blob: 98359badd1b33b7f85b22e0734bb2cba483d74c1 [file] [log] [blame]
Christopher Faulet78880fb2017-09-18 14:43:55 +02001/*
2 * Action management functions.
3 *
4 * Copyright 2017 HAProxy Technologies, Christopher Faulet <cfaulet@haproxy.com>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
Amaury Denoyelle68fd7e42021-03-25 17:15:52 +010013#include <haproxy/acl.h>
Willy Tarreau122eba92020-06-04 10:15:32 +020014#include <haproxy/action.h>
Willy Tarreau4c7e4b72020-05-27 12:58:42 +020015#include <haproxy/api.h>
Christopher Faulet581db2b2021-03-26 10:02:46 +010016#include <haproxy/cfgparse.h>
Willy Tarreau36979d92020-06-05 17:27:29 +020017#include <haproxy/errors.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020018#include <haproxy/list.h>
Willy Tarreau8efbdfb2020-06-04 11:29:21 +020019#include <haproxy/obj_type.h>
Willy Tarreaud0ef4392020-06-02 09:38:52 +020020#include <haproxy/pool.h>
Willy Tarreaua264d962020-06-04 22:29:18 +020021#include <haproxy/proxy.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020022#include <haproxy/stick_table.h>
Willy Tarreaucea0e1b2020-06-04 17:25:40 +020023#include <haproxy/task.h>
Willy Tarreau48fbcae2020-06-03 18:09:46 +020024#include <haproxy/tools.h>
Christopher Faulet78880fb2017-09-18 14:43:55 +020025
Christopher Faulet78880fb2017-09-18 14:43:55 +020026
Christopher Faulet42c6cf92021-03-25 17:19:04 +010027/* Check an action ruleset validity. It returns the number of error encountered
Ilya Shipitsinb2be9a12021-04-24 13:25:42 +050028 * and err_code is updated if a warning is emitted.
Christopher Faulet42c6cf92021-03-25 17:19:04 +010029 */
30int check_action_rules(struct list *rules, struct proxy *px, int *err_code)
31{
32 struct act_rule *rule;
33 char *errmsg = NULL;
34 int err = 0;
35
36 list_for_each_entry(rule, rules, list) {
37 if (rule->check_ptr && !rule->check_ptr(rule, px, &errmsg)) {
38 ha_alert("Proxy '%s': %s.\n", px->id, errmsg);
39 err++;
40 }
Christopher Faulet581db2b2021-03-26 10:02:46 +010041 *err_code |= warnif_tcp_http_cond(px, rule->cond);
Christopher Faulet42c6cf92021-03-25 17:19:04 +010042 free(errmsg);
43 errmsg = NULL;
44 }
45
46 return err;
47}
48
Christopher Fauletac98d812019-12-18 09:20:16 +010049/* Find and check the target table used by an action track-sc*. This
Christopher Faulet78880fb2017-09-18 14:43:55 +020050 * function should be called during the configuration validity check.
51 *
52 * The function returns 1 in success case, otherwise, it returns 0 and err is
53 * filled.
54 */
55int check_trk_action(struct act_rule *rule, struct proxy *px, char **err)
56{
Frédéric Lécaille1b8e68e2019-03-14 07:07:41 +010057 struct stktable *target;
Christopher Faulet78880fb2017-09-18 14:43:55 +020058
59 if (rule->arg.trk_ctr.table.n)
Frédéric Lécaille1b8e68e2019-03-14 07:07:41 +010060 target = stktable_find_by_name(rule->arg.trk_ctr.table.n);
Christopher Faulet78880fb2017-09-18 14:43:55 +020061 else
Frédéric Lécaille1b8e68e2019-03-14 07:07:41 +010062 target = px->table;
Christopher Faulet78880fb2017-09-18 14:43:55 +020063
64 if (!target) {
65 memprintf(err, "unable to find table '%s' referenced by track-sc%d",
Frédéric Lécaille1b8e68e2019-03-14 07:07:41 +010066 rule->arg.trk_ctr.table.n ? rule->arg.trk_ctr.table.n : px->id,
Christopher Fauletac98d812019-12-18 09:20:16 +010067 rule->action);
Christopher Faulet78880fb2017-09-18 14:43:55 +020068 return 0;
69 }
Frédéric Lécaille1b8e68e2019-03-14 07:07:41 +010070
71 if (!stktable_compatible_sample(rule->arg.trk_ctr.expr, target->type)) {
Christopher Faulet78880fb2017-09-18 14:43:55 +020072 memprintf(err, "stick-table '%s' uses a type incompatible with the 'track-sc%d' rule",
73 rule->arg.trk_ctr.table.n ? rule->arg.trk_ctr.table.n : px->id,
Christopher Fauletac98d812019-12-18 09:20:16 +010074 rule->action);
Christopher Faulet78880fb2017-09-18 14:43:55 +020075 return 0;
76 }
Frédéric Lécaille1b8e68e2019-03-14 07:07:41 +010077 else if (target->proxy && (px->bind_proc & ~target->proxy->bind_proc)) {
Willy Tarreau151e1ca2019-02-05 11:38:38 +010078 memprintf(err, "stick-table '%s' referenced by 'track-sc%d' rule not present on all processes covered by proxy '%s'",
Christopher Fauletac98d812019-12-18 09:20:16 +010079 target->id, rule->action, px->id);
Willy Tarreau151e1ca2019-02-05 11:38:38 +010080 return 0;
81 }
Christopher Faulet78880fb2017-09-18 14:43:55 +020082 else {
Frédéric Lécaillebe367932019-08-07 09:28:39 +020083 if (!in_proxies_list(target->proxies_list, px)) {
Frédéric Lécaille015e4d72019-03-19 14:55:01 +010084 px->next_stkt_ref = target->proxies_list;
85 target->proxies_list = px;
86 }
Christopher Faulet78880fb2017-09-18 14:43:55 +020087 free(rule->arg.trk_ctr.table.n);
Frédéric Lécaille1b8e68e2019-03-14 07:07:41 +010088 rule->arg.trk_ctr.table.t = target;
Christopher Faulet78880fb2017-09-18 14:43:55 +020089 /* Note: if we decide to enhance the track-sc syntax, we may be
90 * able to pass a list of counters to track and allocate them
91 * right here using stktable_alloc_data_type().
92 */
93 }
Christopher Fauletac98d812019-12-18 09:20:16 +010094
Christopher Faulet2079a4a2020-10-02 11:48:57 +020095 if (rule->from == ACT_F_TCP_REQ_CNT && (px->cap & PR_CAP_FE)) {
96 if (!px->tcp_req.inspect_delay && !(rule->arg.trk_ctr.expr->fetch->val & SMP_VAL_FE_SES_ACC)) {
97 ha_warning("config : %s '%s' : a 'tcp-request content track-sc*' rule explicitly depending on request"
98 " contents without any 'tcp-request inspect-delay' setting."
99 " This means that this rule will randomly find its contents. This can be fixed by"
100 " setting the tcp-request inspect-delay.\n",
101 proxy_type_str(px), px->id);
102 }
103
104 /* The following warning is emitted because HTTP multiplexers are able to catch errors
105 * or timeouts at the session level, before instantiating any stream.
106 * Thus the tcp-request content ruleset will not be evaluated in such case. It means,
107 * http_req and http_err counters will not be incremented as expected, even if the tracked
108 * counter does not use the request content. To track invalid requests it should be
109 * performed at the session level using a tcp-request session rule.
110 */
111 if (px->mode == PR_MODE_HTTP &&
112 !(rule->arg.trk_ctr.expr->fetch->use & (SMP_USE_L6REQ|SMP_USE_HRQHV|SMP_USE_HRQHP|SMP_USE_HRQBO)) &&
113 (!rule->cond || !(rule->cond->use & (SMP_USE_L6REQ|SMP_USE_HRQHV|SMP_USE_HRQHP|SMP_USE_HRQBO)))) {
114 ha_warning("config : %s '%s' : a 'tcp-request content track-sc*' rule not depending on request"
115 " contents for an HTTP frontend should be executed at the session level, using a"
116 " 'tcp-request session' rule (mandatory to track invalid HTTP requests).\n",
117 proxy_type_str(px), px->id);
118 }
Christopher Fauletac98d812019-12-18 09:20:16 +0100119 }
120
Christopher Faulet78880fb2017-09-18 14:43:55 +0200121 return 1;
122}
123
Christopher Fauletd73b96d2019-12-19 17:27:03 +0100124/* check a capture rule. This function should be called during the configuration
125 * validity check.
126 *
127 * The function returns 1 in success case, otherwise, it returns 0 and err is
128 * filled.
129 */
130int check_capture(struct act_rule *rule, struct proxy *px, char **err)
131{
132 if (rule->from == ACT_F_TCP_REQ_CNT && (px->cap & PR_CAP_FE) && !px->tcp_req.inspect_delay &&
133 !(rule->arg.trk_ctr.expr->fetch->val & SMP_VAL_FE_SES_ACC)) {
134 ha_warning("config : %s '%s' : a 'tcp-request capture' rule explicitly depending on request"
135 " contents without any 'tcp-request inspect-delay' setting."
136 " This means that this rule will randomly find its contents. This can be fixed by"
137 " setting the tcp-request inspect-delay.\n",
138 proxy_type_str(px), px->id);
139 }
140
141 return 1;
142}
143
Emeric Brun08622d32020-12-23 17:41:43 +0100144int act_resolution_cb(struct resolv_requester *requester, struct dns_counters *counters)
Baptiste Assmann333939c2019-01-21 08:34:50 +0100145{
146 struct stream *stream;
147
148 if (requester->resolution == NULL)
149 return 0;
150
151 stream = objt_stream(requester->owner);
152 if (stream == NULL)
153 return 0;
154
155 task_wakeup(stream->task, TASK_WOKEN_MSG);
156
157 return 0;
158}
159
Emeric Brun08622d32020-12-23 17:41:43 +0100160int act_resolution_error_cb(struct resolv_requester *requester, int error_code)
Baptiste Assmann333939c2019-01-21 08:34:50 +0100161{
162 struct stream *stream;
163
164 if (requester->resolution == NULL)
165 return 0;
166
167 stream = objt_stream(requester->owner);
168 if (stream == NULL)
169 return 0;
170
171 task_wakeup(stream->task, TASK_WOKEN_MSG);
172
173 return 0;
174}
175
Amaury Denoyelle8d228232020-12-10 13:43:54 +0100176/* Parse a set-timeout rule statement. It first checks if the timeout name is
177 * valid and returns it in <name>. Then the timeout is parsed as a plain value
178 * and * returned in <out_timeout>. If there is a parsing error, the value is
179 * reparsed as an expression and returned in <expr>.
180 *
181 * Returns -1 if the name is invalid or neither a time or an expression can be
182 * parsed, or if the timeout value is 0.
183 */
184int cfg_parse_rule_set_timeout(const char **args, int idx, int *out_timeout,
185 enum act_timeout_name *name,
186 struct sample_expr **expr, char **err,
187 const char *file, int line, struct arg_list *al)
188{
189 const char *res;
190 const char *timeout_name = args[idx++];
191
Tim Duesterhuse5ff1412021-01-02 22:31:53 +0100192 if (strcmp(timeout_name, "server") == 0) {
Amaury Denoyelle8d228232020-12-10 13:43:54 +0100193 *name = ACT_TIMEOUT_SERVER;
194 }
Tim Duesterhuse5ff1412021-01-02 22:31:53 +0100195 else if (strcmp(timeout_name, "tunnel") == 0) {
Amaury Denoyelle8d228232020-12-10 13:43:54 +0100196 *name = ACT_TIMEOUT_TUNNEL;
197 }
198 else {
199 memprintf(err,
200 "'set-timeout' rule supports 'server'/'tunnel' (got '%s')",
201 timeout_name);
202 return -1;
203 }
204
205 res = parse_time_err(args[idx], (unsigned int *)out_timeout, TIME_UNIT_MS);
206 if (res == PARSE_TIME_OVER) {
207 memprintf(err, "timer overflow in argument '%s' to rule 'set-timeout %s' (maximum value is 2147483647 ms or ~24.8 days)",
208 args[idx], timeout_name);
209 return -1;
210 }
211 else if (res == PARSE_TIME_UNDER) {
212 memprintf(err, "timer underflow in argument '%s' to rule 'set-timeout %s' (minimum value is 1 ms)",
213 args[idx], timeout_name);
214 return -1;
215 }
216 /* res not NULL, parsing error */
217 else if (res) {
218 *expr = sample_parse_expr((char **)args, &idx, file, line, err, al, NULL);
219 if (!*expr) {
220 memprintf(err, "unexpected character '%c' in rule 'set-timeout %s'", *res, timeout_name);
221 return -1;
222 }
223 }
224 /* res NULL, parsing ok but value is 0 */
225 else if (!(*out_timeout)) {
226 memprintf(err, "null value is not valid for a 'set-timeout %s' rule",
227 timeout_name);
228 return -1;
229 }
230
231 return 0;
232}
Willy Tarreau99eb2cc2021-03-12 11:59:24 +0100233
234/* tries to find in list <keywords> a similar looking action as the one in
235 * <word>, and returns it otherwise NULL. <word> may be NULL or empty. An
236 * optional array of extra words to compare may be passed in <extra>, but it
237 * must then be terminated by a NULL entry. If unused it may be NULL.
238 */
239const char *action_suggest(const char *word, const struct list *keywords, const char **extra)
240{
241 uint8_t word_sig[1024];
242 uint8_t list_sig[1024];
243 const struct action_kw_list *kwl;
244 const struct action_kw *best_kw = NULL;
245 const char *best_ptr = NULL;
246 int dist, best_dist = INT_MAX;
247 int index;
248
249 if (!word || !*word)
250 return NULL;
251
252 make_word_fingerprint(word_sig, word);
253 list_for_each_entry(kwl, keywords, list) {
254 for (index = 0; kwl->kw[index].kw != NULL; index++) {
255 make_word_fingerprint(list_sig, kwl->kw[index].kw);
256 dist = word_fingerprint_distance(word_sig, list_sig);
257 if (dist < best_dist) {
258 best_dist = dist;
259 best_kw = &kwl->kw[index];
260 best_ptr = best_kw->kw;
261 }
262 }
263 }
264
265 while (extra && *extra) {
266 make_word_fingerprint(list_sig, *extra);
267 dist = word_fingerprint_distance(word_sig, list_sig);
268 if (dist < best_dist) {
269 best_dist = dist;
270 best_kw = NULL;
271 best_ptr = *extra;
272 }
273 extra++;
274 }
275
276 /* eliminate too different ones, with more tolerance for prefixes
277 * when they're known to exist (not from extra list).
278 */
279 if (best_ptr &&
280 (best_dist > (2 + (best_kw && best_kw->match_pfx)) * strlen(word) ||
281 best_dist > (2 + (best_kw && best_kw->match_pfx)) * strlen(best_ptr)))
282 best_ptr = NULL;
283
284 return best_ptr;
285}
Amaury Denoyelle68fd7e42021-03-25 17:15:52 +0100286
287void free_act_rules(struct list *rules)
288{
289 struct act_rule *rule, *ruleb;
290
291 list_for_each_entry_safe(rule, ruleb, rules, list) {
Willy Tarreau2b718102021-04-21 07:32:39 +0200292 LIST_DELETE(&rule->list);
Amaury Denoyelle68fd7e42021-03-25 17:15:52 +0100293 free_acl_cond(rule->cond);
294 if (rule->release_ptr)
295 rule->release_ptr(rule);
296 free(rule);
297 }
298}