blob: ca993a6fc35afbeffb2d57f5f2eb24c6c4a7fe50 [file] [log] [blame]
Willy Tarreaue6b98942007-10-29 01:09:36 +01001/*
2 * AF_INET/AF_INET6 SOCK_STREAM protocol layer (tcp)
3 *
Willy Tarreau1a687942010-05-23 22:40:30 +02004 * Copyright 2000-2010 Willy Tarreau <w@1wt.eu>
Willy Tarreaue6b98942007-10-29 01:09:36 +01005 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
13#include <ctype.h>
14#include <errno.h>
15#include <fcntl.h>
16#include <stdio.h>
17#include <stdlib.h>
18#include <string.h>
19#include <time.h>
20
21#include <sys/param.h>
22#include <sys/socket.h>
23#include <sys/stat.h>
24#include <sys/types.h>
25#include <sys/un.h>
26
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +040027#include <netinet/tcp.h>
28
Willy Tarreaub6866442008-07-14 23:54:42 +020029#include <common/cfgparse.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010030#include <common/compat.h>
31#include <common/config.h>
32#include <common/debug.h>
33#include <common/errors.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010034#include <common/mini-clist.h>
35#include <common/standard.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010036
Willy Tarreaue6b98942007-10-29 01:09:36 +010037#include <types/global.h>
Willy Tarreau9650f372009-08-16 14:02:45 +020038#include <types/server.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010039
40#include <proto/acl.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010041#include <proto/buffers.h>
Willy Tarreau03fa5df2010-05-24 21:02:37 +020042#include <proto/frontend.h>
Willy Tarreau9650f372009-08-16 14:02:45 +020043#include <proto/log.h>
Willy Tarreau645513a2010-05-24 20:55:15 +020044#include <proto/pattern.h>
Willy Tarreau9650f372009-08-16 14:02:45 +020045#include <proto/port_range.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010046#include <proto/protocols.h>
47#include <proto/proto_tcp.h>
Willy Tarreaub6866442008-07-14 23:54:42 +020048#include <proto/proxy.h>
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +020049#include <proto/session.h>
Willy Tarreaua975b8f2010-06-05 19:13:27 +020050#include <proto/stick_table.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010051#include <proto/stream_sock.h>
Willy Tarreaua975b8f2010-06-05 19:13:27 +020052#include <proto/task.h>
Emeric Brun97679e72010-09-23 17:56:44 +020053#include <proto/buffers.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010054
Willy Tarreaue8c66af2008-01-13 18:40:14 +010055#ifdef CONFIG_HAP_CTTPROXY
56#include <import/ip_tproxy.h>
57#endif
58
Emeric Bruncf20bf12010-10-22 16:06:11 +020059static int tcp_bind_listeners(struct protocol *proto, char *errmsg, int errlen);
60static int tcp_bind_listener(struct listener *listener, char *errmsg, int errlen);
Willy Tarreaue6b98942007-10-29 01:09:36 +010061
62/* Note: must not be declared <const> as its list will be overwritten */
63static struct protocol proto_tcpv4 = {
64 .name = "tcpv4",
65 .sock_domain = AF_INET,
66 .sock_type = SOCK_STREAM,
67 .sock_prot = IPPROTO_TCP,
68 .sock_family = AF_INET,
69 .sock_addrlen = sizeof(struct sockaddr_in),
70 .l3_addrlen = 32/8,
Willy Tarreaueb472682010-05-28 18:46:57 +020071 .accept = &stream_sock_accept,
Willy Tarreaue6b98942007-10-29 01:09:36 +010072 .read = &stream_sock_read,
73 .write = &stream_sock_write,
Emeric Bruncf20bf12010-10-22 16:06:11 +020074 .bind = tcp_bind_listener,
Willy Tarreaue6b98942007-10-29 01:09:36 +010075 .bind_all = tcp_bind_listeners,
76 .unbind_all = unbind_all_listeners,
77 .enable_all = enable_all_listeners,
78 .listeners = LIST_HEAD_INIT(proto_tcpv4.listeners),
79 .nb_listeners = 0,
80};
81
82/* Note: must not be declared <const> as its list will be overwritten */
83static struct protocol proto_tcpv6 = {
84 .name = "tcpv6",
85 .sock_domain = AF_INET6,
86 .sock_type = SOCK_STREAM,
87 .sock_prot = IPPROTO_TCP,
88 .sock_family = AF_INET6,
89 .sock_addrlen = sizeof(struct sockaddr_in6),
90 .l3_addrlen = 128/8,
Willy Tarreaueb472682010-05-28 18:46:57 +020091 .accept = &stream_sock_accept,
Willy Tarreaue6b98942007-10-29 01:09:36 +010092 .read = &stream_sock_read,
93 .write = &stream_sock_write,
Emeric Bruncf20bf12010-10-22 16:06:11 +020094 .bind = tcp_bind_listener,
Willy Tarreaue6b98942007-10-29 01:09:36 +010095 .bind_all = tcp_bind_listeners,
96 .unbind_all = unbind_all_listeners,
97 .enable_all = enable_all_listeners,
98 .listeners = LIST_HEAD_INIT(proto_tcpv6.listeners),
99 .nb_listeners = 0,
100};
101
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100102
David du Colombier6f5ccb12011-03-10 22:26:24 +0100103/* Binds ipv4/ipv6 address <local> to socket <fd>, unless <flags> is set, in which
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100104 * case we try to bind <remote>. <flags> is a 2-bit field consisting of :
105 * - 0 : ignore remote address (may even be a NULL pointer)
106 * - 1 : use provided address
107 * - 2 : use provided port
108 * - 3 : use both
109 *
110 * The function supports multiple foreign binding methods :
111 * - linux_tproxy: we directly bind to the foreign address
112 * - cttproxy: we bind to a local address then nat.
113 * The second one can be used as a fallback for the first one.
114 * This function returns 0 when everything's OK, 1 if it could not bind, to the
115 * local address, 2 if it could not bind to the foreign address.
116 */
David du Colombier6f5ccb12011-03-10 22:26:24 +0100117int tcp_bind_socket(int fd, int flags, struct sockaddr_storage *local, struct sockaddr_storage *remote)
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100118{
David du Colombier6f5ccb12011-03-10 22:26:24 +0100119 struct sockaddr_storage bind_addr;
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100120 int foreign_ok = 0;
121 int ret;
122
123#ifdef CONFIG_HAP_LINUX_TPROXY
124 static int ip_transp_working = 1;
125 if (flags && ip_transp_working) {
126 if (setsockopt(fd, SOL_IP, IP_TRANSPARENT, (char *) &one, sizeof(one)) == 0
127 || setsockopt(fd, SOL_IP, IP_FREEBIND, (char *) &one, sizeof(one)) == 0)
128 foreign_ok = 1;
129 else
130 ip_transp_working = 0;
131 }
132#endif
133 if (flags) {
134 memset(&bind_addr, 0, sizeof(bind_addr));
David du Colombier6f5ccb12011-03-10 22:26:24 +0100135 switch (remote->ss_family) {
136 case AF_INET:
137 if (flags & 1)
138 ((struct sockaddr_in *)&bind_addr)->sin_addr = ((struct sockaddr_in *)remote)->sin_addr;
139 if (flags & 2)
140 ((struct sockaddr_in *)&bind_addr)->sin_port = ((struct sockaddr_in *)remote)->sin_port;
141 break;
142 case AF_INET6:
143 if (flags & 1)
144 ((struct sockaddr_in6 *)&bind_addr)->sin6_addr = ((struct sockaddr_in6 *)remote)->sin6_addr;
145 if (flags & 2)
146 ((struct sockaddr_in6 *)&bind_addr)->sin6_port = ((struct sockaddr_in6 *)remote)->sin6_port;
147 break;
148 }
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100149 }
150
151 setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (char *) &one, sizeof(one));
152 if (foreign_ok) {
153 ret = bind(fd, (struct sockaddr *)&bind_addr, sizeof(bind_addr));
154 if (ret < 0)
155 return 2;
156 }
157 else {
158 ret = bind(fd, (struct sockaddr *)local, sizeof(*local));
159 if (ret < 0)
160 return 1;
161 }
162
163 if (!flags)
164 return 0;
165
166#ifdef CONFIG_HAP_CTTPROXY
Willy Tarreau6f831b42011-03-20 14:03:54 +0100167 if (!foreign_ok && remote->ss_family == AF_INET) {
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100168 struct in_tproxy itp1, itp2;
169 memset(&itp1, 0, sizeof(itp1));
170
171 itp1.op = TPROXY_ASSIGN;
Willy Tarreau6f831b42011-03-20 14:03:54 +0100172 itp1.v.addr.faddr = ((struct sockaddr_in *)&bind_addr)->sin_addr;
173 itp1.v.addr.fport = ((struct sockaddr_in *)&bind_addr)->sin_port;
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100174
175 /* set connect flag on socket */
176 itp2.op = TPROXY_FLAGS;
177 itp2.v.flags = ITP_CONNECT | ITP_ONCE;
178
179 if (setsockopt(fd, SOL_IP, IP_TPROXY, &itp1, sizeof(itp1)) != -1 &&
180 setsockopt(fd, SOL_IP, IP_TPROXY, &itp2, sizeof(itp2)) != -1) {
181 foreign_ok = 1;
182 }
183 }
184#endif
185 if (!foreign_ok)
186 /* we could not bind to a foreign address */
187 return 2;
188
189 return 0;
190}
Willy Tarreaue6b98942007-10-29 01:09:36 +0100191
Willy Tarreau9650f372009-08-16 14:02:45 +0200192
193/*
Willy Tarreauac825402011-03-04 22:04:29 +0100194 * This function initiates a connection to the target assigned to this session
195 * (si->{target,addr.s.to}). A source address may be pointed to by si->addr.s.from
196 * in case of transparent proxying. Normal source bind addresses are still
197 * determined locally (due to the possible need of a source port).
198 * si->target may point either to a valid server or to a backend, depending
199 * on si->target.type. Only TARG_TYPE_PROXY and TARG_TYPE_SERVER are supported.
Willy Tarreaub1d67742010-03-29 19:36:59 +0200200 *
Willy Tarreau9650f372009-08-16 14:02:45 +0200201 * It can return one of :
202 * - SN_ERR_NONE if everything's OK
203 * - SN_ERR_SRVTO if there are no more servers
204 * - SN_ERR_SRVCL if the connection was refused by the server
205 * - SN_ERR_PRXCOND if the connection has been limited by the proxy (maxconn)
206 * - SN_ERR_RESOURCE if a system resource is lacking (eg: fd limits, ports, ...)
207 * - SN_ERR_INTERNAL for any other purely internal errors
208 * Additionnally, in the case of SN_ERR_RESOURCE, an emergency log will be emitted.
209 */
Willy Tarreauf1536862011-03-03 18:27:32 +0100210
David du Colombier6f5ccb12011-03-10 22:26:24 +0100211int tcp_connect_server(struct stream_interface *si)
Willy Tarreau9650f372009-08-16 14:02:45 +0200212{
213 int fd;
Willy Tarreauac825402011-03-04 22:04:29 +0100214 struct server *srv;
215 struct proxy *be;
216
217 switch (si->target.type) {
218 case TARG_TYPE_PROXY:
219 be = si->target.ptr.p;
220 srv = NULL;
221 break;
222 case TARG_TYPE_SERVER:
223 srv = si->target.ptr.s;
224 be = srv->proxy;
225 break;
226 default:
227 return SN_ERR_INTERNAL;
228 }
Willy Tarreau9650f372009-08-16 14:02:45 +0200229
David du Colombier6f5ccb12011-03-10 22:26:24 +0100230 if ((fd = si->fd = socket(si->addr.s.to.ss_family, SOCK_STREAM, IPPROTO_TCP)) == -1) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200231 qfprintf(stderr, "Cannot get a server socket.\n");
232
233 if (errno == ENFILE)
234 send_log(be, LOG_EMERG,
235 "Proxy %s reached system FD limit at %d. Please check system tunables.\n",
236 be->id, maxfd);
237 else if (errno == EMFILE)
238 send_log(be, LOG_EMERG,
239 "Proxy %s reached process FD limit at %d. Please check 'ulimit-n' and restart.\n",
240 be->id, maxfd);
241 else if (errno == ENOBUFS || errno == ENOMEM)
242 send_log(be, LOG_EMERG,
243 "Proxy %s reached system memory limit at %d sockets. Please check system tunables.\n",
244 be->id, maxfd);
245 /* this is a resource error */
246 return SN_ERR_RESOURCE;
247 }
248
249 if (fd >= global.maxsock) {
250 /* do not log anything there, it's a normal condition when this option
251 * is used to serialize connections to a server !
252 */
253 Alert("socket(): not enough free sockets. Raise -n argument. Giving up.\n");
254 close(fd);
255 return SN_ERR_PRXCOND; /* it is a configuration limit */
256 }
257
258 if ((fcntl(fd, F_SETFL, O_NONBLOCK)==-1) ||
259 (setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, (char *) &one, sizeof(one)) == -1)) {
260 qfprintf(stderr,"Cannot set client socket to non blocking mode.\n");
261 close(fd);
262 return SN_ERR_INTERNAL;
263 }
264
265 if (be->options & PR_O_TCP_SRV_KA)
266 setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, (char *) &one, sizeof(one));
267
268 if (be->options & PR_O_TCP_NOLING)
269 setsockopt(fd, SOL_SOCKET, SO_LINGER, (struct linger *) &nolinger, sizeof(struct linger));
270
271 /* allow specific binding :
272 * - server-specific at first
273 * - proxy-specific next
274 */
275 if (srv != NULL && srv->state & SRV_BIND_SRC) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200276 int ret, flags = 0;
277
Willy Tarreau9650f372009-08-16 14:02:45 +0200278 switch (srv->state & SRV_TPROXY_MASK) {
279 case SRV_TPROXY_ADDR:
Willy Tarreau9650f372009-08-16 14:02:45 +0200280 case SRV_TPROXY_CLI:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200281 flags = 3;
282 break;
Willy Tarreau9650f372009-08-16 14:02:45 +0200283 case SRV_TPROXY_CIP:
Willy Tarreau090466c2009-09-07 11:51:47 +0200284 case SRV_TPROXY_DYN:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200285 flags = 1;
Willy Tarreau9650f372009-08-16 14:02:45 +0200286 break;
287 }
Willy Tarreaub1d67742010-03-29 19:36:59 +0200288
Willy Tarreau9650f372009-08-16 14:02:45 +0200289#ifdef SO_BINDTODEVICE
290 /* Note: this might fail if not CAP_NET_RAW */
291 if (srv->iface_name)
292 setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, srv->iface_name, srv->iface_len + 1);
293#endif
294
295 if (srv->sport_range) {
296 int attempts = 10; /* should be more than enough to find a spare port */
David du Colombier6f5ccb12011-03-10 22:26:24 +0100297 struct sockaddr_storage src;
Willy Tarreau9650f372009-08-16 14:02:45 +0200298
299 ret = 1;
300 src = srv->source_addr;
301
302 do {
303 /* note: in case of retry, we may have to release a previously
304 * allocated port, hence this loop's construct.
305 */
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200306 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
307 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200308
309 if (!attempts)
310 break;
311 attempts--;
312
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200313 fdinfo[fd].local_port = port_range_alloc_port(srv->sport_range);
314 if (!fdinfo[fd].local_port)
Willy Tarreau9650f372009-08-16 14:02:45 +0200315 break;
316
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200317 fdinfo[fd].port_range = srv->sport_range;
David du Colombier6f5ccb12011-03-10 22:26:24 +0100318 switch (src.ss_family) {
319 case AF_INET:
320 ((struct sockaddr_in *)&src)->sin_port = htons(fdinfo[fd].local_port);
321 break;
322 case AF_INET6:
323 ((struct sockaddr_in6 *)&src)->sin6_port = htons(fdinfo[fd].local_port);
324 break;
325 }
Willy Tarreau9650f372009-08-16 14:02:45 +0200326
David du Colombier6f5ccb12011-03-10 22:26:24 +0100327 ret = tcp_bind_socket(fd, flags, &src, &si->addr.s.from);
Willy Tarreau9650f372009-08-16 14:02:45 +0200328 } while (ret != 0); /* binding NOK */
329 }
330 else {
David du Colombier6f5ccb12011-03-10 22:26:24 +0100331 ret = tcp_bind_socket(fd, flags, &srv->source_addr, &si->addr.s.from);
Willy Tarreau9650f372009-08-16 14:02:45 +0200332 }
333
334 if (ret) {
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200335 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
336 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200337 close(fd);
338
339 if (ret == 1) {
340 Alert("Cannot bind to source address before connect() for server %s/%s. Aborting.\n",
341 be->id, srv->id);
342 send_log(be, LOG_EMERG,
343 "Cannot bind to source address before connect() for server %s/%s.\n",
344 be->id, srv->id);
345 } else {
346 Alert("Cannot bind to tproxy source address before connect() for server %s/%s. Aborting.\n",
347 be->id, srv->id);
348 send_log(be, LOG_EMERG,
349 "Cannot bind to tproxy source address before connect() for server %s/%s.\n",
350 be->id, srv->id);
351 }
352 return SN_ERR_RESOURCE;
353 }
354 }
355 else if (be->options & PR_O_BIND_SRC) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200356 int ret, flags = 0;
357
Willy Tarreau9650f372009-08-16 14:02:45 +0200358 switch (be->options & PR_O_TPXY_MASK) {
359 case PR_O_TPXY_ADDR:
Willy Tarreau9650f372009-08-16 14:02:45 +0200360 case PR_O_TPXY_CLI:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200361 flags = 3;
362 break;
Willy Tarreau9650f372009-08-16 14:02:45 +0200363 case PR_O_TPXY_CIP:
Willy Tarreau090466c2009-09-07 11:51:47 +0200364 case PR_O_TPXY_DYN:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200365 flags = 1;
Willy Tarreau9650f372009-08-16 14:02:45 +0200366 break;
367 }
Willy Tarreaub1d67742010-03-29 19:36:59 +0200368
Willy Tarreau9650f372009-08-16 14:02:45 +0200369#ifdef SO_BINDTODEVICE
370 /* Note: this might fail if not CAP_NET_RAW */
371 if (be->iface_name)
372 setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, be->iface_name, be->iface_len + 1);
373#endif
David du Colombier6f5ccb12011-03-10 22:26:24 +0100374 ret = tcp_bind_socket(fd, flags, &be->source_addr, &si->addr.s.from);
Willy Tarreau9650f372009-08-16 14:02:45 +0200375 if (ret) {
376 close(fd);
377 if (ret == 1) {
378 Alert("Cannot bind to source address before connect() for proxy %s. Aborting.\n",
379 be->id);
380 send_log(be, LOG_EMERG,
381 "Cannot bind to source address before connect() for proxy %s.\n",
382 be->id);
383 } else {
384 Alert("Cannot bind to tproxy source address before connect() for proxy %s. Aborting.\n",
385 be->id);
386 send_log(be, LOG_EMERG,
387 "Cannot bind to tproxy source address before connect() for proxy %s.\n",
388 be->id);
389 }
390 return SN_ERR_RESOURCE;
391 }
392 }
393
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400394#if defined(TCP_QUICKACK)
Willy Tarreau9650f372009-08-16 14:02:45 +0200395 /* disabling tcp quick ack now allows the first request to leave the
396 * machine with the first ACK. We only do this if there are pending
397 * data in the buffer.
398 */
399 if ((be->options2 & PR_O2_SMARTCON) && si->ob->send_max)
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400400 setsockopt(fd, IPPROTO_TCP, TCP_QUICKACK, (char *) &zero, sizeof(zero));
Willy Tarreau9650f372009-08-16 14:02:45 +0200401#endif
402
Willy Tarreaue803de22010-01-21 17:43:04 +0100403 if (global.tune.server_sndbuf)
404 setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &global.tune.server_sndbuf, sizeof(global.tune.server_sndbuf));
405
406 if (global.tune.server_rcvbuf)
407 setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &global.tune.server_rcvbuf, sizeof(global.tune.server_rcvbuf));
408
David du Colombier6f5ccb12011-03-10 22:26:24 +0100409 if ((connect(fd, (struct sockaddr *)&si->addr.s.to, sizeof(struct sockaddr_storage)) == -1) &&
Willy Tarreau9650f372009-08-16 14:02:45 +0200410 (errno != EINPROGRESS) && (errno != EALREADY) && (errno != EISCONN)) {
411
412 if (errno == EAGAIN || errno == EADDRINUSE) {
413 char *msg;
414 if (errno == EAGAIN) /* no free ports left, try again later */
415 msg = "no free ports";
416 else
417 msg = "local address already in use";
418
419 qfprintf(stderr,"Cannot connect: %s.\n",msg);
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200420 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
421 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200422 close(fd);
423 send_log(be, LOG_EMERG,
424 "Connect() failed for server %s/%s: %s.\n",
425 be->id, srv->id, msg);
426 return SN_ERR_RESOURCE;
427 } else if (errno == ETIMEDOUT) {
428 //qfprintf(stderr,"Connect(): ETIMEDOUT");
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200429 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
430 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200431 close(fd);
432 return SN_ERR_SRVTO;
433 } else {
434 // (errno == ECONNREFUSED || errno == ENETUNREACH || errno == EACCES || errno == EPERM)
435 //qfprintf(stderr,"Connect(): %d", errno);
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200436 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
437 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200438 close(fd);
439 return SN_ERR_SRVCL;
440 }
441 }
442
443 fdtab[fd].owner = si;
444 fdtab[fd].state = FD_STCONN; /* connection in progress */
445 fdtab[fd].flags = FD_FL_TCP | FD_FL_TCP_NODELAY;
446 fdtab[fd].cb[DIR_RD].f = &stream_sock_read;
447 fdtab[fd].cb[DIR_RD].b = si->ib;
448 fdtab[fd].cb[DIR_WR].f = &stream_sock_write;
449 fdtab[fd].cb[DIR_WR].b = si->ob;
450
Willy Tarreauf1536862011-03-03 18:27:32 +0100451 fdinfo[fd].peeraddr = (struct sockaddr *)&si->addr.s.to;
David du Colombier6f5ccb12011-03-10 22:26:24 +0100452 fdinfo[fd].peerlen = sizeof(struct sockaddr_storage);
Willy Tarreau9650f372009-08-16 14:02:45 +0200453
454 fd_insert(fd);
455 EV_FD_SET(fd, DIR_WR); /* for connect status */
456
457 si->state = SI_ST_CON;
458 si->flags |= SI_FL_CAP_SPLTCP; /* TCP supports splicing */
459 si->exp = tick_add_ifset(now_ms, be->timeout.connect);
460
461 return SN_ERR_NONE; /* connection is OK */
462}
463
464
Willy Tarreaue6b98942007-10-29 01:09:36 +0100465/* This function tries to bind a TCPv4/v6 listener. It may return a warning or
466 * an error message in <err> if the message is at most <errlen> bytes long
467 * (including '\0'). The return value is composed from ERR_ABORT, ERR_WARN,
468 * ERR_ALERT, ERR_RETRYABLE and ERR_FATAL. ERR_NONE indicates that everything
469 * was alright and that no message was returned. ERR_RETRYABLE means that an
470 * error occurred but that it may vanish after a retry (eg: port in use), and
471 * ERR_FATAL indicates a non-fixable error.ERR_WARN and ERR_ALERT do not alter
472 * the meaning of the error, but just indicate that a message is present which
473 * should be displayed with the respective level. Last, ERR_ABORT indicates
474 * that it's pointless to try to start other listeners. No error message is
475 * returned if errlen is NULL.
476 */
477int tcp_bind_listener(struct listener *listener, char *errmsg, int errlen)
478{
479 __label__ tcp_return, tcp_close_return;
480 int fd, err;
481 const char *msg = NULL;
482
483 /* ensure we never return garbage */
484 if (errmsg && errlen)
485 *errmsg = 0;
486
487 if (listener->state != LI_ASSIGNED)
488 return ERR_NONE; /* already bound */
489
490 err = ERR_NONE;
491
492 if ((fd = socket(listener->addr.ss_family, SOCK_STREAM, IPPROTO_TCP)) == -1) {
493 err |= ERR_RETRYABLE | ERR_ALERT;
494 msg = "cannot create listening socket";
495 goto tcp_return;
496 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100497
Willy Tarreaue6b98942007-10-29 01:09:36 +0100498 if (fd >= global.maxsock) {
499 err |= ERR_FATAL | ERR_ABORT | ERR_ALERT;
500 msg = "not enough free sockets (raise '-n' parameter)";
501 goto tcp_close_return;
502 }
503
Willy Tarreaufb14edc2009-06-14 15:24:37 +0200504 if (fcntl(fd, F_SETFL, O_NONBLOCK) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100505 err |= ERR_FATAL | ERR_ALERT;
506 msg = "cannot make socket non-blocking";
507 goto tcp_close_return;
508 }
509
510 if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (char *) &one, sizeof(one)) == -1) {
511 /* not fatal but should be reported */
512 msg = "cannot do so_reuseaddr";
513 err |= ERR_ALERT;
514 }
515
516 if (listener->options & LI_O_NOLINGER)
517 setsockopt(fd, SOL_SOCKET, SO_LINGER, (struct linger *) &nolinger, sizeof(struct linger));
Willy Tarreauedcf6682008-11-30 23:15:34 +0100518
Willy Tarreaue6b98942007-10-29 01:09:36 +0100519#ifdef SO_REUSEPORT
520 /* OpenBSD supports this. As it's present in old libc versions of Linux,
521 * it might return an error that we will silently ignore.
522 */
523 setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, (char *) &one, sizeof(one));
524#endif
Willy Tarreaub1e52e82008-01-13 14:49:51 +0100525#ifdef CONFIG_HAP_LINUX_TPROXY
Willy Tarreauedcf6682008-11-30 23:15:34 +0100526 if ((listener->options & LI_O_FOREIGN)
Willy Tarreau0a459892008-01-13 17:37:16 +0100527 && (setsockopt(fd, SOL_IP, IP_TRANSPARENT, (char *) &one, sizeof(one)) == -1)
528 && (setsockopt(fd, SOL_IP, IP_FREEBIND, (char *) &one, sizeof(one)) == -1)) {
Willy Tarreaub1e52e82008-01-13 14:49:51 +0100529 msg = "cannot make listening socket transparent";
530 err |= ERR_ALERT;
531 }
532#endif
Willy Tarreau5e6e2042009-02-04 17:19:29 +0100533#ifdef SO_BINDTODEVICE
534 /* Note: this might fail if not CAP_NET_RAW */
535 if (listener->interface) {
536 if (setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE,
Willy Tarreau604e8302009-03-06 00:48:23 +0100537 listener->interface, strlen(listener->interface) + 1) == -1) {
Willy Tarreau5e6e2042009-02-04 17:19:29 +0100538 msg = "cannot bind listener to device";
539 err |= ERR_WARN;
540 }
541 }
542#endif
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400543#if defined(TCP_MAXSEG)
Willy Tarreau48a7e722010-12-24 15:26:39 +0100544 if (listener->maxseg > 0) {
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400545 if (setsockopt(fd, IPPROTO_TCP, TCP_MAXSEG,
Willy Tarreaube1b9182009-06-14 18:48:19 +0200546 &listener->maxseg, sizeof(listener->maxseg)) == -1) {
547 msg = "cannot set MSS";
548 err |= ERR_WARN;
549 }
550 }
551#endif
Willy Tarreaucb6cd432009-10-13 07:34:14 +0200552#if defined(TCP_DEFER_ACCEPT)
553 if (listener->options & LI_O_DEF_ACCEPT) {
554 /* defer accept by up to one second */
555 int accept_delay = 1;
556 if (setsockopt(fd, IPPROTO_TCP, TCP_DEFER_ACCEPT, &accept_delay, sizeof(accept_delay)) == -1) {
557 msg = "cannot enable DEFER_ACCEPT";
558 err |= ERR_WARN;
559 }
560 }
561#endif
Willy Tarreaue6b98942007-10-29 01:09:36 +0100562 if (bind(fd, (struct sockaddr *)&listener->addr, listener->proto->sock_addrlen) == -1) {
563 err |= ERR_RETRYABLE | ERR_ALERT;
564 msg = "cannot bind socket";
565 goto tcp_close_return;
566 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100567
Willy Tarreauc73ce2b2008-01-06 10:55:10 +0100568 if (listen(fd, listener->backlog ? listener->backlog : listener->maxconn) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100569 err |= ERR_RETRYABLE | ERR_ALERT;
570 msg = "cannot listen to socket";
571 goto tcp_close_return;
572 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100573
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400574#if defined(TCP_QUICKACK)
Willy Tarreau9ea05a72009-06-14 12:07:01 +0200575 if (listener->options & LI_O_NOQUICKACK)
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400576 setsockopt(fd, IPPROTO_TCP, TCP_QUICKACK, (char *) &zero, sizeof(zero));
Willy Tarreau9ea05a72009-06-14 12:07:01 +0200577#endif
578
Willy Tarreaue6b98942007-10-29 01:09:36 +0100579 /* the socket is ready */
580 listener->fd = fd;
581 listener->state = LI_LISTEN;
582
Willy Tarreaueabf3132008-08-29 23:36:51 +0200583 fdtab[fd].owner = listener; /* reference the listener instead of a task */
Willy Tarreaue6b98942007-10-29 01:09:36 +0100584 fdtab[fd].state = FD_STLISTEN;
Willy Tarreaueb472682010-05-28 18:46:57 +0200585 fdtab[fd].flags = FD_FL_TCP | ((listener->options & LI_O_NOLINGER) ? FD_FL_TCP_NOLING : 0);
586 fdtab[fd].cb[DIR_RD].f = listener->proto->accept;
587 fdtab[fd].cb[DIR_WR].f = NULL; /* never called */
588 fdtab[fd].cb[DIR_RD].b = fdtab[fd].cb[DIR_WR].b = NULL;
Willy Tarreau5d707e12009-06-28 11:09:07 +0200589
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200590 fdinfo[fd].peeraddr = NULL;
591 fdinfo[fd].peerlen = 0;
Willy Tarreaueb472682010-05-28 18:46:57 +0200592 fd_insert(fd);
593
Willy Tarreaue6b98942007-10-29 01:09:36 +0100594 tcp_return:
Cyril Bonté43ba1b32010-11-01 19:26:01 +0100595 if (msg && errlen) {
596 char pn[INET6_ADDRSTRLEN];
597
598 if (listener->addr.ss_family == AF_INET) {
599 inet_ntop(AF_INET,
600 (const void *)&((struct sockaddr_in *)&listener->addr)->sin_addr,
601 pn, sizeof(pn));
602 snprintf(errmsg, errlen, "%s [%s:%d]", msg, pn, ntohs(((struct sockaddr_in *)&listener->addr)->sin_port));
603 }
604 else {
605 inet_ntop(AF_INET6,
606 (const void *)&((struct sockaddr_in6 *)(&listener->addr))->sin6_addr,
607 pn, sizeof(pn));
608 snprintf(errmsg, errlen, "%s [%s:%d]", msg, pn, ntohs(((struct sockaddr_in6 *)&listener->addr)->sin6_port));
609 }
610 }
Willy Tarreaue6b98942007-10-29 01:09:36 +0100611 return err;
612
613 tcp_close_return:
614 close(fd);
615 goto tcp_return;
616}
617
618/* This function creates all TCP sockets bound to the protocol entry <proto>.
619 * It is intended to be used as the protocol's bind_all() function.
620 * The sockets will be registered but not added to any fd_set, in order not to
621 * loose them across the fork(). A call to enable_all_listeners() is needed
622 * to complete initialization. The return value is composed from ERR_*.
623 */
Emeric Bruncf20bf12010-10-22 16:06:11 +0200624static int tcp_bind_listeners(struct protocol *proto, char *errmsg, int errlen)
Willy Tarreaue6b98942007-10-29 01:09:36 +0100625{
626 struct listener *listener;
627 int err = ERR_NONE;
628
629 list_for_each_entry(listener, &proto->listeners, proto_list) {
Emeric Bruncf20bf12010-10-22 16:06:11 +0200630 err |= tcp_bind_listener(listener, errmsg, errlen);
631 if (err & ERR_ABORT)
Willy Tarreaue6b98942007-10-29 01:09:36 +0100632 break;
633 }
634
635 return err;
636}
637
638/* Add listener to the list of tcpv4 listeners. The listener's state
639 * is automatically updated from LI_INIT to LI_ASSIGNED. The number of
640 * listeners is updated. This is the function to use to add a new listener.
641 */
642void tcpv4_add_listener(struct listener *listener)
643{
644 if (listener->state != LI_INIT)
645 return;
646 listener->state = LI_ASSIGNED;
647 listener->proto = &proto_tcpv4;
648 LIST_ADDQ(&proto_tcpv4.listeners, &listener->proto_list);
649 proto_tcpv4.nb_listeners++;
650}
651
652/* Add listener to the list of tcpv4 listeners. The listener's state
653 * is automatically updated from LI_INIT to LI_ASSIGNED. The number of
654 * listeners is updated. This is the function to use to add a new listener.
655 */
656void tcpv6_add_listener(struct listener *listener)
657{
658 if (listener->state != LI_INIT)
659 return;
660 listener->state = LI_ASSIGNED;
661 listener->proto = &proto_tcpv6;
662 LIST_ADDQ(&proto_tcpv6.listeners, &listener->proto_list);
663 proto_tcpv6.nb_listeners++;
664}
665
Willy Tarreauedcf6682008-11-30 23:15:34 +0100666/* This function performs the TCP request analysis on the current request. It
667 * returns 1 if the processing can continue on next analysers, or zero if it
668 * needs more data, encounters an error, or wants to immediately abort the
Willy Tarreaufb356202010-08-03 14:02:05 +0200669 * request. It relies on buffers flags, and updates s->req->analysers. The
670 * function may be called for frontend rules and backend rules. It only relies
671 * on the backend pointer so this works for both cases.
Willy Tarreauedcf6682008-11-30 23:15:34 +0100672 */
Willy Tarreau3a816292009-07-07 10:55:49 +0200673int tcp_inspect_request(struct session *s, struct buffer *req, int an_bit)
Willy Tarreauedcf6682008-11-30 23:15:34 +0100674{
675 struct tcp_rule *rule;
Willy Tarreaud1f96522010-08-03 19:34:32 +0200676 struct stksess *ts;
677 struct stktable *t;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100678 int partial;
679
680 DPRINTF(stderr,"[%u] %s: session=%p b=%p, exp(r,w)=%u,%u bf=%08x bl=%d analysers=%02x\n",
681 now_ms, __FUNCTION__,
682 s,
683 req,
684 req->rex, req->wex,
685 req->flags,
686 req->l,
687 req->analysers);
688
Willy Tarreauedcf6682008-11-30 23:15:34 +0100689 /* We don't know whether we have enough data, so must proceed
690 * this way :
691 * - iterate through all rules in their declaration order
692 * - if one rule returns MISS, it means the inspect delay is
693 * not over yet, then return immediately, otherwise consider
694 * it as a non-match.
695 * - if one rule returns OK, then return OK
696 * - if one rule returns KO, then return KO
697 */
698
Willy Tarreaub824b002010-09-29 16:36:16 +0200699 if (req->flags & (BF_SHUTR|BF_FULL) || !s->be->tcp_req.inspect_delay || tick_is_expired(req->analyse_exp, now_ms))
Willy Tarreauedcf6682008-11-30 23:15:34 +0100700 partial = 0;
701 else
702 partial = ACL_PARTIAL;
703
Willy Tarreaufb356202010-08-03 14:02:05 +0200704 list_for_each_entry(rule, &s->be->tcp_req.inspect_rules, list) {
Willy Tarreauedcf6682008-11-30 23:15:34 +0100705 int ret = ACL_PAT_PASS;
706
707 if (rule->cond) {
Willy Tarreaufb356202010-08-03 14:02:05 +0200708 ret = acl_exec_cond(rule->cond, s->be, s, &s->txn, ACL_DIR_REQ | partial);
Willy Tarreauedcf6682008-11-30 23:15:34 +0100709 if (ret == ACL_PAT_MISS) {
Willy Tarreau520d95e2009-09-19 21:04:57 +0200710 buffer_dont_connect(req);
Willy Tarreauedcf6682008-11-30 23:15:34 +0100711 /* just set the request timeout once at the beginning of the request */
Willy Tarreaufb356202010-08-03 14:02:05 +0200712 if (!tick_isset(req->analyse_exp) && s->be->tcp_req.inspect_delay)
713 req->analyse_exp = tick_add_ifset(now_ms, s->be->tcp_req.inspect_delay);
Willy Tarreauedcf6682008-11-30 23:15:34 +0100714 return 0;
715 }
716
717 ret = acl_pass(ret);
718 if (rule->cond->pol == ACL_COND_UNLESS)
719 ret = !ret;
720 }
721
722 if (ret) {
723 /* we have a matching rule. */
724 if (rule->action == TCP_ACT_REJECT) {
725 buffer_abort(req);
726 buffer_abort(s->rep);
727 req->analysers = 0;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +0200728
Willy Tarreau7d0aaf32011-03-10 23:25:56 +0100729 s->be->be_counters.denied_req++;
730 s->fe->fe_counters.denied_req++;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +0200731 if (s->listener->counters)
Willy Tarreau23968d82010-05-23 23:50:44 +0200732 s->listener->counters->denied_req++;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +0200733
Willy Tarreauedcf6682008-11-30 23:15:34 +0100734 if (!(s->flags & SN_ERR_MASK))
735 s->flags |= SN_ERR_PRXCOND;
736 if (!(s->flags & SN_FINST_MASK))
737 s->flags |= SN_FINST_R;
738 return 0;
739 }
Willy Tarreau56123282010-08-06 19:06:56 +0200740 else if (rule->action == TCP_ACT_TRK_SC1) {
741 if (!s->stkctr1_entry) {
742 /* only the first valid track-sc1 directive applies.
Willy Tarreaud1f96522010-08-03 19:34:32 +0200743 * Also, note that right now we can only track SRC so we
744 * don't check how to get the key, but later we may need
745 * to consider rule->act_prm->trk_ctr.type.
746 */
747 t = rule->act_prm.trk_ctr.table.t;
David du Colombier4f92d322011-03-24 11:09:31 +0100748 ts = stktable_get_entry(t, tcp_src_to_stktable_key(s));
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200749 if (ts) {
Willy Tarreau56123282010-08-06 19:06:56 +0200750 session_track_stkctr1(s, t, ts);
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200751 if (s->fe != s->be)
752 s->flags |= SN_BE_TRACK_SC1;
753 }
Willy Tarreaud1f96522010-08-03 19:34:32 +0200754 }
755 }
Willy Tarreau56123282010-08-06 19:06:56 +0200756 else if (rule->action == TCP_ACT_TRK_SC2) {
757 if (!s->stkctr2_entry) {
758 /* only the first valid track-sc2 directive applies.
Willy Tarreaud1f96522010-08-03 19:34:32 +0200759 * Also, note that right now we can only track SRC so we
760 * don't check how to get the key, but later we may need
761 * to consider rule->act_prm->trk_ctr.type.
762 */
763 t = rule->act_prm.trk_ctr.table.t;
David du Colombier4f92d322011-03-24 11:09:31 +0100764 ts = stktable_get_entry(t, tcp_src_to_stktable_key(s));
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200765 if (ts) {
Willy Tarreau56123282010-08-06 19:06:56 +0200766 session_track_stkctr2(s, t, ts);
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200767 if (s->fe != s->be)
768 s->flags |= SN_BE_TRACK_SC2;
769 }
Willy Tarreaud1f96522010-08-03 19:34:32 +0200770 }
771 }
772 else {
Willy Tarreauedcf6682008-11-30 23:15:34 +0100773 /* otherwise accept */
Willy Tarreaud1f96522010-08-03 19:34:32 +0200774 break;
775 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100776 }
777 }
778
779 /* if we get there, it means we have no rule which matches, or
780 * we have an explicit accept, so we apply the default accept.
781 */
Willy Tarreau3a816292009-07-07 10:55:49 +0200782 req->analysers &= ~an_bit;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100783 req->analyse_exp = TICK_ETERNITY;
784 return 1;
785}
786
Emeric Brun97679e72010-09-23 17:56:44 +0200787/* This function performs the TCP response analysis on the current response. It
788 * returns 1 if the processing can continue on next analysers, or zero if it
789 * needs more data, encounters an error, or wants to immediately abort the
790 * response. It relies on buffers flags, and updates s->rep->analysers. The
791 * function may be called for backend rules.
792 */
793int tcp_inspect_response(struct session *s, struct buffer *rep, int an_bit)
794{
795 struct tcp_rule *rule;
796 int partial;
797
798 DPRINTF(stderr,"[%u] %s: session=%p b=%p, exp(r,w)=%u,%u bf=%08x bl=%d analysers=%02x\n",
799 now_ms, __FUNCTION__,
800 s,
801 rep,
802 rep->rex, rep->wex,
803 rep->flags,
804 rep->l,
805 rep->analysers);
806
807 /* We don't know whether we have enough data, so must proceed
808 * this way :
809 * - iterate through all rules in their declaration order
810 * - if one rule returns MISS, it means the inspect delay is
811 * not over yet, then return immediately, otherwise consider
812 * it as a non-match.
813 * - if one rule returns OK, then return OK
814 * - if one rule returns KO, then return KO
815 */
816
817 if (rep->flags & BF_SHUTR || tick_is_expired(rep->analyse_exp, now_ms))
818 partial = 0;
819 else
820 partial = ACL_PARTIAL;
821
822 list_for_each_entry(rule, &s->be->tcp_rep.inspect_rules, list) {
823 int ret = ACL_PAT_PASS;
824
825 if (rule->cond) {
826 ret = acl_exec_cond(rule->cond, s->be, s, &s->txn, ACL_DIR_RTR | partial);
827 if (ret == ACL_PAT_MISS) {
828 /* just set the analyser timeout once at the beginning of the response */
829 if (!tick_isset(rep->analyse_exp) && s->be->tcp_rep.inspect_delay)
830 rep->analyse_exp = tick_add_ifset(now_ms, s->be->tcp_rep.inspect_delay);
831 return 0;
832 }
833
834 ret = acl_pass(ret);
835 if (rule->cond->pol == ACL_COND_UNLESS)
836 ret = !ret;
837 }
838
839 if (ret) {
840 /* we have a matching rule. */
841 if (rule->action == TCP_ACT_REJECT) {
842 buffer_abort(rep);
843 buffer_abort(s->req);
844 rep->analysers = 0;
845
Willy Tarreau7d0aaf32011-03-10 23:25:56 +0100846 s->be->be_counters.denied_resp++;
847 s->fe->fe_counters.denied_resp++;
Emeric Brun97679e72010-09-23 17:56:44 +0200848 if (s->listener->counters)
849 s->listener->counters->denied_resp++;
850
851 if (!(s->flags & SN_ERR_MASK))
852 s->flags |= SN_ERR_PRXCOND;
853 if (!(s->flags & SN_FINST_MASK))
854 s->flags |= SN_FINST_D;
855 return 0;
856 }
857 else {
858 /* otherwise accept */
859 break;
860 }
861 }
862 }
863
864 /* if we get there, it means we have no rule which matches, or
865 * we have an explicit accept, so we apply the default accept.
866 */
867 rep->analysers &= ~an_bit;
868 rep->analyse_exp = TICK_ETERNITY;
869 return 1;
870}
871
872
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200873/* This function performs the TCP layer4 analysis on the current request. It
874 * returns 0 if a reject rule matches, otherwise 1 if either an accept rule
875 * matches or if no more rule matches. It can only use rules which don't need
876 * any data.
877 */
878int tcp_exec_req_rules(struct session *s)
879{
880 struct tcp_rule *rule;
Willy Tarreauf059a0f2010-08-03 16:29:52 +0200881 struct stksess *ts;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200882 struct stktable *t = NULL;
883 int result = 1;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200884 int ret;
885
886 list_for_each_entry(rule, &s->fe->tcp_req.l4_rules, list) {
887 ret = ACL_PAT_PASS;
888
889 if (rule->cond) {
890 ret = acl_exec_cond(rule->cond, s->fe, s, NULL, ACL_DIR_REQ);
891 ret = acl_pass(ret);
892 if (rule->cond->pol == ACL_COND_UNLESS)
893 ret = !ret;
894 }
895
896 if (ret) {
897 /* we have a matching rule. */
898 if (rule->action == TCP_ACT_REJECT) {
Willy Tarreau7d0aaf32011-03-10 23:25:56 +0100899 s->fe->fe_counters.denied_conn++;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200900 if (s->listener->counters)
Willy Tarreau2799e982010-06-05 15:43:21 +0200901 s->listener->counters->denied_conn++;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200902
903 if (!(s->flags & SN_ERR_MASK))
904 s->flags |= SN_ERR_PRXCOND;
905 if (!(s->flags & SN_FINST_MASK))
906 s->flags |= SN_FINST_R;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200907 result = 0;
908 break;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200909 }
Willy Tarreau56123282010-08-06 19:06:56 +0200910 else if (rule->action == TCP_ACT_TRK_SC1) {
911 if (!s->stkctr1_entry) {
912 /* only the first valid track-sc1 directive applies.
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200913 * Also, note that right now we can only track SRC so we
914 * don't check how to get the key, but later we may need
915 * to consider rule->act_prm->trk_ctr.type.
916 */
917 t = rule->act_prm.trk_ctr.table.t;
David du Colombier4f92d322011-03-24 11:09:31 +0100918 ts = stktable_get_entry(t, tcp_src_to_stktable_key(s));
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200919 if (ts)
Willy Tarreau56123282010-08-06 19:06:56 +0200920 session_track_stkctr1(s, t, ts);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200921 }
922 }
Willy Tarreau56123282010-08-06 19:06:56 +0200923 else if (rule->action == TCP_ACT_TRK_SC2) {
924 if (!s->stkctr2_entry) {
925 /* only the first valid track-sc2 directive applies.
Willy Tarreauf059a0f2010-08-03 16:29:52 +0200926 * Also, note that right now we can only track SRC so we
927 * don't check how to get the key, but later we may need
928 * to consider rule->act_prm->trk_ctr.type.
929 */
930 t = rule->act_prm.trk_ctr.table.t;
David du Colombier4f92d322011-03-24 11:09:31 +0100931 ts = stktable_get_entry(t, tcp_src_to_stktable_key(s));
Willy Tarreauf059a0f2010-08-03 16:29:52 +0200932 if (ts)
Willy Tarreau56123282010-08-06 19:06:56 +0200933 session_track_stkctr2(s, t, ts);
Willy Tarreauf059a0f2010-08-03 16:29:52 +0200934 }
935 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200936 else {
937 /* otherwise it's an accept */
938 break;
939 }
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200940 }
941 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200942 return result;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200943}
944
Emeric Brun97679e72010-09-23 17:56:44 +0200945/* Parse a tcp-response rule. Return a negative value in case of failure */
946static int tcp_parse_response_rule(char **args, int arg, int section_type,
947 struct proxy *curpx, struct proxy *defpx,
948 struct tcp_rule *rule, char *err, int errlen)
949{
950 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
951 snprintf(err, errlen, "%s %s is only allowed in 'backend' sections",
952 args[0], args[1]);
953 return -1;
954 }
955
956 if (strcmp(args[arg], "accept") == 0) {
957 arg++;
958 rule->action = TCP_ACT_ACCEPT;
959 }
960 else if (strcmp(args[arg], "reject") == 0) {
961 arg++;
962 rule->action = TCP_ACT_REJECT;
963 }
964 else {
965 snprintf(err, errlen,
966 "'%s %s' expects 'accept' or 'reject' in %s '%s' (was '%s')",
967 args[0], args[1], proxy_type_str(curpx), curpx->id, args[arg]);
968 return -1;
969 }
970
971 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
972 if ((rule->cond = build_acl_cond(NULL, 0, curpx, (const char **)args+arg)) == NULL) {
973 snprintf(err, errlen,
974 "error detected in %s '%s' while parsing '%s' condition",
975 proxy_type_str(curpx), curpx->id, args[arg]);
976 return -1;
977 }
978 }
979 else if (*args[arg]) {
980 snprintf(err, errlen,
981 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (was '%s')",
982 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
983 return -1;
984 }
985 return 0;
986}
987
988
989
Willy Tarreau68c03ab2010-08-06 15:08:45 +0200990/* Parse a tcp-request rule. Return a negative value in case of failure */
991static int tcp_parse_request_rule(char **args, int arg, int section_type,
992 struct proxy *curpx, struct proxy *defpx,
993 struct tcp_rule *rule, char *err, int errlen)
994{
995 if (curpx == defpx) {
996 snprintf(err, errlen, "%s %s is not allowed in 'defaults' sections",
997 args[0], args[1]);
998 return -1;
999 }
1000
1001 if (!strcmp(args[arg], "accept")) {
1002 arg++;
1003 rule->action = TCP_ACT_ACCEPT;
1004 }
1005 else if (!strcmp(args[arg], "reject")) {
1006 arg++;
1007 rule->action = TCP_ACT_REJECT;
1008 }
Willy Tarreau56123282010-08-06 19:06:56 +02001009 else if (strcmp(args[arg], "track-sc1") == 0) {
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001010 int ret;
1011
1012 arg++;
1013 ret = parse_track_counters(args, &arg, section_type, curpx,
1014 &rule->act_prm.trk_ctr, defpx, err, errlen);
1015
1016 if (ret < 0) /* nb: warnings are not handled yet */
1017 return -1;
1018
Willy Tarreau56123282010-08-06 19:06:56 +02001019 rule->action = TCP_ACT_TRK_SC1;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001020 }
Willy Tarreau56123282010-08-06 19:06:56 +02001021 else if (strcmp(args[arg], "track-sc2") == 0) {
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001022 int ret;
1023
1024 arg++;
1025 ret = parse_track_counters(args, &arg, section_type, curpx,
1026 &rule->act_prm.trk_ctr, defpx, err, errlen);
1027
1028 if (ret < 0) /* nb: warnings are not handled yet */
1029 return -1;
1030
Willy Tarreau56123282010-08-06 19:06:56 +02001031 rule->action = TCP_ACT_TRK_SC2;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001032 }
1033 else {
1034 snprintf(err, errlen,
Willy Tarreau56123282010-08-06 19:06:56 +02001035 "'%s %s' expects 'accept', 'reject', 'track-sc1' "
1036 "or 'track-sc2' in %s '%s' (was '%s')",
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001037 args[0], args[1], proxy_type_str(curpx), curpx->id, args[arg]);
1038 return -1;
1039 }
1040
1041 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
1042 if ((rule->cond = build_acl_cond(NULL, 0, curpx, (const char **)args+arg)) == NULL) {
1043 snprintf(err, errlen,
1044 "error detected in %s '%s' while parsing '%s' condition",
1045 proxy_type_str(curpx), curpx->id, args[arg]);
1046 return -1;
1047 }
1048 }
1049 else if (*args[arg]) {
1050 snprintf(err, errlen,
1051 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (was '%s')",
1052 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
1053 return -1;
1054 }
1055 return 0;
1056}
1057
Emeric Brun97679e72010-09-23 17:56:44 +02001058/* This function should be called to parse a line starting with the "tcp-response"
1059 * keyword.
1060 */
1061static int tcp_parse_tcp_rep(char **args, int section_type, struct proxy *curpx,
1062 struct proxy *defpx, char *err, int errlen)
1063{
1064 const char *ptr = NULL;
1065 unsigned int val;
1066 int retlen;
1067 int warn = 0;
1068 int arg;
1069 struct tcp_rule *rule;
1070
1071 if (!*args[1]) {
1072 snprintf(err, errlen, "missing argument for '%s' in %s '%s'",
1073 args[0], proxy_type_str(curpx), curpx->id);
1074 return -1;
1075 }
1076
1077 if (strcmp(args[1], "inspect-delay") == 0) {
1078 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
1079 snprintf(err, errlen, "%s %s is only allowed in 'backend' sections",
1080 args[0], args[1]);
1081 return -1;
1082 }
1083
1084 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
1085 retlen = snprintf(err, errlen,
1086 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
1087 args[0], args[1], proxy_type_str(curpx), curpx->id);
1088 if (ptr && retlen < errlen)
1089 retlen += snprintf(err + retlen, errlen - retlen,
1090 " (unexpected character '%c')", *ptr);
1091 return -1;
1092 }
1093
1094 if (curpx->tcp_rep.inspect_delay) {
1095 snprintf(err, errlen, "ignoring %s %s (was already defined) in %s '%s'",
1096 args[0], args[1], proxy_type_str(curpx), curpx->id);
1097 return 1;
1098 }
1099 curpx->tcp_rep.inspect_delay = val;
1100 return 0;
1101 }
1102
1103 rule = (struct tcp_rule *)calloc(1, sizeof(*rule));
1104 LIST_INIT(&rule->list);
1105 arg = 1;
1106
1107 if (strcmp(args[1], "content") == 0) {
1108 arg++;
1109 if (tcp_parse_response_rule(args, arg, section_type, curpx, defpx, rule, err, errlen) < 0)
1110 goto error;
1111
1112 if (rule->cond && (rule->cond->requires & ACL_USE_L6REQ_VOLATILE)) {
1113 struct acl *acl;
1114 const char *name;
1115
1116 acl = cond_find_require(rule->cond, ACL_USE_L6REQ_VOLATILE);
1117 name = acl ? acl->name : "(unknown)";
1118
1119 retlen = snprintf(err, errlen,
1120 "acl '%s' involves some request-only criteria which will be ignored.",
1121 name);
1122 warn++;
1123 }
1124
1125 LIST_ADDQ(&curpx->tcp_rep.inspect_rules, &rule->list);
1126 }
1127 else {
1128 retlen = snprintf(err, errlen,
1129 "'%s' expects 'inspect-delay' or 'content' in %s '%s' (was '%s')",
1130 args[0], proxy_type_str(curpx), curpx->id, args[1]);
1131 goto error;
1132 }
1133
1134 return warn;
1135 error:
1136 free(rule);
1137 return -1;
1138}
1139
1140
Willy Tarreaub6866442008-07-14 23:54:42 +02001141/* This function should be called to parse a line starting with the "tcp-request"
1142 * keyword.
1143 */
1144static int tcp_parse_tcp_req(char **args, int section_type, struct proxy *curpx,
1145 struct proxy *defpx, char *err, int errlen)
1146{
1147 const char *ptr = NULL;
Willy Tarreauc7e961e2008-08-17 17:13:47 +02001148 unsigned int val;
Willy Tarreaub6866442008-07-14 23:54:42 +02001149 int retlen;
Willy Tarreau1a687942010-05-23 22:40:30 +02001150 int warn = 0;
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001151 int arg;
Willy Tarreau1a687942010-05-23 22:40:30 +02001152 struct tcp_rule *rule;
Willy Tarreaub6866442008-07-14 23:54:42 +02001153
1154 if (!*args[1]) {
1155 snprintf(err, errlen, "missing argument for '%s' in %s '%s'",
Willy Tarreauf5356832010-06-14 18:40:26 +02001156 args[0], proxy_type_str(curpx), curpx->id);
Willy Tarreaub6866442008-07-14 23:54:42 +02001157 return -1;
1158 }
1159
1160 if (!strcmp(args[1], "inspect-delay")) {
1161 if (curpx == defpx) {
1162 snprintf(err, errlen, "%s %s is not allowed in 'defaults' sections",
1163 args[0], args[1]);
1164 return -1;
1165 }
1166
Willy Tarreaub6866442008-07-14 23:54:42 +02001167 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
1168 retlen = snprintf(err, errlen,
1169 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
Willy Tarreauf5356832010-06-14 18:40:26 +02001170 args[0], args[1], proxy_type_str(curpx), curpx->id);
Willy Tarreaub6866442008-07-14 23:54:42 +02001171 if (ptr && retlen < errlen)
1172 retlen += snprintf(err+retlen, errlen - retlen,
1173 " (unexpected character '%c')", *ptr);
1174 return -1;
1175 }
1176
1177 if (curpx->tcp_req.inspect_delay) {
1178 snprintf(err, errlen, "ignoring %s %s (was already defined) in %s '%s'",
Willy Tarreauf5356832010-06-14 18:40:26 +02001179 args[0], args[1], proxy_type_str(curpx), curpx->id);
Willy Tarreaub6866442008-07-14 23:54:42 +02001180 return 1;
1181 }
1182 curpx->tcp_req.inspect_delay = val;
1183 return 0;
1184 }
1185
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001186 rule = (struct tcp_rule *)calloc(1, sizeof(*rule));
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001187 LIST_INIT(&rule->list);
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001188 arg = 1;
1189
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001190 if (strcmp(args[1], "content") == 0) {
Willy Tarreaud1f96522010-08-03 19:34:32 +02001191 arg++;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001192 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, errlen) < 0)
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001193 goto error;
Willy Tarreaub6866442008-07-14 23:54:42 +02001194
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001195 if (rule->cond && (rule->cond->requires & ACL_USE_RTR_ANY)) {
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001196 struct acl *acl;
1197 const char *name;
1198
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001199 acl = cond_find_require(rule->cond, ACL_USE_RTR_ANY);
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001200 name = acl ? acl->name : "(unknown)";
1201
1202 retlen = snprintf(err, errlen,
Willy Tarreau1a211942009-07-14 13:53:17 +02001203 "acl '%s' involves some response-only criteria which will be ignored.",
1204 name);
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001205 warn++;
1206 }
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001207 LIST_ADDQ(&curpx->tcp_req.inspect_rules, &rule->list);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001208 }
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001209 else if (strcmp(args[1], "connection") == 0) {
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001210 arg++;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001211
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001212 if (!(curpx->cap & PR_CAP_FE)) {
1213 snprintf(err, errlen, "%s %s is not allowed because %s %s is not a frontend",
1214 args[0], args[1], proxy_type_str(curpx), curpx->id);
1215 return -1;
1216 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001217
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001218 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, errlen) < 0)
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001219 goto error;
1220
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001221 if (rule->cond && (rule->cond->requires & (ACL_USE_RTR_ANY|ACL_USE_L6_ANY|ACL_USE_L7_ANY))) {
1222 struct acl *acl;
1223 const char *name;
Willy Tarreauf059a0f2010-08-03 16:29:52 +02001224
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001225 acl = cond_find_require(rule->cond, ACL_USE_RTR_ANY|ACL_USE_L6_ANY|ACL_USE_L7_ANY);
1226 name = acl ? acl->name : "(unknown)";
Willy Tarreauf059a0f2010-08-03 16:29:52 +02001227
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001228 if (acl->requires & (ACL_USE_L6_ANY|ACL_USE_L7_ANY)) {
1229 retlen = snprintf(err, errlen,
1230 "'%s %s' may not reference acl '%s' which makes use of "
1231 "payload in %s '%s'. Please use '%s content' for this.",
1232 args[0], args[1], name, proxy_type_str(curpx), curpx->id, args[0]);
1233 goto error;
1234 }
1235 if (acl->requires & ACL_USE_RTR_ANY)
1236 retlen = snprintf(err, errlen,
1237 "acl '%s' involves some response-only criteria which will be ignored.",
1238 name);
1239 warn++;
1240 }
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001241 LIST_ADDQ(&curpx->tcp_req.l4_rules, &rule->list);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001242 }
Willy Tarreau1a687942010-05-23 22:40:30 +02001243 else {
1244 retlen = snprintf(err, errlen,
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001245 "'%s' expects 'inspect-delay', 'connection', or 'content' in %s '%s' (was '%s')",
Willy Tarreau1a687942010-05-23 22:40:30 +02001246 args[0], proxy_type_str(curpx), curpx->id, args[1]);
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001247 goto error;
Willy Tarreau1a687942010-05-23 22:40:30 +02001248 }
1249
Willy Tarreau1a687942010-05-23 22:40:30 +02001250 return warn;
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001251 error:
1252 free(rule);
1253 return -1;
Willy Tarreaub6866442008-07-14 23:54:42 +02001254}
1255
Willy Tarreau645513a2010-05-24 20:55:15 +02001256
1257/************************************************************************/
1258/* All supported ACL keywords must be declared here. */
1259/************************************************************************/
1260
1261/* set test->ptr to point to the source IPv4/IPv6 address and test->i to the family */
1262static int
1263acl_fetch_src(struct proxy *px, struct session *l4, void *l7, int dir,
1264 struct acl_expr *expr, struct acl_test *test)
1265{
Willy Tarreau957c0a52011-03-03 17:42:23 +01001266 test->i = l4->si[0].addr.c.from.ss_family;
Willy Tarreau645513a2010-05-24 20:55:15 +02001267 if (test->i == AF_INET)
Willy Tarreau957c0a52011-03-03 17:42:23 +01001268 test->ptr = (void *)&((struct sockaddr_in *)&l4->si[0].addr.c.from)->sin_addr;
Emeric Brunf769f512010-10-22 17:14:01 +02001269 else if (test->i == AF_INET6)
Willy Tarreau957c0a52011-03-03 17:42:23 +01001270 test->ptr = (void *)&((struct sockaddr_in6 *)(&l4->si[0].addr.c.from))->sin6_addr;
Emeric Brunf769f512010-10-22 17:14:01 +02001271 else
1272 return 0;
1273
Willy Tarreau645513a2010-05-24 20:55:15 +02001274 test->flags = ACL_TEST_F_READ_ONLY;
1275 return 1;
1276}
1277
David du Colombier4f92d322011-03-24 11:09:31 +01001278/* extract the connection's source ipv4 address */
Willy Tarreau645513a2010-05-24 20:55:15 +02001279static int
1280pattern_fetch_src(struct proxy *px, struct session *l4, void *l7, int dir,
Emeric Brun485479d2010-09-23 18:02:19 +02001281 const struct pattern_arg *arg_p, int arg_i, union pattern_data *data)
Willy Tarreau645513a2010-05-24 20:55:15 +02001282{
Willy Tarreau957c0a52011-03-03 17:42:23 +01001283 if (l4->si[0].addr.c.from.ss_family != AF_INET )
Emeric Brunf769f512010-10-22 17:14:01 +02001284 return 0;
1285
Willy Tarreau957c0a52011-03-03 17:42:23 +01001286 data->ip.s_addr = ((struct sockaddr_in *)&l4->si[0].addr.c.from)->sin_addr.s_addr;
Willy Tarreau645513a2010-05-24 20:55:15 +02001287 return 1;
1288}
1289
David du Colombier4f92d322011-03-24 11:09:31 +01001290/* extract the connection's source ipv6 address */
1291static int
1292pattern_fetch_src6(struct proxy *px, struct session *l4, void *l7, int dir,
1293 const struct pattern_arg *arg_p, int arg_i, union pattern_data *data)
1294{
1295 if (l4->si[0].addr.c.from.ss_family != AF_INET6)
1296 return 0;
1297
1298 memcpy(data->ipv6.s6_addr, ((struct sockaddr_in6 *)&l4->si[0].addr.c.from)->sin6_addr.s6_addr, sizeof(data->ipv6.s6_addr));
1299 return 1;
1300}
Willy Tarreau645513a2010-05-24 20:55:15 +02001301
1302/* set test->i to the connection's source port */
1303static int
1304acl_fetch_sport(struct proxy *px, struct session *l4, void *l7, int dir,
1305 struct acl_expr *expr, struct acl_test *test)
1306{
Willy Tarreau957c0a52011-03-03 17:42:23 +01001307 if (l4->si[0].addr.c.from.ss_family == AF_INET)
1308 test->i = ntohs(((struct sockaddr_in *)&l4->si[0].addr.c.from)->sin_port);
1309 else if (l4->si[0].addr.c.from.ss_family == AF_INET6)
1310 test->i = ntohs(((struct sockaddr_in6 *)(&l4->si[0].addr.c.from))->sin6_port);
Emeric Brunf769f512010-10-22 17:14:01 +02001311 else
1312 return 0;
1313
Willy Tarreau645513a2010-05-24 20:55:15 +02001314 test->flags = 0;
1315 return 1;
1316}
1317
1318
1319/* set test->ptr to point to the frontend's IPv4/IPv6 address and test->i to the family */
1320static int
1321acl_fetch_dst(struct proxy *px, struct session *l4, void *l7, int dir,
1322 struct acl_expr *expr, struct acl_test *test)
1323{
1324 if (!(l4->flags & SN_FRT_ADDR_SET))
1325 get_frt_addr(l4);
1326
Willy Tarreau957c0a52011-03-03 17:42:23 +01001327 test->i = l4->si[0].addr.c.to.ss_family;
Willy Tarreau645513a2010-05-24 20:55:15 +02001328 if (test->i == AF_INET)
Willy Tarreau957c0a52011-03-03 17:42:23 +01001329 test->ptr = (void *)&((struct sockaddr_in *)&l4->si[0].addr.c.to)->sin_addr;
Emeric Brunf769f512010-10-22 17:14:01 +02001330 else if (test->i == AF_INET6)
Willy Tarreau957c0a52011-03-03 17:42:23 +01001331 test->ptr = (void *)&((struct sockaddr_in6 *)(&l4->si[0].addr.c.to))->sin6_addr;
Emeric Brunf769f512010-10-22 17:14:01 +02001332 else
1333 return 0;
1334
Willy Tarreau645513a2010-05-24 20:55:15 +02001335 test->flags = ACL_TEST_F_READ_ONLY;
1336 return 1;
1337}
1338
1339
David du Colombier4f92d322011-03-24 11:09:31 +01001340/* extract the connection's destination ipv4 address */
Willy Tarreau645513a2010-05-24 20:55:15 +02001341static int
1342pattern_fetch_dst(struct proxy *px, struct session *l4, void *l7, int dir,
Emeric Brun485479d2010-09-23 18:02:19 +02001343 const struct pattern_arg *arg_p, int arg_i, union pattern_data *data)
Willy Tarreau645513a2010-05-24 20:55:15 +02001344{
emeric8aa6b372010-10-22 17:06:26 +02001345 if (!(l4->flags & SN_FRT_ADDR_SET))
1346 get_frt_addr(l4);
1347
Willy Tarreau957c0a52011-03-03 17:42:23 +01001348 if (l4->si[0].addr.c.to.ss_family != AF_INET)
Emeric Brunf769f512010-10-22 17:14:01 +02001349 return 0;
1350
Willy Tarreau957c0a52011-03-03 17:42:23 +01001351 data->ip.s_addr = ((struct sockaddr_in *)&l4->si[0].addr.c.to)->sin_addr.s_addr;
Willy Tarreau645513a2010-05-24 20:55:15 +02001352 return 1;
1353}
1354
David du Colombier4f92d322011-03-24 11:09:31 +01001355/* extract the connection's destination ipv6 address */
1356static int
1357pattern_fetch_dst6(struct proxy *px, struct session *l4, void *l7, int dir,
1358 const struct pattern_arg *arg_p, int arg_i, union pattern_data *data)
1359{
1360 if (!(l4->flags & SN_FRT_ADDR_SET))
1361 get_frt_addr(l4);
1362
1363 if (l4->si[0].addr.c.to.ss_family != AF_INET6)
1364 return 0;
1365
1366 memcpy(data->ipv6.s6_addr, ((struct sockaddr_in6 *)&l4->si[0].addr.c.to)->sin6_addr.s6_addr, sizeof(data->ipv6.s6_addr));
1367 return 1;
1368}
1369
Willy Tarreau645513a2010-05-24 20:55:15 +02001370/* set test->i to the frontend connexion's destination port */
1371static int
1372acl_fetch_dport(struct proxy *px, struct session *l4, void *l7, int dir,
1373 struct acl_expr *expr, struct acl_test *test)
1374{
1375 if (!(l4->flags & SN_FRT_ADDR_SET))
1376 get_frt_addr(l4);
1377
Willy Tarreau957c0a52011-03-03 17:42:23 +01001378 if (l4->si[0].addr.c.to.ss_family == AF_INET)
1379 test->i = ntohs(((struct sockaddr_in *)&l4->si[0].addr.c.to)->sin_port);
1380 else if (l4->si[0].addr.c.to.ss_family == AF_INET6)
1381 test->i = ntohs(((struct sockaddr_in6 *)(&l4->si[0].addr.c.to))->sin6_port);
Emeric Brunf769f512010-10-22 17:14:01 +02001382 else
1383 return 0;
1384
Willy Tarreau645513a2010-05-24 20:55:15 +02001385 test->flags = 0;
1386 return 1;
1387}
1388
1389static int
1390pattern_fetch_dport(struct proxy *px, struct session *l4, void *l7, int dir,
Emeric Brun485479d2010-09-23 18:02:19 +02001391 const struct pattern_arg *arg, int i, union pattern_data *data)
Willy Tarreau645513a2010-05-24 20:55:15 +02001392{
emeric8aa6b372010-10-22 17:06:26 +02001393 if (!(l4->flags & SN_FRT_ADDR_SET))
1394 get_frt_addr(l4);
1395
David du Colombier4f92d322011-03-24 11:09:31 +01001396 if (l4->si[0].addr.c.to.ss_family == AF_INET)
1397 data->integer = ntohs(((struct sockaddr_in *)&l4->si[0].addr.c.to)->sin_port);
1398 else if (l4->si[0].addr.c.to.ss_family == AF_INET6)
1399 data->integer = ntohs(((struct sockaddr_in6 *)&l4->si[0].addr.c.to)->sin6_port);
1400 else
Emeric Brunf769f512010-10-22 17:14:01 +02001401 return 0;
1402
Willy Tarreau645513a2010-05-24 20:55:15 +02001403 return 1;
1404}
1405
Emericf2d7cae2010-11-05 18:13:50 +01001406static int
1407pattern_arg_fetch_payloadlv(const char *arg, struct pattern_arg **arg_p, int *arg_i)
1408{
1409 int member = 0;
1410 int len_offset = 0;
1411 int len_size = 0;
1412 int buf_offset = 0;
1413 int relative = 0;
1414 int arg_len = strlen(arg);
1415 int i;
1416
1417 for (i = 0; i < arg_len; i++) {
1418 if (arg[i] == ',') {
1419 member++;
1420 } else if (member == 0) {
1421 if (arg[i] < '0' || arg[i] > '9')
1422 return 0;
1423
1424 len_offset = 10 * len_offset + arg[i] - '0';
1425 } else if (member == 1) {
1426 if (arg[i] < '0' || arg[i] > '9')
1427 return 0;
1428
1429 len_size = 10 * len_size + arg[i] - '0';
1430 } else if (member == 2) {
1431 if (!relative && !buf_offset && arg[i] == '+') {
1432 relative = 1;
1433 continue;
1434 } else if (!relative && !buf_offset && arg[i] == '-') {
1435 relative = 2;
1436 continue;
1437 } else if (arg[i] < '0' || arg[i] > '9')
1438 return 0;
1439
1440 buf_offset = 10 * buf_offset + arg[i] - '0';
1441 }
1442 }
1443
1444 if (member < 1)
1445 return 0;
1446
1447 if (!len_size)
1448 return 0;
1449
1450 if (member == 1) {
1451 buf_offset = len_offset + len_size;
1452 }
1453 else if (relative == 1) {
1454 buf_offset = len_offset + len_size + buf_offset;
1455 }
1456 else if (relative == 2) {
1457 if (len_offset + len_size < buf_offset)
1458 return 0;
1459
1460 buf_offset = len_offset + len_size - buf_offset;
1461 }
1462
1463 *arg_i = 3;
1464 *arg_p = calloc(1, *arg_i*sizeof(struct pattern_arg));
1465 (*arg_p)[0].type = PATTERN_ARG_TYPE_INTEGER;
1466 (*arg_p)[0].data.integer = len_offset;
1467 (*arg_p)[1].type = PATTERN_ARG_TYPE_INTEGER;
1468 (*arg_p)[1].data.integer = len_size;
1469 (*arg_p)[2].type = PATTERN_ARG_TYPE_INTEGER;
1470 (*arg_p)[2].data.integer = buf_offset;
1471
1472 return 1;
1473}
1474
1475static int
1476pattern_fetch_payloadlv(struct proxy *px, struct session *l4, void *l7, int dir,
1477 const struct pattern_arg *arg_p, int arg_i, union pattern_data *data)
1478{
1479 int len_offset = arg_p[0].data.integer;
1480 int len_size = arg_p[1].data.integer;
1481 int buf_offset = arg_p[2].data.integer;
1482 int buf_size = 0;
1483 struct buffer *b;
1484 int i;
1485
1486 /* Format is (len offset, len size, buf offset) or (len offset, len size) */
1487 /* by default buf offset == len offset + len size */
1488 /* buf offset could be absolute or relative to len offset + len size if prefixed by + or - */
1489
1490 if (!l4)
1491 return 0;
1492
1493 b = (dir & PATTERN_FETCH_RTR) ? l4->rep : l4->req;
1494
1495 if (!b || !b->l)
1496 return 0;
1497
1498 if (len_offset + len_size > b->l)
1499 return 0;
1500
1501 for (i = 0; i < len_size; i++) {
1502 buf_size = (buf_size << 8) + ((unsigned char *)b->w)[i + len_offset];
1503 }
1504
1505 if (!buf_size)
1506 return 0;
1507
1508 if (buf_offset + buf_size > b->l)
1509 return 0;
1510
1511 /* init chunk as read only */
1512 chunk_initlen(&data->str, (char *)(b->w + buf_offset), 0, buf_size);
1513
1514 return 1;
1515}
1516
1517static int
1518pattern_arg_fetch_payload (const char *arg, struct pattern_arg **arg_p, int *arg_i)
1519{
1520 int member = 0;
1521 int buf_offset = 0;
1522 int buf_size = 0;
1523 int arg_len = strlen(arg);
1524 int i;
1525
1526 for (i = 0 ; i < arg_len ; i++) {
1527 if (arg[i] == ',') {
1528 member++;
1529 } else if (member == 0) {
1530 if (arg[i] < '0' || arg[i] > '9')
1531 return 0;
1532
1533 buf_offset = 10 * buf_offset + arg[i] - '0';
1534 } else if (member == 1) {
1535 if (arg[i] < '0' || arg[i] > '9')
1536 return 0;
1537
1538 buf_size = 10 * buf_size + arg[i] - '0';
1539 }
1540 }
1541
1542 if (!buf_size)
1543 return 0;
1544
1545 *arg_i = 2;
1546 *arg_p = calloc(1, *arg_i*sizeof(struct pattern_arg));
1547 (*arg_p)[0].type = PATTERN_ARG_TYPE_INTEGER;
1548 (*arg_p)[0].data.integer = buf_offset;
1549 (*arg_p)[1].type = PATTERN_ARG_TYPE_INTEGER;
1550 (*arg_p)[1].data.integer = buf_size;
1551
1552 return 1;
1553}
1554
1555static int
1556pattern_fetch_payload(struct proxy *px, struct session *l4, void *l7, int dir,
1557 const struct pattern_arg *arg_p, int arg_i, union pattern_data *data)
1558{
1559 int buf_offset = arg_p[0].data.integer;
1560 int buf_size = arg_p[1].data.integer;
1561 struct buffer *b;
1562
1563 if (!l4)
1564 return 0;
1565
1566 b = (dir & PATTERN_FETCH_RTR) ? l4->rep : l4->req;
1567
1568 if (!b || !b->l)
1569 return 0;
1570
1571 if (buf_offset + buf_size > b->l)
1572 return 0;
1573
1574 /* init chunk as read only */
1575 chunk_initlen(&data->str, (char *)(b->w + buf_offset), 0, buf_size);
1576
1577 return 1;
1578}
1579
Willy Tarreaub6866442008-07-14 23:54:42 +02001580static struct cfg_kw_list cfg_kws = {{ },{
1581 { CFG_LISTEN, "tcp-request", tcp_parse_tcp_req },
Emeric Brun97679e72010-09-23 17:56:44 +02001582 { CFG_LISTEN, "tcp-response", tcp_parse_tcp_rep },
Willy Tarreaub6866442008-07-14 23:54:42 +02001583 { 0, NULL, NULL },
1584}};
1585
Willy Tarreau645513a2010-05-24 20:55:15 +02001586/* Note: must not be declared <const> as its list will be overwritten */
Willy Tarreaub6866442008-07-14 23:54:42 +02001587static struct acl_kw_list acl_kws = {{ },{
Willy Tarreau645513a2010-05-24 20:55:15 +02001588 { "src_port", acl_parse_int, acl_fetch_sport, acl_match_int, ACL_USE_TCP_PERMANENT },
1589 { "src", acl_parse_ip, acl_fetch_src, acl_match_ip, ACL_USE_TCP4_PERMANENT|ACL_MAY_LOOKUP },
1590 { "dst", acl_parse_ip, acl_fetch_dst, acl_match_ip, ACL_USE_TCP4_PERMANENT|ACL_MAY_LOOKUP },
1591 { "dst_port", acl_parse_int, acl_fetch_dport, acl_match_int, ACL_USE_TCP_PERMANENT },
Willy Tarreaub6866442008-07-14 23:54:42 +02001592 { NULL, NULL, NULL, NULL },
1593}};
1594
Willy Tarreau645513a2010-05-24 20:55:15 +02001595/* Note: must not be declared <const> as its list will be overwritten */
1596static struct pattern_fetch_kw_list pattern_fetch_keywords = {{ },{
Emericf2d7cae2010-11-05 18:13:50 +01001597 { "src", pattern_fetch_src, NULL, PATTERN_TYPE_IP, PATTERN_FETCH_REQ },
David du Colombier4f92d322011-03-24 11:09:31 +01001598 { "src6", pattern_fetch_src6, NULL, PATTERN_TYPE_IPV6, PATTERN_FETCH_REQ },
Emericf2d7cae2010-11-05 18:13:50 +01001599 { "dst", pattern_fetch_dst, NULL, PATTERN_TYPE_IP, PATTERN_FETCH_REQ },
David du Colombier4f92d322011-03-24 11:09:31 +01001600 { "dst6", pattern_fetch_dst6, NULL, PATTERN_TYPE_IPV6, PATTERN_FETCH_REQ },
Emericf2d7cae2010-11-05 18:13:50 +01001601 { "dst_port", pattern_fetch_dport, NULL, PATTERN_TYPE_INTEGER, PATTERN_FETCH_REQ },
1602 { "payload", pattern_fetch_payload, pattern_arg_fetch_payload, PATTERN_TYPE_CONSTDATA, PATTERN_FETCH_REQ|PATTERN_FETCH_RTR },
1603 { "payload_lv", pattern_fetch_payloadlv, pattern_arg_fetch_payloadlv, PATTERN_TYPE_CONSTDATA, PATTERN_FETCH_REQ|PATTERN_FETCH_RTR },
Emeric Brun485479d2010-09-23 18:02:19 +02001604 { NULL, NULL, NULL, 0, 0 },
Willy Tarreau645513a2010-05-24 20:55:15 +02001605}};
1606
Willy Tarreaue6b98942007-10-29 01:09:36 +01001607__attribute__((constructor))
1608static void __tcp_protocol_init(void)
1609{
1610 protocol_register(&proto_tcpv4);
1611 protocol_register(&proto_tcpv6);
Willy Tarreau645513a2010-05-24 20:55:15 +02001612 pattern_register_fetches(&pattern_fetch_keywords);
Willy Tarreaub6866442008-07-14 23:54:42 +02001613 cfg_register_keywords(&cfg_kws);
1614 acl_register_keywords(&acl_kws);
Willy Tarreaue6b98942007-10-29 01:09:36 +01001615}
1616
1617
1618/*
1619 * Local variables:
1620 * c-indent-level: 8
1621 * c-basic-offset: 8
1622 * End:
1623 */