blob: 48d7a64de37fed84539c322f063faaf4e5682c10 [file] [log] [blame]
Willy Tarreau59f98392012-07-06 14:13:49 +02001/*
2 * Connection management functions
3 *
4 * Copyright 2000-2012 Willy Tarreau <w@1wt.eu>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
Willy Tarreaue1e4a612012-10-05 00:10:55 +020013#include <errno.h>
14
Willy Tarreau59f98392012-07-06 14:13:49 +020015#include <common/compat.h>
16#include <common/config.h>
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +010017#include <common/namespace.h>
Willy Tarreau59f98392012-07-06 14:13:49 +020018
Willy Tarreauc5788912012-08-24 18:12:41 +020019#include <proto/connection.h>
Willy Tarreaudd2f85e2012-09-02 22:34:23 +020020#include <proto/fd.h>
Willy Tarreau5f1504f2012-10-04 23:55:57 +020021#include <proto/frontend.h>
Willy Tarreau2da156f2012-07-23 15:07:23 +020022#include <proto/proto_tcp.h>
Willy Tarreau2c6be842012-07-06 17:12:34 +020023#include <proto/stream_interface.h>
Emeric Brun4f603012017-01-05 15:11:44 +010024#include <proto/sample.h>
Willy Tarreau59f98392012-07-06 14:13:49 +020025
Emeric Brun46591952012-05-18 15:47:34 +020026#ifdef USE_OPENSSL
27#include <proto/ssl_sock.h>
28#endif
29
Willy Tarreaubafbe012017-11-24 17:34:44 +010030struct pool_head *pool_head_connection;
31struct pool_head *pool_head_connstream;
Willy Tarreau13e14102016-12-22 20:25:26 +010032struct xprt_ops *registered_xprt[XPRT_ENTRIES] = { NULL, };
Willy Tarreauf2943dc2012-10-26 20:10:28 +020033
Willy Tarreau2386be62017-09-21 19:40:52 +020034/* List head of all known muxes for ALPN */
35struct alpn_mux_list alpn_mux_list = {
36 .list = LIST_HEAD_INIT(alpn_mux_list.list)
37};
38
Willy Tarreauf2943dc2012-10-26 20:10:28 +020039/* perform minimal intializations, report 0 in case of error, 1 if OK. */
40int init_connection()
41{
Willy Tarreaubafbe012017-11-24 17:34:44 +010042 pool_head_connection = create_pool("connection", sizeof (struct connection), MEM_F_SHARED);
43 if (!pool_head_connection)
Olivier Houcharde2b40b92017-09-13 18:30:23 +020044 goto fail_conn;
45
Willy Tarreaubafbe012017-11-24 17:34:44 +010046 pool_head_connstream = create_pool("conn_stream", sizeof(struct conn_stream), MEM_F_SHARED);
47 if (!pool_head_connstream)
Olivier Houcharde2b40b92017-09-13 18:30:23 +020048 goto fail_cs;
49
50 return 1;
51 fail_cs:
Willy Tarreaubafbe012017-11-24 17:34:44 +010052 pool_destroy(pool_head_connection);
53 pool_head_connection = NULL;
Olivier Houcharde2b40b92017-09-13 18:30:23 +020054 fail_conn:
55 return 0;
Willy Tarreauf2943dc2012-10-26 20:10:28 +020056}
57
Willy Tarreau59f98392012-07-06 14:13:49 +020058/* I/O callback for fd-based connections. It calls the read/write handlers
Willy Tarreau7a798e52016-04-14 11:13:20 +020059 * provided by the connection's sock_ops, which must be valid.
Willy Tarreau59f98392012-07-06 14:13:49 +020060 */
Willy Tarreau7a798e52016-04-14 11:13:20 +020061void conn_fd_handler(int fd)
Willy Tarreau59f98392012-07-06 14:13:49 +020062{
Willy Tarreau80184712012-07-06 14:54:49 +020063 struct connection *conn = fdtab[fd].owner;
Willy Tarreau9e272bf2012-10-03 21:04:48 +020064 unsigned int flags;
Willy Tarreau59f98392012-07-06 14:13:49 +020065
Willy Tarreaud80cb4e2018-01-20 19:30:13 +010066 if (unlikely(!conn)) {
67 activity[tid].conn_dead++;
Willy Tarreau7a798e52016-04-14 11:13:20 +020068 return;
Willy Tarreaud80cb4e2018-01-20 19:30:13 +010069 }
Willy Tarreau59f98392012-07-06 14:13:49 +020070
Willy Tarreau7d281492012-12-16 19:19:13 +010071 conn_refresh_polling_flags(conn);
Willy Tarreau916e12d2017-10-25 09:22:43 +020072 conn->flags |= CO_FL_WILL_UPDATE;
73
Willy Tarreau7d281492012-12-16 19:19:13 +010074 flags = conn->flags & ~CO_FL_ERROR; /* ensure to call the wake handler upon error */
Willy Tarreaud29a0662012-12-10 16:33:38 +010075
Willy Tarreauc76ae332012-07-12 15:32:13 +020076 process_handshake:
Willy Tarreauf9dabec2012-08-17 17:33:53 +020077 /* The handshake callbacks are called in sequence. If either of them is
78 * missing something, it must enable the required polling at the socket
79 * layer of the connection. Polling state is not guaranteed when entering
80 * these handlers, so any handshake handler which does not complete its
Willy Tarreaud6e999b2013-11-25 08:41:15 +010081 * work must explicitly disable events it's not interested in. Error
82 * handling is also performed here in order to reduce the number of tests
83 * around.
Willy Tarreauf9dabec2012-08-17 17:33:53 +020084 */
Willy Tarreaud6e999b2013-11-25 08:41:15 +010085 while (unlikely(conn->flags & (CO_FL_HANDSHAKE | CO_FL_ERROR))) {
Willy Tarreau310987a2014-01-22 19:46:33 +010086 if (unlikely(conn->flags & CO_FL_ERROR))
Willy Tarreau2c6be842012-07-06 17:12:34 +020087 goto leave;
Willy Tarreau59f98392012-07-06 14:13:49 +020088
Bertrand Jacquin93b227d2016-06-04 15:11:10 +010089 if (conn->flags & CO_FL_ACCEPT_CIP)
90 if (!conn_recv_netscaler_cip(conn, CO_FL_ACCEPT_CIP))
91 goto leave;
92
Willy Tarreau22cda212012-08-31 17:43:29 +020093 if (conn->flags & CO_FL_ACCEPT_PROXY)
94 if (!conn_recv_proxy(conn, CO_FL_ACCEPT_PROXY))
95 goto leave;
96
Willy Tarreau57cd3e42013-10-24 22:01:26 +020097 if (conn->flags & CO_FL_SEND_PROXY)
98 if (!conn_si_send_proxy(conn, CO_FL_SEND_PROXY))
Willy Tarreau5f1504f2012-10-04 23:55:57 +020099 goto leave;
Emeric Brun46591952012-05-18 15:47:34 +0200100#ifdef USE_OPENSSL
101 if (conn->flags & CO_FL_SSL_WAIT_HS)
102 if (!ssl_sock_handshake(conn, CO_FL_SSL_WAIT_HS))
103 goto leave;
104#endif
Willy Tarreauc76ae332012-07-12 15:32:13 +0200105 }
106
Willy Tarreauf9dabec2012-08-17 17:33:53 +0200107 /* Once we're purely in the data phase, we disable handshake polling */
108 if (!(conn->flags & CO_FL_POLL_SOCK))
109 __conn_sock_stop_both(conn);
Willy Tarreauc76ae332012-07-12 15:32:13 +0200110
Willy Tarreau8e3c6ce2017-08-28 15:46:01 +0200111 /* The connection owner might want to be notified about an end of
112 * handshake indicating the connection is ready, before we proceed with
113 * any data exchange. The callback may fail and cause the connection to
114 * be destroyed, thus we must not use it anymore and should immediately
115 * leave instead. The caller must immediately unregister itself once
116 * called.
Willy Tarreau2542b532012-08-31 16:01:23 +0200117 */
Willy Tarreau8e3c6ce2017-08-28 15:46:01 +0200118 if (conn->xprt_done_cb && conn->xprt_done_cb(conn) < 0)
Willy Tarreau7a798e52016-04-14 11:13:20 +0200119 return;
Willy Tarreau2542b532012-08-31 16:01:23 +0200120
Willy Tarreau57ec32f2017-04-11 19:59:33 +0200121 if (conn->xprt && fd_send_ready(fd) &&
Olivier Houchard1a0545f2017-09-13 18:30:23 +0200122 ((conn->flags & (CO_FL_XPRT_WR_ENA|CO_FL_ERROR|CO_FL_HANDSHAKE)) == CO_FL_XPRT_WR_ENA)) {
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100123 /* force reporting of activity by clearing the previous flags :
124 * we'll have at least ERROR or CONNECTED at the end of an I/O,
125 * both of which will be detected below.
Willy Tarreau9e272bf2012-10-03 21:04:48 +0200126 */
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100127 flags = 0;
Willy Tarreau53a47662017-08-28 10:53:00 +0200128 conn->mux->send(conn);
Willy Tarreau9e272bf2012-10-03 21:04:48 +0200129 }
Willy Tarreau59f98392012-07-06 14:13:49 +0200130
Willy Tarreau57ec32f2017-04-11 19:59:33 +0200131 /* The data transfer starts here and stops on error and handshakes. Note
132 * that we must absolutely test conn->xprt at each step in case it suddenly
133 * changes due to a quick unexpected close().
134 */
135 if (conn->xprt && fd_recv_ready(fd) &&
Olivier Houchard1a0545f2017-09-13 18:30:23 +0200136 ((conn->flags & (CO_FL_XPRT_RD_ENA|CO_FL_WAIT_ROOM|CO_FL_ERROR|CO_FL_HANDSHAKE)) == CO_FL_XPRT_RD_ENA)) {
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100137 /* force reporting of activity by clearing the previous flags :
138 * we'll have at least ERROR or CONNECTED at the end of an I/O,
139 * both of which will be detected below.
Willy Tarreau9e272bf2012-10-03 21:04:48 +0200140 */
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100141 flags = 0;
Willy Tarreau53a47662017-08-28 10:53:00 +0200142 conn->mux->recv(conn);
Willy Tarreau9e272bf2012-10-03 21:04:48 +0200143 }
Willy Tarreau2da156f2012-07-23 15:07:23 +0200144
Willy Tarreauc76ae332012-07-12 15:32:13 +0200145 /* It may happen during the data phase that a handshake is
146 * enabled again (eg: SSL)
147 */
Willy Tarreaud6e999b2013-11-25 08:41:15 +0100148 if (unlikely(conn->flags & (CO_FL_HANDSHAKE | CO_FL_ERROR)))
Willy Tarreauc76ae332012-07-12 15:32:13 +0200149 goto process_handshake;
150
Willy Tarreaufd803bb2014-01-20 15:13:07 +0100151 if (unlikely(conn->flags & CO_FL_WAIT_L4_CONN)) {
Willy Tarreauf8deb0c2012-09-01 17:59:22 +0200152 /* still waiting for a connection to establish and nothing was
153 * attempted yet to probe the connection. Then let's retry the
154 * connect().
Willy Tarreau2da156f2012-07-23 15:07:23 +0200155 */
Willy Tarreau239d7182012-07-23 18:53:03 +0200156 if (!tcp_connect_probe(conn))
Willy Tarreauafad0e02012-08-09 14:45:22 +0200157 goto leave;
Willy Tarreau2da156f2012-07-23 15:07:23 +0200158 }
Willy Tarreau2c6be842012-07-06 17:12:34 +0200159 leave:
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100160 /* Verify if the connection just established. */
Willy Tarreau7bf3fa32017-03-14 20:19:29 +0100161 if (unlikely(!(conn->flags & (CO_FL_WAIT_L4_CONN | CO_FL_WAIT_L6_CONN | CO_FL_CONNECTED))))
162 conn->flags |= CO_FL_CONNECTED;
163
Willy Tarreau8e3c6ce2017-08-28 15:46:01 +0200164 /* The connection owner might want to be notified about failures to
165 * complete the handshake. The callback may fail and cause the
166 * connection to be destroyed, thus we must not use it anymore and
167 * should immediately leave instead. The caller must immediately
168 * unregister itself once called.
169 */
170 if (((conn->flags ^ flags) & CO_FL_NOTIFY_DONE) &&
171 conn->xprt_done_cb && conn->xprt_done_cb(conn) < 0)
172 return;
173
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100174 /* The wake callback is normally used to notify the data layer about
175 * data layer activity (successful send/recv), connection establishment,
176 * shutdown and fatal errors. We need to consider the following
177 * situations to wake up the data layer :
178 * - change among the CO_FL_NOTIFY_DATA flags :
179 * {DATA,SOCK}_{RD,WR}_SH, ERROR,
180 * - absence of any of {L4,L6}_CONN and CONNECTED, indicating the
181 * end of handshake and transition to CONNECTED
182 * - raise of CONNECTED with HANDSHAKE down
183 * - end of HANDSHAKE with CONNECTED set
184 * - regular data layer activity
185 *
186 * Note that the wake callback is allowed to release the connection and
187 * the fd (and return < 0 in this case).
Willy Tarreau2396c1c2012-10-03 21:12:16 +0200188 */
Willy Tarreau9fa1ee62017-03-18 15:39:57 +0100189 if ((((conn->flags ^ flags) & CO_FL_NOTIFY_DATA) ||
Willy Tarreau3c0cc492017-03-19 07:54:28 +0100190 ((flags & (CO_FL_CONNECTED|CO_FL_HANDSHAKE)) != CO_FL_CONNECTED &&
191 (conn->flags & (CO_FL_CONNECTED|CO_FL_HANDSHAKE)) == CO_FL_CONNECTED)) &&
Willy Tarreau53a47662017-08-28 10:53:00 +0200192 conn->mux->wake(conn) < 0)
Willy Tarreau7a798e52016-04-14 11:13:20 +0200193 return;
Willy Tarreaufd31e532012-07-23 18:24:25 +0200194
Willy Tarreau61ace1b2012-07-23 12:14:26 +0200195 /* remove the events before leaving */
Willy Tarreau26d7cfc2012-12-07 00:09:43 +0100196 fdtab[fd].ev &= FD_POLL_STICKY;
Willy Tarreauf9dabec2012-08-17 17:33:53 +0200197
198 /* commit polling changes */
Willy Tarreau916e12d2017-10-25 09:22:43 +0200199 conn->flags &= ~CO_FL_WILL_UPDATE;
Willy Tarreauf9dabec2012-08-17 17:33:53 +0200200 conn_cond_update_polling(conn);
Willy Tarreau7a798e52016-04-14 11:13:20 +0200201 return;
Willy Tarreau59f98392012-07-06 14:13:49 +0200202}
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200203
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200204/* Update polling on connection <c>'s file descriptor depending on its current
205 * state as reported in the connection's CO_FL_CURR_* flags, reports of EAGAIN
Olivier Houchard1a0545f2017-09-13 18:30:23 +0200206 * in CO_FL_WAIT_*, and the data layer expectations indicated by CO_FL_XPRT_*.
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200207 * The connection flags are updated with the new flags at the end of the
Willy Tarreau0ffde2c2012-10-04 22:21:15 +0200208 * operation. Polling is totally disabled if an error was reported.
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200209 */
Olivier Houchard1a0545f2017-09-13 18:30:23 +0200210void conn_update_xprt_polling(struct connection *c)
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200211{
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200212 unsigned int f = c->flags;
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200213
Willy Tarreau3c728722014-01-23 13:50:42 +0100214 if (!conn_ctrl_ready(c))
Willy Tarreauf79c8172013-10-21 16:30:56 +0200215 return;
216
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200217 /* update read status if needed */
Olivier Houchard1a0545f2017-09-13 18:30:23 +0200218 if (unlikely((f & (CO_FL_CURR_RD_ENA|CO_FL_XPRT_RD_ENA)) == CO_FL_XPRT_RD_ENA)) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200219 fd_want_recv(c->handle.fd);
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100220 f |= CO_FL_CURR_RD_ENA;
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200221 }
Olivier Houchard1a0545f2017-09-13 18:30:23 +0200222 else if (unlikely((f & (CO_FL_CURR_RD_ENA|CO_FL_XPRT_RD_ENA)) == CO_FL_CURR_RD_ENA)) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200223 fd_stop_recv(c->handle.fd);
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100224 f &= ~CO_FL_CURR_RD_ENA;
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200225 }
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200226
227 /* update write status if needed */
Olivier Houchard1a0545f2017-09-13 18:30:23 +0200228 if (unlikely((f & (CO_FL_CURR_WR_ENA|CO_FL_XPRT_WR_ENA)) == CO_FL_XPRT_WR_ENA)) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200229 fd_want_send(c->handle.fd);
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100230 f |= CO_FL_CURR_WR_ENA;
231 }
Olivier Houchard1a0545f2017-09-13 18:30:23 +0200232 else if (unlikely((f & (CO_FL_CURR_WR_ENA|CO_FL_XPRT_WR_ENA)) == CO_FL_CURR_WR_ENA)) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200233 fd_stop_send(c->handle.fd);
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100234 f &= ~CO_FL_CURR_WR_ENA;
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200235 }
Willy Tarreau310987a2014-01-22 19:46:33 +0100236 c->flags = f;
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200237}
238
239/* Update polling on connection <c>'s file descriptor depending on its current
240 * state as reported in the connection's CO_FL_CURR_* flags, reports of EAGAIN
241 * in CO_FL_WAIT_*, and the sock layer expectations indicated by CO_FL_SOCK_*.
242 * The connection flags are updated with the new flags at the end of the
Willy Tarreau0ffde2c2012-10-04 22:21:15 +0200243 * operation. Polling is totally disabled if an error was reported.
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200244 */
245void conn_update_sock_polling(struct connection *c)
246{
247 unsigned int f = c->flags;
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200248
Willy Tarreau3c728722014-01-23 13:50:42 +0100249 if (!conn_ctrl_ready(c))
Willy Tarreauf79c8172013-10-21 16:30:56 +0200250 return;
251
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200252 /* update read status if needed */
Willy Tarreau310987a2014-01-22 19:46:33 +0100253 if (unlikely((f & (CO_FL_CURR_RD_ENA|CO_FL_SOCK_RD_ENA)) == CO_FL_SOCK_RD_ENA)) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200254 fd_want_recv(c->handle.fd);
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100255 f |= CO_FL_CURR_RD_ENA;
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200256 }
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100257 else if (unlikely((f & (CO_FL_CURR_RD_ENA|CO_FL_SOCK_RD_ENA)) == CO_FL_CURR_RD_ENA)) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200258 fd_stop_recv(c->handle.fd);
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100259 f &= ~CO_FL_CURR_RD_ENA;
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200260 }
261
262 /* update write status if needed */
Willy Tarreau310987a2014-01-22 19:46:33 +0100263 if (unlikely((f & (CO_FL_CURR_WR_ENA|CO_FL_SOCK_WR_ENA)) == CO_FL_SOCK_WR_ENA)) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200264 fd_want_send(c->handle.fd);
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100265 f |= CO_FL_CURR_WR_ENA;
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200266 }
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100267 else if (unlikely((f & (CO_FL_CURR_WR_ENA|CO_FL_SOCK_WR_ENA)) == CO_FL_CURR_WR_ENA)) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200268 fd_stop_send(c->handle.fd);
Willy Tarreauc8dd77f2012-11-05 17:52:26 +0100269 f &= ~CO_FL_CURR_WR_ENA;
Willy Tarreaue9dfa792012-09-01 17:26:16 +0200270 }
Willy Tarreau310987a2014-01-22 19:46:33 +0100271 c->flags = f;
Willy Tarreaub5e2cbd2012-08-17 11:55:04 +0200272}
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200273
Willy Tarreauff3e6482015-03-12 23:56:52 +0100274/* Send a message over an established connection. It makes use of send() and
275 * returns the same return code and errno. If the socket layer is not ready yet
276 * then -1 is returned and ENOTSOCK is set into errno. If the fd is not marked
277 * as ready, or if EAGAIN or ENOTCONN is returned, then we return 0. It returns
278 * EMSGSIZE if called with a zero length message. The purpose is to simplify
279 * some rare attempts to directly write on the socket from above the connection
280 * (typically send_proxy). In case of EAGAIN, the fd is marked as "cant_send".
281 * It automatically retries on EINTR. Other errors cause the connection to be
282 * marked as in error state. It takes similar arguments as send() except the
283 * first one which is the connection instead of the file descriptor. Note,
284 * MSG_DONTWAIT and MSG_NOSIGNAL are forced on the flags.
285 */
286int conn_sock_send(struct connection *conn, const void *buf, int len, int flags)
287{
288 int ret;
289
290 ret = -1;
291 errno = ENOTSOCK;
292
293 if (conn->flags & CO_FL_SOCK_WR_SH)
294 goto fail;
295
296 if (!conn_ctrl_ready(conn))
297 goto fail;
298
299 errno = EMSGSIZE;
300 if (!len)
301 goto fail;
302
Willy Tarreau585744b2017-08-24 14:31:19 +0200303 if (!fd_send_ready(conn->handle.fd))
Willy Tarreauff3e6482015-03-12 23:56:52 +0100304 goto wait;
305
306 do {
Willy Tarreau585744b2017-08-24 14:31:19 +0200307 ret = send(conn->handle.fd, buf, len, flags | MSG_DONTWAIT | MSG_NOSIGNAL);
Willy Tarreauff3e6482015-03-12 23:56:52 +0100308 } while (ret < 0 && errno == EINTR);
309
310
311 if (ret > 0)
312 return ret;
313
314 if (ret == 0 || errno == EAGAIN || errno == ENOTCONN) {
315 wait:
Willy Tarreau585744b2017-08-24 14:31:19 +0200316 fd_cant_send(conn->handle.fd);
Willy Tarreauff3e6482015-03-12 23:56:52 +0100317 return 0;
318 }
319 fail:
320 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH | CO_FL_ERROR;
321 return ret;
322}
323
Willy Tarreaud85c4852015-03-13 00:40:28 +0100324/* Drains possibly pending incoming data on the file descriptor attached to the
325 * connection and update the connection's flags accordingly. This is used to
326 * know whether we need to disable lingering on close. Returns non-zero if it
327 * is safe to close without disabling lingering, otherwise zero. The SOCK_RD_SH
328 * flag may also be updated if the incoming shutdown was reported by the drain()
329 * function.
330 */
331int conn_sock_drain(struct connection *conn)
332{
333 if (!conn_ctrl_ready(conn))
334 return 1;
335
336 if (conn->flags & (CO_FL_ERROR | CO_FL_SOCK_RD_SH))
337 return 1;
338
Willy Tarreau585744b2017-08-24 14:31:19 +0200339 if (fdtab[conn->handle.fd].ev & (FD_POLL_ERR|FD_POLL_HUP)) {
340 fdtab[conn->handle.fd].linger_risk = 0;
Willy Tarreaud85c4852015-03-13 00:40:28 +0100341 }
342 else {
Willy Tarreau585744b2017-08-24 14:31:19 +0200343 if (!fd_recv_ready(conn->handle.fd))
Willy Tarreaud85c4852015-03-13 00:40:28 +0100344 return 0;
345
346 /* disable draining if we were called and have no drain function */
347 if (!conn->ctrl->drain) {
Olivier Houchard1a0545f2017-09-13 18:30:23 +0200348 __conn_xprt_stop_recv(conn);
Willy Tarreaud85c4852015-03-13 00:40:28 +0100349 return 0;
350 }
351
Willy Tarreau585744b2017-08-24 14:31:19 +0200352 if (conn->ctrl->drain(conn->handle.fd) <= 0)
Willy Tarreaud85c4852015-03-13 00:40:28 +0100353 return 0;
354 }
355
356 conn->flags |= CO_FL_SOCK_RD_SH;
357 return 1;
358}
359
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100360/*
361 * Get data length from tlv
362 */
363static int get_tlv_length(const struct tlv *src)
364{
365 return (src->length_hi << 8) | src->length_lo;
366}
367
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200368/* This handshake handler waits a PROXY protocol header at the beginning of the
369 * raw data stream. The header looks like this :
370 *
371 * "PROXY" <SP> PROTO <SP> SRC3 <SP> DST3 <SP> SRC4 <SP> <DST4> "\r\n"
372 *
373 * There must be exactly one space between each field. Fields are :
374 * - PROTO : layer 4 protocol, which must be "TCP4" or "TCP6".
375 * - SRC3 : layer 3 (eg: IP) source address in standard text form
376 * - DST3 : layer 3 (eg: IP) destination address in standard text form
377 * - SRC4 : layer 4 (eg: TCP port) source address in standard text form
378 * - DST4 : layer 4 (eg: TCP port) destination address in standard text form
379 *
380 * This line MUST be at the beginning of the buffer and MUST NOT wrap.
381 *
382 * The header line is small and in all cases smaller than the smallest normal
383 * TCP MSS. So it MUST always be delivered as one segment, which ensures we
384 * can safely use MSG_PEEK and avoid buffering.
385 *
386 * Once the data is fetched, the values are set in the connection's address
387 * fields, and data are removed from the socket's buffer. The function returns
388 * zero if it needs to wait for more data or if it fails, or 1 if it completed
389 * and removed itself.
390 */
391int conn_recv_proxy(struct connection *conn, int flag)
392{
393 char *line, *end;
Willy Tarreau77992672014-06-14 11:06:17 +0200394 struct proxy_hdr_v2 *hdr_v2;
395 const char v2sig[] = PP2_SIGNATURE;
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100396 int tlv_length = 0;
KOVACS Krisztian7209c202015-07-03 14:09:10 +0200397 int tlv_offset = 0;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200398
399 /* we might have been called just after an asynchronous shutr */
400 if (conn->flags & CO_FL_SOCK_RD_SH)
401 goto fail;
402
Willy Tarreau3c728722014-01-23 13:50:42 +0100403 if (!conn_ctrl_ready(conn))
Willy Tarreauf79c8172013-10-21 16:30:56 +0200404 goto fail;
405
Willy Tarreau585744b2017-08-24 14:31:19 +0200406 if (!fd_recv_ready(conn->handle.fd))
Willy Tarreaufd803bb2014-01-20 15:13:07 +0100407 return 0;
408
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200409 do {
Willy Tarreau585744b2017-08-24 14:31:19 +0200410 trash.len = recv(conn->handle.fd, trash.str, trash.size, MSG_PEEK);
Willy Tarreau19d14ef2012-10-29 16:51:55 +0100411 if (trash.len < 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200412 if (errno == EINTR)
413 continue;
414 if (errno == EAGAIN) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200415 fd_cant_recv(conn->handle.fd);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200416 return 0;
417 }
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100418 goto recv_abort;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200419 }
420 } while (0);
421
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100422 if (!trash.len) {
423 /* client shutdown */
424 conn->err_code = CO_ER_PRX_EMPTY;
425 goto fail;
426 }
427
Willy Tarreau19d14ef2012-10-29 16:51:55 +0100428 if (trash.len < 6)
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200429 goto missing;
430
Willy Tarreau19d14ef2012-10-29 16:51:55 +0100431 line = trash.str;
432 end = trash.str + trash.len;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200433
434 /* Decode a possible proxy request, fail early if it does not match */
Willy Tarreau77992672014-06-14 11:06:17 +0200435 if (strncmp(line, "PROXY ", 6) != 0)
436 goto not_v1;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200437
438 line += 6;
Willy Tarreau4c20d292014-06-14 11:41:36 +0200439 if (trash.len < 9) /* shortest possible line */
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200440 goto missing;
441
David CARLIER42ff05e2016-03-24 09:22:36 +0000442 if (memcmp(line, "TCP4 ", 5) == 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200443 u32 src3, dst3, sport, dport;
444
445 line += 5;
446
447 src3 = inetaddr_host_lim_ret(line, end, &line);
448 if (line == end)
449 goto missing;
450 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100451 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200452
453 dst3 = inetaddr_host_lim_ret(line, end, &line);
454 if (line == end)
455 goto missing;
456 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100457 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200458
459 sport = read_uint((const char **)&line, end);
460 if (line == end)
461 goto missing;
462 if (*line++ != ' ')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100463 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200464
465 dport = read_uint((const char **)&line, end);
466 if (line > end - 2)
467 goto missing;
468 if (*line++ != '\r')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100469 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200470 if (*line++ != '\n')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100471 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200472
473 /* update the session's addresses and mark them set */
474 ((struct sockaddr_in *)&conn->addr.from)->sin_family = AF_INET;
475 ((struct sockaddr_in *)&conn->addr.from)->sin_addr.s_addr = htonl(src3);
476 ((struct sockaddr_in *)&conn->addr.from)->sin_port = htons(sport);
477
478 ((struct sockaddr_in *)&conn->addr.to)->sin_family = AF_INET;
479 ((struct sockaddr_in *)&conn->addr.to)->sin_addr.s_addr = htonl(dst3);
480 ((struct sockaddr_in *)&conn->addr.to)->sin_port = htons(dport);
481 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
482 }
David CARLIER42ff05e2016-03-24 09:22:36 +0000483 else if (memcmp(line, "TCP6 ", 5) == 0) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200484 u32 sport, dport;
485 char *src_s;
486 char *dst_s, *sport_s, *dport_s;
487 struct in6_addr src3, dst3;
488
489 line += 5;
490
491 src_s = line;
492 dst_s = sport_s = dport_s = NULL;
493 while (1) {
494 if (line > end - 2) {
495 goto missing;
496 }
497 else if (*line == '\r') {
498 *line = 0;
499 line++;
500 if (*line++ != '\n')
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100501 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200502 break;
503 }
504
505 if (*line == ' ') {
506 *line = 0;
507 if (!dst_s)
508 dst_s = line + 1;
509 else if (!sport_s)
510 sport_s = line + 1;
511 else if (!dport_s)
512 dport_s = line + 1;
513 }
514 line++;
515 }
516
517 if (!dst_s || !sport_s || !dport_s)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100518 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200519
520 sport = read_uint((const char **)&sport_s,dport_s - 1);
521 if (*sport_s != 0)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100522 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200523
524 dport = read_uint((const char **)&dport_s,line - 2);
525 if (*dport_s != 0)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100526 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200527
528 if (inet_pton(AF_INET6, src_s, (void *)&src3) != 1)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100529 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200530
531 if (inet_pton(AF_INET6, dst_s, (void *)&dst3) != 1)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100532 goto bad_header;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200533
534 /* update the session's addresses and mark them set */
535 ((struct sockaddr_in6 *)&conn->addr.from)->sin6_family = AF_INET6;
536 memcpy(&((struct sockaddr_in6 *)&conn->addr.from)->sin6_addr, &src3, sizeof(struct in6_addr));
537 ((struct sockaddr_in6 *)&conn->addr.from)->sin6_port = htons(sport);
538
539 ((struct sockaddr_in6 *)&conn->addr.to)->sin6_family = AF_INET6;
540 memcpy(&((struct sockaddr_in6 *)&conn->addr.to)->sin6_addr, &dst3, sizeof(struct in6_addr));
541 ((struct sockaddr_in6 *)&conn->addr.to)->sin6_port = htons(dport);
542 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
543 }
Willy Tarreau4c20d292014-06-14 11:41:36 +0200544 else if (memcmp(line, "UNKNOWN\r\n", 9) == 0) {
545 /* This can be a UNIX socket forwarded by an haproxy upstream */
546 line += 9;
547 }
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200548 else {
Willy Tarreau4c20d292014-06-14 11:41:36 +0200549 /* The protocol does not match something known (TCP4/TCP6/UNKNOWN) */
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100550 conn->err_code = CO_ER_PRX_BAD_PROTO;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200551 goto fail;
552 }
553
Willy Tarreau77992672014-06-14 11:06:17 +0200554 trash.len = line - trash.str;
555 goto eat_header;
556
557 not_v1:
558 /* try PPv2 */
559 if (trash.len < PP2_HEADER_LEN)
560 goto missing;
561
562 hdr_v2 = (struct proxy_hdr_v2 *)trash.str;
563
564 if (memcmp(hdr_v2->sig, v2sig, PP2_SIGNATURE_LEN) != 0 ||
565 (hdr_v2->ver_cmd & PP2_VERSION_MASK) != PP2_VERSION) {
566 conn->err_code = CO_ER_PRX_NOT_HDR;
567 goto fail;
568 }
569
570 if (trash.len < PP2_HEADER_LEN + ntohs(hdr_v2->len))
571 goto missing;
572
573 switch (hdr_v2->ver_cmd & PP2_CMD_MASK) {
574 case 0x01: /* PROXY command */
575 switch (hdr_v2->fam) {
576 case 0x11: /* TCPv4 */
KOVACS Krisztianefd3aa92014-11-19 10:53:20 +0100577 if (ntohs(hdr_v2->len) < PP2_ADDR_LEN_INET)
578 goto bad_header;
579
Willy Tarreau77992672014-06-14 11:06:17 +0200580 ((struct sockaddr_in *)&conn->addr.from)->sin_family = AF_INET;
581 ((struct sockaddr_in *)&conn->addr.from)->sin_addr.s_addr = hdr_v2->addr.ip4.src_addr;
582 ((struct sockaddr_in *)&conn->addr.from)->sin_port = hdr_v2->addr.ip4.src_port;
583 ((struct sockaddr_in *)&conn->addr.to)->sin_family = AF_INET;
584 ((struct sockaddr_in *)&conn->addr.to)->sin_addr.s_addr = hdr_v2->addr.ip4.dst_addr;
585 ((struct sockaddr_in *)&conn->addr.to)->sin_port = hdr_v2->addr.ip4.dst_port;
586 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
KOVACS Krisztian7209c202015-07-03 14:09:10 +0200587 tlv_offset = PP2_HEADER_LEN + PP2_ADDR_LEN_INET;
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100588 tlv_length = ntohs(hdr_v2->len) - PP2_ADDR_LEN_INET;
Willy Tarreau77992672014-06-14 11:06:17 +0200589 break;
590 case 0x21: /* TCPv6 */
KOVACS Krisztianefd3aa92014-11-19 10:53:20 +0100591 if (ntohs(hdr_v2->len) < PP2_ADDR_LEN_INET6)
592 goto bad_header;
593
Willy Tarreau77992672014-06-14 11:06:17 +0200594 ((struct sockaddr_in6 *)&conn->addr.from)->sin6_family = AF_INET6;
595 memcpy(&((struct sockaddr_in6 *)&conn->addr.from)->sin6_addr, hdr_v2->addr.ip6.src_addr, 16);
596 ((struct sockaddr_in6 *)&conn->addr.from)->sin6_port = hdr_v2->addr.ip6.src_port;
597 ((struct sockaddr_in6 *)&conn->addr.to)->sin6_family = AF_INET6;
598 memcpy(&((struct sockaddr_in6 *)&conn->addr.to)->sin6_addr, hdr_v2->addr.ip6.dst_addr, 16);
599 ((struct sockaddr_in6 *)&conn->addr.to)->sin6_port = hdr_v2->addr.ip6.dst_port;
600 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
KOVACS Krisztian7209c202015-07-03 14:09:10 +0200601 tlv_offset = PP2_HEADER_LEN + PP2_ADDR_LEN_INET6;
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100602 tlv_length = ntohs(hdr_v2->len) - PP2_ADDR_LEN_INET6;
Willy Tarreau77992672014-06-14 11:06:17 +0200603 break;
604 }
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100605
606 /* TLV parsing */
607 if (tlv_length > 0) {
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100608 while (tlv_offset + TLV_HEADER_SIZE <= trash.len) {
609 const struct tlv *tlv_packet = (struct tlv *) &trash.str[tlv_offset];
610 const int tlv_len = get_tlv_length(tlv_packet);
611 tlv_offset += tlv_len + TLV_HEADER_SIZE;
612
613 switch (tlv_packet->type) {
614#ifdef CONFIG_HAP_NS
615 case PP2_TYPE_NETNS: {
616 const struct netns_entry *ns;
617 ns = netns_store_lookup((char*)tlv_packet->value, tlv_len);
618 if (ns)
619 conn->proxy_netns = ns;
620 break;
621 }
622#endif
623 default:
624 break;
625 }
626 }
627 }
628
Willy Tarreau77992672014-06-14 11:06:17 +0200629 /* unsupported protocol, keep local connection address */
630 break;
631 case 0x00: /* LOCAL command */
632 /* keep local connection address for LOCAL */
633 break;
634 default:
635 goto bad_header; /* not a supported command */
636 }
637
638 trash.len = PP2_HEADER_LEN + ntohs(hdr_v2->len);
639 goto eat_header;
640
641 eat_header:
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200642 /* remove the PROXY line from the request. For this we re-read the
643 * exact line at once. If we don't get the exact same result, we
644 * fail.
645 */
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200646 do {
Willy Tarreau585744b2017-08-24 14:31:19 +0200647 int len2 = recv(conn->handle.fd, trash.str, trash.len, 0);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200648 if (len2 < 0 && errno == EINTR)
649 continue;
Willy Tarreau19d14ef2012-10-29 16:51:55 +0100650 if (len2 != trash.len)
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100651 goto recv_abort;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200652 } while (0);
653
654 conn->flags &= ~flag;
Emeric Brun4f603012017-01-05 15:11:44 +0100655 conn->flags |= CO_FL_RCVD_PROXY;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200656 return 1;
657
658 missing:
659 /* Missing data. Since we're using MSG_PEEK, we can only poll again if
660 * we have not read anything. Otherwise we need to fail because we won't
661 * be able to poll anymore.
662 */
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100663 conn->err_code = CO_ER_PRX_TRUNCATED;
664 goto fail;
665
666 bad_header:
667 /* This is not a valid proxy protocol header */
668 conn->err_code = CO_ER_PRX_BAD_HDR;
669 goto fail;
670
671 recv_abort:
672 conn->err_code = CO_ER_PRX_ABORT;
Willy Tarreau26f4a042013-12-04 23:44:10 +0100673 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH;
Willy Tarreau8e3bf692012-12-03 15:41:18 +0100674 goto fail;
675
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200676 fail:
Willy Tarreaud486ef52012-12-10 17:03:52 +0100677 __conn_sock_stop_both(conn);
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200678 conn->flags |= CO_FL_ERROR;
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200679 return 0;
680}
681
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100682/* This handshake handler waits a NetScaler Client IP insertion header
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000683 * at the beginning of the raw data stream. The header format is
684 * described in doc/netscaler-client-ip-insertion-protocol.txt
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100685 *
686 * This line MUST be at the beginning of the buffer and MUST NOT be
687 * fragmented.
688 *
689 * The header line is small and in all cases smaller than the smallest normal
690 * TCP MSS. So it MUST always be delivered as one segment, which ensures we
691 * can safely use MSG_PEEK and avoid buffering.
692 *
693 * Once the data is fetched, the values are set in the connection's address
694 * fields, and data are removed from the socket's buffer. The function returns
695 * zero if it needs to wait for more data or if it fails, or 1 if it completed
696 * and removed itself.
697 */
698int conn_recv_netscaler_cip(struct connection *conn, int flag)
699{
700 char *line;
Bertrand Jacquin7d668f92017-12-13 01:23:39 +0000701 uint32_t hdr_len;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100702 uint8_t ip_v;
703
704 /* we might have been called just after an asynchronous shutr */
705 if (conn->flags & CO_FL_SOCK_RD_SH)
706 goto fail;
707
708 if (!conn_ctrl_ready(conn))
709 goto fail;
710
Willy Tarreau585744b2017-08-24 14:31:19 +0200711 if (!fd_recv_ready(conn->handle.fd))
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100712 return 0;
713
714 do {
Willy Tarreau585744b2017-08-24 14:31:19 +0200715 trash.len = recv(conn->handle.fd, trash.str, trash.size, MSG_PEEK);
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100716 if (trash.len < 0) {
717 if (errno == EINTR)
718 continue;
719 if (errno == EAGAIN) {
Willy Tarreau585744b2017-08-24 14:31:19 +0200720 fd_cant_recv(conn->handle.fd);
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100721 return 0;
722 }
723 goto recv_abort;
724 }
725 } while (0);
726
727 if (!trash.len) {
728 /* client shutdown */
729 conn->err_code = CO_ER_CIP_EMPTY;
730 goto fail;
731 }
732
733 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000734 * CIP magic, header length or
735 * CIP magic, CIP length, CIP type, header length */
736 if (trash.len < 12)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100737 goto missing;
738
739 line = trash.str;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100740
741 /* Decode a possible NetScaler Client IP request, fail early if
742 * it does not match */
Bertrand Jacquin4b4c2862017-12-13 01:07:12 +0000743 if (ntohl(*(uint32_t *)line) != objt_listener(conn->target)->bind_conf->ns_cip_magic)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100744 goto bad_magic;
745
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000746 /* Legacy CIP protocol */
747 if ((trash.str[8] & 0xD0) == 0x40) {
748 hdr_len = ntohl(*(uint32_t *)(line+4));
749 line += 8;
750 }
751 /* Standard CIP protocol */
752 else if (trash.str[8] == 0x00) {
753 hdr_len = ntohs(*(uint32_t *)(line+10));
754 line += 12;
755 }
756 /* Unknown CIP protocol */
757 else {
758 conn->err_code = CO_ER_CIP_BAD_PROTO;
759 goto fail;
760 }
761
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100762 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin72fa1ec2017-12-12 01:17:23 +0000763 * a minimal IP header */
764 if (trash.len < 20)
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100765 goto missing;
766
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100767 /* Get IP version from the first four bits */
768 ip_v = (*line & 0xf0) >> 4;
769
770 if (ip_v == 4) {
771 struct ip *hdr_ip4;
David Carlier3015a2e2016-07-04 22:51:33 +0100772 struct my_tcphdr *hdr_tcp;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100773
774 hdr_ip4 = (struct ip *)line;
775
Bertrand Jacquina341a2f2017-12-13 01:29:56 +0000776 if (trash.len < 40 || trash.len < hdr_len) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100777 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin67de5a22017-12-13 01:15:05 +0000778 * IPv4 header, TCP header */
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100779 goto missing;
Bertrand Jacquinb3875912017-12-13 00:58:51 +0000780 }
781 else if (hdr_ip4->ip_p != IPPROTO_TCP) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100782 /* The protocol does not include a TCP header */
783 conn->err_code = CO_ER_CIP_BAD_PROTO;
784 goto fail;
Bertrand Jacquinb3875912017-12-13 00:58:51 +0000785 }
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100786
David Carlier3015a2e2016-07-04 22:51:33 +0100787 hdr_tcp = (struct my_tcphdr *)(line + (hdr_ip4->ip_hl * 4));
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100788
789 /* update the session's addresses and mark them set */
790 ((struct sockaddr_in *)&conn->addr.from)->sin_family = AF_INET;
791 ((struct sockaddr_in *)&conn->addr.from)->sin_addr.s_addr = hdr_ip4->ip_src.s_addr;
792 ((struct sockaddr_in *)&conn->addr.from)->sin_port = hdr_tcp->source;
793
794 ((struct sockaddr_in *)&conn->addr.to)->sin_family = AF_INET;
795 ((struct sockaddr_in *)&conn->addr.to)->sin_addr.s_addr = hdr_ip4->ip_dst.s_addr;
796 ((struct sockaddr_in *)&conn->addr.to)->sin_port = hdr_tcp->dest;
797
798 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
799 }
800 else if (ip_v == 6) {
801 struct ip6_hdr *hdr_ip6;
David Carlier3015a2e2016-07-04 22:51:33 +0100802 struct my_tcphdr *hdr_tcp;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100803
804 hdr_ip6 = (struct ip6_hdr *)line;
805
Bertrand Jacquina341a2f2017-12-13 01:29:56 +0000806 if (trash.len < 60 || trash.len < hdr_len) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100807 /* Fail if buffer length is not large enough to contain
Bertrand Jacquin67de5a22017-12-13 01:15:05 +0000808 * IPv6 header, TCP header */
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100809 goto missing;
Bertrand Jacquinb3875912017-12-13 00:58:51 +0000810 }
811 else if (hdr_ip6->ip6_nxt != IPPROTO_TCP) {
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100812 /* The protocol does not include a TCP header */
813 conn->err_code = CO_ER_CIP_BAD_PROTO;
814 goto fail;
Bertrand Jacquinb3875912017-12-13 00:58:51 +0000815 }
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100816
David Carlier3015a2e2016-07-04 22:51:33 +0100817 hdr_tcp = (struct my_tcphdr *)(line + sizeof(struct ip6_hdr));
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100818
819 /* update the session's addresses and mark them set */
820 ((struct sockaddr_in6 *)&conn->addr.from)->sin6_family = AF_INET6;
821 ((struct sockaddr_in6 *)&conn->addr.from)->sin6_addr = hdr_ip6->ip6_src;
822 ((struct sockaddr_in6 *)&conn->addr.from)->sin6_port = hdr_tcp->source;
823
824 ((struct sockaddr_in6 *)&conn->addr.to)->sin6_family = AF_INET6;
825 ((struct sockaddr_in6 *)&conn->addr.to)->sin6_addr = hdr_ip6->ip6_dst;
826 ((struct sockaddr_in6 *)&conn->addr.to)->sin6_port = hdr_tcp->dest;
827
828 conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
829 }
830 else {
831 /* The protocol does not match something known (IPv4/IPv6) */
832 conn->err_code = CO_ER_CIP_BAD_PROTO;
833 goto fail;
834 }
835
Bertrand Jacquin7d668f92017-12-13 01:23:39 +0000836 line += hdr_len;
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100837 trash.len = line - trash.str;
838
839 /* remove the NetScaler Client IP header from the request. For this
840 * we re-read the exact line at once. If we don't get the exact same
841 * result, we fail.
842 */
843 do {
Willy Tarreau585744b2017-08-24 14:31:19 +0200844 int len2 = recv(conn->handle.fd, trash.str, trash.len, 0);
Bertrand Jacquin93b227d2016-06-04 15:11:10 +0100845 if (len2 < 0 && errno == EINTR)
846 continue;
847 if (len2 != trash.len)
848 goto recv_abort;
849 } while (0);
850
851 conn->flags &= ~flag;
852 return 1;
853
854 missing:
855 /* Missing data. Since we're using MSG_PEEK, we can only poll again if
856 * we have not read anything. Otherwise we need to fail because we won't
857 * be able to poll anymore.
858 */
859 conn->err_code = CO_ER_CIP_TRUNCATED;
860 goto fail;
861
862 bad_magic:
863 conn->err_code = CO_ER_CIP_BAD_MAGIC;
864 goto fail;
865
866 recv_abort:
867 conn->err_code = CO_ER_CIP_ABORT;
868 conn->flags |= CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH;
869 goto fail;
870
871 fail:
872 __conn_sock_stop_both(conn);
873 conn->flags |= CO_FL_ERROR;
874 return 0;
875}
876
David Safb76832014-05-08 23:42:08 -0400877int make_proxy_line(char *buf, int buf_len, struct server *srv, struct connection *remote)
878{
879 int ret = 0;
880
881 if (srv && (srv->pp_opts & SRV_PP_V2)) {
882 ret = make_proxy_line_v2(buf, buf_len, srv, remote);
883 }
884 else {
885 if (remote)
886 ret = make_proxy_line_v1(buf, buf_len, &remote->addr.from, &remote->addr.to);
887 else
888 ret = make_proxy_line_v1(buf, buf_len, NULL, NULL);
889 }
890
891 return ret;
892}
893
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200894/* Makes a PROXY protocol line from the two addresses. The output is sent to
895 * buffer <buf> for a maximum size of <buf_len> (including the trailing zero).
896 * It returns the number of bytes composing this line (including the trailing
897 * LF), or zero in case of failure (eg: not enough space). It supports TCP4,
Willy Tarreau2e1401a2013-10-01 11:41:55 +0200898 * TCP6 and "UNKNOWN" formats. If any of <src> or <dst> is null, UNKNOWN is
899 * emitted as well.
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200900 */
David Safb76832014-05-08 23:42:08 -0400901int make_proxy_line_v1(char *buf, int buf_len, struct sockaddr_storage *src, struct sockaddr_storage *dst)
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200902{
903 int ret = 0;
904
Willy Tarreau2e1401a2013-10-01 11:41:55 +0200905 if (src && dst && src->ss_family == dst->ss_family && src->ss_family == AF_INET) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200906 ret = snprintf(buf + ret, buf_len - ret, "PROXY TCP4 ");
907 if (ret >= buf_len)
908 return 0;
909
910 /* IPv4 src */
911 if (!inet_ntop(src->ss_family, &((struct sockaddr_in *)src)->sin_addr, buf + ret, buf_len - ret))
912 return 0;
913
914 ret += strlen(buf + ret);
915 if (ret >= buf_len)
916 return 0;
917
918 buf[ret++] = ' ';
919
920 /* IPv4 dst */
921 if (!inet_ntop(dst->ss_family, &((struct sockaddr_in *)dst)->sin_addr, buf + ret, buf_len - ret))
922 return 0;
923
924 ret += strlen(buf + ret);
925 if (ret >= buf_len)
926 return 0;
927
928 /* source and destination ports */
929 ret += snprintf(buf + ret, buf_len - ret, " %u %u\r\n",
930 ntohs(((struct sockaddr_in *)src)->sin_port),
931 ntohs(((struct sockaddr_in *)dst)->sin_port));
932 if (ret >= buf_len)
933 return 0;
934 }
Willy Tarreau2e1401a2013-10-01 11:41:55 +0200935 else if (src && dst && src->ss_family == dst->ss_family && src->ss_family == AF_INET6) {
Willy Tarreaue1e4a612012-10-05 00:10:55 +0200936 ret = snprintf(buf + ret, buf_len - ret, "PROXY TCP6 ");
937 if (ret >= buf_len)
938 return 0;
939
940 /* IPv6 src */
941 if (!inet_ntop(src->ss_family, &((struct sockaddr_in6 *)src)->sin6_addr, buf + ret, buf_len - ret))
942 return 0;
943
944 ret += strlen(buf + ret);
945 if (ret >= buf_len)
946 return 0;
947
948 buf[ret++] = ' ';
949
950 /* IPv6 dst */
951 if (!inet_ntop(dst->ss_family, &((struct sockaddr_in6 *)dst)->sin6_addr, buf + ret, buf_len - ret))
952 return 0;
953
954 ret += strlen(buf + ret);
955 if (ret >= buf_len)
956 return 0;
957
958 /* source and destination ports */
959 ret += snprintf(buf + ret, buf_len - ret, " %u %u\r\n",
960 ntohs(((struct sockaddr_in6 *)src)->sin6_port),
961 ntohs(((struct sockaddr_in6 *)dst)->sin6_port));
962 if (ret >= buf_len)
963 return 0;
964 }
965 else {
966 /* unknown family combination */
967 ret = snprintf(buf, buf_len, "PROXY UNKNOWN\r\n");
968 if (ret >= buf_len)
969 return 0;
970 }
971 return ret;
972}
David Safb76832014-05-08 23:42:08 -0400973
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +0100974static int make_tlv(char *dest, int dest_len, char type, uint16_t length, const char *value)
David Safb76832014-05-08 23:42:08 -0400975{
976 struct tlv *tlv;
977
978 if (!dest || (length + sizeof(*tlv) > dest_len))
979 return 0;
980
981 tlv = (struct tlv *)dest;
982
983 tlv->type = type;
984 tlv->length_hi = length >> 8;
985 tlv->length_lo = length & 0x00ff;
986 memcpy(tlv->value, value, length);
987 return length + sizeof(*tlv);
988}
David Safb76832014-05-08 23:42:08 -0400989
990int make_proxy_line_v2(char *buf, int buf_len, struct server *srv, struct connection *remote)
991{
Willy Tarreau8fccfa22014-06-14 08:28:06 +0200992 const char pp2_signature[] = PP2_SIGNATURE;
David Safb76832014-05-08 23:42:08 -0400993 int ret = 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +0200994 struct proxy_hdr_v2 *hdr = (struct proxy_hdr_v2 *)buf;
Vincent Bernat6e615892016-05-18 16:17:44 +0200995 struct sockaddr_storage null_addr = { .ss_family = 0 };
David Safb76832014-05-08 23:42:08 -0400996 struct sockaddr_storage *src = &null_addr;
997 struct sockaddr_storage *dst = &null_addr;
Emmanuel Hocdet404d9782017-10-24 10:55:14 +0200998 const char *value;
999 int value_len;
David Safb76832014-05-08 23:42:08 -04001000
1001 if (buf_len < PP2_HEADER_LEN)
1002 return 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001003 memcpy(hdr->sig, pp2_signature, PP2_SIGNATURE_LEN);
David Safb76832014-05-08 23:42:08 -04001004
1005 if (remote) {
1006 src = &remote->addr.from;
1007 dst = &remote->addr.to;
1008 }
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001009
David Safb76832014-05-08 23:42:08 -04001010 if (src && dst && src->ss_family == dst->ss_family && src->ss_family == AF_INET) {
1011 if (buf_len < PP2_HDR_LEN_INET)
1012 return 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001013 hdr->ver_cmd = PP2_VERSION | PP2_CMD_PROXY;
1014 hdr->fam = PP2_FAM_INET | PP2_TRANS_STREAM;
1015 hdr->addr.ip4.src_addr = ((struct sockaddr_in *)src)->sin_addr.s_addr;
1016 hdr->addr.ip4.dst_addr = ((struct sockaddr_in *)dst)->sin_addr.s_addr;
1017 hdr->addr.ip4.src_port = ((struct sockaddr_in *)src)->sin_port;
1018 hdr->addr.ip4.dst_port = ((struct sockaddr_in *)dst)->sin_port;
David Safb76832014-05-08 23:42:08 -04001019 ret = PP2_HDR_LEN_INET;
1020 }
1021 else if (src && dst && src->ss_family == dst->ss_family && src->ss_family == AF_INET6) {
1022 if (buf_len < PP2_HDR_LEN_INET6)
1023 return 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001024 hdr->ver_cmd = PP2_VERSION | PP2_CMD_PROXY;
1025 hdr->fam = PP2_FAM_INET6 | PP2_TRANS_STREAM;
1026 memcpy(hdr->addr.ip6.src_addr, &((struct sockaddr_in6 *)src)->sin6_addr, 16);
1027 memcpy(hdr->addr.ip6.dst_addr, &((struct sockaddr_in6 *)dst)->sin6_addr, 16);
1028 hdr->addr.ip6.src_port = ((struct sockaddr_in6 *)src)->sin6_port;
1029 hdr->addr.ip6.dst_port = ((struct sockaddr_in6 *)dst)->sin6_port;
David Safb76832014-05-08 23:42:08 -04001030 ret = PP2_HDR_LEN_INET6;
1031 }
1032 else {
1033 if (buf_len < PP2_HDR_LEN_UNSPEC)
1034 return 0;
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001035 hdr->ver_cmd = PP2_VERSION | PP2_CMD_LOCAL;
1036 hdr->fam = PP2_FAM_UNSPEC | PP2_TRANS_UNSPEC;
David Safb76832014-05-08 23:42:08 -04001037 ret = PP2_HDR_LEN_UNSPEC;
1038 }
1039
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001040 if (conn_get_alpn(remote, &value, &value_len)) {
1041 if ((buf_len - ret) < sizeof(struct tlv))
1042 return 0;
Emmanuel Hocdet571c7ac2017-10-31 18:24:05 +01001043 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_ALPN, value_len, value);
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001044 }
1045
David Safb76832014-05-08 23:42:08 -04001046#ifdef USE_OPENSSL
1047 if (srv->pp_opts & SRV_PP_V2_SSL) {
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001048 struct tlv_ssl *tlv;
1049 int ssl_tlv_len = 0;
David Safb76832014-05-08 23:42:08 -04001050 if ((buf_len - ret) < sizeof(struct tlv_ssl))
1051 return 0;
1052 tlv = (struct tlv_ssl *)&buf[ret];
1053 memset(tlv, 0, sizeof(struct tlv_ssl));
1054 ssl_tlv_len += sizeof(struct tlv_ssl);
1055 tlv->tlv.type = PP2_TYPE_SSL;
1056 if (ssl_sock_is_ssl(remote)) {
1057 tlv->client |= PP2_CLIENT_SSL;
Emmanuel Hocdet01da5712017-10-13 16:59:49 +02001058 value = ssl_sock_get_proto_version(remote);
David Safb76832014-05-08 23:42:08 -04001059 if (value) {
Emmanuel Hocdet82913e42017-10-31 18:31:36 +01001060 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_VERSION, strlen(value)+1, value);
David Safb76832014-05-08 23:42:08 -04001061 }
Dave McCowan328fb582014-07-30 10:39:13 -04001062 if (ssl_sock_get_cert_used_sess(remote)) {
1063 tlv->client |= PP2_CLIENT_CERT_SESS;
David Safb76832014-05-08 23:42:08 -04001064 tlv->verify = htonl(ssl_sock_get_verify_result(remote));
Dave McCowan328fb582014-07-30 10:39:13 -04001065 if (ssl_sock_get_cert_used_conn(remote))
1066 tlv->client |= PP2_CLIENT_CERT_CONN;
David Safb76832014-05-08 23:42:08 -04001067 }
1068 if (srv->pp_opts & SRV_PP_V2_SSL_CN) {
Emmanuel Hocdet404d9782017-10-24 10:55:14 +02001069 struct chunk *cn_trash = get_trash_chunk();
Willy Tarreau3b9a0c92014-07-19 06:37:33 +02001070 if (ssl_sock_get_remote_common_name(remote, cn_trash) > 0) {
Emmanuel Hocdet58118b42017-10-13 12:15:28 +02001071 ssl_tlv_len += make_tlv(&buf[ret+ssl_tlv_len], (buf_len - ret - ssl_tlv_len), PP2_SUBTYPE_SSL_CN, cn_trash->len, cn_trash->str);
David Safb76832014-05-08 23:42:08 -04001072 }
1073 }
1074 }
1075 tlv->tlv.length_hi = (uint16_t)(ssl_tlv_len - sizeof(struct tlv)) >> 8;
1076 tlv->tlv.length_lo = (uint16_t)(ssl_tlv_len - sizeof(struct tlv)) & 0x00ff;
1077 ret += ssl_tlv_len;
1078 }
1079#endif
1080
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001081#ifdef CONFIG_HAP_NS
1082 if (remote && (remote->proxy_netns)) {
1083 if ((buf_len - ret) < sizeof(struct tlv))
1084 return 0;
Emmanuel Hocdet571c7ac2017-10-31 18:24:05 +01001085 ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_NETNS, remote->proxy_netns->name_len, remote->proxy_netns->node.key);
KOVACS Krisztianb3e54fe2014-11-17 15:11:45 +01001086 }
1087#endif
1088
Willy Tarreau8fccfa22014-06-14 08:28:06 +02001089 hdr->len = htons((uint16_t)(ret - PP2_HEADER_LEN));
David Safb76832014-05-08 23:42:08 -04001090
1091 return ret;
1092}
Emeric Brun4f603012017-01-05 15:11:44 +01001093
Willy Tarreau60ca10a2017-08-18 15:26:54 +02001094/* return the major HTTP version as 1 or 2 depending on how the request arrived
1095 * before being processed.
1096 */
1097static int
1098smp_fetch_fc_http_major(const struct arg *args, struct sample *smp, const char *kw, void *private)
1099{
1100 struct connection *conn = objt_conn(smp->sess->origin);
1101
1102 smp->data.type = SMP_T_SINT;
1103 smp->data.u.sint = (conn && strcmp(conn_get_mux_name(conn), "H2") == 0) ? 2 : 1;
1104 return 1;
1105}
1106
Emeric Brun4f603012017-01-05 15:11:44 +01001107/* fetch if the received connection used a PROXY protocol header */
1108int smp_fetch_fc_rcvd_proxy(const struct arg *args, struct sample *smp, const char *kw, void *private)
1109{
1110 struct connection *conn;
1111
1112 conn = objt_conn(smp->sess->origin);
1113 if (!conn)
1114 return 0;
1115
1116 if (!(conn->flags & CO_FL_CONNECTED)) {
1117 smp->flags |= SMP_F_MAY_CHANGE;
1118 return 0;
1119 }
1120
1121 smp->flags = 0;
1122 smp->data.type = SMP_T_BOOL;
1123 smp->data.u.sint = (conn->flags & CO_FL_RCVD_PROXY) ? 1 : 0;
1124
1125 return 1;
1126}
1127
1128/* Note: must not be declared <const> as its list will be overwritten.
1129 * Note: fetches that may return multiple types must be declared as the lowest
1130 * common denominator, the type that can be casted into all other ones. For
1131 * instance v4/v6 must be declared v4.
1132 */
1133static struct sample_fetch_kw_list sample_fetch_keywords = {ILH, {
Willy Tarreau60ca10a2017-08-18 15:26:54 +02001134 { "fc_http_major", smp_fetch_fc_http_major, 0, NULL, SMP_T_SINT, SMP_USE_L4CLI },
Emeric Brun4f603012017-01-05 15:11:44 +01001135 { "fc_rcvd_proxy", smp_fetch_fc_rcvd_proxy, 0, NULL, SMP_T_BOOL, SMP_USE_L4CLI },
1136 { /* END */ },
1137}};
1138
1139
1140__attribute__((constructor))
1141static void __connection_init(void)
1142{
1143 sample_register_fetches(&sample_fetch_keywords);
1144}