blob: ff094c13b09ed2857e7de722492e1c9df9ab2885 [file] [log] [blame]
Willy Tarreaue6b98942007-10-29 01:09:36 +01001/*
2 * AF_INET/AF_INET6 SOCK_STREAM protocol layer (tcp)
3 *
Willy Tarreau1a687942010-05-23 22:40:30 +02004 * Copyright 2000-2010 Willy Tarreau <w@1wt.eu>
Willy Tarreaue6b98942007-10-29 01:09:36 +01005 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
13#include <ctype.h>
14#include <errno.h>
15#include <fcntl.h>
16#include <stdio.h>
17#include <stdlib.h>
18#include <string.h>
19#include <time.h>
20
21#include <sys/param.h>
22#include <sys/socket.h>
23#include <sys/stat.h>
24#include <sys/types.h>
25#include <sys/un.h>
26
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +040027#include <netinet/tcp.h>
28
Willy Tarreaub6866442008-07-14 23:54:42 +020029#include <common/cfgparse.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010030#include <common/compat.h>
31#include <common/config.h>
32#include <common/debug.h>
33#include <common/errors.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010034#include <common/mini-clist.h>
35#include <common/standard.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010036
Willy Tarreaue6b98942007-10-29 01:09:36 +010037#include <types/global.h>
Willy Tarreau9650f372009-08-16 14:02:45 +020038#include <types/server.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010039
40#include <proto/acl.h>
Willy Tarreau9fcb9842012-04-20 14:45:49 +020041#include <proto/arg.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010042#include <proto/buffers.h>
Willy Tarreau03fa5df2010-05-24 21:02:37 +020043#include <proto/frontend.h>
Willy Tarreau9650f372009-08-16 14:02:45 +020044#include <proto/log.h>
Willy Tarreau645513a2010-05-24 20:55:15 +020045#include <proto/pattern.h>
Willy Tarreau9650f372009-08-16 14:02:45 +020046#include <proto/port_range.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010047#include <proto/protocols.h>
48#include <proto/proto_tcp.h>
Willy Tarreaub6866442008-07-14 23:54:42 +020049#include <proto/proxy.h>
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +020050#include <proto/session.h>
Willy Tarreaua975b8f2010-06-05 19:13:27 +020051#include <proto/stick_table.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010052#include <proto/stream_sock.h>
Willy Tarreaua975b8f2010-06-05 19:13:27 +020053#include <proto/task.h>
Emeric Brun97679e72010-09-23 17:56:44 +020054#include <proto/buffers.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010055
Willy Tarreaue8c66af2008-01-13 18:40:14 +010056#ifdef CONFIG_HAP_CTTPROXY
57#include <import/ip_tproxy.h>
58#endif
59
Emeric Bruncf20bf12010-10-22 16:06:11 +020060static int tcp_bind_listeners(struct protocol *proto, char *errmsg, int errlen);
61static int tcp_bind_listener(struct listener *listener, char *errmsg, int errlen);
Willy Tarreaue6b98942007-10-29 01:09:36 +010062
63/* Note: must not be declared <const> as its list will be overwritten */
64static struct protocol proto_tcpv4 = {
65 .name = "tcpv4",
66 .sock_domain = AF_INET,
67 .sock_type = SOCK_STREAM,
68 .sock_prot = IPPROTO_TCP,
69 .sock_family = AF_INET,
70 .sock_addrlen = sizeof(struct sockaddr_in),
71 .l3_addrlen = 32/8,
Willy Tarreaueb472682010-05-28 18:46:57 +020072 .accept = &stream_sock_accept,
Willy Tarreaue6b98942007-10-29 01:09:36 +010073 .read = &stream_sock_read,
74 .write = &stream_sock_write,
Emeric Bruncf20bf12010-10-22 16:06:11 +020075 .bind = tcp_bind_listener,
Willy Tarreaue6b98942007-10-29 01:09:36 +010076 .bind_all = tcp_bind_listeners,
77 .unbind_all = unbind_all_listeners,
78 .enable_all = enable_all_listeners,
79 .listeners = LIST_HEAD_INIT(proto_tcpv4.listeners),
80 .nb_listeners = 0,
81};
82
83/* Note: must not be declared <const> as its list will be overwritten */
84static struct protocol proto_tcpv6 = {
85 .name = "tcpv6",
86 .sock_domain = AF_INET6,
87 .sock_type = SOCK_STREAM,
88 .sock_prot = IPPROTO_TCP,
89 .sock_family = AF_INET6,
90 .sock_addrlen = sizeof(struct sockaddr_in6),
91 .l3_addrlen = 128/8,
Willy Tarreaueb472682010-05-28 18:46:57 +020092 .accept = &stream_sock_accept,
Willy Tarreaue6b98942007-10-29 01:09:36 +010093 .read = &stream_sock_read,
94 .write = &stream_sock_write,
Emeric Bruncf20bf12010-10-22 16:06:11 +020095 .bind = tcp_bind_listener,
Willy Tarreaue6b98942007-10-29 01:09:36 +010096 .bind_all = tcp_bind_listeners,
97 .unbind_all = unbind_all_listeners,
98 .enable_all = enable_all_listeners,
99 .listeners = LIST_HEAD_INIT(proto_tcpv6.listeners),
100 .nb_listeners = 0,
101};
102
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100103
David du Colombier6f5ccb12011-03-10 22:26:24 +0100104/* Binds ipv4/ipv6 address <local> to socket <fd>, unless <flags> is set, in which
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100105 * case we try to bind <remote>. <flags> is a 2-bit field consisting of :
106 * - 0 : ignore remote address (may even be a NULL pointer)
107 * - 1 : use provided address
108 * - 2 : use provided port
109 * - 3 : use both
110 *
111 * The function supports multiple foreign binding methods :
112 * - linux_tproxy: we directly bind to the foreign address
113 * - cttproxy: we bind to a local address then nat.
114 * The second one can be used as a fallback for the first one.
115 * This function returns 0 when everything's OK, 1 if it could not bind, to the
116 * local address, 2 if it could not bind to the foreign address.
117 */
David du Colombier6f5ccb12011-03-10 22:26:24 +0100118int tcp_bind_socket(int fd, int flags, struct sockaddr_storage *local, struct sockaddr_storage *remote)
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100119{
David du Colombier6f5ccb12011-03-10 22:26:24 +0100120 struct sockaddr_storage bind_addr;
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100121 int foreign_ok = 0;
122 int ret;
123
124#ifdef CONFIG_HAP_LINUX_TPROXY
125 static int ip_transp_working = 1;
126 if (flags && ip_transp_working) {
Simon Hormande072bd2011-06-24 15:11:37 +0900127 if (setsockopt(fd, SOL_IP, IP_TRANSPARENT, &one, sizeof(one)) == 0
128 || setsockopt(fd, SOL_IP, IP_FREEBIND, &one, sizeof(one)) == 0)
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100129 foreign_ok = 1;
130 else
131 ip_transp_working = 0;
132 }
133#endif
134 if (flags) {
135 memset(&bind_addr, 0, sizeof(bind_addr));
Willy Tarreau96dd0792011-04-19 07:20:57 +0200136 bind_addr.ss_family = remote->ss_family;
David du Colombier6f5ccb12011-03-10 22:26:24 +0100137 switch (remote->ss_family) {
138 case AF_INET:
139 if (flags & 1)
140 ((struct sockaddr_in *)&bind_addr)->sin_addr = ((struct sockaddr_in *)remote)->sin_addr;
141 if (flags & 2)
142 ((struct sockaddr_in *)&bind_addr)->sin_port = ((struct sockaddr_in *)remote)->sin_port;
143 break;
144 case AF_INET6:
145 if (flags & 1)
146 ((struct sockaddr_in6 *)&bind_addr)->sin6_addr = ((struct sockaddr_in6 *)remote)->sin6_addr;
147 if (flags & 2)
148 ((struct sockaddr_in6 *)&bind_addr)->sin6_port = ((struct sockaddr_in6 *)remote)->sin6_port;
149 break;
Willy Tarreau5dc1e982011-12-16 21:25:11 +0100150 default:
151 /* we don't want to try to bind to an unknown address family */
152 foreign_ok = 0;
David du Colombier6f5ccb12011-03-10 22:26:24 +0100153 }
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100154 }
155
Simon Hormande072bd2011-06-24 15:11:37 +0900156 setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one));
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100157 if (foreign_ok) {
Willy Tarreau1b4b7ce2011-04-05 16:56:50 +0200158 ret = bind(fd, (struct sockaddr *)&bind_addr, get_addr_len(&bind_addr));
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100159 if (ret < 0)
160 return 2;
161 }
162 else {
Willy Tarreau1b4b7ce2011-04-05 16:56:50 +0200163 ret = bind(fd, (struct sockaddr *)local, get_addr_len(local));
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100164 if (ret < 0)
165 return 1;
166 }
167
168 if (!flags)
169 return 0;
170
171#ifdef CONFIG_HAP_CTTPROXY
Willy Tarreau6f831b42011-03-20 14:03:54 +0100172 if (!foreign_ok && remote->ss_family == AF_INET) {
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100173 struct in_tproxy itp1, itp2;
174 memset(&itp1, 0, sizeof(itp1));
175
176 itp1.op = TPROXY_ASSIGN;
Willy Tarreau6f831b42011-03-20 14:03:54 +0100177 itp1.v.addr.faddr = ((struct sockaddr_in *)&bind_addr)->sin_addr;
178 itp1.v.addr.fport = ((struct sockaddr_in *)&bind_addr)->sin_port;
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100179
180 /* set connect flag on socket */
181 itp2.op = TPROXY_FLAGS;
182 itp2.v.flags = ITP_CONNECT | ITP_ONCE;
183
184 if (setsockopt(fd, SOL_IP, IP_TPROXY, &itp1, sizeof(itp1)) != -1 &&
185 setsockopt(fd, SOL_IP, IP_TPROXY, &itp2, sizeof(itp2)) != -1) {
186 foreign_ok = 1;
187 }
188 }
189#endif
190 if (!foreign_ok)
191 /* we could not bind to a foreign address */
192 return 2;
193
194 return 0;
195}
Willy Tarreaue6b98942007-10-29 01:09:36 +0100196
Willy Tarreau9650f372009-08-16 14:02:45 +0200197
198/*
Willy Tarreauac825402011-03-04 22:04:29 +0100199 * This function initiates a connection to the target assigned to this session
Willy Tarreau6471afb2011-09-23 10:54:59 +0200200 * (si->{target,addr.to}). A source address may be pointed to by si->addr.from
Willy Tarreauac825402011-03-04 22:04:29 +0100201 * in case of transparent proxying. Normal source bind addresses are still
202 * determined locally (due to the possible need of a source port).
203 * si->target may point either to a valid server or to a backend, depending
204 * on si->target.type. Only TARG_TYPE_PROXY and TARG_TYPE_SERVER are supported.
Willy Tarreaub1d67742010-03-29 19:36:59 +0200205 *
Willy Tarreau9650f372009-08-16 14:02:45 +0200206 * It can return one of :
207 * - SN_ERR_NONE if everything's OK
208 * - SN_ERR_SRVTO if there are no more servers
209 * - SN_ERR_SRVCL if the connection was refused by the server
210 * - SN_ERR_PRXCOND if the connection has been limited by the proxy (maxconn)
211 * - SN_ERR_RESOURCE if a system resource is lacking (eg: fd limits, ports, ...)
212 * - SN_ERR_INTERNAL for any other purely internal errors
213 * Additionnally, in the case of SN_ERR_RESOURCE, an emergency log will be emitted.
214 */
Willy Tarreauf1536862011-03-03 18:27:32 +0100215
David du Colombier6f5ccb12011-03-10 22:26:24 +0100216int tcp_connect_server(struct stream_interface *si)
Willy Tarreau9650f372009-08-16 14:02:45 +0200217{
218 int fd;
Willy Tarreauac825402011-03-04 22:04:29 +0100219 struct server *srv;
220 struct proxy *be;
221
222 switch (si->target.type) {
223 case TARG_TYPE_PROXY:
224 be = si->target.ptr.p;
225 srv = NULL;
226 break;
227 case TARG_TYPE_SERVER:
228 srv = si->target.ptr.s;
229 be = srv->proxy;
230 break;
231 default:
232 return SN_ERR_INTERNAL;
233 }
Willy Tarreau9650f372009-08-16 14:02:45 +0200234
Willy Tarreau6471afb2011-09-23 10:54:59 +0200235 if ((fd = si->fd = socket(si->addr.to.ss_family, SOCK_STREAM, IPPROTO_TCP)) == -1) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200236 qfprintf(stderr, "Cannot get a server socket.\n");
237
238 if (errno == ENFILE)
239 send_log(be, LOG_EMERG,
240 "Proxy %s reached system FD limit at %d. Please check system tunables.\n",
241 be->id, maxfd);
242 else if (errno == EMFILE)
243 send_log(be, LOG_EMERG,
244 "Proxy %s reached process FD limit at %d. Please check 'ulimit-n' and restart.\n",
245 be->id, maxfd);
246 else if (errno == ENOBUFS || errno == ENOMEM)
247 send_log(be, LOG_EMERG,
248 "Proxy %s reached system memory limit at %d sockets. Please check system tunables.\n",
249 be->id, maxfd);
250 /* this is a resource error */
251 return SN_ERR_RESOURCE;
252 }
253
254 if (fd >= global.maxsock) {
255 /* do not log anything there, it's a normal condition when this option
256 * is used to serialize connections to a server !
257 */
258 Alert("socket(): not enough free sockets. Raise -n argument. Giving up.\n");
259 close(fd);
260 return SN_ERR_PRXCOND; /* it is a configuration limit */
261 }
262
263 if ((fcntl(fd, F_SETFL, O_NONBLOCK)==-1) ||
Simon Hormande072bd2011-06-24 15:11:37 +0900264 (setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &one, sizeof(one)) == -1)) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200265 qfprintf(stderr,"Cannot set client socket to non blocking mode.\n");
266 close(fd);
267 return SN_ERR_INTERNAL;
268 }
269
270 if (be->options & PR_O_TCP_SRV_KA)
Simon Hormande072bd2011-06-24 15:11:37 +0900271 setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, &one, sizeof(one));
Willy Tarreau9650f372009-08-16 14:02:45 +0200272
273 if (be->options & PR_O_TCP_NOLING)
Willy Tarreauf6f82252011-11-30 18:02:24 +0100274 si->flags |= SI_FL_NOLINGER;
Willy Tarreau9650f372009-08-16 14:02:45 +0200275
276 /* allow specific binding :
277 * - server-specific at first
278 * - proxy-specific next
279 */
280 if (srv != NULL && srv->state & SRV_BIND_SRC) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200281 int ret, flags = 0;
282
Willy Tarreau9650f372009-08-16 14:02:45 +0200283 switch (srv->state & SRV_TPROXY_MASK) {
284 case SRV_TPROXY_ADDR:
Willy Tarreau9650f372009-08-16 14:02:45 +0200285 case SRV_TPROXY_CLI:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200286 flags = 3;
287 break;
Willy Tarreau9650f372009-08-16 14:02:45 +0200288 case SRV_TPROXY_CIP:
Willy Tarreau090466c2009-09-07 11:51:47 +0200289 case SRV_TPROXY_DYN:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200290 flags = 1;
Willy Tarreau9650f372009-08-16 14:02:45 +0200291 break;
292 }
Willy Tarreaub1d67742010-03-29 19:36:59 +0200293
Willy Tarreau9650f372009-08-16 14:02:45 +0200294#ifdef SO_BINDTODEVICE
295 /* Note: this might fail if not CAP_NET_RAW */
296 if (srv->iface_name)
297 setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, srv->iface_name, srv->iface_len + 1);
298#endif
299
300 if (srv->sport_range) {
301 int attempts = 10; /* should be more than enough to find a spare port */
David du Colombier6f5ccb12011-03-10 22:26:24 +0100302 struct sockaddr_storage src;
Willy Tarreau9650f372009-08-16 14:02:45 +0200303
304 ret = 1;
305 src = srv->source_addr;
306
307 do {
308 /* note: in case of retry, we may have to release a previously
309 * allocated port, hence this loop's construct.
310 */
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200311 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
312 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200313
314 if (!attempts)
315 break;
316 attempts--;
317
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200318 fdinfo[fd].local_port = port_range_alloc_port(srv->sport_range);
319 if (!fdinfo[fd].local_port)
Willy Tarreau9650f372009-08-16 14:02:45 +0200320 break;
321
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200322 fdinfo[fd].port_range = srv->sport_range;
Willy Tarreau86ad42c2011-08-27 12:29:07 +0200323 set_host_port(&src, fdinfo[fd].local_port);
Willy Tarreau9650f372009-08-16 14:02:45 +0200324
Willy Tarreau6471afb2011-09-23 10:54:59 +0200325 ret = tcp_bind_socket(fd, flags, &src, &si->addr.from);
Willy Tarreau9650f372009-08-16 14:02:45 +0200326 } while (ret != 0); /* binding NOK */
327 }
328 else {
Willy Tarreau6471afb2011-09-23 10:54:59 +0200329 ret = tcp_bind_socket(fd, flags, &srv->source_addr, &si->addr.from);
Willy Tarreau9650f372009-08-16 14:02:45 +0200330 }
331
332 if (ret) {
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200333 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
334 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200335 close(fd);
336
337 if (ret == 1) {
338 Alert("Cannot bind to source address before connect() for server %s/%s. Aborting.\n",
339 be->id, srv->id);
340 send_log(be, LOG_EMERG,
341 "Cannot bind to source address before connect() for server %s/%s.\n",
342 be->id, srv->id);
343 } else {
344 Alert("Cannot bind to tproxy source address before connect() for server %s/%s. Aborting.\n",
345 be->id, srv->id);
346 send_log(be, LOG_EMERG,
347 "Cannot bind to tproxy source address before connect() for server %s/%s.\n",
348 be->id, srv->id);
349 }
350 return SN_ERR_RESOURCE;
351 }
352 }
353 else if (be->options & PR_O_BIND_SRC) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200354 int ret, flags = 0;
355
Willy Tarreau9650f372009-08-16 14:02:45 +0200356 switch (be->options & PR_O_TPXY_MASK) {
357 case PR_O_TPXY_ADDR:
Willy Tarreau9650f372009-08-16 14:02:45 +0200358 case PR_O_TPXY_CLI:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200359 flags = 3;
360 break;
Willy Tarreau9650f372009-08-16 14:02:45 +0200361 case PR_O_TPXY_CIP:
Willy Tarreau090466c2009-09-07 11:51:47 +0200362 case PR_O_TPXY_DYN:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200363 flags = 1;
Willy Tarreau9650f372009-08-16 14:02:45 +0200364 break;
365 }
Willy Tarreaub1d67742010-03-29 19:36:59 +0200366
Willy Tarreau9650f372009-08-16 14:02:45 +0200367#ifdef SO_BINDTODEVICE
368 /* Note: this might fail if not CAP_NET_RAW */
369 if (be->iface_name)
370 setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, be->iface_name, be->iface_len + 1);
371#endif
Willy Tarreau6471afb2011-09-23 10:54:59 +0200372 ret = tcp_bind_socket(fd, flags, &be->source_addr, &si->addr.from);
Willy Tarreau9650f372009-08-16 14:02:45 +0200373 if (ret) {
374 close(fd);
375 if (ret == 1) {
376 Alert("Cannot bind to source address before connect() for proxy %s. Aborting.\n",
377 be->id);
378 send_log(be, LOG_EMERG,
379 "Cannot bind to source address before connect() for proxy %s.\n",
380 be->id);
381 } else {
382 Alert("Cannot bind to tproxy source address before connect() for proxy %s. Aborting.\n",
383 be->id);
384 send_log(be, LOG_EMERG,
385 "Cannot bind to tproxy source address before connect() for proxy %s.\n",
386 be->id);
387 }
388 return SN_ERR_RESOURCE;
389 }
390 }
391
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400392#if defined(TCP_QUICKACK)
Willy Tarreau9650f372009-08-16 14:02:45 +0200393 /* disabling tcp quick ack now allows the first request to leave the
394 * machine with the first ACK. We only do this if there are pending
395 * data in the buffer.
396 */
Willy Tarreau2e046c62012-03-01 16:08:30 +0100397 if ((be->options2 & PR_O2_SMARTCON) && si->ob->o)
Simon Hormande072bd2011-06-24 15:11:37 +0900398 setsockopt(fd, IPPROTO_TCP, TCP_QUICKACK, &zero, sizeof(zero));
Willy Tarreau9650f372009-08-16 14:02:45 +0200399#endif
400
Willy Tarreaue803de22010-01-21 17:43:04 +0100401 if (global.tune.server_sndbuf)
402 setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &global.tune.server_sndbuf, sizeof(global.tune.server_sndbuf));
403
404 if (global.tune.server_rcvbuf)
405 setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &global.tune.server_rcvbuf, sizeof(global.tune.server_rcvbuf));
406
Willy Tarreau9b061e32012-04-07 18:03:52 +0200407 si->flags &= ~SI_FL_FROM_SET;
Willy Tarreau6471afb2011-09-23 10:54:59 +0200408 if ((connect(fd, (struct sockaddr *)&si->addr.to, get_addr_len(&si->addr.to)) == -1) &&
Willy Tarreau9650f372009-08-16 14:02:45 +0200409 (errno != EINPROGRESS) && (errno != EALREADY) && (errno != EISCONN)) {
410
411 if (errno == EAGAIN || errno == EADDRINUSE) {
412 char *msg;
413 if (errno == EAGAIN) /* no free ports left, try again later */
414 msg = "no free ports";
415 else
416 msg = "local address already in use";
417
418 qfprintf(stderr,"Cannot connect: %s.\n",msg);
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200419 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
420 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200421 close(fd);
422 send_log(be, LOG_EMERG,
423 "Connect() failed for server %s/%s: %s.\n",
424 be->id, srv->id, msg);
425 return SN_ERR_RESOURCE;
426 } else if (errno == ETIMEDOUT) {
427 //qfprintf(stderr,"Connect(): ETIMEDOUT");
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200428 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
429 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200430 close(fd);
431 return SN_ERR_SRVTO;
432 } else {
433 // (errno == ECONNREFUSED || errno == ENETUNREACH || errno == EACCES || errno == EPERM)
434 //qfprintf(stderr,"Connect(): %d", errno);
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200435 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
436 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200437 close(fd);
438 return SN_ERR_SRVCL;
439 }
440 }
441
William Lallemandb7ff6a32012-03-02 14:35:21 +0100442 /* needs src ip/port for logging */
Willy Tarreau9b061e32012-04-07 18:03:52 +0200443 if (si->flags & SI_FL_SRC_ADDR)
444 stream_sock_get_from_addr(si);
William Lallemandb7ff6a32012-03-02 14:35:21 +0100445
Willy Tarreau9650f372009-08-16 14:02:45 +0200446 fdtab[fd].owner = si;
447 fdtab[fd].state = FD_STCONN; /* connection in progress */
448 fdtab[fd].flags = FD_FL_TCP | FD_FL_TCP_NODELAY;
449 fdtab[fd].cb[DIR_RD].f = &stream_sock_read;
450 fdtab[fd].cb[DIR_RD].b = si->ib;
451 fdtab[fd].cb[DIR_WR].f = &stream_sock_write;
452 fdtab[fd].cb[DIR_WR].b = si->ob;
453
Willy Tarreau6471afb2011-09-23 10:54:59 +0200454 fdinfo[fd].peeraddr = (struct sockaddr *)&si->addr.to;
455 fdinfo[fd].peerlen = get_addr_len(&si->addr.to);
Willy Tarreau9650f372009-08-16 14:02:45 +0200456
457 fd_insert(fd);
458 EV_FD_SET(fd, DIR_WR); /* for connect status */
459
460 si->state = SI_ST_CON;
461 si->flags |= SI_FL_CAP_SPLTCP; /* TCP supports splicing */
462 si->exp = tick_add_ifset(now_ms, be->timeout.connect);
463
464 return SN_ERR_NONE; /* connection is OK */
465}
466
467
Willy Tarreaue6b98942007-10-29 01:09:36 +0100468/* This function tries to bind a TCPv4/v6 listener. It may return a warning or
469 * an error message in <err> if the message is at most <errlen> bytes long
470 * (including '\0'). The return value is composed from ERR_ABORT, ERR_WARN,
471 * ERR_ALERT, ERR_RETRYABLE and ERR_FATAL. ERR_NONE indicates that everything
472 * was alright and that no message was returned. ERR_RETRYABLE means that an
473 * error occurred but that it may vanish after a retry (eg: port in use), and
Aman Guptad94991d2012-04-06 17:39:26 -0700474 * ERR_FATAL indicates a non-fixable error. ERR_WARN and ERR_ALERT do not alter
Willy Tarreaue6b98942007-10-29 01:09:36 +0100475 * the meaning of the error, but just indicate that a message is present which
476 * should be displayed with the respective level. Last, ERR_ABORT indicates
477 * that it's pointless to try to start other listeners. No error message is
478 * returned if errlen is NULL.
479 */
480int tcp_bind_listener(struct listener *listener, char *errmsg, int errlen)
481{
482 __label__ tcp_return, tcp_close_return;
483 int fd, err;
484 const char *msg = NULL;
485
486 /* ensure we never return garbage */
487 if (errmsg && errlen)
488 *errmsg = 0;
489
490 if (listener->state != LI_ASSIGNED)
491 return ERR_NONE; /* already bound */
492
493 err = ERR_NONE;
494
495 if ((fd = socket(listener->addr.ss_family, SOCK_STREAM, IPPROTO_TCP)) == -1) {
496 err |= ERR_RETRYABLE | ERR_ALERT;
497 msg = "cannot create listening socket";
498 goto tcp_return;
499 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100500
Willy Tarreaue6b98942007-10-29 01:09:36 +0100501 if (fd >= global.maxsock) {
502 err |= ERR_FATAL | ERR_ABORT | ERR_ALERT;
503 msg = "not enough free sockets (raise '-n' parameter)";
504 goto tcp_close_return;
505 }
506
Willy Tarreaufb14edc2009-06-14 15:24:37 +0200507 if (fcntl(fd, F_SETFL, O_NONBLOCK) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100508 err |= ERR_FATAL | ERR_ALERT;
509 msg = "cannot make socket non-blocking";
510 goto tcp_close_return;
511 }
512
Simon Hormande072bd2011-06-24 15:11:37 +0900513 if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100514 /* not fatal but should be reported */
515 msg = "cannot do so_reuseaddr";
516 err |= ERR_ALERT;
517 }
518
519 if (listener->options & LI_O_NOLINGER)
Simon Hormande072bd2011-06-24 15:11:37 +0900520 setsockopt(fd, SOL_SOCKET, SO_LINGER, &nolinger, sizeof(struct linger));
Willy Tarreauedcf6682008-11-30 23:15:34 +0100521
Willy Tarreaue6b98942007-10-29 01:09:36 +0100522#ifdef SO_REUSEPORT
523 /* OpenBSD supports this. As it's present in old libc versions of Linux,
524 * it might return an error that we will silently ignore.
525 */
Simon Hormande072bd2011-06-24 15:11:37 +0900526 setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &one, sizeof(one));
Willy Tarreaue6b98942007-10-29 01:09:36 +0100527#endif
Willy Tarreaub1e52e82008-01-13 14:49:51 +0100528#ifdef CONFIG_HAP_LINUX_TPROXY
Willy Tarreauedcf6682008-11-30 23:15:34 +0100529 if ((listener->options & LI_O_FOREIGN)
Simon Hormande072bd2011-06-24 15:11:37 +0900530 && (setsockopt(fd, SOL_IP, IP_TRANSPARENT, &one, sizeof(one)) == -1)
531 && (setsockopt(fd, SOL_IP, IP_FREEBIND, &one, sizeof(one)) == -1)) {
Willy Tarreaub1e52e82008-01-13 14:49:51 +0100532 msg = "cannot make listening socket transparent";
533 err |= ERR_ALERT;
534 }
535#endif
Willy Tarreau5e6e2042009-02-04 17:19:29 +0100536#ifdef SO_BINDTODEVICE
537 /* Note: this might fail if not CAP_NET_RAW */
538 if (listener->interface) {
539 if (setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE,
Willy Tarreau604e8302009-03-06 00:48:23 +0100540 listener->interface, strlen(listener->interface) + 1) == -1) {
Willy Tarreau5e6e2042009-02-04 17:19:29 +0100541 msg = "cannot bind listener to device";
542 err |= ERR_WARN;
543 }
544 }
545#endif
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400546#if defined(TCP_MAXSEG)
Willy Tarreau48a7e722010-12-24 15:26:39 +0100547 if (listener->maxseg > 0) {
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400548 if (setsockopt(fd, IPPROTO_TCP, TCP_MAXSEG,
Willy Tarreaube1b9182009-06-14 18:48:19 +0200549 &listener->maxseg, sizeof(listener->maxseg)) == -1) {
550 msg = "cannot set MSS";
551 err |= ERR_WARN;
552 }
553 }
554#endif
Willy Tarreaucb6cd432009-10-13 07:34:14 +0200555#if defined(TCP_DEFER_ACCEPT)
556 if (listener->options & LI_O_DEF_ACCEPT) {
557 /* defer accept by up to one second */
558 int accept_delay = 1;
559 if (setsockopt(fd, IPPROTO_TCP, TCP_DEFER_ACCEPT, &accept_delay, sizeof(accept_delay)) == -1) {
560 msg = "cannot enable DEFER_ACCEPT";
561 err |= ERR_WARN;
562 }
563 }
564#endif
Willy Tarreaue6b98942007-10-29 01:09:36 +0100565 if (bind(fd, (struct sockaddr *)&listener->addr, listener->proto->sock_addrlen) == -1) {
566 err |= ERR_RETRYABLE | ERR_ALERT;
567 msg = "cannot bind socket";
568 goto tcp_close_return;
569 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100570
Willy Tarreauc73ce2b2008-01-06 10:55:10 +0100571 if (listen(fd, listener->backlog ? listener->backlog : listener->maxconn) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100572 err |= ERR_RETRYABLE | ERR_ALERT;
573 msg = "cannot listen to socket";
574 goto tcp_close_return;
575 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100576
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400577#if defined(TCP_QUICKACK)
Willy Tarreau9ea05a72009-06-14 12:07:01 +0200578 if (listener->options & LI_O_NOQUICKACK)
Simon Hormande072bd2011-06-24 15:11:37 +0900579 setsockopt(fd, IPPROTO_TCP, TCP_QUICKACK, &zero, sizeof(zero));
Willy Tarreau9ea05a72009-06-14 12:07:01 +0200580#endif
581
Willy Tarreaue6b98942007-10-29 01:09:36 +0100582 /* the socket is ready */
583 listener->fd = fd;
584 listener->state = LI_LISTEN;
585
Willy Tarreaueabf3132008-08-29 23:36:51 +0200586 fdtab[fd].owner = listener; /* reference the listener instead of a task */
Willy Tarreaue6b98942007-10-29 01:09:36 +0100587 fdtab[fd].state = FD_STLISTEN;
Willy Tarreaueb472682010-05-28 18:46:57 +0200588 fdtab[fd].flags = FD_FL_TCP | ((listener->options & LI_O_NOLINGER) ? FD_FL_TCP_NOLING : 0);
589 fdtab[fd].cb[DIR_RD].f = listener->proto->accept;
590 fdtab[fd].cb[DIR_WR].f = NULL; /* never called */
591 fdtab[fd].cb[DIR_RD].b = fdtab[fd].cb[DIR_WR].b = NULL;
Willy Tarreau5d707e12009-06-28 11:09:07 +0200592
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200593 fdinfo[fd].peeraddr = NULL;
594 fdinfo[fd].peerlen = 0;
Willy Tarreaueb472682010-05-28 18:46:57 +0200595 fd_insert(fd);
596
Willy Tarreaue6b98942007-10-29 01:09:36 +0100597 tcp_return:
Cyril Bonté43ba1b32010-11-01 19:26:01 +0100598 if (msg && errlen) {
599 char pn[INET6_ADDRSTRLEN];
600
Willy Tarreau631f01c2011-09-05 00:36:48 +0200601 addr_to_str(&listener->addr, pn, sizeof(pn));
602 snprintf(errmsg, errlen, "%s [%s:%d]", msg, pn, get_host_port(&listener->addr));
Cyril Bonté43ba1b32010-11-01 19:26:01 +0100603 }
Willy Tarreaue6b98942007-10-29 01:09:36 +0100604 return err;
605
606 tcp_close_return:
607 close(fd);
608 goto tcp_return;
609}
610
611/* This function creates all TCP sockets bound to the protocol entry <proto>.
612 * It is intended to be used as the protocol's bind_all() function.
613 * The sockets will be registered but not added to any fd_set, in order not to
614 * loose them across the fork(). A call to enable_all_listeners() is needed
615 * to complete initialization. The return value is composed from ERR_*.
616 */
Emeric Bruncf20bf12010-10-22 16:06:11 +0200617static int tcp_bind_listeners(struct protocol *proto, char *errmsg, int errlen)
Willy Tarreaue6b98942007-10-29 01:09:36 +0100618{
619 struct listener *listener;
620 int err = ERR_NONE;
621
622 list_for_each_entry(listener, &proto->listeners, proto_list) {
Emeric Bruncf20bf12010-10-22 16:06:11 +0200623 err |= tcp_bind_listener(listener, errmsg, errlen);
624 if (err & ERR_ABORT)
Willy Tarreaue6b98942007-10-29 01:09:36 +0100625 break;
626 }
627
628 return err;
629}
630
631/* Add listener to the list of tcpv4 listeners. The listener's state
632 * is automatically updated from LI_INIT to LI_ASSIGNED. The number of
633 * listeners is updated. This is the function to use to add a new listener.
634 */
635void tcpv4_add_listener(struct listener *listener)
636{
637 if (listener->state != LI_INIT)
638 return;
639 listener->state = LI_ASSIGNED;
640 listener->proto = &proto_tcpv4;
641 LIST_ADDQ(&proto_tcpv4.listeners, &listener->proto_list);
642 proto_tcpv4.nb_listeners++;
643}
644
645/* Add listener to the list of tcpv4 listeners. The listener's state
646 * is automatically updated from LI_INIT to LI_ASSIGNED. The number of
647 * listeners is updated. This is the function to use to add a new listener.
648 */
649void tcpv6_add_listener(struct listener *listener)
650{
651 if (listener->state != LI_INIT)
652 return;
653 listener->state = LI_ASSIGNED;
654 listener->proto = &proto_tcpv6;
655 LIST_ADDQ(&proto_tcpv6.listeners, &listener->proto_list);
656 proto_tcpv6.nb_listeners++;
657}
658
Willy Tarreauedcf6682008-11-30 23:15:34 +0100659/* This function performs the TCP request analysis on the current request. It
660 * returns 1 if the processing can continue on next analysers, or zero if it
661 * needs more data, encounters an error, or wants to immediately abort the
Willy Tarreaufb356202010-08-03 14:02:05 +0200662 * request. It relies on buffers flags, and updates s->req->analysers. The
663 * function may be called for frontend rules and backend rules. It only relies
664 * on the backend pointer so this works for both cases.
Willy Tarreauedcf6682008-11-30 23:15:34 +0100665 */
Willy Tarreau3a816292009-07-07 10:55:49 +0200666int tcp_inspect_request(struct session *s, struct buffer *req, int an_bit)
Willy Tarreauedcf6682008-11-30 23:15:34 +0100667{
668 struct tcp_rule *rule;
Willy Tarreaud1f96522010-08-03 19:34:32 +0200669 struct stksess *ts;
670 struct stktable *t;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100671 int partial;
672
Willy Tarreau02d6cfc2012-03-01 18:19:58 +0100673 DPRINTF(stderr,"[%u] %s: session=%p b=%p, exp(r,w)=%u,%u bf=%08x bh=%d analysers=%02x\n",
Willy Tarreauedcf6682008-11-30 23:15:34 +0100674 now_ms, __FUNCTION__,
675 s,
676 req,
677 req->rex, req->wex,
678 req->flags,
Willy Tarreau02d6cfc2012-03-01 18:19:58 +0100679 req->i,
Willy Tarreauedcf6682008-11-30 23:15:34 +0100680 req->analysers);
681
Willy Tarreauedcf6682008-11-30 23:15:34 +0100682 /* We don't know whether we have enough data, so must proceed
683 * this way :
684 * - iterate through all rules in their declaration order
685 * - if one rule returns MISS, it means the inspect delay is
686 * not over yet, then return immediately, otherwise consider
687 * it as a non-match.
688 * - if one rule returns OK, then return OK
689 * - if one rule returns KO, then return KO
690 */
691
Willy Tarreaub824b002010-09-29 16:36:16 +0200692 if (req->flags & (BF_SHUTR|BF_FULL) || !s->be->tcp_req.inspect_delay || tick_is_expired(req->analyse_exp, now_ms))
Willy Tarreauedcf6682008-11-30 23:15:34 +0100693 partial = 0;
694 else
695 partial = ACL_PARTIAL;
696
Willy Tarreaufb356202010-08-03 14:02:05 +0200697 list_for_each_entry(rule, &s->be->tcp_req.inspect_rules, list) {
Willy Tarreauedcf6682008-11-30 23:15:34 +0100698 int ret = ACL_PAT_PASS;
699
700 if (rule->cond) {
Willy Tarreaufb356202010-08-03 14:02:05 +0200701 ret = acl_exec_cond(rule->cond, s->be, s, &s->txn, ACL_DIR_REQ | partial);
Willy Tarreauedcf6682008-11-30 23:15:34 +0100702 if (ret == ACL_PAT_MISS) {
Willy Tarreau520d95e2009-09-19 21:04:57 +0200703 buffer_dont_connect(req);
Willy Tarreauedcf6682008-11-30 23:15:34 +0100704 /* just set the request timeout once at the beginning of the request */
Willy Tarreaufb356202010-08-03 14:02:05 +0200705 if (!tick_isset(req->analyse_exp) && s->be->tcp_req.inspect_delay)
706 req->analyse_exp = tick_add_ifset(now_ms, s->be->tcp_req.inspect_delay);
Willy Tarreauedcf6682008-11-30 23:15:34 +0100707 return 0;
708 }
709
710 ret = acl_pass(ret);
711 if (rule->cond->pol == ACL_COND_UNLESS)
712 ret = !ret;
713 }
714
715 if (ret) {
716 /* we have a matching rule. */
717 if (rule->action == TCP_ACT_REJECT) {
718 buffer_abort(req);
719 buffer_abort(s->rep);
720 req->analysers = 0;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +0200721
Willy Tarreau7d0aaf32011-03-10 23:25:56 +0100722 s->be->be_counters.denied_req++;
723 s->fe->fe_counters.denied_req++;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +0200724 if (s->listener->counters)
Willy Tarreau23968d82010-05-23 23:50:44 +0200725 s->listener->counters->denied_req++;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +0200726
Willy Tarreauedcf6682008-11-30 23:15:34 +0100727 if (!(s->flags & SN_ERR_MASK))
728 s->flags |= SN_ERR_PRXCOND;
729 if (!(s->flags & SN_FINST_MASK))
730 s->flags |= SN_FINST_R;
731 return 0;
732 }
Willy Tarreau56123282010-08-06 19:06:56 +0200733 else if (rule->action == TCP_ACT_TRK_SC1) {
734 if (!s->stkctr1_entry) {
735 /* only the first valid track-sc1 directive applies.
Willy Tarreaud1f96522010-08-03 19:34:32 +0200736 * Also, note that right now we can only track SRC so we
737 * don't check how to get the key, but later we may need
738 * to consider rule->act_prm->trk_ctr.type.
739 */
740 t = rule->act_prm.trk_ctr.table.t;
David du Colombier4f92d322011-03-24 11:09:31 +0100741 ts = stktable_get_entry(t, tcp_src_to_stktable_key(s));
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200742 if (ts) {
Willy Tarreau56123282010-08-06 19:06:56 +0200743 session_track_stkctr1(s, t, ts);
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200744 if (s->fe != s->be)
745 s->flags |= SN_BE_TRACK_SC1;
746 }
Willy Tarreaud1f96522010-08-03 19:34:32 +0200747 }
748 }
Willy Tarreau56123282010-08-06 19:06:56 +0200749 else if (rule->action == TCP_ACT_TRK_SC2) {
750 if (!s->stkctr2_entry) {
751 /* only the first valid track-sc2 directive applies.
Willy Tarreaud1f96522010-08-03 19:34:32 +0200752 * Also, note that right now we can only track SRC so we
753 * don't check how to get the key, but later we may need
754 * to consider rule->act_prm->trk_ctr.type.
755 */
756 t = rule->act_prm.trk_ctr.table.t;
David du Colombier4f92d322011-03-24 11:09:31 +0100757 ts = stktable_get_entry(t, tcp_src_to_stktable_key(s));
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200758 if (ts) {
Willy Tarreau56123282010-08-06 19:06:56 +0200759 session_track_stkctr2(s, t, ts);
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200760 if (s->fe != s->be)
761 s->flags |= SN_BE_TRACK_SC2;
762 }
Willy Tarreaud1f96522010-08-03 19:34:32 +0200763 }
764 }
765 else {
Willy Tarreauedcf6682008-11-30 23:15:34 +0100766 /* otherwise accept */
Willy Tarreaud1f96522010-08-03 19:34:32 +0200767 break;
768 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100769 }
770 }
771
772 /* if we get there, it means we have no rule which matches, or
773 * we have an explicit accept, so we apply the default accept.
774 */
Willy Tarreau3a816292009-07-07 10:55:49 +0200775 req->analysers &= ~an_bit;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100776 req->analyse_exp = TICK_ETERNITY;
777 return 1;
778}
779
Emeric Brun97679e72010-09-23 17:56:44 +0200780/* This function performs the TCP response analysis on the current response. It
781 * returns 1 if the processing can continue on next analysers, or zero if it
782 * needs more data, encounters an error, or wants to immediately abort the
783 * response. It relies on buffers flags, and updates s->rep->analysers. The
784 * function may be called for backend rules.
785 */
786int tcp_inspect_response(struct session *s, struct buffer *rep, int an_bit)
787{
788 struct tcp_rule *rule;
789 int partial;
790
Willy Tarreau02d6cfc2012-03-01 18:19:58 +0100791 DPRINTF(stderr,"[%u] %s: session=%p b=%p, exp(r,w)=%u,%u bf=%08x bh=%d analysers=%02x\n",
Emeric Brun97679e72010-09-23 17:56:44 +0200792 now_ms, __FUNCTION__,
793 s,
794 rep,
795 rep->rex, rep->wex,
796 rep->flags,
Willy Tarreau02d6cfc2012-03-01 18:19:58 +0100797 rep->i,
Emeric Brun97679e72010-09-23 17:56:44 +0200798 rep->analysers);
799
800 /* We don't know whether we have enough data, so must proceed
801 * this way :
802 * - iterate through all rules in their declaration order
803 * - if one rule returns MISS, it means the inspect delay is
804 * not over yet, then return immediately, otherwise consider
805 * it as a non-match.
806 * - if one rule returns OK, then return OK
807 * - if one rule returns KO, then return KO
808 */
809
810 if (rep->flags & BF_SHUTR || tick_is_expired(rep->analyse_exp, now_ms))
811 partial = 0;
812 else
813 partial = ACL_PARTIAL;
814
815 list_for_each_entry(rule, &s->be->tcp_rep.inspect_rules, list) {
816 int ret = ACL_PAT_PASS;
817
818 if (rule->cond) {
819 ret = acl_exec_cond(rule->cond, s->be, s, &s->txn, ACL_DIR_RTR | partial);
820 if (ret == ACL_PAT_MISS) {
821 /* just set the analyser timeout once at the beginning of the response */
822 if (!tick_isset(rep->analyse_exp) && s->be->tcp_rep.inspect_delay)
823 rep->analyse_exp = tick_add_ifset(now_ms, s->be->tcp_rep.inspect_delay);
824 return 0;
825 }
826
827 ret = acl_pass(ret);
828 if (rule->cond->pol == ACL_COND_UNLESS)
829 ret = !ret;
830 }
831
832 if (ret) {
833 /* we have a matching rule. */
834 if (rule->action == TCP_ACT_REJECT) {
835 buffer_abort(rep);
836 buffer_abort(s->req);
837 rep->analysers = 0;
838
Willy Tarreau7d0aaf32011-03-10 23:25:56 +0100839 s->be->be_counters.denied_resp++;
840 s->fe->fe_counters.denied_resp++;
Emeric Brun97679e72010-09-23 17:56:44 +0200841 if (s->listener->counters)
842 s->listener->counters->denied_resp++;
843
844 if (!(s->flags & SN_ERR_MASK))
845 s->flags |= SN_ERR_PRXCOND;
846 if (!(s->flags & SN_FINST_MASK))
847 s->flags |= SN_FINST_D;
848 return 0;
849 }
850 else {
851 /* otherwise accept */
852 break;
853 }
854 }
855 }
856
857 /* if we get there, it means we have no rule which matches, or
858 * we have an explicit accept, so we apply the default accept.
859 */
860 rep->analysers &= ~an_bit;
861 rep->analyse_exp = TICK_ETERNITY;
862 return 1;
863}
864
865
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200866/* This function performs the TCP layer4 analysis on the current request. It
867 * returns 0 if a reject rule matches, otherwise 1 if either an accept rule
868 * matches or if no more rule matches. It can only use rules which don't need
869 * any data.
870 */
871int tcp_exec_req_rules(struct session *s)
872{
873 struct tcp_rule *rule;
Willy Tarreauf059a0f2010-08-03 16:29:52 +0200874 struct stksess *ts;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200875 struct stktable *t = NULL;
876 int result = 1;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200877 int ret;
878
879 list_for_each_entry(rule, &s->fe->tcp_req.l4_rules, list) {
880 ret = ACL_PAT_PASS;
881
882 if (rule->cond) {
883 ret = acl_exec_cond(rule->cond, s->fe, s, NULL, ACL_DIR_REQ);
884 ret = acl_pass(ret);
885 if (rule->cond->pol == ACL_COND_UNLESS)
886 ret = !ret;
887 }
888
889 if (ret) {
890 /* we have a matching rule. */
891 if (rule->action == TCP_ACT_REJECT) {
Willy Tarreau7d0aaf32011-03-10 23:25:56 +0100892 s->fe->fe_counters.denied_conn++;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200893 if (s->listener->counters)
Willy Tarreau2799e982010-06-05 15:43:21 +0200894 s->listener->counters->denied_conn++;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200895
896 if (!(s->flags & SN_ERR_MASK))
897 s->flags |= SN_ERR_PRXCOND;
898 if (!(s->flags & SN_FINST_MASK))
899 s->flags |= SN_FINST_R;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200900 result = 0;
901 break;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200902 }
Willy Tarreau56123282010-08-06 19:06:56 +0200903 else if (rule->action == TCP_ACT_TRK_SC1) {
904 if (!s->stkctr1_entry) {
905 /* only the first valid track-sc1 directive applies.
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200906 * Also, note that right now we can only track SRC so we
907 * don't check how to get the key, but later we may need
908 * to consider rule->act_prm->trk_ctr.type.
909 */
910 t = rule->act_prm.trk_ctr.table.t;
David du Colombier4f92d322011-03-24 11:09:31 +0100911 ts = stktable_get_entry(t, tcp_src_to_stktable_key(s));
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200912 if (ts)
Willy Tarreau56123282010-08-06 19:06:56 +0200913 session_track_stkctr1(s, t, ts);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200914 }
915 }
Willy Tarreau56123282010-08-06 19:06:56 +0200916 else if (rule->action == TCP_ACT_TRK_SC2) {
917 if (!s->stkctr2_entry) {
918 /* only the first valid track-sc2 directive applies.
Willy Tarreauf059a0f2010-08-03 16:29:52 +0200919 * Also, note that right now we can only track SRC so we
920 * don't check how to get the key, but later we may need
921 * to consider rule->act_prm->trk_ctr.type.
922 */
923 t = rule->act_prm.trk_ctr.table.t;
David du Colombier4f92d322011-03-24 11:09:31 +0100924 ts = stktable_get_entry(t, tcp_src_to_stktable_key(s));
Willy Tarreauf059a0f2010-08-03 16:29:52 +0200925 if (ts)
Willy Tarreau56123282010-08-06 19:06:56 +0200926 session_track_stkctr2(s, t, ts);
Willy Tarreauf059a0f2010-08-03 16:29:52 +0200927 }
928 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200929 else {
930 /* otherwise it's an accept */
931 break;
932 }
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200933 }
934 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200935 return result;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200936}
937
Emeric Brun97679e72010-09-23 17:56:44 +0200938/* Parse a tcp-response rule. Return a negative value in case of failure */
939static int tcp_parse_response_rule(char **args, int arg, int section_type,
940 struct proxy *curpx, struct proxy *defpx,
941 struct tcp_rule *rule, char *err, int errlen)
942{
943 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
944 snprintf(err, errlen, "%s %s is only allowed in 'backend' sections",
945 args[0], args[1]);
946 return -1;
947 }
948
949 if (strcmp(args[arg], "accept") == 0) {
950 arg++;
951 rule->action = TCP_ACT_ACCEPT;
952 }
953 else if (strcmp(args[arg], "reject") == 0) {
954 arg++;
955 rule->action = TCP_ACT_REJECT;
956 }
957 else {
958 snprintf(err, errlen,
959 "'%s %s' expects 'accept' or 'reject' in %s '%s' (was '%s')",
960 args[0], args[1], proxy_type_str(curpx), curpx->id, args[arg]);
961 return -1;
962 }
963
964 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
965 if ((rule->cond = build_acl_cond(NULL, 0, curpx, (const char **)args+arg)) == NULL) {
966 snprintf(err, errlen,
967 "error detected in %s '%s' while parsing '%s' condition",
968 proxy_type_str(curpx), curpx->id, args[arg]);
969 return -1;
970 }
971 }
972 else if (*args[arg]) {
973 snprintf(err, errlen,
974 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (was '%s')",
975 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
976 return -1;
977 }
978 return 0;
979}
980
981
982
Willy Tarreau68c03ab2010-08-06 15:08:45 +0200983/* Parse a tcp-request rule. Return a negative value in case of failure */
984static int tcp_parse_request_rule(char **args, int arg, int section_type,
985 struct proxy *curpx, struct proxy *defpx,
986 struct tcp_rule *rule, char *err, int errlen)
987{
988 if (curpx == defpx) {
989 snprintf(err, errlen, "%s %s is not allowed in 'defaults' sections",
990 args[0], args[1]);
991 return -1;
992 }
993
994 if (!strcmp(args[arg], "accept")) {
995 arg++;
996 rule->action = TCP_ACT_ACCEPT;
997 }
998 else if (!strcmp(args[arg], "reject")) {
999 arg++;
1000 rule->action = TCP_ACT_REJECT;
1001 }
Willy Tarreau56123282010-08-06 19:06:56 +02001002 else if (strcmp(args[arg], "track-sc1") == 0) {
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001003 int ret;
1004
1005 arg++;
1006 ret = parse_track_counters(args, &arg, section_type, curpx,
1007 &rule->act_prm.trk_ctr, defpx, err, errlen);
1008
1009 if (ret < 0) /* nb: warnings are not handled yet */
1010 return -1;
1011
Willy Tarreau56123282010-08-06 19:06:56 +02001012 rule->action = TCP_ACT_TRK_SC1;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001013 }
Willy Tarreau56123282010-08-06 19:06:56 +02001014 else if (strcmp(args[arg], "track-sc2") == 0) {
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001015 int ret;
1016
1017 arg++;
1018 ret = parse_track_counters(args, &arg, section_type, curpx,
1019 &rule->act_prm.trk_ctr, defpx, err, errlen);
1020
1021 if (ret < 0) /* nb: warnings are not handled yet */
1022 return -1;
1023
Willy Tarreau56123282010-08-06 19:06:56 +02001024 rule->action = TCP_ACT_TRK_SC2;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001025 }
1026 else {
1027 snprintf(err, errlen,
Willy Tarreau56123282010-08-06 19:06:56 +02001028 "'%s %s' expects 'accept', 'reject', 'track-sc1' "
1029 "or 'track-sc2' in %s '%s' (was '%s')",
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001030 args[0], args[1], proxy_type_str(curpx), curpx->id, args[arg]);
1031 return -1;
1032 }
1033
1034 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
1035 if ((rule->cond = build_acl_cond(NULL, 0, curpx, (const char **)args+arg)) == NULL) {
1036 snprintf(err, errlen,
1037 "error detected in %s '%s' while parsing '%s' condition",
1038 proxy_type_str(curpx), curpx->id, args[arg]);
1039 return -1;
1040 }
1041 }
1042 else if (*args[arg]) {
1043 snprintf(err, errlen,
1044 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (was '%s')",
1045 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
1046 return -1;
1047 }
1048 return 0;
1049}
1050
Emeric Brun97679e72010-09-23 17:56:44 +02001051/* This function should be called to parse a line starting with the "tcp-response"
1052 * keyword.
1053 */
1054static int tcp_parse_tcp_rep(char **args, int section_type, struct proxy *curpx,
1055 struct proxy *defpx, char *err, int errlen)
1056{
1057 const char *ptr = NULL;
1058 unsigned int val;
1059 int retlen;
1060 int warn = 0;
1061 int arg;
1062 struct tcp_rule *rule;
1063
1064 if (!*args[1]) {
1065 snprintf(err, errlen, "missing argument for '%s' in %s '%s'",
1066 args[0], proxy_type_str(curpx), curpx->id);
1067 return -1;
1068 }
1069
1070 if (strcmp(args[1], "inspect-delay") == 0) {
1071 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
1072 snprintf(err, errlen, "%s %s is only allowed in 'backend' sections",
1073 args[0], args[1]);
1074 return -1;
1075 }
1076
1077 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
1078 retlen = snprintf(err, errlen,
1079 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
1080 args[0], args[1], proxy_type_str(curpx), curpx->id);
1081 if (ptr && retlen < errlen)
1082 retlen += snprintf(err + retlen, errlen - retlen,
1083 " (unexpected character '%c')", *ptr);
1084 return -1;
1085 }
1086
1087 if (curpx->tcp_rep.inspect_delay) {
1088 snprintf(err, errlen, "ignoring %s %s (was already defined) in %s '%s'",
1089 args[0], args[1], proxy_type_str(curpx), curpx->id);
1090 return 1;
1091 }
1092 curpx->tcp_rep.inspect_delay = val;
1093 return 0;
1094 }
1095
Simon Hormande072bd2011-06-24 15:11:37 +09001096 rule = calloc(1, sizeof(*rule));
Emeric Brun97679e72010-09-23 17:56:44 +02001097 LIST_INIT(&rule->list);
1098 arg = 1;
1099
1100 if (strcmp(args[1], "content") == 0) {
1101 arg++;
1102 if (tcp_parse_response_rule(args, arg, section_type, curpx, defpx, rule, err, errlen) < 0)
1103 goto error;
1104
1105 if (rule->cond && (rule->cond->requires & ACL_USE_L6REQ_VOLATILE)) {
1106 struct acl *acl;
1107 const char *name;
1108
1109 acl = cond_find_require(rule->cond, ACL_USE_L6REQ_VOLATILE);
1110 name = acl ? acl->name : "(unknown)";
1111
1112 retlen = snprintf(err, errlen,
1113 "acl '%s' involves some request-only criteria which will be ignored.",
1114 name);
1115 warn++;
1116 }
1117
1118 LIST_ADDQ(&curpx->tcp_rep.inspect_rules, &rule->list);
1119 }
1120 else {
1121 retlen = snprintf(err, errlen,
1122 "'%s' expects 'inspect-delay' or 'content' in %s '%s' (was '%s')",
1123 args[0], proxy_type_str(curpx), curpx->id, args[1]);
1124 goto error;
1125 }
1126
1127 return warn;
1128 error:
1129 free(rule);
1130 return -1;
1131}
1132
1133
Willy Tarreaub6866442008-07-14 23:54:42 +02001134/* This function should be called to parse a line starting with the "tcp-request"
1135 * keyword.
1136 */
1137static int tcp_parse_tcp_req(char **args, int section_type, struct proxy *curpx,
1138 struct proxy *defpx, char *err, int errlen)
1139{
1140 const char *ptr = NULL;
Willy Tarreauc7e961e2008-08-17 17:13:47 +02001141 unsigned int val;
Willy Tarreaub6866442008-07-14 23:54:42 +02001142 int retlen;
Willy Tarreau1a687942010-05-23 22:40:30 +02001143 int warn = 0;
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001144 int arg;
Willy Tarreau1a687942010-05-23 22:40:30 +02001145 struct tcp_rule *rule;
Willy Tarreaub6866442008-07-14 23:54:42 +02001146
1147 if (!*args[1]) {
1148 snprintf(err, errlen, "missing argument for '%s' in %s '%s'",
Willy Tarreauf5356832010-06-14 18:40:26 +02001149 args[0], proxy_type_str(curpx), curpx->id);
Willy Tarreaub6866442008-07-14 23:54:42 +02001150 return -1;
1151 }
1152
1153 if (!strcmp(args[1], "inspect-delay")) {
1154 if (curpx == defpx) {
1155 snprintf(err, errlen, "%s %s is not allowed in 'defaults' sections",
1156 args[0], args[1]);
1157 return -1;
1158 }
1159
Willy Tarreaub6866442008-07-14 23:54:42 +02001160 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
1161 retlen = snprintf(err, errlen,
1162 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
Willy Tarreauf5356832010-06-14 18:40:26 +02001163 args[0], args[1], proxy_type_str(curpx), curpx->id);
Willy Tarreaub6866442008-07-14 23:54:42 +02001164 if (ptr && retlen < errlen)
1165 retlen += snprintf(err+retlen, errlen - retlen,
1166 " (unexpected character '%c')", *ptr);
1167 return -1;
1168 }
1169
1170 if (curpx->tcp_req.inspect_delay) {
1171 snprintf(err, errlen, "ignoring %s %s (was already defined) in %s '%s'",
Willy Tarreauf5356832010-06-14 18:40:26 +02001172 args[0], args[1], proxy_type_str(curpx), curpx->id);
Willy Tarreaub6866442008-07-14 23:54:42 +02001173 return 1;
1174 }
1175 curpx->tcp_req.inspect_delay = val;
1176 return 0;
1177 }
1178
Simon Hormande072bd2011-06-24 15:11:37 +09001179 rule = calloc(1, sizeof(*rule));
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001180 LIST_INIT(&rule->list);
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001181 arg = 1;
1182
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001183 if (strcmp(args[1], "content") == 0) {
Willy Tarreaud1f96522010-08-03 19:34:32 +02001184 arg++;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001185 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, errlen) < 0)
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001186 goto error;
Willy Tarreaub6866442008-07-14 23:54:42 +02001187
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001188 if (rule->cond && (rule->cond->requires & ACL_USE_RTR_ANY)) {
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001189 struct acl *acl;
1190 const char *name;
1191
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001192 acl = cond_find_require(rule->cond, ACL_USE_RTR_ANY);
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001193 name = acl ? acl->name : "(unknown)";
1194
1195 retlen = snprintf(err, errlen,
Willy Tarreau1a211942009-07-14 13:53:17 +02001196 "acl '%s' involves some response-only criteria which will be ignored.",
1197 name);
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001198 warn++;
1199 }
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001200 LIST_ADDQ(&curpx->tcp_req.inspect_rules, &rule->list);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001201 }
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001202 else if (strcmp(args[1], "connection") == 0) {
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001203 arg++;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001204
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001205 if (!(curpx->cap & PR_CAP_FE)) {
1206 snprintf(err, errlen, "%s %s is not allowed because %s %s is not a frontend",
1207 args[0], args[1], proxy_type_str(curpx), curpx->id);
Simon Horman6c54d8b2011-07-15 13:14:06 +09001208 goto error;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001209 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001210
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001211 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, errlen) < 0)
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001212 goto error;
1213
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001214 if (rule->cond && (rule->cond->requires & (ACL_USE_RTR_ANY|ACL_USE_L6_ANY|ACL_USE_L7_ANY))) {
1215 struct acl *acl;
1216 const char *name;
Willy Tarreauf059a0f2010-08-03 16:29:52 +02001217
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001218 acl = cond_find_require(rule->cond, ACL_USE_RTR_ANY|ACL_USE_L6_ANY|ACL_USE_L7_ANY);
1219 name = acl ? acl->name : "(unknown)";
Willy Tarreauf059a0f2010-08-03 16:29:52 +02001220
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001221 if (acl->requires & (ACL_USE_L6_ANY|ACL_USE_L7_ANY)) {
1222 retlen = snprintf(err, errlen,
1223 "'%s %s' may not reference acl '%s' which makes use of "
1224 "payload in %s '%s'. Please use '%s content' for this.",
1225 args[0], args[1], name, proxy_type_str(curpx), curpx->id, args[0]);
1226 goto error;
1227 }
1228 if (acl->requires & ACL_USE_RTR_ANY)
1229 retlen = snprintf(err, errlen,
1230 "acl '%s' involves some response-only criteria which will be ignored.",
1231 name);
1232 warn++;
1233 }
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001234 LIST_ADDQ(&curpx->tcp_req.l4_rules, &rule->list);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001235 }
Willy Tarreau1a687942010-05-23 22:40:30 +02001236 else {
1237 retlen = snprintf(err, errlen,
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001238 "'%s' expects 'inspect-delay', 'connection', or 'content' in %s '%s' (was '%s')",
Willy Tarreau1a687942010-05-23 22:40:30 +02001239 args[0], proxy_type_str(curpx), curpx->id, args[1]);
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001240 goto error;
Willy Tarreau1a687942010-05-23 22:40:30 +02001241 }
1242
Willy Tarreau1a687942010-05-23 22:40:30 +02001243 return warn;
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001244 error:
1245 free(rule);
1246 return -1;
Willy Tarreaub6866442008-07-14 23:54:42 +02001247}
1248
Willy Tarreau645513a2010-05-24 20:55:15 +02001249
1250/************************************************************************/
Willy Tarreau32389b72012-04-23 23:13:20 +02001251/* All supported sample fetch functios must be declared here */
1252/************************************************************************/
1253
1254/* Fetch the request RDP cookie identified in the args, or any cookie if no arg
1255 * is passed. It is usable both for ACL and for patterns. Note: this decoder
1256 * only works with non-wrapping data. Accepts either 0 or 1 argument. Argument
1257 * is a string (cookie name), other types will lead to undefined behaviour.
1258 */
1259int
1260smp_fetch_rdp_cookie(struct proxy *px, struct session *l4, void *l7, int dir,
1261 const struct arg *args, struct sample *smp)
1262{
1263 int bleft;
1264 const unsigned char *data;
1265
1266 if (!l4 || !l4->req)
1267 return 0;
1268
1269 smp->flags = 0;
1270 smp->type = SMP_T_CSTR;
1271
1272 bleft = l4->req->i;
1273 if (bleft <= 11)
1274 goto too_short;
1275
1276 data = (const unsigned char *)l4->req->p + 11;
1277 bleft -= 11;
1278
1279 if (bleft <= 7)
1280 goto too_short;
1281
1282 if (strncasecmp((const char *)data, "Cookie:", 7) != 0)
1283 goto not_cookie;
1284
1285 data += 7;
1286 bleft -= 7;
1287
1288 while (bleft > 0 && *data == ' ') {
1289 data++;
1290 bleft--;
1291 }
1292
1293 if (args) {
1294
1295 if (bleft <= args->data.str.len)
1296 goto too_short;
1297
1298 if ((data[args->data.str.len] != '=') ||
1299 strncasecmp(args->data.str.str, (const char *)data, args->data.str.len) != 0)
1300 goto not_cookie;
1301
1302 data += args->data.str.len + 1;
1303 bleft -= args->data.str.len + 1;
1304 } else {
1305 while (bleft > 0 && *data != '=') {
1306 if (*data == '\r' || *data == '\n')
1307 goto not_cookie;
1308 data++;
1309 bleft--;
1310 }
1311
1312 if (bleft < 1)
1313 goto too_short;
1314
1315 if (*data != '=')
1316 goto not_cookie;
1317
1318 data++;
1319 bleft--;
1320 }
1321
1322 /* data points to cookie value */
1323 smp->data.str.str = (char *)data;
1324 smp->data.str.len = 0;
1325
1326 while (bleft > 0 && *data != '\r') {
1327 data++;
1328 bleft--;
1329 }
1330
1331 if (bleft < 2)
1332 goto too_short;
1333
1334 if (data[0] != '\r' || data[1] != '\n')
1335 goto not_cookie;
1336
1337 smp->data.str.len = (char *)data - smp->data.str.str;
1338 smp->flags = SMP_F_VOLATILE;
1339 return 1;
1340
1341 too_short:
1342 smp->flags = SMP_F_MAY_CHANGE;
1343 not_cookie:
1344 return 0;
1345}
1346
1347static int
1348pattern_fetch_rdp_cookie(struct proxy *px, struct session *l4, void *l7, int dir,
1349 const struct arg *arg_p, struct sample *smp)
1350{
1351 int ret;
1352
1353 /* sample type set by smp_fetch_rdp_cookie() */
1354 ret = smp_fetch_rdp_cookie(px, l4, NULL, ACL_DIR_REQ, arg_p, smp);
1355 if (ret == 0 || (smp->flags & SMP_F_MAY_CHANGE) || smp->data.str.len == 0)
1356 return 0;
1357 return 1;
1358}
1359
1360/************************************************************************/
Willy Tarreau645513a2010-05-24 20:55:15 +02001361/* All supported ACL keywords must be declared here. */
1362/************************************************************************/
1363
Willy Tarreau32389b72012-04-23 23:13:20 +02001364/* returns either 1 or 0 depending on whether an RDP cookie is found or not */
1365static int
1366acl_fetch_rdp_cookie_cnt(struct proxy *px, struct session *l4, void *l7, int dir,
Willy Tarreau24e32d82012-04-23 23:55:44 +02001367 const struct arg *args, struct sample *smp)
Willy Tarreau32389b72012-04-23 23:13:20 +02001368{
1369 int ret;
1370
Willy Tarreau24e32d82012-04-23 23:55:44 +02001371 ret = smp_fetch_rdp_cookie(px, l4, l7, dir, args, smp);
Willy Tarreau32389b72012-04-23 23:13:20 +02001372
1373 if (smp->flags & SMP_F_MAY_CHANGE)
1374 return 0;
1375
1376 smp->flags = SMP_F_VOLATILE;
1377 smp->type = SMP_T_UINT;
1378 smp->data.uint = ret;
1379 return 1;
1380}
1381
1382
Willy Tarreauf4362b32011-12-16 17:49:52 +01001383/* copy the source IPv4/v6 address into temp_pattern */
Willy Tarreau645513a2010-05-24 20:55:15 +02001384static int
1385acl_fetch_src(struct proxy *px, struct session *l4, void *l7, int dir,
Willy Tarreau24e32d82012-04-23 23:55:44 +02001386 const struct arg *args, struct sample *smp)
Willy Tarreau645513a2010-05-24 20:55:15 +02001387{
Willy Tarreauf4362b32011-12-16 17:49:52 +01001388 switch (l4->si[0].addr.from.ss_family) {
1389 case AF_INET:
Willy Tarreauf853c462012-04-23 18:53:56 +02001390 smp->data.ipv4 = ((struct sockaddr_in *)&l4->si[0].addr.from)->sin_addr;
1391 smp->type = SMP_T_IPV4;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001392 break;
1393 case AF_INET6:
Willy Tarreauf853c462012-04-23 18:53:56 +02001394 smp->data.ipv6 = ((struct sockaddr_in6 *)(&l4->si[0].addr.from))->sin6_addr;
1395 smp->type = SMP_T_IPV6;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001396 break;
1397 default:
Emeric Brunf769f512010-10-22 17:14:01 +02001398 return 0;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001399 }
Emeric Brunf769f512010-10-22 17:14:01 +02001400
Willy Tarreau37406352012-04-23 16:16:37 +02001401 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001402 return 1;
1403}
1404
David du Colombier4f92d322011-03-24 11:09:31 +01001405/* extract the connection's source ipv4 address */
Willy Tarreau645513a2010-05-24 20:55:15 +02001406static int
1407pattern_fetch_src(struct proxy *px, struct session *l4, void *l7, int dir,
Willy Tarreau342acb42012-04-23 22:03:39 +02001408 const struct arg *arg_p, struct sample *smp)
Willy Tarreau645513a2010-05-24 20:55:15 +02001409{
Willy Tarreau6471afb2011-09-23 10:54:59 +02001410 if (l4->si[0].addr.from.ss_family != AF_INET )
Emeric Brunf769f512010-10-22 17:14:01 +02001411 return 0;
1412
Willy Tarreaub8c8f1f2012-04-23 22:38:26 +02001413 smp->type = SMP_T_IPV4;
Willy Tarreau342acb42012-04-23 22:03:39 +02001414 smp->data.ipv4.s_addr = ((struct sockaddr_in *)&l4->si[0].addr.from)->sin_addr.s_addr;
Willy Tarreau645513a2010-05-24 20:55:15 +02001415 return 1;
1416}
1417
David du Colombier4f92d322011-03-24 11:09:31 +01001418/* extract the connection's source ipv6 address */
1419static int
1420pattern_fetch_src6(struct proxy *px, struct session *l4, void *l7, int dir,
Willy Tarreau342acb42012-04-23 22:03:39 +02001421 const struct arg *arg_p, struct sample *smp)
David du Colombier4f92d322011-03-24 11:09:31 +01001422{
Willy Tarreau6471afb2011-09-23 10:54:59 +02001423 if (l4->si[0].addr.from.ss_family != AF_INET6)
David du Colombier4f92d322011-03-24 11:09:31 +01001424 return 0;
1425
Willy Tarreaub8c8f1f2012-04-23 22:38:26 +02001426 smp->type = SMP_T_IPV6;
Willy Tarreau342acb42012-04-23 22:03:39 +02001427 memcpy(smp->data.ipv6.s6_addr, ((struct sockaddr_in6 *)&l4->si[0].addr.from)->sin6_addr.s6_addr, sizeof(smp->data.ipv6.s6_addr));
David du Colombier4f92d322011-03-24 11:09:31 +01001428 return 1;
1429}
Willy Tarreau645513a2010-05-24 20:55:15 +02001430
Willy Tarreaua5e37562011-12-16 17:06:15 +01001431/* set temp integer to the connection's source port */
Willy Tarreau645513a2010-05-24 20:55:15 +02001432static int
1433acl_fetch_sport(struct proxy *px, struct session *l4, void *l7, int dir,
Willy Tarreau24e32d82012-04-23 23:55:44 +02001434 const struct arg *args, struct sample *smp)
Willy Tarreau645513a2010-05-24 20:55:15 +02001435{
Willy Tarreauf853c462012-04-23 18:53:56 +02001436 smp->type = SMP_T_UINT;
1437 if (!(smp->data.uint = get_host_port(&l4->si[0].addr.from)))
Emeric Brunf769f512010-10-22 17:14:01 +02001438 return 0;
1439
Willy Tarreau37406352012-04-23 16:16:37 +02001440 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001441 return 1;
1442}
1443
1444
1445/* set test->ptr to point to the frontend's IPv4/IPv6 address and test->i to the family */
1446static int
1447acl_fetch_dst(struct proxy *px, struct session *l4, void *l7, int dir,
Willy Tarreau24e32d82012-04-23 23:55:44 +02001448 const struct arg *args, struct sample *smp)
Willy Tarreau645513a2010-05-24 20:55:15 +02001449{
Willy Tarreau9b061e32012-04-07 18:03:52 +02001450 stream_sock_get_to_addr(&l4->si[0]);
Willy Tarreau645513a2010-05-24 20:55:15 +02001451
Willy Tarreauf4362b32011-12-16 17:49:52 +01001452 switch (l4->si[0].addr.to.ss_family) {
1453 case AF_INET:
Willy Tarreauf853c462012-04-23 18:53:56 +02001454 smp->data.ipv4 = ((struct sockaddr_in *)&l4->si[0].addr.to)->sin_addr;
1455 smp->type = SMP_T_IPV4;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001456 break;
1457 case AF_INET6:
Willy Tarreauf853c462012-04-23 18:53:56 +02001458 smp->data.ipv6 = ((struct sockaddr_in6 *)(&l4->si[0].addr.to))->sin6_addr;
1459 smp->type = SMP_T_IPV6;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001460 break;
1461 default:
Emeric Brunf769f512010-10-22 17:14:01 +02001462 return 0;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001463 }
Emeric Brunf769f512010-10-22 17:14:01 +02001464
Willy Tarreau37406352012-04-23 16:16:37 +02001465 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001466 return 1;
1467}
1468
1469
David du Colombier4f92d322011-03-24 11:09:31 +01001470/* extract the connection's destination ipv4 address */
Willy Tarreau645513a2010-05-24 20:55:15 +02001471static int
1472pattern_fetch_dst(struct proxy *px, struct session *l4, void *l7, int dir,
Willy Tarreau342acb42012-04-23 22:03:39 +02001473 const struct arg *arg_p, struct sample *smp)
Willy Tarreau645513a2010-05-24 20:55:15 +02001474{
Willy Tarreau9b061e32012-04-07 18:03:52 +02001475 stream_sock_get_to_addr(&l4->si[0]);
emeric8aa6b372010-10-22 17:06:26 +02001476
Willy Tarreau6471afb2011-09-23 10:54:59 +02001477 if (l4->si[0].addr.to.ss_family != AF_INET)
Emeric Brunf769f512010-10-22 17:14:01 +02001478 return 0;
1479
Willy Tarreaub8c8f1f2012-04-23 22:38:26 +02001480 smp->type = SMP_T_IPV4;
Willy Tarreau342acb42012-04-23 22:03:39 +02001481 smp->data.ipv4.s_addr = ((struct sockaddr_in *)&l4->si[0].addr.to)->sin_addr.s_addr;
Willy Tarreau645513a2010-05-24 20:55:15 +02001482 return 1;
1483}
1484
David du Colombier4f92d322011-03-24 11:09:31 +01001485/* extract the connection's destination ipv6 address */
1486static int
1487pattern_fetch_dst6(struct proxy *px, struct session *l4, void *l7, int dir,
Willy Tarreau342acb42012-04-23 22:03:39 +02001488 const struct arg *arg_p, struct sample *smp)
David du Colombier4f92d322011-03-24 11:09:31 +01001489{
Willy Tarreau9b061e32012-04-07 18:03:52 +02001490 stream_sock_get_to_addr(&l4->si[0]);
David du Colombier4f92d322011-03-24 11:09:31 +01001491
Willy Tarreau6471afb2011-09-23 10:54:59 +02001492 if (l4->si[0].addr.to.ss_family != AF_INET6)
David du Colombier4f92d322011-03-24 11:09:31 +01001493 return 0;
1494
Willy Tarreaub8c8f1f2012-04-23 22:38:26 +02001495 smp->type = SMP_T_IPV6;
Willy Tarreau342acb42012-04-23 22:03:39 +02001496 memcpy(smp->data.ipv6.s6_addr, ((struct sockaddr_in6 *)&l4->si[0].addr.to)->sin6_addr.s6_addr, sizeof(smp->data.ipv6.s6_addr));
David du Colombier4f92d322011-03-24 11:09:31 +01001497 return 1;
1498}
1499
Willy Tarreaua5e37562011-12-16 17:06:15 +01001500/* set temp integer to the frontend connexion's destination port */
Willy Tarreau645513a2010-05-24 20:55:15 +02001501static int
1502acl_fetch_dport(struct proxy *px, struct session *l4, void *l7, int dir,
Willy Tarreau24e32d82012-04-23 23:55:44 +02001503 const struct arg *args, struct sample *smp)
Willy Tarreau645513a2010-05-24 20:55:15 +02001504{
Willy Tarreau9b061e32012-04-07 18:03:52 +02001505 stream_sock_get_to_addr(&l4->si[0]);
Willy Tarreau645513a2010-05-24 20:55:15 +02001506
Willy Tarreauf853c462012-04-23 18:53:56 +02001507 smp->type = SMP_T_UINT;
1508 if (!(smp->data.uint = get_host_port(&l4->si[0].addr.to)))
Emeric Brunf769f512010-10-22 17:14:01 +02001509 return 0;
1510
Willy Tarreau37406352012-04-23 16:16:37 +02001511 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001512 return 1;
1513}
1514
1515static int
1516pattern_fetch_dport(struct proxy *px, struct session *l4, void *l7, int dir,
Willy Tarreau342acb42012-04-23 22:03:39 +02001517 const struct arg *arg, struct sample *smp)
Willy Tarreau645513a2010-05-24 20:55:15 +02001518{
Willy Tarreaub8c8f1f2012-04-23 22:38:26 +02001519 smp->type = SMP_T_UINT;
Willy Tarreau9b061e32012-04-07 18:03:52 +02001520 stream_sock_get_to_addr(&l4->si[0]);
emeric8aa6b372010-10-22 17:06:26 +02001521
Willy Tarreau342acb42012-04-23 22:03:39 +02001522 if (!(smp->data.uint = get_host_port(&l4->si[0].addr.to)))
Emeric Brunf769f512010-10-22 17:14:01 +02001523 return 0;
1524
Willy Tarreau645513a2010-05-24 20:55:15 +02001525 return 1;
1526}
1527
Emericf2d7cae2010-11-05 18:13:50 +01001528static int
Emericf2d7cae2010-11-05 18:13:50 +01001529pattern_fetch_payloadlv(struct proxy *px, struct session *l4, void *l7, int dir,
Willy Tarreau342acb42012-04-23 22:03:39 +02001530 const struct arg *arg_p, struct sample *smp)
Emericf2d7cae2010-11-05 18:13:50 +01001531{
Willy Tarreauecfb8e82012-04-20 12:29:52 +02001532 int len_offset = arg_p[0].data.uint;
1533 int len_size = arg_p[1].data.uint;
1534 int buf_offset = arg_p[2].data.uint;
Emericf2d7cae2010-11-05 18:13:50 +01001535 int buf_size = 0;
1536 struct buffer *b;
1537 int i;
1538
1539 /* Format is (len offset, len size, buf offset) or (len offset, len size) */
1540 /* by default buf offset == len offset + len size */
1541 /* buf offset could be absolute or relative to len offset + len size if prefixed by + or - */
1542
1543 if (!l4)
1544 return 0;
1545
1546 b = (dir & PATTERN_FETCH_RTR) ? l4->rep : l4->req;
1547
Willy Tarreau02d6cfc2012-03-01 18:19:58 +01001548 if (!b || !b->i)
Emericf2d7cae2010-11-05 18:13:50 +01001549 return 0;
1550
Willy Tarreau02d6cfc2012-03-01 18:19:58 +01001551 if (len_offset + len_size > b->i)
Emericf2d7cae2010-11-05 18:13:50 +01001552 return 0;
1553
1554 for (i = 0; i < len_size; i++) {
Willy Tarreau89fa7062012-03-02 16:13:16 +01001555 buf_size = (buf_size << 8) + ((unsigned char *)b->p)[i + len_offset];
Emericf2d7cae2010-11-05 18:13:50 +01001556 }
1557
1558 if (!buf_size)
1559 return 0;
1560
Willy Tarreau9fcb9842012-04-20 14:45:49 +02001561 /* buf offset may be implicit, absolute or relative */
1562 buf_offset = len_offset + len_size;
1563 if (arg_p[2].type == ARGT_UINT)
1564 buf_offset = arg_p[2].data.uint;
1565 else if (arg_p[2].type == ARGT_SINT)
1566 buf_offset += arg_p[2].data.sint;
1567
Willy Tarreau02d6cfc2012-03-01 18:19:58 +01001568 if (buf_offset + buf_size > b->i)
Emericf2d7cae2010-11-05 18:13:50 +01001569 return 0;
1570
1571 /* init chunk as read only */
Willy Tarreaub8c8f1f2012-04-23 22:38:26 +02001572 smp->type = SMP_T_CBIN;
Willy Tarreau342acb42012-04-23 22:03:39 +02001573 chunk_initlen(&smp->data.str, b->p + buf_offset, 0, buf_size);
Emericf2d7cae2010-11-05 18:13:50 +01001574
1575 return 1;
1576}
1577
1578static int
Emericf2d7cae2010-11-05 18:13:50 +01001579pattern_fetch_payload(struct proxy *px, struct session *l4, void *l7, int dir,
Willy Tarreau342acb42012-04-23 22:03:39 +02001580 const struct arg *arg_p, struct sample *smp)
Emericf2d7cae2010-11-05 18:13:50 +01001581{
Willy Tarreauecfb8e82012-04-20 12:29:52 +02001582 int buf_offset = arg_p[0].data.uint;
1583 int buf_size = arg_p[1].data.uint;
Emericf2d7cae2010-11-05 18:13:50 +01001584 struct buffer *b;
1585
1586 if (!l4)
1587 return 0;
1588
1589 b = (dir & PATTERN_FETCH_RTR) ? l4->rep : l4->req;
1590
Willy Tarreau02d6cfc2012-03-01 18:19:58 +01001591 if (!b || !b->i)
Emericf2d7cae2010-11-05 18:13:50 +01001592 return 0;
1593
Willy Tarreau02d6cfc2012-03-01 18:19:58 +01001594 if (buf_offset + buf_size > b->i)
Emericf2d7cae2010-11-05 18:13:50 +01001595 return 0;
1596
1597 /* init chunk as read only */
Willy Tarreaub8c8f1f2012-04-23 22:38:26 +02001598 smp->type = SMP_T_CBIN;
Willy Tarreau342acb42012-04-23 22:03:39 +02001599 chunk_initlen(&smp->data.str, b->p + buf_offset, 0, buf_size);
Emericf2d7cae2010-11-05 18:13:50 +01001600
Simon Hormanab814e02011-06-24 14:50:20 +09001601 return 1;
1602}
1603
Willy Tarreau21d68a62012-04-20 15:52:36 +02001604/* This function is used to validate the arguments passed to a "payload" fetch
1605 * keyword. This keyword expects two positive integers, with the second one
1606 * being strictly positive. It is assumed that the types are already the correct
1607 * ones. Returns 0 on error, non-zero if OK. If <err_msg> is not NULL, it will be
1608 * filled with a pointer to an error message in case of error, that the caller
1609 * is responsible for freeing. The initial location must either be freeable or
1610 * NULL.
1611 */
1612static int val_payload(struct arg *arg, char **err_msg)
1613{
1614 if (!arg[1].data.uint) {
1615 if (err_msg)
1616 memprintf(err_msg, "payload length must be > 0");
1617 return 0;
1618 }
1619 return 1;
1620}
1621
1622/* This function is used to validate the arguments passed to a "payload_lv" fetch
1623 * keyword. This keyword allows two positive integers and an optional signed one,
1624 * with the second one being strictly positive and the third one being greater than
1625 * the opposite of the two others if negative. It is assumed that the types are
1626 * already the correct ones. Returns 0 on error, non-zero if OK. If <err_msg> is
1627 * not NULL, it will be filled with a pointer to an error message in case of
1628 * error, that the caller is responsible for freeing. The initial location must
1629 * either be freeable or NULL.
1630 */
1631static int val_payload_lv(struct arg *arg, char **err_msg)
1632{
1633 if (!arg[1].data.uint) {
1634 if (err_msg)
1635 memprintf(err_msg, "payload length must be > 0");
1636 return 0;
1637 }
1638
1639 if (arg[2].type == ARGT_SINT &&
1640 (int)(arg[0].data.uint + arg[1].data.uint + arg[2].data.sint) < 0) {
1641 if (err_msg)
1642 memprintf(err_msg, "payload offset too negative");
1643 return 0;
1644 }
1645 return 1;
1646}
1647
Willy Tarreaub6866442008-07-14 23:54:42 +02001648static struct cfg_kw_list cfg_kws = {{ },{
1649 { CFG_LISTEN, "tcp-request", tcp_parse_tcp_req },
Emeric Brun97679e72010-09-23 17:56:44 +02001650 { CFG_LISTEN, "tcp-response", tcp_parse_tcp_rep },
Willy Tarreaub6866442008-07-14 23:54:42 +02001651 { 0, NULL, NULL },
1652}};
1653
Willy Tarreau61612d42012-04-19 18:42:05 +02001654/* Note: must not be declared <const> as its list will be overwritten.
1655 * Please take care of keeping this list alphabetically sorted.
1656 */
Willy Tarreaub6866442008-07-14 23:54:42 +02001657static struct acl_kw_list acl_kws = {{ },{
Willy Tarreau61612d42012-04-19 18:42:05 +02001658 { "dst", acl_parse_ip, acl_fetch_dst, acl_match_ip, ACL_USE_TCP4_PERMANENT|ACL_MAY_LOOKUP, 0 },
1659 { "dst_port", acl_parse_int, acl_fetch_dport, acl_match_int, ACL_USE_TCP_PERMANENT, 0 },
Willy Tarreau9fb4bc72012-04-24 00:09:26 +02001660 { "req_rdp_cookie", acl_parse_str, smp_fetch_rdp_cookie, acl_match_str, ACL_USE_L6REQ_VOLATILE|ACL_MAY_LOOKUP, ARG1(0,STR) },
Willy Tarreau32389b72012-04-23 23:13:20 +02001661 { "req_rdp_cookie_cnt", acl_parse_int, acl_fetch_rdp_cookie_cnt, acl_match_int, ACL_USE_L6REQ_VOLATILE, ARG1(0,STR) },
Willy Tarreau61612d42012-04-19 18:42:05 +02001662 { "src", acl_parse_ip, acl_fetch_src, acl_match_ip, ACL_USE_TCP4_PERMANENT|ACL_MAY_LOOKUP, 0 },
1663 { "src_port", acl_parse_int, acl_fetch_sport, acl_match_int, ACL_USE_TCP_PERMANENT, 0 },
Willy Tarreaub6866442008-07-14 23:54:42 +02001664 { NULL, NULL, NULL, NULL },
1665}};
1666
Willy Tarreau645513a2010-05-24 20:55:15 +02001667/* Note: must not be declared <const> as its list will be overwritten */
1668static struct pattern_fetch_kw_list pattern_fetch_keywords = {{ },{
Willy Tarreau422aa072012-04-20 20:49:27 +02001669 { "src", pattern_fetch_src, 0, NULL, SMP_T_IPV4, PATTERN_FETCH_REQ },
1670 { "src6", pattern_fetch_src6, 0, NULL, SMP_T_IPV6, PATTERN_FETCH_REQ },
1671 { "dst", pattern_fetch_dst, 0, NULL, SMP_T_IPV4, PATTERN_FETCH_REQ },
1672 { "dst6", pattern_fetch_dst6, 0, NULL, SMP_T_IPV6, PATTERN_FETCH_REQ },
1673 { "dst_port", pattern_fetch_dport, 0, NULL, SMP_T_UINT, PATTERN_FETCH_REQ },
1674 { "payload", pattern_fetch_payload, ARG2(2,UINT,UINT), val_payload, SMP_T_CBIN, PATTERN_FETCH_REQ|PATTERN_FETCH_RTR },
1675 { "payload_lv", pattern_fetch_payloadlv, ARG3(2,UINT,UINT,SINT), val_payload_lv, SMP_T_CBIN, PATTERN_FETCH_REQ|PATTERN_FETCH_RTR },
1676 { "rdp_cookie", pattern_fetch_rdp_cookie, ARG1(1,STR), NULL, SMP_T_CSTR, PATTERN_FETCH_REQ },
Willy Tarreau9fcb9842012-04-20 14:45:49 +02001677 { NULL, NULL, 0, 0, 0 },
Willy Tarreau645513a2010-05-24 20:55:15 +02001678}};
1679
Willy Tarreaue6b98942007-10-29 01:09:36 +01001680__attribute__((constructor))
1681static void __tcp_protocol_init(void)
1682{
1683 protocol_register(&proto_tcpv4);
1684 protocol_register(&proto_tcpv6);
Willy Tarreau645513a2010-05-24 20:55:15 +02001685 pattern_register_fetches(&pattern_fetch_keywords);
Willy Tarreaub6866442008-07-14 23:54:42 +02001686 cfg_register_keywords(&cfg_kws);
1687 acl_register_keywords(&acl_kws);
Willy Tarreaue6b98942007-10-29 01:09:36 +01001688}
1689
1690
1691/*
1692 * Local variables:
1693 * c-indent-level: 8
1694 * c-basic-offset: 8
1695 * End:
1696 */