blob: dc7812d21c7bd92551dbc2bb39e957fef3cd3288 [file] [log] [blame]
Willy Tarreaue6b98942007-10-29 01:09:36 +01001/*
2 * AF_INET/AF_INET6 SOCK_STREAM protocol layer (tcp)
3 *
Willy Tarreau1a687942010-05-23 22:40:30 +02004 * Copyright 2000-2010 Willy Tarreau <w@1wt.eu>
Willy Tarreaue6b98942007-10-29 01:09:36 +01005 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
13#include <ctype.h>
14#include <errno.h>
15#include <fcntl.h>
16#include <stdio.h>
17#include <stdlib.h>
18#include <string.h>
19#include <time.h>
20
21#include <sys/param.h>
22#include <sys/socket.h>
23#include <sys/stat.h>
24#include <sys/types.h>
25#include <sys/un.h>
26
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +040027#include <netinet/tcp.h>
28
Willy Tarreaub6866442008-07-14 23:54:42 +020029#include <common/cfgparse.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010030#include <common/compat.h>
31#include <common/config.h>
32#include <common/debug.h>
33#include <common/errors.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010034#include <common/mini-clist.h>
35#include <common/standard.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010036
Willy Tarreaue6b98942007-10-29 01:09:36 +010037#include <types/global.h>
Willy Tarreau9650f372009-08-16 14:02:45 +020038#include <types/server.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010039
40#include <proto/acl.h>
Willy Tarreau9fcb9842012-04-20 14:45:49 +020041#include <proto/arg.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010042#include <proto/buffers.h>
Willy Tarreau03fa5df2010-05-24 21:02:37 +020043#include <proto/frontend.h>
Willy Tarreau9650f372009-08-16 14:02:45 +020044#include <proto/log.h>
Willy Tarreau645513a2010-05-24 20:55:15 +020045#include <proto/pattern.h>
Willy Tarreau9650f372009-08-16 14:02:45 +020046#include <proto/port_range.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010047#include <proto/protocols.h>
48#include <proto/proto_tcp.h>
Willy Tarreaub6866442008-07-14 23:54:42 +020049#include <proto/proxy.h>
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +020050#include <proto/session.h>
Willy Tarreaua975b8f2010-06-05 19:13:27 +020051#include <proto/stick_table.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010052#include <proto/stream_sock.h>
Willy Tarreaua975b8f2010-06-05 19:13:27 +020053#include <proto/task.h>
Emeric Brun97679e72010-09-23 17:56:44 +020054#include <proto/buffers.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010055
Willy Tarreaue8c66af2008-01-13 18:40:14 +010056#ifdef CONFIG_HAP_CTTPROXY
57#include <import/ip_tproxy.h>
58#endif
59
Emeric Bruncf20bf12010-10-22 16:06:11 +020060static int tcp_bind_listeners(struct protocol *proto, char *errmsg, int errlen);
61static int tcp_bind_listener(struct listener *listener, char *errmsg, int errlen);
Willy Tarreaue6b98942007-10-29 01:09:36 +010062
63/* Note: must not be declared <const> as its list will be overwritten */
64static struct protocol proto_tcpv4 = {
65 .name = "tcpv4",
66 .sock_domain = AF_INET,
67 .sock_type = SOCK_STREAM,
68 .sock_prot = IPPROTO_TCP,
69 .sock_family = AF_INET,
70 .sock_addrlen = sizeof(struct sockaddr_in),
71 .l3_addrlen = 32/8,
Willy Tarreaueb472682010-05-28 18:46:57 +020072 .accept = &stream_sock_accept,
Willy Tarreaue6b98942007-10-29 01:09:36 +010073 .read = &stream_sock_read,
74 .write = &stream_sock_write,
Emeric Bruncf20bf12010-10-22 16:06:11 +020075 .bind = tcp_bind_listener,
Willy Tarreaue6b98942007-10-29 01:09:36 +010076 .bind_all = tcp_bind_listeners,
77 .unbind_all = unbind_all_listeners,
78 .enable_all = enable_all_listeners,
79 .listeners = LIST_HEAD_INIT(proto_tcpv4.listeners),
80 .nb_listeners = 0,
81};
82
83/* Note: must not be declared <const> as its list will be overwritten */
84static struct protocol proto_tcpv6 = {
85 .name = "tcpv6",
86 .sock_domain = AF_INET6,
87 .sock_type = SOCK_STREAM,
88 .sock_prot = IPPROTO_TCP,
89 .sock_family = AF_INET6,
90 .sock_addrlen = sizeof(struct sockaddr_in6),
91 .l3_addrlen = 128/8,
Willy Tarreaueb472682010-05-28 18:46:57 +020092 .accept = &stream_sock_accept,
Willy Tarreaue6b98942007-10-29 01:09:36 +010093 .read = &stream_sock_read,
94 .write = &stream_sock_write,
Emeric Bruncf20bf12010-10-22 16:06:11 +020095 .bind = tcp_bind_listener,
Willy Tarreaue6b98942007-10-29 01:09:36 +010096 .bind_all = tcp_bind_listeners,
97 .unbind_all = unbind_all_listeners,
98 .enable_all = enable_all_listeners,
99 .listeners = LIST_HEAD_INIT(proto_tcpv6.listeners),
100 .nb_listeners = 0,
101};
102
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100103
David du Colombier6f5ccb12011-03-10 22:26:24 +0100104/* Binds ipv4/ipv6 address <local> to socket <fd>, unless <flags> is set, in which
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100105 * case we try to bind <remote>. <flags> is a 2-bit field consisting of :
106 * - 0 : ignore remote address (may even be a NULL pointer)
107 * - 1 : use provided address
108 * - 2 : use provided port
109 * - 3 : use both
110 *
111 * The function supports multiple foreign binding methods :
112 * - linux_tproxy: we directly bind to the foreign address
113 * - cttproxy: we bind to a local address then nat.
114 * The second one can be used as a fallback for the first one.
115 * This function returns 0 when everything's OK, 1 if it could not bind, to the
116 * local address, 2 if it could not bind to the foreign address.
117 */
David du Colombier6f5ccb12011-03-10 22:26:24 +0100118int tcp_bind_socket(int fd, int flags, struct sockaddr_storage *local, struct sockaddr_storage *remote)
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100119{
David du Colombier6f5ccb12011-03-10 22:26:24 +0100120 struct sockaddr_storage bind_addr;
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100121 int foreign_ok = 0;
122 int ret;
123
124#ifdef CONFIG_HAP_LINUX_TPROXY
125 static int ip_transp_working = 1;
126 if (flags && ip_transp_working) {
Simon Hormande072bd2011-06-24 15:11:37 +0900127 if (setsockopt(fd, SOL_IP, IP_TRANSPARENT, &one, sizeof(one)) == 0
128 || setsockopt(fd, SOL_IP, IP_FREEBIND, &one, sizeof(one)) == 0)
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100129 foreign_ok = 1;
130 else
131 ip_transp_working = 0;
132 }
133#endif
134 if (flags) {
135 memset(&bind_addr, 0, sizeof(bind_addr));
Willy Tarreau96dd0792011-04-19 07:20:57 +0200136 bind_addr.ss_family = remote->ss_family;
David du Colombier6f5ccb12011-03-10 22:26:24 +0100137 switch (remote->ss_family) {
138 case AF_INET:
139 if (flags & 1)
140 ((struct sockaddr_in *)&bind_addr)->sin_addr = ((struct sockaddr_in *)remote)->sin_addr;
141 if (flags & 2)
142 ((struct sockaddr_in *)&bind_addr)->sin_port = ((struct sockaddr_in *)remote)->sin_port;
143 break;
144 case AF_INET6:
145 if (flags & 1)
146 ((struct sockaddr_in6 *)&bind_addr)->sin6_addr = ((struct sockaddr_in6 *)remote)->sin6_addr;
147 if (flags & 2)
148 ((struct sockaddr_in6 *)&bind_addr)->sin6_port = ((struct sockaddr_in6 *)remote)->sin6_port;
149 break;
Willy Tarreau5dc1e982011-12-16 21:25:11 +0100150 default:
151 /* we don't want to try to bind to an unknown address family */
152 foreign_ok = 0;
David du Colombier6f5ccb12011-03-10 22:26:24 +0100153 }
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100154 }
155
Simon Hormande072bd2011-06-24 15:11:37 +0900156 setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one));
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100157 if (foreign_ok) {
Willy Tarreau1b4b7ce2011-04-05 16:56:50 +0200158 ret = bind(fd, (struct sockaddr *)&bind_addr, get_addr_len(&bind_addr));
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100159 if (ret < 0)
160 return 2;
161 }
162 else {
Willy Tarreau1b4b7ce2011-04-05 16:56:50 +0200163 ret = bind(fd, (struct sockaddr *)local, get_addr_len(local));
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100164 if (ret < 0)
165 return 1;
166 }
167
168 if (!flags)
169 return 0;
170
171#ifdef CONFIG_HAP_CTTPROXY
Willy Tarreau6f831b42011-03-20 14:03:54 +0100172 if (!foreign_ok && remote->ss_family == AF_INET) {
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100173 struct in_tproxy itp1, itp2;
174 memset(&itp1, 0, sizeof(itp1));
175
176 itp1.op = TPROXY_ASSIGN;
Willy Tarreau6f831b42011-03-20 14:03:54 +0100177 itp1.v.addr.faddr = ((struct sockaddr_in *)&bind_addr)->sin_addr;
178 itp1.v.addr.fport = ((struct sockaddr_in *)&bind_addr)->sin_port;
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100179
180 /* set connect flag on socket */
181 itp2.op = TPROXY_FLAGS;
182 itp2.v.flags = ITP_CONNECT | ITP_ONCE;
183
184 if (setsockopt(fd, SOL_IP, IP_TPROXY, &itp1, sizeof(itp1)) != -1 &&
185 setsockopt(fd, SOL_IP, IP_TPROXY, &itp2, sizeof(itp2)) != -1) {
186 foreign_ok = 1;
187 }
188 }
189#endif
190 if (!foreign_ok)
191 /* we could not bind to a foreign address */
192 return 2;
193
194 return 0;
195}
Willy Tarreaue6b98942007-10-29 01:09:36 +0100196
Willy Tarreau9650f372009-08-16 14:02:45 +0200197
198/*
Willy Tarreauac825402011-03-04 22:04:29 +0100199 * This function initiates a connection to the target assigned to this session
Willy Tarreau6471afb2011-09-23 10:54:59 +0200200 * (si->{target,addr.to}). A source address may be pointed to by si->addr.from
Willy Tarreauac825402011-03-04 22:04:29 +0100201 * in case of transparent proxying. Normal source bind addresses are still
202 * determined locally (due to the possible need of a source port).
203 * si->target may point either to a valid server or to a backend, depending
204 * on si->target.type. Only TARG_TYPE_PROXY and TARG_TYPE_SERVER are supported.
Willy Tarreaub1d67742010-03-29 19:36:59 +0200205 *
Willy Tarreau9650f372009-08-16 14:02:45 +0200206 * It can return one of :
207 * - SN_ERR_NONE if everything's OK
208 * - SN_ERR_SRVTO if there are no more servers
209 * - SN_ERR_SRVCL if the connection was refused by the server
210 * - SN_ERR_PRXCOND if the connection has been limited by the proxy (maxconn)
211 * - SN_ERR_RESOURCE if a system resource is lacking (eg: fd limits, ports, ...)
212 * - SN_ERR_INTERNAL for any other purely internal errors
213 * Additionnally, in the case of SN_ERR_RESOURCE, an emergency log will be emitted.
214 */
Willy Tarreauf1536862011-03-03 18:27:32 +0100215
David du Colombier6f5ccb12011-03-10 22:26:24 +0100216int tcp_connect_server(struct stream_interface *si)
Willy Tarreau9650f372009-08-16 14:02:45 +0200217{
218 int fd;
Willy Tarreauac825402011-03-04 22:04:29 +0100219 struct server *srv;
220 struct proxy *be;
221
222 switch (si->target.type) {
223 case TARG_TYPE_PROXY:
224 be = si->target.ptr.p;
225 srv = NULL;
226 break;
227 case TARG_TYPE_SERVER:
228 srv = si->target.ptr.s;
229 be = srv->proxy;
230 break;
231 default:
232 return SN_ERR_INTERNAL;
233 }
Willy Tarreau9650f372009-08-16 14:02:45 +0200234
Willy Tarreau6471afb2011-09-23 10:54:59 +0200235 if ((fd = si->fd = socket(si->addr.to.ss_family, SOCK_STREAM, IPPROTO_TCP)) == -1) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200236 qfprintf(stderr, "Cannot get a server socket.\n");
237
238 if (errno == ENFILE)
239 send_log(be, LOG_EMERG,
240 "Proxy %s reached system FD limit at %d. Please check system tunables.\n",
241 be->id, maxfd);
242 else if (errno == EMFILE)
243 send_log(be, LOG_EMERG,
244 "Proxy %s reached process FD limit at %d. Please check 'ulimit-n' and restart.\n",
245 be->id, maxfd);
246 else if (errno == ENOBUFS || errno == ENOMEM)
247 send_log(be, LOG_EMERG,
248 "Proxy %s reached system memory limit at %d sockets. Please check system tunables.\n",
249 be->id, maxfd);
250 /* this is a resource error */
251 return SN_ERR_RESOURCE;
252 }
253
254 if (fd >= global.maxsock) {
255 /* do not log anything there, it's a normal condition when this option
256 * is used to serialize connections to a server !
257 */
258 Alert("socket(): not enough free sockets. Raise -n argument. Giving up.\n");
259 close(fd);
260 return SN_ERR_PRXCOND; /* it is a configuration limit */
261 }
262
263 if ((fcntl(fd, F_SETFL, O_NONBLOCK)==-1) ||
Simon Hormande072bd2011-06-24 15:11:37 +0900264 (setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &one, sizeof(one)) == -1)) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200265 qfprintf(stderr,"Cannot set client socket to non blocking mode.\n");
266 close(fd);
267 return SN_ERR_INTERNAL;
268 }
269
270 if (be->options & PR_O_TCP_SRV_KA)
Simon Hormande072bd2011-06-24 15:11:37 +0900271 setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, &one, sizeof(one));
Willy Tarreau9650f372009-08-16 14:02:45 +0200272
273 if (be->options & PR_O_TCP_NOLING)
Willy Tarreauf6f82252011-11-30 18:02:24 +0100274 si->flags |= SI_FL_NOLINGER;
Willy Tarreau9650f372009-08-16 14:02:45 +0200275
276 /* allow specific binding :
277 * - server-specific at first
278 * - proxy-specific next
279 */
280 if (srv != NULL && srv->state & SRV_BIND_SRC) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200281 int ret, flags = 0;
282
Willy Tarreau9650f372009-08-16 14:02:45 +0200283 switch (srv->state & SRV_TPROXY_MASK) {
284 case SRV_TPROXY_ADDR:
Willy Tarreau9650f372009-08-16 14:02:45 +0200285 case SRV_TPROXY_CLI:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200286 flags = 3;
287 break;
Willy Tarreau9650f372009-08-16 14:02:45 +0200288 case SRV_TPROXY_CIP:
Willy Tarreau090466c2009-09-07 11:51:47 +0200289 case SRV_TPROXY_DYN:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200290 flags = 1;
Willy Tarreau9650f372009-08-16 14:02:45 +0200291 break;
292 }
Willy Tarreaub1d67742010-03-29 19:36:59 +0200293
Willy Tarreau9650f372009-08-16 14:02:45 +0200294#ifdef SO_BINDTODEVICE
295 /* Note: this might fail if not CAP_NET_RAW */
296 if (srv->iface_name)
297 setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, srv->iface_name, srv->iface_len + 1);
298#endif
299
300 if (srv->sport_range) {
301 int attempts = 10; /* should be more than enough to find a spare port */
David du Colombier6f5ccb12011-03-10 22:26:24 +0100302 struct sockaddr_storage src;
Willy Tarreau9650f372009-08-16 14:02:45 +0200303
304 ret = 1;
305 src = srv->source_addr;
306
307 do {
308 /* note: in case of retry, we may have to release a previously
309 * allocated port, hence this loop's construct.
310 */
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200311 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
312 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200313
314 if (!attempts)
315 break;
316 attempts--;
317
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200318 fdinfo[fd].local_port = port_range_alloc_port(srv->sport_range);
319 if (!fdinfo[fd].local_port)
Willy Tarreau9650f372009-08-16 14:02:45 +0200320 break;
321
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200322 fdinfo[fd].port_range = srv->sport_range;
Willy Tarreau86ad42c2011-08-27 12:29:07 +0200323 set_host_port(&src, fdinfo[fd].local_port);
Willy Tarreau9650f372009-08-16 14:02:45 +0200324
Willy Tarreau6471afb2011-09-23 10:54:59 +0200325 ret = tcp_bind_socket(fd, flags, &src, &si->addr.from);
Willy Tarreau9650f372009-08-16 14:02:45 +0200326 } while (ret != 0); /* binding NOK */
327 }
328 else {
Willy Tarreau6471afb2011-09-23 10:54:59 +0200329 ret = tcp_bind_socket(fd, flags, &srv->source_addr, &si->addr.from);
Willy Tarreau9650f372009-08-16 14:02:45 +0200330 }
331
332 if (ret) {
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200333 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
334 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200335 close(fd);
336
337 if (ret == 1) {
338 Alert("Cannot bind to source address before connect() for server %s/%s. Aborting.\n",
339 be->id, srv->id);
340 send_log(be, LOG_EMERG,
341 "Cannot bind to source address before connect() for server %s/%s.\n",
342 be->id, srv->id);
343 } else {
344 Alert("Cannot bind to tproxy source address before connect() for server %s/%s. Aborting.\n",
345 be->id, srv->id);
346 send_log(be, LOG_EMERG,
347 "Cannot bind to tproxy source address before connect() for server %s/%s.\n",
348 be->id, srv->id);
349 }
350 return SN_ERR_RESOURCE;
351 }
352 }
353 else if (be->options & PR_O_BIND_SRC) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200354 int ret, flags = 0;
355
Willy Tarreau9650f372009-08-16 14:02:45 +0200356 switch (be->options & PR_O_TPXY_MASK) {
357 case PR_O_TPXY_ADDR:
Willy Tarreau9650f372009-08-16 14:02:45 +0200358 case PR_O_TPXY_CLI:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200359 flags = 3;
360 break;
Willy Tarreau9650f372009-08-16 14:02:45 +0200361 case PR_O_TPXY_CIP:
Willy Tarreau090466c2009-09-07 11:51:47 +0200362 case PR_O_TPXY_DYN:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200363 flags = 1;
Willy Tarreau9650f372009-08-16 14:02:45 +0200364 break;
365 }
Willy Tarreaub1d67742010-03-29 19:36:59 +0200366
Willy Tarreau9650f372009-08-16 14:02:45 +0200367#ifdef SO_BINDTODEVICE
368 /* Note: this might fail if not CAP_NET_RAW */
369 if (be->iface_name)
370 setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, be->iface_name, be->iface_len + 1);
371#endif
Willy Tarreau6471afb2011-09-23 10:54:59 +0200372 ret = tcp_bind_socket(fd, flags, &be->source_addr, &si->addr.from);
Willy Tarreau9650f372009-08-16 14:02:45 +0200373 if (ret) {
374 close(fd);
375 if (ret == 1) {
376 Alert("Cannot bind to source address before connect() for proxy %s. Aborting.\n",
377 be->id);
378 send_log(be, LOG_EMERG,
379 "Cannot bind to source address before connect() for proxy %s.\n",
380 be->id);
381 } else {
382 Alert("Cannot bind to tproxy source address before connect() for proxy %s. Aborting.\n",
383 be->id);
384 send_log(be, LOG_EMERG,
385 "Cannot bind to tproxy source address before connect() for proxy %s.\n",
386 be->id);
387 }
388 return SN_ERR_RESOURCE;
389 }
390 }
391
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400392#if defined(TCP_QUICKACK)
Willy Tarreau9650f372009-08-16 14:02:45 +0200393 /* disabling tcp quick ack now allows the first request to leave the
394 * machine with the first ACK. We only do this if there are pending
395 * data in the buffer.
396 */
Willy Tarreau2e046c62012-03-01 16:08:30 +0100397 if ((be->options2 & PR_O2_SMARTCON) && si->ob->o)
Simon Hormande072bd2011-06-24 15:11:37 +0900398 setsockopt(fd, IPPROTO_TCP, TCP_QUICKACK, &zero, sizeof(zero));
Willy Tarreau9650f372009-08-16 14:02:45 +0200399#endif
400
Willy Tarreaue803de22010-01-21 17:43:04 +0100401 if (global.tune.server_sndbuf)
402 setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &global.tune.server_sndbuf, sizeof(global.tune.server_sndbuf));
403
404 if (global.tune.server_rcvbuf)
405 setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &global.tune.server_rcvbuf, sizeof(global.tune.server_rcvbuf));
406
Willy Tarreau9b061e32012-04-07 18:03:52 +0200407 si->flags &= ~SI_FL_FROM_SET;
Willy Tarreau6471afb2011-09-23 10:54:59 +0200408 if ((connect(fd, (struct sockaddr *)&si->addr.to, get_addr_len(&si->addr.to)) == -1) &&
Willy Tarreau9650f372009-08-16 14:02:45 +0200409 (errno != EINPROGRESS) && (errno != EALREADY) && (errno != EISCONN)) {
410
411 if (errno == EAGAIN || errno == EADDRINUSE) {
412 char *msg;
413 if (errno == EAGAIN) /* no free ports left, try again later */
414 msg = "no free ports";
415 else
416 msg = "local address already in use";
417
418 qfprintf(stderr,"Cannot connect: %s.\n",msg);
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200419 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
420 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200421 close(fd);
422 send_log(be, LOG_EMERG,
423 "Connect() failed for server %s/%s: %s.\n",
424 be->id, srv->id, msg);
425 return SN_ERR_RESOURCE;
426 } else if (errno == ETIMEDOUT) {
427 //qfprintf(stderr,"Connect(): ETIMEDOUT");
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200428 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
429 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200430 close(fd);
431 return SN_ERR_SRVTO;
432 } else {
433 // (errno == ECONNREFUSED || errno == ENETUNREACH || errno == EACCES || errno == EPERM)
434 //qfprintf(stderr,"Connect(): %d", errno);
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200435 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
436 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200437 close(fd);
438 return SN_ERR_SRVCL;
439 }
440 }
441
William Lallemandb7ff6a32012-03-02 14:35:21 +0100442 /* needs src ip/port for logging */
Willy Tarreau9b061e32012-04-07 18:03:52 +0200443 if (si->flags & SI_FL_SRC_ADDR)
444 stream_sock_get_from_addr(si);
William Lallemandb7ff6a32012-03-02 14:35:21 +0100445
Willy Tarreau9650f372009-08-16 14:02:45 +0200446 fdtab[fd].owner = si;
447 fdtab[fd].state = FD_STCONN; /* connection in progress */
448 fdtab[fd].flags = FD_FL_TCP | FD_FL_TCP_NODELAY;
449 fdtab[fd].cb[DIR_RD].f = &stream_sock_read;
450 fdtab[fd].cb[DIR_RD].b = si->ib;
451 fdtab[fd].cb[DIR_WR].f = &stream_sock_write;
452 fdtab[fd].cb[DIR_WR].b = si->ob;
453
Willy Tarreau6471afb2011-09-23 10:54:59 +0200454 fdinfo[fd].peeraddr = (struct sockaddr *)&si->addr.to;
455 fdinfo[fd].peerlen = get_addr_len(&si->addr.to);
Willy Tarreau9650f372009-08-16 14:02:45 +0200456
457 fd_insert(fd);
458 EV_FD_SET(fd, DIR_WR); /* for connect status */
459
460 si->state = SI_ST_CON;
461 si->flags |= SI_FL_CAP_SPLTCP; /* TCP supports splicing */
462 si->exp = tick_add_ifset(now_ms, be->timeout.connect);
463
464 return SN_ERR_NONE; /* connection is OK */
465}
466
467
Willy Tarreaue6b98942007-10-29 01:09:36 +0100468/* This function tries to bind a TCPv4/v6 listener. It may return a warning or
469 * an error message in <err> if the message is at most <errlen> bytes long
470 * (including '\0'). The return value is composed from ERR_ABORT, ERR_WARN,
471 * ERR_ALERT, ERR_RETRYABLE and ERR_FATAL. ERR_NONE indicates that everything
472 * was alright and that no message was returned. ERR_RETRYABLE means that an
473 * error occurred but that it may vanish after a retry (eg: port in use), and
Aman Guptad94991d2012-04-06 17:39:26 -0700474 * ERR_FATAL indicates a non-fixable error. ERR_WARN and ERR_ALERT do not alter
Willy Tarreaue6b98942007-10-29 01:09:36 +0100475 * the meaning of the error, but just indicate that a message is present which
476 * should be displayed with the respective level. Last, ERR_ABORT indicates
477 * that it's pointless to try to start other listeners. No error message is
478 * returned if errlen is NULL.
479 */
480int tcp_bind_listener(struct listener *listener, char *errmsg, int errlen)
481{
482 __label__ tcp_return, tcp_close_return;
483 int fd, err;
484 const char *msg = NULL;
485
486 /* ensure we never return garbage */
487 if (errmsg && errlen)
488 *errmsg = 0;
489
490 if (listener->state != LI_ASSIGNED)
491 return ERR_NONE; /* already bound */
492
493 err = ERR_NONE;
494
495 if ((fd = socket(listener->addr.ss_family, SOCK_STREAM, IPPROTO_TCP)) == -1) {
496 err |= ERR_RETRYABLE | ERR_ALERT;
497 msg = "cannot create listening socket";
498 goto tcp_return;
499 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100500
Willy Tarreaue6b98942007-10-29 01:09:36 +0100501 if (fd >= global.maxsock) {
502 err |= ERR_FATAL | ERR_ABORT | ERR_ALERT;
503 msg = "not enough free sockets (raise '-n' parameter)";
504 goto tcp_close_return;
505 }
506
Willy Tarreaufb14edc2009-06-14 15:24:37 +0200507 if (fcntl(fd, F_SETFL, O_NONBLOCK) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100508 err |= ERR_FATAL | ERR_ALERT;
509 msg = "cannot make socket non-blocking";
510 goto tcp_close_return;
511 }
512
Simon Hormande072bd2011-06-24 15:11:37 +0900513 if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100514 /* not fatal but should be reported */
515 msg = "cannot do so_reuseaddr";
516 err |= ERR_ALERT;
517 }
518
519 if (listener->options & LI_O_NOLINGER)
Simon Hormande072bd2011-06-24 15:11:37 +0900520 setsockopt(fd, SOL_SOCKET, SO_LINGER, &nolinger, sizeof(struct linger));
Willy Tarreauedcf6682008-11-30 23:15:34 +0100521
Willy Tarreaue6b98942007-10-29 01:09:36 +0100522#ifdef SO_REUSEPORT
523 /* OpenBSD supports this. As it's present in old libc versions of Linux,
524 * it might return an error that we will silently ignore.
525 */
Simon Hormande072bd2011-06-24 15:11:37 +0900526 setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &one, sizeof(one));
Willy Tarreaue6b98942007-10-29 01:09:36 +0100527#endif
Willy Tarreaub1e52e82008-01-13 14:49:51 +0100528#ifdef CONFIG_HAP_LINUX_TPROXY
Willy Tarreauedcf6682008-11-30 23:15:34 +0100529 if ((listener->options & LI_O_FOREIGN)
Simon Hormande072bd2011-06-24 15:11:37 +0900530 && (setsockopt(fd, SOL_IP, IP_TRANSPARENT, &one, sizeof(one)) == -1)
531 && (setsockopt(fd, SOL_IP, IP_FREEBIND, &one, sizeof(one)) == -1)) {
Willy Tarreaub1e52e82008-01-13 14:49:51 +0100532 msg = "cannot make listening socket transparent";
533 err |= ERR_ALERT;
534 }
535#endif
Willy Tarreau5e6e2042009-02-04 17:19:29 +0100536#ifdef SO_BINDTODEVICE
537 /* Note: this might fail if not CAP_NET_RAW */
538 if (listener->interface) {
539 if (setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE,
Willy Tarreau604e8302009-03-06 00:48:23 +0100540 listener->interface, strlen(listener->interface) + 1) == -1) {
Willy Tarreau5e6e2042009-02-04 17:19:29 +0100541 msg = "cannot bind listener to device";
542 err |= ERR_WARN;
543 }
544 }
545#endif
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400546#if defined(TCP_MAXSEG)
Willy Tarreau48a7e722010-12-24 15:26:39 +0100547 if (listener->maxseg > 0) {
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400548 if (setsockopt(fd, IPPROTO_TCP, TCP_MAXSEG,
Willy Tarreaube1b9182009-06-14 18:48:19 +0200549 &listener->maxseg, sizeof(listener->maxseg)) == -1) {
550 msg = "cannot set MSS";
551 err |= ERR_WARN;
552 }
553 }
554#endif
Willy Tarreaucb6cd432009-10-13 07:34:14 +0200555#if defined(TCP_DEFER_ACCEPT)
556 if (listener->options & LI_O_DEF_ACCEPT) {
557 /* defer accept by up to one second */
558 int accept_delay = 1;
559 if (setsockopt(fd, IPPROTO_TCP, TCP_DEFER_ACCEPT, &accept_delay, sizeof(accept_delay)) == -1) {
560 msg = "cannot enable DEFER_ACCEPT";
561 err |= ERR_WARN;
562 }
563 }
564#endif
Willy Tarreaue6b98942007-10-29 01:09:36 +0100565 if (bind(fd, (struct sockaddr *)&listener->addr, listener->proto->sock_addrlen) == -1) {
566 err |= ERR_RETRYABLE | ERR_ALERT;
567 msg = "cannot bind socket";
568 goto tcp_close_return;
569 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100570
Willy Tarreauc73ce2b2008-01-06 10:55:10 +0100571 if (listen(fd, listener->backlog ? listener->backlog : listener->maxconn) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100572 err |= ERR_RETRYABLE | ERR_ALERT;
573 msg = "cannot listen to socket";
574 goto tcp_close_return;
575 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100576
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400577#if defined(TCP_QUICKACK)
Willy Tarreau9ea05a72009-06-14 12:07:01 +0200578 if (listener->options & LI_O_NOQUICKACK)
Simon Hormande072bd2011-06-24 15:11:37 +0900579 setsockopt(fd, IPPROTO_TCP, TCP_QUICKACK, &zero, sizeof(zero));
Willy Tarreau9ea05a72009-06-14 12:07:01 +0200580#endif
581
Willy Tarreaue6b98942007-10-29 01:09:36 +0100582 /* the socket is ready */
583 listener->fd = fd;
584 listener->state = LI_LISTEN;
585
Willy Tarreaueabf3132008-08-29 23:36:51 +0200586 fdtab[fd].owner = listener; /* reference the listener instead of a task */
Willy Tarreaue6b98942007-10-29 01:09:36 +0100587 fdtab[fd].state = FD_STLISTEN;
Willy Tarreaueb472682010-05-28 18:46:57 +0200588 fdtab[fd].flags = FD_FL_TCP | ((listener->options & LI_O_NOLINGER) ? FD_FL_TCP_NOLING : 0);
589 fdtab[fd].cb[DIR_RD].f = listener->proto->accept;
590 fdtab[fd].cb[DIR_WR].f = NULL; /* never called */
591 fdtab[fd].cb[DIR_RD].b = fdtab[fd].cb[DIR_WR].b = NULL;
Willy Tarreau5d707e12009-06-28 11:09:07 +0200592
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200593 fdinfo[fd].peeraddr = NULL;
594 fdinfo[fd].peerlen = 0;
Willy Tarreaueb472682010-05-28 18:46:57 +0200595 fd_insert(fd);
596
Willy Tarreaue6b98942007-10-29 01:09:36 +0100597 tcp_return:
Cyril Bonté43ba1b32010-11-01 19:26:01 +0100598 if (msg && errlen) {
599 char pn[INET6_ADDRSTRLEN];
600
Willy Tarreau631f01c2011-09-05 00:36:48 +0200601 addr_to_str(&listener->addr, pn, sizeof(pn));
602 snprintf(errmsg, errlen, "%s [%s:%d]", msg, pn, get_host_port(&listener->addr));
Cyril Bonté43ba1b32010-11-01 19:26:01 +0100603 }
Willy Tarreaue6b98942007-10-29 01:09:36 +0100604 return err;
605
606 tcp_close_return:
607 close(fd);
608 goto tcp_return;
609}
610
611/* This function creates all TCP sockets bound to the protocol entry <proto>.
612 * It is intended to be used as the protocol's bind_all() function.
613 * The sockets will be registered but not added to any fd_set, in order not to
614 * loose them across the fork(). A call to enable_all_listeners() is needed
615 * to complete initialization. The return value is composed from ERR_*.
616 */
Emeric Bruncf20bf12010-10-22 16:06:11 +0200617static int tcp_bind_listeners(struct protocol *proto, char *errmsg, int errlen)
Willy Tarreaue6b98942007-10-29 01:09:36 +0100618{
619 struct listener *listener;
620 int err = ERR_NONE;
621
622 list_for_each_entry(listener, &proto->listeners, proto_list) {
Emeric Bruncf20bf12010-10-22 16:06:11 +0200623 err |= tcp_bind_listener(listener, errmsg, errlen);
624 if (err & ERR_ABORT)
Willy Tarreaue6b98942007-10-29 01:09:36 +0100625 break;
626 }
627
628 return err;
629}
630
631/* Add listener to the list of tcpv4 listeners. The listener's state
632 * is automatically updated from LI_INIT to LI_ASSIGNED. The number of
633 * listeners is updated. This is the function to use to add a new listener.
634 */
635void tcpv4_add_listener(struct listener *listener)
636{
637 if (listener->state != LI_INIT)
638 return;
639 listener->state = LI_ASSIGNED;
640 listener->proto = &proto_tcpv4;
641 LIST_ADDQ(&proto_tcpv4.listeners, &listener->proto_list);
642 proto_tcpv4.nb_listeners++;
643}
644
645/* Add listener to the list of tcpv4 listeners. The listener's state
646 * is automatically updated from LI_INIT to LI_ASSIGNED. The number of
647 * listeners is updated. This is the function to use to add a new listener.
648 */
649void tcpv6_add_listener(struct listener *listener)
650{
651 if (listener->state != LI_INIT)
652 return;
653 listener->state = LI_ASSIGNED;
654 listener->proto = &proto_tcpv6;
655 LIST_ADDQ(&proto_tcpv6.listeners, &listener->proto_list);
656 proto_tcpv6.nb_listeners++;
657}
658
Willy Tarreauedcf6682008-11-30 23:15:34 +0100659/* This function performs the TCP request analysis on the current request. It
660 * returns 1 if the processing can continue on next analysers, or zero if it
661 * needs more data, encounters an error, or wants to immediately abort the
Willy Tarreaufb356202010-08-03 14:02:05 +0200662 * request. It relies on buffers flags, and updates s->req->analysers. The
663 * function may be called for frontend rules and backend rules. It only relies
664 * on the backend pointer so this works for both cases.
Willy Tarreauedcf6682008-11-30 23:15:34 +0100665 */
Willy Tarreau3a816292009-07-07 10:55:49 +0200666int tcp_inspect_request(struct session *s, struct buffer *req, int an_bit)
Willy Tarreauedcf6682008-11-30 23:15:34 +0100667{
668 struct tcp_rule *rule;
Willy Tarreaud1f96522010-08-03 19:34:32 +0200669 struct stksess *ts;
670 struct stktable *t;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100671 int partial;
672
Willy Tarreau02d6cfc2012-03-01 18:19:58 +0100673 DPRINTF(stderr,"[%u] %s: session=%p b=%p, exp(r,w)=%u,%u bf=%08x bh=%d analysers=%02x\n",
Willy Tarreauedcf6682008-11-30 23:15:34 +0100674 now_ms, __FUNCTION__,
675 s,
676 req,
677 req->rex, req->wex,
678 req->flags,
Willy Tarreau02d6cfc2012-03-01 18:19:58 +0100679 req->i,
Willy Tarreauedcf6682008-11-30 23:15:34 +0100680 req->analysers);
681
Willy Tarreauedcf6682008-11-30 23:15:34 +0100682 /* We don't know whether we have enough data, so must proceed
683 * this way :
684 * - iterate through all rules in their declaration order
685 * - if one rule returns MISS, it means the inspect delay is
686 * not over yet, then return immediately, otherwise consider
687 * it as a non-match.
688 * - if one rule returns OK, then return OK
689 * - if one rule returns KO, then return KO
690 */
691
Willy Tarreaub824b002010-09-29 16:36:16 +0200692 if (req->flags & (BF_SHUTR|BF_FULL) || !s->be->tcp_req.inspect_delay || tick_is_expired(req->analyse_exp, now_ms))
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200693 partial = SMP_OPT_FINAL;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100694 else
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200695 partial = 0;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100696
Willy Tarreaufb356202010-08-03 14:02:05 +0200697 list_for_each_entry(rule, &s->be->tcp_req.inspect_rules, list) {
Willy Tarreauedcf6682008-11-30 23:15:34 +0100698 int ret = ACL_PAT_PASS;
699
700 if (rule->cond) {
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200701 ret = acl_exec_cond(rule->cond, s->be, s, &s->txn, SMP_OPT_DIR_REQ | partial);
Willy Tarreauedcf6682008-11-30 23:15:34 +0100702 if (ret == ACL_PAT_MISS) {
Willy Tarreau520d95e2009-09-19 21:04:57 +0200703 buffer_dont_connect(req);
Willy Tarreauedcf6682008-11-30 23:15:34 +0100704 /* just set the request timeout once at the beginning of the request */
Willy Tarreaufb356202010-08-03 14:02:05 +0200705 if (!tick_isset(req->analyse_exp) && s->be->tcp_req.inspect_delay)
706 req->analyse_exp = tick_add_ifset(now_ms, s->be->tcp_req.inspect_delay);
Willy Tarreauedcf6682008-11-30 23:15:34 +0100707 return 0;
708 }
709
710 ret = acl_pass(ret);
711 if (rule->cond->pol == ACL_COND_UNLESS)
712 ret = !ret;
713 }
714
715 if (ret) {
716 /* we have a matching rule. */
717 if (rule->action == TCP_ACT_REJECT) {
718 buffer_abort(req);
719 buffer_abort(s->rep);
720 req->analysers = 0;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +0200721
Willy Tarreau7d0aaf32011-03-10 23:25:56 +0100722 s->be->be_counters.denied_req++;
723 s->fe->fe_counters.denied_req++;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +0200724 if (s->listener->counters)
Willy Tarreau23968d82010-05-23 23:50:44 +0200725 s->listener->counters->denied_req++;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +0200726
Willy Tarreauedcf6682008-11-30 23:15:34 +0100727 if (!(s->flags & SN_ERR_MASK))
728 s->flags |= SN_ERR_PRXCOND;
729 if (!(s->flags & SN_FINST_MASK))
730 s->flags |= SN_FINST_R;
731 return 0;
732 }
Willy Tarreau56123282010-08-06 19:06:56 +0200733 else if (rule->action == TCP_ACT_TRK_SC1) {
734 if (!s->stkctr1_entry) {
735 /* only the first valid track-sc1 directive applies.
Willy Tarreaud1f96522010-08-03 19:34:32 +0200736 * Also, note that right now we can only track SRC so we
737 * don't check how to get the key, but later we may need
738 * to consider rule->act_prm->trk_ctr.type.
739 */
740 t = rule->act_prm.trk_ctr.table.t;
David du Colombier4f92d322011-03-24 11:09:31 +0100741 ts = stktable_get_entry(t, tcp_src_to_stktable_key(s));
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200742 if (ts) {
Willy Tarreau56123282010-08-06 19:06:56 +0200743 session_track_stkctr1(s, t, ts);
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200744 if (s->fe != s->be)
745 s->flags |= SN_BE_TRACK_SC1;
746 }
Willy Tarreaud1f96522010-08-03 19:34:32 +0200747 }
748 }
Willy Tarreau56123282010-08-06 19:06:56 +0200749 else if (rule->action == TCP_ACT_TRK_SC2) {
750 if (!s->stkctr2_entry) {
751 /* only the first valid track-sc2 directive applies.
Willy Tarreaud1f96522010-08-03 19:34:32 +0200752 * Also, note that right now we can only track SRC so we
753 * don't check how to get the key, but later we may need
754 * to consider rule->act_prm->trk_ctr.type.
755 */
756 t = rule->act_prm.trk_ctr.table.t;
David du Colombier4f92d322011-03-24 11:09:31 +0100757 ts = stktable_get_entry(t, tcp_src_to_stktable_key(s));
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200758 if (ts) {
Willy Tarreau56123282010-08-06 19:06:56 +0200759 session_track_stkctr2(s, t, ts);
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200760 if (s->fe != s->be)
761 s->flags |= SN_BE_TRACK_SC2;
762 }
Willy Tarreaud1f96522010-08-03 19:34:32 +0200763 }
764 }
765 else {
Willy Tarreauedcf6682008-11-30 23:15:34 +0100766 /* otherwise accept */
Willy Tarreaud1f96522010-08-03 19:34:32 +0200767 break;
768 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100769 }
770 }
771
772 /* if we get there, it means we have no rule which matches, or
773 * we have an explicit accept, so we apply the default accept.
774 */
Willy Tarreau3a816292009-07-07 10:55:49 +0200775 req->analysers &= ~an_bit;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100776 req->analyse_exp = TICK_ETERNITY;
777 return 1;
778}
779
Emeric Brun97679e72010-09-23 17:56:44 +0200780/* This function performs the TCP response analysis on the current response. It
781 * returns 1 if the processing can continue on next analysers, or zero if it
782 * needs more data, encounters an error, or wants to immediately abort the
783 * response. It relies on buffers flags, and updates s->rep->analysers. The
784 * function may be called for backend rules.
785 */
786int tcp_inspect_response(struct session *s, struct buffer *rep, int an_bit)
787{
788 struct tcp_rule *rule;
789 int partial;
790
Willy Tarreau02d6cfc2012-03-01 18:19:58 +0100791 DPRINTF(stderr,"[%u] %s: session=%p b=%p, exp(r,w)=%u,%u bf=%08x bh=%d analysers=%02x\n",
Emeric Brun97679e72010-09-23 17:56:44 +0200792 now_ms, __FUNCTION__,
793 s,
794 rep,
795 rep->rex, rep->wex,
796 rep->flags,
Willy Tarreau02d6cfc2012-03-01 18:19:58 +0100797 rep->i,
Emeric Brun97679e72010-09-23 17:56:44 +0200798 rep->analysers);
799
800 /* We don't know whether we have enough data, so must proceed
801 * this way :
802 * - iterate through all rules in their declaration order
803 * - if one rule returns MISS, it means the inspect delay is
804 * not over yet, then return immediately, otherwise consider
805 * it as a non-match.
806 * - if one rule returns OK, then return OK
807 * - if one rule returns KO, then return KO
808 */
809
810 if (rep->flags & BF_SHUTR || tick_is_expired(rep->analyse_exp, now_ms))
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200811 partial = SMP_OPT_FINAL;
Emeric Brun97679e72010-09-23 17:56:44 +0200812 else
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200813 partial = 0;
Emeric Brun97679e72010-09-23 17:56:44 +0200814
815 list_for_each_entry(rule, &s->be->tcp_rep.inspect_rules, list) {
816 int ret = ACL_PAT_PASS;
817
818 if (rule->cond) {
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200819 ret = acl_exec_cond(rule->cond, s->be, s, &s->txn, SMP_OPT_DIR_RES | partial);
Emeric Brun97679e72010-09-23 17:56:44 +0200820 if (ret == ACL_PAT_MISS) {
821 /* just set the analyser timeout once at the beginning of the response */
822 if (!tick_isset(rep->analyse_exp) && s->be->tcp_rep.inspect_delay)
823 rep->analyse_exp = tick_add_ifset(now_ms, s->be->tcp_rep.inspect_delay);
824 return 0;
825 }
826
827 ret = acl_pass(ret);
828 if (rule->cond->pol == ACL_COND_UNLESS)
829 ret = !ret;
830 }
831
832 if (ret) {
833 /* we have a matching rule. */
834 if (rule->action == TCP_ACT_REJECT) {
835 buffer_abort(rep);
836 buffer_abort(s->req);
837 rep->analysers = 0;
838
Willy Tarreau7d0aaf32011-03-10 23:25:56 +0100839 s->be->be_counters.denied_resp++;
840 s->fe->fe_counters.denied_resp++;
Emeric Brun97679e72010-09-23 17:56:44 +0200841 if (s->listener->counters)
842 s->listener->counters->denied_resp++;
843
844 if (!(s->flags & SN_ERR_MASK))
845 s->flags |= SN_ERR_PRXCOND;
846 if (!(s->flags & SN_FINST_MASK))
847 s->flags |= SN_FINST_D;
848 return 0;
849 }
850 else {
851 /* otherwise accept */
852 break;
853 }
854 }
855 }
856
857 /* if we get there, it means we have no rule which matches, or
858 * we have an explicit accept, so we apply the default accept.
859 */
860 rep->analysers &= ~an_bit;
861 rep->analyse_exp = TICK_ETERNITY;
862 return 1;
863}
864
865
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200866/* This function performs the TCP layer4 analysis on the current request. It
867 * returns 0 if a reject rule matches, otherwise 1 if either an accept rule
868 * matches or if no more rule matches. It can only use rules which don't need
869 * any data.
870 */
871int tcp_exec_req_rules(struct session *s)
872{
873 struct tcp_rule *rule;
Willy Tarreauf059a0f2010-08-03 16:29:52 +0200874 struct stksess *ts;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200875 struct stktable *t = NULL;
876 int result = 1;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200877 int ret;
878
879 list_for_each_entry(rule, &s->fe->tcp_req.l4_rules, list) {
880 ret = ACL_PAT_PASS;
881
882 if (rule->cond) {
Willy Tarreau32a6f2e2012-04-25 10:13:36 +0200883 ret = acl_exec_cond(rule->cond, s->fe, s, NULL, SMP_OPT_DIR_REQ|SMP_OPT_FINAL);
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200884 ret = acl_pass(ret);
885 if (rule->cond->pol == ACL_COND_UNLESS)
886 ret = !ret;
887 }
888
889 if (ret) {
890 /* we have a matching rule. */
891 if (rule->action == TCP_ACT_REJECT) {
Willy Tarreau7d0aaf32011-03-10 23:25:56 +0100892 s->fe->fe_counters.denied_conn++;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200893 if (s->listener->counters)
Willy Tarreau2799e982010-06-05 15:43:21 +0200894 s->listener->counters->denied_conn++;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200895
896 if (!(s->flags & SN_ERR_MASK))
897 s->flags |= SN_ERR_PRXCOND;
898 if (!(s->flags & SN_FINST_MASK))
899 s->flags |= SN_FINST_R;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200900 result = 0;
901 break;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200902 }
Willy Tarreau56123282010-08-06 19:06:56 +0200903 else if (rule->action == TCP_ACT_TRK_SC1) {
904 if (!s->stkctr1_entry) {
905 /* only the first valid track-sc1 directive applies.
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200906 * Also, note that right now we can only track SRC so we
907 * don't check how to get the key, but later we may need
908 * to consider rule->act_prm->trk_ctr.type.
909 */
910 t = rule->act_prm.trk_ctr.table.t;
David du Colombier4f92d322011-03-24 11:09:31 +0100911 ts = stktable_get_entry(t, tcp_src_to_stktable_key(s));
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200912 if (ts)
Willy Tarreau56123282010-08-06 19:06:56 +0200913 session_track_stkctr1(s, t, ts);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200914 }
915 }
Willy Tarreau56123282010-08-06 19:06:56 +0200916 else if (rule->action == TCP_ACT_TRK_SC2) {
917 if (!s->stkctr2_entry) {
918 /* only the first valid track-sc2 directive applies.
Willy Tarreauf059a0f2010-08-03 16:29:52 +0200919 * Also, note that right now we can only track SRC so we
920 * don't check how to get the key, but later we may need
921 * to consider rule->act_prm->trk_ctr.type.
922 */
923 t = rule->act_prm.trk_ctr.table.t;
David du Colombier4f92d322011-03-24 11:09:31 +0100924 ts = stktable_get_entry(t, tcp_src_to_stktable_key(s));
Willy Tarreauf059a0f2010-08-03 16:29:52 +0200925 if (ts)
Willy Tarreau56123282010-08-06 19:06:56 +0200926 session_track_stkctr2(s, t, ts);
Willy Tarreauf059a0f2010-08-03 16:29:52 +0200927 }
928 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200929 else {
930 /* otherwise it's an accept */
931 break;
932 }
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200933 }
934 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200935 return result;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200936}
937
Emeric Brun97679e72010-09-23 17:56:44 +0200938/* Parse a tcp-response rule. Return a negative value in case of failure */
939static int tcp_parse_response_rule(char **args, int arg, int section_type,
940 struct proxy *curpx, struct proxy *defpx,
941 struct tcp_rule *rule, char *err, int errlen)
942{
943 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
944 snprintf(err, errlen, "%s %s is only allowed in 'backend' sections",
945 args[0], args[1]);
946 return -1;
947 }
948
949 if (strcmp(args[arg], "accept") == 0) {
950 arg++;
951 rule->action = TCP_ACT_ACCEPT;
952 }
953 else if (strcmp(args[arg], "reject") == 0) {
954 arg++;
955 rule->action = TCP_ACT_REJECT;
956 }
957 else {
958 snprintf(err, errlen,
959 "'%s %s' expects 'accept' or 'reject' in %s '%s' (was '%s')",
960 args[0], args[1], proxy_type_str(curpx), curpx->id, args[arg]);
961 return -1;
962 }
963
964 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
Willy Tarreaub7451bb2012-04-27 12:38:15 +0200965 char *errmsg = NULL;
966
967 if ((rule->cond = build_acl_cond(NULL, 0, curpx, (const char **)args+arg, &errmsg)) == NULL) {
Emeric Brun97679e72010-09-23 17:56:44 +0200968 snprintf(err, errlen,
Willy Tarreaub7451bb2012-04-27 12:38:15 +0200969 "error detected in %s '%s' while parsing '%s' condition : %s",
970 proxy_type_str(curpx), curpx->id, args[arg], errmsg);
971 free(errmsg);
Emeric Brun97679e72010-09-23 17:56:44 +0200972 return -1;
973 }
974 }
975 else if (*args[arg]) {
976 snprintf(err, errlen,
977 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (was '%s')",
978 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
979 return -1;
980 }
981 return 0;
982}
983
984
985
Willy Tarreau68c03ab2010-08-06 15:08:45 +0200986/* Parse a tcp-request rule. Return a negative value in case of failure */
987static int tcp_parse_request_rule(char **args, int arg, int section_type,
988 struct proxy *curpx, struct proxy *defpx,
989 struct tcp_rule *rule, char *err, int errlen)
990{
991 if (curpx == defpx) {
992 snprintf(err, errlen, "%s %s is not allowed in 'defaults' sections",
993 args[0], args[1]);
994 return -1;
995 }
996
997 if (!strcmp(args[arg], "accept")) {
998 arg++;
999 rule->action = TCP_ACT_ACCEPT;
1000 }
1001 else if (!strcmp(args[arg], "reject")) {
1002 arg++;
1003 rule->action = TCP_ACT_REJECT;
1004 }
Willy Tarreau56123282010-08-06 19:06:56 +02001005 else if (strcmp(args[arg], "track-sc1") == 0) {
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001006 int ret;
1007
1008 arg++;
1009 ret = parse_track_counters(args, &arg, section_type, curpx,
1010 &rule->act_prm.trk_ctr, defpx, err, errlen);
1011
1012 if (ret < 0) /* nb: warnings are not handled yet */
1013 return -1;
1014
Willy Tarreau56123282010-08-06 19:06:56 +02001015 rule->action = TCP_ACT_TRK_SC1;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001016 }
Willy Tarreau56123282010-08-06 19:06:56 +02001017 else if (strcmp(args[arg], "track-sc2") == 0) {
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001018 int ret;
1019
1020 arg++;
1021 ret = parse_track_counters(args, &arg, section_type, curpx,
1022 &rule->act_prm.trk_ctr, defpx, err, errlen);
1023
1024 if (ret < 0) /* nb: warnings are not handled yet */
1025 return -1;
1026
Willy Tarreau56123282010-08-06 19:06:56 +02001027 rule->action = TCP_ACT_TRK_SC2;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001028 }
1029 else {
1030 snprintf(err, errlen,
Willy Tarreau56123282010-08-06 19:06:56 +02001031 "'%s %s' expects 'accept', 'reject', 'track-sc1' "
1032 "or 'track-sc2' in %s '%s' (was '%s')",
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001033 args[0], args[1], proxy_type_str(curpx), curpx->id, args[arg]);
1034 return -1;
1035 }
1036
1037 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
Willy Tarreaub7451bb2012-04-27 12:38:15 +02001038 char *errmsg = NULL;
1039
1040 if ((rule->cond = build_acl_cond(NULL, 0, curpx, (const char **)args+arg, &errmsg)) == NULL) {
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001041 snprintf(err, errlen,
Willy Tarreaub7451bb2012-04-27 12:38:15 +02001042 "error detected in %s '%s' while parsing '%s' condition : %s",
1043 proxy_type_str(curpx), curpx->id, args[arg], errmsg);
1044 free(errmsg);
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001045 return -1;
1046 }
1047 }
1048 else if (*args[arg]) {
1049 snprintf(err, errlen,
1050 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (was '%s')",
1051 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
1052 return -1;
1053 }
1054 return 0;
1055}
1056
Emeric Brun97679e72010-09-23 17:56:44 +02001057/* This function should be called to parse a line starting with the "tcp-response"
1058 * keyword.
1059 */
1060static int tcp_parse_tcp_rep(char **args, int section_type, struct proxy *curpx,
1061 struct proxy *defpx, char *err, int errlen)
1062{
1063 const char *ptr = NULL;
1064 unsigned int val;
1065 int retlen;
1066 int warn = 0;
1067 int arg;
1068 struct tcp_rule *rule;
1069
1070 if (!*args[1]) {
1071 snprintf(err, errlen, "missing argument for '%s' in %s '%s'",
1072 args[0], proxy_type_str(curpx), curpx->id);
1073 return -1;
1074 }
1075
1076 if (strcmp(args[1], "inspect-delay") == 0) {
1077 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
1078 snprintf(err, errlen, "%s %s is only allowed in 'backend' sections",
1079 args[0], args[1]);
1080 return -1;
1081 }
1082
1083 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
1084 retlen = snprintf(err, errlen,
1085 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
1086 args[0], args[1], proxy_type_str(curpx), curpx->id);
1087 if (ptr && retlen < errlen)
1088 retlen += snprintf(err + retlen, errlen - retlen,
1089 " (unexpected character '%c')", *ptr);
1090 return -1;
1091 }
1092
1093 if (curpx->tcp_rep.inspect_delay) {
1094 snprintf(err, errlen, "ignoring %s %s (was already defined) in %s '%s'",
1095 args[0], args[1], proxy_type_str(curpx), curpx->id);
1096 return 1;
1097 }
1098 curpx->tcp_rep.inspect_delay = val;
1099 return 0;
1100 }
1101
Simon Hormande072bd2011-06-24 15:11:37 +09001102 rule = calloc(1, sizeof(*rule));
Emeric Brun97679e72010-09-23 17:56:44 +02001103 LIST_INIT(&rule->list);
1104 arg = 1;
1105
1106 if (strcmp(args[1], "content") == 0) {
1107 arg++;
1108 if (tcp_parse_response_rule(args, arg, section_type, curpx, defpx, rule, err, errlen) < 0)
1109 goto error;
1110
1111 if (rule->cond && (rule->cond->requires & ACL_USE_L6REQ_VOLATILE)) {
1112 struct acl *acl;
1113 const char *name;
1114
1115 acl = cond_find_require(rule->cond, ACL_USE_L6REQ_VOLATILE);
1116 name = acl ? acl->name : "(unknown)";
1117
1118 retlen = snprintf(err, errlen,
1119 "acl '%s' involves some request-only criteria which will be ignored.",
1120 name);
1121 warn++;
1122 }
1123
1124 LIST_ADDQ(&curpx->tcp_rep.inspect_rules, &rule->list);
1125 }
1126 else {
1127 retlen = snprintf(err, errlen,
1128 "'%s' expects 'inspect-delay' or 'content' in %s '%s' (was '%s')",
1129 args[0], proxy_type_str(curpx), curpx->id, args[1]);
1130 goto error;
1131 }
1132
1133 return warn;
1134 error:
1135 free(rule);
1136 return -1;
1137}
1138
1139
Willy Tarreaub6866442008-07-14 23:54:42 +02001140/* This function should be called to parse a line starting with the "tcp-request"
1141 * keyword.
1142 */
1143static int tcp_parse_tcp_req(char **args, int section_type, struct proxy *curpx,
1144 struct proxy *defpx, char *err, int errlen)
1145{
1146 const char *ptr = NULL;
Willy Tarreauc7e961e2008-08-17 17:13:47 +02001147 unsigned int val;
Willy Tarreaub6866442008-07-14 23:54:42 +02001148 int retlen;
Willy Tarreau1a687942010-05-23 22:40:30 +02001149 int warn = 0;
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001150 int arg;
Willy Tarreau1a687942010-05-23 22:40:30 +02001151 struct tcp_rule *rule;
Willy Tarreaub6866442008-07-14 23:54:42 +02001152
1153 if (!*args[1]) {
1154 snprintf(err, errlen, "missing argument for '%s' in %s '%s'",
Willy Tarreauf5356832010-06-14 18:40:26 +02001155 args[0], proxy_type_str(curpx), curpx->id);
Willy Tarreaub6866442008-07-14 23:54:42 +02001156 return -1;
1157 }
1158
1159 if (!strcmp(args[1], "inspect-delay")) {
1160 if (curpx == defpx) {
1161 snprintf(err, errlen, "%s %s is not allowed in 'defaults' sections",
1162 args[0], args[1]);
1163 return -1;
1164 }
1165
Willy Tarreaub6866442008-07-14 23:54:42 +02001166 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
1167 retlen = snprintf(err, errlen,
1168 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
Willy Tarreauf5356832010-06-14 18:40:26 +02001169 args[0], args[1], proxy_type_str(curpx), curpx->id);
Willy Tarreaub6866442008-07-14 23:54:42 +02001170 if (ptr && retlen < errlen)
1171 retlen += snprintf(err+retlen, errlen - retlen,
1172 " (unexpected character '%c')", *ptr);
1173 return -1;
1174 }
1175
1176 if (curpx->tcp_req.inspect_delay) {
1177 snprintf(err, errlen, "ignoring %s %s (was already defined) in %s '%s'",
Willy Tarreauf5356832010-06-14 18:40:26 +02001178 args[0], args[1], proxy_type_str(curpx), curpx->id);
Willy Tarreaub6866442008-07-14 23:54:42 +02001179 return 1;
1180 }
1181 curpx->tcp_req.inspect_delay = val;
1182 return 0;
1183 }
1184
Simon Hormande072bd2011-06-24 15:11:37 +09001185 rule = calloc(1, sizeof(*rule));
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001186 LIST_INIT(&rule->list);
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001187 arg = 1;
1188
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001189 if (strcmp(args[1], "content") == 0) {
Willy Tarreaud1f96522010-08-03 19:34:32 +02001190 arg++;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001191 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, errlen) < 0)
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001192 goto error;
Willy Tarreaub6866442008-07-14 23:54:42 +02001193
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001194 if (rule->cond && (rule->cond->requires & ACL_USE_RTR_ANY)) {
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001195 struct acl *acl;
1196 const char *name;
1197
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001198 acl = cond_find_require(rule->cond, ACL_USE_RTR_ANY);
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001199 name = acl ? acl->name : "(unknown)";
1200
1201 retlen = snprintf(err, errlen,
Willy Tarreau1a211942009-07-14 13:53:17 +02001202 "acl '%s' involves some response-only criteria which will be ignored.",
1203 name);
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001204 warn++;
1205 }
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001206 LIST_ADDQ(&curpx->tcp_req.inspect_rules, &rule->list);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001207 }
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001208 else if (strcmp(args[1], "connection") == 0) {
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001209 arg++;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001210
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001211 if (!(curpx->cap & PR_CAP_FE)) {
1212 snprintf(err, errlen, "%s %s is not allowed because %s %s is not a frontend",
1213 args[0], args[1], proxy_type_str(curpx), curpx->id);
Simon Horman6c54d8b2011-07-15 13:14:06 +09001214 goto error;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001215 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001216
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001217 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, errlen) < 0)
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001218 goto error;
1219
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001220 if (rule->cond && (rule->cond->requires & (ACL_USE_RTR_ANY|ACL_USE_L6_ANY|ACL_USE_L7_ANY))) {
1221 struct acl *acl;
1222 const char *name;
Willy Tarreauf059a0f2010-08-03 16:29:52 +02001223
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001224 acl = cond_find_require(rule->cond, ACL_USE_RTR_ANY|ACL_USE_L6_ANY|ACL_USE_L7_ANY);
1225 name = acl ? acl->name : "(unknown)";
Willy Tarreauf059a0f2010-08-03 16:29:52 +02001226
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001227 if (acl->requires & (ACL_USE_L6_ANY|ACL_USE_L7_ANY)) {
1228 retlen = snprintf(err, errlen,
1229 "'%s %s' may not reference acl '%s' which makes use of "
1230 "payload in %s '%s'. Please use '%s content' for this.",
1231 args[0], args[1], name, proxy_type_str(curpx), curpx->id, args[0]);
1232 goto error;
1233 }
1234 if (acl->requires & ACL_USE_RTR_ANY)
1235 retlen = snprintf(err, errlen,
1236 "acl '%s' involves some response-only criteria which will be ignored.",
1237 name);
1238 warn++;
1239 }
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001240 LIST_ADDQ(&curpx->tcp_req.l4_rules, &rule->list);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001241 }
Willy Tarreau1a687942010-05-23 22:40:30 +02001242 else {
1243 retlen = snprintf(err, errlen,
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001244 "'%s' expects 'inspect-delay', 'connection', or 'content' in %s '%s' (was '%s')",
Willy Tarreau1a687942010-05-23 22:40:30 +02001245 args[0], proxy_type_str(curpx), curpx->id, args[1]);
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001246 goto error;
Willy Tarreau1a687942010-05-23 22:40:30 +02001247 }
1248
Willy Tarreau1a687942010-05-23 22:40:30 +02001249 return warn;
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001250 error:
1251 free(rule);
1252 return -1;
Willy Tarreaub6866442008-07-14 23:54:42 +02001253}
1254
Willy Tarreau645513a2010-05-24 20:55:15 +02001255
1256/************************************************************************/
Willy Tarreau32389b72012-04-23 23:13:20 +02001257/* All supported sample fetch functios must be declared here */
1258/************************************************************************/
1259
1260/* Fetch the request RDP cookie identified in the args, or any cookie if no arg
1261 * is passed. It is usable both for ACL and for patterns. Note: this decoder
1262 * only works with non-wrapping data. Accepts either 0 or 1 argument. Argument
1263 * is a string (cookie name), other types will lead to undefined behaviour.
1264 */
1265int
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001266smp_fetch_rdp_cookie(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau32389b72012-04-23 23:13:20 +02001267 const struct arg *args, struct sample *smp)
1268{
1269 int bleft;
1270 const unsigned char *data;
1271
1272 if (!l4 || !l4->req)
1273 return 0;
1274
1275 smp->flags = 0;
1276 smp->type = SMP_T_CSTR;
1277
1278 bleft = l4->req->i;
1279 if (bleft <= 11)
1280 goto too_short;
1281
1282 data = (const unsigned char *)l4->req->p + 11;
1283 bleft -= 11;
1284
1285 if (bleft <= 7)
1286 goto too_short;
1287
1288 if (strncasecmp((const char *)data, "Cookie:", 7) != 0)
1289 goto not_cookie;
1290
1291 data += 7;
1292 bleft -= 7;
1293
1294 while (bleft > 0 && *data == ' ') {
1295 data++;
1296 bleft--;
1297 }
1298
1299 if (args) {
1300
1301 if (bleft <= args->data.str.len)
1302 goto too_short;
1303
1304 if ((data[args->data.str.len] != '=') ||
1305 strncasecmp(args->data.str.str, (const char *)data, args->data.str.len) != 0)
1306 goto not_cookie;
1307
1308 data += args->data.str.len + 1;
1309 bleft -= args->data.str.len + 1;
1310 } else {
1311 while (bleft > 0 && *data != '=') {
1312 if (*data == '\r' || *data == '\n')
1313 goto not_cookie;
1314 data++;
1315 bleft--;
1316 }
1317
1318 if (bleft < 1)
1319 goto too_short;
1320
1321 if (*data != '=')
1322 goto not_cookie;
1323
1324 data++;
1325 bleft--;
1326 }
1327
1328 /* data points to cookie value */
1329 smp->data.str.str = (char *)data;
1330 smp->data.str.len = 0;
1331
1332 while (bleft > 0 && *data != '\r') {
1333 data++;
1334 bleft--;
1335 }
1336
1337 if (bleft < 2)
1338 goto too_short;
1339
1340 if (data[0] != '\r' || data[1] != '\n')
1341 goto not_cookie;
1342
1343 smp->data.str.len = (char *)data - smp->data.str.str;
1344 smp->flags = SMP_F_VOLATILE;
1345 return 1;
1346
1347 too_short:
1348 smp->flags = SMP_F_MAY_CHANGE;
1349 not_cookie:
1350 return 0;
1351}
1352
Willy Tarreau32389b72012-04-23 23:13:20 +02001353/************************************************************************/
Willy Tarreau645513a2010-05-24 20:55:15 +02001354/* All supported ACL keywords must be declared here. */
1355/************************************************************************/
1356
Willy Tarreau32389b72012-04-23 23:13:20 +02001357/* returns either 1 or 0 depending on whether an RDP cookie is found or not */
1358static int
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001359acl_fetch_rdp_cookie_cnt(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau24e32d82012-04-23 23:55:44 +02001360 const struct arg *args, struct sample *smp)
Willy Tarreau32389b72012-04-23 23:13:20 +02001361{
1362 int ret;
1363
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001364 ret = smp_fetch_rdp_cookie(px, l4, l7, opt, args, smp);
Willy Tarreau32389b72012-04-23 23:13:20 +02001365
1366 if (smp->flags & SMP_F_MAY_CHANGE)
1367 return 0;
1368
1369 smp->flags = SMP_F_VOLATILE;
1370 smp->type = SMP_T_UINT;
1371 smp->data.uint = ret;
1372 return 1;
1373}
1374
1375
Willy Tarreau4a129812012-04-25 17:31:42 +02001376/* fetch the connection's source IPv4/IPv6 address */
Willy Tarreau645513a2010-05-24 20:55:15 +02001377static int
Willy Tarreau4a129812012-04-25 17:31:42 +02001378smp_fetch_src(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau24e32d82012-04-23 23:55:44 +02001379 const struct arg *args, struct sample *smp)
Willy Tarreau645513a2010-05-24 20:55:15 +02001380{
Willy Tarreauf4362b32011-12-16 17:49:52 +01001381 switch (l4->si[0].addr.from.ss_family) {
1382 case AF_INET:
Willy Tarreauf853c462012-04-23 18:53:56 +02001383 smp->data.ipv4 = ((struct sockaddr_in *)&l4->si[0].addr.from)->sin_addr;
1384 smp->type = SMP_T_IPV4;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001385 break;
1386 case AF_INET6:
Willy Tarreauf853c462012-04-23 18:53:56 +02001387 smp->data.ipv6 = ((struct sockaddr_in6 *)(&l4->si[0].addr.from))->sin6_addr;
1388 smp->type = SMP_T_IPV6;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001389 break;
1390 default:
Emeric Brunf769f512010-10-22 17:14:01 +02001391 return 0;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001392 }
Emeric Brunf769f512010-10-22 17:14:01 +02001393
Willy Tarreau37406352012-04-23 16:16:37 +02001394 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001395 return 1;
1396}
1397
David du Colombier4f92d322011-03-24 11:09:31 +01001398/* extract the connection's source ipv6 address */
1399static int
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001400pattern_fetch_src6(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau342acb42012-04-23 22:03:39 +02001401 const struct arg *arg_p, struct sample *smp)
David du Colombier4f92d322011-03-24 11:09:31 +01001402{
Willy Tarreau6471afb2011-09-23 10:54:59 +02001403 if (l4->si[0].addr.from.ss_family != AF_INET6)
David du Colombier4f92d322011-03-24 11:09:31 +01001404 return 0;
1405
Willy Tarreaub8c8f1f2012-04-23 22:38:26 +02001406 smp->type = SMP_T_IPV6;
Willy Tarreau342acb42012-04-23 22:03:39 +02001407 memcpy(smp->data.ipv6.s6_addr, ((struct sockaddr_in6 *)&l4->si[0].addr.from)->sin6_addr.s6_addr, sizeof(smp->data.ipv6.s6_addr));
David du Colombier4f92d322011-03-24 11:09:31 +01001408 return 1;
1409}
Willy Tarreau645513a2010-05-24 20:55:15 +02001410
Willy Tarreaua5e37562011-12-16 17:06:15 +01001411/* set temp integer to the connection's source port */
Willy Tarreau645513a2010-05-24 20:55:15 +02001412static int
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001413smp_fetch_sport(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau24e32d82012-04-23 23:55:44 +02001414 const struct arg *args, struct sample *smp)
Willy Tarreau645513a2010-05-24 20:55:15 +02001415{
Willy Tarreauf853c462012-04-23 18:53:56 +02001416 smp->type = SMP_T_UINT;
1417 if (!(smp->data.uint = get_host_port(&l4->si[0].addr.from)))
Emeric Brunf769f512010-10-22 17:14:01 +02001418 return 0;
1419
Willy Tarreau37406352012-04-23 16:16:37 +02001420 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001421 return 1;
1422}
1423
Willy Tarreau4a129812012-04-25 17:31:42 +02001424/* fetch the connection's destination IPv4/IPv6 address */
Willy Tarreau645513a2010-05-24 20:55:15 +02001425static int
Willy Tarreau4a129812012-04-25 17:31:42 +02001426smp_fetch_dst(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau24e32d82012-04-23 23:55:44 +02001427 const struct arg *args, struct sample *smp)
Willy Tarreau645513a2010-05-24 20:55:15 +02001428{
Willy Tarreau9b061e32012-04-07 18:03:52 +02001429 stream_sock_get_to_addr(&l4->si[0]);
Willy Tarreau645513a2010-05-24 20:55:15 +02001430
Willy Tarreauf4362b32011-12-16 17:49:52 +01001431 switch (l4->si[0].addr.to.ss_family) {
1432 case AF_INET:
Willy Tarreauf853c462012-04-23 18:53:56 +02001433 smp->data.ipv4 = ((struct sockaddr_in *)&l4->si[0].addr.to)->sin_addr;
1434 smp->type = SMP_T_IPV4;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001435 break;
1436 case AF_INET6:
Willy Tarreauf853c462012-04-23 18:53:56 +02001437 smp->data.ipv6 = ((struct sockaddr_in6 *)(&l4->si[0].addr.to))->sin6_addr;
1438 smp->type = SMP_T_IPV6;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001439 break;
1440 default:
Emeric Brunf769f512010-10-22 17:14:01 +02001441 return 0;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001442 }
Emeric Brunf769f512010-10-22 17:14:01 +02001443
Willy Tarreau37406352012-04-23 16:16:37 +02001444 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001445 return 1;
1446}
1447
David du Colombier4f92d322011-03-24 11:09:31 +01001448/* extract the connection's destination ipv6 address */
1449static int
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001450pattern_fetch_dst6(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau342acb42012-04-23 22:03:39 +02001451 const struct arg *arg_p, struct sample *smp)
David du Colombier4f92d322011-03-24 11:09:31 +01001452{
Willy Tarreau9b061e32012-04-07 18:03:52 +02001453 stream_sock_get_to_addr(&l4->si[0]);
David du Colombier4f92d322011-03-24 11:09:31 +01001454
Willy Tarreau6471afb2011-09-23 10:54:59 +02001455 if (l4->si[0].addr.to.ss_family != AF_INET6)
David du Colombier4f92d322011-03-24 11:09:31 +01001456 return 0;
1457
Willy Tarreaub8c8f1f2012-04-23 22:38:26 +02001458 smp->type = SMP_T_IPV6;
Willy Tarreau342acb42012-04-23 22:03:39 +02001459 memcpy(smp->data.ipv6.s6_addr, ((struct sockaddr_in6 *)&l4->si[0].addr.to)->sin6_addr.s6_addr, sizeof(smp->data.ipv6.s6_addr));
David du Colombier4f92d322011-03-24 11:09:31 +01001460 return 1;
1461}
1462
Willy Tarreaua5e37562011-12-16 17:06:15 +01001463/* set temp integer to the frontend connexion's destination port */
Willy Tarreau645513a2010-05-24 20:55:15 +02001464static int
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001465smp_fetch_dport(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
Willy Tarreau24e32d82012-04-23 23:55:44 +02001466 const struct arg *args, struct sample *smp)
Willy Tarreau645513a2010-05-24 20:55:15 +02001467{
Willy Tarreau9b061e32012-04-07 18:03:52 +02001468 stream_sock_get_to_addr(&l4->si[0]);
Willy Tarreau645513a2010-05-24 20:55:15 +02001469
Willy Tarreauf853c462012-04-23 18:53:56 +02001470 smp->type = SMP_T_UINT;
1471 if (!(smp->data.uint = get_host_port(&l4->si[0].addr.to)))
Emeric Brunf769f512010-10-22 17:14:01 +02001472 return 0;
1473
Willy Tarreau37406352012-04-23 16:16:37 +02001474 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001475 return 1;
1476}
1477
1478static int
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001479smp_fetch_payload_lv(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
1480 const struct arg *arg_p, struct sample *smp)
Emericf2d7cae2010-11-05 18:13:50 +01001481{
Willy Tarreau82ea8002012-04-25 19:19:43 +02001482 unsigned int len_offset = arg_p[0].data.uint;
1483 unsigned int len_size = arg_p[1].data.uint;
1484 unsigned int buf_offset;
1485 unsigned int buf_size = 0;
Emericf2d7cae2010-11-05 18:13:50 +01001486 struct buffer *b;
1487 int i;
1488
1489 /* Format is (len offset, len size, buf offset) or (len offset, len size) */
1490 /* by default buf offset == len offset + len size */
1491 /* buf offset could be absolute or relative to len offset + len size if prefixed by + or - */
1492
1493 if (!l4)
1494 return 0;
1495
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001496 b = ((opt & SMP_OPT_DIR) == SMP_OPT_DIR_RES) ? l4->rep : l4->req;
Emericf2d7cae2010-11-05 18:13:50 +01001497
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001498 if (!b)
Emericf2d7cae2010-11-05 18:13:50 +01001499 return 0;
1500
Willy Tarreau02d6cfc2012-03-01 18:19:58 +01001501 if (len_offset + len_size > b->i)
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001502 goto too_short;
Emericf2d7cae2010-11-05 18:13:50 +01001503
1504 for (i = 0; i < len_size; i++) {
Willy Tarreau89fa7062012-03-02 16:13:16 +01001505 buf_size = (buf_size << 8) + ((unsigned char *)b->p)[i + len_offset];
Emericf2d7cae2010-11-05 18:13:50 +01001506 }
1507
Willy Tarreau9fcb9842012-04-20 14:45:49 +02001508 /* buf offset may be implicit, absolute or relative */
1509 buf_offset = len_offset + len_size;
1510 if (arg_p[2].type == ARGT_UINT)
1511 buf_offset = arg_p[2].data.uint;
1512 else if (arg_p[2].type == ARGT_SINT)
1513 buf_offset += arg_p[2].data.sint;
1514
Willy Tarreau82ea8002012-04-25 19:19:43 +02001515 if (!buf_size || buf_size > b->size || buf_offset + buf_size > b->size) {
1516 /* will never match */
1517 smp->flags = 0;
1518 return 0;
1519 }
1520
Willy Tarreau02d6cfc2012-03-01 18:19:58 +01001521 if (buf_offset + buf_size > b->i)
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001522 goto too_short;
Emericf2d7cae2010-11-05 18:13:50 +01001523
1524 /* init chunk as read only */
Willy Tarreaub8c8f1f2012-04-23 22:38:26 +02001525 smp->type = SMP_T_CBIN;
Willy Tarreau342acb42012-04-23 22:03:39 +02001526 chunk_initlen(&smp->data.str, b->p + buf_offset, 0, buf_size);
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001527 smp->flags = SMP_F_VOLATILE;
Emericf2d7cae2010-11-05 18:13:50 +01001528 return 1;
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001529
1530 too_short:
1531 smp->flags = SMP_F_MAY_CHANGE;
1532 return 0;
Emericf2d7cae2010-11-05 18:13:50 +01001533}
1534
1535static int
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001536smp_fetch_payload(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
1537 const struct arg *arg_p, struct sample *smp)
Emericf2d7cae2010-11-05 18:13:50 +01001538{
Willy Tarreau82ea8002012-04-25 19:19:43 +02001539 unsigned int buf_offset = arg_p[0].data.uint;
1540 unsigned int buf_size = arg_p[1].data.uint;
Emericf2d7cae2010-11-05 18:13:50 +01001541 struct buffer *b;
1542
1543 if (!l4)
1544 return 0;
1545
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001546 b = ((opt & SMP_OPT_DIR) == SMP_OPT_DIR_RES) ? l4->rep : l4->req;
Emericf2d7cae2010-11-05 18:13:50 +01001547
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001548 if (!b)
Emericf2d7cae2010-11-05 18:13:50 +01001549 return 0;
Willy Tarreau82ea8002012-04-25 19:19:43 +02001550
1551 if (!buf_size || buf_size > b->size || buf_offset + buf_size > b->size) {
1552 /* will never match */
1553 smp->flags = 0;
1554 return 0;
1555 }
Emericf2d7cae2010-11-05 18:13:50 +01001556
Willy Tarreau02d6cfc2012-03-01 18:19:58 +01001557 if (buf_offset + buf_size > b->i)
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001558 goto too_short;
Emericf2d7cae2010-11-05 18:13:50 +01001559
1560 /* init chunk as read only */
Willy Tarreaub8c8f1f2012-04-23 22:38:26 +02001561 smp->type = SMP_T_CBIN;
Willy Tarreau342acb42012-04-23 22:03:39 +02001562 chunk_initlen(&smp->data.str, b->p + buf_offset, 0, buf_size);
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001563 smp->flags = SMP_F_VOLATILE;
Simon Hormanab814e02011-06-24 14:50:20 +09001564 return 1;
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001565
1566 too_short:
1567 smp->flags = SMP_F_MAY_CHANGE;
1568 return 0;
Simon Hormanab814e02011-06-24 14:50:20 +09001569}
1570
Willy Tarreau21d68a62012-04-20 15:52:36 +02001571/* This function is used to validate the arguments passed to a "payload" fetch
1572 * keyword. This keyword expects two positive integers, with the second one
1573 * being strictly positive. It is assumed that the types are already the correct
1574 * ones. Returns 0 on error, non-zero if OK. If <err_msg> is not NULL, it will be
1575 * filled with a pointer to an error message in case of error, that the caller
1576 * is responsible for freeing. The initial location must either be freeable or
1577 * NULL.
1578 */
1579static int val_payload(struct arg *arg, char **err_msg)
1580{
1581 if (!arg[1].data.uint) {
1582 if (err_msg)
1583 memprintf(err_msg, "payload length must be > 0");
1584 return 0;
1585 }
1586 return 1;
1587}
1588
1589/* This function is used to validate the arguments passed to a "payload_lv" fetch
1590 * keyword. This keyword allows two positive integers and an optional signed one,
1591 * with the second one being strictly positive and the third one being greater than
1592 * the opposite of the two others if negative. It is assumed that the types are
1593 * already the correct ones. Returns 0 on error, non-zero if OK. If <err_msg> is
1594 * not NULL, it will be filled with a pointer to an error message in case of
1595 * error, that the caller is responsible for freeing. The initial location must
1596 * either be freeable or NULL.
1597 */
1598static int val_payload_lv(struct arg *arg, char **err_msg)
1599{
1600 if (!arg[1].data.uint) {
1601 if (err_msg)
1602 memprintf(err_msg, "payload length must be > 0");
1603 return 0;
1604 }
1605
1606 if (arg[2].type == ARGT_SINT &&
1607 (int)(arg[0].data.uint + arg[1].data.uint + arg[2].data.sint) < 0) {
1608 if (err_msg)
1609 memprintf(err_msg, "payload offset too negative");
1610 return 0;
1611 }
1612 return 1;
1613}
1614
Willy Tarreaub6866442008-07-14 23:54:42 +02001615static struct cfg_kw_list cfg_kws = {{ },{
1616 { CFG_LISTEN, "tcp-request", tcp_parse_tcp_req },
Emeric Brun97679e72010-09-23 17:56:44 +02001617 { CFG_LISTEN, "tcp-response", tcp_parse_tcp_rep },
Willy Tarreaub6866442008-07-14 23:54:42 +02001618 { 0, NULL, NULL },
1619}};
1620
Willy Tarreau61612d42012-04-19 18:42:05 +02001621/* Note: must not be declared <const> as its list will be overwritten.
1622 * Please take care of keeping this list alphabetically sorted.
1623 */
Willy Tarreaub6866442008-07-14 23:54:42 +02001624static struct acl_kw_list acl_kws = {{ },{
Willy Tarreau4a129812012-04-25 17:31:42 +02001625 { "dst", acl_parse_ip, smp_fetch_dst, acl_match_ip, ACL_USE_TCP4_PERMANENT|ACL_MAY_LOOKUP, 0 },
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001626 { "dst_port", acl_parse_int, smp_fetch_dport, acl_match_int, ACL_USE_TCP_PERMANENT, 0 },
Willy Tarreau0d5fe142012-04-26 12:24:45 +02001627 { "payload", acl_parse_str, smp_fetch_payload, acl_match_str, ACL_USE_L6REQ_VOLATILE|ACL_MAY_LOOKUP, ARG2(2,UINT,UINT), val_payload },
1628 { "payload_lv", acl_parse_str, smp_fetch_payload_lv, acl_match_str, ACL_USE_L6REQ_VOLATILE|ACL_MAY_LOOKUP, ARG3(2,UINT,UINT,SINT), val_payload_lv },
Willy Tarreau9fb4bc72012-04-24 00:09:26 +02001629 { "req_rdp_cookie", acl_parse_str, smp_fetch_rdp_cookie, acl_match_str, ACL_USE_L6REQ_VOLATILE|ACL_MAY_LOOKUP, ARG1(0,STR) },
Willy Tarreau32389b72012-04-23 23:13:20 +02001630 { "req_rdp_cookie_cnt", acl_parse_int, acl_fetch_rdp_cookie_cnt, acl_match_int, ACL_USE_L6REQ_VOLATILE, ARG1(0,STR) },
Willy Tarreau4a129812012-04-25 17:31:42 +02001631 { "src", acl_parse_ip, smp_fetch_src, acl_match_ip, ACL_USE_TCP4_PERMANENT|ACL_MAY_LOOKUP, 0 },
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001632 { "src_port", acl_parse_int, smp_fetch_sport, acl_match_int, ACL_USE_TCP_PERMANENT, 0 },
Willy Tarreaub6866442008-07-14 23:54:42 +02001633 { NULL, NULL, NULL, NULL },
1634}};
1635
Willy Tarreau4a129812012-04-25 17:31:42 +02001636/* Note: must not be declared <const> as its list will be overwritten.
1637 * Note: fetches that may return multiple types must be declared as the lowest
1638 * common denominator, the type that can be casted into all other ones. For
1639 * instance v4/v6 must be declared v4.
1640 */
Willy Tarreau645513a2010-05-24 20:55:15 +02001641static struct pattern_fetch_kw_list pattern_fetch_keywords = {{ },{
Willy Tarreau4a129812012-04-25 17:31:42 +02001642 { "src", smp_fetch_src, 0, NULL, SMP_T_IPV4, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001643 { "src6", pattern_fetch_src6, 0, NULL, SMP_T_IPV6, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreau4a129812012-04-25 17:31:42 +02001644 { "dst", smp_fetch_dst, 0, NULL, SMP_T_IPV4, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001645 { "dst6", pattern_fetch_dst6, 0, NULL, SMP_T_IPV6, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001646 { "dst_port", smp_fetch_dport, 0, NULL, SMP_T_UINT, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreau0ce3aa02012-04-25 18:46:33 +02001647 { "payload", smp_fetch_payload, ARG2(2,UINT,UINT), val_payload, SMP_T_CBIN, SMP_CAP_REQ|SMP_CAP_RES },
1648 { "payload_lv", smp_fetch_payload_lv, ARG3(2,UINT,UINT,SINT), val_payload_lv, SMP_T_CBIN, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreaud6281ae2012-04-26 11:23:39 +02001649 { "rdp_cookie", smp_fetch_rdp_cookie, ARG1(1,STR), NULL, SMP_T_CSTR, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreau25c1ebc2012-04-25 16:21:44 +02001650 { "src_port", smp_fetch_sport, 0, NULL, SMP_T_UINT, SMP_CAP_REQ|SMP_CAP_RES },
Willy Tarreau9fcb9842012-04-20 14:45:49 +02001651 { NULL, NULL, 0, 0, 0 },
Willy Tarreau645513a2010-05-24 20:55:15 +02001652}};
1653
Willy Tarreaue6b98942007-10-29 01:09:36 +01001654__attribute__((constructor))
1655static void __tcp_protocol_init(void)
1656{
1657 protocol_register(&proto_tcpv4);
1658 protocol_register(&proto_tcpv6);
Willy Tarreau645513a2010-05-24 20:55:15 +02001659 pattern_register_fetches(&pattern_fetch_keywords);
Willy Tarreaub6866442008-07-14 23:54:42 +02001660 cfg_register_keywords(&cfg_kws);
1661 acl_register_keywords(&acl_kws);
Willy Tarreaue6b98942007-10-29 01:09:36 +01001662}
1663
1664
1665/*
1666 * Local variables:
1667 * c-indent-level: 8
1668 * c-basic-offset: 8
1669 * End:
1670 */