blob: 330f3efbc995e0b1cf1c24ff063a89fef1c53c91 [file] [log] [blame]
Willy Tarreau59f98392012-07-06 14:13:49 +02001/*
2 * Connection management functions
3 *
4 * Copyright 2000-2012 Willy Tarreau <w@1wt.eu>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
Willy Tarreaue1e4a612012-10-05 00:10:55 +020013#include <errno.h>
14
Willy Tarreau59f98392012-07-06 14:13:49 +020015#include <common/compat.h>
16#include <common/config.h>
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +010017#include <common/namespace.h>
Willy Tarreau59f98392012-07-06 14:13:49 +020018
Willy Tarreauc5788912012-08-24 18:12:41 +020019#include <proto/connection.h>
Willy Tarreaudd2f85e2012-09-02 22:34:23 +020020#include <proto/fd.h>
Willy Tarreau5f1504f2012-10-04 23:55:57 +020021#include <proto/frontend.h>
Willy Tarreau2da156f2012-07-23 15:07:23 +020022#include <proto/proto_tcp.h>
Willy Tarreau2c6be842012-07-06 17:12:34 +020023#include <proto/stream_interface.h>
Willy Tarreau59f98392012-07-06 14:13:49 +020024
Emeric Brun46591952012-05-18 15:47:34 +020025#ifdef USE_OPENSSL
26#include <proto/ssl_sock.h>
27#endif
28
Willy Tarreauf2943dc2012-10-26 20:10:28 +020029struct pool_head *pool2_connection;
30
31/* perform minimal intializations, report 0 in case of error, 1 if OK. */
32int init_connection()
33{
34 pool2_connection = create_pool("connection", sizeof (struct connection), MEM_F_SHARED);
35 return pool2_connection != NULL;
36}
37
Willy Tarreau59f98392012-07-06 14:13:49 +020038/* I/O callback for fd-based connections. It calls the read/write handlers
Willy Tarreau7a798e52016-04-14 11:13:20 +020039 * provided by the connection's sock_ops, which must be valid.
Willy Tarreau59f98392012-07-06 14:13:49 +020040 */
Willy Tarreau7a798e52016-04-14 11:13:20 +020041void conn_fd_handler(int fd)
Willy Tarreau59f98392012-07-06 14:13:49 +020042{
Willy Tarreau80184712012-07-06 14:54:49 +020043 struct connection *conn = fdtab[fd].owner;
Willy Tarreau9e272bf2012-10-03 21:04:48 +020044 unsigned int flags;
Willy Tarreau59f98392012-07-06 14:13:49 +020045
Willy Tarreauc76ae332012-07-12 15:32:13 +020046 if (unlikely(!conn))
Willy Tarreau7a798e52016-04-14 11:13:20 +020047 return;
Willy Tarreau59f98392012-07-06 14:13:49 +020048
Willy Tarreau7d281492012-12-16 19:19:13 +010049 conn_refresh_polling_flags(conn);
50 flags = conn->flags & ~CO_FL_ERROR; /* ensure to call the wake handler upon error */
Willy Tarreaud29a0662012-12-10 16:33:38 +010051
Willy Tarreauc76ae332012-07-12 15:32:13 +020052 process_handshake:
Willy Tarreauf9dabec2012-08-17 17:33:53 +020053 /* The handshake callbacks are called in sequence. If either of them is
54 * missing something, it must enable the required polling at the socket
55 * layer of the connection. Polling state is not guaranteed when entering
56 * these handlers, so any handshake handler which does not complete its
Willy Tarreaud6e999b2013-11-25 08:41:15 +010057 * work must explicitly disable events it's not interested in. Error
58 * handling is also performed here in order to reduce the number of tests
59 * around.
Willy Tarreauf9dabec2012-08-17 17:33:53 +020060 */
Willy Tarreaud6e999b2013-11-25 08:41:15 +010061 while (unlikely(conn->flags & (CO_FL_HANDSHAKE | CO_FL_ERROR))) {
Willy Tarreau310987a2014-01-22 19:46:33 +010062 if (unlikely(conn->flags & CO_FL_ERROR))
Willy Tarreau2c6be842012-07-06 17:12:34 +020063 goto leave;
Willy Tarreau59f98392012-07-06 14:13:49 +020064
Willy Tarreau22cda212012-08-31 17:43:29 +020065 if (conn->flags & CO_FL_ACCEPT_PROXY)
66 if (!conn_recv_proxy(conn, CO_FL_ACCEPT_PROXY))
67 goto leave;
68
Willy Tarreau57cd3e42013-10-24 22:01:26 +020069 if (conn->flags & CO_FL_SEND_PROXY)
70 if (!conn_si_send_proxy(conn, CO_FL_SEND_PROXY))
Willy Tarreau5f1504f2012-10-04 23:55:57 +020071 goto leave;
Emeric Brun46591952012-05-18 15:47:34 +020072#ifdef USE_OPENSSL
73 if (conn->flags & CO_FL_SSL_WAIT_HS)
74 if (!ssl_sock_handshake(conn, CO_FL_SSL_WAIT_HS))
75 goto leave;
76#endif
Willy Tarreauc76ae332012-07-12 15:32:13 +020077 }
78
Willy Tarreauf9dabec2012-08-17 17:33:53 +020079 /* Once we're purely in the data phase, we disable handshake polling */
80 if (!(conn->flags & CO_FL_POLL_SOCK))
81 __conn_sock_stop_both(conn);
Willy Tarreauc76ae332012-07-12 15:32:13 +020082
Willy Tarreau071e1372012-10-03 01:39:48 +020083 /* The data layer might not be ready yet (eg: when using embryonic
84 * sessions). If we're about to move data, we must initialize it first.
85 * The function may fail and cause the connection to be destroyed, thus
Willy Tarreau2542b532012-08-31 16:01:23 +020086 * we must not use it anymore and should immediately leave instead.
87 */
Willy Tarreau071e1372012-10-03 01:39:48 +020088 if ((conn->flags & CO_FL_INIT_DATA) && conn->data->init(conn) < 0)
Willy Tarreau7a798e52016-04-14 11:13:20 +020089 return;
Willy Tarreau2542b532012-08-31 16:01:23 +020090
Willy Tarreau153c3ca2012-10-22 22:47:55 +020091 /* The data transfer starts here and stops on error and handshakes. Note
92 * that we must absolutely test conn->xprt at each step in case it suddenly
93 * changes due to a quick unexpected close().
94 */
Willy Tarreaud8375892014-01-21 11:01:08 +010095 if (conn->xprt && fd_recv_ready(fd) &&
96 ((conn->flags & (CO_FL_DATA_RD_ENA|CO_FL_WAIT_ROOM|CO_FL_ERROR|CO_FL_HANDSHAKE)) == CO_FL_DATA_RD_ENA)) {
Willy Tarreau3b5bc662012-10-05 21:29:37 +020097 /* force detection of a flag change : it's impossible to have both
98 * CONNECTED and WAIT_CONN so we're certain to trigger a change.
Willy Tarreau9e272bf2012-10-03 21:04:48 +020099 */
Willy Tarreau3b5bc662012-10-05 21:29:37 +0200100 flags = CO_FL_WAIT_L4_CONN | CO_FL_CONNECTED;
Willy Tarreau74beec32012-10-03 00:41:04 +0200101 conn->data->recv(conn);
Willy Tarreau9e272bf2012-10-03 21:04:48 +0200102 }
Willy Tarreau59f98392012-07-06 14:13:49 +0200103
Willy Tarreaud8375892014-01-21 11:01:08 +0100104 if (conn->xprt && fd_send_ready(fd) &&
105 ((conn->flags & (CO_FL_DATA_WR_ENA|CO_FL_WAIT_DATA|CO_FL_ERROR|CO_FL_HANDSHAKE)) == CO_FL_DATA_WR_ENA)) {
Willy Tarreau3b5bc662012-10-05 21:29:37 +0200106 /* force detection of a flag change : it's impossible to have both
107 * CONNECTED and WAIT_CONN so we're certain to trigger a change.
Willy Tarreau9e272bf2012-10-03 21:04:48 +0200108 */
Willy Tarreau3b5bc662012-10-05 21:29:37 +0200109 flags = CO_FL_WAIT_L4_CONN | CO_FL_CONNECTED;
Willy Tarreau74beec32012-10-03 00:41:04 +0200110 conn->data->send(conn);
Willy Tarreau9e272bf2012-10-03 21:04:48 +0200111 }
Willy Tarreau2da156f2012-07-23 15:07:23 +0200112
Willy Tarreauc76ae332012-07-12 15:32:13 +0200113 /* It may happen during the data phase that a handshake is
114 * enabled again (eg: SSL)
115 */
Willy Tarreaud6e999b2013-11-25 08:41:15 +0100116 if (unlikely(conn->flags & (CO_FL_HANDSHAKE | CO_FL_ERROR)))
Willy Tarreauc76ae332012-07-12 15:32:13 +0200117 goto process_handshake;
118
Willy Tarreaufd803bb2014-01-20 15:13:07 +0100119 if (unlikely(conn->flags & CO_FL_WAIT_L4_CONN)) {
Willy Tarreauf8deb0c2012-09-01 17:59:22 +0200120 /* still waiting for a connection to establish and nothing was
121 * attempted yet to probe the connection. Then let's retry the
122 * connect().
Willy Tarreau2da156f2012-07-23 15:07:23 +0200123 */
Willy Tarreau239d7182012-07-23 18:53:03 +0200124 if (!tcp_connect_probe(conn))
Willy Tarreauafad0e02012-08-09 14:45:22 +0200125 goto leave;
Willy Tarreau2da156f2012-07-23 15:07:23 +0200126 }
127
Willy Tarreau2c6be842012-07-06 17:12:34 +0200128 leave:
Willy Tarreau2396c1c2012-10-03 21:12:16 +0200129 /* The wake callback may be used to process a critical error and abort the
130 * connection. If so, we don't want to go further as the connection will
131 * have been released and the FD destroyed.
132 */
133 if ((conn->flags & CO_FL_WAKE_DATA) &&
134 ((conn->flags ^ flags) & CO_FL_CONN_STATE) &&
135 conn->data->wake(conn) < 0)
Willy Tarreau7a798e52016-04-14 11:13:20 +0200136 return;
Willy Tarreaufd31e532012-07-23 18:24:25 +0200137
Willy Tarreau8f8c92f2012-07-23 19:45:44 +0200138 /* Last check, verify if the connection just established */
Willy Tarreauc76ae332012-07-12 15:32:13 +0200139 if (unlikely(!(conn->flags & (CO_FL_WAIT_L4_CONN | CO_FL_WAIT_L6_CONN | CO_FL_CONNECTED))))
Willy Tarreau8f8c92f2012-07-23 19:45:44 +0200140 conn->flags |= CO_FL_CONNECTED;
141
Willy Tarreau61ace1b2012-07-23 12:14:26 +0200142 /* remove the events before leaving */
Willy Tarreau26d7cfc2012-12-07 00:09:43 +0100143 fdtab[fd].ev &= FD_POLL_STICKY;
Willy Tarreauf9dabec2012-08-17 17:33:53 +0200144
145 /* commit polling changes */
146 conn_cond_update_polling(conn);
Willy Tarreau7a798e52016-04-14 11:13:20 +0200147 return;
Willy Tarreau59f98392012-07-06 14:13:49 +0200148}
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200149
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200150/* Update polling on connection <c>'s file descriptor depending on its current
151 * state as reported in the connection's CO_FL_CURR_* flags, reports of EAGAIN
152 * in CO_FL_WAIT_*, and the data layer expectations indicated by CO_FL_DATA_*.
153 * The connection flags are updated with the new flags at the end of the
Willy Tarreau0ffde2c2012-10-04 22:21:15 +0200154 * operation. Polling is totally disabled if an error was reported.
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200155 */
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200156void conn_update_data_polling(struct connection *c)
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200157{
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200158 unsigned int f = c->flags;
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200159
Willy Tarreau3c728722014-01-23 13:50:42 +0100160 if (!conn_ctrl_ready(c))
Willy Tarreauf79c8172013-10-21 16:30:56 +0200161 return;
162
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200163 /* update read status if needed */
Willy Tarreau310987a2014-01-22 19:46:33 +0100164 if (unlikely((f & (CO_FL_CURR_RD_ENA|CO_FL_DATA_RD_ENA)) == CO_FL_DATA_RD_ENA)) {
Willy Tarreauf817e9f2014-01-10 16:58:45 +0100165 fd_want_recv(c->t.sock.fd);
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100166 f |= CO_FL_CURR_RD_ENA;
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200167 }
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100168 else if (unlikely((f & (CO_FL_CURR_RD_ENA|CO_FL_DATA_RD_ENA)) == CO_FL_CURR_RD_ENA)) {
169 fd_stop_recv(c->t.sock.fd);
170 f &= ~CO_FL_CURR_RD_ENA;
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200171 }
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200172
173 /* update write status if needed */
Willy Tarreau310987a2014-01-22 19:46:33 +0100174 if (unlikely((f & (CO_FL_CURR_WR_ENA|CO_FL_DATA_WR_ENA)) == CO_FL_DATA_WR_ENA)) {
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200175 fd_want_send(c->t.sock.fd);
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100176 f |= CO_FL_CURR_WR_ENA;
177 }
178 else if (unlikely((f & (CO_FL_CURR_WR_ENA|CO_FL_DATA_WR_ENA)) == CO_FL_CURR_WR_ENA)) {
179 fd_stop_send(c->t.sock.fd);
180 f &= ~CO_FL_CURR_WR_ENA;
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200181 }
Willy Tarreau310987a2014-01-22 19:46:33 +0100182 c->flags = f;
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200183}
184
185/* Update polling on connection <c>'s file descriptor depending on its current
186 * state as reported in the connection's CO_FL_CURR_* flags, reports of EAGAIN
187 * in CO_FL_WAIT_*, and the sock layer expectations indicated by CO_FL_SOCK_*.
188 * The connection flags are updated with the new flags at the end of the
Willy Tarreau0ffde2c2012-10-04 22:21:15 +0200189 * operation. Polling is totally disabled if an error was reported.
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200190 */
191void conn_update_sock_polling(struct connection *c)
192{
193 unsigned int f = c->flags;
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200194
Willy Tarreau3c728722014-01-23 13:50:42 +0100195 if (!conn_ctrl_ready(c))
Willy Tarreauf79c8172013-10-21 16:30:56 +0200196 return;
197
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200198 /* update read status if needed */
Willy Tarreau310987a2014-01-22 19:46:33 +0100199 if (unlikely((f & (CO_FL_CURR_RD_ENA|CO_FL_SOCK_RD_ENA)) == CO_FL_SOCK_RD_ENA)) {
Willy Tarreauf817e9f2014-01-10 16:58:45 +0100200 fd_want_recv(c->t.sock.fd);
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100201 f |= CO_FL_CURR_RD_ENA;
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200202 }
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100203 else if (unlikely((f & (CO_FL_CURR_RD_ENA|CO_FL_SOCK_RD_ENA)) == CO_FL_CURR_RD_ENA)) {
204 fd_stop_recv(c->t.sock.fd);
205 f &= ~CO_FL_CURR_RD_ENA;
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200206 }
207
208 /* update write status if needed */
Willy Tarreau310987a2014-01-22 19:46:33 +0100209 if (unlikely((f & (CO_FL_CURR_WR_ENA|CO_FL_SOCK_WR_ENA)) == CO_FL_SOCK_WR_ENA)) {
Willy Tarreauf817e9f2014-01-10 16:58:45 +0100210 fd_want_send(c->t.sock.fd);
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100211 f |= CO_FL_CURR_WR_ENA;
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200212 }
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100213 else if (unlikely((f & (CO_FL_CURR_WR_ENA|CO_FL_SOCK_WR_ENA)) == CO_FL_CURR_WR_ENA)) {
214 fd_stop_send(c->t.sock.fd);
215 f &= ~CO_FL_CURR_WR_ENA;
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200216 }
Willy Tarreau310987a2014-01-22 19:46:33 +0100217 c->flags = f;
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200218}
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200219
Willy Tarreauff3e6482015-03-12 23:56:52 +0100220/* Send a message over an established connection. It makes use of send() and
221 * returns the same return code and errno. If the socket layer is not ready yet
222 * then -1 is returned and ENOTSOCK is set into errno. If the fd is not marked
223 * as ready, or if EAGAIN or ENOTCONN is returned, then we return 0. It returns
224 * EMSGSIZE if called with a zero length message. The purpose is to simplify
225 * some rare attempts to directly write on the socket from above the connection
226 * (typically send_proxy). In case of EAGAIN, the fd is marked as "cant_send".
227 * It automatically retries on EINTR. Other errors cause the connection to be
228 * marked as in error state. It takes similar arguments as send() except the
229 * first one which is the connection instead of the file descriptor. Note,
230 * MSG_DONTWAIT and MSG_NOSIGNAL are forced on the flags.
231 */
232int conn_sock_send(struct connection *conn, const void *buf, int len, int flags)
233{
234 int ret;
235
236 ret = -1;
237 errno = ENOTSOCK;
238
239 if (conn->flags & CO_FL_SOCK_WR_SH)
240 goto fail;
241
242 if (!conn_ctrl_ready(conn))
243 goto fail;
244
245 errno = EMSGSIZE;
246 if (!len)
247 goto fail;
248
249 if (!fd_send_ready(conn->t.sock.fd))
250 goto wait;
251
252 do {
253 ret = send(conn->t.sock.fd, buf, len, flags | MSG_DONTWAIT | MSG_NOSIGNAL);
254 } while (ret < 0 && errno == EINTR);
255
256
257 if (ret > 0)
258 return ret;
259
260 if (ret == 0 || errno == EAGAIN || errno == ENOTCONN) {
261 wait:
262 fd_cant_send(conn->t.sock.fd);
263 return 0;
264 }
265 fail:
266 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH | CO_FL_ERROR;
267 return ret;
268}
269
Willy Tarreaud85c4852015-03-13 00:40:28 +0100270/* Drains possibly pending incoming data on the file descriptor attached to the
271 * connection and update the connection's flags accordingly. This is used to
272 * know whether we need to disable lingering on close. Returns non-zero if it
273 * is safe to close without disabling lingering, otherwise zero. The SOCK_RD_SH
274 * flag may also be updated if the incoming shutdown was reported by the drain()
275 * function.
276 */
277int conn_sock_drain(struct connection *conn)
278{
279 if (!conn_ctrl_ready(conn))
280 return 1;
281
282 if (conn->flags & (CO_FL_ERROR | CO_FL_SOCK_RD_SH))
283 return 1;
284
285 if (fdtab[conn->t.sock.fd].ev & (FD_POLL_ERR|FD_POLL_HUP)) {
286 fdtab[conn->t.sock.fd].linger_risk = 0;
287 }
288 else {
289 if (!fd_recv_ready(conn->t.sock.fd))
290 return 0;
291
292 /* disable draining if we were called and have no drain function */
293 if (!conn->ctrl->drain) {
294 __conn_data_stop_recv(conn);
295 return 0;
296 }
297
298 if (conn->ctrl->drain(conn->t.sock.fd) <= 0)
299 return 0;
300 }
301
302 conn->flags |= CO_FL_SOCK_RD_SH;
303 return 1;
304}
305
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100306/*
307 * Get data length from tlv
308 */
309static int get_tlv_length(const struct tlv *src)
310{
311 return (src->length_hi << 8) | src->length_lo;
312}
313
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200314/* This handshake handler waits a PROXY protocol header at the beginning of the
315 * raw data stream. The header looks like this :
316 *
317 * "PROXY" <SP> PROTO <SP> SRC3 <SP> DST3 <SP> SRC4 <SP> <DST4> "\r\n"
318 *
319 * There must be exactly one space between each field. Fields are :
320 * - PROTO : layer 4 protocol, which must be "TCP4" or "TCP6".
321 * - SRC3 : layer 3 (eg: IP) source address in standard text form
322 * - DST3 : layer 3 (eg: IP) destination address in standard text form
323 * - SRC4 : layer 4 (eg: TCP port) source address in standard text form
324 * - DST4 : layer 4 (eg: TCP port) destination address in standard text form
325 *
326 * This line MUST be at the beginning of the buffer and MUST NOT wrap.
327 *
328 * The header line is small and in all cases smaller than the smallest normal
329 * TCP MSS. So it MUST always be delivered as one segment, which ensures we
330 * can safely use MSG_PEEK and avoid buffering.
331 *
332 * Once the data is fetched, the values are set in the connection's address
333 * fields, and data are removed from the socket's buffer. The function returns
334 * zero if it needs to wait for more data or if it fails, or 1 if it completed
335 * and removed itself.
336 */
337int conn_recv_proxy(struct connection *conn, int flag)
338{
339 char *line, *end;
Willy Tarreau77992672014-06-14 11:06:17 +0200340 struct proxy_hdr_v2 *hdr_v2;
341 const char v2sig[] = PP2_SIGNATURE;
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100342 int tlv_length = 0;
KOVACS Krisztian7209c202015-07-03 14:09:10 +0200343 int tlv_offset = 0;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200344
345 /* we might have been called just after an asynchronous shutr */
346 if (conn->flags & CO_FL_SOCK_RD_SH)
347 goto fail;
348
Willy Tarreau3c728722014-01-23 13:50:42 +0100349 if (!conn_ctrl_ready(conn))
Willy Tarreauf79c8172013-10-21 16:30:56 +0200350 goto fail;
351
Willy Tarreaufd803bb2014-01-20 15:13:07 +0100352 if (!fd_recv_ready(conn->t.sock.fd))
353 return 0;
354
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200355 do {
Willy Tarreau19d14ef2012-10-29 16:51:55 +0100356 trash.len = recv(conn->t.sock.fd, trash.str, trash.size, MSG_PEEK);
357 if (trash.len < 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200358 if (errno == EINTR)
359 continue;
360 if (errno == EAGAIN) {
Willy Tarreaue1f50c42014-01-22 20:02:06 +0100361 fd_cant_recv(conn->t.sock.fd);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200362 return 0;
363 }
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100364 goto recv_abort;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200365 }
366 } while (0);
367
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100368 if (!trash.len) {
369 /* client shutdown */
370 conn->err_code = CO_ER_PRX_EMPTY;
371 goto fail;
372 }
373
Willy Tarreau19d14ef2012-10-29 16:51:55 +0100374 if (trash.len < 6)
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200375 goto missing;
376
Willy Tarreau19d14ef2012-10-29 16:51:55 +0100377 line = trash.str;
378 end = trash.str + trash.len;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200379
380 /* Decode a possible proxy request, fail early if it does not match */
Willy Tarreau77992672014-06-14 11:06:17 +0200381 if (strncmp(line, "PROXY ", 6) != 0)
382 goto not_v1;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200383
384 line += 6;
Willy Tarreau4c20d292014-06-14 11:41:36 +0200385 if (trash.len < 9) /* shortest possible line */
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200386 goto missing;
387
David CARLIER42ff05e2016-03-24 09:22:36 +0000388 if (memcmp(line, "TCP4 ", 5) == 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200389 u32 src3, dst3, sport, dport;
390
391 line += 5;
392
393 src3 = inetaddr_host_lim_ret(line, end, &line);
394 if (line == end)
395 goto missing;
396 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100397 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200398
399 dst3 = inetaddr_host_lim_ret(line, end, &line);
400 if (line == end)
401 goto missing;
402 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100403 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200404
405 sport = read_uint((const char **)&line, end);
406 if (line == end)
407 goto missing;
408 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100409 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200410
411 dport = read_uint((const char **)&line, end);
412 if (line > end - 2)
413 goto missing;
414 if (*line++ != '\r')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100415 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200416 if (*line++ != '\n')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100417 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200418
419 /* update the session's addresses and mark them set */
420 ((struct sockaddr_in *)&conn->addr.from)->sin_family = AF_INET;
421 ((struct sockaddr_in *)&conn->addr.from)->sin_addr.s_addr = htonl(src3);
422 ((struct sockaddr_in *)&conn->addr.from)->sin_port = htons(sport);
423
424 ((struct sockaddr_in *)&conn->addr.to)->sin_family = AF_INET;
425 ((struct sockaddr_in *)&conn->addr.to)->sin_addr.s_addr = htonl(dst3);
426 ((struct sockaddr_in *)&conn->addr.to)->sin_port = htons(dport);
427 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
428 }
David CARLIER42ff05e2016-03-24 09:22:36 +0000429 else if (memcmp(line, "TCP6 ", 5) == 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200430 u32 sport, dport;
431 char *src_s;
432 char *dst_s, *sport_s, *dport_s;
433 struct in6_addr src3, dst3;
434
435 line += 5;
436
437 src_s = line;
438 dst_s = sport_s = dport_s = NULL;
439 while (1) {
440 if (line > end - 2) {
441 goto missing;
442 }
443 else if (*line == '\r') {
444 *line = 0;
445 line++;
446 if (*line++ != '\n')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100447 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200448 break;
449 }
450
451 if (*line == ' ') {
452 *line = 0;
453 if (!dst_s)
454 dst_s = line + 1;
455 else if (!sport_s)
456 sport_s = line + 1;
457 else if (!dport_s)
458 dport_s = line + 1;
459 }
460 line++;
461 }
462
463 if (!dst_s || !sport_s || !dport_s)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100464 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200465
466 sport = read_uint((const char **)&sport_s,dport_s - 1);
467 if (*sport_s != 0)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100468 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200469
470 dport = read_uint((const char **)&dport_s,line - 2);
471 if (*dport_s != 0)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100472 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200473
474 if (inet_pton(AF_INET6, src_s, (void *)&src3) != 1)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100475 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200476
477 if (inet_pton(AF_INET6, dst_s, (void *)&dst3) != 1)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100478 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200479
480 /* update the session's addresses and mark them set */
481 ((struct sockaddr_in6 *)&conn->addr.from)->sin6_family = AF_INET6;
482 memcpy(&((struct sockaddr_in6 *)&conn->addr.from)->sin6_addr, &src3, sizeof(struct in6_addr));
483 ((struct sockaddr_in6 *)&conn->addr.from)->sin6_port = htons(sport);
484
485 ((struct sockaddr_in6 *)&conn->addr.to)->sin6_family = AF_INET6;
486 memcpy(&((struct sockaddr_in6 *)&conn->addr.to)->sin6_addr, &dst3, sizeof(struct in6_addr));
487 ((struct sockaddr_in6 *)&conn->addr.to)->sin6_port = htons(dport);
488 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
489 }
Willy Tarreau4c20d292014-06-14 11:41:36 +0200490 else if (memcmp(line, "UNKNOWN\r\n", 9) == 0) {
491 /* This can be a UNIX socket forwarded by an haproxy upstream */
492 line += 9;
493 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200494 else {
Willy Tarreau4c20d292014-06-14 11:41:36 +0200495 /* The protocol does not match something known (TCP4/TCP6/UNKNOWN) */
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100496 conn->err_code = CO_ER_PRX_BAD_PROTO;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200497 goto fail;
498 }
499
Willy Tarreau77992672014-06-14 11:06:17 +0200500 trash.len = line - trash.str;
501 goto eat_header;
502
503 not_v1:
504 /* try PPv2 */
505 if (trash.len < PP2_HEADER_LEN)
506 goto missing;
507
508 hdr_v2 = (struct proxy_hdr_v2 *)trash.str;
509
510 if (memcmp(hdr_v2->sig, v2sig, PP2_SIGNATURE_LEN) != 0 ||
511 (hdr_v2->ver_cmd & PP2_VERSION_MASK) != PP2_VERSION) {
512 conn->err_code = CO_ER_PRX_NOT_HDR;
513 goto fail;
514 }
515
516 if (trash.len < PP2_HEADER_LEN + ntohs(hdr_v2->len))
517 goto missing;
518
519 switch (hdr_v2->ver_cmd & PP2_CMD_MASK) {
520 case 0x01: /* PROXY command */
521 switch (hdr_v2->fam) {
522 case 0x11: /* TCPv4 */
KOVACS Krisztianefd3aa92014-11-19 10:53:20 +0100523 if (ntohs(hdr_v2->len) < PP2_ADDR_LEN_INET)
524 goto bad_header;
525
Willy Tarreau77992672014-06-14 11:06:17 +0200526 ((struct sockaddr_in *)&conn->addr.from)->sin_family = AF_INET;
527 ((struct sockaddr_in *)&conn->addr.from)->sin_addr.s_addr = hdr_v2->addr.ip4.src_addr;
528 ((struct sockaddr_in *)&conn->addr.from)->sin_port = hdr_v2->addr.ip4.src_port;
529 ((struct sockaddr_in *)&conn->addr.to)->sin_family = AF_INET;
530 ((struct sockaddr_in *)&conn->addr.to)->sin_addr.s_addr = hdr_v2->addr.ip4.dst_addr;
531 ((struct sockaddr_in *)&conn->addr.to)->sin_port = hdr_v2->addr.ip4.dst_port;
532 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
KOVACS Krisztian7209c202015-07-03 14:09:10 +0200533 tlv_offset = PP2_HEADER_LEN + PP2_ADDR_LEN_INET;
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100534 tlv_length = ntohs(hdr_v2->len) - PP2_ADDR_LEN_INET;
Willy Tarreau77992672014-06-14 11:06:17 +0200535 break;
536 case 0x21: /* TCPv6 */
KOVACS Krisztianefd3aa92014-11-19 10:53:20 +0100537 if (ntohs(hdr_v2->len) < PP2_ADDR_LEN_INET6)
538 goto bad_header;
539
Willy Tarreau77992672014-06-14 11:06:17 +0200540 ((struct sockaddr_in6 *)&conn->addr.from)->sin6_family = AF_INET6;
541 memcpy(&((struct sockaddr_in6 *)&conn->addr.from)->sin6_addr, hdr_v2->addr.ip6.src_addr, 16);
542 ((struct sockaddr_in6 *)&conn->addr.from)->sin6_port = hdr_v2->addr.ip6.src_port;
543 ((struct sockaddr_in6 *)&conn->addr.to)->sin6_family = AF_INET6;
544 memcpy(&((struct sockaddr_in6 *)&conn->addr.to)->sin6_addr, hdr_v2->addr.ip6.dst_addr, 16);
545 ((struct sockaddr_in6 *)&conn->addr.to)->sin6_port = hdr_v2->addr.ip6.dst_port;
546 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
KOVACS Krisztian7209c202015-07-03 14:09:10 +0200547 tlv_offset = PP2_HEADER_LEN + PP2_ADDR_LEN_INET6;
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100548 tlv_length = ntohs(hdr_v2->len) - PP2_ADDR_LEN_INET6;
Willy Tarreau77992672014-06-14 11:06:17 +0200549 break;
550 }
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100551
552 /* TLV parsing */
553 if (tlv_length > 0) {
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100554 while (tlv_offset + TLV_HEADER_SIZE <= trash.len) {
555 const struct tlv *tlv_packet = (struct tlv *) &trash.str[tlv_offset];
556 const int tlv_len = get_tlv_length(tlv_packet);
557 tlv_offset += tlv_len + TLV_HEADER_SIZE;
558
559 switch (tlv_packet->type) {
560#ifdef CONFIG_HAP_NS
561 case PP2_TYPE_NETNS: {
562 const struct netns_entry *ns;
563 ns = netns_store_lookup((char*)tlv_packet->value, tlv_len);
564 if (ns)
565 conn->proxy_netns = ns;
566 break;
567 }
568#endif
569 default:
570 break;
571 }
572 }
573 }
574
Willy Tarreau77992672014-06-14 11:06:17 +0200575 /* unsupported protocol, keep local connection address */
576 break;
577 case 0x00: /* LOCAL command */
578 /* keep local connection address for LOCAL */
579 break;
580 default:
581 goto bad_header; /* not a supported command */
582 }
583
584 trash.len = PP2_HEADER_LEN + ntohs(hdr_v2->len);
585 goto eat_header;
586
587 eat_header:
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200588 /* remove the PROXY line from the request. For this we re-read the
589 * exact line at once. If we don't get the exact same result, we
590 * fail.
591 */
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200592 do {
Willy Tarreau19d14ef2012-10-29 16:51:55 +0100593 int len2 = recv(conn->t.sock.fd, trash.str, trash.len, 0);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200594 if (len2 < 0 && errno == EINTR)
595 continue;
Willy Tarreau19d14ef2012-10-29 16:51:55 +0100596 if (len2 != trash.len)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100597 goto recv_abort;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200598 } while (0);
599
600 conn->flags &= ~flag;
601 return 1;
602
603 missing:
604 /* Missing data. Since we're using MSG_PEEK, we can only poll again if
605 * we have not read anything. Otherwise we need to fail because we won't
606 * be able to poll anymore.
607 */
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100608 conn->err_code = CO_ER_PRX_TRUNCATED;
609 goto fail;
610
611 bad_header:
612 /* This is not a valid proxy protocol header */
613 conn->err_code = CO_ER_PRX_BAD_HDR;
614 goto fail;
615
616 recv_abort:
617 conn->err_code = CO_ER_PRX_ABORT;
Willy Tarreau26f4a042013-12-04 23:44:10 +0100618 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH;
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100619 goto fail;
620
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200621 fail:
Willy Tarreaud486ef52012-12-10 17:03:52 +0100622 __conn_sock_stop_both(conn);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200623 conn->flags |= CO_FL_ERROR;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200624 return 0;
625}
626
David Safb76832014-05-08 23:42:08 -0400627int make_proxy_line(char *buf, int buf_len, struct server *srv, struct connection *remote)
628{
629 int ret = 0;
630
631 if (srv && (srv->pp_opts & SRV_PP_V2)) {
632 ret = make_proxy_line_v2(buf, buf_len, srv, remote);
633 }
634 else {
635 if (remote)
636 ret = make_proxy_line_v1(buf, buf_len, &remote->addr.from, &remote->addr.to);
637 else
638 ret = make_proxy_line_v1(buf, buf_len, NULL, NULL);
639 }
640
641 return ret;
642}
643
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200644/* Makes a PROXY protocol line from the two addresses. The output is sent to
645 * buffer <buf> for a maximum size of <buf_len> (including the trailing zero).
646 * It returns the number of bytes composing this line (including the trailing
647 * LF), or zero in case of failure (eg: not enough space). It supports TCP4,
Willy Tarreau2e1401a2013-10-01 11:41:55 +0200648 * TCP6 and "UNKNOWN" formats. If any of <src> or <dst> is null, UNKNOWN is
649 * emitted as well.
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200650 */
David Safb76832014-05-08 23:42:08 -0400651int make_proxy_line_v1(char *buf, int buf_len, struct sockaddr_storage *src, struct sockaddr_storage *dst)
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200652{
653 int ret = 0;
654
Willy Tarreau2e1401a2013-10-01 11:41:55 +0200655 if (src && dst && src->ss_family == dst->ss_family && src->ss_family == AF_INET) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200656 ret = snprintf(buf + ret, buf_len - ret, "PROXY TCP4 ");
657 if (ret >= buf_len)
658 return 0;
659
660 /* IPv4 src */
661 if (!inet_ntop(src->ss_family, &((struct sockaddr_in *)src)->sin_addr, buf + ret, buf_len - ret))
662 return 0;
663
664 ret += strlen(buf + ret);
665 if (ret >= buf_len)
666 return 0;
667
668 buf[ret++] = ' ';
669
670 /* IPv4 dst */
671 if (!inet_ntop(dst->ss_family, &((struct sockaddr_in *)dst)->sin_addr, buf + ret, buf_len - ret))
672 return 0;
673
674 ret += strlen(buf + ret);
675 if (ret >= buf_len)
676 return 0;
677
678 /* source and destination ports */
679 ret += snprintf(buf + ret, buf_len - ret, " %u %u\r\n",
680 ntohs(((struct sockaddr_in *)src)->sin_port),
681 ntohs(((struct sockaddr_in *)dst)->sin_port));
682 if (ret >= buf_len)
683 return 0;
684 }
Willy Tarreau2e1401a2013-10-01 11:41:55 +0200685 else if (src && dst && src->ss_family == dst->ss_family && src->ss_family == AF_INET6) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200686 ret = snprintf(buf + ret, buf_len - ret, "PROXY TCP6 ");
687 if (ret >= buf_len)
688 return 0;
689
690 /* IPv6 src */
691 if (!inet_ntop(src->ss_family, &((struct sockaddr_in6 *)src)->sin6_addr, buf + ret, buf_len - ret))
692 return 0;
693
694 ret += strlen(buf + ret);
695 if (ret >= buf_len)
696 return 0;
697
698 buf[ret++] = ' ';
699
700 /* IPv6 dst */
701 if (!inet_ntop(dst->ss_family, &((struct sockaddr_in6 *)dst)->sin6_addr, buf + ret, buf_len - ret))
702 return 0;
703
704 ret += strlen(buf + ret);
705 if (ret >= buf_len)
706 return 0;
707
708 /* source and destination ports */
709 ret += snprintf(buf + ret, buf_len - ret, " %u %u\r\n",
710 ntohs(((struct sockaddr_in6 *)src)->sin6_port),
711 ntohs(((struct sockaddr_in6 *)dst)->sin6_port));
712 if (ret >= buf_len)
713 return 0;
714 }
715 else {
716 /* unknown family combination */
717 ret = snprintf(buf, buf_len, "PROXY UNKNOWN\r\n");
718 if (ret >= buf_len)
719 return 0;
720 }
721 return ret;
722}
David Safb76832014-05-08 23:42:08 -0400723
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100724#if defined(USE_OPENSSL) || defined(CONFIG_HAP_NS)
725static int make_tlv(char *dest, int dest_len, char type, uint16_t length, const char *value)
David Safb76832014-05-08 23:42:08 -0400726{
727 struct tlv *tlv;
728
729 if (!dest || (length + sizeof(*tlv) > dest_len))
730 return 0;
731
732 tlv = (struct tlv *)dest;
733
734 tlv->type = type;
735 tlv->length_hi = length >> 8;
736 tlv->length_lo = length & 0x00ff;
737 memcpy(tlv->value, value, length);
738 return length + sizeof(*tlv);
739}
740#endif
741
742int make_proxy_line_v2(char *buf, int buf_len, struct server *srv, struct connection *remote)
743{
Willy Tarreau8fccfa22014-06-14 08:28:06 +0200744 const char pp2_signature[] = PP2_SIGNATURE;
David Safb76832014-05-08 23:42:08 -0400745 int ret = 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +0200746 struct proxy_hdr_v2 *hdr = (struct proxy_hdr_v2 *)buf;
David Safb76832014-05-08 23:42:08 -0400747 struct sockaddr_storage null_addr = {0};
748 struct sockaddr_storage *src = &null_addr;
749 struct sockaddr_storage *dst = &null_addr;
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100750
David Safb76832014-05-08 23:42:08 -0400751#ifdef USE_OPENSSL
David Safb76832014-05-08 23:42:08 -0400752 char *value = NULL;
753 struct tlv_ssl *tlv;
754 int ssl_tlv_len = 0;
Dave McCowan77d1f012014-07-17 14:34:01 -0400755 struct chunk *cn_trash;
David Safb76832014-05-08 23:42:08 -0400756#endif
757
758 if (buf_len < PP2_HEADER_LEN)
759 return 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +0200760 memcpy(hdr->sig, pp2_signature, PP2_SIGNATURE_LEN);
David Safb76832014-05-08 23:42:08 -0400761
762 if (remote) {
763 src = &remote->addr.from;
764 dst = &remote->addr.to;
765 }
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100766
David Safb76832014-05-08 23:42:08 -0400767 if (src && dst && src->ss_family == dst->ss_family && src->ss_family == AF_INET) {
768 if (buf_len < PP2_HDR_LEN_INET)
769 return 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +0200770 hdr->ver_cmd = PP2_VERSION | PP2_CMD_PROXY;
771 hdr->fam = PP2_FAM_INET | PP2_TRANS_STREAM;
772 hdr->addr.ip4.src_addr = ((struct sockaddr_in *)src)->sin_addr.s_addr;
773 hdr->addr.ip4.dst_addr = ((struct sockaddr_in *)dst)->sin_addr.s_addr;
774 hdr->addr.ip4.src_port = ((struct sockaddr_in *)src)->sin_port;
775 hdr->addr.ip4.dst_port = ((struct sockaddr_in *)dst)->sin_port;
David Safb76832014-05-08 23:42:08 -0400776 ret = PP2_HDR_LEN_INET;
777 }
778 else if (src && dst && src->ss_family == dst->ss_family && src->ss_family == AF_INET6) {
779 if (buf_len < PP2_HDR_LEN_INET6)
780 return 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +0200781 hdr->ver_cmd = PP2_VERSION | PP2_CMD_PROXY;
782 hdr->fam = PP2_FAM_INET6 | PP2_TRANS_STREAM;
783 memcpy(hdr->addr.ip6.src_addr, &((struct sockaddr_in6 *)src)->sin6_addr, 16);
784 memcpy(hdr->addr.ip6.dst_addr, &((struct sockaddr_in6 *)dst)->sin6_addr, 16);
785 hdr->addr.ip6.src_port = ((struct sockaddr_in6 *)src)->sin6_port;
786 hdr->addr.ip6.dst_port = ((struct sockaddr_in6 *)dst)->sin6_port;
David Safb76832014-05-08 23:42:08 -0400787 ret = PP2_HDR_LEN_INET6;
788 }
789 else {
790 if (buf_len < PP2_HDR_LEN_UNSPEC)
791 return 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +0200792 hdr->ver_cmd = PP2_VERSION | PP2_CMD_LOCAL;
793 hdr->fam = PP2_FAM_UNSPEC | PP2_TRANS_UNSPEC;
David Safb76832014-05-08 23:42:08 -0400794 ret = PP2_HDR_LEN_UNSPEC;
795 }
796
797#ifdef USE_OPENSSL
798 if (srv->pp_opts & SRV_PP_V2_SSL) {
799 if ((buf_len - ret) < sizeof(struct tlv_ssl))
800 return 0;
801 tlv = (struct tlv_ssl *)&buf[ret];
802 memset(tlv, 0, sizeof(struct tlv_ssl));
803 ssl_tlv_len += sizeof(struct tlv_ssl);
804 tlv->tlv.type = PP2_TYPE_SSL;
805 if (ssl_sock_is_ssl(remote)) {
806 tlv->client |= PP2_CLIENT_SSL;
807 value = ssl_sock_get_version(remote);
808 if (value) {
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100809 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len-ret-ssl_tlv_len), PP2_TYPE_SSL_VERSION, strlen(value), value);
David Safb76832014-05-08 23:42:08 -0400810 }
Dave McCowan328fb582014-07-30 10:39:13 -0400811 if (ssl_sock_get_cert_used_sess(remote)) {
812 tlv->client |= PP2_CLIENT_CERT_SESS;
David Safb76832014-05-08 23:42:08 -0400813 tlv->verify = htonl(ssl_sock_get_verify_result(remote));
Dave McCowan328fb582014-07-30 10:39:13 -0400814 if (ssl_sock_get_cert_used_conn(remote))
815 tlv->client |= PP2_CLIENT_CERT_CONN;
David Safb76832014-05-08 23:42:08 -0400816 }
817 if (srv->pp_opts & SRV_PP_V2_SSL_CN) {
Dave McCowan77d1f012014-07-17 14:34:01 -0400818 cn_trash = get_trash_chunk();
Willy Tarreau3b9a0c92014-07-19 06:37:33 +0200819 if (ssl_sock_get_remote_common_name(remote, cn_trash) > 0) {
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100820 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_TYPE_SSL_CN, cn_trash->len, cn_trash->str);
David Safb76832014-05-08 23:42:08 -0400821 }
822 }
823 }
824 tlv->tlv.length_hi = (uint16_t)(ssl_tlv_len - sizeof(struct tlv)) >> 8;
825 tlv->tlv.length_lo = (uint16_t)(ssl_tlv_len - sizeof(struct tlv)) & 0x00ff;
826 ret += ssl_tlv_len;
827 }
828#endif
829
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100830#ifdef CONFIG_HAP_NS
831 if (remote && (remote->proxy_netns)) {
832 if ((buf_len - ret) < sizeof(struct tlv))
833 return 0;
834 ret += make_tlv(&buf[ret], buf_len, PP2_TYPE_NETNS, remote->proxy_netns->name_len, remote->proxy_netns->node.key);
835 }
836#endif
837
Willy Tarreau8fccfa22014-06-14 08:28:06 +0200838 hdr->len = htons((uint16_t)(ret - PP2_HEADER_LEN));
David Safb76832014-05-08 23:42:08 -0400839
840 return ret;
841}