blob: 7aa6d407dfa6213314e25608168ba2201e330df2 [file] [log] [blame]
Willy Tarreaue6b98942007-10-29 01:09:36 +01001/*
2 * AF_INET/AF_INET6 SOCK_STREAM protocol layer (tcp)
3 *
Willy Tarreau1a687942010-05-23 22:40:30 +02004 * Copyright 2000-2010 Willy Tarreau <w@1wt.eu>
Willy Tarreaue6b98942007-10-29 01:09:36 +01005 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
13#include <ctype.h>
14#include <errno.h>
15#include <fcntl.h>
16#include <stdio.h>
17#include <stdlib.h>
18#include <string.h>
19#include <time.h>
20
21#include <sys/param.h>
22#include <sys/socket.h>
23#include <sys/stat.h>
24#include <sys/types.h>
25#include <sys/un.h>
26
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +040027#include <netinet/tcp.h>
28
Willy Tarreaub6866442008-07-14 23:54:42 +020029#include <common/cfgparse.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010030#include <common/compat.h>
31#include <common/config.h>
32#include <common/debug.h>
33#include <common/errors.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010034#include <common/mini-clist.h>
35#include <common/standard.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010036
Willy Tarreaue6b98942007-10-29 01:09:36 +010037#include <types/global.h>
Willy Tarreau9650f372009-08-16 14:02:45 +020038#include <types/server.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010039
40#include <proto/acl.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010041#include <proto/buffers.h>
Willy Tarreau03fa5df2010-05-24 21:02:37 +020042#include <proto/frontend.h>
Willy Tarreau9650f372009-08-16 14:02:45 +020043#include <proto/log.h>
Willy Tarreau645513a2010-05-24 20:55:15 +020044#include <proto/pattern.h>
Willy Tarreau9650f372009-08-16 14:02:45 +020045#include <proto/port_range.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010046#include <proto/protocols.h>
47#include <proto/proto_tcp.h>
Willy Tarreaub6866442008-07-14 23:54:42 +020048#include <proto/proxy.h>
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +020049#include <proto/session.h>
Willy Tarreaua975b8f2010-06-05 19:13:27 +020050#include <proto/stick_table.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010051#include <proto/stream_sock.h>
Willy Tarreaua975b8f2010-06-05 19:13:27 +020052#include <proto/task.h>
Willy Tarreaue6b98942007-10-29 01:09:36 +010053
Willy Tarreaue8c66af2008-01-13 18:40:14 +010054#ifdef CONFIG_HAP_CTTPROXY
55#include <import/ip_tproxy.h>
56#endif
57
Willy Tarreaue6b98942007-10-29 01:09:36 +010058static int tcp_bind_listeners(struct protocol *proto);
59
60/* Note: must not be declared <const> as its list will be overwritten */
61static struct protocol proto_tcpv4 = {
62 .name = "tcpv4",
63 .sock_domain = AF_INET,
64 .sock_type = SOCK_STREAM,
65 .sock_prot = IPPROTO_TCP,
66 .sock_family = AF_INET,
67 .sock_addrlen = sizeof(struct sockaddr_in),
68 .l3_addrlen = 32/8,
Willy Tarreaueb472682010-05-28 18:46:57 +020069 .accept = &stream_sock_accept,
Willy Tarreaue6b98942007-10-29 01:09:36 +010070 .read = &stream_sock_read,
71 .write = &stream_sock_write,
72 .bind_all = tcp_bind_listeners,
73 .unbind_all = unbind_all_listeners,
74 .enable_all = enable_all_listeners,
75 .listeners = LIST_HEAD_INIT(proto_tcpv4.listeners),
76 .nb_listeners = 0,
77};
78
79/* Note: must not be declared <const> as its list will be overwritten */
80static struct protocol proto_tcpv6 = {
81 .name = "tcpv6",
82 .sock_domain = AF_INET6,
83 .sock_type = SOCK_STREAM,
84 .sock_prot = IPPROTO_TCP,
85 .sock_family = AF_INET6,
86 .sock_addrlen = sizeof(struct sockaddr_in6),
87 .l3_addrlen = 128/8,
Willy Tarreaueb472682010-05-28 18:46:57 +020088 .accept = &stream_sock_accept,
Willy Tarreaue6b98942007-10-29 01:09:36 +010089 .read = &stream_sock_read,
90 .write = &stream_sock_write,
91 .bind_all = tcp_bind_listeners,
92 .unbind_all = unbind_all_listeners,
93 .enable_all = enable_all_listeners,
94 .listeners = LIST_HEAD_INIT(proto_tcpv6.listeners),
95 .nb_listeners = 0,
96};
97
Willy Tarreaue8c66af2008-01-13 18:40:14 +010098
99/* Binds ipv4 address <local> to socket <fd>, unless <flags> is set, in which
100 * case we try to bind <remote>. <flags> is a 2-bit field consisting of :
101 * - 0 : ignore remote address (may even be a NULL pointer)
102 * - 1 : use provided address
103 * - 2 : use provided port
104 * - 3 : use both
105 *
106 * The function supports multiple foreign binding methods :
107 * - linux_tproxy: we directly bind to the foreign address
108 * - cttproxy: we bind to a local address then nat.
109 * The second one can be used as a fallback for the first one.
110 * This function returns 0 when everything's OK, 1 if it could not bind, to the
111 * local address, 2 if it could not bind to the foreign address.
112 */
113int tcpv4_bind_socket(int fd, int flags, struct sockaddr_in *local, struct sockaddr_in *remote)
114{
115 struct sockaddr_in bind_addr;
116 int foreign_ok = 0;
117 int ret;
118
119#ifdef CONFIG_HAP_LINUX_TPROXY
120 static int ip_transp_working = 1;
121 if (flags && ip_transp_working) {
122 if (setsockopt(fd, SOL_IP, IP_TRANSPARENT, (char *) &one, sizeof(one)) == 0
123 || setsockopt(fd, SOL_IP, IP_FREEBIND, (char *) &one, sizeof(one)) == 0)
124 foreign_ok = 1;
125 else
126 ip_transp_working = 0;
127 }
128#endif
129 if (flags) {
130 memset(&bind_addr, 0, sizeof(bind_addr));
131 if (flags & 1)
132 bind_addr.sin_addr = remote->sin_addr;
133 if (flags & 2)
134 bind_addr.sin_port = remote->sin_port;
135 }
136
137 setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (char *) &one, sizeof(one));
138 if (foreign_ok) {
139 ret = bind(fd, (struct sockaddr *)&bind_addr, sizeof(bind_addr));
140 if (ret < 0)
141 return 2;
142 }
143 else {
144 ret = bind(fd, (struct sockaddr *)local, sizeof(*local));
145 if (ret < 0)
146 return 1;
147 }
148
149 if (!flags)
150 return 0;
151
152#ifdef CONFIG_HAP_CTTPROXY
153 if (!foreign_ok) {
154 struct in_tproxy itp1, itp2;
155 memset(&itp1, 0, sizeof(itp1));
156
157 itp1.op = TPROXY_ASSIGN;
158 itp1.v.addr.faddr = bind_addr.sin_addr;
159 itp1.v.addr.fport = bind_addr.sin_port;
160
161 /* set connect flag on socket */
162 itp2.op = TPROXY_FLAGS;
163 itp2.v.flags = ITP_CONNECT | ITP_ONCE;
164
165 if (setsockopt(fd, SOL_IP, IP_TPROXY, &itp1, sizeof(itp1)) != -1 &&
166 setsockopt(fd, SOL_IP, IP_TPROXY, &itp2, sizeof(itp2)) != -1) {
167 foreign_ok = 1;
168 }
169 }
170#endif
171 if (!foreign_ok)
172 /* we could not bind to a foreign address */
173 return 2;
174
175 return 0;
176}
Willy Tarreaue6b98942007-10-29 01:09:36 +0100177
Willy Tarreau9650f372009-08-16 14:02:45 +0200178
179/*
180 * This function initiates a connection to the server assigned to this session
Willy Tarreaub1d67742010-03-29 19:36:59 +0200181 * (s->srv, s->srv_addr). It will assign a server if none is assigned yet. A
182 * source address may be pointed to by <from_addr>. Note that this is only used
183 * in case of transparent proxying. Normal source bind addresses are still
184 * determined locally (due to the possible need of a source port).
185 *
Willy Tarreau9650f372009-08-16 14:02:45 +0200186 * It can return one of :
187 * - SN_ERR_NONE if everything's OK
188 * - SN_ERR_SRVTO if there are no more servers
189 * - SN_ERR_SRVCL if the connection was refused by the server
190 * - SN_ERR_PRXCOND if the connection has been limited by the proxy (maxconn)
191 * - SN_ERR_RESOURCE if a system resource is lacking (eg: fd limits, ports, ...)
192 * - SN_ERR_INTERNAL for any other purely internal errors
193 * Additionnally, in the case of SN_ERR_RESOURCE, an emergency log will be emitted.
194 */
195int tcpv4_connect_server(struct stream_interface *si,
196 struct proxy *be, struct server *srv,
Willy Tarreaub1d67742010-03-29 19:36:59 +0200197 struct sockaddr *srv_addr, struct sockaddr *from_addr)
Willy Tarreau9650f372009-08-16 14:02:45 +0200198{
199 int fd;
200
201 if ((fd = si->fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) == -1) {
202 qfprintf(stderr, "Cannot get a server socket.\n");
203
204 if (errno == ENFILE)
205 send_log(be, LOG_EMERG,
206 "Proxy %s reached system FD limit at %d. Please check system tunables.\n",
207 be->id, maxfd);
208 else if (errno == EMFILE)
209 send_log(be, LOG_EMERG,
210 "Proxy %s reached process FD limit at %d. Please check 'ulimit-n' and restart.\n",
211 be->id, maxfd);
212 else if (errno == ENOBUFS || errno == ENOMEM)
213 send_log(be, LOG_EMERG,
214 "Proxy %s reached system memory limit at %d sockets. Please check system tunables.\n",
215 be->id, maxfd);
216 /* this is a resource error */
217 return SN_ERR_RESOURCE;
218 }
219
220 if (fd >= global.maxsock) {
221 /* do not log anything there, it's a normal condition when this option
222 * is used to serialize connections to a server !
223 */
224 Alert("socket(): not enough free sockets. Raise -n argument. Giving up.\n");
225 close(fd);
226 return SN_ERR_PRXCOND; /* it is a configuration limit */
227 }
228
229 if ((fcntl(fd, F_SETFL, O_NONBLOCK)==-1) ||
230 (setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, (char *) &one, sizeof(one)) == -1)) {
231 qfprintf(stderr,"Cannot set client socket to non blocking mode.\n");
232 close(fd);
233 return SN_ERR_INTERNAL;
234 }
235
236 if (be->options & PR_O_TCP_SRV_KA)
237 setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, (char *) &one, sizeof(one));
238
239 if (be->options & PR_O_TCP_NOLING)
240 setsockopt(fd, SOL_SOCKET, SO_LINGER, (struct linger *) &nolinger, sizeof(struct linger));
241
242 /* allow specific binding :
243 * - server-specific at first
244 * - proxy-specific next
245 */
246 if (srv != NULL && srv->state & SRV_BIND_SRC) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200247 int ret, flags = 0;
248
Willy Tarreau9650f372009-08-16 14:02:45 +0200249 switch (srv->state & SRV_TPROXY_MASK) {
250 case SRV_TPROXY_ADDR:
Willy Tarreau9650f372009-08-16 14:02:45 +0200251 case SRV_TPROXY_CLI:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200252 flags = 3;
253 break;
Willy Tarreau9650f372009-08-16 14:02:45 +0200254 case SRV_TPROXY_CIP:
Willy Tarreau090466c2009-09-07 11:51:47 +0200255 case SRV_TPROXY_DYN:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200256 flags = 1;
Willy Tarreau9650f372009-08-16 14:02:45 +0200257 break;
258 }
Willy Tarreaub1d67742010-03-29 19:36:59 +0200259
Willy Tarreau9650f372009-08-16 14:02:45 +0200260#ifdef SO_BINDTODEVICE
261 /* Note: this might fail if not CAP_NET_RAW */
262 if (srv->iface_name)
263 setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, srv->iface_name, srv->iface_len + 1);
264#endif
265
266 if (srv->sport_range) {
267 int attempts = 10; /* should be more than enough to find a spare port */
268 struct sockaddr_in src;
269
270 ret = 1;
271 src = srv->source_addr;
272
273 do {
274 /* note: in case of retry, we may have to release a previously
275 * allocated port, hence this loop's construct.
276 */
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200277 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
278 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200279
280 if (!attempts)
281 break;
282 attempts--;
283
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200284 fdinfo[fd].local_port = port_range_alloc_port(srv->sport_range);
285 if (!fdinfo[fd].local_port)
Willy Tarreau9650f372009-08-16 14:02:45 +0200286 break;
287
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200288 fdinfo[fd].port_range = srv->sport_range;
289 src.sin_port = htons(fdinfo[fd].local_port);
Willy Tarreau9650f372009-08-16 14:02:45 +0200290
Willy Tarreaub1d67742010-03-29 19:36:59 +0200291 ret = tcpv4_bind_socket(fd, flags, &src, (struct sockaddr_in *)from_addr);
Willy Tarreau9650f372009-08-16 14:02:45 +0200292 } while (ret != 0); /* binding NOK */
293 }
294 else {
Willy Tarreaub1d67742010-03-29 19:36:59 +0200295 ret = tcpv4_bind_socket(fd, flags, &srv->source_addr, (struct sockaddr_in *)from_addr);
Willy Tarreau9650f372009-08-16 14:02:45 +0200296 }
297
298 if (ret) {
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200299 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
300 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200301 close(fd);
302
303 if (ret == 1) {
304 Alert("Cannot bind to source address before connect() for server %s/%s. Aborting.\n",
305 be->id, srv->id);
306 send_log(be, LOG_EMERG,
307 "Cannot bind to source address before connect() for server %s/%s.\n",
308 be->id, srv->id);
309 } else {
310 Alert("Cannot bind to tproxy source address before connect() for server %s/%s. Aborting.\n",
311 be->id, srv->id);
312 send_log(be, LOG_EMERG,
313 "Cannot bind to tproxy source address before connect() for server %s/%s.\n",
314 be->id, srv->id);
315 }
316 return SN_ERR_RESOURCE;
317 }
318 }
319 else if (be->options & PR_O_BIND_SRC) {
Willy Tarreau9650f372009-08-16 14:02:45 +0200320 int ret, flags = 0;
321
Willy Tarreau9650f372009-08-16 14:02:45 +0200322 switch (be->options & PR_O_TPXY_MASK) {
323 case PR_O_TPXY_ADDR:
Willy Tarreau9650f372009-08-16 14:02:45 +0200324 case PR_O_TPXY_CLI:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200325 flags = 3;
326 break;
Willy Tarreau9650f372009-08-16 14:02:45 +0200327 case PR_O_TPXY_CIP:
Willy Tarreau090466c2009-09-07 11:51:47 +0200328 case PR_O_TPXY_DYN:
Willy Tarreaub1d67742010-03-29 19:36:59 +0200329 flags = 1;
Willy Tarreau9650f372009-08-16 14:02:45 +0200330 break;
331 }
Willy Tarreaub1d67742010-03-29 19:36:59 +0200332
Willy Tarreau9650f372009-08-16 14:02:45 +0200333#ifdef SO_BINDTODEVICE
334 /* Note: this might fail if not CAP_NET_RAW */
335 if (be->iface_name)
336 setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, be->iface_name, be->iface_len + 1);
337#endif
Willy Tarreaub1d67742010-03-29 19:36:59 +0200338 ret = tcpv4_bind_socket(fd, flags, &be->source_addr, (struct sockaddr_in *)from_addr);
Willy Tarreau9650f372009-08-16 14:02:45 +0200339 if (ret) {
340 close(fd);
341 if (ret == 1) {
342 Alert("Cannot bind to source address before connect() for proxy %s. Aborting.\n",
343 be->id);
344 send_log(be, LOG_EMERG,
345 "Cannot bind to source address before connect() for proxy %s.\n",
346 be->id);
347 } else {
348 Alert("Cannot bind to tproxy source address before connect() for proxy %s. Aborting.\n",
349 be->id);
350 send_log(be, LOG_EMERG,
351 "Cannot bind to tproxy source address before connect() for proxy %s.\n",
352 be->id);
353 }
354 return SN_ERR_RESOURCE;
355 }
356 }
357
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400358#if defined(TCP_QUICKACK)
Willy Tarreau9650f372009-08-16 14:02:45 +0200359 /* disabling tcp quick ack now allows the first request to leave the
360 * machine with the first ACK. We only do this if there are pending
361 * data in the buffer.
362 */
363 if ((be->options2 & PR_O2_SMARTCON) && si->ob->send_max)
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400364 setsockopt(fd, IPPROTO_TCP, TCP_QUICKACK, (char *) &zero, sizeof(zero));
Willy Tarreau9650f372009-08-16 14:02:45 +0200365#endif
366
Willy Tarreaue803de22010-01-21 17:43:04 +0100367 if (global.tune.server_sndbuf)
368 setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &global.tune.server_sndbuf, sizeof(global.tune.server_sndbuf));
369
370 if (global.tune.server_rcvbuf)
371 setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &global.tune.server_rcvbuf, sizeof(global.tune.server_rcvbuf));
372
Willy Tarreau9650f372009-08-16 14:02:45 +0200373 if ((connect(fd, (struct sockaddr *)srv_addr, sizeof(struct sockaddr_in)) == -1) &&
374 (errno != EINPROGRESS) && (errno != EALREADY) && (errno != EISCONN)) {
375
376 if (errno == EAGAIN || errno == EADDRINUSE) {
377 char *msg;
378 if (errno == EAGAIN) /* no free ports left, try again later */
379 msg = "no free ports";
380 else
381 msg = "local address already in use";
382
383 qfprintf(stderr,"Cannot connect: %s.\n",msg);
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200384 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
385 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200386 close(fd);
387 send_log(be, LOG_EMERG,
388 "Connect() failed for server %s/%s: %s.\n",
389 be->id, srv->id, msg);
390 return SN_ERR_RESOURCE;
391 } else if (errno == ETIMEDOUT) {
392 //qfprintf(stderr,"Connect(): ETIMEDOUT");
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200393 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
394 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200395 close(fd);
396 return SN_ERR_SRVTO;
397 } else {
398 // (errno == ECONNREFUSED || errno == ENETUNREACH || errno == EACCES || errno == EPERM)
399 //qfprintf(stderr,"Connect(): %d", errno);
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200400 port_range_release_port(fdinfo[fd].port_range, fdinfo[fd].local_port);
401 fdinfo[fd].port_range = NULL;
Willy Tarreau9650f372009-08-16 14:02:45 +0200402 close(fd);
403 return SN_ERR_SRVCL;
404 }
405 }
406
407 fdtab[fd].owner = si;
408 fdtab[fd].state = FD_STCONN; /* connection in progress */
409 fdtab[fd].flags = FD_FL_TCP | FD_FL_TCP_NODELAY;
410 fdtab[fd].cb[DIR_RD].f = &stream_sock_read;
411 fdtab[fd].cb[DIR_RD].b = si->ib;
412 fdtab[fd].cb[DIR_WR].f = &stream_sock_write;
413 fdtab[fd].cb[DIR_WR].b = si->ob;
414
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200415 fdinfo[fd].peeraddr = (struct sockaddr *)srv_addr;
416 fdinfo[fd].peerlen = sizeof(struct sockaddr_in);
Willy Tarreau9650f372009-08-16 14:02:45 +0200417
418 fd_insert(fd);
419 EV_FD_SET(fd, DIR_WR); /* for connect status */
420
421 si->state = SI_ST_CON;
422 si->flags |= SI_FL_CAP_SPLTCP; /* TCP supports splicing */
423 si->exp = tick_add_ifset(now_ms, be->timeout.connect);
424
425 return SN_ERR_NONE; /* connection is OK */
426}
427
428
Willy Tarreaue6b98942007-10-29 01:09:36 +0100429/* This function tries to bind a TCPv4/v6 listener. It may return a warning or
430 * an error message in <err> if the message is at most <errlen> bytes long
431 * (including '\0'). The return value is composed from ERR_ABORT, ERR_WARN,
432 * ERR_ALERT, ERR_RETRYABLE and ERR_FATAL. ERR_NONE indicates that everything
433 * was alright and that no message was returned. ERR_RETRYABLE means that an
434 * error occurred but that it may vanish after a retry (eg: port in use), and
435 * ERR_FATAL indicates a non-fixable error.ERR_WARN and ERR_ALERT do not alter
436 * the meaning of the error, but just indicate that a message is present which
437 * should be displayed with the respective level. Last, ERR_ABORT indicates
438 * that it's pointless to try to start other listeners. No error message is
439 * returned if errlen is NULL.
440 */
441int tcp_bind_listener(struct listener *listener, char *errmsg, int errlen)
442{
443 __label__ tcp_return, tcp_close_return;
444 int fd, err;
445 const char *msg = NULL;
446
447 /* ensure we never return garbage */
448 if (errmsg && errlen)
449 *errmsg = 0;
450
451 if (listener->state != LI_ASSIGNED)
452 return ERR_NONE; /* already bound */
453
454 err = ERR_NONE;
455
456 if ((fd = socket(listener->addr.ss_family, SOCK_STREAM, IPPROTO_TCP)) == -1) {
457 err |= ERR_RETRYABLE | ERR_ALERT;
458 msg = "cannot create listening socket";
459 goto tcp_return;
460 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100461
Willy Tarreaue6b98942007-10-29 01:09:36 +0100462 if (fd >= global.maxsock) {
463 err |= ERR_FATAL | ERR_ABORT | ERR_ALERT;
464 msg = "not enough free sockets (raise '-n' parameter)";
465 goto tcp_close_return;
466 }
467
Willy Tarreaufb14edc2009-06-14 15:24:37 +0200468 if (fcntl(fd, F_SETFL, O_NONBLOCK) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100469 err |= ERR_FATAL | ERR_ALERT;
470 msg = "cannot make socket non-blocking";
471 goto tcp_close_return;
472 }
473
474 if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (char *) &one, sizeof(one)) == -1) {
475 /* not fatal but should be reported */
476 msg = "cannot do so_reuseaddr";
477 err |= ERR_ALERT;
478 }
479
480 if (listener->options & LI_O_NOLINGER)
481 setsockopt(fd, SOL_SOCKET, SO_LINGER, (struct linger *) &nolinger, sizeof(struct linger));
Willy Tarreauedcf6682008-11-30 23:15:34 +0100482
Willy Tarreaue6b98942007-10-29 01:09:36 +0100483#ifdef SO_REUSEPORT
484 /* OpenBSD supports this. As it's present in old libc versions of Linux,
485 * it might return an error that we will silently ignore.
486 */
487 setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, (char *) &one, sizeof(one));
488#endif
Willy Tarreaub1e52e82008-01-13 14:49:51 +0100489#ifdef CONFIG_HAP_LINUX_TPROXY
Willy Tarreauedcf6682008-11-30 23:15:34 +0100490 if ((listener->options & LI_O_FOREIGN)
Willy Tarreau0a459892008-01-13 17:37:16 +0100491 && (setsockopt(fd, SOL_IP, IP_TRANSPARENT, (char *) &one, sizeof(one)) == -1)
492 && (setsockopt(fd, SOL_IP, IP_FREEBIND, (char *) &one, sizeof(one)) == -1)) {
Willy Tarreaub1e52e82008-01-13 14:49:51 +0100493 msg = "cannot make listening socket transparent";
494 err |= ERR_ALERT;
495 }
496#endif
Willy Tarreau5e6e2042009-02-04 17:19:29 +0100497#ifdef SO_BINDTODEVICE
498 /* Note: this might fail if not CAP_NET_RAW */
499 if (listener->interface) {
500 if (setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE,
Willy Tarreau604e8302009-03-06 00:48:23 +0100501 listener->interface, strlen(listener->interface) + 1) == -1) {
Willy Tarreau5e6e2042009-02-04 17:19:29 +0100502 msg = "cannot bind listener to device";
503 err |= ERR_WARN;
504 }
505 }
506#endif
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400507#if defined(TCP_MAXSEG)
Willy Tarreaube1b9182009-06-14 18:48:19 +0200508 if (listener->maxseg) {
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400509 if (setsockopt(fd, IPPROTO_TCP, TCP_MAXSEG,
Willy Tarreaube1b9182009-06-14 18:48:19 +0200510 &listener->maxseg, sizeof(listener->maxseg)) == -1) {
511 msg = "cannot set MSS";
512 err |= ERR_WARN;
513 }
514 }
515#endif
Willy Tarreaucb6cd432009-10-13 07:34:14 +0200516#if defined(TCP_DEFER_ACCEPT)
517 if (listener->options & LI_O_DEF_ACCEPT) {
518 /* defer accept by up to one second */
519 int accept_delay = 1;
520 if (setsockopt(fd, IPPROTO_TCP, TCP_DEFER_ACCEPT, &accept_delay, sizeof(accept_delay)) == -1) {
521 msg = "cannot enable DEFER_ACCEPT";
522 err |= ERR_WARN;
523 }
524 }
525#endif
Willy Tarreaue6b98942007-10-29 01:09:36 +0100526 if (bind(fd, (struct sockaddr *)&listener->addr, listener->proto->sock_addrlen) == -1) {
527 err |= ERR_RETRYABLE | ERR_ALERT;
528 msg = "cannot bind socket";
529 goto tcp_close_return;
530 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100531
Willy Tarreauc73ce2b2008-01-06 10:55:10 +0100532 if (listen(fd, listener->backlog ? listener->backlog : listener->maxconn) == -1) {
Willy Tarreaue6b98942007-10-29 01:09:36 +0100533 err |= ERR_RETRYABLE | ERR_ALERT;
534 msg = "cannot listen to socket";
535 goto tcp_close_return;
536 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100537
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400538#if defined(TCP_QUICKACK)
Willy Tarreau9ea05a72009-06-14 12:07:01 +0200539 if (listener->options & LI_O_NOQUICKACK)
Dmitry Sivachenkocaf58982009-08-24 15:11:06 +0400540 setsockopt(fd, IPPROTO_TCP, TCP_QUICKACK, (char *) &zero, sizeof(zero));
Willy Tarreau9ea05a72009-06-14 12:07:01 +0200541#endif
542
Willy Tarreaue6b98942007-10-29 01:09:36 +0100543 /* the socket is ready */
544 listener->fd = fd;
545 listener->state = LI_LISTEN;
546
Willy Tarreaueabf3132008-08-29 23:36:51 +0200547 fdtab[fd].owner = listener; /* reference the listener instead of a task */
Willy Tarreaue6b98942007-10-29 01:09:36 +0100548 fdtab[fd].state = FD_STLISTEN;
Willy Tarreaueb472682010-05-28 18:46:57 +0200549 fdtab[fd].flags = FD_FL_TCP | ((listener->options & LI_O_NOLINGER) ? FD_FL_TCP_NOLING : 0);
550 fdtab[fd].cb[DIR_RD].f = listener->proto->accept;
551 fdtab[fd].cb[DIR_WR].f = NULL; /* never called */
552 fdtab[fd].cb[DIR_RD].b = fdtab[fd].cb[DIR_WR].b = NULL;
Willy Tarreau5d707e12009-06-28 11:09:07 +0200553
Willy Tarreau8d5d77e2009-10-18 07:25:52 +0200554 fdinfo[fd].peeraddr = NULL;
555 fdinfo[fd].peerlen = 0;
Willy Tarreaueb472682010-05-28 18:46:57 +0200556 fd_insert(fd);
557
Willy Tarreaue6b98942007-10-29 01:09:36 +0100558 tcp_return:
559 if (msg && errlen)
560 strlcpy2(errmsg, msg, errlen);
561 return err;
562
563 tcp_close_return:
564 close(fd);
565 goto tcp_return;
566}
567
568/* This function creates all TCP sockets bound to the protocol entry <proto>.
569 * It is intended to be used as the protocol's bind_all() function.
570 * The sockets will be registered but not added to any fd_set, in order not to
571 * loose them across the fork(). A call to enable_all_listeners() is needed
572 * to complete initialization. The return value is composed from ERR_*.
573 */
574static int tcp_bind_listeners(struct protocol *proto)
575{
576 struct listener *listener;
577 int err = ERR_NONE;
578
579 list_for_each_entry(listener, &proto->listeners, proto_list) {
580 err |= tcp_bind_listener(listener, NULL, 0);
581 if ((err & ERR_CODE) == ERR_ABORT)
582 break;
583 }
584
585 return err;
586}
587
588/* Add listener to the list of tcpv4 listeners. The listener's state
589 * is automatically updated from LI_INIT to LI_ASSIGNED. The number of
590 * listeners is updated. This is the function to use to add a new listener.
591 */
592void tcpv4_add_listener(struct listener *listener)
593{
594 if (listener->state != LI_INIT)
595 return;
596 listener->state = LI_ASSIGNED;
597 listener->proto = &proto_tcpv4;
598 LIST_ADDQ(&proto_tcpv4.listeners, &listener->proto_list);
599 proto_tcpv4.nb_listeners++;
600}
601
602/* Add listener to the list of tcpv4 listeners. The listener's state
603 * is automatically updated from LI_INIT to LI_ASSIGNED. The number of
604 * listeners is updated. This is the function to use to add a new listener.
605 */
606void tcpv6_add_listener(struct listener *listener)
607{
608 if (listener->state != LI_INIT)
609 return;
610 listener->state = LI_ASSIGNED;
611 listener->proto = &proto_tcpv6;
612 LIST_ADDQ(&proto_tcpv6.listeners, &listener->proto_list);
613 proto_tcpv6.nb_listeners++;
614}
615
Willy Tarreauedcf6682008-11-30 23:15:34 +0100616/* This function performs the TCP request analysis on the current request. It
617 * returns 1 if the processing can continue on next analysers, or zero if it
618 * needs more data, encounters an error, or wants to immediately abort the
Willy Tarreaufb356202010-08-03 14:02:05 +0200619 * request. It relies on buffers flags, and updates s->req->analysers. The
620 * function may be called for frontend rules and backend rules. It only relies
621 * on the backend pointer so this works for both cases.
Willy Tarreauedcf6682008-11-30 23:15:34 +0100622 */
Willy Tarreau3a816292009-07-07 10:55:49 +0200623int tcp_inspect_request(struct session *s, struct buffer *req, int an_bit)
Willy Tarreauedcf6682008-11-30 23:15:34 +0100624{
625 struct tcp_rule *rule;
Willy Tarreaud1f96522010-08-03 19:34:32 +0200626 struct stksess *ts;
627 struct stktable *t;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100628 int partial;
629
630 DPRINTF(stderr,"[%u] %s: session=%p b=%p, exp(r,w)=%u,%u bf=%08x bl=%d analysers=%02x\n",
631 now_ms, __FUNCTION__,
632 s,
633 req,
634 req->rex, req->wex,
635 req->flags,
636 req->l,
637 req->analysers);
638
Willy Tarreauedcf6682008-11-30 23:15:34 +0100639 /* We don't know whether we have enough data, so must proceed
640 * this way :
641 * - iterate through all rules in their declaration order
642 * - if one rule returns MISS, it means the inspect delay is
643 * not over yet, then return immediately, otherwise consider
644 * it as a non-match.
645 * - if one rule returns OK, then return OK
646 * - if one rule returns KO, then return KO
647 */
648
Willy Tarreaub824b002010-09-29 16:36:16 +0200649 if (req->flags & (BF_SHUTR|BF_FULL) || !s->be->tcp_req.inspect_delay || tick_is_expired(req->analyse_exp, now_ms))
Willy Tarreauedcf6682008-11-30 23:15:34 +0100650 partial = 0;
651 else
652 partial = ACL_PARTIAL;
653
Willy Tarreaufb356202010-08-03 14:02:05 +0200654 list_for_each_entry(rule, &s->be->tcp_req.inspect_rules, list) {
Willy Tarreauedcf6682008-11-30 23:15:34 +0100655 int ret = ACL_PAT_PASS;
656
657 if (rule->cond) {
Willy Tarreaufb356202010-08-03 14:02:05 +0200658 ret = acl_exec_cond(rule->cond, s->be, s, &s->txn, ACL_DIR_REQ | partial);
Willy Tarreauedcf6682008-11-30 23:15:34 +0100659 if (ret == ACL_PAT_MISS) {
Willy Tarreau520d95e2009-09-19 21:04:57 +0200660 buffer_dont_connect(req);
Willy Tarreauedcf6682008-11-30 23:15:34 +0100661 /* just set the request timeout once at the beginning of the request */
Willy Tarreaufb356202010-08-03 14:02:05 +0200662 if (!tick_isset(req->analyse_exp) && s->be->tcp_req.inspect_delay)
663 req->analyse_exp = tick_add_ifset(now_ms, s->be->tcp_req.inspect_delay);
Willy Tarreauedcf6682008-11-30 23:15:34 +0100664 return 0;
665 }
666
667 ret = acl_pass(ret);
668 if (rule->cond->pol == ACL_COND_UNLESS)
669 ret = !ret;
670 }
671
672 if (ret) {
673 /* we have a matching rule. */
674 if (rule->action == TCP_ACT_REJECT) {
675 buffer_abort(req);
676 buffer_abort(s->rep);
677 req->analysers = 0;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +0200678
Willy Tarreaufb356202010-08-03 14:02:05 +0200679 s->be->counters.denied_req++;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +0200680 if (s->listener->counters)
Willy Tarreau23968d82010-05-23 23:50:44 +0200681 s->listener->counters->denied_req++;
Krzysztof Piotr Oledzkiaeebf9b2009-10-04 15:43:17 +0200682
Willy Tarreauedcf6682008-11-30 23:15:34 +0100683 if (!(s->flags & SN_ERR_MASK))
684 s->flags |= SN_ERR_PRXCOND;
685 if (!(s->flags & SN_FINST_MASK))
686 s->flags |= SN_FINST_R;
687 return 0;
688 }
Willy Tarreau56123282010-08-06 19:06:56 +0200689 else if (rule->action == TCP_ACT_TRK_SC1) {
690 if (!s->stkctr1_entry) {
691 /* only the first valid track-sc1 directive applies.
Willy Tarreaud1f96522010-08-03 19:34:32 +0200692 * Also, note that right now we can only track SRC so we
693 * don't check how to get the key, but later we may need
694 * to consider rule->act_prm->trk_ctr.type.
695 */
696 t = rule->act_prm.trk_ctr.table.t;
697 ts = stktable_get_entry(t, tcpv4_src_to_stktable_key(s));
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200698 if (ts) {
Willy Tarreau56123282010-08-06 19:06:56 +0200699 session_track_stkctr1(s, t, ts);
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200700 if (s->fe != s->be)
701 s->flags |= SN_BE_TRACK_SC1;
702 }
Willy Tarreaud1f96522010-08-03 19:34:32 +0200703 }
704 }
Willy Tarreau56123282010-08-06 19:06:56 +0200705 else if (rule->action == TCP_ACT_TRK_SC2) {
706 if (!s->stkctr2_entry) {
707 /* only the first valid track-sc2 directive applies.
Willy Tarreaud1f96522010-08-03 19:34:32 +0200708 * Also, note that right now we can only track SRC so we
709 * don't check how to get the key, but later we may need
710 * to consider rule->act_prm->trk_ctr.type.
711 */
712 t = rule->act_prm.trk_ctr.table.t;
713 ts = stktable_get_entry(t, tcpv4_src_to_stktable_key(s));
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200714 if (ts) {
Willy Tarreau56123282010-08-06 19:06:56 +0200715 session_track_stkctr2(s, t, ts);
Willy Tarreau0a4838c2010-08-06 20:11:05 +0200716 if (s->fe != s->be)
717 s->flags |= SN_BE_TRACK_SC2;
718 }
Willy Tarreaud1f96522010-08-03 19:34:32 +0200719 }
720 }
721 else {
Willy Tarreauedcf6682008-11-30 23:15:34 +0100722 /* otherwise accept */
Willy Tarreaud1f96522010-08-03 19:34:32 +0200723 break;
724 }
Willy Tarreauedcf6682008-11-30 23:15:34 +0100725 }
726 }
727
728 /* if we get there, it means we have no rule which matches, or
729 * we have an explicit accept, so we apply the default accept.
730 */
Willy Tarreau3a816292009-07-07 10:55:49 +0200731 req->analysers &= ~an_bit;
Willy Tarreauedcf6682008-11-30 23:15:34 +0100732 req->analyse_exp = TICK_ETERNITY;
733 return 1;
734}
735
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200736/* This function performs the TCP layer4 analysis on the current request. It
737 * returns 0 if a reject rule matches, otherwise 1 if either an accept rule
738 * matches or if no more rule matches. It can only use rules which don't need
739 * any data.
740 */
741int tcp_exec_req_rules(struct session *s)
742{
743 struct tcp_rule *rule;
Willy Tarreauf059a0f2010-08-03 16:29:52 +0200744 struct stksess *ts;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200745 struct stktable *t = NULL;
746 int result = 1;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200747 int ret;
748
749 list_for_each_entry(rule, &s->fe->tcp_req.l4_rules, list) {
750 ret = ACL_PAT_PASS;
751
752 if (rule->cond) {
753 ret = acl_exec_cond(rule->cond, s->fe, s, NULL, ACL_DIR_REQ);
754 ret = acl_pass(ret);
755 if (rule->cond->pol == ACL_COND_UNLESS)
756 ret = !ret;
757 }
758
759 if (ret) {
760 /* we have a matching rule. */
761 if (rule->action == TCP_ACT_REJECT) {
Willy Tarreau2799e982010-06-05 15:43:21 +0200762 s->fe->counters.denied_conn++;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200763 if (s->listener->counters)
Willy Tarreau2799e982010-06-05 15:43:21 +0200764 s->listener->counters->denied_conn++;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200765
766 if (!(s->flags & SN_ERR_MASK))
767 s->flags |= SN_ERR_PRXCOND;
768 if (!(s->flags & SN_FINST_MASK))
769 s->flags |= SN_FINST_R;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200770 result = 0;
771 break;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200772 }
Willy Tarreau56123282010-08-06 19:06:56 +0200773 else if (rule->action == TCP_ACT_TRK_SC1) {
774 if (!s->stkctr1_entry) {
775 /* only the first valid track-sc1 directive applies.
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200776 * Also, note that right now we can only track SRC so we
777 * don't check how to get the key, but later we may need
778 * to consider rule->act_prm->trk_ctr.type.
779 */
780 t = rule->act_prm.trk_ctr.table.t;
781 ts = stktable_get_entry(t, tcpv4_src_to_stktable_key(s));
782 if (ts)
Willy Tarreau56123282010-08-06 19:06:56 +0200783 session_track_stkctr1(s, t, ts);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200784 }
785 }
Willy Tarreau56123282010-08-06 19:06:56 +0200786 else if (rule->action == TCP_ACT_TRK_SC2) {
787 if (!s->stkctr2_entry) {
788 /* only the first valid track-sc2 directive applies.
Willy Tarreauf059a0f2010-08-03 16:29:52 +0200789 * Also, note that right now we can only track SRC so we
790 * don't check how to get the key, but later we may need
791 * to consider rule->act_prm->trk_ctr.type.
792 */
793 t = rule->act_prm.trk_ctr.table.t;
794 ts = stktable_get_entry(t, tcpv4_src_to_stktable_key(s));
795 if (ts)
Willy Tarreau56123282010-08-06 19:06:56 +0200796 session_track_stkctr2(s, t, ts);
Willy Tarreauf059a0f2010-08-03 16:29:52 +0200797 }
798 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200799 else {
800 /* otherwise it's an accept */
801 break;
802 }
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200803 }
804 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200805 return result;
Willy Tarreaua5c0ab22010-05-31 10:30:33 +0200806}
807
Willy Tarreau68c03ab2010-08-06 15:08:45 +0200808/* Parse a tcp-request rule. Return a negative value in case of failure */
809static int tcp_parse_request_rule(char **args, int arg, int section_type,
810 struct proxy *curpx, struct proxy *defpx,
811 struct tcp_rule *rule, char *err, int errlen)
812{
813 if (curpx == defpx) {
814 snprintf(err, errlen, "%s %s is not allowed in 'defaults' sections",
815 args[0], args[1]);
816 return -1;
817 }
818
819 if (!strcmp(args[arg], "accept")) {
820 arg++;
821 rule->action = TCP_ACT_ACCEPT;
822 }
823 else if (!strcmp(args[arg], "reject")) {
824 arg++;
825 rule->action = TCP_ACT_REJECT;
826 }
Willy Tarreau56123282010-08-06 19:06:56 +0200827 else if (strcmp(args[arg], "track-sc1") == 0) {
Willy Tarreau68c03ab2010-08-06 15:08:45 +0200828 int ret;
829
830 arg++;
831 ret = parse_track_counters(args, &arg, section_type, curpx,
832 &rule->act_prm.trk_ctr, defpx, err, errlen);
833
834 if (ret < 0) /* nb: warnings are not handled yet */
835 return -1;
836
Willy Tarreau56123282010-08-06 19:06:56 +0200837 rule->action = TCP_ACT_TRK_SC1;
Willy Tarreau68c03ab2010-08-06 15:08:45 +0200838 }
Willy Tarreau56123282010-08-06 19:06:56 +0200839 else if (strcmp(args[arg], "track-sc2") == 0) {
Willy Tarreau68c03ab2010-08-06 15:08:45 +0200840 int ret;
841
842 arg++;
843 ret = parse_track_counters(args, &arg, section_type, curpx,
844 &rule->act_prm.trk_ctr, defpx, err, errlen);
845
846 if (ret < 0) /* nb: warnings are not handled yet */
847 return -1;
848
Willy Tarreau56123282010-08-06 19:06:56 +0200849 rule->action = TCP_ACT_TRK_SC2;
Willy Tarreau68c03ab2010-08-06 15:08:45 +0200850 }
851 else {
852 snprintf(err, errlen,
Willy Tarreau56123282010-08-06 19:06:56 +0200853 "'%s %s' expects 'accept', 'reject', 'track-sc1' "
854 "or 'track-sc2' in %s '%s' (was '%s')",
Willy Tarreau68c03ab2010-08-06 15:08:45 +0200855 args[0], args[1], proxy_type_str(curpx), curpx->id, args[arg]);
856 return -1;
857 }
858
859 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
860 if ((rule->cond = build_acl_cond(NULL, 0, curpx, (const char **)args+arg)) == NULL) {
861 snprintf(err, errlen,
862 "error detected in %s '%s' while parsing '%s' condition",
863 proxy_type_str(curpx), curpx->id, args[arg]);
864 return -1;
865 }
866 }
867 else if (*args[arg]) {
868 snprintf(err, errlen,
869 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (was '%s')",
870 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
871 return -1;
872 }
873 return 0;
874}
875
Willy Tarreaub6866442008-07-14 23:54:42 +0200876/* This function should be called to parse a line starting with the "tcp-request"
877 * keyword.
878 */
879static int tcp_parse_tcp_req(char **args, int section_type, struct proxy *curpx,
880 struct proxy *defpx, char *err, int errlen)
881{
882 const char *ptr = NULL;
Willy Tarreauc7e961e2008-08-17 17:13:47 +0200883 unsigned int val;
Willy Tarreaub6866442008-07-14 23:54:42 +0200884 int retlen;
Willy Tarreau1a687942010-05-23 22:40:30 +0200885 int warn = 0;
Willy Tarreau6a984fa2010-06-14 16:44:27 +0200886 int arg;
Willy Tarreau1a687942010-05-23 22:40:30 +0200887 struct tcp_rule *rule;
Willy Tarreaub6866442008-07-14 23:54:42 +0200888
889 if (!*args[1]) {
890 snprintf(err, errlen, "missing argument for '%s' in %s '%s'",
Willy Tarreauf5356832010-06-14 18:40:26 +0200891 args[0], proxy_type_str(curpx), curpx->id);
Willy Tarreaub6866442008-07-14 23:54:42 +0200892 return -1;
893 }
894
895 if (!strcmp(args[1], "inspect-delay")) {
896 if (curpx == defpx) {
897 snprintf(err, errlen, "%s %s is not allowed in 'defaults' sections",
898 args[0], args[1]);
899 return -1;
900 }
901
Willy Tarreaub6866442008-07-14 23:54:42 +0200902 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
903 retlen = snprintf(err, errlen,
904 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
Willy Tarreauf5356832010-06-14 18:40:26 +0200905 args[0], args[1], proxy_type_str(curpx), curpx->id);
Willy Tarreaub6866442008-07-14 23:54:42 +0200906 if (ptr && retlen < errlen)
907 retlen += snprintf(err+retlen, errlen - retlen,
908 " (unexpected character '%c')", *ptr);
909 return -1;
910 }
911
912 if (curpx->tcp_req.inspect_delay) {
913 snprintf(err, errlen, "ignoring %s %s (was already defined) in %s '%s'",
Willy Tarreauf5356832010-06-14 18:40:26 +0200914 args[0], args[1], proxy_type_str(curpx), curpx->id);
Willy Tarreaub6866442008-07-14 23:54:42 +0200915 return 1;
916 }
917 curpx->tcp_req.inspect_delay = val;
918 return 0;
919 }
920
Willy Tarreau6a984fa2010-06-14 16:44:27 +0200921 rule = (struct tcp_rule *)calloc(1, sizeof(*rule));
Willy Tarreaufb024dc2010-08-20 13:35:41 +0200922 LIST_INIT(&rule->list);
Willy Tarreau6a984fa2010-06-14 16:44:27 +0200923 arg = 1;
924
Willy Tarreau68c03ab2010-08-06 15:08:45 +0200925 if (strcmp(args[1], "content") == 0) {
Willy Tarreaud1f96522010-08-03 19:34:32 +0200926 arg++;
Willy Tarreau68c03ab2010-08-06 15:08:45 +0200927 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, errlen) < 0)
Willy Tarreau6a984fa2010-06-14 16:44:27 +0200928 goto error;
Willy Tarreaub6866442008-07-14 23:54:42 +0200929
Willy Tarreau6a984fa2010-06-14 16:44:27 +0200930 if (rule->cond && (rule->cond->requires & ACL_USE_RTR_ANY)) {
Willy Tarreaudd64f8d2008-07-27 22:02:32 +0200931 struct acl *acl;
932 const char *name;
933
Willy Tarreau6a984fa2010-06-14 16:44:27 +0200934 acl = cond_find_require(rule->cond, ACL_USE_RTR_ANY);
Willy Tarreaudd64f8d2008-07-27 22:02:32 +0200935 name = acl ? acl->name : "(unknown)";
936
937 retlen = snprintf(err, errlen,
Willy Tarreau1a211942009-07-14 13:53:17 +0200938 "acl '%s' involves some response-only criteria which will be ignored.",
939 name);
Willy Tarreaudd64f8d2008-07-27 22:02:32 +0200940 warn++;
941 }
Willy Tarreaufb024dc2010-08-20 13:35:41 +0200942 LIST_ADDQ(&curpx->tcp_req.inspect_rules, &rule->list);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200943 }
Willy Tarreau68c03ab2010-08-06 15:08:45 +0200944 else if (strcmp(args[1], "connection") == 0) {
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200945 arg++;
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200946
Willy Tarreau68c03ab2010-08-06 15:08:45 +0200947 if (!(curpx->cap & PR_CAP_FE)) {
948 snprintf(err, errlen, "%s %s is not allowed because %s %s is not a frontend",
949 args[0], args[1], proxy_type_str(curpx), curpx->id);
950 return -1;
951 }
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200952
Willy Tarreau68c03ab2010-08-06 15:08:45 +0200953 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, errlen) < 0)
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200954 goto error;
955
Willy Tarreau68c03ab2010-08-06 15:08:45 +0200956 if (rule->cond && (rule->cond->requires & (ACL_USE_RTR_ANY|ACL_USE_L6_ANY|ACL_USE_L7_ANY))) {
957 struct acl *acl;
958 const char *name;
Willy Tarreauf059a0f2010-08-03 16:29:52 +0200959
Willy Tarreau68c03ab2010-08-06 15:08:45 +0200960 acl = cond_find_require(rule->cond, ACL_USE_RTR_ANY|ACL_USE_L6_ANY|ACL_USE_L7_ANY);
961 name = acl ? acl->name : "(unknown)";
Willy Tarreauf059a0f2010-08-03 16:29:52 +0200962
Willy Tarreau68c03ab2010-08-06 15:08:45 +0200963 if (acl->requires & (ACL_USE_L6_ANY|ACL_USE_L7_ANY)) {
964 retlen = snprintf(err, errlen,
965 "'%s %s' may not reference acl '%s' which makes use of "
966 "payload in %s '%s'. Please use '%s content' for this.",
967 args[0], args[1], name, proxy_type_str(curpx), curpx->id, args[0]);
968 goto error;
969 }
970 if (acl->requires & ACL_USE_RTR_ANY)
971 retlen = snprintf(err, errlen,
972 "acl '%s' involves some response-only criteria which will be ignored.",
973 name);
974 warn++;
975 }
Willy Tarreaufb024dc2010-08-20 13:35:41 +0200976 LIST_ADDQ(&curpx->tcp_req.l4_rules, &rule->list);
Willy Tarreau9ba2dcc2010-06-14 21:04:55 +0200977 }
Willy Tarreau1a687942010-05-23 22:40:30 +0200978 else {
979 retlen = snprintf(err, errlen,
Willy Tarreau68c03ab2010-08-06 15:08:45 +0200980 "'%s' expects 'inspect-delay', 'connection', or 'content' in %s '%s' (was '%s')",
Willy Tarreau1a687942010-05-23 22:40:30 +0200981 args[0], proxy_type_str(curpx), curpx->id, args[1]);
Willy Tarreau6a984fa2010-06-14 16:44:27 +0200982 goto error;
Willy Tarreau1a687942010-05-23 22:40:30 +0200983 }
984
Willy Tarreau1a687942010-05-23 22:40:30 +0200985 return warn;
Willy Tarreau6a984fa2010-06-14 16:44:27 +0200986 error:
987 free(rule);
988 return -1;
Willy Tarreaub6866442008-07-14 23:54:42 +0200989}
990
Willy Tarreau645513a2010-05-24 20:55:15 +0200991
992/************************************************************************/
993/* All supported ACL keywords must be declared here. */
994/************************************************************************/
995
996/* set test->ptr to point to the source IPv4/IPv6 address and test->i to the family */
997static int
998acl_fetch_src(struct proxy *px, struct session *l4, void *l7, int dir,
999 struct acl_expr *expr, struct acl_test *test)
1000{
1001 test->i = l4->cli_addr.ss_family;
1002 if (test->i == AF_INET)
1003 test->ptr = (void *)&((struct sockaddr_in *)&l4->cli_addr)->sin_addr;
1004 else
1005 test->ptr = (void *)&((struct sockaddr_in6 *)(&l4->cli_addr))->sin6_addr;
1006 test->flags = ACL_TEST_F_READ_ONLY;
1007 return 1;
1008}
1009
1010/* extract the connection's source address */
1011static int
1012pattern_fetch_src(struct proxy *px, struct session *l4, void *l7, int dir,
1013 const char *arg, int arg_len, union pattern_data *data)
1014{
1015 data->ip.s_addr = ((struct sockaddr_in *)&l4->cli_addr)->sin_addr.s_addr;
1016 return 1;
1017}
1018
1019
1020/* set test->i to the connection's source port */
1021static int
1022acl_fetch_sport(struct proxy *px, struct session *l4, void *l7, int dir,
1023 struct acl_expr *expr, struct acl_test *test)
1024{
1025 if (l4->cli_addr.ss_family == AF_INET)
1026 test->i = ntohs(((struct sockaddr_in *)&l4->cli_addr)->sin_port);
1027 else
1028 test->i = ntohs(((struct sockaddr_in6 *)(&l4->cli_addr))->sin6_port);
1029 test->flags = 0;
1030 return 1;
1031}
1032
1033
1034/* set test->ptr to point to the frontend's IPv4/IPv6 address and test->i to the family */
1035static int
1036acl_fetch_dst(struct proxy *px, struct session *l4, void *l7, int dir,
1037 struct acl_expr *expr, struct acl_test *test)
1038{
1039 if (!(l4->flags & SN_FRT_ADDR_SET))
1040 get_frt_addr(l4);
1041
1042 test->i = l4->frt_addr.ss_family;
1043 if (test->i == AF_INET)
1044 test->ptr = (void *)&((struct sockaddr_in *)&l4->frt_addr)->sin_addr;
1045 else
1046 test->ptr = (void *)&((struct sockaddr_in6 *)(&l4->frt_addr))->sin6_addr;
1047 test->flags = ACL_TEST_F_READ_ONLY;
1048 return 1;
1049}
1050
1051
1052/* extract the connection's destination address */
1053static int
1054pattern_fetch_dst(struct proxy *px, struct session *l4, void *l7, int dir,
1055 const char *arg, int arg_len, union pattern_data *data)
1056{
emeric8aa6b372010-10-22 17:06:26 +02001057 if (!(l4->flags & SN_FRT_ADDR_SET))
1058 get_frt_addr(l4);
1059
Willy Tarreau645513a2010-05-24 20:55:15 +02001060 data->ip.s_addr = ((struct sockaddr_in *)&l4->frt_addr)->sin_addr.s_addr;
1061 return 1;
1062}
1063
1064/* set test->i to the frontend connexion's destination port */
1065static int
1066acl_fetch_dport(struct proxy *px, struct session *l4, void *l7, int dir,
1067 struct acl_expr *expr, struct acl_test *test)
1068{
1069 if (!(l4->flags & SN_FRT_ADDR_SET))
1070 get_frt_addr(l4);
1071
1072 if (l4->frt_addr.ss_family == AF_INET)
1073 test->i = ntohs(((struct sockaddr_in *)&l4->frt_addr)->sin_port);
1074 else
1075 test->i = ntohs(((struct sockaddr_in6 *)(&l4->frt_addr))->sin6_port);
1076 test->flags = 0;
1077 return 1;
1078}
1079
1080static int
1081pattern_fetch_dport(struct proxy *px, struct session *l4, void *l7, int dir,
1082 const char *arg, int arg_len, union pattern_data *data)
1083
1084{
emeric8aa6b372010-10-22 17:06:26 +02001085 if (!(l4->flags & SN_FRT_ADDR_SET))
1086 get_frt_addr(l4);
1087
Willy Tarreau645513a2010-05-24 20:55:15 +02001088 data->integer = ntohs(((struct sockaddr_in *)&l4->frt_addr)->sin_port);
1089 return 1;
1090}
1091
Willy Tarreaub6866442008-07-14 23:54:42 +02001092static struct cfg_kw_list cfg_kws = {{ },{
1093 { CFG_LISTEN, "tcp-request", tcp_parse_tcp_req },
1094 { 0, NULL, NULL },
1095}};
1096
Willy Tarreau645513a2010-05-24 20:55:15 +02001097/* Note: must not be declared <const> as its list will be overwritten */
Willy Tarreaub6866442008-07-14 23:54:42 +02001098static struct acl_kw_list acl_kws = {{ },{
Willy Tarreau645513a2010-05-24 20:55:15 +02001099 { "src_port", acl_parse_int, acl_fetch_sport, acl_match_int, ACL_USE_TCP_PERMANENT },
1100 { "src", acl_parse_ip, acl_fetch_src, acl_match_ip, ACL_USE_TCP4_PERMANENT|ACL_MAY_LOOKUP },
1101 { "dst", acl_parse_ip, acl_fetch_dst, acl_match_ip, ACL_USE_TCP4_PERMANENT|ACL_MAY_LOOKUP },
1102 { "dst_port", acl_parse_int, acl_fetch_dport, acl_match_int, ACL_USE_TCP_PERMANENT },
Willy Tarreaub6866442008-07-14 23:54:42 +02001103 { NULL, NULL, NULL, NULL },
1104}};
1105
Willy Tarreau645513a2010-05-24 20:55:15 +02001106/* Note: must not be declared <const> as its list will be overwritten */
1107static struct pattern_fetch_kw_list pattern_fetch_keywords = {{ },{
1108 { "src", pattern_fetch_src, PATTERN_TYPE_IP, PATTERN_FETCH_REQ },
1109 { "dst", pattern_fetch_dst, PATTERN_TYPE_IP, PATTERN_FETCH_REQ },
1110 { "dst_port", pattern_fetch_dport, PATTERN_TYPE_INTEGER, PATTERN_FETCH_REQ },
1111 { NULL, NULL, 0, 0 },
1112}};
1113
Willy Tarreaue6b98942007-10-29 01:09:36 +01001114__attribute__((constructor))
1115static void __tcp_protocol_init(void)
1116{
1117 protocol_register(&proto_tcpv4);
1118 protocol_register(&proto_tcpv6);
Willy Tarreau645513a2010-05-24 20:55:15 +02001119 pattern_register_fetches(&pattern_fetch_keywords);
Willy Tarreaub6866442008-07-14 23:54:42 +02001120 cfg_register_keywords(&cfg_kws);
1121 acl_register_keywords(&acl_kws);
Willy Tarreaue6b98942007-10-29 01:09:36 +01001122}
1123
1124
1125/*
1126 * Local variables:
1127 * c-indent-level: 8
1128 * c-basic-offset: 8
1129 * End:
1130 */