blob: 48f0ec33158784a87d2dd4e0127ad2e0f76baaff [file] [log] [blame]
Willy Tarreau59f98392012-07-06 14:13:49 +02001/*
2 * Connection management functions
3 *
4 * Copyright 2000-2012 Willy Tarreau <w@1wt.eu>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
Willy Tarreaue1e4a612012-10-05 00:10:55 +020013#include <errno.h>
14
Willy Tarreau59f98392012-07-06 14:13:49 +020015#include <common/compat.h>
16#include <common/config.h>
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +010017#include <common/namespace.h>
Willy Tarreau59f98392012-07-06 14:13:49 +020018
Willy Tarreauc5788912012-08-24 18:12:41 +020019#include <proto/connection.h>
Willy Tarreaudd2f85e2012-09-02 22:34:23 +020020#include <proto/fd.h>
Willy Tarreau5f1504f2012-10-04 23:55:57 +020021#include <proto/frontend.h>
Willy Tarreau2da156f2012-07-23 15:07:23 +020022#include <proto/proto_tcp.h>
Willy Tarreau2c6be842012-07-06 17:12:34 +020023#include <proto/stream_interface.h>
Emeric Brun4f603012017-01-05 15:11:44 +010024#include <proto/sample.h>
Willy Tarreau59f98392012-07-06 14:13:49 +020025
Emeric Brun46591952012-05-18 15:47:34 +020026#ifdef USE_OPENSSL
27#include <proto/ssl_sock.h>
28#endif
29
Willy Tarreauf2943dc2012-10-26 20:10:28 +020030struct pool_head *pool2_connection;
Willy Tarreau13e14102016-12-22 20:25:26 +010031struct xprt_ops *registered_xprt[XPRT_ENTRIES] = { NULL, };
Willy Tarreauf2943dc2012-10-26 20:10:28 +020032
33/* perform minimal intializations, report 0 in case of error, 1 if OK. */
34int init_connection()
35{
36 pool2_connection = create_pool("connection", sizeof (struct connection), MEM_F_SHARED);
37 return pool2_connection != NULL;
38}
39
Willy Tarreau59f98392012-07-06 14:13:49 +020040/* I/O callback for fd-based connections. It calls the read/write handlers
Willy Tarreau7a798e52016-04-14 11:13:20 +020041 * provided by the connection's sock_ops, which must be valid.
Willy Tarreau59f98392012-07-06 14:13:49 +020042 */
Willy Tarreau7a798e52016-04-14 11:13:20 +020043void conn_fd_handler(int fd)
Willy Tarreau59f98392012-07-06 14:13:49 +020044{
Willy Tarreau80184712012-07-06 14:54:49 +020045 struct connection *conn = fdtab[fd].owner;
Willy Tarreau9e272bf2012-10-03 21:04:48 +020046 unsigned int flags;
Willy Tarreau59f98392012-07-06 14:13:49 +020047
Willy Tarreauc76ae332012-07-12 15:32:13 +020048 if (unlikely(!conn))
Willy Tarreau7a798e52016-04-14 11:13:20 +020049 return;
Willy Tarreau59f98392012-07-06 14:13:49 +020050
Willy Tarreau7d281492012-12-16 19:19:13 +010051 conn_refresh_polling_flags(conn);
Willy Tarreau916e12d2017-10-25 09:22:43 +020052 conn->flags |= CO_FL_WILL_UPDATE;
53
Willy Tarreau7d281492012-12-16 19:19:13 +010054 flags = conn->flags & ~CO_FL_ERROR; /* ensure to call the wake handler upon error */
Willy Tarreaud29a0662012-12-10 16:33:38 +010055
Willy Tarreauc76ae332012-07-12 15:32:13 +020056 process_handshake:
Willy Tarreauf9dabec2012-08-17 17:33:53 +020057 /* The handshake callbacks are called in sequence. If either of them is
58 * missing something, it must enable the required polling at the socket
59 * layer of the connection. Polling state is not guaranteed when entering
60 * these handlers, so any handshake handler which does not complete its
Willy Tarreaud6e999b2013-11-25 08:41:15 +010061 * work must explicitly disable events it's not interested in. Error
62 * handling is also performed here in order to reduce the number of tests
63 * around.
Willy Tarreauf9dabec2012-08-17 17:33:53 +020064 */
Willy Tarreaud6e999b2013-11-25 08:41:15 +010065 while (unlikely(conn->flags & (CO_FL_HANDSHAKE | CO_FL_ERROR))) {
Willy Tarreau310987a2014-01-22 19:46:33 +010066 if (unlikely(conn->flags & CO_FL_ERROR))
Willy Tarreau2c6be842012-07-06 17:12:34 +020067 goto leave;
Willy Tarreau59f98392012-07-06 14:13:49 +020068
Bertrand Jacquin93b227d2016-06-04 15:11:10 +010069 if (conn->flags & CO_FL_ACCEPT_CIP)
70 if (!conn_recv_netscaler_cip(conn, CO_FL_ACCEPT_CIP))
71 goto leave;
72
Willy Tarreau22cda212012-08-31 17:43:29 +020073 if (conn->flags & CO_FL_ACCEPT_PROXY)
74 if (!conn_recv_proxy(conn, CO_FL_ACCEPT_PROXY))
75 goto leave;
76
Willy Tarreau57cd3e42013-10-24 22:01:26 +020077 if (conn->flags & CO_FL_SEND_PROXY)
78 if (!conn_si_send_proxy(conn, CO_FL_SEND_PROXY))
Willy Tarreau5f1504f2012-10-04 23:55:57 +020079 goto leave;
Emeric Brun46591952012-05-18 15:47:34 +020080#ifdef USE_OPENSSL
81 if (conn->flags & CO_FL_SSL_WAIT_HS)
82 if (!ssl_sock_handshake(conn, CO_FL_SSL_WAIT_HS))
83 goto leave;
84#endif
Willy Tarreauc76ae332012-07-12 15:32:13 +020085 }
86
Willy Tarreauf9dabec2012-08-17 17:33:53 +020087 /* Once we're purely in the data phase, we disable handshake polling */
88 if (!(conn->flags & CO_FL_POLL_SOCK))
89 __conn_sock_stop_both(conn);
Willy Tarreauc76ae332012-07-12 15:32:13 +020090
Willy Tarreau8e3c6ce2017-08-28 15:46:01 +020091 /* The connection owner might want to be notified about an end of
92 * handshake indicating the connection is ready, before we proceed with
93 * any data exchange. The callback may fail and cause the connection to
94 * be destroyed, thus we must not use it anymore and should immediately
95 * leave instead. The caller must immediately unregister itself once
96 * called.
Willy Tarreau2542b532012-08-31 16:01:23 +020097 */
Willy Tarreau8e3c6ce2017-08-28 15:46:01 +020098 if (conn->xprt_done_cb && conn->xprt_done_cb(conn) < 0)
Willy Tarreau7a798e52016-04-14 11:13:20 +020099 return;
Willy Tarreau2542b532012-08-31 16:01:23 +0200100
Willy Tarreau57ec32f2017-04-11 19:59:33 +0200101 if (conn->xprt && fd_send_ready(fd) &&
Olivier Houchard1a0545f2017-09-13 18:30:23 +0200102 ((conn->flags & (CO_FL_XPRT_WR_ENA|CO_FL_ERROR|CO_FL_HANDSHAKE)) == CO_FL_XPRT_WR_ENA)) {
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100103 /* force reporting of activity by clearing the previous flags :
104 * we'll have at least ERROR or CONNECTED at the end of an I/O,
105 * both of which will be detected below.
Willy Tarreau9e272bf2012-10-03 21:04:48 +0200106 */
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100107 flags = 0;
Willy Tarreau57ec32f2017-04-11 19:59:33 +0200108 conn->data->send(conn);
Willy Tarreau9e272bf2012-10-03 21:04:48 +0200109 }
Willy Tarreau59f98392012-07-06 14:13:49 +0200110
Willy Tarreau57ec32f2017-04-11 19:59:33 +0200111 /* The data transfer starts here and stops on error and handshakes. Note
112 * that we must absolutely test conn->xprt at each step in case it suddenly
113 * changes due to a quick unexpected close().
114 */
115 if (conn->xprt && fd_recv_ready(fd) &&
Olivier Houchard1a0545f2017-09-13 18:30:23 +0200116 ((conn->flags & (CO_FL_XPRT_RD_ENA|CO_FL_WAIT_ROOM|CO_FL_ERROR|CO_FL_HANDSHAKE)) == CO_FL_XPRT_RD_ENA)) {
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100117 /* force reporting of activity by clearing the previous flags :
118 * we'll have at least ERROR or CONNECTED at the end of an I/O,
119 * both of which will be detected below.
Willy Tarreau9e272bf2012-10-03 21:04:48 +0200120 */
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100121 flags = 0;
Willy Tarreau57ec32f2017-04-11 19:59:33 +0200122 conn->data->recv(conn);
Willy Tarreau9e272bf2012-10-03 21:04:48 +0200123 }
Willy Tarreau2da156f2012-07-23 15:07:23 +0200124
Willy Tarreauc76ae332012-07-12 15:32:13 +0200125 /* It may happen during the data phase that a handshake is
126 * enabled again (eg: SSL)
127 */
Willy Tarreaud6e999b2013-11-25 08:41:15 +0100128 if (unlikely(conn->flags & (CO_FL_HANDSHAKE | CO_FL_ERROR)))
Willy Tarreauc76ae332012-07-12 15:32:13 +0200129 goto process_handshake;
130
Willy Tarreaufd803bb2014-01-20 15:13:07 +0100131 if (unlikely(conn->flags & CO_FL_WAIT_L4_CONN)) {
Willy Tarreauf8deb0c2012-09-01 17:59:22 +0200132 /* still waiting for a connection to establish and nothing was
133 * attempted yet to probe the connection. Then let's retry the
134 * connect().
Willy Tarreau2da156f2012-07-23 15:07:23 +0200135 */
Willy Tarreau239d7182012-07-23 18:53:03 +0200136 if (!tcp_connect_probe(conn))
Willy Tarreauafad0e02012-08-09 14:45:22 +0200137 goto leave;
Willy Tarreau2da156f2012-07-23 15:07:23 +0200138 }
Willy Tarreau2c6be842012-07-06 17:12:34 +0200139 leave:
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100140 /* Verify if the connection just established. */
Willy Tarreau7bf3fa32017-03-14 20:19:29 +0100141 if (unlikely(!(conn->flags & (CO_FL_WAIT_L4_CONN | CO_FL_WAIT_L6_CONN | CO_FL_CONNECTED))))
142 conn->flags |= CO_FL_CONNECTED;
143
Willy Tarreau8e3c6ce2017-08-28 15:46:01 +0200144 /* The connection owner might want to be notified about failures to
145 * complete the handshake. The callback may fail and cause the
146 * connection to be destroyed, thus we must not use it anymore and
147 * should immediately leave instead. The caller must immediately
148 * unregister itself once called.
149 */
150 if (((conn->flags ^ flags) & CO_FL_NOTIFY_DONE) &&
151 conn->xprt_done_cb && conn->xprt_done_cb(conn) < 0)
152 return;
153
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100154 /* The wake callback is normally used to notify the data layer about
155 * data layer activity (successful send/recv), connection establishment,
156 * shutdown and fatal errors. We need to consider the following
157 * situations to wake up the data layer :
158 * - change among the CO_FL_NOTIFY_DATA flags :
159 * {DATA,SOCK}_{RD,WR}_SH, ERROR,
160 * - absence of any of {L4,L6}_CONN and CONNECTED, indicating the
161 * end of handshake and transition to CONNECTED
162 * - raise of CONNECTED with HANDSHAKE down
163 * - end of HANDSHAKE with CONNECTED set
164 * - regular data layer activity
165 *
166 * Note that the wake callback is allowed to release the connection and
167 * the fd (and return < 0 in this case).
Willy Tarreau2396c1c2012-10-03 21:12:16 +0200168 */
Willy Tarreau9fa1ee62017-03-18 15:39:57 +0100169 if ((((conn->flags ^ flags) & CO_FL_NOTIFY_DATA) ||
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100170 ((flags & (CO_FL_CONNECTED|CO_FL_HANDSHAKE)) != CO_FL_CONNECTED &&
171 (conn->flags & (CO_FL_CONNECTED|CO_FL_HANDSHAKE)) == CO_FL_CONNECTED)) &&
Willy Tarreau2396c1c2012-10-03 21:12:16 +0200172 conn->data->wake(conn) < 0)
Willy Tarreau7a798e52016-04-14 11:13:20 +0200173 return;
Willy Tarreaufd31e532012-07-23 18:24:25 +0200174
Willy Tarreau61ace1b2012-07-23 12:14:26 +0200175 /* remove the events before leaving */
Willy Tarreau26d7cfc2012-12-07 00:09:43 +0100176 fdtab[fd].ev &= FD_POLL_STICKY;
Willy Tarreauf9dabec2012-08-17 17:33:53 +0200177
178 /* commit polling changes */
Willy Tarreau916e12d2017-10-25 09:22:43 +0200179 conn->flags &= ~CO_FL_WILL_UPDATE;
Willy Tarreauf9dabec2012-08-17 17:33:53 +0200180 conn_cond_update_polling(conn);
Willy Tarreau7a798e52016-04-14 11:13:20 +0200181 return;
Willy Tarreau59f98392012-07-06 14:13:49 +0200182}
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200183
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200184/* Update polling on connection <c>'s file descriptor depending on its current
185 * state as reported in the connection's CO_FL_CURR_* flags, reports of EAGAIN
Olivier Houchard1a0545f2017-09-13 18:30:23 +0200186 * in CO_FL_WAIT_*, and the data layer expectations indicated by CO_FL_XPRT_*.
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200187 * The connection flags are updated with the new flags at the end of the
Willy Tarreau0ffde2c2012-10-04 22:21:15 +0200188 * operation. Polling is totally disabled if an error was reported.
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200189 */
Olivier Houchard1a0545f2017-09-13 18:30:23 +0200190void conn_update_xprt_polling(struct connection *c)
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200191{
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200192 unsigned int f = c->flags;
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200193
Willy Tarreau3c728722014-01-23 13:50:42 +0100194 if (!conn_ctrl_ready(c))
Willy Tarreauf79c8172013-10-21 16:30:56 +0200195 return;
196
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200197 /* update read status if needed */
Olivier Houchard1a0545f2017-09-13 18:30:23 +0200198 if (unlikely((f & (CO_FL_CURR_RD_ENA|CO_FL_XPRT_RD_ENA)) == CO_FL_XPRT_RD_ENA)) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200199 fd_want_recv(c->handle.fd);
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100200 f |= CO_FL_CURR_RD_ENA;
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200201 }
Olivier Houchard1a0545f2017-09-13 18:30:23 +0200202 else if (unlikely((f & (CO_FL_CURR_RD_ENA|CO_FL_XPRT_RD_ENA)) == CO_FL_CURR_RD_ENA)) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200203 fd_stop_recv(c->handle.fd);
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100204 f &= ~CO_FL_CURR_RD_ENA;
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200205 }
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200206
207 /* update write status if needed */
Olivier Houchard1a0545f2017-09-13 18:30:23 +0200208 if (unlikely((f & (CO_FL_CURR_WR_ENA|CO_FL_XPRT_WR_ENA)) == CO_FL_XPRT_WR_ENA)) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200209 fd_want_send(c->handle.fd);
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100210 f |= CO_FL_CURR_WR_ENA;
211 }
Olivier Houchard1a0545f2017-09-13 18:30:23 +0200212 else if (unlikely((f & (CO_FL_CURR_WR_ENA|CO_FL_XPRT_WR_ENA)) == CO_FL_CURR_WR_ENA)) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200213 fd_stop_send(c->handle.fd);
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100214 f &= ~CO_FL_CURR_WR_ENA;
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200215 }
Willy Tarreau310987a2014-01-22 19:46:33 +0100216 c->flags = f;
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200217}
218
219/* Update polling on connection <c>'s file descriptor depending on its current
220 * state as reported in the connection's CO_FL_CURR_* flags, reports of EAGAIN
221 * in CO_FL_WAIT_*, and the sock layer expectations indicated by CO_FL_SOCK_*.
222 * The connection flags are updated with the new flags at the end of the
Willy Tarreau0ffde2c2012-10-04 22:21:15 +0200223 * operation. Polling is totally disabled if an error was reported.
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200224 */
225void conn_update_sock_polling(struct connection *c)
226{
227 unsigned int f = c->flags;
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200228
Willy Tarreau3c728722014-01-23 13:50:42 +0100229 if (!conn_ctrl_ready(c))
Willy Tarreauf79c8172013-10-21 16:30:56 +0200230 return;
231
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200232 /* update read status if needed */
Willy Tarreau310987a2014-01-22 19:46:33 +0100233 if (unlikely((f & (CO_FL_CURR_RD_ENA|CO_FL_SOCK_RD_ENA)) == CO_FL_SOCK_RD_ENA)) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200234 fd_want_recv(c->handle.fd);
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100235 f |= CO_FL_CURR_RD_ENA;
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200236 }
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100237 else if (unlikely((f & (CO_FL_CURR_RD_ENA|CO_FL_SOCK_RD_ENA)) == CO_FL_CURR_RD_ENA)) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200238 fd_stop_recv(c->handle.fd);
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100239 f &= ~CO_FL_CURR_RD_ENA;
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200240 }
241
242 /* update write status if needed */
Willy Tarreau310987a2014-01-22 19:46:33 +0100243 if (unlikely((f & (CO_FL_CURR_WR_ENA|CO_FL_SOCK_WR_ENA)) == CO_FL_SOCK_WR_ENA)) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200244 fd_want_send(c->handle.fd);
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100245 f |= CO_FL_CURR_WR_ENA;
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200246 }
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100247 else if (unlikely((f & (CO_FL_CURR_WR_ENA|CO_FL_SOCK_WR_ENA)) == CO_FL_CURR_WR_ENA)) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200248 fd_stop_send(c->handle.fd);
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100249 f &= ~CO_FL_CURR_WR_ENA;
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200250 }
Willy Tarreau310987a2014-01-22 19:46:33 +0100251 c->flags = f;
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200252}
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200253
Willy Tarreauff3e6482015-03-12 23:56:52 +0100254/* Send a message over an established connection. It makes use of send() and
255 * returns the same return code and errno. If the socket layer is not ready yet
256 * then -1 is returned and ENOTSOCK is set into errno. If the fd is not marked
257 * as ready, or if EAGAIN or ENOTCONN is returned, then we return 0. It returns
258 * EMSGSIZE if called with a zero length message. The purpose is to simplify
259 * some rare attempts to directly write on the socket from above the connection
260 * (typically send_proxy). In case of EAGAIN, the fd is marked as "cant_send".
261 * It automatically retries on EINTR. Other errors cause the connection to be
262 * marked as in error state. It takes similar arguments as send() except the
263 * first one which is the connection instead of the file descriptor. Note,
264 * MSG_DONTWAIT and MSG_NOSIGNAL are forced on the flags.
265 */
266int conn_sock_send(struct connection *conn, const void *buf, int len, int flags)
267{
268 int ret;
269
270 ret = -1;
271 errno = ENOTSOCK;
272
273 if (conn->flags & CO_FL_SOCK_WR_SH)
274 goto fail;
275
276 if (!conn_ctrl_ready(conn))
277 goto fail;
278
279 errno = EMSGSIZE;
280 if (!len)
281 goto fail;
282
Willy Tarreau585744b2017-08-24 14:31:19 +0200283 if (!fd_send_ready(conn->handle.fd))
Willy Tarreauff3e6482015-03-12 23:56:52 +0100284 goto wait;
285
286 do {
Willy Tarreau585744b2017-08-24 14:31:19 +0200287 ret = send(conn->handle.fd, buf, len, flags | MSG_DONTWAIT | MSG_NOSIGNAL);
Willy Tarreauff3e6482015-03-12 23:56:52 +0100288 } while (ret < 0 && errno == EINTR);
289
290
291 if (ret > 0)
292 return ret;
293
294 if (ret == 0 || errno == EAGAIN || errno == ENOTCONN) {
295 wait:
Willy Tarreau585744b2017-08-24 14:31:19 +0200296 fd_cant_send(conn->handle.fd);
Willy Tarreauff3e6482015-03-12 23:56:52 +0100297 return 0;
298 }
299 fail:
300 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH | CO_FL_ERROR;
301 return ret;
302}
303
Willy Tarreaud85c4852015-03-13 00:40:28 +0100304/* Drains possibly pending incoming data on the file descriptor attached to the
305 * connection and update the connection's flags accordingly. This is used to
306 * know whether we need to disable lingering on close. Returns non-zero if it
307 * is safe to close without disabling lingering, otherwise zero. The SOCK_RD_SH
308 * flag may also be updated if the incoming shutdown was reported by the drain()
309 * function.
310 */
311int conn_sock_drain(struct connection *conn)
312{
313 if (!conn_ctrl_ready(conn))
314 return 1;
315
316 if (conn->flags & (CO_FL_ERROR | CO_FL_SOCK_RD_SH))
317 return 1;
318
Willy Tarreau585744b2017-08-24 14:31:19 +0200319 if (fdtab[conn->handle.fd].ev & (FD_POLL_ERR|FD_POLL_HUP)) {
320 fdtab[conn->handle.fd].linger_risk = 0;
Willy Tarreaud85c4852015-03-13 00:40:28 +0100321 }
322 else {
Willy Tarreau585744b2017-08-24 14:31:19 +0200323 if (!fd_recv_ready(conn->handle.fd))
Willy Tarreaud85c4852015-03-13 00:40:28 +0100324 return 0;
325
326 /* disable draining if we were called and have no drain function */
327 if (!conn->ctrl->drain) {
Olivier Houchard1a0545f2017-09-13 18:30:23 +0200328 __conn_xprt_stop_recv(conn);
Willy Tarreaud85c4852015-03-13 00:40:28 +0100329 return 0;
330 }
331
Willy Tarreau585744b2017-08-24 14:31:19 +0200332 if (conn->ctrl->drain(conn->handle.fd) <= 0)
Willy Tarreaud85c4852015-03-13 00:40:28 +0100333 return 0;
334 }
335
336 conn->flags |= CO_FL_SOCK_RD_SH;
337 return 1;
338}
339
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100340/*
341 * Get data length from tlv
342 */
343static int get_tlv_length(const struct tlv *src)
344{
345 return (src->length_hi << 8) | src->length_lo;
346}
347
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200348/* This handshake handler waits a PROXY protocol header at the beginning of the
349 * raw data stream. The header looks like this :
350 *
351 * "PROXY" <SP> PROTO <SP> SRC3 <SP> DST3 <SP> SRC4 <SP> <DST4> "\r\n"
352 *
353 * There must be exactly one space between each field. Fields are :
354 * - PROTO : layer 4 protocol, which must be "TCP4" or "TCP6".
355 * - SRC3 : layer 3 (eg: IP) source address in standard text form
356 * - DST3 : layer 3 (eg: IP) destination address in standard text form
357 * - SRC4 : layer 4 (eg: TCP port) source address in standard text form
358 * - DST4 : layer 4 (eg: TCP port) destination address in standard text form
359 *
360 * This line MUST be at the beginning of the buffer and MUST NOT wrap.
361 *
362 * The header line is small and in all cases smaller than the smallest normal
363 * TCP MSS. So it MUST always be delivered as one segment, which ensures we
364 * can safely use MSG_PEEK and avoid buffering.
365 *
366 * Once the data is fetched, the values are set in the connection's address
367 * fields, and data are removed from the socket's buffer. The function returns
368 * zero if it needs to wait for more data or if it fails, or 1 if it completed
369 * and removed itself.
370 */
371int conn_recv_proxy(struct connection *conn, int flag)
372{
373 char *line, *end;
Willy Tarreau77992672014-06-14 11:06:17 +0200374 struct proxy_hdr_v2 *hdr_v2;
375 const char v2sig[] = PP2_SIGNATURE;
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100376 int tlv_length = 0;
KOVACS Krisztian7209c202015-07-03 14:09:10 +0200377 int tlv_offset = 0;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200378
379 /* we might have been called just after an asynchronous shutr */
380 if (conn->flags & CO_FL_SOCK_RD_SH)
381 goto fail;
382
Willy Tarreau3c728722014-01-23 13:50:42 +0100383 if (!conn_ctrl_ready(conn))
Willy Tarreauf79c8172013-10-21 16:30:56 +0200384 goto fail;
385
Willy Tarreau585744b2017-08-24 14:31:19 +0200386 if (!fd_recv_ready(conn->handle.fd))
Willy Tarreaufd803bb2014-01-20 15:13:07 +0100387 return 0;
388
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200389 do {
Willy Tarreau585744b2017-08-24 14:31:19 +0200390 trash.len = recv(conn->handle.fd, trash.str, trash.size, MSG_PEEK);
Willy Tarreau19d14ef2012-10-29 16:51:55 +0100391 if (trash.len < 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200392 if (errno == EINTR)
393 continue;
394 if (errno == EAGAIN) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200395 fd_cant_recv(conn->handle.fd);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200396 return 0;
397 }
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100398 goto recv_abort;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200399 }
400 } while (0);
401
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100402 if (!trash.len) {
403 /* client shutdown */
404 conn->err_code = CO_ER_PRX_EMPTY;
405 goto fail;
406 }
407
Willy Tarreau19d14ef2012-10-29 16:51:55 +0100408 if (trash.len < 6)
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200409 goto missing;
410
Willy Tarreau19d14ef2012-10-29 16:51:55 +0100411 line = trash.str;
412 end = trash.str + trash.len;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200413
414 /* Decode a possible proxy request, fail early if it does not match */
Willy Tarreau77992672014-06-14 11:06:17 +0200415 if (strncmp(line, "PROXY ", 6) != 0)
416 goto not_v1;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200417
418 line += 6;
Willy Tarreau4c20d292014-06-14 11:41:36 +0200419 if (trash.len < 9) /* shortest possible line */
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200420 goto missing;
421
David CARLIER42ff05e2016-03-24 09:22:36 +0000422 if (memcmp(line, "TCP4 ", 5) == 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200423 u32 src3, dst3, sport, dport;
424
425 line += 5;
426
427 src3 = inetaddr_host_lim_ret(line, end, &line);
428 if (line == end)
429 goto missing;
430 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100431 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200432
433 dst3 = inetaddr_host_lim_ret(line, end, &line);
434 if (line == end)
435 goto missing;
436 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100437 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200438
439 sport = read_uint((const char **)&line, end);
440 if (line == end)
441 goto missing;
442 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100443 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200444
445 dport = read_uint((const char **)&line, end);
446 if (line > end - 2)
447 goto missing;
448 if (*line++ != '\r')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100449 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200450 if (*line++ != '\n')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100451 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200452
453 /* update the session's addresses and mark them set */
454 ((struct sockaddr_in *)&conn->addr.from)->sin_family = AF_INET;
455 ((struct sockaddr_in *)&conn->addr.from)->sin_addr.s_addr = htonl(src3);
456 ((struct sockaddr_in *)&conn->addr.from)->sin_port = htons(sport);
457
458 ((struct sockaddr_in *)&conn->addr.to)->sin_family = AF_INET;
459 ((struct sockaddr_in *)&conn->addr.to)->sin_addr.s_addr = htonl(dst3);
460 ((struct sockaddr_in *)&conn->addr.to)->sin_port = htons(dport);
461 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
462 }
David CARLIER42ff05e2016-03-24 09:22:36 +0000463 else if (memcmp(line, "TCP6 ", 5) == 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200464 u32 sport, dport;
465 char *src_s;
466 char *dst_s, *sport_s, *dport_s;
467 struct in6_addr src3, dst3;
468
469 line += 5;
470
471 src_s = line;
472 dst_s = sport_s = dport_s = NULL;
473 while (1) {
474 if (line > end - 2) {
475 goto missing;
476 }
477 else if (*line == '\r') {
478 *line = 0;
479 line++;
480 if (*line++ != '\n')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100481 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200482 break;
483 }
484
485 if (*line == ' ') {
486 *line = 0;
487 if (!dst_s)
488 dst_s = line + 1;
489 else if (!sport_s)
490 sport_s = line + 1;
491 else if (!dport_s)
492 dport_s = line + 1;
493 }
494 line++;
495 }
496
497 if (!dst_s || !sport_s || !dport_s)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100498 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200499
500 sport = read_uint((const char **)&sport_s,dport_s - 1);
501 if (*sport_s != 0)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100502 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200503
504 dport = read_uint((const char **)&dport_s,line - 2);
505 if (*dport_s != 0)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100506 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200507
508 if (inet_pton(AF_INET6, src_s, (void *)&src3) != 1)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100509 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200510
511 if (inet_pton(AF_INET6, dst_s, (void *)&dst3) != 1)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100512 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200513
514 /* update the session's addresses and mark them set */
515 ((struct sockaddr_in6 *)&conn->addr.from)->sin6_family = AF_INET6;
516 memcpy(&((struct sockaddr_in6 *)&conn->addr.from)->sin6_addr, &src3, sizeof(struct in6_addr));
517 ((struct sockaddr_in6 *)&conn->addr.from)->sin6_port = htons(sport);
518
519 ((struct sockaddr_in6 *)&conn->addr.to)->sin6_family = AF_INET6;
520 memcpy(&((struct sockaddr_in6 *)&conn->addr.to)->sin6_addr, &dst3, sizeof(struct in6_addr));
521 ((struct sockaddr_in6 *)&conn->addr.to)->sin6_port = htons(dport);
522 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
523 }
Willy Tarreau4c20d292014-06-14 11:41:36 +0200524 else if (memcmp(line, "UNKNOWN\r\n", 9) == 0) {
525 /* This can be a UNIX socket forwarded by an haproxy upstream */
526 line += 9;
527 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200528 else {
Willy Tarreau4c20d292014-06-14 11:41:36 +0200529 /* The protocol does not match something known (TCP4/TCP6/UNKNOWN) */
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100530 conn->err_code = CO_ER_PRX_BAD_PROTO;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200531 goto fail;
532 }
533
Willy Tarreau77992672014-06-14 11:06:17 +0200534 trash.len = line - trash.str;
535 goto eat_header;
536
537 not_v1:
538 /* try PPv2 */
539 if (trash.len < PP2_HEADER_LEN)
540 goto missing;
541
542 hdr_v2 = (struct proxy_hdr_v2 *)trash.str;
543
544 if (memcmp(hdr_v2->sig, v2sig, PP2_SIGNATURE_LEN) != 0 ||
545 (hdr_v2->ver_cmd & PP2_VERSION_MASK) != PP2_VERSION) {
546 conn->err_code = CO_ER_PRX_NOT_HDR;
547 goto fail;
548 }
549
550 if (trash.len < PP2_HEADER_LEN + ntohs(hdr_v2->len))
551 goto missing;
552
553 switch (hdr_v2->ver_cmd & PP2_CMD_MASK) {
554 case 0x01: /* PROXY command */
555 switch (hdr_v2->fam) {
556 case 0x11: /* TCPv4 */
KOVACS Krisztianefd3aa92014-11-19 10:53:20 +0100557 if (ntohs(hdr_v2->len) < PP2_ADDR_LEN_INET)
558 goto bad_header;
559
Willy Tarreau77992672014-06-14 11:06:17 +0200560 ((struct sockaddr_in *)&conn->addr.from)->sin_family = AF_INET;
561 ((struct sockaddr_in *)&conn->addr.from)->sin_addr.s_addr = hdr_v2->addr.ip4.src_addr;
562 ((struct sockaddr_in *)&conn->addr.from)->sin_port = hdr_v2->addr.ip4.src_port;
563 ((struct sockaddr_in *)&conn->addr.to)->sin_family = AF_INET;
564 ((struct sockaddr_in *)&conn->addr.to)->sin_addr.s_addr = hdr_v2->addr.ip4.dst_addr;
565 ((struct sockaddr_in *)&conn->addr.to)->sin_port = hdr_v2->addr.ip4.dst_port;
566 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
KOVACS Krisztian7209c202015-07-03 14:09:10 +0200567 tlv_offset = PP2_HEADER_LEN + PP2_ADDR_LEN_INET;
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100568 tlv_length = ntohs(hdr_v2->len) - PP2_ADDR_LEN_INET;
Willy Tarreau77992672014-06-14 11:06:17 +0200569 break;
570 case 0x21: /* TCPv6 */
KOVACS Krisztianefd3aa92014-11-19 10:53:20 +0100571 if (ntohs(hdr_v2->len) < PP2_ADDR_LEN_INET6)
572 goto bad_header;
573
Willy Tarreau77992672014-06-14 11:06:17 +0200574 ((struct sockaddr_in6 *)&conn->addr.from)->sin6_family = AF_INET6;
575 memcpy(&((struct sockaddr_in6 *)&conn->addr.from)->sin6_addr, hdr_v2->addr.ip6.src_addr, 16);
576 ((struct sockaddr_in6 *)&conn->addr.from)->sin6_port = hdr_v2->addr.ip6.src_port;
577 ((struct sockaddr_in6 *)&conn->addr.to)->sin6_family = AF_INET6;
578 memcpy(&((struct sockaddr_in6 *)&conn->addr.to)->sin6_addr, hdr_v2->addr.ip6.dst_addr, 16);
579 ((struct sockaddr_in6 *)&conn->addr.to)->sin6_port = hdr_v2->addr.ip6.dst_port;
580 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
KOVACS Krisztian7209c202015-07-03 14:09:10 +0200581 tlv_offset = PP2_HEADER_LEN + PP2_ADDR_LEN_INET6;
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100582 tlv_length = ntohs(hdr_v2->len) - PP2_ADDR_LEN_INET6;
Willy Tarreau77992672014-06-14 11:06:17 +0200583 break;
584 }
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100585
586 /* TLV parsing */
587 if (tlv_length > 0) {
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100588 while (tlv_offset + TLV_HEADER_SIZE <= trash.len) {
589 const struct tlv *tlv_packet = (struct tlv *) &trash.str[tlv_offset];
590 const int tlv_len = get_tlv_length(tlv_packet);
591 tlv_offset += tlv_len + TLV_HEADER_SIZE;
592
593 switch (tlv_packet->type) {
594#ifdef CONFIG_HAP_NS
595 case PP2_TYPE_NETNS: {
596 const struct netns_entry *ns;
597 ns = netns_store_lookup((char*)tlv_packet->value, tlv_len);
598 if (ns)
599 conn->proxy_netns = ns;
600 break;
601 }
602#endif
603 default:
604 break;
605 }
606 }
607 }
608
Willy Tarreau77992672014-06-14 11:06:17 +0200609 /* unsupported protocol, keep local connection address */
610 break;
611 case 0x00: /* LOCAL command */
612 /* keep local connection address for LOCAL */
613 break;
614 default:
615 goto bad_header; /* not a supported command */
616 }
617
618 trash.len = PP2_HEADER_LEN + ntohs(hdr_v2->len);
619 goto eat_header;
620
621 eat_header:
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200622 /* remove the PROXY line from the request. For this we re-read the
623 * exact line at once. If we don't get the exact same result, we
624 * fail.
625 */
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200626 do {
Willy Tarreau585744b2017-08-24 14:31:19 +0200627 int len2 = recv(conn->handle.fd, trash.str, trash.len, 0);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200628 if (len2 < 0 && errno == EINTR)
629 continue;
Willy Tarreau19d14ef2012-10-29 16:51:55 +0100630 if (len2 != trash.len)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100631 goto recv_abort;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200632 } while (0);
633
634 conn->flags &= ~flag;
Emeric Brun4f603012017-01-05 15:11:44 +0100635 conn->flags |= CO_FL_RCVD_PROXY;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200636 return 1;
637
638 missing:
639 /* Missing data. Since we're using MSG_PEEK, we can only poll again if
640 * we have not read anything. Otherwise we need to fail because we won't
641 * be able to poll anymore.
642 */
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100643 conn->err_code = CO_ER_PRX_TRUNCATED;
644 goto fail;
645
646 bad_header:
647 /* This is not a valid proxy protocol header */
648 conn->err_code = CO_ER_PRX_BAD_HDR;
649 goto fail;
650
651 recv_abort:
652 conn->err_code = CO_ER_PRX_ABORT;
Willy Tarreau26f4a042013-12-04 23:44:10 +0100653 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH;
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100654 goto fail;
655
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200656 fail:
Willy Tarreaud486ef52012-12-10 17:03:52 +0100657 __conn_sock_stop_both(conn);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200658 conn->flags |= CO_FL_ERROR;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200659 return 0;
660}
661
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100662/* This handshake handler waits a NetScaler Client IP insertion header
663 * at the beginning of the raw data stream. The header looks like this:
664 *
665 * 4 bytes: CIP magic number
666 * 4 bytes: Header length
667 * 20+ bytes: Header of the last IP packet sent by the client during
668 * TCP handshake.
669 * 20+ bytes: Header of the last TCP packet sent by the client during
670 * TCP handshake.
671 *
672 * This line MUST be at the beginning of the buffer and MUST NOT be
673 * fragmented.
674 *
675 * The header line is small and in all cases smaller than the smallest normal
676 * TCP MSS. So it MUST always be delivered as one segment, which ensures we
677 * can safely use MSG_PEEK and avoid buffering.
678 *
679 * Once the data is fetched, the values are set in the connection's address
680 * fields, and data are removed from the socket's buffer. The function returns
681 * zero if it needs to wait for more data or if it fails, or 1 if it completed
682 * and removed itself.
683 */
684int conn_recv_netscaler_cip(struct connection *conn, int flag)
685{
686 char *line;
687 uint32_t cip_magic;
688 uint32_t cip_len;
689 uint8_t ip_v;
690
691 /* we might have been called just after an asynchronous shutr */
692 if (conn->flags & CO_FL_SOCK_RD_SH)
693 goto fail;
694
695 if (!conn_ctrl_ready(conn))
696 goto fail;
697
Willy Tarreau585744b2017-08-24 14:31:19 +0200698 if (!fd_recv_ready(conn->handle.fd))
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100699 return 0;
700
701 do {
Willy Tarreau585744b2017-08-24 14:31:19 +0200702 trash.len = recv(conn->handle.fd, trash.str, trash.size, MSG_PEEK);
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100703 if (trash.len < 0) {
704 if (errno == EINTR)
705 continue;
706 if (errno == EAGAIN) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200707 fd_cant_recv(conn->handle.fd);
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100708 return 0;
709 }
710 goto recv_abort;
711 }
712 } while (0);
713
714 if (!trash.len) {
715 /* client shutdown */
716 conn->err_code = CO_ER_CIP_EMPTY;
717 goto fail;
718 }
719
720 /* Fail if buffer length is not large enough to contain
721 * CIP magic, CIP length */
722 if (trash.len < 8)
723 goto missing;
724
725 line = trash.str;
726
727 cip_magic = ntohl(*(uint32_t *)line);
728 cip_len = ntohl(*(uint32_t *)(line+4));
729
730 /* Decode a possible NetScaler Client IP request, fail early if
731 * it does not match */
732 if (cip_magic != objt_listener(conn->target)->bind_conf->ns_cip_magic)
733 goto bad_magic;
734
735 /* Fail if buffer length is not large enough to contain
736 * CIP magic, CIP length, minimal IP header */
737 if (trash.len < 28)
738 goto missing;
739
740 line += 8;
741
742 /* Get IP version from the first four bits */
743 ip_v = (*line & 0xf0) >> 4;
744
745 if (ip_v == 4) {
746 struct ip *hdr_ip4;
David Carlier3015a2e2016-07-04 22:51:33 +0100747 struct my_tcphdr *hdr_tcp;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100748
749 hdr_ip4 = (struct ip *)line;
750
751 if (trash.len < (8 + ntohs(hdr_ip4->ip_len))) {
752 /* Fail if buffer length is not large enough to contain
753 * CIP magic, CIP length, IPv4 header */
754 goto missing;
755 } else if (hdr_ip4->ip_p != IPPROTO_TCP) {
756 /* The protocol does not include a TCP header */
757 conn->err_code = CO_ER_CIP_BAD_PROTO;
758 goto fail;
759 } else if (trash.len < (28 + ntohs(hdr_ip4->ip_len))) {
760 /* Fail if buffer length is not large enough to contain
761 * CIP magic, CIP length, IPv4 header, TCP header */
762 goto missing;
763 }
764
David Carlier3015a2e2016-07-04 22:51:33 +0100765 hdr_tcp = (struct my_tcphdr *)(line + (hdr_ip4->ip_hl * 4));
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100766
767 /* update the session's addresses and mark them set */
768 ((struct sockaddr_in *)&conn->addr.from)->sin_family = AF_INET;
769 ((struct sockaddr_in *)&conn->addr.from)->sin_addr.s_addr = hdr_ip4->ip_src.s_addr;
770 ((struct sockaddr_in *)&conn->addr.from)->sin_port = hdr_tcp->source;
771
772 ((struct sockaddr_in *)&conn->addr.to)->sin_family = AF_INET;
773 ((struct sockaddr_in *)&conn->addr.to)->sin_addr.s_addr = hdr_ip4->ip_dst.s_addr;
774 ((struct sockaddr_in *)&conn->addr.to)->sin_port = hdr_tcp->dest;
775
776 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
777 }
778 else if (ip_v == 6) {
779 struct ip6_hdr *hdr_ip6;
David Carlier3015a2e2016-07-04 22:51:33 +0100780 struct my_tcphdr *hdr_tcp;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100781
782 hdr_ip6 = (struct ip6_hdr *)line;
783
784 if (trash.len < 28) {
785 /* Fail if buffer length is not large enough to contain
786 * CIP magic, CIP length, IPv6 header */
787 goto missing;
788 } else if (hdr_ip6->ip6_nxt != IPPROTO_TCP) {
789 /* The protocol does not include a TCP header */
790 conn->err_code = CO_ER_CIP_BAD_PROTO;
791 goto fail;
792 } else if (trash.len < 48) {
793 /* Fail if buffer length is not large enough to contain
794 * CIP magic, CIP length, IPv6 header, TCP header */
795 goto missing;
796 }
797
David Carlier3015a2e2016-07-04 22:51:33 +0100798 hdr_tcp = (struct my_tcphdr *)(line + sizeof(struct ip6_hdr));
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100799
800 /* update the session's addresses and mark them set */
801 ((struct sockaddr_in6 *)&conn->addr.from)->sin6_family = AF_INET6;
802 ((struct sockaddr_in6 *)&conn->addr.from)->sin6_addr = hdr_ip6->ip6_src;
803 ((struct sockaddr_in6 *)&conn->addr.from)->sin6_port = hdr_tcp->source;
804
805 ((struct sockaddr_in6 *)&conn->addr.to)->sin6_family = AF_INET6;
806 ((struct sockaddr_in6 *)&conn->addr.to)->sin6_addr = hdr_ip6->ip6_dst;
807 ((struct sockaddr_in6 *)&conn->addr.to)->sin6_port = hdr_tcp->dest;
808
809 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
810 }
811 else {
812 /* The protocol does not match something known (IPv4/IPv6) */
813 conn->err_code = CO_ER_CIP_BAD_PROTO;
814 goto fail;
815 }
816
817 line += cip_len;
818 trash.len = line - trash.str;
819
820 /* remove the NetScaler Client IP header from the request. For this
821 * we re-read the exact line at once. If we don't get the exact same
822 * result, we fail.
823 */
824 do {
Willy Tarreau585744b2017-08-24 14:31:19 +0200825 int len2 = recv(conn->handle.fd, trash.str, trash.len, 0);
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100826 if (len2 < 0 && errno == EINTR)
827 continue;
828 if (len2 != trash.len)
829 goto recv_abort;
830 } while (0);
831
832 conn->flags &= ~flag;
833 return 1;
834
835 missing:
836 /* Missing data. Since we're using MSG_PEEK, we can only poll again if
837 * we have not read anything. Otherwise we need to fail because we won't
838 * be able to poll anymore.
839 */
840 conn->err_code = CO_ER_CIP_TRUNCATED;
841 goto fail;
842
843 bad_magic:
844 conn->err_code = CO_ER_CIP_BAD_MAGIC;
845 goto fail;
846
847 recv_abort:
848 conn->err_code = CO_ER_CIP_ABORT;
849 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH;
850 goto fail;
851
852 fail:
853 __conn_sock_stop_both(conn);
854 conn->flags |= CO_FL_ERROR;
855 return 0;
856}
857
David Safb76832014-05-08 23:42:08 -0400858int make_proxy_line(char *buf, int buf_len, struct server *srv, struct connection *remote)
859{
860 int ret = 0;
861
862 if (srv && (srv->pp_opts & SRV_PP_V2)) {
863 ret = make_proxy_line_v2(buf, buf_len, srv, remote);
864 }
865 else {
866 if (remote)
867 ret = make_proxy_line_v1(buf, buf_len, &remote->addr.from, &remote->addr.to);
868 else
869 ret = make_proxy_line_v1(buf, buf_len, NULL, NULL);
870 }
871
872 return ret;
873}
874
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200875/* Makes a PROXY protocol line from the two addresses. The output is sent to
876 * buffer <buf> for a maximum size of <buf_len> (including the trailing zero).
877 * It returns the number of bytes composing this line (including the trailing
878 * LF), or zero in case of failure (eg: not enough space). It supports TCP4,
Willy Tarreau2e1401a2013-10-01 11:41:55 +0200879 * TCP6 and "UNKNOWN" formats. If any of <src> or <dst> is null, UNKNOWN is
880 * emitted as well.
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200881 */
David Safb76832014-05-08 23:42:08 -0400882int make_proxy_line_v1(char *buf, int buf_len, struct sockaddr_storage *src, struct sockaddr_storage *dst)
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200883{
884 int ret = 0;
885
Willy Tarreau2e1401a2013-10-01 11:41:55 +0200886 if (src && dst && src->ss_family == dst->ss_family && src->ss_family == AF_INET) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200887 ret = snprintf(buf + ret, buf_len - ret, "PROXY TCP4 ");
888 if (ret >= buf_len)
889 return 0;
890
891 /* IPv4 src */
892 if (!inet_ntop(src->ss_family, &((struct sockaddr_in *)src)->sin_addr, buf + ret, buf_len - ret))
893 return 0;
894
895 ret += strlen(buf + ret);
896 if (ret >= buf_len)
897 return 0;
898
899 buf[ret++] = ' ';
900
901 /* IPv4 dst */
902 if (!inet_ntop(dst->ss_family, &((struct sockaddr_in *)dst)->sin_addr, buf + ret, buf_len - ret))
903 return 0;
904
905 ret += strlen(buf + ret);
906 if (ret >= buf_len)
907 return 0;
908
909 /* source and destination ports */
910 ret += snprintf(buf + ret, buf_len - ret, " %u %u\r\n",
911 ntohs(((struct sockaddr_in *)src)->sin_port),
912 ntohs(((struct sockaddr_in *)dst)->sin_port));
913 if (ret >= buf_len)
914 return 0;
915 }
Willy Tarreau2e1401a2013-10-01 11:41:55 +0200916 else if (src && dst && src->ss_family == dst->ss_family && src->ss_family == AF_INET6) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200917 ret = snprintf(buf + ret, buf_len - ret, "PROXY TCP6 ");
918 if (ret >= buf_len)
919 return 0;
920
921 /* IPv6 src */
922 if (!inet_ntop(src->ss_family, &((struct sockaddr_in6 *)src)->sin6_addr, buf + ret, buf_len - ret))
923 return 0;
924
925 ret += strlen(buf + ret);
926 if (ret >= buf_len)
927 return 0;
928
929 buf[ret++] = ' ';
930
931 /* IPv6 dst */
932 if (!inet_ntop(dst->ss_family, &((struct sockaddr_in6 *)dst)->sin6_addr, buf + ret, buf_len - ret))
933 return 0;
934
935 ret += strlen(buf + ret);
936 if (ret >= buf_len)
937 return 0;
938
939 /* source and destination ports */
940 ret += snprintf(buf + ret, buf_len - ret, " %u %u\r\n",
941 ntohs(((struct sockaddr_in6 *)src)->sin6_port),
942 ntohs(((struct sockaddr_in6 *)dst)->sin6_port));
943 if (ret >= buf_len)
944 return 0;
945 }
946 else {
947 /* unknown family combination */
948 ret = snprintf(buf, buf_len, "PROXY UNKNOWN\r\n");
949 if (ret >= buf_len)
950 return 0;
951 }
952 return ret;
953}
David Safb76832014-05-08 23:42:08 -0400954
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100955#if defined(USE_OPENSSL) || defined(CONFIG_HAP_NS)
956static int make_tlv(char *dest, int dest_len, char type, uint16_t length, const char *value)
David Safb76832014-05-08 23:42:08 -0400957{
958 struct tlv *tlv;
959
960 if (!dest || (length + sizeof(*tlv) > dest_len))
961 return 0;
962
963 tlv = (struct tlv *)dest;
964
965 tlv->type = type;
966 tlv->length_hi = length >> 8;
967 tlv->length_lo = length & 0x00ff;
968 memcpy(tlv->value, value, length);
969 return length + sizeof(*tlv);
970}
971#endif
972
973int make_proxy_line_v2(char *buf, int buf_len, struct server *srv, struct connection *remote)
974{
Willy Tarreau8fccfa22014-06-14 08:28:06 +0200975 const char pp2_signature[] = PP2_SIGNATURE;
David Safb76832014-05-08 23:42:08 -0400976 int ret = 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +0200977 struct proxy_hdr_v2 *hdr = (struct proxy_hdr_v2 *)buf;
Vincent Bernat6e615892016-05-18 16:17:44 +0200978 struct sockaddr_storage null_addr = { .ss_family = 0 };
David Safb76832014-05-08 23:42:08 -0400979 struct sockaddr_storage *src = &null_addr;
980 struct sockaddr_storage *dst = &null_addr;
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100981
David Safb76832014-05-08 23:42:08 -0400982#ifdef USE_OPENSSL
David Safb76832014-05-08 23:42:08 -0400983 char *value = NULL;
984 struct tlv_ssl *tlv;
985 int ssl_tlv_len = 0;
Dave McCowan77d1f012014-07-17 14:34:01 -0400986 struct chunk *cn_trash;
David Safb76832014-05-08 23:42:08 -0400987#endif
988
989 if (buf_len < PP2_HEADER_LEN)
990 return 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +0200991 memcpy(hdr->sig, pp2_signature, PP2_SIGNATURE_LEN);
David Safb76832014-05-08 23:42:08 -0400992
993 if (remote) {
994 src = &remote->addr.from;
995 dst = &remote->addr.to;
996 }
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100997
David Safb76832014-05-08 23:42:08 -0400998 if (src && dst && src->ss_family == dst->ss_family && src->ss_family == AF_INET) {
999 if (buf_len < PP2_HDR_LEN_INET)
1000 return 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001001 hdr->ver_cmd = PP2_VERSION | PP2_CMD_PROXY;
1002 hdr->fam = PP2_FAM_INET | PP2_TRANS_STREAM;
1003 hdr->addr.ip4.src_addr = ((struct sockaddr_in *)src)->sin_addr.s_addr;
1004 hdr->addr.ip4.dst_addr = ((struct sockaddr_in *)dst)->sin_addr.s_addr;
1005 hdr->addr.ip4.src_port = ((struct sockaddr_in *)src)->sin_port;
1006 hdr->addr.ip4.dst_port = ((struct sockaddr_in *)dst)->sin_port;
David Safb76832014-05-08 23:42:08 -04001007 ret = PP2_HDR_LEN_INET;
1008 }
1009 else if (src && dst && src->ss_family == dst->ss_family && src->ss_family == AF_INET6) {
1010 if (buf_len < PP2_HDR_LEN_INET6)
1011 return 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001012 hdr->ver_cmd = PP2_VERSION | PP2_CMD_PROXY;
1013 hdr->fam = PP2_FAM_INET6 | PP2_TRANS_STREAM;
1014 memcpy(hdr->addr.ip6.src_addr, &((struct sockaddr_in6 *)src)->sin6_addr, 16);
1015 memcpy(hdr->addr.ip6.dst_addr, &((struct sockaddr_in6 *)dst)->sin6_addr, 16);
1016 hdr->addr.ip6.src_port = ((struct sockaddr_in6 *)src)->sin6_port;
1017 hdr->addr.ip6.dst_port = ((struct sockaddr_in6 *)dst)->sin6_port;
David Safb76832014-05-08 23:42:08 -04001018 ret = PP2_HDR_LEN_INET6;
1019 }
1020 else {
1021 if (buf_len < PP2_HDR_LEN_UNSPEC)
1022 return 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001023 hdr->ver_cmd = PP2_VERSION | PP2_CMD_LOCAL;
1024 hdr->fam = PP2_FAM_UNSPEC | PP2_TRANS_UNSPEC;
David Safb76832014-05-08 23:42:08 -04001025 ret = PP2_HDR_LEN_UNSPEC;
1026 }
1027
1028#ifdef USE_OPENSSL
1029 if (srv->pp_opts & SRV_PP_V2_SSL) {
1030 if ((buf_len - ret) < sizeof(struct tlv_ssl))
1031 return 0;
1032 tlv = (struct tlv_ssl *)&buf[ret];
1033 memset(tlv, 0, sizeof(struct tlv_ssl));
1034 ssl_tlv_len += sizeof(struct tlv_ssl);
1035 tlv->tlv.type = PP2_TYPE_SSL;
1036 if (ssl_sock_is_ssl(remote)) {
1037 tlv->client |= PP2_CLIENT_SSL;
1038 value = ssl_sock_get_version(remote);
1039 if (value) {
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001040 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len-ret-ssl_tlv_len), PP2_TYPE_SSL_VERSION, strlen(value), value);
David Safb76832014-05-08 23:42:08 -04001041 }
Dave McCowan328fb582014-07-30 10:39:13 -04001042 if (ssl_sock_get_cert_used_sess(remote)) {
1043 tlv->client |= PP2_CLIENT_CERT_SESS;
David Safb76832014-05-08 23:42:08 -04001044 tlv->verify = htonl(ssl_sock_get_verify_result(remote));
Dave McCowan328fb582014-07-30 10:39:13 -04001045 if (ssl_sock_get_cert_used_conn(remote))
1046 tlv->client |= PP2_CLIENT_CERT_CONN;
David Safb76832014-05-08 23:42:08 -04001047 }
1048 if (srv->pp_opts & SRV_PP_V2_SSL_CN) {
Dave McCowan77d1f012014-07-17 14:34:01 -04001049 cn_trash = get_trash_chunk();
Willy Tarreau3b9a0c92014-07-19 06:37:33 +02001050 if (ssl_sock_get_remote_common_name(remote, cn_trash) > 0) {
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001051 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_TYPE_SSL_CN, cn_trash->len, cn_trash->str);
David Safb76832014-05-08 23:42:08 -04001052 }
1053 }
1054 }
1055 tlv->tlv.length_hi = (uint16_t)(ssl_tlv_len - sizeof(struct tlv)) >> 8;
1056 tlv->tlv.length_lo = (uint16_t)(ssl_tlv_len - sizeof(struct tlv)) & 0x00ff;
1057 ret += ssl_tlv_len;
1058 }
1059#endif
1060
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001061#ifdef CONFIG_HAP_NS
1062 if (remote && (remote->proxy_netns)) {
1063 if ((buf_len - ret) < sizeof(struct tlv))
1064 return 0;
1065 ret += make_tlv(&buf[ret], buf_len, PP2_TYPE_NETNS, remote->proxy_netns->name_len, remote->proxy_netns->node.key);
1066 }
1067#endif
1068
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001069 hdr->len = htons((uint16_t)(ret - PP2_HEADER_LEN));
David Safb76832014-05-08 23:42:08 -04001070
1071 return ret;
1072}
Emeric Brun4f603012017-01-05 15:11:44 +01001073
1074/* fetch if the received connection used a PROXY protocol header */
1075int smp_fetch_fc_rcvd_proxy(const struct arg *args, struct sample *smp, const char *kw, void *private)
1076{
1077 struct connection *conn;
1078
1079 conn = objt_conn(smp->sess->origin);
1080 if (!conn)
1081 return 0;
1082
1083 if (!(conn->flags & CO_FL_CONNECTED)) {
1084 smp->flags |= SMP_F_MAY_CHANGE;
1085 return 0;
1086 }
1087
1088 smp->flags = 0;
1089 smp->data.type = SMP_T_BOOL;
1090 smp->data.u.sint = (conn->flags & CO_FL_RCVD_PROXY) ? 1 : 0;
1091
1092 return 1;
1093}
1094
1095/* Note: must not be declared <const> as its list will be overwritten.
1096 * Note: fetches that may return multiple types must be declared as the lowest
1097 * common denominator, the type that can be casted into all other ones. For
1098 * instance v4/v6 must be declared v4.
1099 */
1100static struct sample_fetch_kw_list sample_fetch_keywords = {ILH, {
1101 { "fc_rcvd_proxy", smp_fetch_fc_rcvd_proxy, 0, NULL, SMP_T_BOOL, SMP_USE_L4CLI },
1102 { /* END */ },
1103}};
1104
1105
1106__attribute__((constructor))
1107static void __connection_init(void)
1108{
1109 sample_register_fetches(&sample_fetch_keywords);
1110}