blob: ea3692cbbcc0f21144bdf71149d695ecfd573257 [file] [log] [blame]
Willy Tarreaue6b98942007-10-29 01:09:36 +01001/*
2 * AF_INET/AF_INET6 SOCK_STREAM protocol layer (tcp)
3 *
Willy Tarreau1a687942010-05-23 22:40:30 +02004 * Copyright 2000-2010 Willy Tarreau <w@1wt.eu>
Willy Tarreaue6b98942007-10-29 01:09:36 +01005 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
13#include <ctype.h>
14#include <errno.h>
15#include <fcntl.h>
16#include <stdio.h>
17#include <stdlib.h>
18#include <string.h>
19#include <time.h>
20
21#include <sys/param.h>
22#include <sys/socket.h>
23#include <sys/stat.h>
24#include <sys/types.h>
25#include <sys/un.h>
26
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +040027#include <netinet/tcp.h>
28
Willy Tarreaub6866442008-07-14 23:54:42 +020029#include <common/cfgparse.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010030#include <common/compat.h>
31#include <common/config.h>
32#include <common/debug.h>
33#include <common/errors.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010034#include <common/mini-clist.h>
35#include <common/standard.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010036
Willy Tarreaue6b98942007-10-29 01:09:36 +010037#include <types/global.h>
Willy Tarreau9650f372009-08-16 14:02:45 +020038#include <types/server.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010039
40#include <proto/acl.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010041#include <proto/buffers.h>
Willy Tarreau03fa5df2010-05-24 21:02:37 +020042#include <proto/frontend.h>
Willy Tarreau9650f372009-08-16 14:02:45 +020043#include <proto/log.h>
Willy Tarreau645513a2010-05-24 20:55:15 +020044#include <proto/pattern.h>
Willy Tarreau9650f372009-08-16 14:02:45 +020045#include <proto/port_range.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010046#include <proto/protocols.h>
47#include <proto/proto_tcp.h>
Willy Tarreaub6866442008-07-14 23:54:42 +020048#include <proto/proxy.h>
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +020049#include <proto/session.h>
Willy Tarreaua975b8f2010-06-05 19:13:27 +020050#include <proto/stick_table.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010051#include <proto/stream_sock.h>
Willy Tarreaua975b8f2010-06-05 19:13:27 +020052#include <proto/task.h>
Emeric Brun97679e72010-09-23 17:56:44 +020053#include <proto/buffers.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010054
Willy Tarreaue8c66af2008-01-13 18:40:14 +010055#ifdef CONFIG_HAP_CTTPROXY
56#include <import/ip_tproxy.h>
57#endif
58
Emeric Bruncf20bf12010-10-22 16:06:11 +020059static int tcp_bind_listeners(struct protocol *proto, char *errmsg, int errlen);
60static int tcp_bind_listener(struct listener *listener, char *errmsg, int errlen);
Willy Tarreaue6b98942007-10-29 01:09:36 +010061
62/* Note: must not be declared <const> as its list will be overwritten */
63static struct protocol proto_tcpv4 = {
64 .name = "tcpv4",
65 .sock_domain = AF_INET,
66 .sock_type = SOCK_STREAM,
67 .sock_prot = IPPROTO_TCP,
68 .sock_family = AF_INET,
69 .sock_addrlen = sizeof(struct sockaddr_in),
70 .l3_addrlen = 32/8,
Willy Tarreaueb472682010-05-28 18:46:57 +020071 .accept = &stream_sock_accept,
Willy Tarreaue6b98942007-10-29 01:09:36 +010072 .read = &stream_sock_read,
73 .write = &stream_sock_write,
Emeric Bruncf20bf12010-10-22 16:06:11 +020074 .bind = tcp_bind_listener,
Willy Tarreaue6b98942007-10-29 01:09:36 +010075 .bind_all = tcp_bind_listeners,
76 .unbind_all = unbind_all_listeners,
77 .enable_all = enable_all_listeners,
78 .listeners = LIST_HEAD_INIT(proto_tcpv4.listeners),
79 .nb_listeners = 0,
80};
81
82/* Note: must not be declared <const> as its list will be overwritten */
83static struct protocol proto_tcpv6 = {
84 .name = "tcpv6",
85 .sock_domain = AF_INET6,
86 .sock_type = SOCK_STREAM,
87 .sock_prot = IPPROTO_TCP,
88 .sock_family = AF_INET6,
89 .sock_addrlen = sizeof(struct sockaddr_in6),
90 .l3_addrlen = 128/8,
Willy Tarreaueb472682010-05-28 18:46:57 +020091 .accept = &stream_sock_accept,
Willy Tarreaue6b98942007-10-29 01:09:36 +010092 .read = &stream_sock_read,
93 .write = &stream_sock_write,
Emeric Bruncf20bf12010-10-22 16:06:11 +020094 .bind = tcp_bind_listener,
Willy Tarreaue6b98942007-10-29 01:09:36 +010095 .bind_all = tcp_bind_listeners,
96 .unbind_all = unbind_all_listeners,
97 .enable_all = enable_all_listeners,
98 .listeners = LIST_HEAD_INIT(proto_tcpv6.listeners),
99 .nb_listeners = 0,
100};
101
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100102
David du Colombier6f5ccb12011-03-10 22:26:24 +0100103/* Binds ipv4/ipv6 address <local> to socket <fd>, unless <flags> is set, in which
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100104 * case we try to bind <remote>. <flags> is a 2-bit field consisting of :
105 * - 0 : ignore remote address (may even be a NULL pointer)
106 * - 1 : use provided address
107 * - 2 : use provided port
108 * - 3 : use both
109 *
110 * The function supports multiple foreign binding methods :
111 * - linux_tproxy: we directly bind to the foreign address
112 * - cttproxy: we bind to a local address then nat.
113 * The second one can be used as a fallback for the first one.
114 * This function returns 0 when everything's OK, 1 if it could not bind, to the
115 * local address, 2 if it could not bind to the foreign address.
116 */
David du Colombier6f5ccb12011-03-10 22:26:24 +0100117int tcp_bind_socket(int fd, int flags, struct sockaddr_storage *local, struct sockaddr_storage *remote)
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100118{
David du Colombier6f5ccb12011-03-10 22:26:24 +0100119 struct sockaddr_storage bind_addr;
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100120 int foreign_ok = 0;
121 int ret;
122
123#ifdef CONFIG_HAP_LINUX_TPROXY
124 static int ip_transp_working = 1;
125 if (flags && ip_transp_working) {
Simon Hormande072bd2011-06-24 15:11:37 +0900126 if (setsockopt(fd, SOL_IP, IP_TRANSPARENT, &one, sizeof(one)) == 0
127 || setsockopt(fd, SOL_IP, IP_FREEBIND, &one, sizeof(one)) == 0)
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100128 foreign_ok = 1;
129 else
130 ip_transp_working = 0;
131 }
132#endif
133 if (flags) {
134 memset(&bind_addr, 0, sizeof(bind_addr));
Willy Tarreau96dd0792011-04-19 07:20:57 +0200135 bind_addr.ss_family = remote->ss_family;
David du Colombier6f5ccb12011-03-10 22:26:24 +0100136 switch (remote->ss_family) {
137 case AF_INET:
138 if (flags & 1)
139 ((struct sockaddr_in *)&bind_addr)->sin_addr = ((struct sockaddr_in *)remote)->sin_addr;
140 if (flags & 2)
141 ((struct sockaddr_in *)&bind_addr)->sin_port = ((struct sockaddr_in *)remote)->sin_port;
142 break;
143 case AF_INET6:
144 if (flags & 1)
145 ((struct sockaddr_in6 *)&bind_addr)->sin6_addr = ((struct sockaddr_in6 *)remote)->sin6_addr;
146 if (flags & 2)
147 ((struct sockaddr_in6 *)&bind_addr)->sin6_port = ((struct sockaddr_in6 *)remote)->sin6_port;
148 break;
Willy Tarreau5dc1e982011-12-16 21:25:11 +0100149 default:
150 /* we don't want to try to bind to an unknown address family */
151 foreign_ok = 0;
David du Colombier6f5ccb12011-03-10 22:26:24 +0100152 }
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100153 }
154
Simon Hormande072bd2011-06-24 15:11:37 +0900155 setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one));
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100156 if (foreign_ok) {
Willy Tarreau1b4b7ce2011-04-05 16:56:50 +0200157 ret = bind(fd, (struct sockaddr *)&bind_addr, get_addr_len(&bind_addr));
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100158 if (ret < 0)
159 return 2;
160 }
161 else {
Willy Tarreau1b4b7ce2011-04-05 16:56:50 +0200162 ret = bind(fd, (struct sockaddr *)local, get_addr_len(local));
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100163 if (ret < 0)
164 return 1;
165 }
166
167 if (!flags)
168 return 0;
169
170#ifdef CONFIG_HAP_CTTPROXY
Willy Tarreau6f831b42011-03-20 14:03:54 +0100171 if (!foreign_ok && remote->ss_family == AF_INET) {
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100172 struct in_tproxy itp1, itp2;
173 memset(&itp1, 0, sizeof(itp1));
174
175 itp1.op = TPROXY_ASSIGN;
Willy Tarreau6f831b42011-03-20 14:03:54 +0100176 itp1.v.addr.faddr = ((struct sockaddr_in *)&bind_addr)->sin_addr;
177 itp1.v.addr.fport = ((struct sockaddr_in *)&bind_addr)->sin_port;
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100178
179 /* set connect flag on socket */
180 itp2.op = TPROXY_FLAGS;
181 itp2.v.flags = ITP_CONNECT | ITP_ONCE;
182
183 if (setsockopt(fd, SOL_IP, IP_TPROXY, &itp1, sizeof(itp1)) != -1 &&
184 setsockopt(fd, SOL_IP, IP_TPROXY, &itp2, sizeof(itp2)) != -1) {
185 foreign_ok = 1;
186 }
187 }
188#endif
189 if (!foreign_ok)
190 /* we could not bind to a foreign address */
191 return 2;
192
193 return 0;
194}
Willy Tarreaue6b98942007-10-29 01:09:36 +0100195
Willy Tarreau9650f372009-08-16 14:02:45 +0200196
197/*
Willy Tarreauac825402011-03-04 22:04:29 +0100198 * This function initiates a connection to the target assigned to this session
Willy Tarreau6471afb2011-09-23 10:54:59 +0200199 * (si->{target,addr.to}). A source address may be pointed to by si->addr.from
Willy Tarreauac825402011-03-04 22:04:29 +0100200 * in case of transparent proxying. Normal source bind addresses are still
201 * determined locally (due to the possible need of a source port).
202 * si->target may point either to a valid server or to a backend, depending
203 * on si->target.type. Only TARG_TYPE_PROXY and TARG_TYPE_SERVER are supported.
Willy Tarreaub1d67742010-03-29 19:36:59 +0200204 *
Willy Tarreau9650f372009-08-16 14:02:45 +0200205 * It can return one of :
206 * - SN_ERR_NONE if everything's OK
207 * - SN_ERR_SRVTO if there are no more servers
208 * - SN_ERR_SRVCL if the connection was refused by the server
209 * - SN_ERR_PRXCOND if the connection has been limited by the proxy (maxconn)
210 * - SN_ERR_RESOURCE if a system resource is lacking (eg: fd limits, ports, ...)
211 * - SN_ERR_INTERNAL for any other purely internal errors
212 * Additionnally, in the case of SN_ERR_RESOURCE, an emergency log will be emitted.
213 */
Willy Tarreauf1536862011-03-03 18:27:32 +0100214
David du Colombier6f5ccb12011-03-10 22:26:24 +0100215int tcp_connect_server(struct stream_interface *si)
Willy Tarreau9650f372009-08-16 14:02:45 +0200216{
217 int fd;
Willy Tarreauac825402011-03-04 22:04:29 +0100218 struct server *srv;
219 struct proxy *be;
220
221 switch (si->target.type) {
222 case TARG_TYPE_PROXY:
223 be = si->target.ptr.p;
224 srv = NULL;
225 break;
226 case TARG_TYPE_SERVER:
227 srv = si->target.ptr.s;
228 be = srv->proxy;
229 break;
230 default:
231 return SN_ERR_INTERNAL;
232 }
Willy Tarreau9650f372009-08-16 14:02:45 +0200233
Willy Tarreau6471afb2011-09-23 10:54:59 +0200234 if ((fd = si->fd = socket(si->addr.to.ss_family, SOCK_STREAM, IPPROTO_TCP)) == -1) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200235 qfprintf(stderr, "Cannot get a server socket.\n");
236
237 if (errno == ENFILE)
238 send_log(be, LOG_EMERG,
239 "Proxy %s reached system FD limit at %d. Please check system tunables.\n",
240 be->id, maxfd);
241 else if (errno == EMFILE)
242 send_log(be, LOG_EMERG,
243 "Proxy %s reached process FD limit at %d. Please check 'ulimit-n' and restart.\n",
244 be->id, maxfd);
245 else if (errno == ENOBUFS || errno == ENOMEM)
246 send_log(be, LOG_EMERG,
247 "Proxy %s reached system memory limit at %d sockets. Please check system tunables.\n",
248 be->id, maxfd);
249 /* this is a resource error */
250 return SN_ERR_RESOURCE;
251 }
252
253 if (fd >= global.maxsock) {
254 /* do not log anything there, it's a normal condition when this option
255 * is used to serialize connections to a server !
256 */
257 Alert("socket(): not enough free sockets. Raise -n argument. Giving up.\n");
258 close(fd);
259 return SN_ERR_PRXCOND; /* it is a configuration limit */
260 }
261
262 if ((fcntl(fd, F_SETFL, O_NONBLOCK)==-1) ||
Simon Hormande072bd2011-06-24 15:11:37 +0900263 (setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &one, sizeof(one)) == -1)) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200264 qfprintf(stderr,"Cannot set client socket to non blocking mode.\n");
265 close(fd);
266 return SN_ERR_INTERNAL;
267 }
268
269 if (be->options & PR_O_TCP_SRV_KA)
Simon Hormande072bd2011-06-24 15:11:37 +0900270 setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, &one, sizeof(one));
Willy Tarreau9650f372009-08-16 14:02:45 +0200271
272 if (be->options & PR_O_TCP_NOLING)
Willy Tarreauf6f82252011-11-30 18:02:24 +0100273 si->flags |= SI_FL_NOLINGER;
Willy Tarreau9650f372009-08-16 14:02:45 +0200274
275 /* allow specific binding :
276 * - server-specific at first
277 * - proxy-specific next
278 */
279 if (srv != NULL && srv->state & SRV_BIND_SRC) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200280 int ret, flags = 0;
281
Willy Tarreau9650f372009-08-16 14:02:45 +0200282 switch (srv->state & SRV_TPROXY_MASK) {
283 case SRV_TPROXY_ADDR:
Willy Tarreau9650f372009-08-16 14:02:45 +0200284 case SRV_TPROXY_CLI:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200285 flags = 3;
286 break;
Willy Tarreau9650f372009-08-16 14:02:45 +0200287 case SRV_TPROXY_CIP:
Willy Tarreau090466c2009-09-07 11:51:47 +0200288 case SRV_TPROXY_DYN:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200289 flags = 1;
Willy Tarreau9650f372009-08-16 14:02:45 +0200290 break;
291 }
Willy Tarreaub1d67742010-03-29 19:36:59 +0200292
Willy Tarreau9650f372009-08-16 14:02:45 +0200293#ifdef SO_BINDTODEVICE
294 /* Note: this might fail if not CAP_NET_RAW */
295 if (srv->iface_name)
296 setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, srv->iface_name, srv->iface_len + 1);
297#endif
298
299 if (srv->sport_range) {
300 int attempts = 10; /* should be more than enough to find a spare port */
David du Colombier6f5ccb12011-03-10 22:26:24 +0100301 struct sockaddr_storage src;
Willy Tarreau9650f372009-08-16 14:02:45 +0200302
303 ret = 1;
304 src = srv->source_addr;
305
306 do {
307 /* note: in case of retry, we may have to release a previously
308 * allocated port, hence this loop's construct.
309 */
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200310 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
311 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200312
313 if (!attempts)
314 break;
315 attempts--;
316
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200317 fdinfo[fd].local_port = port_range_alloc_port(srv->sport_range);
318 if (!fdinfo[fd].local_port)
Willy Tarreau9650f372009-08-16 14:02:45 +0200319 break;
320
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200321 fdinfo[fd].port_range = srv->sport_range;
Willy Tarreau86ad42c2011-08-27 12:29:07 +0200322 set_host_port(&src, fdinfo[fd].local_port);
Willy Tarreau9650f372009-08-16 14:02:45 +0200323
Willy Tarreau6471afb2011-09-23 10:54:59 +0200324 ret = tcp_bind_socket(fd, flags, &src, &si->addr.from);
Willy Tarreau9650f372009-08-16 14:02:45 +0200325 } while (ret != 0); /* binding NOK */
326 }
327 else {
Willy Tarreau6471afb2011-09-23 10:54:59 +0200328 ret = tcp_bind_socket(fd, flags, &srv->source_addr, &si->addr.from);
Willy Tarreau9650f372009-08-16 14:02:45 +0200329 }
330
331 if (ret) {
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200332 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
333 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200334 close(fd);
335
336 if (ret == 1) {
337 Alert("Cannot bind to source address before connect() for server %s/%s. Aborting.\n",
338 be->id, srv->id);
339 send_log(be, LOG_EMERG,
340 "Cannot bind to source address before connect() for server %s/%s.\n",
341 be->id, srv->id);
342 } else {
343 Alert("Cannot bind to tproxy source address before connect() for server %s/%s. Aborting.\n",
344 be->id, srv->id);
345 send_log(be, LOG_EMERG,
346 "Cannot bind to tproxy source address before connect() for server %s/%s.\n",
347 be->id, srv->id);
348 }
349 return SN_ERR_RESOURCE;
350 }
351 }
352 else if (be->options & PR_O_BIND_SRC) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200353 int ret, flags = 0;
354
Willy Tarreau9650f372009-08-16 14:02:45 +0200355 switch (be->options & PR_O_TPXY_MASK) {
356 case PR_O_TPXY_ADDR:
Willy Tarreau9650f372009-08-16 14:02:45 +0200357 case PR_O_TPXY_CLI:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200358 flags = 3;
359 break;
Willy Tarreau9650f372009-08-16 14:02:45 +0200360 case PR_O_TPXY_CIP:
Willy Tarreau090466c2009-09-07 11:51:47 +0200361 case PR_O_TPXY_DYN:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200362 flags = 1;
Willy Tarreau9650f372009-08-16 14:02:45 +0200363 break;
364 }
Willy Tarreaub1d67742010-03-29 19:36:59 +0200365
Willy Tarreau9650f372009-08-16 14:02:45 +0200366#ifdef SO_BINDTODEVICE
367 /* Note: this might fail if not CAP_NET_RAW */
368 if (be->iface_name)
369 setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, be->iface_name, be->iface_len + 1);
370#endif
Willy Tarreau6471afb2011-09-23 10:54:59 +0200371 ret = tcp_bind_socket(fd, flags, &be->source_addr, &si->addr.from);
Willy Tarreau9650f372009-08-16 14:02:45 +0200372 if (ret) {
373 close(fd);
374 if (ret == 1) {
375 Alert("Cannot bind to source address before connect() for proxy %s. Aborting.\n",
376 be->id);
377 send_log(be, LOG_EMERG,
378 "Cannot bind to source address before connect() for proxy %s.\n",
379 be->id);
380 } else {
381 Alert("Cannot bind to tproxy source address before connect() for proxy %s. Aborting.\n",
382 be->id);
383 send_log(be, LOG_EMERG,
384 "Cannot bind to tproxy source address before connect() for proxy %s.\n",
385 be->id);
386 }
387 return SN_ERR_RESOURCE;
388 }
389 }
390
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400391#if defined(TCP_QUICKACK)
Willy Tarreau9650f372009-08-16 14:02:45 +0200392 /* disabling tcp quick ack now allows the first request to leave the
393 * machine with the first ACK. We only do this if there are pending
394 * data in the buffer.
395 */
396 if ((be->options2 & PR_O2_SMARTCON) && si->ob->send_max)
Simon Hormande072bd2011-06-24 15:11:37 +0900397 setsockopt(fd, IPPROTO_TCP, TCP_QUICKACK, &zero, sizeof(zero));
Willy Tarreau9650f372009-08-16 14:02:45 +0200398#endif
399
Willy Tarreaue803de22010-01-21 17:43:04 +0100400 if (global.tune.server_sndbuf)
401 setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &global.tune.server_sndbuf, sizeof(global.tune.server_sndbuf));
402
403 if (global.tune.server_rcvbuf)
404 setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &global.tune.server_rcvbuf, sizeof(global.tune.server_rcvbuf));
405
Willy Tarreau6471afb2011-09-23 10:54:59 +0200406 if ((connect(fd, (struct sockaddr *)&si->addr.to, get_addr_len(&si->addr.to)) == -1) &&
Willy Tarreau9650f372009-08-16 14:02:45 +0200407 (errno != EINPROGRESS) && (errno != EALREADY) && (errno != EISCONN)) {
408
409 if (errno == EAGAIN || errno == EADDRINUSE) {
410 char *msg;
411 if (errno == EAGAIN) /* no free ports left, try again later */
412 msg = "no free ports";
413 else
414 msg = "local address already in use";
415
416 qfprintf(stderr,"Cannot connect: %s.\n",msg);
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200417 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
418 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200419 close(fd);
420 send_log(be, LOG_EMERG,
421 "Connect() failed for server %s/%s: %s.\n",
422 be->id, srv->id, msg);
423 return SN_ERR_RESOURCE;
424 } else if (errno == ETIMEDOUT) {
425 //qfprintf(stderr,"Connect(): ETIMEDOUT");
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200426 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
427 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200428 close(fd);
429 return SN_ERR_SRVTO;
430 } else {
431 // (errno == ECONNREFUSED || errno == ENETUNREACH || errno == EACCES || errno == EPERM)
432 //qfprintf(stderr,"Connect(): %d", errno);
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200433 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
434 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200435 close(fd);
436 return SN_ERR_SRVCL;
437 }
438 }
439
440 fdtab[fd].owner = si;
441 fdtab[fd].state = FD_STCONN; /* connection in progress */
442 fdtab[fd].flags = FD_FL_TCP | FD_FL_TCP_NODELAY;
443 fdtab[fd].cb[DIR_RD].f = &stream_sock_read;
444 fdtab[fd].cb[DIR_RD].b = si->ib;
445 fdtab[fd].cb[DIR_WR].f = &stream_sock_write;
446 fdtab[fd].cb[DIR_WR].b = si->ob;
447
Willy Tarreau6471afb2011-09-23 10:54:59 +0200448 fdinfo[fd].peeraddr = (struct sockaddr *)&si->addr.to;
449 fdinfo[fd].peerlen = get_addr_len(&si->addr.to);
Willy Tarreau9650f372009-08-16 14:02:45 +0200450
451 fd_insert(fd);
452 EV_FD_SET(fd, DIR_WR); /* for connect status */
453
454 si->state = SI_ST_CON;
455 si->flags |= SI_FL_CAP_SPLTCP; /* TCP supports splicing */
456 si->exp = tick_add_ifset(now_ms, be->timeout.connect);
457
458 return SN_ERR_NONE; /* connection is OK */
459}
460
461
Willy Tarreaue6b98942007-10-29 01:09:36 +0100462/* This function tries to bind a TCPv4/v6 listener. It may return a warning or
463 * an error message in <err> if the message is at most <errlen> bytes long
464 * (including '\0'). The return value is composed from ERR_ABORT, ERR_WARN,
465 * ERR_ALERT, ERR_RETRYABLE and ERR_FATAL. ERR_NONE indicates that everything
466 * was alright and that no message was returned. ERR_RETRYABLE means that an
467 * error occurred but that it may vanish after a retry (eg: port in use), and
468 * ERR_FATAL indicates a non-fixable error.ERR_WARN and ERR_ALERT do not alter
469 * the meaning of the error, but just indicate that a message is present which
470 * should be displayed with the respective level. Last, ERR_ABORT indicates
471 * that it's pointless to try to start other listeners. No error message is
472 * returned if errlen is NULL.
473 */
474int tcp_bind_listener(struct listener *listener, char *errmsg, int errlen)
475{
476 __label__ tcp_return, tcp_close_return;
477 int fd, err;
478 const char *msg = NULL;
479
480 /* ensure we never return garbage */
481 if (errmsg && errlen)
482 *errmsg = 0;
483
484 if (listener->state != LI_ASSIGNED)
485 return ERR_NONE; /* already bound */
486
487 err = ERR_NONE;
488
489 if ((fd = socket(listener->addr.ss_family, SOCK_STREAM, IPPROTO_TCP)) == -1) {
490 err |= ERR_RETRYABLE | ERR_ALERT;
491 msg = "cannot create listening socket";
492 goto tcp_return;
493 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100494
Willy Tarreaue6b98942007-10-29 01:09:36 +0100495 if (fd >= global.maxsock) {
496 err |= ERR_FATAL | ERR_ABORT | ERR_ALERT;
497 msg = "not enough free sockets (raise '-n' parameter)";
498 goto tcp_close_return;
499 }
500
Willy Tarreaufb14edc2009-06-14 15:24:37 +0200501 if (fcntl(fd, F_SETFL, O_NONBLOCK) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100502 err |= ERR_FATAL | ERR_ALERT;
503 msg = "cannot make socket non-blocking";
504 goto tcp_close_return;
505 }
506
Simon Hormande072bd2011-06-24 15:11:37 +0900507 if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100508 /* not fatal but should be reported */
509 msg = "cannot do so_reuseaddr";
510 err |= ERR_ALERT;
511 }
512
513 if (listener->options & LI_O_NOLINGER)
Simon Hormande072bd2011-06-24 15:11:37 +0900514 setsockopt(fd, SOL_SOCKET, SO_LINGER, &nolinger, sizeof(struct linger));
Willy Tarreauedcf6682008-11-30 23:15:34 +0100515
Willy Tarreaue6b98942007-10-29 01:09:36 +0100516#ifdef SO_REUSEPORT
517 /* OpenBSD supports this. As it's present in old libc versions of Linux,
518 * it might return an error that we will silently ignore.
519 */
Simon Hormande072bd2011-06-24 15:11:37 +0900520 setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &one, sizeof(one));
Willy Tarreaue6b98942007-10-29 01:09:36 +0100521#endif
Willy Tarreaub1e52e82008-01-13 14:49:51 +0100522#ifdef CONFIG_HAP_LINUX_TPROXY
Willy Tarreauedcf6682008-11-30 23:15:34 +0100523 if ((listener->options & LI_O_FOREIGN)
Simon Hormande072bd2011-06-24 15:11:37 +0900524 && (setsockopt(fd, SOL_IP, IP_TRANSPARENT, &one, sizeof(one)) == -1)
525 && (setsockopt(fd, SOL_IP, IP_FREEBIND, &one, sizeof(one)) == -1)) {
Willy Tarreaub1e52e82008-01-13 14:49:51 +0100526 msg = "cannot make listening socket transparent";
527 err |= ERR_ALERT;
528 }
529#endif
Willy Tarreau5e6e2042009-02-04 17:19:29 +0100530#ifdef SO_BINDTODEVICE
531 /* Note: this might fail if not CAP_NET_RAW */
532 if (listener->interface) {
533 if (setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE,
Willy Tarreau604e8302009-03-06 00:48:23 +0100534 listener->interface, strlen(listener->interface) + 1) == -1) {
Willy Tarreau5e6e2042009-02-04 17:19:29 +0100535 msg = "cannot bind listener to device";
536 err |= ERR_WARN;
537 }
538 }
539#endif
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400540#if defined(TCP_MAXSEG)
Willy Tarreau48a7e722010-12-24 15:26:39 +0100541 if (listener->maxseg > 0) {
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400542 if (setsockopt(fd, IPPROTO_TCP, TCP_MAXSEG,
Willy Tarreaube1b9182009-06-14 18:48:19 +0200543 &listener->maxseg, sizeof(listener->maxseg)) == -1) {
544 msg = "cannot set MSS";
545 err |= ERR_WARN;
546 }
547 }
548#endif
Willy Tarreaucb6cd432009-10-13 07:34:14 +0200549#if defined(TCP_DEFER_ACCEPT)
550 if (listener->options & LI_O_DEF_ACCEPT) {
551 /* defer accept by up to one second */
552 int accept_delay = 1;
553 if (setsockopt(fd, IPPROTO_TCP, TCP_DEFER_ACCEPT, &accept_delay, sizeof(accept_delay)) == -1) {
554 msg = "cannot enable DEFER_ACCEPT";
555 err |= ERR_WARN;
556 }
557 }
558#endif
Willy Tarreaue6b98942007-10-29 01:09:36 +0100559 if (bind(fd, (struct sockaddr *)&listener->addr, listener->proto->sock_addrlen) == -1) {
560 err |= ERR_RETRYABLE | ERR_ALERT;
561 msg = "cannot bind socket";
562 goto tcp_close_return;
563 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100564
Willy Tarreauc73ce2b2008-01-06 10:55:10 +0100565 if (listen(fd, listener->backlog ? listener->backlog : listener->maxconn) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100566 err |= ERR_RETRYABLE | ERR_ALERT;
567 msg = "cannot listen to socket";
568 goto tcp_close_return;
569 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100570
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400571#if defined(TCP_QUICKACK)
Willy Tarreau9ea05a72009-06-14 12:07:01 +0200572 if (listener->options & LI_O_NOQUICKACK)
Simon Hormande072bd2011-06-24 15:11:37 +0900573 setsockopt(fd, IPPROTO_TCP, TCP_QUICKACK, &zero, sizeof(zero));
Willy Tarreau9ea05a72009-06-14 12:07:01 +0200574#endif
575
Willy Tarreaue6b98942007-10-29 01:09:36 +0100576 /* the socket is ready */
577 listener->fd = fd;
578 listener->state = LI_LISTEN;
579
Willy Tarreaueabf3132008-08-29 23:36:51 +0200580 fdtab[fd].owner = listener; /* reference the listener instead of a task */
Willy Tarreaue6b98942007-10-29 01:09:36 +0100581 fdtab[fd].state = FD_STLISTEN;
Willy Tarreaueb472682010-05-28 18:46:57 +0200582 fdtab[fd].flags = FD_FL_TCP | ((listener->options & LI_O_NOLINGER) ? FD_FL_TCP_NOLING : 0);
583 fdtab[fd].cb[DIR_RD].f = listener->proto->accept;
584 fdtab[fd].cb[DIR_WR].f = NULL; /* never called */
585 fdtab[fd].cb[DIR_RD].b = fdtab[fd].cb[DIR_WR].b = NULL;
Willy Tarreau5d707e12009-06-28 11:09:07 +0200586
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200587 fdinfo[fd].peeraddr = NULL;
588 fdinfo[fd].peerlen = 0;
Willy Tarreaueb472682010-05-28 18:46:57 +0200589 fd_insert(fd);
590
Willy Tarreaue6b98942007-10-29 01:09:36 +0100591 tcp_return:
Cyril Bonté43ba1b32010-11-01 19:26:01 +0100592 if (msg && errlen) {
593 char pn[INET6_ADDRSTRLEN];
594
Willy Tarreau631f01c2011-09-05 00:36:48 +0200595 addr_to_str(&listener->addr, pn, sizeof(pn));
596 snprintf(errmsg, errlen, "%s [%s:%d]", msg, pn, get_host_port(&listener->addr));
Cyril Bonté43ba1b32010-11-01 19:26:01 +0100597 }
Willy Tarreaue6b98942007-10-29 01:09:36 +0100598 return err;
599
600 tcp_close_return:
601 close(fd);
602 goto tcp_return;
603}
604
605/* This function creates all TCP sockets bound to the protocol entry <proto>.
606 * It is intended to be used as the protocol's bind_all() function.
607 * The sockets will be registered but not added to any fd_set, in order not to
608 * loose them across the fork(). A call to enable_all_listeners() is needed
609 * to complete initialization. The return value is composed from ERR_*.
610 */
Emeric Bruncf20bf12010-10-22 16:06:11 +0200611static int tcp_bind_listeners(struct protocol *proto, char *errmsg, int errlen)
Willy Tarreaue6b98942007-10-29 01:09:36 +0100612{
613 struct listener *listener;
614 int err = ERR_NONE;
615
616 list_for_each_entry(listener, &proto->listeners, proto_list) {
Emeric Bruncf20bf12010-10-22 16:06:11 +0200617 err |= tcp_bind_listener(listener, errmsg, errlen);
618 if (err & ERR_ABORT)
Willy Tarreaue6b98942007-10-29 01:09:36 +0100619 break;
620 }
621
622 return err;
623}
624
625/* Add listener to the list of tcpv4 listeners. The listener's state
626 * is automatically updated from LI_INIT to LI_ASSIGNED. The number of
627 * listeners is updated. This is the function to use to add a new listener.
628 */
629void tcpv4_add_listener(struct listener *listener)
630{
631 if (listener->state != LI_INIT)
632 return;
633 listener->state = LI_ASSIGNED;
634 listener->proto = &proto_tcpv4;
635 LIST_ADDQ(&proto_tcpv4.listeners, &listener->proto_list);
636 proto_tcpv4.nb_listeners++;
637}
638
639/* Add listener to the list of tcpv4 listeners. The listener's state
640 * is automatically updated from LI_INIT to LI_ASSIGNED. The number of
641 * listeners is updated. This is the function to use to add a new listener.
642 */
643void tcpv6_add_listener(struct listener *listener)
644{
645 if (listener->state != LI_INIT)
646 return;
647 listener->state = LI_ASSIGNED;
648 listener->proto = &proto_tcpv6;
649 LIST_ADDQ(&proto_tcpv6.listeners, &listener->proto_list);
650 proto_tcpv6.nb_listeners++;
651}
652
Willy Tarreauedcf6682008-11-30 23:15:34 +0100653/* This function performs the TCP request analysis on the current request. It
654 * returns 1 if the processing can continue on next analysers, or zero if it
655 * needs more data, encounters an error, or wants to immediately abort the
Willy Tarreaufb356202010-08-03 14:02:05 +0200656 * request. It relies on buffers flags, and updates s->req->analysers. The
657 * function may be called for frontend rules and backend rules. It only relies
658 * on the backend pointer so this works for both cases.
Willy Tarreauedcf6682008-11-30 23:15:34 +0100659 */
Willy Tarreau3a816292009-07-07 10:55:49 +0200660int tcp_inspect_request(struct session *s, struct buffer *req, int an_bit)
Willy Tarreauedcf6682008-11-30 23:15:34 +0100661{
662 struct tcp_rule *rule;
Willy Tarreaud1f96522010-08-03 19:34:32 +0200663 struct stksess *ts;
664 struct stktable *t;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100665 int partial;
666
667 DPRINTF(stderr,"[%u] %s: session=%p b=%p, exp(r,w)=%u,%u bf=%08x bl=%d analysers=%02x\n",
668 now_ms, __FUNCTION__,
669 s,
670 req,
671 req->rex, req->wex,
672 req->flags,
673 req->l,
674 req->analysers);
675
Willy Tarreauedcf6682008-11-30 23:15:34 +0100676 /* We don't know whether we have enough data, so must proceed
677 * this way :
678 * - iterate through all rules in their declaration order
679 * - if one rule returns MISS, it means the inspect delay is
680 * not over yet, then return immediately, otherwise consider
681 * it as a non-match.
682 * - if one rule returns OK, then return OK
683 * - if one rule returns KO, then return KO
684 */
685
Willy Tarreaub824b002010-09-29 16:36:16 +0200686 if (req->flags & (BF_SHUTR|BF_FULL) || !s->be->tcp_req.inspect_delay || tick_is_expired(req->analyse_exp, now_ms))
Willy Tarreauedcf6682008-11-30 23:15:34 +0100687 partial = 0;
688 else
689 partial = ACL_PARTIAL;
690
Willy Tarreaufb356202010-08-03 14:02:05 +0200691 list_for_each_entry(rule, &s->be->tcp_req.inspect_rules, list) {
Willy Tarreauedcf6682008-11-30 23:15:34 +0100692 int ret = ACL_PAT_PASS;
693
694 if (rule->cond) {
Willy Tarreaufb356202010-08-03 14:02:05 +0200695 ret = acl_exec_cond(rule->cond, s->be, s, &s->txn, ACL_DIR_REQ | partial);
Willy Tarreauedcf6682008-11-30 23:15:34 +0100696 if (ret == ACL_PAT_MISS) {
Willy Tarreau520d95e2009-09-19 21:04:57 +0200697 buffer_dont_connect(req);
Willy Tarreauedcf6682008-11-30 23:15:34 +0100698 /* just set the request timeout once at the beginning of the request */
Willy Tarreaufb356202010-08-03 14:02:05 +0200699 if (!tick_isset(req->analyse_exp) && s->be->tcp_req.inspect_delay)
700 req->analyse_exp = tick_add_ifset(now_ms, s->be->tcp_req.inspect_delay);
Willy Tarreauedcf6682008-11-30 23:15:34 +0100701 return 0;
702 }
703
704 ret = acl_pass(ret);
705 if (rule->cond->pol == ACL_COND_UNLESS)
706 ret = !ret;
707 }
708
709 if (ret) {
710 /* we have a matching rule. */
711 if (rule->action == TCP_ACT_REJECT) {
712 buffer_abort(req);
713 buffer_abort(s->rep);
714 req->analysers = 0;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +0200715
Willy Tarreau7d0aaf32011-03-10 23:25:56 +0100716 s->be->be_counters.denied_req++;
717 s->fe->fe_counters.denied_req++;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +0200718 if (s->listener->counters)
Willy Tarreau23968d82010-05-23 23:50:44 +0200719 s->listener->counters->denied_req++;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +0200720
Willy Tarreauedcf6682008-11-30 23:15:34 +0100721 if (!(s->flags & SN_ERR_MASK))
722 s->flags |= SN_ERR_PRXCOND;
723 if (!(s->flags & SN_FINST_MASK))
724 s->flags |= SN_FINST_R;
725 return 0;
726 }
Willy Tarreau56123282010-08-06 19:06:56 +0200727 else if (rule->action == TCP_ACT_TRK_SC1) {
728 if (!s->stkctr1_entry) {
729 /* only the first valid track-sc1 directive applies.
Willy Tarreaud1f96522010-08-03 19:34:32 +0200730 * Also, note that right now we can only track SRC so we
731 * don't check how to get the key, but later we may need
732 * to consider rule->act_prm->trk_ctr.type.
733 */
734 t = rule->act_prm.trk_ctr.table.t;
David du Colombier4f92d322011-03-24 11:09:31 +0100735 ts = stktable_get_entry(t, tcp_src_to_stktable_key(s));
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200736 if (ts) {
Willy Tarreau56123282010-08-06 19:06:56 +0200737 session_track_stkctr1(s, t, ts);
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200738 if (s->fe != s->be)
739 s->flags |= SN_BE_TRACK_SC1;
740 }
Willy Tarreaud1f96522010-08-03 19:34:32 +0200741 }
742 }
Willy Tarreau56123282010-08-06 19:06:56 +0200743 else if (rule->action == TCP_ACT_TRK_SC2) {
744 if (!s->stkctr2_entry) {
745 /* only the first valid track-sc2 directive applies.
Willy Tarreaud1f96522010-08-03 19:34:32 +0200746 * Also, note that right now we can only track SRC so we
747 * don't check how to get the key, but later we may need
748 * to consider rule->act_prm->trk_ctr.type.
749 */
750 t = rule->act_prm.trk_ctr.table.t;
David du Colombier4f92d322011-03-24 11:09:31 +0100751 ts = stktable_get_entry(t, tcp_src_to_stktable_key(s));
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200752 if (ts) {
Willy Tarreau56123282010-08-06 19:06:56 +0200753 session_track_stkctr2(s, t, ts);
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200754 if (s->fe != s->be)
755 s->flags |= SN_BE_TRACK_SC2;
756 }
Willy Tarreaud1f96522010-08-03 19:34:32 +0200757 }
758 }
759 else {
Willy Tarreauedcf6682008-11-30 23:15:34 +0100760 /* otherwise accept */
Willy Tarreaud1f96522010-08-03 19:34:32 +0200761 break;
762 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100763 }
764 }
765
766 /* if we get there, it means we have no rule which matches, or
767 * we have an explicit accept, so we apply the default accept.
768 */
Willy Tarreau3a816292009-07-07 10:55:49 +0200769 req->analysers &= ~an_bit;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100770 req->analyse_exp = TICK_ETERNITY;
771 return 1;
772}
773
Emeric Brun97679e72010-09-23 17:56:44 +0200774/* This function performs the TCP response analysis on the current response. It
775 * returns 1 if the processing can continue on next analysers, or zero if it
776 * needs more data, encounters an error, or wants to immediately abort the
777 * response. It relies on buffers flags, and updates s->rep->analysers. The
778 * function may be called for backend rules.
779 */
780int tcp_inspect_response(struct session *s, struct buffer *rep, int an_bit)
781{
782 struct tcp_rule *rule;
783 int partial;
784
785 DPRINTF(stderr,"[%u] %s: session=%p b=%p, exp(r,w)=%u,%u bf=%08x bl=%d analysers=%02x\n",
786 now_ms, __FUNCTION__,
787 s,
788 rep,
789 rep->rex, rep->wex,
790 rep->flags,
791 rep->l,
792 rep->analysers);
793
794 /* We don't know whether we have enough data, so must proceed
795 * this way :
796 * - iterate through all rules in their declaration order
797 * - if one rule returns MISS, it means the inspect delay is
798 * not over yet, then return immediately, otherwise consider
799 * it as a non-match.
800 * - if one rule returns OK, then return OK
801 * - if one rule returns KO, then return KO
802 */
803
804 if (rep->flags & BF_SHUTR || tick_is_expired(rep->analyse_exp, now_ms))
805 partial = 0;
806 else
807 partial = ACL_PARTIAL;
808
809 list_for_each_entry(rule, &s->be->tcp_rep.inspect_rules, list) {
810 int ret = ACL_PAT_PASS;
811
812 if (rule->cond) {
813 ret = acl_exec_cond(rule->cond, s->be, s, &s->txn, ACL_DIR_RTR | partial);
814 if (ret == ACL_PAT_MISS) {
815 /* just set the analyser timeout once at the beginning of the response */
816 if (!tick_isset(rep->analyse_exp) && s->be->tcp_rep.inspect_delay)
817 rep->analyse_exp = tick_add_ifset(now_ms, s->be->tcp_rep.inspect_delay);
818 return 0;
819 }
820
821 ret = acl_pass(ret);
822 if (rule->cond->pol == ACL_COND_UNLESS)
823 ret = !ret;
824 }
825
826 if (ret) {
827 /* we have a matching rule. */
828 if (rule->action == TCP_ACT_REJECT) {
829 buffer_abort(rep);
830 buffer_abort(s->req);
831 rep->analysers = 0;
832
Willy Tarreau7d0aaf32011-03-10 23:25:56 +0100833 s->be->be_counters.denied_resp++;
834 s->fe->fe_counters.denied_resp++;
Emeric Brun97679e72010-09-23 17:56:44 +0200835 if (s->listener->counters)
836 s->listener->counters->denied_resp++;
837
838 if (!(s->flags & SN_ERR_MASK))
839 s->flags |= SN_ERR_PRXCOND;
840 if (!(s->flags & SN_FINST_MASK))
841 s->flags |= SN_FINST_D;
842 return 0;
843 }
844 else {
845 /* otherwise accept */
846 break;
847 }
848 }
849 }
850
851 /* if we get there, it means we have no rule which matches, or
852 * we have an explicit accept, so we apply the default accept.
853 */
854 rep->analysers &= ~an_bit;
855 rep->analyse_exp = TICK_ETERNITY;
856 return 1;
857}
858
859
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200860/* This function performs the TCP layer4 analysis on the current request. It
861 * returns 0 if a reject rule matches, otherwise 1 if either an accept rule
862 * matches or if no more rule matches. It can only use rules which don't need
863 * any data.
864 */
865int tcp_exec_req_rules(struct session *s)
866{
867 struct tcp_rule *rule;
Willy Tarreauf059a0f2010-08-03 16:29:52 +0200868 struct stksess *ts;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200869 struct stktable *t = NULL;
870 int result = 1;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200871 int ret;
872
873 list_for_each_entry(rule, &s->fe->tcp_req.l4_rules, list) {
874 ret = ACL_PAT_PASS;
875
876 if (rule->cond) {
877 ret = acl_exec_cond(rule->cond, s->fe, s, NULL, ACL_DIR_REQ);
878 ret = acl_pass(ret);
879 if (rule->cond->pol == ACL_COND_UNLESS)
880 ret = !ret;
881 }
882
883 if (ret) {
884 /* we have a matching rule. */
885 if (rule->action == TCP_ACT_REJECT) {
Willy Tarreau7d0aaf32011-03-10 23:25:56 +0100886 s->fe->fe_counters.denied_conn++;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200887 if (s->listener->counters)
Willy Tarreau2799e982010-06-05 15:43:21 +0200888 s->listener->counters->denied_conn++;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200889
890 if (!(s->flags & SN_ERR_MASK))
891 s->flags |= SN_ERR_PRXCOND;
892 if (!(s->flags & SN_FINST_MASK))
893 s->flags |= SN_FINST_R;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200894 result = 0;
895 break;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200896 }
Willy Tarreau56123282010-08-06 19:06:56 +0200897 else if (rule->action == TCP_ACT_TRK_SC1) {
898 if (!s->stkctr1_entry) {
899 /* only the first valid track-sc1 directive applies.
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200900 * Also, note that right now we can only track SRC so we
901 * don't check how to get the key, but later we may need
902 * to consider rule->act_prm->trk_ctr.type.
903 */
904 t = rule->act_prm.trk_ctr.table.t;
David du Colombier4f92d322011-03-24 11:09:31 +0100905 ts = stktable_get_entry(t, tcp_src_to_stktable_key(s));
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200906 if (ts)
Willy Tarreau56123282010-08-06 19:06:56 +0200907 session_track_stkctr1(s, t, ts);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200908 }
909 }
Willy Tarreau56123282010-08-06 19:06:56 +0200910 else if (rule->action == TCP_ACT_TRK_SC2) {
911 if (!s->stkctr2_entry) {
912 /* only the first valid track-sc2 directive applies.
Willy Tarreauf059a0f2010-08-03 16:29:52 +0200913 * Also, note that right now we can only track SRC so we
914 * don't check how to get the key, but later we may need
915 * to consider rule->act_prm->trk_ctr.type.
916 */
917 t = rule->act_prm.trk_ctr.table.t;
David du Colombier4f92d322011-03-24 11:09:31 +0100918 ts = stktable_get_entry(t, tcp_src_to_stktable_key(s));
Willy Tarreauf059a0f2010-08-03 16:29:52 +0200919 if (ts)
Willy Tarreau56123282010-08-06 19:06:56 +0200920 session_track_stkctr2(s, t, ts);
Willy Tarreauf059a0f2010-08-03 16:29:52 +0200921 }
922 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200923 else {
924 /* otherwise it's an accept */
925 break;
926 }
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200927 }
928 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200929 return result;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200930}
931
Emeric Brun97679e72010-09-23 17:56:44 +0200932/* Parse a tcp-response rule. Return a negative value in case of failure */
933static int tcp_parse_response_rule(char **args, int arg, int section_type,
934 struct proxy *curpx, struct proxy *defpx,
935 struct tcp_rule *rule, char *err, int errlen)
936{
937 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
938 snprintf(err, errlen, "%s %s is only allowed in 'backend' sections",
939 args[0], args[1]);
940 return -1;
941 }
942
943 if (strcmp(args[arg], "accept") == 0) {
944 arg++;
945 rule->action = TCP_ACT_ACCEPT;
946 }
947 else if (strcmp(args[arg], "reject") == 0) {
948 arg++;
949 rule->action = TCP_ACT_REJECT;
950 }
951 else {
952 snprintf(err, errlen,
953 "'%s %s' expects 'accept' or 'reject' in %s '%s' (was '%s')",
954 args[0], args[1], proxy_type_str(curpx), curpx->id, args[arg]);
955 return -1;
956 }
957
958 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
959 if ((rule->cond = build_acl_cond(NULL, 0, curpx, (const char **)args+arg)) == NULL) {
960 snprintf(err, errlen,
961 "error detected in %s '%s' while parsing '%s' condition",
962 proxy_type_str(curpx), curpx->id, args[arg]);
963 return -1;
964 }
965 }
966 else if (*args[arg]) {
967 snprintf(err, errlen,
968 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (was '%s')",
969 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
970 return -1;
971 }
972 return 0;
973}
974
975
976
Willy Tarreau68c03ab2010-08-06 15:08:45 +0200977/* Parse a tcp-request rule. Return a negative value in case of failure */
978static int tcp_parse_request_rule(char **args, int arg, int section_type,
979 struct proxy *curpx, struct proxy *defpx,
980 struct tcp_rule *rule, char *err, int errlen)
981{
982 if (curpx == defpx) {
983 snprintf(err, errlen, "%s %s is not allowed in 'defaults' sections",
984 args[0], args[1]);
985 return -1;
986 }
987
988 if (!strcmp(args[arg], "accept")) {
989 arg++;
990 rule->action = TCP_ACT_ACCEPT;
991 }
992 else if (!strcmp(args[arg], "reject")) {
993 arg++;
994 rule->action = TCP_ACT_REJECT;
995 }
Willy Tarreau56123282010-08-06 19:06:56 +0200996 else if (strcmp(args[arg], "track-sc1") == 0) {
Willy Tarreau68c03ab2010-08-06 15:08:45 +0200997 int ret;
998
999 arg++;
1000 ret = parse_track_counters(args, &arg, section_type, curpx,
1001 &rule->act_prm.trk_ctr, defpx, err, errlen);
1002
1003 if (ret < 0) /* nb: warnings are not handled yet */
1004 return -1;
1005
Willy Tarreau56123282010-08-06 19:06:56 +02001006 rule->action = TCP_ACT_TRK_SC1;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001007 }
Willy Tarreau56123282010-08-06 19:06:56 +02001008 else if (strcmp(args[arg], "track-sc2") == 0) {
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001009 int ret;
1010
1011 arg++;
1012 ret = parse_track_counters(args, &arg, section_type, curpx,
1013 &rule->act_prm.trk_ctr, defpx, err, errlen);
1014
1015 if (ret < 0) /* nb: warnings are not handled yet */
1016 return -1;
1017
Willy Tarreau56123282010-08-06 19:06:56 +02001018 rule->action = TCP_ACT_TRK_SC2;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001019 }
1020 else {
1021 snprintf(err, errlen,
Willy Tarreau56123282010-08-06 19:06:56 +02001022 "'%s %s' expects 'accept', 'reject', 'track-sc1' "
1023 "or 'track-sc2' in %s '%s' (was '%s')",
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001024 args[0], args[1], proxy_type_str(curpx), curpx->id, args[arg]);
1025 return -1;
1026 }
1027
1028 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
1029 if ((rule->cond = build_acl_cond(NULL, 0, curpx, (const char **)args+arg)) == NULL) {
1030 snprintf(err, errlen,
1031 "error detected in %s '%s' while parsing '%s' condition",
1032 proxy_type_str(curpx), curpx->id, args[arg]);
1033 return -1;
1034 }
1035 }
1036 else if (*args[arg]) {
1037 snprintf(err, errlen,
1038 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (was '%s')",
1039 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
1040 return -1;
1041 }
1042 return 0;
1043}
1044
Emeric Brun97679e72010-09-23 17:56:44 +02001045/* This function should be called to parse a line starting with the "tcp-response"
1046 * keyword.
1047 */
1048static int tcp_parse_tcp_rep(char **args, int section_type, struct proxy *curpx,
1049 struct proxy *defpx, char *err, int errlen)
1050{
1051 const char *ptr = NULL;
1052 unsigned int val;
1053 int retlen;
1054 int warn = 0;
1055 int arg;
1056 struct tcp_rule *rule;
1057
1058 if (!*args[1]) {
1059 snprintf(err, errlen, "missing argument for '%s' in %s '%s'",
1060 args[0], proxy_type_str(curpx), curpx->id);
1061 return -1;
1062 }
1063
1064 if (strcmp(args[1], "inspect-delay") == 0) {
1065 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
1066 snprintf(err, errlen, "%s %s is only allowed in 'backend' sections",
1067 args[0], args[1]);
1068 return -1;
1069 }
1070
1071 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
1072 retlen = snprintf(err, errlen,
1073 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
1074 args[0], args[1], proxy_type_str(curpx), curpx->id);
1075 if (ptr && retlen < errlen)
1076 retlen += snprintf(err + retlen, errlen - retlen,
1077 " (unexpected character '%c')", *ptr);
1078 return -1;
1079 }
1080
1081 if (curpx->tcp_rep.inspect_delay) {
1082 snprintf(err, errlen, "ignoring %s %s (was already defined) in %s '%s'",
1083 args[0], args[1], proxy_type_str(curpx), curpx->id);
1084 return 1;
1085 }
1086 curpx->tcp_rep.inspect_delay = val;
1087 return 0;
1088 }
1089
Simon Hormande072bd2011-06-24 15:11:37 +09001090 rule = calloc(1, sizeof(*rule));
Emeric Brun97679e72010-09-23 17:56:44 +02001091 LIST_INIT(&rule->list);
1092 arg = 1;
1093
1094 if (strcmp(args[1], "content") == 0) {
1095 arg++;
1096 if (tcp_parse_response_rule(args, arg, section_type, curpx, defpx, rule, err, errlen) < 0)
1097 goto error;
1098
1099 if (rule->cond && (rule->cond->requires & ACL_USE_L6REQ_VOLATILE)) {
1100 struct acl *acl;
1101 const char *name;
1102
1103 acl = cond_find_require(rule->cond, ACL_USE_L6REQ_VOLATILE);
1104 name = acl ? acl->name : "(unknown)";
1105
1106 retlen = snprintf(err, errlen,
1107 "acl '%s' involves some request-only criteria which will be ignored.",
1108 name);
1109 warn++;
1110 }
1111
1112 LIST_ADDQ(&curpx->tcp_rep.inspect_rules, &rule->list);
1113 }
1114 else {
1115 retlen = snprintf(err, errlen,
1116 "'%s' expects 'inspect-delay' or 'content' in %s '%s' (was '%s')",
1117 args[0], proxy_type_str(curpx), curpx->id, args[1]);
1118 goto error;
1119 }
1120
1121 return warn;
1122 error:
1123 free(rule);
1124 return -1;
1125}
1126
1127
Willy Tarreaub6866442008-07-14 23:54:42 +02001128/* This function should be called to parse a line starting with the "tcp-request"
1129 * keyword.
1130 */
1131static int tcp_parse_tcp_req(char **args, int section_type, struct proxy *curpx,
1132 struct proxy *defpx, char *err, int errlen)
1133{
1134 const char *ptr = NULL;
Willy Tarreauc7e961e2008-08-17 17:13:47 +02001135 unsigned int val;
Willy Tarreaub6866442008-07-14 23:54:42 +02001136 int retlen;
Willy Tarreau1a687942010-05-23 22:40:30 +02001137 int warn = 0;
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001138 int arg;
Willy Tarreau1a687942010-05-23 22:40:30 +02001139 struct tcp_rule *rule;
Willy Tarreaub6866442008-07-14 23:54:42 +02001140
1141 if (!*args[1]) {
1142 snprintf(err, errlen, "missing argument for '%s' in %s '%s'",
Willy Tarreauf5356832010-06-14 18:40:26 +02001143 args[0], proxy_type_str(curpx), curpx->id);
Willy Tarreaub6866442008-07-14 23:54:42 +02001144 return -1;
1145 }
1146
1147 if (!strcmp(args[1], "inspect-delay")) {
1148 if (curpx == defpx) {
1149 snprintf(err, errlen, "%s %s is not allowed in 'defaults' sections",
1150 args[0], args[1]);
1151 return -1;
1152 }
1153
Willy Tarreaub6866442008-07-14 23:54:42 +02001154 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
1155 retlen = snprintf(err, errlen,
1156 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
Willy Tarreauf5356832010-06-14 18:40:26 +02001157 args[0], args[1], proxy_type_str(curpx), curpx->id);
Willy Tarreaub6866442008-07-14 23:54:42 +02001158 if (ptr && retlen < errlen)
1159 retlen += snprintf(err+retlen, errlen - retlen,
1160 " (unexpected character '%c')", *ptr);
1161 return -1;
1162 }
1163
1164 if (curpx->tcp_req.inspect_delay) {
1165 snprintf(err, errlen, "ignoring %s %s (was already defined) in %s '%s'",
Willy Tarreauf5356832010-06-14 18:40:26 +02001166 args[0], args[1], proxy_type_str(curpx), curpx->id);
Willy Tarreaub6866442008-07-14 23:54:42 +02001167 return 1;
1168 }
1169 curpx->tcp_req.inspect_delay = val;
1170 return 0;
1171 }
1172
Simon Hormande072bd2011-06-24 15:11:37 +09001173 rule = calloc(1, sizeof(*rule));
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001174 LIST_INIT(&rule->list);
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001175 arg = 1;
1176
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001177 if (strcmp(args[1], "content") == 0) {
Willy Tarreaud1f96522010-08-03 19:34:32 +02001178 arg++;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001179 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, errlen) < 0)
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001180 goto error;
Willy Tarreaub6866442008-07-14 23:54:42 +02001181
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001182 if (rule->cond && (rule->cond->requires & ACL_USE_RTR_ANY)) {
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001183 struct acl *acl;
1184 const char *name;
1185
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001186 acl = cond_find_require(rule->cond, ACL_USE_RTR_ANY);
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001187 name = acl ? acl->name : "(unknown)";
1188
1189 retlen = snprintf(err, errlen,
Willy Tarreau1a211942009-07-14 13:53:17 +02001190 "acl '%s' involves some response-only criteria which will be ignored.",
1191 name);
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001192 warn++;
1193 }
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001194 LIST_ADDQ(&curpx->tcp_req.inspect_rules, &rule->list);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001195 }
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001196 else if (strcmp(args[1], "connection") == 0) {
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001197 arg++;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001198
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001199 if (!(curpx->cap & PR_CAP_FE)) {
1200 snprintf(err, errlen, "%s %s is not allowed because %s %s is not a frontend",
1201 args[0], args[1], proxy_type_str(curpx), curpx->id);
Simon Horman6c54d8b2011-07-15 13:14:06 +09001202 goto error;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001203 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001204
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001205 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, errlen) < 0)
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001206 goto error;
1207
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001208 if (rule->cond && (rule->cond->requires & (ACL_USE_RTR_ANY|ACL_USE_L6_ANY|ACL_USE_L7_ANY))) {
1209 struct acl *acl;
1210 const char *name;
Willy Tarreauf059a0f2010-08-03 16:29:52 +02001211
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001212 acl = cond_find_require(rule->cond, ACL_USE_RTR_ANY|ACL_USE_L6_ANY|ACL_USE_L7_ANY);
1213 name = acl ? acl->name : "(unknown)";
Willy Tarreauf059a0f2010-08-03 16:29:52 +02001214
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001215 if (acl->requires & (ACL_USE_L6_ANY|ACL_USE_L7_ANY)) {
1216 retlen = snprintf(err, errlen,
1217 "'%s %s' may not reference acl '%s' which makes use of "
1218 "payload in %s '%s'. Please use '%s content' for this.",
1219 args[0], args[1], name, proxy_type_str(curpx), curpx->id, args[0]);
1220 goto error;
1221 }
1222 if (acl->requires & ACL_USE_RTR_ANY)
1223 retlen = snprintf(err, errlen,
1224 "acl '%s' involves some response-only criteria which will be ignored.",
1225 name);
1226 warn++;
1227 }
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001228 LIST_ADDQ(&curpx->tcp_req.l4_rules, &rule->list);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001229 }
Willy Tarreau1a687942010-05-23 22:40:30 +02001230 else {
1231 retlen = snprintf(err, errlen,
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001232 "'%s' expects 'inspect-delay', 'connection', or 'content' in %s '%s' (was '%s')",
Willy Tarreau1a687942010-05-23 22:40:30 +02001233 args[0], proxy_type_str(curpx), curpx->id, args[1]);
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001234 goto error;
Willy Tarreau1a687942010-05-23 22:40:30 +02001235 }
1236
Willy Tarreau1a687942010-05-23 22:40:30 +02001237 return warn;
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001238 error:
1239 free(rule);
1240 return -1;
Willy Tarreaub6866442008-07-14 23:54:42 +02001241}
1242
Willy Tarreau645513a2010-05-24 20:55:15 +02001243
1244/************************************************************************/
1245/* All supported ACL keywords must be declared here. */
1246/************************************************************************/
1247
Willy Tarreauf4362b32011-12-16 17:49:52 +01001248/* copy the source IPv4/v6 address into temp_pattern */
Willy Tarreau645513a2010-05-24 20:55:15 +02001249static int
1250acl_fetch_src(struct proxy *px, struct session *l4, void *l7, int dir,
1251 struct acl_expr *expr, struct acl_test *test)
1252{
Willy Tarreauf4362b32011-12-16 17:49:52 +01001253 switch (l4->si[0].addr.from.ss_family) {
1254 case AF_INET:
1255 temp_pattern.data.ip = ((struct sockaddr_in *)&l4->si[0].addr.from)->sin_addr;
1256 temp_pattern.type = PATTERN_TYPE_IP;
1257 break;
1258 case AF_INET6:
1259 temp_pattern.data.ipv6 = ((struct sockaddr_in6 *)(&l4->si[0].addr.from))->sin6_addr;
1260 temp_pattern.type = PATTERN_TYPE_IPV6;
1261 break;
1262 default:
Emeric Brunf769f512010-10-22 17:14:01 +02001263 return 0;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001264 }
Emeric Brunf769f512010-10-22 17:14:01 +02001265
Willy Tarreauf4362b32011-12-16 17:49:52 +01001266 test->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001267 return 1;
1268}
1269
David du Colombier4f92d322011-03-24 11:09:31 +01001270/* extract the connection's source ipv4 address */
Willy Tarreau645513a2010-05-24 20:55:15 +02001271static int
1272pattern_fetch_src(struct proxy *px, struct session *l4, void *l7, int dir,
Emeric Brun485479d2010-09-23 18:02:19 +02001273 const struct pattern_arg *arg_p, int arg_i, union pattern_data *data)
Willy Tarreau645513a2010-05-24 20:55:15 +02001274{
Willy Tarreau6471afb2011-09-23 10:54:59 +02001275 if (l4->si[0].addr.from.ss_family != AF_INET )
Emeric Brunf769f512010-10-22 17:14:01 +02001276 return 0;
1277
Willy Tarreau6471afb2011-09-23 10:54:59 +02001278 data->ip.s_addr = ((struct sockaddr_in *)&l4->si[0].addr.from)->sin_addr.s_addr;
Willy Tarreau645513a2010-05-24 20:55:15 +02001279 return 1;
1280}
1281
David du Colombier4f92d322011-03-24 11:09:31 +01001282/* extract the connection's source ipv6 address */
1283static int
1284pattern_fetch_src6(struct proxy *px, struct session *l4, void *l7, int dir,
1285 const struct pattern_arg *arg_p, int arg_i, union pattern_data *data)
1286{
Willy Tarreau6471afb2011-09-23 10:54:59 +02001287 if (l4->si[0].addr.from.ss_family != AF_INET6)
David du Colombier4f92d322011-03-24 11:09:31 +01001288 return 0;
1289
Willy Tarreau6471afb2011-09-23 10:54:59 +02001290 memcpy(data->ipv6.s6_addr, ((struct sockaddr_in6 *)&l4->si[0].addr.from)->sin6_addr.s6_addr, sizeof(data->ipv6.s6_addr));
David du Colombier4f92d322011-03-24 11:09:31 +01001291 return 1;
1292}
Willy Tarreau645513a2010-05-24 20:55:15 +02001293
Willy Tarreaua5e37562011-12-16 17:06:15 +01001294/* set temp integer to the connection's source port */
Willy Tarreau645513a2010-05-24 20:55:15 +02001295static int
1296acl_fetch_sport(struct proxy *px, struct session *l4, void *l7, int dir,
1297 struct acl_expr *expr, struct acl_test *test)
1298{
Willy Tarreaua5e37562011-12-16 17:06:15 +01001299 if (!(temp_pattern.data.integer = get_host_port(&l4->si[0].addr.from)))
Emeric Brunf769f512010-10-22 17:14:01 +02001300 return 0;
1301
Willy Tarreau645513a2010-05-24 20:55:15 +02001302 test->flags = 0;
1303 return 1;
1304}
1305
1306
1307/* set test->ptr to point to the frontend's IPv4/IPv6 address and test->i to the family */
1308static int
1309acl_fetch_dst(struct proxy *px, struct session *l4, void *l7, int dir,
1310 struct acl_expr *expr, struct acl_test *test)
1311{
1312 if (!(l4->flags & SN_FRT_ADDR_SET))
1313 get_frt_addr(l4);
1314
Willy Tarreauf4362b32011-12-16 17:49:52 +01001315 switch (l4->si[0].addr.to.ss_family) {
1316 case AF_INET:
1317 temp_pattern.data.ip = ((struct sockaddr_in *)&l4->si[0].addr.to)->sin_addr;
1318 temp_pattern.type = PATTERN_TYPE_IP;
1319 break;
1320 case AF_INET6:
1321 temp_pattern.data.ipv6 = ((struct sockaddr_in6 *)(&l4->si[0].addr.to))->sin6_addr;
1322 temp_pattern.type = PATTERN_TYPE_IPV6;
1323 break;
1324 default:
Emeric Brunf769f512010-10-22 17:14:01 +02001325 return 0;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001326 }
Emeric Brunf769f512010-10-22 17:14:01 +02001327
Willy Tarreauf4362b32011-12-16 17:49:52 +01001328 test->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001329 return 1;
1330}
1331
1332
David du Colombier4f92d322011-03-24 11:09:31 +01001333/* extract the connection's destination ipv4 address */
Willy Tarreau645513a2010-05-24 20:55:15 +02001334static int
1335pattern_fetch_dst(struct proxy *px, struct session *l4, void *l7, int dir,
Emeric Brun485479d2010-09-23 18:02:19 +02001336 const struct pattern_arg *arg_p, int arg_i, union pattern_data *data)
Willy Tarreau645513a2010-05-24 20:55:15 +02001337{
emeric8aa6b372010-10-22 17:06:26 +02001338 if (!(l4->flags & SN_FRT_ADDR_SET))
1339 get_frt_addr(l4);
1340
Willy Tarreau6471afb2011-09-23 10:54:59 +02001341 if (l4->si[0].addr.to.ss_family != AF_INET)
Emeric Brunf769f512010-10-22 17:14:01 +02001342 return 0;
1343
Willy Tarreau6471afb2011-09-23 10:54:59 +02001344 data->ip.s_addr = ((struct sockaddr_in *)&l4->si[0].addr.to)->sin_addr.s_addr;
Willy Tarreau645513a2010-05-24 20:55:15 +02001345 return 1;
1346}
1347
David du Colombier4f92d322011-03-24 11:09:31 +01001348/* extract the connection's destination ipv6 address */
1349static int
1350pattern_fetch_dst6(struct proxy *px, struct session *l4, void *l7, int dir,
1351 const struct pattern_arg *arg_p, int arg_i, union pattern_data *data)
1352{
1353 if (!(l4->flags & SN_FRT_ADDR_SET))
1354 get_frt_addr(l4);
1355
Willy Tarreau6471afb2011-09-23 10:54:59 +02001356 if (l4->si[0].addr.to.ss_family != AF_INET6)
David du Colombier4f92d322011-03-24 11:09:31 +01001357 return 0;
1358
Willy Tarreau6471afb2011-09-23 10:54:59 +02001359 memcpy(data->ipv6.s6_addr, ((struct sockaddr_in6 *)&l4->si[0].addr.to)->sin6_addr.s6_addr, sizeof(data->ipv6.s6_addr));
David du Colombier4f92d322011-03-24 11:09:31 +01001360 return 1;
1361}
1362
Willy Tarreaua5e37562011-12-16 17:06:15 +01001363/* set temp integer to the frontend connexion's destination port */
Willy Tarreau645513a2010-05-24 20:55:15 +02001364static int
1365acl_fetch_dport(struct proxy *px, struct session *l4, void *l7, int dir,
1366 struct acl_expr *expr, struct acl_test *test)
1367{
1368 if (!(l4->flags & SN_FRT_ADDR_SET))
1369 get_frt_addr(l4);
1370
Willy Tarreaua5e37562011-12-16 17:06:15 +01001371 if (!(temp_pattern.data.integer = get_host_port(&l4->si[0].addr.to)))
Emeric Brunf769f512010-10-22 17:14:01 +02001372 return 0;
1373
Willy Tarreau645513a2010-05-24 20:55:15 +02001374 test->flags = 0;
1375 return 1;
1376}
1377
1378static int
1379pattern_fetch_dport(struct proxy *px, struct session *l4, void *l7, int dir,
Emeric Brun485479d2010-09-23 18:02:19 +02001380 const struct pattern_arg *arg, int i, union pattern_data *data)
Willy Tarreau645513a2010-05-24 20:55:15 +02001381{
emeric8aa6b372010-10-22 17:06:26 +02001382 if (!(l4->flags & SN_FRT_ADDR_SET))
1383 get_frt_addr(l4);
1384
Willy Tarreau6471afb2011-09-23 10:54:59 +02001385 if (!(data->integer = get_host_port(&l4->si[0].addr.to)))
Emeric Brunf769f512010-10-22 17:14:01 +02001386 return 0;
1387
Willy Tarreau645513a2010-05-24 20:55:15 +02001388 return 1;
1389}
1390
Emericf2d7cae2010-11-05 18:13:50 +01001391static int
1392pattern_arg_fetch_payloadlv(const char *arg, struct pattern_arg **arg_p, int *arg_i)
1393{
1394 int member = 0;
1395 int len_offset = 0;
1396 int len_size = 0;
1397 int buf_offset = 0;
1398 int relative = 0;
1399 int arg_len = strlen(arg);
1400 int i;
1401
1402 for (i = 0; i < arg_len; i++) {
1403 if (arg[i] == ',') {
1404 member++;
1405 } else if (member == 0) {
1406 if (arg[i] < '0' || arg[i] > '9')
1407 return 0;
1408
1409 len_offset = 10 * len_offset + arg[i] - '0';
1410 } else if (member == 1) {
1411 if (arg[i] < '0' || arg[i] > '9')
1412 return 0;
1413
1414 len_size = 10 * len_size + arg[i] - '0';
1415 } else if (member == 2) {
1416 if (!relative && !buf_offset && arg[i] == '+') {
1417 relative = 1;
1418 continue;
1419 } else if (!relative && !buf_offset && arg[i] == '-') {
1420 relative = 2;
1421 continue;
1422 } else if (arg[i] < '0' || arg[i] > '9')
1423 return 0;
1424
1425 buf_offset = 10 * buf_offset + arg[i] - '0';
1426 }
1427 }
1428
1429 if (member < 1)
1430 return 0;
1431
1432 if (!len_size)
1433 return 0;
1434
1435 if (member == 1) {
1436 buf_offset = len_offset + len_size;
1437 }
1438 else if (relative == 1) {
1439 buf_offset = len_offset + len_size + buf_offset;
1440 }
1441 else if (relative == 2) {
1442 if (len_offset + len_size < buf_offset)
1443 return 0;
1444
1445 buf_offset = len_offset + len_size - buf_offset;
1446 }
1447
1448 *arg_i = 3;
1449 *arg_p = calloc(1, *arg_i*sizeof(struct pattern_arg));
1450 (*arg_p)[0].type = PATTERN_ARG_TYPE_INTEGER;
1451 (*arg_p)[0].data.integer = len_offset;
1452 (*arg_p)[1].type = PATTERN_ARG_TYPE_INTEGER;
1453 (*arg_p)[1].data.integer = len_size;
1454 (*arg_p)[2].type = PATTERN_ARG_TYPE_INTEGER;
1455 (*arg_p)[2].data.integer = buf_offset;
1456
1457 return 1;
1458}
1459
1460static int
1461pattern_fetch_payloadlv(struct proxy *px, struct session *l4, void *l7, int dir,
1462 const struct pattern_arg *arg_p, int arg_i, union pattern_data *data)
1463{
1464 int len_offset = arg_p[0].data.integer;
1465 int len_size = arg_p[1].data.integer;
1466 int buf_offset = arg_p[2].data.integer;
1467 int buf_size = 0;
1468 struct buffer *b;
1469 int i;
1470
1471 /* Format is (len offset, len size, buf offset) or (len offset, len size) */
1472 /* by default buf offset == len offset + len size */
1473 /* buf offset could be absolute or relative to len offset + len size if prefixed by + or - */
1474
1475 if (!l4)
1476 return 0;
1477
1478 b = (dir & PATTERN_FETCH_RTR) ? l4->rep : l4->req;
1479
1480 if (!b || !b->l)
1481 return 0;
1482
1483 if (len_offset + len_size > b->l)
1484 return 0;
1485
1486 for (i = 0; i < len_size; i++) {
1487 buf_size = (buf_size << 8) + ((unsigned char *)b->w)[i + len_offset];
1488 }
1489
1490 if (!buf_size)
1491 return 0;
1492
1493 if (buf_offset + buf_size > b->l)
1494 return 0;
1495
1496 /* init chunk as read only */
Simon Hormande072bd2011-06-24 15:11:37 +09001497 chunk_initlen(&data->str, b->w + buf_offset, 0, buf_size);
Emericf2d7cae2010-11-05 18:13:50 +01001498
1499 return 1;
1500}
1501
1502static int
1503pattern_arg_fetch_payload (const char *arg, struct pattern_arg **arg_p, int *arg_i)
1504{
1505 int member = 0;
1506 int buf_offset = 0;
1507 int buf_size = 0;
1508 int arg_len = strlen(arg);
1509 int i;
1510
1511 for (i = 0 ; i < arg_len ; i++) {
1512 if (arg[i] == ',') {
1513 member++;
1514 } else if (member == 0) {
1515 if (arg[i] < '0' || arg[i] > '9')
1516 return 0;
1517
1518 buf_offset = 10 * buf_offset + arg[i] - '0';
1519 } else if (member == 1) {
1520 if (arg[i] < '0' || arg[i] > '9')
1521 return 0;
1522
1523 buf_size = 10 * buf_size + arg[i] - '0';
1524 }
1525 }
1526
1527 if (!buf_size)
1528 return 0;
1529
1530 *arg_i = 2;
1531 *arg_p = calloc(1, *arg_i*sizeof(struct pattern_arg));
1532 (*arg_p)[0].type = PATTERN_ARG_TYPE_INTEGER;
1533 (*arg_p)[0].data.integer = buf_offset;
1534 (*arg_p)[1].type = PATTERN_ARG_TYPE_INTEGER;
1535 (*arg_p)[1].data.integer = buf_size;
1536
1537 return 1;
1538}
1539
1540static int
1541pattern_fetch_payload(struct proxy *px, struct session *l4, void *l7, int dir,
1542 const struct pattern_arg *arg_p, int arg_i, union pattern_data *data)
1543{
1544 int buf_offset = arg_p[0].data.integer;
1545 int buf_size = arg_p[1].data.integer;
1546 struct buffer *b;
1547
1548 if (!l4)
1549 return 0;
1550
1551 b = (dir & PATTERN_FETCH_RTR) ? l4->rep : l4->req;
1552
1553 if (!b || !b->l)
1554 return 0;
1555
1556 if (buf_offset + buf_size > b->l)
1557 return 0;
1558
1559 /* init chunk as read only */
Simon Hormande072bd2011-06-24 15:11:37 +09001560 chunk_initlen(&data->str, b->w + buf_offset, 0, buf_size);
Emericf2d7cae2010-11-05 18:13:50 +01001561
1562 return 1;
1563}
1564
Simon Hormanab814e02011-06-24 14:50:20 +09001565static int
1566pattern_fetch_rdp_cookie(struct proxy *px, struct session *l4, void *l7, int dir,
1567 const struct pattern_arg *arg_p, int arg_i, union pattern_data *data)
1568{
1569 int ret;
1570 struct acl_expr expr;
1571 struct acl_test test;
1572
1573 if (!l4)
1574 return 0;
1575
1576 memset(&expr, 0, sizeof(expr));
1577 memset(&test, 0, sizeof(test));
1578
1579 expr.arg.str = arg_p[0].data.str.str;
1580 expr.arg_len = arg_p[0].data.str.len;
1581
1582 ret = acl_fetch_rdp_cookie(px, l4, NULL, ACL_DIR_REQ, &expr, &test);
Willy Tarreau664092c2011-12-16 19:11:42 +01001583 if (ret == 0 || (test.flags & ACL_TEST_F_MAY_CHANGE) || temp_pattern.data.str.len == 0)
Simon Hormanab814e02011-06-24 14:50:20 +09001584 return 0;
1585
Willy Tarreau664092c2011-12-16 19:11:42 +01001586 data->str = temp_pattern.data.str;
Simon Hormanab814e02011-06-24 14:50:20 +09001587 return 1;
1588}
1589
Willy Tarreaub6866442008-07-14 23:54:42 +02001590static struct cfg_kw_list cfg_kws = {{ },{
1591 { CFG_LISTEN, "tcp-request", tcp_parse_tcp_req },
Emeric Brun97679e72010-09-23 17:56:44 +02001592 { CFG_LISTEN, "tcp-response", tcp_parse_tcp_rep },
Willy Tarreaub6866442008-07-14 23:54:42 +02001593 { 0, NULL, NULL },
1594}};
1595
Willy Tarreau645513a2010-05-24 20:55:15 +02001596/* Note: must not be declared <const> as its list will be overwritten */
Willy Tarreaub6866442008-07-14 23:54:42 +02001597static struct acl_kw_list acl_kws = {{ },{
Willy Tarreau645513a2010-05-24 20:55:15 +02001598 { "src_port", acl_parse_int, acl_fetch_sport, acl_match_int, ACL_USE_TCP_PERMANENT },
1599 { "src", acl_parse_ip, acl_fetch_src, acl_match_ip, ACL_USE_TCP4_PERMANENT|ACL_MAY_LOOKUP },
1600 { "dst", acl_parse_ip, acl_fetch_dst, acl_match_ip, ACL_USE_TCP4_PERMANENT|ACL_MAY_LOOKUP },
1601 { "dst_port", acl_parse_int, acl_fetch_dport, acl_match_int, ACL_USE_TCP_PERMANENT },
Willy Tarreaub6866442008-07-14 23:54:42 +02001602 { NULL, NULL, NULL, NULL },
1603}};
1604
Willy Tarreau645513a2010-05-24 20:55:15 +02001605/* Note: must not be declared <const> as its list will be overwritten */
1606static struct pattern_fetch_kw_list pattern_fetch_keywords = {{ },{
Emericf2d7cae2010-11-05 18:13:50 +01001607 { "src", pattern_fetch_src, NULL, PATTERN_TYPE_IP, PATTERN_FETCH_REQ },
David du Colombier4f92d322011-03-24 11:09:31 +01001608 { "src6", pattern_fetch_src6, NULL, PATTERN_TYPE_IPV6, PATTERN_FETCH_REQ },
Emericf2d7cae2010-11-05 18:13:50 +01001609 { "dst", pattern_fetch_dst, NULL, PATTERN_TYPE_IP, PATTERN_FETCH_REQ },
David du Colombier4f92d322011-03-24 11:09:31 +01001610 { "dst6", pattern_fetch_dst6, NULL, PATTERN_TYPE_IPV6, PATTERN_FETCH_REQ },
Emericf2d7cae2010-11-05 18:13:50 +01001611 { "dst_port", pattern_fetch_dport, NULL, PATTERN_TYPE_INTEGER, PATTERN_FETCH_REQ },
1612 { "payload", pattern_fetch_payload, pattern_arg_fetch_payload, PATTERN_TYPE_CONSTDATA, PATTERN_FETCH_REQ|PATTERN_FETCH_RTR },
1613 { "payload_lv", pattern_fetch_payloadlv, pattern_arg_fetch_payloadlv, PATTERN_TYPE_CONSTDATA, PATTERN_FETCH_REQ|PATTERN_FETCH_RTR },
Simon Hormanab814e02011-06-24 14:50:20 +09001614 { "rdp_cookie", pattern_fetch_rdp_cookie, pattern_arg_str, PATTERN_TYPE_CONSTSTRING, PATTERN_FETCH_REQ },
Emeric Brun485479d2010-09-23 18:02:19 +02001615 { NULL, NULL, NULL, 0, 0 },
Willy Tarreau645513a2010-05-24 20:55:15 +02001616}};
1617
Willy Tarreaue6b98942007-10-29 01:09:36 +01001618__attribute__((constructor))
1619static void __tcp_protocol_init(void)
1620{
1621 protocol_register(&proto_tcpv4);
1622 protocol_register(&proto_tcpv6);
Willy Tarreau645513a2010-05-24 20:55:15 +02001623 pattern_register_fetches(&pattern_fetch_keywords);
Willy Tarreaub6866442008-07-14 23:54:42 +02001624 cfg_register_keywords(&cfg_kws);
1625 acl_register_keywords(&acl_kws);
Willy Tarreaue6b98942007-10-29 01:09:36 +01001626}
1627
1628
1629/*
1630 * Local variables:
1631 * c-indent-level: 8
1632 * c-basic-offset: 8
1633 * End:
1634 */