blob: f525895360630b885f553b60f1a277a42d4c14e9 [file] [log] [blame]
Willy Tarreau39713102016-11-25 15:49:32 +01001/*
2 * "tcp" rules processing
3 *
4 * Copyright 2000-2016 Willy Tarreau <w@1wt.eu>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
Willy Tarreaudcc048a2020-06-04 19:11:43 +020012#include <haproxy/acl.h>
Willy Tarreau122eba92020-06-04 10:15:32 +020013#include <haproxy/action.h>
Willy Tarreau4c7e4b72020-05-27 12:58:42 +020014#include <haproxy/api.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020015#include <haproxy/arg-t.h>
Willy Tarreau278161c2020-06-04 11:18:28 +020016#include <haproxy/capture-t.h>
Willy Tarreau6be78492020-06-05 00:00:29 +020017#include <haproxy/cfgparse.h>
Willy Tarreauf1d32c42020-06-04 21:07:02 +020018#include <haproxy/channel.h>
Willy Tarreau7ea393d2020-06-04 18:02:10 +020019#include <haproxy/connection.h>
Willy Tarreauf268ee82020-06-04 17:05:57 +020020#include <haproxy/global.h>
Willy Tarreau853b2972020-05-27 18:01:47 +020021#include <haproxy/list.h>
Willy Tarreauaeed4a82020-06-04 22:01:04 +020022#include <haproxy/log.h>
Willy Tarreaua264d962020-06-04 22:29:18 +020023#include <haproxy/proxy.h>
Willy Tarreaue6ce10b2020-06-04 15:33:47 +020024#include <haproxy/sample.h>
Willy Tarreaudfd3de82020-06-04 23:46:14 +020025#include <haproxy/stick_table.h>
26#include <haproxy/stream-t.h>
Willy Tarreau5e539c92020-06-04 20:45:39 +020027#include <haproxy/stream_interface.h>
Willy Tarreau8b550af2020-06-04 17:42:48 +020028#include <haproxy/tcp_rules.h>
Willy Tarreauc2f7c582020-06-02 18:15:32 +020029#include <haproxy/ticks.h>
Willy Tarreau92b4f132020-06-01 11:05:15 +020030#include <haproxy/time.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020031#include <haproxy/tools.h>
Willy Tarreaudfd3de82020-06-04 23:46:14 +020032#include <haproxy/trace.h>
Willy Tarreau39713102016-11-25 15:49:32 +010033
Willy Tarreau39713102016-11-25 15:49:32 +010034
Christopher Fauleteea8fc72019-11-05 16:18:10 +010035#define TRACE_SOURCE &trace_strm
36
Willy Tarreau39713102016-11-25 15:49:32 +010037/* List head of all known action keywords for "tcp-request connection" */
38struct list tcp_req_conn_keywords = LIST_HEAD_INIT(tcp_req_conn_keywords);
39struct list tcp_req_sess_keywords = LIST_HEAD_INIT(tcp_req_sess_keywords);
40struct list tcp_req_cont_keywords = LIST_HEAD_INIT(tcp_req_cont_keywords);
41struct list tcp_res_cont_keywords = LIST_HEAD_INIT(tcp_res_cont_keywords);
42
43/*
44 * Register keywords.
45 */
46void tcp_req_conn_keywords_register(struct action_kw_list *kw_list)
47{
Willy Tarreau2b718102021-04-21 07:32:39 +020048 LIST_APPEND(&tcp_req_conn_keywords, &kw_list->list);
Willy Tarreau39713102016-11-25 15:49:32 +010049}
50
51void tcp_req_sess_keywords_register(struct action_kw_list *kw_list)
52{
Willy Tarreau2b718102021-04-21 07:32:39 +020053 LIST_APPEND(&tcp_req_sess_keywords, &kw_list->list);
Willy Tarreau39713102016-11-25 15:49:32 +010054}
55
56void tcp_req_cont_keywords_register(struct action_kw_list *kw_list)
57{
Willy Tarreau2b718102021-04-21 07:32:39 +020058 LIST_APPEND(&tcp_req_cont_keywords, &kw_list->list);
Willy Tarreau39713102016-11-25 15:49:32 +010059}
60
61void tcp_res_cont_keywords_register(struct action_kw_list *kw_list)
62{
Willy Tarreau2b718102021-04-21 07:32:39 +020063 LIST_APPEND(&tcp_res_cont_keywords, &kw_list->list);
Willy Tarreau39713102016-11-25 15:49:32 +010064}
65
66/*
67 * Return the struct tcp_req_action_kw associated to a keyword.
68 */
Thierry Fournier7a71a6d2020-11-28 17:40:24 +010069struct action_kw *tcp_req_conn_action(const char *kw)
Willy Tarreau39713102016-11-25 15:49:32 +010070{
71 return action_lookup(&tcp_req_conn_keywords, kw);
72}
73
Thierry Fournier7a71a6d2020-11-28 17:40:24 +010074struct action_kw *tcp_req_sess_action(const char *kw)
Willy Tarreau39713102016-11-25 15:49:32 +010075{
76 return action_lookup(&tcp_req_sess_keywords, kw);
77}
78
Thierry Fournier7a71a6d2020-11-28 17:40:24 +010079struct action_kw *tcp_req_cont_action(const char *kw)
Willy Tarreau39713102016-11-25 15:49:32 +010080{
81 return action_lookup(&tcp_req_cont_keywords, kw);
82}
83
Thierry Fournier7a71a6d2020-11-28 17:40:24 +010084struct action_kw *tcp_res_cont_action(const char *kw)
Willy Tarreau39713102016-11-25 15:49:32 +010085{
86 return action_lookup(&tcp_res_cont_keywords, kw);
87}
88
89/* This function performs the TCP request analysis on the current request. It
90 * returns 1 if the processing can continue on next analysers, or zero if it
91 * needs more data, encounters an error, or wants to immediately abort the
92 * request. It relies on buffers flags, and updates s->req->analysers. The
93 * function may be called for frontend rules and backend rules. It only relies
94 * on the backend pointer so this works for both cases.
95 */
96int tcp_inspect_request(struct stream *s, struct channel *req, int an_bit)
97{
98 struct session *sess = s->sess;
99 struct act_rule *rule;
Willy Tarreau39713102016-11-25 15:49:32 +0100100 int partial;
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100101 int act_opts = 0;
Willy Tarreau39713102016-11-25 15:49:32 +0100102
Christopher Fauleteea8fc72019-11-05 16:18:10 +0100103 DBG_TRACE_ENTER(STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
Willy Tarreau39713102016-11-25 15:49:32 +0100104
105 /* We don't know whether we have enough data, so must proceed
106 * this way :
107 * - iterate through all rules in their declaration order
108 * - if one rule returns MISS, it means the inspect delay is
109 * not over yet, then return immediately, otherwise consider
110 * it as a non-match.
111 * - if one rule returns OK, then return OK
112 * - if one rule returns KO, then return KO
113 */
114
Christopher Fauletfc553c92021-09-30 14:56:30 +0200115 if ((req->flags & (CF_EOI|CF_SHUTR|CF_READ_ERROR)) || channel_full(req, global.tune.maxrewrite) ||
Christopher Faulet59df8122021-09-23 14:46:32 +0200116 si_rx_blocked_room(chn_prod(req)) ||
Christopher Faulet2747fbb2020-07-28 11:56:13 +0200117 !s->be->tcp_req.inspect_delay || tick_is_expired(s->rules_exp, now_ms))
Willy Tarreau39713102016-11-25 15:49:32 +0100118 partial = SMP_OPT_FINAL;
119 else
120 partial = 0;
121
122 /* If "the current_rule_list" match the executed rule list, we are in
123 * resume condition. If a resume is needed it is always in the action
124 * and never in the ACL or converters. In this case, we initialise the
125 * current rule, and go to the action execution point.
126 */
127 if (s->current_rule) {
128 rule = s->current_rule;
129 s->current_rule = NULL;
130 if (s->current_rule_list == &s->be->tcp_req.inspect_rules)
131 goto resume_execution;
132 }
133 s->current_rule_list = &s->be->tcp_req.inspect_rules;
134
135 list_for_each_entry(rule, &s->be->tcp_req.inspect_rules, list) {
136 enum acl_test_res ret = ACL_TEST_PASS;
137
138 if (rule->cond) {
139 ret = acl_exec_cond(rule->cond, s->be, sess, s, SMP_OPT_DIR_REQ | partial);
140 if (ret == ACL_TEST_MISS)
141 goto missing_data;
142
143 ret = acl_pass(ret);
144 if (rule->cond->pol == ACL_COND_UNLESS)
145 ret = !ret;
146 }
147
148 if (ret) {
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100149 act_opts |= ACT_OPT_FIRST;
Willy Tarreau39713102016-11-25 15:49:32 +0100150resume_execution:
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100151
152 /* Always call the action function if defined */
153 if (rule->action_ptr) {
154 if (partial & SMP_OPT_FINAL)
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100155 act_opts |= ACT_OPT_FINAL;
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100156
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100157 switch (rule->action_ptr(rule, s->be, s->sess, s, act_opts)) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100158 case ACT_RET_CONT:
159 break;
160 case ACT_RET_STOP:
161 case ACT_RET_DONE:
162 goto end;
163 case ACT_RET_YIELD:
164 s->current_rule = rule;
Christopher Faulet99aaca92020-07-28 11:30:19 +0200165 if (partial & SMP_OPT_FINAL) {
166 send_log(s->be, LOG_WARNING,
167 "Internal error: yield not allowed if the inspect-delay expired "
168 "for the tcp-request content actions.");
169 goto internal;
170 }
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100171 goto missing_data;
172 case ACT_RET_DENY:
173 goto deny;
174 case ACT_RET_ABRT:
175 goto abort;
176 case ACT_RET_ERR:
177 goto internal;
178 case ACT_RET_INV:
179 goto invalid;
180 }
181 continue; /* eval the next rule */
182 }
183
184 /* If not action function defined, check for known actions */
Willy Tarreau39713102016-11-25 15:49:32 +0100185 if (rule->action == ACT_ACTION_ALLOW) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100186 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100187 }
188 else if (rule->action == ACT_ACTION_DENY) {
Christopher Faulet282992e2019-12-16 12:34:31 +0100189 goto deny;
Willy Tarreau39713102016-11-25 15:49:32 +0100190 }
Willy Tarreau39713102016-11-25 15:49:32 +0100191 }
192 }
193
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100194 end:
Willy Tarreau39713102016-11-25 15:49:32 +0100195 /* if we get there, it means we have no rule which matches, or
196 * we have an explicit accept, so we apply the default accept.
197 */
198 req->analysers &= ~an_bit;
Christopher Faulet2747fbb2020-07-28 11:56:13 +0200199 req->analyse_exp = s->rules_exp = TICK_ETERNITY;
Christopher Fauleteea8fc72019-11-05 16:18:10 +0100200 DBG_TRACE_LEAVE(STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
Willy Tarreau39713102016-11-25 15:49:32 +0100201 return 1;
202
203 missing_data:
204 channel_dont_connect(req);
205 /* just set the request timeout once at the beginning of the request */
Christopher Faulet2747fbb2020-07-28 11:56:13 +0200206 if (!tick_isset(s->rules_exp) && s->be->tcp_req.inspect_delay)
207 s->rules_exp = tick_add(now_ms, s->be->tcp_req.inspect_delay);
208 req->analyse_exp = tick_first((tick_is_expired(req->analyse_exp, now_ms) ? 0 : req->analyse_exp), s->rules_exp);
Christopher Fauleteea8fc72019-11-05 16:18:10 +0100209 DBG_TRACE_DEVEL("waiting for more data", STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
Willy Tarreau39713102016-11-25 15:49:32 +0100210 return 0;
211
Christopher Faulet282992e2019-12-16 12:34:31 +0100212 deny:
Willy Tarreau4781b152021-04-06 13:53:36 +0200213 _HA_ATOMIC_INC(&sess->fe->fe_counters.denied_req);
Christopher Faulet282992e2019-12-16 12:34:31 +0100214 if (sess->listener && sess->listener->counters)
Willy Tarreau4781b152021-04-06 13:53:36 +0200215 _HA_ATOMIC_INC(&sess->listener->counters->denied_req);
Christopher Faulet282992e2019-12-16 12:34:31 +0100216 goto reject;
217
218 internal:
Willy Tarreau4781b152021-04-06 13:53:36 +0200219 _HA_ATOMIC_INC(&sess->fe->fe_counters.internal_errors);
Christopher Faulet282992e2019-12-16 12:34:31 +0100220 if (sess->listener && sess->listener->counters)
Willy Tarreau4781b152021-04-06 13:53:36 +0200221 _HA_ATOMIC_INC(&sess->listener->counters->internal_errors);
Christopher Faulet282992e2019-12-16 12:34:31 +0100222 if (!(s->flags & SF_ERR_MASK))
223 s->flags |= SF_ERR_INTERNAL;
224 goto reject;
225
226 invalid:
Willy Tarreau4781b152021-04-06 13:53:36 +0200227 _HA_ATOMIC_INC(&sess->fe->fe_counters.failed_req);
Christopher Faulet282992e2019-12-16 12:34:31 +0100228 if (sess->listener && sess->listener->counters)
Willy Tarreau4781b152021-04-06 13:53:36 +0200229 _HA_ATOMIC_INC(&sess->listener->counters->failed_req);
Christopher Faulet282992e2019-12-16 12:34:31 +0100230
231 reject:
232 si_must_kill_conn(chn_prod(req));
233 channel_abort(req);
234 channel_abort(&s->res);
235
236 abort:
237 req->analysers &= AN_REQ_FLT_END;
238
239 if (!(s->flags & SF_ERR_MASK))
240 s->flags |= SF_ERR_PRXCOND;
241 if (!(s->flags & SF_FINST_MASK))
242 s->flags |= SF_FINST_R;
243 DBG_TRACE_DEVEL("leaving on error|deny|abort", STRM_EV_STRM_ANA|STRM_EV_TCP_ANA|STRM_EV_TCP_ERR, s);
244 return 0;
Willy Tarreau39713102016-11-25 15:49:32 +0100245}
246
247/* This function performs the TCP response analysis on the current response. It
248 * returns 1 if the processing can continue on next analysers, or zero if it
249 * needs more data, encounters an error, or wants to immediately abort the
250 * response. It relies on buffers flags, and updates s->rep->analysers. The
251 * function may be called for backend rules.
252 */
253int tcp_inspect_response(struct stream *s, struct channel *rep, int an_bit)
254{
255 struct session *sess = s->sess;
256 struct act_rule *rule;
257 int partial;
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100258 int act_opts = 0;
Willy Tarreau39713102016-11-25 15:49:32 +0100259
Christopher Fauleteea8fc72019-11-05 16:18:10 +0100260 DBG_TRACE_ENTER(STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
Willy Tarreau39713102016-11-25 15:49:32 +0100261
262 /* We don't know whether we have enough data, so must proceed
263 * this way :
264 * - iterate through all rules in their declaration order
265 * - if one rule returns MISS, it means the inspect delay is
266 * not over yet, then return immediately, otherwise consider
267 * it as a non-match.
268 * - if one rule returns OK, then return OK
269 * - if one rule returns KO, then return KO
270 */
Christopher Fauletfc553c92021-09-30 14:56:30 +0200271 if ((rep->flags & (CF_EOI|CF_SHUTR|CF_READ_ERROR)) || channel_full(rep, global.tune.maxrewrite) ||
Christopher Faulet59df8122021-09-23 14:46:32 +0200272 si_rx_blocked_room(chn_prod(rep)) ||
Christopher Faulet2747fbb2020-07-28 11:56:13 +0200273 !s->be->tcp_rep.inspect_delay || tick_is_expired(s->rules_exp, now_ms))
Willy Tarreau39713102016-11-25 15:49:32 +0100274 partial = SMP_OPT_FINAL;
275 else
276 partial = 0;
277
278 /* If "the current_rule_list" match the executed rule list, we are in
279 * resume condition. If a resume is needed it is always in the action
280 * and never in the ACL or converters. In this case, we initialise the
281 * current rule, and go to the action execution point.
282 */
283 if (s->current_rule) {
284 rule = s->current_rule;
285 s->current_rule = NULL;
286 if (s->current_rule_list == &s->be->tcp_rep.inspect_rules)
287 goto resume_execution;
288 }
289 s->current_rule_list = &s->be->tcp_rep.inspect_rules;
Christopher Faulet2747fbb2020-07-28 11:56:13 +0200290 s->rules_exp = TICK_ETERNITY;
Willy Tarreau39713102016-11-25 15:49:32 +0100291
292 list_for_each_entry(rule, &s->be->tcp_rep.inspect_rules, list) {
293 enum acl_test_res ret = ACL_TEST_PASS;
294
295 if (rule->cond) {
296 ret = acl_exec_cond(rule->cond, s->be, sess, s, SMP_OPT_DIR_RES | partial);
Christopher Faulet2747fbb2020-07-28 11:56:13 +0200297 if (ret == ACL_TEST_MISS)
298 goto missing_data;
Willy Tarreau39713102016-11-25 15:49:32 +0100299
300 ret = acl_pass(ret);
301 if (rule->cond->pol == ACL_COND_UNLESS)
302 ret = !ret;
303 }
304
305 if (ret) {
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100306 act_opts |= ACT_OPT_FIRST;
Willy Tarreau39713102016-11-25 15:49:32 +0100307resume_execution:
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100308 /* Always call the action function if defined */
309 if (rule->action_ptr) {
310 if (partial & SMP_OPT_FINAL)
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100311 act_opts |= ACT_OPT_FINAL;
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100312
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100313 switch (rule->action_ptr(rule, s->be, s->sess, s, act_opts)) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100314 case ACT_RET_CONT:
315 break;
316 case ACT_RET_STOP:
317 case ACT_RET_DONE:
318 goto end;
319 case ACT_RET_YIELD:
320 s->current_rule = rule;
Christopher Faulet99aaca92020-07-28 11:30:19 +0200321 if (partial & SMP_OPT_FINAL) {
322 send_log(s->be, LOG_WARNING,
323 "Internal error: yield not allowed if the inspect-delay expired "
324 "for the tcp-response content actions.");
325 goto internal;
326 }
Christopher Faulet2747fbb2020-07-28 11:56:13 +0200327 channel_dont_close(rep);
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100328 goto missing_data;
329 case ACT_RET_DENY:
330 goto deny;
331 case ACT_RET_ABRT:
332 goto abort;
333 case ACT_RET_ERR:
334 goto internal;
335 case ACT_RET_INV:
336 goto invalid;
337 }
338 continue; /* eval the next rule */
339 }
340
341 /* If not action function defined, check for known actions */
Willy Tarreau39713102016-11-25 15:49:32 +0100342 if (rule->action == ACT_ACTION_ALLOW) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100343 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100344 }
345 else if (rule->action == ACT_ACTION_DENY) {
Christopher Faulet282992e2019-12-16 12:34:31 +0100346 goto deny;
Willy Tarreau39713102016-11-25 15:49:32 +0100347 }
348 else if (rule->action == ACT_TCP_CLOSE) {
349 chn_prod(rep)->flags |= SI_FL_NOLINGER | SI_FL_NOHALF;
Willy Tarreau0f9cd7b2019-01-31 19:02:43 +0100350 si_must_kill_conn(chn_prod(rep));
Willy Tarreau39713102016-11-25 15:49:32 +0100351 si_shutr(chn_prod(rep));
352 si_shutw(chn_prod(rep));
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100353 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100354 }
355 }
356 }
357
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100358 end:
Willy Tarreau39713102016-11-25 15:49:32 +0100359 /* if we get there, it means we have no rule which matches, or
360 * we have an explicit accept, so we apply the default accept.
361 */
362 rep->analysers &= ~an_bit;
Christopher Faulet2747fbb2020-07-28 11:56:13 +0200363 rep->analyse_exp = s->rules_exp = TICK_ETERNITY;
Christopher Fauleteea8fc72019-11-05 16:18:10 +0100364 DBG_TRACE_LEAVE(STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
Willy Tarreau39713102016-11-25 15:49:32 +0100365 return 1;
Christopher Faulet282992e2019-12-16 12:34:31 +0100366
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100367 missing_data:
Christopher Faulet54f3e182020-07-29 12:00:23 +0200368 /* just set the analyser timeout once at the beginning of the response */
Christopher Faulet2747fbb2020-07-28 11:56:13 +0200369 if (!tick_isset(s->rules_exp) && s->be->tcp_rep.inspect_delay)
370 s->rules_exp = tick_add(now_ms, s->be->tcp_rep.inspect_delay);
371 rep->analyse_exp = tick_first((tick_is_expired(rep->analyse_exp, now_ms) ? 0 : rep->analyse_exp), s->rules_exp);
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100372 DBG_TRACE_DEVEL("waiting for more data", STRM_EV_STRM_ANA|STRM_EV_TCP_ANA, s);
373 return 0;
374
Christopher Faulet282992e2019-12-16 12:34:31 +0100375 deny:
Willy Tarreau4781b152021-04-06 13:53:36 +0200376 _HA_ATOMIC_INC(&s->sess->fe->fe_counters.denied_resp);
377 _HA_ATOMIC_INC(&s->be->be_counters.denied_resp);
William Lallemand36119de2021-03-08 15:26:48 +0100378 if (s->sess->listener && s->sess->listener->counters)
Willy Tarreau4781b152021-04-06 13:53:36 +0200379 _HA_ATOMIC_INC(&s->sess->listener->counters->denied_resp);
Christopher Faulet282992e2019-12-16 12:34:31 +0100380 if (objt_server(s->target))
Willy Tarreau4781b152021-04-06 13:53:36 +0200381 _HA_ATOMIC_INC(&__objt_server(s->target)->counters.denied_resp);
Christopher Faulet282992e2019-12-16 12:34:31 +0100382 goto reject;
383
384 internal:
Willy Tarreau4781b152021-04-06 13:53:36 +0200385 _HA_ATOMIC_INC(&s->sess->fe->fe_counters.internal_errors);
386 _HA_ATOMIC_INC(&s->be->be_counters.internal_errors);
William Lallemand36119de2021-03-08 15:26:48 +0100387 if (s->sess->listener && s->sess->listener->counters)
Willy Tarreau4781b152021-04-06 13:53:36 +0200388 _HA_ATOMIC_INC(&s->sess->listener->counters->internal_errors);
Christopher Faulet282992e2019-12-16 12:34:31 +0100389 if (objt_server(s->target))
Willy Tarreau4781b152021-04-06 13:53:36 +0200390 _HA_ATOMIC_INC(&__objt_server(s->target)->counters.internal_errors);
Christopher Faulet282992e2019-12-16 12:34:31 +0100391 if (!(s->flags & SF_ERR_MASK))
392 s->flags |= SF_ERR_INTERNAL;
393 goto reject;
394
395 invalid:
Willy Tarreau4781b152021-04-06 13:53:36 +0200396 _HA_ATOMIC_INC(&s->be->be_counters.failed_resp);
Christopher Faulet282992e2019-12-16 12:34:31 +0100397 if (objt_server(s->target))
Willy Tarreau4781b152021-04-06 13:53:36 +0200398 _HA_ATOMIC_INC(&__objt_server(s->target)->counters.failed_resp);
Christopher Faulet282992e2019-12-16 12:34:31 +0100399
400 reject:
401 si_must_kill_conn(chn_prod(rep));
402 channel_abort(rep);
403 channel_abort(&s->req);
404
405 abort:
Christopher Faulet19dbf2d2020-07-28 11:40:07 +0200406 rep->analysers &= AN_RES_FLT_END;
Christopher Faulet282992e2019-12-16 12:34:31 +0100407
408 if (!(s->flags & SF_ERR_MASK))
409 s->flags |= SF_ERR_PRXCOND;
410 if (!(s->flags & SF_FINST_MASK))
411 s->flags |= SF_FINST_D;
412 DBG_TRACE_DEVEL("leaving on error", STRM_EV_STRM_ANA|STRM_EV_TCP_ANA|STRM_EV_TCP_ERR, s);
413 return 0;
Willy Tarreau39713102016-11-25 15:49:32 +0100414}
415
416
417/* This function performs the TCP layer4 analysis on the current request. It
418 * returns 0 if a reject rule matches, otherwise 1 if either an accept rule
419 * matches or if no more rule matches. It can only use rules which don't need
420 * any data. This only works on connection-based client-facing stream interfaces.
421 */
422int tcp_exec_l4_rules(struct session *sess)
423{
424 struct act_rule *rule;
Willy Tarreau39713102016-11-25 15:49:32 +0100425 struct connection *conn = objt_conn(sess->origin);
426 int result = 1;
427 enum acl_test_res ret;
428
429 if (!conn)
430 return result;
431
432 list_for_each_entry(rule, &sess->fe->tcp_req.l4_rules, list) {
433 ret = ACL_TEST_PASS;
434
435 if (rule->cond) {
436 ret = acl_exec_cond(rule->cond, sess->fe, sess, NULL, SMP_OPT_DIR_REQ|SMP_OPT_FINAL);
437 ret = acl_pass(ret);
438 if (rule->cond->pol == ACL_COND_UNLESS)
439 ret = !ret;
440 }
441
442 if (ret) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100443 /* Always call the action function if defined */
444 if (rule->action_ptr) {
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100445 switch (rule->action_ptr(rule, sess->fe, sess, NULL, ACT_OPT_FINAL | ACT_OPT_FIRST)) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100446 case ACT_RET_YIELD:
447 /* yield is not allowed at this point. If this return code is
448 * used it is a bug, so I prefer to abort the process.
449 */
450 send_log(sess->fe, LOG_WARNING,
451 "Internal error: yield not allowed with tcp-request connection actions.");
452 /* fall through */
453 case ACT_RET_STOP:
454 case ACT_RET_DONE:
455 goto end;
456 case ACT_RET_CONT:
457 break;
458 case ACT_RET_DENY:
459 case ACT_RET_ABRT:
460 case ACT_RET_ERR:
461 case ACT_RET_INV:
462 result = 0;
463 goto end;
464 }
465 continue; /* eval the next rule */
466 }
467
468 /* If not action function defined, check for known actions */
Willy Tarreau39713102016-11-25 15:49:32 +0100469 if (rule->action == ACT_ACTION_ALLOW) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100470 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100471 }
472 else if (rule->action == ACT_ACTION_DENY) {
Willy Tarreau4781b152021-04-06 13:53:36 +0200473 _HA_ATOMIC_INC(&sess->fe->fe_counters.denied_conn);
Willy Tarreaua12dde02016-12-22 18:14:41 +0100474 if (sess->listener && sess->listener->counters)
Willy Tarreau4781b152021-04-06 13:53:36 +0200475 _HA_ATOMIC_INC(&sess->listener->counters->denied_conn);
Willy Tarreau39713102016-11-25 15:49:32 +0100476
477 result = 0;
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100478 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100479 }
Willy Tarreau39713102016-11-25 15:49:32 +0100480 else if (rule->action == ACT_TCP_EXPECT_PX) {
Willy Tarreau4450b582020-01-23 15:23:13 +0100481 if (!(conn->flags & CO_FL_HANDSHAKE)) {
Olivier Houchardfe50bfb2019-05-27 12:09:19 +0200482 if (xprt_add_hs(conn) < 0) {
483 result = 0;
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100484 goto end;
Olivier Houchardfe50bfb2019-05-27 12:09:19 +0200485 }
486 }
Willy Tarreau39713102016-11-25 15:49:32 +0100487 conn->flags |= CO_FL_ACCEPT_PROXY;
Willy Tarreau39713102016-11-25 15:49:32 +0100488 }
489 else if (rule->action == ACT_TCP_EXPECT_CIP) {
Willy Tarreau4450b582020-01-23 15:23:13 +0100490 if (!(conn->flags & CO_FL_HANDSHAKE)) {
Olivier Houchardfe50bfb2019-05-27 12:09:19 +0200491 if (xprt_add_hs(conn) < 0) {
492 result = 0;
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100493 goto end;
Olivier Houchardfe50bfb2019-05-27 12:09:19 +0200494 }
495 }
Willy Tarreau39713102016-11-25 15:49:32 +0100496 conn->flags |= CO_FL_ACCEPT_CIP;
Willy Tarreau39713102016-11-25 15:49:32 +0100497 }
Willy Tarreau39713102016-11-25 15:49:32 +0100498 }
499 }
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100500 end:
Willy Tarreau39713102016-11-25 15:49:32 +0100501 return result;
502}
503
504/* This function performs the TCP layer5 analysis on the current request. It
505 * returns 0 if a reject rule matches, otherwise 1 if either an accept rule
506 * matches or if no more rule matches. It can only use rules which don't need
507 * any data. This only works on session-based client-facing stream interfaces.
508 * An example of valid use case is to track a stick-counter on the source
509 * address extracted from the proxy protocol.
510 */
511int tcp_exec_l5_rules(struct session *sess)
512{
513 struct act_rule *rule;
Willy Tarreau39713102016-11-25 15:49:32 +0100514 int result = 1;
515 enum acl_test_res ret;
516
517 list_for_each_entry(rule, &sess->fe->tcp_req.l5_rules, list) {
518 ret = ACL_TEST_PASS;
519
520 if (rule->cond) {
521 ret = acl_exec_cond(rule->cond, sess->fe, sess, NULL, SMP_OPT_DIR_REQ|SMP_OPT_FINAL);
522 ret = acl_pass(ret);
523 if (rule->cond->pol == ACL_COND_UNLESS)
524 ret = !ret;
525 }
526
527 if (ret) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100528 /* Always call the action function if defined */
529 if (rule->action_ptr) {
Christopher Faulet105ba6c2019-12-18 14:41:51 +0100530 switch (rule->action_ptr(rule, sess->fe, sess, NULL, ACT_OPT_FINAL | ACT_OPT_FIRST)) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100531 case ACT_RET_YIELD:
532 /* yield is not allowed at this point. If this return code is
533 * used it is a bug, so I prefer to abort the process.
534 */
535 send_log(sess->fe, LOG_WARNING,
536 "Internal error: yield not allowed with tcp-request session actions.");
537 /* fall through */
538 case ACT_RET_STOP:
539 case ACT_RET_DONE:
540 goto end;
541 case ACT_RET_CONT:
542 break;
543 case ACT_RET_DENY:
544 case ACT_RET_ABRT:
545 case ACT_RET_ERR:
546 case ACT_RET_INV:
547 result = 0;
548 goto end;
549 }
550 continue; /* eval the next rule */
551 }
552
553 /* If not action function defined, check for known actions */
Willy Tarreau39713102016-11-25 15:49:32 +0100554 if (rule->action == ACT_ACTION_ALLOW) {
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100555 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100556 }
557 else if (rule->action == ACT_ACTION_DENY) {
Willy Tarreau4781b152021-04-06 13:53:36 +0200558 _HA_ATOMIC_INC(&sess->fe->fe_counters.denied_sess);
Willy Tarreaua12dde02016-12-22 18:14:41 +0100559 if (sess->listener && sess->listener->counters)
Willy Tarreau4781b152021-04-06 13:53:36 +0200560 _HA_ATOMIC_INC(&sess->listener->counters->denied_sess);
Willy Tarreau39713102016-11-25 15:49:32 +0100561
562 result = 0;
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100563 goto end;
Willy Tarreau39713102016-11-25 15:49:32 +0100564 }
Willy Tarreau39713102016-11-25 15:49:32 +0100565 }
566 }
Christopher Fauletcd26e8a2019-12-18 11:13:39 +0100567 end:
Willy Tarreau39713102016-11-25 15:49:32 +0100568 return result;
569}
570
571/* Parse a tcp-response rule. Return a negative value in case of failure */
572static int tcp_parse_response_rule(char **args, int arg, int section_type,
Willy Tarreau01825162021-03-09 09:53:46 +0100573 struct proxy *curpx, const struct proxy *defpx,
Willy Tarreau39713102016-11-25 15:49:32 +0100574 struct act_rule *rule, char **err,
575 unsigned int where,
576 const char *file, int line)
577{
578 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
579 memprintf(err, "%s %s is only allowed in 'backend' sections",
580 args[0], args[1]);
581 return -1;
582 }
583
584 if (strcmp(args[arg], "accept") == 0) {
585 arg++;
586 rule->action = ACT_ACTION_ALLOW;
Christopher Faulet245cf792019-12-18 14:58:12 +0100587 rule->flags |= ACT_FLAG_FINAL;
Willy Tarreau39713102016-11-25 15:49:32 +0100588 }
589 else if (strcmp(args[arg], "reject") == 0) {
590 arg++;
591 rule->action = ACT_ACTION_DENY;
Christopher Faulet245cf792019-12-18 14:58:12 +0100592 rule->flags |= ACT_FLAG_FINAL;
Willy Tarreau39713102016-11-25 15:49:32 +0100593 }
594 else if (strcmp(args[arg], "close") == 0) {
595 arg++;
596 rule->action = ACT_TCP_CLOSE;
Christopher Faulet245cf792019-12-18 14:58:12 +0100597 rule->flags |= ACT_FLAG_FINAL;
Willy Tarreau39713102016-11-25 15:49:32 +0100598 }
599 else {
600 struct action_kw *kw;
601 kw = tcp_res_cont_action(args[arg]);
602 if (kw) {
603 arg++;
Willy Tarreau39713102016-11-25 15:49:32 +0100604 rule->kw = kw;
605 if (kw->parse((const char **)args, &arg, curpx, rule, err) == ACT_RET_PRS_ERR)
606 return -1;
607 } else {
Willy Tarreaudb67b0e2021-03-12 13:46:10 +0100608 const char *extra[] = { "accept", "reject", "close", NULL };
609 const char *best = action_suggest(args[arg], &tcp_res_cont_keywords, extra);
610
Willy Tarreau39713102016-11-25 15:49:32 +0100611 action_build_list(&tcp_res_cont_keywords, &trash);
612 memprintf(err,
Willy Tarreaudb67b0e2021-03-12 13:46:10 +0100613 "'%s %s' expects 'accept', 'close', 'reject', %s in %s '%s' (got '%s').%s%s%s",
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200614 args[0], args[1], trash.area,
Willy Tarreaudb67b0e2021-03-12 13:46:10 +0100615 proxy_type_str(curpx), curpx->id, args[arg],
616 best ? " Did you mean '" : "",
617 best ? best : "",
618 best ? "' maybe ?" : "");
Willy Tarreau39713102016-11-25 15:49:32 +0100619 return -1;
620 }
621 }
622
623 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
Christopher Faulet1b421ea2017-09-22 14:38:56 +0200624 if ((rule->cond = build_acl_cond(file, line, &curpx->acl, curpx, (const char **)args+arg, err)) == NULL) {
Willy Tarreau39713102016-11-25 15:49:32 +0100625 memprintf(err,
626 "'%s %s %s' : error detected in %s '%s' while parsing '%s' condition : %s",
627 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg], *err);
628 return -1;
629 }
630 }
631 else if (*args[arg]) {
632 memprintf(err,
633 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (got '%s')",
634 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
635 return -1;
636 }
637 return 0;
638}
639
Christopher Fauletac98d812019-12-18 09:20:16 +0100640
641/* This function executes a track-sc* actions. On success, it returns
642 * ACT_RET_CONT. If it must yield, it return ACT_RET_YIELD. Otherwsize
643 * ACT_RET_ERR is returned.
644 */
645static enum act_return tcp_action_track_sc(struct act_rule *rule, struct proxy *px,
646 struct session *sess, struct stream *s, int flags)
647{
648 struct stksess *ts;
649 struct stktable *t;
650 struct stktable_key *key;
651 struct sample smp;
652 int opt;
653
Christopher Faulet67307792020-02-10 09:54:49 +0100654 opt = SMP_OPT_DIR_REQ;
Christopher Fauletac98d812019-12-18 09:20:16 +0100655 if (flags & ACT_FLAG_FINAL)
656 opt |= SMP_OPT_FINAL;
Willy Tarreau39713102016-11-25 15:49:32 +0100657
Christopher Fauletac98d812019-12-18 09:20:16 +0100658 t = rule->arg.trk_ctr.table.t;
Christopher Faulet67307792020-02-10 09:54:49 +0100659 if (rule->from == ACT_F_TCP_REQ_CNT) { /* L7 rules: use the stream */
660 if (stkctr_entry(&s->stkctr[rule->action]))
661 goto end;
Christopher Fauletac98d812019-12-18 09:20:16 +0100662
Christopher Faulet67307792020-02-10 09:54:49 +0100663 key = stktable_fetch_key(t, s->be, sess, s, opt, rule->arg.trk_ctr.expr, &smp);
Christopher Fauletac98d812019-12-18 09:20:16 +0100664
Christopher Faulet67307792020-02-10 09:54:49 +0100665 if ((smp.flags & SMP_F_MAY_CHANGE) && !(flags & ACT_FLAG_FINAL))
666 return ACT_RET_YIELD; /* key might appear later */
667
668 if (key && (ts = stktable_get_entry(t, key))) {
669 stream_track_stkctr(&s->stkctr[rule->action], t, ts);
Christopher Fauletac98d812019-12-18 09:20:16 +0100670 stkctr_set_flags(&s->stkctr[rule->action], STKCTR_TRACK_CONTENT);
671 if (sess->fe != s->be)
672 stkctr_set_flags(&s->stkctr[rule->action], STKCTR_TRACK_BACKEND);
673 }
674 }
Christopher Faulet67307792020-02-10 09:54:49 +0100675 else { /* L4/L5 rules: use the session */
676 if (stkctr_entry(&sess->stkctr[rule->action]))
677 goto end;
678
679 key = stktable_fetch_key(t, sess->fe, sess, NULL, opt, rule->arg.trk_ctr.expr, NULL);
680 if (key && (ts = stktable_get_entry(t, key)))
681 stream_track_stkctr(&sess->stkctr[rule->action], t, ts);
682 }
Christopher Fauletac98d812019-12-18 09:20:16 +0100683
684 end:
685 return ACT_RET_CONT;
686}
Willy Tarreau39713102016-11-25 15:49:32 +0100687
Christopher Fauletd73b96d2019-12-19 17:27:03 +0100688/* This function executes a capture actions. It executes a fetch expression,
689 * turns the result into a string and puts it in a capture slot. On success, it
690 * returns ACT_RET_CONT. If it must yield, it return ACT_RET_YIELD. Otherwsize
691 * ACT_RET_ERR is returned.
692 */
693static enum act_return tcp_action_capture(struct act_rule *rule, struct proxy *px,
694 struct session *sess, struct stream *s, int flags)
695{
696 struct sample *key;
697 struct cap_hdr *h = rule->arg.cap.hdr;
698 char **cap = s->req_cap;
699 int len, opt;
700
701 opt = ((rule->from == ACT_F_TCP_REQ_CNT) ? SMP_OPT_DIR_REQ : SMP_OPT_DIR_RES);
702 if (flags & ACT_FLAG_FINAL)
703 opt |= SMP_OPT_FINAL;
704
705 key = sample_fetch_as_type(s->be, sess, s, opt, rule->arg.cap.expr, SMP_T_STR);
706 if (!key)
707 goto end;
708
709 if ((key->flags & SMP_F_MAY_CHANGE) && !(flags & ACT_FLAG_FINAL))
710 return ACT_RET_YIELD; /* key might appear later */
711
712 if (cap[h->index] == NULL) {
713 cap[h->index] = pool_alloc(h->pool);
714 if (cap[h->index] == NULL) /* no more capture memory, ignore error */
715 goto end;
716 }
717
718 len = key->data.u.str.data;
719 if (len > h->len)
720 len = h->len;
721
722 memcpy(cap[h->index], key->data.u.str.area, len);
723 cap[h->index][len] = 0;
724
725 end:
726 return ACT_RET_CONT;
727}
728
Christopher Fauletadfc6e82020-01-14 15:05:33 +0100729static void release_tcp_capture(struct act_rule * rule)
730{
731 release_sample_expr(rule->arg.cap.expr);
732}
733
734
735static void release_tcp_track_sc(struct act_rule * rule)
736{
737 release_sample_expr(rule->arg.trk_ctr.expr);
738}
739
Willy Tarreau39713102016-11-25 15:49:32 +0100740/* Parse a tcp-request rule. Return a negative value in case of failure */
741static int tcp_parse_request_rule(char **args, int arg, int section_type,
Willy Tarreau01825162021-03-09 09:53:46 +0100742 struct proxy *curpx, const struct proxy *defpx,
Willy Tarreau39713102016-11-25 15:49:32 +0100743 struct act_rule *rule, char **err,
744 unsigned int where, const char *file, int line)
745{
746 if (curpx == defpx) {
747 memprintf(err, "%s %s is not allowed in 'defaults' sections",
748 args[0], args[1]);
749 return -1;
750 }
751
Tim Duesterhuse5ff1412021-01-02 22:31:53 +0100752 if (strcmp(args[arg], "accept") == 0) {
Willy Tarreau39713102016-11-25 15:49:32 +0100753 arg++;
754 rule->action = ACT_ACTION_ALLOW;
Christopher Faulet245cf792019-12-18 14:58:12 +0100755 rule->flags |= ACT_FLAG_FINAL;
Willy Tarreau39713102016-11-25 15:49:32 +0100756 }
Tim Duesterhuse5ff1412021-01-02 22:31:53 +0100757 else if (strcmp(args[arg], "reject") == 0) {
Willy Tarreau39713102016-11-25 15:49:32 +0100758 arg++;
759 rule->action = ACT_ACTION_DENY;
Christopher Faulet245cf792019-12-18 14:58:12 +0100760 rule->flags |= ACT_FLAG_FINAL;
Willy Tarreau39713102016-11-25 15:49:32 +0100761 }
762 else if (strcmp(args[arg], "capture") == 0) {
763 struct sample_expr *expr;
764 struct cap_hdr *hdr;
765 int kw = arg;
766 int len = 0;
767
768 if (!(curpx->cap & PR_CAP_FE)) {
769 memprintf(err,
770 "'%s %s %s' : proxy '%s' has no frontend capability",
771 args[0], args[1], args[kw], curpx->id);
772 return -1;
773 }
774
775 if (!(where & SMP_VAL_FE_REQ_CNT)) {
776 memprintf(err,
777 "'%s %s' is not allowed in '%s %s' rules in %s '%s'",
778 args[arg], args[arg+1], args[0], args[1], proxy_type_str(curpx), curpx->id);
779 return -1;
780 }
781
782 arg++;
783
784 curpx->conf.args.ctx = ARGC_CAP;
Willy Tarreaue3b57bf2020-02-14 16:50:14 +0100785 expr = sample_parse_expr(args, &arg, file, line, err, &curpx->conf.args, NULL);
Willy Tarreau39713102016-11-25 15:49:32 +0100786 if (!expr) {
787 memprintf(err,
788 "'%s %s %s' : %s",
789 args[0], args[1], args[kw], *err);
790 return -1;
791 }
792
793 if (!(expr->fetch->val & where)) {
794 memprintf(err,
795 "'%s %s %s' : fetch method '%s' extracts information from '%s', none of which is available here",
796 args[0], args[1], args[kw], args[arg-1], sample_src_names(expr->fetch->use));
Christopher Fauletfdb6fbf2020-01-14 15:05:56 +0100797 release_sample_expr(expr);
Willy Tarreau39713102016-11-25 15:49:32 +0100798 return -1;
799 }
800
801 if (strcmp(args[arg], "len") == 0) {
802 arg++;
803 if (!args[arg]) {
804 memprintf(err,
805 "'%s %s %s' : missing length value",
806 args[0], args[1], args[kw]);
Christopher Fauletfdb6fbf2020-01-14 15:05:56 +0100807 release_sample_expr(expr);
Willy Tarreau39713102016-11-25 15:49:32 +0100808 return -1;
809 }
810 /* we copy the table name for now, it will be resolved later */
811 len = atoi(args[arg]);
812 if (len <= 0) {
813 memprintf(err,
814 "'%s %s %s' : length must be > 0",
815 args[0], args[1], args[kw]);
Christopher Fauletfdb6fbf2020-01-14 15:05:56 +0100816 release_sample_expr(expr);
Willy Tarreau39713102016-11-25 15:49:32 +0100817 return -1;
818 }
819 arg++;
820 }
821
822 if (!len) {
823 memprintf(err,
824 "'%s %s %s' : a positive 'len' argument is mandatory",
825 args[0], args[1], args[kw]);
826 free(expr);
827 return -1;
828 }
829
830 hdr = calloc(1, sizeof(*hdr));
Remi Tricot-Le Breton31d170c2021-05-17 10:08:16 +0200831 if (!hdr) {
832 memprintf(err, "parsing [%s:%d] : out of memory", file, line);
833 release_sample_expr(expr);
834 return -1;
835 }
Willy Tarreau39713102016-11-25 15:49:32 +0100836 hdr->next = curpx->req_cap;
837 hdr->name = NULL; /* not a header capture */
838 hdr->namelen = 0;
839 hdr->len = len;
840 hdr->pool = create_pool("caphdr", hdr->len + 1, MEM_F_SHARED);
841 hdr->index = curpx->nb_req_cap++;
842
843 curpx->req_cap = hdr;
844 curpx->to_log |= LW_REQHDR;
845
Christopher Faulet711ed6a2019-07-16 14:16:10 +0200846 /* check if we need to allocate an http_txn struct for HTTP parsing */
Willy Tarreau39713102016-11-25 15:49:32 +0100847 curpx->http_needed |= !!(expr->fetch->use & SMP_USE_HTTP_ANY);
848
849 rule->arg.cap.expr = expr;
850 rule->arg.cap.hdr = hdr;
Christopher Fauletd73b96d2019-12-19 17:27:03 +0100851 rule->action = ACT_CUSTOM;
852 rule->action_ptr = tcp_action_capture;
853 rule->check_ptr = check_capture;
Christopher Fauletadfc6e82020-01-14 15:05:33 +0100854 rule->release_ptr = release_tcp_capture;
Willy Tarreau39713102016-11-25 15:49:32 +0100855 }
Frédéric Lécaillea41d5312018-01-29 12:05:07 +0100856 else if (strncmp(args[arg], "track-sc", 8) == 0) {
Willy Tarreau39713102016-11-25 15:49:32 +0100857 struct sample_expr *expr;
858 int kw = arg;
Frédéric Lécaillea41d5312018-01-29 12:05:07 +0100859 unsigned int tsc_num;
860 const char *tsc_num_str;
Willy Tarreau39713102016-11-25 15:49:32 +0100861
862 arg++;
863
Frédéric Lécaillea41d5312018-01-29 12:05:07 +0100864 tsc_num_str = &args[kw][8];
865 if (cfg_parse_track_sc_num(&tsc_num, tsc_num_str, tsc_num_str + strlen(tsc_num_str), err) == -1) {
866 memprintf(err, "'%s %s %s' : %s", args[0], args[1], args[kw], *err);
867 return -1;
868 }
869
Willy Tarreau39713102016-11-25 15:49:32 +0100870 curpx->conf.args.ctx = ARGC_TRK;
Willy Tarreaue3b57bf2020-02-14 16:50:14 +0100871 expr = sample_parse_expr(args, &arg, file, line, err, &curpx->conf.args, NULL);
Willy Tarreau39713102016-11-25 15:49:32 +0100872 if (!expr) {
873 memprintf(err,
874 "'%s %s %s' : %s",
875 args[0], args[1], args[kw], *err);
876 return -1;
877 }
878
879 if (!(expr->fetch->val & where)) {
880 memprintf(err,
881 "'%s %s %s' : fetch method '%s' extracts information from '%s', none of which is available here",
882 args[0], args[1], args[kw], args[arg-1], sample_src_names(expr->fetch->use));
Christopher Fauletfdb6fbf2020-01-14 15:05:56 +0100883 release_sample_expr(expr);
Willy Tarreau39713102016-11-25 15:49:32 +0100884 return -1;
885 }
886
Christopher Faulet711ed6a2019-07-16 14:16:10 +0200887 /* check if we need to allocate an http_txn struct for HTTP parsing */
Willy Tarreau39713102016-11-25 15:49:32 +0100888 curpx->http_needed |= !!(expr->fetch->use & SMP_USE_HTTP_ANY);
889
890 if (strcmp(args[arg], "table") == 0) {
891 arg++;
892 if (!args[arg]) {
893 memprintf(err,
894 "'%s %s %s' : missing table name",
895 args[0], args[1], args[kw]);
Christopher Fauletfdb6fbf2020-01-14 15:05:56 +0100896 release_sample_expr(expr);
Willy Tarreau39713102016-11-25 15:49:32 +0100897 return -1;
898 }
899 /* we copy the table name for now, it will be resolved later */
900 rule->arg.trk_ctr.table.n = strdup(args[arg]);
901 arg++;
902 }
Christopher Fauletac98d812019-12-18 09:20:16 +0100903 rule->action = tsc_num;
Willy Tarreau39713102016-11-25 15:49:32 +0100904 rule->arg.trk_ctr.expr = expr;
Christopher Fauletac98d812019-12-18 09:20:16 +0100905 rule->action_ptr = tcp_action_track_sc;
Christopher Faulet78880fb2017-09-18 14:43:55 +0200906 rule->check_ptr = check_trk_action;
Christopher Fauletadfc6e82020-01-14 15:05:33 +0100907 rule->release_ptr = release_tcp_track_sc;
Willy Tarreau39713102016-11-25 15:49:32 +0100908 }
909 else if (strcmp(args[arg], "expect-proxy") == 0) {
910 if (strcmp(args[arg+1], "layer4") != 0) {
911 memprintf(err,
912 "'%s %s %s' only supports 'layer4' in %s '%s' (got '%s')",
913 args[0], args[1], args[arg], proxy_type_str(curpx), curpx->id, args[arg+1]);
914 return -1;
915 }
916
917 if (!(where & SMP_VAL_FE_CON_ACC)) {
918 memprintf(err,
919 "'%s %s' is not allowed in '%s %s' rules in %s '%s'",
920 args[arg], args[arg+1], args[0], args[1], proxy_type_str(curpx), curpx->id);
921 return -1;
922 }
923
924 arg += 2;
925 rule->action = ACT_TCP_EXPECT_PX;
926 }
927 else if (strcmp(args[arg], "expect-netscaler-cip") == 0) {
928 if (strcmp(args[arg+1], "layer4") != 0) {
929 memprintf(err,
930 "'%s %s %s' only supports 'layer4' in %s '%s' (got '%s')",
931 args[0], args[1], args[arg], proxy_type_str(curpx), curpx->id, args[arg+1]);
932 return -1;
933 }
934
935 if (!(where & SMP_VAL_FE_CON_ACC)) {
936 memprintf(err,
937 "'%s %s' is not allowed in '%s %s' rules in %s '%s'",
938 args[arg], args[arg+1], args[0], args[1], proxy_type_str(curpx), curpx->id);
939 return -1;
940 }
941
942 arg += 2;
943 rule->action = ACT_TCP_EXPECT_CIP;
944 }
945 else {
946 struct action_kw *kw;
947 if (where & SMP_VAL_FE_CON_ACC) {
948 /* L4 */
949 kw = tcp_req_conn_action(args[arg]);
950 rule->kw = kw;
Willy Tarreau39713102016-11-25 15:49:32 +0100951 } else if (where & SMP_VAL_FE_SES_ACC) {
952 /* L5 */
953 kw = tcp_req_sess_action(args[arg]);
954 rule->kw = kw;
Willy Tarreau39713102016-11-25 15:49:32 +0100955 } else {
956 /* L6 */
957 kw = tcp_req_cont_action(args[arg]);
958 rule->kw = kw;
Willy Tarreau39713102016-11-25 15:49:32 +0100959 }
960 if (kw) {
961 arg++;
962 if (kw->parse((const char **)args, &arg, curpx, rule, err) == ACT_RET_PRS_ERR)
963 return -1;
964 } else {
Christopher Fauleta561ffb2021-03-19 08:53:26 +0100965 const char *extra[] = { "accept", "reject", "capture", "track-sc", "expect-proxy", "expect-netscaler-cip", NULL };
Willy Tarreaudb67b0e2021-03-12 13:46:10 +0100966 const char *best = NULL;
967
968
969 if (where & SMP_VAL_FE_CON_ACC) {
Willy Tarreau39713102016-11-25 15:49:32 +0100970 action_build_list(&tcp_req_conn_keywords, &trash);
Willy Tarreaudb67b0e2021-03-12 13:46:10 +0100971 best = action_suggest(args[arg], &tcp_req_conn_keywords, extra);
972 }
973 else if (where & SMP_VAL_FE_SES_ACC) {
Willy Tarreau39713102016-11-25 15:49:32 +0100974 action_build_list(&tcp_req_sess_keywords, &trash);
Willy Tarreaudb67b0e2021-03-12 13:46:10 +0100975 best = action_suggest(args[arg], &tcp_req_sess_keywords, extra);
976 }
977 else {
Willy Tarreau39713102016-11-25 15:49:32 +0100978 action_build_list(&tcp_req_cont_keywords, &trash);
Willy Tarreaudb67b0e2021-03-12 13:46:10 +0100979 best = action_suggest(args[arg], &tcp_req_cont_keywords, extra);
980 }
981
Willy Tarreau39713102016-11-25 15:49:32 +0100982 memprintf(err,
Christopher Fauleta561ffb2021-03-19 08:53:26 +0100983 "'%s %s' expects 'accept', 'reject', 'capture', 'expect-proxy', 'expect-netscaler-cip', 'track-sc0' ... 'track-sc%d', %s "
Willy Tarreaudb67b0e2021-03-12 13:46:10 +0100984 "in %s '%s' (got '%s').%s%s%s\n",
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200985 args[0], args[1], MAX_SESS_STKCTR-1,
986 trash.area, proxy_type_str(curpx),
Willy Tarreaudb67b0e2021-03-12 13:46:10 +0100987 curpx->id, args[arg],
988 best ? " Did you mean '" : "",
989 best ? best : "",
990 best ? "' maybe ?" : "");
Willy Tarreau39713102016-11-25 15:49:32 +0100991 return -1;
992 }
993 }
994
995 if (strcmp(args[arg], "if") == 0 || strcmp(args[arg], "unless") == 0) {
Christopher Faulet1b421ea2017-09-22 14:38:56 +0200996 if ((rule->cond = build_acl_cond(file, line, &curpx->acl, curpx, (const char **)args+arg, err)) == NULL) {
Willy Tarreau39713102016-11-25 15:49:32 +0100997 memprintf(err,
998 "'%s %s %s' : error detected in %s '%s' while parsing '%s' condition : %s",
999 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg], *err);
1000 return -1;
1001 }
1002 }
1003 else if (*args[arg]) {
1004 memprintf(err,
1005 "'%s %s %s' only accepts 'if' or 'unless', in %s '%s' (got '%s')",
1006 args[0], args[1], args[2], proxy_type_str(curpx), curpx->id, args[arg]);
1007 return -1;
1008 }
1009 return 0;
1010}
1011
1012/* This function should be called to parse a line starting with the "tcp-response"
1013 * keyword.
1014 */
1015static int tcp_parse_tcp_rep(char **args, int section_type, struct proxy *curpx,
Willy Tarreau01825162021-03-09 09:53:46 +01001016 const struct proxy *defpx, const char *file, int line,
Willy Tarreau39713102016-11-25 15:49:32 +01001017 char **err)
1018{
1019 const char *ptr = NULL;
1020 unsigned int val;
1021 int warn = 0;
1022 int arg;
1023 struct act_rule *rule;
1024 unsigned int where;
1025 const struct acl *acl;
1026 const char *kw;
1027
1028 if (!*args[1]) {
1029 memprintf(err, "missing argument for '%s' in %s '%s'",
1030 args[0], proxy_type_str(curpx), curpx->id);
1031 return -1;
1032 }
1033
1034 if (strcmp(args[1], "inspect-delay") == 0) {
1035 if (curpx == defpx || !(curpx->cap & PR_CAP_BE)) {
1036 memprintf(err, "%s %s is only allowed in 'backend' sections",
1037 args[0], args[1]);
1038 return -1;
1039 }
1040
1041 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
1042 memprintf(err,
1043 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
1044 args[0], args[1], proxy_type_str(curpx), curpx->id);
Willy Tarreau9faebe32019-06-07 19:00:37 +02001045
1046 if (ptr == PARSE_TIME_OVER)
1047 memprintf(err, "%s (timer overflow in '%s', maximum value is 2147483647 ms or ~24.8 days)", *err, args[2]);
1048 else if (ptr == PARSE_TIME_UNDER)
1049 memprintf(err, "%s (timer underflow in '%s', minimum non-null value is 1 ms)", *err, args[2]);
1050 else if (ptr)
Willy Tarreau39713102016-11-25 15:49:32 +01001051 memprintf(err, "%s (unexpected character '%c')", *err, *ptr);
1052 return -1;
1053 }
1054
1055 if (curpx->tcp_rep.inspect_delay) {
1056 memprintf(err, "ignoring %s %s (was already defined) in %s '%s'",
1057 args[0], args[1], proxy_type_str(curpx), curpx->id);
1058 return 1;
1059 }
1060 curpx->tcp_rep.inspect_delay = val;
1061 return 0;
1062 }
1063
1064 rule = calloc(1, sizeof(*rule));
Remi Tricot-Le Breton8f86a292021-05-12 18:24:18 +02001065 if (!rule) {
1066 memprintf(err, "parsing [%s:%d] : out of memory", file, line);
1067 return -1;
1068 }
Willy Tarreau39713102016-11-25 15:49:32 +01001069 LIST_INIT(&rule->list);
1070 arg = 1;
1071 where = 0;
1072
1073 if (strcmp(args[1], "content") == 0) {
1074 arg++;
1075
1076 if (curpx->cap & PR_CAP_FE)
1077 where |= SMP_VAL_FE_RES_CNT;
1078 if (curpx->cap & PR_CAP_BE)
1079 where |= SMP_VAL_BE_RES_CNT;
Christopher Fauletcb9106b2019-12-19 15:23:17 +01001080 rule->from = ACT_F_TCP_RES_CNT;
Willy Tarreau39713102016-11-25 15:49:32 +01001081 if (tcp_parse_response_rule(args, arg, section_type, curpx, defpx, rule, err, where, file, line) < 0)
1082 goto error;
1083
1084 acl = rule->cond ? acl_cond_conflicts(rule->cond, where) : NULL;
1085 if (acl) {
1086 if (acl->name && *acl->name)
1087 memprintf(err,
1088 "acl '%s' will never match in '%s %s' because it only involves keywords that are incompatible with '%s'",
1089 acl->name, args[0], args[1], sample_ckp_names(where));
1090 else
1091 memprintf(err,
1092 "anonymous acl will never match in '%s %s' because it uses keyword '%s' which is incompatible with '%s'",
1093 args[0], args[1],
1094 LIST_ELEM(acl->expr.n, struct acl_expr *, list)->kw,
1095 sample_ckp_names(where));
1096
1097 warn++;
1098 }
1099 else if (rule->cond && acl_cond_kw_conflicts(rule->cond, where, &acl, &kw)) {
1100 if (acl->name && *acl->name)
1101 memprintf(err,
1102 "acl '%s' involves keyword '%s' which is incompatible with '%s'",
1103 acl->name, kw, sample_ckp_names(where));
1104 else
1105 memprintf(err,
1106 "anonymous acl involves keyword '%s' which is incompatible with '%s'",
1107 kw, sample_ckp_names(where));
1108 warn++;
1109 }
1110
Willy Tarreau2b718102021-04-21 07:32:39 +02001111 LIST_APPEND(&curpx->tcp_rep.inspect_rules, &rule->list);
Willy Tarreau39713102016-11-25 15:49:32 +01001112 }
1113 else {
1114 memprintf(err,
1115 "'%s' expects 'inspect-delay' or 'content' in %s '%s' (got '%s')",
1116 args[0], proxy_type_str(curpx), curpx->id, args[1]);
1117 goto error;
1118 }
1119
1120 return warn;
1121 error:
1122 free(rule);
1123 return -1;
1124}
1125
1126
1127/* This function should be called to parse a line starting with the "tcp-request"
1128 * keyword.
1129 */
1130static int tcp_parse_tcp_req(char **args, int section_type, struct proxy *curpx,
Willy Tarreau01825162021-03-09 09:53:46 +01001131 const struct proxy *defpx, const char *file, int line,
Willy Tarreau39713102016-11-25 15:49:32 +01001132 char **err)
1133{
1134 const char *ptr = NULL;
1135 unsigned int val;
1136 int warn = 0;
1137 int arg;
1138 struct act_rule *rule;
1139 unsigned int where;
1140 const struct acl *acl;
1141 const char *kw;
1142
1143 if (!*args[1]) {
1144 if (curpx == defpx)
1145 memprintf(err, "missing argument for '%s' in defaults section", args[0]);
1146 else
1147 memprintf(err, "missing argument for '%s' in %s '%s'",
1148 args[0], proxy_type_str(curpx), curpx->id);
1149 return -1;
1150 }
1151
Tim Duesterhuse5ff1412021-01-02 22:31:53 +01001152 if (strcmp(args[1], "inspect-delay") == 0) {
Willy Tarreau39713102016-11-25 15:49:32 +01001153 if (curpx == defpx) {
1154 memprintf(err, "%s %s is not allowed in 'defaults' sections",
1155 args[0], args[1]);
1156 return -1;
1157 }
1158
1159 if (!*args[2] || (ptr = parse_time_err(args[2], &val, TIME_UNIT_MS))) {
1160 memprintf(err,
1161 "'%s %s' expects a positive delay in milliseconds, in %s '%s'",
1162 args[0], args[1], proxy_type_str(curpx), curpx->id);
Willy Tarreau9faebe32019-06-07 19:00:37 +02001163
1164 if (ptr == PARSE_TIME_OVER)
1165 memprintf(err, "%s (timer overflow in '%s', maximum value is 2147483647 ms or ~24.8 days)", *err, args[2]);
1166 else if (ptr == PARSE_TIME_UNDER)
1167 memprintf(err, "%s (timer underflow in '%s', minimum non-null value is 1 ms)", *err, args[2]);
1168 else if (ptr)
Willy Tarreau39713102016-11-25 15:49:32 +01001169 memprintf(err, "%s (unexpected character '%c')", *err, *ptr);
1170 return -1;
1171 }
1172
1173 if (curpx->tcp_req.inspect_delay) {
1174 memprintf(err, "ignoring %s %s (was already defined) in %s '%s'",
1175 args[0], args[1], proxy_type_str(curpx), curpx->id);
1176 return 1;
1177 }
1178 curpx->tcp_req.inspect_delay = val;
1179 return 0;
1180 }
1181
1182 rule = calloc(1, sizeof(*rule));
Remi Tricot-Le Breton8f86a292021-05-12 18:24:18 +02001183 if (!rule) {
1184 memprintf(err, "parsing [%s:%d] : out of memory", file, line);
1185 return -1;
1186 }
Willy Tarreau39713102016-11-25 15:49:32 +01001187 LIST_INIT(&rule->list);
1188 arg = 1;
1189 where = 0;
1190
1191 if (strcmp(args[1], "content") == 0) {
1192 arg++;
1193
1194 if (curpx->cap & PR_CAP_FE)
1195 where |= SMP_VAL_FE_REQ_CNT;
1196 if (curpx->cap & PR_CAP_BE)
1197 where |= SMP_VAL_BE_REQ_CNT;
Christopher Fauletcb9106b2019-12-19 15:23:17 +01001198 rule->from = ACT_F_TCP_REQ_CNT;
Willy Tarreau39713102016-11-25 15:49:32 +01001199 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, where, file, line) < 0)
1200 goto error;
1201
1202 acl = rule->cond ? acl_cond_conflicts(rule->cond, where) : NULL;
1203 if (acl) {
1204 if (acl->name && *acl->name)
1205 memprintf(err,
1206 "acl '%s' will never match in '%s %s' because it only involves keywords that are incompatible with '%s'",
1207 acl->name, args[0], args[1], sample_ckp_names(where));
1208 else
1209 memprintf(err,
1210 "anonymous acl will never match in '%s %s' because it uses keyword '%s' which is incompatible with '%s'",
1211 args[0], args[1],
1212 LIST_ELEM(acl->expr.n, struct acl_expr *, list)->kw,
1213 sample_ckp_names(where));
1214
1215 warn++;
1216 }
1217 else if (rule->cond && acl_cond_kw_conflicts(rule->cond, where, &acl, &kw)) {
1218 if (acl->name && *acl->name)
1219 memprintf(err,
1220 "acl '%s' involves keyword '%s' which is incompatible with '%s'",
1221 acl->name, kw, sample_ckp_names(where));
1222 else
1223 memprintf(err,
1224 "anonymous acl involves keyword '%s' which is incompatible with '%s'",
1225 kw, sample_ckp_names(where));
1226 warn++;
1227 }
1228
1229 /* the following function directly emits the warning */
1230 warnif_misplaced_tcp_cont(curpx, file, line, args[0]);
Willy Tarreau2b718102021-04-21 07:32:39 +02001231 LIST_APPEND(&curpx->tcp_req.inspect_rules, &rule->list);
Willy Tarreau39713102016-11-25 15:49:32 +01001232 }
1233 else if (strcmp(args[1], "connection") == 0) {
1234 arg++;
1235
1236 if (!(curpx->cap & PR_CAP_FE)) {
1237 memprintf(err, "%s %s is not allowed because %s %s is not a frontend",
1238 args[0], args[1], proxy_type_str(curpx), curpx->id);
1239 goto error;
1240 }
1241
1242 where |= SMP_VAL_FE_CON_ACC;
Christopher Fauletcb9106b2019-12-19 15:23:17 +01001243 rule->from = ACT_F_TCP_REQ_CON;
Willy Tarreau39713102016-11-25 15:49:32 +01001244 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, where, file, line) < 0)
1245 goto error;
1246
1247 acl = rule->cond ? acl_cond_conflicts(rule->cond, where) : NULL;
1248 if (acl) {
1249 if (acl->name && *acl->name)
1250 memprintf(err,
1251 "acl '%s' will never match in '%s %s' because it only involves keywords that are incompatible with '%s'",
1252 acl->name, args[0], args[1], sample_ckp_names(where));
1253 else
1254 memprintf(err,
1255 "anonymous acl will never match in '%s %s' because it uses keyword '%s' which is incompatible with '%s'",
1256 args[0], args[1],
1257 LIST_ELEM(acl->expr.n, struct acl_expr *, list)->kw,
1258 sample_ckp_names(where));
1259
1260 warn++;
1261 }
1262 else if (rule->cond && acl_cond_kw_conflicts(rule->cond, where, &acl, &kw)) {
1263 if (acl->name && *acl->name)
1264 memprintf(err,
1265 "acl '%s' involves keyword '%s' which is incompatible with '%s'",
1266 acl->name, kw, sample_ckp_names(where));
1267 else
1268 memprintf(err,
1269 "anonymous acl involves keyword '%s' which is incompatible with '%s'",
1270 kw, sample_ckp_names(where));
1271 warn++;
1272 }
1273
1274 /* the following function directly emits the warning */
1275 warnif_misplaced_tcp_conn(curpx, file, line, args[0]);
Willy Tarreau2b718102021-04-21 07:32:39 +02001276 LIST_APPEND(&curpx->tcp_req.l4_rules, &rule->list);
Willy Tarreau39713102016-11-25 15:49:32 +01001277 }
1278 else if (strcmp(args[1], "session") == 0) {
1279 arg++;
1280
1281 if (!(curpx->cap & PR_CAP_FE)) {
1282 memprintf(err, "%s %s is not allowed because %s %s is not a frontend",
1283 args[0], args[1], proxy_type_str(curpx), curpx->id);
1284 goto error;
1285 }
1286
1287 where |= SMP_VAL_FE_SES_ACC;
Christopher Fauletcb9106b2019-12-19 15:23:17 +01001288 rule->from = ACT_F_TCP_REQ_SES;
Willy Tarreau39713102016-11-25 15:49:32 +01001289 if (tcp_parse_request_rule(args, arg, section_type, curpx, defpx, rule, err, where, file, line) < 0)
1290 goto error;
1291
1292 acl = rule->cond ? acl_cond_conflicts(rule->cond, where) : NULL;
1293 if (acl) {
1294 if (acl->name && *acl->name)
1295 memprintf(err,
1296 "acl '%s' will never match in '%s %s' because it only involves keywords that are incompatible with '%s'",
1297 acl->name, args[0], args[1], sample_ckp_names(where));
1298 else
1299 memprintf(err,
1300 "anonymous acl will never match in '%s %s' because it uses keyword '%s' which is incompatible with '%s'",
1301 args[0], args[1],
1302 LIST_ELEM(acl->expr.n, struct acl_expr *, list)->kw,
1303 sample_ckp_names(where));
1304 warn++;
1305 }
1306 else if (rule->cond && acl_cond_kw_conflicts(rule->cond, where, &acl, &kw)) {
1307 if (acl->name && *acl->name)
1308 memprintf(err,
1309 "acl '%s' involves keyword '%s' which is incompatible with '%s'",
1310 acl->name, kw, sample_ckp_names(where));
1311 else
1312 memprintf(err,
1313 "anonymous acl involves keyword '%s' which is incompatible with '%s'",
1314 kw, sample_ckp_names(where));
1315 warn++;
1316 }
1317
1318 /* the following function directly emits the warning */
1319 warnif_misplaced_tcp_sess(curpx, file, line, args[0]);
Willy Tarreau2b718102021-04-21 07:32:39 +02001320 LIST_APPEND(&curpx->tcp_req.l5_rules, &rule->list);
Willy Tarreau39713102016-11-25 15:49:32 +01001321 }
1322 else {
1323 if (curpx == defpx)
1324 memprintf(err,
1325 "'%s' expects 'inspect-delay', 'connection', or 'content' in defaults section (got '%s')",
1326 args[0], args[1]);
1327 else
1328 memprintf(err,
1329 "'%s' expects 'inspect-delay', 'connection', or 'content' in %s '%s' (got '%s')",
1330 args[0], proxy_type_str(curpx), curpx->id, args[1]);
1331 goto error;
1332 }
1333
1334 return warn;
1335 error:
1336 free(rule);
1337 return -1;
1338}
1339
1340static struct cfg_kw_list cfg_kws = {ILH, {
1341 { CFG_LISTEN, "tcp-request", tcp_parse_tcp_req },
1342 { CFG_LISTEN, "tcp-response", tcp_parse_tcp_rep },
1343 { 0, NULL, NULL },
1344}};
1345
Willy Tarreau0108d902018-11-25 19:14:37 +01001346INITCALL1(STG_REGISTER, cfg_register_keywords, &cfg_kws);
Willy Tarreau39713102016-11-25 15:49:32 +01001347
1348/*
1349 * Local variables:
1350 * c-indent-level: 8
1351 * c-basic-offset: 8
1352 * End:
1353 */