blob: 0c90c3b43743367a4582dba5e32c05c960771dc4 [file] [log] [blame]
Willy Tarreau59f98392012-07-06 14:13:49 +02001/*
2 * Connection management functions
3 *
4 * Copyright 2000-2012 Willy Tarreau <w@1wt.eu>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
Willy Tarreaue1e4a612012-10-05 00:10:55 +020013#include <errno.h>
14
Willy Tarreau59f98392012-07-06 14:13:49 +020015#include <common/compat.h>
16#include <common/config.h>
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +010017#include <common/namespace.h>
Willy Tarreau59f98392012-07-06 14:13:49 +020018
Willy Tarreauc5788912012-08-24 18:12:41 +020019#include <proto/connection.h>
Willy Tarreaudd2f85e2012-09-02 22:34:23 +020020#include <proto/fd.h>
Willy Tarreau5f1504f2012-10-04 23:55:57 +020021#include <proto/frontend.h>
Willy Tarreau2da156f2012-07-23 15:07:23 +020022#include <proto/proto_tcp.h>
Willy Tarreau2c6be842012-07-06 17:12:34 +020023#include <proto/stream_interface.h>
Emeric Brun4f603012017-01-05 15:11:44 +010024#include <proto/sample.h>
Willy Tarreau59f98392012-07-06 14:13:49 +020025
Emeric Brun46591952012-05-18 15:47:34 +020026#ifdef USE_OPENSSL
27#include <proto/ssl_sock.h>
28#endif
29
Willy Tarreauf2943dc2012-10-26 20:10:28 +020030struct pool_head *pool2_connection;
Willy Tarreau13e14102016-12-22 20:25:26 +010031struct xprt_ops *registered_xprt[XPRT_ENTRIES] = { NULL, };
Willy Tarreauf2943dc2012-10-26 20:10:28 +020032
33/* perform minimal intializations, report 0 in case of error, 1 if OK. */
34int init_connection()
35{
36 pool2_connection = create_pool("connection", sizeof (struct connection), MEM_F_SHARED);
37 return pool2_connection != NULL;
38}
39
Willy Tarreau59f98392012-07-06 14:13:49 +020040/* I/O callback for fd-based connections. It calls the read/write handlers
Willy Tarreau7a798e52016-04-14 11:13:20 +020041 * provided by the connection's sock_ops, which must be valid.
Willy Tarreau59f98392012-07-06 14:13:49 +020042 */
Willy Tarreau7a798e52016-04-14 11:13:20 +020043void conn_fd_handler(int fd)
Willy Tarreau59f98392012-07-06 14:13:49 +020044{
Willy Tarreau80184712012-07-06 14:54:49 +020045 struct connection *conn = fdtab[fd].owner;
Willy Tarreau9e272bf2012-10-03 21:04:48 +020046 unsigned int flags;
Willy Tarreau59f98392012-07-06 14:13:49 +020047
Willy Tarreauc76ae332012-07-12 15:32:13 +020048 if (unlikely(!conn))
Willy Tarreau7a798e52016-04-14 11:13:20 +020049 return;
Willy Tarreau59f98392012-07-06 14:13:49 +020050
Willy Tarreau7d281492012-12-16 19:19:13 +010051 conn_refresh_polling_flags(conn);
52 flags = conn->flags & ~CO_FL_ERROR; /* ensure to call the wake handler upon error */
Willy Tarreaud29a0662012-12-10 16:33:38 +010053
Willy Tarreauc76ae332012-07-12 15:32:13 +020054 process_handshake:
Willy Tarreauf9dabec2012-08-17 17:33:53 +020055 /* The handshake callbacks are called in sequence. If either of them is
56 * missing something, it must enable the required polling at the socket
57 * layer of the connection. Polling state is not guaranteed when entering
58 * these handlers, so any handshake handler which does not complete its
Willy Tarreaud6e999b2013-11-25 08:41:15 +010059 * work must explicitly disable events it's not interested in. Error
60 * handling is also performed here in order to reduce the number of tests
61 * around.
Willy Tarreauf9dabec2012-08-17 17:33:53 +020062 */
Willy Tarreaud6e999b2013-11-25 08:41:15 +010063 while (unlikely(conn->flags & (CO_FL_HANDSHAKE | CO_FL_ERROR))) {
Willy Tarreau310987a2014-01-22 19:46:33 +010064 if (unlikely(conn->flags & CO_FL_ERROR))
Willy Tarreau2c6be842012-07-06 17:12:34 +020065 goto leave;
Willy Tarreau59f98392012-07-06 14:13:49 +020066
Bertrand Jacquin93b227d2016-06-04 15:11:10 +010067 if (conn->flags & CO_FL_ACCEPT_CIP)
68 if (!conn_recv_netscaler_cip(conn, CO_FL_ACCEPT_CIP))
69 goto leave;
70
Willy Tarreau22cda212012-08-31 17:43:29 +020071 if (conn->flags & CO_FL_ACCEPT_PROXY)
72 if (!conn_recv_proxy(conn, CO_FL_ACCEPT_PROXY))
73 goto leave;
74
Willy Tarreau57cd3e42013-10-24 22:01:26 +020075 if (conn->flags & CO_FL_SEND_PROXY)
76 if (!conn_si_send_proxy(conn, CO_FL_SEND_PROXY))
Willy Tarreau5f1504f2012-10-04 23:55:57 +020077 goto leave;
Emeric Brun46591952012-05-18 15:47:34 +020078#ifdef USE_OPENSSL
79 if (conn->flags & CO_FL_SSL_WAIT_HS)
80 if (!ssl_sock_handshake(conn, CO_FL_SSL_WAIT_HS))
81 goto leave;
82#endif
Willy Tarreauc76ae332012-07-12 15:32:13 +020083 }
84
Willy Tarreauf9dabec2012-08-17 17:33:53 +020085 /* Once we're purely in the data phase, we disable handshake polling */
86 if (!(conn->flags & CO_FL_POLL_SOCK))
87 __conn_sock_stop_both(conn);
Willy Tarreauc76ae332012-07-12 15:32:13 +020088
Willy Tarreau071e1372012-10-03 01:39:48 +020089 /* The data layer might not be ready yet (eg: when using embryonic
90 * sessions). If we're about to move data, we must initialize it first.
91 * The function may fail and cause the connection to be destroyed, thus
Willy Tarreau2542b532012-08-31 16:01:23 +020092 * we must not use it anymore and should immediately leave instead.
93 */
Willy Tarreau071e1372012-10-03 01:39:48 +020094 if ((conn->flags & CO_FL_INIT_DATA) && conn->data->init(conn) < 0)
Willy Tarreau7a798e52016-04-14 11:13:20 +020095 return;
Willy Tarreau2542b532012-08-31 16:01:23 +020096
Willy Tarreau57ec32f2017-04-11 19:59:33 +020097 if (conn->xprt && fd_send_ready(fd) &&
98 ((conn->flags & (CO_FL_DATA_WR_ENA|CO_FL_ERROR|CO_FL_HANDSHAKE)) == CO_FL_DATA_WR_ENA)) {
Willy Tarreau3c0cc492017-03-19 07:54:28 +010099 /* force reporting of activity by clearing the previous flags :
100 * we'll have at least ERROR or CONNECTED at the end of an I/O,
101 * both of which will be detected below.
Willy Tarreau9e272bf2012-10-03 21:04:48 +0200102 */
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100103 flags = 0;
Willy Tarreau57ec32f2017-04-11 19:59:33 +0200104 conn->data->send(conn);
Willy Tarreau9e272bf2012-10-03 21:04:48 +0200105 }
Willy Tarreau59f98392012-07-06 14:13:49 +0200106
Willy Tarreau57ec32f2017-04-11 19:59:33 +0200107 /* The data transfer starts here and stops on error and handshakes. Note
108 * that we must absolutely test conn->xprt at each step in case it suddenly
109 * changes due to a quick unexpected close().
110 */
111 if (conn->xprt && fd_recv_ready(fd) &&
112 ((conn->flags & (CO_FL_DATA_RD_ENA|CO_FL_WAIT_ROOM|CO_FL_ERROR|CO_FL_HANDSHAKE)) == CO_FL_DATA_RD_ENA)) {
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100113 /* force reporting of activity by clearing the previous flags :
114 * we'll have at least ERROR or CONNECTED at the end of an I/O,
115 * both of which will be detected below.
Willy Tarreau9e272bf2012-10-03 21:04:48 +0200116 */
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100117 flags = 0;
Willy Tarreau57ec32f2017-04-11 19:59:33 +0200118 conn->data->recv(conn);
Willy Tarreau9e272bf2012-10-03 21:04:48 +0200119 }
Willy Tarreau2da156f2012-07-23 15:07:23 +0200120
Willy Tarreauc76ae332012-07-12 15:32:13 +0200121 /* It may happen during the data phase that a handshake is
122 * enabled again (eg: SSL)
123 */
Willy Tarreaud6e999b2013-11-25 08:41:15 +0100124 if (unlikely(conn->flags & (CO_FL_HANDSHAKE | CO_FL_ERROR)))
Willy Tarreauc76ae332012-07-12 15:32:13 +0200125 goto process_handshake;
126
Willy Tarreaufd803bb2014-01-20 15:13:07 +0100127 if (unlikely(conn->flags & CO_FL_WAIT_L4_CONN)) {
Willy Tarreauf8deb0c2012-09-01 17:59:22 +0200128 /* still waiting for a connection to establish and nothing was
129 * attempted yet to probe the connection. Then let's retry the
130 * connect().
Willy Tarreau2da156f2012-07-23 15:07:23 +0200131 */
Willy Tarreau239d7182012-07-23 18:53:03 +0200132 if (!tcp_connect_probe(conn))
Willy Tarreauafad0e02012-08-09 14:45:22 +0200133 goto leave;
Willy Tarreau2da156f2012-07-23 15:07:23 +0200134 }
Willy Tarreau2c6be842012-07-06 17:12:34 +0200135 leave:
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100136 /* Verify if the connection just established. */
Willy Tarreau7bf3fa32017-03-14 20:19:29 +0100137 if (unlikely(!(conn->flags & (CO_FL_WAIT_L4_CONN | CO_FL_WAIT_L6_CONN | CO_FL_CONNECTED))))
138 conn->flags |= CO_FL_CONNECTED;
139
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100140 /* The wake callback is normally used to notify the data layer about
141 * data layer activity (successful send/recv), connection establishment,
142 * shutdown and fatal errors. We need to consider the following
143 * situations to wake up the data layer :
144 * - change among the CO_FL_NOTIFY_DATA flags :
145 * {DATA,SOCK}_{RD,WR}_SH, ERROR,
146 * - absence of any of {L4,L6}_CONN and CONNECTED, indicating the
147 * end of handshake and transition to CONNECTED
148 * - raise of CONNECTED with HANDSHAKE down
149 * - end of HANDSHAKE with CONNECTED set
150 * - regular data layer activity
151 *
152 * Note that the wake callback is allowed to release the connection and
153 * the fd (and return < 0 in this case).
Willy Tarreau2396c1c2012-10-03 21:12:16 +0200154 */
Willy Tarreau9fa1ee62017-03-18 15:39:57 +0100155 if ((((conn->flags ^ flags) & CO_FL_NOTIFY_DATA) ||
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100156 ((flags & (CO_FL_CONNECTED|CO_FL_HANDSHAKE)) != CO_FL_CONNECTED &&
157 (conn->flags & (CO_FL_CONNECTED|CO_FL_HANDSHAKE)) == CO_FL_CONNECTED)) &&
Willy Tarreau2396c1c2012-10-03 21:12:16 +0200158 conn->data->wake(conn) < 0)
Willy Tarreau7a798e52016-04-14 11:13:20 +0200159 return;
Willy Tarreaufd31e532012-07-23 18:24:25 +0200160
Willy Tarreau61ace1b2012-07-23 12:14:26 +0200161 /* remove the events before leaving */
Willy Tarreau26d7cfc2012-12-07 00:09:43 +0100162 fdtab[fd].ev &= FD_POLL_STICKY;
Willy Tarreauf9dabec2012-08-17 17:33:53 +0200163
164 /* commit polling changes */
165 conn_cond_update_polling(conn);
Willy Tarreau7a798e52016-04-14 11:13:20 +0200166 return;
Willy Tarreau59f98392012-07-06 14:13:49 +0200167}
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200168
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200169/* Update polling on connection <c>'s file descriptor depending on its current
170 * state as reported in the connection's CO_FL_CURR_* flags, reports of EAGAIN
171 * in CO_FL_WAIT_*, and the data layer expectations indicated by CO_FL_DATA_*.
172 * The connection flags are updated with the new flags at the end of the
Willy Tarreau0ffde2c2012-10-04 22:21:15 +0200173 * operation. Polling is totally disabled if an error was reported.
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200174 */
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200175void conn_update_data_polling(struct connection *c)
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200176{
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200177 unsigned int f = c->flags;
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200178
Willy Tarreau3c728722014-01-23 13:50:42 +0100179 if (!conn_ctrl_ready(c))
Willy Tarreauf79c8172013-10-21 16:30:56 +0200180 return;
181
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200182 /* update read status if needed */
Willy Tarreau310987a2014-01-22 19:46:33 +0100183 if (unlikely((f & (CO_FL_CURR_RD_ENA|CO_FL_DATA_RD_ENA)) == CO_FL_DATA_RD_ENA)) {
Willy Tarreauf817e9f2014-01-10 16:58:45 +0100184 fd_want_recv(c->t.sock.fd);
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100185 f |= CO_FL_CURR_RD_ENA;
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200186 }
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100187 else if (unlikely((f & (CO_FL_CURR_RD_ENA|CO_FL_DATA_RD_ENA)) == CO_FL_CURR_RD_ENA)) {
188 fd_stop_recv(c->t.sock.fd);
189 f &= ~CO_FL_CURR_RD_ENA;
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200190 }
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200191
192 /* update write status if needed */
Willy Tarreau310987a2014-01-22 19:46:33 +0100193 if (unlikely((f & (CO_FL_CURR_WR_ENA|CO_FL_DATA_WR_ENA)) == CO_FL_DATA_WR_ENA)) {
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200194 fd_want_send(c->t.sock.fd);
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100195 f |= CO_FL_CURR_WR_ENA;
196 }
197 else if (unlikely((f & (CO_FL_CURR_WR_ENA|CO_FL_DATA_WR_ENA)) == CO_FL_CURR_WR_ENA)) {
198 fd_stop_send(c->t.sock.fd);
199 f &= ~CO_FL_CURR_WR_ENA;
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200200 }
Willy Tarreau310987a2014-01-22 19:46:33 +0100201 c->flags = f;
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200202}
203
204/* Update polling on connection <c>'s file descriptor depending on its current
205 * state as reported in the connection's CO_FL_CURR_* flags, reports of EAGAIN
206 * in CO_FL_WAIT_*, and the sock layer expectations indicated by CO_FL_SOCK_*.
207 * The connection flags are updated with the new flags at the end of the
Willy Tarreau0ffde2c2012-10-04 22:21:15 +0200208 * operation. Polling is totally disabled if an error was reported.
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200209 */
210void conn_update_sock_polling(struct connection *c)
211{
212 unsigned int f = c->flags;
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200213
Willy Tarreau3c728722014-01-23 13:50:42 +0100214 if (!conn_ctrl_ready(c))
Willy Tarreauf79c8172013-10-21 16:30:56 +0200215 return;
216
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200217 /* update read status if needed */
Willy Tarreau310987a2014-01-22 19:46:33 +0100218 if (unlikely((f & (CO_FL_CURR_RD_ENA|CO_FL_SOCK_RD_ENA)) == CO_FL_SOCK_RD_ENA)) {
Willy Tarreauf817e9f2014-01-10 16:58:45 +0100219 fd_want_recv(c->t.sock.fd);
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100220 f |= CO_FL_CURR_RD_ENA;
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200221 }
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100222 else if (unlikely((f & (CO_FL_CURR_RD_ENA|CO_FL_SOCK_RD_ENA)) == CO_FL_CURR_RD_ENA)) {
223 fd_stop_recv(c->t.sock.fd);
224 f &= ~CO_FL_CURR_RD_ENA;
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200225 }
226
227 /* update write status if needed */
Willy Tarreau310987a2014-01-22 19:46:33 +0100228 if (unlikely((f & (CO_FL_CURR_WR_ENA|CO_FL_SOCK_WR_ENA)) == CO_FL_SOCK_WR_ENA)) {
Willy Tarreauf817e9f2014-01-10 16:58:45 +0100229 fd_want_send(c->t.sock.fd);
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100230 f |= CO_FL_CURR_WR_ENA;
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200231 }
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100232 else if (unlikely((f & (CO_FL_CURR_WR_ENA|CO_FL_SOCK_WR_ENA)) == CO_FL_CURR_WR_ENA)) {
233 fd_stop_send(c->t.sock.fd);
234 f &= ~CO_FL_CURR_WR_ENA;
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200235 }
Willy Tarreau310987a2014-01-22 19:46:33 +0100236 c->flags = f;
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200237}
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200238
Willy Tarreauff3e6482015-03-12 23:56:52 +0100239/* Send a message over an established connection. It makes use of send() and
240 * returns the same return code and errno. If the socket layer is not ready yet
241 * then -1 is returned and ENOTSOCK is set into errno. If the fd is not marked
242 * as ready, or if EAGAIN or ENOTCONN is returned, then we return 0. It returns
243 * EMSGSIZE if called with a zero length message. The purpose is to simplify
244 * some rare attempts to directly write on the socket from above the connection
245 * (typically send_proxy). In case of EAGAIN, the fd is marked as "cant_send".
246 * It automatically retries on EINTR. Other errors cause the connection to be
247 * marked as in error state. It takes similar arguments as send() except the
248 * first one which is the connection instead of the file descriptor. Note,
249 * MSG_DONTWAIT and MSG_NOSIGNAL are forced on the flags.
250 */
251int conn_sock_send(struct connection *conn, const void *buf, int len, int flags)
252{
253 int ret;
254
255 ret = -1;
256 errno = ENOTSOCK;
257
258 if (conn->flags & CO_FL_SOCK_WR_SH)
259 goto fail;
260
261 if (!conn_ctrl_ready(conn))
262 goto fail;
263
264 errno = EMSGSIZE;
265 if (!len)
266 goto fail;
267
268 if (!fd_send_ready(conn->t.sock.fd))
269 goto wait;
270
271 do {
272 ret = send(conn->t.sock.fd, buf, len, flags | MSG_DONTWAIT | MSG_NOSIGNAL);
273 } while (ret < 0 && errno == EINTR);
274
275
276 if (ret > 0)
277 return ret;
278
279 if (ret == 0 || errno == EAGAIN || errno == ENOTCONN) {
280 wait:
281 fd_cant_send(conn->t.sock.fd);
282 return 0;
283 }
284 fail:
285 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH | CO_FL_ERROR;
286 return ret;
287}
288
Willy Tarreaud85c4852015-03-13 00:40:28 +0100289/* Drains possibly pending incoming data on the file descriptor attached to the
290 * connection and update the connection's flags accordingly. This is used to
291 * know whether we need to disable lingering on close. Returns non-zero if it
292 * is safe to close without disabling lingering, otherwise zero. The SOCK_RD_SH
293 * flag may also be updated if the incoming shutdown was reported by the drain()
294 * function.
295 */
296int conn_sock_drain(struct connection *conn)
297{
298 if (!conn_ctrl_ready(conn))
299 return 1;
300
301 if (conn->flags & (CO_FL_ERROR | CO_FL_SOCK_RD_SH))
302 return 1;
303
304 if (fdtab[conn->t.sock.fd].ev & (FD_POLL_ERR|FD_POLL_HUP)) {
305 fdtab[conn->t.sock.fd].linger_risk = 0;
306 }
307 else {
308 if (!fd_recv_ready(conn->t.sock.fd))
309 return 0;
310
311 /* disable draining if we were called and have no drain function */
312 if (!conn->ctrl->drain) {
313 __conn_data_stop_recv(conn);
314 return 0;
315 }
316
317 if (conn->ctrl->drain(conn->t.sock.fd) <= 0)
318 return 0;
319 }
320
321 conn->flags |= CO_FL_SOCK_RD_SH;
322 return 1;
323}
324
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100325/*
326 * Get data length from tlv
327 */
328static int get_tlv_length(const struct tlv *src)
329{
330 return (src->length_hi << 8) | src->length_lo;
331}
332
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200333/* This handshake handler waits a PROXY protocol header at the beginning of the
334 * raw data stream. The header looks like this :
335 *
336 * "PROXY" <SP> PROTO <SP> SRC3 <SP> DST3 <SP> SRC4 <SP> <DST4> "\r\n"
337 *
338 * There must be exactly one space between each field. Fields are :
339 * - PROTO : layer 4 protocol, which must be "TCP4" or "TCP6".
340 * - SRC3 : layer 3 (eg: IP) source address in standard text form
341 * - DST3 : layer 3 (eg: IP) destination address in standard text form
342 * - SRC4 : layer 4 (eg: TCP port) source address in standard text form
343 * - DST4 : layer 4 (eg: TCP port) destination address in standard text form
344 *
345 * This line MUST be at the beginning of the buffer and MUST NOT wrap.
346 *
347 * The header line is small and in all cases smaller than the smallest normal
348 * TCP MSS. So it MUST always be delivered as one segment, which ensures we
349 * can safely use MSG_PEEK and avoid buffering.
350 *
351 * Once the data is fetched, the values are set in the connection's address
352 * fields, and data are removed from the socket's buffer. The function returns
353 * zero if it needs to wait for more data or if it fails, or 1 if it completed
354 * and removed itself.
355 */
356int conn_recv_proxy(struct connection *conn, int flag)
357{
358 char *line, *end;
Willy Tarreau77992672014-06-14 11:06:17 +0200359 struct proxy_hdr_v2 *hdr_v2;
360 const char v2sig[] = PP2_SIGNATURE;
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100361 int tlv_length = 0;
KOVACS Krisztian7209c202015-07-03 14:09:10 +0200362 int tlv_offset = 0;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200363
364 /* we might have been called just after an asynchronous shutr */
365 if (conn->flags & CO_FL_SOCK_RD_SH)
366 goto fail;
367
Willy Tarreau3c728722014-01-23 13:50:42 +0100368 if (!conn_ctrl_ready(conn))
Willy Tarreauf79c8172013-10-21 16:30:56 +0200369 goto fail;
370
Willy Tarreaufd803bb2014-01-20 15:13:07 +0100371 if (!fd_recv_ready(conn->t.sock.fd))
372 return 0;
373
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200374 do {
Willy Tarreau19d14ef2012-10-29 16:51:55 +0100375 trash.len = recv(conn->t.sock.fd, trash.str, trash.size, MSG_PEEK);
376 if (trash.len < 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200377 if (errno == EINTR)
378 continue;
379 if (errno == EAGAIN) {
Willy Tarreaue1f50c42014-01-22 20:02:06 +0100380 fd_cant_recv(conn->t.sock.fd);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200381 return 0;
382 }
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100383 goto recv_abort;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200384 }
385 } while (0);
386
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100387 if (!trash.len) {
388 /* client shutdown */
389 conn->err_code = CO_ER_PRX_EMPTY;
390 goto fail;
391 }
392
Willy Tarreau19d14ef2012-10-29 16:51:55 +0100393 if (trash.len < 6)
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200394 goto missing;
395
Willy Tarreau19d14ef2012-10-29 16:51:55 +0100396 line = trash.str;
397 end = trash.str + trash.len;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200398
399 /* Decode a possible proxy request, fail early if it does not match */
Willy Tarreau77992672014-06-14 11:06:17 +0200400 if (strncmp(line, "PROXY ", 6) != 0)
401 goto not_v1;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200402
403 line += 6;
Willy Tarreau4c20d292014-06-14 11:41:36 +0200404 if (trash.len < 9) /* shortest possible line */
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200405 goto missing;
406
David CARLIER42ff05e2016-03-24 09:22:36 +0000407 if (memcmp(line, "TCP4 ", 5) == 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200408 u32 src3, dst3, sport, dport;
409
410 line += 5;
411
412 src3 = inetaddr_host_lim_ret(line, end, &line);
413 if (line == end)
414 goto missing;
415 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100416 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200417
418 dst3 = inetaddr_host_lim_ret(line, end, &line);
419 if (line == end)
420 goto missing;
421 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100422 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200423
424 sport = read_uint((const char **)&line, end);
425 if (line == end)
426 goto missing;
427 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100428 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200429
430 dport = read_uint((const char **)&line, end);
431 if (line > end - 2)
432 goto missing;
433 if (*line++ != '\r')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100434 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200435 if (*line++ != '\n')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100436 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200437
438 /* update the session's addresses and mark them set */
439 ((struct sockaddr_in *)&conn->addr.from)->sin_family = AF_INET;
440 ((struct sockaddr_in *)&conn->addr.from)->sin_addr.s_addr = htonl(src3);
441 ((struct sockaddr_in *)&conn->addr.from)->sin_port = htons(sport);
442
443 ((struct sockaddr_in *)&conn->addr.to)->sin_family = AF_INET;
444 ((struct sockaddr_in *)&conn->addr.to)->sin_addr.s_addr = htonl(dst3);
445 ((struct sockaddr_in *)&conn->addr.to)->sin_port = htons(dport);
446 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
447 }
David CARLIER42ff05e2016-03-24 09:22:36 +0000448 else if (memcmp(line, "TCP6 ", 5) == 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200449 u32 sport, dport;
450 char *src_s;
451 char *dst_s, *sport_s, *dport_s;
452 struct in6_addr src3, dst3;
453
454 line += 5;
455
456 src_s = line;
457 dst_s = sport_s = dport_s = NULL;
458 while (1) {
459 if (line > end - 2) {
460 goto missing;
461 }
462 else if (*line == '\r') {
463 *line = 0;
464 line++;
465 if (*line++ != '\n')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100466 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200467 break;
468 }
469
470 if (*line == ' ') {
471 *line = 0;
472 if (!dst_s)
473 dst_s = line + 1;
474 else if (!sport_s)
475 sport_s = line + 1;
476 else if (!dport_s)
477 dport_s = line + 1;
478 }
479 line++;
480 }
481
482 if (!dst_s || !sport_s || !dport_s)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100483 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200484
485 sport = read_uint((const char **)&sport_s,dport_s - 1);
486 if (*sport_s != 0)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100487 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200488
489 dport = read_uint((const char **)&dport_s,line - 2);
490 if (*dport_s != 0)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100491 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200492
493 if (inet_pton(AF_INET6, src_s, (void *)&src3) != 1)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100494 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200495
496 if (inet_pton(AF_INET6, dst_s, (void *)&dst3) != 1)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100497 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200498
499 /* update the session's addresses and mark them set */
500 ((struct sockaddr_in6 *)&conn->addr.from)->sin6_family = AF_INET6;
501 memcpy(&((struct sockaddr_in6 *)&conn->addr.from)->sin6_addr, &src3, sizeof(struct in6_addr));
502 ((struct sockaddr_in6 *)&conn->addr.from)->sin6_port = htons(sport);
503
504 ((struct sockaddr_in6 *)&conn->addr.to)->sin6_family = AF_INET6;
505 memcpy(&((struct sockaddr_in6 *)&conn->addr.to)->sin6_addr, &dst3, sizeof(struct in6_addr));
506 ((struct sockaddr_in6 *)&conn->addr.to)->sin6_port = htons(dport);
507 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
508 }
Willy Tarreau4c20d292014-06-14 11:41:36 +0200509 else if (memcmp(line, "UNKNOWN\r\n", 9) == 0) {
510 /* This can be a UNIX socket forwarded by an haproxy upstream */
511 line += 9;
512 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200513 else {
Willy Tarreau4c20d292014-06-14 11:41:36 +0200514 /* The protocol does not match something known (TCP4/TCP6/UNKNOWN) */
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100515 conn->err_code = CO_ER_PRX_BAD_PROTO;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200516 goto fail;
517 }
518
Willy Tarreau77992672014-06-14 11:06:17 +0200519 trash.len = line - trash.str;
520 goto eat_header;
521
522 not_v1:
523 /* try PPv2 */
524 if (trash.len < PP2_HEADER_LEN)
525 goto missing;
526
527 hdr_v2 = (struct proxy_hdr_v2 *)trash.str;
528
529 if (memcmp(hdr_v2->sig, v2sig, PP2_SIGNATURE_LEN) != 0 ||
530 (hdr_v2->ver_cmd & PP2_VERSION_MASK) != PP2_VERSION) {
531 conn->err_code = CO_ER_PRX_NOT_HDR;
532 goto fail;
533 }
534
535 if (trash.len < PP2_HEADER_LEN + ntohs(hdr_v2->len))
536 goto missing;
537
538 switch (hdr_v2->ver_cmd & PP2_CMD_MASK) {
539 case 0x01: /* PROXY command */
540 switch (hdr_v2->fam) {
541 case 0x11: /* TCPv4 */
KOVACS Krisztianefd3aa92014-11-19 10:53:20 +0100542 if (ntohs(hdr_v2->len) < PP2_ADDR_LEN_INET)
543 goto bad_header;
544
Willy Tarreau77992672014-06-14 11:06:17 +0200545 ((struct sockaddr_in *)&conn->addr.from)->sin_family = AF_INET;
546 ((struct sockaddr_in *)&conn->addr.from)->sin_addr.s_addr = hdr_v2->addr.ip4.src_addr;
547 ((struct sockaddr_in *)&conn->addr.from)->sin_port = hdr_v2->addr.ip4.src_port;
548 ((struct sockaddr_in *)&conn->addr.to)->sin_family = AF_INET;
549 ((struct sockaddr_in *)&conn->addr.to)->sin_addr.s_addr = hdr_v2->addr.ip4.dst_addr;
550 ((struct sockaddr_in *)&conn->addr.to)->sin_port = hdr_v2->addr.ip4.dst_port;
551 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
KOVACS Krisztian7209c202015-07-03 14:09:10 +0200552 tlv_offset = PP2_HEADER_LEN + PP2_ADDR_LEN_INET;
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100553 tlv_length = ntohs(hdr_v2->len) - PP2_ADDR_LEN_INET;
Willy Tarreau77992672014-06-14 11:06:17 +0200554 break;
555 case 0x21: /* TCPv6 */
KOVACS Krisztianefd3aa92014-11-19 10:53:20 +0100556 if (ntohs(hdr_v2->len) < PP2_ADDR_LEN_INET6)
557 goto bad_header;
558
Willy Tarreau77992672014-06-14 11:06:17 +0200559 ((struct sockaddr_in6 *)&conn->addr.from)->sin6_family = AF_INET6;
560 memcpy(&((struct sockaddr_in6 *)&conn->addr.from)->sin6_addr, hdr_v2->addr.ip6.src_addr, 16);
561 ((struct sockaddr_in6 *)&conn->addr.from)->sin6_port = hdr_v2->addr.ip6.src_port;
562 ((struct sockaddr_in6 *)&conn->addr.to)->sin6_family = AF_INET6;
563 memcpy(&((struct sockaddr_in6 *)&conn->addr.to)->sin6_addr, hdr_v2->addr.ip6.dst_addr, 16);
564 ((struct sockaddr_in6 *)&conn->addr.to)->sin6_port = hdr_v2->addr.ip6.dst_port;
565 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
KOVACS Krisztian7209c202015-07-03 14:09:10 +0200566 tlv_offset = PP2_HEADER_LEN + PP2_ADDR_LEN_INET6;
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100567 tlv_length = ntohs(hdr_v2->len) - PP2_ADDR_LEN_INET6;
Willy Tarreau77992672014-06-14 11:06:17 +0200568 break;
569 }
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100570
571 /* TLV parsing */
572 if (tlv_length > 0) {
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100573 while (tlv_offset + TLV_HEADER_SIZE <= trash.len) {
574 const struct tlv *tlv_packet = (struct tlv *) &trash.str[tlv_offset];
575 const int tlv_len = get_tlv_length(tlv_packet);
576 tlv_offset += tlv_len + TLV_HEADER_SIZE;
577
578 switch (tlv_packet->type) {
579#ifdef CONFIG_HAP_NS
580 case PP2_TYPE_NETNS: {
581 const struct netns_entry *ns;
582 ns = netns_store_lookup((char*)tlv_packet->value, tlv_len);
583 if (ns)
584 conn->proxy_netns = ns;
585 break;
586 }
587#endif
588 default:
589 break;
590 }
591 }
592 }
593
Willy Tarreau77992672014-06-14 11:06:17 +0200594 /* unsupported protocol, keep local connection address */
595 break;
596 case 0x00: /* LOCAL command */
597 /* keep local connection address for LOCAL */
598 break;
599 default:
600 goto bad_header; /* not a supported command */
601 }
602
603 trash.len = PP2_HEADER_LEN + ntohs(hdr_v2->len);
604 goto eat_header;
605
606 eat_header:
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200607 /* remove the PROXY line from the request. For this we re-read the
608 * exact line at once. If we don't get the exact same result, we
609 * fail.
610 */
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200611 do {
Willy Tarreau19d14ef2012-10-29 16:51:55 +0100612 int len2 = recv(conn->t.sock.fd, trash.str, trash.len, 0);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200613 if (len2 < 0 && errno == EINTR)
614 continue;
Willy Tarreau19d14ef2012-10-29 16:51:55 +0100615 if (len2 != trash.len)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100616 goto recv_abort;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200617 } while (0);
618
619 conn->flags &= ~flag;
Emeric Brun4f603012017-01-05 15:11:44 +0100620 conn->flags |= CO_FL_RCVD_PROXY;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200621 return 1;
622
623 missing:
624 /* Missing data. Since we're using MSG_PEEK, we can only poll again if
625 * we have not read anything. Otherwise we need to fail because we won't
626 * be able to poll anymore.
627 */
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100628 conn->err_code = CO_ER_PRX_TRUNCATED;
629 goto fail;
630
631 bad_header:
632 /* This is not a valid proxy protocol header */
633 conn->err_code = CO_ER_PRX_BAD_HDR;
634 goto fail;
635
636 recv_abort:
637 conn->err_code = CO_ER_PRX_ABORT;
Willy Tarreau26f4a042013-12-04 23:44:10 +0100638 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH;
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100639 goto fail;
640
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200641 fail:
Willy Tarreaud486ef52012-12-10 17:03:52 +0100642 __conn_sock_stop_both(conn);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200643 conn->flags |= CO_FL_ERROR;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200644 return 0;
645}
646
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100647/* This handshake handler waits a NetScaler Client IP insertion header
648 * at the beginning of the raw data stream. The header looks like this:
649 *
650 * 4 bytes: CIP magic number
651 * 4 bytes: Header length
652 * 20+ bytes: Header of the last IP packet sent by the client during
653 * TCP handshake.
654 * 20+ bytes: Header of the last TCP packet sent by the client during
655 * TCP handshake.
656 *
657 * This line MUST be at the beginning of the buffer and MUST NOT be
658 * fragmented.
659 *
660 * The header line is small and in all cases smaller than the smallest normal
661 * TCP MSS. So it MUST always be delivered as one segment, which ensures we
662 * can safely use MSG_PEEK and avoid buffering.
663 *
664 * Once the data is fetched, the values are set in the connection's address
665 * fields, and data are removed from the socket's buffer. The function returns
666 * zero if it needs to wait for more data or if it fails, or 1 if it completed
667 * and removed itself.
668 */
669int conn_recv_netscaler_cip(struct connection *conn, int flag)
670{
671 char *line;
672 uint32_t cip_magic;
673 uint32_t cip_len;
674 uint8_t ip_v;
675
676 /* we might have been called just after an asynchronous shutr */
677 if (conn->flags & CO_FL_SOCK_RD_SH)
678 goto fail;
679
680 if (!conn_ctrl_ready(conn))
681 goto fail;
682
683 if (!fd_recv_ready(conn->t.sock.fd))
684 return 0;
685
686 do {
687 trash.len = recv(conn->t.sock.fd, trash.str, trash.size, MSG_PEEK);
688 if (trash.len < 0) {
689 if (errno == EINTR)
690 continue;
691 if (errno == EAGAIN) {
692 fd_cant_recv(conn->t.sock.fd);
693 return 0;
694 }
695 goto recv_abort;
696 }
697 } while (0);
698
699 if (!trash.len) {
700 /* client shutdown */
701 conn->err_code = CO_ER_CIP_EMPTY;
702 goto fail;
703 }
704
705 /* Fail if buffer length is not large enough to contain
706 * CIP magic, CIP length */
707 if (trash.len < 8)
708 goto missing;
709
710 line = trash.str;
711
712 cip_magic = ntohl(*(uint32_t *)line);
713 cip_len = ntohl(*(uint32_t *)(line+4));
714
715 /* Decode a possible NetScaler Client IP request, fail early if
716 * it does not match */
717 if (cip_magic != objt_listener(conn->target)->bind_conf->ns_cip_magic)
718 goto bad_magic;
719
720 /* Fail if buffer length is not large enough to contain
721 * CIP magic, CIP length, minimal IP header */
722 if (trash.len < 28)
723 goto missing;
724
725 line += 8;
726
727 /* Get IP version from the first four bits */
728 ip_v = (*line & 0xf0) >> 4;
729
730 if (ip_v == 4) {
731 struct ip *hdr_ip4;
David Carlier3015a2e2016-07-04 22:51:33 +0100732 struct my_tcphdr *hdr_tcp;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100733
734 hdr_ip4 = (struct ip *)line;
735
736 if (trash.len < (8 + ntohs(hdr_ip4->ip_len))) {
737 /* Fail if buffer length is not large enough to contain
738 * CIP magic, CIP length, IPv4 header */
739 goto missing;
740 } else if (hdr_ip4->ip_p != IPPROTO_TCP) {
741 /* The protocol does not include a TCP header */
742 conn->err_code = CO_ER_CIP_BAD_PROTO;
743 goto fail;
744 } else if (trash.len < (28 + ntohs(hdr_ip4->ip_len))) {
745 /* Fail if buffer length is not large enough to contain
746 * CIP magic, CIP length, IPv4 header, TCP header */
747 goto missing;
748 }
749
David Carlier3015a2e2016-07-04 22:51:33 +0100750 hdr_tcp = (struct my_tcphdr *)(line + (hdr_ip4->ip_hl * 4));
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100751
752 /* update the session's addresses and mark them set */
753 ((struct sockaddr_in *)&conn->addr.from)->sin_family = AF_INET;
754 ((struct sockaddr_in *)&conn->addr.from)->sin_addr.s_addr = hdr_ip4->ip_src.s_addr;
755 ((struct sockaddr_in *)&conn->addr.from)->sin_port = hdr_tcp->source;
756
757 ((struct sockaddr_in *)&conn->addr.to)->sin_family = AF_INET;
758 ((struct sockaddr_in *)&conn->addr.to)->sin_addr.s_addr = hdr_ip4->ip_dst.s_addr;
759 ((struct sockaddr_in *)&conn->addr.to)->sin_port = hdr_tcp->dest;
760
761 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
762 }
763 else if (ip_v == 6) {
764 struct ip6_hdr *hdr_ip6;
David Carlier3015a2e2016-07-04 22:51:33 +0100765 struct my_tcphdr *hdr_tcp;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100766
767 hdr_ip6 = (struct ip6_hdr *)line;
768
769 if (trash.len < 28) {
770 /* Fail if buffer length is not large enough to contain
771 * CIP magic, CIP length, IPv6 header */
772 goto missing;
773 } else if (hdr_ip6->ip6_nxt != IPPROTO_TCP) {
774 /* The protocol does not include a TCP header */
775 conn->err_code = CO_ER_CIP_BAD_PROTO;
776 goto fail;
777 } else if (trash.len < 48) {
778 /* Fail if buffer length is not large enough to contain
779 * CIP magic, CIP length, IPv6 header, TCP header */
780 goto missing;
781 }
782
David Carlier3015a2e2016-07-04 22:51:33 +0100783 hdr_tcp = (struct my_tcphdr *)(line + sizeof(struct ip6_hdr));
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100784
785 /* update the session's addresses and mark them set */
786 ((struct sockaddr_in6 *)&conn->addr.from)->sin6_family = AF_INET6;
787 ((struct sockaddr_in6 *)&conn->addr.from)->sin6_addr = hdr_ip6->ip6_src;
788 ((struct sockaddr_in6 *)&conn->addr.from)->sin6_port = hdr_tcp->source;
789
790 ((struct sockaddr_in6 *)&conn->addr.to)->sin6_family = AF_INET6;
791 ((struct sockaddr_in6 *)&conn->addr.to)->sin6_addr = hdr_ip6->ip6_dst;
792 ((struct sockaddr_in6 *)&conn->addr.to)->sin6_port = hdr_tcp->dest;
793
794 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
795 }
796 else {
797 /* The protocol does not match something known (IPv4/IPv6) */
798 conn->err_code = CO_ER_CIP_BAD_PROTO;
799 goto fail;
800 }
801
802 line += cip_len;
803 trash.len = line - trash.str;
804
805 /* remove the NetScaler Client IP header from the request. For this
806 * we re-read the exact line at once. If we don't get the exact same
807 * result, we fail.
808 */
809 do {
810 int len2 = recv(conn->t.sock.fd, trash.str, trash.len, 0);
811 if (len2 < 0 && errno == EINTR)
812 continue;
813 if (len2 != trash.len)
814 goto recv_abort;
815 } while (0);
816
817 conn->flags &= ~flag;
818 return 1;
819
820 missing:
821 /* Missing data. Since we're using MSG_PEEK, we can only poll again if
822 * we have not read anything. Otherwise we need to fail because we won't
823 * be able to poll anymore.
824 */
825 conn->err_code = CO_ER_CIP_TRUNCATED;
826 goto fail;
827
828 bad_magic:
829 conn->err_code = CO_ER_CIP_BAD_MAGIC;
830 goto fail;
831
832 recv_abort:
833 conn->err_code = CO_ER_CIP_ABORT;
834 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH;
835 goto fail;
836
837 fail:
838 __conn_sock_stop_both(conn);
839 conn->flags |= CO_FL_ERROR;
840 return 0;
841}
842
David Safb76832014-05-08 23:42:08 -0400843int make_proxy_line(char *buf, int buf_len, struct server *srv, struct connection *remote)
844{
845 int ret = 0;
846
847 if (srv && (srv->pp_opts & SRV_PP_V2)) {
848 ret = make_proxy_line_v2(buf, buf_len, srv, remote);
849 }
850 else {
851 if (remote)
852 ret = make_proxy_line_v1(buf, buf_len, &remote->addr.from, &remote->addr.to);
853 else
854 ret = make_proxy_line_v1(buf, buf_len, NULL, NULL);
855 }
856
857 return ret;
858}
859
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200860/* Makes a PROXY protocol line from the two addresses. The output is sent to
861 * buffer <buf> for a maximum size of <buf_len> (including the trailing zero).
862 * It returns the number of bytes composing this line (including the trailing
863 * LF), or zero in case of failure (eg: not enough space). It supports TCP4,
Willy Tarreau2e1401a2013-10-01 11:41:55 +0200864 * TCP6 and "UNKNOWN" formats. If any of <src> or <dst> is null, UNKNOWN is
865 * emitted as well.
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200866 */
David Safb76832014-05-08 23:42:08 -0400867int make_proxy_line_v1(char *buf, int buf_len, struct sockaddr_storage *src, struct sockaddr_storage *dst)
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200868{
869 int ret = 0;
870
Willy Tarreau2e1401a2013-10-01 11:41:55 +0200871 if (src && dst && src->ss_family == dst->ss_family && src->ss_family == AF_INET) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200872 ret = snprintf(buf + ret, buf_len - ret, "PROXY TCP4 ");
873 if (ret >= buf_len)
874 return 0;
875
876 /* IPv4 src */
877 if (!inet_ntop(src->ss_family, &((struct sockaddr_in *)src)->sin_addr, buf + ret, buf_len - ret))
878 return 0;
879
880 ret += strlen(buf + ret);
881 if (ret >= buf_len)
882 return 0;
883
884 buf[ret++] = ' ';
885
886 /* IPv4 dst */
887 if (!inet_ntop(dst->ss_family, &((struct sockaddr_in *)dst)->sin_addr, buf + ret, buf_len - ret))
888 return 0;
889
890 ret += strlen(buf + ret);
891 if (ret >= buf_len)
892 return 0;
893
894 /* source and destination ports */
895 ret += snprintf(buf + ret, buf_len - ret, " %u %u\r\n",
896 ntohs(((struct sockaddr_in *)src)->sin_port),
897 ntohs(((struct sockaddr_in *)dst)->sin_port));
898 if (ret >= buf_len)
899 return 0;
900 }
Willy Tarreau2e1401a2013-10-01 11:41:55 +0200901 else if (src && dst && src->ss_family == dst->ss_family && src->ss_family == AF_INET6) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200902 ret = snprintf(buf + ret, buf_len - ret, "PROXY TCP6 ");
903 if (ret >= buf_len)
904 return 0;
905
906 /* IPv6 src */
907 if (!inet_ntop(src->ss_family, &((struct sockaddr_in6 *)src)->sin6_addr, buf + ret, buf_len - ret))
908 return 0;
909
910 ret += strlen(buf + ret);
911 if (ret >= buf_len)
912 return 0;
913
914 buf[ret++] = ' ';
915
916 /* IPv6 dst */
917 if (!inet_ntop(dst->ss_family, &((struct sockaddr_in6 *)dst)->sin6_addr, buf + ret, buf_len - ret))
918 return 0;
919
920 ret += strlen(buf + ret);
921 if (ret >= buf_len)
922 return 0;
923
924 /* source and destination ports */
925 ret += snprintf(buf + ret, buf_len - ret, " %u %u\r\n",
926 ntohs(((struct sockaddr_in6 *)src)->sin6_port),
927 ntohs(((struct sockaddr_in6 *)dst)->sin6_port));
928 if (ret >= buf_len)
929 return 0;
930 }
931 else {
932 /* unknown family combination */
933 ret = snprintf(buf, buf_len, "PROXY UNKNOWN\r\n");
934 if (ret >= buf_len)
935 return 0;
936 }
937 return ret;
938}
David Safb76832014-05-08 23:42:08 -0400939
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100940#if defined(USE_OPENSSL) || defined(CONFIG_HAP_NS)
941static int make_tlv(char *dest, int dest_len, char type, uint16_t length, const char *value)
David Safb76832014-05-08 23:42:08 -0400942{
943 struct tlv *tlv;
944
945 if (!dest || (length + sizeof(*tlv) > dest_len))
946 return 0;
947
948 tlv = (struct tlv *)dest;
949
950 tlv->type = type;
951 tlv->length_hi = length >> 8;
952 tlv->length_lo = length & 0x00ff;
953 memcpy(tlv->value, value, length);
954 return length + sizeof(*tlv);
955}
956#endif
957
958int make_proxy_line_v2(char *buf, int buf_len, struct server *srv, struct connection *remote)
959{
Willy Tarreau8fccfa22014-06-14 08:28:06 +0200960 const char pp2_signature[] = PP2_SIGNATURE;
David Safb76832014-05-08 23:42:08 -0400961 int ret = 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +0200962 struct proxy_hdr_v2 *hdr = (struct proxy_hdr_v2 *)buf;
Vincent Bernat6e615892016-05-18 16:17:44 +0200963 struct sockaddr_storage null_addr = { .ss_family = 0 };
David Safb76832014-05-08 23:42:08 -0400964 struct sockaddr_storage *src = &null_addr;
965 struct sockaddr_storage *dst = &null_addr;
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100966
David Safb76832014-05-08 23:42:08 -0400967#ifdef USE_OPENSSL
David Safb76832014-05-08 23:42:08 -0400968 char *value = NULL;
969 struct tlv_ssl *tlv;
970 int ssl_tlv_len = 0;
Dave McCowan77d1f012014-07-17 14:34:01 -0400971 struct chunk *cn_trash;
David Safb76832014-05-08 23:42:08 -0400972#endif
973
974 if (buf_len < PP2_HEADER_LEN)
975 return 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +0200976 memcpy(hdr->sig, pp2_signature, PP2_SIGNATURE_LEN);
David Safb76832014-05-08 23:42:08 -0400977
978 if (remote) {
979 src = &remote->addr.from;
980 dst = &remote->addr.to;
981 }
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100982
David Safb76832014-05-08 23:42:08 -0400983 if (src && dst && src->ss_family == dst->ss_family && src->ss_family == AF_INET) {
984 if (buf_len < PP2_HDR_LEN_INET)
985 return 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +0200986 hdr->ver_cmd = PP2_VERSION | PP2_CMD_PROXY;
987 hdr->fam = PP2_FAM_INET | PP2_TRANS_STREAM;
988 hdr->addr.ip4.src_addr = ((struct sockaddr_in *)src)->sin_addr.s_addr;
989 hdr->addr.ip4.dst_addr = ((struct sockaddr_in *)dst)->sin_addr.s_addr;
990 hdr->addr.ip4.src_port = ((struct sockaddr_in *)src)->sin_port;
991 hdr->addr.ip4.dst_port = ((struct sockaddr_in *)dst)->sin_port;
David Safb76832014-05-08 23:42:08 -0400992 ret = PP2_HDR_LEN_INET;
993 }
994 else if (src && dst && src->ss_family == dst->ss_family && src->ss_family == AF_INET6) {
995 if (buf_len < PP2_HDR_LEN_INET6)
996 return 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +0200997 hdr->ver_cmd = PP2_VERSION | PP2_CMD_PROXY;
998 hdr->fam = PP2_FAM_INET6 | PP2_TRANS_STREAM;
999 memcpy(hdr->addr.ip6.src_addr, &((struct sockaddr_in6 *)src)->sin6_addr, 16);
1000 memcpy(hdr->addr.ip6.dst_addr, &((struct sockaddr_in6 *)dst)->sin6_addr, 16);
1001 hdr->addr.ip6.src_port = ((struct sockaddr_in6 *)src)->sin6_port;
1002 hdr->addr.ip6.dst_port = ((struct sockaddr_in6 *)dst)->sin6_port;
David Safb76832014-05-08 23:42:08 -04001003 ret = PP2_HDR_LEN_INET6;
1004 }
1005 else {
1006 if (buf_len < PP2_HDR_LEN_UNSPEC)
1007 return 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001008 hdr->ver_cmd = PP2_VERSION | PP2_CMD_LOCAL;
1009 hdr->fam = PP2_FAM_UNSPEC | PP2_TRANS_UNSPEC;
David Safb76832014-05-08 23:42:08 -04001010 ret = PP2_HDR_LEN_UNSPEC;
1011 }
1012
1013#ifdef USE_OPENSSL
1014 if (srv->pp_opts & SRV_PP_V2_SSL) {
1015 if ((buf_len - ret) < sizeof(struct tlv_ssl))
1016 return 0;
1017 tlv = (struct tlv_ssl *)&buf[ret];
1018 memset(tlv, 0, sizeof(struct tlv_ssl));
1019 ssl_tlv_len += sizeof(struct tlv_ssl);
1020 tlv->tlv.type = PP2_TYPE_SSL;
1021 if (ssl_sock_is_ssl(remote)) {
1022 tlv->client |= PP2_CLIENT_SSL;
1023 value = ssl_sock_get_version(remote);
1024 if (value) {
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001025 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len-ret-ssl_tlv_len), PP2_TYPE_SSL_VERSION, strlen(value), value);
David Safb76832014-05-08 23:42:08 -04001026 }
Dave McCowan328fb582014-07-30 10:39:13 -04001027 if (ssl_sock_get_cert_used_sess(remote)) {
1028 tlv->client |= PP2_CLIENT_CERT_SESS;
David Safb76832014-05-08 23:42:08 -04001029 tlv->verify = htonl(ssl_sock_get_verify_result(remote));
Dave McCowan328fb582014-07-30 10:39:13 -04001030 if (ssl_sock_get_cert_used_conn(remote))
1031 tlv->client |= PP2_CLIENT_CERT_CONN;
David Safb76832014-05-08 23:42:08 -04001032 }
1033 if (srv->pp_opts & SRV_PP_V2_SSL_CN) {
Dave McCowan77d1f012014-07-17 14:34:01 -04001034 cn_trash = get_trash_chunk();
Willy Tarreau3b9a0c92014-07-19 06:37:33 +02001035 if (ssl_sock_get_remote_common_name(remote, cn_trash) > 0) {
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001036 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_TYPE_SSL_CN, cn_trash->len, cn_trash->str);
David Safb76832014-05-08 23:42:08 -04001037 }
1038 }
1039 }
1040 tlv->tlv.length_hi = (uint16_t)(ssl_tlv_len - sizeof(struct tlv)) >> 8;
1041 tlv->tlv.length_lo = (uint16_t)(ssl_tlv_len - sizeof(struct tlv)) & 0x00ff;
1042 ret += ssl_tlv_len;
1043 }
1044#endif
1045
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001046#ifdef CONFIG_HAP_NS
1047 if (remote && (remote->proxy_netns)) {
1048 if ((buf_len - ret) < sizeof(struct tlv))
1049 return 0;
1050 ret += make_tlv(&buf[ret], buf_len, PP2_TYPE_NETNS, remote->proxy_netns->name_len, remote->proxy_netns->node.key);
1051 }
1052#endif
1053
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001054 hdr->len = htons((uint16_t)(ret - PP2_HEADER_LEN));
David Safb76832014-05-08 23:42:08 -04001055
1056 return ret;
1057}
Emeric Brun4f603012017-01-05 15:11:44 +01001058
1059/* fetch if the received connection used a PROXY protocol header */
1060int smp_fetch_fc_rcvd_proxy(const struct arg *args, struct sample *smp, const char *kw, void *private)
1061{
1062 struct connection *conn;
1063
1064 conn = objt_conn(smp->sess->origin);
1065 if (!conn)
1066 return 0;
1067
1068 if (!(conn->flags & CO_FL_CONNECTED)) {
1069 smp->flags |= SMP_F_MAY_CHANGE;
1070 return 0;
1071 }
1072
1073 smp->flags = 0;
1074 smp->data.type = SMP_T_BOOL;
1075 smp->data.u.sint = (conn->flags & CO_FL_RCVD_PROXY) ? 1 : 0;
1076
1077 return 1;
1078}
1079
1080/* Note: must not be declared <const> as its list will be overwritten.
1081 * Note: fetches that may return multiple types must be declared as the lowest
1082 * common denominator, the type that can be casted into all other ones. For
1083 * instance v4/v6 must be declared v4.
1084 */
1085static struct sample_fetch_kw_list sample_fetch_keywords = {ILH, {
1086 { "fc_rcvd_proxy", smp_fetch_fc_rcvd_proxy, 0, NULL, SMP_T_BOOL, SMP_USE_L4CLI },
1087 { /* END */ },
1088}};
1089
1090
1091__attribute__((constructor))
1092static void __connection_init(void)
1093{
1094 sample_register_fetches(&sample_fetch_keywords);
1095}