blob: 80f1e36eb04be5fa9d977e49338ebcea2480a9ba [file] [log] [blame]
Willy Tarreaue6b98942007-10-29 01:09:36 +01001/*
2 * AF_INET/AF_INET6 SOCK_STREAM protocol layer (tcp)
3 *
Willy Tarreau1a687942010-05-23 22:40:30 +02004 * Copyright 2000-2010 Willy Tarreau <w@1wt.eu>
Willy Tarreaue6b98942007-10-29 01:09:36 +01005 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
13#include <ctype.h>
14#include <errno.h>
15#include <fcntl.h>
16#include <stdio.h>
17#include <stdlib.h>
18#include <string.h>
19#include <time.h>
20
21#include <sys/param.h>
22#include <sys/socket.h>
23#include <sys/stat.h>
24#include <sys/types.h>
25#include <sys/un.h>
26
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +040027#include <netinet/tcp.h>
28
Willy Tarreaub6866442008-07-14 23:54:42 +020029#include <common/cfgparse.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010030#include <common/compat.h>
31#include <common/config.h>
32#include <common/debug.h>
33#include <common/errors.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010034#include <common/mini-clist.h>
35#include <common/standard.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010036
Willy Tarreaue6b98942007-10-29 01:09:36 +010037#include <types/global.h>
Willy Tarreau9650f372009-08-16 14:02:45 +020038#include <types/server.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010039
40#include <proto/acl.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010041#include <proto/buffers.h>
Willy Tarreau03fa5df2010-05-24 21:02:37 +020042#include <proto/frontend.h>
Willy Tarreau9650f372009-08-16 14:02:45 +020043#include <proto/log.h>
Willy Tarreau645513a2010-05-24 20:55:15 +020044#include <proto/pattern.h>
Willy Tarreau9650f372009-08-16 14:02:45 +020045#include <proto/port_range.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010046#include <proto/protocols.h>
47#include <proto/proto_tcp.h>
Willy Tarreaub6866442008-07-14 23:54:42 +020048#include <proto/proxy.h>
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +020049#include <proto/session.h>
Willy Tarreaua975b8f2010-06-05 19:13:27 +020050#include <proto/stick_table.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010051#include <proto/stream_sock.h>
Willy Tarreaua975b8f2010-06-05 19:13:27 +020052#include <proto/task.h>
Emeric Brun97679e72010-09-23 17:56:44 +020053#include <proto/buffers.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010054
Willy Tarreaue8c66af2008-01-13 18:40:14 +010055#ifdef CONFIG_HAP_CTTPROXY
56#include <import/ip_tproxy.h>
57#endif
58
Emeric Bruncf20bf12010-10-22 16:06:11 +020059static int tcp_bind_listeners(struct protocol *proto, char *errmsg, int errlen);
60static int tcp_bind_listener(struct listener *listener, char *errmsg, int errlen);
Willy Tarreaue6b98942007-10-29 01:09:36 +010061
62/* Note: must not be declared <const> as its list will be overwritten */
63static struct protocol proto_tcpv4 = {
64 .name = "tcpv4",
65 .sock_domain = AF_INET,
66 .sock_type = SOCK_STREAM,
67 .sock_prot = IPPROTO_TCP,
68 .sock_family = AF_INET,
69 .sock_addrlen = sizeof(struct sockaddr_in),
70 .l3_addrlen = 32/8,
Willy Tarreaueb472682010-05-28 18:46:57 +020071 .accept = &stream_sock_accept,
Willy Tarreaue6b98942007-10-29 01:09:36 +010072 .read = &stream_sock_read,
73 .write = &stream_sock_write,
Emeric Bruncf20bf12010-10-22 16:06:11 +020074 .bind = tcp_bind_listener,
Willy Tarreaue6b98942007-10-29 01:09:36 +010075 .bind_all = tcp_bind_listeners,
76 .unbind_all = unbind_all_listeners,
77 .enable_all = enable_all_listeners,
78 .listeners = LIST_HEAD_INIT(proto_tcpv4.listeners),
79 .nb_listeners = 0,
80};
81
82/* Note: must not be declared <const> as its list will be overwritten */
83static struct protocol proto_tcpv6 = {
84 .name = "tcpv6",
85 .sock_domain = AF_INET6,
86 .sock_type = SOCK_STREAM,
87 .sock_prot = IPPROTO_TCP,
88 .sock_family = AF_INET6,
89 .sock_addrlen = sizeof(struct sockaddr_in6),
90 .l3_addrlen = 128/8,
Willy Tarreaueb472682010-05-28 18:46:57 +020091 .accept = &stream_sock_accept,
Willy Tarreaue6b98942007-10-29 01:09:36 +010092 .read = &stream_sock_read,
93 .write = &stream_sock_write,
Emeric Bruncf20bf12010-10-22 16:06:11 +020094 .bind = tcp_bind_listener,
Willy Tarreaue6b98942007-10-29 01:09:36 +010095 .bind_all = tcp_bind_listeners,
96 .unbind_all = unbind_all_listeners,
97 .enable_all = enable_all_listeners,
98 .listeners = LIST_HEAD_INIT(proto_tcpv6.listeners),
99 .nb_listeners = 0,
100};
101
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100102
David du Colombier6f5ccb12011-03-10 22:26:24 +0100103/* Binds ipv4/ipv6 address <local> to socket <fd>, unless <flags> is set, in which
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100104 * case we try to bind <remote>. <flags> is a 2-bit field consisting of :
105 * - 0 : ignore remote address (may even be a NULL pointer)
106 * - 1 : use provided address
107 * - 2 : use provided port
108 * - 3 : use both
109 *
110 * The function supports multiple foreign binding methods :
111 * - linux_tproxy: we directly bind to the foreign address
112 * - cttproxy: we bind to a local address then nat.
113 * The second one can be used as a fallback for the first one.
114 * This function returns 0 when everything's OK, 1 if it could not bind, to the
115 * local address, 2 if it could not bind to the foreign address.
116 */
David du Colombier6f5ccb12011-03-10 22:26:24 +0100117int tcp_bind_socket(int fd, int flags, struct sockaddr_storage *local, struct sockaddr_storage *remote)
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100118{
David du Colombier6f5ccb12011-03-10 22:26:24 +0100119 struct sockaddr_storage bind_addr;
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100120 int foreign_ok = 0;
121 int ret;
122
123#ifdef CONFIG_HAP_LINUX_TPROXY
124 static int ip_transp_working = 1;
125 if (flags && ip_transp_working) {
Simon Hormande072bd2011-06-24 15:11:37 +0900126 if (setsockopt(fd, SOL_IP, IP_TRANSPARENT, &one, sizeof(one)) == 0
127 || setsockopt(fd, SOL_IP, IP_FREEBIND, &one, sizeof(one)) == 0)
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100128 foreign_ok = 1;
129 else
130 ip_transp_working = 0;
131 }
132#endif
133 if (flags) {
134 memset(&bind_addr, 0, sizeof(bind_addr));
Willy Tarreau96dd0792011-04-19 07:20:57 +0200135 bind_addr.ss_family = remote->ss_family;
David du Colombier6f5ccb12011-03-10 22:26:24 +0100136 switch (remote->ss_family) {
137 case AF_INET:
138 if (flags & 1)
139 ((struct sockaddr_in *)&bind_addr)->sin_addr = ((struct sockaddr_in *)remote)->sin_addr;
140 if (flags & 2)
141 ((struct sockaddr_in *)&bind_addr)->sin_port = ((struct sockaddr_in *)remote)->sin_port;
142 break;
143 case AF_INET6:
144 if (flags & 1)
145 ((struct sockaddr_in6 *)&bind_addr)->sin6_addr = ((struct sockaddr_in6 *)remote)->sin6_addr;
146 if (flags & 2)
147 ((struct sockaddr_in6 *)&bind_addr)->sin6_port = ((struct sockaddr_in6 *)remote)->sin6_port;
148 break;
Willy Tarreau5dc1e982011-12-16 21:25:11 +0100149 default:
150 /* we don't want to try to bind to an unknown address family */
151 foreign_ok = 0;
David du Colombier6f5ccb12011-03-10 22:26:24 +0100152 }
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100153 }
154
Simon Hormande072bd2011-06-24 15:11:37 +0900155 setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one));
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100156 if (foreign_ok) {
Willy Tarreau1b4b7ce2011-04-05 16:56:50 +0200157 ret = bind(fd, (struct sockaddr *)&bind_addr, get_addr_len(&bind_addr));
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100158 if (ret < 0)
159 return 2;
160 }
161 else {
Willy Tarreau1b4b7ce2011-04-05 16:56:50 +0200162 ret = bind(fd, (struct sockaddr *)local, get_addr_len(local));
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100163 if (ret < 0)
164 return 1;
165 }
166
167 if (!flags)
168 return 0;
169
170#ifdef CONFIG_HAP_CTTPROXY
Willy Tarreau6f831b42011-03-20 14:03:54 +0100171 if (!foreign_ok && remote->ss_family == AF_INET) {
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100172 struct in_tproxy itp1, itp2;
173 memset(&itp1, 0, sizeof(itp1));
174
175 itp1.op = TPROXY_ASSIGN;
Willy Tarreau6f831b42011-03-20 14:03:54 +0100176 itp1.v.addr.faddr = ((struct sockaddr_in *)&bind_addr)->sin_addr;
177 itp1.v.addr.fport = ((struct sockaddr_in *)&bind_addr)->sin_port;
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100178
179 /* set connect flag on socket */
180 itp2.op = TPROXY_FLAGS;
181 itp2.v.flags = ITP_CONNECT | ITP_ONCE;
182
183 if (setsockopt(fd, SOL_IP, IP_TPROXY, &itp1, sizeof(itp1)) != -1 &&
184 setsockopt(fd, SOL_IP, IP_TPROXY, &itp2, sizeof(itp2)) != -1) {
185 foreign_ok = 1;
186 }
187 }
188#endif
189 if (!foreign_ok)
190 /* we could not bind to a foreign address */
191 return 2;
192
193 return 0;
194}
Willy Tarreaue6b98942007-10-29 01:09:36 +0100195
Willy Tarreau9650f372009-08-16 14:02:45 +0200196
197/*
Willy Tarreauac825402011-03-04 22:04:29 +0100198 * This function initiates a connection to the target assigned to this session
Willy Tarreau6471afb2011-09-23 10:54:59 +0200199 * (si->{target,addr.to}). A source address may be pointed to by si->addr.from
Willy Tarreauac825402011-03-04 22:04:29 +0100200 * in case of transparent proxying. Normal source bind addresses are still
201 * determined locally (due to the possible need of a source port).
202 * si->target may point either to a valid server or to a backend, depending
203 * on si->target.type. Only TARG_TYPE_PROXY and TARG_TYPE_SERVER are supported.
Willy Tarreaub1d67742010-03-29 19:36:59 +0200204 *
Willy Tarreau9650f372009-08-16 14:02:45 +0200205 * It can return one of :
206 * - SN_ERR_NONE if everything's OK
207 * - SN_ERR_SRVTO if there are no more servers
208 * - SN_ERR_SRVCL if the connection was refused by the server
209 * - SN_ERR_PRXCOND if the connection has been limited by the proxy (maxconn)
210 * - SN_ERR_RESOURCE if a system resource is lacking (eg: fd limits, ports, ...)
211 * - SN_ERR_INTERNAL for any other purely internal errors
212 * Additionnally, in the case of SN_ERR_RESOURCE, an emergency log will be emitted.
213 */
Willy Tarreauf1536862011-03-03 18:27:32 +0100214
David du Colombier6f5ccb12011-03-10 22:26:24 +0100215int tcp_connect_server(struct stream_interface *si)
Willy Tarreau9650f372009-08-16 14:02:45 +0200216{
217 int fd;
Willy Tarreauac825402011-03-04 22:04:29 +0100218 struct server *srv;
219 struct proxy *be;
220
221 switch (si->target.type) {
222 case TARG_TYPE_PROXY:
223 be = si->target.ptr.p;
224 srv = NULL;
225 break;
226 case TARG_TYPE_SERVER:
227 srv = si->target.ptr.s;
228 be = srv->proxy;
229 break;
230 default:
231 return SN_ERR_INTERNAL;
232 }
Willy Tarreau9650f372009-08-16 14:02:45 +0200233
Willy Tarreau6471afb2011-09-23 10:54:59 +0200234 if ((fd = si->fd = socket(si->addr.to.ss_family, SOCK_STREAM, IPPROTO_TCP)) == -1) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200235 qfprintf(stderr, "Cannot get a server socket.\n");
236
237 if (errno == ENFILE)
238 send_log(be, LOG_EMERG,
239 "Proxy %s reached system FD limit at %d. Please check system tunables.\n",
240 be->id, maxfd);
241 else if (errno == EMFILE)
242 send_log(be, LOG_EMERG,
243 "Proxy %s reached process FD limit at %d. Please check 'ulimit-n' and restart.\n",
244 be->id, maxfd);
245 else if (errno == ENOBUFS || errno == ENOMEM)
246 send_log(be, LOG_EMERG,
247 "Proxy %s reached system memory limit at %d sockets. Please check system tunables.\n",
248 be->id, maxfd);
249 /* this is a resource error */
250 return SN_ERR_RESOURCE;
251 }
252
253 if (fd >= global.maxsock) {
254 /* do not log anything there, it's a normal condition when this option
255 * is used to serialize connections to a server !
256 */
257 Alert("socket(): not enough free sockets. Raise -n argument. Giving up.\n");
258 close(fd);
259 return SN_ERR_PRXCOND; /* it is a configuration limit */
260 }
261
262 if ((fcntl(fd, F_SETFL, O_NONBLOCK)==-1) ||
Simon Hormande072bd2011-06-24 15:11:37 +0900263 (setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &one, sizeof(one)) == -1)) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200264 qfprintf(stderr,"Cannot set client socket to non blocking mode.\n");
265 close(fd);
266 return SN_ERR_INTERNAL;
267 }
268
269 if (be->options & PR_O_TCP_SRV_KA)
Simon Hormande072bd2011-06-24 15:11:37 +0900270 setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, &one, sizeof(one));
Willy Tarreau9650f372009-08-16 14:02:45 +0200271
272 if (be->options & PR_O_TCP_NOLING)
Willy Tarreauf6f82252011-11-30 18:02:24 +0100273 si->flags |= SI_FL_NOLINGER;
Willy Tarreau9650f372009-08-16 14:02:45 +0200274
275 /* allow specific binding :
276 * - server-specific at first
277 * - proxy-specific next
278 */
279 if (srv != NULL && srv->state & SRV_BIND_SRC) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200280 int ret, flags = 0;
281
Willy Tarreau9650f372009-08-16 14:02:45 +0200282 switch (srv->state & SRV_TPROXY_MASK) {
283 case SRV_TPROXY_ADDR:
Willy Tarreau9650f372009-08-16 14:02:45 +0200284 case SRV_TPROXY_CLI:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200285 flags = 3;
286 break;
Willy Tarreau9650f372009-08-16 14:02:45 +0200287 case SRV_TPROXY_CIP:
Willy Tarreau090466c2009-09-07 11:51:47 +0200288 case SRV_TPROXY_DYN:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200289 flags = 1;
Willy Tarreau9650f372009-08-16 14:02:45 +0200290 break;
291 }
Willy Tarreaub1d67742010-03-29 19:36:59 +0200292
Willy Tarreau9650f372009-08-16 14:02:45 +0200293#ifdef SO_BINDTODEVICE
294 /* Note: this might fail if not CAP_NET_RAW */
295 if (srv->iface_name)
296 setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, srv->iface_name, srv->iface_len + 1);
297#endif
298
299 if (srv->sport_range) {
300 int attempts = 10; /* should be more than enough to find a spare port */
David du Colombier6f5ccb12011-03-10 22:26:24 +0100301 struct sockaddr_storage src;
Willy Tarreau9650f372009-08-16 14:02:45 +0200302
303 ret = 1;
304 src = srv->source_addr;
305
306 do {
307 /* note: in case of retry, we may have to release a previously
308 * allocated port, hence this loop's construct.
309 */
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200310 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
311 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200312
313 if (!attempts)
314 break;
315 attempts--;
316
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200317 fdinfo[fd].local_port = port_range_alloc_port(srv->sport_range);
318 if (!fdinfo[fd].local_port)
Willy Tarreau9650f372009-08-16 14:02:45 +0200319 break;
320
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200321 fdinfo[fd].port_range = srv->sport_range;
Willy Tarreau86ad42c2011-08-27 12:29:07 +0200322 set_host_port(&src, fdinfo[fd].local_port);
Willy Tarreau9650f372009-08-16 14:02:45 +0200323
Willy Tarreau6471afb2011-09-23 10:54:59 +0200324 ret = tcp_bind_socket(fd, flags, &src, &si->addr.from);
Willy Tarreau9650f372009-08-16 14:02:45 +0200325 } while (ret != 0); /* binding NOK */
326 }
327 else {
Willy Tarreau6471afb2011-09-23 10:54:59 +0200328 ret = tcp_bind_socket(fd, flags, &srv->source_addr, &si->addr.from);
Willy Tarreau9650f372009-08-16 14:02:45 +0200329 }
330
331 if (ret) {
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200332 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
333 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200334 close(fd);
335
336 if (ret == 1) {
337 Alert("Cannot bind to source address before connect() for server %s/%s. Aborting.\n",
338 be->id, srv->id);
339 send_log(be, LOG_EMERG,
340 "Cannot bind to source address before connect() for server %s/%s.\n",
341 be->id, srv->id);
342 } else {
343 Alert("Cannot bind to tproxy source address before connect() for server %s/%s. Aborting.\n",
344 be->id, srv->id);
345 send_log(be, LOG_EMERG,
346 "Cannot bind to tproxy source address before connect() for server %s/%s.\n",
347 be->id, srv->id);
348 }
349 return SN_ERR_RESOURCE;
350 }
351 }
352 else if (be->options & PR_O_BIND_SRC) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200353 int ret, flags = 0;
354
Willy Tarreau9650f372009-08-16 14:02:45 +0200355 switch (be->options & PR_O_TPXY_MASK) {
356 case PR_O_TPXY_ADDR:
Willy Tarreau9650f372009-08-16 14:02:45 +0200357 case PR_O_TPXY_CLI:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200358 flags = 3;
359 break;
Willy Tarreau9650f372009-08-16 14:02:45 +0200360 case PR_O_TPXY_CIP:
Willy Tarreau090466c2009-09-07 11:51:47 +0200361 case PR_O_TPXY_DYN:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200362 flags = 1;
Willy Tarreau9650f372009-08-16 14:02:45 +0200363 break;
364 }
Willy Tarreaub1d67742010-03-29 19:36:59 +0200365
Willy Tarreau9650f372009-08-16 14:02:45 +0200366#ifdef SO_BINDTODEVICE
367 /* Note: this might fail if not CAP_NET_RAW */
368 if (be->iface_name)
369 setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, be->iface_name, be->iface_len + 1);
370#endif
Willy Tarreau6471afb2011-09-23 10:54:59 +0200371 ret = tcp_bind_socket(fd, flags, &be->source_addr, &si->addr.from);
Willy Tarreau9650f372009-08-16 14:02:45 +0200372 if (ret) {
373 close(fd);
374 if (ret == 1) {
375 Alert("Cannot bind to source address before connect() for proxy %s. Aborting.\n",
376 be->id);
377 send_log(be, LOG_EMERG,
378 "Cannot bind to source address before connect() for proxy %s.\n",
379 be->id);
380 } else {
381 Alert("Cannot bind to tproxy source address before connect() for proxy %s. Aborting.\n",
382 be->id);
383 send_log(be, LOG_EMERG,
384 "Cannot bind to tproxy source address before connect() for proxy %s.\n",
385 be->id);
386 }
387 return SN_ERR_RESOURCE;
388 }
389 }
390
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400391#if defined(TCP_QUICKACK)
Willy Tarreau9650f372009-08-16 14:02:45 +0200392 /* disabling tcp quick ack now allows the first request to leave the
393 * machine with the first ACK. We only do this if there are pending
394 * data in the buffer.
395 */
396 if ((be->options2 & PR_O2_SMARTCON) && si->ob->send_max)
Simon Hormande072bd2011-06-24 15:11:37 +0900397 setsockopt(fd, IPPROTO_TCP, TCP_QUICKACK, &zero, sizeof(zero));
Willy Tarreau9650f372009-08-16 14:02:45 +0200398#endif
399
Willy Tarreaue803de22010-01-21 17:43:04 +0100400 if (global.tune.server_sndbuf)
401 setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &global.tune.server_sndbuf, sizeof(global.tune.server_sndbuf));
402
403 if (global.tune.server_rcvbuf)
404 setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &global.tune.server_rcvbuf, sizeof(global.tune.server_rcvbuf));
405
Willy Tarreau6471afb2011-09-23 10:54:59 +0200406 if ((connect(fd, (struct sockaddr *)&si->addr.to, get_addr_len(&si->addr.to)) == -1) &&
Willy Tarreau9650f372009-08-16 14:02:45 +0200407 (errno != EINPROGRESS) && (errno != EALREADY) && (errno != EISCONN)) {
408
409 if (errno == EAGAIN || errno == EADDRINUSE) {
410 char *msg;
411 if (errno == EAGAIN) /* no free ports left, try again later */
412 msg = "no free ports";
413 else
414 msg = "local address already in use";
415
416 qfprintf(stderr,"Cannot connect: %s.\n",msg);
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200417 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
418 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200419 close(fd);
420 send_log(be, LOG_EMERG,
421 "Connect() failed for server %s/%s: %s.\n",
422 be->id, srv->id, msg);
423 return SN_ERR_RESOURCE;
424 } else if (errno == ETIMEDOUT) {
425 //qfprintf(stderr,"Connect(): ETIMEDOUT");
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200426 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
427 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200428 close(fd);
429 return SN_ERR_SRVTO;
430 } else {
431 // (errno == ECONNREFUSED || errno == ENETUNREACH || errno == EACCES || errno == EPERM)
432 //qfprintf(stderr,"Connect(): %d", errno);
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200433 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
434 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200435 close(fd);
436 return SN_ERR_SRVCL;
437 }
438 }
439
William Lallemandb7ff6a32012-03-02 14:35:21 +0100440 /* needs src ip/port for logging */
441 if (si->flags & SI_FL_SRC_ADDR) {
442 socklen_t addrlen = sizeof(si->addr.to);
443 if (getsockname(fd, (struct sockaddr *)&si->addr.from, &addrlen) == -1) {
444 Warning("Cannot get source address for logging.\n");
445 }
446 }
447
Willy Tarreau9650f372009-08-16 14:02:45 +0200448 fdtab[fd].owner = si;
449 fdtab[fd].state = FD_STCONN; /* connection in progress */
450 fdtab[fd].flags = FD_FL_TCP | FD_FL_TCP_NODELAY;
451 fdtab[fd].cb[DIR_RD].f = &stream_sock_read;
452 fdtab[fd].cb[DIR_RD].b = si->ib;
453 fdtab[fd].cb[DIR_WR].f = &stream_sock_write;
454 fdtab[fd].cb[DIR_WR].b = si->ob;
455
Willy Tarreau6471afb2011-09-23 10:54:59 +0200456 fdinfo[fd].peeraddr = (struct sockaddr *)&si->addr.to;
457 fdinfo[fd].peerlen = get_addr_len(&si->addr.to);
Willy Tarreau9650f372009-08-16 14:02:45 +0200458
459 fd_insert(fd);
460 EV_FD_SET(fd, DIR_WR); /* for connect status */
461
462 si->state = SI_ST_CON;
463 si->flags |= SI_FL_CAP_SPLTCP; /* TCP supports splicing */
464 si->exp = tick_add_ifset(now_ms, be->timeout.connect);
465
466 return SN_ERR_NONE; /* connection is OK */
467}
468
469
Willy Tarreaue6b98942007-10-29 01:09:36 +0100470/* This function tries to bind a TCPv4/v6 listener. It may return a warning or
471 * an error message in <err> if the message is at most <errlen> bytes long
472 * (including '\0'). The return value is composed from ERR_ABORT, ERR_WARN,
473 * ERR_ALERT, ERR_RETRYABLE and ERR_FATAL. ERR_NONE indicates that everything
474 * was alright and that no message was returned. ERR_RETRYABLE means that an
475 * error occurred but that it may vanish after a retry (eg: port in use), and
476 * ERR_FATAL indicates a non-fixable error.ERR_WARN and ERR_ALERT do not alter
477 * the meaning of the error, but just indicate that a message is present which
478 * should be displayed with the respective level. Last, ERR_ABORT indicates
479 * that it's pointless to try to start other listeners. No error message is
480 * returned if errlen is NULL.
481 */
482int tcp_bind_listener(struct listener *listener, char *errmsg, int errlen)
483{
484 __label__ tcp_return, tcp_close_return;
485 int fd, err;
486 const char *msg = NULL;
487
488 /* ensure we never return garbage */
489 if (errmsg && errlen)
490 *errmsg = 0;
491
492 if (listener->state != LI_ASSIGNED)
493 return ERR_NONE; /* already bound */
494
495 err = ERR_NONE;
496
497 if ((fd = socket(listener->addr.ss_family, SOCK_STREAM, IPPROTO_TCP)) == -1) {
498 err |= ERR_RETRYABLE | ERR_ALERT;
499 msg = "cannot create listening socket";
500 goto tcp_return;
501 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100502
Willy Tarreaue6b98942007-10-29 01:09:36 +0100503 if (fd >= global.maxsock) {
504 err |= ERR_FATAL | ERR_ABORT | ERR_ALERT;
505 msg = "not enough free sockets (raise '-n' parameter)";
506 goto tcp_close_return;
507 }
508
Willy Tarreaufb14edc2009-06-14 15:24:37 +0200509 if (fcntl(fd, F_SETFL, O_NONBLOCK) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100510 err |= ERR_FATAL | ERR_ALERT;
511 msg = "cannot make socket non-blocking";
512 goto tcp_close_return;
513 }
514
Simon Hormande072bd2011-06-24 15:11:37 +0900515 if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100516 /* not fatal but should be reported */
517 msg = "cannot do so_reuseaddr";
518 err |= ERR_ALERT;
519 }
520
521 if (listener->options & LI_O_NOLINGER)
Simon Hormande072bd2011-06-24 15:11:37 +0900522 setsockopt(fd, SOL_SOCKET, SO_LINGER, &nolinger, sizeof(struct linger));
Willy Tarreauedcf6682008-11-30 23:15:34 +0100523
Willy Tarreaue6b98942007-10-29 01:09:36 +0100524#ifdef SO_REUSEPORT
525 /* OpenBSD supports this. As it's present in old libc versions of Linux,
526 * it might return an error that we will silently ignore.
527 */
Simon Hormande072bd2011-06-24 15:11:37 +0900528 setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &one, sizeof(one));
Willy Tarreaue6b98942007-10-29 01:09:36 +0100529#endif
Willy Tarreaub1e52e82008-01-13 14:49:51 +0100530#ifdef CONFIG_HAP_LINUX_TPROXY
Willy Tarreauedcf6682008-11-30 23:15:34 +0100531 if ((listener->options & LI_O_FOREIGN)
Simon Hormande072bd2011-06-24 15:11:37 +0900532 && (setsockopt(fd, SOL_IP, IP_TRANSPARENT, &one, sizeof(one)) == -1)
533 && (setsockopt(fd, SOL_IP, IP_FREEBIND, &one, sizeof(one)) == -1)) {
Willy Tarreaub1e52e82008-01-13 14:49:51 +0100534 msg = "cannot make listening socket transparent";
535 err |= ERR_ALERT;
536 }
537#endif
Willy Tarreau5e6e2042009-02-04 17:19:29 +0100538#ifdef SO_BINDTODEVICE
539 /* Note: this might fail if not CAP_NET_RAW */
540 if (listener->interface) {
541 if (setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE,
Willy Tarreau604e8302009-03-06 00:48:23 +0100542 listener->interface, strlen(listener->interface) + 1) == -1) {
Willy Tarreau5e6e2042009-02-04 17:19:29 +0100543 msg = "cannot bind listener to device";
544 err |= ERR_WARN;
545 }
546 }
547#endif
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400548#if defined(TCP_MAXSEG)
Willy Tarreau48a7e722010-12-24 15:26:39 +0100549 if (listener->maxseg > 0) {
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400550 if (setsockopt(fd, IPPROTO_TCP, TCP_MAXSEG,
Willy Tarreaube1b9182009-06-14 18:48:19 +0200551 &listener->maxseg, sizeof(listener->maxseg)) == -1) {
552 msg = "cannot set MSS";
553 err |= ERR_WARN;
554 }
555 }
556#endif
Willy Tarreaucb6cd432009-10-13 07:34:14 +0200557#if defined(TCP_DEFER_ACCEPT)
558 if (listener->options & LI_O_DEF_ACCEPT) {
559 /* defer accept by up to one second */
560 int accept_delay = 1;
561 if (setsockopt(fd, IPPROTO_TCP, TCP_DEFER_ACCEPT, &accept_delay, sizeof(accept_delay)) == -1) {
562 msg = "cannot enable DEFER_ACCEPT";
563 err |= ERR_WARN;
564 }
565 }
566#endif
Willy Tarreaue6b98942007-10-29 01:09:36 +0100567 if (bind(fd, (struct sockaddr *)&listener->addr, listener->proto->sock_addrlen) == -1) {
568 err |= ERR_RETRYABLE | ERR_ALERT;
569 msg = "cannot bind socket";
570 goto tcp_close_return;
571 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100572
Willy Tarreauc73ce2b2008-01-06 10:55:10 +0100573 if (listen(fd, listener->backlog ? listener->backlog : listener->maxconn) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100574 err |= ERR_RETRYABLE | ERR_ALERT;
575 msg = "cannot listen to socket";
576 goto tcp_close_return;
577 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100578
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400579#if defined(TCP_QUICKACK)
Willy Tarreau9ea05a72009-06-14 12:07:01 +0200580 if (listener->options & LI_O_NOQUICKACK)
Simon Hormande072bd2011-06-24 15:11:37 +0900581 setsockopt(fd, IPPROTO_TCP, TCP_QUICKACK, &zero, sizeof(zero));
Willy Tarreau9ea05a72009-06-14 12:07:01 +0200582#endif
583
Willy Tarreaue6b98942007-10-29 01:09:36 +0100584 /* the socket is ready */
585 listener->fd = fd;
586 listener->state = LI_LISTEN;
587
Willy Tarreaueabf3132008-08-29 23:36:51 +0200588 fdtab[fd].owner = listener; /* reference the listener instead of a task */
Willy Tarreaue6b98942007-10-29 01:09:36 +0100589 fdtab[fd].state = FD_STLISTEN;
Willy Tarreaueb472682010-05-28 18:46:57 +0200590 fdtab[fd].flags = FD_FL_TCP | ((listener->options & LI_O_NOLINGER) ? FD_FL_TCP_NOLING : 0);
591 fdtab[fd].cb[DIR_RD].f = listener->proto->accept;
592 fdtab[fd].cb[DIR_WR].f = NULL; /* never called */
593 fdtab[fd].cb[DIR_RD].b = fdtab[fd].cb[DIR_WR].b = NULL;
Willy Tarreau5d707e12009-06-28 11:09:07 +0200594
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200595 fdinfo[fd].peeraddr = NULL;
596 fdinfo[fd].peerlen = 0;
Willy Tarreaueb472682010-05-28 18:46:57 +0200597 fd_insert(fd);
598
Willy Tarreaue6b98942007-10-29 01:09:36 +0100599 tcp_return:
Cyril Bonté43ba1b32010-11-01 19:26:01 +0100600 if (msg && errlen) {
601 char pn[INET6_ADDRSTRLEN];
602
Willy Tarreau631f01c2011-09-05 00:36:48 +0200603 addr_to_str(&listener->addr, pn, sizeof(pn));
604 snprintf(errmsg, errlen, "%s [%s:%d]", msg, pn, get_host_port(&listener->addr));
Cyril Bonté43ba1b32010-11-01 19:26:01 +0100605 }
Willy Tarreaue6b98942007-10-29 01:09:36 +0100606 return err;
607
608 tcp_close_return:
609 close(fd);
610 goto tcp_return;
611}
612
613/* This function creates all TCP sockets bound to the protocol entry <proto>.
614 * It is intended to be used as the protocol's bind_all() function.
615 * The sockets will be registered but not added to any fd_set, in order not to
616 * loose them across the fork(). A call to enable_all_listeners() is needed
617 * to complete initialization. The return value is composed from ERR_*.
618 */
Emeric Bruncf20bf12010-10-22 16:06:11 +0200619static int tcp_bind_listeners(struct protocol *proto, char *errmsg, int errlen)
Willy Tarreaue6b98942007-10-29 01:09:36 +0100620{
621 struct listener *listener;
622 int err = ERR_NONE;
623
624 list_for_each_entry(listener, &proto->listeners, proto_list) {
Emeric Bruncf20bf12010-10-22 16:06:11 +0200625 err |= tcp_bind_listener(listener, errmsg, errlen);
626 if (err & ERR_ABORT)
Willy Tarreaue6b98942007-10-29 01:09:36 +0100627 break;
628 }
629
630 return err;
631}
632
633/* Add listener to the list of tcpv4 listeners. The listener's state
634 * is automatically updated from LI_INIT to LI_ASSIGNED. The number of
635 * listeners is updated. This is the function to use to add a new listener.
636 */
637void tcpv4_add_listener(struct listener *listener)
638{
639 if (listener->state != LI_INIT)
640 return;
641 listener->state = LI_ASSIGNED;
642 listener->proto = &proto_tcpv4;
643 LIST_ADDQ(&proto_tcpv4.listeners, &listener->proto_list);
644 proto_tcpv4.nb_listeners++;
645}
646
647/* Add listener to the list of tcpv4 listeners. The listener's state
648 * is automatically updated from LI_INIT to LI_ASSIGNED. The number of
649 * listeners is updated. This is the function to use to add a new listener.
650 */
651void tcpv6_add_listener(struct listener *listener)
652{
653 if (listener->state != LI_INIT)
654 return;
655 listener->state = LI_ASSIGNED;
656 listener->proto = &proto_tcpv6;
657 LIST_ADDQ(&proto_tcpv6.listeners, &listener->proto_list);
658 proto_tcpv6.nb_listeners++;
659}
660
Willy Tarreauedcf6682008-11-30 23:15:34 +0100661/* This function performs the TCP request analysis on the current request. It
662 * returns 1 if the processing can continue on next analysers, or zero if it
663 * needs more data, encounters an error, or wants to immediately abort the
Willy Tarreaufb356202010-08-03 14:02:05 +0200664 * request. It relies on buffers flags, and updates s->req->analysers. The
665 * function may be called for frontend rules and backend rules. It only relies
666 * on the backend pointer so this works for both cases.
Willy Tarreauedcf6682008-11-30 23:15:34 +0100667 */
Willy Tarreau3a816292009-07-07 10:55:49 +0200668int tcp_inspect_request(struct session *s, struct buffer *req, int an_bit)
Willy Tarreauedcf6682008-11-30 23:15:34 +0100669{
670 struct tcp_rule *rule;
Willy Tarreaud1f96522010-08-03 19:34:32 +0200671 struct stksess *ts;
672 struct stktable *t;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100673 int partial;
674
675 DPRINTF(stderr,"[%u] %s: session=%p b=%p, exp(r,w)=%u,%u bf=%08x bl=%d analysers=%02x\n",
676 now_ms, __FUNCTION__,
677 s,
678 req,
679 req->rex, req->wex,
680 req->flags,
681 req->l,
682 req->analysers);
683
Willy Tarreauedcf6682008-11-30 23:15:34 +0100684 /* We don't know whether we have enough data, so must proceed
685 * this way :
686 * - iterate through all rules in their declaration order
687 * - if one rule returns MISS, it means the inspect delay is
688 * not over yet, then return immediately, otherwise consider
689 * it as a non-match.
690 * - if one rule returns OK, then return OK
691 * - if one rule returns KO, then return KO
692 */
693
Willy Tarreaub824b002010-09-29 16:36:16 +0200694 if (req->flags & (BF_SHUTR|BF_FULL) || !s->be->tcp_req.inspect_delay || tick_is_expired(req->analyse_exp, now_ms))
Willy Tarreauedcf6682008-11-30 23:15:34 +0100695 partial = 0;
696 else
697 partial = ACL_PARTIAL;
698
Willy Tarreaufb356202010-08-03 14:02:05 +0200699 list_for_each_entry(rule, &s->be->tcp_req.inspect_rules, list) {
Willy Tarreauedcf6682008-11-30 23:15:34 +0100700 int ret = ACL_PAT_PASS;
701
702 if (rule->cond) {
Willy Tarreaufb356202010-08-03 14:02:05 +0200703 ret = acl_exec_cond(rule->cond, s->be, s, &s->txn, ACL_DIR_REQ | partial);
Willy Tarreauedcf6682008-11-30 23:15:34 +0100704 if (ret == ACL_PAT_MISS) {
Willy Tarreau520d95e2009-09-19 21:04:57 +0200705 buffer_dont_connect(req);
Willy Tarreauedcf6682008-11-30 23:15:34 +0100706 /* just set the request timeout once at the beginning of the request */
Willy Tarreaufb356202010-08-03 14:02:05 +0200707 if (!tick_isset(req->analyse_exp) && s->be->tcp_req.inspect_delay)
708 req->analyse_exp = tick_add_ifset(now_ms, s->be->tcp_req.inspect_delay);
Willy Tarreauedcf6682008-11-30 23:15:34 +0100709 return 0;
710 }
711
712 ret = acl_pass(ret);
713 if (rule->cond->pol == ACL_COND_UNLESS)
714 ret = !ret;
715 }
716
717 if (ret) {
718 /* we have a matching rule. */
719 if (rule->action == TCP_ACT_REJECT) {
720 buffer_abort(req);
721 buffer_abort(s->rep);
722 req->analysers = 0;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +0200723
Willy Tarreau7d0aaf32011-03-10 23:25:56 +0100724 s->be->be_counters.denied_req++;
725 s->fe->fe_counters.denied_req++;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +0200726 if (s->listener->counters)
Willy Tarreau23968d82010-05-23 23:50:44 +0200727 s->listener->counters->denied_req++;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +0200728
Willy Tarreauedcf6682008-11-30 23:15:34 +0100729 if (!(s->flags & SN_ERR_MASK))
730 s->flags |= SN_ERR_PRXCOND;
731 if (!(s->flags & SN_FINST_MASK))
732 s->flags |= SN_FINST_R;
733 return 0;
734 }
Willy Tarreau56123282010-08-06 19:06:56 +0200735 else if (rule->action == TCP_ACT_TRK_SC1) {
736 if (!s->stkctr1_entry) {
737 /* only the first valid track-sc1 directive applies.
Willy Tarreaud1f96522010-08-03 19:34:32 +0200738 * Also, note that right now we can only track SRC so we
739 * don't check how to get the key, but later we may need
740 * to consider rule->act_prm->trk_ctr.type.
741 */
742 t = rule->act_prm.trk_ctr.table.t;
David du Colombier4f92d322011-03-24 11:09:31 +0100743 ts = stktable_get_entry(t, tcp_src_to_stktable_key(s));
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200744 if (ts) {
Willy Tarreau56123282010-08-06 19:06:56 +0200745 session_track_stkctr1(s, t, ts);
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200746 if (s->fe != s->be)
747 s->flags |= SN_BE_TRACK_SC1;
748 }
Willy Tarreaud1f96522010-08-03 19:34:32 +0200749 }
750 }
Willy Tarreau56123282010-08-06 19:06:56 +0200751 else if (rule->action == TCP_ACT_TRK_SC2) {
752 if (!s->stkctr2_entry) {
753 /* only the first valid track-sc2 directive applies.
Willy Tarreaud1f96522010-08-03 19:34:32 +0200754 * Also, note that right now we can only track SRC so we
755 * don't check how to get the key, but later we may need
756 * to consider rule->act_prm->trk_ctr.type.
757 */
758 t = rule->act_prm.trk_ctr.table.t;
David du Colombier4f92d322011-03-24 11:09:31 +0100759 ts = stktable_get_entry(t, tcp_src_to_stktable_key(s));
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200760 if (ts) {
Willy Tarreau56123282010-08-06 19:06:56 +0200761 session_track_stkctr2(s, t, ts);
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200762 if (s->fe != s->be)
763 s->flags |= SN_BE_TRACK_SC2;
764 }
Willy Tarreaud1f96522010-08-03 19:34:32 +0200765 }
766 }
767 else {
Willy Tarreauedcf6682008-11-30 23:15:34 +0100768 /* otherwise accept */
Willy Tarreaud1f96522010-08-03 19:34:32 +0200769 break;
770 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100771 }
772 }
773
774 /* if we get there, it means we have no rule which matches, or
775 * we have an explicit accept, so we apply the default accept.
776 */
Willy Tarreau3a816292009-07-07 10:55:49 +0200777 req->analysers &= ~an_bit;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100778 req->analyse_exp = TICK_ETERNITY;
779 return 1;
780}
781
Emeric Brun97679e72010-09-23 17:56:44 +0200782/* This function performs the TCP response analysis on the current response. It
783 * returns 1 if the processing can continue on next analysers, or zero if it
784 * needs more data, encounters an error, or wants to immediately abort the
785 * response. It relies on buffers flags, and updates s->rep->analysers. The
786 * function may be called for backend rules.
787 */
788int tcp_inspect_response(struct session *s, struct buffer *rep, int an_bit)
789{
790 struct tcp_rule *rule;
791 int partial;
792
793 DPRINTF(stderr,"[%u] %s: session=%p b=%p, exp(r,w)=%u,%u bf=%08x bl=%d analysers=%02x\n",
794 now_ms, __FUNCTION__,
795 s,
796 rep,
797 rep->rex, rep->wex,
798 rep->flags,
799 rep->l,
800 rep->analysers);
801
802 /* We don't know whether we have enough data, so must proceed
803 * this way :
804 * - iterate through all rules in their declaration order
805 * - if one rule returns MISS, it means the inspect delay is
806 * not over yet, then return immediately, otherwise consider
807 * it as a non-match.
808 * - if one rule returns OK, then return OK
809 * - if one rule returns KO, then return KO
810 */
811
812 if (rep->flags & BF_SHUTR || tick_is_expired(rep->analyse_exp, now_ms))
813 partial = 0;
814 else
815 partial = ACL_PARTIAL;
816
817 list_for_each_entry(rule, &s->be->tcp_rep.inspect_rules, list) {
818 int ret = ACL_PAT_PASS;
819
820 if (rule->cond) {
821 ret = acl_exec_cond(rule->cond, s->be, s, &s->txn, ACL_DIR_RTR | partial);
822 if (ret == ACL_PAT_MISS) {
823 /* just set the analyser timeout once at the beginning of the response */
824 if (!tick_isset(rep->analyse_exp) && s->be->tcp_rep.inspect_delay)
825 rep->analyse_exp = tick_add_ifset(now_ms, s->be->tcp_rep.inspect_delay);
826 return 0;
827 }
828
829 ret = acl_pass(ret);
830 if (rule->cond->pol == ACL_COND_UNLESS)
831 ret = !ret;
832 }
833
834 if (ret) {
835 /* we have a matching rule. */
836 if (rule->action == TCP_ACT_REJECT) {
837 buffer_abort(rep);
838 buffer_abort(s->req);
839 rep->analysers = 0;
840
Willy Tarreau7d0aaf32011-03-10 23:25:56 +0100841 s->be->be_counters.denied_resp++;
842 s->fe->fe_counters.denied_resp++;
Emeric Brun97679e72010-09-23 17:56:44 +0200843 if (s->listener->counters)
844 s->listener->counters->denied_resp++;
845
846 if (!(s->flags & SN_ERR_MASK))
847 s->flags |= SN_ERR_PRXCOND;
848 if (!(s->flags & SN_FINST_MASK))
849 s->flags |= SN_FINST_D;
850 return 0;
851 }
852 else {
853 /* otherwise accept */
854 break;
855 }
856 }
857 }
858
859 /* if we get there, it means we have no rule which matches, or
860 * we have an explicit accept, so we apply the default accept.
861 */
862 rep->analysers &= ~an_bit;
863 rep->analyse_exp = TICK_ETERNITY;
864 return 1;
865}
866
867
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200868/* This function performs the TCP layer4 analysis on the current request. It
869 * returns 0 if a reject rule matches, otherwise 1 if either an accept rule
870 * matches or if no more rule matches. It can only use rules which don't need
871 * any data.
872 */
873int tcp_exec_req_rules(struct session *s)
874{
875 struct tcp_rule *rule;
Willy Tarreauf059a0f2010-08-03 16:29:52 +0200876 struct stksess *ts;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200877 struct stktable *t = NULL;
878 int result = 1;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200879 int ret;
880
881 list_for_each_entry(rule, &s->fe->tcp_req.l4_rules, list) {
882 ret = ACL_PAT_PASS;
883
884 if (rule->cond) {
885 ret = acl_exec_cond(rule->cond, s->fe, s, NULL, ACL_DIR_REQ);
886 ret = acl_pass(ret);
887 if (rule->cond->pol == ACL_COND_UNLESS)
888 ret = !ret;
889 }
890
891 if (ret) {
892 /* we have a matching rule. */
893 if (rule->action == TCP_ACT_REJECT) {
Willy Tarreau7d0aaf32011-03-10 23:25:56 +0100894 s->fe->fe_counters.denied_conn++;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200895 if (s->listener->counters)
Willy Tarreau2799e982010-06-05 15:43:21 +0200896 s->listener->counters->denied_conn++;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200897
898 if (!(s->flags & SN_ERR_MASK))
899 s->flags |= SN_ERR_PRXCOND;
900 if (!(s->flags & SN_FINST_MASK))
901 s->flags |= SN_FINST_R;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200902 result = 0;
903 break;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200904 }
Willy Tarreau56123282010-08-06 19:06:56 +0200905 else if (rule->action == TCP_ACT_TRK_SC1) {
906 if (!s->stkctr1_entry) {
907 /* only the first valid track-sc1 directive applies.
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200908 * Also, note that right now we can only track SRC so we
909 * don't check how to get the key, but later we may need
910 * to consider rule->act_prm->trk_ctr.type.
911 */
912 t = rule->act_prm.trk_ctr.table.t;
David du Colombier4f92d322011-03-24 11:09:31 +0100913 ts = stktable_get_entry(t, tcp_src_to_stktable_key(s));
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200914 if (ts)
Willy Tarreau56123282010-08-06 19:06:56 +0200915 session_track_stkctr1(s, t, ts);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200916 }
917 }
Willy Tarreau56123282010-08-06 19:06:56 +0200918 else if (rule->action == TCP_ACT_TRK_SC2) {
919 if (!s->stkctr2_entry) {
920 /* only the first valid track-sc2 directive applies.
Willy Tarreauf059a0f2010-08-03 16:29:52 +0200921 * Also, note that right now we can only track SRC so we
922 * don't check how to get the key, but later we may need
923 * to consider rule->act_prm->trk_ctr.type.
924 */
925 t = rule->act_prm.trk_ctr.table.t;
David du Colombier4f92d322011-03-24 11:09:31 +0100926 ts = stktable_get_entry(t, tcp_src_to_stktable_key(s));
Willy Tarreauf059a0f2010-08-03 16:29:52 +0200927 if (ts)
Willy Tarreau56123282010-08-06 19:06:56 +0200928 session_track_stkctr2(s, t, ts);
Willy Tarreauf059a0f2010-08-03 16:29:52 +0200929 }
930 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200931 else {
932 /* otherwise it's an accept */
933 break;
934 }
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200935 }
936 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200937 return result;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200938}
939
Emeric Brun97679e72010-09-23 17:56:44 +0200940/* Parse a tcp-response rule. Return a negative value in case of failure */
941static int tcp_parse_response_rule(char **args, int arg, int section_type,
942 struct proxy *curpx, struct proxy *defpx,
943 struct tcp_rule *rule, char *err, int errlen)
944{
945 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
946 snprintf(err, errlen, "%s %s is only allowed in 'backend' sections",
947 args[0], args[1]);
948 return -1;
949 }
950
951 if (strcmp(args[arg], "accept") == 0) {
952 arg++;
953 rule->action = TCP_ACT_ACCEPT;
954 }
955 else if (strcmp(args[arg], "reject") == 0) {
956 arg++;
957 rule->action = TCP_ACT_REJECT;
958 }
959 else {
960 snprintf(err, errlen,
961 "'%s %s' expects 'accept' or 'reject' in %s '%s' (was '%s')",
962 args[0], args[1], proxy_type_str(curpx), curpx->id, args[arg]);
963 return -1;
964 }
965
966 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
967 if ((rule->cond = build_acl_cond(NULL, 0, curpx, (const char **)args+arg)) == NULL) {
968 snprintf(err, errlen,
969 "error detected in %s '%s' while parsing '%s' condition",
970 proxy_type_str(curpx), curpx->id, args[arg]);
971 return -1;
972 }
973 }
974 else if (*args[arg]) {
975 snprintf(err, errlen,
976 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (was '%s')",
977 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
978 return -1;
979 }
980 return 0;
981}
982
983
984
Willy Tarreau68c03ab2010-08-06 15:08:45 +0200985/* Parse a tcp-request rule. Return a negative value in case of failure */
986static int tcp_parse_request_rule(char **args, int arg, int section_type,
987 struct proxy *curpx, struct proxy *defpx,
988 struct tcp_rule *rule, char *err, int errlen)
989{
990 if (curpx == defpx) {
991 snprintf(err, errlen, "%s %s is not allowed in 'defaults' sections",
992 args[0], args[1]);
993 return -1;
994 }
995
996 if (!strcmp(args[arg], "accept")) {
997 arg++;
998 rule->action = TCP_ACT_ACCEPT;
999 }
1000 else if (!strcmp(args[arg], "reject")) {
1001 arg++;
1002 rule->action = TCP_ACT_REJECT;
1003 }
Willy Tarreau56123282010-08-06 19:06:56 +02001004 else if (strcmp(args[arg], "track-sc1") == 0) {
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001005 int ret;
1006
1007 arg++;
1008 ret = parse_track_counters(args, &arg, section_type, curpx,
1009 &rule->act_prm.trk_ctr, defpx, err, errlen);
1010
1011 if (ret < 0) /* nb: warnings are not handled yet */
1012 return -1;
1013
Willy Tarreau56123282010-08-06 19:06:56 +02001014 rule->action = TCP_ACT_TRK_SC1;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001015 }
Willy Tarreau56123282010-08-06 19:06:56 +02001016 else if (strcmp(args[arg], "track-sc2") == 0) {
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001017 int ret;
1018
1019 arg++;
1020 ret = parse_track_counters(args, &arg, section_type, curpx,
1021 &rule->act_prm.trk_ctr, defpx, err, errlen);
1022
1023 if (ret < 0) /* nb: warnings are not handled yet */
1024 return -1;
1025
Willy Tarreau56123282010-08-06 19:06:56 +02001026 rule->action = TCP_ACT_TRK_SC2;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001027 }
1028 else {
1029 snprintf(err, errlen,
Willy Tarreau56123282010-08-06 19:06:56 +02001030 "'%s %s' expects 'accept', 'reject', 'track-sc1' "
1031 "or 'track-sc2' in %s '%s' (was '%s')",
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001032 args[0], args[1], proxy_type_str(curpx), curpx->id, args[arg]);
1033 return -1;
1034 }
1035
1036 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
1037 if ((rule->cond = build_acl_cond(NULL, 0, curpx, (const char **)args+arg)) == NULL) {
1038 snprintf(err, errlen,
1039 "error detected in %s '%s' while parsing '%s' condition",
1040 proxy_type_str(curpx), curpx->id, args[arg]);
1041 return -1;
1042 }
1043 }
1044 else if (*args[arg]) {
1045 snprintf(err, errlen,
1046 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (was '%s')",
1047 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
1048 return -1;
1049 }
1050 return 0;
1051}
1052
Emeric Brun97679e72010-09-23 17:56:44 +02001053/* This function should be called to parse a line starting with the "tcp-response"
1054 * keyword.
1055 */
1056static int tcp_parse_tcp_rep(char **args, int section_type, struct proxy *curpx,
1057 struct proxy *defpx, char *err, int errlen)
1058{
1059 const char *ptr = NULL;
1060 unsigned int val;
1061 int retlen;
1062 int warn = 0;
1063 int arg;
1064 struct tcp_rule *rule;
1065
1066 if (!*args[1]) {
1067 snprintf(err, errlen, "missing argument for '%s' in %s '%s'",
1068 args[0], proxy_type_str(curpx), curpx->id);
1069 return -1;
1070 }
1071
1072 if (strcmp(args[1], "inspect-delay") == 0) {
1073 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
1074 snprintf(err, errlen, "%s %s is only allowed in 'backend' sections",
1075 args[0], args[1]);
1076 return -1;
1077 }
1078
1079 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
1080 retlen = snprintf(err, errlen,
1081 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
1082 args[0], args[1], proxy_type_str(curpx), curpx->id);
1083 if (ptr && retlen < errlen)
1084 retlen += snprintf(err + retlen, errlen - retlen,
1085 " (unexpected character '%c')", *ptr);
1086 return -1;
1087 }
1088
1089 if (curpx->tcp_rep.inspect_delay) {
1090 snprintf(err, errlen, "ignoring %s %s (was already defined) in %s '%s'",
1091 args[0], args[1], proxy_type_str(curpx), curpx->id);
1092 return 1;
1093 }
1094 curpx->tcp_rep.inspect_delay = val;
1095 return 0;
1096 }
1097
Simon Hormande072bd2011-06-24 15:11:37 +09001098 rule = calloc(1, sizeof(*rule));
Emeric Brun97679e72010-09-23 17:56:44 +02001099 LIST_INIT(&rule->list);
1100 arg = 1;
1101
1102 if (strcmp(args[1], "content") == 0) {
1103 arg++;
1104 if (tcp_parse_response_rule(args, arg, section_type, curpx, defpx, rule, err, errlen) < 0)
1105 goto error;
1106
1107 if (rule->cond && (rule->cond->requires & ACL_USE_L6REQ_VOLATILE)) {
1108 struct acl *acl;
1109 const char *name;
1110
1111 acl = cond_find_require(rule->cond, ACL_USE_L6REQ_VOLATILE);
1112 name = acl ? acl->name : "(unknown)";
1113
1114 retlen = snprintf(err, errlen,
1115 "acl '%s' involves some request-only criteria which will be ignored.",
1116 name);
1117 warn++;
1118 }
1119
1120 LIST_ADDQ(&curpx->tcp_rep.inspect_rules, &rule->list);
1121 }
1122 else {
1123 retlen = snprintf(err, errlen,
1124 "'%s' expects 'inspect-delay' or 'content' in %s '%s' (was '%s')",
1125 args[0], proxy_type_str(curpx), curpx->id, args[1]);
1126 goto error;
1127 }
1128
1129 return warn;
1130 error:
1131 free(rule);
1132 return -1;
1133}
1134
1135
Willy Tarreaub6866442008-07-14 23:54:42 +02001136/* This function should be called to parse a line starting with the "tcp-request"
1137 * keyword.
1138 */
1139static int tcp_parse_tcp_req(char **args, int section_type, struct proxy *curpx,
1140 struct proxy *defpx, char *err, int errlen)
1141{
1142 const char *ptr = NULL;
Willy Tarreauc7e961e2008-08-17 17:13:47 +02001143 unsigned int val;
Willy Tarreaub6866442008-07-14 23:54:42 +02001144 int retlen;
Willy Tarreau1a687942010-05-23 22:40:30 +02001145 int warn = 0;
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001146 int arg;
Willy Tarreau1a687942010-05-23 22:40:30 +02001147 struct tcp_rule *rule;
Willy Tarreaub6866442008-07-14 23:54:42 +02001148
1149 if (!*args[1]) {
1150 snprintf(err, errlen, "missing argument for '%s' in %s '%s'",
Willy Tarreauf5356832010-06-14 18:40:26 +02001151 args[0], proxy_type_str(curpx), curpx->id);
Willy Tarreaub6866442008-07-14 23:54:42 +02001152 return -1;
1153 }
1154
1155 if (!strcmp(args[1], "inspect-delay")) {
1156 if (curpx == defpx) {
1157 snprintf(err, errlen, "%s %s is not allowed in 'defaults' sections",
1158 args[0], args[1]);
1159 return -1;
1160 }
1161
Willy Tarreaub6866442008-07-14 23:54:42 +02001162 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
1163 retlen = snprintf(err, errlen,
1164 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
Willy Tarreauf5356832010-06-14 18:40:26 +02001165 args[0], args[1], proxy_type_str(curpx), curpx->id);
Willy Tarreaub6866442008-07-14 23:54:42 +02001166 if (ptr && retlen < errlen)
1167 retlen += snprintf(err+retlen, errlen - retlen,
1168 " (unexpected character '%c')", *ptr);
1169 return -1;
1170 }
1171
1172 if (curpx->tcp_req.inspect_delay) {
1173 snprintf(err, errlen, "ignoring %s %s (was already defined) in %s '%s'",
Willy Tarreauf5356832010-06-14 18:40:26 +02001174 args[0], args[1], proxy_type_str(curpx), curpx->id);
Willy Tarreaub6866442008-07-14 23:54:42 +02001175 return 1;
1176 }
1177 curpx->tcp_req.inspect_delay = val;
1178 return 0;
1179 }
1180
Simon Hormande072bd2011-06-24 15:11:37 +09001181 rule = calloc(1, sizeof(*rule));
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001182 LIST_INIT(&rule->list);
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001183 arg = 1;
1184
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001185 if (strcmp(args[1], "content") == 0) {
Willy Tarreaud1f96522010-08-03 19:34:32 +02001186 arg++;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001187 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, errlen) < 0)
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001188 goto error;
Willy Tarreaub6866442008-07-14 23:54:42 +02001189
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001190 if (rule->cond && (rule->cond->requires & ACL_USE_RTR_ANY)) {
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001191 struct acl *acl;
1192 const char *name;
1193
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001194 acl = cond_find_require(rule->cond, ACL_USE_RTR_ANY);
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001195 name = acl ? acl->name : "(unknown)";
1196
1197 retlen = snprintf(err, errlen,
Willy Tarreau1a211942009-07-14 13:53:17 +02001198 "acl '%s' involves some response-only criteria which will be ignored.",
1199 name);
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001200 warn++;
1201 }
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001202 LIST_ADDQ(&curpx->tcp_req.inspect_rules, &rule->list);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001203 }
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001204 else if (strcmp(args[1], "connection") == 0) {
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001205 arg++;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001206
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001207 if (!(curpx->cap & PR_CAP_FE)) {
1208 snprintf(err, errlen, "%s %s is not allowed because %s %s is not a frontend",
1209 args[0], args[1], proxy_type_str(curpx), curpx->id);
Simon Horman6c54d8b2011-07-15 13:14:06 +09001210 goto error;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001211 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001212
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001213 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, errlen) < 0)
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001214 goto error;
1215
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001216 if (rule->cond && (rule->cond->requires & (ACL_USE_RTR_ANY|ACL_USE_L6_ANY|ACL_USE_L7_ANY))) {
1217 struct acl *acl;
1218 const char *name;
Willy Tarreauf059a0f2010-08-03 16:29:52 +02001219
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001220 acl = cond_find_require(rule->cond, ACL_USE_RTR_ANY|ACL_USE_L6_ANY|ACL_USE_L7_ANY);
1221 name = acl ? acl->name : "(unknown)";
Willy Tarreauf059a0f2010-08-03 16:29:52 +02001222
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001223 if (acl->requires & (ACL_USE_L6_ANY|ACL_USE_L7_ANY)) {
1224 retlen = snprintf(err, errlen,
1225 "'%s %s' may not reference acl '%s' which makes use of "
1226 "payload in %s '%s'. Please use '%s content' for this.",
1227 args[0], args[1], name, proxy_type_str(curpx), curpx->id, args[0]);
1228 goto error;
1229 }
1230 if (acl->requires & ACL_USE_RTR_ANY)
1231 retlen = snprintf(err, errlen,
1232 "acl '%s' involves some response-only criteria which will be ignored.",
1233 name);
1234 warn++;
1235 }
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001236 LIST_ADDQ(&curpx->tcp_req.l4_rules, &rule->list);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001237 }
Willy Tarreau1a687942010-05-23 22:40:30 +02001238 else {
1239 retlen = snprintf(err, errlen,
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001240 "'%s' expects 'inspect-delay', 'connection', or 'content' in %s '%s' (was '%s')",
Willy Tarreau1a687942010-05-23 22:40:30 +02001241 args[0], proxy_type_str(curpx), curpx->id, args[1]);
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001242 goto error;
Willy Tarreau1a687942010-05-23 22:40:30 +02001243 }
1244
Willy Tarreau1a687942010-05-23 22:40:30 +02001245 return warn;
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001246 error:
1247 free(rule);
1248 return -1;
Willy Tarreaub6866442008-07-14 23:54:42 +02001249}
1250
Willy Tarreau645513a2010-05-24 20:55:15 +02001251
1252/************************************************************************/
1253/* All supported ACL keywords must be declared here. */
1254/************************************************************************/
1255
Willy Tarreauf4362b32011-12-16 17:49:52 +01001256/* copy the source IPv4/v6 address into temp_pattern */
Willy Tarreau645513a2010-05-24 20:55:15 +02001257static int
1258acl_fetch_src(struct proxy *px, struct session *l4, void *l7, int dir,
1259 struct acl_expr *expr, struct acl_test *test)
1260{
Willy Tarreauf4362b32011-12-16 17:49:52 +01001261 switch (l4->si[0].addr.from.ss_family) {
1262 case AF_INET:
1263 temp_pattern.data.ip = ((struct sockaddr_in *)&l4->si[0].addr.from)->sin_addr;
1264 temp_pattern.type = PATTERN_TYPE_IP;
1265 break;
1266 case AF_INET6:
1267 temp_pattern.data.ipv6 = ((struct sockaddr_in6 *)(&l4->si[0].addr.from))->sin6_addr;
1268 temp_pattern.type = PATTERN_TYPE_IPV6;
1269 break;
1270 default:
Emeric Brunf769f512010-10-22 17:14:01 +02001271 return 0;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001272 }
Emeric Brunf769f512010-10-22 17:14:01 +02001273
Willy Tarreauf4362b32011-12-16 17:49:52 +01001274 test->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001275 return 1;
1276}
1277
David du Colombier4f92d322011-03-24 11:09:31 +01001278/* extract the connection's source ipv4 address */
Willy Tarreau645513a2010-05-24 20:55:15 +02001279static int
1280pattern_fetch_src(struct proxy *px, struct session *l4, void *l7, int dir,
Emeric Brun485479d2010-09-23 18:02:19 +02001281 const struct pattern_arg *arg_p, int arg_i, union pattern_data *data)
Willy Tarreau645513a2010-05-24 20:55:15 +02001282{
Willy Tarreau6471afb2011-09-23 10:54:59 +02001283 if (l4->si[0].addr.from.ss_family != AF_INET )
Emeric Brunf769f512010-10-22 17:14:01 +02001284 return 0;
1285
Willy Tarreau6471afb2011-09-23 10:54:59 +02001286 data->ip.s_addr = ((struct sockaddr_in *)&l4->si[0].addr.from)->sin_addr.s_addr;
Willy Tarreau645513a2010-05-24 20:55:15 +02001287 return 1;
1288}
1289
David du Colombier4f92d322011-03-24 11:09:31 +01001290/* extract the connection's source ipv6 address */
1291static int
1292pattern_fetch_src6(struct proxy *px, struct session *l4, void *l7, int dir,
1293 const struct pattern_arg *arg_p, int arg_i, union pattern_data *data)
1294{
Willy Tarreau6471afb2011-09-23 10:54:59 +02001295 if (l4->si[0].addr.from.ss_family != AF_INET6)
David du Colombier4f92d322011-03-24 11:09:31 +01001296 return 0;
1297
Willy Tarreau6471afb2011-09-23 10:54:59 +02001298 memcpy(data->ipv6.s6_addr, ((struct sockaddr_in6 *)&l4->si[0].addr.from)->sin6_addr.s6_addr, sizeof(data->ipv6.s6_addr));
David du Colombier4f92d322011-03-24 11:09:31 +01001299 return 1;
1300}
Willy Tarreau645513a2010-05-24 20:55:15 +02001301
Willy Tarreaua5e37562011-12-16 17:06:15 +01001302/* set temp integer to the connection's source port */
Willy Tarreau645513a2010-05-24 20:55:15 +02001303static int
1304acl_fetch_sport(struct proxy *px, struct session *l4, void *l7, int dir,
1305 struct acl_expr *expr, struct acl_test *test)
1306{
Willy Tarreaua5e37562011-12-16 17:06:15 +01001307 if (!(temp_pattern.data.integer = get_host_port(&l4->si[0].addr.from)))
Emeric Brunf769f512010-10-22 17:14:01 +02001308 return 0;
1309
Willy Tarreau645513a2010-05-24 20:55:15 +02001310 test->flags = 0;
1311 return 1;
1312}
1313
1314
1315/* set test->ptr to point to the frontend's IPv4/IPv6 address and test->i to the family */
1316static int
1317acl_fetch_dst(struct proxy *px, struct session *l4, void *l7, int dir,
1318 struct acl_expr *expr, struct acl_test *test)
1319{
1320 if (!(l4->flags & SN_FRT_ADDR_SET))
1321 get_frt_addr(l4);
1322
Willy Tarreauf4362b32011-12-16 17:49:52 +01001323 switch (l4->si[0].addr.to.ss_family) {
1324 case AF_INET:
1325 temp_pattern.data.ip = ((struct sockaddr_in *)&l4->si[0].addr.to)->sin_addr;
1326 temp_pattern.type = PATTERN_TYPE_IP;
1327 break;
1328 case AF_INET6:
1329 temp_pattern.data.ipv6 = ((struct sockaddr_in6 *)(&l4->si[0].addr.to))->sin6_addr;
1330 temp_pattern.type = PATTERN_TYPE_IPV6;
1331 break;
1332 default:
Emeric Brunf769f512010-10-22 17:14:01 +02001333 return 0;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001334 }
Emeric Brunf769f512010-10-22 17:14:01 +02001335
Willy Tarreauf4362b32011-12-16 17:49:52 +01001336 test->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001337 return 1;
1338}
1339
1340
David du Colombier4f92d322011-03-24 11:09:31 +01001341/* extract the connection's destination ipv4 address */
Willy Tarreau645513a2010-05-24 20:55:15 +02001342static int
1343pattern_fetch_dst(struct proxy *px, struct session *l4, void *l7, int dir,
Emeric Brun485479d2010-09-23 18:02:19 +02001344 const struct pattern_arg *arg_p, int arg_i, union pattern_data *data)
Willy Tarreau645513a2010-05-24 20:55:15 +02001345{
emeric8aa6b372010-10-22 17:06:26 +02001346 if (!(l4->flags & SN_FRT_ADDR_SET))
1347 get_frt_addr(l4);
1348
Willy Tarreau6471afb2011-09-23 10:54:59 +02001349 if (l4->si[0].addr.to.ss_family != AF_INET)
Emeric Brunf769f512010-10-22 17:14:01 +02001350 return 0;
1351
Willy Tarreau6471afb2011-09-23 10:54:59 +02001352 data->ip.s_addr = ((struct sockaddr_in *)&l4->si[0].addr.to)->sin_addr.s_addr;
Willy Tarreau645513a2010-05-24 20:55:15 +02001353 return 1;
1354}
1355
David du Colombier4f92d322011-03-24 11:09:31 +01001356/* extract the connection's destination ipv6 address */
1357static int
1358pattern_fetch_dst6(struct proxy *px, struct session *l4, void *l7, int dir,
1359 const struct pattern_arg *arg_p, int arg_i, union pattern_data *data)
1360{
1361 if (!(l4->flags & SN_FRT_ADDR_SET))
1362 get_frt_addr(l4);
1363
Willy Tarreau6471afb2011-09-23 10:54:59 +02001364 if (l4->si[0].addr.to.ss_family != AF_INET6)
David du Colombier4f92d322011-03-24 11:09:31 +01001365 return 0;
1366
Willy Tarreau6471afb2011-09-23 10:54:59 +02001367 memcpy(data->ipv6.s6_addr, ((struct sockaddr_in6 *)&l4->si[0].addr.to)->sin6_addr.s6_addr, sizeof(data->ipv6.s6_addr));
David du Colombier4f92d322011-03-24 11:09:31 +01001368 return 1;
1369}
1370
Willy Tarreaua5e37562011-12-16 17:06:15 +01001371/* set temp integer to the frontend connexion's destination port */
Willy Tarreau645513a2010-05-24 20:55:15 +02001372static int
1373acl_fetch_dport(struct proxy *px, struct session *l4, void *l7, int dir,
1374 struct acl_expr *expr, struct acl_test *test)
1375{
1376 if (!(l4->flags & SN_FRT_ADDR_SET))
1377 get_frt_addr(l4);
1378
Willy Tarreaua5e37562011-12-16 17:06:15 +01001379 if (!(temp_pattern.data.integer = get_host_port(&l4->si[0].addr.to)))
Emeric Brunf769f512010-10-22 17:14:01 +02001380 return 0;
1381
Willy Tarreau645513a2010-05-24 20:55:15 +02001382 test->flags = 0;
1383 return 1;
1384}
1385
1386static int
1387pattern_fetch_dport(struct proxy *px, struct session *l4, void *l7, int dir,
Emeric Brun485479d2010-09-23 18:02:19 +02001388 const struct pattern_arg *arg, int i, union pattern_data *data)
Willy Tarreau645513a2010-05-24 20:55:15 +02001389{
emeric8aa6b372010-10-22 17:06:26 +02001390 if (!(l4->flags & SN_FRT_ADDR_SET))
1391 get_frt_addr(l4);
1392
Willy Tarreau6471afb2011-09-23 10:54:59 +02001393 if (!(data->integer = get_host_port(&l4->si[0].addr.to)))
Emeric Brunf769f512010-10-22 17:14:01 +02001394 return 0;
1395
Willy Tarreau645513a2010-05-24 20:55:15 +02001396 return 1;
1397}
1398
Emericf2d7cae2010-11-05 18:13:50 +01001399static int
1400pattern_arg_fetch_payloadlv(const char *arg, struct pattern_arg **arg_p, int *arg_i)
1401{
1402 int member = 0;
1403 int len_offset = 0;
1404 int len_size = 0;
1405 int buf_offset = 0;
1406 int relative = 0;
1407 int arg_len = strlen(arg);
1408 int i;
1409
1410 for (i = 0; i < arg_len; i++) {
1411 if (arg[i] == ',') {
1412 member++;
1413 } else if (member == 0) {
1414 if (arg[i] < '0' || arg[i] > '9')
1415 return 0;
1416
1417 len_offset = 10 * len_offset + arg[i] - '0';
1418 } else if (member == 1) {
1419 if (arg[i] < '0' || arg[i] > '9')
1420 return 0;
1421
1422 len_size = 10 * len_size + arg[i] - '0';
1423 } else if (member == 2) {
1424 if (!relative && !buf_offset && arg[i] == '+') {
1425 relative = 1;
1426 continue;
1427 } else if (!relative && !buf_offset && arg[i] == '-') {
1428 relative = 2;
1429 continue;
1430 } else if (arg[i] < '0' || arg[i] > '9')
1431 return 0;
1432
1433 buf_offset = 10 * buf_offset + arg[i] - '0';
1434 }
1435 }
1436
1437 if (member < 1)
1438 return 0;
1439
1440 if (!len_size)
1441 return 0;
1442
1443 if (member == 1) {
1444 buf_offset = len_offset + len_size;
1445 }
1446 else if (relative == 1) {
1447 buf_offset = len_offset + len_size + buf_offset;
1448 }
1449 else if (relative == 2) {
1450 if (len_offset + len_size < buf_offset)
1451 return 0;
1452
1453 buf_offset = len_offset + len_size - buf_offset;
1454 }
1455
1456 *arg_i = 3;
1457 *arg_p = calloc(1, *arg_i*sizeof(struct pattern_arg));
1458 (*arg_p)[0].type = PATTERN_ARG_TYPE_INTEGER;
1459 (*arg_p)[0].data.integer = len_offset;
1460 (*arg_p)[1].type = PATTERN_ARG_TYPE_INTEGER;
1461 (*arg_p)[1].data.integer = len_size;
1462 (*arg_p)[2].type = PATTERN_ARG_TYPE_INTEGER;
1463 (*arg_p)[2].data.integer = buf_offset;
1464
1465 return 1;
1466}
1467
1468static int
1469pattern_fetch_payloadlv(struct proxy *px, struct session *l4, void *l7, int dir,
1470 const struct pattern_arg *arg_p, int arg_i, union pattern_data *data)
1471{
1472 int len_offset = arg_p[0].data.integer;
1473 int len_size = arg_p[1].data.integer;
1474 int buf_offset = arg_p[2].data.integer;
1475 int buf_size = 0;
1476 struct buffer *b;
1477 int i;
1478
1479 /* Format is (len offset, len size, buf offset) or (len offset, len size) */
1480 /* by default buf offset == len offset + len size */
1481 /* buf offset could be absolute or relative to len offset + len size if prefixed by + or - */
1482
1483 if (!l4)
1484 return 0;
1485
1486 b = (dir & PATTERN_FETCH_RTR) ? l4->rep : l4->req;
1487
1488 if (!b || !b->l)
1489 return 0;
1490
1491 if (len_offset + len_size > b->l)
1492 return 0;
1493
1494 for (i = 0; i < len_size; i++) {
1495 buf_size = (buf_size << 8) + ((unsigned char *)b->w)[i + len_offset];
1496 }
1497
1498 if (!buf_size)
1499 return 0;
1500
1501 if (buf_offset + buf_size > b->l)
1502 return 0;
1503
1504 /* init chunk as read only */
Simon Hormande072bd2011-06-24 15:11:37 +09001505 chunk_initlen(&data->str, b->w + buf_offset, 0, buf_size);
Emericf2d7cae2010-11-05 18:13:50 +01001506
1507 return 1;
1508}
1509
1510static int
1511pattern_arg_fetch_payload (const char *arg, struct pattern_arg **arg_p, int *arg_i)
1512{
1513 int member = 0;
1514 int buf_offset = 0;
1515 int buf_size = 0;
1516 int arg_len = strlen(arg);
1517 int i;
1518
1519 for (i = 0 ; i < arg_len ; i++) {
1520 if (arg[i] == ',') {
1521 member++;
1522 } else if (member == 0) {
1523 if (arg[i] < '0' || arg[i] > '9')
1524 return 0;
1525
1526 buf_offset = 10 * buf_offset + arg[i] - '0';
1527 } else if (member == 1) {
1528 if (arg[i] < '0' || arg[i] > '9')
1529 return 0;
1530
1531 buf_size = 10 * buf_size + arg[i] - '0';
1532 }
1533 }
1534
1535 if (!buf_size)
1536 return 0;
1537
1538 *arg_i = 2;
1539 *arg_p = calloc(1, *arg_i*sizeof(struct pattern_arg));
1540 (*arg_p)[0].type = PATTERN_ARG_TYPE_INTEGER;
1541 (*arg_p)[0].data.integer = buf_offset;
1542 (*arg_p)[1].type = PATTERN_ARG_TYPE_INTEGER;
1543 (*arg_p)[1].data.integer = buf_size;
1544
1545 return 1;
1546}
1547
1548static int
1549pattern_fetch_payload(struct proxy *px, struct session *l4, void *l7, int dir,
1550 const struct pattern_arg *arg_p, int arg_i, union pattern_data *data)
1551{
1552 int buf_offset = arg_p[0].data.integer;
1553 int buf_size = arg_p[1].data.integer;
1554 struct buffer *b;
1555
1556 if (!l4)
1557 return 0;
1558
1559 b = (dir & PATTERN_FETCH_RTR) ? l4->rep : l4->req;
1560
1561 if (!b || !b->l)
1562 return 0;
1563
1564 if (buf_offset + buf_size > b->l)
1565 return 0;
1566
1567 /* init chunk as read only */
Simon Hormande072bd2011-06-24 15:11:37 +09001568 chunk_initlen(&data->str, b->w + buf_offset, 0, buf_size);
Emericf2d7cae2010-11-05 18:13:50 +01001569
1570 return 1;
1571}
1572
Simon Hormanab814e02011-06-24 14:50:20 +09001573static int
1574pattern_fetch_rdp_cookie(struct proxy *px, struct session *l4, void *l7, int dir,
1575 const struct pattern_arg *arg_p, int arg_i, union pattern_data *data)
1576{
1577 int ret;
1578 struct acl_expr expr;
1579 struct acl_test test;
1580
1581 if (!l4)
1582 return 0;
1583
1584 memset(&expr, 0, sizeof(expr));
1585 memset(&test, 0, sizeof(test));
1586
1587 expr.arg.str = arg_p[0].data.str.str;
1588 expr.arg_len = arg_p[0].data.str.len;
1589
1590 ret = acl_fetch_rdp_cookie(px, l4, NULL, ACL_DIR_REQ, &expr, &test);
Willy Tarreau664092c2011-12-16 19:11:42 +01001591 if (ret == 0 || (test.flags & ACL_TEST_F_MAY_CHANGE) || temp_pattern.data.str.len == 0)
Simon Hormanab814e02011-06-24 14:50:20 +09001592 return 0;
1593
Willy Tarreau664092c2011-12-16 19:11:42 +01001594 data->str = temp_pattern.data.str;
Simon Hormanab814e02011-06-24 14:50:20 +09001595 return 1;
1596}
1597
Willy Tarreaub6866442008-07-14 23:54:42 +02001598static struct cfg_kw_list cfg_kws = {{ },{
1599 { CFG_LISTEN, "tcp-request", tcp_parse_tcp_req },
Emeric Brun97679e72010-09-23 17:56:44 +02001600 { CFG_LISTEN, "tcp-response", tcp_parse_tcp_rep },
Willy Tarreaub6866442008-07-14 23:54:42 +02001601 { 0, NULL, NULL },
1602}};
1603
Willy Tarreau645513a2010-05-24 20:55:15 +02001604/* Note: must not be declared <const> as its list will be overwritten */
Willy Tarreaub6866442008-07-14 23:54:42 +02001605static struct acl_kw_list acl_kws = {{ },{
Willy Tarreau645513a2010-05-24 20:55:15 +02001606 { "src_port", acl_parse_int, acl_fetch_sport, acl_match_int, ACL_USE_TCP_PERMANENT },
1607 { "src", acl_parse_ip, acl_fetch_src, acl_match_ip, ACL_USE_TCP4_PERMANENT|ACL_MAY_LOOKUP },
1608 { "dst", acl_parse_ip, acl_fetch_dst, acl_match_ip, ACL_USE_TCP4_PERMANENT|ACL_MAY_LOOKUP },
1609 { "dst_port", acl_parse_int, acl_fetch_dport, acl_match_int, ACL_USE_TCP_PERMANENT },
Willy Tarreaub6866442008-07-14 23:54:42 +02001610 { NULL, NULL, NULL, NULL },
1611}};
1612
Willy Tarreau645513a2010-05-24 20:55:15 +02001613/* Note: must not be declared <const> as its list will be overwritten */
1614static struct pattern_fetch_kw_list pattern_fetch_keywords = {{ },{
Emericf2d7cae2010-11-05 18:13:50 +01001615 { "src", pattern_fetch_src, NULL, PATTERN_TYPE_IP, PATTERN_FETCH_REQ },
David du Colombier4f92d322011-03-24 11:09:31 +01001616 { "src6", pattern_fetch_src6, NULL, PATTERN_TYPE_IPV6, PATTERN_FETCH_REQ },
Emericf2d7cae2010-11-05 18:13:50 +01001617 { "dst", pattern_fetch_dst, NULL, PATTERN_TYPE_IP, PATTERN_FETCH_REQ },
David du Colombier4f92d322011-03-24 11:09:31 +01001618 { "dst6", pattern_fetch_dst6, NULL, PATTERN_TYPE_IPV6, PATTERN_FETCH_REQ },
Emericf2d7cae2010-11-05 18:13:50 +01001619 { "dst_port", pattern_fetch_dport, NULL, PATTERN_TYPE_INTEGER, PATTERN_FETCH_REQ },
1620 { "payload", pattern_fetch_payload, pattern_arg_fetch_payload, PATTERN_TYPE_CONSTDATA, PATTERN_FETCH_REQ|PATTERN_FETCH_RTR },
1621 { "payload_lv", pattern_fetch_payloadlv, pattern_arg_fetch_payloadlv, PATTERN_TYPE_CONSTDATA, PATTERN_FETCH_REQ|PATTERN_FETCH_RTR },
Simon Hormanab814e02011-06-24 14:50:20 +09001622 { "rdp_cookie", pattern_fetch_rdp_cookie, pattern_arg_str, PATTERN_TYPE_CONSTSTRING, PATTERN_FETCH_REQ },
Emeric Brun485479d2010-09-23 18:02:19 +02001623 { NULL, NULL, NULL, 0, 0 },
Willy Tarreau645513a2010-05-24 20:55:15 +02001624}};
1625
Willy Tarreaue6b98942007-10-29 01:09:36 +01001626__attribute__((constructor))
1627static void __tcp_protocol_init(void)
1628{
1629 protocol_register(&proto_tcpv4);
1630 protocol_register(&proto_tcpv6);
Willy Tarreau645513a2010-05-24 20:55:15 +02001631 pattern_register_fetches(&pattern_fetch_keywords);
Willy Tarreaub6866442008-07-14 23:54:42 +02001632 cfg_register_keywords(&cfg_kws);
1633 acl_register_keywords(&acl_kws);
Willy Tarreaue6b98942007-10-29 01:09:36 +01001634}
1635
1636
1637/*
1638 * Local variables:
1639 * c-indent-level: 8
1640 * c-basic-offset: 8
1641 * End:
1642 */