blob: a3dce68b909380da2720428381ae86203fb90f45 [file] [log] [blame]
Willy Tarreau79e57332018-10-02 16:01:16 +02001/*
2 * HTTP actions
3 *
4 * Copyright 2000-2018 Willy Tarreau <w@1wt.eu>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
13#include <sys/types.h>
Christopher Faulet24231ab2020-01-24 17:44:23 +010014#include <sys/stat.h>
15#include <fcntl.h>
Willy Tarreau79e57332018-10-02 16:01:16 +020016
17#include <ctype.h>
18#include <string.h>
19#include <time.h>
20
Christopher Faulet81e20172019-12-12 16:40:30 +010021#include <common/cfgparse.h>
Willy Tarreau79e57332018-10-02 16:01:16 +020022#include <common/chunk.h>
23#include <common/compat.h>
24#include <common/config.h>
25#include <common/debug.h>
26#include <common/http.h>
Willy Tarreau0108d902018-11-25 19:14:37 +010027#include <common/initcall.h>
Willy Tarreau79e57332018-10-02 16:01:16 +020028#include <common/memory.h>
29#include <common/standard.h>
30#include <common/version.h>
31
32#include <types/capture.h>
33#include <types/global.h>
34
35#include <proto/acl.h>
36#include <proto/arg.h>
Christopher Faulet81e20172019-12-12 16:40:30 +010037#include <proto/action.h>
Willy Tarreau61c112a2018-10-02 16:43:32 +020038#include <proto/http_rules.h>
Willy Tarreau33810222019-06-12 17:44:02 +020039#include <proto/http_htx.h>
Willy Tarreau79e57332018-10-02 16:01:16 +020040#include <proto/log.h>
Christopher Fauletfc9cfe42019-07-16 14:54:53 +020041#include <proto/http_ana.h>
Christopher Faulet046cf442019-12-17 15:45:23 +010042#include <proto/pattern.h>
Willy Tarreau0f9cd7b2019-01-31 19:02:43 +010043#include <proto/stream_interface.h>
Willy Tarreau79e57332018-10-02 16:01:16 +020044
Christopher Faulet4a2c1422020-01-31 17:36:01 +010045/* Structure used to build the header list of an HTTP return action */
46struct http_ret_hdr {
47 struct ist name; /* the header name */
48 struct list value; /* the log-format string value */
49 struct list list; /* header chained list */
50};
51
Christopher Faulet2eb53962020-01-14 14:47:34 +010052/* Release memory allocated by most of HTTP actions. Concretly, it releases
53 * <arg.http>.
54 */
55static void release_http_action(struct act_rule *rule)
56{
57 struct logformat_node *lf, *lfb;
58
59 if (rule->arg.http.str.ptr)
60 free(rule->arg.http.str.ptr);
61 if (rule->arg.http.re)
62 regex_free(rule->arg.http.re);
63 list_for_each_entry_safe(lf, lfb, &rule->arg.http.fmt, list) {
64 LIST_DEL(&lf->list);
65 release_sample_expr(lf->expr);
66 free(lf->arg);
67 free(lf);
68 }
69}
70
Willy Tarreau79e57332018-10-02 16:01:16 +020071
72/* This function executes one of the set-{method,path,query,uri} actions. It
73 * builds a string in the trash from the specified format string. It finds
Christopher Faulet2c22a692019-12-18 15:39:56 +010074 * the action to be performed in <.action>, previously filled by function
Willy Tarreau79e57332018-10-02 16:01:16 +020075 * parse_set_req_line(). The replacement action is excuted by the function
Christopher Faulete00d06c2019-12-16 17:18:42 +010076 * http_action_set_req_line(). On success, it returns ACT_RET_CONT. If an error
77 * occurs while soft rewrites are enabled, the action is canceled, but the rule
78 * processing continue. Otherwsize ACT_RET_ERR is returned.
Willy Tarreau79e57332018-10-02 16:01:16 +020079 */
80static enum act_return http_action_set_req_line(struct act_rule *rule, struct proxy *px,
81 struct session *sess, struct stream *s, int flags)
82{
83 struct buffer *replace;
Christopher Faulet13403762019-12-13 09:01:57 +010084 enum act_return ret = ACT_RET_CONT;
Willy Tarreau79e57332018-10-02 16:01:16 +020085
86 replace = alloc_trash_chunk();
87 if (!replace)
Christopher Faulete00d06c2019-12-16 17:18:42 +010088 goto fail_alloc;
Willy Tarreau79e57332018-10-02 16:01:16 +020089
90 /* If we have to create a query string, prepare a '?'. */
Christopher Faulet2c22a692019-12-18 15:39:56 +010091 if (rule->action == 2) // set-query
Willy Tarreau79e57332018-10-02 16:01:16 +020092 replace->area[replace->data++] = '?';
93 replace->data += build_logline(s, replace->area + replace->data,
94 replace->size - replace->data,
Christopher Faulet96bff762019-12-17 13:46:18 +010095 &rule->arg.http.fmt);
Willy Tarreau79e57332018-10-02 16:01:16 +020096
Christopher Faulet2c22a692019-12-18 15:39:56 +010097 if (http_req_replace_stline(rule->action, replace->area, replace->data, px, s) == -1)
Christopher Faulete00d06c2019-12-16 17:18:42 +010098 goto fail_rewrite;
Willy Tarreau79e57332018-10-02 16:01:16 +020099
Christopher Faulete00d06c2019-12-16 17:18:42 +0100100 leave:
Willy Tarreau79e57332018-10-02 16:01:16 +0200101 free_trash_chunk(replace);
102 return ret;
Christopher Faulete00d06c2019-12-16 17:18:42 +0100103
104 fail_alloc:
105 if (!(s->flags & SF_ERR_MASK))
106 s->flags |= SF_ERR_RESOURCE;
107 ret = ACT_RET_ERR;
108 goto leave;
109
110 fail_rewrite:
111 _HA_ATOMIC_ADD(&sess->fe->fe_counters.failed_rewrites, 1);
112 if (s->flags & SF_BE_ASSIGNED)
113 _HA_ATOMIC_ADD(&s->be->be_counters.failed_rewrites, 1);
114 if (sess->listener->counters)
115 _HA_ATOMIC_ADD(&sess->listener->counters->failed_rewrites, 1);
116 if (objt_server(s->target))
117 _HA_ATOMIC_ADD(&__objt_server(s->target)->counters.failed_rewrites, 1);
118
Christopher Faulet333bf8c2020-01-22 14:38:05 +0100119 if (!(s->txn->req.flags & HTTP_MSGF_SOFT_RW)) {
Christopher Faulete00d06c2019-12-16 17:18:42 +0100120 ret = ACT_RET_ERR;
Christopher Faulet333bf8c2020-01-22 14:38:05 +0100121 if (!(s->flags & SF_ERR_MASK))
122 s->flags |= SF_ERR_PRXCOND;
123 }
Christopher Faulete00d06c2019-12-16 17:18:42 +0100124 goto leave;
Willy Tarreau79e57332018-10-02 16:01:16 +0200125}
126
127/* parse an http-request action among :
128 * set-method
129 * set-path
130 * set-query
131 * set-uri
132 *
133 * All of them accept a single argument of type string representing a log-format.
Christopher Faulet96bff762019-12-17 13:46:18 +0100134 * The resulting rule makes use of <http.fmt> to store the log-format list head,
Christopher Faulet2c22a692019-12-18 15:39:56 +0100135 * and <.action> to store the action type as an int (0=method, 1=path, 2=query,
136 * 3=uri). It returns ACT_RET_PRS_OK on success, ACT_RET_PRS_ERR on error.
Willy Tarreau79e57332018-10-02 16:01:16 +0200137 */
138static enum act_parse_ret parse_set_req_line(const char **args, int *orig_arg, struct proxy *px,
139 struct act_rule *rule, char **err)
140{
141 int cur_arg = *orig_arg;
142
Willy Tarreau79e57332018-10-02 16:01:16 +0200143 switch (args[0][4]) {
144 case 'm' :
Christopher Faulet2c22a692019-12-18 15:39:56 +0100145 rule->action = 0; // set-method
Willy Tarreau79e57332018-10-02 16:01:16 +0200146 break;
147 case 'p' :
Christopher Faulet2c22a692019-12-18 15:39:56 +0100148 rule->action = 1; // set-path
Willy Tarreau79e57332018-10-02 16:01:16 +0200149 break;
150 case 'q' :
Christopher Faulet2c22a692019-12-18 15:39:56 +0100151 rule->action = 2; // set-query
Willy Tarreau79e57332018-10-02 16:01:16 +0200152 break;
153 case 'u' :
Christopher Faulet2c22a692019-12-18 15:39:56 +0100154 rule->action = 3; // set-uri
Willy Tarreau79e57332018-10-02 16:01:16 +0200155 break;
156 default:
157 memprintf(err, "internal error: unhandled action '%s'", args[0]);
158 return ACT_RET_PRS_ERR;
159 }
Christopher Faulet96bff762019-12-17 13:46:18 +0100160 rule->action_ptr = http_action_set_req_line;
Christopher Faulet2eb53962020-01-14 14:47:34 +0100161 rule->release_ptr = release_http_action;
Willy Tarreau79e57332018-10-02 16:01:16 +0200162
163 if (!*args[cur_arg] ||
164 (*args[cur_arg + 1] && strcmp(args[cur_arg + 1], "if") != 0 && strcmp(args[cur_arg + 1], "unless") != 0)) {
165 memprintf(err, "expects exactly 1 argument <format>");
166 return ACT_RET_PRS_ERR;
167 }
168
Christopher Faulet96bff762019-12-17 13:46:18 +0100169 LIST_INIT(&rule->arg.http.fmt);
Willy Tarreau79e57332018-10-02 16:01:16 +0200170 px->conf.args.ctx = ARGC_HRQ;
Christopher Faulet96bff762019-12-17 13:46:18 +0100171 if (!parse_logformat_string(args[cur_arg], px, &rule->arg.http.fmt, LOG_OPT_HTTP,
Willy Tarreau79e57332018-10-02 16:01:16 +0200172 (px->cap & PR_CAP_FE) ? SMP_VAL_FE_HRQ_HDR : SMP_VAL_BE_HRQ_HDR, err)) {
173 return ACT_RET_PRS_ERR;
174 }
175
176 (*orig_arg)++;
177 return ACT_RET_PRS_OK;
178}
179
Willy Tarreau33810222019-06-12 17:44:02 +0200180/* This function executes a replace-uri action. It finds its arguments in
Christopher Faulet96bff762019-12-17 13:46:18 +0100181 * <rule>.arg.http. It builds a string in the trash from the format string
Willy Tarreau33810222019-06-12 17:44:02 +0200182 * previously filled by function parse_replace_uri() and will execute the regex
Christopher Faulet96bff762019-12-17 13:46:18 +0100183 * in <http.re> to replace the URI. It uses the format string present in
Christopher Faulet2c22a692019-12-18 15:39:56 +0100184 * <http.fmt>. The component to act on (path/uri) is taken from <.action> which
Christopher Faulet96bff762019-12-17 13:46:18 +0100185 * contains 1 for the path or 3 for the URI (values used by
186 * http_req_replace_stline()). On success, it returns ACT_RET_CONT. If an error
187 * occurs while soft rewrites are enabled, the action is canceled, but the rule
188 * processing continue. Otherwsize ACT_RET_ERR is returned.
Willy Tarreau33810222019-06-12 17:44:02 +0200189 */
190static enum act_return http_action_replace_uri(struct act_rule *rule, struct proxy *px,
191 struct session *sess, struct stream *s, int flags)
192{
Christopher Faulet13403762019-12-13 09:01:57 +0100193 enum act_return ret = ACT_RET_CONT;
Willy Tarreau33810222019-06-12 17:44:02 +0200194 struct buffer *replace, *output;
195 struct ist uri;
196 int len;
197
198 replace = alloc_trash_chunk();
199 output = alloc_trash_chunk();
200 if (!replace || !output)
Christopher Faulete00d06c2019-12-16 17:18:42 +0100201 goto fail_alloc;
Christopher Faulet12c28b62019-07-15 16:30:24 +0200202 uri = htx_sl_req_uri(http_get_stline(htxbuf(&s->req.buf)));
Willy Tarreau262c3f12019-12-17 06:52:51 +0100203
Christopher Faulet2c22a692019-12-18 15:39:56 +0100204 if (rule->action == 1) // replace-path
Christopher Faulet96bff762019-12-17 13:46:18 +0100205 uri = http_get_path(uri);
Willy Tarreau262c3f12019-12-17 06:52:51 +0100206
Christopher Faulet96bff762019-12-17 13:46:18 +0100207 if (!regex_exec_match2(rule->arg.http.re, uri.ptr, uri.len, MAX_MATCH, pmatch, 0))
Willy Tarreau33810222019-06-12 17:44:02 +0200208 goto leave;
209
Christopher Faulet96bff762019-12-17 13:46:18 +0100210 replace->data = build_logline(s, replace->area, replace->size, &rule->arg.http.fmt);
Willy Tarreau33810222019-06-12 17:44:02 +0200211
212 /* note: uri.ptr doesn't need to be zero-terminated because it will
213 * only be used to pick pmatch references.
214 */
215 len = exp_replace(output->area, output->size, uri.ptr, replace->area, pmatch);
216 if (len == -1)
Christopher Faulete00d06c2019-12-16 17:18:42 +0100217 goto fail_rewrite;
Willy Tarreau33810222019-06-12 17:44:02 +0200218
Christopher Faulet2c22a692019-12-18 15:39:56 +0100219 if (http_req_replace_stline(rule->action, output->area, len, px, s) == -1)
Christopher Faulete00d06c2019-12-16 17:18:42 +0100220 goto fail_rewrite;
Willy Tarreau33810222019-06-12 17:44:02 +0200221
Christopher Faulete00d06c2019-12-16 17:18:42 +0100222 leave:
Willy Tarreau33810222019-06-12 17:44:02 +0200223 free_trash_chunk(output);
224 free_trash_chunk(replace);
225 return ret;
Christopher Faulete00d06c2019-12-16 17:18:42 +0100226
227 fail_alloc:
228 if (!(s->flags & SF_ERR_MASK))
229 s->flags |= SF_ERR_RESOURCE;
230 ret = ACT_RET_ERR;
231 goto leave;
232
233 fail_rewrite:
234 _HA_ATOMIC_ADD(&sess->fe->fe_counters.failed_rewrites, 1);
235 if (s->flags & SF_BE_ASSIGNED)
236 _HA_ATOMIC_ADD(&s->be->be_counters.failed_rewrites, 1);
237 if (sess->listener->counters)
238 _HA_ATOMIC_ADD(&sess->listener->counters->failed_rewrites, 1);
239 if (objt_server(s->target))
240 _HA_ATOMIC_ADD(&__objt_server(s->target)->counters.failed_rewrites, 1);
241
Christopher Faulet333bf8c2020-01-22 14:38:05 +0100242 if (!(s->txn->req.flags & HTTP_MSGF_SOFT_RW)) {
Christopher Faulete00d06c2019-12-16 17:18:42 +0100243 ret = ACT_RET_ERR;
Christopher Faulet333bf8c2020-01-22 14:38:05 +0100244 if (!(s->flags & SF_ERR_MASK))
245 s->flags |= SF_ERR_PRXCOND;
246 }
Christopher Faulete00d06c2019-12-16 17:18:42 +0100247 goto leave;
Willy Tarreau33810222019-06-12 17:44:02 +0200248}
249
Willy Tarreau262c3f12019-12-17 06:52:51 +0100250/* parse a "replace-uri" or "replace-path" http-request action.
Willy Tarreau33810222019-06-12 17:44:02 +0200251 * This action takes 2 arguments (a regex and a replacement format string).
Christopher Faulet2c22a692019-12-18 15:39:56 +0100252 * The resulting rule makes use of <.action> to store the action (1/3 for now),
Christopher Faulet96bff762019-12-17 13:46:18 +0100253 * <http.re> to store the compiled regex, and <http.fmt> to store the log-format
Willy Tarreau33810222019-06-12 17:44:02 +0200254 * list head. It returns ACT_RET_PRS_OK on success, ACT_RET_PRS_ERR on error.
255 */
256static enum act_parse_ret parse_replace_uri(const char **args, int *orig_arg, struct proxy *px,
257 struct act_rule *rule, char **err)
258{
259 int cur_arg = *orig_arg;
260 char *error = NULL;
261
Willy Tarreau262c3f12019-12-17 06:52:51 +0100262 if (strcmp(args[cur_arg-1], "replace-path") == 0)
Christopher Faulet2c22a692019-12-18 15:39:56 +0100263 rule->action = 1; // replace-path, same as set-path
Willy Tarreau262c3f12019-12-17 06:52:51 +0100264 else
Christopher Faulet2c22a692019-12-18 15:39:56 +0100265 rule->action = 3; // replace-uri, same as set-uri
Willy Tarreau262c3f12019-12-17 06:52:51 +0100266
Willy Tarreau33810222019-06-12 17:44:02 +0200267 rule->action_ptr = http_action_replace_uri;
Christopher Faulet2eb53962020-01-14 14:47:34 +0100268 rule->release_ptr = release_http_action;
Willy Tarreau33810222019-06-12 17:44:02 +0200269
270 if (!*args[cur_arg] || !*args[cur_arg+1] ||
271 (*args[cur_arg+2] && strcmp(args[cur_arg+2], "if") != 0 && strcmp(args[cur_arg+2], "unless") != 0)) {
272 memprintf(err, "expects exactly 2 arguments <match-regex> and <replace-format>");
273 return ACT_RET_PRS_ERR;
274 }
275
Christopher Faulet96bff762019-12-17 13:46:18 +0100276 if (!(rule->arg.http.re = regex_comp(args[cur_arg], 1, 1, &error))) {
Willy Tarreau33810222019-06-12 17:44:02 +0200277 memprintf(err, "failed to parse the regex : %s", error);
278 free(error);
279 return ACT_RET_PRS_ERR;
280 }
281
Christopher Faulet96bff762019-12-17 13:46:18 +0100282 LIST_INIT(&rule->arg.http.fmt);
Willy Tarreau33810222019-06-12 17:44:02 +0200283 px->conf.args.ctx = ARGC_HRQ;
Christopher Faulet96bff762019-12-17 13:46:18 +0100284 if (!parse_logformat_string(args[cur_arg + 1], px, &rule->arg.http.fmt, LOG_OPT_HTTP,
Willy Tarreau33810222019-06-12 17:44:02 +0200285 (px->cap & PR_CAP_FE) ? SMP_VAL_FE_HRQ_HDR : SMP_VAL_BE_HRQ_HDR, err)) {
Christopher Faulet1337b322020-01-14 14:50:55 +0100286 regex_free(rule->arg.http.re);
Willy Tarreau33810222019-06-12 17:44:02 +0200287 return ACT_RET_PRS_ERR;
288 }
289
290 (*orig_arg) += 2;
291 return ACT_RET_PRS_OK;
292}
293
Willy Tarreau79e57332018-10-02 16:01:16 +0200294/* This function is just a compliant action wrapper for "set-status". */
295static enum act_return action_http_set_status(struct act_rule *rule, struct proxy *px,
296 struct session *sess, struct stream *s, int flags)
297{
Christopher Faulet96bff762019-12-17 13:46:18 +0100298 if (http_res_set_status(rule->arg.http.i, rule->arg.http.str, s) == -1) {
Christopher Faulete00d06c2019-12-16 17:18:42 +0100299 _HA_ATOMIC_ADD(&sess->fe->fe_counters.failed_rewrites, 1);
300 if (s->flags & SF_BE_ASSIGNED)
301 _HA_ATOMIC_ADD(&s->be->be_counters.failed_rewrites, 1);
302 if (sess->listener->counters)
303 _HA_ATOMIC_ADD(&sess->listener->counters->failed_rewrites, 1);
304 if (objt_server(s->target))
305 _HA_ATOMIC_ADD(&__objt_server(s->target)->counters.failed_rewrites, 1);
306
Christopher Faulet333bf8c2020-01-22 14:38:05 +0100307 if (!(s->txn->req.flags & HTTP_MSGF_SOFT_RW)) {
Christopher Faulet333bf8c2020-01-22 14:38:05 +0100308 if (!(s->flags & SF_ERR_MASK))
309 s->flags |= SF_ERR_PRXCOND;
Christopher Faulet692a6c22020-02-07 10:22:31 +0100310 return ACT_RET_ERR;
Christopher Faulet333bf8c2020-01-22 14:38:05 +0100311 }
Christopher Faulete00d06c2019-12-16 17:18:42 +0100312 }
313
Willy Tarreau79e57332018-10-02 16:01:16 +0200314 return ACT_RET_CONT;
315}
316
317/* parse set-status action:
318 * This action accepts a single argument of type int representing
319 * an http status code. It returns ACT_RET_PRS_OK on success,
320 * ACT_RET_PRS_ERR on error.
321 */
322static enum act_parse_ret parse_http_set_status(const char **args, int *orig_arg, struct proxy *px,
323 struct act_rule *rule, char **err)
324{
325 char *error;
326
327 rule->action = ACT_CUSTOM;
328 rule->action_ptr = action_http_set_status;
Christopher Faulet2eb53962020-01-14 14:47:34 +0100329 rule->release_ptr = release_http_action;
Willy Tarreau79e57332018-10-02 16:01:16 +0200330
331 /* Check if an argument is available */
332 if (!*args[*orig_arg]) {
333 memprintf(err, "expects 1 argument: <status>; or 3 arguments: <status> reason <fmt>");
334 return ACT_RET_PRS_ERR;
335 }
336
337 /* convert status code as integer */
Christopher Faulet96bff762019-12-17 13:46:18 +0100338 rule->arg.http.i = strtol(args[*orig_arg], &error, 10);
339 if (*error != '\0' || rule->arg.http.i < 100 || rule->arg.http.i > 999) {
Willy Tarreau79e57332018-10-02 16:01:16 +0200340 memprintf(err, "expects an integer status code between 100 and 999");
341 return ACT_RET_PRS_ERR;
342 }
343
344 (*orig_arg)++;
345
346 /* set custom reason string */
Christopher Faulet96bff762019-12-17 13:46:18 +0100347 rule->arg.http.str = ist(NULL); // If null, we use the default reason for the status code.
Willy Tarreau79e57332018-10-02 16:01:16 +0200348 if (*args[*orig_arg] && strcmp(args[*orig_arg], "reason") == 0 &&
349 (*args[*orig_arg + 1] && strcmp(args[*orig_arg + 1], "if") != 0 && strcmp(args[*orig_arg + 1], "unless") != 0)) {
350 (*orig_arg)++;
Christopher Faulet96bff762019-12-17 13:46:18 +0100351 rule->arg.http.str.ptr = strdup(args[*orig_arg]);
352 rule->arg.http.str.len = strlen(rule->arg.http.str.ptr);
Willy Tarreau79e57332018-10-02 16:01:16 +0200353 (*orig_arg)++;
354 }
355
Christopher Fauletc20b3712020-01-27 15:51:56 +0100356 LIST_INIT(&rule->arg.http.fmt);
Willy Tarreau79e57332018-10-02 16:01:16 +0200357 return ACT_RET_PRS_OK;
358}
359
360/* This function executes the "reject" HTTP action. It clears the request and
361 * response buffer without sending any response. It can be useful as an HTTP
362 * alternative to the silent-drop action to defend against DoS attacks, and may
363 * also be used with HTTP/2 to close a connection instead of just a stream.
364 * The txn status is unchanged, indicating no response was sent. The termination
Christopher Faulet8f1aa772019-07-04 11:27:15 +0200365 * flags will indicate "PR". It always returns ACT_RET_DONE.
Willy Tarreau79e57332018-10-02 16:01:16 +0200366 */
367static enum act_return http_action_reject(struct act_rule *rule, struct proxy *px,
368 struct session *sess, struct stream *s, int flags)
369{
Willy Tarreau0f9cd7b2019-01-31 19:02:43 +0100370 si_must_kill_conn(chn_prod(&s->req));
Willy Tarreau79e57332018-10-02 16:01:16 +0200371 channel_abort(&s->req);
372 channel_abort(&s->res);
373 s->req.analysers = 0;
374 s->res.analysers = 0;
375
Olivier Houcharda798bf52019-03-08 18:52:00 +0100376 _HA_ATOMIC_ADD(&s->be->be_counters.denied_req, 1);
377 _HA_ATOMIC_ADD(&sess->fe->fe_counters.denied_req, 1);
Willy Tarreau79e57332018-10-02 16:01:16 +0200378 if (sess->listener && sess->listener->counters)
Olivier Houcharda798bf52019-03-08 18:52:00 +0100379 _HA_ATOMIC_ADD(&sess->listener->counters->denied_req, 1);
Willy Tarreau79e57332018-10-02 16:01:16 +0200380
381 if (!(s->flags & SF_ERR_MASK))
382 s->flags |= SF_ERR_PRXCOND;
383 if (!(s->flags & SF_FINST_MASK))
384 s->flags |= SF_FINST_R;
385
Christopher Faulet8f1aa772019-07-04 11:27:15 +0200386 return ACT_RET_DONE;
Willy Tarreau79e57332018-10-02 16:01:16 +0200387}
388
389/* parse the "reject" action:
390 * This action takes no argument and returns ACT_RET_PRS_OK on success,
391 * ACT_RET_PRS_ERR on error.
392 */
393static enum act_parse_ret parse_http_action_reject(const char **args, int *orig_arg, struct proxy *px,
394 struct act_rule *rule, char **err)
395{
396 rule->action = ACT_CUSTOM;
397 rule->action_ptr = http_action_reject;
398 return ACT_RET_PRS_OK;
399}
400
Olivier Houchard602bf7d2019-05-10 13:59:15 +0200401/* This function executes the "disable-l7-retry" HTTP action.
402 * It disables L7 retries (all retry except for a connection failure). This
403 * can be useful for example to avoid retrying on POST requests.
404 * It just removes the L7 retry flag on the stream_interface, and always
405 * return ACT_RET_CONT;
406 */
407static enum act_return http_req_disable_l7_retry(struct act_rule *rule, struct proxy *px,
408 struct session *sess, struct stream *s, int flags)
409{
410 struct stream_interface *si = &s->si[1];
411
412 /* In theory, the SI_FL_L7_RETRY flags isn't set at this point, but
413 * let's be future-proof and remove it anyway.
414 */
415 si->flags &= ~SI_FL_L7_RETRY;
416 si->flags |= SI_FL_D_L7_RETRY;
417 return ACT_RET_CONT;
418}
419
420/* parse the "disable-l7-retry" action:
421 * This action takes no argument and returns ACT_RET_PRS_OK on success,
422 * ACT_RET_PRS_ERR on error.
423 */
424static enum act_parse_ret parse_http_req_disable_l7_retry(const char **args,
425 int *orig_args, struct proxy *px,
426 struct act_rule *rule, char **err)
427{
428 rule->action = ACT_CUSTOM;
429 rule->action_ptr = http_req_disable_l7_retry;
430 return ACT_RET_PRS_OK;
431}
432
Willy Tarreau79e57332018-10-02 16:01:16 +0200433/* This function executes the "capture" action. It executes a fetch expression,
434 * turns the result into a string and puts it in a capture slot. It always
435 * returns 1. If an error occurs the action is cancelled, but the rule
436 * processing continues.
437 */
438static enum act_return http_action_req_capture(struct act_rule *rule, struct proxy *px,
439 struct session *sess, struct stream *s, int flags)
440{
441 struct sample *key;
442 struct cap_hdr *h = rule->arg.cap.hdr;
443 char **cap = s->req_cap;
444 int len;
445
446 key = sample_fetch_as_type(s->be, sess, s, SMP_OPT_DIR_REQ|SMP_OPT_FINAL, rule->arg.cap.expr, SMP_T_STR);
447 if (!key)
448 return ACT_RET_CONT;
449
450 if (cap[h->index] == NULL)
451 cap[h->index] = pool_alloc(h->pool);
452
453 if (cap[h->index] == NULL) /* no more capture memory */
454 return ACT_RET_CONT;
455
456 len = key->data.u.str.data;
457 if (len > h->len)
458 len = h->len;
459
460 memcpy(cap[h->index], key->data.u.str.area, len);
461 cap[h->index][len] = 0;
462 return ACT_RET_CONT;
463}
464
465/* This function executes the "capture" action and store the result in a
466 * capture slot if exists. It executes a fetch expression, turns the result
467 * into a string and puts it in a capture slot. It always returns 1. If an
468 * error occurs the action is cancelled, but the rule processing continues.
469 */
470static enum act_return http_action_req_capture_by_id(struct act_rule *rule, struct proxy *px,
471 struct session *sess, struct stream *s, int flags)
472{
473 struct sample *key;
474 struct cap_hdr *h;
475 char **cap = s->req_cap;
476 struct proxy *fe = strm_fe(s);
477 int len;
478 int i;
479
480 /* Look for the original configuration. */
481 for (h = fe->req_cap, i = fe->nb_req_cap - 1;
482 h != NULL && i != rule->arg.capid.idx ;
483 i--, h = h->next);
484 if (!h)
485 return ACT_RET_CONT;
486
487 key = sample_fetch_as_type(s->be, sess, s, SMP_OPT_DIR_REQ|SMP_OPT_FINAL, rule->arg.capid.expr, SMP_T_STR);
488 if (!key)
489 return ACT_RET_CONT;
490
491 if (cap[h->index] == NULL)
492 cap[h->index] = pool_alloc(h->pool);
493
494 if (cap[h->index] == NULL) /* no more capture memory */
495 return ACT_RET_CONT;
496
497 len = key->data.u.str.data;
498 if (len > h->len)
499 len = h->len;
500
501 memcpy(cap[h->index], key->data.u.str.area, len);
502 cap[h->index][len] = 0;
503 return ACT_RET_CONT;
504}
505
506/* Check an "http-request capture" action.
507 *
508 * The function returns 1 in success case, otherwise, it returns 0 and err is
509 * filled.
510 */
511static int check_http_req_capture(struct act_rule *rule, struct proxy *px, char **err)
512{
513 if (rule->action_ptr != http_action_req_capture_by_id)
514 return 1;
515
Baptiste Assmann19a69b32020-01-16 14:34:22 +0100516 /* capture slots can only be declared in frontends, so we can't check their
517 * existence in backends at configuration parsing step
518 */
519 if (px->cap & PR_CAP_FE && rule->arg.capid.idx >= px->nb_req_cap) {
Willy Tarreau79e57332018-10-02 16:01:16 +0200520 memprintf(err, "unable to find capture id '%d' referenced by http-request capture rule",
521 rule->arg.capid.idx);
522 return 0;
523 }
524
525 return 1;
526}
527
Christopher Faulet2eb53962020-01-14 14:47:34 +0100528/* Release memory allocate by an http capture action */
529static void release_http_capture(struct act_rule *rule)
530{
531 if (rule->action_ptr == http_action_req_capture)
532 release_sample_expr(rule->arg.cap.expr);
533 else
534 release_sample_expr(rule->arg.capid.expr);
535}
536
Willy Tarreau79e57332018-10-02 16:01:16 +0200537/* parse an "http-request capture" action. It takes a single argument which is
538 * a sample fetch expression. It stores the expression into arg->act.p[0] and
539 * the allocated hdr_cap struct or the preallocated "id" into arg->act.p[1].
540 * It returns ACT_RET_PRS_OK on success, ACT_RET_PRS_ERR on error.
541 */
542static enum act_parse_ret parse_http_req_capture(const char **args, int *orig_arg, struct proxy *px,
543 struct act_rule *rule, char **err)
544{
545 struct sample_expr *expr;
546 struct cap_hdr *hdr;
547 int cur_arg;
548 int len = 0;
549
550 for (cur_arg = *orig_arg; cur_arg < *orig_arg + 3 && *args[cur_arg]; cur_arg++)
551 if (strcmp(args[cur_arg], "if") == 0 ||
552 strcmp(args[cur_arg], "unless") == 0)
553 break;
554
555 if (cur_arg < *orig_arg + 3) {
556 memprintf(err, "expects <expression> [ 'len' <length> | id <idx> ]");
557 return ACT_RET_PRS_ERR;
558 }
559
560 cur_arg = *orig_arg;
561 expr = sample_parse_expr((char **)args, &cur_arg, px->conf.args.file, px->conf.args.line, err, &px->conf.args);
562 if (!expr)
563 return ACT_RET_PRS_ERR;
564
565 if (!(expr->fetch->val & SMP_VAL_FE_HRQ_HDR)) {
566 memprintf(err,
567 "fetch method '%s' extracts information from '%s', none of which is available here",
568 args[cur_arg-1], sample_src_names(expr->fetch->use));
Christopher Faulet1337b322020-01-14 14:50:55 +0100569 release_sample_expr(expr);
Willy Tarreau79e57332018-10-02 16:01:16 +0200570 return ACT_RET_PRS_ERR;
571 }
572
573 if (!args[cur_arg] || !*args[cur_arg]) {
574 memprintf(err, "expects 'len or 'id'");
Christopher Faulet1337b322020-01-14 14:50:55 +0100575 release_sample_expr(expr);
Willy Tarreau79e57332018-10-02 16:01:16 +0200576 return ACT_RET_PRS_ERR;
577 }
578
579 if (strcmp(args[cur_arg], "len") == 0) {
580 cur_arg++;
581
582 if (!(px->cap & PR_CAP_FE)) {
583 memprintf(err, "proxy '%s' has no frontend capability", px->id);
Christopher Faulet1337b322020-01-14 14:50:55 +0100584 release_sample_expr(expr);
Willy Tarreau79e57332018-10-02 16:01:16 +0200585 return ACT_RET_PRS_ERR;
586 }
587
588 px->conf.args.ctx = ARGC_CAP;
589
590 if (!args[cur_arg]) {
591 memprintf(err, "missing length value");
Christopher Faulet1337b322020-01-14 14:50:55 +0100592 release_sample_expr(expr);
Willy Tarreau79e57332018-10-02 16:01:16 +0200593 return ACT_RET_PRS_ERR;
594 }
595 /* we copy the table name for now, it will be resolved later */
596 len = atoi(args[cur_arg]);
597 if (len <= 0) {
598 memprintf(err, "length must be > 0");
Christopher Faulet1337b322020-01-14 14:50:55 +0100599 release_sample_expr(expr);
Willy Tarreau79e57332018-10-02 16:01:16 +0200600 return ACT_RET_PRS_ERR;
601 }
602 cur_arg++;
603
Willy Tarreau79e57332018-10-02 16:01:16 +0200604 hdr = calloc(1, sizeof(*hdr));
605 hdr->next = px->req_cap;
606 hdr->name = NULL; /* not a header capture */
607 hdr->namelen = 0;
608 hdr->len = len;
609 hdr->pool = create_pool("caphdr", hdr->len + 1, MEM_F_SHARED);
610 hdr->index = px->nb_req_cap++;
611
612 px->req_cap = hdr;
613 px->to_log |= LW_REQHDR;
614
615 rule->action = ACT_CUSTOM;
616 rule->action_ptr = http_action_req_capture;
Christopher Faulet2eb53962020-01-14 14:47:34 +0100617 rule->release_ptr = release_http_capture;
Willy Tarreau79e57332018-10-02 16:01:16 +0200618 rule->arg.cap.expr = expr;
619 rule->arg.cap.hdr = hdr;
620 }
621
622 else if (strcmp(args[cur_arg], "id") == 0) {
623 int id;
624 char *error;
625
626 cur_arg++;
627
628 if (!args[cur_arg]) {
629 memprintf(err, "missing id value");
Christopher Faulet1337b322020-01-14 14:50:55 +0100630 release_sample_expr(expr);
Willy Tarreau79e57332018-10-02 16:01:16 +0200631 return ACT_RET_PRS_ERR;
632 }
633
634 id = strtol(args[cur_arg], &error, 10);
635 if (*error != '\0') {
636 memprintf(err, "cannot parse id '%s'", args[cur_arg]);
Christopher Faulet1337b322020-01-14 14:50:55 +0100637 release_sample_expr(expr);
Willy Tarreau79e57332018-10-02 16:01:16 +0200638 return ACT_RET_PRS_ERR;
639 }
640 cur_arg++;
641
642 px->conf.args.ctx = ARGC_CAP;
643
644 rule->action = ACT_CUSTOM;
645 rule->action_ptr = http_action_req_capture_by_id;
646 rule->check_ptr = check_http_req_capture;
Christopher Faulet2eb53962020-01-14 14:47:34 +0100647 rule->release_ptr = release_http_capture;
Willy Tarreau79e57332018-10-02 16:01:16 +0200648 rule->arg.capid.expr = expr;
649 rule->arg.capid.idx = id;
650 }
651
652 else {
653 memprintf(err, "expects 'len' or 'id', found '%s'", args[cur_arg]);
Christopher Faulet1337b322020-01-14 14:50:55 +0100654 release_sample_expr(expr);
Willy Tarreau79e57332018-10-02 16:01:16 +0200655 return ACT_RET_PRS_ERR;
656 }
657
658 *orig_arg = cur_arg;
659 return ACT_RET_PRS_OK;
660}
661
662/* This function executes the "capture" action and store the result in a
663 * capture slot if exists. It executes a fetch expression, turns the result
664 * into a string and puts it in a capture slot. It always returns 1. If an
665 * error occurs the action is cancelled, but the rule processing continues.
666 */
667static enum act_return http_action_res_capture_by_id(struct act_rule *rule, struct proxy *px,
668 struct session *sess, struct stream *s, int flags)
669{
670 struct sample *key;
671 struct cap_hdr *h;
672 char **cap = s->res_cap;
673 struct proxy *fe = strm_fe(s);
674 int len;
675 int i;
676
677 /* Look for the original configuration. */
678 for (h = fe->rsp_cap, i = fe->nb_rsp_cap - 1;
679 h != NULL && i != rule->arg.capid.idx ;
680 i--, h = h->next);
681 if (!h)
682 return ACT_RET_CONT;
683
684 key = sample_fetch_as_type(s->be, sess, s, SMP_OPT_DIR_RES|SMP_OPT_FINAL, rule->arg.capid.expr, SMP_T_STR);
685 if (!key)
686 return ACT_RET_CONT;
687
688 if (cap[h->index] == NULL)
689 cap[h->index] = pool_alloc(h->pool);
690
691 if (cap[h->index] == NULL) /* no more capture memory */
692 return ACT_RET_CONT;
693
694 len = key->data.u.str.data;
695 if (len > h->len)
696 len = h->len;
697
698 memcpy(cap[h->index], key->data.u.str.area, len);
699 cap[h->index][len] = 0;
700 return ACT_RET_CONT;
701}
702
703/* Check an "http-response capture" action.
704 *
705 * The function returns 1 in success case, otherwise, it returns 0 and err is
706 * filled.
707 */
708static int check_http_res_capture(struct act_rule *rule, struct proxy *px, char **err)
709{
710 if (rule->action_ptr != http_action_res_capture_by_id)
711 return 1;
712
713 if (rule->arg.capid.idx >= px->nb_rsp_cap) {
714 memprintf(err, "unable to find capture id '%d' referenced by http-response capture rule",
715 rule->arg.capid.idx);
716 return 0;
717 }
718
719 return 1;
720}
721
722/* parse an "http-response capture" action. It takes a single argument which is
723 * a sample fetch expression. It stores the expression into arg->act.p[0] and
724 * the allocated hdr_cap struct od the preallocated id into arg->act.p[1].
725 * It returns ACT_RET_PRS_OK on success, ACT_RET_PRS_ERR on error.
726 */
727static enum act_parse_ret parse_http_res_capture(const char **args, int *orig_arg, struct proxy *px,
728 struct act_rule *rule, char **err)
729{
730 struct sample_expr *expr;
731 int cur_arg;
732 int id;
733 char *error;
734
735 for (cur_arg = *orig_arg; cur_arg < *orig_arg + 3 && *args[cur_arg]; cur_arg++)
736 if (strcmp(args[cur_arg], "if") == 0 ||
737 strcmp(args[cur_arg], "unless") == 0)
738 break;
739
740 if (cur_arg < *orig_arg + 3) {
741 memprintf(err, "expects <expression> id <idx>");
742 return ACT_RET_PRS_ERR;
743 }
744
745 cur_arg = *orig_arg;
746 expr = sample_parse_expr((char **)args, &cur_arg, px->conf.args.file, px->conf.args.line, err, &px->conf.args);
747 if (!expr)
748 return ACT_RET_PRS_ERR;
749
750 if (!(expr->fetch->val & SMP_VAL_FE_HRS_HDR)) {
751 memprintf(err,
752 "fetch method '%s' extracts information from '%s', none of which is available here",
753 args[cur_arg-1], sample_src_names(expr->fetch->use));
Christopher Faulet1337b322020-01-14 14:50:55 +0100754 release_sample_expr(expr);
Willy Tarreau79e57332018-10-02 16:01:16 +0200755 return ACT_RET_PRS_ERR;
756 }
757
758 if (!args[cur_arg] || !*args[cur_arg]) {
759 memprintf(err, "expects 'id'");
Christopher Faulet1337b322020-01-14 14:50:55 +0100760 release_sample_expr(expr);
Willy Tarreau79e57332018-10-02 16:01:16 +0200761 return ACT_RET_PRS_ERR;
762 }
763
764 if (strcmp(args[cur_arg], "id") != 0) {
765 memprintf(err, "expects 'id', found '%s'", args[cur_arg]);
Christopher Faulet1337b322020-01-14 14:50:55 +0100766 release_sample_expr(expr);
Willy Tarreau79e57332018-10-02 16:01:16 +0200767 return ACT_RET_PRS_ERR;
768 }
769
770 cur_arg++;
771
772 if (!args[cur_arg]) {
773 memprintf(err, "missing id value");
Christopher Faulet1337b322020-01-14 14:50:55 +0100774 release_sample_expr(expr);
Willy Tarreau79e57332018-10-02 16:01:16 +0200775 return ACT_RET_PRS_ERR;
776 }
777
778 id = strtol(args[cur_arg], &error, 10);
779 if (*error != '\0') {
780 memprintf(err, "cannot parse id '%s'", args[cur_arg]);
Christopher Faulet1337b322020-01-14 14:50:55 +0100781 release_sample_expr(expr);
Willy Tarreau79e57332018-10-02 16:01:16 +0200782 return ACT_RET_PRS_ERR;
783 }
784 cur_arg++;
785
786 px->conf.args.ctx = ARGC_CAP;
787
788 rule->action = ACT_CUSTOM;
789 rule->action_ptr = http_action_res_capture_by_id;
790 rule->check_ptr = check_http_res_capture;
Christopher Faulet2eb53962020-01-14 14:47:34 +0100791 rule->release_ptr = release_http_capture;
Willy Tarreau79e57332018-10-02 16:01:16 +0200792 rule->arg.capid.expr = expr;
793 rule->arg.capid.idx = id;
794
795 *orig_arg = cur_arg;
796 return ACT_RET_PRS_OK;
797}
798
Christopher Faulet81e20172019-12-12 16:40:30 +0100799/* Parse a "allow" action for a request or a response rule. It takes no argument. It
800 * returns ACT_RET_PRS_OK on success, ACT_RET_PRS_ERR on error.
801 */
802static enum act_parse_ret parse_http_allow(const char **args, int *orig_arg, struct proxy *px,
803 struct act_rule *rule, char **err)
804{
805 rule->action = ACT_ACTION_ALLOW;
Christopher Faulet245cf792019-12-18 14:58:12 +0100806 rule->flags |= ACT_FLAG_FINAL;
Christopher Faulet81e20172019-12-12 16:40:30 +0100807 return ACT_RET_PRS_OK;
808}
809
Christopher Faulet554c0eb2020-01-14 12:00:28 +0100810/* Check an "http-request deny" action when an http-errors section is referenced.
811 *
812 * The function returns 1 in success case, otherwise, it returns 0 and err is
813 * filled.
814 */
815static int check_http_deny_action(struct act_rule *rule, struct proxy *px, char **err)
816{
817 struct http_errors *http_errs;
818 int status = (intptr_t)(rule->arg.act.p[0]);
819 int ret = 1;
820
821 list_for_each_entry(http_errs, &http_errors_list, list) {
822 if (strcmp(http_errs->id, (char *)rule->arg.act.p[1]) == 0) {
823 free(rule->arg.act.p[1]);
824 rule->arg.http_deny.status = status;
825 rule->arg.http_deny.errmsg = http_errs->errmsg[http_get_status_idx(status)];
826 if (!rule->arg.http_deny.errmsg)
827 ha_warning("Proxy '%s': status '%d' referenced by http deny rule "
828 "not declared in http-errors section '%s'.\n",
829 px->id, status, http_errs->id);
830 break;
831 }
832 }
833
834 if (&http_errs->list == &http_errors_list) {
835 memprintf(err, "unknown http-errors section '%s' referenced by http deny rule",
836 (char *)rule->arg.act.p[1]);
837 free(rule->arg.act.p[1]);
838 ret = 0;
839 }
840
841 return ret;
842}
843
Christopher Faulete0fca292020-01-13 21:49:03 +0100844/* Parse "deny" or "tarpit" actions for a request rule or "deny" action for a
Christopher Faulet554c0eb2020-01-14 12:00:28 +0100845 * response rule. It may take optional arguments to define the status code, the
846 * error file or the http-errors section to use. It returns ACT_RET_PRS_OK on
847 * success, ACT_RET_PRS_ERR on error.
Christopher Faulet81e20172019-12-12 16:40:30 +0100848 */
Christopher Faulete0fca292020-01-13 21:49:03 +0100849static enum act_parse_ret parse_http_deny(const char **args, int *orig_arg, struct proxy *px,
850 struct act_rule *rule, char **err)
Christopher Faulet81e20172019-12-12 16:40:30 +0100851{
Christopher Faulet554c0eb2020-01-14 12:00:28 +0100852 int default_status, status, hc, cur_arg;
853
Christopher Faulet81e20172019-12-12 16:40:30 +0100854
855 cur_arg = *orig_arg;
Christopher Faulete0fca292020-01-13 21:49:03 +0100856 if (rule->from == ACT_F_HTTP_REQ) {
857 if (!strcmp(args[cur_arg-1], "tarpit")) {
858 rule->action = ACT_HTTP_REQ_TARPIT;
Christopher Faulet554c0eb2020-01-14 12:00:28 +0100859 default_status = status = 500;
Christopher Faulet81e20172019-12-12 16:40:30 +0100860 }
Christopher Faulete0fca292020-01-13 21:49:03 +0100861 else {
862 rule->action = ACT_ACTION_DENY;
Christopher Faulet554c0eb2020-01-14 12:00:28 +0100863 default_status = status = 403;
Christopher Faulet81e20172019-12-12 16:40:30 +0100864 }
Christopher Faulet81e20172019-12-12 16:40:30 +0100865 }
Christopher Faulete0fca292020-01-13 21:49:03 +0100866 else {
Christopher Faulet554c0eb2020-01-14 12:00:28 +0100867 rule->action = ACT_ACTION_DENY;
868 default_status = status = 502;
Christopher Faulete0fca292020-01-13 21:49:03 +0100869 }
Christopher Faulet245cf792019-12-18 14:58:12 +0100870 rule->flags |= ACT_FLAG_FINAL;
Christopher Faulet040c8cd2020-01-13 16:43:45 +0100871
872 if (strcmp(args[cur_arg], "deny_status") == 0) {
873 cur_arg++;
874 if (!*args[cur_arg]) {
Christopher Faulet554c0eb2020-01-14 12:00:28 +0100875 memprintf(err, "'%s' expects <status_code> as argument", args[cur_arg-1]);
Christopher Faulet040c8cd2020-01-13 16:43:45 +0100876 return ACT_RET_PRS_ERR;
877 }
878
Christopher Faulet554c0eb2020-01-14 12:00:28 +0100879 status = atol(args[cur_arg]);
Christopher Faulet040c8cd2020-01-13 16:43:45 +0100880 cur_arg++;
881 for (hc = 0; hc < HTTP_ERR_SIZE; hc++) {
Christopher Faulet554c0eb2020-01-14 12:00:28 +0100882 if (http_err_codes[hc] == status)
Christopher Faulet040c8cd2020-01-13 16:43:45 +0100883 break;
Christopher Faulet040c8cd2020-01-13 16:43:45 +0100884 }
Christopher Faulet554c0eb2020-01-14 12:00:28 +0100885 if (hc >= HTTP_ERR_SIZE) {
886 memprintf(err, "status code '%d' not handled, using default code '%d'",
887 status, default_status);
888 status = default_status;
889 hc = http_get_status_idx(status);
890 }
Christopher Faulet040c8cd2020-01-13 16:43:45 +0100891 }
892
Christopher Faulet554c0eb2020-01-14 12:00:28 +0100893 if (strcmp(args[cur_arg], "errorfile") == 0) {
894 cur_arg++;
895 if (!*args[cur_arg]) {
896 memprintf(err, "'%s' expects <file> as argument", args[cur_arg-1]);
897 return ACT_RET_PRS_ERR;
898 }
899
900 rule->arg.http_deny.errmsg = http_load_errorfile(args[cur_arg], err);
901 if (!rule->arg.http_deny.errmsg)
902 return ACT_RET_PRS_ERR;
903 cur_arg++;
904 }
905 else if (strcmp(args[cur_arg], "errorfiles") == 0) {
906 cur_arg++;
907 if (!*args[cur_arg]) {
908 memprintf(err, "'%s' expects <http_errors_name> as argument", args[cur_arg-1]);
909 return ACT_RET_PRS_ERR;
910 }
911 /* Must be resolved during the config validity check */
912 rule->arg.act.p[0] = (void *)((intptr_t)status);
913 rule->arg.act.p[1] = strdup(args[cur_arg]);
914 rule->check_ptr = check_http_deny_action;
915 cur_arg++;
916 goto out;
917 }
918
919 rule->arg.http_deny.status = status;
920
921 out:
Christopher Faulet040c8cd2020-01-13 16:43:45 +0100922 *orig_arg = cur_arg;
Christopher Faulet81e20172019-12-12 16:40:30 +0100923 return ACT_RET_PRS_OK;
924}
925
926/* Parse a "auth" action. It may take 2 optional arguments to define a "realm"
927 * parameter. It returns ACT_RET_PRS_OK on success, ACT_RET_PRS_ERR on error.
928 */
929static enum act_parse_ret parse_http_auth(const char **args, int *orig_arg, struct proxy *px,
930 struct act_rule *rule, char **err)
931{
932 int cur_arg;
933
934 rule->action = ACT_HTTP_REQ_AUTH;
Christopher Faulet245cf792019-12-18 14:58:12 +0100935 rule->flags |= ACT_FLAG_FINAL;
Christopher Faulet2eb53962020-01-14 14:47:34 +0100936 rule->release_ptr = release_http_action;
Christopher Faulet81e20172019-12-12 16:40:30 +0100937
938 cur_arg = *orig_arg;
939 if (!strcmp(args[cur_arg], "realm")) {
940 cur_arg++;
941 if (!*args[cur_arg]) {
942 memprintf(err, "missing realm value.\n");
943 return ACT_RET_PRS_ERR;
944 }
Christopher Faulet96bff762019-12-17 13:46:18 +0100945 rule->arg.http.str.ptr = strdup(args[cur_arg]);
946 rule->arg.http.str.len = strlen(rule->arg.http.str.ptr);
Christopher Faulet81e20172019-12-12 16:40:30 +0100947 cur_arg++;
948 }
949
Christopher Fauletc20b3712020-01-27 15:51:56 +0100950 LIST_INIT(&rule->arg.http.fmt);
Christopher Faulet81e20172019-12-12 16:40:30 +0100951 *orig_arg = cur_arg;
952 return ACT_RET_PRS_OK;
953}
954
955/* Parse a "set-nice" action. It takes the nice value as argument. It returns
956 * ACT_RET_PRS_OK on success, ACT_RET_PRS_ERR on error.
957 */
958static enum act_parse_ret parse_http_set_nice(const char **args, int *orig_arg, struct proxy *px,
959 struct act_rule *rule, char **err)
960{
961 int cur_arg;
962
963 rule->action = ACT_HTTP_SET_NICE;
964
965 cur_arg = *orig_arg;
966 if (!*args[cur_arg]) {
967 memprintf(err, "expects exactly 1 argument (integer value)");
968 return ACT_RET_PRS_ERR;
969 }
Christopher Faulet96bff762019-12-17 13:46:18 +0100970 rule->arg.http.i = atoi(args[cur_arg]);
971 if (rule->arg.http.i < -1024)
972 rule->arg.http.i = -1024;
973 else if (rule->arg.http.i > 1024)
974 rule->arg.http.i = 1024;
Christopher Faulet81e20172019-12-12 16:40:30 +0100975
Christopher Fauletc20b3712020-01-27 15:51:56 +0100976 LIST_INIT(&rule->arg.http.fmt);
Christopher Faulet81e20172019-12-12 16:40:30 +0100977 *orig_arg = cur_arg + 1;
978 return ACT_RET_PRS_OK;
979}
980
981/* Parse a "set-tos" action. It takes the TOS value as argument. It returns
982 * ACT_RET_PRS_OK on success, ACT_RET_PRS_ERR on error.
983 */
984static enum act_parse_ret parse_http_set_tos(const char **args, int *orig_arg, struct proxy *px,
985 struct act_rule *rule, char **err)
986{
987#ifdef IP_TOS
988 char *endp;
989 int cur_arg;
990
991 rule->action = ACT_HTTP_SET_TOS;
992
993 cur_arg = *orig_arg;
994 if (!*args[cur_arg]) {
995 memprintf(err, "expects exactly 1 argument (integer/hex value)");
996 return ACT_RET_PRS_ERR;
997 }
Christopher Faulet96bff762019-12-17 13:46:18 +0100998 rule->arg.http.i = strtol(args[cur_arg], &endp, 0);
Christopher Faulet81e20172019-12-12 16:40:30 +0100999 if (endp && *endp != '\0') {
1000 memprintf(err, "invalid character starting at '%s' (integer/hex value expected)", endp);
1001 return ACT_RET_PRS_ERR;
1002 }
1003
Christopher Fauletc20b3712020-01-27 15:51:56 +01001004 LIST_INIT(&rule->arg.http.fmt);
Christopher Faulet81e20172019-12-12 16:40:30 +01001005 *orig_arg = cur_arg + 1;
1006 return ACT_RET_PRS_OK;
1007#else
1008 memprintf(err, "not supported on this platform (IP_TOS undefined)");
1009 return ACT_RET_PRS_ERR;
1010#endif
1011}
1012
1013/* Parse a "set-mark" action. It takes the MARK value as argument. It returns
1014 * ACT_RET_PRS_OK on success, ACT_RET_PRS_ERR on error.
1015 */
1016static enum act_parse_ret parse_http_set_mark(const char **args, int *orig_arg, struct proxy *px,
1017 struct act_rule *rule, char **err)
1018{
1019#ifdef SO_MARK
1020 char *endp;
1021 int cur_arg;
1022
1023 rule->action = ACT_HTTP_SET_MARK;
1024
1025 cur_arg = *orig_arg;
1026 if (!*args[cur_arg]) {
1027 memprintf(err, "expects exactly 1 argument (integer/hex value)");
1028 return ACT_RET_PRS_ERR;
1029 }
Christopher Faulet96bff762019-12-17 13:46:18 +01001030 rule->arg.http.i = strtoul(args[cur_arg], &endp, 0);
Christopher Faulet81e20172019-12-12 16:40:30 +01001031 if (endp && *endp != '\0') {
1032 memprintf(err, "invalid character starting at '%s' (integer/hex value expected)", endp);
1033 return ACT_RET_PRS_ERR;
1034 }
1035
Christopher Fauletc20b3712020-01-27 15:51:56 +01001036 LIST_INIT(&rule->arg.http.fmt);
Christopher Faulet81e20172019-12-12 16:40:30 +01001037 *orig_arg = cur_arg + 1;
1038 global.last_checks |= LSTCHK_NETADM;
1039 return ACT_RET_PRS_OK;
1040#else
1041 memprintf(err, "not supported on this platform (SO_MARK undefined)");
1042 return ACT_RET_PRS_ERR;
1043#endif
1044}
1045
1046/* Parse a "set-log-level" action. It takes the level value as argument. It
1047 * returns ACT_RET_PRS_OK on success, ACT_RET_PRS_ERR on error.
1048 */
1049static enum act_parse_ret parse_http_set_log_level(const char **args, int *orig_arg, struct proxy *px,
1050 struct act_rule *rule, char **err)
1051{
1052 int cur_arg;
1053
1054 rule->action = ACT_HTTP_SET_LOGL;
1055
1056 cur_arg = *orig_arg;
1057 if (!*args[cur_arg]) {
1058 bad_log_level:
1059 memprintf(err, "expects exactly 1 argument (log level name or 'silent')");
1060 return ACT_RET_PRS_ERR;
1061 }
1062 if (strcmp(args[cur_arg], "silent") == 0)
Christopher Faulet96bff762019-12-17 13:46:18 +01001063 rule->arg.http.i = -1;
1064 else if ((rule->arg.http.i = get_log_level(args[cur_arg]) + 1) == 0)
Christopher Faulet81e20172019-12-12 16:40:30 +01001065 goto bad_log_level;
1066
Christopher Fauletc20b3712020-01-27 15:51:56 +01001067 LIST_INIT(&rule->arg.http.fmt);
Christopher Faulet81e20172019-12-12 16:40:30 +01001068 *orig_arg = cur_arg + 1;
1069 return ACT_RET_PRS_OK;
1070}
1071
Christopher Faulet91b3ec12020-01-17 22:30:06 +01001072/* This function executes a early-hint action. It adds an HTTP Early Hint HTTP
1073 * 103 response header with <.arg.http.str> name and with a value built
1074 * according to <.arg.http.fmt> log line format. If it is the first early-hint
1075 * rule of a serie, the 103 response start-line is added first. At the end, if
1076 * the next rule is not an early-hint rule or if it is the last rule, the EOH
1077 * block is added to terminate the response. On success, it returns
1078 * ACT_RET_CONT. If an error occurs while soft rewrites are enabled, the action
1079 * is canceled, but the rule processing continue. Otherwsize ACT_RET_ERR is
1080 * returned.
1081 */
1082static enum act_return http_action_early_hint(struct act_rule *rule, struct proxy *px,
1083 struct session *sess, struct stream *s, int flags)
1084{
1085 struct act_rule *prev_rule, *next_rule;
1086 struct channel *res = &s->res;
1087 struct htx *htx = htx_from_buf(&res->buf);
1088 struct buffer *value = alloc_trash_chunk();
1089 enum act_return ret = ACT_RET_CONT;
1090
1091 if (!(s->txn->req.flags & HTTP_MSGF_VER_11))
1092 goto leave;
1093
1094 if (!value) {
1095 if (!(s->flags & SF_ERR_MASK))
1096 s->flags |= SF_ERR_RESOURCE;
1097 goto error;
1098 }
1099
1100 /* get previous and next rules */
1101 prev_rule = LIST_PREV(&rule->list, typeof(rule), list);
1102 next_rule = LIST_NEXT(&rule->list, typeof(rule), list);
1103
1104 /* if no previous rule or previous rule is not early-hint, start a new response. Otherwise,
1105 * continue to add link to a previously started response */
1106 if (&prev_rule->list == s->current_rule_list || prev_rule->action_ptr != http_action_early_hint) {
1107 struct htx_sl *sl;
1108 unsigned int flags = (HTX_SL_F_IS_RESP|HTX_SL_F_VER_11|
1109 HTX_SL_F_XFER_LEN|HTX_SL_F_BODYLESS);
1110
1111 sl = htx_add_stline(htx, HTX_BLK_RES_SL, flags,
1112 ist("HTTP/1.1"), ist("103"), ist("Early Hints"));
1113 if (!sl)
1114 goto error;
1115 sl->info.res.status = 103;
1116 }
1117
1118 /* Add the HTTP Early Hint HTTP 103 response heade */
1119 value->data = build_logline(s, b_tail(value), b_room(value), &rule->arg.http.fmt);
1120 if (!htx_add_header(htx, rule->arg.http.str, ist2(b_head(value), b_data(value))))
1121 goto error;
1122
1123 /* if it is the last rule or the next one is not an early-hint, terminate the current
1124 * response. */
1125 if (&next_rule->list == s->current_rule_list || next_rule->action_ptr != http_action_early_hint) {
Christopher Faulet91b3ec12020-01-17 22:30:06 +01001126 if (!htx_add_endof(htx, HTX_BLK_EOH)) {
1127 /* If an error occurred during an Early-hint rule,
1128 * remove the incomplete HTTP 103 response from the
1129 * buffer */
1130 goto error;
1131 }
1132
Christopher Fauleta72a7e42020-01-28 09:28:11 +01001133 if (!http_forward_proxy_resp(s, 0))
1134 goto error;
Christopher Faulet91b3ec12020-01-17 22:30:06 +01001135 }
1136
1137 leave:
1138 free_trash_chunk(value);
1139 return ret;
1140
1141 error:
1142 /* If an error occurred during an Early-hint rule, remove the incomplete
1143 * HTTP 103 response from the buffer */
1144 channel_htx_truncate(res, htx);
1145 ret = ACT_RET_ERR;
1146 goto leave;
1147}
1148
Christopher Fauletd1f27e32019-12-17 09:33:38 +01001149/* This function executes a set-header or add-header actions. It builds a string
1150 * in the trash from the specified format string. It finds the action to be
1151 * performed in <.action>, previously filled by function parse_set_header(). The
1152 * replacement action is excuted by the function http_action_set_header(). On
1153 * success, it returns ACT_RET_CONT. If an error occurs while soft rewrites are
1154 * enabled, the action is canceled, but the rule processing continue. Otherwsize
1155 * ACT_RET_ERR is returned.
1156 */
1157static enum act_return http_action_set_header(struct act_rule *rule, struct proxy *px,
1158 struct session *sess, struct stream *s, int flags)
1159{
Christopher Faulet91e31d82020-01-24 15:37:13 +01001160 struct http_msg *msg = ((rule->from == ACT_F_HTTP_REQ) ? &s->txn->req : &s->txn->rsp);
1161 struct htx *htx = htxbuf(&msg->chn->buf);
Christopher Fauletd1f27e32019-12-17 09:33:38 +01001162 enum act_return ret = ACT_RET_CONT;
1163 struct buffer *replace;
1164 struct http_hdr_ctx ctx;
1165 struct ist n, v;
1166
1167 replace = alloc_trash_chunk();
1168 if (!replace)
1169 goto fail_alloc;
1170
1171 replace->data = build_logline(s, replace->area, replace->size, &rule->arg.http.fmt);
1172 n = rule->arg.http.str;
1173 v = ist2(replace->area, replace->data);
1174
1175 if (rule->action == 0) { // set-header
1176 /* remove all occurrences of the header */
1177 ctx.blk = NULL;
1178 while (http_find_header(htx, n, &ctx, 1))
1179 http_remove_header(htx, &ctx);
1180 }
1181
1182 /* Now add header */
1183 if (!http_add_header(htx, n, v))
1184 goto fail_rewrite;
1185
1186 leave:
1187 free_trash_chunk(replace);
1188 return ret;
1189
1190 fail_alloc:
1191 if (!(s->flags & SF_ERR_MASK))
1192 s->flags |= SF_ERR_RESOURCE;
1193 ret = ACT_RET_ERR;
1194 goto leave;
1195
1196 fail_rewrite:
1197 _HA_ATOMIC_ADD(&sess->fe->fe_counters.failed_rewrites, 1);
1198 if (s->flags & SF_BE_ASSIGNED)
1199 _HA_ATOMIC_ADD(&s->be->be_counters.failed_rewrites, 1);
1200 if (sess->listener->counters)
1201 _HA_ATOMIC_ADD(&sess->listener->counters->failed_rewrites, 1);
1202 if (objt_server(s->target))
1203 _HA_ATOMIC_ADD(&__objt_server(s->target)->counters.failed_rewrites, 1);
1204
Christopher Faulet333bf8c2020-01-22 14:38:05 +01001205 if (!(msg->flags & HTTP_MSGF_SOFT_RW)) {
Christopher Fauletd1f27e32019-12-17 09:33:38 +01001206 ret = ACT_RET_ERR;
Christopher Faulet333bf8c2020-01-22 14:38:05 +01001207 if (!(s->flags & SF_ERR_MASK))
1208 s->flags |= SF_ERR_PRXCOND;
1209 }
Christopher Fauletd1f27e32019-12-17 09:33:38 +01001210 goto leave;
1211}
1212
Christopher Faulet81e20172019-12-12 16:40:30 +01001213/* Parse a "set-header", "add-header" or "early-hint" actions. It takes an
1214 * header name and a log-format string as arguments. It returns ACT_RET_PRS_OK
1215 * on success, ACT_RET_PRS_ERR on error.
1216 *
1217 * Note: same function is used for the request and the response. However
1218 * "early-hint" rules are only supported for request rules.
1219 */
1220static enum act_parse_ret parse_http_set_header(const char **args, int *orig_arg, struct proxy *px,
1221 struct act_rule *rule, char **err)
1222{
Christopher Faulet81e20172019-12-12 16:40:30 +01001223 int cap, cur_arg;
1224
Christopher Faulet91b3ec12020-01-17 22:30:06 +01001225 if (args[*orig_arg-1][0] == 'e') {
1226 rule->action = ACT_CUSTOM;
1227 rule->action_ptr = http_action_early_hint;
1228 }
Christopher Fauletd1f27e32019-12-17 09:33:38 +01001229 else {
1230 if (args[*orig_arg-1][0] == 's')
1231 rule->action = 0; // set-header
1232 else
1233 rule->action = 1; // add-header
1234 rule->action_ptr = http_action_set_header;
1235 }
Christopher Faulet2eb53962020-01-14 14:47:34 +01001236 rule->release_ptr = release_http_action;
Christopher Faulet81e20172019-12-12 16:40:30 +01001237
1238 cur_arg = *orig_arg;
1239 if (!*args[cur_arg] || !*args[cur_arg+1]) {
1240 memprintf(err, "expects exactly 2 arguments");
1241 return ACT_RET_PRS_ERR;
1242 }
1243
Christopher Faulet81e20172019-12-12 16:40:30 +01001244
Christopher Faulet96bff762019-12-17 13:46:18 +01001245 rule->arg.http.str.ptr = strdup(args[cur_arg]);
1246 rule->arg.http.str.len = strlen(rule->arg.http.str.ptr);
1247 LIST_INIT(&rule->arg.http.fmt);
Christopher Faulet81e20172019-12-12 16:40:30 +01001248
1249 if (rule->from == ACT_F_HTTP_REQ) {
1250 px->conf.args.ctx = ARGC_HRQ;
1251 cap = (px->cap & PR_CAP_FE) ? SMP_VAL_FE_HRQ_HDR : SMP_VAL_BE_HRQ_HDR;
1252 }
1253 else{
1254 px->conf.args.ctx = ARGC_HRS;
1255 cap = (px->cap & PR_CAP_BE) ? SMP_VAL_BE_HRS_HDR : SMP_VAL_FE_HRS_HDR;
1256 }
1257
1258 cur_arg++;
Christopher Faulet1337b322020-01-14 14:50:55 +01001259 if (!parse_logformat_string(args[cur_arg], px, &rule->arg.http.fmt, LOG_OPT_HTTP, cap, err)) {
1260 free(rule->arg.http.str.ptr);
Christopher Faulet81e20172019-12-12 16:40:30 +01001261 return ACT_RET_PRS_ERR;
Christopher Faulet1337b322020-01-14 14:50:55 +01001262 }
Christopher Faulet81e20172019-12-12 16:40:30 +01001263
1264 free(px->conf.lfs_file);
1265 px->conf.lfs_file = strdup(px->conf.args.file);
1266 px->conf.lfs_line = px->conf.args.line;
1267
1268 *orig_arg = cur_arg + 1;
1269 return ACT_RET_PRS_OK;
1270}
1271
Christopher Faulet92d34fe2019-12-17 09:20:34 +01001272/* This function executes a replace-header or replace-value actions. It
1273 * builds a string in the trash from the specified format string. It finds
1274 * the action to be performed in <.action>, previously filled by function
1275 * parse_replace_header(). The replacement action is excuted by the function
1276 * http_action_replace_header(). On success, it returns ACT_RET_CONT. If an error
1277 * occurs while soft rewrites are enabled, the action is canceled, but the rule
1278 * processing continue. Otherwsize ACT_RET_ERR is returned.
1279 */
1280static enum act_return http_action_replace_header(struct act_rule *rule, struct proxy *px,
1281 struct session *sess, struct stream *s, int flags)
1282{
Christopher Faulet91e31d82020-01-24 15:37:13 +01001283 struct http_msg *msg = ((rule->from == ACT_F_HTTP_REQ) ? &s->txn->req : &s->txn->rsp);
1284 struct htx *htx = htxbuf(&msg->chn->buf);
Christopher Faulet92d34fe2019-12-17 09:20:34 +01001285 enum act_return ret = ACT_RET_CONT;
1286 struct buffer *replace;
1287 int r;
1288
1289 replace = alloc_trash_chunk();
1290 if (!replace)
1291 goto fail_alloc;
1292
1293 replace->data = build_logline(s, replace->area, replace->size, &rule->arg.http.fmt);
1294
1295 r = http_replace_hdrs(s, htx, rule->arg.http.str, replace->area, rule->arg.http.re, (rule->action == 0));
1296 if (r == -1)
1297 goto fail_rewrite;
1298
1299 leave:
1300 free_trash_chunk(replace);
1301 return ret;
1302
1303 fail_alloc:
1304 if (!(s->flags & SF_ERR_MASK))
1305 s->flags |= SF_ERR_RESOURCE;
1306 ret = ACT_RET_ERR;
1307 goto leave;
1308
1309 fail_rewrite:
1310 _HA_ATOMIC_ADD(&sess->fe->fe_counters.failed_rewrites, 1);
1311 if (s->flags & SF_BE_ASSIGNED)
1312 _HA_ATOMIC_ADD(&s->be->be_counters.failed_rewrites, 1);
1313 if (sess->listener->counters)
1314 _HA_ATOMIC_ADD(&sess->listener->counters->failed_rewrites, 1);
1315 if (objt_server(s->target))
1316 _HA_ATOMIC_ADD(&__objt_server(s->target)->counters.failed_rewrites, 1);
1317
Christopher Faulet333bf8c2020-01-22 14:38:05 +01001318 if (!(msg->flags & HTTP_MSGF_SOFT_RW)) {
Christopher Faulet92d34fe2019-12-17 09:20:34 +01001319 ret = ACT_RET_ERR;
Christopher Faulet333bf8c2020-01-22 14:38:05 +01001320 if (!(s->flags & SF_ERR_MASK))
1321 s->flags |= SF_ERR_PRXCOND;
1322 }
Christopher Faulet92d34fe2019-12-17 09:20:34 +01001323 goto leave;
1324}
1325
Christopher Faulet81e20172019-12-12 16:40:30 +01001326/* Parse a "replace-header" or "replace-value" actions. It takes an header name,
1327 * a regex and replacement string as arguments. It returns ACT_RET_PRS_OK on
1328 * success, ACT_RET_PRS_ERR on error.
1329 */
1330static enum act_parse_ret parse_http_replace_header(const char **args, int *orig_arg, struct proxy *px,
1331 struct act_rule *rule, char **err)
1332{
1333 int cap, cur_arg;
1334
Christopher Faulet92d34fe2019-12-17 09:20:34 +01001335 if (args[*orig_arg-1][8] == 'h')
1336 rule->action = 0; // replace-header
1337 else
1338 rule->action = 1; // replace-value
1339 rule->action_ptr = http_action_replace_header;
Christopher Faulet2eb53962020-01-14 14:47:34 +01001340 rule->release_ptr = release_http_action;
Christopher Faulet81e20172019-12-12 16:40:30 +01001341
1342 cur_arg = *orig_arg;
1343 if (!*args[cur_arg] || !*args[cur_arg+1] || !*args[cur_arg+2]) {
1344 memprintf(err, "expects exactly 3 arguments");
1345 return ACT_RET_PRS_ERR;
1346 }
1347
Christopher Faulet96bff762019-12-17 13:46:18 +01001348 rule->arg.http.str.ptr = strdup(args[cur_arg]);
1349 rule->arg.http.str.len = strlen(rule->arg.http.str.ptr);
1350 LIST_INIT(&rule->arg.http.fmt);
Christopher Faulet81e20172019-12-12 16:40:30 +01001351
1352 cur_arg++;
Christopher Faulet1337b322020-01-14 14:50:55 +01001353 if (!(rule->arg.http.re = regex_comp(args[cur_arg], 1, 1, err))) {
1354 free(rule->arg.http.str.ptr);
Christopher Faulet81e20172019-12-12 16:40:30 +01001355 return ACT_RET_PRS_ERR;
Christopher Faulet1337b322020-01-14 14:50:55 +01001356 }
Christopher Faulet81e20172019-12-12 16:40:30 +01001357
1358 if (rule->from == ACT_F_HTTP_REQ) {
1359 px->conf.args.ctx = ARGC_HRQ;
1360 cap = (px->cap & PR_CAP_FE) ? SMP_VAL_FE_HRQ_HDR : SMP_VAL_BE_HRQ_HDR;
1361 }
1362 else{
1363 px->conf.args.ctx = ARGC_HRS;
1364 cap = (px->cap & PR_CAP_BE) ? SMP_VAL_BE_HRS_HDR : SMP_VAL_FE_HRS_HDR;
1365 }
1366
1367 cur_arg++;
Christopher Faulet1337b322020-01-14 14:50:55 +01001368 if (!parse_logformat_string(args[cur_arg], px, &rule->arg.http.fmt, LOG_OPT_HTTP, cap, err)) {
1369 free(rule->arg.http.str.ptr);
1370 regex_free(rule->arg.http.re);
Christopher Faulet81e20172019-12-12 16:40:30 +01001371 return ACT_RET_PRS_ERR;
Christopher Faulet1337b322020-01-14 14:50:55 +01001372 }
Christopher Faulet81e20172019-12-12 16:40:30 +01001373
1374 free(px->conf.lfs_file);
1375 px->conf.lfs_file = strdup(px->conf.args.file);
1376 px->conf.lfs_line = px->conf.args.line;
1377
1378 *orig_arg = cur_arg + 1;
1379 return ACT_RET_PRS_OK;
1380}
1381
1382/* Parse a "del-header" action. It takes an header name as argument. It returns
1383 * ACT_RET_PRS_OK on success, ACT_RET_PRS_ERR on error.
1384 */
1385static enum act_parse_ret parse_http_del_header(const char **args, int *orig_arg, struct proxy *px,
1386 struct act_rule *rule, char **err)
1387{
1388 int cur_arg;
1389
1390 rule->action = ACT_HTTP_DEL_HDR;
Christopher Faulet2eb53962020-01-14 14:47:34 +01001391 rule->release_ptr = release_http_action;
Christopher Faulet81e20172019-12-12 16:40:30 +01001392
1393 cur_arg = *orig_arg;
1394 if (!*args[cur_arg]) {
1395 memprintf(err, "expects exactly 1 arguments");
1396 return ACT_RET_PRS_ERR;
1397 }
1398
Christopher Faulet96bff762019-12-17 13:46:18 +01001399 rule->arg.http.str.ptr = strdup(args[cur_arg]);
1400 rule->arg.http.str.len = strlen(rule->arg.http.str.ptr);
Christopher Faulet81e20172019-12-12 16:40:30 +01001401
1402 px->conf.args.ctx = (rule->from == ACT_F_HTTP_REQ ? ARGC_HRQ : ARGC_HRS);
1403
Christopher Fauletc20b3712020-01-27 15:51:56 +01001404 LIST_INIT(&rule->arg.http.fmt);
Christopher Faulet81e20172019-12-12 16:40:30 +01001405 *orig_arg = cur_arg + 1;
1406 return ACT_RET_PRS_OK;
1407}
1408
Christopher Faulet2eb53962020-01-14 14:47:34 +01001409/* Release memory allocated by an http redirect action. */
1410static void release_http_redir(struct act_rule *rule)
1411{
1412 struct logformat_node *lf, *lfb;
1413 struct redirect_rule *redir;
1414
1415 redir = rule->arg.redir;
1416 LIST_DEL(&redir->list);
1417 if (redir->cond) {
1418 prune_acl_cond(redir->cond);
1419 free(redir->cond);
1420 }
1421 free(redir->rdr_str);
1422 free(redir->cookie_str);
1423 list_for_each_entry_safe(lf, lfb, &redir->rdr_fmt, list) {
1424 LIST_DEL(&lf->list);
1425 free(lf);
1426 }
1427 free(redir);
1428}
1429
Christopher Faulet81e20172019-12-12 16:40:30 +01001430/* Parse a "redirect" action. It returns ACT_RET_PRS_OK on success,
1431 * ACT_RET_PRS_ERR on error.
1432 */
1433static enum act_parse_ret parse_http_redirect(const char **args, int *orig_arg, struct proxy *px,
1434 struct act_rule *rule, char **err)
1435{
1436 struct redirect_rule *redir;
1437 int dir, cur_arg;
1438
1439 rule->action = ACT_HTTP_REDIR;
Christopher Faulet245cf792019-12-18 14:58:12 +01001440 rule->flags |= ACT_FLAG_FINAL;
Christopher Faulet2eb53962020-01-14 14:47:34 +01001441 rule->release_ptr = release_http_redir;
Christopher Faulet81e20172019-12-12 16:40:30 +01001442
1443 cur_arg = *orig_arg;
1444
1445 dir = (rule->from == ACT_F_HTTP_REQ ? 0 : 1);
1446 if ((redir = http_parse_redirect_rule(px->conf.args.file, px->conf.args.line, px, &args[cur_arg], err, 1, dir)) == NULL)
1447 return ACT_RET_PRS_ERR;
1448
1449 rule->arg.redir = redir;
1450 rule->cond = redir->cond;
1451 redir->cond = NULL;
1452
1453 /* skip all arguments */
1454 while (*args[cur_arg])
1455 cur_arg++;
1456
1457 *orig_arg = cur_arg;
1458 return ACT_RET_PRS_OK;
1459}
1460
Christopher Faulet046cf442019-12-17 15:45:23 +01001461/* This function executes a add-acl, del-acl, set-map or del-map actions. On
1462 * success, it returns ACT_RET_CONT. Otherwsize ACT_RET_ERR is returned.
1463 */
1464static enum act_return http_action_set_map(struct act_rule *rule, struct proxy *px,
1465 struct session *sess, struct stream *s, int flags)
1466{
1467 struct pat_ref *ref;
1468 struct buffer *key = NULL, *value = NULL;
1469 enum act_return ret = ACT_RET_CONT;
1470
1471 /* collect reference */
1472 ref = pat_ref_lookup(rule->arg.map.ref);
1473 if (!ref)
1474 goto leave;
1475
1476 /* allocate key */
1477 key = alloc_trash_chunk();
1478 if (!key)
1479 goto fail_alloc;
1480
1481 /* collect key */
1482 key->data = build_logline(s, key->area, key->size, &rule->arg.map.key);
1483 key->area[key->data] = '\0';
1484
1485 switch (rule->action) {
1486 case 0: // add-acl
1487 /* add entry only if it does not already exist */
1488 HA_SPIN_LOCK(PATREF_LOCK, &ref->lock);
1489 if (pat_ref_find_elt(ref, key->area) == NULL)
1490 pat_ref_add(ref, key->area, NULL, NULL);
1491 HA_SPIN_UNLOCK(PATREF_LOCK, &ref->lock);
1492 break;
1493
1494 case 1: // set-map
1495 /* allocate value */
1496 value = alloc_trash_chunk();
1497 if (!value)
1498 goto fail_alloc;
1499
1500 /* collect value */
1501 value->data = build_logline(s, value->area, value->size, &rule->arg.map.value);
1502 value->area[value->data] = '\0';
1503
1504 HA_SPIN_LOCK(PATREF_LOCK, &ref->lock);
1505 if (pat_ref_find_elt(ref, key->area) != NULL) {
1506 /* update entry if it exists */
1507 pat_ref_set(ref, key->area, value->area, NULL);
1508 }
1509 else {
1510 /* insert a new entry */
1511 pat_ref_add(ref, key->area, value->area, NULL);
1512 }
1513 HA_SPIN_UNLOCK(PATREF_LOCK, &ref->lock);
1514 break;
1515
1516 case 2: // del-acl
1517 case 3: // del-map
1518 /* returned code: 1=ok, 0=ko */
1519 HA_SPIN_LOCK(PATREF_LOCK, &ref->lock);
1520 pat_ref_delete(ref, key->area);
1521 HA_SPIN_UNLOCK(PATREF_LOCK, &ref->lock);
1522 break;
1523
1524 default:
1525 ret = ACT_RET_ERR;
1526 }
1527
1528
1529 leave:
1530 free_trash_chunk(key);
1531 free_trash_chunk(value);
1532 return ret;
1533
1534 fail_alloc:
1535 if (!(s->flags & SF_ERR_MASK))
1536 s->flags |= SF_ERR_RESOURCE;
1537 ret = ACT_RET_ERR;
1538 goto leave;
1539}
1540
Christopher Faulet2eb53962020-01-14 14:47:34 +01001541/* Release memory allocated by an http map/acl action. */
1542static void release_http_map(struct act_rule *rule)
1543{
1544 struct logformat_node *lf, *lfb;
1545
1546 free(rule->arg.map.ref);
1547 list_for_each_entry_safe(lf, lfb, &rule->arg.map.key, list) {
1548 LIST_DEL(&lf->list);
1549 release_sample_expr(lf->expr);
1550 free(lf->arg);
1551 free(lf);
1552 }
1553 if (rule->action == 1) {
1554 list_for_each_entry_safe(lf, lfb, &rule->arg.map.value, list) {
1555 LIST_DEL(&lf->list);
1556 release_sample_expr(lf->expr);
1557 free(lf->arg);
1558 free(lf);
1559 }
1560 }
1561}
1562
Christopher Faulet81e20172019-12-12 16:40:30 +01001563/* Parse a "add-acl", "del-acl", "set-map" or "del-map" actions. It takes one or
Christopher Faulet046cf442019-12-17 15:45:23 +01001564 * two log-format string as argument depending on the action. The action is
1565 * stored in <.action> as an int (0=add-acl, 1=set-map, 2=del-acl,
1566 * 3=del-map). It returns ACT_RET_PRS_OK on success, ACT_RET_PRS_ERR on error.
Christopher Faulet81e20172019-12-12 16:40:30 +01001567 */
1568static enum act_parse_ret parse_http_set_map(const char **args, int *orig_arg, struct proxy *px,
1569 struct act_rule *rule, char **err)
1570{
1571 int cap, cur_arg;
1572
Christopher Faulet046cf442019-12-17 15:45:23 +01001573 if (args[*orig_arg-1][0] == 'a') // add-acl
1574 rule->action = 0;
1575 else if (args[*orig_arg-1][0] == 's') // set-map
1576 rule->action = 1;
1577 else if (args[*orig_arg-1][4] == 'a') // del-acl
1578 rule->action = 2;
1579 else if (args[*orig_arg-1][4] == 'm') // del-map
1580 rule->action = 3;
1581 else {
1582 memprintf(err, "internal error: unhandled action '%s'", args[0]);
1583 return ACT_RET_PRS_ERR;
1584 }
1585 rule->action_ptr = http_action_set_map;
Christopher Faulet2eb53962020-01-14 14:47:34 +01001586 rule->release_ptr = release_http_map;
Christopher Faulet81e20172019-12-12 16:40:30 +01001587
1588 cur_arg = *orig_arg;
Christopher Faulet046cf442019-12-17 15:45:23 +01001589 if (rule->action == 1 && (!*args[cur_arg] || !*args[cur_arg+1])) {
1590 /* 2 args for set-map */
Christopher Faulet81e20172019-12-12 16:40:30 +01001591 memprintf(err, "expects exactly 2 arguments");
1592 return ACT_RET_PRS_ERR;
1593 }
1594 else if (!*args[cur_arg]) {
Christopher Faulet046cf442019-12-17 15:45:23 +01001595 /* only one arg for other actions */
Christopher Faulet81e20172019-12-12 16:40:30 +01001596 memprintf(err, "expects exactly 1 arguments");
1597 return ACT_RET_PRS_ERR;
1598 }
1599
1600 /*
1601 * '+ 8' for 'set-map(' (same for del-map)
1602 * '- 9' for 'set-map(' + trailing ')' (same for del-map)
1603 */
1604 rule->arg.map.ref = my_strndup(args[cur_arg-1] + 8, strlen(args[cur_arg-1]) - 9);
1605
1606 if (rule->from == ACT_F_HTTP_REQ) {
1607 px->conf.args.ctx = ARGC_HRQ;
1608 cap = (px->cap & PR_CAP_FE) ? SMP_VAL_FE_HRQ_HDR : SMP_VAL_BE_HRQ_HDR;
1609 }
1610 else{
1611 px->conf.args.ctx = ARGC_HRS;
1612 cap = (px->cap & PR_CAP_BE) ? SMP_VAL_BE_HRS_HDR : SMP_VAL_FE_HRS_HDR;
1613 }
1614
1615 /* key pattern */
1616 LIST_INIT(&rule->arg.map.key);
Christopher Faulet1337b322020-01-14 14:50:55 +01001617 if (!parse_logformat_string(args[cur_arg], px, &rule->arg.map.key, LOG_OPT_HTTP, cap, err)) {
1618 free(rule->arg.map.ref);
Christopher Faulet81e20172019-12-12 16:40:30 +01001619 return ACT_RET_PRS_ERR;
Christopher Faulet1337b322020-01-14 14:50:55 +01001620 }
Christopher Faulet81e20172019-12-12 16:40:30 +01001621
Christopher Faulet046cf442019-12-17 15:45:23 +01001622 if (rule->action == 1) {
Christopher Faulet81e20172019-12-12 16:40:30 +01001623 /* value pattern for set-map only */
1624 cur_arg++;
1625 LIST_INIT(&rule->arg.map.value);
Christopher Faulet1337b322020-01-14 14:50:55 +01001626 if (!parse_logformat_string(args[cur_arg], px, &rule->arg.map.value, LOG_OPT_HTTP, cap, err)) {
1627 free(rule->arg.map.ref);
Christopher Faulet81e20172019-12-12 16:40:30 +01001628 return ACT_RET_PRS_ERR;
Christopher Faulet1337b322020-01-14 14:50:55 +01001629 }
Christopher Faulet81e20172019-12-12 16:40:30 +01001630 }
1631
1632 free(px->conf.lfs_file);
1633 px->conf.lfs_file = strdup(px->conf.args.file);
1634 px->conf.lfs_line = px->conf.args.line;
1635
1636 *orig_arg = cur_arg + 1;
1637 return ACT_RET_PRS_OK;
1638}
1639
Christopher Fauletac98d812019-12-18 09:20:16 +01001640/* This function executes a track-sc* actions. On success, it returns
1641 * ACT_RET_CONT. Otherwsize ACT_RET_ERR is returned.
1642 */
1643static enum act_return http_action_track_sc(struct act_rule *rule, struct proxy *px,
1644 struct session *sess, struct stream *s, int flags)
1645{
1646 struct stktable *t;
1647 struct stksess *ts;
1648 struct stktable_key *key;
1649 void *ptr1, *ptr2, *ptr3, *ptr4;
1650 int opt;
1651
1652 ptr1 = ptr2 = ptr3 = ptr4 = NULL;
1653 opt = ((rule->from == ACT_F_HTTP_REQ) ? SMP_OPT_DIR_REQ : SMP_OPT_DIR_RES) | SMP_OPT_FINAL;
1654
1655 t = rule->arg.trk_ctr.table.t;
1656 key = stktable_fetch_key(t, s->be, sess, s, opt, rule->arg.trk_ctr.expr, NULL);
1657
1658 if (!key)
1659 goto end;
1660 ts = stktable_get_entry(t, key);
1661 if (!ts)
1662 goto end;
1663
1664 stream_track_stkctr(&s->stkctr[rule->action], t, ts);
1665
1666 /* let's count a new HTTP request as it's the first time we do it */
1667 ptr1 = stktable_data_ptr(t, ts, STKTABLE_DT_HTTP_REQ_CNT);
1668 ptr2 = stktable_data_ptr(t, ts, STKTABLE_DT_HTTP_REQ_RATE);
1669
1670 /* When the client triggers a 4xx from the server, it's most often due
1671 * to a missing object or permission. These events should be tracked
1672 * because if they happen often, it may indicate a brute force or a
1673 * vulnerability scan. Normally this is done when receiving the response
1674 * but here we're tracking after this ought to have been done so we have
1675 * to do it on purpose.
1676 */
1677 if (rule->from == ACT_F_HTTP_RES && (unsigned)(s->txn->status - 400) < 100) {
1678 ptr3 = stktable_data_ptr(t, ts, STKTABLE_DT_HTTP_ERR_CNT);
1679 ptr4 = stktable_data_ptr(t, ts, STKTABLE_DT_HTTP_ERR_RATE);
1680 }
1681
1682 if (ptr1 || ptr2 || ptr3 || ptr4) {
1683 HA_RWLOCK_WRLOCK(STK_SESS_LOCK, &ts->lock);
1684
1685 if (ptr1)
1686 stktable_data_cast(ptr1, http_req_cnt)++;
1687 if (ptr2)
1688 update_freq_ctr_period(&stktable_data_cast(ptr2, http_req_rate),
1689 t->data_arg[STKTABLE_DT_HTTP_REQ_RATE].u, 1);
1690 if (ptr3)
1691 stktable_data_cast(ptr3, http_err_cnt)++;
1692 if (ptr4)
1693 update_freq_ctr_period(&stktable_data_cast(ptr4, http_err_rate),
1694 t->data_arg[STKTABLE_DT_HTTP_ERR_RATE].u, 1);
1695
1696 HA_RWLOCK_WRUNLOCK(STK_SESS_LOCK, &ts->lock);
1697
1698 /* If data was modified, we need to touch to re-schedule sync */
1699 stktable_touch_local(t, ts, 0);
1700 }
1701
1702 stkctr_set_flags(&s->stkctr[rule->action], STKCTR_TRACK_CONTENT);
1703 if (sess->fe != s->be)
1704 stkctr_set_flags(&s->stkctr[rule->action], STKCTR_TRACK_BACKEND);
1705
1706 end:
1707 return ACT_RET_CONT;
1708}
Christopher Faulet81e20172019-12-12 16:40:30 +01001709
Christopher Faulet2eb53962020-01-14 14:47:34 +01001710static void release_http_track_sc(struct act_rule *rule)
1711{
1712 release_sample_expr(rule->arg.trk_ctr.expr);
1713}
1714
Christopher Faulet81e20172019-12-12 16:40:30 +01001715/* Parse a "track-sc*" actions. It returns ACT_RET_PRS_OK on success,
1716 * ACT_RET_PRS_ERR on error.
1717 */
1718static enum act_parse_ret parse_http_track_sc(const char **args, int *orig_arg, struct proxy *px,
1719 struct act_rule *rule, char **err)
1720{
1721 struct sample_expr *expr;
1722 unsigned int where;
1723 unsigned int tsc_num;
1724 const char *tsc_num_str;
1725 int cur_arg;
1726
1727 tsc_num_str = &args[*orig_arg-1][8];
1728 if (cfg_parse_track_sc_num(&tsc_num, tsc_num_str, tsc_num_str + strlen(tsc_num_str), err) == -1)
1729 return ACT_RET_PRS_ERR;
1730
1731 cur_arg = *orig_arg;
1732 expr = sample_parse_expr((char **)args, &cur_arg, px->conf.args.file, px->conf.args.line,
1733 err, &px->conf.args);
1734 if (!expr)
1735 return ACT_RET_PRS_ERR;
1736
1737 where = 0;
1738 if (px->cap & PR_CAP_FE)
1739 where |= (rule->from == ACT_F_HTTP_REQ ? SMP_VAL_FE_HRQ_HDR : SMP_VAL_FE_HRS_HDR);
1740 if (px->cap & PR_CAP_BE)
1741 where |= (rule->from == ACT_F_HTTP_REQ ? SMP_VAL_BE_HRQ_HDR : SMP_VAL_BE_HRS_HDR);
1742
1743 if (!(expr->fetch->val & where)) {
1744 memprintf(err, "fetch method '%s' extracts information from '%s', none of which is available here",
1745 args[cur_arg-1], sample_src_names(expr->fetch->use));
Christopher Faulet1337b322020-01-14 14:50:55 +01001746 release_sample_expr(expr);
Christopher Faulet81e20172019-12-12 16:40:30 +01001747 return ACT_RET_PRS_ERR;
1748 }
1749
1750 if (strcmp(args[cur_arg], "table") == 0) {
1751 cur_arg++;
1752 if (!*args[cur_arg]) {
1753 memprintf(err, "missing table name");
Christopher Faulet1337b322020-01-14 14:50:55 +01001754 release_sample_expr(expr);
Christopher Faulet81e20172019-12-12 16:40:30 +01001755 return ACT_RET_PRS_ERR;
1756 }
1757
1758 /* we copy the table name for now, it will be resolved later */
1759 rule->arg.trk_ctr.table.n = strdup(args[cur_arg]);
1760 cur_arg++;
1761 }
1762
Christopher Fauletac98d812019-12-18 09:20:16 +01001763 rule->action = tsc_num;
Christopher Faulet81e20172019-12-12 16:40:30 +01001764 rule->arg.trk_ctr.expr = expr;
Christopher Fauletac98d812019-12-18 09:20:16 +01001765 rule->action_ptr = http_action_track_sc;
Christopher Faulet2eb53962020-01-14 14:47:34 +01001766 rule->release_ptr = release_http_track_sc;
Christopher Faulet81e20172019-12-12 16:40:30 +01001767 rule->check_ptr = check_trk_action;
1768
1769 *orig_arg = cur_arg;
1770 return ACT_RET_PRS_OK;
1771}
1772
Christopher Faulet46f95542019-12-20 10:07:22 +01001773/* This function executes a strict-mode actions. On success, it always returns
1774 * ACT_RET_CONT
1775 */
1776static enum act_return http_action_strict_mode(struct act_rule *rule, struct proxy *px,
1777 struct session *sess, struct stream *s, int flags)
1778{
1779 struct http_msg *msg = ((rule->from == ACT_F_HTTP_REQ) ? &s->txn->req : &s->txn->rsp);
1780
1781 if (rule->action == 0) // strict-mode on
1782 msg->flags &= ~HTTP_MSGF_SOFT_RW;
1783 else // strict-mode off
1784 msg->flags |= HTTP_MSGF_SOFT_RW;
1785 return ACT_RET_CONT;
1786}
1787
1788/* Parse a "strict-mode" action. It returns ACT_RET_PRS_OK on success,
1789 * ACT_RET_PRS_ERR on error.
1790 */
1791static enum act_parse_ret parse_http_strict_mode(const char **args, int *orig_arg, struct proxy *px,
1792 struct act_rule *rule, char **err)
1793{
1794 int cur_arg;
1795
Christopher Faulet46f95542019-12-20 10:07:22 +01001796 cur_arg = *orig_arg;
1797 if (!*args[cur_arg]) {
1798 memprintf(err, "expects exactly 1 arguments");
1799 return ACT_RET_PRS_ERR;
1800 }
1801
1802 if (strcasecmp(args[cur_arg], "on") == 0)
1803 rule->action = 0; // strict-mode on
1804 else if (strcasecmp(args[cur_arg], "off") == 0)
1805 rule->action = 1; // strict-mode off
1806 else {
1807 memprintf(err, "Unexpected value '%s'. Only 'on' and 'off' are supported", args[cur_arg]);
1808 return ACT_RET_PRS_ERR;
1809 }
1810 rule->action_ptr = http_action_strict_mode;
1811
1812 *orig_arg = cur_arg + 1;
1813 return ACT_RET_PRS_OK;
1814}
1815
Christopher Faulet24231ab2020-01-24 17:44:23 +01001816/* Release <.arg.http_return> */
1817static void release_http_return(struct act_rule *rule)
1818{
1819 struct logformat_node *lf, *lfb;
Christopher Faulet4a2c1422020-01-31 17:36:01 +01001820 struct http_ret_hdr *hdr, *hdrb;
Christopher Faulet24231ab2020-01-24 17:44:23 +01001821
1822 free(rule->arg.http_return.ctype);
Christopher Faulet4a2c1422020-01-31 17:36:01 +01001823
1824 if (rule->arg.http_return.hdrs) {
1825 list_for_each_entry_safe(hdr, hdrb, rule->arg.http_return.hdrs, list) {
1826 LIST_DEL(&hdr->list);
1827 list_for_each_entry_safe(lf, lfb, &hdr->value, list) {
1828 LIST_DEL(&lf->list);
1829 release_sample_expr(lf->expr);
1830 free(lf->arg);
1831 free(lf);
1832 }
1833 free(hdr->name.ptr);
1834 free(hdr);
1835 }
1836 free(rule->arg.http_return.hdrs);
1837 }
1838
Christopher Faulet24231ab2020-01-24 17:44:23 +01001839 if (rule->action == 2) {
1840 chunk_destroy(&rule->arg.http_return.body.obj);
1841 }
1842 else if (rule->action == 3) {
1843 list_for_each_entry_safe(lf, lfb, &rule->arg.http_return.body.fmt, list) {
1844 LIST_DEL(&lf->list);
1845 release_sample_expr(lf->expr);
1846 free(lf->arg);
1847 free(lf);
1848 }
1849 }
1850}
1851
1852/* This function executes a return action. It builds an HTX message from an
1853 * errorfile, an raw file or a log-format string, depending on <.action>
1854 * value. On success, it returns ACT_RET_ABRT. If an error occurs ACT_RET_ERR is
1855 * returned.
1856 */
1857static enum act_return http_action_return(struct act_rule *rule, struct proxy *px,
1858 struct session *sess, struct stream *s, int flags)
1859{
1860 struct channel *req = &s->req;
1861 struct channel *res = &s->res;
1862 struct buffer *errmsg;
1863 struct htx *htx = htx_from_buf(&res->buf);
1864 struct htx_sl *sl;
1865 struct buffer *body = NULL;
1866 const char *status, *reason, *clen, *ctype;
1867 unsigned int slflags;
1868 enum act_return ret = ACT_RET_DONE;
1869
1870 s->txn->status = rule->arg.http_return.status;
1871 channel_htx_truncate(res, htx);
1872
1873 if (rule->action == 1) {
1874 /* implicit or explicit error message*/
1875 errmsg = rule->arg.http_return.body.errmsg;
1876 if (!errmsg) {
1877 /* get default error message */
1878 errmsg = http_error_message(s);
1879 }
1880 if (b_is_null(errmsg))
1881 goto end;
1882 if (!channel_htx_copy_msg(res, htx, errmsg))
1883 goto fail;
1884 }
1885 else {
1886 /* no payload, file or log-format string */
1887 if (rule->action == 2) {
1888 /* file */
1889 body = &rule->arg.http_return.body.obj;
1890 }
1891 else if (rule->action == 3) {
1892 /* log-format string */
1893 body = alloc_trash_chunk();
1894 if (!body)
1895 goto fail_alloc;
1896 body->data = build_logline(s, body->area, body->size, &rule->arg.http_return.body.fmt);
1897 }
1898 /* else no payload */
1899
1900 status = ultoa(rule->arg.http_return.status);
1901 reason = http_get_reason(rule->arg.http_return.status);
1902 slflags = (HTX_SL_F_IS_RESP|HTX_SL_F_VER_11|HTX_SL_F_XFER_LEN|HTX_SL_F_CLEN);
1903 if (!body || !b_data(body))
1904 slflags |= HTX_SL_F_BODYLESS;
1905 sl = htx_add_stline(htx, HTX_BLK_RES_SL, slflags, ist("HTTP/1.1"), ist(status), ist(reason));
1906 if (!sl)
1907 goto fail;
1908 sl->info.res.status = rule->arg.http_return.status;
1909
1910 clen = (body ? ultoa(b_data(body)) : "0");
1911 ctype = rule->arg.http_return.ctype;
1912
Christopher Faulet4a2c1422020-01-31 17:36:01 +01001913 if (rule->arg.http_return.hdrs) {
1914 struct http_ret_hdr *hdr;
1915 struct buffer *value = alloc_trash_chunk();
1916
1917 if (!value)
1918 goto fail;
1919
1920 list_for_each_entry(hdr, rule->arg.http_return.hdrs, list) {
1921 chunk_reset(value);
1922 value->data = build_logline(s, value->area, value->size, &hdr->value);
1923 if (b_data(value) && !htx_add_header(htx, hdr->name, ist2(b_head(value), b_data(value)))) {
1924 free_trash_chunk(value);
1925 goto fail;
1926 }
1927 chunk_reset(value);
1928 }
1929 free_trash_chunk(value);
1930 }
1931
Christopher Faulet24231ab2020-01-24 17:44:23 +01001932 if (!htx_add_header(htx, ist("content-length"), ist(clen)) ||
1933 (body && b_data(body) && ctype && !htx_add_header(htx, ist("content-type"), ist(ctype))) ||
1934 !htx_add_endof(htx, HTX_BLK_EOH) ||
1935 (body && b_data(body) && !htx_add_data_atonce(htx, ist2(b_head(body), b_data(body)))) ||
1936 !htx_add_endof(htx, HTX_BLK_EOM))
1937 goto fail;
1938 }
1939
1940 htx_to_buf(htx, &s->res.buf);
1941 if (!http_forward_proxy_resp(s, 1))
1942 goto fail;
1943
1944 end:
1945 if (rule->from == ACT_F_HTTP_REQ) {
1946 /* let's log the request time */
1947 s->logs.tv_request = now;
1948 req->analysers &= AN_REQ_FLT_END;
1949
1950 if (s->sess->fe == s->be) /* report it if the request was intercepted by the frontend */
1951 _HA_ATOMIC_ADD(&s->sess->fe->fe_counters.intercepted_req, 1);
1952 }
1953
1954 if (!(s->flags & SF_ERR_MASK))
1955 s->flags |= SF_ERR_LOCAL;
1956 if (!(s->flags & SF_FINST_MASK))
1957 s->flags |= ((rule->from == ACT_F_HTTP_REQ) ? SF_FINST_R : SF_FINST_H);
1958
1959 leave:
1960 if (rule->action == 3)
1961 free_trash_chunk(body);
1962 return ret;
1963
1964 fail_alloc:
1965 if (!(s->flags & SF_ERR_MASK))
1966 s->flags |= SF_ERR_RESOURCE;
1967 ret = ACT_RET_ERR;
1968 goto leave;
1969
1970 fail:
1971 /* If an error occurred, remove the incomplete HTTP response from the
1972 * buffer */
1973 channel_htx_truncate(res, htx);
1974 ret = ACT_RET_ERR;
1975 if (!(s->flags & SF_ERR_MASK))
1976 s->flags |= SF_ERR_PRXCOND;
1977 goto leave;
1978}
1979
1980/* Check an "http-request return" action when an http-errors section is referenced.
1981 *
1982 * The function returns 1 in success case, otherwise, it returns 0 and err is
1983 * filled.
1984 */
1985static int check_http_return_action(struct act_rule *rule, struct proxy *px, char **err)
1986{
1987 struct http_errors *http_errs;
1988 int status = (intptr_t)(rule->arg.act.p[0]);
1989 int ret = 1;
1990
1991 list_for_each_entry(http_errs, &http_errors_list, list) {
1992 if (strcmp(http_errs->id, (char *)rule->arg.act.p[1]) == 0) {
1993 free(rule->arg.act.p[1]);
1994 rule->arg.http_return.status = status;
1995 rule->arg.http_return.ctype = NULL;
1996 rule->action = 1;
1997 rule->arg.http_return.body.errmsg = http_errs->errmsg[http_get_status_idx(status)];
1998 rule->action_ptr = http_action_return;
1999 rule->release_ptr = release_http_return;
2000
2001 if (!rule->arg.http_return.body.errmsg)
2002 ha_warning("Proxy '%s': status '%d' referenced by http return rule "
2003 "not declared in http-errors section '%s'.\n",
2004 px->id, status, http_errs->id);
2005 break;
2006 }
2007 }
2008
2009 if (&http_errs->list == &http_errors_list) {
2010 memprintf(err, "unknown http-errors section '%s' referenced by http return rule",
2011 (char *)rule->arg.act.p[1]);
2012 free(rule->arg.act.p[1]);
2013 ret = 0;
2014 }
2015
2016 return ret;
2017}
2018
2019/* Parse a "return" action. It returns ACT_RET_PRS_OK on success,
2020 * ACT_RET_PRS_ERR on error. This function creates 4 action types:
2021 *
2022 * - action 0 : dummy response, no payload
2023 * - action 1 : implicit error message depending on the status code or explicit one
2024 * - action 2 : explicit file oject ('file' argument)
2025 * - action 3 : explicit log-format string ('content' argument)
2026 *
2027 * The content-type must be defined for non-empty payload. It is ignored for
2028 * error messages (implicit or explicit). When an http-errors section is
2029 * referenced, action is set to -1 and the real action is resolved during the
2030 * configuration validity check.
2031 */
2032static enum act_parse_ret parse_http_return(const char **args, int *orig_arg, struct proxy *px,
2033 struct act_rule *rule, char **err)
2034{
2035 struct logformat_node *lf, *lfb;
Christopher Faulet4a2c1422020-01-31 17:36:01 +01002036 struct http_ret_hdr *hdr, *hdrb;
2037 struct list *hdrs = NULL;
Christopher Faulet24231ab2020-01-24 17:44:23 +01002038 struct stat stat;
2039 const char *file = NULL, *act_arg = NULL;
2040 char *obj = NULL, *ctype = NULL, *name = NULL;
2041 int cur_arg, cap, objlen = 0, action = 0, status = 200, fd = -1;
2042
Christopher Faulet4a2c1422020-01-31 17:36:01 +01002043 hdrs = calloc(1, sizeof(*hdrs));
2044 if (!hdrs) {
2045 memprintf(err, "out of memory");
2046 goto error;
2047 }
2048 LIST_INIT(hdrs);
Christopher Faulet24231ab2020-01-24 17:44:23 +01002049
Christopher Faulet4a2c1422020-01-31 17:36:01 +01002050 cur_arg = *orig_arg;
Christopher Faulet24231ab2020-01-24 17:44:23 +01002051 while (*args[cur_arg]) {
2052 if (strcmp(args[cur_arg], "status") == 0) {
2053 cur_arg++;
2054 if (!*args[cur_arg]) {
2055 memprintf(err, "'%s' expects <status_code> as argument", args[cur_arg-1]);
Christopher Faulet817c4e32020-02-07 10:26:23 +01002056 goto error;
Christopher Faulet24231ab2020-01-24 17:44:23 +01002057 }
2058 status = atol(args[cur_arg]);
2059 if (status < 200 || status > 599) {
2060 memprintf(err, "Unexpected status code '%d'", status);
2061 goto error;
2062 }
2063 cur_arg++;
2064 }
2065 else if (strcmp(args[cur_arg], "content-type") == 0) {
2066 cur_arg++;
2067 if (!*args[cur_arg]) {
2068 memprintf(err, "'%s' expects <ctype> as argument", args[cur_arg-1]);
2069 goto error;
2070 }
2071 free(ctype);
2072 ctype = strdup(args[cur_arg]);
2073 cur_arg++;
2074 }
2075 else if (strcmp(args[cur_arg], "errorfiles") == 0) {
2076 if (action != 0) {
2077 memprintf(err, "unexpected '%s' argument, '%s' already defined", args[cur_arg], act_arg);
2078 goto error;
2079 }
2080 act_arg = args[cur_arg];
2081 cur_arg++;
2082 if (!*args[cur_arg]) {
2083 memprintf(err, "'%s' expects <name> as argument", args[cur_arg-1]);
2084 goto error;
2085 }
2086 /* Must be resolved during the config validity check */
2087 name = strdup(args[cur_arg]);
2088 action = -1;
2089 cur_arg++;
2090 }
2091 else if (strcmp(args[cur_arg], "default-errorfiles") == 0) {
2092 if (action != 0) {
2093 memprintf(err, "unexpected '%s' argument, '%s' already defined", args[cur_arg], act_arg);
2094 goto error;
2095 }
2096 act_arg = args[cur_arg];
2097 action = 1;
2098 cur_arg++;
2099 }
2100 else if (strcmp(args[cur_arg], "errorfile") == 0) {
2101 if (action != 0) {
2102 memprintf(err, "unexpected '%s' argument, '%s' already defined", args[cur_arg], act_arg);
2103 goto error;
2104 }
2105 act_arg = args[cur_arg];
2106 cur_arg++;
2107 if (!*args[cur_arg]) {
2108 memprintf(err, "'%s' expects <fmt> as argument", args[cur_arg-1]);
2109 goto error;
2110 }
2111 file = args[cur_arg];
2112 rule->arg.http_return.body.errmsg = http_load_errorfile(args[cur_arg], err);
2113 if (!rule->arg.http_return.body.errmsg) {
2114 goto error;
2115 }
2116 action = 1;
2117 cur_arg++;
2118 }
2119 else if (strcmp(args[cur_arg], "file") == 0) {
2120 if (action != 0) {
2121 memprintf(err, "unexpected '%s' argument, '%s' already defined", args[cur_arg], act_arg);
2122 goto error;
2123 }
2124 act_arg = args[cur_arg];
2125 cur_arg++;
2126 if (!*args[cur_arg]) {
2127 memprintf(err, "'%s' expects <file> as argument", args[cur_arg-1]);
2128 goto error;
2129 }
2130 file = args[cur_arg];
2131 fd = open(args[cur_arg], O_RDONLY);
2132 if ((fd < 0) || (fstat(fd, &stat) < 0)) {
2133 memprintf(err, "error opening file '%s'", args[cur_arg]);
2134 goto error;
2135 }
2136 if (stat.st_size > global.tune.bufsize) {
2137 memprintf(err, "file '%s' exceeds the buffer size (%ld > %d)",
2138 args[cur_arg], stat.st_size, global.tune.bufsize);
2139 goto error;
2140 }
2141 objlen = stat.st_size;
2142 obj = malloc(objlen);
2143 if (!obj || read(fd, obj, objlen) != objlen) {
2144 memprintf(err, "error reading file '%s'", args[cur_arg]);
2145 goto error;
2146 }
2147 close(fd);
2148 fd = -1;
2149 action = 2;
2150 cur_arg++;
2151 }
2152 else if (strcmp(args[cur_arg], "string") == 0) {
2153 if (action != 0) {
2154 memprintf(err, "unexpected '%s' argument, '%s' already defined", args[cur_arg], act_arg);
2155 goto error;
2156 }
2157 act_arg = args[cur_arg];
2158 cur_arg++;
2159 if (!*args[cur_arg]) {
2160 memprintf(err, "'%s' expects <str> as argument", args[cur_arg-1]);
2161 goto error;
2162 }
2163 obj = strdup(args[cur_arg]);
2164 objlen = strlen(args[cur_arg]);
2165 action = 2;
2166 cur_arg++;
2167 }
2168 else if (strcmp(args[cur_arg], "lf-file") == 0) {
2169 if (action != 0) {
2170 memprintf(err, "unexpected '%s' argument, '%s' already defined", args[cur_arg], act_arg);
2171 goto error;
2172 }
2173 act_arg = args[cur_arg];
2174 cur_arg++;
2175 if (!*args[cur_arg]) {
2176 memprintf(err, "'%s' expects <file> as argument", args[cur_arg-1]);
2177 goto error;
2178 }
2179 file = args[cur_arg];
2180 fd = open(args[cur_arg], O_RDONLY);
2181 if ((fd < 0) || (fstat(fd, &stat) < 0)) {
2182 memprintf(err, "error opening file '%s'", args[cur_arg]);
2183 goto error;
2184 }
2185 if (stat.st_size > global.tune.bufsize) {
2186 memprintf(err, "file '%s' exceeds the buffer size (%ld > %d)",
2187 args[cur_arg], stat.st_size, global.tune.bufsize);
2188 goto error;
2189 }
2190 objlen = stat.st_size;
2191 obj = malloc(objlen + 1);
2192 if (!obj || read(fd, obj, objlen) != objlen) {
2193 memprintf(err, "error reading file '%s'", args[cur_arg]);
2194 goto error;
2195 }
2196 close(fd);
2197 fd = -1;
2198 obj[objlen] = '\0';
2199 action = 3;
2200 cur_arg++;
2201 }
2202 else if (strcmp(args[cur_arg], "lf-string") == 0) {
2203 if (action != 0) {
2204 memprintf(err, "unexpected '%s' argument, '%s' already defined", args[cur_arg], act_arg);
2205 goto error;
2206 }
2207 act_arg = args[cur_arg];
2208 cur_arg++;
2209 if (!*args[cur_arg]) {
2210 memprintf(err, "'%s' expects <fmt> as argument", args[cur_arg-1]);
2211 goto error;
2212 }
2213 obj = strdup(args[cur_arg]);
2214 objlen = strlen(args[cur_arg]);
2215 action = 3;
2216 cur_arg++;
2217 }
Christopher Faulet4a2c1422020-01-31 17:36:01 +01002218 else if (strcmp(args[cur_arg], "hdr") == 0) {
2219 cur_arg++;
2220 if (!*args[cur_arg] || !*args[cur_arg+1]) {
2221 memprintf(err, "'%s' expects <name> and <value> as arguments", args[cur_arg-1]);
2222 goto error;
2223 }
2224 if (strcasecmp(args[cur_arg], "content-length") == 0 ||
2225 strcasecmp(args[cur_arg], "transfer-encoding") == 0 ||
2226 strcasecmp(args[cur_arg], "content-type") == 0) {
2227 ha_warning("parsing [%s:%d] : 'http-%s return' : header '%s' ignored.\n",
2228 px->conf.args.file, px->conf.args.line,
2229 (rule->from == ACT_F_HTTP_REQ ? "request" : "response"),
2230 args[cur_arg]);
2231 cur_arg += 2;
2232 continue;
2233 }
2234 hdr = calloc(1, sizeof(*hdr));
2235 if (!hdr) {
2236 memprintf(err, "'%s' : out of memory", args[cur_arg-1]);
2237 goto error;
2238 }
2239 LIST_INIT(&hdr->value);
2240 hdr->name = ist(strdup(args[cur_arg]));
2241 LIST_ADDQ(hdrs, &hdr->list);
2242
2243 if (rule->from == ACT_F_HTTP_REQ) {
2244 px->conf.args.ctx = ARGC_HRQ;
2245 cap = (px->cap & PR_CAP_FE) ? SMP_VAL_FE_HRQ_HDR : SMP_VAL_BE_HRQ_HDR;
2246 }
2247 else {
2248 px->conf.args.ctx = ARGC_HRS;
2249 cap = (px->cap & PR_CAP_BE) ? SMP_VAL_BE_HRS_HDR : SMP_VAL_FE_HRS_HDR;
2250 }
2251 if (!parse_logformat_string(args[cur_arg+1], px, &hdr->value, LOG_OPT_HTTP, cap, err))
2252 goto error;
2253
2254 free(px->conf.lfs_file);
2255 px->conf.lfs_file = strdup(px->conf.args.file);
2256 px->conf.lfs_line = px->conf.args.line;
2257 cur_arg += 2;
2258 }
Christopher Faulet24231ab2020-01-24 17:44:23 +01002259 else
2260 break;
2261 }
2262
2263
2264 if (action == -1) { /* errorfiles */
2265 int rc;
2266
2267 for (rc = 0; rc < HTTP_ERR_SIZE; rc++) {
2268 if (http_err_codes[rc] == status)
2269 break;
2270 }
2271
2272 if (rc >= HTTP_ERR_SIZE) {
2273 memprintf(err, "status code '%d' not handled by default with '%s' argument.",
2274 status, act_arg);
2275 goto error;
2276 }
2277 if (ctype) {
2278 ha_warning("parsing [%s:%d] : 'http-%s return' : content-type '%s' ignored when the "
2279 "returned response is an erorrfile.\n",
2280 px->conf.args.file, px->conf.args.line,
2281 (rule->from == ACT_F_HTTP_REQ ? "request" : "response"),
2282 ctype);
2283 free(ctype);
2284 ctype = NULL;
2285 }
Christopher Faulet4a2c1422020-01-31 17:36:01 +01002286 if (!LIST_ISEMPTY(hdrs)) {
2287 ha_warning("parsing [%s:%d] : 'http-%s return' : hdr parameters ignored when the "
2288 "returned response is an erorrfile.\n",
2289 px->conf.args.file, px->conf.args.line,
2290 (rule->from == ACT_F_HTTP_REQ ? "request" : "response"));
2291 list_for_each_entry_safe(hdr, hdrb, hdrs, list) {
2292 LIST_DEL(&hdr->list);
2293 list_for_each_entry_safe(lf, lfb, &hdr->value, list) {
2294 LIST_DEL(&lf->list);
2295 release_sample_expr(lf->expr);
2296 free(lf->arg);
2297 free(lf);
2298 }
2299 free(hdr->name.ptr);
2300 free(hdr);
2301 }
2302 }
2303 free(hdrs);
2304 hdrs = NULL;
Christopher Faulet24231ab2020-01-24 17:44:23 +01002305
2306 rule->arg.act.p[0] = (void *)((intptr_t)status);
2307 rule->arg.act.p[1] = name;
2308 rule->check_ptr = check_http_return_action;
2309 goto out;
2310 }
2311 else if (action == 0) { /* no payload */
2312 if (ctype) {
2313 ha_warning("parsing [%s:%d] : 'http-%s return' : content-type '%s' ignored because"
2314 " neither errorfile nor payload defined.\n",
2315 px->conf.args.file, px->conf.args.line,
2316 (rule->from == ACT_F_HTTP_REQ ? "request" : "response"),
2317 ctype);
2318 free(ctype);
2319 ctype = NULL;
2320 }
2321 }
2322 else if (action == 1) { /* errorfile */
2323 if (!rule->arg.http_return.body.errmsg) { /* default errorfile */
2324 int rc;
2325
2326 for (rc = 0; rc < HTTP_ERR_SIZE; rc++) {
2327 if (http_err_codes[rc] == status)
2328 break;
2329 }
2330
2331 if (rc >= HTTP_ERR_SIZE) {
2332 memprintf(err, "status code '%d' not handled by default with '%s' argument",
2333 status, act_arg);
2334 goto error;
2335 }
2336 if (ctype) {
2337 ha_warning("parsing [%s:%d] : 'http-%s return' : content-type '%s' ignored when the "
2338 "returned response is an erorrfile.\n",
2339 px->conf.args.file, px->conf.args.line,
2340 (rule->from == ACT_F_HTTP_REQ ? "request" : "response"),
2341 ctype);
2342 free(ctype);
2343 ctype = NULL;
2344 }
2345 }
2346 else { /* explicit payload using 'errorfile' parameter */
2347 if (ctype) {
2348 ha_warning("parsing [%s:%d] : 'http-%s return' : content-type '%s' ignored because"
2349 " the errorfile '%s' is used.\n",
2350 px->conf.args.file, px->conf.args.line,
2351 (rule->from == ACT_F_HTTP_REQ ? "request" : "response"),
2352 ctype, file);
2353 free(ctype);
2354 ctype = NULL;
2355 }
2356 }
Christopher Faulet4a2c1422020-01-31 17:36:01 +01002357 if (!LIST_ISEMPTY(hdrs)) {
2358 ha_warning("parsing [%s:%d] : 'http-%s return' : hdr parameters ignored when the "
2359 "returned response is an erorrfile.\n",
2360 px->conf.args.file, px->conf.args.line,
2361 (rule->from == ACT_F_HTTP_REQ ? "request" : "response"));
2362 list_for_each_entry_safe(hdr, hdrb, hdrs, list) {
2363 LIST_DEL(&hdr->list);
2364 list_for_each_entry_safe(lf, lfb, &hdr->value, list) {
2365 LIST_DEL(&lf->list);
2366 release_sample_expr(lf->expr);
2367 free(lf->arg);
2368 free(lf);
2369 }
2370 free(hdr->name.ptr);
2371 free(hdr);
2372 }
2373 }
2374 free(hdrs);
2375 hdrs = NULL;
Christopher Faulet24231ab2020-01-24 17:44:23 +01002376 }
2377 else if (action == 2) { /* explicit parameter using 'file' parameter*/
2378 if (!ctype && objlen) {
2379 memprintf(err, "a content type must be defined when non-empty payload is configured");
2380 goto error;
2381 }
2382 if (ctype && !objlen) {
2383 ha_warning("parsing [%s:%d] : 'http-%s return' : content-type '%s' ignored when the "
2384 "configured payload is empty.\n",
2385 px->conf.args.file, px->conf.args.line,
2386 (rule->from == ACT_F_HTTP_REQ ? "request" : "response"),
2387 ctype);
2388 free(ctype);
2389 ctype = NULL;
2390 }
2391 if (global.tune.bufsize - objlen < global.tune.maxrewrite) {
2392 ha_warning("parsing [%s:%d] : 'http-%s return' : the payload runs ober the buffer space reserved to headers rewritting."
2393 " It may lead to internal errors if strict rewritting mode is enabled.\n",
2394 px->conf.args.file, px->conf.args.line,
2395 (rule->from == ACT_F_HTTP_REQ ? "request" : "response"));
2396 }
2397 chunk_initlen(&rule->arg.http_return.body.obj, obj, global.tune.bufsize, objlen);
2398 }
2399 else if (action == 3) { /* log-format payload using 'lf-file' of 'lf-string' parameter */
2400 LIST_INIT(&rule->arg.http_return.body.fmt);
2401 if (!ctype) {
2402 memprintf(err, "a content type must be defined with a log-format payload");
2403 goto error;
2404 }
2405 if (rule->from == ACT_F_HTTP_REQ) {
2406 px->conf.args.ctx = ARGC_HRQ;
2407 cap = (px->cap & PR_CAP_FE) ? SMP_VAL_FE_HRQ_HDR : SMP_VAL_BE_HRQ_HDR;
2408 }
2409 else {
2410 px->conf.args.ctx = ARGC_HRS;
2411 cap = (px->cap & PR_CAP_BE) ? SMP_VAL_BE_HRS_HDR : SMP_VAL_FE_HRS_HDR;
2412 }
2413 if (!parse_logformat_string(obj, px, &rule->arg.http_return.body.fmt, LOG_OPT_HTTP, cap, err))
2414 goto error;
2415
2416 free(px->conf.lfs_file);
2417 px->conf.lfs_file = strdup(px->conf.args.file);
2418 px->conf.lfs_line = px->conf.args.line;
2419 free(obj);
2420 }
2421
2422 rule->arg.http_return.status = status;
2423 rule->arg.http_return.ctype = ctype;
Christopher Faulet4a2c1422020-01-31 17:36:01 +01002424 rule->arg.http_return.hdrs = hdrs;
Christopher Faulet24231ab2020-01-24 17:44:23 +01002425 rule->action = action;
2426 rule->action_ptr = http_action_return;
2427 rule->release_ptr = release_http_return;
2428
2429 out:
2430 *orig_arg = cur_arg;
2431 return ACT_RET_PRS_OK;
2432
2433 error:
2434 free(obj);
2435 free(ctype);
2436 free(name);
2437 if (fd >= 0)
2438 close(fd);
Christopher Faulet817c4e32020-02-07 10:26:23 +01002439 if (hdrs) {
2440 list_for_each_entry_safe(hdr, hdrb, hdrs, list) {
2441 LIST_DEL(&hdr->list);
2442 list_for_each_entry_safe(lf, lfb, &hdr->value, list) {
2443 LIST_DEL(&lf->list);
2444 release_sample_expr(lf->expr);
2445 free(lf->arg);
2446 free(lf);
2447 }
2448 free(hdr->name.ptr);
2449 free(hdr);
Christopher Faulet4a2c1422020-01-31 17:36:01 +01002450 }
Christopher Faulet817c4e32020-02-07 10:26:23 +01002451 free(hdrs);
Christopher Faulet4a2c1422020-01-31 17:36:01 +01002452 }
Christopher Faulet24231ab2020-01-24 17:44:23 +01002453 if (action == 3) {
2454 list_for_each_entry_safe(lf, lfb, &rule->arg.http_return.body.fmt, list) {
2455 LIST_DEL(&lf->list);
2456 release_sample_expr(lf->expr);
2457 free(lf->arg);
2458 free(lf);
2459 }
2460 }
2461 free(rule->arg.http_return.ctype);
2462 return ACT_RET_PRS_ERR;
2463}
2464
Willy Tarreau79e57332018-10-02 16:01:16 +02002465/************************************************************************/
2466/* All supported http-request action keywords must be declared here. */
2467/************************************************************************/
2468
2469static struct action_kw_list http_req_actions = {
2470 .kw = {
Christopher Faulet81e20172019-12-12 16:40:30 +01002471 { "add-acl", parse_http_set_map, 1 },
2472 { "add-header", parse_http_set_header, 0 },
2473 { "allow", parse_http_allow, 0 },
2474 { "auth", parse_http_auth, 0 },
2475 { "capture", parse_http_req_capture, 0 },
2476 { "del-acl", parse_http_set_map, 1 },
2477 { "del-header", parse_http_del_header, 0 },
2478 { "del-map", parse_http_set_map, 1 },
Christopher Faulete0fca292020-01-13 21:49:03 +01002479 { "deny", parse_http_deny, 0 },
Christopher Faulet81e20172019-12-12 16:40:30 +01002480 { "disable-l7-retry", parse_http_req_disable_l7_retry, 0 },
2481 { "early-hint", parse_http_set_header, 0 },
2482 { "redirect", parse_http_redirect, 0 },
2483 { "reject", parse_http_action_reject, 0 },
2484 { "replace-header", parse_http_replace_header, 0 },
2485 { "replace-path", parse_replace_uri, 0 },
2486 { "replace-uri", parse_replace_uri, 0 },
2487 { "replace-value", parse_http_replace_header, 0 },
Christopher Faulet24231ab2020-01-24 17:44:23 +01002488 { "return", parse_http_return, 0 },
Christopher Faulet81e20172019-12-12 16:40:30 +01002489 { "set-header", parse_http_set_header, 0 },
2490 { "set-log-level", parse_http_set_log_level, 0 },
2491 { "set-map", parse_http_set_map, 1 },
2492 { "set-method", parse_set_req_line, 0 },
2493 { "set-mark", parse_http_set_mark, 0 },
2494 { "set-nice", parse_http_set_nice, 0 },
2495 { "set-path", parse_set_req_line, 0 },
2496 { "set-query", parse_set_req_line, 0 },
2497 { "set-tos", parse_http_set_tos, 0 },
2498 { "set-uri", parse_set_req_line, 0 },
Christopher Faulet46f95542019-12-20 10:07:22 +01002499 { "strict-mode", parse_http_strict_mode, 0 },
Christopher Faulete0fca292020-01-13 21:49:03 +01002500 { "tarpit", parse_http_deny, 0 },
Christopher Faulet81e20172019-12-12 16:40:30 +01002501 { "track-sc", parse_http_track_sc, 1 },
Willy Tarreau79e57332018-10-02 16:01:16 +02002502 { NULL, NULL }
2503 }
2504};
2505
Willy Tarreau0108d902018-11-25 19:14:37 +01002506INITCALL1(STG_REGISTER, http_req_keywords_register, &http_req_actions);
2507
Willy Tarreau79e57332018-10-02 16:01:16 +02002508static struct action_kw_list http_res_actions = {
2509 .kw = {
Christopher Faulet81e20172019-12-12 16:40:30 +01002510 { "add-acl", parse_http_set_map, 1 },
2511 { "add-header", parse_http_set_header, 0 },
2512 { "allow", parse_http_allow, 0 },
2513 { "capture", parse_http_res_capture, 0 },
2514 { "del-acl", parse_http_set_map, 1 },
2515 { "del-header", parse_http_del_header, 0 },
2516 { "del-map", parse_http_set_map, 1 },
Christopher Faulete0fca292020-01-13 21:49:03 +01002517 { "deny", parse_http_deny, 0 },
Christopher Faulet81e20172019-12-12 16:40:30 +01002518 { "redirect", parse_http_redirect, 0 },
2519 { "replace-header", parse_http_replace_header, 0 },
2520 { "replace-value", parse_http_replace_header, 0 },
Christopher Faulet24231ab2020-01-24 17:44:23 +01002521 { "return", parse_http_return, 0 },
Christopher Faulet81e20172019-12-12 16:40:30 +01002522 { "set-header", parse_http_set_header, 0 },
2523 { "set-log-level", parse_http_set_log_level, 0 },
2524 { "set-map", parse_http_set_map, 1 },
2525 { "set-mark", parse_http_set_mark, 0 },
2526 { "set-nice", parse_http_set_nice, 0 },
2527 { "set-status", parse_http_set_status, 0 },
2528 { "set-tos", parse_http_set_tos, 0 },
Christopher Faulet46f95542019-12-20 10:07:22 +01002529 { "strict-mode", parse_http_strict_mode, 0 },
Christopher Faulet81e20172019-12-12 16:40:30 +01002530 { "track-sc", parse_http_track_sc, 1 },
Willy Tarreau79e57332018-10-02 16:01:16 +02002531 { NULL, NULL }
2532 }
2533};
2534
Willy Tarreau0108d902018-11-25 19:14:37 +01002535INITCALL1(STG_REGISTER, http_res_keywords_register, &http_res_actions);
Willy Tarreau79e57332018-10-02 16:01:16 +02002536
Christopher Faulet6d0c3df2020-01-22 09:26:35 +01002537static struct action_kw_list http_after_res_actions = {
2538 .kw = {
2539 { "add-header", parse_http_set_header, 0 },
2540 { "allow", parse_http_allow, 0 },
2541 { "del-header", parse_http_del_header, 0 },
2542 { "replace-header", parse_http_replace_header, 0 },
2543 { "replace-value", parse_http_replace_header, 0 },
2544 { "set-header", parse_http_set_header, 0 },
2545 { "set-status", parse_http_set_status, 0 },
2546 { "strict-mode", parse_http_strict_mode, 0 },
2547 { NULL, NULL }
2548 }
2549};
2550
2551INITCALL1(STG_REGISTER, http_after_res_keywords_register, &http_after_res_actions);
2552
Willy Tarreau79e57332018-10-02 16:01:16 +02002553/*
2554 * Local variables:
2555 * c-indent-level: 8
2556 * c-basic-offset: 8
2557 * End:
2558 */