blob: fc8b4aed9245d42c184214a18da0ef51e6d3b211 [file] [log] [blame]
Willy Tarreau39713102016-11-25 15:49:32 +01001/*
2 * "tcp" rules processing
3 *
4 * Copyright 2000-2016 Willy Tarreau <w@1wt.eu>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12#include <common/cfgparse.h>
13#include <common/compat.h>
14#include <common/config.h>
15#include <common/debug.h>
Willy Tarreau0108d902018-11-25 19:14:37 +010016#include <common/initcall.h>
Willy Tarreau39713102016-11-25 15:49:32 +010017#include <common/mini-clist.h>
18#include <common/standard.h>
19#include <common/ticks.h>
20#include <common/time.h>
21
22#include <types/arg.h>
23#include <types/capture.h>
24#include <types/connection.h>
25#include <types/global.h>
26
27#include <proto/acl.h>
28#include <proto/action.h>
29#include <proto/channel.h>
30#include <proto/connection.h>
31#include <proto/log.h>
32#include <proto/proxy.h>
33#include <proto/sample.h>
34#include <proto/stick_table.h>
35#include <proto/stream.h>
36#include <proto/stream_interface.h>
37#include <proto/tcp_rules.h>
38
Christopher Fauleteea8fc72019-11-05 16:18:10 +010039#define TRACE_SOURCE &trace_strm
40
Willy Tarreau39713102016-11-25 15:49:32 +010041/* List head of all known action keywords for "tcp-request connection" */
42struct list tcp_req_conn_keywords = LIST_HEAD_INIT(tcp_req_conn_keywords);
43struct list tcp_req_sess_keywords = LIST_HEAD_INIT(tcp_req_sess_keywords);
44struct list tcp_req_cont_keywords = LIST_HEAD_INIT(tcp_req_cont_keywords);
45struct list tcp_res_cont_keywords = LIST_HEAD_INIT(tcp_res_cont_keywords);
46
47/*
48 * Register keywords.
49 */
50void tcp_req_conn_keywords_register(struct action_kw_list *kw_list)
51{
52 LIST_ADDQ(&tcp_req_conn_keywords, &kw_list->list);
53}
54
55void tcp_req_sess_keywords_register(struct action_kw_list *kw_list)
56{
57 LIST_ADDQ(&tcp_req_sess_keywords, &kw_list->list);
58}
59
60void tcp_req_cont_keywords_register(struct action_kw_list *kw_list)
61{
62 LIST_ADDQ(&tcp_req_cont_keywords, &kw_list->list);
63}
64
65void tcp_res_cont_keywords_register(struct action_kw_list *kw_list)
66{
67 LIST_ADDQ(&tcp_res_cont_keywords, &kw_list->list);
68}
69
70/*
71 * Return the struct tcp_req_action_kw associated to a keyword.
72 */
73static struct action_kw *tcp_req_conn_action(const char *kw)
74{
75 return action_lookup(&tcp_req_conn_keywords, kw);
76}
77
78static struct action_kw *tcp_req_sess_action(const char *kw)
79{
80 return action_lookup(&tcp_req_sess_keywords, kw);
81}
82
83static struct action_kw *tcp_req_cont_action(const char *kw)
84{
85 return action_lookup(&tcp_req_cont_keywords, kw);
86}
87
88static struct action_kw *tcp_res_cont_action(const char *kw)
89{
90 return action_lookup(&tcp_res_cont_keywords, kw);
91}
92
93/* This function performs the TCP request analysis on the current request. It
94 * returns 1 if the processing can continue on next analysers, or zero if it
95 * needs more data, encounters an error, or wants to immediately abort the
96 * request. It relies on buffers flags, and updates s->req->analysers. The
97 * function may be called for frontend rules and backend rules. It only relies
98 * on the backend pointer so this works for both cases.
99 */
100int tcp_inspect_request(struct stream *s, struct channel *req, int an_bit)
101{
102 struct session *sess = s->sess;
103 struct act_rule *rule;
Willy Tarreau39713102016-11-25 15:49:32 +0100104 int partial;
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100105 int act_opts = 0;
Willy Tarreau39713102016-11-25 15:49:32 +0100106
Christopher Fauleteea8fc72019-11-05 16:18:10 +0100107 DBG_TRACE_ENTER(STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
Willy Tarreau39713102016-11-25 15:49:32 +0100108
109 /* We don't know whether we have enough data, so must proceed
110 * this way :
111 * - iterate through all rules in their declaration order
112 * - if one rule returns MISS, it means the inspect delay is
113 * not over yet, then return immediately, otherwise consider
114 * it as a non-match.
115 * - if one rule returns OK, then return OK
116 * - if one rule returns KO, then return KO
117 */
118
Willy Tarreau23752332018-06-15 14:54:53 +0200119 if ((req->flags & CF_SHUTR) || channel_full(req, global.tune.maxrewrite) ||
Willy Tarreau39713102016-11-25 15:49:32 +0100120 !s->be->tcp_req.inspect_delay || tick_is_expired(req->analyse_exp, now_ms))
121 partial = SMP_OPT_FINAL;
122 else
123 partial = 0;
124
125 /* If "the current_rule_list" match the executed rule list, we are in
126 * resume condition. If a resume is needed it is always in the action
127 * and never in the ACL or converters. In this case, we initialise the
128 * current rule, and go to the action execution point.
129 */
130 if (s->current_rule) {
131 rule = s->current_rule;
132 s->current_rule = NULL;
133 if (s->current_rule_list == &s->be->tcp_req.inspect_rules)
134 goto resume_execution;
135 }
136 s->current_rule_list = &s->be->tcp_req.inspect_rules;
137
138 list_for_each_entry(rule, &s->be->tcp_req.inspect_rules, list) {
139 enum acl_test_res ret = ACL_TEST_PASS;
140
141 if (rule->cond) {
142 ret = acl_exec_cond(rule->cond, s->be, sess, s, SMP_OPT_DIR_REQ | partial);
143 if (ret == ACL_TEST_MISS)
144 goto missing_data;
145
146 ret = acl_pass(ret);
147 if (rule->cond->pol == ACL_COND_UNLESS)
148 ret = !ret;
149 }
150
151 if (ret) {
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100152 act_opts |= ACT_OPT_FIRST;
Willy Tarreau39713102016-11-25 15:49:32 +0100153resume_execution:
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100154
155 /* Always call the action function if defined */
156 if (rule->action_ptr) {
157 if (partial & SMP_OPT_FINAL)
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100158 act_opts |= ACT_OPT_FINAL;
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100159
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100160 switch (rule->action_ptr(rule, s->be, s->sess, s, act_opts)) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100161 case ACT_RET_CONT:
162 break;
163 case ACT_RET_STOP:
164 case ACT_RET_DONE:
165 goto end;
166 case ACT_RET_YIELD:
167 s->current_rule = rule;
168 goto missing_data;
169 case ACT_RET_DENY:
170 goto deny;
171 case ACT_RET_ABRT:
172 goto abort;
173 case ACT_RET_ERR:
174 goto internal;
175 case ACT_RET_INV:
176 goto invalid;
177 }
178 continue; /* eval the next rule */
179 }
180
181 /* If not action function defined, check for known actions */
Willy Tarreau39713102016-11-25 15:49:32 +0100182 if (rule->action == ACT_ACTION_ALLOW) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100183 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100184 }
185 else if (rule->action == ACT_ACTION_DENY) {
Christopher Faulet282992e2019-12-16 12:34:31 +0100186 goto deny;
Willy Tarreau39713102016-11-25 15:49:32 +0100187 }
Willy Tarreau39713102016-11-25 15:49:32 +0100188 }
189 }
190
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100191 end:
Willy Tarreau39713102016-11-25 15:49:32 +0100192 /* if we get there, it means we have no rule which matches, or
193 * we have an explicit accept, so we apply the default accept.
194 */
195 req->analysers &= ~an_bit;
196 req->analyse_exp = TICK_ETERNITY;
Christopher Fauleteea8fc72019-11-05 16:18:10 +0100197 DBG_TRACE_LEAVE(STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
Willy Tarreau39713102016-11-25 15:49:32 +0100198 return 1;
199
200 missing_data:
201 channel_dont_connect(req);
202 /* just set the request timeout once at the beginning of the request */
203 if (!tick_isset(req->analyse_exp) && s->be->tcp_req.inspect_delay)
204 req->analyse_exp = tick_add(now_ms, s->be->tcp_req.inspect_delay);
Christopher Fauleteea8fc72019-11-05 16:18:10 +0100205 DBG_TRACE_DEVEL("waiting for more data", STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
Willy Tarreau39713102016-11-25 15:49:32 +0100206 return 0;
207
Christopher Faulet282992e2019-12-16 12:34:31 +0100208 deny:
209 _HA_ATOMIC_ADD(&sess->fe->fe_counters.denied_req, 1);
210 if (sess->listener && sess->listener->counters)
211 _HA_ATOMIC_ADD(&sess->listener->counters->denied_req, 1);
212 goto reject;
213
214 internal:
215 _HA_ATOMIC_ADD(&sess->fe->fe_counters.internal_errors, 1);
216 if (sess->listener && sess->listener->counters)
217 _HA_ATOMIC_ADD(&sess->listener->counters->internal_errors, 1);
218 if (!(s->flags & SF_ERR_MASK))
219 s->flags |= SF_ERR_INTERNAL;
220 goto reject;
221
222 invalid:
223 _HA_ATOMIC_ADD(&sess->fe->fe_counters.failed_req, 1);
224 if (sess->listener && sess->listener->counters)
225 _HA_ATOMIC_ADD(&sess->listener->counters->failed_req, 1);
226
227 reject:
228 si_must_kill_conn(chn_prod(req));
229 channel_abort(req);
230 channel_abort(&s->res);
231
232 abort:
233 req->analysers &= AN_REQ_FLT_END;
234
235 if (!(s->flags & SF_ERR_MASK))
236 s->flags |= SF_ERR_PRXCOND;
237 if (!(s->flags & SF_FINST_MASK))
238 s->flags |= SF_FINST_R;
239 DBG_TRACE_DEVEL("leaving on error|deny|abort", STRM_EV_STRM_ANA|STRM_EV_TCP_ANA|STRM_EV_TCP_ERR, s);
240 return 0;
Willy Tarreau39713102016-11-25 15:49:32 +0100241}
242
243/* This function performs the TCP response analysis on the current response. It
244 * returns 1 if the processing can continue on next analysers, or zero if it
245 * needs more data, encounters an error, or wants to immediately abort the
246 * response. It relies on buffers flags, and updates s->rep->analysers. The
247 * function may be called for backend rules.
248 */
249int tcp_inspect_response(struct stream *s, struct channel *rep, int an_bit)
250{
251 struct session *sess = s->sess;
252 struct act_rule *rule;
253 int partial;
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100254 int act_opts = 0;
Willy Tarreau39713102016-11-25 15:49:32 +0100255
Christopher Fauleteea8fc72019-11-05 16:18:10 +0100256 DBG_TRACE_ENTER(STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
Willy Tarreau39713102016-11-25 15:49:32 +0100257
258 /* We don't know whether we have enough data, so must proceed
259 * this way :
260 * - iterate through all rules in their declaration order
261 * - if one rule returns MISS, it means the inspect delay is
262 * not over yet, then return immediately, otherwise consider
263 * it as a non-match.
264 * - if one rule returns OK, then return OK
265 * - if one rule returns KO, then return KO
266 */
267
268 if (rep->flags & CF_SHUTR || tick_is_expired(rep->analyse_exp, now_ms))
269 partial = SMP_OPT_FINAL;
270 else
271 partial = 0;
272
273 /* If "the current_rule_list" match the executed rule list, we are in
274 * resume condition. If a resume is needed it is always in the action
275 * and never in the ACL or converters. In this case, we initialise the
276 * current rule, and go to the action execution point.
277 */
278 if (s->current_rule) {
279 rule = s->current_rule;
280 s->current_rule = NULL;
281 if (s->current_rule_list == &s->be->tcp_rep.inspect_rules)
282 goto resume_execution;
283 }
284 s->current_rule_list = &s->be->tcp_rep.inspect_rules;
285
286 list_for_each_entry(rule, &s->be->tcp_rep.inspect_rules, list) {
287 enum acl_test_res ret = ACL_TEST_PASS;
288
289 if (rule->cond) {
290 ret = acl_exec_cond(rule->cond, s->be, sess, s, SMP_OPT_DIR_RES | partial);
291 if (ret == ACL_TEST_MISS) {
292 /* just set the analyser timeout once at the beginning of the response */
293 if (!tick_isset(rep->analyse_exp) && s->be->tcp_rep.inspect_delay)
294 rep->analyse_exp = tick_add(now_ms, s->be->tcp_rep.inspect_delay);
Christopher Fauleteea8fc72019-11-05 16:18:10 +0100295 DBG_TRACE_DEVEL("waiting for more data", STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
Willy Tarreau39713102016-11-25 15:49:32 +0100296 return 0;
297 }
298
299 ret = acl_pass(ret);
300 if (rule->cond->pol == ACL_COND_UNLESS)
301 ret = !ret;
302 }
303
304 if (ret) {
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100305 act_opts |= ACT_OPT_FIRST;
Willy Tarreau39713102016-11-25 15:49:32 +0100306resume_execution:
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100307 /* Always call the action function if defined */
308 if (rule->action_ptr) {
309 if (partial & SMP_OPT_FINAL)
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100310 act_opts |= ACT_OPT_FINAL;
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100311
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100312 switch (rule->action_ptr(rule, s->be, s->sess, s, act_opts)) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100313 case ACT_RET_CONT:
314 break;
315 case ACT_RET_STOP:
316 case ACT_RET_DONE:
317 goto end;
318 case ACT_RET_YIELD:
319 s->current_rule = rule;
320 goto missing_data;
321 case ACT_RET_DENY:
322 goto deny;
323 case ACT_RET_ABRT:
324 goto abort;
325 case ACT_RET_ERR:
326 goto internal;
327 case ACT_RET_INV:
328 goto invalid;
329 }
330 continue; /* eval the next rule */
331 }
332
333 /* If not action function defined, check for known actions */
Willy Tarreau39713102016-11-25 15:49:32 +0100334 if (rule->action == ACT_ACTION_ALLOW) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100335 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100336 }
337 else if (rule->action == ACT_ACTION_DENY) {
Christopher Faulet282992e2019-12-16 12:34:31 +0100338 goto deny;
Willy Tarreau39713102016-11-25 15:49:32 +0100339 }
340 else if (rule->action == ACT_TCP_CLOSE) {
341 chn_prod(rep)->flags |= SI_FL_NOLINGER | SI_FL_NOHALF;
Willy Tarreau0f9cd7b2019-01-31 19:02:43 +0100342 si_must_kill_conn(chn_prod(rep));
Willy Tarreau39713102016-11-25 15:49:32 +0100343 si_shutr(chn_prod(rep));
344 si_shutw(chn_prod(rep));
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100345 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100346 }
347 }
348 }
349
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100350 end:
Willy Tarreau39713102016-11-25 15:49:32 +0100351 /* if we get there, it means we have no rule which matches, or
352 * we have an explicit accept, so we apply the default accept.
353 */
354 rep->analysers &= ~an_bit;
355 rep->analyse_exp = TICK_ETERNITY;
Christopher Fauleteea8fc72019-11-05 16:18:10 +0100356 DBG_TRACE_LEAVE(STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
Willy Tarreau39713102016-11-25 15:49:32 +0100357 return 1;
Christopher Faulet282992e2019-12-16 12:34:31 +0100358
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100359 missing_data:
360 channel_dont_close(rep);
361 s->current_rule = rule;
362 DBG_TRACE_DEVEL("waiting for more data", STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
363 return 0;
364
Christopher Faulet282992e2019-12-16 12:34:31 +0100365 deny:
Christopher Fauletcff0f732019-12-16 16:13:44 +0100366 _HA_ATOMIC_ADD(&s->sess->fe->fe_counters.denied_resp, 1);
Christopher Faulet282992e2019-12-16 12:34:31 +0100367 _HA_ATOMIC_ADD(&s->be->be_counters.denied_resp, 1);
Christopher Fauletcff0f732019-12-16 16:13:44 +0100368 if (s->sess->listener->counters)
369 _HA_ATOMIC_ADD(&s->sess->listener->counters->denied_resp, 1);
Christopher Faulet282992e2019-12-16 12:34:31 +0100370 if (objt_server(s->target))
371 _HA_ATOMIC_ADD(&__objt_server(s->target)->counters.denied_resp, 1);
372 goto reject;
373
374 internal:
Christopher Fauletcff0f732019-12-16 16:13:44 +0100375 _HA_ATOMIC_ADD(&s->sess->fe->fe_counters.internal_errors, 1);
Christopher Faulet282992e2019-12-16 12:34:31 +0100376 _HA_ATOMIC_ADD(&s->be->be_counters.internal_errors, 1);
Christopher Fauletcff0f732019-12-16 16:13:44 +0100377 if (s->sess->listener->counters)
378 _HA_ATOMIC_ADD(&s->sess->listener->counters->internal_errors, 1);
Christopher Faulet282992e2019-12-16 12:34:31 +0100379 if (objt_server(s->target))
380 _HA_ATOMIC_ADD(&__objt_server(s->target)->counters.internal_errors, 1);
381 if (!(s->flags & SF_ERR_MASK))
382 s->flags |= SF_ERR_INTERNAL;
383 goto reject;
384
385 invalid:
386 _HA_ATOMIC_ADD(&s->be->be_counters.failed_resp, 1);
387 if (objt_server(s->target))
388 _HA_ATOMIC_ADD(&__objt_server(s->target)->counters.failed_resp, 1);
389
390 reject:
391 si_must_kill_conn(chn_prod(rep));
392 channel_abort(rep);
393 channel_abort(&s->req);
394
395 abort:
396 rep->analysers &= AN_REQ_FLT_END;
397
398 if (!(s->flags & SF_ERR_MASK))
399 s->flags |= SF_ERR_PRXCOND;
400 if (!(s->flags & SF_FINST_MASK))
401 s->flags |= SF_FINST_D;
402 DBG_TRACE_DEVEL("leaving on error", STRM_EV_STRM_ANA|STRM_EV_TCP_ANA|STRM_EV_TCP_ERR, s);
403 return 0;
Willy Tarreau39713102016-11-25 15:49:32 +0100404}
405
406
407/* This function performs the TCP layer4 analysis on the current request. It
408 * returns 0 if a reject rule matches, otherwise 1 if either an accept rule
409 * matches or if no more rule matches. It can only use rules which don't need
410 * any data. This only works on connection-based client-facing stream interfaces.
411 */
412int tcp_exec_l4_rules(struct session *sess)
413{
414 struct act_rule *rule;
Willy Tarreau39713102016-11-25 15:49:32 +0100415 struct connection *conn = objt_conn(sess->origin);
416 int result = 1;
417 enum acl_test_res ret;
418
419 if (!conn)
420 return result;
421
422 list_for_each_entry(rule, &sess->fe->tcp_req.l4_rules, list) {
423 ret = ACL_TEST_PASS;
424
425 if (rule->cond) {
426 ret = acl_exec_cond(rule->cond, sess->fe, sess, NULL, SMP_OPT_DIR_REQ|SMP_OPT_FINAL);
427 ret = acl_pass(ret);
428 if (rule->cond->pol == ACL_COND_UNLESS)
429 ret = !ret;
430 }
431
432 if (ret) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100433 /* Always call the action function if defined */
434 if (rule->action_ptr) {
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100435 switch (rule->action_ptr(rule, sess->fe, sess, NULL, ACT_OPT_FINAL | ACT_OPT_FIRST)) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100436 case ACT_RET_YIELD:
437 /* yield is not allowed at this point. If this return code is
438 * used it is a bug, so I prefer to abort the process.
439 */
440 send_log(sess->fe, LOG_WARNING,
441 "Internal error: yield not allowed with tcp-request connection actions.");
442 /* fall through */
443 case ACT_RET_STOP:
444 case ACT_RET_DONE:
445 goto end;
446 case ACT_RET_CONT:
447 break;
448 case ACT_RET_DENY:
449 case ACT_RET_ABRT:
450 case ACT_RET_ERR:
451 case ACT_RET_INV:
452 result = 0;
453 goto end;
454 }
455 continue; /* eval the next rule */
456 }
457
458 /* If not action function defined, check for known actions */
Willy Tarreau39713102016-11-25 15:49:32 +0100459 if (rule->action == ACT_ACTION_ALLOW) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100460 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100461 }
462 else if (rule->action == ACT_ACTION_DENY) {
Olivier Houchard64dbb2d2019-03-08 18:55:10 +0100463 _HA_ATOMIC_ADD(&sess->fe->fe_counters.denied_conn, 1);
Willy Tarreaua12dde02016-12-22 18:14:41 +0100464 if (sess->listener && sess->listener->counters)
Olivier Houchard64dbb2d2019-03-08 18:55:10 +0100465 _HA_ATOMIC_ADD(&sess->listener->counters->denied_conn, 1);
Willy Tarreau39713102016-11-25 15:49:32 +0100466
467 result = 0;
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100468 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100469 }
Willy Tarreau39713102016-11-25 15:49:32 +0100470 else if (rule->action == ACT_TCP_EXPECT_PX) {
Willy Tarreau4450b582020-01-23 15:23:13 +0100471 if (!(conn->flags & CO_FL_HANDSHAKE)) {
Olivier Houchardfe50bfb2019-05-27 12:09:19 +0200472 if (xprt_add_hs(conn) < 0) {
473 result = 0;
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100474 goto end;
Olivier Houchardfe50bfb2019-05-27 12:09:19 +0200475 }
476 }
Willy Tarreau39713102016-11-25 15:49:32 +0100477 conn->flags |= CO_FL_ACCEPT_PROXY;
Willy Tarreau39713102016-11-25 15:49:32 +0100478 }
479 else if (rule->action == ACT_TCP_EXPECT_CIP) {
Willy Tarreau4450b582020-01-23 15:23:13 +0100480 if (!(conn->flags & CO_FL_HANDSHAKE)) {
Olivier Houchardfe50bfb2019-05-27 12:09:19 +0200481 if (xprt_add_hs(conn) < 0) {
482 result = 0;
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100483 goto end;
Olivier Houchardfe50bfb2019-05-27 12:09:19 +0200484 }
485 }
Willy Tarreau39713102016-11-25 15:49:32 +0100486 conn->flags |= CO_FL_ACCEPT_CIP;
Willy Tarreau39713102016-11-25 15:49:32 +0100487 }
Willy Tarreau39713102016-11-25 15:49:32 +0100488 }
489 }
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100490 end:
Willy Tarreau39713102016-11-25 15:49:32 +0100491 return result;
492}
493
494/* This function performs the TCP layer5 analysis on the current request. It
495 * returns 0 if a reject rule matches, otherwise 1 if either an accept rule
496 * matches or if no more rule matches. It can only use rules which don't need
497 * any data. This only works on session-based client-facing stream interfaces.
498 * An example of valid use case is to track a stick-counter on the source
499 * address extracted from the proxy protocol.
500 */
501int tcp_exec_l5_rules(struct session *sess)
502{
503 struct act_rule *rule;
Willy Tarreau39713102016-11-25 15:49:32 +0100504 int result = 1;
505 enum acl_test_res ret;
506
507 list_for_each_entry(rule, &sess->fe->tcp_req.l5_rules, list) {
508 ret = ACL_TEST_PASS;
509
510 if (rule->cond) {
511 ret = acl_exec_cond(rule->cond, sess->fe, sess, NULL, SMP_OPT_DIR_REQ|SMP_OPT_FINAL);
512 ret = acl_pass(ret);
513 if (rule->cond->pol == ACL_COND_UNLESS)
514 ret = !ret;
515 }
516
517 if (ret) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100518 /* Always call the action function if defined */
519 if (rule->action_ptr) {
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100520 switch (rule->action_ptr(rule, sess->fe, sess, NULL, ACT_OPT_FINAL | ACT_OPT_FIRST)) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100521 case ACT_RET_YIELD:
522 /* yield is not allowed at this point. If this return code is
523 * used it is a bug, so I prefer to abort the process.
524 */
525 send_log(sess->fe, LOG_WARNING,
526 "Internal error: yield not allowed with tcp-request session actions.");
527 /* fall through */
528 case ACT_RET_STOP:
529 case ACT_RET_DONE:
530 goto end;
531 case ACT_RET_CONT:
532 break;
533 case ACT_RET_DENY:
534 case ACT_RET_ABRT:
535 case ACT_RET_ERR:
536 case ACT_RET_INV:
537 result = 0;
538 goto end;
539 }
540 continue; /* eval the next rule */
541 }
542
543 /* If not action function defined, check for known actions */
Willy Tarreau39713102016-11-25 15:49:32 +0100544 if (rule->action == ACT_ACTION_ALLOW) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100545 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100546 }
547 else if (rule->action == ACT_ACTION_DENY) {
Olivier Houchard64dbb2d2019-03-08 18:55:10 +0100548 _HA_ATOMIC_ADD(&sess->fe->fe_counters.denied_sess, 1);
Willy Tarreaua12dde02016-12-22 18:14:41 +0100549 if (sess->listener && sess->listener->counters)
Olivier Houchard64dbb2d2019-03-08 18:55:10 +0100550 _HA_ATOMIC_ADD(&sess->listener->counters->denied_sess, 1);
Willy Tarreau39713102016-11-25 15:49:32 +0100551
552 result = 0;
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100553 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100554 }
Willy Tarreau39713102016-11-25 15:49:32 +0100555 }
556 }
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100557 end:
Willy Tarreau39713102016-11-25 15:49:32 +0100558 return result;
559}
560
561/* Parse a tcp-response rule. Return a negative value in case of failure */
562static int tcp_parse_response_rule(char **args, int arg, int section_type,
563 struct proxy *curpx, struct proxy *defpx,
564 struct act_rule *rule, char **err,
565 unsigned int where,
566 const char *file, int line)
567{
568 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
569 memprintf(err, "%s %s is only allowed in 'backend' sections",
570 args[0], args[1]);
571 return -1;
572 }
573
574 if (strcmp(args[arg], "accept") == 0) {
575 arg++;
576 rule->action = ACT_ACTION_ALLOW;
Christopher Faulet245cf792019-12-18 14:58:12 +0100577 rule->flags |= ACT_FLAG_FINAL;
Willy Tarreau39713102016-11-25 15:49:32 +0100578 }
579 else if (strcmp(args[arg], "reject") == 0) {
580 arg++;
581 rule->action = ACT_ACTION_DENY;
Christopher Faulet245cf792019-12-18 14:58:12 +0100582 rule->flags |= ACT_FLAG_FINAL;
Willy Tarreau39713102016-11-25 15:49:32 +0100583 }
584 else if (strcmp(args[arg], "close") == 0) {
585 arg++;
586 rule->action = ACT_TCP_CLOSE;
Christopher Faulet245cf792019-12-18 14:58:12 +0100587 rule->flags |= ACT_FLAG_FINAL;
Willy Tarreau39713102016-11-25 15:49:32 +0100588 }
589 else {
590 struct action_kw *kw;
591 kw = tcp_res_cont_action(args[arg]);
592 if (kw) {
593 arg++;
Willy Tarreau39713102016-11-25 15:49:32 +0100594 rule->kw = kw;
595 if (kw->parse((const char **)args, &arg, curpx, rule, err) == ACT_RET_PRS_ERR)
596 return -1;
597 } else {
598 action_build_list(&tcp_res_cont_keywords, &trash);
599 memprintf(err,
600 "'%s %s' expects 'accept', 'close', 'reject', %s in %s '%s' (got '%s')",
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200601 args[0], args[1], trash.area,
602 proxy_type_str(curpx), curpx->id, args[arg]);
Willy Tarreau39713102016-11-25 15:49:32 +0100603 return -1;
604 }
605 }
606
607 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
Christopher Faulet1b421ea2017-09-22 14:38:56 +0200608 if ((rule->cond = build_acl_cond(file, line, &curpx->acl, curpx, (const char **)args+arg, err)) == NULL) {
Willy Tarreau39713102016-11-25 15:49:32 +0100609 memprintf(err,
610 "'%s %s %s' : error detected in %s '%s' while parsing '%s' condition : %s",
611 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg], *err);
612 return -1;
613 }
614 }
615 else if (*args[arg]) {
616 memprintf(err,
617 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (got '%s')",
618 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
619 return -1;
620 }
621 return 0;
622}
623
Christopher Fauletac98d812019-12-18 09:20:16 +0100624
625/* This function executes a track-sc* actions. On success, it returns
626 * ACT_RET_CONT. If it must yield, it return ACT_RET_YIELD. Otherwsize
627 * ACT_RET_ERR is returned.
628 */
629static enum act_return tcp_action_track_sc(struct act_rule *rule, struct proxy *px,
630 struct session *sess, struct stream *s, int flags)
631{
632 struct stksess *ts;
633 struct stktable *t;
634 struct stktable_key *key;
635 struct sample smp;
636 int opt;
637
Christopher Faulet67307792020-02-10 09:54:49 +0100638 opt = SMP_OPT_DIR_REQ;
Christopher Fauletac98d812019-12-18 09:20:16 +0100639 if (flags & ACT_FLAG_FINAL)
640 opt |= SMP_OPT_FINAL;
Willy Tarreau39713102016-11-25 15:49:32 +0100641
Christopher Fauletac98d812019-12-18 09:20:16 +0100642 t = rule->arg.trk_ctr.table.t;
Christopher Faulet67307792020-02-10 09:54:49 +0100643 if (rule->from == ACT_F_TCP_REQ_CNT) { /* L7 rules: use the stream */
644 if (stkctr_entry(&s->stkctr[rule->action]))
645 goto end;
Christopher Fauletac98d812019-12-18 09:20:16 +0100646
Christopher Faulet67307792020-02-10 09:54:49 +0100647 key = stktable_fetch_key(t, s->be, sess, s, opt, rule->arg.trk_ctr.expr, &smp);
Christopher Fauletac98d812019-12-18 09:20:16 +0100648
Christopher Faulet67307792020-02-10 09:54:49 +0100649 if ((smp.flags & SMP_F_MAY_CHANGE) && !(flags & ACT_FLAG_FINAL))
650 return ACT_RET_YIELD; /* key might appear later */
651
652 if (key && (ts = stktable_get_entry(t, key))) {
653 stream_track_stkctr(&s->stkctr[rule->action], t, ts);
Christopher Fauletac98d812019-12-18 09:20:16 +0100654 stkctr_set_flags(&s->stkctr[rule->action], STKCTR_TRACK_CONTENT);
655 if (sess->fe != s->be)
656 stkctr_set_flags(&s->stkctr[rule->action], STKCTR_TRACK_BACKEND);
657 }
658 }
Christopher Faulet67307792020-02-10 09:54:49 +0100659 else { /* L4/L5 rules: use the session */
660 if (stkctr_entry(&sess->stkctr[rule->action]))
661 goto end;
662
663 key = stktable_fetch_key(t, sess->fe, sess, NULL, opt, rule->arg.trk_ctr.expr, NULL);
664 if (key && (ts = stktable_get_entry(t, key)))
665 stream_track_stkctr(&sess->stkctr[rule->action], t, ts);
666 }
Christopher Fauletac98d812019-12-18 09:20:16 +0100667
668 end:
669 return ACT_RET_CONT;
670}
Willy Tarreau39713102016-11-25 15:49:32 +0100671
Christopher Fauletd73b96d2019-12-19 17:27:03 +0100672/* This function executes a capture actions. It executes a fetch expression,
673 * turns the result into a string and puts it in a capture slot. On success, it
674 * returns ACT_RET_CONT. If it must yield, it return ACT_RET_YIELD. Otherwsize
675 * ACT_RET_ERR is returned.
676 */
677static enum act_return tcp_action_capture(struct act_rule *rule, struct proxy *px,
678 struct session *sess, struct stream *s, int flags)
679{
680 struct sample *key;
681 struct cap_hdr *h = rule->arg.cap.hdr;
682 char **cap = s->req_cap;
683 int len, opt;
684
685 opt = ((rule->from == ACT_F_TCP_REQ_CNT) ? SMP_OPT_DIR_REQ : SMP_OPT_DIR_RES);
686 if (flags & ACT_FLAG_FINAL)
687 opt |= SMP_OPT_FINAL;
688
689 key = sample_fetch_as_type(s->be, sess, s, opt, rule->arg.cap.expr, SMP_T_STR);
690 if (!key)
691 goto end;
692
693 if ((key->flags & SMP_F_MAY_CHANGE) && !(flags & ACT_FLAG_FINAL))
694 return ACT_RET_YIELD; /* key might appear later */
695
696 if (cap[h->index] == NULL) {
697 cap[h->index] = pool_alloc(h->pool);
698 if (cap[h->index] == NULL) /* no more capture memory, ignore error */
699 goto end;
700 }
701
702 len = key->data.u.str.data;
703 if (len > h->len)
704 len = h->len;
705
706 memcpy(cap[h->index], key->data.u.str.area, len);
707 cap[h->index][len] = 0;
708
709 end:
710 return ACT_RET_CONT;
711}
712
Christopher Fauletadfc6e82020-01-14 15:05:33 +0100713static void release_tcp_capture(struct act_rule * rule)
714{
715 release_sample_expr(rule->arg.cap.expr);
716}
717
718
719static void release_tcp_track_sc(struct act_rule * rule)
720{
721 release_sample_expr(rule->arg.trk_ctr.expr);
722}
723
Willy Tarreau39713102016-11-25 15:49:32 +0100724/* Parse a tcp-request rule. Return a negative value in case of failure */
725static int tcp_parse_request_rule(char **args, int arg, int section_type,
726 struct proxy *curpx, struct proxy *defpx,
727 struct act_rule *rule, char **err,
728 unsigned int where, const char *file, int line)
729{
730 if (curpx == defpx) {
731 memprintf(err, "%s %s is not allowed in 'defaults' sections",
732 args[0], args[1]);
733 return -1;
734 }
735
736 if (!strcmp(args[arg], "accept")) {
737 arg++;
738 rule->action = ACT_ACTION_ALLOW;
Christopher Faulet245cf792019-12-18 14:58:12 +0100739 rule->flags |= ACT_FLAG_FINAL;
Willy Tarreau39713102016-11-25 15:49:32 +0100740 }
741 else if (!strcmp(args[arg], "reject")) {
742 arg++;
743 rule->action = ACT_ACTION_DENY;
Christopher Faulet245cf792019-12-18 14:58:12 +0100744 rule->flags |= ACT_FLAG_FINAL;
Willy Tarreau39713102016-11-25 15:49:32 +0100745 }
746 else if (strcmp(args[arg], "capture") == 0) {
747 struct sample_expr *expr;
748 struct cap_hdr *hdr;
749 int kw = arg;
750 int len = 0;
751
752 if (!(curpx->cap & PR_CAP_FE)) {
753 memprintf(err,
754 "'%s %s %s' : proxy '%s' has no frontend capability",
755 args[0], args[1], args[kw], curpx->id);
756 return -1;
757 }
758
759 if (!(where & SMP_VAL_FE_REQ_CNT)) {
760 memprintf(err,
761 "'%s %s' is not allowed in '%s %s' rules in %s '%s'",
762 args[arg], args[arg+1], args[0], args[1], proxy_type_str(curpx), curpx->id);
763 return -1;
764 }
765
766 arg++;
767
768 curpx->conf.args.ctx = ARGC_CAP;
Willy Tarreaue3b57bf2020-02-14 16:50:14 +0100769 expr = sample_parse_expr(args, &arg, file, line, err, &curpx->conf.args, NULL);
Willy Tarreau39713102016-11-25 15:49:32 +0100770 if (!expr) {
771 memprintf(err,
772 "'%s %s %s' : %s",
773 args[0], args[1], args[kw], *err);
774 return -1;
775 }
776
777 if (!(expr->fetch->val & where)) {
778 memprintf(err,
779 "'%s %s %s' : fetch method '%s' extracts information from '%s', none of which is available here",
780 args[0], args[1], args[kw], args[arg-1], sample_src_names(expr->fetch->use));
Christopher Fauletfdb6fbf2020-01-14 15:05:56 +0100781 release_sample_expr(expr);
Willy Tarreau39713102016-11-25 15:49:32 +0100782 return -1;
783 }
784
785 if (strcmp(args[arg], "len") == 0) {
786 arg++;
787 if (!args[arg]) {
788 memprintf(err,
789 "'%s %s %s' : missing length value",
790 args[0], args[1], args[kw]);
Christopher Fauletfdb6fbf2020-01-14 15:05:56 +0100791 release_sample_expr(expr);
Willy Tarreau39713102016-11-25 15:49:32 +0100792 return -1;
793 }
794 /* we copy the table name for now, it will be resolved later */
795 len = atoi(args[arg]);
796 if (len <= 0) {
797 memprintf(err,
798 "'%s %s %s' : length must be > 0",
799 args[0], args[1], args[kw]);
Christopher Fauletfdb6fbf2020-01-14 15:05:56 +0100800 release_sample_expr(expr);
Willy Tarreau39713102016-11-25 15:49:32 +0100801 return -1;
802 }
803 arg++;
804 }
805
806 if (!len) {
807 memprintf(err,
808 "'%s %s %s' : a positive 'len' argument is mandatory",
809 args[0], args[1], args[kw]);
810 free(expr);
811 return -1;
812 }
813
814 hdr = calloc(1, sizeof(*hdr));
815 hdr->next = curpx->req_cap;
816 hdr->name = NULL; /* not a header capture */
817 hdr->namelen = 0;
818 hdr->len = len;
819 hdr->pool = create_pool("caphdr", hdr->len + 1, MEM_F_SHARED);
820 hdr->index = curpx->nb_req_cap++;
821
822 curpx->req_cap = hdr;
823 curpx->to_log |= LW_REQHDR;
824
Christopher Faulet711ed6a2019-07-16 14:16:10 +0200825 /* check if we need to allocate an http_txn struct for HTTP parsing */
Willy Tarreau39713102016-11-25 15:49:32 +0100826 curpx->http_needed |= !!(expr->fetch->use & SMP_USE_HTTP_ANY);
827
828 rule->arg.cap.expr = expr;
829 rule->arg.cap.hdr = hdr;
Christopher Fauletd73b96d2019-12-19 17:27:03 +0100830 rule->action = ACT_CUSTOM;
831 rule->action_ptr = tcp_action_capture;
832 rule->check_ptr = check_capture;
Christopher Fauletadfc6e82020-01-14 15:05:33 +0100833 rule->release_ptr = release_tcp_capture;
Willy Tarreau39713102016-11-25 15:49:32 +0100834 }
Frédéric Lécaillea41d5312018-01-29 12:05:07 +0100835 else if (strncmp(args[arg], "track-sc", 8) == 0) {
Willy Tarreau39713102016-11-25 15:49:32 +0100836 struct sample_expr *expr;
837 int kw = arg;
Frédéric Lécaillea41d5312018-01-29 12:05:07 +0100838 unsigned int tsc_num;
839 const char *tsc_num_str;
Willy Tarreau39713102016-11-25 15:49:32 +0100840
841 arg++;
842
Frédéric Lécaillea41d5312018-01-29 12:05:07 +0100843 tsc_num_str = &args[kw][8];
844 if (cfg_parse_track_sc_num(&tsc_num, tsc_num_str, tsc_num_str + strlen(tsc_num_str), err) == -1) {
845 memprintf(err, "'%s %s %s' : %s", args[0], args[1], args[kw], *err);
846 return -1;
847 }
848
Willy Tarreau39713102016-11-25 15:49:32 +0100849 curpx->conf.args.ctx = ARGC_TRK;
Willy Tarreaue3b57bf2020-02-14 16:50:14 +0100850 expr = sample_parse_expr(args, &arg, file, line, err, &curpx->conf.args, NULL);
Willy Tarreau39713102016-11-25 15:49:32 +0100851 if (!expr) {
852 memprintf(err,
853 "'%s %s %s' : %s",
854 args[0], args[1], args[kw], *err);
855 return -1;
856 }
857
858 if (!(expr->fetch->val & where)) {
859 memprintf(err,
860 "'%s %s %s' : fetch method '%s' extracts information from '%s', none of which is available here",
861 args[0], args[1], args[kw], args[arg-1], sample_src_names(expr->fetch->use));
Christopher Fauletfdb6fbf2020-01-14 15:05:56 +0100862 release_sample_expr(expr);
Willy Tarreau39713102016-11-25 15:49:32 +0100863 return -1;
864 }
865
Christopher Faulet711ed6a2019-07-16 14:16:10 +0200866 /* check if we need to allocate an http_txn struct for HTTP parsing */
Willy Tarreau39713102016-11-25 15:49:32 +0100867 curpx->http_needed |= !!(expr->fetch->use & SMP_USE_HTTP_ANY);
868
869 if (strcmp(args[arg], "table") == 0) {
870 arg++;
871 if (!args[arg]) {
872 memprintf(err,
873 "'%s %s %s' : missing table name",
874 args[0], args[1], args[kw]);
Christopher Fauletfdb6fbf2020-01-14 15:05:56 +0100875 release_sample_expr(expr);
Willy Tarreau39713102016-11-25 15:49:32 +0100876 return -1;
877 }
878 /* we copy the table name for now, it will be resolved later */
879 rule->arg.trk_ctr.table.n = strdup(args[arg]);
880 arg++;
881 }
Christopher Fauletac98d812019-12-18 09:20:16 +0100882 rule->action = tsc_num;
Willy Tarreau39713102016-11-25 15:49:32 +0100883 rule->arg.trk_ctr.expr = expr;
Christopher Fauletac98d812019-12-18 09:20:16 +0100884 rule->action_ptr = tcp_action_track_sc;
Christopher Faulet78880fb2017-09-18 14:43:55 +0200885 rule->check_ptr = check_trk_action;
Christopher Fauletadfc6e82020-01-14 15:05:33 +0100886 rule->release_ptr = release_tcp_track_sc;
Willy Tarreau39713102016-11-25 15:49:32 +0100887 }
888 else if (strcmp(args[arg], "expect-proxy") == 0) {
889 if (strcmp(args[arg+1], "layer4") != 0) {
890 memprintf(err,
891 "'%s %s %s' only supports 'layer4' in %s '%s' (got '%s')",
892 args[0], args[1], args[arg], proxy_type_str(curpx), curpx->id, args[arg+1]);
893 return -1;
894 }
895
896 if (!(where & SMP_VAL_FE_CON_ACC)) {
897 memprintf(err,
898 "'%s %s' is not allowed in '%s %s' rules in %s '%s'",
899 args[arg], args[arg+1], args[0], args[1], proxy_type_str(curpx), curpx->id);
900 return -1;
901 }
902
903 arg += 2;
904 rule->action = ACT_TCP_EXPECT_PX;
905 }
906 else if (strcmp(args[arg], "expect-netscaler-cip") == 0) {
907 if (strcmp(args[arg+1], "layer4") != 0) {
908 memprintf(err,
909 "'%s %s %s' only supports 'layer4' in %s '%s' (got '%s')",
910 args[0], args[1], args[arg], proxy_type_str(curpx), curpx->id, args[arg+1]);
911 return -1;
912 }
913
914 if (!(where & SMP_VAL_FE_CON_ACC)) {
915 memprintf(err,
916 "'%s %s' is not allowed in '%s %s' rules in %s '%s'",
917 args[arg], args[arg+1], args[0], args[1], proxy_type_str(curpx), curpx->id);
918 return -1;
919 }
920
921 arg += 2;
922 rule->action = ACT_TCP_EXPECT_CIP;
923 }
924 else {
925 struct action_kw *kw;
926 if (where & SMP_VAL_FE_CON_ACC) {
927 /* L4 */
928 kw = tcp_req_conn_action(args[arg]);
929 rule->kw = kw;
Willy Tarreau39713102016-11-25 15:49:32 +0100930 } else if (where & SMP_VAL_FE_SES_ACC) {
931 /* L5 */
932 kw = tcp_req_sess_action(args[arg]);
933 rule->kw = kw;
Willy Tarreau39713102016-11-25 15:49:32 +0100934 } else {
935 /* L6 */
936 kw = tcp_req_cont_action(args[arg]);
937 rule->kw = kw;
Willy Tarreau39713102016-11-25 15:49:32 +0100938 }
939 if (kw) {
940 arg++;
941 if (kw->parse((const char **)args, &arg, curpx, rule, err) == ACT_RET_PRS_ERR)
942 return -1;
943 } else {
944 if (where & SMP_VAL_FE_CON_ACC)
945 action_build_list(&tcp_req_conn_keywords, &trash);
946 else if (where & SMP_VAL_FE_SES_ACC)
947 action_build_list(&tcp_req_sess_keywords, &trash);
948 else
949 action_build_list(&tcp_req_cont_keywords, &trash);
950 memprintf(err,
951 "'%s %s' expects 'accept', 'reject', 'track-sc0' ... 'track-sc%d', %s "
952 "in %s '%s' (got '%s').\n",
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200953 args[0], args[1], MAX_SESS_STKCTR-1,
954 trash.area, proxy_type_str(curpx),
Willy Tarreau39713102016-11-25 15:49:32 +0100955 curpx->id, args[arg]);
956 return -1;
957 }
958 }
959
960 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
Christopher Faulet1b421ea2017-09-22 14:38:56 +0200961 if ((rule->cond = build_acl_cond(file, line, &curpx->acl, curpx, (const char **)args+arg, err)) == NULL) {
Willy Tarreau39713102016-11-25 15:49:32 +0100962 memprintf(err,
963 "'%s %s %s' : error detected in %s '%s' while parsing '%s' condition : %s",
964 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg], *err);
965 return -1;
966 }
967 }
968 else if (*args[arg]) {
969 memprintf(err,
970 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (got '%s')",
971 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
972 return -1;
973 }
974 return 0;
975}
976
977/* This function should be called to parse a line starting with the "tcp-response"
978 * keyword.
979 */
980static int tcp_parse_tcp_rep(char **args, int section_type, struct proxy *curpx,
981 struct proxy *defpx, const char *file, int line,
982 char **err)
983{
984 const char *ptr = NULL;
985 unsigned int val;
986 int warn = 0;
987 int arg;
988 struct act_rule *rule;
989 unsigned int where;
990 const struct acl *acl;
991 const char *kw;
992
993 if (!*args[1]) {
994 memprintf(err, "missing argument for '%s' in %s '%s'",
995 args[0], proxy_type_str(curpx), curpx->id);
996 return -1;
997 }
998
999 if (strcmp(args[1], "inspect-delay") == 0) {
1000 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
1001 memprintf(err, "%s %s is only allowed in 'backend' sections",
1002 args[0], args[1]);
1003 return -1;
1004 }
1005
1006 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
1007 memprintf(err,
1008 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
1009 args[0], args[1], proxy_type_str(curpx), curpx->id);
Willy Tarreau9faebe32019-06-07 19:00:37 +02001010
1011 if (ptr == PARSE_TIME_OVER)
1012 memprintf(err, "%s (timer overflow in '%s', maximum value is 2147483647 ms or ~24.8 days)", *err, args[2]);
1013 else if (ptr == PARSE_TIME_UNDER)
1014 memprintf(err, "%s (timer underflow in '%s', minimum non-null value is 1 ms)", *err, args[2]);
1015 else if (ptr)
Willy Tarreau39713102016-11-25 15:49:32 +01001016 memprintf(err, "%s (unexpected character '%c')", *err, *ptr);
1017 return -1;
1018 }
1019
1020 if (curpx->tcp_rep.inspect_delay) {
1021 memprintf(err, "ignoring %s %s (was already defined) in %s '%s'",
1022 args[0], args[1], proxy_type_str(curpx), curpx->id);
1023 return 1;
1024 }
1025 curpx->tcp_rep.inspect_delay = val;
1026 return 0;
1027 }
1028
1029 rule = calloc(1, sizeof(*rule));
1030 LIST_INIT(&rule->list);
1031 arg = 1;
1032 where = 0;
1033
1034 if (strcmp(args[1], "content") == 0) {
1035 arg++;
1036
1037 if (curpx->cap & PR_CAP_FE)
1038 where |= SMP_VAL_FE_RES_CNT;
1039 if (curpx->cap & PR_CAP_BE)
1040 where |= SMP_VAL_BE_RES_CNT;
Christopher Fauletcb9106b2019-12-19 15:23:17 +01001041 rule->from = ACT_F_TCP_RES_CNT;
Willy Tarreau39713102016-11-25 15:49:32 +01001042 if (tcp_parse_response_rule(args, arg, section_type, curpx, defpx, rule, err, where, file, line) < 0)
1043 goto error;
1044
1045 acl = rule->cond ? acl_cond_conflicts(rule->cond, where) : NULL;
1046 if (acl) {
1047 if (acl->name && *acl->name)
1048 memprintf(err,
1049 "acl '%s' will never match in '%s %s' because it only involves keywords that are incompatible with '%s'",
1050 acl->name, args[0], args[1], sample_ckp_names(where));
1051 else
1052 memprintf(err,
1053 "anonymous acl will never match in '%s %s' because it uses keyword '%s' which is incompatible with '%s'",
1054 args[0], args[1],
1055 LIST_ELEM(acl->expr.n, struct acl_expr *, list)->kw,
1056 sample_ckp_names(where));
1057
1058 warn++;
1059 }
1060 else if (rule->cond && acl_cond_kw_conflicts(rule->cond, where, &acl, &kw)) {
1061 if (acl->name && *acl->name)
1062 memprintf(err,
1063 "acl '%s' involves keyword '%s' which is incompatible with '%s'",
1064 acl->name, kw, sample_ckp_names(where));
1065 else
1066 memprintf(err,
1067 "anonymous acl involves keyword '%s' which is incompatible with '%s'",
1068 kw, sample_ckp_names(where));
1069 warn++;
1070 }
1071
1072 LIST_ADDQ(&curpx->tcp_rep.inspect_rules, &rule->list);
1073 }
1074 else {
1075 memprintf(err,
1076 "'%s' expects 'inspect-delay' or 'content' in %s '%s' (got '%s')",
1077 args[0], proxy_type_str(curpx), curpx->id, args[1]);
1078 goto error;
1079 }
1080
1081 return warn;
1082 error:
1083 free(rule);
1084 return -1;
1085}
1086
1087
1088/* This function should be called to parse a line starting with the "tcp-request"
1089 * keyword.
1090 */
1091static int tcp_parse_tcp_req(char **args, int section_type, struct proxy *curpx,
1092 struct proxy *defpx, const char *file, int line,
1093 char **err)
1094{
1095 const char *ptr = NULL;
1096 unsigned int val;
1097 int warn = 0;
1098 int arg;
1099 struct act_rule *rule;
1100 unsigned int where;
1101 const struct acl *acl;
1102 const char *kw;
1103
1104 if (!*args[1]) {
1105 if (curpx == defpx)
1106 memprintf(err, "missing argument for '%s' in defaults section", args[0]);
1107 else
1108 memprintf(err, "missing argument for '%s' in %s '%s'",
1109 args[0], proxy_type_str(curpx), curpx->id);
1110 return -1;
1111 }
1112
1113 if (!strcmp(args[1], "inspect-delay")) {
1114 if (curpx == defpx) {
1115 memprintf(err, "%s %s is not allowed in 'defaults' sections",
1116 args[0], args[1]);
1117 return -1;
1118 }
1119
1120 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
1121 memprintf(err,
1122 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
1123 args[0], args[1], proxy_type_str(curpx), curpx->id);
Willy Tarreau9faebe32019-06-07 19:00:37 +02001124
1125 if (ptr == PARSE_TIME_OVER)
1126 memprintf(err, "%s (timer overflow in '%s', maximum value is 2147483647 ms or ~24.8 days)", *err, args[2]);
1127 else if (ptr == PARSE_TIME_UNDER)
1128 memprintf(err, "%s (timer underflow in '%s', minimum non-null value is 1 ms)", *err, args[2]);
1129 else if (ptr)
Willy Tarreau39713102016-11-25 15:49:32 +01001130 memprintf(err, "%s (unexpected character '%c')", *err, *ptr);
1131 return -1;
1132 }
1133
1134 if (curpx->tcp_req.inspect_delay) {
1135 memprintf(err, "ignoring %s %s (was already defined) in %s '%s'",
1136 args[0], args[1], proxy_type_str(curpx), curpx->id);
1137 return 1;
1138 }
1139 curpx->tcp_req.inspect_delay = val;
1140 return 0;
1141 }
1142
1143 rule = calloc(1, sizeof(*rule));
1144 LIST_INIT(&rule->list);
1145 arg = 1;
1146 where = 0;
1147
1148 if (strcmp(args[1], "content") == 0) {
1149 arg++;
1150
1151 if (curpx->cap & PR_CAP_FE)
1152 where |= SMP_VAL_FE_REQ_CNT;
1153 if (curpx->cap & PR_CAP_BE)
1154 where |= SMP_VAL_BE_REQ_CNT;
Christopher Fauletcb9106b2019-12-19 15:23:17 +01001155 rule->from = ACT_F_TCP_REQ_CNT;
Willy Tarreau39713102016-11-25 15:49:32 +01001156 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, where, file, line) < 0)
1157 goto error;
1158
1159 acl = rule->cond ? acl_cond_conflicts(rule->cond, where) : NULL;
1160 if (acl) {
1161 if (acl->name && *acl->name)
1162 memprintf(err,
1163 "acl '%s' will never match in '%s %s' because it only involves keywords that are incompatible with '%s'",
1164 acl->name, args[0], args[1], sample_ckp_names(where));
1165 else
1166 memprintf(err,
1167 "anonymous acl will never match in '%s %s' because it uses keyword '%s' which is incompatible with '%s'",
1168 args[0], args[1],
1169 LIST_ELEM(acl->expr.n, struct acl_expr *, list)->kw,
1170 sample_ckp_names(where));
1171
1172 warn++;
1173 }
1174 else if (rule->cond && acl_cond_kw_conflicts(rule->cond, where, &acl, &kw)) {
1175 if (acl->name && *acl->name)
1176 memprintf(err,
1177 "acl '%s' involves keyword '%s' which is incompatible with '%s'",
1178 acl->name, kw, sample_ckp_names(where));
1179 else
1180 memprintf(err,
1181 "anonymous acl involves keyword '%s' which is incompatible with '%s'",
1182 kw, sample_ckp_names(where));
1183 warn++;
1184 }
1185
1186 /* the following function directly emits the warning */
1187 warnif_misplaced_tcp_cont(curpx, file, line, args[0]);
1188 LIST_ADDQ(&curpx->tcp_req.inspect_rules, &rule->list);
1189 }
1190 else if (strcmp(args[1], "connection") == 0) {
1191 arg++;
1192
1193 if (!(curpx->cap & PR_CAP_FE)) {
1194 memprintf(err, "%s %s is not allowed because %s %s is not a frontend",
1195 args[0], args[1], proxy_type_str(curpx), curpx->id);
1196 goto error;
1197 }
1198
1199 where |= SMP_VAL_FE_CON_ACC;
Christopher Fauletcb9106b2019-12-19 15:23:17 +01001200 rule->from = ACT_F_TCP_REQ_CON;
Willy Tarreau39713102016-11-25 15:49:32 +01001201 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, where, file, line) < 0)
1202 goto error;
1203
1204 acl = rule->cond ? acl_cond_conflicts(rule->cond, where) : NULL;
1205 if (acl) {
1206 if (acl->name && *acl->name)
1207 memprintf(err,
1208 "acl '%s' will never match in '%s %s' because it only involves keywords that are incompatible with '%s'",
1209 acl->name, args[0], args[1], sample_ckp_names(where));
1210 else
1211 memprintf(err,
1212 "anonymous acl will never match in '%s %s' because it uses keyword '%s' which is incompatible with '%s'",
1213 args[0], args[1],
1214 LIST_ELEM(acl->expr.n, struct acl_expr *, list)->kw,
1215 sample_ckp_names(where));
1216
1217 warn++;
1218 }
1219 else if (rule->cond && acl_cond_kw_conflicts(rule->cond, where, &acl, &kw)) {
1220 if (acl->name && *acl->name)
1221 memprintf(err,
1222 "acl '%s' involves keyword '%s' which is incompatible with '%s'",
1223 acl->name, kw, sample_ckp_names(where));
1224 else
1225 memprintf(err,
1226 "anonymous acl involves keyword '%s' which is incompatible with '%s'",
1227 kw, sample_ckp_names(where));
1228 warn++;
1229 }
1230
1231 /* the following function directly emits the warning */
1232 warnif_misplaced_tcp_conn(curpx, file, line, args[0]);
1233 LIST_ADDQ(&curpx->tcp_req.l4_rules, &rule->list);
1234 }
1235 else if (strcmp(args[1], "session") == 0) {
1236 arg++;
1237
1238 if (!(curpx->cap & PR_CAP_FE)) {
1239 memprintf(err, "%s %s is not allowed because %s %s is not a frontend",
1240 args[0], args[1], proxy_type_str(curpx), curpx->id);
1241 goto error;
1242 }
1243
1244 where |= SMP_VAL_FE_SES_ACC;
Christopher Fauletcb9106b2019-12-19 15:23:17 +01001245 rule->from = ACT_F_TCP_REQ_SES;
Willy Tarreau39713102016-11-25 15:49:32 +01001246 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, where, file, line) < 0)
1247 goto error;
1248
1249 acl = rule->cond ? acl_cond_conflicts(rule->cond, where) : NULL;
1250 if (acl) {
1251 if (acl->name && *acl->name)
1252 memprintf(err,
1253 "acl '%s' will never match in '%s %s' because it only involves keywords that are incompatible with '%s'",
1254 acl->name, args[0], args[1], sample_ckp_names(where));
1255 else
1256 memprintf(err,
1257 "anonymous acl will never match in '%s %s' because it uses keyword '%s' which is incompatible with '%s'",
1258 args[0], args[1],
1259 LIST_ELEM(acl->expr.n, struct acl_expr *, list)->kw,
1260 sample_ckp_names(where));
1261 warn++;
1262 }
1263 else if (rule->cond && acl_cond_kw_conflicts(rule->cond, where, &acl, &kw)) {
1264 if (acl->name && *acl->name)
1265 memprintf(err,
1266 "acl '%s' involves keyword '%s' which is incompatible with '%s'",
1267 acl->name, kw, sample_ckp_names(where));
1268 else
1269 memprintf(err,
1270 "anonymous acl involves keyword '%s' which is incompatible with '%s'",
1271 kw, sample_ckp_names(where));
1272 warn++;
1273 }
1274
1275 /* the following function directly emits the warning */
1276 warnif_misplaced_tcp_sess(curpx, file, line, args[0]);
1277 LIST_ADDQ(&curpx->tcp_req.l5_rules, &rule->list);
1278 }
1279 else {
1280 if (curpx == defpx)
1281 memprintf(err,
1282 "'%s' expects 'inspect-delay', 'connection', or 'content' in defaults section (got '%s')",
1283 args[0], args[1]);
1284 else
1285 memprintf(err,
1286 "'%s' expects 'inspect-delay', 'connection', or 'content' in %s '%s' (got '%s')",
1287 args[0], proxy_type_str(curpx), curpx->id, args[1]);
1288 goto error;
1289 }
1290
1291 return warn;
1292 error:
1293 free(rule);
1294 return -1;
1295}
1296
1297static struct cfg_kw_list cfg_kws = {ILH, {
1298 { CFG_LISTEN, "tcp-request", tcp_parse_tcp_req },
1299 { CFG_LISTEN, "tcp-response", tcp_parse_tcp_rep },
1300 { 0, NULL, NULL },
1301}};
1302
Willy Tarreau0108d902018-11-25 19:14:37 +01001303INITCALL1(STG_REGISTER, cfg_register_keywords, &cfg_kws);
Willy Tarreau39713102016-11-25 15:49:32 +01001304
1305/*
1306 * Local variables:
1307 * c-indent-level: 8
1308 * c-basic-offset: 8
1309 * End:
1310 */