blob: aa713c59e016c453f68db5ce8af228e2970242f2 [file] [log] [blame]
Willy Tarreau39713102016-11-25 15:49:32 +01001/*
2 * "tcp" rules processing
3 *
4 * Copyright 2000-2016 Willy Tarreau <w@1wt.eu>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12#include <common/cfgparse.h>
13#include <common/compat.h>
14#include <common/config.h>
15#include <common/debug.h>
Willy Tarreau0108d902018-11-25 19:14:37 +010016#include <common/initcall.h>
Willy Tarreau39713102016-11-25 15:49:32 +010017#include <common/mini-clist.h>
18#include <common/standard.h>
19#include <common/ticks.h>
20#include <common/time.h>
21
22#include <types/arg.h>
23#include <types/capture.h>
24#include <types/connection.h>
25#include <types/global.h>
26
27#include <proto/acl.h>
28#include <proto/action.h>
29#include <proto/channel.h>
30#include <proto/connection.h>
31#include <proto/log.h>
32#include <proto/proxy.h>
33#include <proto/sample.h>
34#include <proto/stick_table.h>
35#include <proto/stream.h>
36#include <proto/stream_interface.h>
37#include <proto/tcp_rules.h>
38
Christopher Fauleteea8fc72019-11-05 16:18:10 +010039#define TRACE_SOURCE &trace_strm
40
Willy Tarreau39713102016-11-25 15:49:32 +010041/* List head of all known action keywords for "tcp-request connection" */
42struct list tcp_req_conn_keywords = LIST_HEAD_INIT(tcp_req_conn_keywords);
43struct list tcp_req_sess_keywords = LIST_HEAD_INIT(tcp_req_sess_keywords);
44struct list tcp_req_cont_keywords = LIST_HEAD_INIT(tcp_req_cont_keywords);
45struct list tcp_res_cont_keywords = LIST_HEAD_INIT(tcp_res_cont_keywords);
46
47/*
48 * Register keywords.
49 */
50void tcp_req_conn_keywords_register(struct action_kw_list *kw_list)
51{
52 LIST_ADDQ(&tcp_req_conn_keywords, &kw_list->list);
53}
54
55void tcp_req_sess_keywords_register(struct action_kw_list *kw_list)
56{
57 LIST_ADDQ(&tcp_req_sess_keywords, &kw_list->list);
58}
59
60void tcp_req_cont_keywords_register(struct action_kw_list *kw_list)
61{
62 LIST_ADDQ(&tcp_req_cont_keywords, &kw_list->list);
63}
64
65void tcp_res_cont_keywords_register(struct action_kw_list *kw_list)
66{
67 LIST_ADDQ(&tcp_res_cont_keywords, &kw_list->list);
68}
69
70/*
71 * Return the struct tcp_req_action_kw associated to a keyword.
72 */
73static struct action_kw *tcp_req_conn_action(const char *kw)
74{
75 return action_lookup(&tcp_req_conn_keywords, kw);
76}
77
78static struct action_kw *tcp_req_sess_action(const char *kw)
79{
80 return action_lookup(&tcp_req_sess_keywords, kw);
81}
82
83static struct action_kw *tcp_req_cont_action(const char *kw)
84{
85 return action_lookup(&tcp_req_cont_keywords, kw);
86}
87
88static struct action_kw *tcp_res_cont_action(const char *kw)
89{
90 return action_lookup(&tcp_res_cont_keywords, kw);
91}
92
93/* This function performs the TCP request analysis on the current request. It
94 * returns 1 if the processing can continue on next analysers, or zero if it
95 * needs more data, encounters an error, or wants to immediately abort the
96 * request. It relies on buffers flags, and updates s->req->analysers. The
97 * function may be called for frontend rules and backend rules. It only relies
98 * on the backend pointer so this works for both cases.
99 */
100int tcp_inspect_request(struct stream *s, struct channel *req, int an_bit)
101{
102 struct session *sess = s->sess;
103 struct act_rule *rule;
Willy Tarreau39713102016-11-25 15:49:32 +0100104 int partial;
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100105 int act_opts = 0;
Willy Tarreau39713102016-11-25 15:49:32 +0100106
Christopher Fauleteea8fc72019-11-05 16:18:10 +0100107 DBG_TRACE_ENTER(STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
Willy Tarreau39713102016-11-25 15:49:32 +0100108
109 /* We don't know whether we have enough data, so must proceed
110 * this way :
111 * - iterate through all rules in their declaration order
112 * - if one rule returns MISS, it means the inspect delay is
113 * not over yet, then return immediately, otherwise consider
114 * it as a non-match.
115 * - if one rule returns OK, then return OK
116 * - if one rule returns KO, then return KO
117 */
118
Willy Tarreau23752332018-06-15 14:54:53 +0200119 if ((req->flags & CF_SHUTR) || channel_full(req, global.tune.maxrewrite) ||
Willy Tarreau39713102016-11-25 15:49:32 +0100120 !s->be->tcp_req.inspect_delay || tick_is_expired(req->analyse_exp, now_ms))
121 partial = SMP_OPT_FINAL;
122 else
123 partial = 0;
124
125 /* If "the current_rule_list" match the executed rule list, we are in
126 * resume condition. If a resume is needed it is always in the action
127 * and never in the ACL or converters. In this case, we initialise the
128 * current rule, and go to the action execution point.
129 */
130 if (s->current_rule) {
131 rule = s->current_rule;
132 s->current_rule = NULL;
133 if (s->current_rule_list == &s->be->tcp_req.inspect_rules)
134 goto resume_execution;
135 }
136 s->current_rule_list = &s->be->tcp_req.inspect_rules;
137
138 list_for_each_entry(rule, &s->be->tcp_req.inspect_rules, list) {
139 enum acl_test_res ret = ACL_TEST_PASS;
140
141 if (rule->cond) {
142 ret = acl_exec_cond(rule->cond, s->be, sess, s, SMP_OPT_DIR_REQ | partial);
143 if (ret == ACL_TEST_MISS)
144 goto missing_data;
145
146 ret = acl_pass(ret);
147 if (rule->cond->pol == ACL_COND_UNLESS)
148 ret = !ret;
149 }
150
151 if (ret) {
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100152 act_opts |= ACT_OPT_FIRST;
Willy Tarreau39713102016-11-25 15:49:32 +0100153resume_execution:
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100154
155 /* Always call the action function if defined */
156 if (rule->action_ptr) {
157 if (partial & SMP_OPT_FINAL)
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100158 act_opts |= ACT_OPT_FINAL;
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100159
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100160 switch (rule->action_ptr(rule, s->be, s->sess, s, act_opts)) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100161 case ACT_RET_CONT:
162 break;
163 case ACT_RET_STOP:
164 case ACT_RET_DONE:
165 goto end;
166 case ACT_RET_YIELD:
167 s->current_rule = rule;
168 goto missing_data;
169 case ACT_RET_DENY:
170 goto deny;
171 case ACT_RET_ABRT:
172 goto abort;
173 case ACT_RET_ERR:
174 goto internal;
175 case ACT_RET_INV:
176 goto invalid;
177 }
178 continue; /* eval the next rule */
179 }
180
181 /* If not action function defined, check for known actions */
Willy Tarreau39713102016-11-25 15:49:32 +0100182 if (rule->action == ACT_ACTION_ALLOW) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100183 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100184 }
185 else if (rule->action == ACT_ACTION_DENY) {
Christopher Faulet282992e2019-12-16 12:34:31 +0100186 goto deny;
Willy Tarreau39713102016-11-25 15:49:32 +0100187 }
Willy Tarreau39713102016-11-25 15:49:32 +0100188 }
189 }
190
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100191 end:
Willy Tarreau39713102016-11-25 15:49:32 +0100192 /* if we get there, it means we have no rule which matches, or
193 * we have an explicit accept, so we apply the default accept.
194 */
195 req->analysers &= ~an_bit;
196 req->analyse_exp = TICK_ETERNITY;
Christopher Fauleteea8fc72019-11-05 16:18:10 +0100197 DBG_TRACE_LEAVE(STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
Willy Tarreau39713102016-11-25 15:49:32 +0100198 return 1;
199
200 missing_data:
201 channel_dont_connect(req);
202 /* just set the request timeout once at the beginning of the request */
203 if (!tick_isset(req->analyse_exp) && s->be->tcp_req.inspect_delay)
204 req->analyse_exp = tick_add(now_ms, s->be->tcp_req.inspect_delay);
Christopher Fauleteea8fc72019-11-05 16:18:10 +0100205 DBG_TRACE_DEVEL("waiting for more data", STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
Willy Tarreau39713102016-11-25 15:49:32 +0100206 return 0;
207
Christopher Faulet282992e2019-12-16 12:34:31 +0100208 deny:
209 _HA_ATOMIC_ADD(&sess->fe->fe_counters.denied_req, 1);
210 if (sess->listener && sess->listener->counters)
211 _HA_ATOMIC_ADD(&sess->listener->counters->denied_req, 1);
212 goto reject;
213
214 internal:
215 _HA_ATOMIC_ADD(&sess->fe->fe_counters.internal_errors, 1);
216 if (sess->listener && sess->listener->counters)
217 _HA_ATOMIC_ADD(&sess->listener->counters->internal_errors, 1);
218 if (!(s->flags & SF_ERR_MASK))
219 s->flags |= SF_ERR_INTERNAL;
220 goto reject;
221
222 invalid:
223 _HA_ATOMIC_ADD(&sess->fe->fe_counters.failed_req, 1);
224 if (sess->listener && sess->listener->counters)
225 _HA_ATOMIC_ADD(&sess->listener->counters->failed_req, 1);
226
227 reject:
228 si_must_kill_conn(chn_prod(req));
229 channel_abort(req);
230 channel_abort(&s->res);
231
232 abort:
233 req->analysers &= AN_REQ_FLT_END;
234
235 if (!(s->flags & SF_ERR_MASK))
236 s->flags |= SF_ERR_PRXCOND;
237 if (!(s->flags & SF_FINST_MASK))
238 s->flags |= SF_FINST_R;
239 DBG_TRACE_DEVEL("leaving on error|deny|abort", STRM_EV_STRM_ANA|STRM_EV_TCP_ANA|STRM_EV_TCP_ERR, s);
240 return 0;
Willy Tarreau39713102016-11-25 15:49:32 +0100241}
242
243/* This function performs the TCP response analysis on the current response. It
244 * returns 1 if the processing can continue on next analysers, or zero if it
245 * needs more data, encounters an error, or wants to immediately abort the
246 * response. It relies on buffers flags, and updates s->rep->analysers. The
247 * function may be called for backend rules.
248 */
249int tcp_inspect_response(struct stream *s, struct channel *rep, int an_bit)
250{
251 struct session *sess = s->sess;
252 struct act_rule *rule;
253 int partial;
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100254 int act_opts = 0;
Willy Tarreau39713102016-11-25 15:49:32 +0100255
Christopher Fauleteea8fc72019-11-05 16:18:10 +0100256 DBG_TRACE_ENTER(STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
Willy Tarreau39713102016-11-25 15:49:32 +0100257
258 /* We don't know whether we have enough data, so must proceed
259 * this way :
260 * - iterate through all rules in their declaration order
261 * - if one rule returns MISS, it means the inspect delay is
262 * not over yet, then return immediately, otherwise consider
263 * it as a non-match.
264 * - if one rule returns OK, then return OK
265 * - if one rule returns KO, then return KO
266 */
267
268 if (rep->flags & CF_SHUTR || tick_is_expired(rep->analyse_exp, now_ms))
269 partial = SMP_OPT_FINAL;
270 else
271 partial = 0;
272
273 /* If "the current_rule_list" match the executed rule list, we are in
274 * resume condition. If a resume is needed it is always in the action
275 * and never in the ACL or converters. In this case, we initialise the
276 * current rule, and go to the action execution point.
277 */
278 if (s->current_rule) {
279 rule = s->current_rule;
280 s->current_rule = NULL;
281 if (s->current_rule_list == &s->be->tcp_rep.inspect_rules)
282 goto resume_execution;
283 }
284 s->current_rule_list = &s->be->tcp_rep.inspect_rules;
285
286 list_for_each_entry(rule, &s->be->tcp_rep.inspect_rules, list) {
287 enum acl_test_res ret = ACL_TEST_PASS;
288
289 if (rule->cond) {
290 ret = acl_exec_cond(rule->cond, s->be, sess, s, SMP_OPT_DIR_RES | partial);
291 if (ret == ACL_TEST_MISS) {
292 /* just set the analyser timeout once at the beginning of the response */
293 if (!tick_isset(rep->analyse_exp) && s->be->tcp_rep.inspect_delay)
294 rep->analyse_exp = tick_add(now_ms, s->be->tcp_rep.inspect_delay);
Christopher Fauleteea8fc72019-11-05 16:18:10 +0100295 DBG_TRACE_DEVEL("waiting for more data", STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
Willy Tarreau39713102016-11-25 15:49:32 +0100296 return 0;
297 }
298
299 ret = acl_pass(ret);
300 if (rule->cond->pol == ACL_COND_UNLESS)
301 ret = !ret;
302 }
303
304 if (ret) {
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100305 act_opts |= ACT_OPT_FIRST;
Willy Tarreau39713102016-11-25 15:49:32 +0100306resume_execution:
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100307 /* Always call the action function if defined */
308 if (rule->action_ptr) {
309 if (partial & SMP_OPT_FINAL)
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100310 act_opts |= ACT_OPT_FINAL;
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100311
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100312 switch (rule->action_ptr(rule, s->be, s->sess, s, act_opts)) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100313 case ACT_RET_CONT:
314 break;
315 case ACT_RET_STOP:
316 case ACT_RET_DONE:
317 goto end;
318 case ACT_RET_YIELD:
319 s->current_rule = rule;
320 goto missing_data;
321 case ACT_RET_DENY:
322 goto deny;
323 case ACT_RET_ABRT:
324 goto abort;
325 case ACT_RET_ERR:
326 goto internal;
327 case ACT_RET_INV:
328 goto invalid;
329 }
330 continue; /* eval the next rule */
331 }
332
333 /* If not action function defined, check for known actions */
Willy Tarreau39713102016-11-25 15:49:32 +0100334 if (rule->action == ACT_ACTION_ALLOW) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100335 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100336 }
337 else if (rule->action == ACT_ACTION_DENY) {
Christopher Faulet282992e2019-12-16 12:34:31 +0100338 goto deny;
Willy Tarreau39713102016-11-25 15:49:32 +0100339 }
340 else if (rule->action == ACT_TCP_CLOSE) {
341 chn_prod(rep)->flags |= SI_FL_NOLINGER | SI_FL_NOHALF;
Willy Tarreau0f9cd7b2019-01-31 19:02:43 +0100342 si_must_kill_conn(chn_prod(rep));
Willy Tarreau39713102016-11-25 15:49:32 +0100343 si_shutr(chn_prod(rep));
344 si_shutw(chn_prod(rep));
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100345 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100346 }
347 }
348 }
349
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100350 end:
Willy Tarreau39713102016-11-25 15:49:32 +0100351 /* if we get there, it means we have no rule which matches, or
352 * we have an explicit accept, so we apply the default accept.
353 */
354 rep->analysers &= ~an_bit;
355 rep->analyse_exp = TICK_ETERNITY;
Christopher Fauleteea8fc72019-11-05 16:18:10 +0100356 DBG_TRACE_LEAVE(STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
Willy Tarreau39713102016-11-25 15:49:32 +0100357 return 1;
Christopher Faulet282992e2019-12-16 12:34:31 +0100358
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100359 missing_data:
360 channel_dont_close(rep);
361 s->current_rule = rule;
362 DBG_TRACE_DEVEL("waiting for more data", STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
363 return 0;
364
Christopher Faulet282992e2019-12-16 12:34:31 +0100365 deny:
Christopher Fauletcff0f732019-12-16 16:13:44 +0100366 _HA_ATOMIC_ADD(&s->sess->fe->fe_counters.denied_resp, 1);
Christopher Faulet282992e2019-12-16 12:34:31 +0100367 _HA_ATOMIC_ADD(&s->be->be_counters.denied_resp, 1);
Christopher Fauletcff0f732019-12-16 16:13:44 +0100368 if (s->sess->listener->counters)
369 _HA_ATOMIC_ADD(&s->sess->listener->counters->denied_resp, 1);
Christopher Faulet282992e2019-12-16 12:34:31 +0100370 if (objt_server(s->target))
371 _HA_ATOMIC_ADD(&__objt_server(s->target)->counters.denied_resp, 1);
372 goto reject;
373
374 internal:
Christopher Fauletcff0f732019-12-16 16:13:44 +0100375 _HA_ATOMIC_ADD(&s->sess->fe->fe_counters.internal_errors, 1);
Christopher Faulet282992e2019-12-16 12:34:31 +0100376 _HA_ATOMIC_ADD(&s->be->be_counters.internal_errors, 1);
Christopher Fauletcff0f732019-12-16 16:13:44 +0100377 if (s->sess->listener->counters)
378 _HA_ATOMIC_ADD(&s->sess->listener->counters->internal_errors, 1);
Christopher Faulet282992e2019-12-16 12:34:31 +0100379 if (objt_server(s->target))
380 _HA_ATOMIC_ADD(&__objt_server(s->target)->counters.internal_errors, 1);
381 if (!(s->flags & SF_ERR_MASK))
382 s->flags |= SF_ERR_INTERNAL;
383 goto reject;
384
385 invalid:
386 _HA_ATOMIC_ADD(&s->be->be_counters.failed_resp, 1);
387 if (objt_server(s->target))
388 _HA_ATOMIC_ADD(&__objt_server(s->target)->counters.failed_resp, 1);
389
390 reject:
391 si_must_kill_conn(chn_prod(rep));
392 channel_abort(rep);
393 channel_abort(&s->req);
394
395 abort:
396 rep->analysers &= AN_REQ_FLT_END;
397
398 if (!(s->flags & SF_ERR_MASK))
399 s->flags |= SF_ERR_PRXCOND;
400 if (!(s->flags & SF_FINST_MASK))
401 s->flags |= SF_FINST_D;
402 DBG_TRACE_DEVEL("leaving on error", STRM_EV_STRM_ANA|STRM_EV_TCP_ANA|STRM_EV_TCP_ERR, s);
403 return 0;
Willy Tarreau39713102016-11-25 15:49:32 +0100404}
405
406
407/* This function performs the TCP layer4 analysis on the current request. It
408 * returns 0 if a reject rule matches, otherwise 1 if either an accept rule
409 * matches or if no more rule matches. It can only use rules which don't need
410 * any data. This only works on connection-based client-facing stream interfaces.
411 */
412int tcp_exec_l4_rules(struct session *sess)
413{
414 struct act_rule *rule;
Willy Tarreau39713102016-11-25 15:49:32 +0100415 struct connection *conn = objt_conn(sess->origin);
416 int result = 1;
417 enum acl_test_res ret;
418
419 if (!conn)
420 return result;
421
422 list_for_each_entry(rule, &sess->fe->tcp_req.l4_rules, list) {
423 ret = ACL_TEST_PASS;
424
425 if (rule->cond) {
426 ret = acl_exec_cond(rule->cond, sess->fe, sess, NULL, SMP_OPT_DIR_REQ|SMP_OPT_FINAL);
427 ret = acl_pass(ret);
428 if (rule->cond->pol == ACL_COND_UNLESS)
429 ret = !ret;
430 }
431
432 if (ret) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100433 /* Always call the action function if defined */
434 if (rule->action_ptr) {
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100435 switch (rule->action_ptr(rule, sess->fe, sess, NULL, ACT_OPT_FINAL | ACT_OPT_FIRST)) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100436 case ACT_RET_YIELD:
437 /* yield is not allowed at this point. If this return code is
438 * used it is a bug, so I prefer to abort the process.
439 */
440 send_log(sess->fe, LOG_WARNING,
441 "Internal error: yield not allowed with tcp-request connection actions.");
442 /* fall through */
443 case ACT_RET_STOP:
444 case ACT_RET_DONE:
445 goto end;
446 case ACT_RET_CONT:
447 break;
448 case ACT_RET_DENY:
449 case ACT_RET_ABRT:
450 case ACT_RET_ERR:
451 case ACT_RET_INV:
452 result = 0;
453 goto end;
454 }
455 continue; /* eval the next rule */
456 }
457
458 /* If not action function defined, check for known actions */
Willy Tarreau39713102016-11-25 15:49:32 +0100459 if (rule->action == ACT_ACTION_ALLOW) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100460 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100461 }
462 else if (rule->action == ACT_ACTION_DENY) {
Olivier Houchard64dbb2d2019-03-08 18:55:10 +0100463 _HA_ATOMIC_ADD(&sess->fe->fe_counters.denied_conn, 1);
Willy Tarreaua12dde02016-12-22 18:14:41 +0100464 if (sess->listener && sess->listener->counters)
Olivier Houchard64dbb2d2019-03-08 18:55:10 +0100465 _HA_ATOMIC_ADD(&sess->listener->counters->denied_conn, 1);
Willy Tarreau39713102016-11-25 15:49:32 +0100466
467 result = 0;
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100468 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100469 }
Willy Tarreau39713102016-11-25 15:49:32 +0100470 else if (rule->action == ACT_TCP_EXPECT_PX) {
Olivier Houchardfe50bfb2019-05-27 12:09:19 +0200471 if (!(conn->flags & (CO_FL_HANDSHAKE_NOSSL))) {
472 if (xprt_add_hs(conn) < 0) {
473 result = 0;
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100474 goto end;
Olivier Houchardfe50bfb2019-05-27 12:09:19 +0200475 }
476 }
Willy Tarreau39713102016-11-25 15:49:32 +0100477 conn->flags |= CO_FL_ACCEPT_PROXY;
Willy Tarreau39713102016-11-25 15:49:32 +0100478 }
479 else if (rule->action == ACT_TCP_EXPECT_CIP) {
Olivier Houchardfe50bfb2019-05-27 12:09:19 +0200480 if (!(conn->flags & (CO_FL_HANDSHAKE_NOSSL))) {
481 if (xprt_add_hs(conn) < 0) {
482 result = 0;
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100483 goto end;
Olivier Houchardfe50bfb2019-05-27 12:09:19 +0200484 }
485 }
Willy Tarreau39713102016-11-25 15:49:32 +0100486 conn->flags |= CO_FL_ACCEPT_CIP;
Willy Tarreau39713102016-11-25 15:49:32 +0100487 }
Willy Tarreau39713102016-11-25 15:49:32 +0100488 }
489 }
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100490 end:
Willy Tarreau39713102016-11-25 15:49:32 +0100491 return result;
492}
493
494/* This function performs the TCP layer5 analysis on the current request. It
495 * returns 0 if a reject rule matches, otherwise 1 if either an accept rule
496 * matches or if no more rule matches. It can only use rules which don't need
497 * any data. This only works on session-based client-facing stream interfaces.
498 * An example of valid use case is to track a stick-counter on the source
499 * address extracted from the proxy protocol.
500 */
501int tcp_exec_l5_rules(struct session *sess)
502{
503 struct act_rule *rule;
Willy Tarreau39713102016-11-25 15:49:32 +0100504 int result = 1;
505 enum acl_test_res ret;
506
507 list_for_each_entry(rule, &sess->fe->tcp_req.l5_rules, list) {
508 ret = ACL_TEST_PASS;
509
510 if (rule->cond) {
511 ret = acl_exec_cond(rule->cond, sess->fe, sess, NULL, SMP_OPT_DIR_REQ|SMP_OPT_FINAL);
512 ret = acl_pass(ret);
513 if (rule->cond->pol == ACL_COND_UNLESS)
514 ret = !ret;
515 }
516
517 if (ret) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100518 /* Always call the action function if defined */
519 if (rule->action_ptr) {
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100520 switch (rule->action_ptr(rule, sess->fe, sess, NULL, ACT_OPT_FINAL | ACT_OPT_FIRST)) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100521 case ACT_RET_YIELD:
522 /* yield is not allowed at this point. If this return code is
523 * used it is a bug, so I prefer to abort the process.
524 */
525 send_log(sess->fe, LOG_WARNING,
526 "Internal error: yield not allowed with tcp-request session actions.");
527 /* fall through */
528 case ACT_RET_STOP:
529 case ACT_RET_DONE:
530 goto end;
531 case ACT_RET_CONT:
532 break;
533 case ACT_RET_DENY:
534 case ACT_RET_ABRT:
535 case ACT_RET_ERR:
536 case ACT_RET_INV:
537 result = 0;
538 goto end;
539 }
540 continue; /* eval the next rule */
541 }
542
543 /* If not action function defined, check for known actions */
Willy Tarreau39713102016-11-25 15:49:32 +0100544 if (rule->action == ACT_ACTION_ALLOW) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100545 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100546 }
547 else if (rule->action == ACT_ACTION_DENY) {
Olivier Houchard64dbb2d2019-03-08 18:55:10 +0100548 _HA_ATOMIC_ADD(&sess->fe->fe_counters.denied_sess, 1);
Willy Tarreaua12dde02016-12-22 18:14:41 +0100549 if (sess->listener && sess->listener->counters)
Olivier Houchard64dbb2d2019-03-08 18:55:10 +0100550 _HA_ATOMIC_ADD(&sess->listener->counters->denied_sess, 1);
Willy Tarreau39713102016-11-25 15:49:32 +0100551
552 result = 0;
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100553 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100554 }
Willy Tarreau39713102016-11-25 15:49:32 +0100555 }
556 }
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100557 end:
Willy Tarreau39713102016-11-25 15:49:32 +0100558 return result;
559}
560
561/* Parse a tcp-response rule. Return a negative value in case of failure */
562static int tcp_parse_response_rule(char **args, int arg, int section_type,
563 struct proxy *curpx, struct proxy *defpx,
564 struct act_rule *rule, char **err,
565 unsigned int where,
566 const char *file, int line)
567{
568 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
569 memprintf(err, "%s %s is only allowed in 'backend' sections",
570 args[0], args[1]);
571 return -1;
572 }
573
574 if (strcmp(args[arg], "accept") == 0) {
575 arg++;
576 rule->action = ACT_ACTION_ALLOW;
Christopher Faulet245cf792019-12-18 14:58:12 +0100577 rule->flags |= ACT_FLAG_FINAL;
Willy Tarreau39713102016-11-25 15:49:32 +0100578 }
579 else if (strcmp(args[arg], "reject") == 0) {
580 arg++;
581 rule->action = ACT_ACTION_DENY;
Christopher Faulet245cf792019-12-18 14:58:12 +0100582 rule->flags |= ACT_FLAG_FINAL;
Willy Tarreau39713102016-11-25 15:49:32 +0100583 }
584 else if (strcmp(args[arg], "close") == 0) {
585 arg++;
586 rule->action = ACT_TCP_CLOSE;
Christopher Faulet245cf792019-12-18 14:58:12 +0100587 rule->flags |= ACT_FLAG_FINAL;
Willy Tarreau39713102016-11-25 15:49:32 +0100588 }
589 else {
590 struct action_kw *kw;
591 kw = tcp_res_cont_action(args[arg]);
592 if (kw) {
593 arg++;
Willy Tarreau39713102016-11-25 15:49:32 +0100594 rule->kw = kw;
595 if (kw->parse((const char **)args, &arg, curpx, rule, err) == ACT_RET_PRS_ERR)
596 return -1;
597 } else {
598 action_build_list(&tcp_res_cont_keywords, &trash);
599 memprintf(err,
600 "'%s %s' expects 'accept', 'close', 'reject', %s in %s '%s' (got '%s')",
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200601 args[0], args[1], trash.area,
602 proxy_type_str(curpx), curpx->id, args[arg]);
Willy Tarreau39713102016-11-25 15:49:32 +0100603 return -1;
604 }
605 }
606
607 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
Christopher Faulet1b421ea2017-09-22 14:38:56 +0200608 if ((rule->cond = build_acl_cond(file, line, &curpx->acl, curpx, (const char **)args+arg, err)) == NULL) {
Willy Tarreau39713102016-11-25 15:49:32 +0100609 memprintf(err,
610 "'%s %s %s' : error detected in %s '%s' while parsing '%s' condition : %s",
611 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg], *err);
612 return -1;
613 }
614 }
615 else if (*args[arg]) {
616 memprintf(err,
617 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (got '%s')",
618 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
619 return -1;
620 }
621 return 0;
622}
623
Christopher Fauletac98d812019-12-18 09:20:16 +0100624
625/* This function executes a track-sc* actions. On success, it returns
626 * ACT_RET_CONT. If it must yield, it return ACT_RET_YIELD. Otherwsize
627 * ACT_RET_ERR is returned.
628 */
629static enum act_return tcp_action_track_sc(struct act_rule *rule, struct proxy *px,
630 struct session *sess, struct stream *s, int flags)
631{
632 struct stksess *ts;
633 struct stktable *t;
634 struct stktable_key *key;
635 struct sample smp;
636 int opt;
637
638 opt = ((rule->from == ACT_F_TCP_REQ_CNT) ? SMP_OPT_DIR_REQ : SMP_OPT_DIR_RES);
639 if (flags & ACT_FLAG_FINAL)
640 opt |= SMP_OPT_FINAL;
Willy Tarreau39713102016-11-25 15:49:32 +0100641
Christopher Fauletac98d812019-12-18 09:20:16 +0100642 if (stkctr_entry(&s->stkctr[rule->action]))
643 goto end;
644
645 t = rule->arg.trk_ctr.table.t;
646 key = stktable_fetch_key(t, s->be, sess, s, opt, rule->arg.trk_ctr.expr, &smp);
647
648 if ((smp.flags & SMP_F_MAY_CHANGE) && !(flags & ACT_FLAG_FINAL))
649 return ACT_RET_YIELD; /* key might appear later */
650
651 if (key && (ts = stktable_get_entry(t, key))) {
652 stream_track_stkctr(&s->stkctr[rule->action], t, ts);
653 if (rule->from == ACT_F_TCP_REQ_CNT) {
654 stkctr_set_flags(&s->stkctr[rule->action], STKCTR_TRACK_CONTENT);
655 if (sess->fe != s->be)
656 stkctr_set_flags(&s->stkctr[rule->action], STKCTR_TRACK_BACKEND);
657 }
658 }
659
660 end:
661 return ACT_RET_CONT;
662}
Willy Tarreau39713102016-11-25 15:49:32 +0100663
Christopher Fauletd73b96d2019-12-19 17:27:03 +0100664/* This function executes a capture actions. It executes a fetch expression,
665 * turns the result into a string and puts it in a capture slot. On success, it
666 * returns ACT_RET_CONT. If it must yield, it return ACT_RET_YIELD. Otherwsize
667 * ACT_RET_ERR is returned.
668 */
669static enum act_return tcp_action_capture(struct act_rule *rule, struct proxy *px,
670 struct session *sess, struct stream *s, int flags)
671{
672 struct sample *key;
673 struct cap_hdr *h = rule->arg.cap.hdr;
674 char **cap = s->req_cap;
675 int len, opt;
676
677 opt = ((rule->from == ACT_F_TCP_REQ_CNT) ? SMP_OPT_DIR_REQ : SMP_OPT_DIR_RES);
678 if (flags & ACT_FLAG_FINAL)
679 opt |= SMP_OPT_FINAL;
680
681 key = sample_fetch_as_type(s->be, sess, s, opt, rule->arg.cap.expr, SMP_T_STR);
682 if (!key)
683 goto end;
684
685 if ((key->flags & SMP_F_MAY_CHANGE) && !(flags & ACT_FLAG_FINAL))
686 return ACT_RET_YIELD; /* key might appear later */
687
688 if (cap[h->index] == NULL) {
689 cap[h->index] = pool_alloc(h->pool);
690 if (cap[h->index] == NULL) /* no more capture memory, ignore error */
691 goto end;
692 }
693
694 len = key->data.u.str.data;
695 if (len > h->len)
696 len = h->len;
697
698 memcpy(cap[h->index], key->data.u.str.area, len);
699 cap[h->index][len] = 0;
700
701 end:
702 return ACT_RET_CONT;
703}
704
Christopher Fauletadfc6e82020-01-14 15:05:33 +0100705static void release_tcp_capture(struct act_rule * rule)
706{
707 release_sample_expr(rule->arg.cap.expr);
708}
709
710
711static void release_tcp_track_sc(struct act_rule * rule)
712{
713 release_sample_expr(rule->arg.trk_ctr.expr);
714}
715
Willy Tarreau39713102016-11-25 15:49:32 +0100716/* Parse a tcp-request rule. Return a negative value in case of failure */
717static int tcp_parse_request_rule(char **args, int arg, int section_type,
718 struct proxy *curpx, struct proxy *defpx,
719 struct act_rule *rule, char **err,
720 unsigned int where, const char *file, int line)
721{
722 if (curpx == defpx) {
723 memprintf(err, "%s %s is not allowed in 'defaults' sections",
724 args[0], args[1]);
725 return -1;
726 }
727
728 if (!strcmp(args[arg], "accept")) {
729 arg++;
730 rule->action = ACT_ACTION_ALLOW;
Christopher Faulet245cf792019-12-18 14:58:12 +0100731 rule->flags |= ACT_FLAG_FINAL;
Willy Tarreau39713102016-11-25 15:49:32 +0100732 }
733 else if (!strcmp(args[arg], "reject")) {
734 arg++;
735 rule->action = ACT_ACTION_DENY;
Christopher Faulet245cf792019-12-18 14:58:12 +0100736 rule->flags |= ACT_FLAG_FINAL;
Willy Tarreau39713102016-11-25 15:49:32 +0100737 }
738 else if (strcmp(args[arg], "capture") == 0) {
739 struct sample_expr *expr;
740 struct cap_hdr *hdr;
741 int kw = arg;
742 int len = 0;
743
744 if (!(curpx->cap & PR_CAP_FE)) {
745 memprintf(err,
746 "'%s %s %s' : proxy '%s' has no frontend capability",
747 args[0], args[1], args[kw], curpx->id);
748 return -1;
749 }
750
751 if (!(where & SMP_VAL_FE_REQ_CNT)) {
752 memprintf(err,
753 "'%s %s' is not allowed in '%s %s' rules in %s '%s'",
754 args[arg], args[arg+1], args[0], args[1], proxy_type_str(curpx), curpx->id);
755 return -1;
756 }
757
758 arg++;
759
760 curpx->conf.args.ctx = ARGC_CAP;
761 expr = sample_parse_expr(args, &arg, file, line, err, &curpx->conf.args);
762 if (!expr) {
763 memprintf(err,
764 "'%s %s %s' : %s",
765 args[0], args[1], args[kw], *err);
766 return -1;
767 }
768
769 if (!(expr->fetch->val & where)) {
770 memprintf(err,
771 "'%s %s %s' : fetch method '%s' extracts information from '%s', none of which is available here",
772 args[0], args[1], args[kw], args[arg-1], sample_src_names(expr->fetch->use));
Christopher Fauletfdb6fbf2020-01-14 15:05:56 +0100773 release_sample_expr(expr);
Willy Tarreau39713102016-11-25 15:49:32 +0100774 return -1;
775 }
776
777 if (strcmp(args[arg], "len") == 0) {
778 arg++;
779 if (!args[arg]) {
780 memprintf(err,
781 "'%s %s %s' : missing length value",
782 args[0], args[1], args[kw]);
Christopher Fauletfdb6fbf2020-01-14 15:05:56 +0100783 release_sample_expr(expr);
Willy Tarreau39713102016-11-25 15:49:32 +0100784 return -1;
785 }
786 /* we copy the table name for now, it will be resolved later */
787 len = atoi(args[arg]);
788 if (len <= 0) {
789 memprintf(err,
790 "'%s %s %s' : length must be > 0",
791 args[0], args[1], args[kw]);
Christopher Fauletfdb6fbf2020-01-14 15:05:56 +0100792 release_sample_expr(expr);
Willy Tarreau39713102016-11-25 15:49:32 +0100793 return -1;
794 }
795 arg++;
796 }
797
798 if (!len) {
799 memprintf(err,
800 "'%s %s %s' : a positive 'len' argument is mandatory",
801 args[0], args[1], args[kw]);
802 free(expr);
803 return -1;
804 }
805
806 hdr = calloc(1, sizeof(*hdr));
807 hdr->next = curpx->req_cap;
808 hdr->name = NULL; /* not a header capture */
809 hdr->namelen = 0;
810 hdr->len = len;
811 hdr->pool = create_pool("caphdr", hdr->len + 1, MEM_F_SHARED);
812 hdr->index = curpx->nb_req_cap++;
813
814 curpx->req_cap = hdr;
815 curpx->to_log |= LW_REQHDR;
816
Christopher Faulet711ed6a2019-07-16 14:16:10 +0200817 /* check if we need to allocate an http_txn struct for HTTP parsing */
Willy Tarreau39713102016-11-25 15:49:32 +0100818 curpx->http_needed |= !!(expr->fetch->use & SMP_USE_HTTP_ANY);
819
820 rule->arg.cap.expr = expr;
821 rule->arg.cap.hdr = hdr;
Christopher Fauletd73b96d2019-12-19 17:27:03 +0100822 rule->action = ACT_CUSTOM;
823 rule->action_ptr = tcp_action_capture;
824 rule->check_ptr = check_capture;
Christopher Fauletadfc6e82020-01-14 15:05:33 +0100825 rule->release_ptr = release_tcp_capture;
Willy Tarreau39713102016-11-25 15:49:32 +0100826 }
Frédéric Lécaillea41d5312018-01-29 12:05:07 +0100827 else if (strncmp(args[arg], "track-sc", 8) == 0) {
Willy Tarreau39713102016-11-25 15:49:32 +0100828 struct sample_expr *expr;
829 int kw = arg;
Frédéric Lécaillea41d5312018-01-29 12:05:07 +0100830 unsigned int tsc_num;
831 const char *tsc_num_str;
Willy Tarreau39713102016-11-25 15:49:32 +0100832
833 arg++;
834
Frédéric Lécaillea41d5312018-01-29 12:05:07 +0100835 tsc_num_str = &args[kw][8];
836 if (cfg_parse_track_sc_num(&tsc_num, tsc_num_str, tsc_num_str + strlen(tsc_num_str), err) == -1) {
837 memprintf(err, "'%s %s %s' : %s", args[0], args[1], args[kw], *err);
838 return -1;
839 }
840
Willy Tarreau39713102016-11-25 15:49:32 +0100841 curpx->conf.args.ctx = ARGC_TRK;
842 expr = sample_parse_expr(args, &arg, file, line, err, &curpx->conf.args);
843 if (!expr) {
844 memprintf(err,
845 "'%s %s %s' : %s",
846 args[0], args[1], args[kw], *err);
847 return -1;
848 }
849
850 if (!(expr->fetch->val & where)) {
851 memprintf(err,
852 "'%s %s %s' : fetch method '%s' extracts information from '%s', none of which is available here",
853 args[0], args[1], args[kw], args[arg-1], sample_src_names(expr->fetch->use));
Christopher Fauletfdb6fbf2020-01-14 15:05:56 +0100854 release_sample_expr(expr);
Willy Tarreau39713102016-11-25 15:49:32 +0100855 return -1;
856 }
857
Christopher Faulet711ed6a2019-07-16 14:16:10 +0200858 /* check if we need to allocate an http_txn struct for HTTP parsing */
Willy Tarreau39713102016-11-25 15:49:32 +0100859 curpx->http_needed |= !!(expr->fetch->use & SMP_USE_HTTP_ANY);
860
861 if (strcmp(args[arg], "table") == 0) {
862 arg++;
863 if (!args[arg]) {
864 memprintf(err,
865 "'%s %s %s' : missing table name",
866 args[0], args[1], args[kw]);
Christopher Fauletfdb6fbf2020-01-14 15:05:56 +0100867 release_sample_expr(expr);
Willy Tarreau39713102016-11-25 15:49:32 +0100868 return -1;
869 }
870 /* we copy the table name for now, it will be resolved later */
871 rule->arg.trk_ctr.table.n = strdup(args[arg]);
872 arg++;
873 }
Christopher Fauletac98d812019-12-18 09:20:16 +0100874 rule->action = tsc_num;
Willy Tarreau39713102016-11-25 15:49:32 +0100875 rule->arg.trk_ctr.expr = expr;
Christopher Fauletac98d812019-12-18 09:20:16 +0100876 rule->action_ptr = tcp_action_track_sc;
Christopher Faulet78880fb2017-09-18 14:43:55 +0200877 rule->check_ptr = check_trk_action;
Christopher Fauletadfc6e82020-01-14 15:05:33 +0100878 rule->release_ptr = release_tcp_track_sc;
Willy Tarreau39713102016-11-25 15:49:32 +0100879 }
880 else if (strcmp(args[arg], "expect-proxy") == 0) {
881 if (strcmp(args[arg+1], "layer4") != 0) {
882 memprintf(err,
883 "'%s %s %s' only supports 'layer4' in %s '%s' (got '%s')",
884 args[0], args[1], args[arg], proxy_type_str(curpx), curpx->id, args[arg+1]);
885 return -1;
886 }
887
888 if (!(where & SMP_VAL_FE_CON_ACC)) {
889 memprintf(err,
890 "'%s %s' is not allowed in '%s %s' rules in %s '%s'",
891 args[arg], args[arg+1], args[0], args[1], proxy_type_str(curpx), curpx->id);
892 return -1;
893 }
894
895 arg += 2;
896 rule->action = ACT_TCP_EXPECT_PX;
897 }
898 else if (strcmp(args[arg], "expect-netscaler-cip") == 0) {
899 if (strcmp(args[arg+1], "layer4") != 0) {
900 memprintf(err,
901 "'%s %s %s' only supports 'layer4' in %s '%s' (got '%s')",
902 args[0], args[1], args[arg], proxy_type_str(curpx), curpx->id, args[arg+1]);
903 return -1;
904 }
905
906 if (!(where & SMP_VAL_FE_CON_ACC)) {
907 memprintf(err,
908 "'%s %s' is not allowed in '%s %s' rules in %s '%s'",
909 args[arg], args[arg+1], args[0], args[1], proxy_type_str(curpx), curpx->id);
910 return -1;
911 }
912
913 arg += 2;
914 rule->action = ACT_TCP_EXPECT_CIP;
915 }
916 else {
917 struct action_kw *kw;
918 if (where & SMP_VAL_FE_CON_ACC) {
919 /* L4 */
920 kw = tcp_req_conn_action(args[arg]);
921 rule->kw = kw;
Willy Tarreau39713102016-11-25 15:49:32 +0100922 } else if (where & SMP_VAL_FE_SES_ACC) {
923 /* L5 */
924 kw = tcp_req_sess_action(args[arg]);
925 rule->kw = kw;
Willy Tarreau39713102016-11-25 15:49:32 +0100926 } else {
927 /* L6 */
928 kw = tcp_req_cont_action(args[arg]);
929 rule->kw = kw;
Willy Tarreau39713102016-11-25 15:49:32 +0100930 }
931 if (kw) {
932 arg++;
933 if (kw->parse((const char **)args, &arg, curpx, rule, err) == ACT_RET_PRS_ERR)
934 return -1;
935 } else {
936 if (where & SMP_VAL_FE_CON_ACC)
937 action_build_list(&tcp_req_conn_keywords, &trash);
938 else if (where & SMP_VAL_FE_SES_ACC)
939 action_build_list(&tcp_req_sess_keywords, &trash);
940 else
941 action_build_list(&tcp_req_cont_keywords, &trash);
942 memprintf(err,
943 "'%s %s' expects 'accept', 'reject', 'track-sc0' ... 'track-sc%d', %s "
944 "in %s '%s' (got '%s').\n",
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200945 args[0], args[1], MAX_SESS_STKCTR-1,
946 trash.area, proxy_type_str(curpx),
Willy Tarreau39713102016-11-25 15:49:32 +0100947 curpx->id, args[arg]);
948 return -1;
949 }
950 }
951
952 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
Christopher Faulet1b421ea2017-09-22 14:38:56 +0200953 if ((rule->cond = build_acl_cond(file, line, &curpx->acl, curpx, (const char **)args+arg, err)) == NULL) {
Willy Tarreau39713102016-11-25 15:49:32 +0100954 memprintf(err,
955 "'%s %s %s' : error detected in %s '%s' while parsing '%s' condition : %s",
956 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg], *err);
957 return -1;
958 }
959 }
960 else if (*args[arg]) {
961 memprintf(err,
962 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (got '%s')",
963 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
964 return -1;
965 }
966 return 0;
967}
968
969/* This function should be called to parse a line starting with the "tcp-response"
970 * keyword.
971 */
972static int tcp_parse_tcp_rep(char **args, int section_type, struct proxy *curpx,
973 struct proxy *defpx, const char *file, int line,
974 char **err)
975{
976 const char *ptr = NULL;
977 unsigned int val;
978 int warn = 0;
979 int arg;
980 struct act_rule *rule;
981 unsigned int where;
982 const struct acl *acl;
983 const char *kw;
984
985 if (!*args[1]) {
986 memprintf(err, "missing argument for '%s' in %s '%s'",
987 args[0], proxy_type_str(curpx), curpx->id);
988 return -1;
989 }
990
991 if (strcmp(args[1], "inspect-delay") == 0) {
992 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
993 memprintf(err, "%s %s is only allowed in 'backend' sections",
994 args[0], args[1]);
995 return -1;
996 }
997
998 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
999 memprintf(err,
1000 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
1001 args[0], args[1], proxy_type_str(curpx), curpx->id);
Willy Tarreau9faebe32019-06-07 19:00:37 +02001002
1003 if (ptr == PARSE_TIME_OVER)
1004 memprintf(err, "%s (timer overflow in '%s', maximum value is 2147483647 ms or ~24.8 days)", *err, args[2]);
1005 else if (ptr == PARSE_TIME_UNDER)
1006 memprintf(err, "%s (timer underflow in '%s', minimum non-null value is 1 ms)", *err, args[2]);
1007 else if (ptr)
Willy Tarreau39713102016-11-25 15:49:32 +01001008 memprintf(err, "%s (unexpected character '%c')", *err, *ptr);
1009 return -1;
1010 }
1011
1012 if (curpx->tcp_rep.inspect_delay) {
1013 memprintf(err, "ignoring %s %s (was already defined) in %s '%s'",
1014 args[0], args[1], proxy_type_str(curpx), curpx->id);
1015 return 1;
1016 }
1017 curpx->tcp_rep.inspect_delay = val;
1018 return 0;
1019 }
1020
1021 rule = calloc(1, sizeof(*rule));
1022 LIST_INIT(&rule->list);
1023 arg = 1;
1024 where = 0;
1025
1026 if (strcmp(args[1], "content") == 0) {
1027 arg++;
1028
1029 if (curpx->cap & PR_CAP_FE)
1030 where |= SMP_VAL_FE_RES_CNT;
1031 if (curpx->cap & PR_CAP_BE)
1032 where |= SMP_VAL_BE_RES_CNT;
Christopher Fauletcb9106b2019-12-19 15:23:17 +01001033 rule->from = ACT_F_TCP_RES_CNT;
Willy Tarreau39713102016-11-25 15:49:32 +01001034 if (tcp_parse_response_rule(args, arg, section_type, curpx, defpx, rule, err, where, file, line) < 0)
1035 goto error;
1036
1037 acl = rule->cond ? acl_cond_conflicts(rule->cond, where) : NULL;
1038 if (acl) {
1039 if (acl->name && *acl->name)
1040 memprintf(err,
1041 "acl '%s' will never match in '%s %s' because it only involves keywords that are incompatible with '%s'",
1042 acl->name, args[0], args[1], sample_ckp_names(where));
1043 else
1044 memprintf(err,
1045 "anonymous acl will never match in '%s %s' because it uses keyword '%s' which is incompatible with '%s'",
1046 args[0], args[1],
1047 LIST_ELEM(acl->expr.n, struct acl_expr *, list)->kw,
1048 sample_ckp_names(where));
1049
1050 warn++;
1051 }
1052 else if (rule->cond && acl_cond_kw_conflicts(rule->cond, where, &acl, &kw)) {
1053 if (acl->name && *acl->name)
1054 memprintf(err,
1055 "acl '%s' involves keyword '%s' which is incompatible with '%s'",
1056 acl->name, kw, sample_ckp_names(where));
1057 else
1058 memprintf(err,
1059 "anonymous acl involves keyword '%s' which is incompatible with '%s'",
1060 kw, sample_ckp_names(where));
1061 warn++;
1062 }
1063
1064 LIST_ADDQ(&curpx->tcp_rep.inspect_rules, &rule->list);
1065 }
1066 else {
1067 memprintf(err,
1068 "'%s' expects 'inspect-delay' or 'content' in %s '%s' (got '%s')",
1069 args[0], proxy_type_str(curpx), curpx->id, args[1]);
1070 goto error;
1071 }
1072
1073 return warn;
1074 error:
1075 free(rule);
1076 return -1;
1077}
1078
1079
1080/* This function should be called to parse a line starting with the "tcp-request"
1081 * keyword.
1082 */
1083static int tcp_parse_tcp_req(char **args, int section_type, struct proxy *curpx,
1084 struct proxy *defpx, const char *file, int line,
1085 char **err)
1086{
1087 const char *ptr = NULL;
1088 unsigned int val;
1089 int warn = 0;
1090 int arg;
1091 struct act_rule *rule;
1092 unsigned int where;
1093 const struct acl *acl;
1094 const char *kw;
1095
1096 if (!*args[1]) {
1097 if (curpx == defpx)
1098 memprintf(err, "missing argument for '%s' in defaults section", args[0]);
1099 else
1100 memprintf(err, "missing argument for '%s' in %s '%s'",
1101 args[0], proxy_type_str(curpx), curpx->id);
1102 return -1;
1103 }
1104
1105 if (!strcmp(args[1], "inspect-delay")) {
1106 if (curpx == defpx) {
1107 memprintf(err, "%s %s is not allowed in 'defaults' sections",
1108 args[0], args[1]);
1109 return -1;
1110 }
1111
1112 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
1113 memprintf(err,
1114 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
1115 args[0], args[1], proxy_type_str(curpx), curpx->id);
Willy Tarreau9faebe32019-06-07 19:00:37 +02001116
1117 if (ptr == PARSE_TIME_OVER)
1118 memprintf(err, "%s (timer overflow in '%s', maximum value is 2147483647 ms or ~24.8 days)", *err, args[2]);
1119 else if (ptr == PARSE_TIME_UNDER)
1120 memprintf(err, "%s (timer underflow in '%s', minimum non-null value is 1 ms)", *err, args[2]);
1121 else if (ptr)
Willy Tarreau39713102016-11-25 15:49:32 +01001122 memprintf(err, "%s (unexpected character '%c')", *err, *ptr);
1123 return -1;
1124 }
1125
1126 if (curpx->tcp_req.inspect_delay) {
1127 memprintf(err, "ignoring %s %s (was already defined) in %s '%s'",
1128 args[0], args[1], proxy_type_str(curpx), curpx->id);
1129 return 1;
1130 }
1131 curpx->tcp_req.inspect_delay = val;
1132 return 0;
1133 }
1134
1135 rule = calloc(1, sizeof(*rule));
1136 LIST_INIT(&rule->list);
1137 arg = 1;
1138 where = 0;
1139
1140 if (strcmp(args[1], "content") == 0) {
1141 arg++;
1142
1143 if (curpx->cap & PR_CAP_FE)
1144 where |= SMP_VAL_FE_REQ_CNT;
1145 if (curpx->cap & PR_CAP_BE)
1146 where |= SMP_VAL_BE_REQ_CNT;
Christopher Fauletcb9106b2019-12-19 15:23:17 +01001147 rule->from = ACT_F_TCP_REQ_CNT;
Willy Tarreau39713102016-11-25 15:49:32 +01001148 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, where, file, line) < 0)
1149 goto error;
1150
1151 acl = rule->cond ? acl_cond_conflicts(rule->cond, where) : NULL;
1152 if (acl) {
1153 if (acl->name && *acl->name)
1154 memprintf(err,
1155 "acl '%s' will never match in '%s %s' because it only involves keywords that are incompatible with '%s'",
1156 acl->name, args[0], args[1], sample_ckp_names(where));
1157 else
1158 memprintf(err,
1159 "anonymous acl will never match in '%s %s' because it uses keyword '%s' which is incompatible with '%s'",
1160 args[0], args[1],
1161 LIST_ELEM(acl->expr.n, struct acl_expr *, list)->kw,
1162 sample_ckp_names(where));
1163
1164 warn++;
1165 }
1166 else if (rule->cond && acl_cond_kw_conflicts(rule->cond, where, &acl, &kw)) {
1167 if (acl->name && *acl->name)
1168 memprintf(err,
1169 "acl '%s' involves keyword '%s' which is incompatible with '%s'",
1170 acl->name, kw, sample_ckp_names(where));
1171 else
1172 memprintf(err,
1173 "anonymous acl involves keyword '%s' which is incompatible with '%s'",
1174 kw, sample_ckp_names(where));
1175 warn++;
1176 }
1177
1178 /* the following function directly emits the warning */
1179 warnif_misplaced_tcp_cont(curpx, file, line, args[0]);
1180 LIST_ADDQ(&curpx->tcp_req.inspect_rules, &rule->list);
1181 }
1182 else if (strcmp(args[1], "connection") == 0) {
1183 arg++;
1184
1185 if (!(curpx->cap & PR_CAP_FE)) {
1186 memprintf(err, "%s %s is not allowed because %s %s is not a frontend",
1187 args[0], args[1], proxy_type_str(curpx), curpx->id);
1188 goto error;
1189 }
1190
1191 where |= SMP_VAL_FE_CON_ACC;
Christopher Fauletcb9106b2019-12-19 15:23:17 +01001192 rule->from = ACT_F_TCP_REQ_CON;
Willy Tarreau39713102016-11-25 15:49:32 +01001193 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, where, file, line) < 0)
1194 goto error;
1195
1196 acl = rule->cond ? acl_cond_conflicts(rule->cond, where) : NULL;
1197 if (acl) {
1198 if (acl->name && *acl->name)
1199 memprintf(err,
1200 "acl '%s' will never match in '%s %s' because it only involves keywords that are incompatible with '%s'",
1201 acl->name, args[0], args[1], sample_ckp_names(where));
1202 else
1203 memprintf(err,
1204 "anonymous acl will never match in '%s %s' because it uses keyword '%s' which is incompatible with '%s'",
1205 args[0], args[1],
1206 LIST_ELEM(acl->expr.n, struct acl_expr *, list)->kw,
1207 sample_ckp_names(where));
1208
1209 warn++;
1210 }
1211 else if (rule->cond && acl_cond_kw_conflicts(rule->cond, where, &acl, &kw)) {
1212 if (acl->name && *acl->name)
1213 memprintf(err,
1214 "acl '%s' involves keyword '%s' which is incompatible with '%s'",
1215 acl->name, kw, sample_ckp_names(where));
1216 else
1217 memprintf(err,
1218 "anonymous acl involves keyword '%s' which is incompatible with '%s'",
1219 kw, sample_ckp_names(where));
1220 warn++;
1221 }
1222
1223 /* the following function directly emits the warning */
1224 warnif_misplaced_tcp_conn(curpx, file, line, args[0]);
1225 LIST_ADDQ(&curpx->tcp_req.l4_rules, &rule->list);
1226 }
1227 else if (strcmp(args[1], "session") == 0) {
1228 arg++;
1229
1230 if (!(curpx->cap & PR_CAP_FE)) {
1231 memprintf(err, "%s %s is not allowed because %s %s is not a frontend",
1232 args[0], args[1], proxy_type_str(curpx), curpx->id);
1233 goto error;
1234 }
1235
1236 where |= SMP_VAL_FE_SES_ACC;
Christopher Fauletcb9106b2019-12-19 15:23:17 +01001237 rule->from = ACT_F_TCP_REQ_SES;
Willy Tarreau39713102016-11-25 15:49:32 +01001238 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, where, file, line) < 0)
1239 goto error;
1240
1241 acl = rule->cond ? acl_cond_conflicts(rule->cond, where) : NULL;
1242 if (acl) {
1243 if (acl->name && *acl->name)
1244 memprintf(err,
1245 "acl '%s' will never match in '%s %s' because it only involves keywords that are incompatible with '%s'",
1246 acl->name, args[0], args[1], sample_ckp_names(where));
1247 else
1248 memprintf(err,
1249 "anonymous acl will never match in '%s %s' because it uses keyword '%s' which is incompatible with '%s'",
1250 args[0], args[1],
1251 LIST_ELEM(acl->expr.n, struct acl_expr *, list)->kw,
1252 sample_ckp_names(where));
1253 warn++;
1254 }
1255 else if (rule->cond && acl_cond_kw_conflicts(rule->cond, where, &acl, &kw)) {
1256 if (acl->name && *acl->name)
1257 memprintf(err,
1258 "acl '%s' involves keyword '%s' which is incompatible with '%s'",
1259 acl->name, kw, sample_ckp_names(where));
1260 else
1261 memprintf(err,
1262 "anonymous acl involves keyword '%s' which is incompatible with '%s'",
1263 kw, sample_ckp_names(where));
1264 warn++;
1265 }
1266
1267 /* the following function directly emits the warning */
1268 warnif_misplaced_tcp_sess(curpx, file, line, args[0]);
1269 LIST_ADDQ(&curpx->tcp_req.l5_rules, &rule->list);
1270 }
1271 else {
1272 if (curpx == defpx)
1273 memprintf(err,
1274 "'%s' expects 'inspect-delay', 'connection', or 'content' in defaults section (got '%s')",
1275 args[0], args[1]);
1276 else
1277 memprintf(err,
1278 "'%s' expects 'inspect-delay', 'connection', or 'content' in %s '%s' (got '%s')",
1279 args[0], proxy_type_str(curpx), curpx->id, args[1]);
1280 goto error;
1281 }
1282
1283 return warn;
1284 error:
1285 free(rule);
1286 return -1;
1287}
1288
1289static struct cfg_kw_list cfg_kws = {ILH, {
1290 { CFG_LISTEN, "tcp-request", tcp_parse_tcp_req },
1291 { CFG_LISTEN, "tcp-response", tcp_parse_tcp_rep },
1292 { 0, NULL, NULL },
1293}};
1294
Willy Tarreau0108d902018-11-25 19:14:37 +01001295INITCALL1(STG_REGISTER, cfg_register_keywords, &cfg_kws);
Willy Tarreau39713102016-11-25 15:49:32 +01001296
1297/*
1298 * Local variables:
1299 * c-indent-level: 8
1300 * c-basic-offset: 8
1301 * End:
1302 */