blob: 2acdf986bf92206a9e95742ab1583cbf4f657861 [file] [log] [blame]
Willy Tarreaue6b98942007-10-29 01:09:36 +01001/*
2 * AF_INET/AF_INET6 SOCK_STREAM protocol layer (tcp)
3 *
Willy Tarreau1a687942010-05-23 22:40:30 +02004 * Copyright 2000-2010 Willy Tarreau <w@1wt.eu>
Willy Tarreaue6b98942007-10-29 01:09:36 +01005 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
13#include <ctype.h>
14#include <errno.h>
15#include <fcntl.h>
16#include <stdio.h>
17#include <stdlib.h>
18#include <string.h>
19#include <time.h>
20
21#include <sys/param.h>
22#include <sys/socket.h>
23#include <sys/stat.h>
24#include <sys/types.h>
25#include <sys/un.h>
26
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +040027#include <netinet/tcp.h>
28
Willy Tarreaub6866442008-07-14 23:54:42 +020029#include <common/cfgparse.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010030#include <common/compat.h>
31#include <common/config.h>
32#include <common/debug.h>
33#include <common/errors.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010034#include <common/mini-clist.h>
35#include <common/standard.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010036
Willy Tarreaue6b98942007-10-29 01:09:36 +010037#include <types/global.h>
Willy Tarreau9650f372009-08-16 14:02:45 +020038#include <types/server.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010039
40#include <proto/acl.h>
Willy Tarreau9fcb9842012-04-20 14:45:49 +020041#include <proto/arg.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010042#include <proto/buffers.h>
Willy Tarreau03fa5df2010-05-24 21:02:37 +020043#include <proto/frontend.h>
Willy Tarreau9650f372009-08-16 14:02:45 +020044#include <proto/log.h>
45#include <proto/port_range.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010046#include <proto/protocols.h>
47#include <proto/proto_tcp.h>
Willy Tarreaub6866442008-07-14 23:54:42 +020048#include <proto/proxy.h>
Willy Tarreaucd3b0942012-04-27 21:52:18 +020049#include <proto/sample.h>
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +020050#include <proto/session.h>
Willy Tarreaua975b8f2010-06-05 19:13:27 +020051#include <proto/stick_table.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010052#include <proto/stream_sock.h>
Willy Tarreaua975b8f2010-06-05 19:13:27 +020053#include <proto/task.h>
Emeric Brun97679e72010-09-23 17:56:44 +020054#include <proto/buffers.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010055
Willy Tarreaue8c66af2008-01-13 18:40:14 +010056#ifdef CONFIG_HAP_CTTPROXY
57#include <import/ip_tproxy.h>
58#endif
59
Emeric Bruncf20bf12010-10-22 16:06:11 +020060static int tcp_bind_listeners(struct protocol *proto, char *errmsg, int errlen);
61static int tcp_bind_listener(struct listener *listener, char *errmsg, int errlen);
Willy Tarreaue6b98942007-10-29 01:09:36 +010062
63/* Note: must not be declared <const> as its list will be overwritten */
64static struct protocol proto_tcpv4 = {
65 .name = "tcpv4",
66 .sock_domain = AF_INET,
67 .sock_type = SOCK_STREAM,
68 .sock_prot = IPPROTO_TCP,
69 .sock_family = AF_INET,
70 .sock_addrlen = sizeof(struct sockaddr_in),
71 .l3_addrlen = 32/8,
Willy Tarreaubbebbbf2012-05-07 21:22:09 +020072 .accept = &listener_accept,
Willy Tarreau26d8c592012-05-07 18:12:14 +020073 .connect = tcp_connect_server,
Emeric Bruncf20bf12010-10-22 16:06:11 +020074 .bind = tcp_bind_listener,
Willy Tarreaue6b98942007-10-29 01:09:36 +010075 .bind_all = tcp_bind_listeners,
76 .unbind_all = unbind_all_listeners,
77 .enable_all = enable_all_listeners,
78 .listeners = LIST_HEAD_INIT(proto_tcpv4.listeners),
79 .nb_listeners = 0,
80};
81
82/* Note: must not be declared <const> as its list will be overwritten */
83static struct protocol proto_tcpv6 = {
84 .name = "tcpv6",
85 .sock_domain = AF_INET6,
86 .sock_type = SOCK_STREAM,
87 .sock_prot = IPPROTO_TCP,
88 .sock_family = AF_INET6,
89 .sock_addrlen = sizeof(struct sockaddr_in6),
90 .l3_addrlen = 128/8,
Willy Tarreaubbebbbf2012-05-07 21:22:09 +020091 .accept = &listener_accept,
Willy Tarreau26d8c592012-05-07 18:12:14 +020092 .connect = tcp_connect_server,
Emeric Bruncf20bf12010-10-22 16:06:11 +020093 .bind = tcp_bind_listener,
Willy Tarreaue6b98942007-10-29 01:09:36 +010094 .bind_all = tcp_bind_listeners,
95 .unbind_all = unbind_all_listeners,
96 .enable_all = enable_all_listeners,
97 .listeners = LIST_HEAD_INIT(proto_tcpv6.listeners),
98 .nb_listeners = 0,
99};
100
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100101
David du Colombier6f5ccb12011-03-10 22:26:24 +0100102/* Binds ipv4/ipv6 address <local> to socket <fd>, unless <flags> is set, in which
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100103 * case we try to bind <remote>. <flags> is a 2-bit field consisting of :
104 * - 0 : ignore remote address (may even be a NULL pointer)
105 * - 1 : use provided address
106 * - 2 : use provided port
107 * - 3 : use both
108 *
109 * The function supports multiple foreign binding methods :
110 * - linux_tproxy: we directly bind to the foreign address
111 * - cttproxy: we bind to a local address then nat.
112 * The second one can be used as a fallback for the first one.
113 * This function returns 0 when everything's OK, 1 if it could not bind, to the
114 * local address, 2 if it could not bind to the foreign address.
115 */
David du Colombier6f5ccb12011-03-10 22:26:24 +0100116int tcp_bind_socket(int fd, int flags, struct sockaddr_storage *local, struct sockaddr_storage *remote)
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100117{
David du Colombier6f5ccb12011-03-10 22:26:24 +0100118 struct sockaddr_storage bind_addr;
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100119 int foreign_ok = 0;
120 int ret;
121
122#ifdef CONFIG_HAP_LINUX_TPROXY
123 static int ip_transp_working = 1;
124 if (flags && ip_transp_working) {
Simon Hormande072bd2011-06-24 15:11:37 +0900125 if (setsockopt(fd, SOL_IP, IP_TRANSPARENT, &one, sizeof(one)) == 0
126 || setsockopt(fd, SOL_IP, IP_FREEBIND, &one, sizeof(one)) == 0)
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100127 foreign_ok = 1;
128 else
129 ip_transp_working = 0;
130 }
131#endif
132 if (flags) {
133 memset(&bind_addr, 0, sizeof(bind_addr));
Willy Tarreau96dd0792011-04-19 07:20:57 +0200134 bind_addr.ss_family = remote->ss_family;
David du Colombier6f5ccb12011-03-10 22:26:24 +0100135 switch (remote->ss_family) {
136 case AF_INET:
137 if (flags & 1)
138 ((struct sockaddr_in *)&bind_addr)->sin_addr = ((struct sockaddr_in *)remote)->sin_addr;
139 if (flags & 2)
140 ((struct sockaddr_in *)&bind_addr)->sin_port = ((struct sockaddr_in *)remote)->sin_port;
141 break;
142 case AF_INET6:
143 if (flags & 1)
144 ((struct sockaddr_in6 *)&bind_addr)->sin6_addr = ((struct sockaddr_in6 *)remote)->sin6_addr;
145 if (flags & 2)
146 ((struct sockaddr_in6 *)&bind_addr)->sin6_port = ((struct sockaddr_in6 *)remote)->sin6_port;
147 break;
Willy Tarreau5dc1e982011-12-16 21:25:11 +0100148 default:
149 /* we don't want to try to bind to an unknown address family */
150 foreign_ok = 0;
David du Colombier6f5ccb12011-03-10 22:26:24 +0100151 }
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100152 }
153
Simon Hormande072bd2011-06-24 15:11:37 +0900154 setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one));
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100155 if (foreign_ok) {
Willy Tarreau1b4b7ce2011-04-05 16:56:50 +0200156 ret = bind(fd, (struct sockaddr *)&bind_addr, get_addr_len(&bind_addr));
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100157 if (ret < 0)
158 return 2;
159 }
160 else {
Willy Tarreau1b4b7ce2011-04-05 16:56:50 +0200161 ret = bind(fd, (struct sockaddr *)local, get_addr_len(local));
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100162 if (ret < 0)
163 return 1;
164 }
165
166 if (!flags)
167 return 0;
168
169#ifdef CONFIG_HAP_CTTPROXY
Willy Tarreau6f831b42011-03-20 14:03:54 +0100170 if (!foreign_ok && remote->ss_family == AF_INET) {
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100171 struct in_tproxy itp1, itp2;
172 memset(&itp1, 0, sizeof(itp1));
173
174 itp1.op = TPROXY_ASSIGN;
Willy Tarreau6f831b42011-03-20 14:03:54 +0100175 itp1.v.addr.faddr = ((struct sockaddr_in *)&bind_addr)->sin_addr;
176 itp1.v.addr.fport = ((struct sockaddr_in *)&bind_addr)->sin_port;
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100177
178 /* set connect flag on socket */
179 itp2.op = TPROXY_FLAGS;
180 itp2.v.flags = ITP_CONNECT | ITP_ONCE;
181
182 if (setsockopt(fd, SOL_IP, IP_TPROXY, &itp1, sizeof(itp1)) != -1 &&
183 setsockopt(fd, SOL_IP, IP_TPROXY, &itp2, sizeof(itp2)) != -1) {
184 foreign_ok = 1;
185 }
186 }
187#endif
188 if (!foreign_ok)
189 /* we could not bind to a foreign address */
190 return 2;
191
192 return 0;
193}
Willy Tarreaue6b98942007-10-29 01:09:36 +0100194
Willy Tarreau9650f372009-08-16 14:02:45 +0200195
196/*
Willy Tarreauac825402011-03-04 22:04:29 +0100197 * This function initiates a connection to the target assigned to this session
Willy Tarreau6471afb2011-09-23 10:54:59 +0200198 * (si->{target,addr.to}). A source address may be pointed to by si->addr.from
Willy Tarreauac825402011-03-04 22:04:29 +0100199 * in case of transparent proxying. Normal source bind addresses are still
200 * determined locally (due to the possible need of a source port).
201 * si->target may point either to a valid server or to a backend, depending
202 * on si->target.type. Only TARG_TYPE_PROXY and TARG_TYPE_SERVER are supported.
Willy Tarreaub1d67742010-03-29 19:36:59 +0200203 *
Willy Tarreau9650f372009-08-16 14:02:45 +0200204 * It can return one of :
205 * - SN_ERR_NONE if everything's OK
206 * - SN_ERR_SRVTO if there are no more servers
207 * - SN_ERR_SRVCL if the connection was refused by the server
208 * - SN_ERR_PRXCOND if the connection has been limited by the proxy (maxconn)
209 * - SN_ERR_RESOURCE if a system resource is lacking (eg: fd limits, ports, ...)
210 * - SN_ERR_INTERNAL for any other purely internal errors
211 * Additionnally, in the case of SN_ERR_RESOURCE, an emergency log will be emitted.
212 */
Willy Tarreauf1536862011-03-03 18:27:32 +0100213
David du Colombier6f5ccb12011-03-10 22:26:24 +0100214int tcp_connect_server(struct stream_interface *si)
Willy Tarreau9650f372009-08-16 14:02:45 +0200215{
216 int fd;
Willy Tarreauac825402011-03-04 22:04:29 +0100217 struct server *srv;
218 struct proxy *be;
219
220 switch (si->target.type) {
221 case TARG_TYPE_PROXY:
222 be = si->target.ptr.p;
223 srv = NULL;
224 break;
225 case TARG_TYPE_SERVER:
226 srv = si->target.ptr.s;
227 be = srv->proxy;
228 break;
229 default:
230 return SN_ERR_INTERNAL;
231 }
Willy Tarreau9650f372009-08-16 14:02:45 +0200232
Willy Tarreau6471afb2011-09-23 10:54:59 +0200233 if ((fd = si->fd = socket(si->addr.to.ss_family, SOCK_STREAM, IPPROTO_TCP)) == -1) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200234 qfprintf(stderr, "Cannot get a server socket.\n");
235
236 if (errno == ENFILE)
237 send_log(be, LOG_EMERG,
238 "Proxy %s reached system FD limit at %d. Please check system tunables.\n",
239 be->id, maxfd);
240 else if (errno == EMFILE)
241 send_log(be, LOG_EMERG,
242 "Proxy %s reached process FD limit at %d. Please check 'ulimit-n' and restart.\n",
243 be->id, maxfd);
244 else if (errno == ENOBUFS || errno == ENOMEM)
245 send_log(be, LOG_EMERG,
246 "Proxy %s reached system memory limit at %d sockets. Please check system tunables.\n",
247 be->id, maxfd);
248 /* this is a resource error */
249 return SN_ERR_RESOURCE;
250 }
251
252 if (fd >= global.maxsock) {
253 /* do not log anything there, it's a normal condition when this option
254 * is used to serialize connections to a server !
255 */
256 Alert("socket(): not enough free sockets. Raise -n argument. Giving up.\n");
257 close(fd);
258 return SN_ERR_PRXCOND; /* it is a configuration limit */
259 }
260
261 if ((fcntl(fd, F_SETFL, O_NONBLOCK)==-1) ||
Simon Hormande072bd2011-06-24 15:11:37 +0900262 (setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &one, sizeof(one)) == -1)) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200263 qfprintf(stderr,"Cannot set client socket to non blocking mode.\n");
264 close(fd);
265 return SN_ERR_INTERNAL;
266 }
267
268 if (be->options & PR_O_TCP_SRV_KA)
Simon Hormande072bd2011-06-24 15:11:37 +0900269 setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, &one, sizeof(one));
Willy Tarreau9650f372009-08-16 14:02:45 +0200270
271 if (be->options & PR_O_TCP_NOLING)
Willy Tarreauf6f82252011-11-30 18:02:24 +0100272 si->flags |= SI_FL_NOLINGER;
Willy Tarreau9650f372009-08-16 14:02:45 +0200273
274 /* allow specific binding :
275 * - server-specific at first
276 * - proxy-specific next
277 */
278 if (srv != NULL && srv->state & SRV_BIND_SRC) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200279 int ret, flags = 0;
280
Willy Tarreau9650f372009-08-16 14:02:45 +0200281 switch (srv->state & SRV_TPROXY_MASK) {
282 case SRV_TPROXY_ADDR:
Willy Tarreau9650f372009-08-16 14:02:45 +0200283 case SRV_TPROXY_CLI:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200284 flags = 3;
285 break;
Willy Tarreau9650f372009-08-16 14:02:45 +0200286 case SRV_TPROXY_CIP:
Willy Tarreau090466c2009-09-07 11:51:47 +0200287 case SRV_TPROXY_DYN:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200288 flags = 1;
Willy Tarreau9650f372009-08-16 14:02:45 +0200289 break;
290 }
Willy Tarreaub1d67742010-03-29 19:36:59 +0200291
Willy Tarreau9650f372009-08-16 14:02:45 +0200292#ifdef SO_BINDTODEVICE
293 /* Note: this might fail if not CAP_NET_RAW */
294 if (srv->iface_name)
295 setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, srv->iface_name, srv->iface_len + 1);
296#endif
297
298 if (srv->sport_range) {
299 int attempts = 10; /* should be more than enough to find a spare port */
David du Colombier6f5ccb12011-03-10 22:26:24 +0100300 struct sockaddr_storage src;
Willy Tarreau9650f372009-08-16 14:02:45 +0200301
302 ret = 1;
303 src = srv->source_addr;
304
305 do {
306 /* note: in case of retry, we may have to release a previously
307 * allocated port, hence this loop's construct.
308 */
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200309 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
310 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200311
312 if (!attempts)
313 break;
314 attempts--;
315
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200316 fdinfo[fd].local_port = port_range_alloc_port(srv->sport_range);
317 if (!fdinfo[fd].local_port)
Willy Tarreau9650f372009-08-16 14:02:45 +0200318 break;
319
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200320 fdinfo[fd].port_range = srv->sport_range;
Willy Tarreau86ad42c2011-08-27 12:29:07 +0200321 set_host_port(&src, fdinfo[fd].local_port);
Willy Tarreau9650f372009-08-16 14:02:45 +0200322
Willy Tarreau6471afb2011-09-23 10:54:59 +0200323 ret = tcp_bind_socket(fd, flags, &src, &si->addr.from);
Willy Tarreau9650f372009-08-16 14:02:45 +0200324 } while (ret != 0); /* binding NOK */
325 }
326 else {
Willy Tarreau6471afb2011-09-23 10:54:59 +0200327 ret = tcp_bind_socket(fd, flags, &srv->source_addr, &si->addr.from);
Willy Tarreau9650f372009-08-16 14:02:45 +0200328 }
329
330 if (ret) {
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200331 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
332 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200333 close(fd);
334
335 if (ret == 1) {
336 Alert("Cannot bind to source address before connect() for server %s/%s. Aborting.\n",
337 be->id, srv->id);
338 send_log(be, LOG_EMERG,
339 "Cannot bind to source address before connect() for server %s/%s.\n",
340 be->id, srv->id);
341 } else {
342 Alert("Cannot bind to tproxy source address before connect() for server %s/%s. Aborting.\n",
343 be->id, srv->id);
344 send_log(be, LOG_EMERG,
345 "Cannot bind to tproxy source address before connect() for server %s/%s.\n",
346 be->id, srv->id);
347 }
348 return SN_ERR_RESOURCE;
349 }
350 }
351 else if (be->options & PR_O_BIND_SRC) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200352 int ret, flags = 0;
353
Willy Tarreau9650f372009-08-16 14:02:45 +0200354 switch (be->options & PR_O_TPXY_MASK) {
355 case PR_O_TPXY_ADDR:
Willy Tarreau9650f372009-08-16 14:02:45 +0200356 case PR_O_TPXY_CLI:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200357 flags = 3;
358 break;
Willy Tarreau9650f372009-08-16 14:02:45 +0200359 case PR_O_TPXY_CIP:
Willy Tarreau090466c2009-09-07 11:51:47 +0200360 case PR_O_TPXY_DYN:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200361 flags = 1;
Willy Tarreau9650f372009-08-16 14:02:45 +0200362 break;
363 }
Willy Tarreaub1d67742010-03-29 19:36:59 +0200364
Willy Tarreau9650f372009-08-16 14:02:45 +0200365#ifdef SO_BINDTODEVICE
366 /* Note: this might fail if not CAP_NET_RAW */
367 if (be->iface_name)
368 setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, be->iface_name, be->iface_len + 1);
369#endif
Willy Tarreau6471afb2011-09-23 10:54:59 +0200370 ret = tcp_bind_socket(fd, flags, &be->source_addr, &si->addr.from);
Willy Tarreau9650f372009-08-16 14:02:45 +0200371 if (ret) {
372 close(fd);
373 if (ret == 1) {
374 Alert("Cannot bind to source address before connect() for proxy %s. Aborting.\n",
375 be->id);
376 send_log(be, LOG_EMERG,
377 "Cannot bind to source address before connect() for proxy %s.\n",
378 be->id);
379 } else {
380 Alert("Cannot bind to tproxy source address before connect() for proxy %s. Aborting.\n",
381 be->id);
382 send_log(be, LOG_EMERG,
383 "Cannot bind to tproxy source address before connect() for proxy %s.\n",
384 be->id);
385 }
386 return SN_ERR_RESOURCE;
387 }
388 }
389
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400390#if defined(TCP_QUICKACK)
Willy Tarreau9650f372009-08-16 14:02:45 +0200391 /* disabling tcp quick ack now allows the first request to leave the
392 * machine with the first ACK. We only do this if there are pending
393 * data in the buffer.
394 */
Willy Tarreau2e046c62012-03-01 16:08:30 +0100395 if ((be->options2 & PR_O2_SMARTCON) && si->ob->o)
Simon Hormande072bd2011-06-24 15:11:37 +0900396 setsockopt(fd, IPPROTO_TCP, TCP_QUICKACK, &zero, sizeof(zero));
Willy Tarreau9650f372009-08-16 14:02:45 +0200397#endif
398
Willy Tarreaue803de22010-01-21 17:43:04 +0100399 if (global.tune.server_sndbuf)
400 setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &global.tune.server_sndbuf, sizeof(global.tune.server_sndbuf));
401
402 if (global.tune.server_rcvbuf)
403 setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &global.tune.server_rcvbuf, sizeof(global.tune.server_rcvbuf));
404
Willy Tarreau9b061e32012-04-07 18:03:52 +0200405 si->flags &= ~SI_FL_FROM_SET;
Willy Tarreau6471afb2011-09-23 10:54:59 +0200406 if ((connect(fd, (struct sockaddr *)&si->addr.to, get_addr_len(&si->addr.to)) == -1) &&
Willy Tarreau9650f372009-08-16 14:02:45 +0200407 (errno != EINPROGRESS) && (errno != EALREADY) && (errno != EISCONN)) {
408
409 if (errno == EAGAIN || errno == EADDRINUSE) {
410 char *msg;
411 if (errno == EAGAIN) /* no free ports left, try again later */
412 msg = "no free ports";
413 else
414 msg = "local address already in use";
415
416 qfprintf(stderr,"Cannot connect: %s.\n",msg);
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200417 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
418 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200419 close(fd);
420 send_log(be, LOG_EMERG,
421 "Connect() failed for server %s/%s: %s.\n",
422 be->id, srv->id, msg);
423 return SN_ERR_RESOURCE;
424 } else if (errno == ETIMEDOUT) {
425 //qfprintf(stderr,"Connect(): ETIMEDOUT");
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200426 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
427 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200428 close(fd);
429 return SN_ERR_SRVTO;
430 } else {
431 // (errno == ECONNREFUSED || errno == ENETUNREACH || errno == EACCES || errno == EPERM)
432 //qfprintf(stderr,"Connect(): %d", errno);
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200433 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
434 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200435 close(fd);
436 return SN_ERR_SRVCL;
437 }
438 }
439
William Lallemandb7ff6a32012-03-02 14:35:21 +0100440 /* needs src ip/port for logging */
Willy Tarreau9b061e32012-04-07 18:03:52 +0200441 if (si->flags & SI_FL_SRC_ADDR)
442 stream_sock_get_from_addr(si);
William Lallemandb7ff6a32012-03-02 14:35:21 +0100443
Willy Tarreau9650f372009-08-16 14:02:45 +0200444 fdtab[fd].owner = si;
445 fdtab[fd].state = FD_STCONN; /* connection in progress */
446 fdtab[fd].flags = FD_FL_TCP | FD_FL_TCP_NODELAY;
Willy Tarreau1b79bde2012-05-07 17:01:39 +0200447 fdtab[fd].cb[DIR_RD].f = si->sock.read;
Willy Tarreau9650f372009-08-16 14:02:45 +0200448 fdtab[fd].cb[DIR_RD].b = si->ib;
Willy Tarreau1b79bde2012-05-07 17:01:39 +0200449 fdtab[fd].cb[DIR_WR].f = si->sock.write;
Willy Tarreau9650f372009-08-16 14:02:45 +0200450 fdtab[fd].cb[DIR_WR].b = si->ob;
451
Willy Tarreau6471afb2011-09-23 10:54:59 +0200452 fdinfo[fd].peeraddr = (struct sockaddr *)&si->addr.to;
453 fdinfo[fd].peerlen = get_addr_len(&si->addr.to);
Willy Tarreau9650f372009-08-16 14:02:45 +0200454
455 fd_insert(fd);
456 EV_FD_SET(fd, DIR_WR); /* for connect status */
457
458 si->state = SI_ST_CON;
459 si->flags |= SI_FL_CAP_SPLTCP; /* TCP supports splicing */
460 si->exp = tick_add_ifset(now_ms, be->timeout.connect);
461
462 return SN_ERR_NONE; /* connection is OK */
463}
464
465
Willy Tarreaue6b98942007-10-29 01:09:36 +0100466/* This function tries to bind a TCPv4/v6 listener. It may return a warning or
467 * an error message in <err> if the message is at most <errlen> bytes long
468 * (including '\0'). The return value is composed from ERR_ABORT, ERR_WARN,
469 * ERR_ALERT, ERR_RETRYABLE and ERR_FATAL. ERR_NONE indicates that everything
470 * was alright and that no message was returned. ERR_RETRYABLE means that an
471 * error occurred but that it may vanish after a retry (eg: port in use), and
Aman Guptad94991d2012-04-06 17:39:26 -0700472 * ERR_FATAL indicates a non-fixable error. ERR_WARN and ERR_ALERT do not alter
Willy Tarreaue6b98942007-10-29 01:09:36 +0100473 * the meaning of the error, but just indicate that a message is present which
474 * should be displayed with the respective level. Last, ERR_ABORT indicates
475 * that it's pointless to try to start other listeners. No error message is
476 * returned if errlen is NULL.
477 */
478int tcp_bind_listener(struct listener *listener, char *errmsg, int errlen)
479{
480 __label__ tcp_return, tcp_close_return;
481 int fd, err;
482 const char *msg = NULL;
483
484 /* ensure we never return garbage */
485 if (errmsg && errlen)
486 *errmsg = 0;
487
488 if (listener->state != LI_ASSIGNED)
489 return ERR_NONE; /* already bound */
490
491 err = ERR_NONE;
492
493 if ((fd = socket(listener->addr.ss_family, SOCK_STREAM, IPPROTO_TCP)) == -1) {
494 err |= ERR_RETRYABLE | ERR_ALERT;
495 msg = "cannot create listening socket";
496 goto tcp_return;
497 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100498
Willy Tarreaue6b98942007-10-29 01:09:36 +0100499 if (fd >= global.maxsock) {
500 err |= ERR_FATAL | ERR_ABORT | ERR_ALERT;
501 msg = "not enough free sockets (raise '-n' parameter)";
502 goto tcp_close_return;
503 }
504
Willy Tarreaufb14edc2009-06-14 15:24:37 +0200505 if (fcntl(fd, F_SETFL, O_NONBLOCK) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100506 err |= ERR_FATAL | ERR_ALERT;
507 msg = "cannot make socket non-blocking";
508 goto tcp_close_return;
509 }
510
Simon Hormande072bd2011-06-24 15:11:37 +0900511 if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100512 /* not fatal but should be reported */
513 msg = "cannot do so_reuseaddr";
514 err |= ERR_ALERT;
515 }
516
517 if (listener->options & LI_O_NOLINGER)
Simon Hormande072bd2011-06-24 15:11:37 +0900518 setsockopt(fd, SOL_SOCKET, SO_LINGER, &nolinger, sizeof(struct linger));
Willy Tarreauedcf6682008-11-30 23:15:34 +0100519
Willy Tarreaue6b98942007-10-29 01:09:36 +0100520#ifdef SO_REUSEPORT
521 /* OpenBSD supports this. As it's present in old libc versions of Linux,
522 * it might return an error that we will silently ignore.
523 */
Simon Hormande072bd2011-06-24 15:11:37 +0900524 setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &one, sizeof(one));
Willy Tarreaue6b98942007-10-29 01:09:36 +0100525#endif
Willy Tarreaub1e52e82008-01-13 14:49:51 +0100526#ifdef CONFIG_HAP_LINUX_TPROXY
Willy Tarreauedcf6682008-11-30 23:15:34 +0100527 if ((listener->options & LI_O_FOREIGN)
Simon Hormande072bd2011-06-24 15:11:37 +0900528 && (setsockopt(fd, SOL_IP, IP_TRANSPARENT, &one, sizeof(one)) == -1)
529 && (setsockopt(fd, SOL_IP, IP_FREEBIND, &one, sizeof(one)) == -1)) {
Willy Tarreaub1e52e82008-01-13 14:49:51 +0100530 msg = "cannot make listening socket transparent";
531 err |= ERR_ALERT;
532 }
533#endif
Willy Tarreau5e6e2042009-02-04 17:19:29 +0100534#ifdef SO_BINDTODEVICE
535 /* Note: this might fail if not CAP_NET_RAW */
536 if (listener->interface) {
537 if (setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE,
Willy Tarreau604e8302009-03-06 00:48:23 +0100538 listener->interface, strlen(listener->interface) + 1) == -1) {
Willy Tarreau5e6e2042009-02-04 17:19:29 +0100539 msg = "cannot bind listener to device";
540 err |= ERR_WARN;
541 }
542 }
543#endif
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400544#if defined(TCP_MAXSEG)
Willy Tarreau48a7e722010-12-24 15:26:39 +0100545 if (listener->maxseg > 0) {
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400546 if (setsockopt(fd, IPPROTO_TCP, TCP_MAXSEG,
Willy Tarreaube1b9182009-06-14 18:48:19 +0200547 &listener->maxseg, sizeof(listener->maxseg)) == -1) {
548 msg = "cannot set MSS";
549 err |= ERR_WARN;
550 }
551 }
552#endif
Willy Tarreaucb6cd432009-10-13 07:34:14 +0200553#if defined(TCP_DEFER_ACCEPT)
554 if (listener->options & LI_O_DEF_ACCEPT) {
555 /* defer accept by up to one second */
556 int accept_delay = 1;
557 if (setsockopt(fd, IPPROTO_TCP, TCP_DEFER_ACCEPT, &accept_delay, sizeof(accept_delay)) == -1) {
558 msg = "cannot enable DEFER_ACCEPT";
559 err |= ERR_WARN;
560 }
561 }
562#endif
Willy Tarreaue6b98942007-10-29 01:09:36 +0100563 if (bind(fd, (struct sockaddr *)&listener->addr, listener->proto->sock_addrlen) == -1) {
564 err |= ERR_RETRYABLE | ERR_ALERT;
565 msg = "cannot bind socket";
566 goto tcp_close_return;
567 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100568
Willy Tarreauc73ce2b2008-01-06 10:55:10 +0100569 if (listen(fd, listener->backlog ? listener->backlog : listener->maxconn) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100570 err |= ERR_RETRYABLE | ERR_ALERT;
571 msg = "cannot listen to socket";
572 goto tcp_close_return;
573 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100574
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400575#if defined(TCP_QUICKACK)
Willy Tarreau9ea05a72009-06-14 12:07:01 +0200576 if (listener->options & LI_O_NOQUICKACK)
Simon Hormande072bd2011-06-24 15:11:37 +0900577 setsockopt(fd, IPPROTO_TCP, TCP_QUICKACK, &zero, sizeof(zero));
Willy Tarreau9ea05a72009-06-14 12:07:01 +0200578#endif
579
Willy Tarreaue6b98942007-10-29 01:09:36 +0100580 /* the socket is ready */
581 listener->fd = fd;
582 listener->state = LI_LISTEN;
583
Willy Tarreaueabf3132008-08-29 23:36:51 +0200584 fdtab[fd].owner = listener; /* reference the listener instead of a task */
Willy Tarreaue6b98942007-10-29 01:09:36 +0100585 fdtab[fd].state = FD_STLISTEN;
Willy Tarreaueb472682010-05-28 18:46:57 +0200586 fdtab[fd].flags = FD_FL_TCP | ((listener->options & LI_O_NOLINGER) ? FD_FL_TCP_NOLING : 0);
587 fdtab[fd].cb[DIR_RD].f = listener->proto->accept;
588 fdtab[fd].cb[DIR_WR].f = NULL; /* never called */
589 fdtab[fd].cb[DIR_RD].b = fdtab[fd].cb[DIR_WR].b = NULL;
Willy Tarreau5d707e12009-06-28 11:09:07 +0200590
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200591 fdinfo[fd].peeraddr = NULL;
592 fdinfo[fd].peerlen = 0;
Willy Tarreaueb472682010-05-28 18:46:57 +0200593 fd_insert(fd);
594
Willy Tarreaue6b98942007-10-29 01:09:36 +0100595 tcp_return:
Cyril Bonté43ba1b32010-11-01 19:26:01 +0100596 if (msg && errlen) {
597 char pn[INET6_ADDRSTRLEN];
598
Willy Tarreau631f01c2011-09-05 00:36:48 +0200599 addr_to_str(&listener->addr, pn, sizeof(pn));
600 snprintf(errmsg, errlen, "%s [%s:%d]", msg, pn, get_host_port(&listener->addr));
Cyril Bonté43ba1b32010-11-01 19:26:01 +0100601 }
Willy Tarreaue6b98942007-10-29 01:09:36 +0100602 return err;
603
604 tcp_close_return:
605 close(fd);
606 goto tcp_return;
607}
608
609/* This function creates all TCP sockets bound to the protocol entry <proto>.
610 * It is intended to be used as the protocol's bind_all() function.
611 * The sockets will be registered but not added to any fd_set, in order not to
612 * loose them across the fork(). A call to enable_all_listeners() is needed
613 * to complete initialization. The return value is composed from ERR_*.
614 */
Emeric Bruncf20bf12010-10-22 16:06:11 +0200615static int tcp_bind_listeners(struct protocol *proto, char *errmsg, int errlen)
Willy Tarreaue6b98942007-10-29 01:09:36 +0100616{
617 struct listener *listener;
618 int err = ERR_NONE;
619
620 list_for_each_entry(listener, &proto->listeners, proto_list) {
Emeric Bruncf20bf12010-10-22 16:06:11 +0200621 err |= tcp_bind_listener(listener, errmsg, errlen);
622 if (err & ERR_ABORT)
Willy Tarreaue6b98942007-10-29 01:09:36 +0100623 break;
624 }
625
626 return err;
627}
628
629/* Add listener to the list of tcpv4 listeners. The listener's state
630 * is automatically updated from LI_INIT to LI_ASSIGNED. The number of
631 * listeners is updated. This is the function to use to add a new listener.
632 */
633void tcpv4_add_listener(struct listener *listener)
634{
635 if (listener->state != LI_INIT)
636 return;
637 listener->state = LI_ASSIGNED;
638 listener->proto = &proto_tcpv4;
639 LIST_ADDQ(&proto_tcpv4.listeners, &listener->proto_list);
640 proto_tcpv4.nb_listeners++;
641}
642
643/* Add listener to the list of tcpv4 listeners. The listener's state
644 * is automatically updated from LI_INIT to LI_ASSIGNED. The number of
645 * listeners is updated. This is the function to use to add a new listener.
646 */
647void tcpv6_add_listener(struct listener *listener)
648{
649 if (listener->state != LI_INIT)
650 return;
651 listener->state = LI_ASSIGNED;
652 listener->proto = &proto_tcpv6;
653 LIST_ADDQ(&proto_tcpv6.listeners, &listener->proto_list);
654 proto_tcpv6.nb_listeners++;
655}
656
Willy Tarreauedcf6682008-11-30 23:15:34 +0100657/* This function performs the TCP request analysis on the current request. It
658 * returns 1 if the processing can continue on next analysers, or zero if it
659 * needs more data, encounters an error, or wants to immediately abort the
Willy Tarreaufb356202010-08-03 14:02:05 +0200660 * request. It relies on buffers flags, and updates s->req->analysers. The
661 * function may be called for frontend rules and backend rules. It only relies
662 * on the backend pointer so this works for both cases.
Willy Tarreauedcf6682008-11-30 23:15:34 +0100663 */
Willy Tarreau3a816292009-07-07 10:55:49 +0200664int tcp_inspect_request(struct session *s, struct buffer *req, int an_bit)
Willy Tarreauedcf6682008-11-30 23:15:34 +0100665{
666 struct tcp_rule *rule;
Willy Tarreaud1f96522010-08-03 19:34:32 +0200667 struct stksess *ts;
668 struct stktable *t;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100669 int partial;
670
Willy Tarreau02d6cfc2012-03-01 18:19:58 +0100671 DPRINTF(stderr,"[%u] %s: session=%p b=%p, exp(r,w)=%u,%u bf=%08x bh=%d analysers=%02x\n",
Willy Tarreauedcf6682008-11-30 23:15:34 +0100672 now_ms, __FUNCTION__,
673 s,
674 req,
675 req->rex, req->wex,
676 req->flags,
Willy Tarreau02d6cfc2012-03-01 18:19:58 +0100677 req->i,
Willy Tarreauedcf6682008-11-30 23:15:34 +0100678 req->analysers);
679
Willy Tarreauedcf6682008-11-30 23:15:34 +0100680 /* We don't know whether we have enough data, so must proceed
681 * this way :
682 * - iterate through all rules in their declaration order
683 * - if one rule returns MISS, it means the inspect delay is
684 * not over yet, then return immediately, otherwise consider
685 * it as a non-match.
686 * - if one rule returns OK, then return OK
687 * - if one rule returns KO, then return KO
688 */
689
Willy Tarreaub824b002010-09-29 16:36:16 +0200690 if (req->flags & (BF_SHUTR|BF_FULL) || !s->be->tcp_req.inspect_delay || tick_is_expired(req->analyse_exp, now_ms))
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200691 partial = SMP_OPT_FINAL;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100692 else
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200693 partial = 0;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100694
Willy Tarreaufb356202010-08-03 14:02:05 +0200695 list_for_each_entry(rule, &s->be->tcp_req.inspect_rules, list) {
Willy Tarreauedcf6682008-11-30 23:15:34 +0100696 int ret = ACL_PAT_PASS;
697
698 if (rule->cond) {
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200699 ret = acl_exec_cond(rule->cond, s->be, s, &s->txn, SMP_OPT_DIR_REQ | partial);
Willy Tarreauedcf6682008-11-30 23:15:34 +0100700 if (ret == ACL_PAT_MISS) {
Willy Tarreau520d95e2009-09-19 21:04:57 +0200701 buffer_dont_connect(req);
Willy Tarreauedcf6682008-11-30 23:15:34 +0100702 /* just set the request timeout once at the beginning of the request */
Willy Tarreaufb356202010-08-03 14:02:05 +0200703 if (!tick_isset(req->analyse_exp) && s->be->tcp_req.inspect_delay)
704 req->analyse_exp = tick_add_ifset(now_ms, s->be->tcp_req.inspect_delay);
Willy Tarreauedcf6682008-11-30 23:15:34 +0100705 return 0;
706 }
707
708 ret = acl_pass(ret);
709 if (rule->cond->pol == ACL_COND_UNLESS)
710 ret = !ret;
711 }
712
713 if (ret) {
714 /* we have a matching rule. */
715 if (rule->action == TCP_ACT_REJECT) {
716 buffer_abort(req);
717 buffer_abort(s->rep);
718 req->analysers = 0;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +0200719
Willy Tarreau7d0aaf32011-03-10 23:25:56 +0100720 s->be->be_counters.denied_req++;
721 s->fe->fe_counters.denied_req++;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +0200722 if (s->listener->counters)
Willy Tarreau23968d82010-05-23 23:50:44 +0200723 s->listener->counters->denied_req++;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +0200724
Willy Tarreauedcf6682008-11-30 23:15:34 +0100725 if (!(s->flags & SN_ERR_MASK))
726 s->flags |= SN_ERR_PRXCOND;
727 if (!(s->flags & SN_FINST_MASK))
728 s->flags |= SN_FINST_R;
729 return 0;
730 }
Willy Tarreau56123282010-08-06 19:06:56 +0200731 else if (rule->action == TCP_ACT_TRK_SC1) {
732 if (!s->stkctr1_entry) {
733 /* only the first valid track-sc1 directive applies.
Willy Tarreaud1f96522010-08-03 19:34:32 +0200734 * Also, note that right now we can only track SRC so we
735 * don't check how to get the key, but later we may need
736 * to consider rule->act_prm->trk_ctr.type.
737 */
738 t = rule->act_prm.trk_ctr.table.t;
David du Colombier4f92d322011-03-24 11:09:31 +0100739 ts = stktable_get_entry(t, tcp_src_to_stktable_key(s));
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200740 if (ts) {
Willy Tarreau56123282010-08-06 19:06:56 +0200741 session_track_stkctr1(s, t, ts);
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200742 if (s->fe != s->be)
743 s->flags |= SN_BE_TRACK_SC1;
744 }
Willy Tarreaud1f96522010-08-03 19:34:32 +0200745 }
746 }
Willy Tarreau56123282010-08-06 19:06:56 +0200747 else if (rule->action == TCP_ACT_TRK_SC2) {
748 if (!s->stkctr2_entry) {
749 /* only the first valid track-sc2 directive applies.
Willy Tarreaud1f96522010-08-03 19:34:32 +0200750 * Also, note that right now we can only track SRC so we
751 * don't check how to get the key, but later we may need
752 * to consider rule->act_prm->trk_ctr.type.
753 */
754 t = rule->act_prm.trk_ctr.table.t;
David du Colombier4f92d322011-03-24 11:09:31 +0100755 ts = stktable_get_entry(t, tcp_src_to_stktable_key(s));
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200756 if (ts) {
Willy Tarreau56123282010-08-06 19:06:56 +0200757 session_track_stkctr2(s, t, ts);
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200758 if (s->fe != s->be)
759 s->flags |= SN_BE_TRACK_SC2;
760 }
Willy Tarreaud1f96522010-08-03 19:34:32 +0200761 }
762 }
763 else {
Willy Tarreauedcf6682008-11-30 23:15:34 +0100764 /* otherwise accept */
Willy Tarreaud1f96522010-08-03 19:34:32 +0200765 break;
766 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100767 }
768 }
769
770 /* if we get there, it means we have no rule which matches, or
771 * we have an explicit accept, so we apply the default accept.
772 */
Willy Tarreau3a816292009-07-07 10:55:49 +0200773 req->analysers &= ~an_bit;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100774 req->analyse_exp = TICK_ETERNITY;
775 return 1;
776}
777
Emeric Brun97679e72010-09-23 17:56:44 +0200778/* This function performs the TCP response analysis on the current response. It
779 * returns 1 if the processing can continue on next analysers, or zero if it
780 * needs more data, encounters an error, or wants to immediately abort the
781 * response. It relies on buffers flags, and updates s->rep->analysers. The
782 * function may be called for backend rules.
783 */
784int tcp_inspect_response(struct session *s, struct buffer *rep, int an_bit)
785{
786 struct tcp_rule *rule;
787 int partial;
788
Willy Tarreau02d6cfc2012-03-01 18:19:58 +0100789 DPRINTF(stderr,"[%u] %s: session=%p b=%p, exp(r,w)=%u,%u bf=%08x bh=%d analysers=%02x\n",
Emeric Brun97679e72010-09-23 17:56:44 +0200790 now_ms, __FUNCTION__,
791 s,
792 rep,
793 rep->rex, rep->wex,
794 rep->flags,
Willy Tarreau02d6cfc2012-03-01 18:19:58 +0100795 rep->i,
Emeric Brun97679e72010-09-23 17:56:44 +0200796 rep->analysers);
797
798 /* We don't know whether we have enough data, so must proceed
799 * this way :
800 * - iterate through all rules in their declaration order
801 * - if one rule returns MISS, it means the inspect delay is
802 * not over yet, then return immediately, otherwise consider
803 * it as a non-match.
804 * - if one rule returns OK, then return OK
805 * - if one rule returns KO, then return KO
806 */
807
808 if (rep->flags & BF_SHUTR || tick_is_expired(rep->analyse_exp, now_ms))
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200809 partial = SMP_OPT_FINAL;
Emeric Brun97679e72010-09-23 17:56:44 +0200810 else
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200811 partial = 0;
Emeric Brun97679e72010-09-23 17:56:44 +0200812
813 list_for_each_entry(rule, &s->be->tcp_rep.inspect_rules, list) {
814 int ret = ACL_PAT_PASS;
815
816 if (rule->cond) {
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200817 ret = acl_exec_cond(rule->cond, s->be, s, &s->txn, SMP_OPT_DIR_RES | partial);
Emeric Brun97679e72010-09-23 17:56:44 +0200818 if (ret == ACL_PAT_MISS) {
819 /* just set the analyser timeout once at the beginning of the response */
820 if (!tick_isset(rep->analyse_exp) && s->be->tcp_rep.inspect_delay)
821 rep->analyse_exp = tick_add_ifset(now_ms, s->be->tcp_rep.inspect_delay);
822 return 0;
823 }
824
825 ret = acl_pass(ret);
826 if (rule->cond->pol == ACL_COND_UNLESS)
827 ret = !ret;
828 }
829
830 if (ret) {
831 /* we have a matching rule. */
832 if (rule->action == TCP_ACT_REJECT) {
833 buffer_abort(rep);
834 buffer_abort(s->req);
835 rep->analysers = 0;
836
Willy Tarreau7d0aaf32011-03-10 23:25:56 +0100837 s->be->be_counters.denied_resp++;
838 s->fe->fe_counters.denied_resp++;
Emeric Brun97679e72010-09-23 17:56:44 +0200839 if (s->listener->counters)
840 s->listener->counters->denied_resp++;
841
842 if (!(s->flags & SN_ERR_MASK))
843 s->flags |= SN_ERR_PRXCOND;
844 if (!(s->flags & SN_FINST_MASK))
845 s->flags |= SN_FINST_D;
846 return 0;
847 }
848 else {
849 /* otherwise accept */
850 break;
851 }
852 }
853 }
854
855 /* if we get there, it means we have no rule which matches, or
856 * we have an explicit accept, so we apply the default accept.
857 */
858 rep->analysers &= ~an_bit;
859 rep->analyse_exp = TICK_ETERNITY;
860 return 1;
861}
862
863
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200864/* This function performs the TCP layer4 analysis on the current request. It
865 * returns 0 if a reject rule matches, otherwise 1 if either an accept rule
866 * matches or if no more rule matches. It can only use rules which don't need
867 * any data.
868 */
869int tcp_exec_req_rules(struct session *s)
870{
871 struct tcp_rule *rule;
Willy Tarreauf059a0f2010-08-03 16:29:52 +0200872 struct stksess *ts;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200873 struct stktable *t = NULL;
874 int result = 1;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200875 int ret;
876
877 list_for_each_entry(rule, &s->fe->tcp_req.l4_rules, list) {
878 ret = ACL_PAT_PASS;
879
880 if (rule->cond) {
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200881 ret = acl_exec_cond(rule->cond, s->fe, s, NULL, SMP_OPT_DIR_REQ|SMP_OPT_FINAL);
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200882 ret = acl_pass(ret);
883 if (rule->cond->pol == ACL_COND_UNLESS)
884 ret = !ret;
885 }
886
887 if (ret) {
888 /* we have a matching rule. */
889 if (rule->action == TCP_ACT_REJECT) {
Willy Tarreau7d0aaf32011-03-10 23:25:56 +0100890 s->fe->fe_counters.denied_conn++;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200891 if (s->listener->counters)
Willy Tarreau2799e982010-06-05 15:43:21 +0200892 s->listener->counters->denied_conn++;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200893
894 if (!(s->flags & SN_ERR_MASK))
895 s->flags |= SN_ERR_PRXCOND;
896 if (!(s->flags & SN_FINST_MASK))
897 s->flags |= SN_FINST_R;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200898 result = 0;
899 break;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200900 }
Willy Tarreau56123282010-08-06 19:06:56 +0200901 else if (rule->action == TCP_ACT_TRK_SC1) {
902 if (!s->stkctr1_entry) {
903 /* only the first valid track-sc1 directive applies.
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200904 * Also, note that right now we can only track SRC so we
905 * don't check how to get the key, but later we may need
906 * to consider rule->act_prm->trk_ctr.type.
907 */
908 t = rule->act_prm.trk_ctr.table.t;
David du Colombier4f92d322011-03-24 11:09:31 +0100909 ts = stktable_get_entry(t, tcp_src_to_stktable_key(s));
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200910 if (ts)
Willy Tarreau56123282010-08-06 19:06:56 +0200911 session_track_stkctr1(s, t, ts);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200912 }
913 }
Willy Tarreau56123282010-08-06 19:06:56 +0200914 else if (rule->action == TCP_ACT_TRK_SC2) {
915 if (!s->stkctr2_entry) {
916 /* only the first valid track-sc2 directive applies.
Willy Tarreauf059a0f2010-08-03 16:29:52 +0200917 * Also, note that right now we can only track SRC so we
918 * don't check how to get the key, but later we may need
919 * to consider rule->act_prm->trk_ctr.type.
920 */
921 t = rule->act_prm.trk_ctr.table.t;
David du Colombier4f92d322011-03-24 11:09:31 +0100922 ts = stktable_get_entry(t, tcp_src_to_stktable_key(s));
Willy Tarreauf059a0f2010-08-03 16:29:52 +0200923 if (ts)
Willy Tarreau56123282010-08-06 19:06:56 +0200924 session_track_stkctr2(s, t, ts);
Willy Tarreauf059a0f2010-08-03 16:29:52 +0200925 }
926 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200927 else {
928 /* otherwise it's an accept */
929 break;
930 }
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200931 }
932 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200933 return result;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200934}
935
Emeric Brun97679e72010-09-23 17:56:44 +0200936/* Parse a tcp-response rule. Return a negative value in case of failure */
937static int tcp_parse_response_rule(char **args, int arg, int section_type,
938 struct proxy *curpx, struct proxy *defpx,
Willy Tarreau0a3dd742012-05-08 19:47:01 +0200939 struct tcp_rule *rule, char **err)
Emeric Brun97679e72010-09-23 17:56:44 +0200940{
941 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +0200942 memprintf(err, "%s %s is only allowed in 'backend' sections",
943 args[0], args[1]);
Emeric Brun97679e72010-09-23 17:56:44 +0200944 return -1;
945 }
946
947 if (strcmp(args[arg], "accept") == 0) {
948 arg++;
949 rule->action = TCP_ACT_ACCEPT;
950 }
951 else if (strcmp(args[arg], "reject") == 0) {
952 arg++;
953 rule->action = TCP_ACT_REJECT;
954 }
955 else {
Willy Tarreau0a3dd742012-05-08 19:47:01 +0200956 memprintf(err,
957 "'%s %s' expects 'accept' or 'reject' in %s '%s' (got '%s')",
958 args[0], args[1], proxy_type_str(curpx), curpx->id, args[arg]);
Emeric Brun97679e72010-09-23 17:56:44 +0200959 return -1;
960 }
961
962 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +0200963 if ((rule->cond = build_acl_cond(NULL, 0, curpx, (const char **)args+arg, err)) == NULL) {
964 memprintf(err,
965 "'%s %s %s' : error detected in %s '%s' while parsing '%s' condition : %s",
966 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg], *err);
Emeric Brun97679e72010-09-23 17:56:44 +0200967 return -1;
968 }
969 }
970 else if (*args[arg]) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +0200971 memprintf(err,
972 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (got '%s')",
Emeric Brun97679e72010-09-23 17:56:44 +0200973 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
974 return -1;
975 }
976 return 0;
977}
978
979
980
Willy Tarreau68c03ab2010-08-06 15:08:45 +0200981/* Parse a tcp-request rule. Return a negative value in case of failure */
982static int tcp_parse_request_rule(char **args, int arg, int section_type,
983 struct proxy *curpx, struct proxy *defpx,
Willy Tarreau0a3dd742012-05-08 19:47:01 +0200984 struct tcp_rule *rule, char **err)
Willy Tarreau68c03ab2010-08-06 15:08:45 +0200985{
986 if (curpx == defpx) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +0200987 memprintf(err, "%s %s is not allowed in 'defaults' sections",
988 args[0], args[1]);
Willy Tarreau68c03ab2010-08-06 15:08:45 +0200989 return -1;
990 }
991
992 if (!strcmp(args[arg], "accept")) {
993 arg++;
994 rule->action = TCP_ACT_ACCEPT;
995 }
996 else if (!strcmp(args[arg], "reject")) {
997 arg++;
998 rule->action = TCP_ACT_REJECT;
999 }
Willy Tarreau56123282010-08-06 19:06:56 +02001000 else if (strcmp(args[arg], "track-sc1") == 0) {
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001001 int ret;
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001002 int kw = arg;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001003
1004 arg++;
1005 ret = parse_track_counters(args, &arg, section_type, curpx,
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001006 &rule->act_prm.trk_ctr, defpx, err);
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001007
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001008 if (ret < 0) { /* nb: warnings are not handled yet */
1009 memprintf(err,
1010 "'%s %s %s' : %s in %s '%s'",
1011 args[0], args[1], args[kw], *err, proxy_type_str(curpx), curpx->id);
1012 return ret;
1013 }
Willy Tarreau56123282010-08-06 19:06:56 +02001014 rule->action = TCP_ACT_TRK_SC1;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001015 }
Willy Tarreau56123282010-08-06 19:06:56 +02001016 else if (strcmp(args[arg], "track-sc2") == 0) {
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001017 int ret;
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001018 int kw = arg;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001019
1020 arg++;
1021 ret = parse_track_counters(args, &arg, section_type, curpx,
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001022 &rule->act_prm.trk_ctr, defpx, err);
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001023
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001024 if (ret < 0) { /* nb: warnings are not handled yet */
1025 memprintf(err,
1026 "'%s %s %s' : %s in %s '%s'",
1027 args[0], args[1], args[kw], *err, proxy_type_str(curpx), curpx->id);
1028 return ret;
1029 }
Willy Tarreau56123282010-08-06 19:06:56 +02001030 rule->action = TCP_ACT_TRK_SC2;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001031 }
1032 else {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001033 memprintf(err,
1034 "'%s %s' expects 'accept', 'reject', 'track-sc1' "
1035 "or 'track-sc2' in %s '%s' (got '%s')",
1036 args[0], args[1], proxy_type_str(curpx), curpx->id, args[arg]);
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001037 return -1;
1038 }
1039
1040 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001041 if ((rule->cond = build_acl_cond(NULL, 0, curpx, (const char **)args+arg, err)) == NULL) {
1042 memprintf(err,
1043 "'%s %s %s' : error detected in %s '%s' while parsing '%s' condition : %s",
1044 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg], *err);
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001045 return -1;
1046 }
1047 }
1048 else if (*args[arg]) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001049 memprintf(err,
1050 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (got '%s')",
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001051 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
1052 return -1;
1053 }
1054 return 0;
1055}
1056
Emeric Brun97679e72010-09-23 17:56:44 +02001057/* This function should be called to parse a line starting with the "tcp-response"
1058 * keyword.
1059 */
1060static int tcp_parse_tcp_rep(char **args, int section_type, struct proxy *curpx,
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001061 struct proxy *defpx, char **err)
Emeric Brun97679e72010-09-23 17:56:44 +02001062{
1063 const char *ptr = NULL;
1064 unsigned int val;
Emeric Brun97679e72010-09-23 17:56:44 +02001065 int warn = 0;
1066 int arg;
1067 struct tcp_rule *rule;
1068
1069 if (!*args[1]) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001070 memprintf(err, "missing argument for '%s' in %s '%s'",
1071 args[0], proxy_type_str(curpx), curpx->id);
Emeric Brun97679e72010-09-23 17:56:44 +02001072 return -1;
1073 }
1074
1075 if (strcmp(args[1], "inspect-delay") == 0) {
1076 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001077 memprintf(err, "%s %s is only allowed in 'backend' sections",
1078 args[0], args[1]);
Emeric Brun97679e72010-09-23 17:56:44 +02001079 return -1;
1080 }
1081
1082 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001083 memprintf(err,
1084 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
1085 args[0], args[1], proxy_type_str(curpx), curpx->id);
1086 if (ptr)
1087 memprintf(err, "%s (unexpected character '%c')", *err, *ptr);
Emeric Brun97679e72010-09-23 17:56:44 +02001088 return -1;
1089 }
1090
1091 if (curpx->tcp_rep.inspect_delay) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001092 memprintf(err, "ignoring %s %s (was already defined) in %s '%s'",
1093 args[0], args[1], proxy_type_str(curpx), curpx->id);
Emeric Brun97679e72010-09-23 17:56:44 +02001094 return 1;
1095 }
1096 curpx->tcp_rep.inspect_delay = val;
1097 return 0;
1098 }
1099
Simon Hormande072bd2011-06-24 15:11:37 +09001100 rule = calloc(1, sizeof(*rule));
Emeric Brun97679e72010-09-23 17:56:44 +02001101 LIST_INIT(&rule->list);
1102 arg = 1;
1103
1104 if (strcmp(args[1], "content") == 0) {
1105 arg++;
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001106 if (tcp_parse_response_rule(args, arg, section_type, curpx, defpx, rule, err) < 0)
Emeric Brun97679e72010-09-23 17:56:44 +02001107 goto error;
1108
1109 if (rule->cond && (rule->cond->requires & ACL_USE_L6REQ_VOLATILE)) {
1110 struct acl *acl;
1111 const char *name;
1112
1113 acl = cond_find_require(rule->cond, ACL_USE_L6REQ_VOLATILE);
1114 name = acl ? acl->name : "(unknown)";
1115
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001116 memprintf(err,
1117 "acl '%s' involves some request-only criteria which will be ignored in '%s %s'",
1118 name, args[0], args[1]);
Emeric Brun97679e72010-09-23 17:56:44 +02001119 warn++;
1120 }
1121
1122 LIST_ADDQ(&curpx->tcp_rep.inspect_rules, &rule->list);
1123 }
1124 else {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001125 memprintf(err,
1126 "'%s' expects 'inspect-delay' or 'content' in %s '%s' (got '%s')",
1127 args[0], proxy_type_str(curpx), curpx->id, args[1]);
Emeric Brun97679e72010-09-23 17:56:44 +02001128 goto error;
1129 }
1130
1131 return warn;
1132 error:
1133 free(rule);
1134 return -1;
1135}
1136
1137
Willy Tarreaub6866442008-07-14 23:54:42 +02001138/* This function should be called to parse a line starting with the "tcp-request"
1139 * keyword.
1140 */
1141static int tcp_parse_tcp_req(char **args, int section_type, struct proxy *curpx,
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001142 struct proxy *defpx, char **err)
Willy Tarreaub6866442008-07-14 23:54:42 +02001143{
1144 const char *ptr = NULL;
Willy Tarreauc7e961e2008-08-17 17:13:47 +02001145 unsigned int val;
Willy Tarreau1a687942010-05-23 22:40:30 +02001146 int warn = 0;
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001147 int arg;
Willy Tarreau1a687942010-05-23 22:40:30 +02001148 struct tcp_rule *rule;
Willy Tarreaub6866442008-07-14 23:54:42 +02001149
1150 if (!*args[1]) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001151 if (curpx == defpx)
1152 memprintf(err, "missing argument for '%s' in defaults section", args[0]);
1153 else
1154 memprintf(err, "missing argument for '%s' in %s '%s'",
1155 args[0], proxy_type_str(curpx), curpx->id);
Willy Tarreaub6866442008-07-14 23:54:42 +02001156 return -1;
1157 }
1158
1159 if (!strcmp(args[1], "inspect-delay")) {
1160 if (curpx == defpx) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001161 memprintf(err, "%s %s is not allowed in 'defaults' sections",
1162 args[0], args[1]);
Willy Tarreaub6866442008-07-14 23:54:42 +02001163 return -1;
1164 }
1165
Willy Tarreaub6866442008-07-14 23:54:42 +02001166 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001167 memprintf(err,
1168 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
1169 args[0], args[1], proxy_type_str(curpx), curpx->id);
1170 if (ptr)
1171 memprintf(err, "%s (unexpected character '%c')", *err, *ptr);
Willy Tarreaub6866442008-07-14 23:54:42 +02001172 return -1;
1173 }
1174
1175 if (curpx->tcp_req.inspect_delay) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001176 memprintf(err, "ignoring %s %s (was already defined) in %s '%s'",
1177 args[0], args[1], proxy_type_str(curpx), curpx->id);
Willy Tarreaub6866442008-07-14 23:54:42 +02001178 return 1;
1179 }
1180 curpx->tcp_req.inspect_delay = val;
1181 return 0;
1182 }
1183
Simon Hormande072bd2011-06-24 15:11:37 +09001184 rule = calloc(1, sizeof(*rule));
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001185 LIST_INIT(&rule->list);
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001186 arg = 1;
1187
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001188 if (strcmp(args[1], "content") == 0) {
Willy Tarreaud1f96522010-08-03 19:34:32 +02001189 arg++;
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001190 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err) < 0)
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001191 goto error;
Willy Tarreaub6866442008-07-14 23:54:42 +02001192
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001193 if (rule->cond && (rule->cond->requires & ACL_USE_RTR_ANY)) {
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001194 struct acl *acl;
1195 const char *name;
1196
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001197 acl = cond_find_require(rule->cond, ACL_USE_RTR_ANY);
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001198 name = acl ? acl->name : "(unknown)";
1199
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001200 memprintf(err,
1201 "acl '%s' involves some response-only criteria which will be ignored in '%s %s'",
1202 name, args[0], args[1]);
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001203 warn++;
1204 }
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001205 LIST_ADDQ(&curpx->tcp_req.inspect_rules, &rule->list);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001206 }
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001207 else if (strcmp(args[1], "connection") == 0) {
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001208 arg++;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001209
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001210 if (!(curpx->cap & PR_CAP_FE)) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001211 memprintf(err, "%s %s is not allowed because %s %s is not a frontend",
1212 args[0], args[1], proxy_type_str(curpx), curpx->id);
Simon Horman6c54d8b2011-07-15 13:14:06 +09001213 goto error;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001214 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001215
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001216 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err) < 0)
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001217 goto error;
1218
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001219 if (rule->cond && (rule->cond->requires & (ACL_USE_RTR_ANY|ACL_USE_L6_ANY|ACL_USE_L7_ANY))) {
1220 struct acl *acl;
1221 const char *name;
Willy Tarreauf059a0f2010-08-03 16:29:52 +02001222
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001223 acl = cond_find_require(rule->cond, ACL_USE_RTR_ANY|ACL_USE_L6_ANY|ACL_USE_L7_ANY);
1224 name = acl ? acl->name : "(unknown)";
Willy Tarreauf059a0f2010-08-03 16:29:52 +02001225
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001226 if (acl->requires & (ACL_USE_L6_ANY|ACL_USE_L7_ANY)) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001227 memprintf(err,
1228 "'%s %s' may not reference acl '%s' which makes use of "
1229 "payload in %s '%s'. Please use '%s content' for this.",
1230 args[0], args[1], name, proxy_type_str(curpx), curpx->id, args[0]);
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001231 goto error;
1232 }
1233 if (acl->requires & ACL_USE_RTR_ANY)
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001234 memprintf(err,
1235 "acl '%s' involves some response-only criteria which will be ignored in '%s %s'",
1236 name, args[0], args[1]);
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001237 warn++;
1238 }
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001239 LIST_ADDQ(&curpx->tcp_req.l4_rules, &rule->list);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001240 }
Willy Tarreau1a687942010-05-23 22:40:30 +02001241 else {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001242 if (curpx == defpx)
1243 memprintf(err,
1244 "'%s' expects 'inspect-delay', 'connection', or 'content' in defaults section (got '%s')",
1245 args[0], args[1]);
1246 else
1247 memprintf(err,
1248 "'%s' expects 'inspect-delay', 'connection', or 'content' in %s '%s' (got '%s')",
1249 args[0], args[1], proxy_type_str(curpx), curpx->id);
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001250 goto error;
Willy Tarreau1a687942010-05-23 22:40:30 +02001251 }
1252
Willy Tarreau1a687942010-05-23 22:40:30 +02001253 return warn;
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001254 error:
1255 free(rule);
1256 return -1;
Willy Tarreaub6866442008-07-14 23:54:42 +02001257}
1258
Willy Tarreau645513a2010-05-24 20:55:15 +02001259
1260/************************************************************************/
Willy Tarreau32389b72012-04-23 23:13:20 +02001261/* All supported sample fetch functios must be declared here */
1262/************************************************************************/
1263
1264/* Fetch the request RDP cookie identified in the args, or any cookie if no arg
Willy Tarreau12785782012-04-27 21:37:17 +02001265 * is passed. It is usable both for ACL and for samples. Note: this decoder
Willy Tarreau32389b72012-04-23 23:13:20 +02001266 * only works with non-wrapping data. Accepts either 0 or 1 argument. Argument
1267 * is a string (cookie name), other types will lead to undefined behaviour.
1268 */
1269int
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001270smp_fetch_rdp_cookie(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau32389b72012-04-23 23:13:20 +02001271 const struct arg *args, struct sample *smp)
1272{
1273 int bleft;
1274 const unsigned char *data;
1275
1276 if (!l4 || !l4->req)
1277 return 0;
1278
1279 smp->flags = 0;
1280 smp->type = SMP_T_CSTR;
1281
1282 bleft = l4->req->i;
1283 if (bleft <= 11)
1284 goto too_short;
1285
1286 data = (const unsigned char *)l4->req->p + 11;
1287 bleft -= 11;
1288
1289 if (bleft <= 7)
1290 goto too_short;
1291
1292 if (strncasecmp((const char *)data, "Cookie:", 7) != 0)
1293 goto not_cookie;
1294
1295 data += 7;
1296 bleft -= 7;
1297
1298 while (bleft > 0 && *data == ' ') {
1299 data++;
1300 bleft--;
1301 }
1302
1303 if (args) {
1304
1305 if (bleft <= args->data.str.len)
1306 goto too_short;
1307
1308 if ((data[args->data.str.len] != '=') ||
1309 strncasecmp(args->data.str.str, (const char *)data, args->data.str.len) != 0)
1310 goto not_cookie;
1311
1312 data += args->data.str.len + 1;
1313 bleft -= args->data.str.len + 1;
1314 } else {
1315 while (bleft > 0 && *data != '=') {
1316 if (*data == '\r' || *data == '\n')
1317 goto not_cookie;
1318 data++;
1319 bleft--;
1320 }
1321
1322 if (bleft < 1)
1323 goto too_short;
1324
1325 if (*data != '=')
1326 goto not_cookie;
1327
1328 data++;
1329 bleft--;
1330 }
1331
1332 /* data points to cookie value */
1333 smp->data.str.str = (char *)data;
1334 smp->data.str.len = 0;
1335
1336 while (bleft > 0 && *data != '\r') {
1337 data++;
1338 bleft--;
1339 }
1340
1341 if (bleft < 2)
1342 goto too_short;
1343
1344 if (data[0] != '\r' || data[1] != '\n')
1345 goto not_cookie;
1346
1347 smp->data.str.len = (char *)data - smp->data.str.str;
1348 smp->flags = SMP_F_VOLATILE;
1349 return 1;
1350
1351 too_short:
1352 smp->flags = SMP_F_MAY_CHANGE;
1353 not_cookie:
1354 return 0;
1355}
1356
Willy Tarreau32389b72012-04-23 23:13:20 +02001357/************************************************************************/
Willy Tarreau645513a2010-05-24 20:55:15 +02001358/* All supported ACL keywords must be declared here. */
1359/************************************************************************/
1360
Willy Tarreau32389b72012-04-23 23:13:20 +02001361/* returns either 1 or 0 depending on whether an RDP cookie is found or not */
1362static int
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001363acl_fetch_rdp_cookie_cnt(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau24e32d82012-04-23 23:55:44 +02001364 const struct arg *args, struct sample *smp)
Willy Tarreau32389b72012-04-23 23:13:20 +02001365{
1366 int ret;
1367
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001368 ret = smp_fetch_rdp_cookie(px, l4, l7, opt, args, smp);
Willy Tarreau32389b72012-04-23 23:13:20 +02001369
1370 if (smp->flags & SMP_F_MAY_CHANGE)
1371 return 0;
1372
1373 smp->flags = SMP_F_VOLATILE;
1374 smp->type = SMP_T_UINT;
1375 smp->data.uint = ret;
1376 return 1;
1377}
1378
1379
Willy Tarreau4a129812012-04-25 17:31:42 +02001380/* fetch the connection's source IPv4/IPv6 address */
Willy Tarreau645513a2010-05-24 20:55:15 +02001381static int
Willy Tarreau4a129812012-04-25 17:31:42 +02001382smp_fetch_src(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau24e32d82012-04-23 23:55:44 +02001383 const struct arg *args, struct sample *smp)
Willy Tarreau645513a2010-05-24 20:55:15 +02001384{
Willy Tarreauf4362b32011-12-16 17:49:52 +01001385 switch (l4->si[0].addr.from.ss_family) {
1386 case AF_INET:
Willy Tarreauf853c462012-04-23 18:53:56 +02001387 smp->data.ipv4 = ((struct sockaddr_in *)&l4->si[0].addr.from)->sin_addr;
1388 smp->type = SMP_T_IPV4;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001389 break;
1390 case AF_INET6:
Willy Tarreauf853c462012-04-23 18:53:56 +02001391 smp->data.ipv6 = ((struct sockaddr_in6 *)(&l4->si[0].addr.from))->sin6_addr;
1392 smp->type = SMP_T_IPV6;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001393 break;
1394 default:
Emeric Brunf769f512010-10-22 17:14:01 +02001395 return 0;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001396 }
Emeric Brunf769f512010-10-22 17:14:01 +02001397
Willy Tarreau37406352012-04-23 16:16:37 +02001398 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001399 return 1;
1400}
1401
Willy Tarreaua5e37562011-12-16 17:06:15 +01001402/* set temp integer to the connection's source port */
Willy Tarreau645513a2010-05-24 20:55:15 +02001403static int
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001404smp_fetch_sport(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau24e32d82012-04-23 23:55:44 +02001405 const struct arg *args, struct sample *smp)
Willy Tarreau645513a2010-05-24 20:55:15 +02001406{
Willy Tarreauf853c462012-04-23 18:53:56 +02001407 smp->type = SMP_T_UINT;
1408 if (!(smp->data.uint = get_host_port(&l4->si[0].addr.from)))
Emeric Brunf769f512010-10-22 17:14:01 +02001409 return 0;
1410
Willy Tarreau37406352012-04-23 16:16:37 +02001411 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001412 return 1;
1413}
1414
Willy Tarreau4a129812012-04-25 17:31:42 +02001415/* fetch the connection's destination IPv4/IPv6 address */
Willy Tarreau645513a2010-05-24 20:55:15 +02001416static int
Willy Tarreau4a129812012-04-25 17:31:42 +02001417smp_fetch_dst(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau24e32d82012-04-23 23:55:44 +02001418 const struct arg *args, struct sample *smp)
Willy Tarreau645513a2010-05-24 20:55:15 +02001419{
Willy Tarreau9b061e32012-04-07 18:03:52 +02001420 stream_sock_get_to_addr(&l4->si[0]);
Willy Tarreau645513a2010-05-24 20:55:15 +02001421
Willy Tarreauf4362b32011-12-16 17:49:52 +01001422 switch (l4->si[0].addr.to.ss_family) {
1423 case AF_INET:
Willy Tarreauf853c462012-04-23 18:53:56 +02001424 smp->data.ipv4 = ((struct sockaddr_in *)&l4->si[0].addr.to)->sin_addr;
1425 smp->type = SMP_T_IPV4;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001426 break;
1427 case AF_INET6:
Willy Tarreauf853c462012-04-23 18:53:56 +02001428 smp->data.ipv6 = ((struct sockaddr_in6 *)(&l4->si[0].addr.to))->sin6_addr;
1429 smp->type = SMP_T_IPV6;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001430 break;
1431 default:
Emeric Brunf769f512010-10-22 17:14:01 +02001432 return 0;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001433 }
Emeric Brunf769f512010-10-22 17:14:01 +02001434
Willy Tarreau37406352012-04-23 16:16:37 +02001435 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001436 return 1;
1437}
1438
Willy Tarreaua5e37562011-12-16 17:06:15 +01001439/* set temp integer to the frontend connexion's destination port */
Willy Tarreau645513a2010-05-24 20:55:15 +02001440static int
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001441smp_fetch_dport(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau24e32d82012-04-23 23:55:44 +02001442 const struct arg *args, struct sample *smp)
Willy Tarreau645513a2010-05-24 20:55:15 +02001443{
Willy Tarreau9b061e32012-04-07 18:03:52 +02001444 stream_sock_get_to_addr(&l4->si[0]);
Willy Tarreau645513a2010-05-24 20:55:15 +02001445
Willy Tarreauf853c462012-04-23 18:53:56 +02001446 smp->type = SMP_T_UINT;
1447 if (!(smp->data.uint = get_host_port(&l4->si[0].addr.to)))
Emeric Brunf769f512010-10-22 17:14:01 +02001448 return 0;
1449
Willy Tarreau37406352012-04-23 16:16:37 +02001450 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001451 return 1;
1452}
1453
1454static int
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001455smp_fetch_payload_lv(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
1456 const struct arg *arg_p, struct sample *smp)
Emericf2d7cae2010-11-05 18:13:50 +01001457{
Willy Tarreau82ea8002012-04-25 19:19:43 +02001458 unsigned int len_offset = arg_p[0].data.uint;
1459 unsigned int len_size = arg_p[1].data.uint;
1460 unsigned int buf_offset;
1461 unsigned int buf_size = 0;
Emericf2d7cae2010-11-05 18:13:50 +01001462 struct buffer *b;
1463 int i;
1464
1465 /* Format is (len offset, len size, buf offset) or (len offset, len size) */
1466 /* by default buf offset == len offset + len size */
1467 /* buf offset could be absolute or relative to len offset + len size if prefixed by + or - */
1468
1469 if (!l4)
1470 return 0;
1471
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001472 b = ((opt & SMP_OPT_DIR) == SMP_OPT_DIR_RES) ? l4->rep : l4->req;
Emericf2d7cae2010-11-05 18:13:50 +01001473
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001474 if (!b)
Emericf2d7cae2010-11-05 18:13:50 +01001475 return 0;
1476
Willy Tarreau02d6cfc2012-03-01 18:19:58 +01001477 if (len_offset + len_size > b->i)
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001478 goto too_short;
Emericf2d7cae2010-11-05 18:13:50 +01001479
1480 for (i = 0; i < len_size; i++) {
Willy Tarreau89fa7062012-03-02 16:13:16 +01001481 buf_size = (buf_size << 8) + ((unsigned char *)b->p)[i + len_offset];
Emericf2d7cae2010-11-05 18:13:50 +01001482 }
1483
Willy Tarreau9fcb9842012-04-20 14:45:49 +02001484 /* buf offset may be implicit, absolute or relative */
1485 buf_offset = len_offset + len_size;
1486 if (arg_p[2].type == ARGT_UINT)
1487 buf_offset = arg_p[2].data.uint;
1488 else if (arg_p[2].type == ARGT_SINT)
1489 buf_offset += arg_p[2].data.sint;
1490
Willy Tarreau82ea8002012-04-25 19:19:43 +02001491 if (!buf_size || buf_size > b->size || buf_offset + buf_size > b->size) {
1492 /* will never match */
1493 smp->flags = 0;
1494 return 0;
1495 }
1496
Willy Tarreau02d6cfc2012-03-01 18:19:58 +01001497 if (buf_offset + buf_size > b->i)
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001498 goto too_short;
Emericf2d7cae2010-11-05 18:13:50 +01001499
1500 /* init chunk as read only */
Willy Tarreaub8c8f1f2012-04-23 22:38:26 +02001501 smp->type = SMP_T_CBIN;
Willy Tarreau342acb42012-04-23 22:03:39 +02001502 chunk_initlen(&smp->data.str, b->p + buf_offset, 0, buf_size);
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001503 smp->flags = SMP_F_VOLATILE;
Emericf2d7cae2010-11-05 18:13:50 +01001504 return 1;
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001505
1506 too_short:
1507 smp->flags = SMP_F_MAY_CHANGE;
1508 return 0;
Emericf2d7cae2010-11-05 18:13:50 +01001509}
1510
1511static int
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001512smp_fetch_payload(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
1513 const struct arg *arg_p, struct sample *smp)
Emericf2d7cae2010-11-05 18:13:50 +01001514{
Willy Tarreau82ea8002012-04-25 19:19:43 +02001515 unsigned int buf_offset = arg_p[0].data.uint;
1516 unsigned int buf_size = arg_p[1].data.uint;
Emericf2d7cae2010-11-05 18:13:50 +01001517 struct buffer *b;
1518
1519 if (!l4)
1520 return 0;
1521
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001522 b = ((opt & SMP_OPT_DIR) == SMP_OPT_DIR_RES) ? l4->rep : l4->req;
Emericf2d7cae2010-11-05 18:13:50 +01001523
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001524 if (!b)
Emericf2d7cae2010-11-05 18:13:50 +01001525 return 0;
Willy Tarreau82ea8002012-04-25 19:19:43 +02001526
1527 if (!buf_size || buf_size > b->size || buf_offset + buf_size > b->size) {
1528 /* will never match */
1529 smp->flags = 0;
1530 return 0;
1531 }
Emericf2d7cae2010-11-05 18:13:50 +01001532
Willy Tarreau02d6cfc2012-03-01 18:19:58 +01001533 if (buf_offset + buf_size > b->i)
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001534 goto too_short;
Emericf2d7cae2010-11-05 18:13:50 +01001535
1536 /* init chunk as read only */
Willy Tarreaub8c8f1f2012-04-23 22:38:26 +02001537 smp->type = SMP_T_CBIN;
Willy Tarreau342acb42012-04-23 22:03:39 +02001538 chunk_initlen(&smp->data.str, b->p + buf_offset, 0, buf_size);
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001539 smp->flags = SMP_F_VOLATILE;
Simon Hormanab814e02011-06-24 14:50:20 +09001540 return 1;
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001541
1542 too_short:
1543 smp->flags = SMP_F_MAY_CHANGE;
1544 return 0;
Simon Hormanab814e02011-06-24 14:50:20 +09001545}
1546
Willy Tarreau21d68a62012-04-20 15:52:36 +02001547/* This function is used to validate the arguments passed to a "payload" fetch
1548 * keyword. This keyword expects two positive integers, with the second one
1549 * being strictly positive. It is assumed that the types are already the correct
1550 * ones. Returns 0 on error, non-zero if OK. If <err_msg> is not NULL, it will be
1551 * filled with a pointer to an error message in case of error, that the caller
1552 * is responsible for freeing. The initial location must either be freeable or
1553 * NULL.
1554 */
1555static int val_payload(struct arg *arg, char **err_msg)
1556{
1557 if (!arg[1].data.uint) {
1558 if (err_msg)
1559 memprintf(err_msg, "payload length must be > 0");
1560 return 0;
1561 }
1562 return 1;
1563}
1564
1565/* This function is used to validate the arguments passed to a "payload_lv" fetch
1566 * keyword. This keyword allows two positive integers and an optional signed one,
1567 * with the second one being strictly positive and the third one being greater than
1568 * the opposite of the two others if negative. It is assumed that the types are
1569 * already the correct ones. Returns 0 on error, non-zero if OK. If <err_msg> is
1570 * not NULL, it will be filled with a pointer to an error message in case of
1571 * error, that the caller is responsible for freeing. The initial location must
1572 * either be freeable or NULL.
1573 */
1574static int val_payload_lv(struct arg *arg, char **err_msg)
1575{
1576 if (!arg[1].data.uint) {
1577 if (err_msg)
1578 memprintf(err_msg, "payload length must be > 0");
1579 return 0;
1580 }
1581
1582 if (arg[2].type == ARGT_SINT &&
1583 (int)(arg[0].data.uint + arg[1].data.uint + arg[2].data.sint) < 0) {
1584 if (err_msg)
1585 memprintf(err_msg, "payload offset too negative");
1586 return 0;
1587 }
1588 return 1;
1589}
1590
Willy Tarreaub6866442008-07-14 23:54:42 +02001591static struct cfg_kw_list cfg_kws = {{ },{
1592 { CFG_LISTEN, "tcp-request", tcp_parse_tcp_req },
Emeric Brun97679e72010-09-23 17:56:44 +02001593 { CFG_LISTEN, "tcp-response", tcp_parse_tcp_rep },
Willy Tarreaub6866442008-07-14 23:54:42 +02001594 { 0, NULL, NULL },
1595}};
1596
Willy Tarreau61612d42012-04-19 18:42:05 +02001597/* Note: must not be declared <const> as its list will be overwritten.
1598 * Please take care of keeping this list alphabetically sorted.
1599 */
Willy Tarreaub6866442008-07-14 23:54:42 +02001600static struct acl_kw_list acl_kws = {{ },{
Willy Tarreau4a129812012-04-25 17:31:42 +02001601 { "dst", acl_parse_ip, smp_fetch_dst, acl_match_ip, ACL_USE_TCP4_PERMANENT|ACL_MAY_LOOKUP, 0 },
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001602 { "dst_port", acl_parse_int, smp_fetch_dport, acl_match_int, ACL_USE_TCP_PERMANENT, 0 },
Willy Tarreau0d5fe142012-04-26 12:24:45 +02001603 { "payload", acl_parse_str, smp_fetch_payload, acl_match_str, ACL_USE_L6REQ_VOLATILE|ACL_MAY_LOOKUP, ARG2(2,UINT,UINT), val_payload },
1604 { "payload_lv", acl_parse_str, smp_fetch_payload_lv, acl_match_str, ACL_USE_L6REQ_VOLATILE|ACL_MAY_LOOKUP, ARG3(2,UINT,UINT,SINT), val_payload_lv },
Willy Tarreau9fb4bc72012-04-24 00:09:26 +02001605 { "req_rdp_cookie", acl_parse_str, smp_fetch_rdp_cookie, acl_match_str, ACL_USE_L6REQ_VOLATILE|ACL_MAY_LOOKUP, ARG1(0,STR) },
Willy Tarreau32389b72012-04-23 23:13:20 +02001606 { "req_rdp_cookie_cnt", acl_parse_int, acl_fetch_rdp_cookie_cnt, acl_match_int, ACL_USE_L6REQ_VOLATILE, ARG1(0,STR) },
Willy Tarreau4a129812012-04-25 17:31:42 +02001607 { "src", acl_parse_ip, smp_fetch_src, acl_match_ip, ACL_USE_TCP4_PERMANENT|ACL_MAY_LOOKUP, 0 },
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001608 { "src_port", acl_parse_int, smp_fetch_sport, acl_match_int, ACL_USE_TCP_PERMANENT, 0 },
Willy Tarreaub6866442008-07-14 23:54:42 +02001609 { NULL, NULL, NULL, NULL },
1610}};
1611
Willy Tarreau4a129812012-04-25 17:31:42 +02001612/* Note: must not be declared <const> as its list will be overwritten.
1613 * Note: fetches that may return multiple types must be declared as the lowest
1614 * common denominator, the type that can be casted into all other ones. For
1615 * instance v4/v6 must be declared v4.
1616 */
Willy Tarreau12785782012-04-27 21:37:17 +02001617static struct sample_fetch_kw_list sample_fetch_keywords = {{ },{
Willy Tarreau4a129812012-04-25 17:31:42 +02001618 { "src", smp_fetch_src, 0, NULL, SMP_T_IPV4, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreau4a129812012-04-25 17:31:42 +02001619 { "dst", smp_fetch_dst, 0, NULL, SMP_T_IPV4, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001620 { "dst_port", smp_fetch_dport, 0, NULL, SMP_T_UINT, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001621 { "payload", smp_fetch_payload, ARG2(2,UINT,UINT), val_payload, SMP_T_CBIN, SMP_CAP_REQ|SMP_CAP_RES },
1622 { "payload_lv", smp_fetch_payload_lv, ARG3(2,UINT,UINT,SINT), val_payload_lv, SMP_T_CBIN, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreaud6281ae2012-04-26 11:23:39 +02001623 { "rdp_cookie", smp_fetch_rdp_cookie, ARG1(1,STR), NULL, SMP_T_CSTR, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001624 { "src_port", smp_fetch_sport, 0, NULL, SMP_T_UINT, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreau9fcb9842012-04-20 14:45:49 +02001625 { NULL, NULL, 0, 0, 0 },
Willy Tarreau645513a2010-05-24 20:55:15 +02001626}};
1627
Willy Tarreaue6b98942007-10-29 01:09:36 +01001628__attribute__((constructor))
1629static void __tcp_protocol_init(void)
1630{
1631 protocol_register(&proto_tcpv4);
1632 protocol_register(&proto_tcpv6);
Willy Tarreau12785782012-04-27 21:37:17 +02001633 sample_register_fetches(&sample_fetch_keywords);
Willy Tarreaub6866442008-07-14 23:54:42 +02001634 cfg_register_keywords(&cfg_kws);
1635 acl_register_keywords(&acl_kws);
Willy Tarreaue6b98942007-10-29 01:09:36 +01001636}
1637
1638
1639/*
1640 * Local variables:
1641 * c-indent-level: 8
1642 * c-basic-offset: 8
1643 * End:
1644 */