blob: 1e39648d8e65e86ac9ba3dd63a253a14f3a0a00d [file] [log] [blame]
Willy Tarreau51cd5952020-06-05 12:25:38 +02001/*
2 * Health-checks functions.
3 *
4 * Copyright 2000-2009,2020 Willy Tarreau <w@1wt.eu>
5 * Copyright 2007-2010 Krzysztof Piotr Oledzki <ole@ans.pl>
6 * Copyright 2013 Baptiste Assmann <bedis9@gmail.com>
7 * Copyright 2020 Gaetan Rivet <grive@u256.net>
8 * Copyright 2020 Christopher Faulet <cfaulet@haproxy.com>
9 *
10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License
12 * as published by the Free Software Foundation; either version
13 * 2 of the License, or (at your option) any later version.
14 *
15 */
16
17#include <sys/resource.h>
18#include <sys/socket.h>
19#include <sys/types.h>
20#include <sys/wait.h>
21#include <netinet/in.h>
22#include <netinet/tcp.h>
23#include <arpa/inet.h>
24
25#include <ctype.h>
26#include <errno.h>
27#include <fcntl.h>
28#include <signal.h>
29#include <stdarg.h>
30#include <stdio.h>
31#include <stdlib.h>
32#include <string.h>
33#include <time.h>
34#include <unistd.h>
35
36#include <haproxy/action.h>
37#include <haproxy/api.h>
38#include <haproxy/cfgparse.h>
39#include <haproxy/check.h>
40#include <haproxy/chunk.h>
41#include <haproxy/connection.h>
Willy Tarreau36979d92020-06-05 17:27:29 +020042#include <haproxy/errors.h>
Willy Tarreau51cd5952020-06-05 12:25:38 +020043#include <haproxy/global.h>
44#include <haproxy/h1.h>
45#include <haproxy/http.h>
46#include <haproxy/http_htx.h>
47#include <haproxy/htx.h>
48#include <haproxy/istbuf.h>
49#include <haproxy/list.h>
50#include <haproxy/log.h>
Willy Tarreau51cd5952020-06-05 12:25:38 +020051#include <haproxy/protocol.h>
52#include <haproxy/proxy-t.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020053#include <haproxy/regex.h>
54#include <haproxy/sample.h>
Willy Tarreau51cd5952020-06-05 12:25:38 +020055#include <haproxy/server.h>
56#include <haproxy/ssl_sock.h>
Willy Tarreau51cd5952020-06-05 12:25:38 +020057#include <haproxy/task.h>
58#include <haproxy/tcpcheck.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020059#include <haproxy/time.h>
60#include <haproxy/tools.h>
Willy Tarreau51cd5952020-06-05 12:25:38 +020061#include <haproxy/vars.h>
62
63
64/* Global tree to share all tcp-checks */
65struct eb_root shared_tcpchecks = EB_ROOT;
66
67
68DECLARE_POOL(pool_head_tcpcheck_rule, "tcpcheck_rule", sizeof(struct tcpcheck_rule));
69
70/**************************************************************************/
71/*************** Init/deinit tcp-check rules and ruleset ******************/
72/**************************************************************************/
73/* Releases memory allocated for a log-format string */
74static void free_tcpcheck_fmt(struct list *fmt)
75{
76 struct logformat_node *lf, *lfb;
77
78 list_for_each_entry_safe(lf, lfb, fmt, list) {
79 LIST_DEL(&lf->list);
80 release_sample_expr(lf->expr);
81 free(lf->arg);
82 free(lf);
83 }
84}
85
86/* Releases memory allocated for an HTTP header used in a tcp-check send rule */
87void free_tcpcheck_http_hdr(struct tcpcheck_http_hdr *hdr)
88{
89 if (!hdr)
90 return;
91
92 free_tcpcheck_fmt(&hdr->value);
93 istfree(&hdr->name);
94 free(hdr);
95}
96
97/* Releases memory allocated for an HTTP header list used in a tcp-check send
98 * rule
99 */
100static void free_tcpcheck_http_hdrs(struct list *hdrs)
101{
102 struct tcpcheck_http_hdr *hdr, *bhdr;
103
104 list_for_each_entry_safe(hdr, bhdr, hdrs, list) {
105 LIST_DEL(&hdr->list);
106 free_tcpcheck_http_hdr(hdr);
107 }
108}
109
110/* Releases memory allocated for a tcp-check. If in_pool is set, it means the
111 * tcp-check was allocated using a memory pool (it is used to instantiate email
112 * alerts).
113 */
114void free_tcpcheck(struct tcpcheck_rule *rule, int in_pool)
115{
116 if (!rule)
117 return;
118
119 free(rule->comment);
120 switch (rule->action) {
121 case TCPCHK_ACT_SEND:
122 switch (rule->send.type) {
123 case TCPCHK_SEND_STRING:
124 case TCPCHK_SEND_BINARY:
125 istfree(&rule->send.data);
126 break;
127 case TCPCHK_SEND_STRING_LF:
128 case TCPCHK_SEND_BINARY_LF:
129 free_tcpcheck_fmt(&rule->send.fmt);
130 break;
131 case TCPCHK_SEND_HTTP:
132 free(rule->send.http.meth.str.area);
133 if (!(rule->send.http.flags & TCPCHK_SND_HTTP_FL_URI_FMT))
134 istfree(&rule->send.http.uri);
135 else
136 free_tcpcheck_fmt(&rule->send.http.uri_fmt);
137 istfree(&rule->send.http.vsn);
138 free_tcpcheck_http_hdrs(&rule->send.http.hdrs);
139 if (!(rule->send.http.flags & TCPCHK_SND_HTTP_FL_BODY_FMT))
140 istfree(&rule->send.http.body);
141 else
142 free_tcpcheck_fmt(&rule->send.http.body_fmt);
143 break;
144 case TCPCHK_SEND_UNDEF:
145 break;
146 }
147 break;
148 case TCPCHK_ACT_EXPECT:
149 free_tcpcheck_fmt(&rule->expect.onerror_fmt);
150 free_tcpcheck_fmt(&rule->expect.onsuccess_fmt);
151 release_sample_expr(rule->expect.status_expr);
152 switch (rule->expect.type) {
153 case TCPCHK_EXPECT_HTTP_STATUS:
154 free(rule->expect.codes.codes);
155 break;
156 case TCPCHK_EXPECT_STRING:
157 case TCPCHK_EXPECT_BINARY:
158 case TCPCHK_EXPECT_HTTP_BODY:
159 istfree(&rule->expect.data);
160 break;
161 case TCPCHK_EXPECT_STRING_REGEX:
162 case TCPCHK_EXPECT_BINARY_REGEX:
163 case TCPCHK_EXPECT_HTTP_STATUS_REGEX:
164 case TCPCHK_EXPECT_HTTP_BODY_REGEX:
165 regex_free(rule->expect.regex);
166 break;
167 case TCPCHK_EXPECT_STRING_LF:
168 case TCPCHK_EXPECT_BINARY_LF:
169 case TCPCHK_EXPECT_HTTP_BODY_LF:
170 free_tcpcheck_fmt(&rule->expect.fmt);
171 break;
172 case TCPCHK_EXPECT_HTTP_HEADER:
173 if (rule->expect.flags & TCPCHK_EXPT_FL_HTTP_HNAME_REG)
174 regex_free(rule->expect.hdr.name_re);
175 else if (rule->expect.flags & TCPCHK_EXPT_FL_HTTP_HNAME_FMT)
176 free_tcpcheck_fmt(&rule->expect.hdr.name_fmt);
177 else
178 istfree(&rule->expect.hdr.name);
179
180 if (rule->expect.flags & TCPCHK_EXPT_FL_HTTP_HVAL_REG)
181 regex_free(rule->expect.hdr.value_re);
182 else if (rule->expect.flags & TCPCHK_EXPT_FL_HTTP_HVAL_FMT)
183 free_tcpcheck_fmt(&rule->expect.hdr.value_fmt);
184 else if (!(rule->expect.flags & TCPCHK_EXPT_FL_HTTP_HVAL_NONE))
185 istfree(&rule->expect.hdr.value);
186 break;
187 case TCPCHK_EXPECT_CUSTOM:
188 case TCPCHK_EXPECT_UNDEF:
189 break;
190 }
191 break;
192 case TCPCHK_ACT_CONNECT:
193 free(rule->connect.sni);
194 free(rule->connect.alpn);
195 release_sample_expr(rule->connect.port_expr);
196 break;
197 case TCPCHK_ACT_COMMENT:
198 break;
199 case TCPCHK_ACT_ACTION_KW:
200 free(rule->action_kw.rule);
201 break;
202 }
203
204 if (in_pool)
205 pool_free(pool_head_tcpcheck_rule, rule);
206 else
207 free(rule);
208}
209
210/* Creates a tcp-check variable used in preset variables before executing a
211 * tcp-check ruleset.
212 */
213struct tcpcheck_var *create_tcpcheck_var(const struct ist name)
214{
215 struct tcpcheck_var *var = NULL;
216
217 var = calloc(1, sizeof(*var));
218 if (var == NULL)
219 return NULL;
220
221 var->name = istdup(name);
222 if (!isttest(var->name)) {
223 free(var);
224 return NULL;
225 }
226
227 LIST_INIT(&var->list);
228 return var;
229}
230
231/* Releases memory allocated for a preset tcp-check variable */
232void free_tcpcheck_var(struct tcpcheck_var *var)
233{
234 if (!var)
235 return;
236
237 istfree(&var->name);
238 if (var->data.type == SMP_T_STR || var->data.type == SMP_T_BIN)
239 free(var->data.u.str.area);
240 else if (var->data.type == SMP_T_METH && var->data.u.meth.meth == HTTP_METH_OTHER)
241 free(var->data.u.meth.str.area);
242 free(var);
243}
244
245/* Releases a list of preset tcp-check variables */
246void free_tcpcheck_vars(struct list *vars)
247{
248 struct tcpcheck_var *var, *back;
249
250 list_for_each_entry_safe(var, back, vars, list) {
251 LIST_DEL(&var->list);
252 free_tcpcheck_var(var);
253 }
254}
255
256/* Duplicate a list of preset tcp-check variables */
257int dup_tcpcheck_vars(struct list *dst, struct list *src)
258{
259 struct tcpcheck_var *var, *new = NULL;
260
261 list_for_each_entry(var, src, list) {
262 new = create_tcpcheck_var(var->name);
263 if (!new)
264 goto error;
265 new->data.type = var->data.type;
266 if (var->data.type == SMP_T_STR || var->data.type == SMP_T_BIN) {
267 if (chunk_dup(&new->data.u.str, &var->data.u.str) == NULL)
268 goto error;
269 if (var->data.type == SMP_T_STR)
270 new->data.u.str.area[new->data.u.str.data] = 0;
271 }
272 else if (var->data.type == SMP_T_METH && var->data.u.meth.meth == HTTP_METH_OTHER) {
273 if (chunk_dup(&new->data.u.str, &var->data.u.str) == NULL)
274 goto error;
275 new->data.u.str.area[new->data.u.str.data] = 0;
276 new->data.u.meth.meth = var->data.u.meth.meth;
277 }
278 else
279 new->data.u = var->data.u;
280 LIST_ADDQ(dst, &new->list);
281 }
282 return 1;
283
284 error:
285 free(new);
286 return 0;
287}
288
289/* Looks for a shared tcp-check ruleset given its name. */
290struct tcpcheck_ruleset *find_tcpcheck_ruleset(const char *name)
291{
292 struct tcpcheck_ruleset *rs;
293 struct ebpt_node *node;
294
295 node = ebis_lookup_len(&shared_tcpchecks, name, strlen(name));
296 if (node) {
297 rs = container_of(node, typeof(*rs), node);
298 return rs;
299 }
300 return NULL;
301}
302
303/* Creates a new shared tcp-check ruleset and insert it in shared_tcpchecks
304 * tree.
305 */
306struct tcpcheck_ruleset *create_tcpcheck_ruleset(const char *name)
307{
308 struct tcpcheck_ruleset *rs;
309
310 rs = calloc(1, sizeof(*rs));
311 if (rs == NULL)
312 return NULL;
313
314 rs->node.key = strdup(name);
315 if (rs->node.key == NULL) {
316 free(rs);
317 return NULL;
318 }
319
320 LIST_INIT(&rs->rules);
321 ebis_insert(&shared_tcpchecks, &rs->node);
322 return rs;
323}
324
325/* Releases memory allocated by a tcp-check ruleset. */
326void free_tcpcheck_ruleset(struct tcpcheck_ruleset *rs)
327{
328 struct tcpcheck_rule *r, *rb;
329
330 if (!rs)
331 return;
332
333 ebpt_delete(&rs->node);
334 free(rs->node.key);
335 list_for_each_entry_safe(r, rb, &rs->rules, list) {
336 LIST_DEL(&r->list);
337 free_tcpcheck(r, 0);
338 }
339 free(rs);
340}
341
342
343/**************************************************************************/
344/**************** Everything about tcp-checks execution *******************/
345/**************************************************************************/
346/* Returns the id of a step in a tcp-check ruleset */
347int tcpcheck_get_step_id(struct check *check, struct tcpcheck_rule *rule)
348{
349 if (!rule)
350 rule = check->current_step;
351
352 /* no last started step => first step */
353 if (!rule)
354 return 1;
355
356 /* last step is the first implicit connect */
357 if (rule->index == 0 &&
358 rule->action == TCPCHK_ACT_CONNECT &&
359 (rule->connect.options & TCPCHK_OPT_IMPLICIT))
360 return 0;
361
362 return rule->index + 1;
363}
364
365/* Returns the first non COMMENT/ACTION_KW tcp-check rule from list <list> or
366 * NULL if none was found.
367 */
368struct tcpcheck_rule *get_first_tcpcheck_rule(struct tcpcheck_rules *rules)
369{
370 struct tcpcheck_rule *r;
371
372 list_for_each_entry(r, rules->list, list) {
373 if (r->action != TCPCHK_ACT_COMMENT && r->action != TCPCHK_ACT_ACTION_KW)
374 return r;
375 }
376 return NULL;
377}
378
379/* Returns the last non COMMENT/ACTION_KW tcp-check rule from list <list> or
380 * NULL if none was found.
381 */
382static struct tcpcheck_rule *get_last_tcpcheck_rule(struct tcpcheck_rules *rules)
383{
384 struct tcpcheck_rule *r;
385
386 list_for_each_entry_rev(r, rules->list, list) {
387 if (r->action != TCPCHK_ACT_COMMENT && r->action != TCPCHK_ACT_ACTION_KW)
388 return r;
389 }
390 return NULL;
391}
392
393/* Returns the non COMMENT/ACTION_KW tcp-check rule from list <list> following
394 * <start> or NULL if non was found. If <start> is NULL, it relies on
395 * get_first_tcpcheck_rule().
396 */
397static struct tcpcheck_rule *get_next_tcpcheck_rule(struct tcpcheck_rules *rules, struct tcpcheck_rule *start)
398{
399 struct tcpcheck_rule *r;
400
401 if (!start)
402 return get_first_tcpcheck_rule(rules);
403
404 r = LIST_NEXT(&start->list, typeof(r), list);
405 list_for_each_entry_from(r, rules->list, list) {
406 if (r->action != TCPCHK_ACT_COMMENT && r->action != TCPCHK_ACT_ACTION_KW)
407 return r;
408 }
409 return NULL;
410}
411
412
413/* Creates info message when a tcp-check healthcheck fails on an expect rule */
414static void tcpcheck_expect_onerror_message(struct buffer *msg, struct check *check, struct tcpcheck_rule *rule,
415 int match, struct ist info)
416{
417 struct sample *smp;
418
419 /* Follows these step to produce the info message:
420 * 1. if info field is already provided, copy it
421 * 2. if the expect rule provides an onerror log-format string,
422 * use it to produce the message
423 * 3. the expect rule is part of a protocol check (http, redis, mysql...), do nothing
424 * 4. Otherwise produce the generic tcp-check info message
425 */
426 if (istlen(info)) {
427 chunk_strncat(msg, istptr(info), istlen(info));
428 goto comment;
429 }
430 else if (!LIST_ISEMPTY(&rule->expect.onerror_fmt)) {
431 msg->data += sess_build_logline(check->sess, NULL, b_tail(msg), b_room(msg), &rule->expect.onerror_fmt);
432 goto comment;
433 }
434
435 if (check->type == PR_O2_TCPCHK_CHK &&
436 (check->tcpcheck_rules->flags & TCPCHK_RULES_PROTO_CHK) != TCPCHK_RULES_TCP_CHK)
437 goto comment;
438
439 chunk_strcat(msg, (match ? "TCPCHK matched unwanted content" : "TCPCHK did not match content"));
440 switch (rule->expect.type) {
441 case TCPCHK_EXPECT_HTTP_STATUS:
442 chunk_appendf(msg, "(status codes) at step %d", tcpcheck_get_step_id(check, rule));
443 break;
444 case TCPCHK_EXPECT_STRING:
445 case TCPCHK_EXPECT_HTTP_BODY:
446 chunk_appendf(msg, " '%.*s' at step %d", (unsigned int)istlen(rule->expect.data), istptr(rule->expect.data),
447 tcpcheck_get_step_id(check, rule));
448 break;
449 case TCPCHK_EXPECT_BINARY:
450 chunk_appendf(msg, " (binary) at step %d", tcpcheck_get_step_id(check, rule));
451 break;
452 case TCPCHK_EXPECT_STRING_REGEX:
453 case TCPCHK_EXPECT_HTTP_STATUS_REGEX:
454 case TCPCHK_EXPECT_HTTP_BODY_REGEX:
455 chunk_appendf(msg, " (regex) at step %d", tcpcheck_get_step_id(check, rule));
456 break;
457 case TCPCHK_EXPECT_BINARY_REGEX:
458 chunk_appendf(msg, " (binary regex) at step %d", tcpcheck_get_step_id(check, rule));
459 break;
460 case TCPCHK_EXPECT_STRING_LF:
461 case TCPCHK_EXPECT_HTTP_BODY_LF:
462 chunk_appendf(msg, " (log-format string) at step %d", tcpcheck_get_step_id(check, rule));
463 break;
464 case TCPCHK_EXPECT_BINARY_LF:
465 chunk_appendf(msg, " (log-format binary) at step %d", tcpcheck_get_step_id(check, rule));
466 break;
467 case TCPCHK_EXPECT_CUSTOM:
468 chunk_appendf(msg, " (custom function) at step %d", tcpcheck_get_step_id(check, rule));
469 break;
470 case TCPCHK_EXPECT_HTTP_HEADER:
471 chunk_appendf(msg, " (header pattern) at step %d", tcpcheck_get_step_id(check, rule));
472 case TCPCHK_EXPECT_UNDEF:
473 /* Should never happen. */
474 return;
475 }
476
477 comment:
478 /* If the failing expect rule provides a comment, it is concatenated to
479 * the info message.
480 */
481 if (rule->comment) {
482 chunk_strcat(msg, " comment: ");
483 chunk_strcat(msg, rule->comment);
484 }
485
486 /* Finally, the check status code is set if the failing expect rule
487 * defines a status expression.
488 */
489 if (rule->expect.status_expr) {
490 smp = sample_fetch_as_type(check->proxy, check->sess, NULL, SMP_OPT_DIR_RES | SMP_OPT_FINAL,
491 rule->expect.status_expr, SMP_T_STR);
492
493 if (smp && sample_casts[smp->data.type][SMP_T_SINT] &&
494 sample_casts[smp->data.type][SMP_T_SINT](smp))
495 check->code = smp->data.u.sint;
496 }
497
498 *(b_tail(msg)) = '\0';
499}
500
501/* Creates info message when a tcp-check healthcheck succeeds on an expect rule */
502static void tcpcheck_expect_onsuccess_message(struct buffer *msg, struct check *check, struct tcpcheck_rule *rule,
503 struct ist info)
504{
505 struct sample *smp;
506
507 /* Follows these step to produce the info message:
508 * 1. if info field is already provided, copy it
509 * 2. if the expect rule provides an onsucces log-format string,
510 * use it to produce the message
511 * 3. the expect rule is part of a protocol check (http, redis, mysql...), do nothing
512 * 4. Otherwise produce the generic tcp-check info message
513 */
514 if (istlen(info))
515 chunk_strncat(msg, istptr(info), istlen(info));
516 if (!LIST_ISEMPTY(&rule->expect.onsuccess_fmt))
517 msg->data += sess_build_logline(check->sess, NULL, b_tail(msg), b_room(msg),
518 &rule->expect.onsuccess_fmt);
519 else if (check->type == PR_O2_TCPCHK_CHK &&
520 (check->tcpcheck_rules->flags & TCPCHK_RULES_PROTO_CHK) == TCPCHK_RULES_TCP_CHK)
521 chunk_strcat(msg, "(tcp-check)");
522
523 /* Finally, the check status code is set if the expect rule defines a
524 * status expression.
525 */
526 if (rule->expect.status_expr) {
527 smp = sample_fetch_as_type(check->proxy, check->sess, NULL, SMP_OPT_DIR_RES | SMP_OPT_FINAL,
528 rule->expect.status_expr, SMP_T_STR);
529
530 if (smp && sample_casts[smp->data.type][SMP_T_SINT] &&
531 sample_casts[smp->data.type][SMP_T_SINT](smp))
532 check->code = smp->data.u.sint;
533 }
534
535 *(b_tail(msg)) = '\0';
536}
537
538/* Internal functions to parse and validate a MySQL packet in the context of an
539 * expect rule. It start to parse the input buffer at the offset <offset>. If
540 * <last_read> is set, no more data are expected.
541 */
542static enum tcpcheck_eval_ret tcpcheck_mysql_expect_packet(struct check *check, struct tcpcheck_rule *rule,
543 unsigned int offset, int last_read)
544{
545 enum tcpcheck_eval_ret ret = TCPCHK_EVAL_CONTINUE;
546 enum healthcheck_status status;
547 struct buffer *msg = NULL;
548 struct ist desc = IST_NULL;
549 unsigned int err = 0, plen = 0;
550
551
552 /* 3 Bytes for the packet length and 1 byte for the sequence id */
553 if (b_data(&check->bi) < offset+4) {
554 if (!last_read)
555 goto wait_more_data;
556
557 /* invalid length or truncated response */
558 status = HCHK_STATUS_L7RSP;
559 goto error;
560 }
561
562 plen = ((unsigned char) *b_peek(&check->bi, offset)) +
563 (((unsigned char) *(b_peek(&check->bi, offset+1))) << 8) +
564 (((unsigned char) *(b_peek(&check->bi, offset+2))) << 16);
565
566 if (b_data(&check->bi) < offset+plen+4) {
567 if (!last_read)
568 goto wait_more_data;
569
570 /* invalid length or truncated response */
571 status = HCHK_STATUS_L7RSP;
572 goto error;
573 }
574
575 if (*b_peek(&check->bi, offset+4) == '\xff') {
576 /* MySQL Error packet always begin with field_count = 0xff */
577 status = HCHK_STATUS_L7STS;
578 err = ((unsigned char) *b_peek(&check->bi, offset+5)) +
579 (((unsigned char) *(b_peek(&check->bi, offset+6))) << 8);
580 desc = ist2(b_peek(&check->bi, offset+7), b_data(&check->bi) - offset - 7);
581 goto error;
582 }
583
584 if (get_next_tcpcheck_rule(check->tcpcheck_rules, rule) != NULL) {
585 /* Not the last rule, continue */
586 goto out;
587 }
588
589 /* We set the MySQL Version in description for information purpose
590 * FIXME : it can be cool to use MySQL Version for other purpose,
591 * like mark as down old MySQL server.
592 */
593 status = ((rule->expect.ok_status != HCHK_STATUS_UNKNOWN) ? rule->expect.ok_status : HCHK_STATUS_L7OKD);
594 set_server_check_status(check, status, b_peek(&check->bi, 5));
595
596 out:
597 free_trash_chunk(msg);
598 return ret;
599
600 error:
601 ret = TCPCHK_EVAL_STOP;
602 check->code = err;
603 msg = alloc_trash_chunk();
604 if (msg)
605 tcpcheck_expect_onerror_message(msg, check, rule, 0, desc);
606 set_server_check_status(check, status, (msg ? b_head(msg) : NULL));
607 goto out;
608
609 wait_more_data:
610 ret = TCPCHK_EVAL_WAIT;
611 goto out;
612}
613
614/* Custom tcp-check expect function to parse and validate the MySQL initial
615 * handshake packet. Returns TCPCHK_EVAL_WAIT to wait for more data,
616 * TCPCHK_EVAL_CONTINUE to evaluate the next rule or TCPCHK_EVAL_STOP if an
617 * error occurred.
618 */
619enum tcpcheck_eval_ret tcpcheck_mysql_expect_iniths(struct check *check, struct tcpcheck_rule *rule, int last_read)
620{
621 return tcpcheck_mysql_expect_packet(check, rule, 0, last_read);
622}
623
624/* Custom tcp-check expect function to parse and validate the MySQL OK packet
625 * following the initial handshake. Returns TCPCHK_EVAL_WAIT to wait for more
626 * data, TCPCHK_EVAL_CONTINUE to evaluate the next rule or TCPCHK_EVAL_STOP if
627 * an error occurred.
628 */
629enum tcpcheck_eval_ret tcpcheck_mysql_expect_ok(struct check *check, struct tcpcheck_rule *rule, int last_read)
630{
631 unsigned int hslen = 0;
632
633 hslen = 4 + ((unsigned char) *b_head(&check->bi)) +
634 (((unsigned char) *(b_peek(&check->bi, 1))) << 8) +
635 (((unsigned char) *(b_peek(&check->bi, 2))) << 16);
636
637 return tcpcheck_mysql_expect_packet(check, rule, hslen, last_read);
638}
639
640/* Custom tcp-check expect function to parse and validate the LDAP bind response
641 * package packet. Returns TCPCHK_EVAL_WAIT to wait for more data,
642 * TCPCHK_EVAL_CONTINUE to evaluate the next rule or TCPCHK_EVAL_STOP if an
643 * error occurred.
644 */
645enum tcpcheck_eval_ret tcpcheck_ldap_expect_bindrsp(struct check *check, struct tcpcheck_rule *rule, int last_read)
646{
647 enum tcpcheck_eval_ret ret = TCPCHK_EVAL_CONTINUE;
648 enum healthcheck_status status;
649 struct buffer *msg = NULL;
650 struct ist desc = IST_NULL;
651 unsigned short msglen = 0;
652
653 /* Check if the server speaks LDAP (ASN.1/BER)
654 * http://en.wikipedia.org/wiki/Basic_Encoding_Rules
655 * http://tools.ietf.org/html/rfc4511
656 */
657 /* size of LDAPMessage */
658 msglen = (*(b_head(&check->bi) + 1) & 0x80) ? (*(b_head(&check->bi) + 1) & 0x7f) : 0;
659
660 /* http://tools.ietf.org/html/rfc4511#section-4.2.2
661 * messageID: 0x02 0x01 0x01: INTEGER 1
662 * protocolOp: 0x61: bindResponse
663 */
664 if ((msglen > 2) || (memcmp(b_head(&check->bi) + 2 + msglen, "\x02\x01\x01\x61", 4) != 0)) {
665 status = HCHK_STATUS_L7RSP;
666 desc = ist("Not LDAPv3 protocol");
667 goto error;
668 }
669
670 /* size of bindResponse */
671 msglen += (*(b_head(&check->bi) + msglen + 6) & 0x80) ? (*(b_head(&check->bi) + msglen + 6) & 0x7f) : 0;
672
673 /* http://tools.ietf.org/html/rfc4511#section-4.1.9
674 * ldapResult: 0x0a 0x01: ENUMERATION
675 */
676 if ((msglen > 4) || (memcmp(b_head(&check->bi) + 7 + msglen, "\x0a\x01", 2) != 0)) {
677 status = HCHK_STATUS_L7RSP;
678 desc = ist("Not LDAPv3 protocol");
679 goto error;
680 }
681
682 /* http://tools.ietf.org/html/rfc4511#section-4.1.9
683 * resultCode
684 */
685 check->code = *(b_head(&check->bi) + msglen + 9);
686 if (check->code) {
687 status = HCHK_STATUS_L7STS;
688 desc = ist("See RFC: http://tools.ietf.org/html/rfc4511#section-4.1.9");
689 goto error;
690 }
691
692 status = ((rule->expect.ok_status != HCHK_STATUS_UNKNOWN) ? rule->expect.ok_status : HCHK_STATUS_L7OKD);
693 set_server_check_status(check, status, "Success");
694
695 out:
696 free_trash_chunk(msg);
697 return ret;
698
699 error:
700 ret = TCPCHK_EVAL_STOP;
701 msg = alloc_trash_chunk();
702 if (msg)
703 tcpcheck_expect_onerror_message(msg, check, rule, 0, desc);
704 set_server_check_status(check, status, (msg ? b_head(msg) : NULL));
705 goto out;
706}
707
708/* Custom tcp-check expect function to parse and validate the SPOP hello agent
709 * frame. Returns TCPCHK_EVAL_WAIT to wait for more data, TCPCHK_EVAL_CONTINUE
710 * to evaluate the next rule or TCPCHK_EVAL_STOP if an error occurred.
711 */
712enum tcpcheck_eval_ret tcpcheck_spop_expect_agenthello(struct check *check, struct tcpcheck_rule *rule, int last_read)
713{
714 enum tcpcheck_eval_ret ret = TCPCHK_EVAL_CONTINUE;
715 enum healthcheck_status status;
716 struct buffer *msg = NULL;
717 struct ist desc = IST_NULL;
718 unsigned int framesz;
719
720
721 memcpy(&framesz, b_head(&check->bi), 4);
722 framesz = ntohl(framesz);
723
724 if (!last_read && b_data(&check->bi) < (4+framesz))
725 goto wait_more_data;
726
727 memset(b_orig(&trash), 0, b_size(&trash));
728 if (spoe_handle_healthcheck_response(b_peek(&check->bi, 4), framesz, b_orig(&trash), HCHK_DESC_LEN) == -1) {
729 status = HCHK_STATUS_L7RSP;
730 desc = ist2(b_orig(&trash), strlen(b_orig(&trash)));
731 goto error;
732 }
733
734 status = ((rule->expect.ok_status != HCHK_STATUS_UNKNOWN) ? rule->expect.ok_status : HCHK_STATUS_L7OKD);
735 set_server_check_status(check, status, "SPOA server is ok");
736
737 out:
738 free_trash_chunk(msg);
739 return ret;
740
741 error:
742 ret = TCPCHK_EVAL_STOP;
743 msg = alloc_trash_chunk();
744 if (msg)
745 tcpcheck_expect_onerror_message(msg, check, rule, 0, desc);
746 set_server_check_status(check, status, (msg ? b_head(msg) : NULL));
747 goto out;
748
749 wait_more_data:
750 ret = TCPCHK_EVAL_WAIT;
751 goto out;
752}
753
754/* Custom tcp-check expect function to parse and validate the agent-check
755 * reply. Returns TCPCHK_EVAL_WAIT to wait for more data, TCPCHK_EVAL_CONTINUE
756 * to evaluate the next rule or TCPCHK_EVAL_STOP if an error occurred.
757 */
758enum tcpcheck_eval_ret tcpcheck_agent_expect_reply(struct check *check, struct tcpcheck_rule *rule, int last_read)
759{
760 enum tcpcheck_eval_ret ret = TCPCHK_EVAL_STOP;
761 enum healthcheck_status status = HCHK_STATUS_CHECKED;
762 const char *hs = NULL; /* health status */
763 const char *as = NULL; /* admin status */
764 const char *ps = NULL; /* performance status */
765 const char *cs = NULL; /* maxconn */
766 const char *err = NULL; /* first error to report */
767 const char *wrn = NULL; /* first warning to report */
768 char *cmd, *p;
769
770 /* We're getting an agent check response. The agent could
771 * have been disabled in the mean time with a long check
772 * still pending. It is important that we ignore the whole
773 * response.
774 */
775 if (!(check->state & CHK_ST_ENABLED))
776 goto out;
777
778 /* The agent supports strings made of a single line ended by the
779 * first CR ('\r') or LF ('\n'). This line is composed of words
780 * delimited by spaces (' '), tabs ('\t'), or commas (','). The
781 * line may optionally contained a description of a state change
782 * after a sharp ('#'), which is only considered if a health state
783 * is announced.
784 *
785 * Words may be composed of :
786 * - a numeric weight suffixed by the percent character ('%').
787 * - a health status among "up", "down", "stopped", and "fail".
788 * - an admin status among "ready", "drain", "maint".
789 *
790 * These words may appear in any order. If multiple words of the
791 * same category appear, the last one wins.
792 */
793
794 p = b_head(&check->bi);
795 while (*p && *p != '\n' && *p != '\r')
796 p++;
797
798 if (!*p) {
799 if (!last_read)
800 goto wait_more_data;
801
802 /* at least inform the admin that the agent is mis-behaving */
803 set_server_check_status(check, check->status, "Ignoring incomplete line from agent");
804 goto out;
805 }
806
807 *p = 0;
808 cmd = b_head(&check->bi);
809
810 while (*cmd) {
811 /* look for next word */
812 if (*cmd == ' ' || *cmd == '\t' || *cmd == ',') {
813 cmd++;
814 continue;
815 }
816
817 if (*cmd == '#') {
818 /* this is the beginning of a health status description,
819 * skip the sharp and blanks.
820 */
821 cmd++;
822 while (*cmd == '\t' || *cmd == ' ')
823 cmd++;
824 break;
825 }
826
827 /* find the end of the word so that we have a null-terminated
828 * word between <cmd> and <p>.
829 */
830 p = cmd + 1;
831 while (*p && *p != '\t' && *p != ' ' && *p != '\n' && *p != ',')
832 p++;
833 if (*p)
834 *p++ = 0;
835
836 /* first, health statuses */
837 if (strcasecmp(cmd, "up") == 0) {
838 check->server->check.health = check->server->check.rise + check->server->check.fall - 1;
839 status = HCHK_STATUS_L7OKD;
840 hs = cmd;
841 }
842 else if (strcasecmp(cmd, "down") == 0) {
843 check->server->check.health = 0;
844 status = HCHK_STATUS_L7STS;
845 hs = cmd;
846 }
847 else if (strcasecmp(cmd, "stopped") == 0) {
848 check->server->check.health = 0;
849 status = HCHK_STATUS_L7STS;
850 hs = cmd;
851 }
852 else if (strcasecmp(cmd, "fail") == 0) {
853 check->server->check.health = 0;
854 status = HCHK_STATUS_L7STS;
855 hs = cmd;
856 }
857 /* admin statuses */
858 else if (strcasecmp(cmd, "ready") == 0) {
859 as = cmd;
860 }
861 else if (strcasecmp(cmd, "drain") == 0) {
862 as = cmd;
863 }
864 else if (strcasecmp(cmd, "maint") == 0) {
865 as = cmd;
866 }
867 /* try to parse a weight here and keep the last one */
868 else if (isdigit((unsigned char)*cmd) && strchr(cmd, '%') != NULL) {
869 ps = cmd;
870 }
871 /* try to parse a maxconn here */
872 else if (strncasecmp(cmd, "maxconn:", strlen("maxconn:")) == 0) {
873 cs = cmd;
874 }
875 else {
876 /* keep a copy of the first error */
877 if (!err)
878 err = cmd;
879 }
880 /* skip to next word */
881 cmd = p;
882 }
883 /* here, cmd points either to \0 or to the beginning of a
884 * description. Skip possible leading spaces.
885 */
886 while (*cmd == ' ' || *cmd == '\n')
887 cmd++;
888
889 /* First, update the admin status so that we avoid sending other
890 * possibly useless warnings and can also update the health if
891 * present after going back up.
892 */
893 if (as) {
894 if (strcasecmp(as, "drain") == 0)
895 srv_adm_set_drain(check->server);
896 else if (strcasecmp(as, "maint") == 0)
897 srv_adm_set_maint(check->server);
898 else
899 srv_adm_set_ready(check->server);
900 }
901
902 /* now change weights */
903 if (ps) {
904 const char *msg;
905
906 msg = server_parse_weight_change_request(check->server, ps);
907 if (!wrn || !*wrn)
908 wrn = msg;
909 }
910
911 if (cs) {
912 const char *msg;
913
914 cs += strlen("maxconn:");
915
916 msg = server_parse_maxconn_change_request(check->server, cs);
917 if (!wrn || !*wrn)
918 wrn = msg;
919 }
920
921 /* and finally health status */
922 if (hs) {
923 /* We'll report some of the warnings and errors we have
924 * here. Down reports are critical, we leave them untouched.
925 * Lack of report, or report of 'UP' leaves the room for
926 * ERR first, then WARN.
927 */
928 const char *msg = cmd;
929 struct buffer *t;
930
931 if (!*msg || status == HCHK_STATUS_L7OKD) {
932 if (err && *err)
933 msg = err;
934 else if (wrn && *wrn)
935 msg = wrn;
936 }
937
938 t = get_trash_chunk();
939 chunk_printf(t, "via agent : %s%s%s%s",
940 hs, *msg ? " (" : "",
941 msg, *msg ? ")" : "");
942 set_server_check_status(check, status, t->area);
943 }
944 else if (err && *err) {
945 /* No status change but we'd like to report something odd.
946 * Just report the current state and copy the message.
947 */
948 chunk_printf(&trash, "agent reports an error : %s", err);
949 set_server_check_status(check, status/*check->status*/, trash.area);
950 }
951 else if (wrn && *wrn) {
952 /* No status change but we'd like to report something odd.
953 * Just report the current state and copy the message.
954 */
955 chunk_printf(&trash, "agent warns : %s", wrn);
956 set_server_check_status(check, status/*check->status*/, trash.area);
957 }
958 else
959 set_server_check_status(check, status, NULL);
960
961 out:
962 return ret;
963
964 wait_more_data:
965 ret = TCPCHK_EVAL_WAIT;
966 goto out;
967}
968
969/* Evaluates a TCPCHK_ACT_CONNECT rule. Returns TCPCHK_EVAL_WAIT to wait the
970 * connection establishment, TCPCHK_EVAL_CONTINUE to evaluate the next rule or
971 * TCPCHK_EVAL_STOP if an error occurred.
972 */
973enum tcpcheck_eval_ret tcpcheck_eval_connect(struct check *check, struct tcpcheck_rule *rule)
974{
975 enum tcpcheck_eval_ret ret = TCPCHK_EVAL_CONTINUE;
976 struct tcpcheck_connect *connect = &rule->connect;
977 struct proxy *proxy = check->proxy;
978 struct server *s = check->server;
979 struct task *t = check->task;
980 struct conn_stream *cs;
981 struct connection *conn = NULL;
982 struct protocol *proto;
983 struct xprt_ops *xprt;
984 struct tcpcheck_rule *next;
985 int status, port;
986
Christopher Faulet444b7b12021-01-18 15:47:03 +0100987 /* For a connect action we'll create a new connection. The previous one,
988 * if any should have been killed. We don't want to leave *without* a
Willy Tarreau51cd5952020-06-05 12:25:38 +0200989 * connection if we came here from the connection layer, hence with a
990 * connection. Thus we'll proceed in the following order :
991 * 1: close but not release previous connection (handled by the caller)
Christopher Faulet444b7b12021-01-18 15:47:03 +0100992 * 2: Wait the connection is released (handled by process_chk_conn())
993 * 3: try to get a new connection
Willy Tarreau51cd5952020-06-05 12:25:38 +0200994 */
995
Christopher Fauletb51e0372020-11-25 13:47:00 +0100996 /* Always release input and output buffer when a new connect is evaluated */
997 check_release_buf(check, &check->bi);
998 check_release_buf(check, &check->bo);
999
Christopher Faulet444b7b12021-01-18 15:47:03 +01001000 /* prepare new connection */
Christopher Faulet236c93b2020-07-02 09:19:54 +02001001 cs = cs_new(NULL, (s ? &s->obj_type : &proxy->obj_type));
Willy Tarreau51cd5952020-06-05 12:25:38 +02001002 if (!cs) {
1003 chunk_printf(&trash, "TCPCHK error allocating connection at step %d",
1004 tcpcheck_get_step_id(check, rule));
1005 if (rule->comment)
1006 chunk_appendf(&trash, " comment: '%s'", rule->comment);
1007 set_server_check_status(check, HCHK_STATUS_SOCKERR, trash.area);
1008 ret = TCPCHK_EVAL_STOP;
1009 goto out;
1010 }
1011
Willy Tarreau51cd5952020-06-05 12:25:38 +02001012 tasklet_set_tid(check->wait_list.tasklet, tid);
1013
1014 check->cs = cs;
1015 conn = cs->conn;
1016 conn_set_owner(conn, check->sess, NULL);
1017
1018 /* Maybe there were an older connection we were waiting on */
1019 check->wait_list.events = 0;
Willy Tarreau51cd5952020-06-05 12:25:38 +02001020
1021 /* no client address */
Willy Tarreau9b7587a2020-10-15 07:32:10 +02001022 if (!sockaddr_alloc(&conn->dst, NULL, 0)) {
Willy Tarreau51cd5952020-06-05 12:25:38 +02001023 status = SF_ERR_RESOURCE;
1024 goto fail_check;
1025 }
1026
1027 /* connect to the connect rule addr if specified, otherwise the check
1028 * addr if specified on the server. otherwise, use the server addr (it
1029 * MUST exist at this step).
1030 */
1031 *conn->dst = (is_addr(&connect->addr)
1032 ? connect->addr
1033 : (is_addr(&check->addr) ? check->addr : s->addr));
1034 proto = protocol_by_family(conn->dst->ss_family);
1035
1036 port = 0;
1037 if (!port && connect->port)
1038 port = connect->port;
1039 if (!port && connect->port_expr) {
1040 struct sample *smp;
1041
1042 smp = sample_fetch_as_type(check->proxy, check->sess, NULL,
1043 SMP_OPT_DIR_REQ | SMP_OPT_FINAL,
1044 connect->port_expr, SMP_T_SINT);
1045 if (smp)
1046 port = smp->data.u.sint;
1047 }
1048 if (!port && is_inet_addr(&connect->addr))
1049 port = get_host_port(&connect->addr);
1050 if (!port && check->port)
1051 port = check->port;
1052 if (!port && is_inet_addr(&check->addr))
1053 port = get_host_port(&check->addr);
1054 if (!port) {
1055 /* The server MUST exist here */
1056 port = s->svc_port;
1057 }
1058 set_host_port(conn->dst, port);
1059
1060 xprt = ((connect->options & TCPCHK_OPT_SSL)
1061 ? xprt_get(XPRT_SSL)
1062 : ((connect->options & TCPCHK_OPT_DEFAULT_CONNECT) ? check->xprt : xprt_get(XPRT_RAW)));
1063
1064 conn_prepare(conn, proto, xprt);
1065 cs_attach(cs, check, &check_conn_cb);
1066
Christopher Fauletf7177272020-10-02 13:41:55 +02001067 if ((connect->options & TCPCHK_OPT_SOCKS4) && s && (s->flags & SRV_F_SOCKS4_PROXY)) {
1068 conn->send_proxy_ofs = 1;
1069 conn->flags |= CO_FL_SOCKS4;
1070 }
1071 else if ((connect->options & TCPCHK_OPT_DEFAULT_CONNECT) && s && s->check.via_socks4 && (s->flags & SRV_F_SOCKS4_PROXY)) {
1072 conn->send_proxy_ofs = 1;
1073 conn->flags |= CO_FL_SOCKS4;
1074 }
1075
1076 if (connect->options & TCPCHK_OPT_SEND_PROXY) {
1077 conn->send_proxy_ofs = 1;
1078 conn->flags |= CO_FL_SEND_PROXY;
1079 }
1080 else if ((connect->options & TCPCHK_OPT_DEFAULT_CONNECT) && s && s->check.send_proxy && !(check->state & CHK_ST_AGENT)) {
1081 conn->send_proxy_ofs = 1;
1082 conn->flags |= CO_FL_SEND_PROXY;
1083 }
1084
Willy Tarreau51cd5952020-06-05 12:25:38 +02001085 status = SF_ERR_INTERNAL;
1086 next = get_next_tcpcheck_rule(check->tcpcheck_rules, rule);
1087 if (proto && proto->connect) {
1088 int flags = 0;
1089
1090 if (check->tcpcheck_rules->flags & TCPCHK_RULES_PROTO_CHK)
1091 flags |= CONNECT_HAS_DATA;
1092 if (!next || next->action != TCPCHK_ACT_EXPECT)
1093 flags |= CONNECT_DELACK_ALWAYS;
1094 status = proto->connect(conn, flags);
1095 }
1096
1097 if (status != SF_ERR_NONE)
1098 goto fail_check;
1099
Christopher Faulet21ddc742020-07-01 15:26:14 +02001100 conn_set_private(conn);
Willy Tarreau51cd5952020-06-05 12:25:38 +02001101 conn->ctx = cs;
1102
Willy Tarreau51cd5952020-06-05 12:25:38 +02001103#ifdef USE_OPENSSL
1104 if (connect->sni)
1105 ssl_sock_set_servername(conn, connect->sni);
1106 else if ((connect->options & TCPCHK_OPT_DEFAULT_CONNECT) && s && s->check.sni)
1107 ssl_sock_set_servername(conn, s->check.sni);
1108
1109 if (connect->alpn)
1110 ssl_sock_set_alpn(conn, (unsigned char *)connect->alpn, connect->alpn_len);
1111 else if ((connect->options & TCPCHK_OPT_DEFAULT_CONNECT) && s && s->check.alpn_str)
1112 ssl_sock_set_alpn(conn, (unsigned char *)s->check.alpn_str, s->check.alpn_len);
1113#endif
Willy Tarreau51cd5952020-06-05 12:25:38 +02001114
1115 if (conn_ctrl_ready(conn) && (connect->options & TCPCHK_OPT_LINGER)) {
1116 /* Some servers don't like reset on close */
1117 fdtab[cs->conn->handle.fd].linger_risk = 0;
1118 }
1119
1120 if (conn_ctrl_ready(conn) && (conn->flags & (CO_FL_SEND_PROXY | CO_FL_SOCKS4))) {
1121 if (xprt_add_hs(conn) < 0)
1122 status = SF_ERR_RESOURCE;
1123 }
1124
Willy Tarreau8e979fa2020-07-31 08:49:31 +02001125 /* The mux may be initialized now if there isn't server attached to the
1126 * check (email alerts) or if there is a mux proto specified or if there
1127 * is no alpn.
1128 */
1129 if (!s || ((connect->options & TCPCHK_OPT_DEFAULT_CONNECT) && check->mux_proto) ||
1130 connect->mux_proto || (!connect->alpn && !check->alpn_str)) {
1131 const struct mux_ops *mux_ops;
1132
1133 if (connect->mux_proto)
1134 mux_ops = connect->mux_proto->mux;
1135 else if ((connect->options & TCPCHK_OPT_DEFAULT_CONNECT) && check->mux_proto)
1136 mux_ops = check->mux_proto->mux;
1137 else {
1138 int mode = ((check->tcpcheck_rules->flags & TCPCHK_RULES_PROTO_CHK) == TCPCHK_RULES_HTTP_CHK
1139 ? PROTO_MODE_HTTP
1140 : PROTO_MODE_TCP);
1141
1142 mux_ops = conn_get_best_mux(conn, IST_NULL, PROTO_SIDE_BE, mode);
1143 }
1144 if (mux_ops && conn_install_mux(conn, mux_ops, cs, proxy, check->sess) < 0) {
1145 status = SF_ERR_INTERNAL;
1146 goto fail_check;
1147 }
1148 }
1149
Willy Tarreau51cd5952020-06-05 12:25:38 +02001150 fail_check:
1151 /* It can return one of :
1152 * - SF_ERR_NONE if everything's OK
1153 * - SF_ERR_SRVTO if there are no more servers
1154 * - SF_ERR_SRVCL if the connection was refused by the server
1155 * - SF_ERR_PRXCOND if the connection has been limited by the proxy (maxconn)
1156 * - SF_ERR_RESOURCE if a system resource is lacking (eg: fd limits, ports, ...)
1157 * - SF_ERR_INTERNAL for any other purely internal errors
1158 * Additionally, in the case of SF_ERR_RESOURCE, an emergency log will be emitted.
1159 * Note that we try to prevent the network stack from sending the ACK during the
1160 * connect() when a pure TCP check is used (without PROXY protocol).
1161 */
1162 switch (status) {
1163 case SF_ERR_NONE:
1164 /* we allow up to min(inter, timeout.connect) for a connection
1165 * to establish but only when timeout.check is set as it may be
1166 * to short for a full check otherwise
1167 */
1168 t->expire = tick_add(now_ms, MS_TO_TICKS(check->inter));
1169
1170 if (proxy->timeout.check && proxy->timeout.connect) {
1171 int t_con = tick_add(now_ms, proxy->timeout.connect);
1172 t->expire = tick_first(t->expire, t_con);
1173 }
1174 break;
1175 case SF_ERR_SRVTO: /* ETIMEDOUT */
1176 case SF_ERR_SRVCL: /* ECONNREFUSED, ENETUNREACH, ... */
1177 case SF_ERR_PRXCOND:
1178 case SF_ERR_RESOURCE:
1179 case SF_ERR_INTERNAL:
1180 chk_report_conn_err(check, errno, 0);
1181 ret = TCPCHK_EVAL_STOP;
1182 goto out;
1183 }
1184
1185 /* don't do anything until the connection is established */
1186 if (conn->flags & CO_FL_WAIT_XPRT) {
1187 if (conn->mux) {
1188 if (next && next->action == TCPCHK_ACT_SEND)
1189 conn->mux->subscribe(cs, SUB_RETRY_SEND, &check->wait_list);
1190 else
1191 conn->mux->subscribe(cs, SUB_RETRY_RECV, &check->wait_list);
1192 }
1193 ret = TCPCHK_EVAL_WAIT;
1194 goto out;
1195 }
1196
1197 out:
1198 if (conn && check->result == CHK_RES_FAILED)
1199 conn->flags |= CO_FL_ERROR;
Christopher Fauletcc554532020-12-09 19:46:38 +01001200
1201 if (ret == TCPCHK_EVAL_CONTINUE && check->proxy->timeout.check)
1202 check->task->expire = tick_add_ifset(now_ms, check->proxy->timeout.check);
1203
Willy Tarreau51cd5952020-06-05 12:25:38 +02001204 return ret;
1205}
1206
1207/* Evaluates a TCPCHK_ACT_SEND rule. Returns TCPCHK_EVAL_WAIT if outgoing data
1208 * were not fully sent, TCPCHK_EVAL_CONTINUE to evaluate the next rule or
1209 * TCPCHK_EVAL_STOP if an error occurred.
1210 */
1211enum tcpcheck_eval_ret tcpcheck_eval_send(struct check *check, struct tcpcheck_rule *rule)
1212{
1213 enum tcpcheck_eval_ret ret = TCPCHK_EVAL_CONTINUE;
1214 struct tcpcheck_send *send = &rule->send;
1215 struct conn_stream *cs = check->cs;
1216 struct connection *conn = cs_conn(cs);
1217 struct buffer *tmp = NULL;
1218 struct htx *htx = NULL;
1219
Christopher Fauletb51e0372020-11-25 13:47:00 +01001220 if (check->state & CHK_ST_OUT_ALLOC) {
1221 ret = TCPCHK_EVAL_WAIT;
1222 goto out;
1223 }
1224
1225 if (!check_get_buf(check, &check->bo)) {
1226 check->state |= CHK_ST_OUT_ALLOC;
1227 ret = TCPCHK_EVAL_WAIT;
1228 goto out;
1229 }
1230
Christopher Faulet6f45f032020-11-25 13:34:51 +01001231 /* Data already pending in the output buffer, send them now */
1232 if (b_data(&check->bo))
1233 goto do_send;
1234
Christopher Fauletb51e0372020-11-25 13:47:00 +01001235 /* Always release input buffer when a new send is evaluated */
1236 check_release_buf(check, &check->bi);
Willy Tarreau51cd5952020-06-05 12:25:38 +02001237
1238 switch (send->type) {
1239 case TCPCHK_SEND_STRING:
1240 case TCPCHK_SEND_BINARY:
1241 if (istlen(send->data) >= b_size(&check->bo)) {
1242 chunk_printf(&trash, "tcp-check send : string too large (%u) for buffer size (%u) at step %d",
1243 (unsigned int)istlen(send->data), (unsigned int)b_size(&check->bo),
1244 tcpcheck_get_step_id(check, rule));
1245 set_server_check_status(check, HCHK_STATUS_L7RSP, trash.area);
1246 ret = TCPCHK_EVAL_STOP;
1247 goto out;
1248 }
1249 b_putist(&check->bo, send->data);
1250 break;
1251 case TCPCHK_SEND_STRING_LF:
1252 check->bo.data = sess_build_logline(check->sess, NULL, b_orig(&check->bo), b_size(&check->bo), &rule->send.fmt);
1253 if (!b_data(&check->bo))
1254 goto out;
1255 break;
1256 case TCPCHK_SEND_BINARY_LF: {
1257 int len = b_size(&check->bo);
1258
1259 tmp = alloc_trash_chunk();
1260 if (!tmp)
1261 goto error_lf;
1262 tmp->data = sess_build_logline(check->sess, NULL, b_orig(tmp), b_size(tmp), &rule->send.fmt);
1263 if (!b_data(tmp))
1264 goto out;
1265 tmp->area[tmp->data] = '\0';
1266 if (parse_binary(b_orig(tmp), &check->bo.area, &len, NULL) == 0)
1267 goto error_lf;
1268 check->bo.data = len;
1269 break;
1270 }
1271 case TCPCHK_SEND_HTTP: {
1272 struct htx_sl *sl;
1273 struct ist meth, uri, vsn, clen, body;
1274 unsigned int slflags = 0;
1275
1276 tmp = alloc_trash_chunk();
1277 if (!tmp)
1278 goto error_htx;
1279
1280 meth = ((send->http.meth.meth == HTTP_METH_OTHER)
1281 ? ist2(send->http.meth.str.area, send->http.meth.str.data)
1282 : http_known_methods[send->http.meth.meth]);
1283 if (send->http.flags & TCPCHK_SND_HTTP_FL_URI_FMT) {
1284 tmp->data = sess_build_logline(check->sess, NULL, b_orig(tmp), b_size(tmp), &send->http.uri_fmt);
1285 uri = (b_data(tmp) ? ist2(b_orig(tmp), b_data(tmp)) : ist("/"));
1286 }
1287 else
1288 uri = (isttest(send->http.uri) ? send->http.uri : ist("/"));
1289 vsn = (isttest(send->http.vsn) ? send->http.vsn : ist("HTTP/1.0"));
1290
1291 if ((istlen(vsn) == 6 && *(vsn.ptr+5) == '2') ||
1292 (istlen(vsn) == 8 && (*(vsn.ptr+5) > '1' || (*(vsn.ptr+5) == '1' && *(vsn.ptr+7) >= '1'))))
1293 slflags |= HTX_SL_F_VER_11;
1294 slflags |= (HTX_SL_F_XFER_LEN|HTX_SL_F_CLEN);
1295 if (!isttest(send->http.body))
1296 slflags |= HTX_SL_F_BODYLESS;
1297
1298 htx = htx_from_buf(&check->bo);
1299 sl = htx_add_stline(htx, HTX_BLK_REQ_SL, slflags, meth, uri, vsn);
1300 if (!sl)
1301 goto error_htx;
1302 sl->info.req.meth = send->http.meth.meth;
1303 if (!http_update_host(htx, sl, uri))
1304 goto error_htx;
1305
1306 if (!LIST_ISEMPTY(&send->http.hdrs)) {
1307 struct tcpcheck_http_hdr *hdr;
1308 struct ist hdr_value;
1309
1310 list_for_each_entry(hdr, &send->http.hdrs, list) {
1311 chunk_reset(tmp);
1312 tmp->data = sess_build_logline(check->sess, NULL, b_orig(tmp), b_size(tmp), &hdr->value);
1313 if (!b_data(tmp))
1314 continue;
1315 hdr_value = ist2(b_orig(tmp), b_data(tmp));
1316 if (!htx_add_header(htx, hdr->name, hdr_value))
1317 goto error_htx;
1318 if ((sl->flags & HTX_SL_F_HAS_AUTHORITY) && isteqi(hdr->name, ist("host"))) {
1319 if (!http_update_authority(htx, sl, hdr_value))
1320 goto error_htx;
1321 }
1322 }
1323
1324 }
1325 if (check->proxy->options2 & PR_O2_CHK_SNDST) {
1326 chunk_reset(tmp);
1327 httpchk_build_status_header(check->server, tmp);
1328 if (!htx_add_header(htx, ist("X-Haproxy-Server-State"), ist2(b_orig(tmp), b_data(tmp))))
1329 goto error_htx;
1330 }
1331
1332
1333 if (send->http.flags & TCPCHK_SND_HTTP_FL_BODY_FMT) {
1334 chunk_reset(tmp);
1335 tmp->data = sess_build_logline(check->sess, NULL, b_orig(tmp), b_size(tmp), &send->http.body_fmt);
1336 body = ist2(b_orig(tmp), b_data(tmp));
1337 }
1338 else
1339 body = send->http.body;
1340 clen = ist((!istlen(body) ? "0" : ultoa(istlen(body))));
1341
1342 if (!htx_add_header(htx, ist("Connection"), ist("close")) ||
1343 !htx_add_header(htx, ist("Content-length"), clen))
1344 goto error_htx;
1345
1346
1347 if (!htx_add_endof(htx, HTX_BLK_EOH) ||
Christopher Faulet810df062020-07-22 16:20:34 +02001348 (istlen(body) && !htx_add_data_atonce(htx, body)))
1349 goto error_htx;
1350
1351 htx->flags |= HTX_FL_EOI; /* no more data are expected. Only EOM remains to add now */
1352 if (!htx_add_endof(htx, HTX_BLK_EOM))
Willy Tarreau51cd5952020-06-05 12:25:38 +02001353 goto error_htx;
1354
1355 htx_to_buf(htx, &check->bo);
1356 break;
1357 }
1358 case TCPCHK_SEND_UNDEF:
1359 /* Should never happen. */
1360 ret = TCPCHK_EVAL_STOP;
1361 goto out;
1362 };
1363
Christopher Faulet6f45f032020-11-25 13:34:51 +01001364 do_send:
Willy Tarreau51cd5952020-06-05 12:25:38 +02001365 if (conn->mux->snd_buf(cs, &check->bo,
1366 (IS_HTX_CONN(conn) ? (htxbuf(&check->bo))->data: b_data(&check->bo)), 0) <= 0) {
1367 if ((conn->flags & CO_FL_ERROR) || (cs->flags & CS_FL_ERROR)) {
1368 ret = TCPCHK_EVAL_STOP;
1369 goto out;
1370 }
1371 }
1372 if ((IS_HTX_CONN(conn) && !htx_is_empty(htxbuf(&check->bo))) || b_data(&check->bo)) {
1373 cs->conn->mux->subscribe(cs, SUB_RETRY_SEND, &check->wait_list);
1374 ret = TCPCHK_EVAL_WAIT;
1375 goto out;
1376 }
1377
1378 out:
1379 free_trash_chunk(tmp);
Christopher Fauletb51e0372020-11-25 13:47:00 +01001380 if (!b_data(&check->bo) || ret == TCPCHK_EVAL_STOP)
1381 check_release_buf(check, &check->bo);
Willy Tarreau51cd5952020-06-05 12:25:38 +02001382 return ret;
1383
1384 error_htx:
1385 if (htx) {
1386 htx_reset(htx);
1387 htx_to_buf(htx, &check->bo);
1388 }
1389 chunk_printf(&trash, "tcp-check send : failed to build HTTP request at step %d",
1390 tcpcheck_get_step_id(check, rule));
1391 set_server_check_status(check, HCHK_STATUS_L7RSP, trash.area);
1392 ret = TCPCHK_EVAL_STOP;
1393 goto out;
1394
1395 error_lf:
1396 chunk_printf(&trash, "tcp-check send : failed to build log-format string at step %d",
1397 tcpcheck_get_step_id(check, rule));
1398 set_server_check_status(check, HCHK_STATUS_L7RSP, trash.area);
1399 ret = TCPCHK_EVAL_STOP;
1400 goto out;
1401
1402}
1403
1404/* Try to receive data before evaluating a tcp-check expect rule. Returns
1405 * TCPCHK_EVAL_WAIT if it is already subscribed on receive events or if nothing
1406 * was received, TCPCHK_EVAL_CONTINUE to evaluate the expect rule or
1407 * TCPCHK_EVAL_STOP if an error occurred.
1408 */
1409enum tcpcheck_eval_ret tcpcheck_eval_recv(struct check *check, struct tcpcheck_rule *rule)
1410{
1411 struct conn_stream *cs = check->cs;
1412 struct connection *conn = cs_conn(cs);
1413 enum tcpcheck_eval_ret ret = TCPCHK_EVAL_CONTINUE;
1414 size_t max, read, cur_read = 0;
1415 int is_empty;
1416 int read_poll = MAX_READ_POLL_LOOPS;
1417
1418 if (check->wait_list.events & SUB_RETRY_RECV)
1419 goto wait_more_data;
1420
1421 if (cs->flags & CS_FL_EOS)
1422 goto end_recv;
1423
Christopher Fauletb51e0372020-11-25 13:47:00 +01001424 if (check->state & CHK_ST_IN_ALLOC)
1425 goto wait_more_data;
1426
1427 if (!check_get_buf(check, &check->bi)) {
1428 check->state |= CHK_ST_IN_ALLOC;
1429 goto wait_more_data;
1430 }
1431
Willy Tarreau51cd5952020-06-05 12:25:38 +02001432 /* errors on the connection and the conn-stream were already checked */
1433
1434 /* prepare to detect if the mux needs more room */
1435 cs->flags &= ~CS_FL_WANT_ROOM;
1436
1437 while ((cs->flags & CS_FL_RCV_MORE) ||
1438 (!(conn->flags & CO_FL_ERROR) && !(cs->flags & (CS_FL_ERROR|CS_FL_EOS)))) {
1439 max = (IS_HTX_CS(cs) ? htx_free_space(htxbuf(&check->bi)) : b_room(&check->bi));
1440 read = conn->mux->rcv_buf(cs, &check->bi, max, 0);
1441 cur_read += read;
1442 if (!read ||
1443 (cs->flags & CS_FL_WANT_ROOM) ||
1444 (--read_poll <= 0) ||
1445 (read < max && read >= global.tune.recv_enough))
1446 break;
1447 }
1448
1449 end_recv:
1450 is_empty = (IS_HTX_CS(cs) ? htx_is_empty(htxbuf(&check->bi)) : !b_data(&check->bi));
1451 if (is_empty && ((conn->flags & CO_FL_ERROR) || (cs->flags & CS_FL_ERROR))) {
1452 /* Report network errors only if we got no other data. Otherwise
1453 * we'll let the upper layers decide whether the response is OK
1454 * or not. It is very common that an RST sent by the server is
1455 * reported as an error just after the last data chunk.
1456 */
1457 goto stop;
1458 }
1459 if (!cur_read) {
1460 if (!(cs->flags & (CS_FL_WANT_ROOM|CS_FL_ERROR|CS_FL_EOS))) {
1461 conn->mux->subscribe(cs, SUB_RETRY_RECV, &check->wait_list);
1462 goto wait_more_data;
1463 }
1464 if (is_empty) {
1465 int status;
1466
1467 chunk_printf(&trash, "TCPCHK got an empty response at step %d",
1468 tcpcheck_get_step_id(check, rule));
1469 if (rule->comment)
1470 chunk_appendf(&trash, " comment: '%s'", rule->comment);
1471
1472 status = ((rule->expect.err_status != HCHK_STATUS_UNKNOWN) ? rule->expect.err_status : HCHK_STATUS_L7RSP);
1473 set_server_check_status(check, status, trash.area);
1474 goto stop;
1475 }
1476 }
1477
1478 out:
Christopher Fauletb51e0372020-11-25 13:47:00 +01001479 if (!b_data(&check->bi) || ret == TCPCHK_EVAL_STOP)
1480 check_release_buf(check, &check->bi);
Willy Tarreau51cd5952020-06-05 12:25:38 +02001481 return ret;
1482
1483 stop:
1484 ret = TCPCHK_EVAL_STOP;
1485 goto out;
1486
1487 wait_more_data:
1488 ret = TCPCHK_EVAL_WAIT;
1489 goto out;
1490}
1491
1492/* Evaluates an HTTP TCPCHK_ACT_EXPECT rule. If <last_read> is set , no more data
1493 * are expected. Returns TCPCHK_EVAL_WAIT to wait for more data,
1494 * TCPCHK_EVAL_CONTINUE to evaluate the next rule or TCPCHK_EVAL_STOP if an
1495 * error occurred.
1496 */
1497enum tcpcheck_eval_ret tcpcheck_eval_expect_http(struct check *check, struct tcpcheck_rule *rule, int last_read)
1498{
1499 struct htx *htx = htxbuf(&check->bi);
1500 struct htx_sl *sl;
1501 struct htx_blk *blk;
1502 enum tcpcheck_eval_ret ret = TCPCHK_EVAL_CONTINUE;
1503 struct tcpcheck_expect *expect = &rule->expect;
1504 struct buffer *msg = NULL, *tmp = NULL, *nbuf = NULL, *vbuf = NULL;
1505 enum healthcheck_status status = HCHK_STATUS_L7RSP;
1506 struct ist desc = IST_NULL;
1507 int i, match, inverse;
1508
Christopher Faulet18d98902020-12-09 19:45:07 +01001509 last_read |= (!htx_free_data_space(htx) || (htx_get_tail_type(htx) == HTX_BLK_EOM));
Willy Tarreau51cd5952020-06-05 12:25:38 +02001510
1511 if (htx->flags & HTX_FL_PARSING_ERROR) {
1512 status = HCHK_STATUS_L7RSP;
1513 goto error;
1514 }
1515
1516 if (htx_is_empty(htx)) {
1517 if (last_read) {
1518 status = HCHK_STATUS_L7RSP;
1519 goto error;
1520 }
1521 goto wait_more_data;
1522 }
1523
1524 sl = http_get_stline(htx);
1525 check->code = sl->info.res.status;
1526
1527 if (check->server &&
1528 (check->server->proxy->options & PR_O_DISABLE404) &&
1529 (check->server->next_state != SRV_ST_STOPPED) &&
1530 (check->code == 404)) {
1531 /* 404 may be accepted as "stopping" only if the server was up */
1532 goto out;
1533 }
1534
1535 inverse = !!(expect->flags & TCPCHK_EXPT_FL_INV);
1536 /* Make GCC happy ; initialize match to a failure state. */
1537 match = inverse;
1538 status = expect->err_status;
1539
1540 switch (expect->type) {
1541 case TCPCHK_EXPECT_HTTP_STATUS:
1542 match = 0;
1543 for (i = 0; i < expect->codes.num; i++) {
1544 if (sl->info.res.status >= expect->codes.codes[i][0] &&
1545 sl->info.res.status <= expect->codes.codes[i][1]) {
1546 match = 1;
1547 break;
1548 }
1549 }
1550
1551 /* Set status and description in case of error */
1552 status = ((status != HCHK_STATUS_UNKNOWN) ? status : HCHK_STATUS_L7STS);
1553 if (LIST_ISEMPTY(&expect->onerror_fmt))
1554 desc = htx_sl_res_reason(sl);
1555 break;
1556 case TCPCHK_EXPECT_HTTP_STATUS_REGEX:
1557 match = regex_exec2(expect->regex, HTX_SL_RES_CPTR(sl), HTX_SL_RES_CLEN(sl));
1558
1559 /* Set status and description in case of error */
1560 status = ((status != HCHK_STATUS_UNKNOWN) ? status : HCHK_STATUS_L7STS);
1561 if (LIST_ISEMPTY(&expect->onerror_fmt))
1562 desc = htx_sl_res_reason(sl);
1563 break;
1564
1565 case TCPCHK_EXPECT_HTTP_HEADER: {
1566 struct http_hdr_ctx ctx;
1567 struct ist npat, vpat, value;
1568 int full = (expect->flags & (TCPCHK_EXPT_FL_HTTP_HVAL_NONE|TCPCHK_EXPT_FL_HTTP_HVAL_FULL));
1569
1570 if (expect->flags & TCPCHK_EXPT_FL_HTTP_HNAME_FMT) {
1571 nbuf = alloc_trash_chunk();
1572 if (!nbuf) {
1573 status = HCHK_STATUS_L7RSP;
1574 desc = ist("Failed to allocate buffer to eval log-format string");
1575 goto error;
1576 }
1577 nbuf->data = sess_build_logline(check->sess, NULL, b_orig(nbuf), b_size(nbuf), &expect->hdr.name_fmt);
1578 if (!b_data(nbuf)) {
1579 status = HCHK_STATUS_L7RSP;
1580 desc = ist("log-format string evaluated to an empty string");
1581 goto error;
1582 }
1583 npat = ist2(b_orig(nbuf), b_data(nbuf));
1584 }
1585 else if (!(expect->flags & TCPCHK_EXPT_FL_HTTP_HNAME_REG))
1586 npat = expect->hdr.name;
1587
1588 if (expect->flags & TCPCHK_EXPT_FL_HTTP_HVAL_FMT) {
1589 vbuf = alloc_trash_chunk();
1590 if (!vbuf) {
1591 status = HCHK_STATUS_L7RSP;
1592 desc = ist("Failed to allocate buffer to eval log-format string");
1593 goto error;
1594 }
1595 vbuf->data = sess_build_logline(check->sess, NULL, b_orig(vbuf), b_size(vbuf), &expect->hdr.value_fmt);
1596 if (!b_data(vbuf)) {
1597 status = HCHK_STATUS_L7RSP;
1598 desc = ist("log-format string evaluated to an empty string");
1599 goto error;
1600 }
1601 vpat = ist2(b_orig(vbuf), b_data(vbuf));
1602 }
1603 else if (!(expect->flags & TCPCHK_EXPT_FL_HTTP_HVAL_REG))
1604 vpat = expect->hdr.value;
1605
1606 match = 0;
1607 ctx.blk = NULL;
1608 while (1) {
1609 switch (expect->flags & TCPCHK_EXPT_FL_HTTP_HNAME_TYPE) {
1610 case TCPCHK_EXPT_FL_HTTP_HNAME_STR:
1611 if (!http_find_str_header(htx, npat, &ctx, full))
1612 goto end_of_match;
1613 break;
1614 case TCPCHK_EXPT_FL_HTTP_HNAME_BEG:
1615 if (!http_find_pfx_header(htx, npat, &ctx, full))
1616 goto end_of_match;
1617 break;
1618 case TCPCHK_EXPT_FL_HTTP_HNAME_END:
1619 if (!http_find_sfx_header(htx, npat, &ctx, full))
1620 goto end_of_match;
1621 break;
1622 case TCPCHK_EXPT_FL_HTTP_HNAME_SUB:
1623 if (!http_find_sub_header(htx, npat, &ctx, full))
1624 goto end_of_match;
1625 break;
1626 case TCPCHK_EXPT_FL_HTTP_HNAME_REG:
1627 if (!http_match_header(htx, expect->hdr.name_re, &ctx, full))
1628 goto end_of_match;
1629 break;
1630 default:
1631 /* should never happen */
1632 goto end_of_match;
1633 }
1634
1635 /* A header has matched the name pattern, let's test its
1636 * value now (always defined from there). If there is no
1637 * value pattern, it is a good match.
1638 */
1639
1640 if (expect->flags & TCPCHK_EXPT_FL_HTTP_HVAL_NONE) {
1641 match = 1;
1642 goto end_of_match;
1643 }
1644
1645 value = ctx.value;
1646 switch (expect->flags & TCPCHK_EXPT_FL_HTTP_HVAL_TYPE) {
1647 case TCPCHK_EXPT_FL_HTTP_HVAL_STR:
1648 if (isteq(value, vpat)) {
1649 match = 1;
1650 goto end_of_match;
1651 }
1652 break;
1653 case TCPCHK_EXPT_FL_HTTP_HVAL_BEG:
1654 if (istlen(value) < istlen(vpat))
1655 break;
1656 value = ist2(istptr(value), istlen(vpat));
1657 if (isteq(value, vpat)) {
1658 match = 1;
1659 goto end_of_match;
1660 }
1661 break;
1662 case TCPCHK_EXPT_FL_HTTP_HVAL_END:
1663 if (istlen(value) < istlen(vpat))
1664 break;
1665 value = ist2(istptr(value) + istlen(value) - istlen(vpat), istlen(vpat));
1666 if (isteq(value, vpat)) {
1667 match = 1;
1668 goto end_of_match;
1669 }
1670 break;
1671 case TCPCHK_EXPT_FL_HTTP_HVAL_SUB:
1672 if (isttest(istist(value, vpat))) {
1673 match = 1;
1674 goto end_of_match;
1675 }
1676 break;
1677 case TCPCHK_EXPT_FL_HTTP_HVAL_REG:
1678 if (regex_exec2(expect->hdr.value_re, istptr(value), istlen(value))) {
1679 match = 1;
1680 goto end_of_match;
1681 }
1682 break;
1683 }
1684 }
1685
1686 end_of_match:
1687 status = ((status != HCHK_STATUS_UNKNOWN) ? status : HCHK_STATUS_L7STS);
1688 if (LIST_ISEMPTY(&expect->onerror_fmt))
1689 desc = htx_sl_res_reason(sl);
1690 break;
1691 }
1692
1693 case TCPCHK_EXPECT_HTTP_BODY:
1694 case TCPCHK_EXPECT_HTTP_BODY_REGEX:
1695 case TCPCHK_EXPECT_HTTP_BODY_LF:
1696 match = 0;
1697 chunk_reset(&trash);
1698 for (blk = htx_get_head_blk(htx); blk; blk = htx_get_next_blk(htx, blk)) {
1699 enum htx_blk_type type = htx_get_blk_type(blk);
1700
1701 if (type == HTX_BLK_EOM || type == HTX_BLK_TLR || type == HTX_BLK_EOT)
1702 break;
1703 if (type == HTX_BLK_DATA) {
1704 if (!chunk_istcat(&trash, htx_get_blk_value(htx, blk)))
1705 break;
1706 }
1707 }
1708
1709 if (!b_data(&trash)) {
1710 if (!last_read)
1711 goto wait_more_data;
1712 status = ((status != HCHK_STATUS_UNKNOWN) ? status : HCHK_STATUS_L7RSP);
1713 if (LIST_ISEMPTY(&expect->onerror_fmt))
1714 desc = ist("HTTP content check could not find a response body");
1715 goto error;
1716 }
1717
1718 if (expect->type == TCPCHK_EXPECT_HTTP_BODY_LF) {
1719 tmp = alloc_trash_chunk();
1720 if (!tmp) {
1721 status = HCHK_STATUS_L7RSP;
1722 desc = ist("Failed to allocate buffer to eval log-format string");
1723 goto error;
1724 }
1725 tmp->data = sess_build_logline(check->sess, NULL, b_orig(tmp), b_size(tmp), &expect->fmt);
1726 if (!b_data(tmp)) {
1727 status = HCHK_STATUS_L7RSP;
1728 desc = ist("log-format string evaluated to an empty string");
1729 goto error;
1730 }
1731 }
1732
1733 if (!last_read &&
1734 ((expect->type == TCPCHK_EXPECT_HTTP_BODY && b_data(&trash) < istlen(expect->data)) ||
1735 ((expect->type == TCPCHK_EXPECT_HTTP_BODY_LF && b_data(&trash) < b_data(tmp))) ||
1736 (expect->min_recv > 0 && b_data(&trash) < expect->min_recv))) {
1737 ret = TCPCHK_EVAL_WAIT;
1738 goto out;
1739 }
1740
1741 if (expect->type ==TCPCHK_EXPECT_HTTP_BODY)
1742 match = my_memmem(b_orig(&trash), b_data(&trash), istptr(expect->data), istlen(expect->data)) != NULL;
1743 else if (expect->type ==TCPCHK_EXPECT_HTTP_BODY_LF)
1744 match = my_memmem(b_orig(&trash), b_data(&trash), b_orig(tmp), b_data(tmp)) != NULL;
1745 else
1746 match = regex_exec2(expect->regex, b_orig(&trash), b_data(&trash));
1747
Christopher Fauletac3b1552020-12-09 18:45:47 +01001748 /* Wait for more data on mismatch only if no minimum is defined (-1),
1749 * otherwise the absence of match is already conclusive.
1750 */
1751 if (!match && !last_read && (expect->min_recv == -1)) {
1752 ret = TCPCHK_EVAL_WAIT;
1753 goto out;
1754 }
1755
Willy Tarreau51cd5952020-06-05 12:25:38 +02001756 /* Set status and description in case of error */
1757 status = ((status != HCHK_STATUS_UNKNOWN) ? status : HCHK_STATUS_L7RSP);
1758 if (LIST_ISEMPTY(&expect->onerror_fmt))
1759 desc = (inverse
1760 ? ist("HTTP check matched unwanted content")
1761 : ist("HTTP content check did not match"));
1762 break;
1763
1764
1765 default:
1766 /* should never happen */
1767 status = ((status != HCHK_STATUS_UNKNOWN) ? status : HCHK_STATUS_L7RSP);
1768 goto error;
1769 }
1770
Willy Tarreau51cd5952020-06-05 12:25:38 +02001771 if (!(match ^ inverse))
1772 goto error;
1773
1774 out:
1775 free_trash_chunk(tmp);
1776 free_trash_chunk(nbuf);
1777 free_trash_chunk(vbuf);
1778 free_trash_chunk(msg);
1779 return ret;
1780
1781 error:
1782 ret = TCPCHK_EVAL_STOP;
1783 msg = alloc_trash_chunk();
1784 if (msg)
1785 tcpcheck_expect_onerror_message(msg, check, rule, 0, desc);
1786 set_server_check_status(check, status, (msg ? b_head(msg) : NULL));
1787 goto out;
1788
1789 wait_more_data:
1790 ret = TCPCHK_EVAL_WAIT;
1791 goto out;
1792}
1793
1794/* Evaluates a TCP TCPCHK_ACT_EXPECT rule. Returns TCPCHK_EVAL_WAIT to wait for
1795 * more data, TCPCHK_EVAL_CONTINUE to evaluate the next rule or TCPCHK_EVAL_STOP
1796 * if an error occurred.
1797 */
1798enum tcpcheck_eval_ret tcpcheck_eval_expect(struct check *check, struct tcpcheck_rule *rule, int last_read)
1799{
1800 enum tcpcheck_eval_ret ret = TCPCHK_EVAL_CONTINUE;
1801 struct tcpcheck_expect *expect = &rule->expect;
1802 struct buffer *msg = NULL, *tmp = NULL;
1803 struct ist desc = IST_NULL;
1804 enum healthcheck_status status;
1805 int match, inverse;
1806
1807 last_read |= b_full(&check->bi);
1808
1809 /* The current expect might need more data than the previous one, check again
1810 * that the minimum amount data required to match is respected.
1811 */
1812 if (!last_read) {
1813 if ((expect->type == TCPCHK_EXPECT_STRING || expect->type == TCPCHK_EXPECT_BINARY) &&
1814 (b_data(&check->bi) < istlen(expect->data))) {
1815 ret = TCPCHK_EVAL_WAIT;
1816 goto out;
1817 }
1818 if (expect->min_recv > 0 && (b_data(&check->bi) < expect->min_recv)) {
1819 ret = TCPCHK_EVAL_WAIT;
1820 goto out;
1821 }
1822 }
1823
1824 inverse = !!(expect->flags & TCPCHK_EXPT_FL_INV);
1825 /* Make GCC happy ; initialize match to a failure state. */
1826 match = inverse;
1827 status = ((expect->err_status != HCHK_STATUS_UNKNOWN) ? expect->err_status : HCHK_STATUS_L7RSP);
1828
1829 switch (expect->type) {
1830 case TCPCHK_EXPECT_STRING:
1831 case TCPCHK_EXPECT_BINARY:
1832 match = my_memmem(b_head(&check->bi), b_data(&check->bi), istptr(expect->data), istlen(expect->data)) != NULL;
1833 break;
1834 case TCPCHK_EXPECT_STRING_REGEX:
1835 match = regex_exec2(expect->regex, b_head(&check->bi), MIN(b_data(&check->bi), b_size(&check->bi)-1));
1836 break;
1837
1838 case TCPCHK_EXPECT_BINARY_REGEX:
1839 chunk_reset(&trash);
1840 dump_binary(&trash, b_head(&check->bi), b_data(&check->bi));
1841 match = regex_exec2(expect->regex, b_head(&trash), MIN(b_data(&trash), b_size(&trash)-1));
1842 break;
1843
1844 case TCPCHK_EXPECT_STRING_LF:
1845 case TCPCHK_EXPECT_BINARY_LF:
1846 match = 0;
1847 tmp = alloc_trash_chunk();
1848 if (!tmp) {
1849 status = HCHK_STATUS_L7RSP;
1850 desc = ist("Failed to allocate buffer to eval format string");
1851 goto error;
1852 }
1853 tmp->data = sess_build_logline(check->sess, NULL, b_orig(tmp), b_size(tmp), &expect->fmt);
1854 if (!b_data(tmp)) {
1855 status = HCHK_STATUS_L7RSP;
1856 desc = ist("log-format string evaluated to an empty string");
1857 goto error;
1858 }
1859 if (expect->type == TCPCHK_EXPECT_BINARY_LF) {
1860 int len = tmp->data;
1861 if (parse_binary(b_orig(tmp), &tmp->area, &len, NULL) == 0) {
1862 status = HCHK_STATUS_L7RSP;
1863 desc = ist("Failed to parse hexastring resulting of eval of a log-format string");
1864 goto error;
1865 }
1866 tmp->data = len;
1867 }
1868 if (b_data(&check->bi) < tmp->data) {
1869 if (!last_read) {
1870 ret = TCPCHK_EVAL_WAIT;
1871 goto out;
1872 }
1873 break;
1874 }
1875 match = my_memmem(b_head(&check->bi), b_data(&check->bi), b_orig(tmp), b_data(tmp)) != NULL;
1876 break;
1877
1878 case TCPCHK_EXPECT_CUSTOM:
1879 if (expect->custom)
1880 ret = expect->custom(check, rule, last_read);
1881 goto out;
1882 default:
1883 /* Should never happen. */
1884 ret = TCPCHK_EVAL_STOP;
1885 goto out;
1886 }
1887
1888
1889 /* Wait for more data on mismatch only if no minimum is defined (-1),
1890 * otherwise the absence of match is already conclusive.
1891 */
1892 if (!match && !last_read && (expect->min_recv == -1)) {
1893 ret = TCPCHK_EVAL_WAIT;
1894 goto out;
1895 }
1896
1897 /* Result as expected, next rule. */
1898 if (match ^ inverse)
1899 goto out;
1900
1901 error:
1902 /* From this point on, we matched something we did not want, this is an error state. */
1903 ret = TCPCHK_EVAL_STOP;
1904 msg = alloc_trash_chunk();
1905 if (msg)
1906 tcpcheck_expect_onerror_message(msg, check, rule, match, desc);
1907 set_server_check_status(check, status, (msg ? b_head(msg) : NULL));
1908 free_trash_chunk(msg);
1909
1910 out:
1911 free_trash_chunk(tmp);
1912 return ret;
1913}
1914
1915/* Evaluates a TCPCHK_ACT_ACTION_KW rule. Returns TCPCHK_EVAL_CONTINUE to
1916 * evaluate the next rule or TCPCHK_EVAL_STOP if an error occurred. It never
1917 * waits.
1918 */
1919enum tcpcheck_eval_ret tcpcheck_eval_action_kw(struct check *check, struct tcpcheck_rule *rule)
1920{
1921 enum tcpcheck_eval_ret ret = TCPCHK_EVAL_CONTINUE;
1922 struct act_rule *act_rule;
1923 enum act_return act_ret;
1924
1925 act_rule =rule->action_kw.rule;
1926 act_ret = act_rule->action_ptr(act_rule, check->proxy, check->sess, NULL, 0);
1927 if (act_ret != ACT_RET_CONT) {
1928 chunk_printf(&trash, "TCPCHK ACTION unexpected result at step %d\n",
1929 tcpcheck_get_step_id(check, rule));
1930 set_server_check_status(check, HCHK_STATUS_L7RSP, trash.area);
1931 ret = TCPCHK_EVAL_STOP;
1932 }
1933
1934 return ret;
1935}
1936
1937/* Executes a tcp-check ruleset. Note that this is called both from the
1938 * connection's wake() callback and from the check scheduling task. It returns
1939 * 0 on normal cases, or <0 if a close() has happened on an existing connection,
1940 * presenting the risk of an fd replacement.
1941 *
1942 * Please do NOT place any return statement in this function and only leave
1943 * via the out_end_tcpcheck label after setting retcode.
1944 */
1945int tcpcheck_main(struct check *check)
1946{
1947 struct tcpcheck_rule *rule;
1948 struct conn_stream *cs = check->cs;
1949 struct connection *conn = cs_conn(cs);
1950 int must_read = 1, last_read = 0;
Christopher Faulet6f45f032020-11-25 13:34:51 +01001951 int retcode = 0;
Willy Tarreau51cd5952020-06-05 12:25:38 +02001952 enum tcpcheck_eval_ret eval_ret;
1953
1954 /* here, we know that the check is complete or that it failed */
1955 if (check->result != CHK_RES_UNKNOWN)
1956 goto out;
1957
1958 /* Note: the conn-stream and the connection may only be undefined before
1959 * the first rule evaluation (it is always a connect rule) or when the
1960 * conn-stream allocation failed on the first connect.
1961 */
1962
1963 /* 1- check for connection error, if any */
1964 if ((conn && conn->flags & CO_FL_ERROR) || (cs && cs->flags & CS_FL_ERROR))
1965 goto out_end_tcpcheck;
1966
1967 /* 2- check if we are waiting for the connection establishment. It only
1968 * happens during TCPCHK_ACT_CONNECT. */
1969 if (check->current_step && check->current_step->action == TCPCHK_ACT_CONNECT) {
Christopher Faulet444b7b12021-01-18 15:47:03 +01001970 if (!cs)
1971 rule = check->current_step;
1972 else if (cs && (check->state & CHK_ST_CLOSE_CONN)) {
1973 /* We are still waiting the connection gets closed */
1974 goto out;
1975 }
1976 else {
1977 if (conn->flags & CO_FL_WAIT_XPRT) {
1978 struct tcpcheck_rule *next;
Willy Tarreau51cd5952020-06-05 12:25:38 +02001979
Christopher Faulet444b7b12021-01-18 15:47:03 +01001980 next = get_next_tcpcheck_rule(check->tcpcheck_rules, check->current_step);
1981 if (next && next->action == TCPCHK_ACT_SEND) {
1982 if (!(check->wait_list.events & SUB_RETRY_SEND))
1983 conn->mux->subscribe(cs, SUB_RETRY_SEND, &check->wait_list);
Willy Tarreau51cd5952020-06-05 12:25:38 +02001984 goto out;
Christopher Faulet444b7b12021-01-18 15:47:03 +01001985 }
1986 else {
1987 eval_ret = tcpcheck_eval_recv(check, check->current_step);
1988 if (eval_ret == TCPCHK_EVAL_STOP)
1989 goto out_end_tcpcheck;
1990 else if (eval_ret == TCPCHK_EVAL_WAIT)
1991 goto out;
1992 last_read = ((conn->flags & CO_FL_ERROR) || (cs->flags & (CS_FL_ERROR|CS_FL_EOS)));
1993 must_read = 0;
1994 }
Willy Tarreau51cd5952020-06-05 12:25:38 +02001995 }
Christopher Fauletcc554532020-12-09 19:46:38 +01001996
Christopher Faulet444b7b12021-01-18 15:47:03 +01001997 if (check->proxy->timeout.check)
1998 check->task->expire = tick_add_ifset(now_ms, check->proxy->timeout.check);
Christopher Fauletcc554532020-12-09 19:46:38 +01001999
Christopher Faulet444b7b12021-01-18 15:47:03 +01002000 rule = LIST_NEXT(&check->current_step->list, typeof(rule), list);
2001 }
Willy Tarreau51cd5952020-06-05 12:25:38 +02002002 }
2003
Christopher Faulet6f45f032020-11-25 13:34:51 +01002004 /* 3- check if a rule must be resume. It happens if check->current_step
Willy Tarreau51cd5952020-06-05 12:25:38 +02002005 * is defined. */
2006 else if (check->current_step)
2007 rule = check->current_step;
2008
Christopher Faulet6f45f032020-11-25 13:34:51 +01002009 /* 4- It is the first evaluation. We must create a session and preset
Willy Tarreau51cd5952020-06-05 12:25:38 +02002010 * tcp-check variables */
2011 else {
2012 struct tcpcheck_var *var;
2013
2014 /* First evaluation, create a session */
2015 check->sess = session_new(&checks_fe, NULL, &check->obj_type);
2016 if (!check->sess) {
2017 chunk_printf(&trash, "TCPCHK error allocating check session");
2018 set_server_check_status(check, HCHK_STATUS_SOCKERR, trash.area);
2019 goto out_end_tcpcheck;
2020 }
2021 vars_init(&check->vars, SCOPE_CHECK);
2022 rule = LIST_NEXT(check->tcpcheck_rules->list, typeof(rule), list);
2023
2024 /* Preset tcp-check variables */
2025 list_for_each_entry(var, &check->tcpcheck_rules->preset_vars, list) {
2026 struct sample smp;
2027
2028 memset(&smp, 0, sizeof(smp));
2029 smp_set_owner(&smp, check->proxy, check->sess, NULL, SMP_OPT_FINAL);
2030 smp.data = var->data;
2031 vars_set_by_name_ifexist(istptr(var->name), istlen(var->name), &smp);
2032 }
2033 }
2034
2035 /* Now evaluate the tcp-check rules */
2036
2037 list_for_each_entry_from(rule, check->tcpcheck_rules->list, list) {
2038 check->code = 0;
2039 switch (rule->action) {
2040 case TCPCHK_ACT_CONNECT:
Christopher Faulet444b7b12021-01-18 15:47:03 +01002041 /* Not the first connection, release it first */
2042 if (check->cs && check->current_step != rule) {
2043 check->state |= CHK_ST_CLOSE_CONN;
2044 retcode = -1;
2045 }
2046
Willy Tarreau51cd5952020-06-05 12:25:38 +02002047 check->current_step = rule;
2048
Christopher Faulet444b7b12021-01-18 15:47:03 +01002049 /* We are still waiting the connection gets closed */
2050 if (check->cs && (check->state & CHK_ST_CLOSE_CONN)) {
2051 eval_ret = TCPCHK_EVAL_WAIT;
2052 break;
Willy Tarreau51cd5952020-06-05 12:25:38 +02002053 }
Christopher Faulet444b7b12021-01-18 15:47:03 +01002054
Willy Tarreau51cd5952020-06-05 12:25:38 +02002055 eval_ret = tcpcheck_eval_connect(check, rule);
2056
2057 /* Refresh conn-stream and connection */
2058 cs = check->cs;
2059 conn = cs_conn(cs);
2060 must_read = 1; last_read = 0;
2061 break;
2062 case TCPCHK_ACT_SEND:
2063 check->current_step = rule;
2064 eval_ret = tcpcheck_eval_send(check, rule);
2065 must_read = 1;
2066 break;
2067 case TCPCHK_ACT_EXPECT:
2068 check->current_step = rule;
2069 if (must_read) {
Willy Tarreau51cd5952020-06-05 12:25:38 +02002070 eval_ret = tcpcheck_eval_recv(check, rule);
2071 if (eval_ret == TCPCHK_EVAL_STOP)
2072 goto out_end_tcpcheck;
2073 else if (eval_ret == TCPCHK_EVAL_WAIT)
2074 goto out;
2075 last_read = ((conn->flags & CO_FL_ERROR) || (cs->flags & (CS_FL_ERROR|CS_FL_EOS)));
2076 must_read = 0;
2077 }
2078
2079 eval_ret = ((check->tcpcheck_rules->flags & TCPCHK_RULES_PROTO_CHK) == TCPCHK_RULES_HTTP_CHK
2080 ? tcpcheck_eval_expect_http(check, rule, last_read)
2081 : tcpcheck_eval_expect(check, rule, last_read));
2082
2083 if (eval_ret == TCPCHK_EVAL_WAIT) {
2084 check->current_step = rule->expect.head;
2085 if (!(check->wait_list.events & SUB_RETRY_RECV))
2086 conn->mux->subscribe(cs, SUB_RETRY_RECV, &check->wait_list);
2087 }
2088 break;
2089 case TCPCHK_ACT_ACTION_KW:
2090 /* Don't update the current step */
2091 eval_ret = tcpcheck_eval_action_kw(check, rule);
2092 break;
2093 default:
2094 /* Otherwise, just go to the next one and don't update
2095 * the current step
2096 */
2097 eval_ret = TCPCHK_EVAL_CONTINUE;
2098 break;
2099 }
2100
2101 switch (eval_ret) {
2102 case TCPCHK_EVAL_CONTINUE:
2103 break;
2104 case TCPCHK_EVAL_WAIT:
2105 goto out;
2106 case TCPCHK_EVAL_STOP:
2107 goto out_end_tcpcheck;
2108 }
2109 }
2110
2111 /* All rules was evaluated */
2112 if (check->current_step) {
2113 rule = check->current_step;
2114
2115 if (rule->action == TCPCHK_ACT_EXPECT) {
2116 struct buffer *msg;
2117 enum healthcheck_status status;
2118
2119 if (check->server &&
2120 (check->server->proxy->options & PR_O_DISABLE404) &&
2121 (check->server->next_state != SRV_ST_STOPPED) &&
2122 (check->code == 404)) {
2123 set_server_check_status(check, HCHK_STATUS_L7OKCD, NULL);
2124 goto out_end_tcpcheck;
2125 }
2126
2127 msg = alloc_trash_chunk();
2128 if (msg)
2129 tcpcheck_expect_onsuccess_message(msg, check, rule, IST_NULL);
2130 status = ((rule->expect.ok_status != HCHK_STATUS_UNKNOWN) ? rule->expect.ok_status : HCHK_STATUS_L7OKD);
2131 set_server_check_status(check, status, (msg ? b_head(msg) : "(tcp-check)"));
2132 free_trash_chunk(msg);
2133 }
2134 else if (rule->action == TCPCHK_ACT_CONNECT) {
2135 const char *msg = ((rule->connect.options & TCPCHK_OPT_IMPLICIT) ? NULL : "(tcp-check)");
2136 enum healthcheck_status status = HCHK_STATUS_L4OK;
2137#ifdef USE_OPENSSL
2138 if (ssl_sock_is_ssl(conn))
2139 status = HCHK_STATUS_L6OK;
2140#endif
2141 set_server_check_status(check, status, msg);
2142 }
Christopher Fauletb4ae2472021-01-05 16:56:07 +01002143 else
2144 set_server_check_status(check, HCHK_STATUS_L7OKD, "(tcp-check)");
Willy Tarreau51cd5952020-06-05 12:25:38 +02002145 }
2146 else
2147 set_server_check_status(check, HCHK_STATUS_L7OKD, "(tcp-check)");
2148
2149 out_end_tcpcheck:
2150 if ((conn && conn->flags & CO_FL_ERROR) || (cs && cs->flags & CS_FL_ERROR))
2151 chk_report_conn_err(check, errno, 0);
2152
Christopher Fauletb51e0372020-11-25 13:47:00 +01002153 /* the tcpcheck is finished, release in/out buffer now */
2154 check_release_buf(check, &check->bi);
2155 check_release_buf(check, &check->bo);
2156
Willy Tarreau51cd5952020-06-05 12:25:38 +02002157 out:
2158 return retcode;
2159}
2160
2161
2162/**************************************************************************/
2163/******************* Internals to parse tcp-check rules *******************/
2164/**************************************************************************/
2165struct action_kw_list tcp_check_keywords = {
2166 .list = LIST_HEAD_INIT(tcp_check_keywords.list),
2167};
2168
2169/* Creates a tcp-check rule resulting from parsing a custom keyword. NULL is
2170 * returned on error.
2171 */
2172struct tcpcheck_rule *parse_tcpcheck_action(char **args, int cur_arg, struct proxy *px,
2173 struct list *rules, struct action_kw *kw,
2174 const char *file, int line, char **errmsg)
2175{
2176 struct tcpcheck_rule *chk = NULL;
2177 struct act_rule *actrule = NULL;
2178
2179 actrule = calloc(1, sizeof(*actrule));
2180 if (!actrule) {
2181 memprintf(errmsg, "out of memory");
2182 goto error;
2183 }
2184 actrule->kw = kw;
2185 actrule->from = ACT_F_TCP_CHK;
2186
2187 cur_arg++;
2188 if (kw->parse((const char **)args, &cur_arg, px, actrule, errmsg) == ACT_RET_PRS_ERR) {
2189 memprintf(errmsg, "'%s' : %s", kw->kw, *errmsg);
2190 goto error;
2191 }
2192
2193 chk = calloc(1, sizeof(*chk));
2194 if (!chk) {
2195 memprintf(errmsg, "out of memory");
2196 goto error;
2197 }
2198 chk->action = TCPCHK_ACT_ACTION_KW;
2199 chk->action_kw.rule = actrule;
2200 return chk;
2201
2202 error:
2203 free(actrule);
2204 return NULL;
2205}
2206
2207/* Parses and creates a tcp-check connect or an http-check connect rule. NULL is
2208 * returned on error.
2209 */
2210struct tcpcheck_rule *parse_tcpcheck_connect(char **args, int cur_arg, struct proxy *px, struct list *rules,
2211 const char *file, int line, char **errmsg)
2212{
2213 struct tcpcheck_rule *chk = NULL;
2214 struct sockaddr_storage *sk = NULL;
2215 char *comment = NULL, *sni = NULL, *alpn = NULL;
2216 struct sample_expr *port_expr = NULL;
2217 const struct mux_proto_list *mux_proto = NULL;
2218 unsigned short conn_opts = 0;
2219 long port = 0;
2220 int alpn_len = 0;
2221
2222 list_for_each_entry(chk, rules, list) {
2223 if (chk->action == TCPCHK_ACT_CONNECT)
2224 break;
2225 if (chk->action == TCPCHK_ACT_COMMENT ||
2226 chk->action == TCPCHK_ACT_ACTION_KW ||
2227 (chk->action == TCPCHK_ACT_SEND && (chk->send.http.flags & TCPCHK_SND_HTTP_FROM_OPT)))
2228 continue;
2229
2230 memprintf(errmsg, "first step MUST also be a 'connect', "
2231 "optionally preceded by a 'set-var', an 'unset-var' or a 'comment', "
2232 "when there is a 'connect' step in the tcp-check ruleset");
2233 goto error;
2234 }
2235
2236 cur_arg++;
2237 while (*(args[cur_arg])) {
2238 if (strcmp(args[cur_arg], "default") == 0)
2239 conn_opts |= TCPCHK_OPT_DEFAULT_CONNECT;
2240 else if (strcmp(args[cur_arg], "addr") == 0) {
2241 int port1, port2;
Willy Tarreau51cd5952020-06-05 12:25:38 +02002242
2243 if (!*(args[cur_arg+1])) {
2244 memprintf(errmsg, "'%s' expects <ipv4|ipv6> as argument.", args[cur_arg]);
2245 goto error;
2246 }
2247
Willy Tarreau65ec4e32020-09-16 19:17:08 +02002248 sk = str2sa_range(args[cur_arg+1], NULL, &port1, &port2, NULL, NULL,
2249 errmsg, NULL, NULL, PA_O_RESOLVE | PA_O_PORT_OK | PA_O_STREAM | PA_O_CONNECT);
Willy Tarreau51cd5952020-06-05 12:25:38 +02002250 if (!sk) {
2251 memprintf(errmsg, "'%s' : %s.", args[cur_arg], *errmsg);
2252 goto error;
2253 }
2254
Willy Tarreau51cd5952020-06-05 12:25:38 +02002255 cur_arg++;
2256 }
2257 else if (strcmp(args[cur_arg], "port") == 0) {
2258 const char *p, *end;
2259
2260 if (!*(args[cur_arg+1])) {
2261 memprintf(errmsg, "'%s' expects a port number or a sample expression as argument.", args[cur_arg]);
2262 goto error;
2263 }
2264 cur_arg++;
2265
2266 port = 0;
2267 release_sample_expr(port_expr);
2268 p = args[cur_arg]; end = p + strlen(p);
2269 port = read_uint(&p, end);
2270 if (p != end) {
2271 int idx = 0;
2272
2273 px->conf.args.ctx = ARGC_SRV;
2274 port_expr = sample_parse_expr((char *[]){args[cur_arg], NULL}, &idx,
2275 file, line, errmsg, &px->conf.args, NULL);
2276
2277 if (!port_expr) {
2278 memprintf(errmsg, "error detected while parsing port expression : %s", *errmsg);
2279 goto error;
2280 }
2281 if (!(port_expr->fetch->val & SMP_VAL_BE_CHK_RUL)) {
2282 memprintf(errmsg, "error detected while parsing port expression : "
2283 " fetch method '%s' extracts information from '%s', "
2284 "none of which is available here.\n",
2285 args[cur_arg], sample_src_names(port_expr->fetch->use));
2286 goto error;
2287 }
2288 px->http_needed |= !!(port_expr->fetch->use & SMP_USE_HTTP_ANY);
2289 }
2290 else if (port > 65535 || port < 1) {
2291 memprintf(errmsg, "expects a valid TCP port (from range 1 to 65535) or a sample expression, got %s.",
2292 args[cur_arg]);
2293 goto error;
2294 }
2295 }
2296 else if (strcmp(args[cur_arg], "proto") == 0) {
2297 if (!*(args[cur_arg+1])) {
2298 memprintf(errmsg, "'%s' expects a MUX protocol as argument.", args[cur_arg]);
2299 goto error;
2300 }
2301 mux_proto = get_mux_proto(ist2(args[cur_arg+1], strlen(args[cur_arg+1])));
2302 if (!mux_proto) {
2303 memprintf(errmsg, "'%s' : unknown MUX protocol '%s'.", args[cur_arg], args[cur_arg+1]);
2304 goto error;
2305 }
Amaury Denoyelle34ff9ac2020-11-13 12:34:58 +01002306
2307 if (strcmp(args[0], "tcp-check") == 0 && mux_proto->mode != PROTO_MODE_TCP) {
2308 memprintf(errmsg, "'%s' : invalid MUX protocol '%s' for tcp-check", args[cur_arg], args[cur_arg+1]);
2309 goto error;
2310 }
2311 else if (strcmp(args[0], "http-check") == 0 && mux_proto->mode != PROTO_MODE_HTTP) {
2312 memprintf(errmsg, "'%s' : invalid MUX protocol '%s' for http-check", args[cur_arg], args[cur_arg+1]);
2313 goto error;
2314 }
2315
Willy Tarreau51cd5952020-06-05 12:25:38 +02002316 cur_arg++;
2317 }
2318 else if (strcmp(args[cur_arg], "comment") == 0) {
2319 if (!*(args[cur_arg+1])) {
2320 memprintf(errmsg, "'%s' expects a string as argument.", args[cur_arg]);
2321 goto error;
2322 }
2323 cur_arg++;
2324 free(comment);
2325 comment = strdup(args[cur_arg]);
2326 if (!comment) {
2327 memprintf(errmsg, "out of memory");
2328 goto error;
2329 }
2330 }
2331 else if (strcmp(args[cur_arg], "send-proxy") == 0)
2332 conn_opts |= TCPCHK_OPT_SEND_PROXY;
2333 else if (strcmp(args[cur_arg], "via-socks4") == 0)
2334 conn_opts |= TCPCHK_OPT_SOCKS4;
2335 else if (strcmp(args[cur_arg], "linger") == 0)
2336 conn_opts |= TCPCHK_OPT_LINGER;
2337#ifdef USE_OPENSSL
2338 else if (strcmp(args[cur_arg], "ssl") == 0) {
2339 px->options |= PR_O_TCPCHK_SSL;
2340 conn_opts |= TCPCHK_OPT_SSL;
2341 }
2342 else if (strcmp(args[cur_arg], "sni") == 0) {
2343 if (!*(args[cur_arg+1])) {
2344 memprintf(errmsg, "'%s' expects a string as argument.", args[cur_arg]);
2345 goto error;
2346 }
2347 cur_arg++;
2348 free(sni);
2349 sni = strdup(args[cur_arg]);
2350 if (!sni) {
2351 memprintf(errmsg, "out of memory");
2352 goto error;
2353 }
2354 }
2355 else if (strcmp(args[cur_arg], "alpn") == 0) {
2356#ifdef TLSEXT_TYPE_application_layer_protocol_negotiation
2357 free(alpn);
2358 if (ssl_sock_parse_alpn(args[cur_arg + 1], &alpn, &alpn_len, errmsg)) {
2359 memprintf(errmsg, "'%s' : %s", args[cur_arg], *errmsg);
2360 goto error;
2361 }
2362 cur_arg++;
2363#else
2364 memprintf(errmsg, "'%s' : library does not support TLS ALPN extension.", args[cur_arg]);
2365 goto error;
2366#endif
2367 }
2368#endif /* USE_OPENSSL */
2369
2370 else {
2371 memprintf(errmsg, "expects 'comment', 'port', 'addr', 'send-proxy'"
2372#ifdef USE_OPENSSL
2373 ", 'ssl', 'sni', 'alpn'"
2374#endif /* USE_OPENSSL */
2375 " or 'via-socks4', 'linger', 'default' but got '%s' as argument.",
2376 args[cur_arg]);
2377 goto error;
2378 }
2379 cur_arg++;
2380 }
2381
2382 chk = calloc(1, sizeof(*chk));
2383 if (!chk) {
2384 memprintf(errmsg, "out of memory");
2385 goto error;
2386 }
2387 chk->action = TCPCHK_ACT_CONNECT;
2388 chk->comment = comment;
2389 chk->connect.port = port;
2390 chk->connect.options = conn_opts;
2391 chk->connect.sni = sni;
2392 chk->connect.alpn = alpn;
2393 chk->connect.alpn_len= alpn_len;
2394 chk->connect.port_expr= port_expr;
2395 chk->connect.mux_proto= mux_proto;
2396 if (sk)
2397 chk->connect.addr = *sk;
2398 return chk;
2399
2400 error:
2401 free(alpn);
2402 free(sni);
2403 free(comment);
2404 release_sample_expr(port_expr);
2405 return NULL;
2406}
2407
2408/* Parses and creates a tcp-check send rule. NULL is returned on error */
2409struct tcpcheck_rule *parse_tcpcheck_send(char **args, int cur_arg, struct proxy *px, struct list *rules,
2410 const char *file, int line, char **errmsg)
2411{
2412 struct tcpcheck_rule *chk = NULL;
2413 char *comment = NULL, *data = NULL;
2414 enum tcpcheck_send_type type = TCPCHK_SEND_UNDEF;
2415
2416 if (strcmp(args[cur_arg], "send-binary-lf") == 0)
2417 type = TCPCHK_SEND_BINARY_LF;
2418 else if (strcmp(args[cur_arg], "send-binary") == 0)
2419 type = TCPCHK_SEND_BINARY;
2420 else if (strcmp(args[cur_arg], "send-lf") == 0)
2421 type = TCPCHK_SEND_STRING_LF;
2422 else if (strcmp(args[cur_arg], "send") == 0)
2423 type = TCPCHK_SEND_STRING;
2424
2425 if (!*(args[cur_arg+1])) {
2426 memprintf(errmsg, "'%s' expects a %s as argument",
2427 (type == TCPCHK_SEND_BINARY ? "binary string": "string"), args[cur_arg]);
2428 goto error;
2429 }
2430
2431 data = args[cur_arg+1];
2432
2433 cur_arg += 2;
2434 while (*(args[cur_arg])) {
2435 if (strcmp(args[cur_arg], "comment") == 0) {
2436 if (!*(args[cur_arg+1])) {
2437 memprintf(errmsg, "'%s' expects a string as argument.", args[cur_arg]);
2438 goto error;
2439 }
2440 cur_arg++;
2441 free(comment);
2442 comment = strdup(args[cur_arg]);
2443 if (!comment) {
2444 memprintf(errmsg, "out of memory");
2445 goto error;
2446 }
2447 }
2448 else {
2449 memprintf(errmsg, "expects 'comment' but got '%s' as argument.",
2450 args[cur_arg]);
2451 goto error;
2452 }
2453 cur_arg++;
2454 }
2455
2456 chk = calloc(1, sizeof(*chk));
2457 if (!chk) {
2458 memprintf(errmsg, "out of memory");
2459 goto error;
2460 }
2461 chk->action = TCPCHK_ACT_SEND;
2462 chk->comment = comment;
2463 chk->send.type = type;
2464
2465 switch (chk->send.type) {
2466 case TCPCHK_SEND_STRING:
2467 chk->send.data = ist2(strdup(data), strlen(data));
2468 if (!isttest(chk->send.data)) {
2469 memprintf(errmsg, "out of memory");
2470 goto error;
2471 }
2472 break;
2473 case TCPCHK_SEND_BINARY: {
2474 int len = chk->send.data.len;
2475 if (parse_binary(data, &chk->send.data.ptr, &len, errmsg) == 0) {
2476 memprintf(errmsg, "'%s' invalid binary string (%s).\n", data, *errmsg);
2477 goto error;
2478 }
2479 chk->send.data.len = len;
2480 break;
2481 }
2482 case TCPCHK_SEND_STRING_LF:
2483 case TCPCHK_SEND_BINARY_LF:
2484 LIST_INIT(&chk->send.fmt);
2485 px->conf.args.ctx = ARGC_SRV;
2486 if (!parse_logformat_string(data, px, &chk->send.fmt, 0, SMP_VAL_BE_CHK_RUL, errmsg)) {
2487 memprintf(errmsg, "'%s' invalid log-format string (%s).\n", data, *errmsg);
2488 goto error;
2489 }
2490 break;
2491 case TCPCHK_SEND_HTTP:
2492 case TCPCHK_SEND_UNDEF:
2493 goto error;
2494 }
2495
2496 return chk;
2497
2498 error:
2499 free(chk);
2500 free(comment);
2501 return NULL;
2502}
2503
2504/* Parses and creates a http-check send rule. NULL is returned on error */
2505struct tcpcheck_rule *parse_tcpcheck_send_http(char **args, int cur_arg, struct proxy *px, struct list *rules,
2506 const char *file, int line, char **errmsg)
2507{
2508 struct tcpcheck_rule *chk = NULL;
2509 struct tcpcheck_http_hdr *hdr = NULL;
2510 struct http_hdr hdrs[global.tune.max_http_hdr];
2511 char *meth = NULL, *uri = NULL, *vsn = NULL;
2512 char *body = NULL, *comment = NULL;
2513 unsigned int flags = 0;
2514 int i = 0, host_hdr = -1;
2515
2516 cur_arg++;
2517 while (*(args[cur_arg])) {
2518 if (strcmp(args[cur_arg], "meth") == 0) {
2519 if (!*(args[cur_arg+1])) {
2520 memprintf(errmsg, "'%s' expects a string as argument.", args[cur_arg]);
2521 goto error;
2522 }
2523 cur_arg++;
2524 meth = args[cur_arg];
2525 }
2526 else if (strcmp(args[cur_arg], "uri") == 0 || strcmp(args[cur_arg], "uri-lf") == 0) {
2527 if (!*(args[cur_arg+1])) {
2528 memprintf(errmsg, "'%s' expects a string as argument.", args[cur_arg]);
2529 goto error;
2530 }
2531 flags &= ~TCPCHK_SND_HTTP_FL_URI_FMT;
2532 if (strcmp(args[cur_arg], "uri-lf") == 0)
2533 flags |= TCPCHK_SND_HTTP_FL_URI_FMT;
2534 cur_arg++;
2535 uri = args[cur_arg];
2536 }
2537 else if (strcmp(args[cur_arg], "ver") == 0) {
2538 if (!*(args[cur_arg+1])) {
2539 memprintf(errmsg, "'%s' expects a string as argument.", args[cur_arg]);
2540 goto error;
2541 }
2542 cur_arg++;
2543 vsn = args[cur_arg];
2544 }
2545 else if (strcmp(args[cur_arg], "hdr") == 0) {
2546 if (!*args[cur_arg+1] || !*args[cur_arg+2]) {
2547 memprintf(errmsg, "'%s' expects <name> and <value> as arguments", args[cur_arg]);
2548 goto error;
2549 }
2550
2551 if (strcasecmp(args[cur_arg+1], "host") == 0) {
2552 if (host_hdr >= 0) {
2553 memprintf(errmsg, "'%s' header already defined (previous value is '%s')",
2554 args[cur_arg+1], istptr(hdrs[host_hdr].v));
2555 goto error;
2556 }
2557 host_hdr = i;
2558 }
2559 else if (strcasecmp(args[cur_arg+1], "connection") == 0 ||
2560 strcasecmp(args[cur_arg+1], "content-length") == 0 ||
2561 strcasecmp(args[cur_arg+1], "transfer-encoding") == 0)
2562 goto skip_hdr;
2563
2564 hdrs[i].n = ist2(args[cur_arg+1], strlen(args[cur_arg+1]));
2565 hdrs[i].v = ist2(args[cur_arg+2], strlen(args[cur_arg+2]));
2566 i++;
2567 skip_hdr:
2568 cur_arg += 2;
2569 }
2570 else if (strcmp(args[cur_arg], "body") == 0 || strcmp(args[cur_arg], "body-lf") == 0) {
2571 if (!*(args[cur_arg+1])) {
2572 memprintf(errmsg, "'%s' expects a string as argument.", args[cur_arg]);
2573 goto error;
2574 }
2575 flags &= ~TCPCHK_SND_HTTP_FL_BODY_FMT;
2576 if (strcmp(args[cur_arg], "body-lf") == 0)
2577 flags |= TCPCHK_SND_HTTP_FL_BODY_FMT;
2578 cur_arg++;
2579 body = args[cur_arg];
2580 }
2581 else if (strcmp(args[cur_arg], "comment") == 0) {
2582 if (!*(args[cur_arg+1])) {
2583 memprintf(errmsg, "'%s' expects a string as argument.", args[cur_arg]);
2584 goto error;
2585 }
2586 cur_arg++;
2587 free(comment);
2588 comment = strdup(args[cur_arg]);
2589 if (!comment) {
2590 memprintf(errmsg, "out of memory");
2591 goto error;
2592 }
2593 }
2594 else {
2595 memprintf(errmsg, "expects 'comment', 'meth', 'uri', 'uri-lf', 'ver', 'hdr', 'body' or 'body-lf'"
2596 " but got '%s' as argument.", args[cur_arg]);
2597 goto error;
2598 }
2599 cur_arg++;
2600 }
2601
2602 hdrs[i].n = hdrs[i].v = IST_NULL;
2603
2604 chk = calloc(1, sizeof(*chk));
2605 if (!chk) {
2606 memprintf(errmsg, "out of memory");
2607 goto error;
2608 }
2609 chk->action = TCPCHK_ACT_SEND;
2610 chk->comment = comment; comment = NULL;
2611 chk->send.type = TCPCHK_SEND_HTTP;
2612 chk->send.http.flags = flags;
2613 LIST_INIT(&chk->send.http.hdrs);
2614
2615 if (meth) {
2616 chk->send.http.meth.meth = find_http_meth(meth, strlen(meth));
2617 chk->send.http.meth.str.area = strdup(meth);
2618 chk->send.http.meth.str.data = strlen(meth);
2619 if (!chk->send.http.meth.str.area) {
2620 memprintf(errmsg, "out of memory");
2621 goto error;
2622 }
2623 }
2624 if (uri) {
2625 if (chk->send.http.flags & TCPCHK_SND_HTTP_FL_URI_FMT) {
2626 LIST_INIT(&chk->send.http.uri_fmt);
2627 px->conf.args.ctx = ARGC_SRV;
2628 if (!parse_logformat_string(uri, px, &chk->send.http.uri_fmt, 0, SMP_VAL_BE_CHK_RUL, errmsg)) {
2629 memprintf(errmsg, "'%s' invalid log-format string (%s).\n", uri, *errmsg);
2630 goto error;
2631 }
2632 }
2633 else {
2634 chk->send.http.uri = ist2(strdup(uri), strlen(uri));
2635 if (!isttest(chk->send.http.uri)) {
2636 memprintf(errmsg, "out of memory");
2637 goto error;
2638 }
2639 }
2640 }
2641 if (vsn) {
2642 chk->send.http.vsn = ist2(strdup(vsn), strlen(vsn));
2643 if (!isttest(chk->send.http.vsn)) {
2644 memprintf(errmsg, "out of memory");
2645 goto error;
2646 }
2647 }
2648 for (i = 0; istlen(hdrs[i].n); i++) {
2649 hdr = calloc(1, sizeof(*hdr));
2650 if (!hdr) {
2651 memprintf(errmsg, "out of memory");
2652 goto error;
2653 }
2654 LIST_INIT(&hdr->value);
2655 hdr->name = istdup(hdrs[i].n);
2656 if (!isttest(hdr->name)) {
2657 memprintf(errmsg, "out of memory");
2658 goto error;
2659 }
2660
2661 ist0(hdrs[i].v);
2662 if (!parse_logformat_string(istptr(hdrs[i].v), px, &hdr->value, 0, SMP_VAL_BE_CHK_RUL, errmsg))
2663 goto error;
2664 LIST_ADDQ(&chk->send.http.hdrs, &hdr->list);
2665 hdr = NULL;
2666 }
2667
2668 if (body) {
2669 if (chk->send.http.flags & TCPCHK_SND_HTTP_FL_BODY_FMT) {
2670 LIST_INIT(&chk->send.http.body_fmt);
2671 px->conf.args.ctx = ARGC_SRV;
2672 if (!parse_logformat_string(body, px, &chk->send.http.body_fmt, 0, SMP_VAL_BE_CHK_RUL, errmsg)) {
2673 memprintf(errmsg, "'%s' invalid log-format string (%s).\n", body, *errmsg);
2674 goto error;
2675 }
2676 }
2677 else {
2678 chk->send.http.body = ist2(strdup(body), strlen(body));
2679 if (!isttest(chk->send.http.body)) {
2680 memprintf(errmsg, "out of memory");
2681 goto error;
2682 }
2683 }
2684 }
2685
2686 return chk;
2687
2688 error:
2689 free_tcpcheck_http_hdr(hdr);
2690 free_tcpcheck(chk, 0);
2691 free(comment);
2692 return NULL;
2693}
2694
2695/* Parses and creates a http-check comment rule. NULL is returned on error */
2696struct tcpcheck_rule *parse_tcpcheck_comment(char **args, int cur_arg, struct proxy *px, struct list *rules,
2697 const char *file, int line, char **errmsg)
2698{
2699 struct tcpcheck_rule *chk = NULL;
2700 char *comment = NULL;
2701
2702 if (!*(args[cur_arg+1])) {
2703 memprintf(errmsg, "expects a string as argument");
2704 goto error;
2705 }
2706 cur_arg++;
2707 comment = strdup(args[cur_arg]);
2708 if (!comment) {
2709 memprintf(errmsg, "out of memory");
2710 goto error;
2711 }
2712
2713 chk = calloc(1, sizeof(*chk));
2714 if (!chk) {
2715 memprintf(errmsg, "out of memory");
2716 goto error;
2717 }
2718 chk->action = TCPCHK_ACT_COMMENT;
2719 chk->comment = comment;
2720 return chk;
2721
2722 error:
2723 free(comment);
2724 return NULL;
2725}
2726
2727/* Parses and creates a tcp-check or an http-check expect rule. NULL is returned
2728 * on error. <proto> is set to the right protocol flags (covered by the
2729 * TCPCHK_RULES_PROTO_CHK mask).
2730 */
2731struct tcpcheck_rule *parse_tcpcheck_expect(char **args, int cur_arg, struct proxy *px,
2732 struct list *rules, unsigned int proto,
2733 const char *file, int line, char **errmsg)
2734{
2735 struct tcpcheck_rule *prev_check, *chk = NULL;
2736 struct sample_expr *status_expr = NULL;
2737 char *on_success_msg, *on_error_msg, *comment, *pattern, *npat, *vpat;
2738 enum tcpcheck_expect_type type = TCPCHK_EXPECT_UNDEF;
2739 enum healthcheck_status ok_st = HCHK_STATUS_UNKNOWN;
2740 enum healthcheck_status err_st = HCHK_STATUS_UNKNOWN;
2741 enum healthcheck_status tout_st = HCHK_STATUS_UNKNOWN;
2742 unsigned int flags = 0;
2743 long min_recv = -1;
2744 int inverse = 0;
2745
2746 on_success_msg = on_error_msg = comment = pattern = npat = vpat = NULL;
2747 if (!*(args[cur_arg+1])) {
2748 memprintf(errmsg, "expects at least a matching pattern as arguments");
2749 goto error;
2750 }
2751
2752 cur_arg++;
2753 while (*(args[cur_arg])) {
2754 int in_pattern = 0;
2755
2756 rescan:
2757 if (strcmp(args[cur_arg], "min-recv") == 0) {
2758 if (in_pattern) {
2759 memprintf(errmsg, "[!] not supported with '%s'", args[cur_arg]);
2760 goto error;
2761 }
2762 if (!*(args[cur_arg+1])) {
2763 memprintf(errmsg, "'%s' expects a integer as argument", args[cur_arg]);
2764 goto error;
2765 }
Christopher Faulet7151a122020-11-25 17:20:57 +01002766 /* Use an signed integer here because of bufsize */
Willy Tarreau51cd5952020-06-05 12:25:38 +02002767 cur_arg++;
2768 min_recv = atol(args[cur_arg]);
2769 if (min_recv < -1 || min_recv > INT_MAX) {
2770 memprintf(errmsg, "'%s' expects -1 or an integer from 0 to INT_MAX" , args[cur_arg-1]);
2771 goto error;
2772 }
2773 }
2774 else if (*(args[cur_arg]) == '!') {
2775 in_pattern = 1;
2776 while (*(args[cur_arg]) == '!') {
2777 inverse = !inverse;
2778 args[cur_arg]++;
2779 }
2780 if (!*(args[cur_arg]))
2781 cur_arg++;
2782 goto rescan;
2783 }
2784 else if (strcmp(args[cur_arg], "string") == 0 || strcmp(args[cur_arg], "rstring") == 0) {
2785 if (type != TCPCHK_EXPECT_UNDEF) {
2786 memprintf(errmsg, "only on pattern expected");
2787 goto error;
2788 }
2789 if (proto != TCPCHK_RULES_HTTP_CHK)
2790 type = ((*(args[cur_arg]) == 's') ? TCPCHK_EXPECT_STRING : TCPCHK_EXPECT_STRING_REGEX);
2791 else
2792 type = ((*(args[cur_arg]) == 's') ? TCPCHK_EXPECT_HTTP_BODY : TCPCHK_EXPECT_HTTP_BODY_REGEX);
2793
2794 if (!*(args[cur_arg+1])) {
2795 memprintf(errmsg, "'%s' expects a <pattern> as argument", args[cur_arg]);
2796 goto error;
2797 }
2798 cur_arg++;
2799 pattern = args[cur_arg];
2800 }
2801 else if (strcmp(args[cur_arg], "binary") == 0 || strcmp(args[cur_arg], "rbinary") == 0) {
2802 if (proto == TCPCHK_RULES_HTTP_CHK)
2803 goto bad_http_kw;
2804 if (type != TCPCHK_EXPECT_UNDEF) {
2805 memprintf(errmsg, "only on pattern expected");
2806 goto error;
2807 }
2808 type = ((*(args[cur_arg]) == 'b') ? TCPCHK_EXPECT_BINARY : TCPCHK_EXPECT_BINARY_REGEX);
2809
2810 if (!*(args[cur_arg+1])) {
2811 memprintf(errmsg, "'%s' expects a <pattern> as argument", args[cur_arg]);
2812 goto error;
2813 }
2814 cur_arg++;
2815 pattern = args[cur_arg];
2816 }
2817 else if (strcmp(args[cur_arg], "string-lf") == 0 || strcmp(args[cur_arg], "binary-lf") == 0) {
2818 if (type != TCPCHK_EXPECT_UNDEF) {
2819 memprintf(errmsg, "only on pattern expected");
2820 goto error;
2821 }
2822 if (proto != TCPCHK_RULES_HTTP_CHK)
2823 type = ((*(args[cur_arg]) == 's') ? TCPCHK_EXPECT_STRING_LF : TCPCHK_EXPECT_BINARY_LF);
2824 else {
2825 if (*(args[cur_arg]) != 's')
2826 goto bad_http_kw;
2827 type = TCPCHK_EXPECT_HTTP_BODY_LF;
2828 }
2829
2830 if (!*(args[cur_arg+1])) {
2831 memprintf(errmsg, "'%s' expects a <pattern> as argument", args[cur_arg]);
2832 goto error;
2833 }
2834 cur_arg++;
2835 pattern = args[cur_arg];
2836 }
2837 else if (strcmp(args[cur_arg], "status") == 0 || strcmp(args[cur_arg], "rstatus") == 0) {
2838 if (proto != TCPCHK_RULES_HTTP_CHK)
2839 goto bad_tcp_kw;
2840 if (type != TCPCHK_EXPECT_UNDEF) {
2841 memprintf(errmsg, "only on pattern expected");
2842 goto error;
2843 }
2844 type = ((*(args[cur_arg]) == 's') ? TCPCHK_EXPECT_HTTP_STATUS : TCPCHK_EXPECT_HTTP_STATUS_REGEX);
2845
2846 if (!*(args[cur_arg+1])) {
2847 memprintf(errmsg, "'%s' expects a <pattern> as argument", args[cur_arg]);
2848 goto error;
2849 }
2850 cur_arg++;
2851 pattern = args[cur_arg];
2852 }
2853 else if (strcmp(args[cur_arg], "custom") == 0) {
2854 if (in_pattern) {
2855 memprintf(errmsg, "[!] not supported with '%s'", args[cur_arg]);
2856 goto error;
2857 }
2858 if (type != TCPCHK_EXPECT_UNDEF) {
2859 memprintf(errmsg, "only on pattern expected");
2860 goto error;
2861 }
2862 type = TCPCHK_EXPECT_CUSTOM;
2863 }
2864 else if (strcmp(args[cur_arg], "hdr") == 0 || strcmp(args[cur_arg], "fhdr") == 0) {
2865 int orig_arg = cur_arg;
2866
2867 if (proto != TCPCHK_RULES_HTTP_CHK)
2868 goto bad_tcp_kw;
2869 if (type != TCPCHK_EXPECT_UNDEF) {
2870 memprintf(errmsg, "only on pattern expected");
2871 goto error;
2872 }
2873 type = TCPCHK_EXPECT_HTTP_HEADER;
2874
2875 if (strcmp(args[cur_arg], "fhdr") == 0)
2876 flags |= TCPCHK_EXPT_FL_HTTP_HVAL_FULL;
2877
2878 /* Parse the name pattern, mandatory */
2879 if (!*(args[cur_arg+1]) || !*(args[cur_arg+2]) ||
2880 (strcmp(args[cur_arg+1], "name") != 0 && strcmp(args[cur_arg+1], "name-lf") != 0)) {
2881 memprintf(errmsg, "'%s' expects at the name keyword as first argument followed by a pattern",
2882 args[orig_arg]);
2883 goto error;
2884 }
2885
2886 if (strcmp(args[cur_arg+1], "name-lf") == 0)
2887 flags |= TCPCHK_EXPT_FL_HTTP_HNAME_FMT;
2888
2889 cur_arg += 2;
2890 if (strcmp(args[cur_arg], "-m") == 0) {
2891 if (!*(args[cur_arg+1])) {
2892 memprintf(errmsg, "'%s' : '%s' expects at a matching pattern ('str', 'beg', 'end', 'sub' or 'reg')",
2893 args[orig_arg], args[cur_arg]);
2894 goto error;
2895 }
2896 if (strcmp(args[cur_arg+1], "str") == 0)
2897 flags |= TCPCHK_EXPT_FL_HTTP_HNAME_STR;
2898 else if (strcmp(args[cur_arg+1], "beg") == 0)
2899 flags |= TCPCHK_EXPT_FL_HTTP_HNAME_BEG;
2900 else if (strcmp(args[cur_arg+1], "end") == 0)
2901 flags |= TCPCHK_EXPT_FL_HTTP_HNAME_END;
2902 else if (strcmp(args[cur_arg+1], "sub") == 0)
2903 flags |= TCPCHK_EXPT_FL_HTTP_HNAME_SUB;
2904 else if (strcmp(args[cur_arg+1], "reg") == 0) {
2905 if (flags & TCPCHK_EXPT_FL_HTTP_HNAME_FMT) {
2906 memprintf(errmsg, "'%s': log-format string is not supported with a regex matching method",
2907 args[orig_arg]);
2908 goto error;
2909 }
2910 flags |= TCPCHK_EXPT_FL_HTTP_HNAME_REG;
2911 }
2912 else {
2913 memprintf(errmsg, "'%s' : '%s' only supports 'str', 'beg', 'end', 'sub' or 'reg' (got '%s')",
2914 args[orig_arg], args[cur_arg], args[cur_arg+1]);
2915 goto error;
2916 }
2917 cur_arg += 2;
2918 }
2919 else
2920 flags |= TCPCHK_EXPT_FL_HTTP_HNAME_STR;
2921 npat = args[cur_arg];
2922
2923 if (!*(args[cur_arg+1]) ||
2924 (strcmp(args[cur_arg+1], "value") != 0 && strcmp(args[cur_arg+1], "value-lf") != 0)) {
2925 flags |= TCPCHK_EXPT_FL_HTTP_HVAL_NONE;
2926 goto next;
2927 }
2928 if (strcmp(args[cur_arg+1], "value-lf") == 0)
2929 flags |= TCPCHK_EXPT_FL_HTTP_HVAL_FMT;
2930
2931 /* Parse the value pattern, optional */
2932 if (strcmp(args[cur_arg+2], "-m") == 0) {
2933 cur_arg += 2;
2934 if (!*(args[cur_arg+1])) {
2935 memprintf(errmsg, "'%s' : '%s' expects at a matching pattern ('str', 'beg', 'end', 'sub' or 'reg')",
2936 args[orig_arg], args[cur_arg]);
2937 goto error;
2938 }
2939 if (strcmp(args[cur_arg+1], "str") == 0)
2940 flags |= TCPCHK_EXPT_FL_HTTP_HVAL_STR;
2941 else if (strcmp(args[cur_arg+1], "beg") == 0)
2942 flags |= TCPCHK_EXPT_FL_HTTP_HVAL_BEG;
2943 else if (strcmp(args[cur_arg+1], "end") == 0)
2944 flags |= TCPCHK_EXPT_FL_HTTP_HVAL_END;
2945 else if (strcmp(args[cur_arg+1], "sub") == 0)
2946 flags |= TCPCHK_EXPT_FL_HTTP_HVAL_SUB;
2947 else if (strcmp(args[cur_arg+1], "reg") == 0) {
2948 if (flags & TCPCHK_EXPT_FL_HTTP_HVAL_FMT) {
2949 memprintf(errmsg, "'%s': log-format string is not supported with a regex matching method",
2950 args[orig_arg]);
2951 goto error;
2952 }
2953 flags |= TCPCHK_EXPT_FL_HTTP_HVAL_REG;
2954 }
2955 else {
2956 memprintf(errmsg, "'%s' : '%s' only supports 'str', 'beg', 'end', 'sub' or 'reg' (got '%s')",
2957 args[orig_arg], args[cur_arg], args[cur_arg+1]);
2958 goto error;
2959 }
2960 }
2961 else
2962 flags |= TCPCHK_EXPT_FL_HTTP_HVAL_STR;
2963
2964 if (!*(args[cur_arg+2])) {
2965 memprintf(errmsg, "'%s' expect a pattern with the value keyword", args[orig_arg]);
2966 goto error;
2967 }
2968 vpat = args[cur_arg+2];
2969 cur_arg += 2;
2970 }
2971 else if (strcmp(args[cur_arg], "comment") == 0) {
2972 if (in_pattern) {
2973 memprintf(errmsg, "[!] not supported with '%s'", args[cur_arg]);
2974 goto error;
2975 }
2976 if (!*(args[cur_arg+1])) {
2977 memprintf(errmsg, "'%s' expects a string as argument", args[cur_arg]);
2978 goto error;
2979 }
2980 cur_arg++;
2981 free(comment);
2982 comment = strdup(args[cur_arg]);
2983 if (!comment) {
2984 memprintf(errmsg, "out of memory");
2985 goto error;
2986 }
2987 }
2988 else if (strcmp(args[cur_arg], "on-success") == 0) {
2989 if (in_pattern) {
2990 memprintf(errmsg, "[!] not supported with '%s'", args[cur_arg]);
2991 goto error;
2992 }
2993 if (!*(args[cur_arg+1])) {
2994 memprintf(errmsg, "'%s' expects a string as argument", args[cur_arg]);
2995 goto error;
2996 }
2997 cur_arg++;
2998 on_success_msg = args[cur_arg];
2999 }
3000 else if (strcmp(args[cur_arg], "on-error") == 0) {
3001 if (in_pattern) {
3002 memprintf(errmsg, "[!] not supported with '%s'", args[cur_arg]);
3003 goto error;
3004 }
3005 if (!*(args[cur_arg+1])) {
3006 memprintf(errmsg, "'%s' expects a string as argument", args[cur_arg]);
3007 goto error;
3008 }
3009 cur_arg++;
3010 on_error_msg = args[cur_arg];
3011 }
3012 else if (strcmp(args[cur_arg], "ok-status") == 0) {
3013 if (in_pattern) {
3014 memprintf(errmsg, "[!] not supported with '%s'", args[cur_arg]);
3015 goto error;
3016 }
3017 if (!*(args[cur_arg+1])) {
3018 memprintf(errmsg, "'%s' expects a string as argument", args[cur_arg]);
3019 goto error;
3020 }
3021 if (strcasecmp(args[cur_arg+1], "L7OK") == 0)
3022 ok_st = HCHK_STATUS_L7OKD;
3023 else if (strcasecmp(args[cur_arg+1], "L7OKC") == 0)
3024 ok_st = HCHK_STATUS_L7OKCD;
3025 else if (strcasecmp(args[cur_arg+1], "L6OK") == 0)
3026 ok_st = HCHK_STATUS_L6OK;
3027 else if (strcasecmp(args[cur_arg+1], "L4OK") == 0)
3028 ok_st = HCHK_STATUS_L4OK;
3029 else {
3030 memprintf(errmsg, "'%s' only supports 'L4OK', 'L6OK', 'L7OK' or 'L7OKC' status (got '%s').",
3031 args[cur_arg], args[cur_arg+1]);
3032 goto error;
3033 }
3034 cur_arg++;
3035 }
3036 else if (strcmp(args[cur_arg], "error-status") == 0) {
3037 if (in_pattern) {
3038 memprintf(errmsg, "[!] not supported with '%s'", args[cur_arg]);
3039 goto error;
3040 }
3041 if (!*(args[cur_arg+1])) {
3042 memprintf(errmsg, "'%s' expects a string as argument", args[cur_arg]);
3043 goto error;
3044 }
3045 if (strcasecmp(args[cur_arg+1], "L7RSP") == 0)
3046 err_st = HCHK_STATUS_L7RSP;
3047 else if (strcasecmp(args[cur_arg+1], "L7STS") == 0)
3048 err_st = HCHK_STATUS_L7STS;
3049 else if (strcasecmp(args[cur_arg+1], "L6RSP") == 0)
3050 err_st = HCHK_STATUS_L6RSP;
3051 else if (strcasecmp(args[cur_arg+1], "L4CON") == 0)
3052 err_st = HCHK_STATUS_L4CON;
3053 else {
3054 memprintf(errmsg, "'%s' only supports 'L4CON', 'L6RSP', 'L7RSP' or 'L7STS' status (got '%s').",
3055 args[cur_arg], args[cur_arg+1]);
3056 goto error;
3057 }
3058 cur_arg++;
3059 }
3060 else if (strcmp(args[cur_arg], "status-code") == 0) {
3061 int idx = 0;
3062
3063 if (in_pattern) {
3064 memprintf(errmsg, "[!] not supported with '%s'", args[cur_arg]);
3065 goto error;
3066 }
3067 if (!*(args[cur_arg+1])) {
3068 memprintf(errmsg, "'%s' expects an expression as argument", args[cur_arg]);
3069 goto error;
3070 }
3071
3072 cur_arg++;
3073 release_sample_expr(status_expr);
3074 px->conf.args.ctx = ARGC_SRV;
3075 status_expr = sample_parse_expr((char *[]){args[cur_arg], NULL}, &idx,
3076 file, line, errmsg, &px->conf.args, NULL);
3077 if (!status_expr) {
3078 memprintf(errmsg, "error detected while parsing status-code expression : %s", *errmsg);
3079 goto error;
3080 }
3081 if (!(status_expr->fetch->val & SMP_VAL_BE_CHK_RUL)) {
3082 memprintf(errmsg, "error detected while parsing status-code expression : "
3083 " fetch method '%s' extracts information from '%s', "
3084 "none of which is available here.\n",
3085 args[cur_arg], sample_src_names(status_expr->fetch->use));
3086 goto error;
3087 }
3088 px->http_needed |= !!(status_expr->fetch->use & SMP_USE_HTTP_ANY);
3089 }
3090 else if (strcmp(args[cur_arg], "tout-status") == 0) {
3091 if (in_pattern) {
3092 memprintf(errmsg, "[!] not supported with '%s'", args[cur_arg]);
3093 goto error;
3094 }
3095 if (!*(args[cur_arg+1])) {
3096 memprintf(errmsg, "'%s' expects a string as argument", args[cur_arg]);
3097 goto error;
3098 }
3099 if (strcasecmp(args[cur_arg+1], "L7TOUT") == 0)
3100 tout_st = HCHK_STATUS_L7TOUT;
3101 else if (strcasecmp(args[cur_arg+1], "L6TOUT") == 0)
3102 tout_st = HCHK_STATUS_L6TOUT;
3103 else if (strcasecmp(args[cur_arg+1], "L4TOUT") == 0)
3104 tout_st = HCHK_STATUS_L4TOUT;
3105 else {
3106 memprintf(errmsg, "'%s' only supports 'L4TOUT', 'L6TOUT' or 'L7TOUT' status (got '%s').",
3107 args[cur_arg], args[cur_arg+1]);
3108 goto error;
3109 }
3110 cur_arg++;
3111 }
3112 else {
3113 if (proto == TCPCHK_RULES_HTTP_CHK) {
3114 bad_http_kw:
3115 memprintf(errmsg, "'only supports min-recv, [!]string', '[!]rstring', '[!]string-lf', '[!]status', "
3116 "'[!]rstatus', [!]hdr, [!]fhdr or comment but got '%s' as argument.", args[cur_arg]);
3117 }
3118 else {
3119 bad_tcp_kw:
3120 memprintf(errmsg, "'only supports min-recv, '[!]binary', '[!]string', '[!]rstring', '[!]string-lf'"
3121 "'[!]rbinary', '[!]binary-lf' or comment but got '%s' as argument.", args[cur_arg]);
3122 }
3123 goto error;
3124 }
3125 next:
3126 cur_arg++;
3127 }
3128
3129 chk = calloc(1, sizeof(*chk));
3130 if (!chk) {
3131 memprintf(errmsg, "out of memory");
3132 goto error;
3133 }
3134 chk->action = TCPCHK_ACT_EXPECT;
3135 LIST_INIT(&chk->expect.onerror_fmt);
3136 LIST_INIT(&chk->expect.onsuccess_fmt);
3137 chk->comment = comment; comment = NULL;
3138 chk->expect.type = type;
3139 chk->expect.min_recv = min_recv;
3140 chk->expect.flags = flags | (inverse ? TCPCHK_EXPT_FL_INV : 0);
3141 chk->expect.ok_status = ok_st;
3142 chk->expect.err_status = err_st;
3143 chk->expect.tout_status = tout_st;
3144 chk->expect.status_expr = status_expr; status_expr = NULL;
3145
3146 if (on_success_msg) {
3147 px->conf.args.ctx = ARGC_SRV;
3148 if (!parse_logformat_string(on_success_msg, px, &chk->expect.onsuccess_fmt, 0, SMP_VAL_BE_CHK_RUL, errmsg)) {
3149 memprintf(errmsg, "'%s' invalid log-format string (%s).\n", on_success_msg, *errmsg);
3150 goto error;
3151 }
3152 }
3153 if (on_error_msg) {
3154 px->conf.args.ctx = ARGC_SRV;
3155 if (!parse_logformat_string(on_error_msg, px, &chk->expect.onerror_fmt, 0, SMP_VAL_BE_CHK_RUL, errmsg)) {
3156 memprintf(errmsg, "'%s' invalid log-format string (%s).\n", on_error_msg, *errmsg);
3157 goto error;
3158 }
3159 }
3160
3161 switch (chk->expect.type) {
3162 case TCPCHK_EXPECT_HTTP_STATUS: {
3163 const char *p = pattern;
3164 unsigned int c1,c2;
3165
3166 chk->expect.codes.codes = NULL;
3167 chk->expect.codes.num = 0;
3168 while (1) {
3169 c1 = c2 = read_uint(&p, pattern + strlen(pattern));
3170 if (*p == '-') {
3171 p++;
3172 c2 = read_uint(&p, pattern + strlen(pattern));
3173 }
3174 if (c1 > c2) {
3175 memprintf(errmsg, "invalid range of status codes '%s'", pattern);
3176 goto error;
3177 }
3178
3179 chk->expect.codes.num++;
3180 chk->expect.codes.codes = my_realloc2(chk->expect.codes.codes,
3181 chk->expect.codes.num * sizeof(*chk->expect.codes.codes));
3182 if (!chk->expect.codes.codes) {
3183 memprintf(errmsg, "out of memory");
3184 goto error;
3185 }
3186 chk->expect.codes.codes[chk->expect.codes.num-1][0] = c1;
3187 chk->expect.codes.codes[chk->expect.codes.num-1][1] = c2;
3188
3189 if (*p == '\0')
3190 break;
3191 if (*p != ',') {
3192 memprintf(errmsg, "invalid character '%c' in the list of status codes", *p);
3193 goto error;
3194 }
3195 p++;
3196 }
3197 break;
3198 }
3199 case TCPCHK_EXPECT_STRING:
3200 case TCPCHK_EXPECT_HTTP_BODY:
3201 chk->expect.data = ist2(strdup(pattern), strlen(pattern));
3202 if (!isttest(chk->expect.data)) {
3203 memprintf(errmsg, "out of memory");
3204 goto error;
3205 }
3206 break;
3207 case TCPCHK_EXPECT_BINARY: {
3208 int len = chk->expect.data.len;
3209
3210 if (parse_binary(pattern, &chk->expect.data.ptr, &len, errmsg) == 0) {
3211 memprintf(errmsg, "invalid binary string (%s)", *errmsg);
3212 goto error;
3213 }
3214 chk->expect.data.len = len;
3215 break;
3216 }
3217 case TCPCHK_EXPECT_STRING_REGEX:
3218 case TCPCHK_EXPECT_BINARY_REGEX:
3219 case TCPCHK_EXPECT_HTTP_STATUS_REGEX:
3220 case TCPCHK_EXPECT_HTTP_BODY_REGEX:
3221 chk->expect.regex = regex_comp(pattern, 1, 0, errmsg);
3222 if (!chk->expect.regex)
3223 goto error;
3224 break;
3225
3226 case TCPCHK_EXPECT_STRING_LF:
3227 case TCPCHK_EXPECT_BINARY_LF:
3228 case TCPCHK_EXPECT_HTTP_BODY_LF:
3229 LIST_INIT(&chk->expect.fmt);
3230 px->conf.args.ctx = ARGC_SRV;
3231 if (!parse_logformat_string(pattern, px, &chk->expect.fmt, 0, SMP_VAL_BE_CHK_RUL, errmsg)) {
3232 memprintf(errmsg, "'%s' invalid log-format string (%s).\n", pattern, *errmsg);
3233 goto error;
3234 }
3235 break;
3236
3237 case TCPCHK_EXPECT_HTTP_HEADER:
3238 if (!npat) {
3239 memprintf(errmsg, "unexpected error, undefined header name pattern");
3240 goto error;
3241 }
3242 if (chk->expect.flags & TCPCHK_EXPT_FL_HTTP_HNAME_REG) {
3243 chk->expect.hdr.name_re = regex_comp(npat, 0, 0, errmsg);
3244 if (!chk->expect.hdr.name_re)
3245 goto error;
3246 }
3247 else if (chk->expect.flags & TCPCHK_EXPT_FL_HTTP_HNAME_FMT) {
3248 px->conf.args.ctx = ARGC_SRV;
3249 LIST_INIT(&chk->expect.hdr.name_fmt);
3250 if (!parse_logformat_string(npat, px, &chk->expect.hdr.name_fmt, 0, SMP_VAL_BE_CHK_RUL, errmsg)) {
3251 memprintf(errmsg, "'%s' invalid log-format string (%s).\n", npat, *errmsg);
3252 goto error;
3253 }
3254 }
3255 else {
3256 chk->expect.hdr.name = ist2(strdup(npat), strlen(npat));
3257 if (!isttest(chk->expect.hdr.name)) {
3258 memprintf(errmsg, "out of memory");
3259 goto error;
3260 }
3261 }
3262
3263 if (chk->expect.flags & TCPCHK_EXPT_FL_HTTP_HVAL_NONE) {
3264 chk->expect.hdr.value = IST_NULL;
3265 break;
3266 }
3267
3268 if (!vpat) {
3269 memprintf(errmsg, "unexpected error, undefined header value pattern");
3270 goto error;
3271 }
3272 else if (chk->expect.flags & TCPCHK_EXPT_FL_HTTP_HVAL_REG) {
3273 chk->expect.hdr.value_re = regex_comp(vpat, 1, 0, errmsg);
3274 if (!chk->expect.hdr.value_re)
3275 goto error;
3276 }
3277 else if (chk->expect.flags & TCPCHK_EXPT_FL_HTTP_HVAL_FMT) {
3278 px->conf.args.ctx = ARGC_SRV;
3279 LIST_INIT(&chk->expect.hdr.value_fmt);
3280 if (!parse_logformat_string(vpat, px, &chk->expect.hdr.value_fmt, 0, SMP_VAL_BE_CHK_RUL, errmsg)) {
3281 memprintf(errmsg, "'%s' invalid log-format string (%s).\n", npat, *errmsg);
3282 goto error;
3283 }
3284 }
3285 else {
3286 chk->expect.hdr.value = ist2(strdup(vpat), strlen(vpat));
3287 if (!isttest(chk->expect.hdr.value)) {
3288 memprintf(errmsg, "out of memory");
3289 goto error;
3290 }
3291 }
3292
3293 break;
3294 case TCPCHK_EXPECT_CUSTOM:
3295 chk->expect.custom = NULL; /* Must be defined by the caller ! */
3296 break;
3297 case TCPCHK_EXPECT_UNDEF:
3298 memprintf(errmsg, "pattern not found");
3299 goto error;
3300 }
3301
3302 /* All tcp-check expect points back to the first inverse expect rule in
3303 * a chain of one or more expect rule, potentially itself.
3304 */
3305 chk->expect.head = chk;
3306 list_for_each_entry_rev(prev_check, rules, list) {
3307 if (prev_check->action == TCPCHK_ACT_EXPECT) {
3308 if (prev_check->expect.flags & TCPCHK_EXPT_FL_INV)
3309 chk->expect.head = prev_check;
3310 continue;
3311 }
3312 if (prev_check->action != TCPCHK_ACT_COMMENT && prev_check->action != TCPCHK_ACT_ACTION_KW)
3313 break;
3314 }
3315 return chk;
3316
3317 error:
3318 free_tcpcheck(chk, 0);
3319 free(comment);
3320 release_sample_expr(status_expr);
3321 return NULL;
3322}
3323
3324/* Overwrites fields of the old http send rule with those of the new one. When
3325 * replaced, old values are freed and replaced by the new ones. New values are
3326 * not copied but transferred. At the end <new> should be empty and can be
3327 * safely released. This function never fails.
3328 */
3329void tcpcheck_overwrite_send_http_rule(struct tcpcheck_rule *old, struct tcpcheck_rule *new)
3330{
3331 struct logformat_node *lf, *lfb;
3332 struct tcpcheck_http_hdr *hdr, *bhdr;
3333
3334
3335 if (new->send.http.meth.str.area) {
3336 free(old->send.http.meth.str.area);
3337 old->send.http.meth.meth = new->send.http.meth.meth;
3338 old->send.http.meth.str.area = new->send.http.meth.str.area;
3339 old->send.http.meth.str.data = new->send.http.meth.str.data;
3340 new->send.http.meth.str = BUF_NULL;
3341 }
3342
3343 if (!(new->send.http.flags & TCPCHK_SND_HTTP_FL_URI_FMT) && isttest(new->send.http.uri)) {
3344 if (!(old->send.http.flags & TCPCHK_SND_HTTP_FL_URI_FMT))
3345 istfree(&old->send.http.uri);
3346 else
3347 free_tcpcheck_fmt(&old->send.http.uri_fmt);
3348 old->send.http.flags &= ~TCPCHK_SND_HTTP_FL_URI_FMT;
3349 old->send.http.uri = new->send.http.uri;
3350 new->send.http.uri = IST_NULL;
3351 }
3352 else if ((new->send.http.flags & TCPCHK_SND_HTTP_FL_URI_FMT) && !LIST_ISEMPTY(&new->send.http.uri_fmt)) {
3353 if (!(old->send.http.flags & TCPCHK_SND_HTTP_FL_URI_FMT))
3354 istfree(&old->send.http.uri);
3355 else
3356 free_tcpcheck_fmt(&old->send.http.uri_fmt);
3357 old->send.http.flags |= TCPCHK_SND_HTTP_FL_URI_FMT;
3358 LIST_INIT(&old->send.http.uri_fmt);
3359 list_for_each_entry_safe(lf, lfb, &new->send.http.uri_fmt, list) {
3360 LIST_DEL(&lf->list);
3361 LIST_ADDQ(&old->send.http.uri_fmt, &lf->list);
3362 }
3363 }
3364
3365 if (isttest(new->send.http.vsn)) {
3366 istfree(&old->send.http.vsn);
3367 old->send.http.vsn = new->send.http.vsn;
3368 new->send.http.vsn = IST_NULL;
3369 }
3370
3371 free_tcpcheck_http_hdrs(&old->send.http.hdrs);
3372 list_for_each_entry_safe(hdr, bhdr, &new->send.http.hdrs, list) {
3373 LIST_DEL(&hdr->list);
3374 LIST_ADDQ(&old->send.http.hdrs, &hdr->list);
3375 }
3376
3377 if (!(new->send.http.flags & TCPCHK_SND_HTTP_FL_BODY_FMT) && isttest(new->send.http.body)) {
3378 if (!(old->send.http.flags & TCPCHK_SND_HTTP_FL_BODY_FMT))
3379 istfree(&old->send.http.body);
3380 else
3381 free_tcpcheck_fmt(&old->send.http.body_fmt);
3382 old->send.http.flags &= ~TCPCHK_SND_HTTP_FL_BODY_FMT;
3383 old->send.http.body = new->send.http.body;
3384 new->send.http.body = IST_NULL;
3385 }
3386 else if ((new->send.http.flags & TCPCHK_SND_HTTP_FL_BODY_FMT) && !LIST_ISEMPTY(&new->send.http.body_fmt)) {
3387 if (!(old->send.http.flags & TCPCHK_SND_HTTP_FL_BODY_FMT))
3388 istfree(&old->send.http.body);
3389 else
3390 free_tcpcheck_fmt(&old->send.http.body_fmt);
3391 old->send.http.flags |= TCPCHK_SND_HTTP_FL_BODY_FMT;
3392 LIST_INIT(&old->send.http.body_fmt);
3393 list_for_each_entry_safe(lf, lfb, &new->send.http.body_fmt, list) {
3394 LIST_DEL(&lf->list);
3395 LIST_ADDQ(&old->send.http.body_fmt, &lf->list);
3396 }
3397 }
3398}
3399
3400/* Internal function used to add an http-check rule in a list during the config
3401 * parsing step. Depending on its type, and the previously inserted rules, a
3402 * specific action may be performed or an error may be reported. This functions
3403 * returns 1 on success and 0 on error and <errmsg> is filled with the error
3404 * message.
3405 */
3406int tcpcheck_add_http_rule(struct tcpcheck_rule *chk, struct tcpcheck_rules *rules, char **errmsg)
3407{
3408 struct tcpcheck_rule *r;
3409
3410 /* the implicit send rule coming from an "option httpchk" line must be
3411 * merged with the first explici http-check send rule, if
Ilya Shipitsin47d17182020-06-21 21:42:57 +05003412 * any. Depending on the declaration order some tests are required.
Willy Tarreau51cd5952020-06-05 12:25:38 +02003413 *
Ilya Shipitsin47d17182020-06-21 21:42:57 +05003414 * Some tests are also required for other kinds of http-check rules to be
Willy Tarreau51cd5952020-06-05 12:25:38 +02003415 * sure the ruleset remains valid.
3416 */
3417
3418 if (chk->action == TCPCHK_ACT_SEND && (chk->send.http.flags & TCPCHK_SND_HTTP_FROM_OPT)) {
3419 /* Tries to add an implicit http-check send rule from an "option httpchk" line.
3420 * First, the first rule is retrieved, skipping the first CONNECT, if any, and
3421 * following tests are performed :
3422 *
3423 * 1- If there is no such rule or if it is not a send rule, the implicit send
3424 * rule is pushed in front of the ruleset
3425 *
3426 * 2- If it is another implicit send rule, it is replaced with the new one.
3427 *
3428 * 3- Otherwise, it means it is an explicit send rule. In this case we merge
3429 * both, overwriting the old send rule (the explicit one) with info of the
3430 * new send rule (the implicit one).
3431 */
3432 r = get_first_tcpcheck_rule(rules);
3433 if (r && r->action == TCPCHK_ACT_CONNECT)
3434 r = get_next_tcpcheck_rule(rules, r);
3435 if (!r || r->action != TCPCHK_ACT_SEND)
3436 LIST_ADD(rules->list, &chk->list);
3437 else if (r->send.http.flags & TCPCHK_SND_HTTP_FROM_OPT) {
3438 LIST_DEL(&r->list);
3439 free_tcpcheck(r, 0);
3440 LIST_ADD(rules->list, &chk->list);
3441 }
3442 else {
3443 tcpcheck_overwrite_send_http_rule(r, chk);
3444 free_tcpcheck(chk, 0);
3445 }
3446 }
3447 else {
3448 /* Tries to add an explicit http-check rule. First of all we check the typefo the
3449 * last inserted rule to be sure it is valid. Then for send rule, we try to merge it
3450 * with an existing implicit send rule, if any. At the end, if there is no error,
3451 * the rule is appended to the list.
3452 */
3453
3454 r = get_last_tcpcheck_rule(rules);
3455 if (!r || (r->action == TCPCHK_ACT_SEND && (r->send.http.flags & TCPCHK_SND_HTTP_FROM_OPT)))
3456 /* no error */;
3457 else if (r->action != TCPCHK_ACT_CONNECT && chk->action == TCPCHK_ACT_SEND) {
3458 memprintf(errmsg, "unable to add http-check send rule at step %d (missing connect rule).",
3459 chk->index+1);
3460 return 0;
3461 }
3462 else if (r->action != TCPCHK_ACT_SEND && r->action != TCPCHK_ACT_EXPECT && chk->action == TCPCHK_ACT_EXPECT) {
3463 memprintf(errmsg, "unable to add http-check expect rule at step %d (missing send rule).",
3464 chk->index+1);
3465 return 0;
3466 }
3467 else if (r->action != TCPCHK_ACT_EXPECT && chk->action == TCPCHK_ACT_CONNECT) {
3468 memprintf(errmsg, "unable to add http-check connect rule at step %d (missing expect rule).",
3469 chk->index+1);
3470 return 0;
3471 }
3472
3473 if (chk->action == TCPCHK_ACT_SEND) {
3474 r = get_first_tcpcheck_rule(rules);
3475 if (r && r->action == TCPCHK_ACT_SEND && (r->send.http.flags & TCPCHK_SND_HTTP_FROM_OPT)) {
3476 tcpcheck_overwrite_send_http_rule(r, chk);
3477 free_tcpcheck(chk, 0);
3478 LIST_DEL(&r->list);
3479 r->send.http.flags &= ~TCPCHK_SND_HTTP_FROM_OPT;
3480 chk = r;
3481 }
3482 }
3483 LIST_ADDQ(rules->list, &chk->list);
3484 }
3485 return 1;
3486}
3487
3488/* Check tcp-check health-check configuration for the proxy <px>. */
3489static int check_proxy_tcpcheck(struct proxy *px)
3490{
3491 struct tcpcheck_rule *chk, *back;
3492 char *comment = NULL, *errmsg = NULL;
3493 enum tcpcheck_rule_type prev_action = TCPCHK_ACT_COMMENT;
3494 int ret = 0;
3495
3496 if (!(px->cap & PR_CAP_BE) || (px->options2 & PR_O2_CHK_ANY) != PR_O2_TCPCHK_CHK) {
3497 deinit_proxy_tcpcheck(px);
3498 goto out;
3499 }
3500
3501 free(px->check_command);
3502 free(px->check_path);
3503 px->check_command = px->check_path = NULL;
3504
3505 if (!px->tcpcheck_rules.list) {
3506 ha_alert("config : proxy '%s' : tcp-check configured but no ruleset defined.\n", px->id);
3507 ret |= ERR_ALERT | ERR_FATAL;
3508 goto out;
3509 }
3510
3511 /* HTTP ruleset only : */
3512 if ((px->tcpcheck_rules.flags & TCPCHK_RULES_PROTO_CHK) == TCPCHK_RULES_HTTP_CHK) {
3513 struct tcpcheck_rule *next;
3514
3515 /* move remaining implicit send rule from "option httpchk" line to the right place.
3516 * If such rule exists, it must be the first one. In this case, the rule is moved
3517 * after the first connect rule, if any. Otherwise, nothing is done.
3518 */
3519 chk = get_first_tcpcheck_rule(&px->tcpcheck_rules);
3520 if (chk && chk->action == TCPCHK_ACT_SEND && (chk->send.http.flags & TCPCHK_SND_HTTP_FROM_OPT)) {
3521 next = get_next_tcpcheck_rule(&px->tcpcheck_rules, chk);
3522 if (next && next->action == TCPCHK_ACT_CONNECT) {
3523 LIST_DEL(&chk->list);
3524 LIST_ADD(&next->list, &chk->list);
3525 chk->index = next->index;
3526 }
3527 }
3528
3529 /* add implicit expect rule if the last one is a send. It is inherited from previous
3530 * versions where the http expect rule was optional. Now it is possible to chained
3531 * send/expect rules but the last expect may still be implicit.
3532 */
3533 chk = get_last_tcpcheck_rule(&px->tcpcheck_rules);
3534 if (chk && chk->action == TCPCHK_ACT_SEND) {
3535 next = parse_tcpcheck_expect((char *[]){"http-check", "expect", "status", "200-399", ""},
3536 1, px, px->tcpcheck_rules.list, TCPCHK_RULES_HTTP_CHK,
3537 px->conf.file, px->conf.line, &errmsg);
3538 if (!next) {
3539 ha_alert("config : proxy '%s': unable to add implicit http-check expect rule "
3540 "(%s).\n", px->id, errmsg);
3541 free(errmsg);
3542 ret |= ERR_ALERT | ERR_FATAL;
3543 goto out;
3544 }
3545 LIST_ADDQ(px->tcpcheck_rules.list, &next->list);
3546 next->index = chk->index;
3547 }
3548 }
3549
3550 /* For all ruleset: */
3551
3552 /* If there is no connect rule preceding all send / expect rules, an
3553 * implicit one is inserted before all others.
3554 */
3555 chk = get_first_tcpcheck_rule(&px->tcpcheck_rules);
3556 if (!chk || chk->action != TCPCHK_ACT_CONNECT) {
3557 chk = calloc(1, sizeof(*chk));
3558 if (!chk) {
3559 ha_alert("config : proxy '%s': unable to add implicit tcp-check connect rule "
3560 "(out of memory).\n", px->id);
3561 ret |= ERR_ALERT | ERR_FATAL;
3562 goto out;
3563 }
3564 chk->action = TCPCHK_ACT_CONNECT;
3565 chk->connect.options = (TCPCHK_OPT_DEFAULT_CONNECT|TCPCHK_OPT_IMPLICIT);
3566 LIST_ADD(px->tcpcheck_rules.list, &chk->list);
3567 }
3568
3569 /* Remove all comment rules. To do so, when a such rule is found, the
3570 * comment is assigned to the following rule(s).
3571 */
3572 list_for_each_entry_safe(chk, back, px->tcpcheck_rules.list, list) {
3573 if (chk->action != prev_action && prev_action != TCPCHK_ACT_COMMENT) {
3574 free(comment);
3575 comment = NULL;
3576 }
3577
3578 prev_action = chk->action;
3579 switch (chk->action) {
3580 case TCPCHK_ACT_COMMENT:
3581 free(comment);
3582 comment = chk->comment;
3583 LIST_DEL(&chk->list);
3584 free(chk);
3585 break;
3586 case TCPCHK_ACT_CONNECT:
3587 if (!chk->comment && comment)
3588 chk->comment = strdup(comment);
Tim Duesterhus588b3142020-05-29 14:35:51 +02003589 /* fall through */
Willy Tarreau51cd5952020-06-05 12:25:38 +02003590 case TCPCHK_ACT_ACTION_KW:
3591 free(comment);
3592 comment = NULL;
3593 break;
3594 case TCPCHK_ACT_SEND:
3595 case TCPCHK_ACT_EXPECT:
3596 if (!chk->comment && comment)
3597 chk->comment = strdup(comment);
3598 break;
3599 }
3600 }
3601 free(comment);
3602 comment = NULL;
3603
3604 out:
3605 return ret;
3606}
3607
3608void deinit_proxy_tcpcheck(struct proxy *px)
3609{
3610 free_tcpcheck_vars(&px->tcpcheck_rules.preset_vars);
3611 px->tcpcheck_rules.flags = 0;
3612 px->tcpcheck_rules.list = NULL;
3613}
3614
3615static void deinit_tcpchecks()
3616{
3617 struct tcpcheck_ruleset *rs;
3618 struct tcpcheck_rule *r, *rb;
3619 struct ebpt_node *node, *next;
3620
3621 node = ebpt_first(&shared_tcpchecks);
3622 while (node) {
3623 next = ebpt_next(node);
3624 ebpt_delete(node);
3625 free(node->key);
3626 rs = container_of(node, typeof(*rs), node);
3627 list_for_each_entry_safe(r, rb, &rs->rules, list) {
3628 LIST_DEL(&r->list);
3629 free_tcpcheck(r, 0);
3630 }
3631 free(rs);
3632 node = next;
3633 }
3634}
3635
3636int add_tcpcheck_expect_str(struct tcpcheck_rules *rules, const char *str)
3637{
3638 struct tcpcheck_rule *tcpcheck, *prev_check;
3639 struct tcpcheck_expect *expect;
3640
3641 if ((tcpcheck = pool_alloc(pool_head_tcpcheck_rule)) == NULL)
3642 return 0;
3643 memset(tcpcheck, 0, sizeof(*tcpcheck));
3644 tcpcheck->action = TCPCHK_ACT_EXPECT;
3645
3646 expect = &tcpcheck->expect;
3647 expect->type = TCPCHK_EXPECT_STRING;
3648 LIST_INIT(&expect->onerror_fmt);
3649 LIST_INIT(&expect->onsuccess_fmt);
3650 expect->ok_status = HCHK_STATUS_L7OKD;
3651 expect->err_status = HCHK_STATUS_L7RSP;
3652 expect->tout_status = HCHK_STATUS_L7TOUT;
3653 expect->data = ist2(strdup(str), strlen(str));
3654 if (!isttest(expect->data)) {
3655 pool_free(pool_head_tcpcheck_rule, tcpcheck);
3656 return 0;
3657 }
3658
3659 /* All tcp-check expect points back to the first inverse expect rule
3660 * in a chain of one or more expect rule, potentially itself.
3661 */
3662 tcpcheck->expect.head = tcpcheck;
3663 list_for_each_entry_rev(prev_check, rules->list, list) {
3664 if (prev_check->action == TCPCHK_ACT_EXPECT) {
3665 if (prev_check->expect.flags & TCPCHK_EXPT_FL_INV)
3666 tcpcheck->expect.head = prev_check;
3667 continue;
3668 }
3669 if (prev_check->action != TCPCHK_ACT_COMMENT && prev_check->action != TCPCHK_ACT_ACTION_KW)
3670 break;
3671 }
3672 LIST_ADDQ(rules->list, &tcpcheck->list);
3673 return 1;
3674}
3675
3676int add_tcpcheck_send_strs(struct tcpcheck_rules *rules, const char * const *strs)
3677{
3678 struct tcpcheck_rule *tcpcheck;
3679 struct tcpcheck_send *send;
3680 const char *in;
3681 char *dst;
3682 int i;
3683
3684 if ((tcpcheck = pool_alloc(pool_head_tcpcheck_rule)) == NULL)
3685 return 0;
3686 memset(tcpcheck, 0, sizeof(*tcpcheck));
3687 tcpcheck->action = TCPCHK_ACT_SEND;
3688
3689 send = &tcpcheck->send;
3690 send->type = TCPCHK_SEND_STRING;
3691
3692 for (i = 0; strs[i]; i++)
3693 send->data.len += strlen(strs[i]);
3694
3695 send->data.ptr = malloc(istlen(send->data) + 1);
3696 if (!isttest(send->data)) {
3697 pool_free(pool_head_tcpcheck_rule, tcpcheck);
3698 return 0;
3699 }
3700
3701 dst = istptr(send->data);
3702 for (i = 0; strs[i]; i++)
3703 for (in = strs[i]; (*dst = *in++); dst++);
3704 *dst = 0;
3705
3706 LIST_ADDQ(rules->list, &tcpcheck->list);
3707 return 1;
3708}
3709
3710/* Parses the "tcp-check" proxy keyword */
3711static int proxy_parse_tcpcheck(char **args, int section, struct proxy *curpx,
3712 struct proxy *defpx, const char *file, int line,
3713 char **errmsg)
3714{
3715 struct tcpcheck_ruleset *rs = NULL;
3716 struct tcpcheck_rule *chk = NULL;
3717 int index, cur_arg, ret = 0;
3718
3719 if (warnifnotcap(curpx, PR_CAP_BE, file, line, args[0], NULL))
3720 ret = 1;
3721
3722 /* Deduce the ruleset name from the proxy info */
3723 chunk_printf(&trash, "*tcp-check-%s_%s-%d",
3724 ((curpx == defpx) ? "defaults" : curpx->id),
3725 curpx->conf.file, curpx->conf.line);
3726
3727 rs = find_tcpcheck_ruleset(b_orig(&trash));
3728 if (rs == NULL) {
3729 rs = create_tcpcheck_ruleset(b_orig(&trash));
3730 if (rs == NULL) {
3731 memprintf(errmsg, "out of memory.\n");
3732 goto error;
3733 }
3734 }
3735
3736 index = 0;
3737 if (!LIST_ISEMPTY(&rs->rules)) {
3738 chk = LIST_PREV(&rs->rules, typeof(chk), list);
3739 index = chk->index + 1;
3740 }
3741
3742 cur_arg = 1;
3743 if (strcmp(args[cur_arg], "connect") == 0)
3744 chk = parse_tcpcheck_connect(args, cur_arg, curpx, &rs->rules, file, line, errmsg);
3745 else if (strcmp(args[cur_arg], "send") == 0 || strcmp(args[cur_arg], "send-binary") == 0 ||
3746 strcmp(args[cur_arg], "send-lf") == 0 || strcmp(args[cur_arg], "send-binary-lf") == 0)
3747 chk = parse_tcpcheck_send(args, cur_arg, curpx, &rs->rules, file, line, errmsg);
3748 else if (strcmp(args[cur_arg], "expect") == 0)
3749 chk = parse_tcpcheck_expect(args, cur_arg, curpx, &rs->rules, 0, file, line, errmsg);
3750 else if (strcmp(args[cur_arg], "comment") == 0)
3751 chk = parse_tcpcheck_comment(args, cur_arg, curpx, &rs->rules, file, line, errmsg);
3752 else {
3753 struct action_kw *kw = action_kw_tcp_check_lookup(args[cur_arg]);
3754
3755 if (!kw) {
3756 action_kw_tcp_check_build_list(&trash);
3757 memprintf(errmsg, "'%s' only supports 'comment', 'connect', 'send', 'send-binary', 'expect'"
3758 "%s%s. but got '%s'",
3759 args[0], (*trash.area ? ", " : ""), trash.area, args[1]);
3760 goto error;
3761 }
3762 chk = parse_tcpcheck_action(args, cur_arg, curpx, &rs->rules, kw, file, line, errmsg);
3763 }
3764
3765 if (!chk) {
3766 memprintf(errmsg, "'%s %s' : %s.", args[0], args[1], *errmsg);
3767 goto error;
3768 }
3769 ret = (ret || (*errmsg != NULL)); /* Handle warning */
3770
3771 /* No error: add the tcp-check rule in the list */
3772 chk->index = index;
3773 LIST_ADDQ(&rs->rules, &chk->list);
3774
3775 if ((curpx->options2 & PR_O2_CHK_ANY) == PR_O2_TCPCHK_CHK &&
3776 (curpx->tcpcheck_rules.flags & TCPCHK_RULES_PROTO_CHK) == TCPCHK_RULES_TCP_CHK) {
3777 /* Use this ruleset if the proxy already has tcp-check enabled */
3778 curpx->tcpcheck_rules.list = &rs->rules;
3779 curpx->tcpcheck_rules.flags &= ~TCPCHK_RULES_UNUSED_TCP_RS;
3780 }
3781 else {
3782 /* mark this ruleset as unused for now */
3783 curpx->tcpcheck_rules.flags |= TCPCHK_RULES_UNUSED_TCP_RS;
3784 }
3785
3786 return ret;
3787
3788 error:
3789 free_tcpcheck(chk, 0);
3790 free_tcpcheck_ruleset(rs);
3791 return -1;
3792}
3793
3794static struct cfg_kw_list cfg_kws = {ILH, {
3795 { CFG_LISTEN, "tcp-check", proxy_parse_tcpcheck },
3796 { 0, NULL, NULL },
3797}};
3798
3799REGISTER_POST_PROXY_CHECK(check_proxy_tcpcheck);
3800REGISTER_PROXY_DEINIT(deinit_proxy_tcpcheck);
3801REGISTER_POST_DEINIT(deinit_tcpchecks);
3802INITCALL1(STG_REGISTER, cfg_register_keywords, &cfg_kws);