blob: b8413f33185f8e822a15ea7f0745da20d286b86f [file] [log] [blame]
Willy Tarreau79e57332018-10-02 16:01:16 +02001/*
2 * HTTP actions
3 *
4 * Copyright 2000-2018 Willy Tarreau <w@1wt.eu>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
13#include <sys/types.h>
14
15#include <ctype.h>
16#include <string.h>
17#include <time.h>
18
Willy Tarreaudcc048a2020-06-04 19:11:43 +020019#include <haproxy/acl.h>
Willy Tarreau122eba92020-06-04 10:15:32 +020020#include <haproxy/action.h>
Willy Tarreau4c7e4b72020-05-27 12:58:42 +020021#include <haproxy/api.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020022#include <haproxy/arg.h>
23#include <haproxy/capture-t.h>
Willy Tarreau6be78492020-06-05 00:00:29 +020024#include <haproxy/cfgparse.h>
Willy Tarreauc13ed532020-06-02 10:22:45 +020025#include <haproxy/chunk.h>
Willy Tarreauf268ee82020-06-04 17:05:57 +020026#include <haproxy/global.h>
Willy Tarreaucd72d8c2020-06-02 19:11:26 +020027#include <haproxy/http.h>
Willy Tarreauc2b1ff02020-06-04 21:21:03 +020028#include <haproxy/http_ana.h>
Willy Tarreau87735332020-06-04 09:08:41 +020029#include <haproxy/http_htx.h>
Willy Tarreauc761f842020-06-04 11:40:28 +020030#include <haproxy/http_rules.h>
Willy Tarreau36979d92020-06-05 17:27:29 +020031#include <haproxy/log.h>
Willy Tarreau225a90a2020-06-04 15:06:28 +020032#include <haproxy/pattern.h>
Willy Tarreaud0ef4392020-06-02 09:38:52 +020033#include <haproxy/pool.h>
Willy Tarreau7cd8b6e2020-06-02 17:32:26 +020034#include <haproxy/regex.h>
Willy Tarreaue6ce10b2020-06-04 15:33:47 +020035#include <haproxy/sample.h>
Willy Tarreau5e539c92020-06-04 20:45:39 +020036#include <haproxy/stream_interface.h>
Willy Tarreau48fbcae2020-06-03 18:09:46 +020037#include <haproxy/tools.h>
Willy Tarreau8c42b8a2020-06-04 19:27:34 +020038#include <haproxy/uri_auth-t.h>
Tim Duesterhusd2bedcc2021-04-15 21:45:57 +020039#include <haproxy/uri_normalizer.h>
Willy Tarreaud6788052020-05-27 15:59:00 +020040#include <haproxy/version.h>
Willy Tarreau79e57332018-10-02 16:01:16 +020041
Willy Tarreau79e57332018-10-02 16:01:16 +020042
Christopher Faulet2eb53962020-01-14 14:47:34 +010043/* Release memory allocated by most of HTTP actions. Concretly, it releases
44 * <arg.http>.
45 */
46static void release_http_action(struct act_rule *rule)
47{
48 struct logformat_node *lf, *lfb;
49
Tim Duesterhused526372020-03-05 17:56:33 +010050 istfree(&rule->arg.http.str);
Christopher Faulet2eb53962020-01-14 14:47:34 +010051 if (rule->arg.http.re)
52 regex_free(rule->arg.http.re);
53 list_for_each_entry_safe(lf, lfb, &rule->arg.http.fmt, list) {
Willy Tarreau2b718102021-04-21 07:32:39 +020054 LIST_DELETE(&lf->list);
Christopher Faulet2eb53962020-01-14 14:47:34 +010055 release_sample_expr(lf->expr);
56 free(lf->arg);
57 free(lf);
58 }
59}
60
Christopher Faulet5cb513a2020-05-13 17:56:56 +020061/* Release memory allocated by HTTP actions relying on an http reply. Concretly,
62 * it releases <.arg.http_reply>
63 */
64static void release_act_http_reply(struct act_rule *rule)
65{
66 release_http_reply(rule->arg.http_reply);
67 rule->arg.http_reply = NULL;
68}
69
70
71/* Check function for HTTP actions relying on an http reply. The function
72 * returns 1 in success case, otherwise, it returns 0 and err is filled.
73 */
74static int check_act_http_reply(struct act_rule *rule, struct proxy *px, char **err)
75{
76 struct http_reply *reply = rule->arg.http_reply;
77
78 if (!http_check_http_reply(reply, px, err)) {
79 release_act_http_reply(rule);
80 return 0;
81 }
82 return 1;
83}
84
Willy Tarreau79e57332018-10-02 16:01:16 +020085
86/* This function executes one of the set-{method,path,query,uri} actions. It
87 * builds a string in the trash from the specified format string. It finds
Christopher Faulet2c22a692019-12-18 15:39:56 +010088 * the action to be performed in <.action>, previously filled by function
Ilya Shipitsinc02a23f2020-05-06 00:53:22 +050089 * parse_set_req_line(). The replacement action is executed by the function
Christopher Faulete00d06c2019-12-16 17:18:42 +010090 * http_action_set_req_line(). On success, it returns ACT_RET_CONT. If an error
91 * occurs while soft rewrites are enabled, the action is canceled, but the rule
92 * processing continue. Otherwsize ACT_RET_ERR is returned.
Willy Tarreau79e57332018-10-02 16:01:16 +020093 */
94static enum act_return http_action_set_req_line(struct act_rule *rule, struct proxy *px,
95 struct session *sess, struct stream *s, int flags)
96{
97 struct buffer *replace;
Christopher Faulet13403762019-12-13 09:01:57 +010098 enum act_return ret = ACT_RET_CONT;
Willy Tarreau79e57332018-10-02 16:01:16 +020099
100 replace = alloc_trash_chunk();
101 if (!replace)
Christopher Faulete00d06c2019-12-16 17:18:42 +0100102 goto fail_alloc;
Willy Tarreau79e57332018-10-02 16:01:16 +0200103
104 /* If we have to create a query string, prepare a '?'. */
Christopher Faulet2c22a692019-12-18 15:39:56 +0100105 if (rule->action == 2) // set-query
Willy Tarreau79e57332018-10-02 16:01:16 +0200106 replace->area[replace->data++] = '?';
107 replace->data += build_logline(s, replace->area + replace->data,
108 replace->size - replace->data,
Christopher Faulet96bff762019-12-17 13:46:18 +0100109 &rule->arg.http.fmt);
Willy Tarreau79e57332018-10-02 16:01:16 +0200110
Christopher Faulet2c22a692019-12-18 15:39:56 +0100111 if (http_req_replace_stline(rule->action, replace->area, replace->data, px, s) == -1)
Christopher Faulete00d06c2019-12-16 17:18:42 +0100112 goto fail_rewrite;
Willy Tarreau79e57332018-10-02 16:01:16 +0200113
Christopher Faulete00d06c2019-12-16 17:18:42 +0100114 leave:
Willy Tarreau79e57332018-10-02 16:01:16 +0200115 free_trash_chunk(replace);
116 return ret;
Christopher Faulete00d06c2019-12-16 17:18:42 +0100117
118 fail_alloc:
119 if (!(s->flags & SF_ERR_MASK))
120 s->flags |= SF_ERR_RESOURCE;
121 ret = ACT_RET_ERR;
122 goto leave;
123
124 fail_rewrite:
Willy Tarreau4781b152021-04-06 13:53:36 +0200125 _HA_ATOMIC_INC(&sess->fe->fe_counters.failed_rewrites);
Christopher Faulete00d06c2019-12-16 17:18:42 +0100126 if (s->flags & SF_BE_ASSIGNED)
Willy Tarreau4781b152021-04-06 13:53:36 +0200127 _HA_ATOMIC_INC(&s->be->be_counters.failed_rewrites);
William Lallemand36119de2021-03-08 15:26:48 +0100128 if (sess->listener && sess->listener->counters)
Willy Tarreau4781b152021-04-06 13:53:36 +0200129 _HA_ATOMIC_INC(&sess->listener->counters->failed_rewrites);
Christopher Faulete00d06c2019-12-16 17:18:42 +0100130 if (objt_server(s->target))
Willy Tarreau4781b152021-04-06 13:53:36 +0200131 _HA_ATOMIC_INC(&__objt_server(s->target)->counters.failed_rewrites);
Christopher Faulete00d06c2019-12-16 17:18:42 +0100132
Christopher Faulet333bf8c2020-01-22 14:38:05 +0100133 if (!(s->txn->req.flags & HTTP_MSGF_SOFT_RW)) {
Christopher Faulete00d06c2019-12-16 17:18:42 +0100134 ret = ACT_RET_ERR;
Christopher Faulet333bf8c2020-01-22 14:38:05 +0100135 if (!(s->flags & SF_ERR_MASK))
136 s->flags |= SF_ERR_PRXCOND;
137 }
Christopher Faulete00d06c2019-12-16 17:18:42 +0100138 goto leave;
Willy Tarreau79e57332018-10-02 16:01:16 +0200139}
140
141/* parse an http-request action among :
142 * set-method
143 * set-path
Christopher Faulet312294f2020-09-02 17:17:44 +0200144 * set-pathq
Willy Tarreau79e57332018-10-02 16:01:16 +0200145 * set-query
146 * set-uri
147 *
148 * All of them accept a single argument of type string representing a log-format.
Christopher Faulet96bff762019-12-17 13:46:18 +0100149 * The resulting rule makes use of <http.fmt> to store the log-format list head,
Christopher Faulet2c22a692019-12-18 15:39:56 +0100150 * and <.action> to store the action type as an int (0=method, 1=path, 2=query,
151 * 3=uri). It returns ACT_RET_PRS_OK on success, ACT_RET_PRS_ERR on error.
Willy Tarreau79e57332018-10-02 16:01:16 +0200152 */
153static enum act_parse_ret parse_set_req_line(const char **args, int *orig_arg, struct proxy *px,
154 struct act_rule *rule, char **err)
155{
156 int cur_arg = *orig_arg;
157
Willy Tarreau79e57332018-10-02 16:01:16 +0200158 switch (args[0][4]) {
159 case 'm' :
Christopher Faulet2c22a692019-12-18 15:39:56 +0100160 rule->action = 0; // set-method
Willy Tarreau79e57332018-10-02 16:01:16 +0200161 break;
162 case 'p' :
Christopher Faulet312294f2020-09-02 17:17:44 +0200163 if (args[0][8] == 'q')
164 rule->action = 4; // set-pathq
165 else
166 rule->action = 1; // set-path
Willy Tarreau79e57332018-10-02 16:01:16 +0200167 break;
168 case 'q' :
Christopher Faulet2c22a692019-12-18 15:39:56 +0100169 rule->action = 2; // set-query
Willy Tarreau79e57332018-10-02 16:01:16 +0200170 break;
171 case 'u' :
Christopher Faulet2c22a692019-12-18 15:39:56 +0100172 rule->action = 3; // set-uri
Willy Tarreau79e57332018-10-02 16:01:16 +0200173 break;
174 default:
175 memprintf(err, "internal error: unhandled action '%s'", args[0]);
176 return ACT_RET_PRS_ERR;
177 }
Christopher Faulet96bff762019-12-17 13:46:18 +0100178 rule->action_ptr = http_action_set_req_line;
Christopher Faulet2eb53962020-01-14 14:47:34 +0100179 rule->release_ptr = release_http_action;
Willy Tarreau79e57332018-10-02 16:01:16 +0200180
181 if (!*args[cur_arg] ||
182 (*args[cur_arg + 1] && strcmp(args[cur_arg + 1], "if") != 0 && strcmp(args[cur_arg + 1], "unless") != 0)) {
183 memprintf(err, "expects exactly 1 argument <format>");
184 return ACT_RET_PRS_ERR;
185 }
186
Christopher Faulet96bff762019-12-17 13:46:18 +0100187 LIST_INIT(&rule->arg.http.fmt);
Willy Tarreau79e57332018-10-02 16:01:16 +0200188 px->conf.args.ctx = ARGC_HRQ;
Christopher Faulet96bff762019-12-17 13:46:18 +0100189 if (!parse_logformat_string(args[cur_arg], px, &rule->arg.http.fmt, LOG_OPT_HTTP,
Willy Tarreau79e57332018-10-02 16:01:16 +0200190 (px->cap & PR_CAP_FE) ? SMP_VAL_FE_HRQ_HDR : SMP_VAL_BE_HRQ_HDR, err)) {
191 return ACT_RET_PRS_ERR;
192 }
193
194 (*orig_arg)++;
195 return ACT_RET_PRS_OK;
196}
197
Tim Duesterhusd2bedcc2021-04-15 21:45:57 +0200198/* This function executes the http-request normalize-uri action.
199 * `rule->action` is expected to be a value from `enum act_normalize_uri`.
200 *
201 * On success, it returns ACT_RET_CONT. If an error
202 * occurs while soft rewrites are enabled, the action is canceled, but the rule
203 * processing continue. Otherwsize ACT_RET_ERR is returned.
204 */
205static enum act_return http_action_normalize_uri(struct act_rule *rule, struct proxy *px,
206 struct session *sess, struct stream *s, int flags)
207{
208 enum act_return ret = ACT_RET_CONT;
209 struct htx *htx = htxbuf(&s->req.buf);
210 const struct ist uri = htx_sl_req_uri(http_get_stline(htx));
211 struct buffer *replace = alloc_trash_chunk();
212 enum uri_normalizer_err err = URI_NORMALIZER_ERR_INTERNAL_ERROR;
213
214 if (!replace)
215 goto fail_alloc;
216
217 switch ((enum act_normalize_uri) rule->action) {
Tim Duesterhus5be6ab22021-04-17 11:21:10 +0200218 case ACT_NORMALIZE_URI_PATH_MERGE_SLASHES: {
Tim Duesterhusd371e992021-04-15 21:45:58 +0200219 const struct ist path = http_get_path(uri);
220 struct ist newpath = ist2(replace->area, replace->size);
221
222 if (!isttest(path))
223 goto leave;
224
225 err = uri_normalizer_path_merge_slashes(iststop(path, '?'), &newpath);
226
227 if (err != URI_NORMALIZER_ERR_NONE)
228 break;
229
230 if (!http_replace_req_path(htx, newpath, 0))
231 goto fail_rewrite;
232
233 break;
234 }
Maximilian Maderff3bb8b2021-04-21 00:22:50 +0200235 case ACT_NORMALIZE_URI_PATH_STRIP_DOT: {
236 const struct ist path = http_get_path(uri);
237 struct ist newpath = ist2(replace->area, replace->size);
238
239 if (!isttest(path))
240 goto leave;
241
242 err = uri_normalizer_path_dot(iststop(path, '?'), &newpath);
243
244 if (err != URI_NORMALIZER_ERR_NONE)
245 break;
246
247 if (!http_replace_req_path(htx, newpath, 0))
248 goto fail_rewrite;
249
250 break;
251 }
Tim Duesterhus5be6ab22021-04-17 11:21:10 +0200252 case ACT_NORMALIZE_URI_PATH_STRIP_DOTDOT:
253 case ACT_NORMALIZE_URI_PATH_STRIP_DOTDOT_FULL: {
Tim Duesterhus9982fc22021-04-15 21:45:59 +0200254 const struct ist path = http_get_path(uri);
255 struct ist newpath = ist2(replace->area, replace->size);
256
257 if (!isttest(path))
258 goto leave;
259
Tim Duesterhus5be6ab22021-04-17 11:21:10 +0200260 err = uri_normalizer_path_dotdot(iststop(path, '?'), rule->action == ACT_NORMALIZE_URI_PATH_STRIP_DOTDOT_FULL, &newpath);
Tim Duesterhus9982fc22021-04-15 21:45:59 +0200261
262 if (err != URI_NORMALIZER_ERR_NONE)
263 break;
264
265 if (!http_replace_req_path(htx, newpath, 0))
266 goto fail_rewrite;
267
268 break;
269 }
Tim Duesterhus5be6ab22021-04-17 11:21:10 +0200270 case ACT_NORMALIZE_URI_QUERY_SORT_BY_NAME: {
Tim Duesterhusd7b89be2021-04-15 21:46:01 +0200271 const struct ist path = http_get_path(uri);
272 struct ist newquery = ist2(replace->area, replace->size);
273
274 if (!isttest(path))
275 goto leave;
276
277 err = uri_normalizer_query_sort(istfind(path, '?'), '&', &newquery);
278
279 if (err != URI_NORMALIZER_ERR_NONE)
280 break;
281
282 if (!http_replace_req_query(htx, newquery))
283 goto fail_rewrite;
284
285 break;
286 }
Tim Duesterhus5be6ab22021-04-17 11:21:10 +0200287 case ACT_NORMALIZE_URI_PERCENT_TO_UPPERCASE:
288 case ACT_NORMALIZE_URI_PERCENT_TO_UPPERCASE_STRICT: {
Tim Duesterhusa4071932021-04-15 21:46:02 +0200289 const struct ist path = http_get_path(uri);
290 struct ist newpath = ist2(replace->area, replace->size);
291
292 if (!isttest(path))
293 goto leave;
294
Tim Duesterhus5be6ab22021-04-17 11:21:10 +0200295 err = uri_normalizer_percent_upper(path, rule->action == ACT_NORMALIZE_URI_PERCENT_TO_UPPERCASE_STRICT, &newpath);
Tim Duesterhusa4071932021-04-15 21:46:02 +0200296
297 if (err != URI_NORMALIZER_ERR_NONE)
298 break;
299
300 if (!http_replace_req_path(htx, newpath, 1))
301 goto fail_rewrite;
302
303 break;
304 }
Tim Duesterhus2e4a18e2021-04-21 21:20:36 +0200305 case ACT_NORMALIZE_URI_PERCENT_DECODE_UNRESERVED:
306 case ACT_NORMALIZE_URI_PERCENT_DECODE_UNRESERVED_STRICT: {
307 const struct ist path = http_get_path(uri);
308 struct ist newpath = ist2(replace->area, replace->size);
309
310 if (!isttest(path))
311 goto leave;
312
313 err = uri_normalizer_percent_decode_unreserved(path, rule->action == ACT_NORMALIZE_URI_PERCENT_DECODE_UNRESERVED_STRICT, &newpath);
314
315 if (err != URI_NORMALIZER_ERR_NONE)
316 break;
317
318 if (!http_replace_req_path(htx, newpath, 1))
319 goto fail_rewrite;
320
321 break;
322 }
Tim Duesterhusd2bedcc2021-04-15 21:45:57 +0200323 }
324
325 switch (err) {
326 case URI_NORMALIZER_ERR_NONE:
327 break;
328 case URI_NORMALIZER_ERR_INTERNAL_ERROR:
329 ret = ACT_RET_ERR;
330 break;
331 case URI_NORMALIZER_ERR_INVALID_INPUT:
332 ret = ACT_RET_INV;
333 break;
334 case URI_NORMALIZER_ERR_ALLOC:
335 goto fail_alloc;
336 }
337
338 leave:
339 free_trash_chunk(replace);
340 return ret;
341
342 fail_alloc:
343 if (!(s->flags & SF_ERR_MASK))
344 s->flags |= SF_ERR_RESOURCE;
345 ret = ACT_RET_ERR;
346 goto leave;
347
348 fail_rewrite:
349 _HA_ATOMIC_ADD(&sess->fe->fe_counters.failed_rewrites, 1);
350 if (s->flags & SF_BE_ASSIGNED)
351 _HA_ATOMIC_ADD(&s->be->be_counters.failed_rewrites, 1);
352 if (sess->listener && sess->listener->counters)
353 _HA_ATOMIC_ADD(&sess->listener->counters->failed_rewrites, 1);
354 if (objt_server(s->target))
355 _HA_ATOMIC_ADD(&__objt_server(s->target)->counters.failed_rewrites, 1);
356
357 if (!(s->txn->req.flags & HTTP_MSGF_SOFT_RW)) {
358 ret = ACT_RET_ERR;
359 if (!(s->flags & SF_ERR_MASK))
360 s->flags |= SF_ERR_PRXCOND;
361 }
362 goto leave;
363}
364
365/* Parses the http-request normalize-uri action. It expects a single <normalizer>
366 * argument, corresponding too a value in `enum act_normalize_uri`.
367 *
368 * It returns ACT_RET_PRS_OK on success, ACT_RET_PRS_ERR on error.
369 */
370static enum act_parse_ret parse_http_normalize_uri(const char **args, int *orig_arg, struct proxy *px,
371 struct act_rule *rule, char **err)
372{
373 int cur_arg = *orig_arg;
374
375 rule->action_ptr = http_action_normalize_uri;
376 rule->release_ptr = NULL;
377
378 if (!*args[cur_arg]) {
379 memprintf(err, "missing argument <normalizer>");
380 return ACT_RET_PRS_ERR;
381 }
382
Tim Duesterhus5be6ab22021-04-17 11:21:10 +0200383 if (strcmp(args[cur_arg], "path-merge-slashes") == 0) {
Tim Duesterhusd371e992021-04-15 21:45:58 +0200384 cur_arg++;
Tim Duesterhusd2bedcc2021-04-15 21:45:57 +0200385
Tim Duesterhus5be6ab22021-04-17 11:21:10 +0200386 rule->action = ACT_NORMALIZE_URI_PATH_MERGE_SLASHES;
Tim Duesterhusd2bedcc2021-04-15 21:45:57 +0200387 }
Maximilian Maderff3bb8b2021-04-21 00:22:50 +0200388 else if (strcmp(args[cur_arg], "path-strip-dot") == 0) {
389 cur_arg++;
390
391 rule->action = ACT_NORMALIZE_URI_PATH_STRIP_DOT;
392 }
Tim Duesterhus5be6ab22021-04-17 11:21:10 +0200393 else if (strcmp(args[cur_arg], "path-strip-dotdot") == 0) {
Tim Duesterhus9982fc22021-04-15 21:45:59 +0200394 cur_arg++;
395
Tim Duesterhus560e1a62021-04-15 21:46:00 +0200396 if (strcmp(args[cur_arg], "full") == 0) {
397 cur_arg++;
Tim Duesterhus5be6ab22021-04-17 11:21:10 +0200398 rule->action = ACT_NORMALIZE_URI_PATH_STRIP_DOTDOT_FULL;
Tim Duesterhus560e1a62021-04-15 21:46:00 +0200399 }
400 else if (!*args[cur_arg]) {
Tim Duesterhus5be6ab22021-04-17 11:21:10 +0200401 rule->action = ACT_NORMALIZE_URI_PATH_STRIP_DOTDOT;
Tim Duesterhus560e1a62021-04-15 21:46:00 +0200402 }
403 else if (strcmp(args[cur_arg], "if") != 0 && strcmp(args[cur_arg], "unless") != 0) {
404 memprintf(err, "unknown argument '%s' for 'dotdot' normalizer", args[cur_arg]);
405 return ACT_RET_PRS_ERR;
406 }
Tim Duesterhus9982fc22021-04-15 21:45:59 +0200407 }
Tim Duesterhus5be6ab22021-04-17 11:21:10 +0200408 else if (strcmp(args[cur_arg], "query-sort-by-name") == 0) {
Tim Duesterhusd7b89be2021-04-15 21:46:01 +0200409 cur_arg++;
410
Tim Duesterhus5be6ab22021-04-17 11:21:10 +0200411 rule->action = ACT_NORMALIZE_URI_QUERY_SORT_BY_NAME;
Tim Duesterhusd7b89be2021-04-15 21:46:01 +0200412 }
Tim Duesterhus5be6ab22021-04-17 11:21:10 +0200413 else if (strcmp(args[cur_arg], "percent-to-uppercase") == 0) {
Tim Duesterhusa4071932021-04-15 21:46:02 +0200414 cur_arg++;
415
416 if (strcmp(args[cur_arg], "strict") == 0) {
417 cur_arg++;
Tim Duesterhus5be6ab22021-04-17 11:21:10 +0200418 rule->action = ACT_NORMALIZE_URI_PERCENT_TO_UPPERCASE_STRICT;
Tim Duesterhusa4071932021-04-15 21:46:02 +0200419 }
420 else if (!*args[cur_arg]) {
Tim Duesterhus5be6ab22021-04-17 11:21:10 +0200421 rule->action = ACT_NORMALIZE_URI_PERCENT_TO_UPPERCASE;
Tim Duesterhusa4071932021-04-15 21:46:02 +0200422 }
423 else if (strcmp(args[cur_arg], "if") != 0 && strcmp(args[cur_arg], "unless") != 0) {
424 memprintf(err, "unknown argument '%s' for 'percent-upper' normalizer", args[cur_arg]);
425 return ACT_RET_PRS_ERR;
426 }
427 }
Tim Duesterhus2e4a18e2021-04-21 21:20:36 +0200428 else if (strcmp(args[cur_arg], "percent-decode-unreserved") == 0) {
429 cur_arg++;
430
431 if (strcmp(args[cur_arg], "strict") == 0) {
432 cur_arg++;
433 rule->action = ACT_NORMALIZE_URI_PERCENT_DECODE_UNRESERVED_STRICT;
434 }
435 else if (!*args[cur_arg]) {
436 rule->action = ACT_NORMALIZE_URI_PERCENT_DECODE_UNRESERVED;
437 }
438 else if (strcmp(args[cur_arg], "if") != 0 && strcmp(args[cur_arg], "unless") != 0) {
439 memprintf(err, "unknown argument '%s' for 'percent-decode-unreserved' normalizer", args[cur_arg]);
440 return ACT_RET_PRS_ERR;
441 }
442 }
Tim Duesterhusd2bedcc2021-04-15 21:45:57 +0200443 else {
444 memprintf(err, "unknown normalizer '%s'", args[cur_arg]);
445 return ACT_RET_PRS_ERR;
446 }
447
448 *orig_arg = cur_arg;
449 return ACT_RET_PRS_OK;
450}
451
Willy Tarreau33810222019-06-12 17:44:02 +0200452/* This function executes a replace-uri action. It finds its arguments in
Christopher Faulet96bff762019-12-17 13:46:18 +0100453 * <rule>.arg.http. It builds a string in the trash from the format string
Willy Tarreau33810222019-06-12 17:44:02 +0200454 * previously filled by function parse_replace_uri() and will execute the regex
Christopher Faulet96bff762019-12-17 13:46:18 +0100455 * in <http.re> to replace the URI. It uses the format string present in
Christopher Faulet2c22a692019-12-18 15:39:56 +0100456 * <http.fmt>. The component to act on (path/uri) is taken from <.action> which
Christopher Faulet96bff762019-12-17 13:46:18 +0100457 * contains 1 for the path or 3 for the URI (values used by
458 * http_req_replace_stline()). On success, it returns ACT_RET_CONT. If an error
459 * occurs while soft rewrites are enabled, the action is canceled, but the rule
460 * processing continue. Otherwsize ACT_RET_ERR is returned.
Willy Tarreau33810222019-06-12 17:44:02 +0200461 */
462static enum act_return http_action_replace_uri(struct act_rule *rule, struct proxy *px,
463 struct session *sess, struct stream *s, int flags)
464{
Christopher Faulet13403762019-12-13 09:01:57 +0100465 enum act_return ret = ACT_RET_CONT;
Willy Tarreau33810222019-06-12 17:44:02 +0200466 struct buffer *replace, *output;
467 struct ist uri;
468 int len;
469
470 replace = alloc_trash_chunk();
471 output = alloc_trash_chunk();
472 if (!replace || !output)
Christopher Faulete00d06c2019-12-16 17:18:42 +0100473 goto fail_alloc;
Christopher Faulet12c28b62019-07-15 16:30:24 +0200474 uri = htx_sl_req_uri(http_get_stline(htxbuf(&s->req.buf)));
Willy Tarreau262c3f12019-12-17 06:52:51 +0100475
Christopher Faulet1fa0cc12020-09-02 11:10:38 +0200476 if (rule->action == 1) // replace-path
477 uri = iststop(http_get_path(uri), '?');
Christopher Faulet312294f2020-09-02 17:17:44 +0200478 else if (rule->action == 4) // replace-pathq
479 uri = http_get_path(uri);
Willy Tarreau262c3f12019-12-17 06:52:51 +0100480
Christopher Faulet96bff762019-12-17 13:46:18 +0100481 if (!regex_exec_match2(rule->arg.http.re, uri.ptr, uri.len, MAX_MATCH, pmatch, 0))
Willy Tarreau33810222019-06-12 17:44:02 +0200482 goto leave;
483
Christopher Faulet96bff762019-12-17 13:46:18 +0100484 replace->data = build_logline(s, replace->area, replace->size, &rule->arg.http.fmt);
Willy Tarreau33810222019-06-12 17:44:02 +0200485
486 /* note: uri.ptr doesn't need to be zero-terminated because it will
487 * only be used to pick pmatch references.
488 */
489 len = exp_replace(output->area, output->size, uri.ptr, replace->area, pmatch);
490 if (len == -1)
Christopher Faulete00d06c2019-12-16 17:18:42 +0100491 goto fail_rewrite;
Willy Tarreau33810222019-06-12 17:44:02 +0200492
Christopher Faulet2c22a692019-12-18 15:39:56 +0100493 if (http_req_replace_stline(rule->action, output->area, len, px, s) == -1)
Christopher Faulete00d06c2019-12-16 17:18:42 +0100494 goto fail_rewrite;
Willy Tarreau33810222019-06-12 17:44:02 +0200495
Christopher Faulete00d06c2019-12-16 17:18:42 +0100496 leave:
Willy Tarreau33810222019-06-12 17:44:02 +0200497 free_trash_chunk(output);
498 free_trash_chunk(replace);
499 return ret;
Christopher Faulete00d06c2019-12-16 17:18:42 +0100500
501 fail_alloc:
502 if (!(s->flags & SF_ERR_MASK))
503 s->flags |= SF_ERR_RESOURCE;
504 ret = ACT_RET_ERR;
505 goto leave;
506
507 fail_rewrite:
Willy Tarreau4781b152021-04-06 13:53:36 +0200508 _HA_ATOMIC_INC(&sess->fe->fe_counters.failed_rewrites);
Christopher Faulete00d06c2019-12-16 17:18:42 +0100509 if (s->flags & SF_BE_ASSIGNED)
Willy Tarreau4781b152021-04-06 13:53:36 +0200510 _HA_ATOMIC_INC(&s->be->be_counters.failed_rewrites);
William Lallemand36119de2021-03-08 15:26:48 +0100511 if (sess->listener && sess->listener->counters)
Willy Tarreau4781b152021-04-06 13:53:36 +0200512 _HA_ATOMIC_INC(&sess->listener->counters->failed_rewrites);
Christopher Faulete00d06c2019-12-16 17:18:42 +0100513 if (objt_server(s->target))
Willy Tarreau4781b152021-04-06 13:53:36 +0200514 _HA_ATOMIC_INC(&__objt_server(s->target)->counters.failed_rewrites);
Christopher Faulete00d06c2019-12-16 17:18:42 +0100515
Christopher Faulet333bf8c2020-01-22 14:38:05 +0100516 if (!(s->txn->req.flags & HTTP_MSGF_SOFT_RW)) {
Christopher Faulete00d06c2019-12-16 17:18:42 +0100517 ret = ACT_RET_ERR;
Christopher Faulet333bf8c2020-01-22 14:38:05 +0100518 if (!(s->flags & SF_ERR_MASK))
519 s->flags |= SF_ERR_PRXCOND;
520 }
Christopher Faulete00d06c2019-12-16 17:18:42 +0100521 goto leave;
Willy Tarreau33810222019-06-12 17:44:02 +0200522}
523
Christopher Faulet312294f2020-09-02 17:17:44 +0200524/* parse a "replace-uri", "replace-path" or "replace-pathq"
525 * http-request action.
Willy Tarreau33810222019-06-12 17:44:02 +0200526 * This action takes 2 arguments (a regex and a replacement format string).
Christopher Faulet2c22a692019-12-18 15:39:56 +0100527 * The resulting rule makes use of <.action> to store the action (1/3 for now),
Christopher Faulet96bff762019-12-17 13:46:18 +0100528 * <http.re> to store the compiled regex, and <http.fmt> to store the log-format
Willy Tarreau33810222019-06-12 17:44:02 +0200529 * list head. It returns ACT_RET_PRS_OK on success, ACT_RET_PRS_ERR on error.
530 */
531static enum act_parse_ret parse_replace_uri(const char **args, int *orig_arg, struct proxy *px,
532 struct act_rule *rule, char **err)
533{
534 int cur_arg = *orig_arg;
535 char *error = NULL;
536
Christopher Faulet312294f2020-09-02 17:17:44 +0200537 switch (args[0][8]) {
538 case 'p':
539 if (args[0][12] == 'q')
540 rule->action = 4; // replace-pathq, same as set-pathq
541 else
542 rule->action = 1; // replace-path, same as set-path
543 break;
544 case 'u':
Christopher Faulet2c22a692019-12-18 15:39:56 +0100545 rule->action = 3; // replace-uri, same as set-uri
Christopher Faulet312294f2020-09-02 17:17:44 +0200546 break;
547 default:
548 memprintf(err, "internal error: unhandled action '%s'", args[0]);
549 return ACT_RET_PRS_ERR;
550 }
Willy Tarreau262c3f12019-12-17 06:52:51 +0100551
Willy Tarreau33810222019-06-12 17:44:02 +0200552 rule->action_ptr = http_action_replace_uri;
Christopher Faulet2eb53962020-01-14 14:47:34 +0100553 rule->release_ptr = release_http_action;
Willy Tarreau33810222019-06-12 17:44:02 +0200554
555 if (!*args[cur_arg] || !*args[cur_arg+1] ||
556 (*args[cur_arg+2] && strcmp(args[cur_arg+2], "if") != 0 && strcmp(args[cur_arg+2], "unless") != 0)) {
557 memprintf(err, "expects exactly 2 arguments <match-regex> and <replace-format>");
558 return ACT_RET_PRS_ERR;
559 }
560
Christopher Faulet96bff762019-12-17 13:46:18 +0100561 if (!(rule->arg.http.re = regex_comp(args[cur_arg], 1, 1, &error))) {
Willy Tarreau33810222019-06-12 17:44:02 +0200562 memprintf(err, "failed to parse the regex : %s", error);
563 free(error);
564 return ACT_RET_PRS_ERR;
565 }
566
Christopher Faulet96bff762019-12-17 13:46:18 +0100567 LIST_INIT(&rule->arg.http.fmt);
Willy Tarreau33810222019-06-12 17:44:02 +0200568 px->conf.args.ctx = ARGC_HRQ;
Christopher Faulet96bff762019-12-17 13:46:18 +0100569 if (!parse_logformat_string(args[cur_arg + 1], px, &rule->arg.http.fmt, LOG_OPT_HTTP,
Willy Tarreau33810222019-06-12 17:44:02 +0200570 (px->cap & PR_CAP_FE) ? SMP_VAL_FE_HRQ_HDR : SMP_VAL_BE_HRQ_HDR, err)) {
Christopher Faulet1337b322020-01-14 14:50:55 +0100571 regex_free(rule->arg.http.re);
Willy Tarreau33810222019-06-12 17:44:02 +0200572 return ACT_RET_PRS_ERR;
573 }
574
575 (*orig_arg) += 2;
576 return ACT_RET_PRS_OK;
577}
578
Willy Tarreau79e57332018-10-02 16:01:16 +0200579/* This function is just a compliant action wrapper for "set-status". */
580static enum act_return action_http_set_status(struct act_rule *rule, struct proxy *px,
581 struct session *sess, struct stream *s, int flags)
582{
Christopher Faulet96bff762019-12-17 13:46:18 +0100583 if (http_res_set_status(rule->arg.http.i, rule->arg.http.str, s) == -1) {
Willy Tarreau4781b152021-04-06 13:53:36 +0200584 _HA_ATOMIC_INC(&sess->fe->fe_counters.failed_rewrites);
Christopher Faulete00d06c2019-12-16 17:18:42 +0100585 if (s->flags & SF_BE_ASSIGNED)
Willy Tarreau4781b152021-04-06 13:53:36 +0200586 _HA_ATOMIC_INC(&s->be->be_counters.failed_rewrites);
William Lallemand36119de2021-03-08 15:26:48 +0100587 if (sess->listener && sess->listener->counters)
Willy Tarreau4781b152021-04-06 13:53:36 +0200588 _HA_ATOMIC_INC(&sess->listener->counters->failed_rewrites);
Christopher Faulete00d06c2019-12-16 17:18:42 +0100589 if (objt_server(s->target))
Willy Tarreau4781b152021-04-06 13:53:36 +0200590 _HA_ATOMIC_INC(&__objt_server(s->target)->counters.failed_rewrites);
Christopher Faulete00d06c2019-12-16 17:18:42 +0100591
Christopher Faulet333bf8c2020-01-22 14:38:05 +0100592 if (!(s->txn->req.flags & HTTP_MSGF_SOFT_RW)) {
Christopher Faulet333bf8c2020-01-22 14:38:05 +0100593 if (!(s->flags & SF_ERR_MASK))
594 s->flags |= SF_ERR_PRXCOND;
Christopher Faulet692a6c22020-02-07 10:22:31 +0100595 return ACT_RET_ERR;
Christopher Faulet333bf8c2020-01-22 14:38:05 +0100596 }
Christopher Faulete00d06c2019-12-16 17:18:42 +0100597 }
598
Willy Tarreau79e57332018-10-02 16:01:16 +0200599 return ACT_RET_CONT;
600}
601
602/* parse set-status action:
603 * This action accepts a single argument of type int representing
604 * an http status code. It returns ACT_RET_PRS_OK on success,
605 * ACT_RET_PRS_ERR on error.
606 */
607static enum act_parse_ret parse_http_set_status(const char **args, int *orig_arg, struct proxy *px,
608 struct act_rule *rule, char **err)
609{
610 char *error;
611
612 rule->action = ACT_CUSTOM;
613 rule->action_ptr = action_http_set_status;
Christopher Faulet2eb53962020-01-14 14:47:34 +0100614 rule->release_ptr = release_http_action;
Willy Tarreau79e57332018-10-02 16:01:16 +0200615
616 /* Check if an argument is available */
617 if (!*args[*orig_arg]) {
618 memprintf(err, "expects 1 argument: <status>; or 3 arguments: <status> reason <fmt>");
619 return ACT_RET_PRS_ERR;
620 }
621
622 /* convert status code as integer */
Christopher Faulet96bff762019-12-17 13:46:18 +0100623 rule->arg.http.i = strtol(args[*orig_arg], &error, 10);
624 if (*error != '\0' || rule->arg.http.i < 100 || rule->arg.http.i > 999) {
Willy Tarreau79e57332018-10-02 16:01:16 +0200625 memprintf(err, "expects an integer status code between 100 and 999");
626 return ACT_RET_PRS_ERR;
627 }
628
629 (*orig_arg)++;
630
631 /* set custom reason string */
Christopher Faulet96bff762019-12-17 13:46:18 +0100632 rule->arg.http.str = ist(NULL); // If null, we use the default reason for the status code.
Willy Tarreau79e57332018-10-02 16:01:16 +0200633 if (*args[*orig_arg] && strcmp(args[*orig_arg], "reason") == 0 &&
634 (*args[*orig_arg + 1] && strcmp(args[*orig_arg + 1], "if") != 0 && strcmp(args[*orig_arg + 1], "unless") != 0)) {
635 (*orig_arg)++;
Christopher Faulet96bff762019-12-17 13:46:18 +0100636 rule->arg.http.str.ptr = strdup(args[*orig_arg]);
637 rule->arg.http.str.len = strlen(rule->arg.http.str.ptr);
Willy Tarreau79e57332018-10-02 16:01:16 +0200638 (*orig_arg)++;
639 }
640
Christopher Fauletc20b3712020-01-27 15:51:56 +0100641 LIST_INIT(&rule->arg.http.fmt);
Willy Tarreau79e57332018-10-02 16:01:16 +0200642 return ACT_RET_PRS_OK;
643}
644
645/* This function executes the "reject" HTTP action. It clears the request and
646 * response buffer without sending any response. It can be useful as an HTTP
647 * alternative to the silent-drop action to defend against DoS attacks, and may
648 * also be used with HTTP/2 to close a connection instead of just a stream.
649 * The txn status is unchanged, indicating no response was sent. The termination
Christopher Faulet90d22a82020-03-06 11:18:39 +0100650 * flags will indicate "PR". It always returns ACT_RET_ABRT.
Willy Tarreau79e57332018-10-02 16:01:16 +0200651 */
652static enum act_return http_action_reject(struct act_rule *rule, struct proxy *px,
653 struct session *sess, struct stream *s, int flags)
654{
Willy Tarreau0f9cd7b2019-01-31 19:02:43 +0100655 si_must_kill_conn(chn_prod(&s->req));
Willy Tarreau79e57332018-10-02 16:01:16 +0200656 channel_abort(&s->req);
657 channel_abort(&s->res);
Christopher Fauletd4a824e2020-03-06 15:07:09 +0100658 s->req.analysers &= AN_REQ_FLT_END;
659 s->res.analysers &= AN_RES_FLT_END;
Willy Tarreau79e57332018-10-02 16:01:16 +0200660
Willy Tarreau4781b152021-04-06 13:53:36 +0200661 _HA_ATOMIC_INC(&s->be->be_counters.denied_req);
662 _HA_ATOMIC_INC(&sess->fe->fe_counters.denied_req);
Willy Tarreau79e57332018-10-02 16:01:16 +0200663 if (sess->listener && sess->listener->counters)
Willy Tarreau4781b152021-04-06 13:53:36 +0200664 _HA_ATOMIC_INC(&sess->listener->counters->denied_req);
Willy Tarreau79e57332018-10-02 16:01:16 +0200665
666 if (!(s->flags & SF_ERR_MASK))
667 s->flags |= SF_ERR_PRXCOND;
668 if (!(s->flags & SF_FINST_MASK))
669 s->flags |= SF_FINST_R;
670
Christopher Faulet90d22a82020-03-06 11:18:39 +0100671 return ACT_RET_ABRT;
Willy Tarreau79e57332018-10-02 16:01:16 +0200672}
673
674/* parse the "reject" action:
675 * This action takes no argument and returns ACT_RET_PRS_OK on success,
676 * ACT_RET_PRS_ERR on error.
677 */
678static enum act_parse_ret parse_http_action_reject(const char **args, int *orig_arg, struct proxy *px,
679 struct act_rule *rule, char **err)
680{
681 rule->action = ACT_CUSTOM;
682 rule->action_ptr = http_action_reject;
683 return ACT_RET_PRS_OK;
684}
685
Olivier Houchard602bf7d2019-05-10 13:59:15 +0200686/* This function executes the "disable-l7-retry" HTTP action.
687 * It disables L7 retries (all retry except for a connection failure). This
688 * can be useful for example to avoid retrying on POST requests.
689 * It just removes the L7 retry flag on the stream_interface, and always
690 * return ACT_RET_CONT;
691 */
692static enum act_return http_req_disable_l7_retry(struct act_rule *rule, struct proxy *px,
693 struct session *sess, struct stream *s, int flags)
694{
695 struct stream_interface *si = &s->si[1];
696
697 /* In theory, the SI_FL_L7_RETRY flags isn't set at this point, but
698 * let's be future-proof and remove it anyway.
699 */
700 si->flags &= ~SI_FL_L7_RETRY;
701 si->flags |= SI_FL_D_L7_RETRY;
702 return ACT_RET_CONT;
703}
704
705/* parse the "disable-l7-retry" action:
706 * This action takes no argument and returns ACT_RET_PRS_OK on success,
707 * ACT_RET_PRS_ERR on error.
708 */
709static enum act_parse_ret parse_http_req_disable_l7_retry(const char **args,
710 int *orig_args, struct proxy *px,
711 struct act_rule *rule, char **err)
712{
713 rule->action = ACT_CUSTOM;
714 rule->action_ptr = http_req_disable_l7_retry;
715 return ACT_RET_PRS_OK;
716}
717
Willy Tarreau79e57332018-10-02 16:01:16 +0200718/* This function executes the "capture" action. It executes a fetch expression,
719 * turns the result into a string and puts it in a capture slot. It always
720 * returns 1. If an error occurs the action is cancelled, but the rule
721 * processing continues.
722 */
723static enum act_return http_action_req_capture(struct act_rule *rule, struct proxy *px,
724 struct session *sess, struct stream *s, int flags)
725{
726 struct sample *key;
727 struct cap_hdr *h = rule->arg.cap.hdr;
728 char **cap = s->req_cap;
729 int len;
730
731 key = sample_fetch_as_type(s->be, sess, s, SMP_OPT_DIR_REQ|SMP_OPT_FINAL, rule->arg.cap.expr, SMP_T_STR);
732 if (!key)
733 return ACT_RET_CONT;
734
735 if (cap[h->index] == NULL)
736 cap[h->index] = pool_alloc(h->pool);
737
738 if (cap[h->index] == NULL) /* no more capture memory */
739 return ACT_RET_CONT;
740
741 len = key->data.u.str.data;
742 if (len > h->len)
743 len = h->len;
744
745 memcpy(cap[h->index], key->data.u.str.area, len);
746 cap[h->index][len] = 0;
747 return ACT_RET_CONT;
748}
749
750/* This function executes the "capture" action and store the result in a
751 * capture slot if exists. It executes a fetch expression, turns the result
752 * into a string and puts it in a capture slot. It always returns 1. If an
753 * error occurs the action is cancelled, but the rule processing continues.
754 */
755static enum act_return http_action_req_capture_by_id(struct act_rule *rule, struct proxy *px,
756 struct session *sess, struct stream *s, int flags)
757{
758 struct sample *key;
759 struct cap_hdr *h;
760 char **cap = s->req_cap;
761 struct proxy *fe = strm_fe(s);
762 int len;
763 int i;
764
765 /* Look for the original configuration. */
766 for (h = fe->req_cap, i = fe->nb_req_cap - 1;
767 h != NULL && i != rule->arg.capid.idx ;
768 i--, h = h->next);
769 if (!h)
770 return ACT_RET_CONT;
771
772 key = sample_fetch_as_type(s->be, sess, s, SMP_OPT_DIR_REQ|SMP_OPT_FINAL, rule->arg.capid.expr, SMP_T_STR);
773 if (!key)
774 return ACT_RET_CONT;
775
776 if (cap[h->index] == NULL)
777 cap[h->index] = pool_alloc(h->pool);
778
779 if (cap[h->index] == NULL) /* no more capture memory */
780 return ACT_RET_CONT;
781
782 len = key->data.u.str.data;
783 if (len > h->len)
784 len = h->len;
785
786 memcpy(cap[h->index], key->data.u.str.area, len);
787 cap[h->index][len] = 0;
788 return ACT_RET_CONT;
789}
790
791/* Check an "http-request capture" action.
792 *
793 * The function returns 1 in success case, otherwise, it returns 0 and err is
794 * filled.
795 */
796static int check_http_req_capture(struct act_rule *rule, struct proxy *px, char **err)
797{
798 if (rule->action_ptr != http_action_req_capture_by_id)
799 return 1;
800
Baptiste Assmann19a69b32020-01-16 14:34:22 +0100801 /* capture slots can only be declared in frontends, so we can't check their
802 * existence in backends at configuration parsing step
803 */
804 if (px->cap & PR_CAP_FE && rule->arg.capid.idx >= px->nb_req_cap) {
Willy Tarreau79e57332018-10-02 16:01:16 +0200805 memprintf(err, "unable to find capture id '%d' referenced by http-request capture rule",
806 rule->arg.capid.idx);
807 return 0;
808 }
809
810 return 1;
811}
812
Christopher Faulet2eb53962020-01-14 14:47:34 +0100813/* Release memory allocate by an http capture action */
814static void release_http_capture(struct act_rule *rule)
815{
816 if (rule->action_ptr == http_action_req_capture)
817 release_sample_expr(rule->arg.cap.expr);
818 else
819 release_sample_expr(rule->arg.capid.expr);
820}
821
Willy Tarreau79e57332018-10-02 16:01:16 +0200822/* parse an "http-request capture" action. It takes a single argument which is
823 * a sample fetch expression. It stores the expression into arg->act.p[0] and
824 * the allocated hdr_cap struct or the preallocated "id" into arg->act.p[1].
825 * It returns ACT_RET_PRS_OK on success, ACT_RET_PRS_ERR on error.
826 */
827static enum act_parse_ret parse_http_req_capture(const char **args, int *orig_arg, struct proxy *px,
828 struct act_rule *rule, char **err)
829{
830 struct sample_expr *expr;
831 struct cap_hdr *hdr;
832 int cur_arg;
833 int len = 0;
834
835 for (cur_arg = *orig_arg; cur_arg < *orig_arg + 3 && *args[cur_arg]; cur_arg++)
836 if (strcmp(args[cur_arg], "if") == 0 ||
837 strcmp(args[cur_arg], "unless") == 0)
838 break;
839
840 if (cur_arg < *orig_arg + 3) {
841 memprintf(err, "expects <expression> [ 'len' <length> | id <idx> ]");
842 return ACT_RET_PRS_ERR;
843 }
844
845 cur_arg = *orig_arg;
Willy Tarreaue3b57bf2020-02-14 16:50:14 +0100846 expr = sample_parse_expr((char **)args, &cur_arg, px->conf.args.file, px->conf.args.line, err, &px->conf.args, NULL);
Willy Tarreau79e57332018-10-02 16:01:16 +0200847 if (!expr)
848 return ACT_RET_PRS_ERR;
849
850 if (!(expr->fetch->val & SMP_VAL_FE_HRQ_HDR)) {
851 memprintf(err,
852 "fetch method '%s' extracts information from '%s', none of which is available here",
853 args[cur_arg-1], sample_src_names(expr->fetch->use));
Christopher Faulet1337b322020-01-14 14:50:55 +0100854 release_sample_expr(expr);
Willy Tarreau79e57332018-10-02 16:01:16 +0200855 return ACT_RET_PRS_ERR;
856 }
857
858 if (!args[cur_arg] || !*args[cur_arg]) {
859 memprintf(err, "expects 'len or 'id'");
Christopher Faulet1337b322020-01-14 14:50:55 +0100860 release_sample_expr(expr);
Willy Tarreau79e57332018-10-02 16:01:16 +0200861 return ACT_RET_PRS_ERR;
862 }
863
864 if (strcmp(args[cur_arg], "len") == 0) {
865 cur_arg++;
866
867 if (!(px->cap & PR_CAP_FE)) {
868 memprintf(err, "proxy '%s' has no frontend capability", px->id);
Christopher Faulet1337b322020-01-14 14:50:55 +0100869 release_sample_expr(expr);
Willy Tarreau79e57332018-10-02 16:01:16 +0200870 return ACT_RET_PRS_ERR;
871 }
872
873 px->conf.args.ctx = ARGC_CAP;
874
875 if (!args[cur_arg]) {
876 memprintf(err, "missing length value");
Christopher Faulet1337b322020-01-14 14:50:55 +0100877 release_sample_expr(expr);
Willy Tarreau79e57332018-10-02 16:01:16 +0200878 return ACT_RET_PRS_ERR;
879 }
880 /* we copy the table name for now, it will be resolved later */
881 len = atoi(args[cur_arg]);
882 if (len <= 0) {
883 memprintf(err, "length must be > 0");
Christopher Faulet1337b322020-01-14 14:50:55 +0100884 release_sample_expr(expr);
Willy Tarreau79e57332018-10-02 16:01:16 +0200885 return ACT_RET_PRS_ERR;
886 }
887 cur_arg++;
888
Willy Tarreau79e57332018-10-02 16:01:16 +0200889 hdr = calloc(1, sizeof(*hdr));
890 hdr->next = px->req_cap;
891 hdr->name = NULL; /* not a header capture */
892 hdr->namelen = 0;
893 hdr->len = len;
894 hdr->pool = create_pool("caphdr", hdr->len + 1, MEM_F_SHARED);
895 hdr->index = px->nb_req_cap++;
896
897 px->req_cap = hdr;
898 px->to_log |= LW_REQHDR;
899
900 rule->action = ACT_CUSTOM;
901 rule->action_ptr = http_action_req_capture;
Christopher Faulet2eb53962020-01-14 14:47:34 +0100902 rule->release_ptr = release_http_capture;
Willy Tarreau79e57332018-10-02 16:01:16 +0200903 rule->arg.cap.expr = expr;
904 rule->arg.cap.hdr = hdr;
905 }
906
907 else if (strcmp(args[cur_arg], "id") == 0) {
908 int id;
909 char *error;
910
911 cur_arg++;
912
913 if (!args[cur_arg]) {
914 memprintf(err, "missing id value");
Christopher Faulet1337b322020-01-14 14:50:55 +0100915 release_sample_expr(expr);
Willy Tarreau79e57332018-10-02 16:01:16 +0200916 return ACT_RET_PRS_ERR;
917 }
918
919 id = strtol(args[cur_arg], &error, 10);
920 if (*error != '\0') {
921 memprintf(err, "cannot parse id '%s'", args[cur_arg]);
Christopher Faulet1337b322020-01-14 14:50:55 +0100922 release_sample_expr(expr);
Willy Tarreau79e57332018-10-02 16:01:16 +0200923 return ACT_RET_PRS_ERR;
924 }
925 cur_arg++;
926
927 px->conf.args.ctx = ARGC_CAP;
928
929 rule->action = ACT_CUSTOM;
930 rule->action_ptr = http_action_req_capture_by_id;
931 rule->check_ptr = check_http_req_capture;
Christopher Faulet2eb53962020-01-14 14:47:34 +0100932 rule->release_ptr = release_http_capture;
Willy Tarreau79e57332018-10-02 16:01:16 +0200933 rule->arg.capid.expr = expr;
934 rule->arg.capid.idx = id;
935 }
936
937 else {
938 memprintf(err, "expects 'len' or 'id', found '%s'", args[cur_arg]);
Christopher Faulet1337b322020-01-14 14:50:55 +0100939 release_sample_expr(expr);
Willy Tarreau79e57332018-10-02 16:01:16 +0200940 return ACT_RET_PRS_ERR;
941 }
942
943 *orig_arg = cur_arg;
944 return ACT_RET_PRS_OK;
945}
946
947/* This function executes the "capture" action and store the result in a
948 * capture slot if exists. It executes a fetch expression, turns the result
949 * into a string and puts it in a capture slot. It always returns 1. If an
950 * error occurs the action is cancelled, but the rule processing continues.
951 */
952static enum act_return http_action_res_capture_by_id(struct act_rule *rule, struct proxy *px,
953 struct session *sess, struct stream *s, int flags)
954{
955 struct sample *key;
956 struct cap_hdr *h;
957 char **cap = s->res_cap;
958 struct proxy *fe = strm_fe(s);
959 int len;
960 int i;
961
962 /* Look for the original configuration. */
963 for (h = fe->rsp_cap, i = fe->nb_rsp_cap - 1;
964 h != NULL && i != rule->arg.capid.idx ;
965 i--, h = h->next);
966 if (!h)
967 return ACT_RET_CONT;
968
969 key = sample_fetch_as_type(s->be, sess, s, SMP_OPT_DIR_RES|SMP_OPT_FINAL, rule->arg.capid.expr, SMP_T_STR);
970 if (!key)
971 return ACT_RET_CONT;
972
973 if (cap[h->index] == NULL)
974 cap[h->index] = pool_alloc(h->pool);
975
976 if (cap[h->index] == NULL) /* no more capture memory */
977 return ACT_RET_CONT;
978
979 len = key->data.u.str.data;
980 if (len > h->len)
981 len = h->len;
982
983 memcpy(cap[h->index], key->data.u.str.area, len);
984 cap[h->index][len] = 0;
985 return ACT_RET_CONT;
986}
987
988/* Check an "http-response capture" action.
989 *
990 * The function returns 1 in success case, otherwise, it returns 0 and err is
991 * filled.
992 */
993static int check_http_res_capture(struct act_rule *rule, struct proxy *px, char **err)
994{
995 if (rule->action_ptr != http_action_res_capture_by_id)
996 return 1;
997
Tim Duesterhusf3f4aa02020-07-03 13:43:42 +0200998 /* capture slots can only be declared in frontends, so we can't check their
999 * existence in backends at configuration parsing step
1000 */
1001 if (px->cap & PR_CAP_FE && rule->arg.capid.idx >= px->nb_rsp_cap) {
Willy Tarreau79e57332018-10-02 16:01:16 +02001002 memprintf(err, "unable to find capture id '%d' referenced by http-response capture rule",
1003 rule->arg.capid.idx);
1004 return 0;
1005 }
1006
1007 return 1;
1008}
1009
1010/* parse an "http-response capture" action. It takes a single argument which is
1011 * a sample fetch expression. It stores the expression into arg->act.p[0] and
Thayne McCombs8f0cc5c2021-01-07 21:35:52 -07001012 * the allocated hdr_cap struct of the preallocated id into arg->act.p[1].
Willy Tarreau79e57332018-10-02 16:01:16 +02001013 * It returns ACT_RET_PRS_OK on success, ACT_RET_PRS_ERR on error.
1014 */
1015static enum act_parse_ret parse_http_res_capture(const char **args, int *orig_arg, struct proxy *px,
1016 struct act_rule *rule, char **err)
1017{
1018 struct sample_expr *expr;
1019 int cur_arg;
1020 int id;
1021 char *error;
1022
1023 for (cur_arg = *orig_arg; cur_arg < *orig_arg + 3 && *args[cur_arg]; cur_arg++)
1024 if (strcmp(args[cur_arg], "if") == 0 ||
1025 strcmp(args[cur_arg], "unless") == 0)
1026 break;
1027
1028 if (cur_arg < *orig_arg + 3) {
1029 memprintf(err, "expects <expression> id <idx>");
1030 return ACT_RET_PRS_ERR;
1031 }
1032
1033 cur_arg = *orig_arg;
Willy Tarreaue3b57bf2020-02-14 16:50:14 +01001034 expr = sample_parse_expr((char **)args, &cur_arg, px->conf.args.file, px->conf.args.line, err, &px->conf.args, NULL);
Willy Tarreau79e57332018-10-02 16:01:16 +02001035 if (!expr)
1036 return ACT_RET_PRS_ERR;
1037
1038 if (!(expr->fetch->val & SMP_VAL_FE_HRS_HDR)) {
1039 memprintf(err,
1040 "fetch method '%s' extracts information from '%s', none of which is available here",
1041 args[cur_arg-1], sample_src_names(expr->fetch->use));
Christopher Faulet1337b322020-01-14 14:50:55 +01001042 release_sample_expr(expr);
Willy Tarreau79e57332018-10-02 16:01:16 +02001043 return ACT_RET_PRS_ERR;
1044 }
1045
1046 if (!args[cur_arg] || !*args[cur_arg]) {
1047 memprintf(err, "expects 'id'");
Christopher Faulet1337b322020-01-14 14:50:55 +01001048 release_sample_expr(expr);
Willy Tarreau79e57332018-10-02 16:01:16 +02001049 return ACT_RET_PRS_ERR;
1050 }
1051
1052 if (strcmp(args[cur_arg], "id") != 0) {
1053 memprintf(err, "expects 'id', found '%s'", args[cur_arg]);
Christopher Faulet1337b322020-01-14 14:50:55 +01001054 release_sample_expr(expr);
Willy Tarreau79e57332018-10-02 16:01:16 +02001055 return ACT_RET_PRS_ERR;
1056 }
1057
1058 cur_arg++;
1059
1060 if (!args[cur_arg]) {
1061 memprintf(err, "missing id value");
Christopher Faulet1337b322020-01-14 14:50:55 +01001062 release_sample_expr(expr);
Willy Tarreau79e57332018-10-02 16:01:16 +02001063 return ACT_RET_PRS_ERR;
1064 }
1065
1066 id = strtol(args[cur_arg], &error, 10);
1067 if (*error != '\0') {
1068 memprintf(err, "cannot parse id '%s'", args[cur_arg]);
Christopher Faulet1337b322020-01-14 14:50:55 +01001069 release_sample_expr(expr);
Willy Tarreau79e57332018-10-02 16:01:16 +02001070 return ACT_RET_PRS_ERR;
1071 }
1072 cur_arg++;
1073
1074 px->conf.args.ctx = ARGC_CAP;
1075
1076 rule->action = ACT_CUSTOM;
1077 rule->action_ptr = http_action_res_capture_by_id;
1078 rule->check_ptr = check_http_res_capture;
Christopher Faulet2eb53962020-01-14 14:47:34 +01001079 rule->release_ptr = release_http_capture;
Willy Tarreau79e57332018-10-02 16:01:16 +02001080 rule->arg.capid.expr = expr;
1081 rule->arg.capid.idx = id;
1082
1083 *orig_arg = cur_arg;
1084 return ACT_RET_PRS_OK;
1085}
1086
Christopher Faulet81e20172019-12-12 16:40:30 +01001087/* Parse a "allow" action for a request or a response rule. It takes no argument. It
1088 * returns ACT_RET_PRS_OK on success, ACT_RET_PRS_ERR on error.
1089 */
1090static enum act_parse_ret parse_http_allow(const char **args, int *orig_arg, struct proxy *px,
1091 struct act_rule *rule, char **err)
1092{
1093 rule->action = ACT_ACTION_ALLOW;
Christopher Faulet245cf792019-12-18 14:58:12 +01001094 rule->flags |= ACT_FLAG_FINAL;
Christopher Faulet81e20172019-12-12 16:40:30 +01001095 return ACT_RET_PRS_OK;
1096}
1097
Christopher Faulete0fca292020-01-13 21:49:03 +01001098/* Parse "deny" or "tarpit" actions for a request rule or "deny" action for a
Christopher Faulet5cb513a2020-05-13 17:56:56 +02001099 * response rule. It returns ACT_RET_PRS_OK on success, ACT_RET_PRS_ERR on
1100 * error. It relies on http_parse_http_reply() to set
1101 * <.arg.http_reply>.
Christopher Faulet81e20172019-12-12 16:40:30 +01001102 */
Christopher Faulete0fca292020-01-13 21:49:03 +01001103static enum act_parse_ret parse_http_deny(const char **args, int *orig_arg, struct proxy *px,
1104 struct act_rule *rule, char **err)
Christopher Faulet81e20172019-12-12 16:40:30 +01001105{
Christopher Faulet5cb513a2020-05-13 17:56:56 +02001106 int default_status;
1107 int cur_arg, arg = 0;
Christopher Faulet81e20172019-12-12 16:40:30 +01001108
1109 cur_arg = *orig_arg;
Christopher Faulete0fca292020-01-13 21:49:03 +01001110 if (rule->from == ACT_F_HTTP_REQ) {
Tim Duesterhuse5ff1412021-01-02 22:31:53 +01001111 if (strcmp(args[cur_arg - 1], "tarpit") == 0) {
Christopher Faulete0fca292020-01-13 21:49:03 +01001112 rule->action = ACT_HTTP_REQ_TARPIT;
Christopher Faulet5cb513a2020-05-13 17:56:56 +02001113 default_status = 500;
Christopher Faulet81e20172019-12-12 16:40:30 +01001114 }
Christopher Faulete0fca292020-01-13 21:49:03 +01001115 else {
1116 rule->action = ACT_ACTION_DENY;
Christopher Faulet5cb513a2020-05-13 17:56:56 +02001117 default_status = 403;
Christopher Faulet81e20172019-12-12 16:40:30 +01001118 }
Christopher Faulet81e20172019-12-12 16:40:30 +01001119 }
Christopher Faulete0fca292020-01-13 21:49:03 +01001120 else {
Christopher Faulet554c0eb2020-01-14 12:00:28 +01001121 rule->action = ACT_ACTION_DENY;
Christopher Faulet5cb513a2020-05-13 17:56:56 +02001122 default_status = 502;
Christopher Faulete0fca292020-01-13 21:49:03 +01001123 }
Christopher Faulet040c8cd2020-01-13 16:43:45 +01001124
Christopher Faulet5cb513a2020-05-13 17:56:56 +02001125 /* If no args or only a deny_status specified, fallback on the legacy
1126 * mode and use default error files despite the fact that
1127 * default-errorfiles is not used. Otherwise, parse an http reply.
1128 */
Christopher Faulet040c8cd2020-01-13 16:43:45 +01001129
Christopher Faulet5cb513a2020-05-13 17:56:56 +02001130 /* Prepare parsing of log-format strings */
1131 px->conf.args.ctx = ((rule->from == ACT_F_HTTP_REQ) ? ARGC_HRQ : ARGC_HRS);
Christopher Faulet554c0eb2020-01-14 12:00:28 +01001132
Christopher Faulet9467f182020-06-30 09:32:01 +02001133 if (!*(args[cur_arg]) || strcmp(args[cur_arg], "if") == 0 || strcmp(args[cur_arg], "unless") == 0) {
Christopher Faulet5cb513a2020-05-13 17:56:56 +02001134 rule->arg.http_reply = http_parse_http_reply((const char *[]){"default-errorfiles", ""}, &arg, px, default_status, err);
1135 goto end;
Christopher Faulet554c0eb2020-01-14 12:00:28 +01001136 }
Christopher Faulet5cb513a2020-05-13 17:56:56 +02001137
1138 if (strcmp(args[cur_arg], "deny_status") == 0) {
Christopher Faulet9467f182020-06-30 09:32:01 +02001139 if (!*(args[cur_arg+2]) || strcmp(args[cur_arg+2], "if") == 0 || strcmp(args[cur_arg+2], "unless") == 0) {
Christopher Faulet5cb513a2020-05-13 17:56:56 +02001140 rule->arg.http_reply = http_parse_http_reply((const char *[]){"status", args[cur_arg+1], "default-errorfiles", ""},
1141 &arg, px, default_status, err);
1142 *orig_arg += 2;
1143 goto end;
Christopher Faulet554c0eb2020-01-14 12:00:28 +01001144 }
Christopher Faulet5cb513a2020-05-13 17:56:56 +02001145 args[cur_arg] += 5; /* skip "deny_" for the parsing */
Christopher Faulet554c0eb2020-01-14 12:00:28 +01001146 }
1147
Christopher Faulet5cb513a2020-05-13 17:56:56 +02001148 rule->arg.http_reply = http_parse_http_reply(args, orig_arg, px, default_status, err);
Christopher Faulet554c0eb2020-01-14 12:00:28 +01001149
Christopher Faulet5cb513a2020-05-13 17:56:56 +02001150 end:
1151 if (!rule->arg.http_reply)
1152 return ACT_RET_PRS_ERR;
1153
1154 rule->flags |= ACT_FLAG_FINAL;
1155 rule->check_ptr = check_act_http_reply;
1156 rule->release_ptr = release_act_http_reply;
Christopher Faulet81e20172019-12-12 16:40:30 +01001157 return ACT_RET_PRS_OK;
1158}
1159
Christopher Fauletb3048832020-05-27 15:26:43 +02001160
1161/* This function executes a auth action. It builds an 401/407 HTX message using
1162 * the corresponding proxy's error message. On success, it returns
1163 * ACT_RET_ABRT. If an error occurs ACT_RET_ERR is returned.
1164 */
1165static enum act_return http_action_auth(struct act_rule *rule, struct proxy *px,
1166 struct session *sess, struct stream *s, int flags)
1167{
1168 struct channel *req = &s->req;
1169 struct channel *res = &s->res;
1170 struct htx *htx = htx_from_buf(&res->buf);
1171 struct http_reply *reply;
1172 const char *auth_realm;
1173 struct http_hdr_ctx ctx;
1174 struct ist hdr;
1175
1176 /* Auth might be performed on regular http-req rules as well as on stats */
1177 auth_realm = rule->arg.http.str.ptr;
1178 if (!auth_realm) {
1179 if (px->uri_auth && s->current_rule_list == &px->uri_auth->http_req_rules)
1180 auth_realm = STATS_DEFAULT_REALM;
1181 else
1182 auth_realm = px->id;
1183 }
1184
1185 if (!(s->txn->flags & TX_USE_PX_CONN)) {
1186 s->txn->status = 401;
1187 hdr = ist("WWW-Authenticate");
1188 }
1189 else {
1190 s->txn->status = 407;
1191 hdr = ist("Proxy-Authenticate");
1192 }
1193 reply = http_error_message(s);
1194 channel_htx_truncate(res, htx);
1195
1196 if (chunk_printf(&trash, "Basic realm=\"%s\"", auth_realm) == -1)
1197 goto fail;
1198
1199 /* Write the generic 40x message */
1200 if (http_reply_to_htx(s, htx, reply) == -1)
1201 goto fail;
1202
1203 /* Remove all existing occurrences of the XXX-Authenticate header */
1204 ctx.blk = NULL;
1205 while (http_find_header(htx, hdr, &ctx, 1))
1206 http_remove_header(htx, &ctx);
1207
1208 /* Now a the right XXX-Authenticate header */
1209 if (!http_add_header(htx, hdr, ist2(b_orig(&trash), b_data(&trash))))
1210 goto fail;
1211
1212 /* Finally forward the reply */
1213 htx_to_buf(htx, &res->buf);
1214 if (!http_forward_proxy_resp(s, 1))
1215 goto fail;
1216
1217 /* Note: Only eval on the request */
1218 s->logs.tv_request = now;
1219 req->analysers &= AN_REQ_FLT_END;
1220
1221 if (s->sess->fe == s->be) /* report it if the request was intercepted by the frontend */
Willy Tarreau4781b152021-04-06 13:53:36 +02001222 _HA_ATOMIC_INC(&s->sess->fe->fe_counters.intercepted_req);
Christopher Fauletb3048832020-05-27 15:26:43 +02001223
1224 if (!(s->flags & SF_ERR_MASK))
1225 s->flags |= SF_ERR_LOCAL;
1226 if (!(s->flags & SF_FINST_MASK))
1227 s->flags |= SF_FINST_R;
1228
1229 stream_inc_http_err_ctr(s);
1230 return ACT_RET_ABRT;
1231
1232 fail:
1233 /* If an error occurred, remove the incomplete HTTP response from the
1234 * buffer */
1235 channel_htx_truncate(res, htx);
1236 return ACT_RET_ERR;
1237}
1238
Christopher Faulet81e20172019-12-12 16:40:30 +01001239/* Parse a "auth" action. It may take 2 optional arguments to define a "realm"
1240 * parameter. It returns ACT_RET_PRS_OK on success, ACT_RET_PRS_ERR on error.
1241 */
1242static enum act_parse_ret parse_http_auth(const char **args, int *orig_arg, struct proxy *px,
1243 struct act_rule *rule, char **err)
1244{
1245 int cur_arg;
1246
Christopher Fauletb3048832020-05-27 15:26:43 +02001247 rule->action = ACT_CUSTOM;
Christopher Faulet245cf792019-12-18 14:58:12 +01001248 rule->flags |= ACT_FLAG_FINAL;
Christopher Fauletb3048832020-05-27 15:26:43 +02001249 rule->action_ptr = http_action_auth;
Christopher Faulet2eb53962020-01-14 14:47:34 +01001250 rule->release_ptr = release_http_action;
Christopher Faulet81e20172019-12-12 16:40:30 +01001251
1252 cur_arg = *orig_arg;
Tim Duesterhuse5ff1412021-01-02 22:31:53 +01001253 if (strcmp(args[cur_arg], "realm") == 0) {
Christopher Faulet81e20172019-12-12 16:40:30 +01001254 cur_arg++;
1255 if (!*args[cur_arg]) {
1256 memprintf(err, "missing realm value.\n");
1257 return ACT_RET_PRS_ERR;
1258 }
Christopher Faulet96bff762019-12-17 13:46:18 +01001259 rule->arg.http.str.ptr = strdup(args[cur_arg]);
1260 rule->arg.http.str.len = strlen(rule->arg.http.str.ptr);
Christopher Faulet81e20172019-12-12 16:40:30 +01001261 cur_arg++;
1262 }
1263
Christopher Fauletc20b3712020-01-27 15:51:56 +01001264 LIST_INIT(&rule->arg.http.fmt);
Christopher Faulet81e20172019-12-12 16:40:30 +01001265 *orig_arg = cur_arg;
1266 return ACT_RET_PRS_OK;
1267}
1268
1269/* Parse a "set-nice" action. It takes the nice value as argument. It returns
1270 * ACT_RET_PRS_OK on success, ACT_RET_PRS_ERR on error.
1271 */
1272static enum act_parse_ret parse_http_set_nice(const char **args, int *orig_arg, struct proxy *px,
1273 struct act_rule *rule, char **err)
1274{
1275 int cur_arg;
1276
1277 rule->action = ACT_HTTP_SET_NICE;
1278
1279 cur_arg = *orig_arg;
1280 if (!*args[cur_arg]) {
1281 memprintf(err, "expects exactly 1 argument (integer value)");
1282 return ACT_RET_PRS_ERR;
1283 }
Christopher Faulet96bff762019-12-17 13:46:18 +01001284 rule->arg.http.i = atoi(args[cur_arg]);
1285 if (rule->arg.http.i < -1024)
1286 rule->arg.http.i = -1024;
1287 else if (rule->arg.http.i > 1024)
1288 rule->arg.http.i = 1024;
Christopher Faulet81e20172019-12-12 16:40:30 +01001289
Christopher Fauletc20b3712020-01-27 15:51:56 +01001290 LIST_INIT(&rule->arg.http.fmt);
Christopher Faulet81e20172019-12-12 16:40:30 +01001291 *orig_arg = cur_arg + 1;
1292 return ACT_RET_PRS_OK;
1293}
1294
1295/* Parse a "set-tos" action. It takes the TOS value as argument. It returns
1296 * ACT_RET_PRS_OK on success, ACT_RET_PRS_ERR on error.
1297 */
1298static enum act_parse_ret parse_http_set_tos(const char **args, int *orig_arg, struct proxy *px,
1299 struct act_rule *rule, char **err)
1300{
1301#ifdef IP_TOS
1302 char *endp;
1303 int cur_arg;
1304
1305 rule->action = ACT_HTTP_SET_TOS;
1306
1307 cur_arg = *orig_arg;
1308 if (!*args[cur_arg]) {
1309 memprintf(err, "expects exactly 1 argument (integer/hex value)");
1310 return ACT_RET_PRS_ERR;
1311 }
Christopher Faulet96bff762019-12-17 13:46:18 +01001312 rule->arg.http.i = strtol(args[cur_arg], &endp, 0);
Christopher Faulet81e20172019-12-12 16:40:30 +01001313 if (endp && *endp != '\0') {
1314 memprintf(err, "invalid character starting at '%s' (integer/hex value expected)", endp);
1315 return ACT_RET_PRS_ERR;
1316 }
1317
Christopher Fauletc20b3712020-01-27 15:51:56 +01001318 LIST_INIT(&rule->arg.http.fmt);
Christopher Faulet81e20172019-12-12 16:40:30 +01001319 *orig_arg = cur_arg + 1;
1320 return ACT_RET_PRS_OK;
1321#else
1322 memprintf(err, "not supported on this platform (IP_TOS undefined)");
1323 return ACT_RET_PRS_ERR;
1324#endif
1325}
1326
1327/* Parse a "set-mark" action. It takes the MARK value as argument. It returns
1328 * ACT_RET_PRS_OK on success, ACT_RET_PRS_ERR on error.
1329 */
1330static enum act_parse_ret parse_http_set_mark(const char **args, int *orig_arg, struct proxy *px,
1331 struct act_rule *rule, char **err)
1332{
1333#ifdef SO_MARK
1334 char *endp;
1335 int cur_arg;
1336
1337 rule->action = ACT_HTTP_SET_MARK;
1338
1339 cur_arg = *orig_arg;
1340 if (!*args[cur_arg]) {
1341 memprintf(err, "expects exactly 1 argument (integer/hex value)");
1342 return ACT_RET_PRS_ERR;
1343 }
Christopher Faulet96bff762019-12-17 13:46:18 +01001344 rule->arg.http.i = strtoul(args[cur_arg], &endp, 0);
Christopher Faulet81e20172019-12-12 16:40:30 +01001345 if (endp && *endp != '\0') {
1346 memprintf(err, "invalid character starting at '%s' (integer/hex value expected)", endp);
1347 return ACT_RET_PRS_ERR;
1348 }
1349
Christopher Fauletc20b3712020-01-27 15:51:56 +01001350 LIST_INIT(&rule->arg.http.fmt);
Christopher Faulet81e20172019-12-12 16:40:30 +01001351 *orig_arg = cur_arg + 1;
1352 global.last_checks |= LSTCHK_NETADM;
1353 return ACT_RET_PRS_OK;
1354#else
1355 memprintf(err, "not supported on this platform (SO_MARK undefined)");
1356 return ACT_RET_PRS_ERR;
1357#endif
1358}
1359
1360/* Parse a "set-log-level" action. It takes the level value as argument. It
1361 * returns ACT_RET_PRS_OK on success, ACT_RET_PRS_ERR on error.
1362 */
1363static enum act_parse_ret parse_http_set_log_level(const char **args, int *orig_arg, struct proxy *px,
1364 struct act_rule *rule, char **err)
1365{
1366 int cur_arg;
1367
1368 rule->action = ACT_HTTP_SET_LOGL;
1369
1370 cur_arg = *orig_arg;
1371 if (!*args[cur_arg]) {
1372 bad_log_level:
1373 memprintf(err, "expects exactly 1 argument (log level name or 'silent')");
1374 return ACT_RET_PRS_ERR;
1375 }
1376 if (strcmp(args[cur_arg], "silent") == 0)
Christopher Faulet96bff762019-12-17 13:46:18 +01001377 rule->arg.http.i = -1;
1378 else if ((rule->arg.http.i = get_log_level(args[cur_arg]) + 1) == 0)
Christopher Faulet81e20172019-12-12 16:40:30 +01001379 goto bad_log_level;
1380
Christopher Fauletc20b3712020-01-27 15:51:56 +01001381 LIST_INIT(&rule->arg.http.fmt);
Christopher Faulet81e20172019-12-12 16:40:30 +01001382 *orig_arg = cur_arg + 1;
1383 return ACT_RET_PRS_OK;
1384}
1385
Christopher Faulet91b3ec12020-01-17 22:30:06 +01001386/* This function executes a early-hint action. It adds an HTTP Early Hint HTTP
1387 * 103 response header with <.arg.http.str> name and with a value built
1388 * according to <.arg.http.fmt> log line format. If it is the first early-hint
Ilya Shipitsinc02a23f2020-05-06 00:53:22 +05001389 * rule of series, the 103 response start-line is added first. At the end, if
Christopher Faulet91b3ec12020-01-17 22:30:06 +01001390 * the next rule is not an early-hint rule or if it is the last rule, the EOH
1391 * block is added to terminate the response. On success, it returns
1392 * ACT_RET_CONT. If an error occurs while soft rewrites are enabled, the action
1393 * is canceled, but the rule processing continue. Otherwsize ACT_RET_ERR is
1394 * returned.
1395 */
1396static enum act_return http_action_early_hint(struct act_rule *rule, struct proxy *px,
1397 struct session *sess, struct stream *s, int flags)
1398{
1399 struct act_rule *prev_rule, *next_rule;
1400 struct channel *res = &s->res;
1401 struct htx *htx = htx_from_buf(&res->buf);
1402 struct buffer *value = alloc_trash_chunk();
1403 enum act_return ret = ACT_RET_CONT;
1404
1405 if (!(s->txn->req.flags & HTTP_MSGF_VER_11))
1406 goto leave;
1407
1408 if (!value) {
1409 if (!(s->flags & SF_ERR_MASK))
1410 s->flags |= SF_ERR_RESOURCE;
1411 goto error;
1412 }
1413
1414 /* get previous and next rules */
1415 prev_rule = LIST_PREV(&rule->list, typeof(rule), list);
1416 next_rule = LIST_NEXT(&rule->list, typeof(rule), list);
1417
1418 /* if no previous rule or previous rule is not early-hint, start a new response. Otherwise,
1419 * continue to add link to a previously started response */
1420 if (&prev_rule->list == s->current_rule_list || prev_rule->action_ptr != http_action_early_hint) {
1421 struct htx_sl *sl;
1422 unsigned int flags = (HTX_SL_F_IS_RESP|HTX_SL_F_VER_11|
1423 HTX_SL_F_XFER_LEN|HTX_SL_F_BODYLESS);
1424
1425 sl = htx_add_stline(htx, HTX_BLK_RES_SL, flags,
1426 ist("HTTP/1.1"), ist("103"), ist("Early Hints"));
1427 if (!sl)
1428 goto error;
1429 sl->info.res.status = 103;
1430 }
1431
1432 /* Add the HTTP Early Hint HTTP 103 response heade */
1433 value->data = build_logline(s, b_tail(value), b_room(value), &rule->arg.http.fmt);
1434 if (!htx_add_header(htx, rule->arg.http.str, ist2(b_head(value), b_data(value))))
1435 goto error;
1436
1437 /* if it is the last rule or the next one is not an early-hint, terminate the current
1438 * response. */
1439 if (&next_rule->list == s->current_rule_list || next_rule->action_ptr != http_action_early_hint) {
Christopher Faulet91b3ec12020-01-17 22:30:06 +01001440 if (!htx_add_endof(htx, HTX_BLK_EOH)) {
1441 /* If an error occurred during an Early-hint rule,
1442 * remove the incomplete HTTP 103 response from the
1443 * buffer */
1444 goto error;
1445 }
1446
Christopher Fauleta72a7e42020-01-28 09:28:11 +01001447 if (!http_forward_proxy_resp(s, 0))
1448 goto error;
Christopher Faulet91b3ec12020-01-17 22:30:06 +01001449 }
1450
1451 leave:
1452 free_trash_chunk(value);
1453 return ret;
1454
1455 error:
1456 /* If an error occurred during an Early-hint rule, remove the incomplete
1457 * HTTP 103 response from the buffer */
1458 channel_htx_truncate(res, htx);
1459 ret = ACT_RET_ERR;
1460 goto leave;
1461}
1462
Christopher Fauletd1f27e32019-12-17 09:33:38 +01001463/* This function executes a set-header or add-header actions. It builds a string
1464 * in the trash from the specified format string. It finds the action to be
1465 * performed in <.action>, previously filled by function parse_set_header(). The
Ilya Shipitsinc02a23f2020-05-06 00:53:22 +05001466 * replacement action is executed by the function http_action_set_header(). On
Christopher Fauletd1f27e32019-12-17 09:33:38 +01001467 * success, it returns ACT_RET_CONT. If an error occurs while soft rewrites are
1468 * enabled, the action is canceled, but the rule processing continue. Otherwsize
1469 * ACT_RET_ERR is returned.
1470 */
1471static enum act_return http_action_set_header(struct act_rule *rule, struct proxy *px,
1472 struct session *sess, struct stream *s, int flags)
1473{
Christopher Faulet91e31d82020-01-24 15:37:13 +01001474 struct http_msg *msg = ((rule->from == ACT_F_HTTP_REQ) ? &s->txn->req : &s->txn->rsp);
1475 struct htx *htx = htxbuf(&msg->chn->buf);
Christopher Fauletd1f27e32019-12-17 09:33:38 +01001476 enum act_return ret = ACT_RET_CONT;
1477 struct buffer *replace;
1478 struct http_hdr_ctx ctx;
1479 struct ist n, v;
1480
1481 replace = alloc_trash_chunk();
1482 if (!replace)
1483 goto fail_alloc;
1484
1485 replace->data = build_logline(s, replace->area, replace->size, &rule->arg.http.fmt);
1486 n = rule->arg.http.str;
1487 v = ist2(replace->area, replace->data);
1488
1489 if (rule->action == 0) { // set-header
1490 /* remove all occurrences of the header */
1491 ctx.blk = NULL;
1492 while (http_find_header(htx, n, &ctx, 1))
1493 http_remove_header(htx, &ctx);
1494 }
1495
1496 /* Now add header */
1497 if (!http_add_header(htx, n, v))
1498 goto fail_rewrite;
1499
1500 leave:
1501 free_trash_chunk(replace);
1502 return ret;
1503
1504 fail_alloc:
1505 if (!(s->flags & SF_ERR_MASK))
1506 s->flags |= SF_ERR_RESOURCE;
1507 ret = ACT_RET_ERR;
1508 goto leave;
1509
1510 fail_rewrite:
Willy Tarreau4781b152021-04-06 13:53:36 +02001511 _HA_ATOMIC_INC(&sess->fe->fe_counters.failed_rewrites);
Christopher Fauletd1f27e32019-12-17 09:33:38 +01001512 if (s->flags & SF_BE_ASSIGNED)
Willy Tarreau4781b152021-04-06 13:53:36 +02001513 _HA_ATOMIC_INC(&s->be->be_counters.failed_rewrites);
William Lallemand36119de2021-03-08 15:26:48 +01001514 if (sess->listener && sess->listener->counters)
Willy Tarreau4781b152021-04-06 13:53:36 +02001515 _HA_ATOMIC_INC(&sess->listener->counters->failed_rewrites);
Christopher Fauletd1f27e32019-12-17 09:33:38 +01001516 if (objt_server(s->target))
Willy Tarreau4781b152021-04-06 13:53:36 +02001517 _HA_ATOMIC_INC(&__objt_server(s->target)->counters.failed_rewrites);
Christopher Fauletd1f27e32019-12-17 09:33:38 +01001518
Christopher Faulet333bf8c2020-01-22 14:38:05 +01001519 if (!(msg->flags & HTTP_MSGF_SOFT_RW)) {
Christopher Fauletd1f27e32019-12-17 09:33:38 +01001520 ret = ACT_RET_ERR;
Christopher Faulet333bf8c2020-01-22 14:38:05 +01001521 if (!(s->flags & SF_ERR_MASK))
1522 s->flags |= SF_ERR_PRXCOND;
1523 }
Christopher Fauletd1f27e32019-12-17 09:33:38 +01001524 goto leave;
1525}
1526
Christopher Faulet81e20172019-12-12 16:40:30 +01001527/* Parse a "set-header", "add-header" or "early-hint" actions. It takes an
1528 * header name and a log-format string as arguments. It returns ACT_RET_PRS_OK
1529 * on success, ACT_RET_PRS_ERR on error.
1530 *
1531 * Note: same function is used for the request and the response. However
1532 * "early-hint" rules are only supported for request rules.
1533 */
1534static enum act_parse_ret parse_http_set_header(const char **args, int *orig_arg, struct proxy *px,
1535 struct act_rule *rule, char **err)
1536{
Christopher Faulet81e20172019-12-12 16:40:30 +01001537 int cap, cur_arg;
1538
Christopher Faulet91b3ec12020-01-17 22:30:06 +01001539 if (args[*orig_arg-1][0] == 'e') {
1540 rule->action = ACT_CUSTOM;
1541 rule->action_ptr = http_action_early_hint;
1542 }
Christopher Fauletd1f27e32019-12-17 09:33:38 +01001543 else {
1544 if (args[*orig_arg-1][0] == 's')
1545 rule->action = 0; // set-header
1546 else
1547 rule->action = 1; // add-header
1548 rule->action_ptr = http_action_set_header;
1549 }
Christopher Faulet2eb53962020-01-14 14:47:34 +01001550 rule->release_ptr = release_http_action;
Christopher Faulet81e20172019-12-12 16:40:30 +01001551
1552 cur_arg = *orig_arg;
1553 if (!*args[cur_arg] || !*args[cur_arg+1]) {
1554 memprintf(err, "expects exactly 2 arguments");
1555 return ACT_RET_PRS_ERR;
1556 }
1557
Christopher Faulet81e20172019-12-12 16:40:30 +01001558
Christopher Faulet96bff762019-12-17 13:46:18 +01001559 rule->arg.http.str.ptr = strdup(args[cur_arg]);
1560 rule->arg.http.str.len = strlen(rule->arg.http.str.ptr);
1561 LIST_INIT(&rule->arg.http.fmt);
Christopher Faulet81e20172019-12-12 16:40:30 +01001562
1563 if (rule->from == ACT_F_HTTP_REQ) {
1564 px->conf.args.ctx = ARGC_HRQ;
1565 cap = (px->cap & PR_CAP_FE) ? SMP_VAL_FE_HRQ_HDR : SMP_VAL_BE_HRQ_HDR;
1566 }
1567 else{
1568 px->conf.args.ctx = ARGC_HRS;
1569 cap = (px->cap & PR_CAP_BE) ? SMP_VAL_BE_HRS_HDR : SMP_VAL_FE_HRS_HDR;
1570 }
1571
1572 cur_arg++;
Christopher Faulet1337b322020-01-14 14:50:55 +01001573 if (!parse_logformat_string(args[cur_arg], px, &rule->arg.http.fmt, LOG_OPT_HTTP, cap, err)) {
Tim Duesterhused526372020-03-05 17:56:33 +01001574 istfree(&rule->arg.http.str);
Christopher Faulet81e20172019-12-12 16:40:30 +01001575 return ACT_RET_PRS_ERR;
Christopher Faulet1337b322020-01-14 14:50:55 +01001576 }
Christopher Faulet81e20172019-12-12 16:40:30 +01001577
1578 free(px->conf.lfs_file);
1579 px->conf.lfs_file = strdup(px->conf.args.file);
1580 px->conf.lfs_line = px->conf.args.line;
1581
1582 *orig_arg = cur_arg + 1;
1583 return ACT_RET_PRS_OK;
1584}
1585
Christopher Faulet92d34fe2019-12-17 09:20:34 +01001586/* This function executes a replace-header or replace-value actions. It
1587 * builds a string in the trash from the specified format string. It finds
1588 * the action to be performed in <.action>, previously filled by function
Ilya Shipitsinc02a23f2020-05-06 00:53:22 +05001589 * parse_replace_header(). The replacement action is executed by the function
Christopher Faulet92d34fe2019-12-17 09:20:34 +01001590 * http_action_replace_header(). On success, it returns ACT_RET_CONT. If an error
1591 * occurs while soft rewrites are enabled, the action is canceled, but the rule
1592 * processing continue. Otherwsize ACT_RET_ERR is returned.
1593 */
1594static enum act_return http_action_replace_header(struct act_rule *rule, struct proxy *px,
1595 struct session *sess, struct stream *s, int flags)
1596{
Christopher Faulet91e31d82020-01-24 15:37:13 +01001597 struct http_msg *msg = ((rule->from == ACT_F_HTTP_REQ) ? &s->txn->req : &s->txn->rsp);
1598 struct htx *htx = htxbuf(&msg->chn->buf);
Christopher Faulet92d34fe2019-12-17 09:20:34 +01001599 enum act_return ret = ACT_RET_CONT;
1600 struct buffer *replace;
1601 int r;
1602
1603 replace = alloc_trash_chunk();
1604 if (!replace)
1605 goto fail_alloc;
1606
1607 replace->data = build_logline(s, replace->area, replace->size, &rule->arg.http.fmt);
1608
1609 r = http_replace_hdrs(s, htx, rule->arg.http.str, replace->area, rule->arg.http.re, (rule->action == 0));
1610 if (r == -1)
1611 goto fail_rewrite;
1612
1613 leave:
1614 free_trash_chunk(replace);
1615 return ret;
1616
1617 fail_alloc:
1618 if (!(s->flags & SF_ERR_MASK))
1619 s->flags |= SF_ERR_RESOURCE;
1620 ret = ACT_RET_ERR;
1621 goto leave;
1622
1623 fail_rewrite:
Willy Tarreau4781b152021-04-06 13:53:36 +02001624 _HA_ATOMIC_INC(&sess->fe->fe_counters.failed_rewrites);
Christopher Faulet92d34fe2019-12-17 09:20:34 +01001625 if (s->flags & SF_BE_ASSIGNED)
Willy Tarreau4781b152021-04-06 13:53:36 +02001626 _HA_ATOMIC_INC(&s->be->be_counters.failed_rewrites);
William Lallemand36119de2021-03-08 15:26:48 +01001627 if (sess->listener && sess->listener->counters)
Willy Tarreau4781b152021-04-06 13:53:36 +02001628 _HA_ATOMIC_INC(&sess->listener->counters->failed_rewrites);
Christopher Faulet92d34fe2019-12-17 09:20:34 +01001629 if (objt_server(s->target))
Willy Tarreau4781b152021-04-06 13:53:36 +02001630 _HA_ATOMIC_INC(&__objt_server(s->target)->counters.failed_rewrites);
Christopher Faulet92d34fe2019-12-17 09:20:34 +01001631
Christopher Faulet333bf8c2020-01-22 14:38:05 +01001632 if (!(msg->flags & HTTP_MSGF_SOFT_RW)) {
Christopher Faulet92d34fe2019-12-17 09:20:34 +01001633 ret = ACT_RET_ERR;
Christopher Faulet333bf8c2020-01-22 14:38:05 +01001634 if (!(s->flags & SF_ERR_MASK))
1635 s->flags |= SF_ERR_PRXCOND;
1636 }
Christopher Faulet92d34fe2019-12-17 09:20:34 +01001637 goto leave;
1638}
1639
Christopher Faulet81e20172019-12-12 16:40:30 +01001640/* Parse a "replace-header" or "replace-value" actions. It takes an header name,
1641 * a regex and replacement string as arguments. It returns ACT_RET_PRS_OK on
1642 * success, ACT_RET_PRS_ERR on error.
1643 */
1644static enum act_parse_ret parse_http_replace_header(const char **args, int *orig_arg, struct proxy *px,
1645 struct act_rule *rule, char **err)
1646{
1647 int cap, cur_arg;
1648
Christopher Faulet92d34fe2019-12-17 09:20:34 +01001649 if (args[*orig_arg-1][8] == 'h')
1650 rule->action = 0; // replace-header
1651 else
1652 rule->action = 1; // replace-value
1653 rule->action_ptr = http_action_replace_header;
Christopher Faulet2eb53962020-01-14 14:47:34 +01001654 rule->release_ptr = release_http_action;
Christopher Faulet81e20172019-12-12 16:40:30 +01001655
1656 cur_arg = *orig_arg;
1657 if (!*args[cur_arg] || !*args[cur_arg+1] || !*args[cur_arg+2]) {
1658 memprintf(err, "expects exactly 3 arguments");
1659 return ACT_RET_PRS_ERR;
1660 }
1661
Christopher Faulet96bff762019-12-17 13:46:18 +01001662 rule->arg.http.str.ptr = strdup(args[cur_arg]);
1663 rule->arg.http.str.len = strlen(rule->arg.http.str.ptr);
1664 LIST_INIT(&rule->arg.http.fmt);
Christopher Faulet81e20172019-12-12 16:40:30 +01001665
1666 cur_arg++;
Christopher Faulet1337b322020-01-14 14:50:55 +01001667 if (!(rule->arg.http.re = regex_comp(args[cur_arg], 1, 1, err))) {
Tim Duesterhused526372020-03-05 17:56:33 +01001668 istfree(&rule->arg.http.str);
Christopher Faulet81e20172019-12-12 16:40:30 +01001669 return ACT_RET_PRS_ERR;
Christopher Faulet1337b322020-01-14 14:50:55 +01001670 }
Christopher Faulet81e20172019-12-12 16:40:30 +01001671
1672 if (rule->from == ACT_F_HTTP_REQ) {
1673 px->conf.args.ctx = ARGC_HRQ;
1674 cap = (px->cap & PR_CAP_FE) ? SMP_VAL_FE_HRQ_HDR : SMP_VAL_BE_HRQ_HDR;
1675 }
1676 else{
1677 px->conf.args.ctx = ARGC_HRS;
1678 cap = (px->cap & PR_CAP_BE) ? SMP_VAL_BE_HRS_HDR : SMP_VAL_FE_HRS_HDR;
1679 }
1680
1681 cur_arg++;
Christopher Faulet1337b322020-01-14 14:50:55 +01001682 if (!parse_logformat_string(args[cur_arg], px, &rule->arg.http.fmt, LOG_OPT_HTTP, cap, err)) {
Tim Duesterhused526372020-03-05 17:56:33 +01001683 istfree(&rule->arg.http.str);
Christopher Faulet1337b322020-01-14 14:50:55 +01001684 regex_free(rule->arg.http.re);
Christopher Faulet81e20172019-12-12 16:40:30 +01001685 return ACT_RET_PRS_ERR;
Christopher Faulet1337b322020-01-14 14:50:55 +01001686 }
Christopher Faulet81e20172019-12-12 16:40:30 +01001687
1688 free(px->conf.lfs_file);
1689 px->conf.lfs_file = strdup(px->conf.args.file);
1690 px->conf.lfs_line = px->conf.args.line;
1691
1692 *orig_arg = cur_arg + 1;
1693 return ACT_RET_PRS_OK;
1694}
1695
Maciej Zdebebdd4c52020-11-20 13:58:48 +00001696/* This function executes a del-header action with selected matching mode for
1697 * header name. It finds the matching method to be performed in <.action>, previously
1698 * filled by function parse_http_del_header(). On success, it returns ACT_RET_CONT.
1699 * Otherwise ACT_RET_ERR is returned.
1700 */
1701static enum act_return http_action_del_header(struct act_rule *rule, struct proxy *px,
1702 struct session *sess, struct stream *s, int flags)
1703{
1704 struct http_hdr_ctx ctx;
1705 struct http_msg *msg = ((rule->from == ACT_F_HTTP_REQ) ? &s->txn->req : &s->txn->rsp);
1706 struct htx *htx = htxbuf(&msg->chn->buf);
1707 enum act_return ret = ACT_RET_CONT;
1708
1709 /* remove all occurrences of the header */
1710 ctx.blk = NULL;
1711 switch (rule->action) {
1712 case PAT_MATCH_STR:
1713 while (http_find_header(htx, rule->arg.http.str, &ctx, 1))
1714 http_remove_header(htx, &ctx);
1715 break;
1716 case PAT_MATCH_BEG:
1717 while (http_find_pfx_header(htx, rule->arg.http.str, &ctx, 1))
1718 http_remove_header(htx, &ctx);
1719 break;
1720 case PAT_MATCH_END:
1721 while (http_find_sfx_header(htx, rule->arg.http.str, &ctx, 1))
1722 http_remove_header(htx, &ctx);
1723 break;
1724 case PAT_MATCH_SUB:
1725 while (http_find_sub_header(htx, rule->arg.http.str, &ctx, 1))
1726 http_remove_header(htx, &ctx);
1727 break;
1728 case PAT_MATCH_REG:
1729 while (http_match_header(htx, rule->arg.http.re, &ctx, 1))
1730 http_remove_header(htx, &ctx);
1731 break;
1732 default:
1733 return ACT_RET_ERR;
1734 }
1735 return ret;
1736}
1737
1738/* Parse a "del-header" action. It takes string as a required argument,
1739 * optional flag (currently only -m) and optional matching method of input string
1740 * with header name to be deleted. Default matching method is exact match (-m str).
1741 * It returns ACT_RET_PRS_OK on success, ACT_RET_PRS_ERR on error.
Christopher Faulet81e20172019-12-12 16:40:30 +01001742 */
1743static enum act_parse_ret parse_http_del_header(const char **args, int *orig_arg, struct proxy *px,
1744 struct act_rule *rule, char **err)
1745{
1746 int cur_arg;
Maciej Zdebebdd4c52020-11-20 13:58:48 +00001747 int pat_idx;
Christopher Faulet81e20172019-12-12 16:40:30 +01001748
Maciej Zdebebdd4c52020-11-20 13:58:48 +00001749 /* set exact matching (-m str) as default */
1750 rule->action = PAT_MATCH_STR;
1751 rule->action_ptr = http_action_del_header;
Christopher Faulet2eb53962020-01-14 14:47:34 +01001752 rule->release_ptr = release_http_action;
Christopher Faulet81e20172019-12-12 16:40:30 +01001753
1754 cur_arg = *orig_arg;
1755 if (!*args[cur_arg]) {
Maciej Zdebebdd4c52020-11-20 13:58:48 +00001756 memprintf(err, "expects at least 1 argument");
Christopher Faulet81e20172019-12-12 16:40:30 +01001757 return ACT_RET_PRS_ERR;
1758 }
1759
Christopher Faulet96bff762019-12-17 13:46:18 +01001760 rule->arg.http.str.ptr = strdup(args[cur_arg]);
1761 rule->arg.http.str.len = strlen(rule->arg.http.str.ptr);
Christopher Faulet81e20172019-12-12 16:40:30 +01001762 px->conf.args.ctx = (rule->from == ACT_F_HTTP_REQ ? ARGC_HRQ : ARGC_HRS);
1763
Maciej Zdeb6dee9962020-11-23 16:03:09 +00001764 LIST_INIT(&rule->arg.http.fmt);
Maciej Zdebebdd4c52020-11-20 13:58:48 +00001765 if (strcmp(args[cur_arg+1], "-m") == 0) {
1766 cur_arg++;
1767 if (!*args[cur_arg+1]) {
1768 memprintf(err, "-m flag expects exactly 1 argument");
1769 return ACT_RET_PRS_ERR;
1770 }
1771
1772 cur_arg++;
1773 pat_idx = pat_find_match_name(args[cur_arg]);
1774 switch (pat_idx) {
1775 case PAT_MATCH_REG:
1776 if (!(rule->arg.http.re = regex_comp(rule->arg.http.str.ptr, 1, 1, err)))
1777 return ACT_RET_PRS_ERR;
1778 /* fall through */
1779 case PAT_MATCH_STR:
1780 case PAT_MATCH_BEG:
1781 case PAT_MATCH_END:
1782 case PAT_MATCH_SUB:
1783 rule->action = pat_idx;
1784 break;
1785 default:
1786 memprintf(err, "-m with unsupported matching method '%s'", args[cur_arg]);
1787 return ACT_RET_PRS_ERR;
1788 }
1789 }
1790
Christopher Faulet81e20172019-12-12 16:40:30 +01001791 *orig_arg = cur_arg + 1;
1792 return ACT_RET_PRS_OK;
1793}
1794
Christopher Faulet2eb53962020-01-14 14:47:34 +01001795/* Release memory allocated by an http redirect action. */
1796static void release_http_redir(struct act_rule *rule)
1797{
1798 struct logformat_node *lf, *lfb;
1799 struct redirect_rule *redir;
1800
1801 redir = rule->arg.redir;
Willy Tarreau2b718102021-04-21 07:32:39 +02001802 LIST_DELETE(&redir->list);
Christopher Faulet2eb53962020-01-14 14:47:34 +01001803 if (redir->cond) {
1804 prune_acl_cond(redir->cond);
1805 free(redir->cond);
1806 }
1807 free(redir->rdr_str);
1808 free(redir->cookie_str);
1809 list_for_each_entry_safe(lf, lfb, &redir->rdr_fmt, list) {
Willy Tarreau2b718102021-04-21 07:32:39 +02001810 LIST_DELETE(&lf->list);
Christopher Faulet2eb53962020-01-14 14:47:34 +01001811 free(lf);
1812 }
1813 free(redir);
1814}
1815
Christopher Faulet81e20172019-12-12 16:40:30 +01001816/* Parse a "redirect" action. It returns ACT_RET_PRS_OK on success,
1817 * ACT_RET_PRS_ERR on error.
1818 */
1819static enum act_parse_ret parse_http_redirect(const char **args, int *orig_arg, struct proxy *px,
1820 struct act_rule *rule, char **err)
1821{
1822 struct redirect_rule *redir;
1823 int dir, cur_arg;
1824
1825 rule->action = ACT_HTTP_REDIR;
Christopher Faulet245cf792019-12-18 14:58:12 +01001826 rule->flags |= ACT_FLAG_FINAL;
Christopher Faulet2eb53962020-01-14 14:47:34 +01001827 rule->release_ptr = release_http_redir;
Christopher Faulet81e20172019-12-12 16:40:30 +01001828
1829 cur_arg = *orig_arg;
1830
1831 dir = (rule->from == ACT_F_HTTP_REQ ? 0 : 1);
1832 if ((redir = http_parse_redirect_rule(px->conf.args.file, px->conf.args.line, px, &args[cur_arg], err, 1, dir)) == NULL)
1833 return ACT_RET_PRS_ERR;
1834
1835 rule->arg.redir = redir;
1836 rule->cond = redir->cond;
1837 redir->cond = NULL;
1838
1839 /* skip all arguments */
1840 while (*args[cur_arg])
1841 cur_arg++;
1842
1843 *orig_arg = cur_arg;
1844 return ACT_RET_PRS_OK;
1845}
1846
Christopher Faulet046cf442019-12-17 15:45:23 +01001847/* This function executes a add-acl, del-acl, set-map or del-map actions. On
1848 * success, it returns ACT_RET_CONT. Otherwsize ACT_RET_ERR is returned.
1849 */
1850static enum act_return http_action_set_map(struct act_rule *rule, struct proxy *px,
1851 struct session *sess, struct stream *s, int flags)
1852{
1853 struct pat_ref *ref;
1854 struct buffer *key = NULL, *value = NULL;
1855 enum act_return ret = ACT_RET_CONT;
1856
1857 /* collect reference */
1858 ref = pat_ref_lookup(rule->arg.map.ref);
1859 if (!ref)
1860 goto leave;
1861
1862 /* allocate key */
1863 key = alloc_trash_chunk();
1864 if (!key)
1865 goto fail_alloc;
1866
1867 /* collect key */
1868 key->data = build_logline(s, key->area, key->size, &rule->arg.map.key);
1869 key->area[key->data] = '\0';
1870
1871 switch (rule->action) {
1872 case 0: // add-acl
1873 /* add entry only if it does not already exist */
1874 HA_SPIN_LOCK(PATREF_LOCK, &ref->lock);
1875 if (pat_ref_find_elt(ref, key->area) == NULL)
1876 pat_ref_add(ref, key->area, NULL, NULL);
1877 HA_SPIN_UNLOCK(PATREF_LOCK, &ref->lock);
1878 break;
1879
1880 case 1: // set-map
1881 /* allocate value */
1882 value = alloc_trash_chunk();
1883 if (!value)
1884 goto fail_alloc;
1885
1886 /* collect value */
1887 value->data = build_logline(s, value->area, value->size, &rule->arg.map.value);
1888 value->area[value->data] = '\0';
1889
1890 HA_SPIN_LOCK(PATREF_LOCK, &ref->lock);
1891 if (pat_ref_find_elt(ref, key->area) != NULL) {
1892 /* update entry if it exists */
1893 pat_ref_set(ref, key->area, value->area, NULL);
1894 }
1895 else {
1896 /* insert a new entry */
1897 pat_ref_add(ref, key->area, value->area, NULL);
1898 }
1899 HA_SPIN_UNLOCK(PATREF_LOCK, &ref->lock);
1900 break;
1901
1902 case 2: // del-acl
1903 case 3: // del-map
1904 /* returned code: 1=ok, 0=ko */
1905 HA_SPIN_LOCK(PATREF_LOCK, &ref->lock);
1906 pat_ref_delete(ref, key->area);
1907 HA_SPIN_UNLOCK(PATREF_LOCK, &ref->lock);
1908 break;
1909
1910 default:
1911 ret = ACT_RET_ERR;
1912 }
1913
1914
1915 leave:
1916 free_trash_chunk(key);
1917 free_trash_chunk(value);
1918 return ret;
1919
1920 fail_alloc:
1921 if (!(s->flags & SF_ERR_MASK))
1922 s->flags |= SF_ERR_RESOURCE;
1923 ret = ACT_RET_ERR;
1924 goto leave;
1925}
1926
Christopher Faulet2eb53962020-01-14 14:47:34 +01001927/* Release memory allocated by an http map/acl action. */
1928static void release_http_map(struct act_rule *rule)
1929{
1930 struct logformat_node *lf, *lfb;
1931
1932 free(rule->arg.map.ref);
1933 list_for_each_entry_safe(lf, lfb, &rule->arg.map.key, list) {
Willy Tarreau2b718102021-04-21 07:32:39 +02001934 LIST_DELETE(&lf->list);
Christopher Faulet2eb53962020-01-14 14:47:34 +01001935 release_sample_expr(lf->expr);
1936 free(lf->arg);
1937 free(lf);
1938 }
1939 if (rule->action == 1) {
1940 list_for_each_entry_safe(lf, lfb, &rule->arg.map.value, list) {
Willy Tarreau2b718102021-04-21 07:32:39 +02001941 LIST_DELETE(&lf->list);
Christopher Faulet2eb53962020-01-14 14:47:34 +01001942 release_sample_expr(lf->expr);
1943 free(lf->arg);
1944 free(lf);
1945 }
1946 }
1947}
1948
Christopher Faulet81e20172019-12-12 16:40:30 +01001949/* Parse a "add-acl", "del-acl", "set-map" or "del-map" actions. It takes one or
Christopher Faulet046cf442019-12-17 15:45:23 +01001950 * two log-format string as argument depending on the action. The action is
1951 * stored in <.action> as an int (0=add-acl, 1=set-map, 2=del-acl,
1952 * 3=del-map). It returns ACT_RET_PRS_OK on success, ACT_RET_PRS_ERR on error.
Christopher Faulet81e20172019-12-12 16:40:30 +01001953 */
1954static enum act_parse_ret parse_http_set_map(const char **args, int *orig_arg, struct proxy *px,
1955 struct act_rule *rule, char **err)
1956{
1957 int cap, cur_arg;
1958
Christopher Faulet046cf442019-12-17 15:45:23 +01001959 if (args[*orig_arg-1][0] == 'a') // add-acl
1960 rule->action = 0;
1961 else if (args[*orig_arg-1][0] == 's') // set-map
1962 rule->action = 1;
1963 else if (args[*orig_arg-1][4] == 'a') // del-acl
1964 rule->action = 2;
1965 else if (args[*orig_arg-1][4] == 'm') // del-map
1966 rule->action = 3;
1967 else {
1968 memprintf(err, "internal error: unhandled action '%s'", args[0]);
1969 return ACT_RET_PRS_ERR;
1970 }
1971 rule->action_ptr = http_action_set_map;
Christopher Faulet2eb53962020-01-14 14:47:34 +01001972 rule->release_ptr = release_http_map;
Christopher Faulet81e20172019-12-12 16:40:30 +01001973
1974 cur_arg = *orig_arg;
Christopher Faulet046cf442019-12-17 15:45:23 +01001975 if (rule->action == 1 && (!*args[cur_arg] || !*args[cur_arg+1])) {
1976 /* 2 args for set-map */
Christopher Faulet81e20172019-12-12 16:40:30 +01001977 memprintf(err, "expects exactly 2 arguments");
1978 return ACT_RET_PRS_ERR;
1979 }
1980 else if (!*args[cur_arg]) {
Christopher Faulet046cf442019-12-17 15:45:23 +01001981 /* only one arg for other actions */
Christopher Faulet81e20172019-12-12 16:40:30 +01001982 memprintf(err, "expects exactly 1 arguments");
1983 return ACT_RET_PRS_ERR;
1984 }
1985
1986 /*
1987 * '+ 8' for 'set-map(' (same for del-map)
1988 * '- 9' for 'set-map(' + trailing ')' (same for del-map)
1989 */
1990 rule->arg.map.ref = my_strndup(args[cur_arg-1] + 8, strlen(args[cur_arg-1]) - 9);
1991
1992 if (rule->from == ACT_F_HTTP_REQ) {
1993 px->conf.args.ctx = ARGC_HRQ;
1994 cap = (px->cap & PR_CAP_FE) ? SMP_VAL_FE_HRQ_HDR : SMP_VAL_BE_HRQ_HDR;
1995 }
1996 else{
1997 px->conf.args.ctx = ARGC_HRS;
1998 cap = (px->cap & PR_CAP_BE) ? SMP_VAL_BE_HRS_HDR : SMP_VAL_FE_HRS_HDR;
1999 }
2000
2001 /* key pattern */
2002 LIST_INIT(&rule->arg.map.key);
Christopher Faulet1337b322020-01-14 14:50:55 +01002003 if (!parse_logformat_string(args[cur_arg], px, &rule->arg.map.key, LOG_OPT_HTTP, cap, err)) {
2004 free(rule->arg.map.ref);
Christopher Faulet81e20172019-12-12 16:40:30 +01002005 return ACT_RET_PRS_ERR;
Christopher Faulet1337b322020-01-14 14:50:55 +01002006 }
Christopher Faulet81e20172019-12-12 16:40:30 +01002007
Christopher Faulet046cf442019-12-17 15:45:23 +01002008 if (rule->action == 1) {
Christopher Faulet81e20172019-12-12 16:40:30 +01002009 /* value pattern for set-map only */
2010 cur_arg++;
2011 LIST_INIT(&rule->arg.map.value);
Christopher Faulet1337b322020-01-14 14:50:55 +01002012 if (!parse_logformat_string(args[cur_arg], px, &rule->arg.map.value, LOG_OPT_HTTP, cap, err)) {
2013 free(rule->arg.map.ref);
Christopher Faulet81e20172019-12-12 16:40:30 +01002014 return ACT_RET_PRS_ERR;
Christopher Faulet1337b322020-01-14 14:50:55 +01002015 }
Christopher Faulet81e20172019-12-12 16:40:30 +01002016 }
2017
2018 free(px->conf.lfs_file);
2019 px->conf.lfs_file = strdup(px->conf.args.file);
2020 px->conf.lfs_line = px->conf.args.line;
2021
2022 *orig_arg = cur_arg + 1;
2023 return ACT_RET_PRS_OK;
2024}
2025
Christopher Fauletac98d812019-12-18 09:20:16 +01002026/* This function executes a track-sc* actions. On success, it returns
2027 * ACT_RET_CONT. Otherwsize ACT_RET_ERR is returned.
2028 */
2029static enum act_return http_action_track_sc(struct act_rule *rule, struct proxy *px,
2030 struct session *sess, struct stream *s, int flags)
2031{
2032 struct stktable *t;
2033 struct stksess *ts;
2034 struct stktable_key *key;
Willy Tarreau826f3ab2021-02-10 12:07:15 +01002035 void *ptr1, *ptr2, *ptr3, *ptr4, *ptr5, *ptr6;
Christopher Fauletac98d812019-12-18 09:20:16 +01002036 int opt;
2037
Willy Tarreau826f3ab2021-02-10 12:07:15 +01002038 ptr1 = ptr2 = ptr3 = ptr4 = ptr5 = ptr6 = NULL;
Christopher Fauletac98d812019-12-18 09:20:16 +01002039 opt = ((rule->from == ACT_F_HTTP_REQ) ? SMP_OPT_DIR_REQ : SMP_OPT_DIR_RES) | SMP_OPT_FINAL;
2040
2041 t = rule->arg.trk_ctr.table.t;
Emeric Brun362d25e2021-03-10 16:58:03 +01002042
2043 if (stkctr_entry(&s->stkctr[rule->action]))
2044 goto end;
2045
Christopher Fauletac98d812019-12-18 09:20:16 +01002046 key = stktable_fetch_key(t, s->be, sess, s, opt, rule->arg.trk_ctr.expr, NULL);
2047
2048 if (!key)
2049 goto end;
2050 ts = stktable_get_entry(t, key);
2051 if (!ts)
2052 goto end;
2053
2054 stream_track_stkctr(&s->stkctr[rule->action], t, ts);
2055
2056 /* let's count a new HTTP request as it's the first time we do it */
2057 ptr1 = stktable_data_ptr(t, ts, STKTABLE_DT_HTTP_REQ_CNT);
2058 ptr2 = stktable_data_ptr(t, ts, STKTABLE_DT_HTTP_REQ_RATE);
2059
2060 /* When the client triggers a 4xx from the server, it's most often due
2061 * to a missing object or permission. These events should be tracked
2062 * because if they happen often, it may indicate a brute force or a
2063 * vulnerability scan. Normally this is done when receiving the response
2064 * but here we're tracking after this ought to have been done so we have
2065 * to do it on purpose.
2066 */
2067 if (rule->from == ACT_F_HTTP_RES && (unsigned)(s->txn->status - 400) < 100) {
2068 ptr3 = stktable_data_ptr(t, ts, STKTABLE_DT_HTTP_ERR_CNT);
2069 ptr4 = stktable_data_ptr(t, ts, STKTABLE_DT_HTTP_ERR_RATE);
2070 }
2071
Willy Tarreau826f3ab2021-02-10 12:07:15 +01002072 if (rule->from == ACT_F_HTTP_RES && (unsigned)(s->txn->status - 500) < 100 &&
2073 s->txn->status != 501 && s->txn->status != 505) {
2074 ptr5 = stktable_data_ptr(t, ts, STKTABLE_DT_HTTP_FAIL_CNT);
2075 ptr6 = stktable_data_ptr(t, ts, STKTABLE_DT_HTTP_FAIL_RATE);
2076 }
2077
2078 if (ptr1 || ptr2 || ptr3 || ptr4 || ptr5 || ptr6) {
Christopher Fauletac98d812019-12-18 09:20:16 +01002079 HA_RWLOCK_WRLOCK(STK_SESS_LOCK, &ts->lock);
2080
2081 if (ptr1)
2082 stktable_data_cast(ptr1, http_req_cnt)++;
2083 if (ptr2)
2084 update_freq_ctr_period(&stktable_data_cast(ptr2, http_req_rate),
2085 t->data_arg[STKTABLE_DT_HTTP_REQ_RATE].u, 1);
2086 if (ptr3)
2087 stktable_data_cast(ptr3, http_err_cnt)++;
2088 if (ptr4)
2089 update_freq_ctr_period(&stktable_data_cast(ptr4, http_err_rate),
2090 t->data_arg[STKTABLE_DT_HTTP_ERR_RATE].u, 1);
Willy Tarreau826f3ab2021-02-10 12:07:15 +01002091 if (ptr5)
2092 stktable_data_cast(ptr5, http_fail_cnt)++;
2093 if (ptr6)
2094 update_freq_ctr_period(&stktable_data_cast(ptr6, http_fail_rate),
2095 t->data_arg[STKTABLE_DT_HTTP_FAIL_RATE].u, 1);
Christopher Fauletac98d812019-12-18 09:20:16 +01002096
2097 HA_RWLOCK_WRUNLOCK(STK_SESS_LOCK, &ts->lock);
2098
2099 /* If data was modified, we need to touch to re-schedule sync */
2100 stktable_touch_local(t, ts, 0);
2101 }
2102
2103 stkctr_set_flags(&s->stkctr[rule->action], STKCTR_TRACK_CONTENT);
2104 if (sess->fe != s->be)
2105 stkctr_set_flags(&s->stkctr[rule->action], STKCTR_TRACK_BACKEND);
2106
2107 end:
2108 return ACT_RET_CONT;
2109}
Christopher Faulet81e20172019-12-12 16:40:30 +01002110
Christopher Faulet2eb53962020-01-14 14:47:34 +01002111static void release_http_track_sc(struct act_rule *rule)
2112{
2113 release_sample_expr(rule->arg.trk_ctr.expr);
2114}
2115
Christopher Faulet81e20172019-12-12 16:40:30 +01002116/* Parse a "track-sc*" actions. It returns ACT_RET_PRS_OK on success,
2117 * ACT_RET_PRS_ERR on error.
2118 */
2119static enum act_parse_ret parse_http_track_sc(const char **args, int *orig_arg, struct proxy *px,
2120 struct act_rule *rule, char **err)
2121{
2122 struct sample_expr *expr;
2123 unsigned int where;
2124 unsigned int tsc_num;
2125 const char *tsc_num_str;
2126 int cur_arg;
2127
2128 tsc_num_str = &args[*orig_arg-1][8];
2129 if (cfg_parse_track_sc_num(&tsc_num, tsc_num_str, tsc_num_str + strlen(tsc_num_str), err) == -1)
2130 return ACT_RET_PRS_ERR;
2131
2132 cur_arg = *orig_arg;
2133 expr = sample_parse_expr((char **)args, &cur_arg, px->conf.args.file, px->conf.args.line,
Willy Tarreaue3b57bf2020-02-14 16:50:14 +01002134 err, &px->conf.args, NULL);
Christopher Faulet81e20172019-12-12 16:40:30 +01002135 if (!expr)
2136 return ACT_RET_PRS_ERR;
2137
2138 where = 0;
2139 if (px->cap & PR_CAP_FE)
2140 where |= (rule->from == ACT_F_HTTP_REQ ? SMP_VAL_FE_HRQ_HDR : SMP_VAL_FE_HRS_HDR);
2141 if (px->cap & PR_CAP_BE)
2142 where |= (rule->from == ACT_F_HTTP_REQ ? SMP_VAL_BE_HRQ_HDR : SMP_VAL_BE_HRS_HDR);
2143
2144 if (!(expr->fetch->val & where)) {
2145 memprintf(err, "fetch method '%s' extracts information from '%s', none of which is available here",
2146 args[cur_arg-1], sample_src_names(expr->fetch->use));
Christopher Faulet1337b322020-01-14 14:50:55 +01002147 release_sample_expr(expr);
Christopher Faulet81e20172019-12-12 16:40:30 +01002148 return ACT_RET_PRS_ERR;
2149 }
2150
2151 if (strcmp(args[cur_arg], "table") == 0) {
2152 cur_arg++;
2153 if (!*args[cur_arg]) {
2154 memprintf(err, "missing table name");
Christopher Faulet1337b322020-01-14 14:50:55 +01002155 release_sample_expr(expr);
Christopher Faulet81e20172019-12-12 16:40:30 +01002156 return ACT_RET_PRS_ERR;
2157 }
2158
2159 /* we copy the table name for now, it will be resolved later */
2160 rule->arg.trk_ctr.table.n = strdup(args[cur_arg]);
2161 cur_arg++;
2162 }
2163
Christopher Fauletac98d812019-12-18 09:20:16 +01002164 rule->action = tsc_num;
Christopher Faulet81e20172019-12-12 16:40:30 +01002165 rule->arg.trk_ctr.expr = expr;
Christopher Fauletac98d812019-12-18 09:20:16 +01002166 rule->action_ptr = http_action_track_sc;
Christopher Faulet2eb53962020-01-14 14:47:34 +01002167 rule->release_ptr = release_http_track_sc;
Christopher Faulet81e20172019-12-12 16:40:30 +01002168 rule->check_ptr = check_trk_action;
2169
2170 *orig_arg = cur_arg;
2171 return ACT_RET_PRS_OK;
2172}
2173
Amaury Denoyelle8d228232020-12-10 13:43:54 +01002174static enum act_return action_timeout_set_stream_timeout(struct act_rule *rule,
2175 struct proxy *px,
2176 struct session *sess,
2177 struct stream *s,
2178 int flags)
2179{
2180 struct sample *key;
2181
2182 if (rule->arg.timeout.expr) {
2183 key = sample_fetch_as_type(px, sess, s, SMP_OPT_FINAL, rule->arg.timeout.expr, SMP_T_SINT);
2184 if (!key)
2185 return ACT_RET_CONT;
2186
2187 stream_set_timeout(s, rule->arg.timeout.type, MS_TO_TICKS(key->data.u.sint));
2188 }
2189 else {
2190 stream_set_timeout(s, rule->arg.timeout.type, MS_TO_TICKS(rule->arg.timeout.value));
2191 }
2192
2193 return ACT_RET_CONT;
2194}
2195
2196/* Parse a "set-timeout" action. Returns ACT_RET_PRS_ERR if parsing error.
2197 */
2198static enum act_parse_ret parse_http_set_timeout(const char **args,
2199 int *orig_arg,
2200 struct proxy *px,
2201 struct act_rule *rule, char **err)
2202{
2203 int cur_arg;
2204
2205 rule->action = ACT_CUSTOM;
2206 rule->action_ptr = action_timeout_set_stream_timeout;
2207 rule->release_ptr = release_timeout_action;
2208
2209 cur_arg = *orig_arg;
2210 if (!*args[cur_arg] || !*args[cur_arg + 1]) {
2211 memprintf(err, "expects exactly 2 arguments");
2212 return ACT_RET_PRS_ERR;
2213 }
2214
2215 if (!(px->cap & PR_CAP_BE)) {
2216 memprintf(err, "proxy '%s' has no backend capability", px->id);
2217 return ACT_RET_PRS_ERR;
2218 }
2219
2220 if (cfg_parse_rule_set_timeout(args, cur_arg,
2221 &rule->arg.timeout.value,
2222 &rule->arg.timeout.type,
2223 &rule->arg.timeout.expr,
2224 err,
2225 px->conf.args.file,
2226 px->conf.args.line, &px->conf.args) == -1) {
2227 return ACT_RET_PRS_ERR;
2228 }
2229
2230 *orig_arg = cur_arg + 2;
2231
2232 return ACT_RET_PRS_OK;
2233}
2234
Christopher Faulet46f95542019-12-20 10:07:22 +01002235/* This function executes a strict-mode actions. On success, it always returns
2236 * ACT_RET_CONT
2237 */
2238static enum act_return http_action_strict_mode(struct act_rule *rule, struct proxy *px,
2239 struct session *sess, struct stream *s, int flags)
2240{
2241 struct http_msg *msg = ((rule->from == ACT_F_HTTP_REQ) ? &s->txn->req : &s->txn->rsp);
2242
2243 if (rule->action == 0) // strict-mode on
2244 msg->flags &= ~HTTP_MSGF_SOFT_RW;
2245 else // strict-mode off
2246 msg->flags |= HTTP_MSGF_SOFT_RW;
2247 return ACT_RET_CONT;
2248}
2249
2250/* Parse a "strict-mode" action. It returns ACT_RET_PRS_OK on success,
2251 * ACT_RET_PRS_ERR on error.
2252 */
2253static enum act_parse_ret parse_http_strict_mode(const char **args, int *orig_arg, struct proxy *px,
2254 struct act_rule *rule, char **err)
2255{
2256 int cur_arg;
2257
Christopher Faulet46f95542019-12-20 10:07:22 +01002258 cur_arg = *orig_arg;
2259 if (!*args[cur_arg]) {
2260 memprintf(err, "expects exactly 1 arguments");
2261 return ACT_RET_PRS_ERR;
2262 }
2263
2264 if (strcasecmp(args[cur_arg], "on") == 0)
2265 rule->action = 0; // strict-mode on
2266 else if (strcasecmp(args[cur_arg], "off") == 0)
2267 rule->action = 1; // strict-mode off
2268 else {
2269 memprintf(err, "Unexpected value '%s'. Only 'on' and 'off' are supported", args[cur_arg]);
2270 return ACT_RET_PRS_ERR;
2271 }
2272 rule->action_ptr = http_action_strict_mode;
2273
2274 *orig_arg = cur_arg + 1;
2275 return ACT_RET_PRS_OK;
2276}
2277
Christopher Faulet24231ab2020-01-24 17:44:23 +01002278/* This function executes a return action. It builds an HTX message from an
2279 * errorfile, an raw file or a log-format string, depending on <.action>
2280 * value. On success, it returns ACT_RET_ABRT. If an error occurs ACT_RET_ERR is
2281 * returned.
2282 */
2283static enum act_return http_action_return(struct act_rule *rule, struct proxy *px,
2284 struct session *sess, struct stream *s, int flags)
2285{
2286 struct channel *req = &s->req;
Christopher Faulet24231ab2020-01-24 17:44:23 +01002287
Christopher Faulet2d36df22021-02-19 11:41:01 +01002288 s->txn->status = rule->arg.http_reply->status;
Christopher Faulet0e2ad612020-05-13 16:38:37 +02002289 if (http_reply_message(s, rule->arg.http_reply) == -1)
2290 return ACT_RET_ERR;
Christopher Faulet24231ab2020-01-24 17:44:23 +01002291
Christopher Faulet24231ab2020-01-24 17:44:23 +01002292 if (rule->from == ACT_F_HTTP_REQ) {
2293 /* let's log the request time */
2294 s->logs.tv_request = now;
2295 req->analysers &= AN_REQ_FLT_END;
2296
2297 if (s->sess->fe == s->be) /* report it if the request was intercepted by the frontend */
Willy Tarreau4781b152021-04-06 13:53:36 +02002298 _HA_ATOMIC_INC(&s->sess->fe->fe_counters.intercepted_req);
Christopher Faulet24231ab2020-01-24 17:44:23 +01002299 }
2300
2301 if (!(s->flags & SF_ERR_MASK))
2302 s->flags |= SF_ERR_LOCAL;
2303 if (!(s->flags & SF_FINST_MASK))
2304 s->flags |= ((rule->from == ACT_F_HTTP_REQ) ? SF_FINST_R : SF_FINST_H);
2305
Christopher Faulet0e2ad612020-05-13 16:38:37 +02002306 return ACT_RET_ABRT;
Christopher Faulet24231ab2020-01-24 17:44:23 +01002307}
2308
Christopher Faulet24231ab2020-01-24 17:44:23 +01002309/* Parse a "return" action. It returns ACT_RET_PRS_OK on success,
Christopher Faulet47e791e2020-05-13 14:36:55 +02002310 * ACT_RET_PRS_ERR on error. It relies on http_parse_http_reply() to set
2311 * <.arg.http_reply>.
Christopher Faulet24231ab2020-01-24 17:44:23 +01002312 */
2313static enum act_parse_ret parse_http_return(const char **args, int *orig_arg, struct proxy *px,
2314 struct act_rule *rule, char **err)
2315{
Christopher Faulet47e791e2020-05-13 14:36:55 +02002316 /* Prepare parsing of log-format strings */
2317 px->conf.args.ctx = ((rule->from == ACT_F_HTTP_REQ) ? ARGC_HRQ : ARGC_HRS);
2318 rule->arg.http_reply = http_parse_http_reply(args, orig_arg, px, 200, err);
2319 if (!rule->arg.http_reply)
2320 return ACT_RET_PRS_ERR;
Christopher Faulet24231ab2020-01-24 17:44:23 +01002321
Christopher Fauletba946bf2020-05-13 08:50:07 +02002322 rule->flags |= ACT_FLAG_FINAL;
Christopher Faulet5ff0c642020-05-12 18:33:37 +02002323 rule->action = ACT_CUSTOM;
Christopher Faulet5cb513a2020-05-13 17:56:56 +02002324 rule->check_ptr = check_act_http_reply;
Christopher Faulet24231ab2020-01-24 17:44:23 +01002325 rule->action_ptr = http_action_return;
Christopher Faulet5cb513a2020-05-13 17:56:56 +02002326 rule->release_ptr = release_act_http_reply;
Christopher Faulet24231ab2020-01-24 17:44:23 +01002327 return ACT_RET_PRS_OK;
Christopher Faulet24231ab2020-01-24 17:44:23 +01002328}
2329
Christopher Faulet021a8e42021-03-29 10:46:38 +02002330
2331
2332/* This function executes a wait-for-body action. It waits for the message
2333 * payload for a max configured time (.arg.p[0]) and eventually for only first
2334 * <arg.p[1]> bytes (0 means no limit). It relies on http_wait_for_msg_body()
2335 * function. it returns ACT_RET_CONT when conditions are met to stop to wait.
2336 * Otherwise ACT_RET_YIELD is returned to wait for more data. ACT_RET_INV is
2337 * returned if a parsing error is raised by lower level and ACT_RET_ERR if an
Ilya Shipitsinb2be9a12021-04-24 13:25:42 +05002338 * internal error occurred. Finally ACT_RET_ABRT is returned when a timeout
2339 * occurred.
Christopher Faulet021a8e42021-03-29 10:46:38 +02002340 */
2341static enum act_return http_action_wait_for_body(struct act_rule *rule, struct proxy *px,
2342 struct session *sess, struct stream *s, int flags)
2343{
2344 struct channel *chn = ((rule->from == ACT_F_HTTP_REQ) ? &s->req : &s->res);
2345 unsigned int time = (uintptr_t)rule->arg.act.p[0];
2346 unsigned int bytes = (uintptr_t)rule->arg.act.p[1];
2347
2348 switch (http_wait_for_msg_body(s, chn, time, bytes)) {
2349 case HTTP_RULE_RES_CONT:
2350 return ACT_RET_CONT;
2351 case HTTP_RULE_RES_YIELD:
2352 return ACT_RET_YIELD;
2353 case HTTP_RULE_RES_BADREQ:
2354 return ACT_RET_INV;
2355 case HTTP_RULE_RES_ERROR:
2356 return ACT_RET_ERR;
2357 case HTTP_RULE_RES_ABRT:
2358 return ACT_RET_ABRT;
2359 default:
2360 return ACT_RET_ERR;
2361 }
2362}
2363
2364/* Parse a "wait-for-body" action. It returns ACT_RET_PRS_OK on success,
2365 * ACT_RET_PRS_ERR on error.
2366 */
2367static enum act_parse_ret parse_http_wait_for_body(const char **args, int *orig_arg, struct proxy *px,
2368 struct act_rule *rule, char **err)
2369{
2370 int cur_arg;
2371 unsigned int time, bytes;
2372 const char *res;
2373
2374 cur_arg = *orig_arg;
2375 if (!*args[cur_arg]) {
2376 memprintf(err, "expects time <time> [ at-least <bytes> ]");
2377 return ACT_RET_PRS_ERR;
2378 }
2379
2380 time = UINT_MAX; /* To be sure it is set */
2381 bytes = 0; /* Default value, wait all the body */
2382 while (*(args[cur_arg])) {
2383 if (strcmp(args[cur_arg], "time") == 0) {
2384 if (!*args[cur_arg + 1]) {
2385 memprintf(err, "missing argument for '%s'", args[cur_arg]);
2386 return ACT_RET_PRS_ERR;
2387 }
2388 res = parse_time_err(args[cur_arg+1], &time, TIME_UNIT_MS);
2389 if (res == PARSE_TIME_OVER) {
2390 memprintf(err, "time overflow (maximum value is 2147483647 ms or ~24.8 days)");
2391 return ACT_RET_PRS_ERR;
2392 }
2393 if (res == PARSE_TIME_UNDER) {
2394 memprintf(err, "time underflow (minimum non-null value is 1 ms)");
2395 return ACT_RET_PRS_ERR;
2396 }
2397 if (res) {
2398 memprintf(err, "unexpected character '%c'", *res);
2399 return ACT_RET_PRS_ERR;
2400 }
2401 cur_arg++;
2402 }
2403 else if (strcmp(args[cur_arg], "at-least") == 0) {
2404 if (!*args[cur_arg + 1]) {
2405 memprintf(err, "missing argument for '%s'", args[cur_arg]);
2406 return ACT_RET_PRS_ERR;
2407 }
2408 res = parse_size_err(args[cur_arg+1], &bytes);
2409 if (res) {
2410 memprintf(err, "unexpected character '%c'", *res);
2411 return ACT_RET_PRS_ERR;
2412 }
2413 cur_arg++;
2414 }
2415 else
2416 break;
2417 cur_arg++;
2418 }
2419
2420 if (time == UINT_MAX) {
2421 memprintf(err, "expects time <time> [ at-least <bytes> ]");
2422 return ACT_RET_PRS_ERR;
2423 }
2424
2425 rule->arg.act.p[0] = (void *)(uintptr_t)time;
2426 rule->arg.act.p[1] = (void *)(uintptr_t)bytes;
2427
2428 *orig_arg = cur_arg;
2429
2430 rule->action = ACT_CUSTOM;
2431 rule->action_ptr = http_action_wait_for_body;
2432 return ACT_RET_PRS_OK;
2433}
2434
Willy Tarreau79e57332018-10-02 16:01:16 +02002435/************************************************************************/
2436/* All supported http-request action keywords must be declared here. */
2437/************************************************************************/
2438
2439static struct action_kw_list http_req_actions = {
2440 .kw = {
Amaury Denoyellee4a617c2021-05-06 15:33:09 +02002441 { "add-acl", parse_http_set_map, KWF_MATCH_PREFIX },
Christopher Faulet81e20172019-12-12 16:40:30 +01002442 { "add-header", parse_http_set_header, 0 },
2443 { "allow", parse_http_allow, 0 },
2444 { "auth", parse_http_auth, 0 },
2445 { "capture", parse_http_req_capture, 0 },
Amaury Denoyellee4a617c2021-05-06 15:33:09 +02002446 { "del-acl", parse_http_set_map, KWF_MATCH_PREFIX },
Christopher Faulet81e20172019-12-12 16:40:30 +01002447 { "del-header", parse_http_del_header, 0 },
Amaury Denoyellee4a617c2021-05-06 15:33:09 +02002448 { "del-map", parse_http_set_map, KWF_MATCH_PREFIX },
Christopher Faulete0fca292020-01-13 21:49:03 +01002449 { "deny", parse_http_deny, 0 },
Christopher Faulet81e20172019-12-12 16:40:30 +01002450 { "disable-l7-retry", parse_http_req_disable_l7_retry, 0 },
2451 { "early-hint", parse_http_set_header, 0 },
Amaury Denoyellea9e639a2021-05-06 15:50:12 +02002452 { "normalize-uri", parse_http_normalize_uri, KWF_EXPERIMENTAL },
Christopher Faulet81e20172019-12-12 16:40:30 +01002453 { "redirect", parse_http_redirect, 0 },
2454 { "reject", parse_http_action_reject, 0 },
2455 { "replace-header", parse_http_replace_header, 0 },
2456 { "replace-path", parse_replace_uri, 0 },
Christopher Faulet312294f2020-09-02 17:17:44 +02002457 { "replace-pathq", parse_replace_uri, 0 },
Christopher Faulet81e20172019-12-12 16:40:30 +01002458 { "replace-uri", parse_replace_uri, 0 },
2459 { "replace-value", parse_http_replace_header, 0 },
Christopher Faulet24231ab2020-01-24 17:44:23 +01002460 { "return", parse_http_return, 0 },
Christopher Faulet81e20172019-12-12 16:40:30 +01002461 { "set-header", parse_http_set_header, 0 },
2462 { "set-log-level", parse_http_set_log_level, 0 },
Amaury Denoyellee4a617c2021-05-06 15:33:09 +02002463 { "set-map", parse_http_set_map, KWF_MATCH_PREFIX },
Christopher Faulet81e20172019-12-12 16:40:30 +01002464 { "set-method", parse_set_req_line, 0 },
2465 { "set-mark", parse_http_set_mark, 0 },
2466 { "set-nice", parse_http_set_nice, 0 },
2467 { "set-path", parse_set_req_line, 0 },
Christopher Faulet312294f2020-09-02 17:17:44 +02002468 { "set-pathq", parse_set_req_line, 0 },
Christopher Faulet81e20172019-12-12 16:40:30 +01002469 { "set-query", parse_set_req_line, 0 },
2470 { "set-tos", parse_http_set_tos, 0 },
2471 { "set-uri", parse_set_req_line, 0 },
Christopher Faulet46f95542019-12-20 10:07:22 +01002472 { "strict-mode", parse_http_strict_mode, 0 },
Christopher Faulete0fca292020-01-13 21:49:03 +01002473 { "tarpit", parse_http_deny, 0 },
Amaury Denoyellee4a617c2021-05-06 15:33:09 +02002474 { "track-sc", parse_http_track_sc, KWF_MATCH_PREFIX },
Amaury Denoyelle8d228232020-12-10 13:43:54 +01002475 { "set-timeout", parse_http_set_timeout, 0 },
Christopher Faulet021a8e42021-03-29 10:46:38 +02002476 { "wait-for-body", parse_http_wait_for_body, 0 },
Willy Tarreau79e57332018-10-02 16:01:16 +02002477 { NULL, NULL }
2478 }
2479};
2480
Willy Tarreau0108d902018-11-25 19:14:37 +01002481INITCALL1(STG_REGISTER, http_req_keywords_register, &http_req_actions);
2482
Willy Tarreau79e57332018-10-02 16:01:16 +02002483static struct action_kw_list http_res_actions = {
2484 .kw = {
Amaury Denoyellee4a617c2021-05-06 15:33:09 +02002485 { "add-acl", parse_http_set_map, KWF_MATCH_PREFIX },
Christopher Faulet81e20172019-12-12 16:40:30 +01002486 { "add-header", parse_http_set_header, 0 },
2487 { "allow", parse_http_allow, 0 },
2488 { "capture", parse_http_res_capture, 0 },
Amaury Denoyellee4a617c2021-05-06 15:33:09 +02002489 { "del-acl", parse_http_set_map, KWF_MATCH_PREFIX },
Christopher Faulet81e20172019-12-12 16:40:30 +01002490 { "del-header", parse_http_del_header, 0 },
Amaury Denoyellee4a617c2021-05-06 15:33:09 +02002491 { "del-map", parse_http_set_map, KWF_MATCH_PREFIX },
Christopher Faulete0fca292020-01-13 21:49:03 +01002492 { "deny", parse_http_deny, 0 },
Christopher Faulet81e20172019-12-12 16:40:30 +01002493 { "redirect", parse_http_redirect, 0 },
2494 { "replace-header", parse_http_replace_header, 0 },
2495 { "replace-value", parse_http_replace_header, 0 },
Christopher Faulet24231ab2020-01-24 17:44:23 +01002496 { "return", parse_http_return, 0 },
Christopher Faulet81e20172019-12-12 16:40:30 +01002497 { "set-header", parse_http_set_header, 0 },
2498 { "set-log-level", parse_http_set_log_level, 0 },
Amaury Denoyellee4a617c2021-05-06 15:33:09 +02002499 { "set-map", parse_http_set_map, KWF_MATCH_PREFIX },
Christopher Faulet81e20172019-12-12 16:40:30 +01002500 { "set-mark", parse_http_set_mark, 0 },
2501 { "set-nice", parse_http_set_nice, 0 },
2502 { "set-status", parse_http_set_status, 0 },
2503 { "set-tos", parse_http_set_tos, 0 },
Christopher Faulet46f95542019-12-20 10:07:22 +01002504 { "strict-mode", parse_http_strict_mode, 0 },
Amaury Denoyellee4a617c2021-05-06 15:33:09 +02002505 { "track-sc", parse_http_track_sc, KWF_MATCH_PREFIX },
Christopher Faulet021a8e42021-03-29 10:46:38 +02002506 { "wait-for-body", parse_http_wait_for_body, 0 },
Willy Tarreau79e57332018-10-02 16:01:16 +02002507 { NULL, NULL }
2508 }
2509};
2510
Willy Tarreau0108d902018-11-25 19:14:37 +01002511INITCALL1(STG_REGISTER, http_res_keywords_register, &http_res_actions);
Willy Tarreau79e57332018-10-02 16:01:16 +02002512
Christopher Faulet6d0c3df2020-01-22 09:26:35 +01002513static struct action_kw_list http_after_res_actions = {
2514 .kw = {
2515 { "add-header", parse_http_set_header, 0 },
2516 { "allow", parse_http_allow, 0 },
2517 { "del-header", parse_http_del_header, 0 },
2518 { "replace-header", parse_http_replace_header, 0 },
2519 { "replace-value", parse_http_replace_header, 0 },
2520 { "set-header", parse_http_set_header, 0 },
2521 { "set-status", parse_http_set_status, 0 },
2522 { "strict-mode", parse_http_strict_mode, 0 },
2523 { NULL, NULL }
2524 }
2525};
2526
2527INITCALL1(STG_REGISTER, http_after_res_keywords_register, &http_after_res_actions);
2528
Willy Tarreau79e57332018-10-02 16:01:16 +02002529/*
2530 * Local variables:
2531 * c-indent-level: 8
2532 * c-basic-offset: 8
2533 * End:
2534 */