blob: 06f2b7bc2fce79006fe551357745cf0375cb38a8 [file] [log] [blame]
Willy Tarreau59f98392012-07-06 14:13:49 +02001/*
2 * Connection management functions
3 *
4 * Copyright 2000-2012 Willy Tarreau <w@1wt.eu>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
Willy Tarreaue1e4a612012-10-05 00:10:55 +020013#include <errno.h>
14
Willy Tarreau59f98392012-07-06 14:13:49 +020015#include <common/compat.h>
16#include <common/config.h>
Willy Tarreau0108d902018-11-25 19:14:37 +010017#include <common/initcall.h>
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +010018#include <common/namespace.h>
Emmanuel Hocdet4399c752018-02-05 15:26:43 +010019#include <common/hash.h>
20#include <common/net_helper.h>
Willy Tarreau59f98392012-07-06 14:13:49 +020021
Willy Tarreauc5788912012-08-24 18:12:41 +020022#include <proto/connection.h>
Willy Tarreaudd2f85e2012-09-02 22:34:23 +020023#include <proto/fd.h>
Willy Tarreau5f1504f2012-10-04 23:55:57 +020024#include <proto/frontend.h>
Willy Tarreau2da156f2012-07-23 15:07:23 +020025#include <proto/proto_tcp.h>
Willy Tarreau2c6be842012-07-06 17:12:34 +020026#include <proto/stream_interface.h>
Emeric Brun4f603012017-01-05 15:11:44 +010027#include <proto/sample.h>
Emeric Brun46591952012-05-18 15:47:34 +020028#include <proto/ssl_sock.h>
Emeric Brun46591952012-05-18 15:47:34 +020029
Alexander Liu2a54bb72019-05-22 19:44:48 +080030#include <common/debug.h>
31
Willy Tarreau8ceae722018-11-26 11:58:30 +010032DECLARE_POOL(pool_head_connection, "connection", sizeof(struct connection));
33DECLARE_POOL(pool_head_connstream, "conn_stream", sizeof(struct conn_stream));
Willy Tarreauff5d57b2019-07-17 18:37:02 +020034DECLARE_POOL(pool_head_sockaddr, "sockaddr", sizeof(struct sockaddr_storage));
Geoff Simmons7185b782019-08-27 18:31:16 +020035DECLARE_POOL(pool_head_authority, "authority", PP2_AUTHORITY_MAX);
Willy Tarreau8ceae722018-11-26 11:58:30 +010036
Willy Tarreau13e14102016-12-22 20:25:26 +010037struct xprt_ops *registered_xprt[XPRT_ENTRIES] = { NULL, };
Willy Tarreauf2943dc2012-10-26 20:10:28 +020038
Christopher Faulet32f61c02018-04-10 14:33:41 +020039/* List head of all known muxes for PROTO */
40struct mux_proto_list mux_proto_list = {
41 .list = LIST_HEAD_INIT(mux_proto_list.list)
Willy Tarreau2386be62017-09-21 19:40:52 +020042};
43
Olivier Houchard477902b2020-01-22 18:08:48 +010044int conn_create_mux(struct connection *conn)
45{
Olivier Houchard477902b2020-01-22 18:08:48 +010046 if (conn_is_back(conn)) {
47 struct server *srv;
48 struct conn_stream *cs = conn->ctx;
49
50 if (conn->flags & CO_FL_ERROR)
51 goto fail;
Olivier Houcharda8a415d2020-01-23 13:15:14 +010052
Olivier Houchard477902b2020-01-22 18:08:48 +010053 if (conn_install_mux_be(conn, conn->ctx, conn->owner) < 0)
54 goto fail;
55 srv = objt_server(conn->target);
56 if (srv && ((srv->proxy->options & PR_O_REUSE_MASK) != PR_O_REUSE_NEVR) &&
57 conn->mux->avail_streams(conn) > 0)
58 LIST_ADD(&srv->idle_conns[tid], &conn->list);
59 return 0;
60fail:
61 /* let the upper layer know the connection failed */
62 cs->data_cb->wake(cs);
63 return -1;
64 } else
65 return conn_complete_session(conn);
66
67}
68
Willy Tarreau59f98392012-07-06 14:13:49 +020069/* I/O callback for fd-based connections. It calls the read/write handlers
Willy Tarreau7a798e52016-04-14 11:13:20 +020070 * provided by the connection's sock_ops, which must be valid.
Willy Tarreau59f98392012-07-06 14:13:49 +020071 */
Willy Tarreau7a798e52016-04-14 11:13:20 +020072void conn_fd_handler(int fd)
Willy Tarreau59f98392012-07-06 14:13:49 +020073{
Willy Tarreau80184712012-07-06 14:54:49 +020074 struct connection *conn = fdtab[fd].owner;
Willy Tarreau9e272bf2012-10-03 21:04:48 +020075 unsigned int flags;
Olivier Houchardaf4021e2018-08-09 13:06:55 +020076 int io_available = 0;
Willy Tarreau59f98392012-07-06 14:13:49 +020077
Willy Tarreaud80cb4e2018-01-20 19:30:13 +010078 if (unlikely(!conn)) {
79 activity[tid].conn_dead++;
Willy Tarreau7a798e52016-04-14 11:13:20 +020080 return;
Willy Tarreaud80cb4e2018-01-20 19:30:13 +010081 }
Willy Tarreau59f98392012-07-06 14:13:49 +020082
Willy Tarreau7d281492012-12-16 19:19:13 +010083 flags = conn->flags & ~CO_FL_ERROR; /* ensure to call the wake handler upon error */
Willy Tarreaud29a0662012-12-10 16:33:38 +010084
Willy Tarreaub2a7ab02019-12-27 10:54:22 +010085 if (unlikely(conn->flags & CO_FL_WAIT_L4_CONN) &&
86 ((fd_send_ready(fd) && fd_send_active(fd)) ||
87 (fd_recv_ready(fd) && fd_recv_active(fd)))) {
88 /* Still waiting for a connection to establish and nothing was
89 * attempted yet to probe the connection. this will clear the
90 * CO_FL_WAIT_L4_CONN flag on success.
91 */
92 if (!conn_fd_check(conn))
93 goto leave;
94 }
95
Willy Tarreau8081abe2019-11-28 18:08:49 +010096 if (fd_send_ready(fd) && fd_send_active(fd)) {
Willy Tarreau3c0cc492017-03-19 07:54:28 +010097 /* force reporting of activity by clearing the previous flags :
98 * we'll have at least ERROR or CONNECTED at the end of an I/O,
99 * both of which will be detected below.
Willy Tarreau9e272bf2012-10-03 21:04:48 +0200100 */
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100101 flags = 0;
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100102 if (conn->subs && conn->subs->events & SUB_RETRY_SEND) {
103 tasklet_wakeup(conn->subs->tasklet);
104 conn->subs->events &= ~SUB_RETRY_SEND;
105 if (!conn->subs->events)
106 conn->subs = NULL;
Olivier Houchardfa8aa862018-10-10 18:25:41 +0200107 } else
108 io_available = 1;
Willy Tarreaud1d14c32020-02-21 10:34:19 +0100109 fd_stop_send(fd);
Willy Tarreau9e272bf2012-10-03 21:04:48 +0200110 }
Willy Tarreau59f98392012-07-06 14:13:49 +0200111
Willy Tarreau57ec32f2017-04-11 19:59:33 +0200112 /* The data transfer starts here and stops on error and handshakes. Note
113 * that we must absolutely test conn->xprt at each step in case it suddenly
114 * changes due to a quick unexpected close().
115 */
Willy Tarreau8081abe2019-11-28 18:08:49 +0100116 if (fd_recv_ready(fd) && fd_recv_active(fd)) {
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100117 /* force reporting of activity by clearing the previous flags :
118 * we'll have at least ERROR or CONNECTED at the end of an I/O,
119 * both of which will be detected below.
Willy Tarreau9e272bf2012-10-03 21:04:48 +0200120 */
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100121 flags = 0;
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100122 if (conn->subs && conn->subs->events & SUB_RETRY_RECV) {
123 tasklet_wakeup(conn->subs->tasklet);
124 conn->subs->events &= ~SUB_RETRY_RECV;
125 if (!conn->subs->events)
126 conn->subs = NULL;
Olivier Houchardfa8aa862018-10-10 18:25:41 +0200127 } else
128 io_available = 1;
Willy Tarreaud1d14c32020-02-21 10:34:19 +0100129 fd_stop_recv(fd);
Willy Tarreau9e272bf2012-10-03 21:04:48 +0200130 }
Willy Tarreau2da156f2012-07-23 15:07:23 +0200131
Willy Tarreau2c6be842012-07-06 17:12:34 +0200132 leave:
Olivier Houchard477902b2020-01-22 18:08:48 +0100133 /* If we don't yet have a mux, that means we were waiting for
134 * informations to create one, typically from the ALPN. If we're
135 * done with the handshake, attempt to create one.
Willy Tarreau8e3c6ce2017-08-28 15:46:01 +0200136 */
Willy Tarreau911db9b2020-01-23 16:27:54 +0100137 if (unlikely(!conn->mux) && !(conn->flags & CO_FL_WAIT_XPRT))
Olivier Houchard477902b2020-01-22 18:08:48 +0100138 if (conn_create_mux(conn) < 0)
139 return;
Willy Tarreau8e3c6ce2017-08-28 15:46:01 +0200140
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100141 /* The wake callback is normally used to notify the data layer about
142 * data layer activity (successful send/recv), connection establishment,
143 * shutdown and fatal errors. We need to consider the following
144 * situations to wake up the data layer :
Willy Tarreau0fbc3182019-12-27 14:57:45 +0100145 * - change among the CO_FL_NOTIFY_DONE flags :
146 * SOCK_{RD,WR}_SH, ERROR,
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100147 * - absence of any of {L4,L6}_CONN and CONNECTED, indicating the
148 * end of handshake and transition to CONNECTED
149 * - raise of CONNECTED with HANDSHAKE down
150 * - end of HANDSHAKE with CONNECTED set
151 * - regular data layer activity
152 *
153 * Note that the wake callback is allowed to release the connection and
154 * the fd (and return < 0 in this case).
Willy Tarreau2396c1c2012-10-03 21:12:16 +0200155 */
Willy Tarreau911db9b2020-01-23 16:27:54 +0100156 if ((io_available || ((conn->flags ^ flags) & CO_FL_NOTIFY_DONE) ||
157 ((flags & CO_FL_WAIT_XPRT) && !(conn->flags & CO_FL_WAIT_XPRT))) &&
Olivier Houchardfe50bfb2019-05-27 12:09:19 +0200158 conn->mux && conn->mux->wake && conn->mux->wake(conn) < 0)
Willy Tarreau7a798e52016-04-14 11:13:20 +0200159 return;
Willy Tarreaufd31e532012-07-23 18:24:25 +0200160
Willy Tarreauf9dabec2012-08-17 17:33:53 +0200161 /* commit polling changes */
162 conn_cond_update_polling(conn);
Willy Tarreau7a798e52016-04-14 11:13:20 +0200163 return;
Willy Tarreau59f98392012-07-06 14:13:49 +0200164}
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200165
Willy Tarreau4970e5a2019-12-27 10:40:21 +0100166/* This is the callback which is set when a connection establishment is pending
167 * and we have nothing to send. It may update the FD polling status to indicate
168 * !READY. It returns 0 if it fails in a fatal way or needs to poll to go
169 * further, otherwise it returns non-zero and removes the CO_FL_WAIT_L4_CONN
170 * flag from the connection's flags. In case of error, it sets CO_FL_ERROR and
171 * leaves the error code in errno.
172 */
173int conn_fd_check(struct connection *conn)
174{
175 struct sockaddr_storage *addr;
176 int fd = conn->handle.fd;
177
178 if (conn->flags & CO_FL_ERROR)
179 return 0;
180
181 if (!conn_ctrl_ready(conn))
182 return 0;
183
184 if (!(conn->flags & CO_FL_WAIT_L4_CONN))
185 return 1; /* strange we were called while ready */
186
187 if (!fd_send_ready(fd))
188 return 0;
189
190 /* Here we have 2 cases :
191 * - modern pollers, able to report ERR/HUP. If these ones return any
192 * of these flags then it's likely a failure, otherwise it possibly
193 * is a success (i.e. there may have been data received just before
194 * the error was reported).
195 * - select, which doesn't report these and with which it's always
196 * necessary either to try connect() again or to check for SO_ERROR.
197 * In order to simplify everything, we double-check using connect() as
198 * soon as we meet either of these delicate situations. Note that
199 * SO_ERROR would clear the error after reporting it!
200 */
201 if (cur_poller.flags & HAP_POLL_F_ERRHUP) {
202 /* modern poller, able to report ERR/HUP */
203 if ((fdtab[fd].ev & (FD_POLL_IN|FD_POLL_ERR|FD_POLL_HUP)) == FD_POLL_IN)
204 goto done;
205 if ((fdtab[fd].ev & (FD_POLL_OUT|FD_POLL_ERR|FD_POLL_HUP)) == FD_POLL_OUT)
206 goto done;
207 if (!(fdtab[fd].ev & (FD_POLL_ERR|FD_POLL_HUP)))
208 goto wait;
209 /* error present, fall through common error check path */
210 }
211
212 /* Use connect() to check the state of the socket. This has the double
213 * advantage of *not* clearing the error (so that health checks can
214 * still use getsockopt(SO_ERROR)) and giving us the following info :
215 * - error
216 * - connecting (EALREADY, EINPROGRESS)
217 * - connected (EISCONN, 0)
218 */
219 addr = conn->dst;
220 if ((conn->flags & CO_FL_SOCKS4) && obj_type(conn->target) == OBJ_TYPE_SERVER)
221 addr = &objt_server(conn->target)->socks4_addr;
222
223 if (connect(fd, (const struct sockaddr *)addr, get_addr_len(addr)) == -1) {
224 if (errno == EALREADY || errno == EINPROGRESS)
225 goto wait;
226
227 if (errno && errno != EISCONN)
228 goto out_error;
229 }
230
231 done:
232 /* The FD is ready now, we'll mark the connection as complete and
233 * forward the event to the transport layer which will notify the
234 * data layer.
235 */
236 conn->flags &= ~CO_FL_WAIT_L4_CONN;
237 fd_may_send(fd);
238 fd_cond_recv(fd);
239 errno = 0; // make health checks happy
240 return 1;
241
242 out_error:
243 /* Write error on the file descriptor. Report it to the connection
244 * and disable polling on this FD.
245 */
246 fdtab[fd].linger_risk = 0;
247 conn->flags |= CO_FL_ERROR | CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH;
Willy Tarreau5d4d1802020-02-21 09:58:29 +0100248 conn_stop_polling(conn);
Willy Tarreau4970e5a2019-12-27 10:40:21 +0100249 return 0;
250
251 wait:
Willy Tarreau4970e5a2019-12-27 10:40:21 +0100252 fd_cant_send(fd);
Willy Tarreaud1d14c32020-02-21 10:34:19 +0100253 fd_want_send(fd);
Willy Tarreau4970e5a2019-12-27 10:40:21 +0100254 return 0;
255}
256
Willy Tarreauff3e6482015-03-12 23:56:52 +0100257/* Send a message over an established connection. It makes use of send() and
258 * returns the same return code and errno. If the socket layer is not ready yet
259 * then -1 is returned and ENOTSOCK is set into errno. If the fd is not marked
260 * as ready, or if EAGAIN or ENOTCONN is returned, then we return 0. It returns
261 * EMSGSIZE if called with a zero length message. The purpose is to simplify
262 * some rare attempts to directly write on the socket from above the connection
263 * (typically send_proxy). In case of EAGAIN, the fd is marked as "cant_send".
264 * It automatically retries on EINTR. Other errors cause the connection to be
265 * marked as in error state. It takes similar arguments as send() except the
266 * first one which is the connection instead of the file descriptor. Note,
267 * MSG_DONTWAIT and MSG_NOSIGNAL are forced on the flags.
268 */
269int conn_sock_send(struct connection *conn, const void *buf, int len, int flags)
270{
271 int ret;
272
273 ret = -1;
274 errno = ENOTSOCK;
275
276 if (conn->flags & CO_FL_SOCK_WR_SH)
277 goto fail;
278
279 if (!conn_ctrl_ready(conn))
280 goto fail;
281
282 errno = EMSGSIZE;
283 if (!len)
284 goto fail;
285
Willy Tarreau585744b2017-08-24 14:31:19 +0200286 if (!fd_send_ready(conn->handle.fd))
Willy Tarreauff3e6482015-03-12 23:56:52 +0100287 goto wait;
288
289 do {
Willy Tarreau585744b2017-08-24 14:31:19 +0200290 ret = send(conn->handle.fd, buf, len, flags | MSG_DONTWAIT | MSG_NOSIGNAL);
Willy Tarreauff3e6482015-03-12 23:56:52 +0100291 } while (ret < 0 && errno == EINTR);
292
293
Willy Tarreauccf3f6d2019-09-05 17:05:05 +0200294 if (ret > 0) {
295 if (conn->flags & CO_FL_WAIT_L4_CONN) {
296 conn->flags &= ~CO_FL_WAIT_L4_CONN;
297 fd_may_send(conn->handle.fd);
298 fd_cond_recv(conn->handle.fd);
299 }
Willy Tarreauff3e6482015-03-12 23:56:52 +0100300 return ret;
Willy Tarreauccf3f6d2019-09-05 17:05:05 +0200301 }
Willy Tarreauff3e6482015-03-12 23:56:52 +0100302
303 if (ret == 0 || errno == EAGAIN || errno == ENOTCONN) {
304 wait:
Willy Tarreau585744b2017-08-24 14:31:19 +0200305 fd_cant_send(conn->handle.fd);
Willy Tarreauff3e6482015-03-12 23:56:52 +0100306 return 0;
307 }
308 fail:
309 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH | CO_FL_ERROR;
310 return ret;
311}
312
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100313/* Called from the upper layer, to subscribe <es> to events <event_type>. The
314 * event subscriber <es> is not allowed to change from a previous call as long
315 * as at least one event is still subscribed. The <event_type> must only be a
316 * combination of SUB_RETRY_RECV and SUB_RETRY_SEND. It always returns 0.
317 */
318int conn_unsubscribe(struct connection *conn, void *xprt_ctx, int event_type, struct wait_event *es)
Olivier Houchard83a0cd82018-09-28 17:57:58 +0200319{
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100320 BUG_ON(event_type & ~(SUB_RETRY_SEND|SUB_RETRY_RECV));
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100321 BUG_ON(conn->subs && conn->subs != es);
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100322
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100323 es->events &= ~event_type;
324 if (!es->events)
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100325 conn->subs = NULL;
326
Willy Tarreaud1d14c32020-02-21 10:34:19 +0100327 if (conn_ctrl_ready(conn)) {
328 if (event_type & SUB_RETRY_RECV)
329 fd_stop_recv(conn->handle.fd);
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100330
Willy Tarreaud1d14c32020-02-21 10:34:19 +0100331 if (event_type & SUB_RETRY_SEND)
332 fd_stop_send(conn->handle.fd);
333 }
Olivier Houchard83a0cd82018-09-28 17:57:58 +0200334 return 0;
335}
336
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100337/* Called from the upper layer, to unsubscribe <es> from events <event_type>
338 * (undo fcgi_subscribe). The <es> struct is not allowed to differ from the one
339 * passed to the subscribe() call. It always returns zero.
340 */
341int conn_subscribe(struct connection *conn, void *xprt_ctx, int event_type, struct wait_event *es)
Olivier Houchard6ff20392018-07-17 18:46:31 +0200342{
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100343 BUG_ON(event_type & ~(SUB_RETRY_SEND|SUB_RETRY_RECV));
344 BUG_ON(conn->subs && conn->subs->events & event_type);
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100345 BUG_ON(conn->subs && conn->subs != es);
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100346
Willy Tarreauee1a6fc2020-01-17 07:52:13 +0100347 conn->subs = es;
348 es->events |= event_type;
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100349
Willy Tarreaud1d14c32020-02-21 10:34:19 +0100350 if (conn_ctrl_ready(conn)) {
351 if (event_type & SUB_RETRY_RECV)
352 fd_want_recv(conn->handle.fd);
Willy Tarreau7872d1f2020-01-10 07:06:05 +0100353
Willy Tarreaud1d14c32020-02-21 10:34:19 +0100354 if (event_type & SUB_RETRY_SEND)
355 fd_want_send(conn->handle.fd);
356 }
Olivier Houchard83a0cd82018-09-28 17:57:58 +0200357 return 0;
Olivier Houchard6ff20392018-07-17 18:46:31 +0200358}
359
Willy Tarreaud85c4852015-03-13 00:40:28 +0100360/* Drains possibly pending incoming data on the file descriptor attached to the
361 * connection and update the connection's flags accordingly. This is used to
362 * know whether we need to disable lingering on close. Returns non-zero if it
363 * is safe to close without disabling lingering, otherwise zero. The SOCK_RD_SH
364 * flag may also be updated if the incoming shutdown was reported by the drain()
365 * function.
366 */
367int conn_sock_drain(struct connection *conn)
368{
Willy Tarreaue215bba2018-08-24 14:31:53 +0200369 int turns = 2;
370 int len;
371
Willy Tarreaud85c4852015-03-13 00:40:28 +0100372 if (!conn_ctrl_ready(conn))
373 return 1;
374
375 if (conn->flags & (CO_FL_ERROR | CO_FL_SOCK_RD_SH))
376 return 1;
377
Willy Tarreaue215bba2018-08-24 14:31:53 +0200378 if (fdtab[conn->handle.fd].ev & (FD_POLL_ERR|FD_POLL_HUP))
379 goto shut;
Willy Tarreaud85c4852015-03-13 00:40:28 +0100380
Willy Tarreaue215bba2018-08-24 14:31:53 +0200381 if (!fd_recv_ready(conn->handle.fd))
382 return 0;
Willy Tarreaud85c4852015-03-13 00:40:28 +0100383
Willy Tarreaue215bba2018-08-24 14:31:53 +0200384 if (conn->ctrl->drain) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200385 if (conn->ctrl->drain(conn->handle.fd) <= 0)
Willy Tarreaud85c4852015-03-13 00:40:28 +0100386 return 0;
Willy Tarreaue215bba2018-08-24 14:31:53 +0200387 goto shut;
388 }
389
390 /* no drain function defined, use the generic one */
391
392 while (turns) {
393#ifdef MSG_TRUNC_CLEARS_INPUT
394 len = recv(conn->handle.fd, NULL, INT_MAX, MSG_DONTWAIT | MSG_NOSIGNAL | MSG_TRUNC);
395 if (len == -1 && errno == EFAULT)
396#endif
397 len = recv(conn->handle.fd, trash.area, trash.size,
398 MSG_DONTWAIT | MSG_NOSIGNAL);
399
400 if (len == 0)
401 goto shut;
402
403 if (len < 0) {
404 if (errno == EAGAIN) {
405 /* connection not closed yet */
406 fd_cant_recv(conn->handle.fd);
407 break;
408 }
409 if (errno == EINTR) /* oops, try again */
410 continue;
411 /* other errors indicate a dead connection, fine. */
412 goto shut;
413 }
414 /* OK we read some data, let's try again once */
415 turns--;
Willy Tarreaud85c4852015-03-13 00:40:28 +0100416 }
417
Willy Tarreaue215bba2018-08-24 14:31:53 +0200418 /* some data are still present, give up */
419 return 0;
420
421 shut:
422 /* we're certain the connection was shut down */
423 fdtab[conn->handle.fd].linger_risk = 0;
Willy Tarreaud85c4852015-03-13 00:40:28 +0100424 conn->flags |= CO_FL_SOCK_RD_SH;
425 return 1;
426}
427
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100428/*
429 * Get data length from tlv
430 */
431static int get_tlv_length(const struct tlv *src)
432{
433 return (src->length_hi << 8) | src->length_lo;
434}
435
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200436/* This handshake handler waits a PROXY protocol header at the beginning of the
437 * raw data stream. The header looks like this :
438 *
439 * "PROXY" <SP> PROTO <SP> SRC3 <SP> DST3 <SP> SRC4 <SP> <DST4> "\r\n"
440 *
441 * There must be exactly one space between each field. Fields are :
442 * - PROTO : layer 4 protocol, which must be "TCP4" or "TCP6".
443 * - SRC3 : layer 3 (eg: IP) source address in standard text form
444 * - DST3 : layer 3 (eg: IP) destination address in standard text form
445 * - SRC4 : layer 4 (eg: TCP port) source address in standard text form
446 * - DST4 : layer 4 (eg: TCP port) destination address in standard text form
447 *
448 * This line MUST be at the beginning of the buffer and MUST NOT wrap.
449 *
450 * The header line is small and in all cases smaller than the smallest normal
451 * TCP MSS. So it MUST always be delivered as one segment, which ensures we
452 * can safely use MSG_PEEK and avoid buffering.
453 *
454 * Once the data is fetched, the values are set in the connection's address
455 * fields, and data are removed from the socket's buffer. The function returns
456 * zero if it needs to wait for more data or if it fails, or 1 if it completed
457 * and removed itself.
458 */
459int conn_recv_proxy(struct connection *conn, int flag)
460{
461 char *line, *end;
Willy Tarreau77992672014-06-14 11:06:17 +0200462 struct proxy_hdr_v2 *hdr_v2;
463 const char v2sig[] = PP2_SIGNATURE;
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100464 int tlv_length = 0;
KOVACS Krisztian7209c202015-07-03 14:09:10 +0200465 int tlv_offset = 0;
Willy Tarreaub406b872018-08-22 05:20:32 +0200466 int ret;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200467
Willy Tarreau3c728722014-01-23 13:50:42 +0100468 if (!conn_ctrl_ready(conn))
Willy Tarreauf79c8172013-10-21 16:30:56 +0200469 goto fail;
470
Willy Tarreauca79f592019-07-17 19:04:47 +0200471 if (!sockaddr_alloc(&conn->src) || !sockaddr_alloc(&conn->dst))
472 goto fail;
473
Willy Tarreau585744b2017-08-24 14:31:19 +0200474 if (!fd_recv_ready(conn->handle.fd))
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200475 goto not_ready;
Willy Tarreaufd803bb2014-01-20 15:13:07 +0100476
Willy Tarreau157788c2020-02-11 10:08:05 +0100477 while (1) {
Willy Tarreaub406b872018-08-22 05:20:32 +0200478 ret = recv(conn->handle.fd, trash.area, trash.size, MSG_PEEK);
479 if (ret < 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200480 if (errno == EINTR)
481 continue;
482 if (errno == EAGAIN) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200483 fd_cant_recv(conn->handle.fd);
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200484 goto not_ready;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200485 }
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100486 goto recv_abort;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200487 }
Willy Tarreaub406b872018-08-22 05:20:32 +0200488 trash.data = ret;
Willy Tarreau157788c2020-02-11 10:08:05 +0100489 break;
490 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200491
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200492 if (!trash.data) {
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100493 /* client shutdown */
494 conn->err_code = CO_ER_PRX_EMPTY;
495 goto fail;
496 }
497
Willy Tarreauc192b0a2020-01-23 09:11:58 +0100498 conn->flags &= ~CO_FL_WAIT_L4_CONN;
499
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200500 if (trash.data < 6)
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200501 goto missing;
502
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200503 line = trash.area;
504 end = trash.area + trash.data;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200505
506 /* Decode a possible proxy request, fail early if it does not match */
Willy Tarreau77992672014-06-14 11:06:17 +0200507 if (strncmp(line, "PROXY ", 6) != 0)
508 goto not_v1;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200509
510 line += 6;
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200511 if (trash.data < 9) /* shortest possible line */
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200512 goto missing;
513
David CARLIER42ff05e2016-03-24 09:22:36 +0000514 if (memcmp(line, "TCP4 ", 5) == 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200515 u32 src3, dst3, sport, dport;
516
517 line += 5;
518
519 src3 = inetaddr_host_lim_ret(line, end, &line);
520 if (line == end)
521 goto missing;
522 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100523 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200524
525 dst3 = inetaddr_host_lim_ret(line, end, &line);
526 if (line == end)
527 goto missing;
528 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100529 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200530
531 sport = read_uint((const char **)&line, end);
532 if (line == end)
533 goto missing;
534 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100535 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200536
537 dport = read_uint((const char **)&line, end);
538 if (line > end - 2)
539 goto missing;
540 if (*line++ != '\r')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100541 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200542 if (*line++ != '\n')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100543 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200544
545 /* update the session's addresses and mark them set */
Willy Tarreau226572f2019-07-17 14:46:00 +0200546 ((struct sockaddr_in *)conn->src)->sin_family = AF_INET;
547 ((struct sockaddr_in *)conn->src)->sin_addr.s_addr = htonl(src3);
548 ((struct sockaddr_in *)conn->src)->sin_port = htons(sport);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200549
Willy Tarreau226572f2019-07-17 14:46:00 +0200550 ((struct sockaddr_in *)conn->dst)->sin_family = AF_INET;
551 ((struct sockaddr_in *)conn->dst)->sin_addr.s_addr = htonl(dst3);
552 ((struct sockaddr_in *)conn->dst)->sin_port = htons(dport);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200553 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
554 }
David CARLIER42ff05e2016-03-24 09:22:36 +0000555 else if (memcmp(line, "TCP6 ", 5) == 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200556 u32 sport, dport;
557 char *src_s;
558 char *dst_s, *sport_s, *dport_s;
559 struct in6_addr src3, dst3;
560
561 line += 5;
562
563 src_s = line;
564 dst_s = sport_s = dport_s = NULL;
565 while (1) {
566 if (line > end - 2) {
567 goto missing;
568 }
569 else if (*line == '\r') {
570 *line = 0;
571 line++;
572 if (*line++ != '\n')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100573 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200574 break;
575 }
576
577 if (*line == ' ') {
578 *line = 0;
579 if (!dst_s)
580 dst_s = line + 1;
581 else if (!sport_s)
582 sport_s = line + 1;
583 else if (!dport_s)
584 dport_s = line + 1;
585 }
586 line++;
587 }
588
589 if (!dst_s || !sport_s || !dport_s)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100590 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200591
592 sport = read_uint((const char **)&sport_s,dport_s - 1);
593 if (*sport_s != 0)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100594 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200595
596 dport = read_uint((const char **)&dport_s,line - 2);
597 if (*dport_s != 0)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100598 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200599
600 if (inet_pton(AF_INET6, src_s, (void *)&src3) != 1)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100601 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200602
603 if (inet_pton(AF_INET6, dst_s, (void *)&dst3) != 1)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100604 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200605
606 /* update the session's addresses and mark them set */
Willy Tarreau226572f2019-07-17 14:46:00 +0200607 ((struct sockaddr_in6 *)conn->src)->sin6_family = AF_INET6;
608 memcpy(&((struct sockaddr_in6 *)conn->src)->sin6_addr, &src3, sizeof(struct in6_addr));
609 ((struct sockaddr_in6 *)conn->src)->sin6_port = htons(sport);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200610
Willy Tarreau226572f2019-07-17 14:46:00 +0200611 ((struct sockaddr_in6 *)conn->dst)->sin6_family = AF_INET6;
612 memcpy(&((struct sockaddr_in6 *)conn->dst)->sin6_addr, &dst3, sizeof(struct in6_addr));
613 ((struct sockaddr_in6 *)conn->dst)->sin6_port = htons(dport);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200614 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
615 }
Willy Tarreau4c20d292014-06-14 11:41:36 +0200616 else if (memcmp(line, "UNKNOWN\r\n", 9) == 0) {
617 /* This can be a UNIX socket forwarded by an haproxy upstream */
618 line += 9;
619 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200620 else {
Willy Tarreau4c20d292014-06-14 11:41:36 +0200621 /* The protocol does not match something known (TCP4/TCP6/UNKNOWN) */
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100622 conn->err_code = CO_ER_PRX_BAD_PROTO;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200623 goto fail;
624 }
625
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200626 trash.data = line - trash.area;
Willy Tarreau77992672014-06-14 11:06:17 +0200627 goto eat_header;
628
629 not_v1:
630 /* try PPv2 */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200631 if (trash.data < PP2_HEADER_LEN)
Willy Tarreau77992672014-06-14 11:06:17 +0200632 goto missing;
633
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200634 hdr_v2 = (struct proxy_hdr_v2 *) trash.area;
Willy Tarreau77992672014-06-14 11:06:17 +0200635
636 if (memcmp(hdr_v2->sig, v2sig, PP2_SIGNATURE_LEN) != 0 ||
637 (hdr_v2->ver_cmd & PP2_VERSION_MASK) != PP2_VERSION) {
638 conn->err_code = CO_ER_PRX_NOT_HDR;
639 goto fail;
640 }
641
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200642 if (trash.data < PP2_HEADER_LEN + ntohs(hdr_v2->len))
Willy Tarreau77992672014-06-14 11:06:17 +0200643 goto missing;
644
645 switch (hdr_v2->ver_cmd & PP2_CMD_MASK) {
646 case 0x01: /* PROXY command */
647 switch (hdr_v2->fam) {
648 case 0x11: /* TCPv4 */
KOVACS Krisztianefd3aa92014-11-19 10:53:20 +0100649 if (ntohs(hdr_v2->len) < PP2_ADDR_LEN_INET)
650 goto bad_header;
651
Willy Tarreau226572f2019-07-17 14:46:00 +0200652 ((struct sockaddr_in *)conn->src)->sin_family = AF_INET;
653 ((struct sockaddr_in *)conn->src)->sin_addr.s_addr = hdr_v2->addr.ip4.src_addr;
654 ((struct sockaddr_in *)conn->src)->sin_port = hdr_v2->addr.ip4.src_port;
655 ((struct sockaddr_in *)conn->dst)->sin_family = AF_INET;
656 ((struct sockaddr_in *)conn->dst)->sin_addr.s_addr = hdr_v2->addr.ip4.dst_addr;
657 ((struct sockaddr_in *)conn->dst)->sin_port = hdr_v2->addr.ip4.dst_port;
Willy Tarreau77992672014-06-14 11:06:17 +0200658 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
KOVACS Krisztian7209c202015-07-03 14:09:10 +0200659 tlv_offset = PP2_HEADER_LEN + PP2_ADDR_LEN_INET;
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100660 tlv_length = ntohs(hdr_v2->len) - PP2_ADDR_LEN_INET;
Willy Tarreau77992672014-06-14 11:06:17 +0200661 break;
662 case 0x21: /* TCPv6 */
KOVACS Krisztianefd3aa92014-11-19 10:53:20 +0100663 if (ntohs(hdr_v2->len) < PP2_ADDR_LEN_INET6)
664 goto bad_header;
665
Willy Tarreau226572f2019-07-17 14:46:00 +0200666 ((struct sockaddr_in6 *)conn->src)->sin6_family = AF_INET6;
667 memcpy(&((struct sockaddr_in6 *)conn->src)->sin6_addr, hdr_v2->addr.ip6.src_addr, 16);
668 ((struct sockaddr_in6 *)conn->src)->sin6_port = hdr_v2->addr.ip6.src_port;
669 ((struct sockaddr_in6 *)conn->dst)->sin6_family = AF_INET6;
670 memcpy(&((struct sockaddr_in6 *)conn->dst)->sin6_addr, hdr_v2->addr.ip6.dst_addr, 16);
671 ((struct sockaddr_in6 *)conn->dst)->sin6_port = hdr_v2->addr.ip6.dst_port;
Willy Tarreau77992672014-06-14 11:06:17 +0200672 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
KOVACS Krisztian7209c202015-07-03 14:09:10 +0200673 tlv_offset = PP2_HEADER_LEN + PP2_ADDR_LEN_INET6;
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100674 tlv_length = ntohs(hdr_v2->len) - PP2_ADDR_LEN_INET6;
Willy Tarreau77992672014-06-14 11:06:17 +0200675 break;
676 }
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100677
678 /* TLV parsing */
679 if (tlv_length > 0) {
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200680 while (tlv_offset + TLV_HEADER_SIZE <= trash.data) {
681 const struct tlv *tlv_packet = (struct tlv *) &trash.area[tlv_offset];
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100682 const int tlv_len = get_tlv_length(tlv_packet);
683 tlv_offset += tlv_len + TLV_HEADER_SIZE;
684
685 switch (tlv_packet->type) {
Emmanuel Hocdet115df3e2018-02-05 16:23:23 +0100686 case PP2_TYPE_CRC32C: {
687 void *tlv_crc32c_p = (void *)tlv_packet->value;
688 uint32_t n_crc32c = ntohl(read_u32(tlv_crc32c_p));
689 write_u32(tlv_crc32c_p, 0);
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200690 if (hash_crc32c(trash.area, PP2_HEADER_LEN + ntohs(hdr_v2->len)) != n_crc32c)
Emmanuel Hocdet115df3e2018-02-05 16:23:23 +0100691 goto bad_header;
692 break;
693 }
Willy Tarreaue5733232019-05-22 19:24:06 +0200694#ifdef USE_NS
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100695 case PP2_TYPE_NETNS: {
696 const struct netns_entry *ns;
697 ns = netns_store_lookup((char*)tlv_packet->value, tlv_len);
698 if (ns)
699 conn->proxy_netns = ns;
700 break;
701 }
702#endif
Geoff Simmons7185b782019-08-27 18:31:16 +0200703 case PP2_TYPE_AUTHORITY: {
704 if (tlv_len > PP2_AUTHORITY_MAX)
705 goto bad_header;
706 conn->proxy_authority = pool_alloc(pool_head_authority);
707 if (conn->proxy_authority == NULL)
708 goto fail;
709 memcpy(conn->proxy_authority, (const char *)tlv_packet->value, tlv_len);
710 conn->proxy_authority_len = tlv_len;
711 break;
712 }
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100713 default:
714 break;
715 }
716 }
717 }
718
Willy Tarreau77992672014-06-14 11:06:17 +0200719 /* unsupported protocol, keep local connection address */
720 break;
721 case 0x00: /* LOCAL command */
722 /* keep local connection address for LOCAL */
723 break;
724 default:
725 goto bad_header; /* not a supported command */
726 }
727
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200728 trash.data = PP2_HEADER_LEN + ntohs(hdr_v2->len);
Willy Tarreau77992672014-06-14 11:06:17 +0200729 goto eat_header;
730
731 eat_header:
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200732 /* remove the PROXY line from the request. For this we re-read the
733 * exact line at once. If we don't get the exact same result, we
734 * fail.
735 */
Willy Tarreau157788c2020-02-11 10:08:05 +0100736 while (1) {
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200737 int len2 = recv(conn->handle.fd, trash.area, trash.data, 0);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200738 if (len2 < 0 && errno == EINTR)
739 continue;
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200740 if (len2 != trash.data)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100741 goto recv_abort;
Willy Tarreau157788c2020-02-11 10:08:05 +0100742 break;
743 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200744
745 conn->flags &= ~flag;
Emeric Brun4f603012017-01-05 15:11:44 +0100746 conn->flags |= CO_FL_RCVD_PROXY;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200747 return 1;
748
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200749 not_ready:
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200750 return 0;
751
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200752 missing:
753 /* Missing data. Since we're using MSG_PEEK, we can only poll again if
754 * we have not read anything. Otherwise we need to fail because we won't
755 * be able to poll anymore.
756 */
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100757 conn->err_code = CO_ER_PRX_TRUNCATED;
758 goto fail;
759
760 bad_header:
761 /* This is not a valid proxy protocol header */
762 conn->err_code = CO_ER_PRX_BAD_HDR;
763 goto fail;
764
765 recv_abort:
766 conn->err_code = CO_ER_PRX_ABORT;
Willy Tarreau26f4a042013-12-04 23:44:10 +0100767 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH;
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100768 goto fail;
769
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200770 fail:
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200771 conn->flags |= CO_FL_ERROR;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200772 return 0;
773}
774
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100775/* This handshake handler waits a NetScaler Client IP insertion header
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000776 * at the beginning of the raw data stream. The header format is
777 * described in doc/netscaler-client-ip-insertion-protocol.txt
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100778 *
779 * This line MUST be at the beginning of the buffer and MUST NOT be
780 * fragmented.
781 *
782 * The header line is small and in all cases smaller than the smallest normal
783 * TCP MSS. So it MUST always be delivered as one segment, which ensures we
784 * can safely use MSG_PEEK and avoid buffering.
785 *
786 * Once the data is fetched, the values are set in the connection's address
787 * fields, and data are removed from the socket's buffer. The function returns
788 * zero if it needs to wait for more data or if it fails, or 1 if it completed
789 * and removed itself.
790 */
791int conn_recv_netscaler_cip(struct connection *conn, int flag)
792{
793 char *line;
Bertrand Jacquin7d668f92017-12-13 01:23:39 +0000794 uint32_t hdr_len;
Willy Tarreau0ca24aa2019-03-29 17:35:32 +0100795 uint8_t ip_ver;
Willy Tarreaub406b872018-08-22 05:20:32 +0200796 int ret;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100797
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100798 if (!conn_ctrl_ready(conn))
799 goto fail;
800
Olivier Houchard1a9dbe52020-01-22 15:31:09 +0100801 if (!sockaddr_alloc(&conn->src) || !sockaddr_alloc(&conn->dst))
802 goto fail;
803
Willy Tarreau585744b2017-08-24 14:31:19 +0200804 if (!fd_recv_ready(conn->handle.fd))
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200805 goto not_ready;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100806
Willy Tarreau157788c2020-02-11 10:08:05 +0100807 while (1) {
Willy Tarreaub406b872018-08-22 05:20:32 +0200808 ret = recv(conn->handle.fd, trash.area, trash.size, MSG_PEEK);
809 if (ret < 0) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100810 if (errno == EINTR)
811 continue;
812 if (errno == EAGAIN) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200813 fd_cant_recv(conn->handle.fd);
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200814 goto not_ready;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100815 }
816 goto recv_abort;
817 }
Willy Tarreaub406b872018-08-22 05:20:32 +0200818 trash.data = ret;
Willy Tarreau157788c2020-02-11 10:08:05 +0100819 break;
820 }
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100821
Willy Tarreauc192b0a2020-01-23 09:11:58 +0100822 conn->flags &= ~CO_FL_WAIT_L4_CONN;
823
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200824 if (!trash.data) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100825 /* client shutdown */
826 conn->err_code = CO_ER_CIP_EMPTY;
827 goto fail;
828 }
829
830 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000831 * CIP magic, header length or
832 * CIP magic, CIP length, CIP type, header length */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200833 if (trash.data < 12)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100834 goto missing;
835
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200836 line = trash.area;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100837
838 /* Decode a possible NetScaler Client IP request, fail early if
839 * it does not match */
Willy Tarreau55e0da62018-09-20 11:26:52 +0200840 if (ntohl(*(uint32_t *)line) != __objt_listener(conn->target)->bind_conf->ns_cip_magic)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100841 goto bad_magic;
842
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000843 /* Legacy CIP protocol */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200844 if ((trash.area[8] & 0xD0) == 0x40) {
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000845 hdr_len = ntohl(*(uint32_t *)(line+4));
846 line += 8;
847 }
848 /* Standard CIP protocol */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200849 else if (trash.area[8] == 0x00) {
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000850 hdr_len = ntohs(*(uint32_t *)(line+10));
851 line += 12;
852 }
853 /* Unknown CIP protocol */
854 else {
855 conn->err_code = CO_ER_CIP_BAD_PROTO;
856 goto fail;
857 }
858
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100859 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000860 * a minimal IP header */
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200861 if (trash.data < 20)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100862 goto missing;
863
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100864 /* Get IP version from the first four bits */
Willy Tarreau0ca24aa2019-03-29 17:35:32 +0100865 ip_ver = (*line & 0xf0) >> 4;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100866
Willy Tarreau0ca24aa2019-03-29 17:35:32 +0100867 if (ip_ver == 4) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100868 struct ip *hdr_ip4;
David Carlier3015a2e2016-07-04 22:51:33 +0100869 struct my_tcphdr *hdr_tcp;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100870
871 hdr_ip4 = (struct ip *)line;
872
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200873 if (trash.data < 40 || trash.data < hdr_len) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100874 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin67de5a22017-12-13 01:15:05 +0000875 * IPv4 header, TCP header */
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100876 goto missing;
Bertrand Jacquinb3875912017-12-13 00:58:51 +0000877 }
878 else if (hdr_ip4->ip_p != IPPROTO_TCP) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100879 /* The protocol does not include a TCP header */
880 conn->err_code = CO_ER_CIP_BAD_PROTO;
881 goto fail;
Bertrand Jacquinb3875912017-12-13 00:58:51 +0000882 }
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100883
David Carlier3015a2e2016-07-04 22:51:33 +0100884 hdr_tcp = (struct my_tcphdr *)(line + (hdr_ip4->ip_hl * 4));
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100885
886 /* update the session's addresses and mark them set */
Willy Tarreau226572f2019-07-17 14:46:00 +0200887 ((struct sockaddr_in *)conn->src)->sin_family = AF_INET;
888 ((struct sockaddr_in *)conn->src)->sin_addr.s_addr = hdr_ip4->ip_src.s_addr;
889 ((struct sockaddr_in *)conn->src)->sin_port = hdr_tcp->source;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100890
Willy Tarreau226572f2019-07-17 14:46:00 +0200891 ((struct sockaddr_in *)conn->dst)->sin_family = AF_INET;
892 ((struct sockaddr_in *)conn->dst)->sin_addr.s_addr = hdr_ip4->ip_dst.s_addr;
893 ((struct sockaddr_in *)conn->dst)->sin_port = hdr_tcp->dest;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100894
895 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
896 }
Willy Tarreau0ca24aa2019-03-29 17:35:32 +0100897 else if (ip_ver == 6) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100898 struct ip6_hdr *hdr_ip6;
David Carlier3015a2e2016-07-04 22:51:33 +0100899 struct my_tcphdr *hdr_tcp;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100900
901 hdr_ip6 = (struct ip6_hdr *)line;
902
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200903 if (trash.data < 60 || trash.data < hdr_len) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100904 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin67de5a22017-12-13 01:15:05 +0000905 * IPv6 header, TCP header */
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100906 goto missing;
Bertrand Jacquinb3875912017-12-13 00:58:51 +0000907 }
908 else if (hdr_ip6->ip6_nxt != IPPROTO_TCP) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100909 /* The protocol does not include a TCP header */
910 conn->err_code = CO_ER_CIP_BAD_PROTO;
911 goto fail;
Bertrand Jacquinb3875912017-12-13 00:58:51 +0000912 }
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100913
David Carlier3015a2e2016-07-04 22:51:33 +0100914 hdr_tcp = (struct my_tcphdr *)(line + sizeof(struct ip6_hdr));
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100915
916 /* update the session's addresses and mark them set */
Willy Tarreau226572f2019-07-17 14:46:00 +0200917 ((struct sockaddr_in6 *)conn->src)->sin6_family = AF_INET6;
918 ((struct sockaddr_in6 *)conn->src)->sin6_addr = hdr_ip6->ip6_src;
919 ((struct sockaddr_in6 *)conn->src)->sin6_port = hdr_tcp->source;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100920
Willy Tarreau226572f2019-07-17 14:46:00 +0200921 ((struct sockaddr_in6 *)conn->dst)->sin6_family = AF_INET6;
922 ((struct sockaddr_in6 *)conn->dst)->sin6_addr = hdr_ip6->ip6_dst;
923 ((struct sockaddr_in6 *)conn->dst)->sin6_port = hdr_tcp->dest;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100924
925 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
926 }
927 else {
928 /* The protocol does not match something known (IPv4/IPv6) */
929 conn->err_code = CO_ER_CIP_BAD_PROTO;
930 goto fail;
931 }
932
Bertrand Jacquin7d668f92017-12-13 01:23:39 +0000933 line += hdr_len;
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200934 trash.data = line - trash.area;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100935
936 /* remove the NetScaler Client IP header from the request. For this
937 * we re-read the exact line at once. If we don't get the exact same
938 * result, we fail.
939 */
Willy Tarreau157788c2020-02-11 10:08:05 +0100940 while (1) {
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200941 int len2 = recv(conn->handle.fd, trash.area, trash.data, 0);
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100942 if (len2 < 0 && errno == EINTR)
943 continue;
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200944 if (len2 != trash.data)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100945 goto recv_abort;
Willy Tarreau157788c2020-02-11 10:08:05 +0100946 break;
947 }
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100948
949 conn->flags &= ~flag;
950 return 1;
951
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200952 not_ready:
Willy Tarreau6499b9d2019-06-03 08:17:30 +0200953 return 0;
954
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100955 missing:
956 /* Missing data. Since we're using MSG_PEEK, we can only poll again if
957 * we have not read anything. Otherwise we need to fail because we won't
958 * be able to poll anymore.
959 */
960 conn->err_code = CO_ER_CIP_TRUNCATED;
961 goto fail;
962
963 bad_magic:
964 conn->err_code = CO_ER_CIP_BAD_MAGIC;
965 goto fail;
966
967 recv_abort:
968 conn->err_code = CO_ER_CIP_ABORT;
969 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH;
970 goto fail;
971
972 fail:
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100973 conn->flags |= CO_FL_ERROR;
974 return 0;
975}
976
Alexander Liu2a54bb72019-05-22 19:44:48 +0800977
978int conn_send_socks4_proxy_request(struct connection *conn)
979{
980 struct socks4_request req_line;
981
Alexander Liu2a54bb72019-05-22 19:44:48 +0800982 if (!conn_ctrl_ready(conn))
983 goto out_error;
984
Willy Tarreau226572f2019-07-17 14:46:00 +0200985 if (!conn_get_dst(conn))
986 goto out_error;
987
Alexander Liu2a54bb72019-05-22 19:44:48 +0800988 req_line.version = 0x04;
989 req_line.command = 0x01;
Willy Tarreau226572f2019-07-17 14:46:00 +0200990 req_line.port = get_net_port(conn->dst);
991 req_line.ip = is_inet_addr(conn->dst);
Alexander Liu2a54bb72019-05-22 19:44:48 +0800992 memcpy(req_line.user_id, "HAProxy\0", 8);
993
994 if (conn->send_proxy_ofs > 0) {
995 /*
996 * This is the first call to send the request
997 */
998 conn->send_proxy_ofs = -(int)sizeof(req_line);
999 }
1000
1001 if (conn->send_proxy_ofs < 0) {
1002 int ret = 0;
1003
1004 /* we are sending the socks4_req_line here. If the data layer
1005 * has a pending write, we'll also set MSG_MORE.
1006 */
1007 ret = conn_sock_send(
1008 conn,
1009 ((char *)(&req_line)) + (sizeof(req_line)+conn->send_proxy_ofs),
1010 -conn->send_proxy_ofs,
Willy Tarreau19bc2012020-02-21 08:46:19 +01001011 (conn->subs && conn->subs->events & SUB_RETRY_SEND) ? MSG_MORE : 0);
Alexander Liu2a54bb72019-05-22 19:44:48 +08001012
1013 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Before send remain is [%d], sent [%d]\n",
1014 conn->handle.fd, -conn->send_proxy_ofs, ret);
1015
1016 if (ret < 0) {
1017 goto out_error;
1018 }
1019
1020 conn->send_proxy_ofs += ret; /* becomes zero once complete */
1021 if (conn->send_proxy_ofs != 0) {
1022 goto out_wait;
1023 }
1024 }
1025
1026 /* OK we've the whole request sent */
1027 conn->flags &= ~CO_FL_SOCKS4_SEND;
Alexander Liu2a54bb72019-05-22 19:44:48 +08001028
1029 /* The connection is ready now, simply return and let the connection
1030 * handler notify upper layers if needed.
1031 */
Willy Tarreauc192b0a2020-01-23 09:11:58 +01001032 conn->flags &= ~CO_FL_WAIT_L4_CONN;
Alexander Liu2a54bb72019-05-22 19:44:48 +08001033
1034 if (conn->flags & CO_FL_SEND_PROXY) {
1035 /*
1036 * Get the send_proxy_ofs ready for the send_proxy due to we are
1037 * reusing the "send_proxy_ofs", and SOCKS4 handshake should be done
1038 * before sending PROXY Protocol.
1039 */
1040 conn->send_proxy_ofs = 1;
1041 }
1042 return 1;
1043
1044 out_error:
1045 /* Write error on the file descriptor */
1046 conn->flags |= CO_FL_ERROR;
1047 if (conn->err_code == CO_ER_NONE) {
1048 conn->err_code = CO_ER_SOCKS4_SEND;
1049 }
1050 return 0;
1051
1052 out_wait:
Alexander Liu2a54bb72019-05-22 19:44:48 +08001053 return 0;
1054}
1055
1056int conn_recv_socks4_proxy_response(struct connection *conn)
1057{
1058 char line[SOCKS4_HS_RSP_LEN];
1059 int ret;
1060
Alexander Liu2a54bb72019-05-22 19:44:48 +08001061 if (!conn_ctrl_ready(conn))
1062 goto fail;
1063
1064 if (!fd_recv_ready(conn->handle.fd))
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001065 goto not_ready;
Alexander Liu2a54bb72019-05-22 19:44:48 +08001066
Willy Tarreau157788c2020-02-11 10:08:05 +01001067 while (1) {
Alexander Liu2a54bb72019-05-22 19:44:48 +08001068 /* SOCKS4 Proxy will response with 8 bytes, 0x00 | 0x5A | 0x00 0x00 | 0x00 0x00 0x00 0x00
1069 * Try to peek into it, before all 8 bytes ready.
1070 */
1071 ret = recv(conn->handle.fd, line, SOCKS4_HS_RSP_LEN, MSG_PEEK);
1072
1073 if (ret == 0) {
1074 /* the socket has been closed or shutdown for send */
1075 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Received ret[%d], errno[%d], looks like the socket has been closed or shutdown for send\n",
1076 conn->handle.fd, ret, errno);
1077 if (conn->err_code == CO_ER_NONE) {
1078 conn->err_code = CO_ER_SOCKS4_RECV;
1079 }
1080 goto fail;
1081 }
1082
1083 if (ret > 0) {
1084 if (ret == SOCKS4_HS_RSP_LEN) {
1085 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Received 8 bytes, the response is [%02X|%02X|%02X %02X|%02X %02X %02X %02X]\n",
1086 conn->handle.fd, line[0], line[1], line[2], line[3], line[4], line[5], line[6], line[7]);
1087 }else{
1088 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Received ret[%d], first byte is [%02X], last bye is [%02X]\n", conn->handle.fd, ret, line[0], line[ret-1]);
1089 }
1090 } else {
1091 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: Received ret[%d], errno[%d]\n", conn->handle.fd, ret, errno);
1092 }
1093
1094 if (ret < 0) {
1095 if (errno == EINTR) {
1096 continue;
1097 }
1098 if (errno == EAGAIN) {
1099 fd_cant_recv(conn->handle.fd);
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001100 goto not_ready;
Alexander Liu2a54bb72019-05-22 19:44:48 +08001101 }
1102 goto recv_abort;
1103 }
Willy Tarreau157788c2020-02-11 10:08:05 +01001104 break;
1105 }
Alexander Liu2a54bb72019-05-22 19:44:48 +08001106
Willy Tarreauc192b0a2020-01-23 09:11:58 +01001107 conn->flags &= ~CO_FL_WAIT_L4_CONN;
1108
Alexander Liu2a54bb72019-05-22 19:44:48 +08001109 if (ret < SOCKS4_HS_RSP_LEN) {
1110 /* Missing data. Since we're using MSG_PEEK, we can only poll again if
1111 * we are not able to read enough data.
1112 */
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001113 goto not_ready;
Alexander Liu2a54bb72019-05-22 19:44:48 +08001114 }
1115
1116 /*
1117 * Base on the SOCSK4 protocol:
1118 *
1119 * +----+----+----+----+----+----+----+----+
1120 * | VN | CD | DSTPORT | DSTIP |
1121 * +----+----+----+----+----+----+----+----+
1122 * # of bytes: 1 1 2 4
1123 * VN is the version of the reply code and should be 0. CD is the result
1124 * code with one of the following values:
1125 * 90: request granted
1126 * 91: request rejected or failed
1127 * 92: request rejected becasue SOCKS server cannot connect to identd on the client
1128 * 93: request rejected because the client program and identd report different user-ids
1129 * The remaining fields are ignored.
1130 */
1131 if (line[1] != 90) {
1132 conn->flags &= ~CO_FL_SOCKS4_RECV;
1133
1134 DPRINTF(stderr, "SOCKS PROXY HS FD[%04X]: FAIL, the response is [%02X|%02X|%02X %02X|%02X %02X %02X %02X]\n",
1135 conn->handle.fd, line[0], line[1], line[2], line[3], line[4], line[5], line[6], line[7]);
1136 if (conn->err_code == CO_ER_NONE) {
1137 conn->err_code = CO_ER_SOCKS4_DENY;
1138 }
1139 goto fail;
1140 }
1141
1142 /* remove the 8 bytes response from the stream */
Willy Tarreau157788c2020-02-11 10:08:05 +01001143 while (1) {
Alexander Liu2a54bb72019-05-22 19:44:48 +08001144 ret = recv(conn->handle.fd, line, SOCKS4_HS_RSP_LEN, 0);
1145 if (ret < 0 && errno == EINTR) {
1146 continue;
1147 }
1148 if (ret != SOCKS4_HS_RSP_LEN) {
1149 if (conn->err_code == CO_ER_NONE) {
1150 conn->err_code = CO_ER_SOCKS4_RECV;
1151 }
1152 goto fail;
1153 }
Willy Tarreau157788c2020-02-11 10:08:05 +01001154 break;
1155 }
Alexander Liu2a54bb72019-05-22 19:44:48 +08001156
1157 conn->flags &= ~CO_FL_SOCKS4_RECV;
1158 return 1;
1159
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001160 not_ready:
Willy Tarreau6499b9d2019-06-03 08:17:30 +02001161 return 0;
1162
Alexander Liu2a54bb72019-05-22 19:44:48 +08001163 recv_abort:
1164 if (conn->err_code == CO_ER_NONE) {
1165 conn->err_code = CO_ER_SOCKS4_ABORT;
1166 }
1167 conn->flags |= (CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH);
1168 goto fail;
1169
1170 fail:
Alexander Liu2a54bb72019-05-22 19:44:48 +08001171 conn->flags |= CO_FL_ERROR;
1172 return 0;
1173}
1174
Ilya Shipitsinca56fce2018-09-15 00:50:05 +05001175/* Note: <remote> is explicitly allowed to be NULL */
David Safb76832014-05-08 23:42:08 -04001176int make_proxy_line(char *buf, int buf_len, struct server *srv, struct connection *remote)
1177{
1178 int ret = 0;
1179
1180 if (srv && (srv->pp_opts & SRV_PP_V2)) {
1181 ret = make_proxy_line_v2(buf, buf_len, srv, remote);
1182 }
1183 else {
Willy Tarreau226572f2019-07-17 14:46:00 +02001184 if (remote && conn_get_src(remote) && conn_get_dst(remote))
1185 ret = make_proxy_line_v1(buf, buf_len, remote->src, remote->dst);
David Safb76832014-05-08 23:42:08 -04001186 else
1187 ret = make_proxy_line_v1(buf, buf_len, NULL, NULL);
1188 }
1189
1190 return ret;
1191}
1192
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001193/* Makes a PROXY protocol line from the two addresses. The output is sent to
1194 * buffer <buf> for a maximum size of <buf_len> (including the trailing zero).
1195 * It returns the number of bytes composing this line (including the trailing
1196 * LF), or zero in case of failure (eg: not enough space). It supports TCP4,
Willy Tarreau2e1401a2013-10-01 11:41:55 +02001197 * TCP6 and "UNKNOWN" formats. If any of <src> or <dst> is null, UNKNOWN is
1198 * emitted as well.
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001199 */
David Safb76832014-05-08 23:42:08 -04001200int make_proxy_line_v1(char *buf, int buf_len, struct sockaddr_storage *src, struct sockaddr_storage *dst)
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001201{
1202 int ret = 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001203 char * protocol;
1204 char src_str[MAX(INET_ADDRSTRLEN, INET6_ADDRSTRLEN)];
1205 char dst_str[MAX(INET_ADDRSTRLEN, INET6_ADDRSTRLEN)];
1206 in_port_t src_port;
1207 in_port_t dst_port;
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001208
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001209 if ( !src
1210 || !dst
1211 || (src->ss_family != AF_INET && src->ss_family != AF_INET6)
1212 || (dst->ss_family != AF_INET && dst->ss_family != AF_INET6)) {
1213 /* unknown family combination */
1214 ret = snprintf(buf, buf_len, "PROXY UNKNOWN\r\n");
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001215 if (ret >= buf_len)
1216 return 0;
1217
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001218 return ret;
1219 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001220
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001221 /* IPv4 for both src and dst */
1222 if (src->ss_family == AF_INET && dst->ss_family == AF_INET) {
1223 protocol = "TCP4";
1224 if (!inet_ntop(AF_INET, &((struct sockaddr_in *)src)->sin_addr, src_str, sizeof(src_str)))
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001225 return 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001226 src_port = ((struct sockaddr_in *)src)->sin_port;
1227 if (!inet_ntop(AF_INET, &((struct sockaddr_in *)dst)->sin_addr, dst_str, sizeof(dst_str)))
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001228 return 0;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001229 dst_port = ((struct sockaddr_in *)dst)->sin_port;
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001230 }
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001231 /* IPv6 for at least one of src and dst */
1232 else {
1233 struct in6_addr tmp;
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001234
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001235 protocol = "TCP6";
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001236
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001237 if (src->ss_family == AF_INET) {
1238 /* Convert src to IPv6 */
1239 v4tov6(&tmp, &((struct sockaddr_in *)src)->sin_addr);
1240 src_port = ((struct sockaddr_in *)src)->sin_port;
1241 }
1242 else {
1243 tmp = ((struct sockaddr_in6 *)src)->sin6_addr;
1244 src_port = ((struct sockaddr_in6 *)src)->sin6_port;
1245 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001246
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001247 if (!inet_ntop(AF_INET6, &tmp, src_str, sizeof(src_str)))
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001248 return 0;
1249
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001250 if (dst->ss_family == AF_INET) {
1251 /* Convert dst to IPv6 */
1252 v4tov6(&tmp, &((struct sockaddr_in *)dst)->sin_addr);
1253 dst_port = ((struct sockaddr_in *)dst)->sin_port;
1254 }
1255 else {
1256 tmp = ((struct sockaddr_in6 *)dst)->sin6_addr;
1257 dst_port = ((struct sockaddr_in6 *)dst)->sin6_port;
1258 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001259
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001260 if (!inet_ntop(AF_INET6, &tmp, dst_str, sizeof(dst_str)))
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001261 return 0;
1262 }
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001263
1264 ret = snprintf(buf, buf_len, "PROXY %s %s %s %u %u\r\n", protocol, src_str, dst_str, ntohs(src_port), ntohs(dst_port));
1265 if (ret >= buf_len)
1266 return 0;
1267
Willy Tarreaue1e4a612012-10-05 00:10:55 +02001268 return ret;
1269}
David Safb76832014-05-08 23:42:08 -04001270
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001271static int make_tlv(char *dest, int dest_len, char type, uint16_t length, const char *value)
David Safb76832014-05-08 23:42:08 -04001272{
1273 struct tlv *tlv;
1274
1275 if (!dest || (length + sizeof(*tlv) > dest_len))
1276 return 0;
1277
1278 tlv = (struct tlv *)dest;
1279
1280 tlv->type = type;
1281 tlv->length_hi = length >> 8;
1282 tlv->length_lo = length & 0x00ff;
1283 memcpy(tlv->value, value, length);
1284 return length + sizeof(*tlv);
1285}
David Safb76832014-05-08 23:42:08 -04001286
Ilya Shipitsinca56fce2018-09-15 00:50:05 +05001287/* Note: <remote> is explicitly allowed to be NULL */
David Safb76832014-05-08 23:42:08 -04001288int make_proxy_line_v2(char *buf, int buf_len, struct server *srv, struct connection *remote)
1289{
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001290 const char pp2_signature[] = PP2_SIGNATURE;
Emmanuel Hocdet4399c752018-02-05 15:26:43 +01001291 void *tlv_crc32c_p = NULL;
David Safb76832014-05-08 23:42:08 -04001292 int ret = 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001293 struct proxy_hdr_v2 *hdr = (struct proxy_hdr_v2 *)buf;
Vincent Bernat6e615892016-05-18 16:17:44 +02001294 struct sockaddr_storage null_addr = { .ss_family = 0 };
David Safb76832014-05-08 23:42:08 -04001295 struct sockaddr_storage *src = &null_addr;
1296 struct sockaddr_storage *dst = &null_addr;
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001297 const char *value;
1298 int value_len;
David Safb76832014-05-08 23:42:08 -04001299
1300 if (buf_len < PP2_HEADER_LEN)
1301 return 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001302 memcpy(hdr->sig, pp2_signature, PP2_SIGNATURE_LEN);
David Safb76832014-05-08 23:42:08 -04001303
Willy Tarreau226572f2019-07-17 14:46:00 +02001304 if (remote && conn_get_src(remote) && conn_get_dst(remote)) {
1305 src = remote->src;
1306 dst = remote->dst;
David Safb76832014-05-08 23:42:08 -04001307 }
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001308
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001309 /* At least one of src or dst is not of AF_INET or AF_INET6 */
1310 if ( !src
1311 || !dst
1312 || (src->ss_family != AF_INET && src->ss_family != AF_INET6)
1313 || (dst->ss_family != AF_INET && dst->ss_family != AF_INET6)) {
David Safb76832014-05-08 23:42:08 -04001314 if (buf_len < PP2_HDR_LEN_UNSPEC)
1315 return 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001316 hdr->ver_cmd = PP2_VERSION | PP2_CMD_LOCAL;
1317 hdr->fam = PP2_FAM_UNSPEC | PP2_TRANS_UNSPEC;
David Safb76832014-05-08 23:42:08 -04001318 ret = PP2_HDR_LEN_UNSPEC;
1319 }
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001320 else {
1321 /* IPv4 for both src and dst */
1322 if (src->ss_family == AF_INET && dst->ss_family == AF_INET) {
1323 if (buf_len < PP2_HDR_LEN_INET)
1324 return 0;
1325 hdr->ver_cmd = PP2_VERSION | PP2_CMD_PROXY;
1326 hdr->fam = PP2_FAM_INET | PP2_TRANS_STREAM;
1327 hdr->addr.ip4.src_addr = ((struct sockaddr_in *)src)->sin_addr.s_addr;
1328 hdr->addr.ip4.src_port = ((struct sockaddr_in *)src)->sin_port;
1329 hdr->addr.ip4.dst_addr = ((struct sockaddr_in *)dst)->sin_addr.s_addr;
1330 hdr->addr.ip4.dst_port = ((struct sockaddr_in *)dst)->sin_port;
1331 ret = PP2_HDR_LEN_INET;
1332 }
1333 /* IPv6 for at least one of src and dst */
1334 else {
1335 struct in6_addr tmp;
1336
1337 if (buf_len < PP2_HDR_LEN_INET6)
1338 return 0;
1339 hdr->ver_cmd = PP2_VERSION | PP2_CMD_PROXY;
1340 hdr->fam = PP2_FAM_INET6 | PP2_TRANS_STREAM;
1341 if (src->ss_family == AF_INET) {
1342 v4tov6(&tmp, &((struct sockaddr_in *)src)->sin_addr);
1343 memcpy(hdr->addr.ip6.src_addr, &tmp, 16);
1344 hdr->addr.ip6.src_port = ((struct sockaddr_in *)src)->sin_port;
1345 }
1346 else {
1347 memcpy(hdr->addr.ip6.src_addr, &((struct sockaddr_in6 *)src)->sin6_addr, 16);
1348 hdr->addr.ip6.src_port = ((struct sockaddr_in6 *)src)->sin6_port;
1349 }
1350 if (dst->ss_family == AF_INET) {
1351 v4tov6(&tmp, &((struct sockaddr_in *)dst)->sin_addr);
1352 memcpy(hdr->addr.ip6.dst_addr, &tmp, 16);
William Dauchybd8bf672020-01-26 19:06:39 +01001353 hdr->addr.ip6.dst_port = ((struct sockaddr_in *)dst)->sin_port;
Tim Duesterhus7fec0212018-07-27 18:46:13 +02001354 }
1355 else {
1356 memcpy(hdr->addr.ip6.dst_addr, &((struct sockaddr_in6 *)dst)->sin6_addr, 16);
1357 hdr->addr.ip6.dst_port = ((struct sockaddr_in6 *)dst)->sin6_port;
1358 }
1359
1360 ret = PP2_HDR_LEN_INET6;
1361 }
1362 }
David Safb76832014-05-08 23:42:08 -04001363
Emmanuel Hocdet4399c752018-02-05 15:26:43 +01001364 if (srv->pp_opts & SRV_PP_V2_CRC32C) {
1365 uint32_t zero_crc32c = 0;
1366 if ((buf_len - ret) < sizeof(struct tlv))
1367 return 0;
1368 tlv_crc32c_p = (void *)((struct tlv *)&buf[ret])->value;
1369 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_CRC32C, sizeof(zero_crc32c), (const char *)&zero_crc32c);
1370 }
1371
Ilya Shipitsinca56fce2018-09-15 00:50:05 +05001372 if (remote && conn_get_alpn(remote, &value, &value_len)) {
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001373 if ((buf_len - ret) < sizeof(struct tlv))
1374 return 0;
Emmanuel Hocdet571c7ac2017-10-31 18:24:05 +01001375 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_ALPN, value_len, value);
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001376 }
1377
Emmanuel Hocdet253c3b72018-02-01 18:29:59 +01001378 if (srv->pp_opts & SRV_PP_V2_AUTHORITY) {
Emmanuel Hocdet8a4ffa02019-08-29 11:54:51 +02001379 value = NULL;
1380 if (remote && remote->proxy_authority) {
1381 value = remote->proxy_authority;
1382 value_len = remote->proxy_authority_len;
1383 }
1384#ifdef USE_OPENSSL
1385 else {
Jerome Magnin78891c72019-09-02 09:53:41 +02001386 if ((value = ssl_sock_get_sni(remote)))
Emmanuel Hocdet8a4ffa02019-08-29 11:54:51 +02001387 value_len = strlen(value);
1388 }
1389#endif
Emmanuel Hocdet253c3b72018-02-01 18:29:59 +01001390 if (value) {
1391 if ((buf_len - ret) < sizeof(struct tlv))
1392 return 0;
Emmanuel Hocdet8a4ffa02019-08-29 11:54:51 +02001393 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_AUTHORITY, value_len, value);
Emmanuel Hocdet253c3b72018-02-01 18:29:59 +01001394 }
1395 }
1396
Emmanuel Hocdet8a4ffa02019-08-29 11:54:51 +02001397#ifdef USE_OPENSSL
David Safb76832014-05-08 23:42:08 -04001398 if (srv->pp_opts & SRV_PP_V2_SSL) {
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001399 struct tlv_ssl *tlv;
1400 int ssl_tlv_len = 0;
David Safb76832014-05-08 23:42:08 -04001401 if ((buf_len - ret) < sizeof(struct tlv_ssl))
1402 return 0;
1403 tlv = (struct tlv_ssl *)&buf[ret];
1404 memset(tlv, 0, sizeof(struct tlv_ssl));
1405 ssl_tlv_len += sizeof(struct tlv_ssl);
1406 tlv->tlv.type = PP2_TYPE_SSL;
1407 if (ssl_sock_is_ssl(remote)) {
1408 tlv->client |= PP2_CLIENT_SSL;
Emmanuel Hocdet01da5712017-10-13 16:59:49 +02001409 value = ssl_sock_get_proto_version(remote);
David Safb76832014-05-08 23:42:08 -04001410 if (value) {
Emmanuel Hocdet8c0c34b2018-02-28 12:02:14 +01001411 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len-ret-ssl_tlv_len), PP2_SUBTYPE_SSL_VERSION, strlen(value), value);
David Safb76832014-05-08 23:42:08 -04001412 }
Dave McCowan328fb582014-07-30 10:39:13 -04001413 if (ssl_sock_get_cert_used_sess(remote)) {
1414 tlv->client |= PP2_CLIENT_CERT_SESS;
David Safb76832014-05-08 23:42:08 -04001415 tlv->verify = htonl(ssl_sock_get_verify_result(remote));
Dave McCowan328fb582014-07-30 10:39:13 -04001416 if (ssl_sock_get_cert_used_conn(remote))
1417 tlv->client |= PP2_CLIENT_CERT_CONN;
David Safb76832014-05-08 23:42:08 -04001418 }
1419 if (srv->pp_opts & SRV_PP_V2_SSL_CN) {
Willy Tarreau83061a82018-07-13 11:56:34 +02001420 struct buffer *cn_trash = get_trash_chunk();
Willy Tarreau3b9a0c92014-07-19 06:37:33 +02001421 if (ssl_sock_get_remote_common_name(remote, cn_trash) > 0) {
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001422 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_CN,
1423 cn_trash->data,
1424 cn_trash->area);
David Safb76832014-05-08 23:42:08 -04001425 }
1426 }
Emmanuel Hocdetfa8d0f12018-02-01 15:53:52 +01001427 if (srv->pp_opts & SRV_PP_V2_SSL_KEY_ALG) {
Willy Tarreau83061a82018-07-13 11:56:34 +02001428 struct buffer *pkey_trash = get_trash_chunk();
Emmanuel Hocdetfa8d0f12018-02-01 15:53:52 +01001429 if (ssl_sock_get_pkey_algo(remote, pkey_trash) > 0) {
Willy Tarreau843b7cb2018-07-13 10:54:26 +02001430 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_KEY_ALG,
1431 pkey_trash->data,
1432 pkey_trash->area);
Emmanuel Hocdetfa8d0f12018-02-01 15:53:52 +01001433 }
1434 }
1435 if (srv->pp_opts & SRV_PP_V2_SSL_SIG_ALG) {
1436 value = ssl_sock_get_cert_sig(remote);
1437 if (value) {
1438 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_SIG_ALG, strlen(value), value);
1439 }
1440 }
1441 if (srv->pp_opts & SRV_PP_V2_SSL_CIPHER) {
1442 value = ssl_sock_get_cipher_name(remote);
1443 if (value) {
1444 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_CIPHER, strlen(value), value);
1445 }
1446 }
David Safb76832014-05-08 23:42:08 -04001447 }
1448 tlv->tlv.length_hi = (uint16_t)(ssl_tlv_len - sizeof(struct tlv)) >> 8;
1449 tlv->tlv.length_lo = (uint16_t)(ssl_tlv_len - sizeof(struct tlv)) & 0x00ff;
1450 ret += ssl_tlv_len;
1451 }
1452#endif
1453
Willy Tarreaue5733232019-05-22 19:24:06 +02001454#ifdef USE_NS
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001455 if (remote && (remote->proxy_netns)) {
1456 if ((buf_len - ret) < sizeof(struct tlv))
1457 return 0;
Emmanuel Hocdet571c7ac2017-10-31 18:24:05 +01001458 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_NETNS, remote->proxy_netns->name_len, remote->proxy_netns->node.key);
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001459 }
1460#endif
1461
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001462 hdr->len = htons((uint16_t)(ret - PP2_HEADER_LEN));
David Safb76832014-05-08 23:42:08 -04001463
Emmanuel Hocdet4399c752018-02-05 15:26:43 +01001464 if (tlv_crc32c_p) {
1465 write_u32(tlv_crc32c_p, htonl(hash_crc32c(buf, ret)));
1466 }
1467
David Safb76832014-05-08 23:42:08 -04001468 return ret;
1469}
Emeric Brun4f603012017-01-05 15:11:44 +01001470
Willy Tarreau60ca10a2017-08-18 15:26:54 +02001471/* return the major HTTP version as 1 or 2 depending on how the request arrived
1472 * before being processed.
1473 */
1474static int
1475smp_fetch_fc_http_major(const struct arg *args, struct sample *smp, const char *kw, void *private)
1476{
Jérôme Magnin86577422018-12-07 09:03:11 +01001477 struct connection *conn = (kw[0] != 'b') ? objt_conn(smp->sess->origin) :
1478 smp->strm ? cs_conn(objt_cs(smp->strm->si[1].end)) : NULL;
Willy Tarreau60ca10a2017-08-18 15:26:54 +02001479
1480 smp->data.type = SMP_T_SINT;
1481 smp->data.u.sint = (conn && strcmp(conn_get_mux_name(conn), "H2") == 0) ? 2 : 1;
1482 return 1;
1483}
1484
Emeric Brun4f603012017-01-05 15:11:44 +01001485/* fetch if the received connection used a PROXY protocol header */
1486int smp_fetch_fc_rcvd_proxy(const struct arg *args, struct sample *smp, const char *kw, void *private)
1487{
1488 struct connection *conn;
1489
1490 conn = objt_conn(smp->sess->origin);
1491 if (!conn)
1492 return 0;
1493
Willy Tarreau911db9b2020-01-23 16:27:54 +01001494 if (conn->flags & CO_FL_WAIT_XPRT) {
Emeric Brun4f603012017-01-05 15:11:44 +01001495 smp->flags |= SMP_F_MAY_CHANGE;
1496 return 0;
1497 }
1498
1499 smp->flags = 0;
1500 smp->data.type = SMP_T_BOOL;
1501 smp->data.u.sint = (conn->flags & CO_FL_RCVD_PROXY) ? 1 : 0;
1502
1503 return 1;
1504}
1505
Geoff Simmons7185b782019-08-27 18:31:16 +02001506/* fetch the authority TLV from a PROXY protocol header */
1507int smp_fetch_fc_pp_authority(const struct arg *args, struct sample *smp, const char *kw, void *private)
1508{
1509 struct connection *conn;
1510
1511 conn = objt_conn(smp->sess->origin);
1512 if (!conn)
1513 return 0;
1514
Willy Tarreau911db9b2020-01-23 16:27:54 +01001515 if (conn->flags & CO_FL_WAIT_XPRT) {
Geoff Simmons7185b782019-08-27 18:31:16 +02001516 smp->flags |= SMP_F_MAY_CHANGE;
1517 return 0;
1518 }
1519
1520 if (conn->proxy_authority == NULL)
1521 return 0;
1522
1523 smp->flags = 0;
1524 smp->data.type = SMP_T_STR;
1525 smp->data.u.str.area = conn->proxy_authority;
1526 smp->data.u.str.data = conn->proxy_authority_len;
1527
1528 return 1;
1529}
1530
Emeric Brun4f603012017-01-05 15:11:44 +01001531/* Note: must not be declared <const> as its list will be overwritten.
1532 * Note: fetches that may return multiple types must be declared as the lowest
1533 * common denominator, the type that can be casted into all other ones. For
1534 * instance v4/v6 must be declared v4.
1535 */
1536static struct sample_fetch_kw_list sample_fetch_keywords = {ILH, {
Willy Tarreau60ca10a2017-08-18 15:26:54 +02001537 { "fc_http_major", smp_fetch_fc_http_major, 0, NULL, SMP_T_SINT, SMP_USE_L4CLI },
Jérôme Magnin86577422018-12-07 09:03:11 +01001538 { "bc_http_major", smp_fetch_fc_http_major, 0, NULL, SMP_T_SINT, SMP_USE_L4SRV },
Emeric Brun4f603012017-01-05 15:11:44 +01001539 { "fc_rcvd_proxy", smp_fetch_fc_rcvd_proxy, 0, NULL, SMP_T_BOOL, SMP_USE_L4CLI },
Geoff Simmons7185b782019-08-27 18:31:16 +02001540 { "fc_pp_authority", smp_fetch_fc_pp_authority, 0, NULL, SMP_T_STR, SMP_USE_L4CLI },
Emeric Brun4f603012017-01-05 15:11:44 +01001541 { /* END */ },
1542}};
1543
Willy Tarreau0108d902018-11-25 19:14:37 +01001544INITCALL1(STG_REGISTER, sample_register_fetches, &sample_fetch_keywords);