) != n_crc32c)
741 goto bad_header;
742 break;
743 }
Willy Tarreaue5733232019-05-22 19:24:06 +0200744#ifdef USE_NS
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100745 case PP2_TYPE_NETNS: {
746 const struct netns_entry *ns;
747
748 ns = netns_store_lookup((char*)tlv_packet->value, tlv_len);
749 if (ns)
750 conn->proxy_netns = ns;
751 break;
752 }
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100753#endif
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100754 case PP2_TYPE_AUTHORITY: {
755 if (tlv_len > PP2_AUTHORITY_MAX)
756 goto bad_header;
757 conn->proxy_authority = pool_alloc(pool_head_authority);
758 if (conn->proxy_authority == NULL)
759 goto fail;
760 memcpy(conn->proxy_authority, (const char *)tlv_packet->value, tlv_len);
761 conn->proxy_authority_len = tlv_len;
762 break;
763 }
Tim Duesterhusd1b15b62020-03-13 12:34:23 +0100764 case PP2_TYPE_UNIQUE_ID: {
765 const struct ist tlv = ist2((const char *)tlv_packet->value, tlv_len);
766
767 if (tlv.len > UNIQUEID_LEN)
768 goto bad_header;
Tim Duesterhus2b7f6c22020-03-14 13:07:05 +0100769 conn->proxy_unique_id = ist2(pool_alloc(pool_head_uniqueid), 0);
Tim Duesterhusd1b15b62020-03-13 12:34:23 +0100770 if (!isttest(conn->proxy_unique_id))
771 goto fail;
772 if (istcpy(&conn->proxy_unique_id, tlv, UNIQUEID_LEN) < 0) {
773 /* This is technically unreachable, because we verified above
774 * that the TLV value fits.
775 */
776 goto fail;
777 }
778 break;
779 }
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100780 default:
781 break;
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100782 }
783 }
784
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100785 /* Verify that the PROXYv2 header ends at a TLV boundary.
786 * This is technically unreachable, because the TLV parsing already
787 * verifies that a TLV does not exceed the total length and also
788 * that there is space for a TLV header.
789 */
790 if (tlv_offset != total_v2_len)
791 goto bad_header;
792
Willy Tarreau77992672014-06-14 11:06:17 +0200793 /* unsupported protocol, keep local connection address */
794 break;
795 case 0x00: /* LOCAL command */
796 /* keep local connection address for LOCAL */
797 break;
798 default:
799 goto bad_header; /* not a supported command */
800 }
801
Tim Duesterhus488ee7f2020-03-05 22:55:20 +0100802 trash.data = total_v2_len;
Willy Tarreau77992672014-06-14 11:06:17 +0200803 goto eat_header;
804
805 eat_header:
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200806 /* remove the PROXY line from the request. For this we re-read the
807 * exact line at once. If we don't get the exact same result, we
808 * fail.
809 */
Willy Tarreau157788c2020-02-11 10:08:05 +0100810 while (1) {
Tim Duesterhusa8692f32020-03-13 12:34:25 +0100811 ssize_t len2 = recv(conn->handle.fd, trash.area, trash.data, 0);
812
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200813 if (len2 < 0 && errno == EINTR)
814 continue;
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200815 if (len2 != trash.data)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100816 goto recv_abort;
Willy Tarreau157788c2020-02-11 10:08:05 +0100817 break;
818 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200819
820 conn->flags &= ~flag;
Emeric Brun4f603012017-01-05 15:11:44 +0100821 conn->flags |= CO_FL_RCVD_PROXY;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200822 return 1;
823
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200824 not_ready:
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200825 return 0;
826
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200827 missing:
828 /* Missing data. Since we're using MSG_PEEK, we can only poll again if
829 * we have not read anything. Otherwise we need to fail because we won't
830 * be able to poll anymore.
831 */
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100832 conn->err_code = CO_ER_PRX_TRUNCATED;
833 goto fail;
834
835 bad_header:
836 /* This is not a valid proxy protocol header */
837 conn->err_code = CO_ER_PRX_BAD_HDR;
838 goto fail;
839
840 recv_abort:
841 conn->err_code = CO_ER_PRX_ABORT;
Willy Tarreau26f4a042013-12-04 23:44:10 +0100842 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH;
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100843 goto fail;
844
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200845 fail:
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200846 conn->flags |= CO_FL_ERROR;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200847 return 0;
848}
849
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100850/* This handshake handler waits a NetScaler Client IP insertion header
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000851 * at the beginning of the raw data stream. The header format is
852 * described in doc/netscaler-client-ip-insertion-protocol.txt
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100853 *
854 * This line MUST be at the beginning of the buffer and MUST NOT be
855 * fragmented.
856 *
857 * The header line is small and in all cases smaller than the smallest normal
858 * TCP MSS. So it MUST always be delivered as one segment, which ensures we
859 * can safely use MSG_PEEK and avoid buffering.
860 *
861 * Once the data is fetched, the values are set in the connection's address
862 * fields, and data are removed from the socket's buffer. The function returns
863 * zero if it needs to wait for more data or if it fails, or 1 if it completed
864 * and removed itself.
865 */
866int conn_recv_netscaler_cip(struct connection *conn, int flag)
867{
868 char *line;
Bertrand Jacquin7d668f92017-12-13 01:23:39 +0000869 uint32_t hdr_len;
Willy Tarreau0ca24aa2019-03-29 17:35:32 +0100870 uint8_t ip_ver;
Willy Tarreaub406b872018-08-22 05:20:32 +0200871 int ret;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100872
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100873 if (!conn_ctrl_ready(conn))
874 goto fail;
875
Olivier Houchard1a9dbe52020-01-22 15:31:09 +0100876 if (!sockaddr_alloc(&conn->src) || !sockaddr_alloc(&conn->dst))
877 goto fail;
878
Willy Tarreau585744b2017-08-24 14:31:19 +0200879 if (!fd_recv_ready(conn->handle.fd))
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200880 goto not_ready;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100881
Willy Tarreau157788c2020-02-11 10:08:05 +0100882 while (1) {
Willy Tarreaub406b872018-08-22 05:20:32 +0200883 ret = recv(conn->handle.fd, trash.area, trash.size, MSG_PEEK);
884 if (ret < 0) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100885 if (errno == EINTR)
886 continue;
887 if (errno == EAGAIN) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200888 fd_cant_recv(conn->handle.fd);
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200889 goto not_ready;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100890 }
891 goto recv_abort;
892 }
Willy Tarreaub406b872018-08-22 05:20:32 +0200893 trash.data = ret;
Willy Tarreau157788c2020-02-11 10:08:05 +0100894 break;
895 }
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100896
Willy Tarreauc192b0a2020-01-23 09:11:58 +0100897 conn->flags &= ~CO_FL_WAIT_L4_CONN;
898
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200899 if (!trash.data) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100900 /* client shutdown */
901 conn->err_code = CO_ER_CIP_EMPTY;
902 goto fail;
903 }
904
905 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000906 * CIP magic, header length or
907 * CIP magic, CIP length, CIP type, header length */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200908 if (trash.data < 12)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100909 goto missing;
910
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200911 line = trash.area;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100912
913 /* Decode a possible NetScaler Client IP request, fail early if
914 * it does not match */
Willy Tarreau1ac83af2020-02-25 10:06:49 +0100915 if (ntohl(read_u32(line)) != __objt_listener(conn->target)->bind_conf->ns_cip_magic)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100916 goto bad_magic;
917
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000918 /* Legacy CIP protocol */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200919 if ((trash.area[8] & 0xD0) == 0x40) {
Willy Tarreau1ac83af2020-02-25 10:06:49 +0100920 hdr_len = ntohl(read_u32((line+4)));
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000921 line += 8;
922 }
923 /* Standard CIP protocol */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200924 else if (trash.area[8] == 0x00) {
Willy Tarreau1ac83af2020-02-25 10:06:49 +0100925 hdr_len = ntohs(read_u32((line+10)));
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000926 line += 12;
927 }
928 /* Unknown CIP protocol */
929 else {
930 conn->err_code = CO_ER_CIP_BAD_PROTO;
931 goto fail;
932 }
933
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100934 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000935 * a minimal IP header */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200936 if (trash.data < 20)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100937 goto missing;
938
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100939 /* Get IP version from the first four bits */
Willy Tarreau0ca24aa2019-03-29 17:35:32 +0100940 ip_ver = (*line & 0xf0) >> 4;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100941
Willy Tarreau0ca24aa2019-03-29 17:35:32 +0100942 if (ip_ver == 4) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100943 struct ip *hdr_ip4;
David Carlier3015a2e2016-07-04 22:51:33 +0100944 struct my_tcphdr *hdr_tcp;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100945
946 hdr_ip4 = (struct ip *)line;
947
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200948 if (trash.data < 40 || trash.data < hdr_len) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100949 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin67de5a22017-12-13 01:15:05 +0000950 * IPv4 header, TCP header */
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100951 goto missing;
Bertrand Jacquinb3875912017-12-13 00:58:51 +0000952 }
953 else if (hdr_ip4->ip_p != IPPROTO_TCP) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100954 /* The protocol does not include a TCP header */
955 conn->err_code = CO_ER_CIP_BAD_PROTO;
956 goto fail;
Bertrand Jacquinb3875912017-12-13 00:58:51 +0000957 }
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100958
David Carlier3015a2e2016-07-04 22:51:33 +0100959 hdr_tcp = (struct my_tcphdr *)(line + (hdr_ip4->ip_hl * 4));
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100960
961 /* update the session's addresses and mark them set */
Willy Tarreau226572f2019-07-17 14:46:00 +0200962 ((struct sockaddr_in *)conn->src)->sin_family = AF_INET;
963 ((struct sockaddr_in *)conn->src)->sin_addr.s_addr = hdr_ip4->ip_src.s_addr;
964 ((struct sockaddr_in *)conn->src)->sin_port = hdr_tcp->source;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100965
Willy Tarreau226572f2019-07-17 14:46:00 +0200966 ((struct sockaddr_in *)conn->dst)->sin_family = AF_INET;
967 ((struct sockaddr_in *)conn->dst)->sin_addr.s_addr = hdr_ip4->ip_dst.s_addr;
968 ((struct sockaddr_in *)conn->dst)->sin_port = hdr_tcp->dest;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100969
970 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
971 }
Willy Tarreau0ca24aa2019-03-29 17:35:32 +0100972 else if (ip_ver == 6) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100973 struct ip6_hdr *hdr_ip6;
David Carlier3015a2e2016-07-04 22:51:33 +0100974 struct my_tcphdr *hdr_tcp;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100975
976 hdr_ip6 = (struct ip6_hdr *)line;
977
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200978 if (trash.data < 60 || trash.data < hdr_len) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100979 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin67de5a22017-12-13 01:15:05 +0000980 * IPv6 header, TCP header */
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100981 goto missing;
Bertrand Jacquinb3875912017-12-13 00:58:51 +0000982 }
983 else if (hdr_ip6->ip6_nxt != IPPROTO_TCP) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100984 /* The protocol does not include a TCP header */
985 conn->err_code = CO_ER_CIP_BAD_PROTO;
986 goto fail;
Bertrand Jacquinb3875912017-12-13 00:58:51 +0000987 }
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100988
David Carlier3015a2e2016-07-04 22:51:33 +0100989 hdr_tcp = (struct my_tcphdr *)(line + sizeof(struct ip6_hdr));
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100990
991 /* update the session's addresses and mark them set */
Willy Tarreau226572f2019-07-17 14:46:00 +0200992 ((struct sockaddr_in6 *)conn->src)->sin6_family = AF_INET6;
993 ((struct sockaddr_in6 *)conn->src)->sin6_addr = hdr_ip6->ip6_src;
994 ((struct sockaddr_in6 *)conn->src)->sin6_port = hdr_tcp->source;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100995
Willy Tarreau226572f2019-07-17 14:46:00 +0200996 ((struct sockaddr_in6 *)conn->dst)->sin6_family = AF_INET6;
997 ((struct sockaddr_in6 *)conn->dst)->sin6_addr = hdr_ip6->ip6_dst;
998 ((struct sockaddr_in6 *)conn->dst)->sin6_port = hdr_tcp->dest;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100999
1000 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
1001 }
1002 else {
1003 /* The protocol does not match something known (IPv4/IPv6) */
1004 conn->err_code = CO_ER_CIP_BAD_PROTO;
1005 goto fail;
1006 }
1007
Bertrand Jacquin7d668f92017-12-13 01:23:39 +00001008 line += hdr_len;
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001009 trash.data = line - trash.area;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001010
1011 /* remove the NetScaler Client IP header from the request. For this
1012 * we re-read the exact line at once. If we don't get the exact same
1013 * result, we fail.
1014 */
Willy Tarreau157788c2020-02-11 10:08:05 +01001015 while (1) {
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001016 int len2 = recv(conn->handle.fd, trash.area, trash.data, 0);
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001017 if (len2 < 0 && errno == EINTR)
1018 continue;
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001019 if (len2 != trash.data)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001020 goto recv_abort;
Willy Tarreau157788c2020-02-11 10:08:05 +01001021 break;
1022 }
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001023
1024 conn->flags &= ~flag;
1025 return 1;
1026
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001027 not_ready:
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001028 return 0;
1029
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001030 missing:
1031 /* Missing data. Since we're using MSG_PEEK, we can only poll again if
1032 * we have not read anything. Otherwise we need to fail because we won't
1033 * be able to poll anymore.
1034 */
1035 conn->err_code = CO_ER_CIP_TRUNCATED;
1036 goto fail;
1037
1038 bad_magic:
1039 conn->err_code = CO_ER_CIP_BAD_MAGIC;
1040 goto fail;
1041
1042 recv_abort:
1043 conn->err_code = CO_ER_CIP_ABORT;
1044 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH;
1045 goto fail;
1046
1047 fail:
Bertrand Jacquin93b227d2016-06-04 15:11:10 +01001048 conn->flags |= CO_FL_ERROR;
1049 return 0;
1050}
1051
Alexander Liu2a54bb72019-05-22 19:44:48 +08001052
1053int conn_send_socks4_proxy_request(struct connection *conn)
1054{
1055 struct socks4_request req_line;
1056
Alexander Liu2a54bb72019-05-22 19:44:48 +08001057 if (!conn_ctrl_ready(conn))
1058 goto out_error;
1059
Willy Tarreau226572f2019-07-17 14:46:00 +02001060 if (!conn_get_dst(conn))
1061 goto out_error;
1062
Alexander Liu2a54bb72019-05-22 19:44:48 +08001063 req_line.version = 0x04;
1064 req_line.command = 0x01;
Willy Tarreau226572f2019-07-17 14:46:00 +02001065 req_line.port = get_net_port(conn->dst);
1066 req_line.ip = is_inet_addr(conn->dst);
Alexander Liu2a54bb72019-05-22 19:44:48 +08001067 memcpy(req_line.user_id, "HAProxy\0", 8);
1068
1069 if (conn->send_proxy_ofs > 0) {
1070 /*
1071 * This is the first call to send the request
1072 */
1073 conn->send_proxy_ofs = -(int)sizeof(req_line);
1074 }
1075
1076 if (conn->send_proxy_ofs < 0) {
1077 int ret = 0;
1078
1079 /* we are sending the socks4_req_line here. If the data layer
1080 * has a pending write, we'll also set MSG_MORE.
1081 */
1082 ret = conn_sock_send(
1083 conn,
1084 ((char *)(&req_line)) + (sizeof(req_line)+conn->send_proxy_ofs),
1085 -conn->send_proxy_ofs,
Willy Tarreau19bc2012020-02-21 08:46:19 +01001086 (conn->subs && conn->subs->events & SUB_RETRY_SEND) ? MSG_MORE : 0);
Alexander Liu2a54bb72019-05-22 19:44:48 +08001087
1088 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Before send remain is [%d], sent [%d]\n",
1089 conn->handle.fd, -conn->send_proxy_ofs, ret);
1090
1091 if (ret < 0) {
1092 goto out_error;
1093 }
1094
1095 conn->send_proxy_ofs += ret; /* becomes zero once complete */
1096 if (conn->send_proxy_ofs != 0) {
1097 goto out_wait;
1098 }
1099 }
1100
1101 /* OK we've the whole request sent */
1102 conn->flags &= ~CO_FL_SOCKS4_SEND;
Alexander Liu2a54bb72019-05-22 19:44:48 +08001103
1104 /* The connection is ready now, simply return and let the connection
1105 * handler notify upper layers if needed.
1106 */
Willy Tarreauc192b0a2020-01-23 09:11:58 +01001107 conn->flags &= ~CO_FL_WAIT_L4_CONN;
Alexander Liu2a54bb72019-05-22 19:44:48 +08001108
1109 if (conn->flags & CO_FL_SEND_PROXY) {
1110 /*
1111 * Get the send_proxy_ofs ready for the send_proxy due to we are
1112 * reusing the "send_proxy_ofs", and SOCKS4 handshake should be done
1113 * before sending PROXY Protocol.
1114 */
1115 conn->send_proxy_ofs = 1;
1116 }
1117 return 1;
1118
1119 out_error:
1120 /* Write error on the file descriptor */
1121 conn->flags |= CO_FL_ERROR;
1122 if (conn->err_code == CO_ER_NONE) {
1123 conn->err_code = CO_ER_SOCKS4_SEND;
1124 }
1125 return 0;
1126
1127 out_wait:
Alexander Liu2a54bb72019-05-22 19:44:48 +08001128 return 0;
1129}
1130
1131int conn_recv_socks4_proxy_response(struct connection *conn)
1132{
1133 char line[SOCKS4_HS_RSP_LEN];
1134 int ret;
1135
Alexander Liu2a54bb72019-05-22 19:44:48 +08001136 if (!conn_ctrl_ready(conn))
1137 goto fail;
1138
1139 if (!fd_recv_ready(conn->handle.fd))
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001140 goto not_ready;
Alexander Liu2a54bb72019-05-22 19:44:48 +08001141
Willy Tarreau157788c2020-02-11 10:08:05 +01001142 while (1) {
Alexander Liu2a54bb72019-05-22 19:44:48 +08001143 /* SOCKS4 Proxy will response with 8 bytes, 0x00 | 0x5A | 0x00 0x00 | 0x00 0x00 0x00 0x00
1144 * Try to peek into it, before all 8 bytes ready.
1145 */
1146 ret = recv(conn->handle.fd, line, SOCKS4_HS_RSP_LEN, MSG_PEEK);
1147
1148 if (ret == 0) {
1149 /* the socket has been closed or shutdown for send */
1150 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Received ret[%d], errno[%d], looks like the socket has been closed or shutdown for send\n",
1151 conn->handle.fd, ret, errno);
1152 if (conn->err_code == CO_ER_NONE) {
1153 conn->err_code = CO_ER_SOCKS4_RECV;
1154 }
1155 goto fail;
1156 }
1157
1158 if (ret > 0) {
1159 if (ret == SOCKS4_HS_RSP_LEN) {
1160 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Received 8 bytes, the response is [%02X|%02X|%02X %02X|%02X %02X %02X %02X]\n",
1161 conn->handle.fd, line[0], line[1], line[2], line[3], line[4], line[5], line[6], line[7]);
1162 }else{
1163 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Received ret[%d], first byte is [%02X], last bye is [%02X]\n", conn->handle.fd, ret, line[0], line[ret-1]);
1164 }
1165 } else {
1166 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Received ret[%d], errno[%d]\n", conn->handle.fd, ret, errno);
1167 }
1168
1169 if (ret < 0) {
1170 if (errno == EINTR) {
1171 continue;
1172 }
1173 if (errno == EAGAIN) {
1174 fd_cant_recv(conn->handle.fd);
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001175 goto not_ready;
Alexander Liu2a54bb72019-05-22 19:44:48 +08001176 }
1177 goto recv_abort;
1178 }
Willy Tarreau157788c2020-02-11 10:08:05 +01001179 break;
1180 }
Alexander Liu2a54bb72019-05-22 19:44:48 +08001181
Willy Tarreauc192b0a2020-01-23 09:11:58 +01001182 conn->flags &= ~CO_FL_WAIT_L4_CONN;
1183
Alexander Liu2a54bb72019-05-22 19:44:48 +08001184 if (ret < SOCKS4_HS_RSP_LEN) {
1185 /* Missing data. Since we're using MSG_PEEK, we can only poll again if
1186 * we are not able to read enough data.
1187 */
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001188 goto not_ready;
Alexander Liu2a54bb72019-05-22 19:44:48 +08001189 }
1190
1191 /*
1192 * Base on the SOCSK4 protocol:
1193 *
1194 * +----+----+----+----+----+----+----+----+
1195 * | VN | CD | DSTPORT | DSTIP |
1196 * +----+----+----+----+----+----+----+----+
1197 * # of bytes: 1 1 2 4
1198 * VN is the version of the reply code and should be 0. CD is the result
1199 * code with one of the following values:
1200 * 90: request granted
1201 * 91: request rejected or failed
Ilya Shipitsince7b00f2020-03-23 22:28:40 +05001202 * 92: request rejected because SOCKS server cannot connect to identd on the client
Alexander Liu2a54bb72019-05-22 19:44:48 +08001203 * 93: request rejected because the client program and identd report different user-ids
1204 * The remaining fields are ignored.
1205 */
1206 if (line[1] != 90) {
1207 conn->flags &= ~CO_FL_SOCKS4_RECV;
1208
1209 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: FAIL, the response is [%02X|%02X|%02X %02X|%02X %02X %02X %02X]\n",
1210 conn->handle.fd, line[0], line[1], line[2], line[3], line[4], line[5], line[6], line[7]);
1211 if (conn->err_code == CO_ER_NONE) {
1212 conn->err_code = CO_ER_SOCKS4_DENY;
1213 }
1214 goto fail;
1215 }
1216
1217 /* remove the 8 bytes response from the stream */
Willy Tarreau157788c2020-02-11 10:08:05 +01001218 while (1) {
Alexander Liu2a54bb72019-05-22 19:44:48 +08001219 ret = recv(conn->handle.fd, line, SOCKS4_HS_RSP_LEN, 0);
1220 if (ret < 0 && errno == EINTR) {
1221 continue;
1222 }
1223 if (ret != SOCKS4_HS_RSP_LEN) {
1224 if (conn->err_code == CO_ER_NONE) {
1225 conn->err_code = CO_ER_SOCKS4_RECV;
1226 }
1227 goto fail;
1228 }
Willy Tarreau157788c2020-02-11 10:08:05 +01001229 break;
1230 }
Alexander Liu2a54bb72019-05-22 19:44:48 +08001231
1232 conn->flags &= ~CO_FL_SOCKS4_RECV;
1233 return 1;
1234
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001235 not_ready:
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001236 return 0;
1237
Alexander Liu2a54bb72019-05-22 19:44:48 +08001238 recv_abort:
1239 if (conn->err_code == CO_ER_NONE) {
1240 conn->err_code = CO_ER_SOCKS4_ABORT;
1241 }
1242 conn->flags |= (CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH);
1243 goto fail;
1244
1245 fail:
Alexander Liu2a54bb72019-05-22 19:44:48 +08001246 conn->flags |= CO_FL_ERROR;
1247 return 0;
1248}
1249
Ilya Shipitsinca56fce2018-09-15 00:50:05 +05001250/* Note: <remote> is explicitly allowed to be NULL */
Tim Duesterhuscf6e0c82020-03-13 12:34:24 +01001251int make_proxy_line(char *buf, int buf_len, struct server *srv, struct connection *remote, struct stream *strm)
David Safb76832014-05-08 23:42:08 -04001252{
1253 int ret = 0;
1254
1255 if (srv && (srv->pp_opts & SRV_PP_V2)) {
Tim Duesterhuscf6e0c82020-03-13 12:34:24 +01001256 ret = make_proxy_line_v2(buf, buf_len, srv, remote, strm);
David Safb76832014-05-08 23:42:08 -04001257 }
1258 else {
Willy Tarreau226572f2019-07-17 14:46:00 +02001259 if (remote && conn_get_src(remote) && conn_get_dst(remote))
1260 ret = make_proxy_line_v1(buf, buf_len, remote->src, remote->dst);
David Safb76832014-05-08 23:42:08 -04001261 else
1262 ret = make_proxy_line_v1(buf, buf_len, NULL, NULL);
1263 }
1264
1265 return ret;
1266}
1267
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001268/* Makes a PROXY protocol line from the two addresses. The output is sent to
1269 * buffer <buf> for a maximum size of <buf_len> (including the trailing zero).
1270 * It returns the number of bytes composing this line (including the trailing
1271 * LF), or zero in case of failure (eg: not enough space). It supports TCP4,
Willy Tarreau2e1401a2013-10-01 11:41:55 +02001272 * TCP6 and "UNKNOWN" formats. If any of <src> or <dst> is null, UNKNOWN is
1273 * emitted as well.
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001274 */
David Safb76832014-05-08 23:42:08 -04001275int make_proxy_line_v1(char *buf, int buf_len, struct sockaddr_storage *src, struct sockaddr_storage *dst)
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001276{
1277 int ret = 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001278 char * protocol;
1279 char src_str[MAX(INET_ADDRSTRLEN, INET6_ADDRSTRLEN)];
1280 char dst_str[MAX(INET_ADDRSTRLEN, INET6_ADDRSTRLEN)];
1281 in_port_t src_port;
1282 in_port_t dst_port;
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001283
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001284 if ( !src
1285 || !dst
1286 || (src->ss_family != AF_INET && src->ss_family != AF_INET6)
1287 || (dst->ss_family != AF_INET && dst->ss_family != AF_INET6)) {
1288 /* unknown family combination */
1289 ret = snprintf(buf, buf_len, "PROXY UNKNOWN\r\n");
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001290 if (ret >= buf_len)
1291 return 0;
1292
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001293 return ret;
1294 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001295
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001296 /* IPv4 for both src and dst */
1297 if (src->ss_family == AF_INET && dst->ss_family == AF_INET) {
1298 protocol = "TCP4";
1299 if (!inet_ntop(AF_INET, &((struct sockaddr_in *)src)->sin_addr, src_str, sizeof(src_str)))
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001300 return 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001301 src_port = ((struct sockaddr_in *)src)->sin_port;
1302 if (!inet_ntop(AF_INET, &((struct sockaddr_in *)dst)->sin_addr, dst_str, sizeof(dst_str)))
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001303 return 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001304 dst_port = ((struct sockaddr_in *)dst)->sin_port;
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001305 }
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001306 /* IPv6 for at least one of src and dst */
1307 else {
1308 struct in6_addr tmp;
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001309
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001310 protocol = "TCP6";
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001311
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001312 if (src->ss_family == AF_INET) {
1313 /* Convert src to IPv6 */
1314 v4tov6(&tmp, &((struct sockaddr_in *)src)->sin_addr);
1315 src_port = ((struct sockaddr_in *)src)->sin_port;
1316 }
1317 else {
1318 tmp = ((struct sockaddr_in6 *)src)->sin6_addr;
1319 src_port = ((struct sockaddr_in6 *)src)->sin6_port;
1320 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001321
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001322 if (!inet_ntop(AF_INET6, &tmp, src_str, sizeof(src_str)))
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001323 return 0;
1324
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001325 if (dst->ss_family == AF_INET) {
1326 /* Convert dst to IPv6 */
1327 v4tov6(&tmp, &((struct sockaddr_in *)dst)->sin_addr);
1328 dst_port = ((struct sockaddr_in *)dst)->sin_port;
1329 }
1330 else {
1331 tmp = ((struct sockaddr_in6 *)dst)->sin6_addr;
1332 dst_port = ((struct sockaddr_in6 *)dst)->sin6_port;
1333 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001334
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001335 if (!inet_ntop(AF_INET6, &tmp, dst_str, sizeof(dst_str)))
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001336 return 0;
1337 }
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001338
1339 ret = snprintf(buf, buf_len, "PROXY %s %s %s %u %u\r\n", protocol, src_str, dst_str, ntohs(src_port), ntohs(dst_port));
1340 if (ret >= buf_len)
1341 return 0;
1342
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001343 return ret;
1344}
David Safb76832014-05-08 23:42:08 -04001345
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001346static int make_tlv(char *dest, int dest_len, char type, uint16_t length, const char *value)
David Safb76832014-05-08 23:42:08 -04001347{
1348 struct tlv *tlv;
1349
1350 if (!dest || (length + sizeof(*tlv) > dest_len))
1351 return 0;
1352
1353 tlv = (struct tlv *)dest;
1354
1355 tlv->type = type;
1356 tlv->length_hi = length >> 8;
1357 tlv->length_lo = length & 0x00ff;
1358 memcpy(tlv->value, value, length);
1359 return length + sizeof(*tlv);
1360}
David Safb76832014-05-08 23:42:08 -04001361
Ilya Shipitsinca56fce2018-09-15 00:50:05 +05001362/* Note: <remote> is explicitly allowed to be NULL */
Tim Duesterhuscf6e0c82020-03-13 12:34:24 +01001363int make_proxy_line_v2(char *buf, int buf_len, struct server *srv, struct connection *remote, struct stream *strm)
David Safb76832014-05-08 23:42:08 -04001364{
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001365 const char pp2_signature[] = PP2_SIGNATURE;
Emmanuel Hocdet4399c752018-02-05 15:26:43 +01001366 void *tlv_crc32c_p = NULL;
David Safb76832014-05-08 23:42:08 -04001367 int ret = 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001368 struct proxy_hdr_v2 *hdr = (struct proxy_hdr_v2 *)buf;
Vincent Bernat6e615892016-05-18 16:17:44 +02001369 struct sockaddr_storage null_addr = { .ss_family = 0 };
David Safb76832014-05-08 23:42:08 -04001370 struct sockaddr_storage *src = &null_addr;
1371 struct sockaddr_storage *dst = &null_addr;
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001372 const char *value;
1373 int value_len;
David Safb76832014-05-08 23:42:08 -04001374
1375 if (buf_len < PP2_HEADER_LEN)
1376 return 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001377 memcpy(hdr->sig, pp2_signature, PP2_SIGNATURE_LEN);
David Safb76832014-05-08 23:42:08 -04001378
Willy Tarreau226572f2019-07-17 14:46:00 +02001379 if (remote && conn_get_src(remote) && conn_get_dst(remote)) {
1380 src = remote->src;
1381 dst = remote->dst;
David Safb76832014-05-08 23:42:08 -04001382 }
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001383
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001384 /* At least one of src or dst is not of AF_INET or AF_INET6 */
1385 if ( !src
1386 || !dst
Willy Tarreau119e50e2020-05-22 13:53:29 +02001387 || (!pp2_never_send_local && conn_is_back(remote)) // locally initiated connection
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001388 || (src->ss_family != AF_INET && src->ss_family != AF_INET6)
1389 || (dst->ss_family != AF_INET && dst->ss_family != AF_INET6)) {
David Safb76832014-05-08 23:42:08 -04001390 if (buf_len < PP2_HDR_LEN_UNSPEC)
1391 return 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001392 hdr->ver_cmd = PP2_VERSION | PP2_CMD_LOCAL;
1393 hdr->fam = PP2_FAM_UNSPEC | PP2_TRANS_UNSPEC;
David Safb76832014-05-08 23:42:08 -04001394 ret = PP2_HDR_LEN_UNSPEC;
1395 }
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001396 else {
Willy Tarreau02c88032020-04-14 12:54:10 +02001397 hdr->ver_cmd = PP2_VERSION | PP2_CMD_PROXY;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001398 /* IPv4 for both src and dst */
1399 if (src->ss_family == AF_INET && dst->ss_family == AF_INET) {
1400 if (buf_len < PP2_HDR_LEN_INET)
1401 return 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001402 hdr->fam = PP2_FAM_INET | PP2_TRANS_STREAM;
1403 hdr->addr.ip4.src_addr = ((struct sockaddr_in *)src)->sin_addr.s_addr;
1404 hdr->addr.ip4.src_port = ((struct sockaddr_in *)src)->sin_port;
1405 hdr->addr.ip4.dst_addr = ((struct sockaddr_in *)dst)->sin_addr.s_addr;
1406 hdr->addr.ip4.dst_port = ((struct sockaddr_in *)dst)->sin_port;
1407 ret = PP2_HDR_LEN_INET;
1408 }
1409 /* IPv6 for at least one of src and dst */
1410 else {
1411 struct in6_addr tmp;
1412
1413 if (buf_len < PP2_HDR_LEN_INET6)
1414 return 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001415 hdr->fam = PP2_FAM_INET6 | PP2_TRANS_STREAM;
1416 if (src->ss_family == AF_INET) {
1417 v4tov6(&tmp, &((struct sockaddr_in *)src)->sin_addr);
1418 memcpy(hdr->addr.ip6.src_addr, &tmp, 16);
1419 hdr->addr.ip6.src_port = ((struct sockaddr_in *)src)->sin_port;
1420 }
1421 else {
1422 memcpy(hdr->addr.ip6.src_addr, &((struct sockaddr_in6 *)src)->sin6_addr, 16);
1423 hdr->addr.ip6.src_port = ((struct sockaddr_in6 *)src)->sin6_port;
1424 }
1425 if (dst->ss_family == AF_INET) {
1426 v4tov6(&tmp, &((struct sockaddr_in *)dst)->sin_addr);
1427 memcpy(hdr->addr.ip6.dst_addr, &tmp, 16);
William Dauchybd8bf672020-01-26 19:06:39 +01001428 hdr->addr.ip6.dst_port = ((struct sockaddr_in *)dst)->sin_port;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001429 }
1430 else {
1431 memcpy(hdr->addr.ip6.dst_addr, &((struct sockaddr_in6 *)dst)->sin6_addr, 16);
1432 hdr->addr.ip6.dst_port = ((struct sockaddr_in6 *)dst)->sin6_port;
1433 }
1434
1435 ret = PP2_HDR_LEN_INET6;
1436 }
1437 }
David Safb76832014-05-08 23:42:08 -04001438
Emmanuel Hocdet4399c752018-02-05 15:26:43 +01001439 if (srv->pp_opts & SRV_PP_V2_CRC32C) {
1440 uint32_t zero_crc32c = 0;
Tim Duesterhusa8692f32020-03-13 12:34:25 +01001441
Emmanuel Hocdet4399c752018-02-05 15:26:43 +01001442 if ((buf_len - ret) < sizeof(struct tlv))
1443 return 0;
1444 tlv_crc32c_p = (void *)((struct tlv *)&buf[ret])->value;
1445 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_CRC32C, sizeof(zero_crc32c), (const char *)&zero_crc32c);
1446 }
1447
Ilya Shipitsinca56fce2018-09-15 00:50:05 +05001448 if (remote && conn_get_alpn(remote, &value, &value_len)) {
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001449 if ((buf_len - ret) < sizeof(struct tlv))
1450 return 0;
Emmanuel Hocdet571c7ac2017-10-31 18:24:05 +01001451 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_ALPN, value_len, value);
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001452 }
1453
Emmanuel Hocdet253c3b72018-02-01 18:29:59 +01001454 if (srv->pp_opts & SRV_PP_V2_AUTHORITY) {
Emmanuel Hocdet8a4ffa02019-08-29 11:54:51 +02001455 value = NULL;
1456 if (remote && remote->proxy_authority) {
1457 value = remote->proxy_authority;
1458 value_len = remote->proxy_authority_len;
1459 }
1460#ifdef USE_OPENSSL
1461 else {
Jerome Magnin78891c72019-09-02 09:53:41 +02001462 if ((value = ssl_sock_get_sni(remote)))
Emmanuel Hocdet8a4ffa02019-08-29 11:54:51 +02001463 value_len = strlen(value);
1464 }
1465#endif
Emmanuel Hocdet253c3b72018-02-01 18:29:59 +01001466 if (value) {
1467 if ((buf_len - ret) < sizeof(struct tlv))
1468 return 0;
Emmanuel Hocdet8a4ffa02019-08-29 11:54:51 +02001469 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_AUTHORITY, value_len, value);
Emmanuel Hocdet253c3b72018-02-01 18:29:59 +01001470 }
1471 }
1472
Christopher Faulet3ab504f2020-05-26 15:16:01 +02001473 if (strm && (srv->pp_opts & SRV_PP_V2_UNIQUE_ID)) {
Tim Duesterhuscf6e0c82020-03-13 12:34:24 +01001474 struct session* sess = strm_sess(strm);
1475 struct ist unique_id = stream_generate_unique_id(strm, &sess->fe->format_unique_id);
1476
1477 value = unique_id.ptr;
1478 value_len = unique_id.len;
1479
1480 if (value_len >= 0) {
1481 if ((buf_len - ret) < sizeof(struct tlv))
1482 return 0;
1483 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_UNIQUE_ID, value_len, value);
1484 }
1485 }
1486
Emmanuel Hocdet8a4ffa02019-08-29 11:54:51 +02001487#ifdef USE_OPENSSL
David Safb76832014-05-08 23:42:08 -04001488 if (srv->pp_opts & SRV_PP_V2_SSL) {
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001489 struct tlv_ssl *tlv;
1490 int ssl_tlv_len = 0;
Tim Duesterhusa8692f32020-03-13 12:34:25 +01001491
David Safb76832014-05-08 23:42:08 -04001492 if ((buf_len - ret) < sizeof(struct tlv_ssl))
1493 return 0;
1494 tlv = (struct tlv_ssl *)&buf[ret];
1495 memset(tlv, 0, sizeof(struct tlv_ssl));
1496 ssl_tlv_len += sizeof(struct tlv_ssl);
1497 tlv->tlv.type = PP2_TYPE_SSL;
1498 if (ssl_sock_is_ssl(remote)) {
1499 tlv->client |= PP2_CLIENT_SSL;
Emmanuel Hocdet01da5712017-10-13 16:59:49 +02001500 value = ssl_sock_get_proto_version(remote);
David Safb76832014-05-08 23:42:08 -04001501 if (value) {
Emmanuel Hocdet8c0c34b2018-02-28 12:02:14 +01001502 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len-ret-ssl_tlv_len), PP2_SUBTYPE_SSL_VERSION, strlen(value), value);
David Safb76832014-05-08 23:42:08 -04001503 }
Dave McCowan328fb582014-07-30 10:39:13 -04001504 if (ssl_sock_get_cert_used_sess(remote)) {
1505 tlv->client |= PP2_CLIENT_CERT_SESS;
David Safb76832014-05-08 23:42:08 -04001506 tlv->verify = htonl(ssl_sock_get_verify_result(remote));
Dave McCowan328fb582014-07-30 10:39:13 -04001507 if (ssl_sock_get_cert_used_conn(remote))
1508 tlv->client |= PP2_CLIENT_CERT_CONN;
David Safb76832014-05-08 23:42:08 -04001509 }
1510 if (srv->pp_opts & SRV_PP_V2_SSL_CN) {
Willy Tarreau83061a82018-07-13 11:56:34 +02001511 struct buffer *cn_trash = get_trash_chunk();
Willy Tarreau3b9a0c92014-07-19 06:37:33 +02001512 if (ssl_sock_get_remote_common_name(remote, cn_trash) > 0) {
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001513 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_CN,
1514 cn_trash->data,
1515 cn_trash->area);
David Safb76832014-05-08 23:42:08 -04001516 }
1517 }
Emmanuel Hocdetfa8d0f12018-02-01 15:53:52 +01001518 if (srv->pp_opts & SRV_PP_V2_SSL_KEY_ALG) {
Willy Tarreau83061a82018-07-13 11:56:34 +02001519 struct buffer *pkey_trash = get_trash_chunk();
Emmanuel Hocdetfa8d0f12018-02-01 15:53:52 +01001520 if (ssl_sock_get_pkey_algo(remote, pkey_trash) > 0) {
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001521 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_KEY_ALG,
1522 pkey_trash->data,
1523 pkey_trash->area);
Emmanuel Hocdetfa8d0f12018-02-01 15:53:52 +01001524 }
1525 }
1526 if (srv->pp_opts & SRV_PP_V2_SSL_SIG_ALG) {
1527 value = ssl_sock_get_cert_sig(remote);
1528 if (value) {
1529 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_SIG_ALG, strlen(value), value);
1530 }
1531 }
1532 if (srv->pp_opts & SRV_PP_V2_SSL_CIPHER) {
1533 value = ssl_sock_get_cipher_name(remote);
1534 if (value) {
1535 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_CIPHER, strlen(value), value);
1536 }
1537 }
David Safb76832014-05-08 23:42:08 -04001538 }
1539 tlv->tlv.length_hi = (uint16_t)(ssl_tlv_len - sizeof(struct tlv)) >> 8;
1540 tlv->tlv.length_lo = (uint16_t)(ssl_tlv_len - sizeof(struct tlv)) & 0x00ff;
1541 ret += ssl_tlv_len;
1542 }
1543#endif
1544
Willy Tarreaue5733232019-05-22 19:24:06 +02001545#ifdef USE_NS
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001546 if (remote && (remote->proxy_netns)) {
1547 if ((buf_len - ret) < sizeof(struct tlv))
1548 return 0;
Emmanuel Hocdet571c7ac2017-10-31 18:24:05 +01001549 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_NETNS, remote->proxy_netns->name_len, remote->proxy_netns->node.key);
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001550 }
1551#endif
1552
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001553 hdr->len = htons((uint16_t)(ret - PP2_HEADER_LEN));
David Safb76832014-05-08 23:42:08 -04001554
Emmanuel Hocdet4399c752018-02-05 15:26:43 +01001555 if (tlv_crc32c_p) {
1556 write_u32(tlv_crc32c_p, htonl(hash_crc32c(buf, ret)));
1557 }
1558
David Safb76832014-05-08 23:42:08 -04001559 return ret;
1560}
Emeric Brun4f603012017-01-05 15:11:44 +01001561
Willy Tarreau119e50e2020-05-22 13:53:29 +02001562/* returns 0 on success */
1563static int cfg_parse_pp2_never_send_local(char **args, int section_type, struct proxy *curpx,
1564 struct proxy *defpx, const char *file, int line,
1565 char **err)
1566{
1567 if (too_many_args(0, args, err, NULL))
1568 return -1;
1569 pp2_never_send_local = 1;
1570 return 0;
1571}
1572
Willy Tarreau60ca10a2017-08-18 15:26:54 +02001573/* return the major HTTP version as 1 or 2 depending on how the request arrived
1574 * before being processed.
1575 */
1576static int
1577smp_fetch_fc_http_major(const struct arg *args, struct sample *smp, const char *kw, void *private)
1578{
Jérôme Magnin86577422018-12-07 09:03:11 +01001579 struct connection *conn = (kw[0] != 'b') ? objt_conn(smp->sess->origin) :
1580 smp->strm ? cs_conn(objt_cs(smp->strm->si[1].end)) : NULL;
Willy Tarreau60ca10a2017-08-18 15:26:54 +02001581
1582 smp->data.type = SMP_T_SINT;
1583 smp->data.u.sint = (conn && strcmp(conn_get_mux_name(conn), "H2") == 0) ? 2 : 1;
1584 return 1;
1585}
1586
Emeric Brun4f603012017-01-05 15:11:44 +01001587/* fetch if the received connection used a PROXY protocol header */
1588int smp_fetch_fc_rcvd_proxy(const struct arg *args, struct sample *smp, const char *kw, void *private)
1589{
1590 struct connection *conn;
1591
1592 conn = objt_conn(smp->sess->origin);
1593 if (!conn)
1594 return 0;
1595
Willy Tarreau911db9b2020-01-23 16:27:54 +01001596 if (conn->flags & CO_FL_WAIT_XPRT) {
Emeric Brun4f603012017-01-05 15:11:44 +01001597 smp->flags |= SMP_F_MAY_CHANGE;
1598 return 0;
1599 }
1600
1601 smp->flags = 0;
1602 smp->data.type = SMP_T_BOOL;
1603 smp->data.u.sint = (conn->flags & CO_FL_RCVD_PROXY) ? 1 : 0;
1604
1605 return 1;
1606}
1607
Geoff Simmons7185b782019-08-27 18:31:16 +02001608/* fetch the authority TLV from a PROXY protocol header */
1609int smp_fetch_fc_pp_authority(const struct arg *args, struct sample *smp, const char *kw, void *private)
1610{
1611 struct connection *conn;
1612
1613 conn = objt_conn(smp->sess->origin);
1614 if (!conn)
1615 return 0;
1616
Willy Tarreau911db9b2020-01-23 16:27:54 +01001617 if (conn->flags & CO_FL_WAIT_XPRT) {
Geoff Simmons7185b782019-08-27 18:31:16 +02001618 smp->flags |= SMP_F_MAY_CHANGE;
1619 return 0;
1620 }
1621
1622 if (conn->proxy_authority == NULL)
1623 return 0;
1624
1625 smp->flags = 0;
1626 smp->data.type = SMP_T_STR;
1627 smp->data.u.str.area = conn->proxy_authority;
1628 smp->data.u.str.data = conn->proxy_authority_len;
1629
1630 return 1;
1631}
1632
Tim Duesterhusd1b15b62020-03-13 12:34:23 +01001633/* fetch the unique ID TLV from a PROXY protocol header */
1634int smp_fetch_fc_pp_unique_id(const struct arg *args, struct sample *smp, const char *kw, void *private)
1635{
1636 struct connection *conn;
1637
1638 conn = objt_conn(smp->sess->origin);
1639 if (!conn)
1640 return 0;
1641
1642 if (conn->flags & CO_FL_WAIT_XPRT) {
1643 smp->flags |= SMP_F_MAY_CHANGE;
1644 return 0;
1645 }
1646
1647 if (!isttest(conn->proxy_unique_id))
1648 return 0;
1649
1650 smp->flags = 0;
1651 smp->data.type = SMP_T_STR;
1652 smp->data.u.str.area = conn->proxy_unique_id.ptr;
1653 smp->data.u.str.data = conn->proxy_unique_id.len;
1654
1655 return 1;
1656}
1657
Emeric Brun4f603012017-01-05 15:11:44 +01001658/* Note: must not be declared <const> as its list will be overwritten.
1659 * Note: fetches that may return multiple types must be declared as the lowest
1660 * common denominator, the type that can be casted into all other ones. For
1661 * instance v4/v6 must be declared v4.
1662 */
1663static struct sample_fetch_kw_list sample_fetch_keywords = {ILH, {
Willy Tarreau60ca10a2017-08-18 15:26:54 +02001664 { "fc_http_major", smp_fetch_fc_http_major, 0, NULL, SMP_T_SINT, SMP_USE_L4CLI },
Jérôme Magnin86577422018-12-07 09:03:11 +01001665 { "bc_http_major", smp_fetch_fc_http_major, 0, NULL, SMP_T_SINT, SMP_USE_L4SRV },
Emeric Brun4f603012017-01-05 15:11:44 +01001666 { "fc_rcvd_proxy", smp_fetch_fc_rcvd_proxy, 0, NULL, SMP_T_BOOL, SMP_USE_L4CLI },
Geoff Simmons7185b782019-08-27 18:31:16 +02001667 { "fc_pp_authority", smp_fetch_fc_pp_authority, 0, NULL, SMP_T_STR, SMP_USE_L4CLI },
Tim Duesterhusd1b15b62020-03-13 12:34:23 +01001668 { "fc_pp_unique_id", smp_fetch_fc_pp_unique_id, 0, NULL, SMP_T_STR, SMP_USE_L4CLI },
Emeric Brun4f603012017-01-05 15:11:44 +01001669 { /* END */ },
1670}};
1671
Willy Tarreau0108d902018-11-25 19:14:37 +01001672INITCALL1(STG_REGISTER, sample_register_fetches, &sample_fetch_keywords);
Willy Tarreau119e50e2020-05-22 13:53:29 +02001673
1674static struct cfg_kw_list cfg_kws = {ILH, {
1675 { CFG_GLOBAL, "pp2-never-send-local", cfg_parse_pp2_never_send_local },
1676 { /* END */ },
1677}};
1678
1679INITCALL1(STG_REGISTER, cfg_register_keywords, &cfg_kws);