blob: e671e41404a844bd7577da0fbb591ee833e5829c [file] [log] [blame]
Willy Tarreaue6b98942007-10-29 01:09:36 +01001/*
2 * AF_INET/AF_INET6 SOCK_STREAM protocol layer (tcp)
3 *
Willy Tarreaud4c33c82013-01-07 21:59:07 +01004 * Copyright 2000-2013 Willy Tarreau <w@1wt.eu>
Willy Tarreaue6b98942007-10-29 01:09:36 +01005 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
13#include <ctype.h>
14#include <errno.h>
15#include <fcntl.h>
16#include <stdio.h>
17#include <stdlib.h>
18#include <string.h>
19#include <time.h>
20
21#include <sys/param.h>
22#include <sys/socket.h>
23#include <sys/stat.h>
24#include <sys/types.h>
25#include <sys/un.h>
26
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +040027#include <netinet/tcp.h>
28
Willy Tarreaub6866442008-07-14 23:54:42 +020029#include <common/cfgparse.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010030#include <common/compat.h>
31#include <common/config.h>
32#include <common/debug.h>
33#include <common/errors.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010034#include <common/mini-clist.h>
35#include <common/standard.h>
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +010036#include <common/namespace.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010037
Willy Tarreaue6b98942007-10-29 01:09:36 +010038#include <types/global.h>
Willy Tarreau18bf01e2014-06-13 16:18:52 +020039#include <types/capture.h>
Willy Tarreau9650f372009-08-16 14:02:45 +020040#include <types/server.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010041
42#include <proto/acl.h>
Thierry FOURNIER322a1242015-08-19 09:07:47 +020043#include <proto/action.h>
Willy Tarreau9fcb9842012-04-20 14:45:49 +020044#include <proto/arg.h>
Willy Tarreauc7e42382012-08-24 19:22:53 +020045#include <proto/channel.h>
Willy Tarreaud2274c62012-07-06 14:29:45 +020046#include <proto/connection.h>
Willy Tarreaudd2f85e2012-09-02 22:34:23 +020047#include <proto/fd.h>
Willy Tarreaud1d54542012-09-12 22:58:11 +020048#include <proto/listener.h>
Willy Tarreau9650f372009-08-16 14:02:45 +020049#include <proto/log.h>
50#include <proto/port_range.h>
Willy Tarreaud1d54542012-09-12 22:58:11 +020051#include <proto/protocol.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010052#include <proto/proto_tcp.h>
Willy Tarreaub6866442008-07-14 23:54:42 +020053#include <proto/proxy.h>
Willy Tarreaucd3b0942012-04-27 21:52:18 +020054#include <proto/sample.h>
Willy Tarreau87b09662015-04-03 00:22:06 +020055#include <proto/stream.h>
Willy Tarreaua975b8f2010-06-05 19:13:27 +020056#include <proto/stick_table.h>
Willy Tarreaucc1e04b2013-09-11 23:20:29 +020057#include <proto/stream_interface.h>
Willy Tarreaua975b8f2010-06-05 19:13:27 +020058#include <proto/task.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010059
Emeric Bruncf20bf12010-10-22 16:06:11 +020060static int tcp_bind_listeners(struct protocol *proto, char *errmsg, int errlen);
61static int tcp_bind_listener(struct listener *listener, char *errmsg, int errlen);
Willy Tarreaue6b98942007-10-29 01:09:36 +010062
Thierry FOURNIERcc87a112014-12-12 19:41:33 +010063/* List head of all known action keywords for "tcp-request connection" */
64struct list tcp_req_conn_keywords = LIST_HEAD_INIT(tcp_req_conn_keywords);
65struct list tcp_req_cont_keywords = LIST_HEAD_INIT(tcp_req_cont_keywords);
66struct list tcp_res_cont_keywords = LIST_HEAD_INIT(tcp_res_cont_keywords);
67
Willy Tarreaue6b98942007-10-29 01:09:36 +010068/* Note: must not be declared <const> as its list will be overwritten */
69static struct protocol proto_tcpv4 = {
70 .name = "tcpv4",
71 .sock_domain = AF_INET,
72 .sock_type = SOCK_STREAM,
73 .sock_prot = IPPROTO_TCP,
74 .sock_family = AF_INET,
75 .sock_addrlen = sizeof(struct sockaddr_in),
76 .l3_addrlen = 32/8,
Willy Tarreaubbebbbf2012-05-07 21:22:09 +020077 .accept = &listener_accept,
Willy Tarreau26d8c592012-05-07 18:12:14 +020078 .connect = tcp_connect_server,
Emeric Bruncf20bf12010-10-22 16:06:11 +020079 .bind = tcp_bind_listener,
Willy Tarreaue6b98942007-10-29 01:09:36 +010080 .bind_all = tcp_bind_listeners,
81 .unbind_all = unbind_all_listeners,
82 .enable_all = enable_all_listeners,
Willy Tarreau59b94792012-05-11 16:16:40 +020083 .get_src = tcp_get_src,
84 .get_dst = tcp_get_dst,
Willy Tarreau2b57cb82013-06-10 19:56:38 +020085 .drain = tcp_drain,
Willy Tarreau092d8652014-07-07 20:22:12 +020086 .pause = tcp_pause_listener,
Willy Tarreaue6b98942007-10-29 01:09:36 +010087 .listeners = LIST_HEAD_INIT(proto_tcpv4.listeners),
88 .nb_listeners = 0,
89};
90
91/* Note: must not be declared <const> as its list will be overwritten */
92static struct protocol proto_tcpv6 = {
93 .name = "tcpv6",
94 .sock_domain = AF_INET6,
95 .sock_type = SOCK_STREAM,
96 .sock_prot = IPPROTO_TCP,
97 .sock_family = AF_INET6,
98 .sock_addrlen = sizeof(struct sockaddr_in6),
99 .l3_addrlen = 128/8,
Willy Tarreaubbebbbf2012-05-07 21:22:09 +0200100 .accept = &listener_accept,
Willy Tarreau26d8c592012-05-07 18:12:14 +0200101 .connect = tcp_connect_server,
Emeric Bruncf20bf12010-10-22 16:06:11 +0200102 .bind = tcp_bind_listener,
Willy Tarreaue6b98942007-10-29 01:09:36 +0100103 .bind_all = tcp_bind_listeners,
104 .unbind_all = unbind_all_listeners,
105 .enable_all = enable_all_listeners,
Willy Tarreau59b94792012-05-11 16:16:40 +0200106 .get_src = tcp_get_src,
107 .get_dst = tcp_get_dst,
Willy Tarreau2b57cb82013-06-10 19:56:38 +0200108 .drain = tcp_drain,
Willy Tarreau092d8652014-07-07 20:22:12 +0200109 .pause = tcp_pause_listener,
Willy Tarreaue6b98942007-10-29 01:09:36 +0100110 .listeners = LIST_HEAD_INIT(proto_tcpv6.listeners),
111 .nb_listeners = 0,
112};
113
Thierry FOURNIERcc87a112014-12-12 19:41:33 +0100114/*
115 * Register keywords.
116 */
Thierry FOURNIER36481b82015-08-19 09:01:53 +0200117void tcp_req_conn_keywords_register(struct action_kw_list *kw_list)
Thierry FOURNIERcc87a112014-12-12 19:41:33 +0100118{
119 LIST_ADDQ(&tcp_req_conn_keywords, &kw_list->list);
120}
121
Thierry FOURNIER36481b82015-08-19 09:01:53 +0200122void tcp_req_cont_keywords_register(struct action_kw_list *kw_list)
Thierry FOURNIERcc87a112014-12-12 19:41:33 +0100123{
124 LIST_ADDQ(&tcp_req_cont_keywords, &kw_list->list);
125}
126
Thierry FOURNIER36481b82015-08-19 09:01:53 +0200127void tcp_res_cont_keywords_register(struct action_kw_list *kw_list)
Thierry FOURNIERcc87a112014-12-12 19:41:33 +0100128{
129 LIST_ADDQ(&tcp_res_cont_keywords, &kw_list->list);
130}
131
132/*
133 * Return the struct http_req_action_kw associated to a keyword.
134 */
Thierry FOURNIER36481b82015-08-19 09:01:53 +0200135static struct action_kw *tcp_req_conn_action(const char *kw)
Thierry FOURNIERcc87a112014-12-12 19:41:33 +0100136{
Thierry FOURNIER322a1242015-08-19 09:07:47 +0200137 return action_lookup(&tcp_req_conn_keywords, kw);
Thierry FOURNIERcc87a112014-12-12 19:41:33 +0100138}
139
Thierry FOURNIER36481b82015-08-19 09:01:53 +0200140static struct action_kw *tcp_req_cont_action(const char *kw)
Thierry FOURNIERcc87a112014-12-12 19:41:33 +0100141{
Thierry FOURNIER322a1242015-08-19 09:07:47 +0200142 return action_lookup(&tcp_req_cont_keywords, kw);
Thierry FOURNIERcc87a112014-12-12 19:41:33 +0100143}
144
Thierry FOURNIER36481b82015-08-19 09:01:53 +0200145static struct action_kw *tcp_res_cont_action(const char *kw)
Thierry FOURNIERcc87a112014-12-12 19:41:33 +0100146{
Thierry FOURNIER322a1242015-08-19 09:07:47 +0200147 return action_lookup(&tcp_res_cont_keywords, kw);
Thierry FOURNIERcc87a112014-12-12 19:41:33 +0100148}
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100149
David du Colombier6f5ccb12011-03-10 22:26:24 +0100150/* Binds ipv4/ipv6 address <local> to socket <fd>, unless <flags> is set, in which
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100151 * case we try to bind <remote>. <flags> is a 2-bit field consisting of :
152 * - 0 : ignore remote address (may even be a NULL pointer)
153 * - 1 : use provided address
154 * - 2 : use provided port
155 * - 3 : use both
156 *
157 * The function supports multiple foreign binding methods :
158 * - linux_tproxy: we directly bind to the foreign address
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100159 * The second one can be used as a fallback for the first one.
160 * This function returns 0 when everything's OK, 1 if it could not bind, to the
161 * local address, 2 if it could not bind to the foreign address.
162 */
David du Colombier6f5ccb12011-03-10 22:26:24 +0100163int tcp_bind_socket(int fd, int flags, struct sockaddr_storage *local, struct sockaddr_storage *remote)
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100164{
David du Colombier6f5ccb12011-03-10 22:26:24 +0100165 struct sockaddr_storage bind_addr;
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100166 int foreign_ok = 0;
167 int ret;
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100168 static int ip_transp_working = 1;
David du Colombier65c17962012-07-13 14:34:59 +0200169 static int ip6_transp_working = 1;
Pieter Baauwd551fb52013-05-08 22:49:23 +0200170
David du Colombier65c17962012-07-13 14:34:59 +0200171 switch (local->ss_family) {
172 case AF_INET:
173 if (flags && ip_transp_working) {
Pieter Baauwd551fb52013-05-08 22:49:23 +0200174 /* This deserves some explanation. Some platforms will support
175 * multiple combinations of certain methods, so we try the
176 * supported ones until one succeeds.
177 */
178 if (0
179#if defined(IP_TRANSPARENT)
180 || (setsockopt(fd, SOL_IP, IP_TRANSPARENT, &one, sizeof(one)) == 0)
181#endif
182#if defined(IP_FREEBIND)
183 || (setsockopt(fd, SOL_IP, IP_FREEBIND, &one, sizeof(one)) == 0)
184#endif
Pieter Baauwff30b662013-05-08 23:22:39 +0200185#if defined(IP_BINDANY)
186 || (setsockopt(fd, IPPROTO_IP, IP_BINDANY, &one, sizeof(one)) == 0)
187#endif
Pieter Baauw1eb75922013-05-08 23:30:23 +0200188#if defined(SO_BINDANY)
189 || (setsockopt(fd, SOL_SOCKET, SO_BINDANY, &one, sizeof(one)) == 0)
190#endif
Pieter Baauwd551fb52013-05-08 22:49:23 +0200191 )
David du Colombier65c17962012-07-13 14:34:59 +0200192 foreign_ok = 1;
193 else
194 ip_transp_working = 0;
195 }
196 break;
197 case AF_INET6:
198 if (flags && ip6_transp_working) {
Pieter Baauwd551fb52013-05-08 22:49:23 +0200199 if (0
200#if defined(IPV6_TRANSPARENT)
201 || (setsockopt(fd, SOL_IPV6, IPV6_TRANSPARENT, &one, sizeof(one)) == 0)
202#endif
Lukas Tribus7640e722014-03-03 21:10:51 +0100203#if defined(IP_FREEBIND)
204 || (setsockopt(fd, SOL_IP, IP_FREEBIND, &one, sizeof(one)) == 0)
205#endif
Pieter Baauwff30b662013-05-08 23:22:39 +0200206#if defined(IPV6_BINDANY)
207 || (setsockopt(fd, IPPROTO_IPV6, IPV6_BINDANY, &one, sizeof(one)) == 0)
208#endif
Pieter Baauw1eb75922013-05-08 23:30:23 +0200209#if defined(SO_BINDANY)
210 || (setsockopt(fd, SOL_SOCKET, SO_BINDANY, &one, sizeof(one)) == 0)
211#endif
Pieter Baauwd551fb52013-05-08 22:49:23 +0200212 )
David du Colombier65c17962012-07-13 14:34:59 +0200213 foreign_ok = 1;
214 else
215 ip6_transp_working = 0;
216 }
217 break;
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100218 }
Pieter Baauwd551fb52013-05-08 22:49:23 +0200219
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100220 if (flags) {
221 memset(&bind_addr, 0, sizeof(bind_addr));
Willy Tarreau96dd0792011-04-19 07:20:57 +0200222 bind_addr.ss_family = remote->ss_family;
David du Colombier6f5ccb12011-03-10 22:26:24 +0100223 switch (remote->ss_family) {
224 case AF_INET:
225 if (flags & 1)
226 ((struct sockaddr_in *)&bind_addr)->sin_addr = ((struct sockaddr_in *)remote)->sin_addr;
227 if (flags & 2)
228 ((struct sockaddr_in *)&bind_addr)->sin_port = ((struct sockaddr_in *)remote)->sin_port;
229 break;
230 case AF_INET6:
231 if (flags & 1)
232 ((struct sockaddr_in6 *)&bind_addr)->sin6_addr = ((struct sockaddr_in6 *)remote)->sin6_addr;
233 if (flags & 2)
234 ((struct sockaddr_in6 *)&bind_addr)->sin6_port = ((struct sockaddr_in6 *)remote)->sin6_port;
235 break;
Willy Tarreau5dc1e982011-12-16 21:25:11 +0100236 default:
237 /* we don't want to try to bind to an unknown address family */
238 foreign_ok = 0;
David du Colombier6f5ccb12011-03-10 22:26:24 +0100239 }
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100240 }
241
Simon Hormande072bd2011-06-24 15:11:37 +0900242 setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one));
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100243 if (foreign_ok) {
Willy Tarreau9cf8d3f2014-05-09 22:56:10 +0200244 if (is_inet_addr(&bind_addr)) {
Willy Tarreau5f2877a2012-10-26 19:57:58 +0200245 ret = bind(fd, (struct sockaddr *)&bind_addr, get_addr_len(&bind_addr));
246 if (ret < 0)
247 return 2;
248 }
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100249 }
250 else {
Willy Tarreau9cf8d3f2014-05-09 22:56:10 +0200251 if (is_inet_addr(local)) {
Willy Tarreau5f2877a2012-10-26 19:57:58 +0200252 ret = bind(fd, (struct sockaddr *)local, get_addr_len(local));
253 if (ret < 0)
254 return 1;
255 }
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100256 }
257
258 if (!flags)
259 return 0;
260
Willy Tarreaue8c66af2008-01-13 18:40:14 +0100261 if (!foreign_ok)
262 /* we could not bind to a foreign address */
263 return 2;
264
265 return 0;
266}
Willy Tarreaue6b98942007-10-29 01:09:36 +0100267
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100268static int create_server_socket(struct connection *conn)
269{
Willy Tarreau529c1392014-12-24 13:47:55 +0100270 const struct netns_entry *ns = NULL;
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100271
Willy Tarreau529c1392014-12-24 13:47:55 +0100272#ifdef CONFIG_HAP_NS
273 if (objt_server(conn->target)) {
274 if (__objt_server(conn->target)->flags & SRV_F_USE_NS_FROM_PP)
275 ns = conn->proxy_netns;
276 else
277 ns = __objt_server(conn->target)->netns;
278 }
279#endif
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100280 return my_socketat(ns, conn->addr.to.ss_family, SOCK_STREAM, IPPROTO_TCP);
281}
Willy Tarreau9650f372009-08-16 14:02:45 +0200282
283/*
Willy Tarreau14f8e862012-08-30 22:23:13 +0200284 * This function initiates a TCP connection establishment to the target assigned
285 * to connection <conn> using (si->{target,addr.to}). A source address may be
286 * pointed to by conn->addr.from in case of transparent proxying. Normal source
287 * bind addresses are still determined locally (due to the possible need of a
288 * source port). conn->target may point either to a valid server or to a backend,
Willy Tarreau3fdb3662012-11-12 00:42:33 +0100289 * depending on conn->target. Only OBJ_TYPE_PROXY and OBJ_TYPE_SERVER are
Willy Tarreauf0837b22012-11-24 10:24:27 +0100290 * supported. The <data> parameter is a boolean indicating whether there are data
291 * waiting for being sent or not, in order to adjust data write polling and on
292 * some platforms, the ability to avoid an empty initial ACK. The <delack> argument
293 * allows the caller to force using a delayed ACK when establishing the connection :
294 * - 0 = no delayed ACK unless data are advertised and backend has tcp-smart-connect
295 * - 1 = delayed ACK if backend has tcp-smart-connect, regardless of data
296 * - 2 = delayed ACK regardless of backend options
Willy Tarreaub1d67742010-03-29 19:36:59 +0200297 *
Willy Tarreau1ec74bf2013-10-24 21:45:00 +0200298 * Note that a pending send_proxy message accounts for data.
299 *
Willy Tarreau9650f372009-08-16 14:02:45 +0200300 * It can return one of :
Willy Tarreaue7dff022015-04-03 01:14:29 +0200301 * - SF_ERR_NONE if everything's OK
302 * - SF_ERR_SRVTO if there are no more servers
303 * - SF_ERR_SRVCL if the connection was refused by the server
304 * - SF_ERR_PRXCOND if the connection has been limited by the proxy (maxconn)
305 * - SF_ERR_RESOURCE if a system resource is lacking (eg: fd limits, ports, ...)
306 * - SF_ERR_INTERNAL for any other purely internal errors
307 * Additionnally, in the case of SF_ERR_RESOURCE, an emergency log will be emitted.
Willy Tarreau6b0a8502012-11-23 08:51:32 +0100308 *
Willy Tarreaue7dff022015-04-03 01:14:29 +0200309 * The connection's fd is inserted only when SF_ERR_NONE is returned, otherwise
Willy Tarreau6b0a8502012-11-23 08:51:32 +0100310 * it's invalid and the caller has nothing to do.
Willy Tarreau9650f372009-08-16 14:02:45 +0200311 */
Willy Tarreauf1536862011-03-03 18:27:32 +0100312
Willy Tarreauf0837b22012-11-24 10:24:27 +0100313int tcp_connect_server(struct connection *conn, int data, int delack)
Willy Tarreau9650f372009-08-16 14:02:45 +0200314{
315 int fd;
Willy Tarreauac825402011-03-04 22:04:29 +0100316 struct server *srv;
317 struct proxy *be;
Willy Tarreaua4380b42012-12-08 22:49:11 +0100318 struct conn_src *src;
Willy Tarreauac825402011-03-04 22:04:29 +0100319
Willy Tarreau9ce70132014-01-24 16:08:19 +0100320 conn->flags = CO_FL_WAIT_L4_CONN; /* connection in progress */
321
Willy Tarreau3fdb3662012-11-12 00:42:33 +0100322 switch (obj_type(conn->target)) {
323 case OBJ_TYPE_PROXY:
324 be = objt_proxy(conn->target);
Willy Tarreauac825402011-03-04 22:04:29 +0100325 srv = NULL;
326 break;
Willy Tarreau3fdb3662012-11-12 00:42:33 +0100327 case OBJ_TYPE_SERVER:
328 srv = objt_server(conn->target);
Willy Tarreauac825402011-03-04 22:04:29 +0100329 be = srv->proxy;
330 break;
331 default:
Willy Tarreau9ce70132014-01-24 16:08:19 +0100332 conn->flags |= CO_FL_ERROR;
Willy Tarreaue7dff022015-04-03 01:14:29 +0200333 return SF_ERR_INTERNAL;
Willy Tarreauac825402011-03-04 22:04:29 +0100334 }
Willy Tarreau9650f372009-08-16 14:02:45 +0200335
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100336 fd = conn->t.sock.fd = create_server_socket(conn);
337
338 if (fd == -1) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200339 qfprintf(stderr, "Cannot get a server socket.\n");
340
Willy Tarreau9ce70132014-01-24 16:08:19 +0100341 if (errno == ENFILE) {
342 conn->err_code = CO_ER_SYS_FDLIM;
Willy Tarreau9650f372009-08-16 14:02:45 +0200343 send_log(be, LOG_EMERG,
344 "Proxy %s reached system FD limit at %d. Please check system tunables.\n",
345 be->id, maxfd);
Willy Tarreau9ce70132014-01-24 16:08:19 +0100346 }
347 else if (errno == EMFILE) {
348 conn->err_code = CO_ER_PROC_FDLIM;
Willy Tarreau9650f372009-08-16 14:02:45 +0200349 send_log(be, LOG_EMERG,
350 "Proxy %s reached process FD limit at %d. Please check 'ulimit-n' and restart.\n",
351 be->id, maxfd);
Willy Tarreau9ce70132014-01-24 16:08:19 +0100352 }
353 else if (errno == ENOBUFS || errno == ENOMEM) {
354 conn->err_code = CO_ER_SYS_MEMLIM;
Willy Tarreau9650f372009-08-16 14:02:45 +0200355 send_log(be, LOG_EMERG,
356 "Proxy %s reached system memory limit at %d sockets. Please check system tunables.\n",
357 be->id, maxfd);
Willy Tarreau9ce70132014-01-24 16:08:19 +0100358 }
359 else if (errno == EAFNOSUPPORT || errno == EPROTONOSUPPORT) {
360 conn->err_code = CO_ER_NOPROTO;
361 }
362 else
363 conn->err_code = CO_ER_SOCK_ERR;
364
Willy Tarreau9650f372009-08-16 14:02:45 +0200365 /* this is a resource error */
Willy Tarreau9ce70132014-01-24 16:08:19 +0100366 conn->flags |= CO_FL_ERROR;
Willy Tarreaue7dff022015-04-03 01:14:29 +0200367 return SF_ERR_RESOURCE;
Willy Tarreau9650f372009-08-16 14:02:45 +0200368 }
369
370 if (fd >= global.maxsock) {
371 /* do not log anything there, it's a normal condition when this option
372 * is used to serialize connections to a server !
373 */
374 Alert("socket(): not enough free sockets. Raise -n argument. Giving up.\n");
375 close(fd);
Willy Tarreau9ce70132014-01-24 16:08:19 +0100376 conn->err_code = CO_ER_CONF_FDLIM;
377 conn->flags |= CO_FL_ERROR;
Willy Tarreaue7dff022015-04-03 01:14:29 +0200378 return SF_ERR_PRXCOND; /* it is a configuration limit */
Willy Tarreau9650f372009-08-16 14:02:45 +0200379 }
380
381 if ((fcntl(fd, F_SETFL, O_NONBLOCK)==-1) ||
Simon Hormande072bd2011-06-24 15:11:37 +0900382 (setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &one, sizeof(one)) == -1)) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200383 qfprintf(stderr,"Cannot set client socket to non blocking mode.\n");
384 close(fd);
Willy Tarreau9ce70132014-01-24 16:08:19 +0100385 conn->err_code = CO_ER_SOCK_ERR;
386 conn->flags |= CO_FL_ERROR;
Willy Tarreaue7dff022015-04-03 01:14:29 +0200387 return SF_ERR_INTERNAL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200388 }
389
390 if (be->options & PR_O_TCP_SRV_KA)
Simon Hormande072bd2011-06-24 15:11:37 +0900391 setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, &one, sizeof(one));
Willy Tarreau9650f372009-08-16 14:02:45 +0200392
Willy Tarreau9650f372009-08-16 14:02:45 +0200393 /* allow specific binding :
394 * - server-specific at first
395 * - proxy-specific next
396 */
Willy Tarreaua4380b42012-12-08 22:49:11 +0100397 if (srv && srv->conn_src.opts & CO_SRC_BIND)
398 src = &srv->conn_src;
399 else if (be->conn_src.opts & CO_SRC_BIND)
400 src = &be->conn_src;
401 else
402 src = NULL;
403
404 if (src) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200405 int ret, flags = 0;
406
Willy Tarreau9cf8d3f2014-05-09 22:56:10 +0200407 if (is_inet_addr(&conn->addr.from)) {
Willy Tarreaua4380b42012-12-08 22:49:11 +0100408 switch (src->opts & CO_SRC_TPROXY_MASK) {
Willy Tarreauef9a3602012-12-08 22:29:20 +0100409 case CO_SRC_TPROXY_CLI:
Willy Tarreau387ebf82015-08-04 19:24:13 +0200410 conn->flags |= CO_FL_PRIVATE;
411 /* fall through */
412 case CO_SRC_TPROXY_ADDR:
Willy Tarreau5f2877a2012-10-26 19:57:58 +0200413 flags = 3;
414 break;
Willy Tarreauef9a3602012-12-08 22:29:20 +0100415 case CO_SRC_TPROXY_CIP:
416 case CO_SRC_TPROXY_DYN:
Willy Tarreau387ebf82015-08-04 19:24:13 +0200417 conn->flags |= CO_FL_PRIVATE;
Willy Tarreau5f2877a2012-10-26 19:57:58 +0200418 flags = 1;
419 break;
420 }
Willy Tarreau9650f372009-08-16 14:02:45 +0200421 }
Willy Tarreaub1d67742010-03-29 19:36:59 +0200422
Willy Tarreau9650f372009-08-16 14:02:45 +0200423#ifdef SO_BINDTODEVICE
424 /* Note: this might fail if not CAP_NET_RAW */
Willy Tarreaua4380b42012-12-08 22:49:11 +0100425 if (src->iface_name)
426 setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, src->iface_name, src->iface_len + 1);
Willy Tarreau9650f372009-08-16 14:02:45 +0200427#endif
428
Willy Tarreaua4380b42012-12-08 22:49:11 +0100429 if (src->sport_range) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200430 int attempts = 10; /* should be more than enough to find a spare port */
Willy Tarreaua4380b42012-12-08 22:49:11 +0100431 struct sockaddr_storage sa;
Willy Tarreau9650f372009-08-16 14:02:45 +0200432
433 ret = 1;
Willy Tarreaua4380b42012-12-08 22:49:11 +0100434 sa = src->source_addr;
Willy Tarreau9650f372009-08-16 14:02:45 +0200435
436 do {
437 /* note: in case of retry, we may have to release a previously
438 * allocated port, hence this loop's construct.
439 */
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200440 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
441 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200442
443 if (!attempts)
444 break;
445 attempts--;
446
Willy Tarreaua4380b42012-12-08 22:49:11 +0100447 fdinfo[fd].local_port = port_range_alloc_port(src->sport_range);
Willy Tarreau9ce70132014-01-24 16:08:19 +0100448 if (!fdinfo[fd].local_port) {
449 conn->err_code = CO_ER_PORT_RANGE;
Willy Tarreau9650f372009-08-16 14:02:45 +0200450 break;
Willy Tarreau9ce70132014-01-24 16:08:19 +0100451 }
Willy Tarreau9650f372009-08-16 14:02:45 +0200452
Willy Tarreaua4380b42012-12-08 22:49:11 +0100453 fdinfo[fd].port_range = src->sport_range;
454 set_host_port(&sa, fdinfo[fd].local_port);
Willy Tarreau9650f372009-08-16 14:02:45 +0200455
Willy Tarreaua4380b42012-12-08 22:49:11 +0100456 ret = tcp_bind_socket(fd, flags, &sa, &conn->addr.from);
Willy Tarreau9ce70132014-01-24 16:08:19 +0100457 if (ret != 0)
458 conn->err_code = CO_ER_CANT_BIND;
Willy Tarreau9650f372009-08-16 14:02:45 +0200459 } while (ret != 0); /* binding NOK */
460 }
461 else {
Willy Tarreaua4380b42012-12-08 22:49:11 +0100462 ret = tcp_bind_socket(fd, flags, &src->source_addr, &conn->addr.from);
Willy Tarreau9ce70132014-01-24 16:08:19 +0100463 if (ret != 0)
464 conn->err_code = CO_ER_CANT_BIND;
Willy Tarreau9650f372009-08-16 14:02:45 +0200465 }
466
Willy Tarreaua4380b42012-12-08 22:49:11 +0100467 if (unlikely(ret != 0)) {
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200468 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
469 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200470 close(fd);
471
Willy Tarreau9650f372009-08-16 14:02:45 +0200472 if (ret == 1) {
Willy Tarreaua4380b42012-12-08 22:49:11 +0100473 Alert("Cannot bind to source address before connect() for backend %s. Aborting.\n",
Willy Tarreau9650f372009-08-16 14:02:45 +0200474 be->id);
475 send_log(be, LOG_EMERG,
Willy Tarreaua4380b42012-12-08 22:49:11 +0100476 "Cannot bind to source address before connect() for backend %s.\n",
Willy Tarreau9650f372009-08-16 14:02:45 +0200477 be->id);
478 } else {
Willy Tarreaua4380b42012-12-08 22:49:11 +0100479 Alert("Cannot bind to tproxy source address before connect() for backend %s. Aborting.\n",
Willy Tarreau9650f372009-08-16 14:02:45 +0200480 be->id);
481 send_log(be, LOG_EMERG,
Willy Tarreaua4380b42012-12-08 22:49:11 +0100482 "Cannot bind to tproxy source address before connect() for backend %s.\n",
Willy Tarreau9650f372009-08-16 14:02:45 +0200483 be->id);
484 }
Willy Tarreau9ce70132014-01-24 16:08:19 +0100485 conn->flags |= CO_FL_ERROR;
Willy Tarreaue7dff022015-04-03 01:14:29 +0200486 return SF_ERR_RESOURCE;
Willy Tarreau9650f372009-08-16 14:02:45 +0200487 }
488 }
489
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400490#if defined(TCP_QUICKACK)
Willy Tarreau9650f372009-08-16 14:02:45 +0200491 /* disabling tcp quick ack now allows the first request to leave the
492 * machine with the first ACK. We only do this if there are pending
Willy Tarreauf0837b22012-11-24 10:24:27 +0100493 * data in the buffer.
Willy Tarreau9650f372009-08-16 14:02:45 +0200494 */
Willy Tarreaufb20e462014-10-24 12:02:24 +0200495 if (delack == 2 || ((delack || data || conn->send_proxy_ofs) && (be->options2 & PR_O2_SMARTCON)))
Simon Hormande072bd2011-06-24 15:11:37 +0900496 setsockopt(fd, IPPROTO_TCP, TCP_QUICKACK, &zero, sizeof(zero));
Willy Tarreau9650f372009-08-16 14:02:45 +0200497#endif
498
Willy Tarreaue803de22010-01-21 17:43:04 +0100499 if (global.tune.server_sndbuf)
500 setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &global.tune.server_sndbuf, sizeof(global.tune.server_sndbuf));
501
502 if (global.tune.server_rcvbuf)
503 setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &global.tune.server_rcvbuf, sizeof(global.tune.server_rcvbuf));
504
Willy Tarreau986a9d22012-08-30 21:11:38 +0200505 if ((connect(fd, (struct sockaddr *)&conn->addr.to, get_addr_len(&conn->addr.to)) == -1) &&
Willy Tarreau9650f372009-08-16 14:02:45 +0200506 (errno != EINPROGRESS) && (errno != EALREADY) && (errno != EISCONN)) {
507
Willy Tarreaub1719512012-12-08 23:03:28 +0100508 if (errno == EAGAIN || errno == EADDRINUSE || errno == EADDRNOTAVAIL) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200509 char *msg;
Willy Tarreau9ce70132014-01-24 16:08:19 +0100510 if (errno == EAGAIN || errno == EADDRNOTAVAIL) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200511 msg = "no free ports";
Willy Tarreau9ce70132014-01-24 16:08:19 +0100512 conn->err_code = CO_ER_FREE_PORTS;
513 }
514 else {
Willy Tarreau9650f372009-08-16 14:02:45 +0200515 msg = "local address already in use";
Willy Tarreau9ce70132014-01-24 16:08:19 +0100516 conn->err_code = CO_ER_ADDR_INUSE;
517 }
Willy Tarreau9650f372009-08-16 14:02:45 +0200518
Willy Tarreaub1719512012-12-08 23:03:28 +0100519 qfprintf(stderr,"Connect() failed for backend %s: %s.\n", be->id, msg);
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200520 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
521 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200522 close(fd);
Willy Tarreaub1719512012-12-08 23:03:28 +0100523 send_log(be, LOG_ERR, "Connect() failed for backend %s: %s.\n", be->id, msg);
Willy Tarreau9ce70132014-01-24 16:08:19 +0100524 conn->flags |= CO_FL_ERROR;
Willy Tarreaue7dff022015-04-03 01:14:29 +0200525 return SF_ERR_RESOURCE;
Willy Tarreau9650f372009-08-16 14:02:45 +0200526 } else if (errno == ETIMEDOUT) {
527 //qfprintf(stderr,"Connect(): ETIMEDOUT");
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200528 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
529 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200530 close(fd);
Willy Tarreau9ce70132014-01-24 16:08:19 +0100531 conn->err_code = CO_ER_SOCK_ERR;
532 conn->flags |= CO_FL_ERROR;
Willy Tarreaue7dff022015-04-03 01:14:29 +0200533 return SF_ERR_SRVTO;
Willy Tarreau9650f372009-08-16 14:02:45 +0200534 } else {
535 // (errno == ECONNREFUSED || errno == ENETUNREACH || errno == EACCES || errno == EPERM)
536 //qfprintf(stderr,"Connect(): %d", errno);
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200537 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
538 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200539 close(fd);
Willy Tarreau9ce70132014-01-24 16:08:19 +0100540 conn->err_code = CO_ER_SOCK_ERR;
541 conn->flags |= CO_FL_ERROR;
Willy Tarreaue7dff022015-04-03 01:14:29 +0200542 return SF_ERR_SRVCL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200543 }
544 }
545
Willy Tarreaufc8f1f02012-12-08 18:53:44 +0100546 conn->flags |= CO_FL_ADDR_TO_SET;
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200547
Willy Tarreau1ec74bf2013-10-24 21:45:00 +0200548 /* Prepare to send a few handshakes related to the on-wire protocol. */
549 if (conn->send_proxy_ofs)
Willy Tarreau57cd3e42013-10-24 22:01:26 +0200550 conn->flags |= CO_FL_SEND_PROXY;
Willy Tarreau1ec74bf2013-10-24 21:45:00 +0200551
Willy Tarreauf79c8172013-10-21 16:30:56 +0200552 conn_ctrl_init(conn); /* registers the FD */
Willy Tarreauad38ace2013-12-15 14:19:38 +0100553 fdtab[fd].linger_risk = 1; /* close hard if needed */
Willy Tarreau986a9d22012-08-30 21:11:38 +0200554 conn_sock_want_send(conn); /* for connect status */
Willy Tarreau15678ef2012-08-31 13:54:11 +0200555
Willy Tarreauf7bc57c2012-10-03 00:19:48 +0200556 if (conn_xprt_init(conn) < 0) {
Willy Tarreauf79c8172013-10-21 16:30:56 +0200557 conn_force_close(conn);
Willy Tarreau9ce70132014-01-24 16:08:19 +0100558 conn->flags |= CO_FL_ERROR;
Willy Tarreaue7dff022015-04-03 01:14:29 +0200559 return SF_ERR_RESOURCE;
Willy Tarreau184636e2012-09-06 14:04:41 +0200560 }
Willy Tarreau15678ef2012-08-31 13:54:11 +0200561
Willy Tarreau14f8e862012-08-30 22:23:13 +0200562 if (data)
Willy Tarreau986a9d22012-08-30 21:11:38 +0200563 conn_data_want_send(conn); /* prepare to send data if any */
Willy Tarreau9650f372009-08-16 14:02:45 +0200564
Willy Tarreaue7dff022015-04-03 01:14:29 +0200565 return SF_ERR_NONE; /* connection is OK */
Willy Tarreau9650f372009-08-16 14:02:45 +0200566}
567
568
Willy Tarreau59b94792012-05-11 16:16:40 +0200569/*
570 * Retrieves the source address for the socket <fd>, with <dir> indicating
571 * if we're a listener (=0) or an initiator (!=0). It returns 0 in case of
572 * success, -1 in case of error. The socket's source address is stored in
573 * <sa> for <salen> bytes.
574 */
575int tcp_get_src(int fd, struct sockaddr *sa, socklen_t salen, int dir)
576{
577 if (dir)
578 return getsockname(fd, sa, &salen);
579 else
580 return getpeername(fd, sa, &salen);
581}
582
583
584/*
585 * Retrieves the original destination address for the socket <fd>, with <dir>
586 * indicating if we're a listener (=0) or an initiator (!=0). In the case of a
587 * listener, if the original destination address was translated, the original
588 * address is retrieved. It returns 0 in case of success, -1 in case of error.
589 * The socket's source address is stored in <sa> for <salen> bytes.
590 */
591int tcp_get_dst(int fd, struct sockaddr *sa, socklen_t salen, int dir)
592{
593 if (dir)
594 return getpeername(fd, sa, &salen);
Willy Tarreau5e0d0e02014-10-29 21:46:01 +0100595 else {
596 int ret = getsockname(fd, sa, &salen);
597
598 if (ret < 0)
599 return ret;
600
Willy Tarreau59b94792012-05-11 16:16:40 +0200601#if defined(TPROXY) && defined(SO_ORIGINAL_DST)
Willy Tarreau5e0d0e02014-10-29 21:46:01 +0100602 /* For TPROXY and Netfilter's NAT, we can retrieve the original
603 * IPv4 address before DNAT/REDIRECT. We must not do that with
604 * other families because v6-mapped IPv4 addresses are still
605 * reported as v4.
606 */
607 if (((struct sockaddr_storage *)sa)->ss_family == AF_INET
608 && getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) == 0)
609 return 0;
Willy Tarreau59b94792012-05-11 16:16:40 +0200610#endif
Willy Tarreau5e0d0e02014-10-29 21:46:01 +0100611 return ret;
612 }
Willy Tarreau59b94792012-05-11 16:16:40 +0200613}
614
Willy Tarreau2b57cb82013-06-10 19:56:38 +0200615/* Tries to drain any pending incoming data from the socket to reach the
Willy Tarreau7f4bcc32014-01-20 11:26:12 +0100616 * receive shutdown. Returns positive if the shutdown was found, negative
617 * if EAGAIN was hit, otherwise zero. This is useful to decide whether we
618 * can close a connection cleanly are we must kill it hard.
Willy Tarreau2b57cb82013-06-10 19:56:38 +0200619 */
620int tcp_drain(int fd)
621{
622 int turns = 2;
623 int len;
624
625 while (turns) {
626#ifdef MSG_TRUNC_CLEARS_INPUT
627 len = recv(fd, NULL, INT_MAX, MSG_DONTWAIT | MSG_NOSIGNAL | MSG_TRUNC);
628 if (len == -1 && errno == EFAULT)
629#endif
630 len = recv(fd, trash.str, trash.size, MSG_DONTWAIT | MSG_NOSIGNAL);
631
Willy Tarreau3bd3e572014-01-20 11:56:37 +0100632 if (len == 0) {
633 /* cool, shutdown received */
634 fdtab[fd].linger_risk = 0;
Willy Tarreau2b57cb82013-06-10 19:56:38 +0200635 return 1;
Willy Tarreau3bd3e572014-01-20 11:56:37 +0100636 }
Willy Tarreau2b57cb82013-06-10 19:56:38 +0200637
638 if (len < 0) {
Willy Tarreauf817e9f2014-01-10 16:58:45 +0100639 if (errno == EAGAIN) {
640 /* connection not closed yet */
641 fd_cant_recv(fd);
Willy Tarreau7f4bcc32014-01-20 11:26:12 +0100642 return -1;
Willy Tarreauf817e9f2014-01-10 16:58:45 +0100643 }
Willy Tarreau2b57cb82013-06-10 19:56:38 +0200644 if (errno == EINTR) /* oops, try again */
645 continue;
646 /* other errors indicate a dead connection, fine. */
Willy Tarreau3bd3e572014-01-20 11:56:37 +0100647 fdtab[fd].linger_risk = 0;
Willy Tarreau2b57cb82013-06-10 19:56:38 +0200648 return 1;
649 }
650 /* OK we read some data, let's try again once */
651 turns--;
652 }
653 /* some data are still present, give up */
654 return 0;
655}
656
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200657/* This is the callback which is set when a connection establishment is pending
Willy Tarreauf12a20e2013-12-04 16:11:04 +0100658 * and we have nothing to send. It updates the FD polling status. It returns 0
659 * if it fails in a fatal way or needs to poll to go further, otherwise it
660 * returns non-zero and removes the CO_FL_WAIT_L4_CONN flag from the connection's
661 * flags. In case of error, it sets CO_FL_ERROR and leaves the error code in
662 * errno. The error checking is done in two passes in order to limit the number
663 * of syscalls in the normal case :
664 * - if POLL_ERR was reported by the poller, we check for a pending error on
665 * the socket before proceeding. If found, it's assigned to errno so that
666 * upper layers can see it.
667 * - otherwise connect() is used to check the connection state again, since
668 * the getsockopt return cannot reliably be used to know if the connection
669 * is still pending or ready. This one may often return an error as well,
670 * since we don't always have POLL_ERR (eg: OSX or cached events).
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200671 */
Willy Tarreau239d7182012-07-23 18:53:03 +0200672int tcp_connect_probe(struct connection *conn)
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200673{
Willy Tarreau239d7182012-07-23 18:53:03 +0200674 int fd = conn->t.sock.fd;
Willy Tarreauf12a20e2013-12-04 16:11:04 +0100675 socklen_t lskerr;
676 int skerr;
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200677
Willy Tarreau80184712012-07-06 14:54:49 +0200678 if (conn->flags & CO_FL_ERROR)
Willy Tarreauafad0e02012-08-09 14:45:22 +0200679 return 0;
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200680
Willy Tarreau3c728722014-01-23 13:50:42 +0100681 if (!conn_ctrl_ready(conn))
Willy Tarreauf79c8172013-10-21 16:30:56 +0200682 return 0;
683
Willy Tarreau80184712012-07-06 14:54:49 +0200684 if (!(conn->flags & CO_FL_WAIT_L4_CONN))
Willy Tarreau0b0c0972012-07-23 20:05:00 +0200685 return 1; /* strange we were called while ready */
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200686
Willy Tarreaufd803bb2014-01-20 15:13:07 +0100687 if (!fd_send_ready(fd))
688 return 0;
689
Willy Tarreauf12a20e2013-12-04 16:11:04 +0100690 /* we might be the first witness of FD_POLL_ERR. Note that FD_POLL_HUP
691 * without FD_POLL_IN also indicates a hangup without input data meaning
692 * there was no connection.
693 */
694 if (fdtab[fd].ev & FD_POLL_ERR ||
695 (fdtab[fd].ev & (FD_POLL_IN|FD_POLL_HUP)) == FD_POLL_HUP) {
696 skerr = 0;
697 lskerr = sizeof(skerr);
698 getsockopt(fd, SOL_SOCKET, SO_ERROR, &skerr, &lskerr);
699 errno = skerr;
700 if (errno == EAGAIN)
701 errno = 0;
702 if (errno)
703 goto out_error;
704 }
Willy Tarreau2da156f2012-07-23 15:07:23 +0200705
Willy Tarreauf12a20e2013-12-04 16:11:04 +0100706 /* Use connect() to check the state of the socket. This has the
707 * advantage of giving us the following info :
Willy Tarreau2c6be842012-07-06 17:12:34 +0200708 * - error
709 * - connecting (EALREADY, EINPROGRESS)
710 * - connected (EISCONN, 0)
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200711 */
Willy Tarreau986a9d22012-08-30 21:11:38 +0200712 if (connect(fd, (struct sockaddr *)&conn->addr.to, get_addr_len(&conn->addr.to)) < 0) {
Willy Tarreauf9dabec2012-08-17 17:33:53 +0200713 if (errno == EALREADY || errno == EINPROGRESS) {
Willy Tarreaud486ef52012-12-10 17:03:52 +0100714 __conn_sock_stop_recv(conn);
Willy Tarreaue1f50c42014-01-22 20:02:06 +0100715 fd_cant_send(fd);
Willy Tarreau0b0c0972012-07-23 20:05:00 +0200716 return 0;
Willy Tarreauf9dabec2012-08-17 17:33:53 +0200717 }
Willy Tarreaua190d592012-05-20 18:35:19 +0200718
Willy Tarreau2c6be842012-07-06 17:12:34 +0200719 if (errno && errno != EISCONN)
Willy Tarreaua190d592012-05-20 18:35:19 +0200720 goto out_error;
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200721
Willy Tarreau2c6be842012-07-06 17:12:34 +0200722 /* otherwise we're connected */
Willy Tarreaua190d592012-05-20 18:35:19 +0200723 }
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200724
Willy Tarreau076be252012-07-06 16:02:29 +0200725 /* The FD is ready now, we'll mark the connection as complete and
Willy Tarreauf7bc57c2012-10-03 00:19:48 +0200726 * forward the event to the transport layer which will notify the
727 * data layer.
Willy Tarreaua190d592012-05-20 18:35:19 +0200728 */
Willy Tarreau80184712012-07-06 14:54:49 +0200729 conn->flags &= ~CO_FL_WAIT_L4_CONN;
Willy Tarreau0b0c0972012-07-23 20:05:00 +0200730 return 1;
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200731
732 out_error:
Willy Tarreau0b0c0972012-07-23 20:05:00 +0200733 /* Write error on the file descriptor. Report it to the connection
734 * and disable polling on this FD.
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200735 */
Willy Tarreau3bd3e572014-01-20 11:56:37 +0100736 fdtab[fd].linger_risk = 0;
Willy Tarreau26f4a042013-12-04 23:44:10 +0100737 conn->flags |= CO_FL_ERROR | CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH;
Willy Tarreaud486ef52012-12-10 17:03:52 +0100738 __conn_sock_stop_both(conn);
Willy Tarreauafad0e02012-08-09 14:45:22 +0200739 return 0;
Willy Tarreaueeda90e2012-05-11 19:53:32 +0200740}
741
Willy Tarreau59b94792012-05-11 16:16:40 +0200742
Willy Tarreaue6b98942007-10-29 01:09:36 +0100743/* This function tries to bind a TCPv4/v6 listener. It may return a warning or
Willy Tarreau8ab505b2013-01-24 01:41:38 +0100744 * an error message in <errmsg> if the message is at most <errlen> bytes long
745 * (including '\0'). Note that <errmsg> may be NULL if <errlen> is also zero.
746 * The return value is composed from ERR_ABORT, ERR_WARN,
Willy Tarreaue6b98942007-10-29 01:09:36 +0100747 * ERR_ALERT, ERR_RETRYABLE and ERR_FATAL. ERR_NONE indicates that everything
748 * was alright and that no message was returned. ERR_RETRYABLE means that an
749 * error occurred but that it may vanish after a retry (eg: port in use), and
Aman Guptad94991d2012-04-06 17:39:26 -0700750 * ERR_FATAL indicates a non-fixable error. ERR_WARN and ERR_ALERT do not alter
Willy Tarreaue6b98942007-10-29 01:09:36 +0100751 * the meaning of the error, but just indicate that a message is present which
752 * should be displayed with the respective level. Last, ERR_ABORT indicates
753 * that it's pointless to try to start other listeners. No error message is
754 * returned if errlen is NULL.
755 */
756int tcp_bind_listener(struct listener *listener, char *errmsg, int errlen)
757{
758 __label__ tcp_return, tcp_close_return;
759 int fd, err;
Willy Tarreau40aa0702013-03-10 23:51:38 +0100760 int ext, ready;
761 socklen_t ready_len;
Willy Tarreaue6b98942007-10-29 01:09:36 +0100762 const char *msg = NULL;
763
764 /* ensure we never return garbage */
Willy Tarreau8ab505b2013-01-24 01:41:38 +0100765 if (errlen)
Willy Tarreaue6b98942007-10-29 01:09:36 +0100766 *errmsg = 0;
767
768 if (listener->state != LI_ASSIGNED)
769 return ERR_NONE; /* already bound */
770
771 err = ERR_NONE;
772
Willy Tarreau40aa0702013-03-10 23:51:38 +0100773 /* if the listener already has an fd assigned, then we were offered the
774 * fd by an external process (most likely the parent), and we don't want
775 * to create a new socket. However we still want to set a few flags on
776 * the socket.
777 */
778 fd = listener->fd;
779 ext = (fd >= 0);
780
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100781 if (!ext) {
782 fd = my_socketat(listener->netns, listener->addr.ss_family, SOCK_STREAM, IPPROTO_TCP);
783
784 if (fd == -1) {
785 err |= ERR_RETRYABLE | ERR_ALERT;
786 msg = "cannot create listening socket";
787 goto tcp_return;
788 }
Willy Tarreaue6b98942007-10-29 01:09:36 +0100789 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100790
Willy Tarreaue6b98942007-10-29 01:09:36 +0100791 if (fd >= global.maxsock) {
792 err |= ERR_FATAL | ERR_ABORT | ERR_ALERT;
793 msg = "not enough free sockets (raise '-n' parameter)";
794 goto tcp_close_return;
795 }
796
Willy Tarreaufb14edc2009-06-14 15:24:37 +0200797 if (fcntl(fd, F_SETFL, O_NONBLOCK) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100798 err |= ERR_FATAL | ERR_ALERT;
799 msg = "cannot make socket non-blocking";
800 goto tcp_close_return;
801 }
802
Willy Tarreau40aa0702013-03-10 23:51:38 +0100803 if (!ext && setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100804 /* not fatal but should be reported */
805 msg = "cannot do so_reuseaddr";
806 err |= ERR_ALERT;
807 }
808
809 if (listener->options & LI_O_NOLINGER)
Simon Hormande072bd2011-06-24 15:11:37 +0900810 setsockopt(fd, SOL_SOCKET, SO_LINGER, &nolinger, sizeof(struct linger));
Willy Tarreauedcf6682008-11-30 23:15:34 +0100811
Willy Tarreaue6b98942007-10-29 01:09:36 +0100812#ifdef SO_REUSEPORT
813 /* OpenBSD supports this. As it's present in old libc versions of Linux,
814 * it might return an error that we will silently ignore.
815 */
Willy Tarreau40aa0702013-03-10 23:51:38 +0100816 if (!ext)
817 setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &one, sizeof(one));
Willy Tarreaue6b98942007-10-29 01:09:36 +0100818#endif
Pieter Baauwd551fb52013-05-08 22:49:23 +0200819
Willy Tarreau40aa0702013-03-10 23:51:38 +0100820 if (!ext && (listener->options & LI_O_FOREIGN)) {
David du Colombier65c17962012-07-13 14:34:59 +0200821 switch (listener->addr.ss_family) {
822 case AF_INET:
Pieter Baauwd551fb52013-05-08 22:49:23 +0200823 if (1
824#if defined(IP_TRANSPARENT)
825 && (setsockopt(fd, SOL_IP, IP_TRANSPARENT, &one, sizeof(one)) == -1)
826#endif
827#if defined(IP_FREEBIND)
828 && (setsockopt(fd, SOL_IP, IP_FREEBIND, &one, sizeof(one)) == -1)
829#endif
Pieter Baauwff30b662013-05-08 23:22:39 +0200830#if defined(IP_BINDANY)
831 && (setsockopt(fd, IPPROTO_IP, IP_BINDANY, &one, sizeof(one)) == -1)
832#endif
Pieter Baauw1eb75922013-05-08 23:30:23 +0200833#if defined(SO_BINDANY)
834 && (setsockopt(fd, SOL_SOCKET, SO_BINDANY, &one, sizeof(one)) == -1)
835#endif
Pieter Baauwd551fb52013-05-08 22:49:23 +0200836 ) {
David du Colombier65c17962012-07-13 14:34:59 +0200837 msg = "cannot make listening socket transparent";
838 err |= ERR_ALERT;
839 }
840 break;
841 case AF_INET6:
Pieter Baauwd551fb52013-05-08 22:49:23 +0200842 if (1
843#if defined(IPV6_TRANSPARENT)
844 && (setsockopt(fd, SOL_IPV6, IPV6_TRANSPARENT, &one, sizeof(one)) == -1)
845#endif
Lukas Tribus7640e722014-03-03 21:10:51 +0100846#if defined(IP_FREEBIND)
847 && (setsockopt(fd, SOL_IP, IP_FREEBIND, &one, sizeof(one)) == -1)
848#endif
Pieter Baauwff30b662013-05-08 23:22:39 +0200849#if defined(IPV6_BINDANY)
850 && (setsockopt(fd, IPPROTO_IPV6, IPV6_BINDANY, &one, sizeof(one)) == -1)
851#endif
Pieter Baauw1eb75922013-05-08 23:30:23 +0200852#if defined(SO_BINDANY)
853 && (setsockopt(fd, SOL_SOCKET, SO_BINDANY, &one, sizeof(one)) == -1)
854#endif
Pieter Baauwd551fb52013-05-08 22:49:23 +0200855 ) {
David du Colombier65c17962012-07-13 14:34:59 +0200856 msg = "cannot make listening socket transparent";
857 err |= ERR_ALERT;
858 }
859 break;
860 }
Willy Tarreaub1e52e82008-01-13 14:49:51 +0100861 }
Pieter Baauwd551fb52013-05-08 22:49:23 +0200862
Willy Tarreau5e6e2042009-02-04 17:19:29 +0100863#ifdef SO_BINDTODEVICE
864 /* Note: this might fail if not CAP_NET_RAW */
Willy Tarreau40aa0702013-03-10 23:51:38 +0100865 if (!ext && listener->interface) {
Willy Tarreau5e6e2042009-02-04 17:19:29 +0100866 if (setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE,
Willy Tarreau604e8302009-03-06 00:48:23 +0100867 listener->interface, strlen(listener->interface) + 1) == -1) {
Willy Tarreau5e6e2042009-02-04 17:19:29 +0100868 msg = "cannot bind listener to device";
869 err |= ERR_WARN;
870 }
871 }
872#endif
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400873#if defined(TCP_MAXSEG)
Willy Tarreau48a7e722010-12-24 15:26:39 +0100874 if (listener->maxseg > 0) {
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400875 if (setsockopt(fd, IPPROTO_TCP, TCP_MAXSEG,
Willy Tarreaube1b9182009-06-14 18:48:19 +0200876 &listener->maxseg, sizeof(listener->maxseg)) == -1) {
877 msg = "cannot set MSS";
878 err |= ERR_WARN;
879 }
880 }
881#endif
Willy Tarreau2af207a2015-02-04 00:45:58 +0100882#if defined(TCP_USER_TIMEOUT)
883 if (listener->tcp_ut) {
884 if (setsockopt(fd, IPPROTO_TCP, TCP_USER_TIMEOUT,
885 &listener->tcp_ut, sizeof(listener->tcp_ut)) == -1) {
886 msg = "cannot set TCP User Timeout";
887 err |= ERR_WARN;
888 }
889 }
890#endif
Willy Tarreaucb6cd432009-10-13 07:34:14 +0200891#if defined(TCP_DEFER_ACCEPT)
892 if (listener->options & LI_O_DEF_ACCEPT) {
893 /* defer accept by up to one second */
894 int accept_delay = 1;
895 if (setsockopt(fd, IPPROTO_TCP, TCP_DEFER_ACCEPT, &accept_delay, sizeof(accept_delay)) == -1) {
896 msg = "cannot enable DEFER_ACCEPT";
897 err |= ERR_WARN;
898 }
899 }
900#endif
Willy Tarreau1c862c52012-10-05 16:21:00 +0200901#if defined(TCP_FASTOPEN)
902 if (listener->options & LI_O_TCP_FO) {
903 /* TFO needs a queue length, let's use the configured backlog */
904 int qlen = listener->backlog ? listener->backlog : listener->maxconn;
905 if (setsockopt(fd, IPPROTO_TCP, TCP_FASTOPEN, &qlen, sizeof(qlen)) == -1) {
906 msg = "cannot enable TCP_FASTOPEN";
907 err |= ERR_WARN;
908 }
909 }
910#endif
Willy Tarreau9b6700f2012-11-24 11:55:28 +0100911#if defined(IPV6_V6ONLY)
912 if (listener->options & LI_O_V6ONLY)
913 setsockopt(fd, IPPROTO_IPV6, IPV6_V6ONLY, &one, sizeof(one));
Willy Tarreau77e3af92012-11-24 15:07:23 +0100914 else if (listener->options & LI_O_V4V6)
915 setsockopt(fd, IPPROTO_IPV6, IPV6_V6ONLY, &zero, sizeof(zero));
Willy Tarreau9b6700f2012-11-24 11:55:28 +0100916#endif
917
Willy Tarreau40aa0702013-03-10 23:51:38 +0100918 if (!ext && bind(fd, (struct sockaddr *)&listener->addr, listener->proto->sock_addrlen) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100919 err |= ERR_RETRYABLE | ERR_ALERT;
920 msg = "cannot bind socket";
921 goto tcp_close_return;
922 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100923
Willy Tarreau40aa0702013-03-10 23:51:38 +0100924 ready = 0;
925 ready_len = sizeof(ready);
926 if (getsockopt(fd, SOL_SOCKET, SO_ACCEPTCONN, &ready, &ready_len) == -1)
927 ready = 0;
928
929 if (!(ext && ready) && /* only listen if not already done by external process */
930 listen(fd, listener->backlog ? listener->backlog : listener->maxconn) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100931 err |= ERR_RETRYABLE | ERR_ALERT;
932 msg = "cannot listen to socket";
933 goto tcp_close_return;
934 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100935
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400936#if defined(TCP_QUICKACK)
Willy Tarreau9ea05a72009-06-14 12:07:01 +0200937 if (listener->options & LI_O_NOQUICKACK)
Simon Hormande072bd2011-06-24 15:11:37 +0900938 setsockopt(fd, IPPROTO_TCP, TCP_QUICKACK, &zero, sizeof(zero));
Willy Tarreau9ea05a72009-06-14 12:07:01 +0200939#endif
940
Willy Tarreaue6b98942007-10-29 01:09:36 +0100941 /* the socket is ready */
942 listener->fd = fd;
943 listener->state = LI_LISTEN;
944
Willy Tarreaueabf3132008-08-29 23:36:51 +0200945 fdtab[fd].owner = listener; /* reference the listener instead of a task */
Willy Tarreauaece46a2012-07-06 12:25:58 +0200946 fdtab[fd].iocb = listener->proto->accept;
Willy Tarreaueb472682010-05-28 18:46:57 +0200947 fd_insert(fd);
948
Willy Tarreaue6b98942007-10-29 01:09:36 +0100949 tcp_return:
Cyril Bonté43ba1b32010-11-01 19:26:01 +0100950 if (msg && errlen) {
951 char pn[INET6_ADDRSTRLEN];
952
Willy Tarreau631f01c2011-09-05 00:36:48 +0200953 addr_to_str(&listener->addr, pn, sizeof(pn));
954 snprintf(errmsg, errlen, "%s [%s:%d]", msg, pn, get_host_port(&listener->addr));
Cyril Bonté43ba1b32010-11-01 19:26:01 +0100955 }
Willy Tarreaue6b98942007-10-29 01:09:36 +0100956 return err;
957
958 tcp_close_return:
959 close(fd);
960 goto tcp_return;
961}
962
963/* This function creates all TCP sockets bound to the protocol entry <proto>.
964 * It is intended to be used as the protocol's bind_all() function.
965 * The sockets will be registered but not added to any fd_set, in order not to
966 * loose them across the fork(). A call to enable_all_listeners() is needed
967 * to complete initialization. The return value is composed from ERR_*.
968 */
Emeric Bruncf20bf12010-10-22 16:06:11 +0200969static int tcp_bind_listeners(struct protocol *proto, char *errmsg, int errlen)
Willy Tarreaue6b98942007-10-29 01:09:36 +0100970{
971 struct listener *listener;
972 int err = ERR_NONE;
973
974 list_for_each_entry(listener, &proto->listeners, proto_list) {
Emeric Bruncf20bf12010-10-22 16:06:11 +0200975 err |= tcp_bind_listener(listener, errmsg, errlen);
976 if (err & ERR_ABORT)
Willy Tarreaue6b98942007-10-29 01:09:36 +0100977 break;
978 }
979
980 return err;
981}
982
983/* Add listener to the list of tcpv4 listeners. The listener's state
984 * is automatically updated from LI_INIT to LI_ASSIGNED. The number of
985 * listeners is updated. This is the function to use to add a new listener.
986 */
987void tcpv4_add_listener(struct listener *listener)
988{
989 if (listener->state != LI_INIT)
990 return;
991 listener->state = LI_ASSIGNED;
992 listener->proto = &proto_tcpv4;
993 LIST_ADDQ(&proto_tcpv4.listeners, &listener->proto_list);
994 proto_tcpv4.nb_listeners++;
995}
996
997/* Add listener to the list of tcpv4 listeners. The listener's state
998 * is automatically updated from LI_INIT to LI_ASSIGNED. The number of
999 * listeners is updated. This is the function to use to add a new listener.
1000 */
1001void tcpv6_add_listener(struct listener *listener)
1002{
1003 if (listener->state != LI_INIT)
1004 return;
1005 listener->state = LI_ASSIGNED;
1006 listener->proto = &proto_tcpv6;
1007 LIST_ADDQ(&proto_tcpv6.listeners, &listener->proto_list);
1008 proto_tcpv6.nb_listeners++;
1009}
1010
Willy Tarreau092d8652014-07-07 20:22:12 +02001011/* Pause a listener. Returns < 0 in case of failure, 0 if the listener
1012 * was totally stopped, or > 0 if correctly paused.
1013 */
1014int tcp_pause_listener(struct listener *l)
1015{
1016 if (shutdown(l->fd, SHUT_WR) != 0)
1017 return -1; /* Solaris dies here */
1018
1019 if (listen(l->fd, l->backlog ? l->backlog : l->maxconn) != 0)
1020 return -1; /* OpenBSD dies here */
1021
1022 if (shutdown(l->fd, SHUT_RD) != 0)
1023 return -1; /* should always be OK */
1024 return 1;
1025}
1026
Willy Tarreauedcf6682008-11-30 23:15:34 +01001027/* This function performs the TCP request analysis on the current request. It
1028 * returns 1 if the processing can continue on next analysers, or zero if it
1029 * needs more data, encounters an error, or wants to immediately abort the
Willy Tarreaufb356202010-08-03 14:02:05 +02001030 * request. It relies on buffers flags, and updates s->req->analysers. The
1031 * function may be called for frontend rules and backend rules. It only relies
1032 * on the backend pointer so this works for both cases.
Willy Tarreauedcf6682008-11-30 23:15:34 +01001033 */
Willy Tarreau87b09662015-04-03 00:22:06 +02001034int tcp_inspect_request(struct stream *s, struct channel *req, int an_bit)
Willy Tarreauedcf6682008-11-30 23:15:34 +01001035{
Willy Tarreaufb0afa72015-04-03 14:46:27 +02001036 struct session *sess = s->sess;
Thierry FOURNIERa28a9422015-08-04 19:35:46 +02001037 struct act_rule *rule;
Willy Tarreaud1f96522010-08-03 19:34:32 +02001038 struct stksess *ts;
1039 struct stktable *t;
Willy Tarreauedcf6682008-11-30 23:15:34 +01001040 int partial;
1041
Willy Tarreau87b09662015-04-03 00:22:06 +02001042 DPRINTF(stderr,"[%u] %s: stream=%p b=%p, exp(r,w)=%u,%u bf=%08x bh=%d analysers=%02x\n",
Willy Tarreauedcf6682008-11-30 23:15:34 +01001043 now_ms, __FUNCTION__,
1044 s,
1045 req,
1046 req->rex, req->wex,
1047 req->flags,
Willy Tarreau9b28e032012-10-12 23:49:43 +02001048 req->buf->i,
Willy Tarreauedcf6682008-11-30 23:15:34 +01001049 req->analysers);
1050
Willy Tarreauedcf6682008-11-30 23:15:34 +01001051 /* We don't know whether we have enough data, so must proceed
1052 * this way :
1053 * - iterate through all rules in their declaration order
1054 * - if one rule returns MISS, it means the inspect delay is
1055 * not over yet, then return immediately, otherwise consider
1056 * it as a non-match.
1057 * - if one rule returns OK, then return OK
1058 * - if one rule returns KO, then return KO
1059 */
1060
Willy Tarreau9b28e032012-10-12 23:49:43 +02001061 if ((req->flags & CF_SHUTR) || buffer_full(req->buf, global.tune.maxrewrite) ||
Willy Tarreau3bf1b2b2012-08-27 20:46:07 +02001062 !s->be->tcp_req.inspect_delay || tick_is_expired(req->analyse_exp, now_ms))
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001063 partial = SMP_OPT_FINAL;
Willy Tarreauedcf6682008-11-30 23:15:34 +01001064 else
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001065 partial = 0;
Willy Tarreauedcf6682008-11-30 23:15:34 +01001066
Thierry FOURNIERbc4c1ac2015-02-25 13:36:14 +01001067 /* If "the current_rule_list" match the executed rule list, we are in
1068 * resume condition. If a resume is needed it is always in the action
1069 * and never in the ACL or converters. In this case, we initialise the
1070 * current rule, and go to the action execution point.
1071 */
Willy Tarreau152b81e2015-04-20 13:26:17 +02001072 if (s->current_rule) {
1073 rule = s->current_rule;
1074 s->current_rule = NULL;
1075 if (s->current_rule_list == &s->be->tcp_req.inspect_rules)
1076 goto resume_execution;
Thierry FOURNIERbc4c1ac2015-02-25 13:36:14 +01001077 }
1078 s->current_rule_list = &s->be->tcp_req.inspect_rules;
Willy Tarreau152b81e2015-04-20 13:26:17 +02001079
Willy Tarreaufb356202010-08-03 14:02:05 +02001080 list_for_each_entry(rule, &s->be->tcp_req.inspect_rules, list) {
Willy Tarreau0cba6072013-11-28 22:21:02 +01001081 enum acl_test_res ret = ACL_TEST_PASS;
Willy Tarreauedcf6682008-11-30 23:15:34 +01001082
1083 if (rule->cond) {
Willy Tarreau192252e2015-04-04 01:47:55 +02001084 ret = acl_exec_cond(rule->cond, s->be, sess, s, SMP_OPT_DIR_REQ | partial);
Willy Tarreau18bf01e2014-06-13 16:18:52 +02001085 if (ret == ACL_TEST_MISS)
1086 goto missing_data;
Willy Tarreauedcf6682008-11-30 23:15:34 +01001087
1088 ret = acl_pass(ret);
1089 if (rule->cond->pol == ACL_COND_UNLESS)
1090 ret = !ret;
1091 }
1092
1093 if (ret) {
Thierry FOURNIERbc4c1ac2015-02-25 13:36:14 +01001094resume_execution:
Willy Tarreauedcf6682008-11-30 23:15:34 +01001095 /* we have a matching rule. */
Thierry FOURNIER0ea5c7f2015-08-05 19:05:19 +02001096 if (rule->action == ACT_ACTION_ALLOW) {
Willy Tarreau27f78242015-07-04 11:36:30 +02001097 break;
1098 }
Thierry FOURNIER0ea5c7f2015-08-05 19:05:19 +02001099 else if (rule->action == ACT_ACTION_DENY) {
Willy Tarreau8263d2b2012-08-28 00:06:31 +02001100 channel_abort(req);
Willy Tarreau22ec1ea2014-11-27 20:45:39 +01001101 channel_abort(&s->res);
Willy Tarreauedcf6682008-11-30 23:15:34 +01001102 req->analysers = 0;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +02001103
Willy Tarreau7d0aaf32011-03-10 23:25:56 +01001104 s->be->be_counters.denied_req++;
Willy Tarreaue36cbcb2015-04-03 15:40:56 +02001105 sess->fe->fe_counters.denied_req++;
Willy Tarreaufb0afa72015-04-03 14:46:27 +02001106 if (sess->listener->counters)
1107 sess->listener->counters->denied_req++;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +02001108
Willy Tarreaue7dff022015-04-03 01:14:29 +02001109 if (!(s->flags & SF_ERR_MASK))
1110 s->flags |= SF_ERR_PRXCOND;
1111 if (!(s->flags & SF_FINST_MASK))
1112 s->flags |= SF_FINST_R;
Willy Tarreauedcf6682008-11-30 23:15:34 +01001113 return 0;
1114 }
Thierry FOURNIER0ea5c7f2015-08-05 19:05:19 +02001115 else if (rule->action >= ACT_ACTION_TRK_SC0 && rule->action <= ACT_ACTION_TRK_SCMAX) {
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001116 /* Note: only the first valid tracking parameter of each
1117 * applies.
1118 */
1119 struct stktable_key *key;
Willy Tarreau1b71eb52014-06-25 17:01:56 +02001120 struct sample smp;
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001121
Willy Tarreaucc08d2c2014-01-28 23:18:23 +01001122 if (stkctr_entry(&s->stkctr[tcp_trk_idx(rule->action)]))
Willy Tarreau44778ad2013-10-30 19:24:00 +01001123 continue;
1124
Thierry FOURNIER5ec63e02015-08-04 09:09:48 +02001125 t = rule->arg.trk_ctr.table.t;
1126 key = stktable_fetch_key(t, s->be, sess, s, SMP_OPT_DIR_REQ | partial, rule->arg.trk_ctr.expr, &smp);
Willy Tarreau1b71eb52014-06-25 17:01:56 +02001127
Willy Tarreau6bcb0a82014-07-30 08:56:35 +02001128 if ((smp.flags & SMP_F_MAY_CHANGE) && !(partial & SMP_OPT_FINAL))
1129 goto missing_data; /* key might appear later */
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001130
1131 if (key && (ts = stktable_get_entry(t, key))) {
Willy Tarreau87b09662015-04-03 00:22:06 +02001132 stream_track_stkctr(&s->stkctr[tcp_trk_idx(rule->action)], t, ts);
Willy Tarreaucc08d2c2014-01-28 23:18:23 +01001133 stkctr_set_flags(&s->stkctr[tcp_trk_idx(rule->action)], STKCTR_TRACK_CONTENT);
Willy Tarreaue36cbcb2015-04-03 15:40:56 +02001134 if (sess->fe != s->be)
Willy Tarreaucc08d2c2014-01-28 23:18:23 +01001135 stkctr_set_flags(&s->stkctr[tcp_trk_idx(rule->action)], STKCTR_TRACK_BACKEND);
Willy Tarreaud1f96522010-08-03 19:34:32 +02001136 }
1137 }
Thierry FOURNIER0ea5c7f2015-08-05 19:05:19 +02001138 else if (rule->action == ACT_TCP_CAPTURE) {
Willy Tarreau18bf01e2014-06-13 16:18:52 +02001139 struct sample *key;
Thierry FOURNIERd0d65ae2015-08-04 08:21:12 +02001140 struct cap_hdr *h = rule->arg.cap.hdr;
Willy Tarreaucb7dd012015-04-03 22:16:32 +02001141 char **cap = s->req_cap;
Willy Tarreau18bf01e2014-06-13 16:18:52 +02001142 int len;
1143
Thierry FOURNIERd0d65ae2015-08-04 08:21:12 +02001144 key = sample_fetch_as_type(s->be, sess, s, SMP_OPT_DIR_REQ | partial, rule->arg.cap.expr, SMP_T_STR);
Willy Tarreau18bf01e2014-06-13 16:18:52 +02001145 if (!key)
1146 continue;
1147
1148 if (key->flags & SMP_F_MAY_CHANGE)
1149 goto missing_data;
1150
1151 if (cap[h->index] == NULL)
1152 cap[h->index] = pool_alloc2(h->pool);
1153
1154 if (cap[h->index] == NULL) /* no more capture memory */
1155 continue;
1156
Thierry FOURNIER136f9d32015-08-19 09:07:19 +02001157 len = key->data.u.str.len;
Willy Tarreau18bf01e2014-06-13 16:18:52 +02001158 if (len > h->len)
1159 len = h->len;
1160
Thierry FOURNIER136f9d32015-08-19 09:07:19 +02001161 memcpy(cap[h->index], key->data.u.str.str, len);
Willy Tarreau18bf01e2014-06-13 16:18:52 +02001162 cap[h->index][len] = 0;
1163 }
Willy Tarreaud1f96522010-08-03 19:34:32 +02001164 else {
Thierry FOURNIERcc87a112014-12-12 19:41:33 +01001165 /* Custom keywords. */
Thierry FOURNIER42148732015-09-02 17:17:33 +02001166 if (!rule->action_ptr)
1167 continue;
1168 switch (rule->action_ptr(rule, s->be, s->sess, s)) {
1169 case ACT_RET_ERR:
1170 case ACT_RET_CONT:
1171 continue;
1172 case ACT_RET_STOP:
Thierry FOURNIER561a0f92015-05-29 17:29:14 +02001173 break;
Thierry FOURNIER42148732015-09-02 17:17:33 +02001174 case ACT_RET_YIELD:
1175 s->current_rule = rule;
1176 goto missing_data;
1177 }
1178 break; /* ACT_RET_STOP */
Willy Tarreaud1f96522010-08-03 19:34:32 +02001179 }
Willy Tarreauedcf6682008-11-30 23:15:34 +01001180 }
1181 }
1182
1183 /* if we get there, it means we have no rule which matches, or
1184 * we have an explicit accept, so we apply the default accept.
1185 */
Willy Tarreau3a816292009-07-07 10:55:49 +02001186 req->analysers &= ~an_bit;
Willy Tarreauedcf6682008-11-30 23:15:34 +01001187 req->analyse_exp = TICK_ETERNITY;
1188 return 1;
Willy Tarreau18bf01e2014-06-13 16:18:52 +02001189
1190 missing_data:
1191 channel_dont_connect(req);
1192 /* just set the request timeout once at the beginning of the request */
1193 if (!tick_isset(req->analyse_exp) && s->be->tcp_req.inspect_delay)
1194 req->analyse_exp = tick_add(now_ms, s->be->tcp_req.inspect_delay);
1195 return 0;
1196
Willy Tarreauedcf6682008-11-30 23:15:34 +01001197}
1198
Emeric Brun97679e72010-09-23 17:56:44 +02001199/* This function performs the TCP response analysis on the current response. It
1200 * returns 1 if the processing can continue on next analysers, or zero if it
1201 * needs more data, encounters an error, or wants to immediately abort the
1202 * response. It relies on buffers flags, and updates s->rep->analysers. The
1203 * function may be called for backend rules.
1204 */
Willy Tarreau87b09662015-04-03 00:22:06 +02001205int tcp_inspect_response(struct stream *s, struct channel *rep, int an_bit)
Emeric Brun97679e72010-09-23 17:56:44 +02001206{
Willy Tarreaufb0afa72015-04-03 14:46:27 +02001207 struct session *sess = s->sess;
Thierry FOURNIERa28a9422015-08-04 19:35:46 +02001208 struct act_rule *rule;
Emeric Brun97679e72010-09-23 17:56:44 +02001209 int partial;
1210
Willy Tarreau87b09662015-04-03 00:22:06 +02001211 DPRINTF(stderr,"[%u] %s: stream=%p b=%p, exp(r,w)=%u,%u bf=%08x bh=%d analysers=%02x\n",
Emeric Brun97679e72010-09-23 17:56:44 +02001212 now_ms, __FUNCTION__,
1213 s,
1214 rep,
1215 rep->rex, rep->wex,
1216 rep->flags,
Willy Tarreau9b28e032012-10-12 23:49:43 +02001217 rep->buf->i,
Emeric Brun97679e72010-09-23 17:56:44 +02001218 rep->analysers);
1219
1220 /* We don't know whether we have enough data, so must proceed
1221 * this way :
1222 * - iterate through all rules in their declaration order
1223 * - if one rule returns MISS, it means the inspect delay is
1224 * not over yet, then return immediately, otherwise consider
1225 * it as a non-match.
1226 * - if one rule returns OK, then return OK
1227 * - if one rule returns KO, then return KO
1228 */
1229
Willy Tarreau03cdb7c2012-08-27 23:14:58 +02001230 if (rep->flags & CF_SHUTR || tick_is_expired(rep->analyse_exp, now_ms))
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001231 partial = SMP_OPT_FINAL;
Emeric Brun97679e72010-09-23 17:56:44 +02001232 else
Willy Tarreau32a6f2e2012-04-25 10:13:36 +02001233 partial = 0;
Emeric Brun97679e72010-09-23 17:56:44 +02001234
Thierry FOURNIERbc4c1ac2015-02-25 13:36:14 +01001235 /* If "the current_rule_list" match the executed rule list, we are in
1236 * resume condition. If a resume is needed it is always in the action
1237 * and never in the ACL or converters. In this case, we initialise the
1238 * current rule, and go to the action execution point.
1239 */
Willy Tarreau152b81e2015-04-20 13:26:17 +02001240 if (s->current_rule) {
1241 rule = s->current_rule;
1242 s->current_rule = NULL;
1243 if (s->current_rule_list == &s->be->tcp_rep.inspect_rules)
1244 goto resume_execution;
Thierry FOURNIERbc4c1ac2015-02-25 13:36:14 +01001245 }
1246 s->current_rule_list = &s->be->tcp_rep.inspect_rules;
Willy Tarreau152b81e2015-04-20 13:26:17 +02001247
Emeric Brun97679e72010-09-23 17:56:44 +02001248 list_for_each_entry(rule, &s->be->tcp_rep.inspect_rules, list) {
Willy Tarreau0cba6072013-11-28 22:21:02 +01001249 enum acl_test_res ret = ACL_TEST_PASS;
Emeric Brun97679e72010-09-23 17:56:44 +02001250
1251 if (rule->cond) {
Willy Tarreau192252e2015-04-04 01:47:55 +02001252 ret = acl_exec_cond(rule->cond, s->be, sess, s, SMP_OPT_DIR_RES | partial);
Thierry FOURNIERa65b3432013-11-28 18:22:00 +01001253 if (ret == ACL_TEST_MISS) {
Emeric Brun97679e72010-09-23 17:56:44 +02001254 /* just set the analyser timeout once at the beginning of the response */
1255 if (!tick_isset(rep->analyse_exp) && s->be->tcp_rep.inspect_delay)
Willy Tarreau0bb166b2013-11-04 15:56:53 +01001256 rep->analyse_exp = tick_add(now_ms, s->be->tcp_rep.inspect_delay);
Emeric Brun97679e72010-09-23 17:56:44 +02001257 return 0;
1258 }
1259
1260 ret = acl_pass(ret);
1261 if (rule->cond->pol == ACL_COND_UNLESS)
1262 ret = !ret;
1263 }
1264
1265 if (ret) {
Thierry FOURNIERbc4c1ac2015-02-25 13:36:14 +01001266resume_execution:
Emeric Brun97679e72010-09-23 17:56:44 +02001267 /* we have a matching rule. */
Thierry FOURNIER0ea5c7f2015-08-05 19:05:19 +02001268 if (rule->action == ACT_ACTION_ALLOW) {
Willy Tarreau27f78242015-07-04 11:36:30 +02001269 break;
1270 }
Thierry FOURNIER0ea5c7f2015-08-05 19:05:19 +02001271 else if (rule->action == ACT_ACTION_DENY) {
Willy Tarreau8263d2b2012-08-28 00:06:31 +02001272 channel_abort(rep);
Willy Tarreau22ec1ea2014-11-27 20:45:39 +01001273 channel_abort(&s->req);
Emeric Brun97679e72010-09-23 17:56:44 +02001274 rep->analysers = 0;
1275
Willy Tarreau7d0aaf32011-03-10 23:25:56 +01001276 s->be->be_counters.denied_resp++;
Willy Tarreaue36cbcb2015-04-03 15:40:56 +02001277 sess->fe->fe_counters.denied_resp++;
Willy Tarreaufb0afa72015-04-03 14:46:27 +02001278 if (sess->listener->counters)
1279 sess->listener->counters->denied_resp++;
Emeric Brun97679e72010-09-23 17:56:44 +02001280
Willy Tarreaue7dff022015-04-03 01:14:29 +02001281 if (!(s->flags & SF_ERR_MASK))
1282 s->flags |= SF_ERR_PRXCOND;
1283 if (!(s->flags & SF_FINST_MASK))
1284 s->flags |= SF_FINST_D;
Emeric Brun97679e72010-09-23 17:56:44 +02001285 return 0;
1286 }
Thierry FOURNIER0ea5c7f2015-08-05 19:05:19 +02001287 else if (rule->action == ACT_TCP_CLOSE) {
Willy Tarreau73796532014-11-28 14:10:28 +01001288 chn_prod(rep)->flags |= SI_FL_NOLINGER | SI_FL_NOHALF;
1289 si_shutr(chn_prod(rep));
1290 si_shutw(chn_prod(rep));
Willy Tarreaucc1e04b2013-09-11 23:20:29 +02001291 break;
1292 }
Emeric Brun97679e72010-09-23 17:56:44 +02001293 else {
Thierry FOURNIERcc87a112014-12-12 19:41:33 +01001294 /* Custom keywords. */
Thierry FOURNIER42148732015-09-02 17:17:33 +02001295 if (!rule->action_ptr)
1296 continue;
1297 switch (rule->action_ptr(rule, s->be, s->sess, s)) {
1298 case ACT_RET_ERR:
1299 case ACT_RET_CONT:
1300 continue;
1301 case ACT_RET_STOP:
Thierry FOURNIER561a0f92015-05-29 17:29:14 +02001302 break;
Thierry FOURNIER42148732015-09-02 17:17:33 +02001303 case ACT_RET_YIELD:
1304 channel_dont_close(rep);
1305 s->current_rule = rule;
1306 return 0;
1307 }
1308 break; /* ACT_RET_STOP */
Emeric Brun97679e72010-09-23 17:56:44 +02001309 }
1310 }
1311 }
1312
1313 /* if we get there, it means we have no rule which matches, or
1314 * we have an explicit accept, so we apply the default accept.
1315 */
1316 rep->analysers &= ~an_bit;
1317 rep->analyse_exp = TICK_ETERNITY;
1318 return 1;
1319}
1320
1321
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001322/* This function performs the TCP layer4 analysis on the current request. It
1323 * returns 0 if a reject rule matches, otherwise 1 if either an accept rule
1324 * matches or if no more rule matches. It can only use rules which don't need
Willy Tarreaub363a1f2013-10-01 10:45:07 +02001325 * any data. This only works on connection-based client-facing stream interfaces.
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001326 */
Willy Tarreaue73ef852015-04-04 16:41:45 +02001327int tcp_exec_req_rules(struct session *sess)
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001328{
Thierry FOURNIERa28a9422015-08-04 19:35:46 +02001329 struct act_rule *rule;
Willy Tarreauf059a0f2010-08-03 16:29:52 +02001330 struct stksess *ts;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001331 struct stktable *t = NULL;
Willy Tarreau9ad7bd42015-04-03 19:19:59 +02001332 struct connection *conn = objt_conn(sess->origin);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001333 int result = 1;
Willy Tarreau0cba6072013-11-28 22:21:02 +01001334 enum acl_test_res ret;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001335
Willy Tarreaub363a1f2013-10-01 10:45:07 +02001336 if (!conn)
1337 return result;
1338
Willy Tarreaue36cbcb2015-04-03 15:40:56 +02001339 list_for_each_entry(rule, &sess->fe->tcp_req.l4_rules, list) {
Thierry FOURNIERa65b3432013-11-28 18:22:00 +01001340 ret = ACL_TEST_PASS;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001341
1342 if (rule->cond) {
Willy Tarreaue73ef852015-04-04 16:41:45 +02001343 ret = acl_exec_cond(rule->cond, sess->fe, sess, NULL, SMP_OPT_DIR_REQ|SMP_OPT_FINAL);
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001344 ret = acl_pass(ret);
1345 if (rule->cond->pol == ACL_COND_UNLESS)
1346 ret = !ret;
1347 }
1348
1349 if (ret) {
1350 /* we have a matching rule. */
Thierry FOURNIER0ea5c7f2015-08-05 19:05:19 +02001351 if (rule->action == ACT_ACTION_ALLOW) {
Willy Tarreau27f78242015-07-04 11:36:30 +02001352 break;
1353 }
Thierry FOURNIER0ea5c7f2015-08-05 19:05:19 +02001354 else if (rule->action == ACT_ACTION_DENY) {
Willy Tarreaue36cbcb2015-04-03 15:40:56 +02001355 sess->fe->fe_counters.denied_conn++;
Willy Tarreaufb0afa72015-04-03 14:46:27 +02001356 if (sess->listener->counters)
1357 sess->listener->counters->denied_conn++;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001358
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001359 result = 0;
1360 break;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001361 }
Thierry FOURNIER0ea5c7f2015-08-05 19:05:19 +02001362 else if (rule->action >= ACT_ACTION_TRK_SC0 && rule->action <= ACT_ACTION_TRK_SCMAX) {
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001363 /* Note: only the first valid tracking parameter of each
1364 * applies.
1365 */
1366 struct stktable_key *key;
1367
Willy Tarreau70f454e2015-04-04 16:38:07 +02001368 if (stkctr_entry(&sess->stkctr[tcp_trk_idx(rule->action)]))
Willy Tarreau44778ad2013-10-30 19:24:00 +01001369 continue;
1370
Thierry FOURNIER5ec63e02015-08-04 09:09:48 +02001371 t = rule->arg.trk_ctr.table.t;
1372 key = stktable_fetch_key(t, sess->fe, sess, NULL, SMP_OPT_DIR_REQ|SMP_OPT_FINAL, rule->arg.trk_ctr.expr, NULL);
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001373
Willy Tarreaud5ca9ab2013-05-28 17:40:25 +02001374 if (key && (ts = stktable_get_entry(t, key)))
Willy Tarreau70f454e2015-04-04 16:38:07 +02001375 stream_track_stkctr(&sess->stkctr[tcp_trk_idx(rule->action)], t, ts);
Willy Tarreauf059a0f2010-08-03 16:29:52 +02001376 }
Thierry FOURNIER0ea5c7f2015-08-05 19:05:19 +02001377 else if (rule->action == ACT_TCP_EXPECT_PX) {
Willy Tarreaub363a1f2013-10-01 10:45:07 +02001378 conn->flags |= CO_FL_ACCEPT_PROXY;
1379 conn_sock_want_recv(conn);
Willy Tarreau4f0d9192013-06-11 20:40:55 +02001380 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001381 else {
Thierry FOURNIERcc87a112014-12-12 19:41:33 +01001382 /* Custom keywords. */
Thierry FOURNIER42148732015-09-02 17:17:33 +02001383 if (rule->action_ptr)
1384 break;
1385 switch (rule->action_ptr(rule, sess->fe, sess, NULL)) {
1386 case ACT_RET_YIELD:
1387 /* yield is not allowed at this point. If this return code is
1388 * used it is a bug, so I prefer to abort the process.
1389 */
1390 send_log(sess->fe, LOG_WARNING,
1391 "Internal error: yield not allowed with tcp-request connection actions.");
1392 case ACT_RET_STOP:
1393 break;
1394 case ACT_RET_CONT:
1395 continue;
1396 case ACT_RET_ERR:
1397 result = 0;
1398 break;
Thierry FOURNIERc89f4f52015-08-11 09:48:02 +02001399 }
Thierry FOURNIER42148732015-09-02 17:17:33 +02001400 break; /* ACT_RET_STOP */
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001401 }
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001402 }
1403 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001404 return result;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +02001405}
1406
Emeric Brun97679e72010-09-23 17:56:44 +02001407/* Parse a tcp-response rule. Return a negative value in case of failure */
1408static int tcp_parse_response_rule(char **args, int arg, int section_type,
Thierry FOURNIER0d6ba512014-02-11 03:31:34 +01001409 struct proxy *curpx, struct proxy *defpx,
Thierry FOURNIERa28a9422015-08-04 19:35:46 +02001410 struct act_rule *rule, char **err,
Thierry FOURNIER0d6ba512014-02-11 03:31:34 +01001411 unsigned int where,
1412 const char *file, int line)
Emeric Brun97679e72010-09-23 17:56:44 +02001413{
1414 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001415 memprintf(err, "%s %s is only allowed in 'backend' sections",
1416 args[0], args[1]);
Emeric Brun97679e72010-09-23 17:56:44 +02001417 return -1;
1418 }
1419
1420 if (strcmp(args[arg], "accept") == 0) {
1421 arg++;
Thierry FOURNIER0ea5c7f2015-08-05 19:05:19 +02001422 rule->action = ACT_ACTION_ALLOW;
Emeric Brun97679e72010-09-23 17:56:44 +02001423 }
1424 else if (strcmp(args[arg], "reject") == 0) {
1425 arg++;
Thierry FOURNIER0ea5c7f2015-08-05 19:05:19 +02001426 rule->action = ACT_ACTION_DENY;
Emeric Brun97679e72010-09-23 17:56:44 +02001427 }
Willy Tarreaucc1e04b2013-09-11 23:20:29 +02001428 else if (strcmp(args[arg], "close") == 0) {
1429 arg++;
Thierry FOURNIER0ea5c7f2015-08-05 19:05:19 +02001430 rule->action = ACT_TCP_CLOSE;
Willy Tarreaucc1e04b2013-09-11 23:20:29 +02001431 }
Emeric Brun97679e72010-09-23 17:56:44 +02001432 else {
Thierry FOURNIER36481b82015-08-19 09:01:53 +02001433 struct action_kw *kw;
Thierry FOURNIERcc87a112014-12-12 19:41:33 +01001434 kw = tcp_res_cont_action(args[arg]);
1435 if (kw) {
1436 arg++;
Thierry FOURNIER5563e4b2015-08-14 19:20:07 +02001437 rule->from = ACT_F_TCP_RES_CNT;
Thierry FOURNIERafa80492015-08-19 09:04:15 +02001438 if (kw->parse((const char **)args, &arg, curpx, rule, err) == ACT_RET_PRS_ERR)
Thierry FOURNIERcc87a112014-12-12 19:41:33 +01001439 return -1;
1440 } else {
1441 memprintf(err,
Thierry FOURNIER4834bc72015-06-06 19:29:07 +02001442 "'%s %s' expects 'accept', 'close', 'reject' or 'set-var' in %s '%s' (got '%s')",
Thierry FOURNIERcc87a112014-12-12 19:41:33 +01001443 args[0], args[1], proxy_type_str(curpx), curpx->id, args[arg]);
1444 return -1;
1445 }
Emeric Brun97679e72010-09-23 17:56:44 +02001446 }
1447
1448 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
Thierry FOURNIER0d6ba512014-02-11 03:31:34 +01001449 if ((rule->cond = build_acl_cond(file, line, curpx, (const char **)args+arg, err)) == NULL) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001450 memprintf(err,
1451 "'%s %s %s' : error detected in %s '%s' while parsing '%s' condition : %s",
1452 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg], *err);
Emeric Brun97679e72010-09-23 17:56:44 +02001453 return -1;
1454 }
1455 }
1456 else if (*args[arg]) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001457 memprintf(err,
1458 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (got '%s')",
Emeric Brun97679e72010-09-23 17:56:44 +02001459 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
1460 return -1;
1461 }
1462 return 0;
1463}
1464
1465
1466
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001467/* Parse a tcp-request rule. Return a negative value in case of failure */
1468static int tcp_parse_request_rule(char **args, int arg, int section_type,
Willy Tarreau80aca902013-01-07 15:42:20 +01001469 struct proxy *curpx, struct proxy *defpx,
Thierry FOURNIERa28a9422015-08-04 19:35:46 +02001470 struct act_rule *rule, char **err,
Thierry FOURNIER0d6ba512014-02-11 03:31:34 +01001471 unsigned int where, const char *file, int line)
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001472{
1473 if (curpx == defpx) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001474 memprintf(err, "%s %s is not allowed in 'defaults' sections",
1475 args[0], args[1]);
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001476 return -1;
1477 }
1478
1479 if (!strcmp(args[arg], "accept")) {
1480 arg++;
Thierry FOURNIER0ea5c7f2015-08-05 19:05:19 +02001481 rule->action = ACT_ACTION_ALLOW;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001482 }
1483 else if (!strcmp(args[arg], "reject")) {
1484 arg++;
Thierry FOURNIER0ea5c7f2015-08-05 19:05:19 +02001485 rule->action = ACT_ACTION_DENY;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001486 }
Willy Tarreau18bf01e2014-06-13 16:18:52 +02001487 else if (strcmp(args[arg], "capture") == 0) {
1488 struct sample_expr *expr;
1489 struct cap_hdr *hdr;
1490 int kw = arg;
1491 int len = 0;
1492
1493 if (!(curpx->cap & PR_CAP_FE)) {
1494 memprintf(err,
1495 "'%s %s %s' : proxy '%s' has no frontend capability",
1496 args[0], args[1], args[kw], curpx->id);
1497 return -1;
1498 }
1499
1500 if (!(where & SMP_VAL_FE_REQ_CNT)) {
1501 memprintf(err,
1502 "'%s %s' is not allowed in '%s %s' rules in %s '%s'",
1503 args[arg], args[arg+1], args[0], args[1], proxy_type_str(curpx), curpx->id);
1504 return -1;
1505 }
1506
1507 arg++;
1508
1509 curpx->conf.args.ctx = ARGC_CAP;
1510 expr = sample_parse_expr(args, &arg, file, line, err, &curpx->conf.args);
1511 if (!expr) {
1512 memprintf(err,
1513 "'%s %s %s' : %s",
1514 args[0], args[1], args[kw], *err);
1515 return -1;
1516 }
1517
1518 if (!(expr->fetch->val & where)) {
1519 memprintf(err,
1520 "'%s %s %s' : fetch method '%s' extracts information from '%s', none of which is available here",
1521 args[0], args[1], args[kw], args[arg-1], sample_src_names(expr->fetch->use));
1522 free(expr);
1523 return -1;
1524 }
1525
1526 if (strcmp(args[arg], "len") == 0) {
1527 arg++;
1528 if (!args[arg]) {
1529 memprintf(err,
1530 "'%s %s %s' : missing length value",
1531 args[0], args[1], args[kw]);
1532 free(expr);
1533 return -1;
1534 }
1535 /* we copy the table name for now, it will be resolved later */
1536 len = atoi(args[arg]);
1537 if (len <= 0) {
1538 memprintf(err,
1539 "'%s %s %s' : length must be > 0",
1540 args[0], args[1], args[kw]);
1541 free(expr);
1542 return -1;
1543 }
1544 arg++;
1545 }
1546
1547 if (!len) {
1548 memprintf(err,
1549 "'%s %s %s' : a positive 'len' argument is mandatory",
1550 args[0], args[1], args[kw]);
1551 free(expr);
1552 return -1;
1553 }
1554
1555 hdr = calloc(sizeof(struct cap_hdr), 1);
1556 hdr->next = curpx->req_cap;
1557 hdr->name = NULL; /* not a header capture */
1558 hdr->namelen = 0;
1559 hdr->len = len;
1560 hdr->pool = create_pool("caphdr", hdr->len + 1, MEM_F_SHARED);
1561 hdr->index = curpx->nb_req_cap++;
1562
1563 curpx->req_cap = hdr;
1564 curpx->to_log |= LW_REQHDR;
1565
1566 /* check if we need to allocate an hdr_idx struct for HTTP parsing */
1567 curpx->http_needed |= !!(expr->fetch->use & SMP_USE_HTTP_ANY);
1568
Thierry FOURNIERd0d65ae2015-08-04 08:21:12 +02001569 rule->arg.cap.expr = expr;
1570 rule->arg.cap.hdr = hdr;
Thierry FOURNIER0ea5c7f2015-08-05 19:05:19 +02001571 rule->action = ACT_TCP_CAPTURE;
Willy Tarreau18bf01e2014-06-13 16:18:52 +02001572 }
Willy Tarreaub4c84932013-07-23 19:15:30 +02001573 else if (strncmp(args[arg], "track-sc", 8) == 0 &&
1574 args[arg][9] == '\0' && args[arg][8] >= '0' &&
Willy Tarreaue1cfc1f2014-10-17 11:53:05 +02001575 args[arg][8] < '0' + MAX_SESS_STKCTR) { /* track-sc 0..9 */
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001576 struct sample_expr *expr;
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001577 int kw = arg;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001578
1579 arg++;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001580
Willy Tarreaua4312fa2013-04-02 16:34:32 +02001581 curpx->conf.args.ctx = ARGC_TRK;
Thierry FOURNIEReeaa9512014-02-11 14:00:19 +01001582 expr = sample_parse_expr(args, &arg, file, line, err, &curpx->conf.args);
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001583 if (!expr) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001584 memprintf(err,
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001585 "'%s %s %s' : %s",
Willy Tarreau975c1782013-12-12 23:16:54 +01001586 args[0], args[1], args[kw], *err);
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001587 return -1;
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001588 }
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001589
Willy Tarreau80aca902013-01-07 15:42:20 +01001590 if (!(expr->fetch->val & where)) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001591 memprintf(err,
Willy Tarreau80aca902013-01-07 15:42:20 +01001592 "'%s %s %s' : fetch method '%s' extracts information from '%s', none of which is available here",
Willy Tarreau33c60de2013-04-12 08:26:32 +02001593 args[0], args[1], args[kw], args[arg-1], sample_src_names(expr->fetch->use));
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001594 free(expr);
1595 return -1;
1596 }
1597
1598 /* check if we need to allocate an hdr_idx struct for HTTP parsing */
Willy Tarreau25320b22013-03-24 07:22:08 +01001599 curpx->http_needed |= !!(expr->fetch->use & SMP_USE_HTTP_ANY);
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001600
1601 if (strcmp(args[arg], "table") == 0) {
Willy Tarreau598718a2012-12-09 16:57:27 +01001602 arg++;
1603 if (!args[arg]) {
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001604 memprintf(err,
1605 "'%s %s %s' : missing table name",
1606 args[0], args[1], args[kw]);
1607 free(expr);
1608 return -1;
1609 }
1610 /* we copy the table name for now, it will be resolved later */
Thierry FOURNIER5ec63e02015-08-04 09:09:48 +02001611 rule->arg.trk_ctr.table.n = strdup(args[arg]);
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001612 arg++;
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001613 }
Thierry FOURNIER5ec63e02015-08-04 09:09:48 +02001614 rule->arg.trk_ctr.expr = expr;
Thierry FOURNIER0ea5c7f2015-08-05 19:05:19 +02001615 rule->action = ACT_ACTION_TRK_SC0 + args[kw][8] - '0';
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001616 }
Willy Tarreau4f0d9192013-06-11 20:40:55 +02001617 else if (strcmp(args[arg], "expect-proxy") == 0) {
1618 if (strcmp(args[arg+1], "layer4") != 0) {
1619 memprintf(err,
1620 "'%s %s %s' only supports 'layer4' in %s '%s' (got '%s')",
1621 args[0], args[1], args[arg], proxy_type_str(curpx), curpx->id, args[arg+1]);
1622 return -1;
1623 }
1624
1625 if (!(where & SMP_VAL_FE_CON_ACC)) {
1626 memprintf(err,
1627 "'%s %s' is not allowed in '%s %s' rules in %s '%s'",
1628 args[arg], args[arg+1], args[0], args[1], proxy_type_str(curpx), curpx->id);
1629 return -1;
1630 }
1631
1632 arg += 2;
Thierry FOURNIER0ea5c7f2015-08-05 19:05:19 +02001633 rule->action = ACT_TCP_EXPECT_PX;
Willy Tarreau4f0d9192013-06-11 20:40:55 +02001634 }
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001635 else {
Thierry FOURNIER36481b82015-08-19 09:01:53 +02001636 struct action_kw *kw;
Thierry FOURNIER5563e4b2015-08-14 19:20:07 +02001637 if (where & SMP_VAL_FE_CON_ACC) {
Thierry FOURNIERcc87a112014-12-12 19:41:33 +01001638 kw = tcp_req_conn_action(args[arg]);
Thierry FOURNIER5563e4b2015-08-14 19:20:07 +02001639 rule->from = ACT_F_TCP_REQ_CON;
1640 } else {
Thierry FOURNIERcc87a112014-12-12 19:41:33 +01001641 kw = tcp_req_cont_action(args[arg]);
Thierry FOURNIER5563e4b2015-08-14 19:20:07 +02001642 rule->from = ACT_F_TCP_REQ_CNT;
1643 }
Thierry FOURNIERcc87a112014-12-12 19:41:33 +01001644 if (kw) {
1645 arg++;
Thierry FOURNIERafa80492015-08-19 09:04:15 +02001646 if (kw->parse((const char **)args, &arg, curpx, rule, err) == ACT_RET_PRS_ERR)
Thierry FOURNIERcc87a112014-12-12 19:41:33 +01001647 return -1;
1648 } else {
1649 memprintf(err,
Thierry FOURNIER4834bc72015-06-06 19:29:07 +02001650 "'%s %s' expects 'accept', 'reject', 'track-sc0' ... 'track-sc%d', "
1651 " or 'set-var' in %s '%s' (got '%s')",
Thierry FOURNIERcc87a112014-12-12 19:41:33 +01001652 args[0], args[1], MAX_SESS_STKCTR-1, proxy_type_str(curpx),
1653 curpx->id, args[arg]);
1654 return -1;
1655 }
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001656 }
1657
1658 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
Thierry FOURNIER0d6ba512014-02-11 03:31:34 +01001659 if ((rule->cond = build_acl_cond(file, line, curpx, (const char **)args+arg, err)) == NULL) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001660 memprintf(err,
1661 "'%s %s %s' : error detected in %s '%s' while parsing '%s' condition : %s",
1662 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg], *err);
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001663 return -1;
1664 }
1665 }
1666 else if (*args[arg]) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001667 memprintf(err,
1668 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (got '%s')",
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001669 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
1670 return -1;
1671 }
1672 return 0;
1673}
1674
Emeric Brun97679e72010-09-23 17:56:44 +02001675/* This function should be called to parse a line starting with the "tcp-response"
1676 * keyword.
1677 */
1678static int tcp_parse_tcp_rep(char **args, int section_type, struct proxy *curpx,
Willy Tarreau28a47d62012-09-18 20:02:48 +02001679 struct proxy *defpx, const char *file, int line,
1680 char **err)
Emeric Brun97679e72010-09-23 17:56:44 +02001681{
1682 const char *ptr = NULL;
1683 unsigned int val;
Emeric Brun97679e72010-09-23 17:56:44 +02001684 int warn = 0;
1685 int arg;
Thierry FOURNIERa28a9422015-08-04 19:35:46 +02001686 struct act_rule *rule;
Willy Tarreau80aca902013-01-07 15:42:20 +01001687 unsigned int where;
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001688 const struct acl *acl;
Willy Tarreau93fddf12013-03-31 22:59:32 +02001689 const char *kw;
Emeric Brun97679e72010-09-23 17:56:44 +02001690
1691 if (!*args[1]) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001692 memprintf(err, "missing argument for '%s' in %s '%s'",
1693 args[0], proxy_type_str(curpx), curpx->id);
Emeric Brun97679e72010-09-23 17:56:44 +02001694 return -1;
1695 }
1696
1697 if (strcmp(args[1], "inspect-delay") == 0) {
1698 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001699 memprintf(err, "%s %s is only allowed in 'backend' sections",
1700 args[0], args[1]);
Emeric Brun97679e72010-09-23 17:56:44 +02001701 return -1;
1702 }
1703
1704 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001705 memprintf(err,
1706 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
1707 args[0], args[1], proxy_type_str(curpx), curpx->id);
1708 if (ptr)
1709 memprintf(err, "%s (unexpected character '%c')", *err, *ptr);
Emeric Brun97679e72010-09-23 17:56:44 +02001710 return -1;
1711 }
1712
1713 if (curpx->tcp_rep.inspect_delay) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001714 memprintf(err, "ignoring %s %s (was already defined) in %s '%s'",
1715 args[0], args[1], proxy_type_str(curpx), curpx->id);
Emeric Brun97679e72010-09-23 17:56:44 +02001716 return 1;
1717 }
1718 curpx->tcp_rep.inspect_delay = val;
1719 return 0;
1720 }
1721
Simon Hormande072bd2011-06-24 15:11:37 +09001722 rule = calloc(1, sizeof(*rule));
Emeric Brun97679e72010-09-23 17:56:44 +02001723 LIST_INIT(&rule->list);
1724 arg = 1;
Willy Tarreau80aca902013-01-07 15:42:20 +01001725 where = 0;
Emeric Brun97679e72010-09-23 17:56:44 +02001726
1727 if (strcmp(args[1], "content") == 0) {
1728 arg++;
Willy Tarreau80aca902013-01-07 15:42:20 +01001729
1730 if (curpx->cap & PR_CAP_FE)
1731 where |= SMP_VAL_FE_RES_CNT;
1732 if (curpx->cap & PR_CAP_BE)
1733 where |= SMP_VAL_BE_RES_CNT;
1734
Thierry FOURNIER0d6ba512014-02-11 03:31:34 +01001735 if (tcp_parse_response_rule(args, arg, section_type, curpx, defpx, rule, err, where, file, line) < 0)
Emeric Brun97679e72010-09-23 17:56:44 +02001736 goto error;
1737
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001738 acl = rule->cond ? acl_cond_conflicts(rule->cond, where) : NULL;
1739 if (acl) {
1740 if (acl->name && *acl->name)
1741 memprintf(err,
1742 "acl '%s' will never match in '%s %s' because it only involves keywords that are incompatible with '%s'",
1743 acl->name, args[0], args[1], sample_ckp_names(where));
1744 else
1745 memprintf(err,
1746 "anonymous acl will never match in '%s %s' because it uses keyword '%s' which is incompatible with '%s'",
1747 args[0], args[1],
Willy Tarreau93fddf12013-03-31 22:59:32 +02001748 LIST_ELEM(acl->expr.n, struct acl_expr *, list)->kw,
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001749 sample_ckp_names(where));
Emeric Brun97679e72010-09-23 17:56:44 +02001750
Emeric Brun97679e72010-09-23 17:56:44 +02001751 warn++;
1752 }
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001753 else if (rule->cond && acl_cond_kw_conflicts(rule->cond, where, &acl, &kw)) {
1754 if (acl->name && *acl->name)
1755 memprintf(err,
1756 "acl '%s' involves keyword '%s' which is incompatible with '%s'",
Willy Tarreau93fddf12013-03-31 22:59:32 +02001757 acl->name, kw, sample_ckp_names(where));
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001758 else
1759 memprintf(err,
1760 "anonymous acl involves keyword '%s' which is incompatible with '%s'",
Willy Tarreau93fddf12013-03-31 22:59:32 +02001761 kw, sample_ckp_names(where));
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001762 warn++;
1763 }
Emeric Brun97679e72010-09-23 17:56:44 +02001764
1765 LIST_ADDQ(&curpx->tcp_rep.inspect_rules, &rule->list);
1766 }
1767 else {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001768 memprintf(err,
1769 "'%s' expects 'inspect-delay' or 'content' in %s '%s' (got '%s')",
1770 args[0], proxy_type_str(curpx), curpx->id, args[1]);
Emeric Brun97679e72010-09-23 17:56:44 +02001771 goto error;
1772 }
1773
1774 return warn;
1775 error:
1776 free(rule);
1777 return -1;
1778}
1779
1780
Willy Tarreaub6866442008-07-14 23:54:42 +02001781/* This function should be called to parse a line starting with the "tcp-request"
1782 * keyword.
1783 */
1784static int tcp_parse_tcp_req(char **args, int section_type, struct proxy *curpx,
Willy Tarreau28a47d62012-09-18 20:02:48 +02001785 struct proxy *defpx, const char *file, int line,
1786 char **err)
Willy Tarreaub6866442008-07-14 23:54:42 +02001787{
1788 const char *ptr = NULL;
Willy Tarreauc7e961e2008-08-17 17:13:47 +02001789 unsigned int val;
Willy Tarreau1a687942010-05-23 22:40:30 +02001790 int warn = 0;
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001791 int arg;
Thierry FOURNIERa28a9422015-08-04 19:35:46 +02001792 struct act_rule *rule;
Willy Tarreau80aca902013-01-07 15:42:20 +01001793 unsigned int where;
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001794 const struct acl *acl;
Willy Tarreau93fddf12013-03-31 22:59:32 +02001795 const char *kw;
Willy Tarreaub6866442008-07-14 23:54:42 +02001796
1797 if (!*args[1]) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001798 if (curpx == defpx)
1799 memprintf(err, "missing argument for '%s' in defaults section", args[0]);
1800 else
1801 memprintf(err, "missing argument for '%s' in %s '%s'",
1802 args[0], proxy_type_str(curpx), curpx->id);
Willy Tarreaub6866442008-07-14 23:54:42 +02001803 return -1;
1804 }
1805
1806 if (!strcmp(args[1], "inspect-delay")) {
1807 if (curpx == defpx) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001808 memprintf(err, "%s %s is not allowed in 'defaults' sections",
1809 args[0], args[1]);
Willy Tarreaub6866442008-07-14 23:54:42 +02001810 return -1;
1811 }
1812
Willy Tarreaub6866442008-07-14 23:54:42 +02001813 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001814 memprintf(err,
1815 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
1816 args[0], args[1], proxy_type_str(curpx), curpx->id);
1817 if (ptr)
1818 memprintf(err, "%s (unexpected character '%c')", *err, *ptr);
Willy Tarreaub6866442008-07-14 23:54:42 +02001819 return -1;
1820 }
1821
1822 if (curpx->tcp_req.inspect_delay) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001823 memprintf(err, "ignoring %s %s (was already defined) in %s '%s'",
1824 args[0], args[1], proxy_type_str(curpx), curpx->id);
Willy Tarreaub6866442008-07-14 23:54:42 +02001825 return 1;
1826 }
1827 curpx->tcp_req.inspect_delay = val;
1828 return 0;
1829 }
1830
Simon Hormande072bd2011-06-24 15:11:37 +09001831 rule = calloc(1, sizeof(*rule));
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001832 LIST_INIT(&rule->list);
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001833 arg = 1;
Willy Tarreau80aca902013-01-07 15:42:20 +01001834 where = 0;
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001835
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001836 if (strcmp(args[1], "content") == 0) {
Willy Tarreaud1f96522010-08-03 19:34:32 +02001837 arg++;
Willy Tarreau80aca902013-01-07 15:42:20 +01001838
1839 if (curpx->cap & PR_CAP_FE)
1840 where |= SMP_VAL_FE_REQ_CNT;
1841 if (curpx->cap & PR_CAP_BE)
1842 where |= SMP_VAL_BE_REQ_CNT;
1843
Thierry FOURNIER0d6ba512014-02-11 03:31:34 +01001844 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, where, file, line) < 0)
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001845 goto error;
Willy Tarreaub6866442008-07-14 23:54:42 +02001846
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001847 acl = rule->cond ? acl_cond_conflicts(rule->cond, where) : NULL;
1848 if (acl) {
1849 if (acl->name && *acl->name)
1850 memprintf(err,
1851 "acl '%s' will never match in '%s %s' because it only involves keywords that are incompatible with '%s'",
1852 acl->name, args[0], args[1], sample_ckp_names(where));
1853 else
1854 memprintf(err,
1855 "anonymous acl will never match in '%s %s' because it uses keyword '%s' which is incompatible with '%s'",
1856 args[0], args[1],
Willy Tarreau93fddf12013-03-31 22:59:32 +02001857 LIST_ELEM(acl->expr.n, struct acl_expr *, list)->kw,
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001858 sample_ckp_names(where));
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001859
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001860 warn++;
1861 }
1862 else if (rule->cond && acl_cond_kw_conflicts(rule->cond, where, &acl, &kw)) {
1863 if (acl->name && *acl->name)
1864 memprintf(err,
1865 "acl '%s' involves keyword '%s' which is incompatible with '%s'",
Willy Tarreau93fddf12013-03-31 22:59:32 +02001866 acl->name, kw, sample_ckp_names(where));
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001867 else
1868 memprintf(err,
1869 "anonymous acl involves keyword '%s' which is incompatible with '%s'",
Willy Tarreau93fddf12013-03-31 22:59:32 +02001870 kw, sample_ckp_names(where));
Willy Tarreaudd64f8d2008-07-27 22:02:32 +02001871 warn++;
1872 }
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001873
Willy Tarreau3986b9c2014-09-16 15:39:51 +02001874 /* the following function directly emits the warning */
1875 warnif_misplaced_tcp_cont(curpx, file, line, args[0]);
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001876 LIST_ADDQ(&curpx->tcp_req.inspect_rules, &rule->list);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001877 }
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001878 else if (strcmp(args[1], "connection") == 0) {
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001879 arg++;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001880
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001881 if (!(curpx->cap & PR_CAP_FE)) {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001882 memprintf(err, "%s %s is not allowed because %s %s is not a frontend",
1883 args[0], args[1], proxy_type_str(curpx), curpx->id);
Simon Horman6c54d8b2011-07-15 13:14:06 +09001884 goto error;
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001885 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001886
Willy Tarreau80aca902013-01-07 15:42:20 +01001887 where |= SMP_VAL_FE_CON_ACC;
1888
Thierry FOURNIER0d6ba512014-02-11 03:31:34 +01001889 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, where, file, line) < 0)
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001890 goto error;
1891
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001892 acl = rule->cond ? acl_cond_conflicts(rule->cond, where) : NULL;
1893 if (acl) {
1894 if (acl->name && *acl->name)
1895 memprintf(err,
1896 "acl '%s' will never match in '%s %s' because it only involves keywords that are incompatible with '%s'",
1897 acl->name, args[0], args[1], sample_ckp_names(where));
1898 else
1899 memprintf(err,
1900 "anonymous acl will never match in '%s %s' because it uses keyword '%s' which is incompatible with '%s'",
1901 args[0], args[1],
Willy Tarreau93fddf12013-03-31 22:59:32 +02001902 LIST_ELEM(acl->expr.n, struct acl_expr *, list)->kw,
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001903 sample_ckp_names(where));
Willy Tarreauf059a0f2010-08-03 16:29:52 +02001904
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001905 warn++;
1906 }
1907 else if (rule->cond && acl_cond_kw_conflicts(rule->cond, where, &acl, &kw)) {
1908 if (acl->name && *acl->name)
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001909 memprintf(err,
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001910 "acl '%s' involves keyword '%s' which is incompatible with '%s'",
Willy Tarreau93fddf12013-03-31 22:59:32 +02001911 acl->name, kw, sample_ckp_names(where));
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001912 else
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001913 memprintf(err,
Willy Tarreaua91d0a52013-03-25 08:12:18 +01001914 "anonymous acl involves keyword '%s' which is incompatible with '%s'",
Willy Tarreau93fddf12013-03-31 22:59:32 +02001915 kw, sample_ckp_names(where));
Willy Tarreau68c03ab2010-08-06 15:08:45 +02001916 warn++;
1917 }
Willy Tarreau5d5b5d82012-12-09 12:00:04 +01001918
Willy Tarreau3986b9c2014-09-16 15:39:51 +02001919 /* the following function directly emits the warning */
1920 warnif_misplaced_tcp_conn(curpx, file, line, args[0]);
Willy Tarreaufb024dc2010-08-20 13:35:41 +02001921 LIST_ADDQ(&curpx->tcp_req.l4_rules, &rule->list);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +02001922 }
Willy Tarreau1a687942010-05-23 22:40:30 +02001923 else {
Willy Tarreau0a3dd742012-05-08 19:47:01 +02001924 if (curpx == defpx)
1925 memprintf(err,
1926 "'%s' expects 'inspect-delay', 'connection', or 'content' in defaults section (got '%s')",
1927 args[0], args[1]);
1928 else
1929 memprintf(err,
1930 "'%s' expects 'inspect-delay', 'connection', or 'content' in %s '%s' (got '%s')",
Willy Tarreaudeaec2f2013-04-10 16:31:11 +02001931 args[0], proxy_type_str(curpx), curpx->id, args[1]);
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001932 goto error;
Willy Tarreau1a687942010-05-23 22:40:30 +02001933 }
1934
Willy Tarreau1a687942010-05-23 22:40:30 +02001935 return warn;
Willy Tarreau6a984fa2010-06-14 16:44:27 +02001936 error:
1937 free(rule);
1938 return -1;
Willy Tarreaub6866442008-07-14 23:54:42 +02001939}
1940
Willy Tarreau645513a2010-05-24 20:55:15 +02001941
1942/************************************************************************/
Willy Tarreaud4c33c82013-01-07 21:59:07 +01001943/* All supported sample fetch functions must be declared here */
Willy Tarreau32389b72012-04-23 23:13:20 +02001944/************************************************************************/
1945
Willy Tarreau4a129812012-04-25 17:31:42 +02001946/* fetch the connection's source IPv4/IPv6 address */
Thierry FOURNIERa123ad82015-07-24 09:12:15 +02001947int smp_fetch_src(const struct arg *args, struct sample *smp, const char *kw, void *private)
Willy Tarreau645513a2010-05-24 20:55:15 +02001948{
Thierry FOURNIER0a9a2b82015-05-11 15:20:49 +02001949 struct connection *cli_conn = objt_conn(smp->sess->origin);
Willy Tarreaub363a1f2013-10-01 10:45:07 +02001950
1951 if (!cli_conn)
1952 return 0;
1953
1954 switch (cli_conn->addr.from.ss_family) {
Willy Tarreauf4362b32011-12-16 17:49:52 +01001955 case AF_INET:
Thierry FOURNIER136f9d32015-08-19 09:07:19 +02001956 smp->data.u.ipv4 = ((struct sockaddr_in *)&cli_conn->addr.from)->sin_addr;
Thierry FOURNIER8c542ca2015-08-19 09:00:18 +02001957 smp->data.type = SMP_T_IPV4;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001958 break;
1959 case AF_INET6:
Thierry FOURNIER136f9d32015-08-19 09:07:19 +02001960 smp->data.u.ipv6 = ((struct sockaddr_in6 *)&cli_conn->addr.from)->sin6_addr;
Thierry FOURNIER8c542ca2015-08-19 09:00:18 +02001961 smp->data.type = SMP_T_IPV6;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001962 break;
1963 default:
Emeric Brunf769f512010-10-22 17:14:01 +02001964 return 0;
Willy Tarreauf4362b32011-12-16 17:49:52 +01001965 }
Emeric Brunf769f512010-10-22 17:14:01 +02001966
Willy Tarreau37406352012-04-23 16:16:37 +02001967 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001968 return 1;
1969}
1970
Willy Tarreaua5e37562011-12-16 17:06:15 +01001971/* set temp integer to the connection's source port */
Willy Tarreau645513a2010-05-24 20:55:15 +02001972static int
Thierry FOURNIER0786d052015-05-11 15:42:45 +02001973smp_fetch_sport(const struct arg *args, struct sample *smp, const char *k, void *private)
Willy Tarreau645513a2010-05-24 20:55:15 +02001974{
Thierry FOURNIER0a9a2b82015-05-11 15:20:49 +02001975 struct connection *cli_conn = objt_conn(smp->sess->origin);
Willy Tarreaub363a1f2013-10-01 10:45:07 +02001976
1977 if (!cli_conn)
1978 return 0;
1979
Thierry FOURNIER8c542ca2015-08-19 09:00:18 +02001980 smp->data.type = SMP_T_SINT;
Thierry FOURNIER136f9d32015-08-19 09:07:19 +02001981 if (!(smp->data.u.sint = get_host_port(&cli_conn->addr.from)))
Emeric Brunf769f512010-10-22 17:14:01 +02001982 return 0;
1983
Willy Tarreau37406352012-04-23 16:16:37 +02001984 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02001985 return 1;
1986}
1987
Willy Tarreau4a129812012-04-25 17:31:42 +02001988/* fetch the connection's destination IPv4/IPv6 address */
Willy Tarreau645513a2010-05-24 20:55:15 +02001989static int
Thierry FOURNIER0786d052015-05-11 15:42:45 +02001990smp_fetch_dst(const struct arg *args, struct sample *smp, const char *kw, void *private)
Willy Tarreau645513a2010-05-24 20:55:15 +02001991{
Thierry FOURNIER0a9a2b82015-05-11 15:20:49 +02001992 struct connection *cli_conn = objt_conn(smp->sess->origin);
Willy Tarreau645513a2010-05-24 20:55:15 +02001993
Willy Tarreaub363a1f2013-10-01 10:45:07 +02001994 if (!cli_conn)
1995 return 0;
1996
1997 conn_get_to_addr(cli_conn);
1998
1999 switch (cli_conn->addr.to.ss_family) {
Willy Tarreauf4362b32011-12-16 17:49:52 +01002000 case AF_INET:
Thierry FOURNIER136f9d32015-08-19 09:07:19 +02002001 smp->data.u.ipv4 = ((struct sockaddr_in *)&cli_conn->addr.to)->sin_addr;
Thierry FOURNIER8c542ca2015-08-19 09:00:18 +02002002 smp->data.type = SMP_T_IPV4;
Willy Tarreauf4362b32011-12-16 17:49:52 +01002003 break;
2004 case AF_INET6:
Thierry FOURNIER136f9d32015-08-19 09:07:19 +02002005 smp->data.u.ipv6 = ((struct sockaddr_in6 *)&cli_conn->addr.to)->sin6_addr;
Thierry FOURNIER8c542ca2015-08-19 09:00:18 +02002006 smp->data.type = SMP_T_IPV6;
Willy Tarreauf4362b32011-12-16 17:49:52 +01002007 break;
2008 default:
Emeric Brunf769f512010-10-22 17:14:01 +02002009 return 0;
Willy Tarreauf4362b32011-12-16 17:49:52 +01002010 }
Emeric Brunf769f512010-10-22 17:14:01 +02002011
Willy Tarreau37406352012-04-23 16:16:37 +02002012 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02002013 return 1;
2014}
2015
Willy Tarreaua5e37562011-12-16 17:06:15 +01002016/* set temp integer to the frontend connexion's destination port */
Willy Tarreau645513a2010-05-24 20:55:15 +02002017static int
Thierry FOURNIER0786d052015-05-11 15:42:45 +02002018smp_fetch_dport(const struct arg *args, struct sample *smp, const char *kw, void *private)
Willy Tarreau645513a2010-05-24 20:55:15 +02002019{
Thierry FOURNIER0a9a2b82015-05-11 15:20:49 +02002020 struct connection *cli_conn = objt_conn(smp->sess->origin);
Willy Tarreaub363a1f2013-10-01 10:45:07 +02002021
2022 if (!cli_conn)
2023 return 0;
2024
2025 conn_get_to_addr(cli_conn);
Willy Tarreau645513a2010-05-24 20:55:15 +02002026
Thierry FOURNIER8c542ca2015-08-19 09:00:18 +02002027 smp->data.type = SMP_T_SINT;
Thierry FOURNIER136f9d32015-08-19 09:07:19 +02002028 if (!(smp->data.u.sint = get_host_port(&cli_conn->addr.to)))
Emeric Brunf769f512010-10-22 17:14:01 +02002029 return 0;
2030
Willy Tarreau37406352012-04-23 16:16:37 +02002031 smp->flags = 0;
Willy Tarreau645513a2010-05-24 20:55:15 +02002032 return 1;
Emericf2d7cae2010-11-05 18:13:50 +01002033}
2034
Willy Tarreau9b6700f2012-11-24 11:55:28 +01002035#ifdef IPV6_V6ONLY
Willy Tarreau77e3af92012-11-24 15:07:23 +01002036/* parse the "v4v6" bind keyword */
2037static int bind_parse_v4v6(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
2038{
2039 struct listener *l;
2040
2041 list_for_each_entry(l, &conf->listeners, by_bind) {
2042 if (l->addr.ss_family == AF_INET6)
2043 l->options |= LI_O_V4V6;
2044 }
2045
2046 return 0;
2047}
2048
Willy Tarreau9b6700f2012-11-24 11:55:28 +01002049/* parse the "v6only" bind keyword */
2050static int bind_parse_v6only(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
2051{
2052 struct listener *l;
2053
2054 list_for_each_entry(l, &conf->listeners, by_bind) {
2055 if (l->addr.ss_family == AF_INET6)
2056 l->options |= LI_O_V6ONLY;
2057 }
2058
2059 return 0;
2060}
2061#endif
2062
Pieter Baauwd551fb52013-05-08 22:49:23 +02002063#ifdef CONFIG_HAP_TRANSPARENT
Willy Tarreau44791242012-09-12 23:27:21 +02002064/* parse the "transparent" bind keyword */
Willy Tarreau4348fad2012-09-20 16:48:07 +02002065static int bind_parse_transparent(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
Willy Tarreau44791242012-09-12 23:27:21 +02002066{
2067 struct listener *l;
2068
Willy Tarreau4348fad2012-09-20 16:48:07 +02002069 list_for_each_entry(l, &conf->listeners, by_bind) {
2070 if (l->addr.ss_family == AF_INET || l->addr.ss_family == AF_INET6)
2071 l->options |= LI_O_FOREIGN;
Willy Tarreau44791242012-09-12 23:27:21 +02002072 }
2073
Willy Tarreau44791242012-09-12 23:27:21 +02002074 return 0;
2075}
2076#endif
2077
2078#ifdef TCP_DEFER_ACCEPT
2079/* parse the "defer-accept" bind keyword */
Willy Tarreau4348fad2012-09-20 16:48:07 +02002080static int bind_parse_defer_accept(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
Willy Tarreau44791242012-09-12 23:27:21 +02002081{
2082 struct listener *l;
2083
Willy Tarreau4348fad2012-09-20 16:48:07 +02002084 list_for_each_entry(l, &conf->listeners, by_bind) {
2085 if (l->addr.ss_family == AF_INET || l->addr.ss_family == AF_INET6)
2086 l->options |= LI_O_DEF_ACCEPT;
Willy Tarreau44791242012-09-12 23:27:21 +02002087 }
2088
Willy Tarreau44791242012-09-12 23:27:21 +02002089 return 0;
2090}
2091#endif
2092
Willy Tarreau1c862c52012-10-05 16:21:00 +02002093#ifdef TCP_FASTOPEN
Lukas Tribus0defb902013-02-13 23:35:39 +01002094/* parse the "tfo" bind keyword */
Willy Tarreau1c862c52012-10-05 16:21:00 +02002095static int bind_parse_tfo(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
2096{
2097 struct listener *l;
2098
2099 list_for_each_entry(l, &conf->listeners, by_bind) {
2100 if (l->addr.ss_family == AF_INET || l->addr.ss_family == AF_INET6)
2101 l->options |= LI_O_TCP_FO;
2102 }
2103
2104 return 0;
2105}
2106#endif
2107
Willy Tarreau44791242012-09-12 23:27:21 +02002108#ifdef TCP_MAXSEG
2109/* parse the "mss" bind keyword */
Willy Tarreau4348fad2012-09-20 16:48:07 +02002110static int bind_parse_mss(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
Willy Tarreau44791242012-09-12 23:27:21 +02002111{
2112 struct listener *l;
2113 int mss;
2114
Willy Tarreau44791242012-09-12 23:27:21 +02002115 if (!*args[cur_arg + 1]) {
Willy Tarreaueb6cead2012-09-20 19:43:14 +02002116 memprintf(err, "'%s' : missing MSS value", args[cur_arg]);
Willy Tarreau44791242012-09-12 23:27:21 +02002117 return ERR_ALERT | ERR_FATAL;
2118 }
2119
2120 mss = atoi(args[cur_arg + 1]);
2121 if (!mss || abs(mss) > 65535) {
Willy Tarreaueb6cead2012-09-20 19:43:14 +02002122 memprintf(err, "'%s' : expects an MSS with and absolute value between 1 and 65535", args[cur_arg]);
Willy Tarreau44791242012-09-12 23:27:21 +02002123 return ERR_ALERT | ERR_FATAL;
2124 }
2125
Willy Tarreau4348fad2012-09-20 16:48:07 +02002126 list_for_each_entry(l, &conf->listeners, by_bind) {
2127 if (l->addr.ss_family == AF_INET || l->addr.ss_family == AF_INET6)
2128 l->maxseg = mss;
2129 }
Willy Tarreau44791242012-09-12 23:27:21 +02002130
2131 return 0;
2132}
2133#endif
2134
Willy Tarreau2af207a2015-02-04 00:45:58 +01002135#ifdef TCP_USER_TIMEOUT
2136/* parse the "tcp-ut" bind keyword */
2137static int bind_parse_tcp_ut(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
2138{
2139 const char *ptr = NULL;
2140 struct listener *l;
2141 unsigned int timeout;
2142
2143 if (!*args[cur_arg + 1]) {
2144 memprintf(err, "'%s' : missing TCP User Timeout value", args[cur_arg]);
2145 return ERR_ALERT | ERR_FATAL;
2146 }
2147
2148 ptr = parse_time_err(args[cur_arg + 1], &timeout, TIME_UNIT_MS);
2149 if (ptr) {
2150 memprintf(err, "'%s' : expects a positive delay in milliseconds", args[cur_arg]);
2151 return ERR_ALERT | ERR_FATAL;
2152 }
2153
2154 list_for_each_entry(l, &conf->listeners, by_bind) {
2155 if (l->addr.ss_family == AF_INET || l->addr.ss_family == AF_INET6)
2156 l->tcp_ut = timeout;
2157 }
2158
2159 return 0;
2160}
2161#endif
2162
Willy Tarreau44791242012-09-12 23:27:21 +02002163#ifdef SO_BINDTODEVICE
Willy Tarreau2af207a2015-02-04 00:45:58 +01002164/* parse the "interface" bind keyword */
Willy Tarreau4348fad2012-09-20 16:48:07 +02002165static int bind_parse_interface(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
Willy Tarreau44791242012-09-12 23:27:21 +02002166{
2167 struct listener *l;
2168
Willy Tarreau44791242012-09-12 23:27:21 +02002169 if (!*args[cur_arg + 1]) {
Willy Tarreaueb6cead2012-09-20 19:43:14 +02002170 memprintf(err, "'%s' : missing interface name", args[cur_arg]);
Willy Tarreau44791242012-09-12 23:27:21 +02002171 return ERR_ALERT | ERR_FATAL;
2172 }
2173
Willy Tarreau4348fad2012-09-20 16:48:07 +02002174 list_for_each_entry(l, &conf->listeners, by_bind) {
2175 if (l->addr.ss_family == AF_INET || l->addr.ss_family == AF_INET6)
2176 l->interface = strdup(args[cur_arg + 1]);
2177 }
Willy Tarreau44791242012-09-12 23:27:21 +02002178
2179 global.last_checks |= LSTCHK_NETADM;
2180 return 0;
2181}
2182#endif
2183
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01002184#ifdef CONFIG_HAP_NS
2185/* parse the "namespace" bind keyword */
2186static int bind_parse_namespace(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
2187{
2188 struct listener *l;
2189 char *namespace = NULL;
2190
2191 if (!*args[cur_arg + 1]) {
2192 memprintf(err, "'%s' : missing namespace id", args[cur_arg]);
2193 return ERR_ALERT | ERR_FATAL;
2194 }
2195 namespace = args[cur_arg + 1];
2196
2197 list_for_each_entry(l, &conf->listeners, by_bind) {
2198 l->netns = netns_store_lookup(namespace, strlen(namespace));
2199
2200 if (l->netns == NULL)
2201 l->netns = netns_store_insert(namespace);
2202
2203 if (l->netns == NULL) {
2204 Alert("Cannot open namespace '%s'.\n", args[cur_arg + 1]);
2205 return ERR_ALERT | ERR_FATAL;
2206 }
2207 }
2208 return 0;
2209}
2210#endif
2211
Willy Tarreaudc13c112013-06-21 23:16:39 +02002212static struct cfg_kw_list cfg_kws = {ILH, {
Willy Tarreaud4c33c82013-01-07 21:59:07 +01002213 { CFG_LISTEN, "tcp-request", tcp_parse_tcp_req },
Emeric Brun97679e72010-09-23 17:56:44 +02002214 { CFG_LISTEN, "tcp-response", tcp_parse_tcp_rep },
Willy Tarreaub6866442008-07-14 23:54:42 +02002215 { 0, NULL, NULL },
2216}};
2217
Willy Tarreaud4c33c82013-01-07 21:59:07 +01002218
Willy Tarreau61612d42012-04-19 18:42:05 +02002219/* Note: must not be declared <const> as its list will be overwritten.
2220 * Please take care of keeping this list alphabetically sorted.
2221 */
Willy Tarreaudc13c112013-06-21 23:16:39 +02002222static struct acl_kw_list acl_kws = {ILH, {
Willy Tarreaud4c33c82013-01-07 21:59:07 +01002223 { /* END */ },
Willy Tarreaub6866442008-07-14 23:54:42 +02002224}};
2225
Willy Tarreaud4c33c82013-01-07 21:59:07 +01002226
Willy Tarreau4a129812012-04-25 17:31:42 +02002227/* Note: must not be declared <const> as its list will be overwritten.
2228 * Note: fetches that may return multiple types must be declared as the lowest
2229 * common denominator, the type that can be casted into all other ones. For
2230 * instance v4/v6 must be declared v4.
2231 */
Willy Tarreaudc13c112013-06-21 23:16:39 +02002232static struct sample_fetch_kw_list sample_fetch_keywords = {ILH, {
Willy Tarreaud4c33c82013-01-07 21:59:07 +01002233 { "dst", smp_fetch_dst, 0, NULL, SMP_T_IPV4, SMP_USE_L4CLI },
Thierry FOURNIER07ee64e2015-07-06 23:43:03 +02002234 { "dst_port", smp_fetch_dport, 0, NULL, SMP_T_SINT, SMP_USE_L4CLI },
Willy Tarreaud4c33c82013-01-07 21:59:07 +01002235 { "src", smp_fetch_src, 0, NULL, SMP_T_IPV4, SMP_USE_L4CLI },
Thierry FOURNIER07ee64e2015-07-06 23:43:03 +02002236 { "src_port", smp_fetch_sport, 0, NULL, SMP_T_SINT, SMP_USE_L4CLI },
Willy Tarreaud4c33c82013-01-07 21:59:07 +01002237 { /* END */ },
Willy Tarreau645513a2010-05-24 20:55:15 +02002238}};
2239
Willy Tarreau44791242012-09-12 23:27:21 +02002240/************************************************************************/
2241/* All supported bind keywords must be declared here. */
2242/************************************************************************/
2243
2244/* Note: must not be declared <const> as its list will be overwritten.
2245 * Please take care of keeping this list alphabetically sorted, doing so helps
2246 * all code contributors.
2247 * Optional keywords are also declared with a NULL ->parse() function so that
2248 * the config parser can report an appropriate error when a known keyword was
2249 * not enabled.
2250 */
Willy Tarreau51fb7652012-09-18 18:24:39 +02002251static struct bind_kw_list bind_kws = { "TCP", { }, {
Willy Tarreau44791242012-09-12 23:27:21 +02002252#ifdef TCP_DEFER_ACCEPT
2253 { "defer-accept", bind_parse_defer_accept, 0 }, /* wait for some data for 1 second max before doing accept */
2254#endif
2255#ifdef SO_BINDTODEVICE
2256 { "interface", bind_parse_interface, 1 }, /* specifically bind to this interface */
2257#endif
2258#ifdef TCP_MAXSEG
2259 { "mss", bind_parse_mss, 1 }, /* set MSS of listening socket */
2260#endif
Willy Tarreau2af207a2015-02-04 00:45:58 +01002261#ifdef TCP_USER_TIMEOUT
2262 { "tcp-ut", bind_parse_tcp_ut, 1 }, /* set User Timeout on listening socket */
2263#endif
Willy Tarreau1c862c52012-10-05 16:21:00 +02002264#ifdef TCP_FASTOPEN
2265 { "tfo", bind_parse_tfo, 0 }, /* enable TCP_FASTOPEN of listening socket */
2266#endif
Pieter Baauwd551fb52013-05-08 22:49:23 +02002267#ifdef CONFIG_HAP_TRANSPARENT
Willy Tarreau44791242012-09-12 23:27:21 +02002268 { "transparent", bind_parse_transparent, 0 }, /* transparently bind to the specified addresses */
2269#endif
Willy Tarreau9b6700f2012-11-24 11:55:28 +01002270#ifdef IPV6_V6ONLY
Willy Tarreau77e3af92012-11-24 15:07:23 +01002271 { "v4v6", bind_parse_v4v6, 0 }, /* force socket to bind to IPv4+IPv6 */
Willy Tarreau9b6700f2012-11-24 11:55:28 +01002272 { "v6only", bind_parse_v6only, 0 }, /* force socket to bind to IPv6 only */
2273#endif
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01002274#ifdef CONFIG_HAP_NS
2275 { "namespace", bind_parse_namespace, 1 },
2276#endif
Willy Tarreau44791242012-09-12 23:27:21 +02002277 /* the versions with the NULL parse function*/
2278 { "defer-accept", NULL, 0 },
2279 { "interface", NULL, 1 },
2280 { "mss", NULL, 1 },
2281 { "transparent", NULL, 0 },
Willy Tarreau77e3af92012-11-24 15:07:23 +01002282 { "v4v6", NULL, 0 },
Willy Tarreau9b6700f2012-11-24 11:55:28 +01002283 { "v6only", NULL, 0 },
Willy Tarreau44791242012-09-12 23:27:21 +02002284 { NULL, NULL, 0 },
2285}};
2286
Willy Tarreaue6b98942007-10-29 01:09:36 +01002287__attribute__((constructor))
2288static void __tcp_protocol_init(void)
2289{
2290 protocol_register(&proto_tcpv4);
2291 protocol_register(&proto_tcpv6);
Willy Tarreau12785782012-04-27 21:37:17 +02002292 sample_register_fetches(&sample_fetch_keywords);
Willy Tarreaub6866442008-07-14 23:54:42 +02002293 cfg_register_keywords(&cfg_kws);
2294 acl_register_keywords(&acl_kws);
Willy Tarreau44791242012-09-12 23:27:21 +02002295 bind_register_keywords(&bind_kws);
Willy Tarreaue6b98942007-10-29 01:09:36 +01002296}
2297
2298
2299/*
2300 * Local variables:
2301 * c-indent-level: 8
2302 * c-basic-offset: 8
2303 * End:
2304 */