blob: 80a7c66b3fddeee6b33a8232a647680b75de8a00 [file] [log] [blame]
Willy Tarreaue6b98942007-10-29 01:09:36 +01001/*
2 * AF_INET/AF_INET6 SOCK_STREAM protocol layer (tcp)
3 *
Willy Tarreau1a687942010-05-23 22:40:30 +02004 * Copyright 2000-2010 Willy Tarreau <w@1wt.eu>
Willy Tarreaue6b98942007-10-29 01:09:36 +01005 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
13#include <ctype.h>
14#include <errno.h>
15#include <fcntl.h>
16#include <stdio.h>
17#include <stdlib.h>
18#include <string.h>
19#include <time.h>
20
21#include <sys/param.h>
22#include <sys/socket.h>
23#include <sys/stat.h>
24#include <sys/types.h>
25#include <sys/un.h>
26
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +040027#include <netinet/tcp.h>
28
Willy Tarreaub6866442008-07-14 23:54:42 +020029#include <common/cfgparse.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010030#include <common/compat.h>
31#include <common/config.h>
32#include <common/debug.h>
33#include <common/errors.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010034#include <common/mini-clist.h>
35#include <common/standard.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010036
Willy Tarreaue6b98942007-10-29 01:09:36 +010037#include <types/global.h>
Willy Tarreau9650f372009-08-16 14:02:45 +020038#include <types/server.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010039
40#include <proto/acl.h>
Willy Tarreau9fcb9842012-04-20 14:45:49 +020041#include <proto/arg.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010042#include <proto/buffers.h>
Willy Tarreau03fa5df2010-05-24 21:02:37 +020043#include <proto/frontend.h>
Willy Tarreau9650f372009-08-16 14:02:45 +020044#include <proto/log.h>
45#include <proto/port_range.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010046#include <proto/protocols.h>
47#include <proto/proto_tcp.h>
Willy Tarreaub6866442008-07-14 23:54:42 +020048#include <proto/proxy.h>
Willy Tarreaucd3b0942012-04-27 21:52:18 +020049#include <proto/sample.h>
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +020050#include <proto/session.h>
Willy Tarreaua975b8f2010-06-05 19:13:27 +020051#include <proto/stick_table.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010052#include <proto/stream_sock.h>
Willy Tarreaua975b8f2010-06-05 19:13:27 +020053#include <proto/task.h>
Emeric Brun97679e72010-09-23 17:56:44 +020054#include <proto/buffers.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010055
Willy Tarreaue8c66af2008-01-13 18:40:14 +010056#ifdef CONFIG_HAP_CTTPROXY
57#include <import/ip_tproxy.h>
58#endif
59
Emeric Bruncf20bf12010-10-22 16:06:11 +020060static int tcp_bind_listeners(struct protocol *proto, char *errmsg, int errlen);
61static int tcp_bind_listener(struct listener *listener, char *errmsg, int errlen);
Willy Tarreaue6b98942007-10-29 01:09:36 +010062
63/* Note: must not be declared <const> as its list will be overwritten */
64static struct protocol proto_tcpv4 = {
65 .name = "tcpv4",
66 .sock_domain = AF_INET,
67 .sock_type = SOCK_STREAM,
68 .sock_prot = IPPROTO_TCP,
69 .sock_family = AF_INET,
70 .sock_addrlen = sizeof(struct sockaddr_in),
71 .l3_addrlen = 32/8,
Willy Tarreaubbebbbf2012-05-07 21:22:09 +020072 .accept = &listener_accept,
Willy Tarreau26d8c592012-05-07 18:12:14 +020073 .connect = tcp_connect_server,
Emeric Bruncf20bf12010-10-22 16:06:11 +020074 .bind = tcp_bind_listener,
Willy Tarreaue6b98942007-10-29 01:09:36 +010075 .bind_all = tcp_bind_listeners,
76 .unbind_all = unbind_all_listeners,
77 .enable_all = enable_all_listeners,
78 .listeners = LIST_HEAD_INIT(proto_tcpv4.listeners),
79 .nb_listeners = 0,
80};
81
82/* Note: must not be declared <const> as its list will be overwritten */
83static struct protocol proto_tcpv6 = {
84 .name = "tcpv6",
85 .sock_domain = AF_INET6,
86 .sock_type = SOCK_STREAM,
87 .sock_prot = IPPROTO_TCP,
88 .sock_family = AF_INET6,
89 .sock_addrlen = sizeof(struct sockaddr_in6),
90 .l3_addrlen = 128/8,
Willy Tarreaubbebbbf2012-05-07 21:22:09 +020091 .accept = &listener_accept,
Willy Tarreau26d8c592012-05-07 18:12:14 +020092 .connect = tcp_connect_server,
Emeric Bruncf20bf12010-10-22 16:06:11 +020093 .bind = tcp_bind_listener,
Willy Tarreaue6b98942007-10-29 01:09:36 +010094 .bind_all = tcp_bind_listeners,
95 .unbind_all = unbind_all_listeners,
96 .enable_all = enable_all_listeners,
97 .listeners = LIST_HEAD_INIT(proto_tcpv6.listeners),
98 .nb_listeners = 0,
99};
100
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100101
David du Colombier6f5ccb12011-03-10 22:26:24 +0100102/* Binds ipv4/ipv6 address <local> to socket <fd>, unless <flags> is set, in which
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100103 * case we try to bind <remote>. <flags> is a 2-bit field consisting of :
104 * - 0 : ignore remote address (may even be a NULL pointer)
105 * - 1 : use provided address
106 * - 2 : use provided port
107 * - 3 : use both
108 *
109 * The function supports multiple foreign binding methods :
110 * - linux_tproxy: we directly bind to the foreign address
111 * - cttproxy: we bind to a local address then nat.
112 * The second one can be used as a fallback for the first one.
113 * This function returns 0 when everything's OK, 1 if it could not bind, to the
114 * local address, 2 if it could not bind to the foreign address.
115 */
David du Colombier6f5ccb12011-03-10 22:26:24 +0100116int tcp_bind_socket(int fd, int flags, struct sockaddr_storage *local, struct sockaddr_storage *remote)
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100117{
David du Colombier6f5ccb12011-03-10 22:26:24 +0100118 struct sockaddr_storage bind_addr;
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100119 int foreign_ok = 0;
120 int ret;
121
122#ifdef CONFIG_HAP_LINUX_TPROXY
123 static int ip_transp_working = 1;
124 if (flags && ip_transp_working) {
Simon Hormande072bd2011-06-24 15:11:37 +0900125 if (setsockopt(fd, SOL_IP, IP_TRANSPARENT, &one, sizeof(one)) == 0
126 || setsockopt(fd, SOL_IP, IP_FREEBIND, &one, sizeof(one)) == 0)
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100127 foreign_ok = 1;
128 else
129 ip_transp_working = 0;
130 }
131#endif
132 if (flags) {
133 memset(&bind_addr, 0, sizeof(bind_addr));
Willy Tarreau96dd0792011-04-19 07:20:57 +0200134 bind_addr.ss_family = remote->ss_family;
David du Colombier6f5ccb12011-03-10 22:26:24 +0100135 switch (remote->ss_family) {
136 case AF_INET:
137 if (flags & 1)
138 ((struct sockaddr_in *)&bind_addr)->sin_addr = ((struct sockaddr_in *)remote)->sin_addr;
139 if (flags & 2)
140 ((struct sockaddr_in *)&bind_addr)->sin_port = ((struct sockaddr_in *)remote)->sin_port;
141 break;
142 case AF_INET6:
143 if (flags & 1)
144 ((struct sockaddr_in6 *)&bind_addr)->sin6_addr = ((struct sockaddr_in6 *)remote)->sin6_addr;
145 if (flags & 2)
146 ((struct sockaddr_in6 *)&bind_addr)->sin6_port = ((struct sockaddr_in6 *)remote)->sin6_port;
147 break;
Willy Tarreau5dc1e982011-12-16 21:25:11 +0100148 default:
149 /* we don't want to try to bind to an unknown address family */
150 foreign_ok = 0;
David du Colombier6f5ccb12011-03-10 22:26:24 +0100151 }
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100152 }
153
Simon Hormande072bd2011-06-24 15:11:37 +0900154 setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one));
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100155 if (foreign_ok) {
Willy Tarreau1b4b7ce2011-04-05 16:56:50 +0200156 ret = bind(fd, (struct sockaddr *)&bind_addr, get_addr_len(&bind_addr));
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100157 if (ret < 0)
158 return 2;
159 }
160 else {
Willy Tarreau1b4b7ce2011-04-05 16:56:50 +0200161 ret = bind(fd, (struct sockaddr *)local, get_addr_len(local));
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100162 if (ret < 0)
163 return 1;
164 }
165
166 if (!flags)
167 return 0;
168
169#ifdef CONFIG_HAP_CTTPROXY
Willy Tarreau6f831b42011-03-20 14:03:54 +0100170 if (!foreign_ok && remote->ss_family == AF_INET) {
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100171 struct in_tproxy itp1, itp2;
172 memset(&itp1, 0, sizeof(itp1));
173
174 itp1.op = TPROXY_ASSIGN;
Willy Tarreau6f831b42011-03-20 14:03:54 +0100175 itp1.v.addr.faddr = ((struct sockaddr_in *)&bind_addr)->sin_addr;
176 itp1.v.addr.fport = ((struct sockaddr_in *)&bind_addr)->sin_port;
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100177
178 /* set connect flag on socket */
179 itp2.op = TPROXY_FLAGS;
180 itp2.v.flags = ITP_CONNECT | ITP_ONCE;
181
182 if (setsockopt(fd, SOL_IP, IP_TPROXY, &itp1, sizeof(itp1)) != -1 &&
183 setsockopt(fd, SOL_IP, IP_TPROXY, &itp2, sizeof(itp2)) != -1) {
184 foreign_ok = 1;
185 }
186 }
187#endif
188 if (!foreign_ok)
189 /* we could not bind to a foreign address */
190 return 2;
191
192 return 0;
193}
Willy Tarreaue6b98942007-10-29 01:09:36 +0100194
Willy Tarreau9650f372009-08-16 14:02:45 +0200195
196/*
Willy Tarreauac825402011-03-04 22:04:29 +0100197 * This function initiates a connection to the target assigned to this session
Willy Tarreau6471afb2011-09-23 10:54:59 +0200198 * (si->{target,addr.to}). A source address may be pointed to by si->addr.from
Willy Tarreauac825402011-03-04 22:04:29 +0100199 * in case of transparent proxying. Normal source bind addresses are still
200 * determined locally (due to the possible need of a source port).
201 * si->target may point either to a valid server or to a backend, depending
202 * on si->target.type. Only TARG_TYPE_PROXY and TARG_TYPE_SERVER are supported.
Willy Tarreaub1d67742010-03-29 19:36:59 +0200203 *
Willy Tarreau9650f372009-08-16 14:02:45 +0200204 * It can return one of :
205 * - SN_ERR_NONE if everything's OK
206 * - SN_ERR_SRVTO if there are no more servers
207 * - SN_ERR_SRVCL if the connection was refused by the server
208 * - SN_ERR_PRXCOND if the connection has been limited by the proxy (maxconn)
209 * - SN_ERR_RESOURCE if a system resource is lacking (eg: fd limits, ports, ...)
210 * - SN_ERR_INTERNAL for any other purely internal errors
211 * Additionnally, in the case of SN_ERR_RESOURCE, an emergency log will be emitted.
212 */
Willy Tarreauf1536862011-03-03 18:27:32 +0100213
David du Colombier6f5ccb12011-03-10 22:26:24 +0100214int tcp_connect_server(struct stream_interface *si)
Willy Tarreau9650f372009-08-16 14:02:45 +0200215{
216 int fd;
Willy Tarreauac825402011-03-04 22:04:29 +0100217 struct server *srv;
218 struct proxy *be;
219
220 switch (si->target.type) {
221 case TARG_TYPE_PROXY:
222 be = si->target.ptr.p;
223 srv = NULL;
224 break;
225 case TARG_TYPE_SERVER:
226 srv = si->target.ptr.s;
227 be = srv->proxy;
228 break;
229 default:
230 return SN_ERR_INTERNAL;
231 }
Willy Tarreau9650f372009-08-16 14:02:45 +0200232
Willy Tarreau6471afb2011-09-23 10:54:59 +0200233 if ((fd = si->fd = socket(si->addr.to.ss_family, SOCK_STREAM, IPPROTO_TCP)) == -1) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200234 qfprintf(stderr, "Cannot get a server socket.\n");
235
236 if (errno == ENFILE)
237 send_log(be, LOG_EMERG,
238 "Proxy %s reached system FD limit at %d. Please check system tunables.\n",
239 be->id, maxfd);
240 else if (errno == EMFILE)
241 send_log(be, LOG_EMERG,
242 "Proxy %s reached process FD limit at %d. Please check 'ulimit-n' and restart.\n",
243 be->id, maxfd);
244 else if (errno == ENOBUFS || errno == ENOMEM)
245 send_log(be, LOG_EMERG,
246 "Proxy %s reached system memory limit at %d sockets. Please check system tunables.\n",
247 be->id, maxfd);
248 /* this is a resource error */
249 return SN_ERR_RESOURCE;
250 }
251
252 if (fd >= global.maxsock) {
253 /* do not log anything there, it's a normal condition when this option
254 * is used to serialize connections to a server !
255 */
256 Alert("socket(): not enough free sockets. Raise -n argument. Giving up.\n");
257 close(fd);
258 return SN_ERR_PRXCOND; /* it is a configuration limit */
259 }
260
261 if ((fcntl(fd, F_SETFL, O_NONBLOCK)==-1) ||
Simon Hormande072bd2011-06-24 15:11:37 +0900262 (setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &one, sizeof(one)) == -1)) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200263 qfprintf(stderr,"Cannot set client socket to non blocking mode.\n");
264 close(fd);
265 return SN_ERR_INTERNAL;
266 }
267
268 if (be->options & PR_O_TCP_SRV_KA)
Simon Hormande072bd2011-06-24 15:11:37 +0900269 setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, &one, sizeof(one));
Willy Tarreau9650f372009-08-16 14:02:45 +0200270
271 if (be->options & PR_O_TCP_NOLING)
Willy Tarreauf6f82252011-11-30 18:02:24 +0100272 si->flags |= SI_FL_NOLINGER;
Willy Tarreau9650f372009-08-16 14:02:45 +0200273
274 /* allow specific binding :
275 * - server-specific at first
276 * - proxy-specific next
277 */
278 if (srv != NULL && srv->state & SRV_BIND_SRC) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200279 int ret, flags = 0;
280
Willy Tarreau9650f372009-08-16 14:02:45 +0200281 switch (srv->state & SRV_TPROXY_MASK) {
282 case SRV_TPROXY_ADDR:
Willy Tarreau9650f372009-08-16 14:02:45 +0200283 case SRV_TPROXY_CLI:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200284 flags = 3;
285 break;
Willy Tarreau9650f372009-08-16 14:02:45 +0200286 case SRV_TPROXY_CIP:
Willy Tarreau090466c2009-09-07 11:51:47 +0200287 case SRV_TPROXY_DYN:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200288 flags = 1;
Willy Tarreau9650f372009-08-16 14:02:45 +0200289 break;
290 }
Willy Tarreaub1d67742010-03-29 19:36:59 +0200291
Willy Tarreau9650f372009-08-16 14:02:45 +0200292#ifdef SO_BINDTODEVICE
293 /* Note: this might fail if not CAP_NET_RAW */
294 if (srv->iface_name)
295 setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, srv->iface_name, srv->iface_len + 1);
296#endif
297
298 if (srv->sport_range) {
299 int attempts = 10; /* should be more than enough to find a spare port */
David du Colombier6f5ccb12011-03-10 22:26:24 +0100300 struct sockaddr_storage src;
Willy Tarreau9650f372009-08-16 14:02:45 +0200301
302 ret = 1;
303 src = srv->source_addr;
304
305 do {
306 /* note: in case of retry, we may have to release a previously
307 * allocated port, hence this loop's construct.
308 */
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200309 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
310 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200311
312 if (!attempts)
313 break;
314 attempts--;
315
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200316 fdinfo[fd].local_port = port_range_alloc_port(srv->sport_range);
317 if (!fdinfo[fd].local_port)
Willy Tarreau9650f372009-08-16 14:02:45 +0200318 break;
319
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200320 fdinfo[fd].port_range = srv->sport_range;
Willy Tarreau86ad42c2011-08-27 12:29:07 +0200321 set_host_port(&src, fdinfo[fd].local_port);
Willy Tarreau9650f372009-08-16 14:02:45 +0200322
Willy Tarreau6471afb2011-09-23 10:54:59 +0200323 ret = tcp_bind_socket(fd, flags, &src, &si->addr.from);
Willy Tarreau9650f372009-08-16 14:02:45 +0200324 } while (ret != 0); /* binding NOK */
325 }
326 else {
Willy Tarreau6471afb2011-09-23 10:54:59 +0200327 ret = tcp_bind_socket(fd, flags, &srv->source_addr, &si->addr.from);
Willy Tarreau9650f372009-08-16 14:02:45 +0200328 }
329
330 if (ret) {
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200331 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
332 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200333 close(fd);
334
335 if (ret == 1) {
336 Alert("Cannot bind to source address before connect() for server %s/%s. Aborting.\n",
337 be->id, srv->id);
338 send_log(be, LOG_EMERG,
339 "Cannot bind to source address before connect() for server %s/%s.\n",
340 be->id, srv->id);
341 } else {
342 Alert("Cannot bind to tproxy source address before connect() for server %s/%s. Aborting.\n",
343 be->id, srv->id);
344 send_log(be, LOG_EMERG,
345 "Cannot bind to tproxy source address before connect() for server %s/%s.\n",
346 be->id, srv->id);
347 }
348 return SN_ERR_RESOURCE;
349 }
350 }
351 else if (be->options & PR_O_BIND_SRC) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200352 int ret, flags = 0;
353
Willy Tarreau9650f372009-08-16 14:02:45 +0200354 switch (be->options & PR_O_TPXY_MASK) {
355 case PR_O_TPXY_ADDR:
Willy Tarreau9650f372009-08-16 14:02:45 +0200356 case PR_O_TPXY_CLI:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200357 flags = 3;
358 break;
Willy Tarreau9650f372009-08-16 14:02:45 +0200359 case PR_O_TPXY_CIP:
Willy Tarreau090466c2009-09-07 11:51:47 +0200360 case PR_O_TPXY_DYN:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200361 flags = 1;
Willy Tarreau9650f372009-08-16 14:02:45 +0200362 break;
363 }
Willy Tarreaub1d67742010-03-29 19:36:59 +0200364
Willy Tarreau9650f372009-08-16 14:02:45 +0200365#ifdef SO_BINDTODEVICE
366 /* Note: this might fail if not CAP_NET_RAW */
367 if (be->iface_name)
368 setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, be->iface_name, be->iface_len + 1);
369#endif
Willy Tarreau6471afb2011-09-23 10:54:59 +0200370 ret = tcp_bind_socket(fd, flags, &be->source_addr, &si->addr.from);
Willy Tarreau9650f372009-08-16 14:02:45 +0200371 if (ret) {
372 close(fd);
373 if (ret == 1) {
374 Alert("Cannot bind to source address before connect() for proxy %s. Aborting.\n",
375 be->id);
376 send_log(be, LOG_EMERG,
377 "Cannot bind to source address before connect() for proxy %s.\n",
378 be->id);
379 } else {
380 Alert("Cannot bind to tproxy source address before connect() for proxy %s. Aborting.\n",
381 be->id);
382 send_log(be, LOG_EMERG,
383 "Cannot bind to tproxy source address before connect() for proxy %s.\n",
384 be->id);
385 }
386 return SN_ERR_RESOURCE;
387 }
388 }
389
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400390#if defined(TCP_QUICKACK)
Willy Tarreau9650f372009-08-16 14:02:45 +0200391 /* disabling tcp quick ack now allows the first request to leave the
392 * machine with the first ACK. We only do this if there are pending
393 * data in the buffer.
394 */
Willy Tarreau2e046c62012-03-01 16:08:30 +0100395 if ((be->options2 & PR_O2_SMARTCON) && si->ob->o)
Simon Hormande072bd2011-06-24 15:11:37 +0900396 setsockopt(fd, IPPROTO_TCP, TCP_QUICKACK, &zero, sizeof(zero));
Willy Tarreau9650f372009-08-16 14:02:45 +0200397#endif
398
Willy Tarreaue803de22010-01-21 17:43:04 +0100399 if (global.tune.server_sndbuf)
400 setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &global.tune.server_sndbuf, sizeof(global.tune.server_sndbuf));
401
402 if (global.tune.server_rcvbuf)
403 setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &global.tune.server_rcvbuf, sizeof(global.tune.server_rcvbuf));
404
Willy Tarreau9b061e32012-04-07 18:03:52 +0200405 si->flags &= ~SI_FL_FROM_SET;
Willy Tarreau6471afb2011-09-23 10:54:59 +0200406 if ((connect(fd, (struct sockaddr *)&si->addr.to, get_addr_len(&si->addr.to)) == -1) &&
Willy Tarreau9650f372009-08-16 14:02:45 +0200407 (errno != EINPROGRESS) && (errno != EALREADY) && (errno != EISCONN)) {
408
409 if (errno == EAGAIN || errno == EADDRINUSE) {
410 char *msg;
411 if (errno == EAGAIN) /* no free ports left, try again later */
412 msg = "no free ports";
413 else
414 msg = "local address already in use";
415
416 qfprintf(stderr,"Cannot connect: %s.\n",msg);
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200417 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
418 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200419 close(fd);
420 send_log(be, LOG_EMERG,
421 "Connect() failed for server %s/%s: %s.\n",
422 be->id, srv->id, msg);
423 return SN_ERR_RESOURCE;
424 } else if (errno == ETIMEDOUT) {
425 //qfprintf(stderr,"Connect(): ETIMEDOUT");
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200426 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
427 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200428 close(fd);
429 return SN_ERR_SRVTO;
430 } else {
431 // (errno == ECONNREFUSED || errno == ENETUNREACH || errno == EACCES || errno == EPERM)
432 //qfprintf(stderr,"Connect(): %d", errno);
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200433 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
434 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200435 close(fd);
436 return SN_ERR_SRVCL;
437 }
438 }
439
William Lallemandb7ff6a32012-03-02 14:35:21 +0100440 /* needs src ip/port for logging */
Willy Tarreau9b061e32012-04-07 18:03:52 +0200441 if (si->flags & SI_FL_SRC_ADDR)
442 stream_sock_get_from_addr(si);
William Lallemandb7ff6a32012-03-02 14:35:21 +0100443
Willy Tarreau9650f372009-08-16 14:02:45 +0200444 fdtab[fd].owner = si;
445 fdtab[fd].state = FD_STCONN; /* connection in progress */
446 fdtab[fd].flags = FD_FL_TCP | FD_FL_TCP_NODELAY;
Willy Tarreau1b79bde2012-05-07 17:01:39 +0200447 fdtab[fd].cb[DIR_RD].f = si->sock.read;
Willy Tarreau9650f372009-08-16 14:02:45 +0200448 fdtab[fd].cb[DIR_RD].b = si->ib;
Willy Tarreau1b79bde2012-05-07 17:01:39 +0200449 fdtab[fd].cb[DIR_WR].f = si->sock.write;
Willy Tarreau9650f372009-08-16 14:02:45 +0200450 fdtab[fd].cb[DIR_WR].b = si->ob;
451
Willy Tarreau6471afb2011-09-23 10:54:59 +0200452 fdinfo[fd].peeraddr = (struct sockaddr *)&si->addr.to;
453 fdinfo[fd].peerlen = get_addr_len(&si->addr.to);
Willy Tarreau9650f372009-08-16 14:02:45 +0200454
455 fd_insert(fd);
456 EV_FD_SET(fd, DIR_WR); /* for connect status */
457
458 si->state = SI_ST_CON;
459 si->flags |= SI_FL_CAP_SPLTCP; /* TCP supports splicing */
460 si->exp = tick_add_ifset(now_ms, be->timeout.connect);
461
462 return SN_ERR_NONE; /* connection is OK */
463}
464
465
Willy Tarreaue6b98942007-10-29 01:09:36 +0100466/* This function tries to bind a TCPv4/v6 listener. It may return a warning or
467 * an error message in <err> if the message is at most <errlen> bytes long
468 * (including '\0'). The return value is composed from ERR_ABORT, ERR_WARN,
469 * ERR_ALERT, ERR_RETRYABLE and ERR_FATAL. ERR_NONE indicates that everything
470 * was alright and that no message was returned. ERR_RETRYABLE means that an
471 * error occurred but that it may vanish after a retry (eg: port in use), and
Aman Guptad94991d2012-04-06 17:39:26 -0700472 * ERR_FATAL indicates a non-fixable error. ERR_WARN and ERR_ALERT do not alter
Willy Tarreaue6b98942007-10-29 01:09:36 +0100473 * the meaning of the error, but just indicate that a message is present which
474 * should be displayed with the respective level. Last, ERR_ABORT indicates
475 * that it's pointless to try to start other listeners. No error message is
476 * returned if errlen is NULL.
477 */
478int tcp_bind_listener(struct listener *listener, char *errmsg, int errlen)
479{
480 __label__ tcp_return, tcp_close_return;
481 int fd, err;
482 const char *msg = NULL;
483
484 /* ensure we never return garbage */
485 if (errmsg && errlen)
486 *errmsg = 0;
487
488 if (listener->state != LI_ASSIGNED)
489 return ERR_NONE; /* already bound */
490
491 err = ERR_NONE;
492
493 if ((fd = socket(listener->addr.ss_family, SOCK_STREAM, IPPROTO_TCP)) == -1) {
494 err |= ERR_RETRYABLE | ERR_ALERT;
495 msg = "cannot create listening socket";
496 goto tcp_return;
497 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100498
Willy Tarreaue6b98942007-10-29 01:09:36 +0100499 if (fd >= global.maxsock) {
500 err |= ERR_FATAL | ERR_ABORT | ERR_ALERT;
501 msg = "not enough free sockets (raise '-n' parameter)";
502 goto tcp_close_return;
503 }
504
Willy Tarreaufb14edc2009-06-14 15:24:37 +0200505 if (fcntl(fd, F_SETFL, O_NONBLOCK) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100506 err |= ERR_FATAL | ERR_ALERT;
507 msg = "cannot make socket non-blocking";
508 goto tcp_close_return;
509 }
510
Simon Hormande072bd2011-06-24 15:11:37 +0900511 if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100512 /* not fatal but should be reported */
513 msg = "cannot do so_reuseaddr";
514 err |= ERR_ALERT;
515 }
516
517 if (listener->options & LI_O_NOLINGER)
Simon Hormande072bd2011-06-24 15:11:37 +0900518 setsockopt(fd, SOL_SOCKET, SO_LINGER, &nolinger, sizeof(struct linger));
Willy Tarreauedcf6682008-11-30 23:15:34 +0100519
Willy Tarreaue6b98942007-10-29 01:09:36 +0100520#ifdef SO_REUSEPORT
521 /* OpenBSD supports this. As it's present in old libc versions of Linux,
522 * it might return an error that we will silently ignore.
523 */
Simon Hormande072bd2011-06-24 15:11:37 +0900524 setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &one, sizeof(one));
Willy Tarreaue6b98942007-10-29 01:09:36 +0100525#endif
Willy Tarreaub1e52e82008-01-13 14:49:51 +0100526#ifdef CONFIG_HAP_LINUX_TPROXY
Willy Tarreauedcf6682008-11-30 23:15:34 +0100527 if ((listener->options & LI_O_FOREIGN)
Simon Hormande072bd2011-06-24 15:11:37 +0900528 && (setsockopt(fd, SOL_IP, IP_TRANSPARENT, &one, sizeof(one)) == -1)
529 && (setsockopt(fd, SOL_IP, IP_FREEBIND, &one, sizeof(one)) == -1)) {
Willy Tarreaub1e52e82008-01-13 14:49:51 +0100530 msg = "cannot make listening socket transparent";
531 err |= ERR_ALERT;
532 }
533#endif
Willy Tarreau5e6e2042009-02-04 17:19:29 +0100534#ifdef SO_BINDTODEVICE
535 /* Note: this might fail if not CAP_NET_RAW */
536 if (listener->interface) {
537 if (setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE,
Willy Tarreau604e8302009-03-06 00:48:23 +0100538 listener->interface, strlen(listener->interface) + 1) == -1) {
Willy Tarreau5e6e2042009-02-04 17:19:29 +0100539 msg = "cannot bind listener to device";
540 err |= ERR_WARN;
541 }
542 }
543#endif
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400544#if defined(TCP_MAXSEG)
Willy Tarreau48a7e722010-12-24 15:26:39 +0100545 if (listener->maxseg > 0) {
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400546 if (setsockopt(fd, IPPROTO_TCP, TCP_MAXSEG,
Willy Tarreaube1b9182009-06-14 18:48:19 +0200547 &listener->maxseg, sizeof(listener->maxseg)) == -1) {
548 msg = "cannot set MSS";
549 err |= ERR_WARN;
550 }
551 }
552#endif
Willy Tarreaucb6cd432009-10-13 07:34:14 +0200553#if defined(TCP_DEFER_ACCEPT)
554 if (listener->options & LI_O_DEF_ACCEPT) {
555 /* defer accept by up to one second */
556 int accept_delay = 1;
557 if (setsockopt(fd, IPPROTO_TCP, TCP_DEFER_ACCEPT, &accept_delay, sizeof(accept_delay)) == -1) {
558 msg = "cannot enable DEFER_ACCEPT";
559 err |= ERR_WARN;
560 }
561 }
562#endif
Willy Tarreaue6b98942007-10-29 01:09:36 +0100563 if (bind(fd, (struct sockaddr *)&listener->addr, listener->proto->sock_addrlen) == -1) {
564 err |= ERR_RETRYABLE | ERR_ALERT;
565 msg = "cannot bind socket";
566 goto tcp_close_return;
567 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100568
Willy Tarreauc73ce2b2008-01-06 10:55:10 +0100569 if (listen(fd, listener->backlog ? listener->backlog : listener->maxconn) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100570 err |= ERR_RETRYABLE | ERR_ALERT;
571 msg = "cannot listen to socket";
572 goto tcp_close_return;
573 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100574
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400575#if defined(TCP_QUICKACK)
Willy Tarreau9ea05a72009-06-14 12:07:01 +0200576 if (listener->options & LI_O_NOQUICKACK)
Simon Hormande072bd2011-06-24 15:11:37 +0900577 setsockopt(fd, IPPROTO_TCP, TCP_QUICKACK, &zero, sizeof(zero));
Willy Tarreau9ea05a72009-06-14 12:07:01 +0200578#endif
579
Willy Tarreaue6b98942007-10-29 01:09:36 +0100580 /* the socket is ready */
581 listener->fd = fd;
582 listener->state = LI_LISTEN;
583
Willy Tarreaueabf3132008-08-29 23:36:51 +0200584 fdtab[fd].owner = listener; /* reference the listener instead of a task */
Willy Tarreaue6b98942007-10-29 01:09:36 +0100585 fdtab[fd].state = FD_STLISTEN;
Willy Tarreaueb472682010-05-28 18:46:57 +0200586 fdtab[fd].flags = FD_FL_TCP | ((listener->options & LI_O_NOLINGER) ? FD_FL_TCP_NOLING : 0);
587 fdtab[fd].cb[DIR_RD].f = listener->proto->accept;
588 fdtab[fd].cb[DIR_WR].f = NULL; /* never called */
589 fdtab[fd].cb[DIR_RD].b = fdtab[fd].cb[DIR_WR].b = NULL;
Willy Tarreau5d707e12009-06-28 11:09:07 +0200590
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200591 fdinfo[fd].peeraddr = NULL;
592 fdinfo[fd].peerlen = 0;
Willy Tarreaueb472682010-05-28 18:46:57 +0200593 fd_insert(fd);
594
Willy Tarreaue6b98942007-10-29 01:09:36 +0100595 tcp_return:
Cyril Bonté43ba1b32010-11-01 19:26:01 +0100596 if (msg && errlen) {
597 char pn[INET6_ADDRSTRLEN];
598
Willy Tarreau631f01c2011-09-05 00:36:48 +0200599 addr_to_str(&listener->addr, pn, sizeof(pn));
600 snprintf(errmsg, errlen, "%s [%s:%d]", msg, pn, get_host_port(&listener->addr));
Cyril Bonté43ba1b32010-11-01 19:26:01 +0100601 }
Willy Tarreaue6b98942007-10-29 01:09:36 +0100602 return err;
603
604 tcp_close_return:
605 close(fd);
606 goto tcp_return;
607}
608
609/* This function creates all TCP sockets bound to the protocol entry <proto>.
610 * It is intended to be used as the protocol's bind_all() function.
611 * The sockets will be registered but not added to any fd_set, in order not to
612 * loose them across the fork(). A call to enable_all_listeners() is needed
613 * to complete initialization. The return value is composed from ERR_*.
614 */
Emeric Bruncf20bf12010-10-22 16:06:11 +0200615static int tcp_bind_listeners(struct protocol *proto, char *errmsg, int errlen)
Willy Tarreaue6b98942007-10-29 01:09:36 +0100616{
617 struct listener *listener;
618 int err = ERR_NONE;
619
620 list_for_each_entry(listener, &proto->listeners, proto_list) {
Emeric Bruncf20bf12010-10-22 16:06:11 +0200621 err |= tcp_bind_listener(listener, errmsg, errlen);
622 if (err & ERR_ABORT)
Willy Tarreaue6b98942007-10-29 01:09:36 +0100623 break;
624 }
625
626 return err;
627}
628
629/* Add listener to the list of tcpv4 listeners. The listener's state
630 * is automatically updated from LI_INIT to LI_ASSIGNED. The number of
631 * listeners is updated. This is the function to use to add a new listener.
632 */
633void tcpv4_add_listener(struct listener *listener)
634{
635 if (listener->state != LI_INIT)
636 return;
637 listener->state = LI_ASSIGNED;
638 listener->proto = &proto_tcpv4;
639 LIST_ADDQ(&proto_tcpv4.listeners, &listener->proto_list);
640 proto_tcpv4.nb_listeners++;
641}
642
643/* Add listener to the list of tcpv4 listeners. The listener's state
644 * is automatically updated from LI_INIT to LI_ASSIGNED. The number of
645 * listeners is updated. This is the function to use to add a new listener.
646 */
647void tcpv6_add_listener(struct listener *listener)
648{
649 if (listener->state != LI_INIT)
650 return;
651 listener->state = LI_ASSIGNED;
652 listener->proto = &proto_tcpv6;
653 LIST_ADDQ(&proto_tcpv6.listeners, &listener->proto_list);
654 proto_tcpv6.nb_listeners++;
655}
656
Willy Tarreauedcf6682008-11-30 23:15:34 +0100657/* This function performs the TCP request analysis on the current request. It
658 * returns 1 if the processing can continue on next analysers, or zero if it
659 * needs more data, encounters an error, or wants to immediately abort the
Willy Tarreaufb356202010-08-03 14:02:05 +0200660 * request. It relies on buffers flags, and updates s->req->analysers. The
661 * function may be called for frontend rules and backend rules. It only relies
662 * on the backend pointer so this works for both cases.
Willy Tarreauedcf6682008-11-30 23:15:34 +0100663 */
Willy Tarreau3a816292009-07-07 10:55:49 +0200664int tcp_inspect_request(struct session *s, struct buffer *req, int an_bit)
Willy Tarreauedcf6682008-11-30 23:15:34 +0100665{
666 struct tcp_rule *rule;
Willy Tarreaud1f96522010-08-03 19:34:32 +0200667 struct stksess *ts;
668 struct stktable *t;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100669 int partial;
670
Willy Tarreau02d6cfc2012-03-01 18:19:58 +0100671 DPRINTF(stderr,"[%u] %s: session=%p b=%p, exp(r,w)=%u,%u bf=%08x bh=%d analysers=%02x\n",
Willy Tarreauedcf6682008-11-30 23:15:34 +0100672 now_ms, __FUNCTION__,
673 s,
674 req,
675 req->rex, req->wex,
676 req->flags,
Willy Tarreau02d6cfc2012-03-01 18:19:58 +0100677 req->i,
Willy Tarreauedcf6682008-11-30 23:15:34 +0100678 req->analysers);
679
Willy Tarreauedcf6682008-11-30 23:15:34 +0100680 /* We don't know whether we have enough data, so must proceed
681 * this way :
682 * - iterate through all rules in their declaration order
683 * - if one rule returns MISS, it means the inspect delay is
684 * not over yet, then return immediately, otherwise consider
685 * it as a non-match.
686 * - if one rule returns OK, then return OK
687 * - if one rule returns KO, then return KO
688 */
689
Willy Tarreaub824b002010-09-29 16:36:16 +0200690 if (req->flags & (BF_SHUTR|BF_FULL) || !s->be->tcp_req.inspect_delay || tick_is_expired(req->analyse_exp, now_ms))
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200691 partial = SMP_OPT_FINAL;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100692 else
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200693 partial = 0;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100694
Willy Tarreaufb356202010-08-03 14:02:05 +0200695 list_for_each_entry(rule, &s->be->tcp_req.inspect_rules, list) {
Willy Tarreauedcf6682008-11-30 23:15:34 +0100696 int ret = ACL_PAT_PASS;
697
698 if (rule->cond) {
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200699 ret = acl_exec_cond(rule->cond, s->be, s, &s->txn, SMP_OPT_DIR_REQ | partial);
Willy Tarreauedcf6682008-11-30 23:15:34 +0100700 if (ret == ACL_PAT_MISS) {
Willy Tarreau520d95e2009-09-19 21:04:57 +0200701 buffer_dont_connect(req);
Willy Tarreauedcf6682008-11-30 23:15:34 +0100702 /* just set the request timeout once at the beginning of the request */
Willy Tarreaufb356202010-08-03 14:02:05 +0200703 if (!tick_isset(req->analyse_exp) && s->be->tcp_req.inspect_delay)
704 req->analyse_exp = tick_add_ifset(now_ms, s->be->tcp_req.inspect_delay);
Willy Tarreauedcf6682008-11-30 23:15:34 +0100705 return 0;
706 }
707
708 ret = acl_pass(ret);
709 if (rule->cond->pol == ACL_COND_UNLESS)
710 ret = !ret;
711 }
712
713 if (ret) {
714 /* we have a matching rule. */
715 if (rule->action == TCP_ACT_REJECT) {
716 buffer_abort(req);
717 buffer_abort(s->rep);
718 req->analysers = 0;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +0200719
Willy Tarreau7d0aaf32011-03-10 23:25:56 +0100720 s->be->be_counters.denied_req++;
721 s->fe->fe_counters.denied_req++;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +0200722 if (s->listener->counters)
Willy Tarreau23968d82010-05-23 23:50:44 +0200723 s->listener->counters->denied_req++;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +0200724
Willy Tarreauedcf6682008-11-30 23:15:34 +0100725 if (!(s->flags & SN_ERR_MASK))
726 s->flags |= SN_ERR_PRXCOND;
727 if (!(s->flags & SN_FINST_MASK))
728 s->flags |= SN_FINST_R;
729 return 0;
730 }
Willy Tarreau56123282010-08-06 19:06:56 +0200731 else if (rule->action == TCP_ACT_TRK_SC1) {
732 if (!s->stkctr1_entry) {
733 /* only the first valid track-sc1 directive applies.
Willy Tarreaud1f96522010-08-03 19:34:32 +0200734 * Also, note that right now we can only track SRC so we
735 * don't check how to get the key, but later we may need
736 * to consider rule->act_prm->trk_ctr.type.
737 */
738 t = rule->act_prm.trk_ctr.table.t;
David du Colombier4f92d322011-03-24 11:09:31 +0100739 ts = stktable_get_entry(t, tcp_src_to_stktable_key(s));
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200740 if (ts) {
Willy Tarreau56123282010-08-06 19:06:56 +0200741 session_track_stkctr1(s, t, ts);
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200742 if (s->fe != s->be)
743 s->flags |= SN_BE_TRACK_SC1;
744 }
Willy Tarreaud1f96522010-08-03 19:34:32 +0200745 }
746 }
Willy Tarreau56123282010-08-06 19:06:56 +0200747 else if (rule->action == TCP_ACT_TRK_SC2) {
748 if (!s->stkctr2_entry) {
749 /* only the first valid track-sc2 directive applies.
Willy Tarreaud1f96522010-08-03 19:34:32 +0200750 * Also, note that right now we can only track SRC so we
751 * don't check how to get the key, but later we may need
752 * to consider rule->act_prm->trk_ctr.type.
753 */
754 t = rule->act_prm.trk_ctr.table.t;
David du Colombier4f92d322011-03-24 11:09:31 +0100755 ts = stktable_get_entry(t, tcp_src_to_stktable_key(s));
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200756 if (ts) {
Willy Tarreau56123282010-08-06 19:06:56 +0200757 session_track_stkctr2(s, t, ts);
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200758 if (s->fe != s->be)
759 s->flags |= SN_BE_TRACK_SC2;
760 }
Willy Tarreaud1f96522010-08-03 19:34:32 +0200761 }
762 }
763 else {
Willy Tarreauedcf6682008-11-30 23:15:34 +0100764 /* otherwise accept */
Willy Tarreaud1f96522010-08-03 19:34:32 +0200765 break;
766 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100767 }
768 }
769
770 /* if we get there, it means we have no rule which matches, or
771 * we have an explicit accept, so we apply the default accept.
772 */
Willy Tarreau3a816292009-07-07 10:55:49 +0200773 req->analysers &= ~an_bit;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100774 req->analyse_exp = TICK_ETERNITY;
775 return 1;
776}
777
Emeric Brun97679e72010-09-23 17:56:44 +0200778/* This function performs the TCP response analysis on the current response. It
779 * returns 1 if the processing can continue on next analysers, or zero if it
780 * needs more data, encounters an error, or wants to immediately abort the
781 * response. It relies on buffers flags, and updates s->rep->analysers. The
782 * function may be called for backend rules.
783 */
784int tcp_inspect_response(struct session *s, struct buffer *rep, int an_bit)
785{
786 struct tcp_rule *rule;
787 int partial;
788
Willy Tarreau02d6cfc2012-03-01 18:19:58 +0100789 DPRINTF(stderr,"[%u] %s: session=%p b=%p, exp(r,w)=%u,%u bf=%08x bh=%d analysers=%02x\n",
Emeric Brun97679e72010-09-23 17:56:44 +0200790 now_ms, __FUNCTION__,
791 s,
792 rep,
793 rep->rex, rep->wex,
794 rep->flags,
Willy Tarreau02d6cfc2012-03-01 18:19:58 +0100795 rep->i,
Emeric Brun97679e72010-09-23 17:56:44 +0200796 rep->analysers);
797
798 /* We don't know whether we have enough data, so must proceed
799 * this way :
800 * - iterate through all rules in their declaration order
801 * - if one rule returns MISS, it means the inspect delay is
802 * not over yet, then return immediately, otherwise consider
803 * it as a non-match.
804 * - if one rule returns OK, then return OK
805 * - if one rule returns KO, then return KO
806 */
807
808 if (rep->flags & BF_SHUTR || tick_is_expired(rep->analyse_exp, now_ms))
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200809 partial = SMP_OPT_FINAL;
Emeric Brun97679e72010-09-23 17:56:44 +0200810 else
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200811 partial = 0;
Emeric Brun97679e72010-09-23 17:56:44 +0200812
813 list_for_each_entry(rule, &s->be->tcp_rep.inspect_rules, list) {
814 int ret = ACL_PAT_PASS;
815
816 if (rule->cond) {
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200817 ret = acl_exec_cond(rule->cond, s->be, s, &s->txn, SMP_OPT_DIR_RES | partial);
Emeric Brun97679e72010-09-23 17:56:44 +0200818 if (ret == ACL_PAT_MISS) {
819 /* just set the analyser timeout once at the beginning of the response */
820 if (!tick_isset(rep->analyse_exp) && s->be->tcp_rep.inspect_delay)
821 rep->analyse_exp = tick_add_ifset(now_ms, s->be->tcp_rep.inspect_delay);
822 return 0;
823 }
824
825 ret = acl_pass(ret);
826 if (rule->cond->pol == ACL_COND_UNLESS)
827 ret = !ret;
828 }
829
830 if (ret) {
831 /* we have a matching rule. */
832 if (rule->action == TCP_ACT_REJECT) {
833 buffer_abort(rep);
834 buffer_abort(s->req);
835 rep->analysers = 0;
836
Willy Tarreau7d0aaf32011-03-10 23:25:56 +0100837 s->be->be_counters.denied_resp++;
838 s->fe->fe_counters.denied_resp++;
Emeric Brun97679e72010-09-23 17:56:44 +0200839 if (s->listener->counters)
840 s->listener->counters->denied_resp++;
841
842 if (!(s->flags & SN_ERR_MASK))
843 s->flags |= SN_ERR_PRXCOND;
844 if (!(s->flags & SN_FINST_MASK))
845 s->flags |= SN_FINST_D;
846 return 0;
847 }
848 else {
849 /* otherwise accept */
850 break;
851 }
852 }
853 }
854
855 /* if we get there, it means we have no rule which matches, or
856 * we have an explicit accept, so we apply the default accept.
857 */
858 rep->analysers &= ~an_bit;
859 rep->analyse_exp = TICK_ETERNITY;
860 return 1;
861}
862
863
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200864/* This function performs the TCP layer4 analysis on the current request. It
865 * returns 0 if a reject rule matches, otherwise 1 if either an accept rule
866 * matches or if no more rule matches. It can only use rules which don't need
867 * any data.
868 */
869int tcp_exec_req_rules(struct session *s)
870{
871 struct tcp_rule *rule;
Willy Tarreauf059a0f2010-08-03 16:29:52 +0200872 struct stksess *ts;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200873 struct stktable *t = NULL;
874 int result = 1;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200875 int ret;
876
877 list_for_each_entry(rule, &s->fe->tcp_req.l4_rules, list) {
878 ret = ACL_PAT_PASS;
879
880 if (rule->cond) {
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200881 ret = acl_exec_cond(rule->cond, s->fe, s, NULL, SMP_OPT_DIR_REQ|SMP_OPT_FINAL);
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200882 ret = acl_pass(ret);
883 if (rule->cond->pol == ACL_COND_UNLESS)
884 ret = !ret;
885 }
886
887 if (ret) {
888 /* we have a matching rule. */
889 if (rule->action == TCP_ACT_REJECT) {
Willy Tarreau7d0aaf32011-03-10 23:25:56 +0100890 s->fe->fe_counters.denied_conn++;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200891 if (s->listener->counters)
Willy Tarreau2799e982010-06-05 15:43:21 +0200892 s->listener->counters->denied_conn++;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200893
894 if (!(s->flags & SN_ERR_MASK))
895 s->flags |= SN_ERR_PRXCOND;
896 if (!(s->flags & SN_FINST_MASK))
897 s->flags |= SN_FINST_R;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200898 result = 0;
899 break;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200900 }
Willy Tarreau56123282010-08-06 19:06:56 +0200901 else if (rule->action == TCP_ACT_TRK_SC1) {
902 if (!s->stkctr1_entry) {
903 /* only the first valid track-sc1 directive applies.
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200904 * Also, note that right now we can only track SRC so we
905 * don't check how to get the key, but later we may need
906 * to consider rule->act_prm->trk_ctr.type.
907 */
908 t = rule->act_prm.trk_ctr.table.t;
David du Colombier4f92d322011-03-24 11:09:31 +0100909 ts = stktable_get_entry(t, tcp_src_to_stktable_key(s));
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200910 if (ts)
Willy Tarreau56123282010-08-06 19:06:56 +0200911 session_track_stkctr1(s, t, ts);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200912 }
913 }
Willy Tarreau56123282010-08-06 19:06:56 +0200914 else if (rule->action == TCP_ACT_TRK_SC2) {
915 if (!s->stkctr2_entry) {
916 /* only the first valid track-sc2 directive applies.
Willy Tarreauf059a0f2010-08-03 16:29:52 +0200917 * Also, note that right now we can only track SRC so we
918 * don't check how to get the key, but later we may need
919 * to consider rule->act_prm->trk_ctr.type.
920 */
921 t = rule->act_prm.trk_ctr.table.t;
David du Colombier4f92d322011-03-24 11:09:31 +0100922 ts = stktable_get_entry(t, tcp_src_to_stktable_key(s));
Willy Tarreauf059a0f2010-08-03 16:29:52 +0200923 if (ts)
Willy Tarreau56123282010-08-06 19:06:56 +0200924 session_track_stkctr2(s, t, ts);
Willy Tarreauf059a0f2010-08-03 16:29:52 +0200925 }
926 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200927 else {
928 /* otherwise it's an accept */
929 break;
930 }
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200931 }
932 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200933 return result;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200934}
935
Emeric Brun97679e72010-09-23 17:56:44 +0200936/* Parse a tcp-response rule. Return a negative value in case of failure */
937static int tcp_parse_response_rule(char **args, int arg, int section_type,
938 struct proxy *curpx, struct proxy *defpx,
939 struct tcp_rule *rule, char *err, int errlen)
940{
941 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
942 snprintf(err, errlen, "%s %s is only allowed in 'backend' sections",
943 args[0], args[1]);
944 return -1;
945 }
946
947 if (strcmp(args[arg], "accept") == 0) {
948 arg++;
949 rule->action = TCP_ACT_ACCEPT;
950 }
951 else if (strcmp(args[arg], "reject") == 0) {
952 arg++;
953 rule->action = TCP_ACT_REJECT;
954 }
955 else {
956 snprintf(err, errlen,
957 "'%s %s' expects 'accept' or 'reject' in %s '%s' (was '%s')",
958 args[0], args[1], proxy_type_str(curpx), curpx->id, args[arg]);
959 return -1;
960 }
961
962 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
Willy Tarreaub7451bb2012-04-27 12:38:15 +0200963 char *errmsg = NULL;
964
965 if ((rule->cond = build_acl_cond(NULL, 0, curpx, (const char **)args+arg, &errmsg)) == NULL) {
Emeric Brun97679e72010-09-23 17:56:44 +0200966 snprintf(err, errlen,
Willy Tarreaub7451bb2012-04-27 12:38:15 +0200967 "error detected in %s '%s' while parsing '%s' condition : %s",
968 proxy_type_str(curpx), curpx->id, args[arg], errmsg);
969 free(errmsg);
Emeric Brun97679e72010-09-23 17:56:44 +0200970 return -1;
971 }
972 }
973 else if (*args[arg]) {
974 snprintf(err, errlen,
975 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (was '%s')",
976 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
977 return -1;
978 }
979 return 0;
980}
981
982
983
Willy Tarreau68c03ab2010-08-06 15:08:45 +0200984/* Parse a tcp-request rule. Return a negative value in case of failure */
985static int tcp_parse_request_rule(char **args, int arg, int section_type,
986 struct proxy *curpx, struct proxy *defpx,
987 struct tcp_rule *rule, char *err, int errlen)
988{
989 if (curpx == defpx) {
990 snprintf(err, errlen, "%s %s is not allowed in 'defaults' sections",
991 args[0], args[1]);
992 return -1;
993 }
994
995 if (!strcmp(args[arg], "accept")) {
996 arg++;
997 rule->action = TCP_ACT_ACCEPT;
998 }
999 else if (!strcmp(args[arg], "reject")) {
1000 arg++;
1001 rule->action = TCP_ACT_REJECT;
1002 }
Willy Tarreau56123282010-08-06 19:06:56 +02001003 else if (strcmp(args[arg], "track-sc1") == 0) {
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001004 int ret;
1005
1006 arg++;
1007 ret = parse_track_counters(args, &arg, section_type, curpx,
1008 &rule->act_prm.trk_ctr, defpx, err, errlen);
1009
1010 if (ret < 0) /* nb: warnings are not handled yet */
1011 return -1;
1012
Willy Tarreau56123282010-08-06 19:06:56 +02001013 rule->action = TCP_ACT_TRK_SC1;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001014 }
Willy Tarreau56123282010-08-06 19:06:56 +02001015 else if (strcmp(args[arg], "track-sc2") == 0) {
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001016 int ret;
1017
1018 arg++;
1019 ret = parse_track_counters(args, &arg, section_type, curpx,
1020 &rule->act_prm.trk_ctr, defpx, err, errlen);
1021
1022 if (ret < 0) /* nb: warnings are not handled yet */
1023 return -1;
1024
Willy Tarreau56123282010-08-06 19:06:56 +02001025 rule->action = TCP_ACT_TRK_SC2;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001026 }
1027 else {
1028 snprintf(err, errlen,
Willy Tarreau56123282010-08-06 19:06:56 +02001029 "'%s %s' expects 'accept', 'reject', 'track-sc1' "
1030 "or 'track-sc2' in %s '%s' (was '%s')",
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001031 args[0], args[1], proxy_type_str(curpx), curpx->id, args[arg]);
1032 return -1;
1033 }
1034
1035 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
Willy Tarreaub7451bb2012-04-27 12:38:15 +02001036 char *errmsg = NULL;
1037
1038 if ((rule->cond = build_acl_cond(NULL, 0, curpx, (const char **)args+arg, &errmsg)) == NULL) {
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001039 snprintf(err, errlen,
Willy Tarreaub7451bb2012-04-27 12:38:15 +02001040 "error detected in %s '%s' while parsing '%s' condition : %s",
1041 proxy_type_str(curpx), curpx->id, args[arg], errmsg);
1042 free(errmsg);
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001043 return -1;
1044 }
1045 }
1046 else if (*args[arg]) {
1047 snprintf(err, errlen,
1048 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (was '%s')",
1049 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
1050 return -1;
1051 }
1052 return 0;
1053}
1054
Emeric Brun97679e72010-09-23 17:56:44 +02001055/* This function should be called to parse a line starting with the "tcp-response"
1056 * keyword.
1057 */
1058static int tcp_parse_tcp_rep(char **args, int section_type, struct proxy *curpx,
1059 struct proxy *defpx, char *err, int errlen)
1060{
1061 const char *ptr = NULL;
1062 unsigned int val;
1063 int retlen;
1064 int warn = 0;
1065 int arg;
1066 struct tcp_rule *rule;
1067
1068 if (!*args[1]) {
1069 snprintf(err, errlen, "missing argument for '%s' in %s '%s'",
1070 args[0], proxy_type_str(curpx), curpx->id);
1071 return -1;
1072 }
1073
1074 if (strcmp(args[1], "inspect-delay") == 0) {
1075 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
1076 snprintf(err, errlen, "%s %s is only allowed in 'backend' sections",
1077 args[0], args[1]);
1078 return -1;
1079 }
1080
1081 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
1082 retlen = snprintf(err, errlen,
1083 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
1084 args[0], args[1], proxy_type_str(curpx), curpx->id);
1085 if (ptr && retlen < errlen)
1086 retlen += snprintf(err + retlen, errlen - retlen,
1087 " (unexpected character '%c')", *ptr);
1088 return -1;
1089 }
1090
1091 if (curpx->tcp_rep.inspect_delay) {
1092 snprintf(err, errlen, "ignoring %s %s (was already defined) in %s '%s'",
1093 args[0], args[1], proxy_type_str(curpx), curpx->id);
1094 return 1;
1095 }
1096 curpx->tcp_rep.inspect_delay = val;
1097 return 0;
1098 }
1099
Simon Hormande072bd2011-06-24 15:11:37 +09001100 rule = calloc(1, sizeof(*rule));
Emeric Brun97679e72010-09-23 17:56:44 +02001101 LIST_INIT(&rule->list);
1102 arg = 1;
1103
1104 if (strcmp(args[1], "content") == 0) {
1105 arg++;
1106 if (tcp_parse_response_rule(args, arg, section_type, curpx, defpx, rule, err, errlen) < 0)
1107 goto error;
1108
1109 if (rule->cond && (rule->cond->requires & ACL_USE_L6REQ_VOLATILE)) {
1110 struct acl *acl;
1111 const char *name;
1112
1113 acl = cond_find_require(rule->cond, ACL_USE_L6REQ_VOLATILE);
1114 name = acl ? acl->name : "(unknown)";
1115
1116 retlen = snprintf(err, errlen,
1117 "acl '%s' involves some request-only criteria which will be ignored.",
1118 name);
1119 warn++;
1120 }
1121
1122 LIST_ADDQ(&curpx->tcp_rep.inspect_rules, &rule->list);
1123 }
1124 else {
1125 retlen = snprintf(err, errlen,
1126 "'%s' expects 'inspect-delay' or 'content' in %s '%s' (was '%s')",
1127 args[0], proxy_type_str(curpx), curpx->id, args[1]);
1128 goto error;
1129 }
1130
1131 return warn;
1132 error:
1133 free(rule);
1134 return -1;
1135}
1136
1137
Willy Tarreaub6866442008-07-14 23:54:42 +02001138/* This function should be called to parse a line starting with the "tcp-request"
1139 * keyword.
1140 */
1141static int tcp_parse_tcp_req(char **args, int section_type, struct proxy *curpx,
1142 struct proxy *defpx, char *err, int errlen)
1143{
1144 const char *ptr = NULL;
Willy Tarreauc7e961e2008-08-17 17:13:47 +02001145 unsigned int val;
Willy Tarreaub6866442008-07-14 23:54:42 +02001146 int retlen;
Willy Tarreau1a687942010-05-23 22:40:30 +02001147 int warn = 0;
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001148 int arg;
Willy Tarreau1a687942010-05-23 22:40:30 +02001149 struct tcp_rule *rule;
Willy Tarreaub6866442008-07-14 23:54:42 +02001150
1151 if (!*args[1]) {
1152 snprintf(err, errlen, "missing argument for '%s' in %s '%s'",
Willy Tarreauf5356832010-06-14 18:40:26 +02001153 args[0], proxy_type_str(curpx), curpx->id);
Willy Tarreaub6866442008-07-14 23:54:42 +02001154 return -1;
1155 }
1156
1157 if (!strcmp(args[1], "inspect-delay")) {
1158 if (curpx == defpx) {
1159 snprintf(err, errlen, "%s %s is not allowed in 'defaults' sections",
1160 args[0], args[1]);
1161 return -1;
1162 }
1163
Willy Tarreaub6866442008-07-14 23:54:42 +02001164 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
1165 retlen = snprintf(err, errlen,
1166 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
Willy Tarreauf5356832010-06-14 18:40:26 +02001167 args[0], args[1], proxy_type_str(curpx), curpx->id);
Willy Tarreaub6866442008-07-14 23:54:42 +02001168 if (ptr && retlen < errlen)
1169 retlen += snprintf(err+retlen, errlen - retlen,
1170 " (unexpected character '%c')", *ptr);
1171 return -1;
1172 }
1173
1174 if (curpx->tcp_req.inspect_delay) {
1175 snprintf(err, errlen, "ignoring %s %s (was already defined) in %s '%s'",
Willy Tarreauf5356832010-06-14 18:40:26 +02001176 args[0], args[1], proxy_type_str(curpx), curpx->id);
Willy Tarreaub6866442008-07-14 23:54:42 +02001177 return 1;
1178 }
1179 curpx->tcp_req.inspect_delay = val;
1180 return 0;
1181 }
1182
Simon Hormande072bd2011-06-24 15:11:37 +09001183 rule = calloc(1, sizeof(*rule));
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001184 LIST_INIT(&rule->list);
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001185 arg = 1;
1186
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001187 if (strcmp(args[1], "content") == 0) {
Willy Tarreaud1f96522010-08-03 19:34:32 +02001188 arg++;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001189 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, errlen) < 0)
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001190 goto error;
Willy Tarreaub6866442008-07-14 23:54:42 +02001191
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001192 if (rule->cond && (rule->cond->requires & ACL_USE_RTR_ANY)) {
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001193 struct acl *acl;
1194 const char *name;
1195
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001196 acl = cond_find_require(rule->cond, ACL_USE_RTR_ANY);
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001197 name = acl ? acl->name : "(unknown)";
1198
1199 retlen = snprintf(err, errlen,
Willy Tarreau1a211942009-07-14 13:53:17 +02001200 "acl '%s' involves some response-only criteria which will be ignored.",
1201 name);
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001202 warn++;
1203 }
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001204 LIST_ADDQ(&curpx->tcp_req.inspect_rules, &rule->list);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001205 }
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001206 else if (strcmp(args[1], "connection") == 0) {
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001207 arg++;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001208
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001209 if (!(curpx->cap & PR_CAP_FE)) {
1210 snprintf(err, errlen, "%s %s is not allowed because %s %s is not a frontend",
1211 args[0], args[1], proxy_type_str(curpx), curpx->id);
Simon Horman6c54d8b2011-07-15 13:14:06 +09001212 goto error;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001213 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001214
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001215 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, errlen) < 0)
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001216 goto error;
1217
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001218 if (rule->cond && (rule->cond->requires & (ACL_USE_RTR_ANY|ACL_USE_L6_ANY|ACL_USE_L7_ANY))) {
1219 struct acl *acl;
1220 const char *name;
Willy Tarreauf059a0f2010-08-03 16:29:52 +02001221
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001222 acl = cond_find_require(rule->cond, ACL_USE_RTR_ANY|ACL_USE_L6_ANY|ACL_USE_L7_ANY);
1223 name = acl ? acl->name : "(unknown)";
Willy Tarreauf059a0f2010-08-03 16:29:52 +02001224
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001225 if (acl->requires & (ACL_USE_L6_ANY|ACL_USE_L7_ANY)) {
1226 retlen = snprintf(err, errlen,
1227 "'%s %s' may not reference acl '%s' which makes use of "
1228 "payload in %s '%s'. Please use '%s content' for this.",
1229 args[0], args[1], name, proxy_type_str(curpx), curpx->id, args[0]);
1230 goto error;
1231 }
1232 if (acl->requires & ACL_USE_RTR_ANY)
1233 retlen = snprintf(err, errlen,
1234 "acl '%s' involves some response-only criteria which will be ignored.",
1235 name);
1236 warn++;
1237 }
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001238 LIST_ADDQ(&curpx->tcp_req.l4_rules, &rule->list);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001239 }
Willy Tarreau1a687942010-05-23 22:40:30 +02001240 else {
1241 retlen = snprintf(err, errlen,
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001242 "'%s' expects 'inspect-delay', 'connection', or 'content' in %s '%s' (was '%s')",
Willy Tarreau1a687942010-05-23 22:40:30 +02001243 args[0], proxy_type_str(curpx), curpx->id, args[1]);
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001244 goto error;
Willy Tarreau1a687942010-05-23 22:40:30 +02001245 }
1246
Willy Tarreau1a687942010-05-23 22:40:30 +02001247 return warn;
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001248 error:
1249 free(rule);
1250 return -1;
Willy Tarreaub6866442008-07-14 23:54:42 +02001251}
1252
Willy Tarreau645513a2010-05-24 20:55:15 +02001253
1254/************************************************************************/
Willy Tarreau32389b72012-04-23 23:13:20 +02001255/* All supported sample fetch functios must be declared here */
1256/************************************************************************/
1257
1258/* Fetch the request RDP cookie identified in the args, or any cookie if no arg
Willy Tarreau12785782012-04-27 21:37:17 +02001259 * is passed. It is usable both for ACL and for samples. Note: this decoder
Willy Tarreau32389b72012-04-23 23:13:20 +02001260 * only works with non-wrapping data. Accepts either 0 or 1 argument. Argument
1261 * is a string (cookie name), other types will lead to undefined behaviour.
1262 */
1263int
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001264smp_fetch_rdp_cookie(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau32389b72012-04-23 23:13:20 +02001265 const struct arg *args, struct sample *smp)
1266{
1267 int bleft;
1268 const unsigned char *data;
1269
1270 if (!l4 || !l4->req)
1271 return 0;
1272
1273 smp->flags = 0;
1274 smp->type = SMP_T_CSTR;
1275
1276 bleft = l4->req->i;
1277 if (bleft <= 11)
1278 goto too_short;
1279
1280 data = (const unsigned char *)l4->req->p + 11;
1281 bleft -= 11;
1282
1283 if (bleft <= 7)
1284 goto too_short;
1285
1286 if (strncasecmp((const char *)data, "Cookie:", 7) != 0)
1287 goto not_cookie;
1288
1289 data += 7;
1290 bleft -= 7;
1291
1292 while (bleft > 0 && *data == ' ') {
1293 data++;
1294 bleft--;
1295 }
1296
1297 if (args) {
1298
1299 if (bleft <= args->data.str.len)
1300 goto too_short;
1301
1302 if ((data[args->data.str.len] != '=') ||
1303 strncasecmp(args->data.str.str, (const char *)data, args->data.str.len) != 0)
1304 goto not_cookie;
1305
1306 data += args->data.str.len + 1;
1307 bleft -= args->data.str.len + 1;
1308 } else {
1309 while (bleft > 0 && *data != '=') {
1310 if (*data == '\r' || *data == '\n')
1311 goto not_cookie;
1312 data++;
1313 bleft--;
1314 }
1315
1316 if (bleft < 1)
1317 goto too_short;
1318
1319 if (*data != '=')
1320 goto not_cookie;
1321
1322 data++;
1323 bleft--;
1324 }
1325
1326 /* data points to cookie value */
1327 smp->data.str.str = (char *)data;
1328 smp->data.str.len = 0;
1329
1330 while (bleft > 0 && *data != '\r') {
1331 data++;
1332 bleft--;
1333 }
1334
1335 if (bleft < 2)
1336 goto too_short;
1337
1338 if (data[0] != '\r' || data[1] != '\n')
1339 goto not_cookie;
1340
1341 smp->data.str.len = (char *)data - smp->data.str.str;
1342 smp->flags = SMP_F_VOLATILE;
1343 return 1;
1344
1345 too_short:
1346 smp->flags = SMP_F_MAY_CHANGE;
1347 not_cookie:
1348 return 0;
1349}
1350
Willy Tarreau32389b72012-04-23 23:13:20 +02001351/************************************************************************/
Willy Tarreau645513a2010-05-24 20:55:15 +02001352/* All supported ACL keywords must be declared here. */
1353/************************************************************************/
1354
Willy Tarreau32389b72012-04-23 23:13:20 +02001355/* returns either 1 or 0 depending on whether an RDP cookie is found or not */
1356static int
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001357acl_fetch_rdp_cookie_cnt(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau24e32d82012-04-23 23:55:44 +02001358 const struct arg *args, struct sample *smp)
Willy Tarreau32389b72012-04-23 23:13:20 +02001359{
1360 int ret;
1361
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001362 ret = smp_fetch_rdp_cookie(px, l4, l7, opt, args, smp);
Willy Tarreau32389b72012-04-23 23:13:20 +02001363
1364 if (smp->flags & SMP_F_MAY_CHANGE)
1365 return 0;
1366
1367 smp->flags = SMP_F_VOLATILE;
1368 smp->type = SMP_T_UINT;
1369 smp->data.uint = ret;
1370 return 1;
1371}
1372
1373
Willy Tarreau4a129812012-04-25 17:31:42 +02001374/* fetch the connection's source IPv4/IPv6 address */
Willy Tarreau645513a2010-05-24 20:55:15 +02001375static int
Willy Tarreau4a129812012-04-25 17:31:42 +02001376smp_fetch_src(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau24e32d82012-04-23 23:55:44 +02001377 const struct arg *args, struct sample *smp)
Willy Tarreau645513a2010-05-24 20:55:15 +02001378{
Willy Tarreauf4362b32011-12-16 17:49:52 +01001379 switch (l4->si[0].addr.from.ss_family) {
1380 case AF_INET:
Willy Tarreauf853c462012-04-23 18:53:56 +02001381 smp->data.ipv4 = ((struct sockaddr_in *)&l4->si[0].addr.from)->sin_addr;
1382 smp->type = SMP_T_IPV4;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001383 break;
1384 case AF_INET6:
Willy Tarreauf853c462012-04-23 18:53:56 +02001385 smp->data.ipv6 = ((struct sockaddr_in6 *)(&l4->si[0].addr.from))->sin6_addr;
1386 smp->type = SMP_T_IPV6;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001387 break;
1388 default:
Emeric Brunf769f512010-10-22 17:14:01 +02001389 return 0;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001390 }
Emeric Brunf769f512010-10-22 17:14:01 +02001391
Willy Tarreau37406352012-04-23 16:16:37 +02001392 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001393 return 1;
1394}
1395
Willy Tarreaua5e37562011-12-16 17:06:15 +01001396/* set temp integer to the connection's source port */
Willy Tarreau645513a2010-05-24 20:55:15 +02001397static int
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001398smp_fetch_sport(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau24e32d82012-04-23 23:55:44 +02001399 const struct arg *args, struct sample *smp)
Willy Tarreau645513a2010-05-24 20:55:15 +02001400{
Willy Tarreauf853c462012-04-23 18:53:56 +02001401 smp->type = SMP_T_UINT;
1402 if (!(smp->data.uint = get_host_port(&l4->si[0].addr.from)))
Emeric Brunf769f512010-10-22 17:14:01 +02001403 return 0;
1404
Willy Tarreau37406352012-04-23 16:16:37 +02001405 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001406 return 1;
1407}
1408
Willy Tarreau4a129812012-04-25 17:31:42 +02001409/* fetch the connection's destination IPv4/IPv6 address */
Willy Tarreau645513a2010-05-24 20:55:15 +02001410static int
Willy Tarreau4a129812012-04-25 17:31:42 +02001411smp_fetch_dst(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau24e32d82012-04-23 23:55:44 +02001412 const struct arg *args, struct sample *smp)
Willy Tarreau645513a2010-05-24 20:55:15 +02001413{
Willy Tarreau9b061e32012-04-07 18:03:52 +02001414 stream_sock_get_to_addr(&l4->si[0]);
Willy Tarreau645513a2010-05-24 20:55:15 +02001415
Willy Tarreauf4362b32011-12-16 17:49:52 +01001416 switch (l4->si[0].addr.to.ss_family) {
1417 case AF_INET:
Willy Tarreauf853c462012-04-23 18:53:56 +02001418 smp->data.ipv4 = ((struct sockaddr_in *)&l4->si[0].addr.to)->sin_addr;
1419 smp->type = SMP_T_IPV4;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001420 break;
1421 case AF_INET6:
Willy Tarreauf853c462012-04-23 18:53:56 +02001422 smp->data.ipv6 = ((struct sockaddr_in6 *)(&l4->si[0].addr.to))->sin6_addr;
1423 smp->type = SMP_T_IPV6;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001424 break;
1425 default:
Emeric Brunf769f512010-10-22 17:14:01 +02001426 return 0;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001427 }
Emeric Brunf769f512010-10-22 17:14:01 +02001428
Willy Tarreau37406352012-04-23 16:16:37 +02001429 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001430 return 1;
1431}
1432
Willy Tarreaua5e37562011-12-16 17:06:15 +01001433/* set temp integer to the frontend connexion's destination port */
Willy Tarreau645513a2010-05-24 20:55:15 +02001434static int
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001435smp_fetch_dport(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau24e32d82012-04-23 23:55:44 +02001436 const struct arg *args, struct sample *smp)
Willy Tarreau645513a2010-05-24 20:55:15 +02001437{
Willy Tarreau9b061e32012-04-07 18:03:52 +02001438 stream_sock_get_to_addr(&l4->si[0]);
Willy Tarreau645513a2010-05-24 20:55:15 +02001439
Willy Tarreauf853c462012-04-23 18:53:56 +02001440 smp->type = SMP_T_UINT;
1441 if (!(smp->data.uint = get_host_port(&l4->si[0].addr.to)))
Emeric Brunf769f512010-10-22 17:14:01 +02001442 return 0;
1443
Willy Tarreau37406352012-04-23 16:16:37 +02001444 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001445 return 1;
1446}
1447
1448static int
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001449smp_fetch_payload_lv(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
1450 const struct arg *arg_p, struct sample *smp)
Emericf2d7cae2010-11-05 18:13:50 +01001451{
Willy Tarreau82ea8002012-04-25 19:19:43 +02001452 unsigned int len_offset = arg_p[0].data.uint;
1453 unsigned int len_size = arg_p[1].data.uint;
1454 unsigned int buf_offset;
1455 unsigned int buf_size = 0;
Emericf2d7cae2010-11-05 18:13:50 +01001456 struct buffer *b;
1457 int i;
1458
1459 /* Format is (len offset, len size, buf offset) or (len offset, len size) */
1460 /* by default buf offset == len offset + len size */
1461 /* buf offset could be absolute or relative to len offset + len size if prefixed by + or - */
1462
1463 if (!l4)
1464 return 0;
1465
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001466 b = ((opt & SMP_OPT_DIR) == SMP_OPT_DIR_RES) ? l4->rep : l4->req;
Emericf2d7cae2010-11-05 18:13:50 +01001467
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001468 if (!b)
Emericf2d7cae2010-11-05 18:13:50 +01001469 return 0;
1470
Willy Tarreau02d6cfc2012-03-01 18:19:58 +01001471 if (len_offset + len_size > b->i)
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001472 goto too_short;
Emericf2d7cae2010-11-05 18:13:50 +01001473
1474 for (i = 0; i < len_size; i++) {
Willy Tarreau89fa7062012-03-02 16:13:16 +01001475 buf_size = (buf_size << 8) + ((unsigned char *)b->p)[i + len_offset];
Emericf2d7cae2010-11-05 18:13:50 +01001476 }
1477
Willy Tarreau9fcb9842012-04-20 14:45:49 +02001478 /* buf offset may be implicit, absolute or relative */
1479 buf_offset = len_offset + len_size;
1480 if (arg_p[2].type == ARGT_UINT)
1481 buf_offset = arg_p[2].data.uint;
1482 else if (arg_p[2].type == ARGT_SINT)
1483 buf_offset += arg_p[2].data.sint;
1484
Willy Tarreau82ea8002012-04-25 19:19:43 +02001485 if (!buf_size || buf_size > b->size || buf_offset + buf_size > b->size) {
1486 /* will never match */
1487 smp->flags = 0;
1488 return 0;
1489 }
1490
Willy Tarreau02d6cfc2012-03-01 18:19:58 +01001491 if (buf_offset + buf_size > b->i)
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001492 goto too_short;
Emericf2d7cae2010-11-05 18:13:50 +01001493
1494 /* init chunk as read only */
Willy Tarreaub8c8f1f2012-04-23 22:38:26 +02001495 smp->type = SMP_T_CBIN;
Willy Tarreau342acb42012-04-23 22:03:39 +02001496 chunk_initlen(&smp->data.str, b->p + buf_offset, 0, buf_size);
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001497 smp->flags = SMP_F_VOLATILE;
Emericf2d7cae2010-11-05 18:13:50 +01001498 return 1;
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001499
1500 too_short:
1501 smp->flags = SMP_F_MAY_CHANGE;
1502 return 0;
Emericf2d7cae2010-11-05 18:13:50 +01001503}
1504
1505static int
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001506smp_fetch_payload(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
1507 const struct arg *arg_p, struct sample *smp)
Emericf2d7cae2010-11-05 18:13:50 +01001508{
Willy Tarreau82ea8002012-04-25 19:19:43 +02001509 unsigned int buf_offset = arg_p[0].data.uint;
1510 unsigned int buf_size = arg_p[1].data.uint;
Emericf2d7cae2010-11-05 18:13:50 +01001511 struct buffer *b;
1512
1513 if (!l4)
1514 return 0;
1515
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001516 b = ((opt & SMP_OPT_DIR) == SMP_OPT_DIR_RES) ? l4->rep : l4->req;
Emericf2d7cae2010-11-05 18:13:50 +01001517
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001518 if (!b)
Emericf2d7cae2010-11-05 18:13:50 +01001519 return 0;
Willy Tarreau82ea8002012-04-25 19:19:43 +02001520
1521 if (!buf_size || buf_size > b->size || buf_offset + buf_size > b->size) {
1522 /* will never match */
1523 smp->flags = 0;
1524 return 0;
1525 }
Emericf2d7cae2010-11-05 18:13:50 +01001526
Willy Tarreau02d6cfc2012-03-01 18:19:58 +01001527 if (buf_offset + buf_size > b->i)
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001528 goto too_short;
Emericf2d7cae2010-11-05 18:13:50 +01001529
1530 /* init chunk as read only */
Willy Tarreaub8c8f1f2012-04-23 22:38:26 +02001531 smp->type = SMP_T_CBIN;
Willy Tarreau342acb42012-04-23 22:03:39 +02001532 chunk_initlen(&smp->data.str, b->p + buf_offset, 0, buf_size);
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001533 smp->flags = SMP_F_VOLATILE;
Simon Hormanab814e02011-06-24 14:50:20 +09001534 return 1;
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001535
1536 too_short:
1537 smp->flags = SMP_F_MAY_CHANGE;
1538 return 0;
Simon Hormanab814e02011-06-24 14:50:20 +09001539}
1540
Willy Tarreau21d68a62012-04-20 15:52:36 +02001541/* This function is used to validate the arguments passed to a "payload" fetch
1542 * keyword. This keyword expects two positive integers, with the second one
1543 * being strictly positive. It is assumed that the types are already the correct
1544 * ones. Returns 0 on error, non-zero if OK. If <err_msg> is not NULL, it will be
1545 * filled with a pointer to an error message in case of error, that the caller
1546 * is responsible for freeing. The initial location must either be freeable or
1547 * NULL.
1548 */
1549static int val_payload(struct arg *arg, char **err_msg)
1550{
1551 if (!arg[1].data.uint) {
1552 if (err_msg)
1553 memprintf(err_msg, "payload length must be > 0");
1554 return 0;
1555 }
1556 return 1;
1557}
1558
1559/* This function is used to validate the arguments passed to a "payload_lv" fetch
1560 * keyword. This keyword allows two positive integers and an optional signed one,
1561 * with the second one being strictly positive and the third one being greater than
1562 * the opposite of the two others if negative. It is assumed that the types are
1563 * already the correct ones. Returns 0 on error, non-zero if OK. If <err_msg> is
1564 * not NULL, it will be filled with a pointer to an error message in case of
1565 * error, that the caller is responsible for freeing. The initial location must
1566 * either be freeable or NULL.
1567 */
1568static int val_payload_lv(struct arg *arg, char **err_msg)
1569{
1570 if (!arg[1].data.uint) {
1571 if (err_msg)
1572 memprintf(err_msg, "payload length must be > 0");
1573 return 0;
1574 }
1575
1576 if (arg[2].type == ARGT_SINT &&
1577 (int)(arg[0].data.uint + arg[1].data.uint + arg[2].data.sint) < 0) {
1578 if (err_msg)
1579 memprintf(err_msg, "payload offset too negative");
1580 return 0;
1581 }
1582 return 1;
1583}
1584
Willy Tarreaub6866442008-07-14 23:54:42 +02001585static struct cfg_kw_list cfg_kws = {{ },{
1586 { CFG_LISTEN, "tcp-request", tcp_parse_tcp_req },
Emeric Brun97679e72010-09-23 17:56:44 +02001587 { CFG_LISTEN, "tcp-response", tcp_parse_tcp_rep },
Willy Tarreaub6866442008-07-14 23:54:42 +02001588 { 0, NULL, NULL },
1589}};
1590
Willy Tarreau61612d42012-04-19 18:42:05 +02001591/* Note: must not be declared <const> as its list will be overwritten.
1592 * Please take care of keeping this list alphabetically sorted.
1593 */
Willy Tarreaub6866442008-07-14 23:54:42 +02001594static struct acl_kw_list acl_kws = {{ },{
Willy Tarreau4a129812012-04-25 17:31:42 +02001595 { "dst", acl_parse_ip, smp_fetch_dst, acl_match_ip, ACL_USE_TCP4_PERMANENT|ACL_MAY_LOOKUP, 0 },
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001596 { "dst_port", acl_parse_int, smp_fetch_dport, acl_match_int, ACL_USE_TCP_PERMANENT, 0 },
Willy Tarreau0d5fe142012-04-26 12:24:45 +02001597 { "payload", acl_parse_str, smp_fetch_payload, acl_match_str, ACL_USE_L6REQ_VOLATILE|ACL_MAY_LOOKUP, ARG2(2,UINT,UINT), val_payload },
1598 { "payload_lv", acl_parse_str, smp_fetch_payload_lv, acl_match_str, ACL_USE_L6REQ_VOLATILE|ACL_MAY_LOOKUP, ARG3(2,UINT,UINT,SINT), val_payload_lv },
Willy Tarreau9fb4bc72012-04-24 00:09:26 +02001599 { "req_rdp_cookie", acl_parse_str, smp_fetch_rdp_cookie, acl_match_str, ACL_USE_L6REQ_VOLATILE|ACL_MAY_LOOKUP, ARG1(0,STR) },
Willy Tarreau32389b72012-04-23 23:13:20 +02001600 { "req_rdp_cookie_cnt", acl_parse_int, acl_fetch_rdp_cookie_cnt, acl_match_int, ACL_USE_L6REQ_VOLATILE, ARG1(0,STR) },
Willy Tarreau4a129812012-04-25 17:31:42 +02001601 { "src", acl_parse_ip, smp_fetch_src, acl_match_ip, ACL_USE_TCP4_PERMANENT|ACL_MAY_LOOKUP, 0 },
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001602 { "src_port", acl_parse_int, smp_fetch_sport, acl_match_int, ACL_USE_TCP_PERMANENT, 0 },
Willy Tarreaub6866442008-07-14 23:54:42 +02001603 { NULL, NULL, NULL, NULL },
1604}};
1605
Willy Tarreau4a129812012-04-25 17:31:42 +02001606/* Note: must not be declared <const> as its list will be overwritten.
1607 * Note: fetches that may return multiple types must be declared as the lowest
1608 * common denominator, the type that can be casted into all other ones. For
1609 * instance v4/v6 must be declared v4.
1610 */
Willy Tarreau12785782012-04-27 21:37:17 +02001611static struct sample_fetch_kw_list sample_fetch_keywords = {{ },{
Willy Tarreau4a129812012-04-25 17:31:42 +02001612 { "src", smp_fetch_src, 0, NULL, SMP_T_IPV4, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreau4a129812012-04-25 17:31:42 +02001613 { "dst", smp_fetch_dst, 0, NULL, SMP_T_IPV4, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001614 { "dst_port", smp_fetch_dport, 0, NULL, SMP_T_UINT, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001615 { "payload", smp_fetch_payload, ARG2(2,UINT,UINT), val_payload, SMP_T_CBIN, SMP_CAP_REQ|SMP_CAP_RES },
1616 { "payload_lv", smp_fetch_payload_lv, ARG3(2,UINT,UINT,SINT), val_payload_lv, SMP_T_CBIN, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreaud6281ae2012-04-26 11:23:39 +02001617 { "rdp_cookie", smp_fetch_rdp_cookie, ARG1(1,STR), NULL, SMP_T_CSTR, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001618 { "src_port", smp_fetch_sport, 0, NULL, SMP_T_UINT, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreau9fcb9842012-04-20 14:45:49 +02001619 { NULL, NULL, 0, 0, 0 },
Willy Tarreau645513a2010-05-24 20:55:15 +02001620}};
1621
Willy Tarreaue6b98942007-10-29 01:09:36 +01001622__attribute__((constructor))
1623static void __tcp_protocol_init(void)
1624{
1625 protocol_register(&proto_tcpv4);
1626 protocol_register(&proto_tcpv6);
Willy Tarreau12785782012-04-27 21:37:17 +02001627 sample_register_fetches(&sample_fetch_keywords);
Willy Tarreaub6866442008-07-14 23:54:42 +02001628 cfg_register_keywords(&cfg_kws);
1629 acl_register_keywords(&acl_kws);
Willy Tarreaue6b98942007-10-29 01:09:36 +01001630}
1631
1632
1633/*
1634 * Local variables:
1635 * c-indent-level: 8
1636 * c-basic-offset: 8
1637 * End:
1638 */