blob: e9dbc9c0b6de03dc2b2e9a41966509a8a44d1f56 [file] [log] [blame]
Willy Tarreaue6b98942007-10-29 01:09:36 +01001/*
2 * AF_INET/AF_INET6 SOCK_STREAM protocol layer (tcp)
3 *
Willy Tarreaud4c33c82013-01-07 21:59:07 +01004 * Copyright 2000-2013 Willy Tarreau <w@1wt.eu>
Willy Tarreaue6b98942007-10-29 01:09:36 +01005 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
13#include <ctype.h>
14#include <errno.h>
15#include <fcntl.h>
16#include <stdio.h>
17#include <stdlib.h>
18#include <string.h>
19#include <time.h>
20
21#include <sys/param.h>
22#include <sys/socket.h>
23#include <sys/stat.h>
24#include <sys/types.h>
25#include <sys/un.h>
26
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +040027#include <netinet/tcp.h>
28
Willy Tarreaub6866442008-07-14 23:54:42 +020029#include <common/cfgparse.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010030#include <common/compat.h>
31#include <common/config.h>
32#include <common/debug.h>
33#include <common/errors.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010034#include <common/mini-clist.h>
35#include <common/standard.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010036
Willy Tarreaue6b98942007-10-29 01:09:36 +010037#include <types/global.h>
Willy Tarreau18bf01e2014-06-13 16:18:52 +020038#include <types/capture.h>
Willy Tarreau9650f372009-08-16 14:02:45 +020039#include <types/server.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010040
41#include <proto/acl.h>
Willy Tarreau9fcb9842012-04-20 14:45:49 +020042#include <proto/arg.h>
Willy Tarreauc7e42382012-08-24 19:22:53 +020043#include <proto/channel.h>
Willy Tarreaud2274c62012-07-06 14:29:45 +020044#include <proto/connection.h>
Willy Tarreaudd2f85e2012-09-02 22:34:23 +020045#include <proto/fd.h>
Willy Tarreaud1d54542012-09-12 22:58:11 +020046#include <proto/listener.h>
Willy Tarreau9650f372009-08-16 14:02:45 +020047#include <proto/log.h>
48#include <proto/port_range.h>
Willy Tarreaud1d54542012-09-12 22:58:11 +020049#include <proto/protocol.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010050#include <proto/proto_tcp.h>
Willy Tarreaub6866442008-07-14 23:54:42 +020051#include <proto/proxy.h>
Willy Tarreaucd3b0942012-04-27 21:52:18 +020052#include <proto/sample.h>
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +020053#include <proto/session.h>
Willy Tarreaua975b8f2010-06-05 19:13:27 +020054#include <proto/stick_table.h>
Willy Tarreaucc1e04b2013-09-11 23:20:29 +020055#include <proto/stream_interface.h>
Willy Tarreaua975b8f2010-06-05 19:13:27 +020056#include <proto/task.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010057
Willy Tarreaue8c66af2008-01-13 18:40:14 +010058#ifdef CONFIG_HAP_CTTPROXY
59#include <import/ip_tproxy.h>
60#endif
61
Emeric Bruncf20bf12010-10-22 16:06:11 +020062static int tcp_bind_listeners(struct protocol *proto, char *errmsg, int errlen);
63static int tcp_bind_listener(struct listener *listener, char *errmsg, int errlen);
Willy Tarreaue6b98942007-10-29 01:09:36 +010064
65/* Note: must not be declared <const> as its list will be overwritten */
66static struct protocol proto_tcpv4 = {
67 .name = "tcpv4",
68 .sock_domain = AF_INET,
69 .sock_type = SOCK_STREAM,
70 .sock_prot = IPPROTO_TCP,
71 .sock_family = AF_INET,
72 .sock_addrlen = sizeof(struct sockaddr_in),
73 .l3_addrlen = 32/8,
Willy Tarreaubbebbbf2012-05-07 21:22:09 +020074 .accept = &listener_accept,
Willy Tarreau26d8c592012-05-07 18:12:14 +020075 .connect = tcp_connect_server,
Emeric Bruncf20bf12010-10-22 16:06:11 +020076 .bind = tcp_bind_listener,
Willy Tarreaue6b98942007-10-29 01:09:36 +010077 .bind_all = tcp_bind_listeners,
78 .unbind_all = unbind_all_listeners,
79 .enable_all = enable_all_listeners,
Willy Tarreau59b94792012-05-11 16:16:40 +020080 .get_src = tcp_get_src,
81 .get_dst = tcp_get_dst,
Willy Tarreau2b57cb82013-06-10 19:56:38 +020082 .drain = tcp_drain,
Willy Tarreaue6b98942007-10-29 01:09:36 +010083 .listeners = LIST_HEAD_INIT(proto_tcpv4.listeners),
84 .nb_listeners = 0,
85};
86
87/* Note: must not be declared <const> as its list will be overwritten */
88static struct protocol proto_tcpv6 = {
89 .name = "tcpv6",
90 .sock_domain = AF_INET6,
91 .sock_type = SOCK_STREAM,
92 .sock_prot = IPPROTO_TCP,
93 .sock_family = AF_INET6,
94 .sock_addrlen = sizeof(struct sockaddr_in6),
95 .l3_addrlen = 128/8,
Willy Tarreaubbebbbf2012-05-07 21:22:09 +020096 .accept = &listener_accept,
Willy Tarreau26d8c592012-05-07 18:12:14 +020097 .connect = tcp_connect_server,
Emeric Bruncf20bf12010-10-22 16:06:11 +020098 .bind = tcp_bind_listener,
Willy Tarreaue6b98942007-10-29 01:09:36 +010099 .bind_all = tcp_bind_listeners,
100 .unbind_all = unbind_all_listeners,
101 .enable_all = enable_all_listeners,
Willy Tarreau59b94792012-05-11 16:16:40 +0200102 .get_src = tcp_get_src,
103 .get_dst = tcp_get_dst,
Willy Tarreau2b57cb82013-06-10 19:56:38 +0200104 .drain = tcp_drain,
Willy Tarreaue6b98942007-10-29 01:09:36 +0100105 .listeners = LIST_HEAD_INIT(proto_tcpv6.listeners),
106 .nb_listeners = 0,
107};
108
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100109
David du Colombier6f5ccb12011-03-10 22:26:24 +0100110/* Binds ipv4/ipv6 address <local> to socket <fd>, unless <flags> is set, in which
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100111 * case we try to bind <remote>. <flags> is a 2-bit field consisting of :
112 * - 0 : ignore remote address (may even be a NULL pointer)
113 * - 1 : use provided address
114 * - 2 : use provided port
115 * - 3 : use both
116 *
117 * The function supports multiple foreign binding methods :
118 * - linux_tproxy: we directly bind to the foreign address
119 * - cttproxy: we bind to a local address then nat.
120 * The second one can be used as a fallback for the first one.
121 * This function returns 0 when everything's OK, 1 if it could not bind, to the
122 * local address, 2 if it could not bind to the foreign address.
123 */
David du Colombier6f5ccb12011-03-10 22:26:24 +0100124int tcp_bind_socket(int fd, int flags, struct sockaddr_storage *local, struct sockaddr_storage *remote)
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100125{
David du Colombier6f5ccb12011-03-10 22:26:24 +0100126 struct sockaddr_storage bind_addr;
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100127 int foreign_ok = 0;
128 int ret;
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100129 static int ip_transp_working = 1;
David du Colombier65c17962012-07-13 14:34:59 +0200130 static int ip6_transp_working = 1;
Pieter Baauwd551fb52013-05-08 22:49:23 +0200131
David du Colombier65c17962012-07-13 14:34:59 +0200132 switch (local->ss_family) {
133 case AF_INET:
134 if (flags && ip_transp_working) {
Pieter Baauwd551fb52013-05-08 22:49:23 +0200135 /* This deserves some explanation. Some platforms will support
136 * multiple combinations of certain methods, so we try the
137 * supported ones until one succeeds.
138 */
139 if (0
140#if defined(IP_TRANSPARENT)
141 || (setsockopt(fd, SOL_IP, IP_TRANSPARENT, &one, sizeof(one)) == 0)
142#endif
143#if defined(IP_FREEBIND)
144 || (setsockopt(fd, SOL_IP, IP_FREEBIND, &one, sizeof(one)) == 0)
145#endif
Pieter Baauwff30b662013-05-08 23:22:39 +0200146#if defined(IP_BINDANY)
147 || (setsockopt(fd, IPPROTO_IP, IP_BINDANY, &one, sizeof(one)) == 0)
148#endif
Pieter Baauw1eb75922013-05-08 23:30:23 +0200149#if defined(SO_BINDANY)
150 || (setsockopt(fd, SOL_SOCKET, SO_BINDANY, &one, sizeof(one)) == 0)
151#endif
Pieter Baauwd551fb52013-05-08 22:49:23 +0200152 )
David du Colombier65c17962012-07-13 14:34:59 +0200153 foreign_ok = 1;
154 else
155 ip_transp_working = 0;
156 }
157 break;
158 case AF_INET6:
159 if (flags && ip6_transp_working) {
Pieter Baauwd551fb52013-05-08 22:49:23 +0200160 if (0
161#if defined(IPV6_TRANSPARENT)
162 || (setsockopt(fd, SOL_IPV6, IPV6_TRANSPARENT, &one, sizeof(one)) == 0)
163#endif
Lukas Tribus7640e722014-03-03 21:10:51 +0100164#if defined(IP_FREEBIND)
165 || (setsockopt(fd, SOL_IP, IP_FREEBIND, &one, sizeof(one)) == 0)
166#endif
Pieter Baauwff30b662013-05-08 23:22:39 +0200167#if defined(IPV6_BINDANY)
168 || (setsockopt(fd, IPPROTO_IPV6, IPV6_BINDANY, &one, sizeof(one)) == 0)
169#endif
Pieter Baauw1eb75922013-05-08 23:30:23 +0200170#if defined(SO_BINDANY)
171 || (setsockopt(fd, SOL_SOCKET, SO_BINDANY, &one, sizeof(one)) == 0)
172#endif
Pieter Baauwd551fb52013-05-08 22:49:23 +0200173 )
David du Colombier65c17962012-07-13 14:34:59 +0200174 foreign_ok = 1;
175 else
176 ip6_transp_working = 0;
177 }
178 break;
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100179 }
Pieter Baauwd551fb52013-05-08 22:49:23 +0200180
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100181 if (flags) {
182 memset(&bind_addr, 0, sizeof(bind_addr));
Willy Tarreau96dd0792011-04-19 07:20:57 +0200183 bind_addr.ss_family = remote->ss_family;
David du Colombier6f5ccb12011-03-10 22:26:24 +0100184 switch (remote->ss_family) {
185 case AF_INET:
186 if (flags & 1)
187 ((struct sockaddr_in *)&bind_addr)->sin_addr = ((struct sockaddr_in *)remote)->sin_addr;
188 if (flags & 2)
189 ((struct sockaddr_in *)&bind_addr)->sin_port = ((struct sockaddr_in *)remote)->sin_port;
190 break;
191 case AF_INET6:
192 if (flags & 1)
193 ((struct sockaddr_in6 *)&bind_addr)->sin6_addr = ((struct sockaddr_in6 *)remote)->sin6_addr;
194 if (flags & 2)
195 ((struct sockaddr_in6 *)&bind_addr)->sin6_port = ((struct sockaddr_in6 *)remote)->sin6_port;
196 break;
Willy Tarreau5dc1e982011-12-16 21:25:11 +0100197 default:
198 /* we don't want to try to bind to an unknown address family */
199 foreign_ok = 0;
David du Colombier6f5ccb12011-03-10 22:26:24 +0100200 }
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100201 }
202
Simon Hormande072bd2011-06-24 15:11:37 +0900203 setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one));
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100204 if (foreign_ok) {
Willy Tarreau9cf8d3f2014-05-09 22:56:10 +0200205 if (is_inet_addr(&bind_addr)) {
Willy Tarreau5f2877a2012-10-26 19:57:58 +0200206 ret = bind(fd, (struct sockaddr *)&bind_addr, get_addr_len(&bind_addr));
207 if (ret < 0)
208 return 2;
209 }
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100210 }
211 else {
Willy Tarreau9cf8d3f2014-05-09 22:56:10 +0200212 if (is_inet_addr(local)) {
Willy Tarreau5f2877a2012-10-26 19:57:58 +0200213 ret = bind(fd, (struct sockaddr *)local, get_addr_len(local));
214 if (ret < 0)
215 return 1;
216 }
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100217 }
218
219 if (!flags)
220 return 0;
221
222#ifdef CONFIG_HAP_CTTPROXY
Willy Tarreau6f831b42011-03-20 14:03:54 +0100223 if (!foreign_ok && remote->ss_family == AF_INET) {
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100224 struct in_tproxy itp1, itp2;
225 memset(&itp1, 0, sizeof(itp1));
226
227 itp1.op = TPROXY_ASSIGN;
Willy Tarreau6f831b42011-03-20 14:03:54 +0100228 itp1.v.addr.faddr = ((struct sockaddr_in *)&bind_addr)->sin_addr;
229 itp1.v.addr.fport = ((struct sockaddr_in *)&bind_addr)->sin_port;
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100230
231 /* set connect flag on socket */
232 itp2.op = TPROXY_FLAGS;
233 itp2.v.flags = ITP_CONNECT | ITP_ONCE;
234
235 if (setsockopt(fd, SOL_IP, IP_TPROXY, &itp1, sizeof(itp1)) != -1 &&
236 setsockopt(fd, SOL_IP, IP_TPROXY, &itp2, sizeof(itp2)) != -1) {
237 foreign_ok = 1;
238 }
239 }
240#endif
241 if (!foreign_ok)
242 /* we could not bind to a foreign address */
243 return 2;
244
245 return 0;
246}
Willy Tarreaue6b98942007-10-29 01:09:36 +0100247
Willy Tarreau9650f372009-08-16 14:02:45 +0200248
249/*
Willy Tarreau14f8e862012-08-30 22:23:13 +0200250 * This function initiates a TCP connection establishment to the target assigned
251 * to connection <conn> using (si->{target,addr.to}). A source address may be
252 * pointed to by conn->addr.from in case of transparent proxying. Normal source
253 * bind addresses are still determined locally (due to the possible need of a
254 * source port). conn->target may point either to a valid server or to a backend,
Willy Tarreau3fdb3662012-11-12 00:42:33 +0100255 * depending on conn->target. Only OBJ_TYPE_PROXY and OBJ_TYPE_SERVER are
Willy Tarreauf0837b22012-11-24 10:24:27 +0100256 * supported. The <data> parameter is a boolean indicating whether there are data
257 * waiting for being sent or not, in order to adjust data write polling and on
258 * some platforms, the ability to avoid an empty initial ACK. The <delack> argument
259 * allows the caller to force using a delayed ACK when establishing the connection :
260 * - 0 = no delayed ACK unless data are advertised and backend has tcp-smart-connect
261 * - 1 = delayed ACK if backend has tcp-smart-connect, regardless of data
262 * - 2 = delayed ACK regardless of backend options
Willy Tarreaub1d67742010-03-29 19:36:59 +0200263 *
Willy Tarreau1ec74bf2013-10-24 21:45:00 +0200264 * Note that a pending send_proxy message accounts for data.
265 *
Willy Tarreau9650f372009-08-16 14:02:45 +0200266 * It can return one of :
267 * - SN_ERR_NONE if everything's OK
268 * - SN_ERR_SRVTO if there are no more servers
269 * - SN_ERR_SRVCL if the connection was refused by the server
270 * - SN_ERR_PRXCOND if the connection has been limited by the proxy (maxconn)
271 * - SN_ERR_RESOURCE if a system resource is lacking (eg: fd limits, ports, ...)
272 * - SN_ERR_INTERNAL for any other purely internal errors
273 * Additionnally, in the case of SN_ERR_RESOURCE, an emergency log will be emitted.
Willy Tarreau6b0a8502012-11-23 08:51:32 +0100274 *
275 * The connection's fd is inserted only when SN_ERR_NONE is returned, otherwise
276 * it's invalid and the caller has nothing to do.
Willy Tarreau9650f372009-08-16 14:02:45 +0200277 */
Willy Tarreauf1536862011-03-03 18:27:32 +0100278
Willy Tarreauf0837b22012-11-24 10:24:27 +0100279int tcp_connect_server(struct connection *conn, int data, int delack)
Willy Tarreau9650f372009-08-16 14:02:45 +0200280{
281 int fd;
Willy Tarreauac825402011-03-04 22:04:29 +0100282 struct server *srv;
283 struct proxy *be;
Willy Tarreaua4380b42012-12-08 22:49:11 +0100284 struct conn_src *src;
Willy Tarreauac825402011-03-04 22:04:29 +0100285
Willy Tarreau9ce70132014-01-24 16:08:19 +0100286 conn->flags = CO_FL_WAIT_L4_CONN; /* connection in progress */
287
Willy Tarreau3fdb3662012-11-12 00:42:33 +0100288 switch (obj_type(conn->target)) {
289 case OBJ_TYPE_PROXY:
290 be = objt_proxy(conn->target);
Willy Tarreauac825402011-03-04 22:04:29 +0100291 srv = NULL;
292 break;
Willy Tarreau3fdb3662012-11-12 00:42:33 +0100293 case OBJ_TYPE_SERVER:
294 srv = objt_server(conn->target);
Willy Tarreauac825402011-03-04 22:04:29 +0100295 be = srv->proxy;
296 break;
297 default:
Willy Tarreau9ce70132014-01-24 16:08:19 +0100298 conn->flags |= CO_FL_ERROR;
Willy Tarreauac825402011-03-04 22:04:29 +0100299 return SN_ERR_INTERNAL;
300 }
Willy Tarreau9650f372009-08-16 14:02:45 +0200301
Willy Tarreau986a9d22012-08-30 21:11:38 +0200302 if ((fd = conn->t.sock.fd = socket(conn->addr.to.ss_family, SOCK_STREAM, IPPROTO_TCP)) == -1) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200303 qfprintf(stderr, "Cannot get a server socket.\n");
304
Willy Tarreau9ce70132014-01-24 16:08:19 +0100305 if (errno == ENFILE) {
306 conn->err_code = CO_ER_SYS_FDLIM;
Willy Tarreau9650f372009-08-16 14:02:45 +0200307 send_log(be, LOG_EMERG,
308 "Proxy %s reached system FD limit at %d. Please check system tunables.\n",
309 be->id, maxfd);
Willy Tarreau9ce70132014-01-24 16:08:19 +0100310 }
311 else if (errno == EMFILE) {
312 conn->err_code = CO_ER_PROC_FDLIM;
Willy Tarreau9650f372009-08-16 14:02:45 +0200313 send_log(be, LOG_EMERG,
314 "Proxy %s reached process FD limit at %d. Please check 'ulimit-n' and restart.\n",
315 be->id, maxfd);
Willy Tarreau9ce70132014-01-24 16:08:19 +0100316 }
317 else if (errno == ENOBUFS || errno == ENOMEM) {
318 conn->err_code = CO_ER_SYS_MEMLIM;
Willy Tarreau9650f372009-08-16 14:02:45 +0200319 send_log(be, LOG_EMERG,
320 "Proxy %s reached system memory limit at %d sockets. Please check system tunables.\n",
321 be->id, maxfd);
Willy Tarreau9ce70132014-01-24 16:08:19 +0100322 }
323 else if (errno == EAFNOSUPPORT || errno == EPROTONOSUPPORT) {
324 conn->err_code = CO_ER_NOPROTO;
325 }
326 else
327 conn->err_code = CO_ER_SOCK_ERR;
328
Willy Tarreau9650f372009-08-16 14:02:45 +0200329 /* this is a resource error */
Willy Tarreau9ce70132014-01-24 16:08:19 +0100330 conn->flags |= CO_FL_ERROR;
Willy Tarreau9650f372009-08-16 14:02:45 +0200331 return SN_ERR_RESOURCE;
332 }
333
334 if (fd >= global.maxsock) {
335 /* do not log anything there, it's a normal condition when this option
336 * is used to serialize connections to a server !
337 */
338 Alert("socket(): not enough free sockets. Raise -n argument. Giving up.\n");
339 close(fd);
Willy Tarreau9ce70132014-01-24 16:08:19 +0100340 conn->err_code = CO_ER_CONF_FDLIM;
341 conn->flags |= CO_FL_ERROR;
Willy Tarreau9650f372009-08-16 14:02:45 +0200342 return SN_ERR_PRXCOND; /* it is a configuration limit */
343 }
344
345 if ((fcntl(fd, F_SETFL, O_NONBLOCK)==-1) ||
Simon Hormande072bd2011-06-24 15:11:37 +0900346 (setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &one, sizeof(one)) == -1)) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200347 qfprintf(stderr,"Cannot set client socket to non blocking mode.\n");
348 close(fd);
Willy Tarreau9ce70132014-01-24 16:08:19 +0100349 conn->err_code = CO_ER_SOCK_ERR;
350 conn->flags |= CO_FL_ERROR;
Willy Tarreau9650f372009-08-16 14:02:45 +0200351 return SN_ERR_INTERNAL;
352 }
353
354 if (be->options & PR_O_TCP_SRV_KA)
Simon Hormande072bd2011-06-24 15:11:37 +0900355 setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, &one, sizeof(one));
Willy Tarreau9650f372009-08-16 14:02:45 +0200356
Willy Tarreau9650f372009-08-16 14:02:45 +0200357 /* allow specific binding :
358 * - server-specific at first
359 * - proxy-specific next
360 */
Willy Tarreaua4380b42012-12-08 22:49:11 +0100361 if (srv && srv->conn_src.opts & CO_SRC_BIND)
362 src = &srv->conn_src;
363 else if (be->conn_src.opts & CO_SRC_BIND)
364 src = &be->conn_src;
365 else
366 src = NULL;
367
368 if (src) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200369 int ret, flags = 0;
370
Willy Tarreau9cf8d3f2014-05-09 22:56:10 +0200371 if (is_inet_addr(&conn->addr.from)) {
Willy Tarreaua4380b42012-12-08 22:49:11 +0100372 switch (src->opts & CO_SRC_TPROXY_MASK) {
Willy Tarreauef9a3602012-12-08 22:29:20 +0100373 case CO_SRC_TPROXY_ADDR:
374 case CO_SRC_TPROXY_CLI:
Willy Tarreau5f2877a2012-10-26 19:57:58 +0200375 flags = 3;
376 break;
Willy Tarreauef9a3602012-12-08 22:29:20 +0100377 case CO_SRC_TPROXY_CIP:
378 case CO_SRC_TPROXY_DYN:
Willy Tarreau5f2877a2012-10-26 19:57:58 +0200379 flags = 1;
380 break;
381 }
Willy Tarreau9650f372009-08-16 14:02:45 +0200382 }
Willy Tarreaub1d67742010-03-29 19:36:59 +0200383
Willy Tarreau9650f372009-08-16 14:02:45 +0200384#ifdef SO_BINDTODEVICE
385 /* Note: this might fail if not CAP_NET_RAW */
Willy Tarreaua4380b42012-12-08 22:49:11 +0100386 if (src->iface_name)
387 setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, src->iface_name, src->iface_len + 1);
Willy Tarreau9650f372009-08-16 14:02:45 +0200388#endif
389
Willy Tarreaua4380b42012-12-08 22:49:11 +0100390 if (src->sport_range) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200391 int attempts = 10; /* should be more than enough to find a spare port */
Willy Tarreaua4380b42012-12-08 22:49:11 +0100392 struct sockaddr_storage sa;
Willy Tarreau9650f372009-08-16 14:02:45 +0200393
394 ret = 1;
Willy Tarreaua4380b42012-12-08 22:49:11 +0100395 sa = src->source_addr;
Willy Tarreau9650f372009-08-16 14:02:45 +0200396
397 do {
398 /* note: in case of retry, we may have to release a previously
399 * allocated port, hence this loop's construct.
400 */
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200401 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
402 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200403
404 if (!attempts)
405 break;
406 attempts--;
407
Willy Tarreaua4380b42012-12-08 22:49:11 +0100408 fdinfo[fd].local_port = port_range_alloc_port(src->sport_range);
Willy Tarreau9ce70132014-01-24 16:08:19 +0100409 if (!fdinfo[fd].local_port) {
410 conn->err_code = CO_ER_PORT_RANGE;
Willy Tarreau9650f372009-08-16 14:02:45 +0200411 break;
Willy Tarreau9ce70132014-01-24 16:08:19 +0100412 }
Willy Tarreau9650f372009-08-16 14:02:45 +0200413
Willy Tarreaua4380b42012-12-08 22:49:11 +0100414 fdinfo[fd].port_range = src->sport_range;
415 set_host_port(&sa, fdinfo[fd].local_port);
Willy Tarreau9650f372009-08-16 14:02:45 +0200416
Willy Tarreaua4380b42012-12-08 22:49:11 +0100417 ret = tcp_bind_socket(fd, flags, &sa, &conn->addr.from);
Willy Tarreau9ce70132014-01-24 16:08:19 +0100418 if (ret != 0)
419 conn->err_code = CO_ER_CANT_BIND;
Willy Tarreau9650f372009-08-16 14:02:45 +0200420 } while (ret != 0); /* binding NOK */
421 }
422 else {
Willy Tarreaua4380b42012-12-08 22:49:11 +0100423 ret = tcp_bind_socket(fd, flags, &src->source_addr, &conn->addr.from);
Willy Tarreau9ce70132014-01-24 16:08:19 +0100424 if (ret != 0)
425 conn->err_code = CO_ER_CANT_BIND;
Willy Tarreau9650f372009-08-16 14:02:45 +0200426 }
427
Willy Tarreaua4380b42012-12-08 22:49:11 +0100428 if (unlikely(ret != 0)) {
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200429 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
430 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200431 close(fd);
432
Willy Tarreau9650f372009-08-16 14:02:45 +0200433 if (ret == 1) {
Willy Tarreaua4380b42012-12-08 22:49:11 +0100434 Alert("Cannot bind to source address before connect() for backend %s. Aborting.\n",
Willy Tarreau9650f372009-08-16 14:02:45 +0200435 be->id);
436 send_log(be, LOG_EMERG,
Willy Tarreaua4380b42012-12-08 22:49:11 +0100437 "Cannot bind to source address before connect() for backend %s.\n",
Willy Tarreau9650f372009-08-16 14:02:45 +0200438 be->id);
439 } else {
Willy Tarreaua4380b42012-12-08 22:49:11 +0100440 Alert("Cannot bind to tproxy source address before connect() for backend %s. Aborting.\n",
Willy Tarreau9650f372009-08-16 14:02:45 +0200441 be->id);
442 send_log(be, LOG_EMERG,
Willy Tarreaua4380b42012-12-08 22:49:11 +0100443 "Cannot bind to tproxy source address before connect() for backend %s.\n",
Willy Tarreau9650f372009-08-16 14:02:45 +0200444 be->id);
445 }
Willy Tarreau9ce70132014-01-24 16:08:19 +0100446 conn->flags |= CO_FL_ERROR;
Willy Tarreau9650f372009-08-16 14:02:45 +0200447 return SN_ERR_RESOURCE;
448 }
449 }
450
Willy Tarreau1ec74bf2013-10-24 21:45:00 +0200451 /* if a send_proxy is there, there are data */
452 data |= conn->send_proxy_ofs;
453
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400454#if defined(TCP_QUICKACK)
Willy Tarreau9650f372009-08-16 14:02:45 +0200455 /* disabling tcp quick ack now allows the first request to leave the
456 * machine with the first ACK. We only do this if there are pending
Willy Tarreauf0837b22012-11-24 10:24:27 +0100457 * data in the buffer.
Willy Tarreau9650f372009-08-16 14:02:45 +0200458 */
Willy Tarreauf0837b22012-11-24 10:24:27 +0100459 if (delack == 2 || ((delack || data) && (be->options2 & PR_O2_SMARTCON)))
Simon Hormande072bd2011-06-24 15:11:37 +0900460 setsockopt(fd, IPPROTO_TCP, TCP_QUICKACK, &zero, sizeof(zero));
Willy Tarreau9650f372009-08-16 14:02:45 +0200461#endif
462
Willy Tarreaue803de22010-01-21 17:43:04 +0100463 if (global.tune.server_sndbuf)
464 setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &global.tune.server_sndbuf, sizeof(global.tune.server_sndbuf));
465
466 if (global.tune.server_rcvbuf)
467 setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &global.tune.server_rcvbuf, sizeof(global.tune.server_rcvbuf));
468
Willy Tarreau986a9d22012-08-30 21:11:38 +0200469 if ((connect(fd, (struct sockaddr *)&conn->addr.to, get_addr_len(&conn->addr.to)) == -1) &&
Willy Tarreau9650f372009-08-16 14:02:45 +0200470 (errno != EINPROGRESS) && (errno != EALREADY) && (errno != EISCONN)) {
471
Willy Tarreaub1719512012-12-08 23:03:28 +0100472 if (errno == EAGAIN || errno == EADDRINUSE || errno == EADDRNOTAVAIL) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200473 char *msg;
Willy Tarreau9ce70132014-01-24 16:08:19 +0100474 if (errno == EAGAIN || errno == EADDRNOTAVAIL) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200475 msg = "no free ports";
Willy Tarreau9ce70132014-01-24 16:08:19 +0100476 conn->err_code = CO_ER_FREE_PORTS;
477 }
478 else {
Willy Tarreau9650f372009-08-16 14:02:45 +0200479 msg = "local address already in use";
Willy Tarreau9ce70132014-01-24 16:08:19 +0100480 conn->err_code = CO_ER_ADDR_INUSE;
481 }
Willy Tarreau9650f372009-08-16 14:02:45 +0200482
Willy Tarreaub1719512012-12-08 23:03:28 +0100483 qfprintf(stderr,"Connect() failed for backend %s: %s.\n", be->id, msg);
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200484 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
485 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200486 close(fd);
Willy Tarreaub1719512012-12-08 23:03:28 +0100487 send_log(be, LOG_ERR, "Connect() failed for backend %s: %s.\n", be->id, msg);
Willy Tarreau9ce70132014-01-24 16:08:19 +0100488 conn->flags |= CO_FL_ERROR;
Willy Tarreau9650f372009-08-16 14:02:45 +0200489 return SN_ERR_RESOURCE;
490 } else if (errno == ETIMEDOUT) {
491 //qfprintf(stderr,"Connect(): ETIMEDOUT");
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200492 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
493 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200494 close(fd);
Willy Tarreau9ce70132014-01-24 16:08:19 +0100495 conn->err_code = CO_ER_SOCK_ERR;
496 conn->flags |= CO_FL_ERROR;
Willy Tarreau9650f372009-08-16 14:02:45 +0200497 return SN_ERR_SRVTO;
498 } else {
499 // (errno == ECONNREFUSED || errno == ENETUNREACH || errno == EACCES || errno == EPERM)
500 //qfprintf(stderr,"Connect(): %d", errno);
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200501 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
502 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200503 close(fd);
Willy Tarreau9ce70132014-01-24 16:08:19 +0100504 conn->err_code = CO_ER_SOCK_ERR;
505 conn->flags |= CO_FL_ERROR;
Willy Tarreau9650f372009-08-16 14:02:45 +0200506 return SN_ERR_SRVCL;
507 }
508 }
509
Willy Tarreaufc8f1f02012-12-08 18:53:44 +0100510 conn->flags |= CO_FL_ADDR_TO_SET;
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200511
Willy Tarreau1ec74bf2013-10-24 21:45:00 +0200512 /* Prepare to send a few handshakes related to the on-wire protocol. */
513 if (conn->send_proxy_ofs)
Willy Tarreau57cd3e42013-10-24 22:01:26 +0200514 conn->flags |= CO_FL_SEND_PROXY;
Willy Tarreau1ec74bf2013-10-24 21:45:00 +0200515
Willy Tarreauf79c8172013-10-21 16:30:56 +0200516 conn_ctrl_init(conn); /* registers the FD */
Willy Tarreauad38ace2013-12-15 14:19:38 +0100517 fdtab[fd].linger_risk = 1; /* close hard if needed */
Willy Tarreau986a9d22012-08-30 21:11:38 +0200518 conn_sock_want_send(conn); /* for connect status */
Willy Tarreau15678ef2012-08-31 13:54:11 +0200519
Willy Tarreauf7bc57c2012-10-03 00:19:48 +0200520 if (conn_xprt_init(conn) < 0) {
Willy Tarreauf79c8172013-10-21 16:30:56 +0200521 conn_force_close(conn);
Willy Tarreau9ce70132014-01-24 16:08:19 +0100522 conn->flags |= CO_FL_ERROR;
Willy Tarreau15678ef2012-08-31 13:54:11 +0200523 return SN_ERR_RESOURCE;
Willy Tarreau184636e2012-09-06 14:04:41 +0200524 }
Willy Tarreau15678ef2012-08-31 13:54:11 +0200525
Willy Tarreau14f8e862012-08-30 22:23:13 +0200526 if (data)
Willy Tarreau986a9d22012-08-30 21:11:38 +0200527 conn_data_want_send(conn); /* prepare to send data if any */
Willy Tarreau9650f372009-08-16 14:02:45 +0200528
Willy Tarreau9650f372009-08-16 14:02:45 +0200529 return SN_ERR_NONE; /* connection is OK */
530}
531
532
Willy Tarreau59b94792012-05-11 16:16:40 +0200533/*
534 * Retrieves the source address for the socket <fd>, with <dir> indicating
535 * if we're a listener (=0) or an initiator (!=0). It returns 0 in case of
536 * success, -1 in case of error. The socket's source address is stored in
537 * <sa> for <salen> bytes.
538 */
539int tcp_get_src(int fd, struct sockaddr *sa, socklen_t salen, int dir)
540{
541 if (dir)
542 return getsockname(fd, sa, &salen);
543 else
544 return getpeername(fd, sa, &salen);
545}
546
547
548/*
549 * Retrieves the original destination address for the socket <fd>, with <dir>
550 * indicating if we're a listener (=0) or an initiator (!=0). In the case of a
551 * listener, if the original destination address was translated, the original
552 * address is retrieved. It returns 0 in case of success, -1 in case of error.
553 * The socket's source address is stored in <sa> for <salen> bytes.
554 */
555int tcp_get_dst(int fd, struct sockaddr *sa, socklen_t salen, int dir)
556{
557 if (dir)
558 return getpeername(fd, sa, &salen);
559#if defined(TPROXY) && defined(SO_ORIGINAL_DST)
560 else if (getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) == 0)
561 return 0;
562#endif
563 else
564 return getsockname(fd, sa, &salen);
565}
566
Willy Tarreau2b57cb82013-06-10 19:56:38 +0200567/* Tries to drain any pending incoming data from the socket to reach the
Willy Tarreau7f4bcc32014-01-20 11:26:12 +0100568 * receive shutdown. Returns positive if the shutdown was found, negative
569 * if EAGAIN was hit, otherwise zero. This is useful to decide whether we
570 * can close a connection cleanly are we must kill it hard.
Willy Tarreau2b57cb82013-06-10 19:56:38 +0200571 */
572int tcp_drain(int fd)
573{
574 int turns = 2;
575 int len;
576
577 while (turns) {
578#ifdef MSG_TRUNC_CLEARS_INPUT
579 len = recv(fd, NULL, INT_MAX, MSG_DONTWAIT | MSG_NOSIGNAL | MSG_TRUNC);
580 if (len == -1 && errno == EFAULT)
581#endif
582 len = recv(fd, trash.str, trash.size, MSG_DONTWAIT | MSG_NOSIGNAL);
583
Willy Tarreau3bd3e572014-01-20 11:56:37 +0100584 if (len == 0) {
585 /* cool, shutdown received */
586 fdtab[fd].linger_risk = 0;
Willy Tarreau2b57cb82013-06-10 19:56:38 +0200587 return 1;
Willy Tarreau3bd3e572014-01-20 11:56:37 +0100588 }
Willy Tarreau2b57cb82013-06-10 19:56:38 +0200589
590 if (len < 0) {
Willy Tarreauf817e9f2014-01-10 16:58:45 +0100591 if (errno == EAGAIN) {
592 /* connection not closed yet */
593 fd_cant_recv(fd);
Willy Tarreau7f4bcc32014-01-20 11:26:12 +0100594 return -1;
Willy Tarreauf817e9f2014-01-10 16:58:45 +0100595 }
Willy Tarreau2b57cb82013-06-10 19:56:38 +0200596 if (errno == EINTR) /* oops, try again */
597 continue;
598 /* other errors indicate a dead connection, fine. */
Willy Tarreau3bd3e572014-01-20 11:56:37 +0100599 fdtab[fd].linger_risk = 0;
Willy Tarreau2b57cb82013-06-10 19:56:38 +0200600 return 1;
601 }
602 /* OK we read some data, let's try again once */
603 turns--;
604 }
605 /* some data are still present, give up */
606 return 0;
607}
608
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200609/* This is the callback which is set when a connection establishment is pending
Willy Tarreauf12a20e2013-12-04 16:11:04 +0100610 * and we have nothing to send. It updates the FD polling status. It returns 0
611 * if it fails in a fatal way or needs to poll to go further, otherwise it
612 * returns non-zero and removes the CO_FL_WAIT_L4_CONN flag from the connection's
613 * flags. In case of error, it sets CO_FL_ERROR and leaves the error code in
614 * errno. The error checking is done in two passes in order to limit the number
615 * of syscalls in the normal case :
616 * - if POLL_ERR was reported by the poller, we check for a pending error on
617 * the socket before proceeding. If found, it's assigned to errno so that
618 * upper layers can see it.
619 * - otherwise connect() is used to check the connection state again, since
620 * the getsockopt return cannot reliably be used to know if the connection
621 * is still pending or ready. This one may often return an error as well,
622 * since we don't always have POLL_ERR (eg: OSX or cached events).
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200623 */
Willy Tarreau239d7182012-07-23 18:53:03 +0200624int tcp_connect_probe(struct connection *conn)
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200625{
Willy Tarreau239d7182012-07-23 18:53:03 +0200626 int fd = conn->t.sock.fd;
Willy Tarreauf12a20e2013-12-04 16:11:04 +0100627 socklen_t lskerr;
628 int skerr;
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200629
Willy Tarreau80184712012-07-06 14:54:49 +0200630 if (conn->flags & CO_FL_ERROR)
Willy Tarreauafad0e02012-08-09 14:45:22 +0200631 return 0;
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200632
Willy Tarreau3c728722014-01-23 13:50:42 +0100633 if (!conn_ctrl_ready(conn))
Willy Tarreauf79c8172013-10-21 16:30:56 +0200634 return 0;
635
Willy Tarreau80184712012-07-06 14:54:49 +0200636 if (!(conn->flags & CO_FL_WAIT_L4_CONN))
Willy Tarreau0b0c0972012-07-23 20:05:00 +0200637 return 1; /* strange we were called while ready */
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200638
Willy Tarreaufd803bb2014-01-20 15:13:07 +0100639 if (!fd_send_ready(fd))
640 return 0;
641
Willy Tarreauf12a20e2013-12-04 16:11:04 +0100642 /* we might be the first witness of FD_POLL_ERR. Note that FD_POLL_HUP
643 * without FD_POLL_IN also indicates a hangup without input data meaning
644 * there was no connection.
645 */
646 if (fdtab[fd].ev & FD_POLL_ERR ||
647 (fdtab[fd].ev & (FD_POLL_IN|FD_POLL_HUP)) == FD_POLL_HUP) {
648 skerr = 0;
649 lskerr = sizeof(skerr);
650 getsockopt(fd, SOL_SOCKET, SO_ERROR, &skerr, &lskerr);
651 errno = skerr;
652 if (errno == EAGAIN)
653 errno = 0;
654 if (errno)
655 goto out_error;
656 }
Willy Tarreau2da156f2012-07-23 15:07:23 +0200657
Willy Tarreauf12a20e2013-12-04 16:11:04 +0100658 /* Use connect() to check the state of the socket. This has the
659 * advantage of giving us the following info :
Willy Tarreau2c6be842012-07-06 17:12:34 +0200660 * - error
661 * - connecting (EALREADY, EINPROGRESS)
662 * - connected (EISCONN, 0)
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200663 */
Willy Tarreau986a9d22012-08-30 21:11:38 +0200664 if (connect(fd, (struct sockaddr *)&conn->addr.to, get_addr_len(&conn->addr.to)) < 0) {
Willy Tarreauf9dabec2012-08-17 17:33:53 +0200665 if (errno == EALREADY || errno == EINPROGRESS) {
Willy Tarreaud486ef52012-12-10 17:03:52 +0100666 __conn_sock_stop_recv(conn);
Willy Tarreaue1f50c42014-01-22 20:02:06 +0100667 fd_cant_send(fd);
Willy Tarreau0b0c0972012-07-23 20:05:00 +0200668 return 0;
Willy Tarreauf9dabec2012-08-17 17:33:53 +0200669 }
Willy Tarreaua190d592012-05-20 18:35:19 +0200670
Willy Tarreau2c6be842012-07-06 17:12:34 +0200671 if (errno && errno != EISCONN)
Willy Tarreaua190d592012-05-20 18:35:19 +0200672 goto out_error;
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200673
Willy Tarreau2c6be842012-07-06 17:12:34 +0200674 /* otherwise we're connected */
Willy Tarreaua190d592012-05-20 18:35:19 +0200675 }
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200676
Willy Tarreau076be252012-07-06 16:02:29 +0200677 /* The FD is ready now, we'll mark the connection as complete and
Willy Tarreauf7bc57c2012-10-03 00:19:48 +0200678 * forward the event to the transport layer which will notify the
679 * data layer.
Willy Tarreaua190d592012-05-20 18:35:19 +0200680 */
Willy Tarreau80184712012-07-06 14:54:49 +0200681 conn->flags &= ~CO_FL_WAIT_L4_CONN;
Willy Tarreau0b0c0972012-07-23 20:05:00 +0200682 return 1;
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200683
684 out_error:
Willy Tarreau0b0c0972012-07-23 20:05:00 +0200685 /* Write error on the file descriptor. Report it to the connection
686 * and disable polling on this FD.
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200687 */
Willy Tarreau3bd3e572014-01-20 11:56:37 +0100688 fdtab[fd].linger_risk = 0;
Willy Tarreau26f4a042013-12-04 23:44:10 +0100689 conn->flags |= CO_FL_ERROR | CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH;
Willy Tarreaud486ef52012-12-10 17:03:52 +0100690 __conn_sock_stop_both(conn);
Willy Tarreauafad0e02012-08-09 14:45:22 +0200691 return 0;
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200692}
693
Willy Tarreau59b94792012-05-11 16:16:40 +0200694
Willy Tarreaue6b98942007-10-29 01:09:36 +0100695/* This function tries to bind a TCPv4/v6 listener. It may return a warning or
Willy Tarreau8ab505b2013-01-24 01:41:38 +0100696 * an error message in <errmsg> if the message is at most <errlen> bytes long
697 * (including '\0'). Note that <errmsg> may be NULL if <errlen> is also zero.
698 * The return value is composed from ERR_ABORT, ERR_WARN,
Willy Tarreaue6b98942007-10-29 01:09:36 +0100699 * ERR_ALERT, ERR_RETRYABLE and ERR_FATAL. ERR_NONE indicates that everything
700 * was alright and that no message was returned. ERR_RETRYABLE means that an
701 * error occurred but that it may vanish after a retry (eg: port in use), and
Aman Guptad94991d2012-04-06 17:39:26 -0700702 * ERR_FATAL indicates a non-fixable error. ERR_WARN and ERR_ALERT do not alter
Willy Tarreaue6b98942007-10-29 01:09:36 +0100703 * the meaning of the error, but just indicate that a message is present which
704 * should be displayed with the respective level. Last, ERR_ABORT indicates
705 * that it's pointless to try to start other listeners. No error message is
706 * returned if errlen is NULL.
707 */
708int tcp_bind_listener(struct listener *listener, char *errmsg, int errlen)
709{
710 __label__ tcp_return, tcp_close_return;
711 int fd, err;
Willy Tarreau40aa0702013-03-10 23:51:38 +0100712 int ext, ready;
713 socklen_t ready_len;
Willy Tarreaue6b98942007-10-29 01:09:36 +0100714 const char *msg = NULL;
715
716 /* ensure we never return garbage */
Willy Tarreau8ab505b2013-01-24 01:41:38 +0100717 if (errlen)
Willy Tarreaue6b98942007-10-29 01:09:36 +0100718 *errmsg = 0;
719
720 if (listener->state != LI_ASSIGNED)
721 return ERR_NONE; /* already bound */
722
723 err = ERR_NONE;
724
Willy Tarreau40aa0702013-03-10 23:51:38 +0100725 /* if the listener already has an fd assigned, then we were offered the
726 * fd by an external process (most likely the parent), and we don't want
727 * to create a new socket. However we still want to set a few flags on
728 * the socket.
729 */
730 fd = listener->fd;
731 ext = (fd >= 0);
732
733 if (!ext && (fd = socket(listener->addr.ss_family, SOCK_STREAM, IPPROTO_TCP)) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100734 err |= ERR_RETRYABLE | ERR_ALERT;
735 msg = "cannot create listening socket";
736 goto tcp_return;
737 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100738
Willy Tarreaue6b98942007-10-29 01:09:36 +0100739 if (fd >= global.maxsock) {
740 err |= ERR_FATAL | ERR_ABORT | ERR_ALERT;
741 msg = "not enough free sockets (raise '-n' parameter)";
742 goto tcp_close_return;
743 }
744
Willy Tarreaufb14edc2009-06-14 15:24:37 +0200745 if (fcntl(fd, F_SETFL, O_NONBLOCK) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100746 err |= ERR_FATAL | ERR_ALERT;
747 msg = "cannot make socket non-blocking";
748 goto tcp_close_return;
749 }
750
Willy Tarreau40aa0702013-03-10 23:51:38 +0100751 if (!ext && setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100752 /* not fatal but should be reported */
753 msg = "cannot do so_reuseaddr";
754 err |= ERR_ALERT;
755 }
756
757 if (listener->options & LI_O_NOLINGER)
Simon Hormande072bd2011-06-24 15:11:37 +0900758 setsockopt(fd, SOL_SOCKET, SO_LINGER, &nolinger, sizeof(struct linger));
Willy Tarreauedcf6682008-11-30 23:15:34 +0100759
Willy Tarreaue6b98942007-10-29 01:09:36 +0100760#ifdef SO_REUSEPORT
761 /* OpenBSD supports this. As it's present in old libc versions of Linux,
762 * it might return an error that we will silently ignore.
763 */
Willy Tarreau40aa0702013-03-10 23:51:38 +0100764 if (!ext)
765 setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &one, sizeof(one));
Willy Tarreaue6b98942007-10-29 01:09:36 +0100766#endif
Pieter Baauwd551fb52013-05-08 22:49:23 +0200767
Willy Tarreau40aa0702013-03-10 23:51:38 +0100768 if (!ext && (listener->options & LI_O_FOREIGN)) {
David du Colombier65c17962012-07-13 14:34:59 +0200769 switch (listener->addr.ss_family) {
770 case AF_INET:
Pieter Baauwd551fb52013-05-08 22:49:23 +0200771 if (1
772#if defined(IP_TRANSPARENT)
773 && (setsockopt(fd, SOL_IP, IP_TRANSPARENT, &one, sizeof(one)) == -1)
774#endif
775#if defined(IP_FREEBIND)
776 && (setsockopt(fd, SOL_IP, IP_FREEBIND, &one, sizeof(one)) == -1)
777#endif
Pieter Baauwff30b662013-05-08 23:22:39 +0200778#if defined(IP_BINDANY)
779 && (setsockopt(fd, IPPROTO_IP, IP_BINDANY, &one, sizeof(one)) == -1)
780#endif
Pieter Baauw1eb75922013-05-08 23:30:23 +0200781#if defined(SO_BINDANY)
782 && (setsockopt(fd, SOL_SOCKET, SO_BINDANY, &one, sizeof(one)) == -1)
783#endif
Pieter Baauwd551fb52013-05-08 22:49:23 +0200784 ) {
David du Colombier65c17962012-07-13 14:34:59 +0200785 msg = "cannot make listening socket transparent";
786 err |= ERR_ALERT;
787 }
788 break;
789 case AF_INET6:
Pieter Baauwd551fb52013-05-08 22:49:23 +0200790 if (1
791#if defined(IPV6_TRANSPARENT)
792 && (setsockopt(fd, SOL_IPV6, IPV6_TRANSPARENT, &one, sizeof(one)) == -1)
793#endif
Lukas Tribus7640e722014-03-03 21:10:51 +0100794#if defined(IP_FREEBIND)
795 && (setsockopt(fd, SOL_IP, IP_FREEBIND, &one, sizeof(one)) == -1)
796#endif
Pieter Baauwff30b662013-05-08 23:22:39 +0200797#if defined(IPV6_BINDANY)
798 && (setsockopt(fd, IPPROTO_IPV6, IPV6_BINDANY, &one, sizeof(one)) == -1)
799#endif
Pieter Baauw1eb75922013-05-08 23:30:23 +0200800#if defined(SO_BINDANY)
801 && (setsockopt(fd, SOL_SOCKET, SO_BINDANY, &one, sizeof(one)) == -1)
802#endif
Pieter Baauwd551fb52013-05-08 22:49:23 +0200803 ) {
David du Colombier65c17962012-07-13 14:34:59 +0200804 msg = "cannot make listening socket transparent";
805 err |= ERR_ALERT;
806 }
807 break;
808 }
Willy Tarreaub1e52e82008-01-13 14:49:51 +0100809 }
Pieter Baauwd551fb52013-05-08 22:49:23 +0200810
Willy Tarreau5e6e2042009-02-04 17:19:29 +0100811#ifdef SO_BINDTODEVICE
812 /* Note: this might fail if not CAP_NET_RAW */
Willy Tarreau40aa0702013-03-10 23:51:38 +0100813 if (!ext && listener->interface) {
Willy Tarreau5e6e2042009-02-04 17:19:29 +0100814 if (setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE,
Willy Tarreau604e8302009-03-06 00:48:23 +0100815 listener->interface, strlen(listener->interface) + 1) == -1) {
Willy Tarreau5e6e2042009-02-04 17:19:29 +0100816 msg = "cannot bind listener to device";
817 err |= ERR_WARN;
818 }
819 }
820#endif
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400821#if defined(TCP_MAXSEG)
Willy Tarreau48a7e722010-12-24 15:26:39 +0100822 if (listener->maxseg > 0) {
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400823 if (setsockopt(fd, IPPROTO_TCP, TCP_MAXSEG,
Willy Tarreaube1b9182009-06-14 18:48:19 +0200824 &listener->maxseg, sizeof(listener->maxseg)) == -1) {
825 msg = "cannot set MSS";
826 err |= ERR_WARN;
827 }
828 }
829#endif
Willy Tarreaucb6cd432009-10-13 07:34:14 +0200830#if defined(TCP_DEFER_ACCEPT)
831 if (listener->options & LI_O_DEF_ACCEPT) {
832 /* defer accept by up to one second */
833 int accept_delay = 1;
834 if (setsockopt(fd, IPPROTO_TCP, TCP_DEFER_ACCEPT, &accept_delay, sizeof(accept_delay)) == -1) {
835 msg = "cannot enable DEFER_ACCEPT";
836 err |= ERR_WARN;
837 }
838 }
839#endif
Willy Tarreau1c862c52012-10-05 16:21:00 +0200840#if defined(TCP_FASTOPEN)
841 if (listener->options & LI_O_TCP_FO) {
842 /* TFO needs a queue length, let's use the configured backlog */
843 int qlen = listener->backlog ? listener->backlog : listener->maxconn;
844 if (setsockopt(fd, IPPROTO_TCP, TCP_FASTOPEN, &qlen, sizeof(qlen)) == -1) {
845 msg = "cannot enable TCP_FASTOPEN";
846 err |= ERR_WARN;
847 }
848 }
849#endif
Willy Tarreau9b6700f2012-11-24 11:55:28 +0100850#if defined(IPV6_V6ONLY)
851 if (listener->options & LI_O_V6ONLY)
852 setsockopt(fd, IPPROTO_IPV6, IPV6_V6ONLY, &one, sizeof(one));
Willy Tarreau77e3af92012-11-24 15:07:23 +0100853 else if (listener->options & LI_O_V4V6)
854 setsockopt(fd, IPPROTO_IPV6, IPV6_V6ONLY, &zero, sizeof(zero));
Willy Tarreau9b6700f2012-11-24 11:55:28 +0100855#endif
856
Willy Tarreau40aa0702013-03-10 23:51:38 +0100857 if (!ext && bind(fd, (struct sockaddr *)&listener->addr, listener->proto->sock_addrlen) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100858 err |= ERR_RETRYABLE | ERR_ALERT;
859 msg = "cannot bind socket";
860 goto tcp_close_return;
861 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100862
Willy Tarreau40aa0702013-03-10 23:51:38 +0100863 ready = 0;
864 ready_len = sizeof(ready);
865 if (getsockopt(fd, SOL_SOCKET, SO_ACCEPTCONN, &ready, &ready_len) == -1)
866 ready = 0;
867
868 if (!(ext && ready) && /* only listen if not already done by external process */
869 listen(fd, listener->backlog ? listener->backlog : listener->maxconn) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100870 err |= ERR_RETRYABLE | ERR_ALERT;
871 msg = "cannot listen to socket";
872 goto tcp_close_return;
873 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100874
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400875#if defined(TCP_QUICKACK)
Willy Tarreau9ea05a72009-06-14 12:07:01 +0200876 if (listener->options & LI_O_NOQUICKACK)
Simon Hormande072bd2011-06-24 15:11:37 +0900877 setsockopt(fd, IPPROTO_TCP, TCP_QUICKACK, &zero, sizeof(zero));
Willy Tarreau9ea05a72009-06-14 12:07:01 +0200878#endif
879
Willy Tarreaue6b98942007-10-29 01:09:36 +0100880 /* the socket is ready */
881 listener->fd = fd;
882 listener->state = LI_LISTEN;
883
Willy Tarreaueabf3132008-08-29 23:36:51 +0200884 fdtab[fd].owner = listener; /* reference the listener instead of a task */
Willy Tarreauaece46a2012-07-06 12:25:58 +0200885 fdtab[fd].iocb = listener->proto->accept;
Willy Tarreaueb472682010-05-28 18:46:57 +0200886 fd_insert(fd);
887
Willy Tarreaue6b98942007-10-29 01:09:36 +0100888 tcp_return:
Cyril Bonté43ba1b32010-11-01 19:26:01 +0100889 if (msg && errlen) {
890 char pn[INET6_ADDRSTRLEN];
891
Willy Tarreau631f01c2011-09-05 00:36:48 +0200892 addr_to_str(&listener->addr, pn, sizeof(pn));
893 snprintf(errmsg, errlen, "%s [%s:%d]", msg, pn, get_host_port(&listener->addr));
Cyril Bonté43ba1b32010-11-01 19:26:01 +0100894 }
Willy Tarreaue6b98942007-10-29 01:09:36 +0100895 return err;
896
897 tcp_close_return:
898 close(fd);
899 goto tcp_return;
900}
901
902/* This function creates all TCP sockets bound to the protocol entry <proto>.
903 * It is intended to be used as the protocol's bind_all() function.
904 * The sockets will be registered but not added to any fd_set, in order not to
905 * loose them across the fork(). A call to enable_all_listeners() is needed
906 * to complete initialization. The return value is composed from ERR_*.
907 */
Emeric Bruncf20bf12010-10-22 16:06:11 +0200908static int tcp_bind_listeners(struct protocol *proto, char *errmsg, int errlen)
Willy Tarreaue6b98942007-10-29 01:09:36 +0100909{
910 struct listener *listener;
911 int err = ERR_NONE;
912
913 list_for_each_entry(listener, &proto->listeners, proto_list) {
Emeric Bruncf20bf12010-10-22 16:06:11 +0200914 err |= tcp_bind_listener(listener, errmsg, errlen);
915 if (err & ERR_ABORT)
Willy Tarreaue6b98942007-10-29 01:09:36 +0100916 break;
917 }
918
919 return err;
920}
921
922/* Add listener to the list of tcpv4 listeners. The listener's state
923 * is automatically updated from LI_INIT to LI_ASSIGNED. The number of
924 * listeners is updated. This is the function to use to add a new listener.
925 */
926void tcpv4_add_listener(struct listener *listener)
927{
928 if (listener->state != LI_INIT)
929 return;
930 listener->state = LI_ASSIGNED;
931 listener->proto = &proto_tcpv4;
932 LIST_ADDQ(&proto_tcpv4.listeners, &listener->proto_list);
933 proto_tcpv4.nb_listeners++;
934}
935
936/* Add listener to the list of tcpv4 listeners. The listener's state
937 * is automatically updated from LI_INIT to LI_ASSIGNED. The number of
938 * listeners is updated. This is the function to use to add a new listener.
939 */
940void tcpv6_add_listener(struct listener *listener)
941{
942 if (listener->state != LI_INIT)
943 return;
944 listener->state = LI_ASSIGNED;
945 listener->proto = &proto_tcpv6;
946 LIST_ADDQ(&proto_tcpv6.listeners, &listener->proto_list);
947 proto_tcpv6.nb_listeners++;
948}
949
Willy Tarreauedcf6682008-11-30 23:15:34 +0100950/* This function performs the TCP request analysis on the current request. It
951 * returns 1 if the processing can continue on next analysers, or zero if it
952 * needs more data, encounters an error, or wants to immediately abort the
Willy Tarreaufb356202010-08-03 14:02:05 +0200953 * request. It relies on buffers flags, and updates s->req->analysers. The
954 * function may be called for frontend rules and backend rules. It only relies
955 * on the backend pointer so this works for both cases.
Willy Tarreauedcf6682008-11-30 23:15:34 +0100956 */
Willy Tarreau7421efb2012-07-02 15:11:27 +0200957int tcp_inspect_request(struct session *s, struct channel *req, int an_bit)
Willy Tarreauedcf6682008-11-30 23:15:34 +0100958{
959 struct tcp_rule *rule;
Willy Tarreaud1f96522010-08-03 19:34:32 +0200960 struct stksess *ts;
961 struct stktable *t;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100962 int partial;
963
Willy Tarreau02d6cfc2012-03-01 18:19:58 +0100964 DPRINTF(stderr,"[%u] %s: session=%p b=%p, exp(r,w)=%u,%u bf=%08x bh=%d analysers=%02x\n",
Willy Tarreauedcf6682008-11-30 23:15:34 +0100965 now_ms, __FUNCTION__,
966 s,
967 req,
968 req->rex, req->wex,
969 req->flags,
Willy Tarreau9b28e032012-10-12 23:49:43 +0200970 req->buf->i,
Willy Tarreauedcf6682008-11-30 23:15:34 +0100971 req->analysers);
972
Willy Tarreauedcf6682008-11-30 23:15:34 +0100973 /* We don't know whether we have enough data, so must proceed
974 * this way :
975 * - iterate through all rules in their declaration order
976 * - if one rule returns MISS, it means the inspect delay is
977 * not over yet, then return immediately, otherwise consider
978 * it as a non-match.
979 * - if one rule returns OK, then return OK
980 * - if one rule returns KO, then return KO
981 */
982
Willy Tarreau9b28e032012-10-12 23:49:43 +0200983 if ((req->flags & CF_SHUTR) || buffer_full(req->buf, global.tune.maxrewrite) ||
Willy Tarreau3bf1b2b2012-08-27 20:46:07 +0200984 !s->be->tcp_req.inspect_delay || tick_is_expired(req->analyse_exp, now_ms))
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200985 partial = SMP_OPT_FINAL;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100986 else
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200987 partial = 0;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100988
Willy Tarreaufb356202010-08-03 14:02:05 +0200989 list_for_each_entry(rule, &s->be->tcp_req.inspect_rules, list) {
Willy Tarreau0cba6072013-11-28 22:21:02 +0100990 enum acl_test_res ret = ACL_TEST_PASS;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100991
992 if (rule->cond) {
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200993 ret = acl_exec_cond(rule->cond, s->be, s, &s->txn, SMP_OPT_DIR_REQ | partial);
Willy Tarreau18bf01e2014-06-13 16:18:52 +0200994 if (ret == ACL_TEST_MISS)
995 goto missing_data;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100996
997 ret = acl_pass(ret);
998 if (rule->cond->pol == ACL_COND_UNLESS)
999 ret = !ret;
1000 }
1001
1002 if (ret) {
1003 /* we have a matching rule. */
1004 if (rule->action == TCP_ACT_REJECT) {
Willy Tarreau8263d2b2012-08-28 00:06:31 +02001005 channel_abort(req);
1006 channel_abort(s->rep);
Willy Tarreauedcf6682008-11-30 23:15:34 +01001007 req->analysers = 0;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +02001008
Willy Tarreau7d0aaf32011-03-10 23:25:56 +01001009 s->be->be_counters.denied_req++;
1010 s->fe->fe_counters.denied_req++;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +02001011 if (s->listener->counters)
Willy Tarreau23968d82010-05-23 23:50:44 +02001012 s->listener->counters->denied_req++;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +02001013
Willy Tarreauedcf6682008-11-30 23:15:34 +01001014 if (!(s->flags & SN_ERR_MASK))
1015 s->flags |= SN_ERR_PRXCOND;
1016 if (!(s->flags & SN_FINST_MASK))
1017 s->flags |= SN_FINST_R;
1018 return 0;
1019 }
Willy Tarreau44778ad2013-10-30 19:24:00 +01001020 else if (rule->action >= TCP_ACT_TRK_SC0 && rule->action <= TCP_ACT_TRK_SCMAX) {
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001021 /* Note: only the first valid tracking parameter of each
1022 * applies.
1023 */
1024 struct stktable_key *key;
Willy Tarreau86bd33a2014-06-25 17:01:56 +02001025 struct sample smp;
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001026
Willy Tarreaucc08d2c2014-01-28 23:18:23 +01001027 if (stkctr_entry(&s->stkctr[tcp_trk_idx(rule->action)]))
Willy Tarreau44778ad2013-10-30 19:24:00 +01001028 continue;
1029
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001030 t = rule->act_prm.trk_ctr.table.t;
Willy Tarreau86bd33a2014-06-25 17:01:56 +02001031 key = stktable_fetch_key(t, s->be, s, &s->txn, SMP_OPT_DIR_REQ | partial, rule->act_prm.trk_ctr.expr, &smp);
1032
1033 if (smp.flags & SMP_F_MAY_CHANGE)
1034 goto missing_data;
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001035
1036 if (key && (ts = stktable_get_entry(t, key))) {
Willy Tarreaud5ca9ab2013-05-28 17:40:25 +02001037 session_track_stkctr(&s->stkctr[tcp_trk_idx(rule->action)], t, ts);
Willy Tarreaucc08d2c2014-01-28 23:18:23 +01001038 stkctr_set_flags(&s->stkctr[tcp_trk_idx(rule->action)], STKCTR_TRACK_CONTENT);
Willy Tarreaud5ca9ab2013-05-28 17:40:25 +02001039 if (s->fe != s->be)
Willy Tarreaucc08d2c2014-01-28 23:18:23 +01001040 stkctr_set_flags(&s->stkctr[tcp_trk_idx(rule->action)], STKCTR_TRACK_BACKEND);
Willy Tarreaud1f96522010-08-03 19:34:32 +02001041 }
1042 }
Willy Tarreau18bf01e2014-06-13 16:18:52 +02001043 else if (rule->action == TCP_ACT_CAPTURE) {
1044 struct sample *key;
1045 struct cap_hdr *h = rule->act_prm.cap.hdr;
1046 char **cap = s->txn.req.cap;
1047 int len;
1048
1049 key = sample_fetch_string(s->be, s, &s->txn, SMP_OPT_DIR_REQ | partial, rule->act_prm.cap.expr);
1050 if (!key)
1051 continue;
1052
1053 if (key->flags & SMP_F_MAY_CHANGE)
1054 goto missing_data;
1055
1056 if (cap[h->index] == NULL)
1057 cap[h->index] = pool_alloc2(h->pool);
1058
1059 if (cap[h->index] == NULL) /* no more capture memory */
1060 continue;
1061
1062 len = key->data.str.len;
1063 if (len > h->len)
1064 len = h->len;
1065
1066 memcpy(cap[h->index], key->data.str.str, len);
1067 cap[h->index][len] = 0;
1068 }
Willy Tarreaud1f96522010-08-03 19:34:32 +02001069 else {
Willy Tarreauedcf6682008-11-30 23:15:34 +01001070 /* otherwise accept */
Willy Tarreaud1f96522010-08-03 19:34:32 +02001071 break;
1072 }
Willy Tarreauedcf6682008-11-30 23:15:34 +01001073 }
1074 }
1075
1076 /* if we get there, it means we have no rule which matches, or
1077 * we have an explicit accept, so we apply the default accept.
1078 */
Willy Tarreau3a816292009-07-07 10:55:49 +02001079 req->analysers &= ~an_bit;
Willy Tarreauedcf6682008-11-30 23:15:34 +01001080 req->analyse_exp = TICK_ETERNITY;
1081 return 1;
Willy Tarreau18bf01e2014-06-13 16:18:52 +02001082
1083 missing_data:
1084 channel_dont_connect(req);
1085 /* just set the request timeout once at the beginning of the request */
1086 if (!tick_isset(req->analyse_exp) && s->be->tcp_req.inspect_delay)
1087 req->analyse_exp = tick_add(now_ms, s->be->tcp_req.inspect_delay);
1088 return 0;
1089
Willy Tarreauedcf6682008-11-30 23:15:34 +01001090}
1091
Emeric Brun97679e72010-09-23 17:56:44 +02001092/* This function performs the TCP response analysis on the current response. It
1093 * returns 1 if the processing can continue on next analysers, or zero if it
1094 * needs more data, encounters an error, or wants to immediately abort the
1095 * response. It relies on buffers flags, and updates s->rep->analysers. The
1096 * function may be called for backend rules.
1097 */
Willy Tarreau7421efb2012-07-02 15:11:27 +02001098int tcp_inspect_response(struct session *s, struct channel *rep, int an_bit)
Emeric Brun97679e72010-09-23 17:56:44 +02001099{
1100 struct tcp_rule *rule;
1101 int partial;
1102
Willy Tarreau02d6cfc2012-03-01 18:19:58 +01001103 DPRINTF(stderr,"[%u] %s: session=%p b=%p, exp(r,w)=%u,%u bf=%08x bh=%d analysers=%02x\n",
Emeric Brun97679e72010-09-23 17:56:44 +02001104 now_ms, __FUNCTION__,
1105 s,
1106 rep,
1107 rep->rex, rep->wex,
1108 rep->flags,
Willy Tarreau9b28e032012-10-12 23:49:43 +02001109 rep->buf->i,
Emeric Brun97679e72010-09-23 17:56:44 +02001110 rep->analysers);
1111
1112 /* We don't know whether we have enough data, so must proceed
1113 * this way :
1114 * - iterate through all rules in their declaration order
1115 * - if one rule returns MISS, it means the inspect delay is
1116 * not over yet, then return immediately, otherwise consider
1117 * it as a non-match.
1118 * - if one rule returns OK, then return OK
1119 * - if one rule returns KO, then return KO
1120 */
1121
Willy Tarreau03cdb7c2012-08-27 23:14:58 +02001122 if (rep->flags & CF_SHUTR || tick_is_expired(rep->analyse_exp, now_ms))
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001123 partial = SMP_OPT_FINAL;
Emeric Brun97679e72010-09-23 17:56:44 +02001124 else
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001125 partial = 0;
Emeric Brun97679e72010-09-23 17:56:44 +02001126
1127 list_for_each_entry(rule, &s->be->tcp_rep.inspect_rules, list) {
Willy Tarreau0cba6072013-11-28 22:21:02 +01001128 enum acl_test_res ret = ACL_TEST_PASS;
Emeric Brun97679e72010-09-23 17:56:44 +02001129
1130 if (rule->cond) {
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001131 ret = acl_exec_cond(rule->cond, s->be, s, &s->txn, SMP_OPT_DIR_RES | partial);
Thierry FOURNIERa65b3432013-11-28 18:22:00 +01001132 if (ret == ACL_TEST_MISS) {
Emeric Brun97679e72010-09-23 17:56:44 +02001133 /* just set the analyser timeout once at the beginning of the response */
1134 if (!tick_isset(rep->analyse_exp) && s->be->tcp_rep.inspect_delay)
Willy Tarreau0bb166b2013-11-04 15:56:53 +01001135 rep->analyse_exp = tick_add(now_ms, s->be->tcp_rep.inspect_delay);
Emeric Brun97679e72010-09-23 17:56:44 +02001136 return 0;
1137 }
1138
1139 ret = acl_pass(ret);
1140 if (rule->cond->pol == ACL_COND_UNLESS)
1141 ret = !ret;
1142 }
1143
1144 if (ret) {
1145 /* we have a matching rule. */
1146 if (rule->action == TCP_ACT_REJECT) {
Willy Tarreau8263d2b2012-08-28 00:06:31 +02001147 channel_abort(rep);
1148 channel_abort(s->req);
Emeric Brun97679e72010-09-23 17:56:44 +02001149 rep->analysers = 0;
1150
Willy Tarreau7d0aaf32011-03-10 23:25:56 +01001151 s->be->be_counters.denied_resp++;
1152 s->fe->fe_counters.denied_resp++;
Emeric Brun97679e72010-09-23 17:56:44 +02001153 if (s->listener->counters)
1154 s->listener->counters->denied_resp++;
1155
1156 if (!(s->flags & SN_ERR_MASK))
1157 s->flags |= SN_ERR_PRXCOND;
1158 if (!(s->flags & SN_FINST_MASK))
1159 s->flags |= SN_FINST_D;
1160 return 0;
1161 }
Willy Tarreaucc1e04b2013-09-11 23:20:29 +02001162 else if (rule->action == TCP_ACT_CLOSE) {
1163 rep->prod->flags |= SI_FL_NOLINGER | SI_FL_NOHALF;
1164 si_shutr(rep->prod);
1165 si_shutw(rep->prod);
1166 break;
1167 }
Emeric Brun97679e72010-09-23 17:56:44 +02001168 else {
1169 /* otherwise accept */
1170 break;
1171 }
1172 }
1173 }
1174
1175 /* if we get there, it means we have no rule which matches, or
1176 * we have an explicit accept, so we apply the default accept.
1177 */
1178 rep->analysers &= ~an_bit;
1179 rep->analyse_exp = TICK_ETERNITY;
1180 return 1;
1181}
1182
1183
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001184/* This function performs the TCP layer4 analysis on the current request. It
1185 * returns 0 if a reject rule matches, otherwise 1 if either an accept rule
1186 * matches or if no more rule matches. It can only use rules which don't need
Willy Tarreaub363a1f2013-10-01 10:45:07 +02001187 * any data. This only works on connection-based client-facing stream interfaces.
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001188 */
1189int tcp_exec_req_rules(struct session *s)
1190{
1191 struct tcp_rule *rule;
Willy Tarreauf059a0f2010-08-03 16:29:52 +02001192 struct stksess *ts;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001193 struct stktable *t = NULL;
Willy Tarreaub363a1f2013-10-01 10:45:07 +02001194 struct connection *conn = objt_conn(s->si[0].end);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001195 int result = 1;
Willy Tarreau0cba6072013-11-28 22:21:02 +01001196 enum acl_test_res ret;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001197
Willy Tarreaub363a1f2013-10-01 10:45:07 +02001198 if (!conn)
1199 return result;
1200
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001201 list_for_each_entry(rule, &s->fe->tcp_req.l4_rules, list) {
Thierry FOURNIERa65b3432013-11-28 18:22:00 +01001202 ret = ACL_TEST_PASS;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001203
1204 if (rule->cond) {
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001205 ret = acl_exec_cond(rule->cond, s->fe, s, NULL, SMP_OPT_DIR_REQ|SMP_OPT_FINAL);
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001206 ret = acl_pass(ret);
1207 if (rule->cond->pol == ACL_COND_UNLESS)
1208 ret = !ret;
1209 }
1210
1211 if (ret) {
1212 /* we have a matching rule. */
1213 if (rule->action == TCP_ACT_REJECT) {
Willy Tarreau7d0aaf32011-03-10 23:25:56 +01001214 s->fe->fe_counters.denied_conn++;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001215 if (s->listener->counters)
Willy Tarreau2799e982010-06-05 15:43:21 +02001216 s->listener->counters->denied_conn++;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001217
1218 if (!(s->flags & SN_ERR_MASK))
1219 s->flags |= SN_ERR_PRXCOND;
1220 if (!(s->flags & SN_FINST_MASK))
1221 s->flags |= SN_FINST_R;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001222 result = 0;
1223 break;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001224 }
Willy Tarreau44778ad2013-10-30 19:24:00 +01001225 else if (rule->action >= TCP_ACT_TRK_SC0 && rule->action <= TCP_ACT_TRK_SCMAX) {
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001226 /* Note: only the first valid tracking parameter of each
1227 * applies.
1228 */
1229 struct stktable_key *key;
1230
Willy Tarreaucc08d2c2014-01-28 23:18:23 +01001231 if (stkctr_entry(&s->stkctr[tcp_trk_idx(rule->action)]))
Willy Tarreau44778ad2013-10-30 19:24:00 +01001232 continue;
1233
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001234 t = rule->act_prm.trk_ctr.table.t;
Willy Tarreaud0083942014-06-25 16:20:53 +02001235 key = stktable_fetch_key(t, s->be, s, &s->txn, SMP_OPT_DIR_REQ|SMP_OPT_FINAL, rule->act_prm.trk_ctr.expr, NULL);
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001236
Willy Tarreaud5ca9ab2013-05-28 17:40:25 +02001237 if (key && (ts = stktable_get_entry(t, key)))
1238 session_track_stkctr(&s->stkctr[tcp_trk_idx(rule->action)], t, ts);
Willy Tarreauf059a0f2010-08-03 16:29:52 +02001239 }
Willy Tarreau4f0d9192013-06-11 20:40:55 +02001240 else if (rule->action == TCP_ACT_EXPECT_PX) {
Willy Tarreaub363a1f2013-10-01 10:45:07 +02001241 conn->flags |= CO_FL_ACCEPT_PROXY;
1242 conn_sock_want_recv(conn);
Willy Tarreau4f0d9192013-06-11 20:40:55 +02001243 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001244 else {
1245 /* otherwise it's an accept */
1246 break;
1247 }
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001248 }
1249 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001250 return result;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001251}
1252
Emeric Brun97679e72010-09-23 17:56:44 +02001253/* Parse a tcp-response rule. Return a negative value in case of failure */
1254static int tcp_parse_response_rule(char **args, int arg, int section_type,
Thierry FOURNIER0d6ba512014-02-11 03:31:34 +01001255 struct proxy *curpx, struct proxy *defpx,
1256 struct tcp_rule *rule, char **err,
1257 unsigned int where,
1258 const char *file, int line)
Emeric Brun97679e72010-09-23 17:56:44 +02001259{
1260 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001261 memprintf(err, "%s %s is only allowed in 'backend' sections",
1262 args[0], args[1]);
Emeric Brun97679e72010-09-23 17:56:44 +02001263 return -1;
1264 }
1265
1266 if (strcmp(args[arg], "accept") == 0) {
1267 arg++;
1268 rule->action = TCP_ACT_ACCEPT;
1269 }
1270 else if (strcmp(args[arg], "reject") == 0) {
1271 arg++;
1272 rule->action = TCP_ACT_REJECT;
1273 }
Willy Tarreaucc1e04b2013-09-11 23:20:29 +02001274 else if (strcmp(args[arg], "close") == 0) {
1275 arg++;
1276 rule->action = TCP_ACT_CLOSE;
1277 }
Emeric Brun97679e72010-09-23 17:56:44 +02001278 else {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001279 memprintf(err,
Willy Tarreaucc1e04b2013-09-11 23:20:29 +02001280 "'%s %s' expects 'accept', 'close' or 'reject' in %s '%s' (got '%s')",
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001281 args[0], args[1], proxy_type_str(curpx), curpx->id, args[arg]);
Emeric Brun97679e72010-09-23 17:56:44 +02001282 return -1;
1283 }
1284
1285 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
Thierry FOURNIER0d6ba512014-02-11 03:31:34 +01001286 if ((rule->cond = build_acl_cond(file, line, curpx, (const char **)args+arg, err)) == NULL) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001287 memprintf(err,
1288 "'%s %s %s' : error detected in %s '%s' while parsing '%s' condition : %s",
1289 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg], *err);
Emeric Brun97679e72010-09-23 17:56:44 +02001290 return -1;
1291 }
1292 }
1293 else if (*args[arg]) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001294 memprintf(err,
1295 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (got '%s')",
Emeric Brun97679e72010-09-23 17:56:44 +02001296 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
1297 return -1;
1298 }
1299 return 0;
1300}
1301
1302
1303
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001304/* Parse a tcp-request rule. Return a negative value in case of failure */
1305static int tcp_parse_request_rule(char **args, int arg, int section_type,
Willy Tarreau80aca902013-01-07 15:42:20 +01001306 struct proxy *curpx, struct proxy *defpx,
1307 struct tcp_rule *rule, char **err,
Thierry FOURNIER0d6ba512014-02-11 03:31:34 +01001308 unsigned int where, const char *file, int line)
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001309{
1310 if (curpx == defpx) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001311 memprintf(err, "%s %s is not allowed in 'defaults' sections",
1312 args[0], args[1]);
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001313 return -1;
1314 }
1315
1316 if (!strcmp(args[arg], "accept")) {
1317 arg++;
1318 rule->action = TCP_ACT_ACCEPT;
1319 }
1320 else if (!strcmp(args[arg], "reject")) {
1321 arg++;
1322 rule->action = TCP_ACT_REJECT;
1323 }
Willy Tarreau18bf01e2014-06-13 16:18:52 +02001324 else if (strcmp(args[arg], "capture") == 0) {
1325 struct sample_expr *expr;
1326 struct cap_hdr *hdr;
1327 int kw = arg;
1328 int len = 0;
1329
1330 if (!(curpx->cap & PR_CAP_FE)) {
1331 memprintf(err,
1332 "'%s %s %s' : proxy '%s' has no frontend capability",
1333 args[0], args[1], args[kw], curpx->id);
1334 return -1;
1335 }
1336
1337 if (!(where & SMP_VAL_FE_REQ_CNT)) {
1338 memprintf(err,
1339 "'%s %s' is not allowed in '%s %s' rules in %s '%s'",
1340 args[arg], args[arg+1], args[0], args[1], proxy_type_str(curpx), curpx->id);
1341 return -1;
1342 }
1343
1344 arg++;
1345
1346 curpx->conf.args.ctx = ARGC_CAP;
1347 expr = sample_parse_expr(args, &arg, file, line, err, &curpx->conf.args);
1348 if (!expr) {
1349 memprintf(err,
1350 "'%s %s %s' : %s",
1351 args[0], args[1], args[kw], *err);
1352 return -1;
1353 }
1354
1355 if (!(expr->fetch->val & where)) {
1356 memprintf(err,
1357 "'%s %s %s' : fetch method '%s' extracts information from '%s', none of which is available here",
1358 args[0], args[1], args[kw], args[arg-1], sample_src_names(expr->fetch->use));
1359 free(expr);
1360 return -1;
1361 }
1362
1363 if (strcmp(args[arg], "len") == 0) {
1364 arg++;
1365 if (!args[arg]) {
1366 memprintf(err,
1367 "'%s %s %s' : missing length value",
1368 args[0], args[1], args[kw]);
1369 free(expr);
1370 return -1;
1371 }
1372 /* we copy the table name for now, it will be resolved later */
1373 len = atoi(args[arg]);
1374 if (len <= 0) {
1375 memprintf(err,
1376 "'%s %s %s' : length must be > 0",
1377 args[0], args[1], args[kw]);
1378 free(expr);
1379 return -1;
1380 }
1381 arg++;
1382 }
1383
1384 if (!len) {
1385 memprintf(err,
1386 "'%s %s %s' : a positive 'len' argument is mandatory",
1387 args[0], args[1], args[kw]);
1388 free(expr);
1389 return -1;
1390 }
1391
1392 hdr = calloc(sizeof(struct cap_hdr), 1);
1393 hdr->next = curpx->req_cap;
1394 hdr->name = NULL; /* not a header capture */
1395 hdr->namelen = 0;
1396 hdr->len = len;
1397 hdr->pool = create_pool("caphdr", hdr->len + 1, MEM_F_SHARED);
1398 hdr->index = curpx->nb_req_cap++;
1399
1400 curpx->req_cap = hdr;
1401 curpx->to_log |= LW_REQHDR;
1402
1403 /* check if we need to allocate an hdr_idx struct for HTTP parsing */
1404 curpx->http_needed |= !!(expr->fetch->use & SMP_USE_HTTP_ANY);
1405
1406 rule->act_prm.cap.expr = expr;
1407 rule->act_prm.cap.hdr = hdr;
1408 rule->action = TCP_ACT_CAPTURE;
1409 }
Willy Tarreaub4c84932013-07-23 19:15:30 +02001410 else if (strncmp(args[arg], "track-sc", 8) == 0 &&
1411 args[arg][9] == '\0' && args[arg][8] >= '0' &&
1412 args[arg][8] <= '0' + MAX_SESS_STKCTR) { /* track-sc 0..9 */
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001413 struct sample_expr *expr;
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001414 int kw = arg;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001415
1416 arg++;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001417
Willy Tarreaua4312fa2013-04-02 16:34:32 +02001418 curpx->conf.args.ctx = ARGC_TRK;
Thierry FOURNIEReeaa9512014-02-11 14:00:19 +01001419 expr = sample_parse_expr(args, &arg, file, line, err, &curpx->conf.args);
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001420 if (!expr) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001421 memprintf(err,
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001422 "'%s %s %s' : %s",
Willy Tarreau975c1782013-12-12 23:16:54 +01001423 args[0], args[1], args[kw], *err);
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001424 return -1;
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001425 }
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001426
Willy Tarreau80aca902013-01-07 15:42:20 +01001427 if (!(expr->fetch->val & where)) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001428 memprintf(err,
Willy Tarreau80aca902013-01-07 15:42:20 +01001429 "'%s %s %s' : fetch method '%s' extracts information from '%s', none of which is available here",
Willy Tarreau33c60de2013-04-12 08:26:32 +02001430 args[0], args[1], args[kw], args[arg-1], sample_src_names(expr->fetch->use));
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001431 free(expr);
1432 return -1;
1433 }
1434
1435 /* check if we need to allocate an hdr_idx struct for HTTP parsing */
Willy Tarreau25320b22013-03-24 07:22:08 +01001436 curpx->http_needed |= !!(expr->fetch->use & SMP_USE_HTTP_ANY);
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001437
1438 if (strcmp(args[arg], "table") == 0) {
Willy Tarreau598718a2012-12-09 16:57:27 +01001439 arg++;
1440 if (!args[arg]) {
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001441 memprintf(err,
1442 "'%s %s %s' : missing table name",
1443 args[0], args[1], args[kw]);
1444 free(expr);
1445 return -1;
1446 }
1447 /* we copy the table name for now, it will be resolved later */
Willy Tarreau598718a2012-12-09 16:57:27 +01001448 rule->act_prm.trk_ctr.table.n = strdup(args[arg]);
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001449 arg++;
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001450 }
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001451 rule->act_prm.trk_ctr.expr = expr;
Willy Tarreaube4a3ef2013-06-17 15:04:07 +02001452 rule->action = TCP_ACT_TRK_SC0 + args[kw][8] - '0';
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001453 }
Willy Tarreau4f0d9192013-06-11 20:40:55 +02001454 else if (strcmp(args[arg], "expect-proxy") == 0) {
1455 if (strcmp(args[arg+1], "layer4") != 0) {
1456 memprintf(err,
1457 "'%s %s %s' only supports 'layer4' in %s '%s' (got '%s')",
1458 args[0], args[1], args[arg], proxy_type_str(curpx), curpx->id, args[arg+1]);
1459 return -1;
1460 }
1461
1462 if (!(where & SMP_VAL_FE_CON_ACC)) {
1463 memprintf(err,
1464 "'%s %s' is not allowed in '%s %s' rules in %s '%s'",
1465 args[arg], args[arg+1], args[0], args[1], proxy_type_str(curpx), curpx->id);
1466 return -1;
1467 }
1468
1469 arg += 2;
1470 rule->action = TCP_ACT_EXPECT_PX;
1471 }
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001472 else {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001473 memprintf(err,
Willy Tarreaub4c84932013-07-23 19:15:30 +02001474 "'%s %s' expects 'accept', 'reject', 'track-sc0' ... 'track-sc%d' "
1475 " in %s '%s' (got '%s')",
1476 args[0], args[1], MAX_SESS_STKCTR, proxy_type_str(curpx), curpx->id, args[arg]);
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001477 return -1;
1478 }
1479
1480 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
Thierry FOURNIER0d6ba512014-02-11 03:31:34 +01001481 if ((rule->cond = build_acl_cond(file, line, curpx, (const char **)args+arg, err)) == NULL) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001482 memprintf(err,
1483 "'%s %s %s' : error detected in %s '%s' while parsing '%s' condition : %s",
1484 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg], *err);
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001485 return -1;
1486 }
1487 }
1488 else if (*args[arg]) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001489 memprintf(err,
1490 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (got '%s')",
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001491 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
1492 return -1;
1493 }
1494 return 0;
1495}
1496
Emeric Brun97679e72010-09-23 17:56:44 +02001497/* This function should be called to parse a line starting with the "tcp-response"
1498 * keyword.
1499 */
1500static int tcp_parse_tcp_rep(char **args, int section_type, struct proxy *curpx,
Willy Tarreau28a47d62012-09-18 20:02:48 +02001501 struct proxy *defpx, const char *file, int line,
1502 char **err)
Emeric Brun97679e72010-09-23 17:56:44 +02001503{
1504 const char *ptr = NULL;
1505 unsigned int val;
Emeric Brun97679e72010-09-23 17:56:44 +02001506 int warn = 0;
1507 int arg;
1508 struct tcp_rule *rule;
Willy Tarreau80aca902013-01-07 15:42:20 +01001509 unsigned int where;
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001510 const struct acl *acl;
Willy Tarreau93fddf12013-03-31 22:59:32 +02001511 const char *kw;
Emeric Brun97679e72010-09-23 17:56:44 +02001512
1513 if (!*args[1]) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001514 memprintf(err, "missing argument for '%s' in %s '%s'",
1515 args[0], proxy_type_str(curpx), curpx->id);
Emeric Brun97679e72010-09-23 17:56:44 +02001516 return -1;
1517 }
1518
1519 if (strcmp(args[1], "inspect-delay") == 0) {
1520 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001521 memprintf(err, "%s %s is only allowed in 'backend' sections",
1522 args[0], args[1]);
Emeric Brun97679e72010-09-23 17:56:44 +02001523 return -1;
1524 }
1525
1526 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001527 memprintf(err,
1528 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
1529 args[0], args[1], proxy_type_str(curpx), curpx->id);
1530 if (ptr)
1531 memprintf(err, "%s (unexpected character '%c')", *err, *ptr);
Emeric Brun97679e72010-09-23 17:56:44 +02001532 return -1;
1533 }
1534
1535 if (curpx->tcp_rep.inspect_delay) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001536 memprintf(err, "ignoring %s %s (was already defined) in %s '%s'",
1537 args[0], args[1], proxy_type_str(curpx), curpx->id);
Emeric Brun97679e72010-09-23 17:56:44 +02001538 return 1;
1539 }
1540 curpx->tcp_rep.inspect_delay = val;
1541 return 0;
1542 }
1543
Simon Hormande072bd2011-06-24 15:11:37 +09001544 rule = calloc(1, sizeof(*rule));
Emeric Brun97679e72010-09-23 17:56:44 +02001545 LIST_INIT(&rule->list);
1546 arg = 1;
Willy Tarreau80aca902013-01-07 15:42:20 +01001547 where = 0;
Emeric Brun97679e72010-09-23 17:56:44 +02001548
1549 if (strcmp(args[1], "content") == 0) {
1550 arg++;
Willy Tarreau80aca902013-01-07 15:42:20 +01001551
1552 if (curpx->cap & PR_CAP_FE)
1553 where |= SMP_VAL_FE_RES_CNT;
1554 if (curpx->cap & PR_CAP_BE)
1555 where |= SMP_VAL_BE_RES_CNT;
1556
Thierry FOURNIER0d6ba512014-02-11 03:31:34 +01001557 if (tcp_parse_response_rule(args, arg, section_type, curpx, defpx, rule, err, where, file, line) < 0)
Emeric Brun97679e72010-09-23 17:56:44 +02001558 goto error;
1559
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001560 acl = rule->cond ? acl_cond_conflicts(rule->cond, where) : NULL;
1561 if (acl) {
1562 if (acl->name && *acl->name)
1563 memprintf(err,
1564 "acl '%s' will never match in '%s %s' because it only involves keywords that are incompatible with '%s'",
1565 acl->name, args[0], args[1], sample_ckp_names(where));
1566 else
1567 memprintf(err,
1568 "anonymous acl will never match in '%s %s' because it uses keyword '%s' which is incompatible with '%s'",
1569 args[0], args[1],
Willy Tarreau93fddf12013-03-31 22:59:32 +02001570 LIST_ELEM(acl->expr.n, struct acl_expr *, list)->kw,
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001571 sample_ckp_names(where));
Emeric Brun97679e72010-09-23 17:56:44 +02001572
Emeric Brun97679e72010-09-23 17:56:44 +02001573 warn++;
1574 }
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001575 else if (rule->cond && acl_cond_kw_conflicts(rule->cond, where, &acl, &kw)) {
1576 if (acl->name && *acl->name)
1577 memprintf(err,
1578 "acl '%s' involves keyword '%s' which is incompatible with '%s'",
Willy Tarreau93fddf12013-03-31 22:59:32 +02001579 acl->name, kw, sample_ckp_names(where));
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001580 else
1581 memprintf(err,
1582 "anonymous acl involves keyword '%s' which is incompatible with '%s'",
Willy Tarreau93fddf12013-03-31 22:59:32 +02001583 kw, sample_ckp_names(where));
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001584 warn++;
1585 }
Emeric Brun97679e72010-09-23 17:56:44 +02001586
1587 LIST_ADDQ(&curpx->tcp_rep.inspect_rules, &rule->list);
1588 }
1589 else {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001590 memprintf(err,
1591 "'%s' expects 'inspect-delay' or 'content' in %s '%s' (got '%s')",
1592 args[0], proxy_type_str(curpx), curpx->id, args[1]);
Emeric Brun97679e72010-09-23 17:56:44 +02001593 goto error;
1594 }
1595
1596 return warn;
1597 error:
1598 free(rule);
1599 return -1;
1600}
1601
1602
Willy Tarreaub6866442008-07-14 23:54:42 +02001603/* This function should be called to parse a line starting with the "tcp-request"
1604 * keyword.
1605 */
1606static int tcp_parse_tcp_req(char **args, int section_type, struct proxy *curpx,
Willy Tarreau28a47d62012-09-18 20:02:48 +02001607 struct proxy *defpx, const char *file, int line,
1608 char **err)
Willy Tarreaub6866442008-07-14 23:54:42 +02001609{
1610 const char *ptr = NULL;
Willy Tarreauc7e961e2008-08-17 17:13:47 +02001611 unsigned int val;
Willy Tarreau1a687942010-05-23 22:40:30 +02001612 int warn = 0;
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001613 int arg;
Willy Tarreau1a687942010-05-23 22:40:30 +02001614 struct tcp_rule *rule;
Willy Tarreau80aca902013-01-07 15:42:20 +01001615 unsigned int where;
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001616 const struct acl *acl;
Willy Tarreau93fddf12013-03-31 22:59:32 +02001617 const char *kw;
Willy Tarreaub6866442008-07-14 23:54:42 +02001618
1619 if (!*args[1]) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001620 if (curpx == defpx)
1621 memprintf(err, "missing argument for '%s' in defaults section", args[0]);
1622 else
1623 memprintf(err, "missing argument for '%s' in %s '%s'",
1624 args[0], proxy_type_str(curpx), curpx->id);
Willy Tarreaub6866442008-07-14 23:54:42 +02001625 return -1;
1626 }
1627
1628 if (!strcmp(args[1], "inspect-delay")) {
1629 if (curpx == defpx) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001630 memprintf(err, "%s %s is not allowed in 'defaults' sections",
1631 args[0], args[1]);
Willy Tarreaub6866442008-07-14 23:54:42 +02001632 return -1;
1633 }
1634
Willy Tarreaub6866442008-07-14 23:54:42 +02001635 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001636 memprintf(err,
1637 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
1638 args[0], args[1], proxy_type_str(curpx), curpx->id);
1639 if (ptr)
1640 memprintf(err, "%s (unexpected character '%c')", *err, *ptr);
Willy Tarreaub6866442008-07-14 23:54:42 +02001641 return -1;
1642 }
1643
1644 if (curpx->tcp_req.inspect_delay) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001645 memprintf(err, "ignoring %s %s (was already defined) in %s '%s'",
1646 args[0], args[1], proxy_type_str(curpx), curpx->id);
Willy Tarreaub6866442008-07-14 23:54:42 +02001647 return 1;
1648 }
1649 curpx->tcp_req.inspect_delay = val;
1650 return 0;
1651 }
1652
Simon Hormande072bd2011-06-24 15:11:37 +09001653 rule = calloc(1, sizeof(*rule));
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001654 LIST_INIT(&rule->list);
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001655 arg = 1;
Willy Tarreau80aca902013-01-07 15:42:20 +01001656 where = 0;
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001657
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001658 if (strcmp(args[1], "content") == 0) {
Willy Tarreaud1f96522010-08-03 19:34:32 +02001659 arg++;
Willy Tarreau80aca902013-01-07 15:42:20 +01001660
1661 if (curpx->cap & PR_CAP_FE)
1662 where |= SMP_VAL_FE_REQ_CNT;
1663 if (curpx->cap & PR_CAP_BE)
1664 where |= SMP_VAL_BE_REQ_CNT;
1665
Thierry FOURNIER0d6ba512014-02-11 03:31:34 +01001666 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, where, file, line) < 0)
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001667 goto error;
Willy Tarreaub6866442008-07-14 23:54:42 +02001668
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001669 acl = rule->cond ? acl_cond_conflicts(rule->cond, where) : NULL;
1670 if (acl) {
1671 if (acl->name && *acl->name)
1672 memprintf(err,
1673 "acl '%s' will never match in '%s %s' because it only involves keywords that are incompatible with '%s'",
1674 acl->name, args[0], args[1], sample_ckp_names(where));
1675 else
1676 memprintf(err,
1677 "anonymous acl will never match in '%s %s' because it uses keyword '%s' which is incompatible with '%s'",
1678 args[0], args[1],
Willy Tarreau93fddf12013-03-31 22:59:32 +02001679 LIST_ELEM(acl->expr.n, struct acl_expr *, list)->kw,
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001680 sample_ckp_names(where));
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001681
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001682 warn++;
1683 }
1684 else if (rule->cond && acl_cond_kw_conflicts(rule->cond, where, &acl, &kw)) {
1685 if (acl->name && *acl->name)
1686 memprintf(err,
1687 "acl '%s' involves keyword '%s' which is incompatible with '%s'",
Willy Tarreau93fddf12013-03-31 22:59:32 +02001688 acl->name, kw, sample_ckp_names(where));
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001689 else
1690 memprintf(err,
1691 "anonymous acl involves keyword '%s' which is incompatible with '%s'",
Willy Tarreau93fddf12013-03-31 22:59:32 +02001692 kw, sample_ckp_names(where));
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001693 warn++;
1694 }
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001695
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001696 LIST_ADDQ(&curpx->tcp_req.inspect_rules, &rule->list);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001697 }
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001698 else if (strcmp(args[1], "connection") == 0) {
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001699 arg++;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001700
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001701 if (!(curpx->cap & PR_CAP_FE)) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001702 memprintf(err, "%s %s is not allowed because %s %s is not a frontend",
1703 args[0], args[1], proxy_type_str(curpx), curpx->id);
Simon Horman6c54d8b2011-07-15 13:14:06 +09001704 goto error;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001705 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001706
Willy Tarreau80aca902013-01-07 15:42:20 +01001707 where |= SMP_VAL_FE_CON_ACC;
1708
Thierry FOURNIER0d6ba512014-02-11 03:31:34 +01001709 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, where, file, line) < 0)
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001710 goto error;
1711
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001712 acl = rule->cond ? acl_cond_conflicts(rule->cond, where) : NULL;
1713 if (acl) {
1714 if (acl->name && *acl->name)
1715 memprintf(err,
1716 "acl '%s' will never match in '%s %s' because it only involves keywords that are incompatible with '%s'",
1717 acl->name, args[0], args[1], sample_ckp_names(where));
1718 else
1719 memprintf(err,
1720 "anonymous acl will never match in '%s %s' because it uses keyword '%s' which is incompatible with '%s'",
1721 args[0], args[1],
Willy Tarreau93fddf12013-03-31 22:59:32 +02001722 LIST_ELEM(acl->expr.n, struct acl_expr *, list)->kw,
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001723 sample_ckp_names(where));
Willy Tarreauf059a0f2010-08-03 16:29:52 +02001724
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001725 warn++;
1726 }
1727 else if (rule->cond && acl_cond_kw_conflicts(rule->cond, where, &acl, &kw)) {
1728 if (acl->name && *acl->name)
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001729 memprintf(err,
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001730 "acl '%s' involves keyword '%s' which is incompatible with '%s'",
Willy Tarreau93fddf12013-03-31 22:59:32 +02001731 acl->name, kw, sample_ckp_names(where));
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001732 else
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001733 memprintf(err,
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001734 "anonymous acl involves keyword '%s' which is incompatible with '%s'",
Willy Tarreau93fddf12013-03-31 22:59:32 +02001735 kw, sample_ckp_names(where));
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001736 warn++;
1737 }
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001738
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001739 LIST_ADDQ(&curpx->tcp_req.l4_rules, &rule->list);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001740 }
Willy Tarreau1a687942010-05-23 22:40:30 +02001741 else {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001742 if (curpx == defpx)
1743 memprintf(err,
1744 "'%s' expects 'inspect-delay', 'connection', or 'content' in defaults section (got '%s')",
1745 args[0], args[1]);
1746 else
1747 memprintf(err,
1748 "'%s' expects 'inspect-delay', 'connection', or 'content' in %s '%s' (got '%s')",
Willy Tarreaudeaec2f2013-04-10 16:31:11 +02001749 args[0], proxy_type_str(curpx), curpx->id, args[1]);
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001750 goto error;
Willy Tarreau1a687942010-05-23 22:40:30 +02001751 }
1752
Willy Tarreau1a687942010-05-23 22:40:30 +02001753 return warn;
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001754 error:
1755 free(rule);
1756 return -1;
Willy Tarreaub6866442008-07-14 23:54:42 +02001757}
1758
Willy Tarreau645513a2010-05-24 20:55:15 +02001759
1760/************************************************************************/
Willy Tarreaud4c33c82013-01-07 21:59:07 +01001761/* All supported sample fetch functions must be declared here */
Willy Tarreau32389b72012-04-23 23:13:20 +02001762/************************************************************************/
1763
Willy Tarreau4a129812012-04-25 17:31:42 +02001764/* fetch the connection's source IPv4/IPv6 address */
Willy Tarreau645513a2010-05-24 20:55:15 +02001765static int
Willy Tarreau4a129812012-04-25 17:31:42 +02001766smp_fetch_src(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreauef38c392013-07-22 16:29:32 +02001767 const struct arg *args, struct sample *smp, const char *kw)
Willy Tarreau645513a2010-05-24 20:55:15 +02001768{
Willy Tarreaub363a1f2013-10-01 10:45:07 +02001769 struct connection *cli_conn = objt_conn(l4->si[0].end);
1770
1771 if (!cli_conn)
1772 return 0;
1773
1774 switch (cli_conn->addr.from.ss_family) {
Willy Tarreauf4362b32011-12-16 17:49:52 +01001775 case AF_INET:
Willy Tarreaub363a1f2013-10-01 10:45:07 +02001776 smp->data.ipv4 = ((struct sockaddr_in *)&cli_conn->addr.from)->sin_addr;
Willy Tarreauf853c462012-04-23 18:53:56 +02001777 smp->type = SMP_T_IPV4;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001778 break;
1779 case AF_INET6:
Willy Tarreaub363a1f2013-10-01 10:45:07 +02001780 smp->data.ipv6 = ((struct sockaddr_in6 *)&cli_conn->addr.from)->sin6_addr;
Willy Tarreauf853c462012-04-23 18:53:56 +02001781 smp->type = SMP_T_IPV6;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001782 break;
1783 default:
Emeric Brunf769f512010-10-22 17:14:01 +02001784 return 0;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001785 }
Emeric Brunf769f512010-10-22 17:14:01 +02001786
Willy Tarreau37406352012-04-23 16:16:37 +02001787 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001788 return 1;
1789}
1790
Willy Tarreaua5e37562011-12-16 17:06:15 +01001791/* set temp integer to the connection's source port */
Willy Tarreau645513a2010-05-24 20:55:15 +02001792static int
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001793smp_fetch_sport(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreauef38c392013-07-22 16:29:32 +02001794 const struct arg *args, struct sample *smp, const char *kw)
Willy Tarreau645513a2010-05-24 20:55:15 +02001795{
Willy Tarreaub363a1f2013-10-01 10:45:07 +02001796 struct connection *cli_conn = objt_conn(l4->si[0].end);
1797
1798 if (!cli_conn)
1799 return 0;
1800
Willy Tarreauf853c462012-04-23 18:53:56 +02001801 smp->type = SMP_T_UINT;
Willy Tarreaub363a1f2013-10-01 10:45:07 +02001802 if (!(smp->data.uint = get_host_port(&cli_conn->addr.from)))
Emeric Brunf769f512010-10-22 17:14:01 +02001803 return 0;
1804
Willy Tarreau37406352012-04-23 16:16:37 +02001805 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001806 return 1;
1807}
1808
Willy Tarreau4a129812012-04-25 17:31:42 +02001809/* fetch the connection's destination IPv4/IPv6 address */
Willy Tarreau645513a2010-05-24 20:55:15 +02001810static int
Willy Tarreau4a129812012-04-25 17:31:42 +02001811smp_fetch_dst(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreauef38c392013-07-22 16:29:32 +02001812 const struct arg *args, struct sample *smp, const char *kw)
Willy Tarreau645513a2010-05-24 20:55:15 +02001813{
Willy Tarreaub363a1f2013-10-01 10:45:07 +02001814 struct connection *cli_conn = objt_conn(l4->si[0].end);
Willy Tarreau645513a2010-05-24 20:55:15 +02001815
Willy Tarreaub363a1f2013-10-01 10:45:07 +02001816 if (!cli_conn)
1817 return 0;
1818
1819 conn_get_to_addr(cli_conn);
1820
1821 switch (cli_conn->addr.to.ss_family) {
Willy Tarreauf4362b32011-12-16 17:49:52 +01001822 case AF_INET:
Willy Tarreaub363a1f2013-10-01 10:45:07 +02001823 smp->data.ipv4 = ((struct sockaddr_in *)&cli_conn->addr.to)->sin_addr;
Willy Tarreauf853c462012-04-23 18:53:56 +02001824 smp->type = SMP_T_IPV4;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001825 break;
1826 case AF_INET6:
Willy Tarreaub363a1f2013-10-01 10:45:07 +02001827 smp->data.ipv6 = ((struct sockaddr_in6 *)&cli_conn->addr.to)->sin6_addr;
Willy Tarreauf853c462012-04-23 18:53:56 +02001828 smp->type = SMP_T_IPV6;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001829 break;
1830 default:
Emeric Brunf769f512010-10-22 17:14:01 +02001831 return 0;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001832 }
Emeric Brunf769f512010-10-22 17:14:01 +02001833
Willy Tarreau37406352012-04-23 16:16:37 +02001834 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001835 return 1;
1836}
1837
Willy Tarreaua5e37562011-12-16 17:06:15 +01001838/* set temp integer to the frontend connexion's destination port */
Willy Tarreau645513a2010-05-24 20:55:15 +02001839static int
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001840smp_fetch_dport(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreauef38c392013-07-22 16:29:32 +02001841 const struct arg *args, struct sample *smp, const char *kw)
Willy Tarreau645513a2010-05-24 20:55:15 +02001842{
Willy Tarreaub363a1f2013-10-01 10:45:07 +02001843 struct connection *cli_conn = objt_conn(l4->si[0].end);
1844
1845 if (!cli_conn)
1846 return 0;
1847
1848 conn_get_to_addr(cli_conn);
Willy Tarreau645513a2010-05-24 20:55:15 +02001849
Willy Tarreauf853c462012-04-23 18:53:56 +02001850 smp->type = SMP_T_UINT;
Willy Tarreaub363a1f2013-10-01 10:45:07 +02001851 if (!(smp->data.uint = get_host_port(&cli_conn->addr.to)))
Emeric Brunf769f512010-10-22 17:14:01 +02001852 return 0;
1853
Willy Tarreau37406352012-04-23 16:16:37 +02001854 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001855 return 1;
Emericf2d7cae2010-11-05 18:13:50 +01001856}
1857
Willy Tarreau9b6700f2012-11-24 11:55:28 +01001858#ifdef IPV6_V6ONLY
Willy Tarreau77e3af92012-11-24 15:07:23 +01001859/* parse the "v4v6" bind keyword */
1860static int bind_parse_v4v6(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
1861{
1862 struct listener *l;
1863
1864 list_for_each_entry(l, &conf->listeners, by_bind) {
1865 if (l->addr.ss_family == AF_INET6)
1866 l->options |= LI_O_V4V6;
1867 }
1868
1869 return 0;
1870}
1871
Willy Tarreau9b6700f2012-11-24 11:55:28 +01001872/* parse the "v6only" bind keyword */
1873static int bind_parse_v6only(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
1874{
1875 struct listener *l;
1876
1877 list_for_each_entry(l, &conf->listeners, by_bind) {
1878 if (l->addr.ss_family == AF_INET6)
1879 l->options |= LI_O_V6ONLY;
1880 }
1881
1882 return 0;
1883}
1884#endif
1885
Pieter Baauwd551fb52013-05-08 22:49:23 +02001886#ifdef CONFIG_HAP_TRANSPARENT
Willy Tarreau44791242012-09-12 23:27:21 +02001887/* parse the "transparent" bind keyword */
Willy Tarreau4348fad2012-09-20 16:48:07 +02001888static int bind_parse_transparent(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
Willy Tarreau44791242012-09-12 23:27:21 +02001889{
1890 struct listener *l;
1891
Willy Tarreau4348fad2012-09-20 16:48:07 +02001892 list_for_each_entry(l, &conf->listeners, by_bind) {
1893 if (l->addr.ss_family == AF_INET || l->addr.ss_family == AF_INET6)
1894 l->options |= LI_O_FOREIGN;
Willy Tarreau44791242012-09-12 23:27:21 +02001895 }
1896
Willy Tarreau44791242012-09-12 23:27:21 +02001897 return 0;
1898}
1899#endif
1900
1901#ifdef TCP_DEFER_ACCEPT
1902/* parse the "defer-accept" bind keyword */
Willy Tarreau4348fad2012-09-20 16:48:07 +02001903static int bind_parse_defer_accept(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
Willy Tarreau44791242012-09-12 23:27:21 +02001904{
1905 struct listener *l;
1906
Willy Tarreau4348fad2012-09-20 16:48:07 +02001907 list_for_each_entry(l, &conf->listeners, by_bind) {
1908 if (l->addr.ss_family == AF_INET || l->addr.ss_family == AF_INET6)
1909 l->options |= LI_O_DEF_ACCEPT;
Willy Tarreau44791242012-09-12 23:27:21 +02001910 }
1911
Willy Tarreau44791242012-09-12 23:27:21 +02001912 return 0;
1913}
1914#endif
1915
Willy Tarreau1c862c52012-10-05 16:21:00 +02001916#ifdef TCP_FASTOPEN
Lukas Tribus0defb902013-02-13 23:35:39 +01001917/* parse the "tfo" bind keyword */
Willy Tarreau1c862c52012-10-05 16:21:00 +02001918static int bind_parse_tfo(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
1919{
1920 struct listener *l;
1921
1922 list_for_each_entry(l, &conf->listeners, by_bind) {
1923 if (l->addr.ss_family == AF_INET || l->addr.ss_family == AF_INET6)
1924 l->options |= LI_O_TCP_FO;
1925 }
1926
1927 return 0;
1928}
1929#endif
1930
Willy Tarreau44791242012-09-12 23:27:21 +02001931#ifdef TCP_MAXSEG
1932/* parse the "mss" bind keyword */
Willy Tarreau4348fad2012-09-20 16:48:07 +02001933static int bind_parse_mss(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
Willy Tarreau44791242012-09-12 23:27:21 +02001934{
1935 struct listener *l;
1936 int mss;
1937
Willy Tarreau44791242012-09-12 23:27:21 +02001938 if (!*args[cur_arg + 1]) {
Willy Tarreaueb6cead2012-09-20 19:43:14 +02001939 memprintf(err, "'%s' : missing MSS value", args[cur_arg]);
Willy Tarreau44791242012-09-12 23:27:21 +02001940 return ERR_ALERT | ERR_FATAL;
1941 }
1942
1943 mss = atoi(args[cur_arg + 1]);
1944 if (!mss || abs(mss) > 65535) {
Willy Tarreaueb6cead2012-09-20 19:43:14 +02001945 memprintf(err, "'%s' : expects an MSS with and absolute value between 1 and 65535", args[cur_arg]);
Willy Tarreau44791242012-09-12 23:27:21 +02001946 return ERR_ALERT | ERR_FATAL;
1947 }
1948
Willy Tarreau4348fad2012-09-20 16:48:07 +02001949 list_for_each_entry(l, &conf->listeners, by_bind) {
1950 if (l->addr.ss_family == AF_INET || l->addr.ss_family == AF_INET6)
1951 l->maxseg = mss;
1952 }
Willy Tarreau44791242012-09-12 23:27:21 +02001953
1954 return 0;
1955}
1956#endif
1957
1958#ifdef SO_BINDTODEVICE
1959/* parse the "mss" bind keyword */
Willy Tarreau4348fad2012-09-20 16:48:07 +02001960static int bind_parse_interface(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
Willy Tarreau44791242012-09-12 23:27:21 +02001961{
1962 struct listener *l;
1963
Willy Tarreau44791242012-09-12 23:27:21 +02001964 if (!*args[cur_arg + 1]) {
Willy Tarreaueb6cead2012-09-20 19:43:14 +02001965 memprintf(err, "'%s' : missing interface name", args[cur_arg]);
Willy Tarreau44791242012-09-12 23:27:21 +02001966 return ERR_ALERT | ERR_FATAL;
1967 }
1968
Willy Tarreau4348fad2012-09-20 16:48:07 +02001969 list_for_each_entry(l, &conf->listeners, by_bind) {
1970 if (l->addr.ss_family == AF_INET || l->addr.ss_family == AF_INET6)
1971 l->interface = strdup(args[cur_arg + 1]);
1972 }
Willy Tarreau44791242012-09-12 23:27:21 +02001973
1974 global.last_checks |= LSTCHK_NETADM;
1975 return 0;
1976}
1977#endif
1978
Willy Tarreaudc13c112013-06-21 23:16:39 +02001979static struct cfg_kw_list cfg_kws = {ILH, {
Willy Tarreaud4c33c82013-01-07 21:59:07 +01001980 { CFG_LISTEN, "tcp-request", tcp_parse_tcp_req },
Emeric Brun97679e72010-09-23 17:56:44 +02001981 { CFG_LISTEN, "tcp-response", tcp_parse_tcp_rep },
Willy Tarreaub6866442008-07-14 23:54:42 +02001982 { 0, NULL, NULL },
1983}};
1984
Willy Tarreaud4c33c82013-01-07 21:59:07 +01001985
Willy Tarreau61612d42012-04-19 18:42:05 +02001986/* Note: must not be declared <const> as its list will be overwritten.
1987 * Please take care of keeping this list alphabetically sorted.
1988 */
Willy Tarreaudc13c112013-06-21 23:16:39 +02001989static struct acl_kw_list acl_kws = {ILH, {
Willy Tarreaud4c33c82013-01-07 21:59:07 +01001990 { /* END */ },
Willy Tarreaub6866442008-07-14 23:54:42 +02001991}};
1992
Willy Tarreaud4c33c82013-01-07 21:59:07 +01001993
Willy Tarreau4a129812012-04-25 17:31:42 +02001994/* Note: must not be declared <const> as its list will be overwritten.
1995 * Note: fetches that may return multiple types must be declared as the lowest
1996 * common denominator, the type that can be casted into all other ones. For
1997 * instance v4/v6 must be declared v4.
1998 */
Willy Tarreaudc13c112013-06-21 23:16:39 +02001999static struct sample_fetch_kw_list sample_fetch_keywords = {ILH, {
Willy Tarreaud4c33c82013-01-07 21:59:07 +01002000 { "dst", smp_fetch_dst, 0, NULL, SMP_T_IPV4, SMP_USE_L4CLI },
2001 { "dst_port", smp_fetch_dport, 0, NULL, SMP_T_UINT, SMP_USE_L4CLI },
2002 { "src", smp_fetch_src, 0, NULL, SMP_T_IPV4, SMP_USE_L4CLI },
2003 { "src_port", smp_fetch_sport, 0, NULL, SMP_T_UINT, SMP_USE_L4CLI },
2004 { /* END */ },
Willy Tarreau645513a2010-05-24 20:55:15 +02002005}};
2006
Willy Tarreau44791242012-09-12 23:27:21 +02002007/************************************************************************/
2008/* All supported bind keywords must be declared here. */
2009/************************************************************************/
2010
2011/* Note: must not be declared <const> as its list will be overwritten.
2012 * Please take care of keeping this list alphabetically sorted, doing so helps
2013 * all code contributors.
2014 * Optional keywords are also declared with a NULL ->parse() function so that
2015 * the config parser can report an appropriate error when a known keyword was
2016 * not enabled.
2017 */
Willy Tarreau51fb7652012-09-18 18:24:39 +02002018static struct bind_kw_list bind_kws = { "TCP", { }, {
Willy Tarreau44791242012-09-12 23:27:21 +02002019#ifdef TCP_DEFER_ACCEPT
2020 { "defer-accept", bind_parse_defer_accept, 0 }, /* wait for some data for 1 second max before doing accept */
2021#endif
2022#ifdef SO_BINDTODEVICE
2023 { "interface", bind_parse_interface, 1 }, /* specifically bind to this interface */
2024#endif
2025#ifdef TCP_MAXSEG
2026 { "mss", bind_parse_mss, 1 }, /* set MSS of listening socket */
2027#endif
Willy Tarreau1c862c52012-10-05 16:21:00 +02002028#ifdef TCP_FASTOPEN
2029 { "tfo", bind_parse_tfo, 0 }, /* enable TCP_FASTOPEN of listening socket */
2030#endif
Pieter Baauwd551fb52013-05-08 22:49:23 +02002031#ifdef CONFIG_HAP_TRANSPARENT
Willy Tarreau44791242012-09-12 23:27:21 +02002032 { "transparent", bind_parse_transparent, 0 }, /* transparently bind to the specified addresses */
2033#endif
Willy Tarreau9b6700f2012-11-24 11:55:28 +01002034#ifdef IPV6_V6ONLY
Willy Tarreau77e3af92012-11-24 15:07:23 +01002035 { "v4v6", bind_parse_v4v6, 0 }, /* force socket to bind to IPv4+IPv6 */
Willy Tarreau9b6700f2012-11-24 11:55:28 +01002036 { "v6only", bind_parse_v6only, 0 }, /* force socket to bind to IPv6 only */
2037#endif
Willy Tarreau44791242012-09-12 23:27:21 +02002038 /* the versions with the NULL parse function*/
2039 { "defer-accept", NULL, 0 },
2040 { "interface", NULL, 1 },
2041 { "mss", NULL, 1 },
2042 { "transparent", NULL, 0 },
Willy Tarreau77e3af92012-11-24 15:07:23 +01002043 { "v4v6", NULL, 0 },
Willy Tarreau9b6700f2012-11-24 11:55:28 +01002044 { "v6only", NULL, 0 },
Willy Tarreau44791242012-09-12 23:27:21 +02002045 { NULL, NULL, 0 },
2046}};
2047
Willy Tarreaue6b98942007-10-29 01:09:36 +01002048__attribute__((constructor))
2049static void __tcp_protocol_init(void)
2050{
2051 protocol_register(&proto_tcpv4);
2052 protocol_register(&proto_tcpv6);
Willy Tarreau12785782012-04-27 21:37:17 +02002053 sample_register_fetches(&sample_fetch_keywords);
Willy Tarreaub6866442008-07-14 23:54:42 +02002054 cfg_register_keywords(&cfg_kws);
2055 acl_register_keywords(&acl_kws);
Willy Tarreau44791242012-09-12 23:27:21 +02002056 bind_register_keywords(&bind_kws);
Willy Tarreaue6b98942007-10-29 01:09:36 +01002057}
2058
2059
2060/*
2061 * Local variables:
2062 * c-indent-level: 8
2063 * c-basic-offset: 8
2064 * End:
2065 */