blob: 46157c1026afe3364ce2b75e5502cdb986276b64 [file] [log] [blame]
Willy Tarreauaeae66c2020-08-28 11:03:28 +02001/*
2 * AF_INET/AF_INET6 SOCK_STREAM protocol layer (tcp)
3 *
4 * Copyright 2000-2013 Willy Tarreau <w@1wt.eu>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
13#include <ctype.h>
14#include <errno.h>
15#include <fcntl.h>
16#include <stdio.h>
17#include <stdlib.h>
18#include <string.h>
19#include <time.h>
20
21#include <sys/param.h>
22#include <sys/socket.h>
23#include <sys/types.h>
24
25#include <netinet/tcp.h>
26#include <netinet/in.h>
27
28#include <haproxy/action-t.h>
29#include <haproxy/api.h>
30#include <haproxy/arg.h>
31#include <haproxy/channel.h>
32#include <haproxy/connection.h>
33#include <haproxy/global.h>
34#include <haproxy/http_rules.h>
35#include <haproxy/proto_tcp.h>
36#include <haproxy/proxy-t.h>
37#include <haproxy/sample.h>
38#include <haproxy/stream-t.h>
39#include <haproxy/tcp_rules.h>
40#include <haproxy/tools.h>
41
42/*
43 * Execute the "set-src" action. May be called from {tcp,http}request.
44 * It only changes the address and tries to preserve the original port. If the
45 * previous family was neither AF_INET nor AF_INET6, the port is set to zero.
46 */
47static enum act_return tcp_action_req_set_src(struct act_rule *rule, struct proxy *px,
48 struct session *sess, struct stream *s, int flags)
49{
50 struct connection *cli_conn;
51
52 if ((cli_conn = objt_conn(sess->origin)) && conn_get_src(cli_conn)) {
53 struct sample *smp;
54
55 smp = sample_fetch_as_type(px, sess, s, SMP_OPT_DIR_REQ|SMP_OPT_FINAL, rule->arg.expr, SMP_T_ADDR);
56 if (smp) {
57 int port = get_net_port(cli_conn->src);
58
59 if (smp->data.type == SMP_T_IPV4) {
60 ((struct sockaddr_in *)cli_conn->src)->sin_family = AF_INET;
61 ((struct sockaddr_in *)cli_conn->src)->sin_addr.s_addr = smp->data.u.ipv4.s_addr;
62 ((struct sockaddr_in *)cli_conn->src)->sin_port = port;
63 } else if (smp->data.type == SMP_T_IPV6) {
64 ((struct sockaddr_in6 *)cli_conn->src)->sin6_family = AF_INET6;
65 memcpy(&((struct sockaddr_in6 *)cli_conn->src)->sin6_addr, &smp->data.u.ipv6, sizeof(struct in6_addr));
66 ((struct sockaddr_in6 *)cli_conn->src)->sin6_port = port;
67 }
68 }
69 cli_conn->flags |= CO_FL_ADDR_FROM_SET;
70 }
71 return ACT_RET_CONT;
72}
73
74/*
75 * Execute the "set-dst" action. May be called from {tcp,http}request.
76 * It only changes the address and tries to preserve the original port. If the
77 * previous family was neither AF_INET nor AF_INET6, the port is set to zero.
78 */
79static enum act_return tcp_action_req_set_dst(struct act_rule *rule, struct proxy *px,
80 struct session *sess, struct stream *s, int flags)
81{
82 struct connection *cli_conn;
83
84 if ((cli_conn = objt_conn(sess->origin)) && conn_get_dst(cli_conn)) {
85 struct sample *smp;
86
87 smp = sample_fetch_as_type(px, sess, s, SMP_OPT_DIR_REQ|SMP_OPT_FINAL, rule->arg.expr, SMP_T_ADDR);
88 if (smp) {
89 int port = get_net_port(cli_conn->dst);
90
91 if (smp->data.type == SMP_T_IPV4) {
92 ((struct sockaddr_in *)cli_conn->dst)->sin_family = AF_INET;
93 ((struct sockaddr_in *)cli_conn->dst)->sin_addr.s_addr = smp->data.u.ipv4.s_addr;
Christopher Faulete01ca0f2021-03-01 11:21:14 +010094 ((struct sockaddr_in *)cli_conn->dst)->sin_port = port;
Willy Tarreauaeae66c2020-08-28 11:03:28 +020095 } else if (smp->data.type == SMP_T_IPV6) {
96 ((struct sockaddr_in6 *)cli_conn->dst)->sin6_family = AF_INET6;
97 memcpy(&((struct sockaddr_in6 *)cli_conn->dst)->sin6_addr, &smp->data.u.ipv6, sizeof(struct in6_addr));
98 ((struct sockaddr_in6 *)cli_conn->dst)->sin6_port = port;
99 }
100 cli_conn->flags |= CO_FL_ADDR_TO_SET;
101 }
102 }
103 return ACT_RET_CONT;
104}
105
106/*
107 * Execute the "set-src-port" action. May be called from {tcp,http}request.
108 * We must test the sin_family before setting the port. If the address family
109 * is neither AF_INET nor AF_INET6, the address is forced to AF_INET "0.0.0.0"
110 * and the port is assigned.
111 */
112static enum act_return tcp_action_req_set_src_port(struct act_rule *rule, struct proxy *px,
113 struct session *sess, struct stream *s, int flags)
114{
115 struct connection *cli_conn;
116
117 if ((cli_conn = objt_conn(sess->origin)) && conn_get_src(cli_conn)) {
118 struct sample *smp;
119
120 smp = sample_fetch_as_type(px, sess, s, SMP_OPT_DIR_REQ|SMP_OPT_FINAL, rule->arg.expr, SMP_T_SINT);
121 if (smp) {
122 if (cli_conn->src->ss_family == AF_INET6) {
123 ((struct sockaddr_in6 *)cli_conn->src)->sin6_port = htons(smp->data.u.sint);
124 } else {
125 if (cli_conn->src->ss_family != AF_INET) {
126 cli_conn->src->ss_family = AF_INET;
127 ((struct sockaddr_in *)cli_conn->src)->sin_addr.s_addr = 0;
128 }
129 ((struct sockaddr_in *)cli_conn->src)->sin_port = htons(smp->data.u.sint);
130 }
131 }
132 }
133 return ACT_RET_CONT;
134}
135
136/*
137 * Execute the "set-dst-port" action. May be called from {tcp,http}request.
138 * We must test the sin_family before setting the port. If the address family
139 * is neither AF_INET nor AF_INET6, the address is forced to AF_INET "0.0.0.0"
140 * and the port is assigned.
141 */
142static enum act_return tcp_action_req_set_dst_port(struct act_rule *rule, struct proxy *px,
143 struct session *sess, struct stream *s, int flags)
144{
145 struct connection *cli_conn;
146
147 if ((cli_conn = objt_conn(sess->origin)) && conn_get_dst(cli_conn)) {
148 struct sample *smp;
149
150 smp = sample_fetch_as_type(px, sess, s, SMP_OPT_DIR_REQ|SMP_OPT_FINAL, rule->arg.expr, SMP_T_SINT);
151 if (smp) {
152 if (cli_conn->dst->ss_family == AF_INET6) {
153 ((struct sockaddr_in6 *)cli_conn->dst)->sin6_port = htons(smp->data.u.sint);
154 } else {
155 if (cli_conn->dst->ss_family != AF_INET) {
156 cli_conn->dst->ss_family = AF_INET;
157 ((struct sockaddr_in *)cli_conn->dst)->sin_addr.s_addr = 0;
158 }
159 ((struct sockaddr_in *)cli_conn->dst)->sin_port = htons(smp->data.u.sint);
160 }
161 }
162 }
163 return ACT_RET_CONT;
164}
165
166/* Executes the "silent-drop" action. May be called from {tcp,http}{request,response} */
167static enum act_return tcp_exec_action_silent_drop(struct act_rule *rule, struct proxy *px,
168 struct session *sess, struct stream *strm, int flags)
169{
170 struct connection *conn = objt_conn(sess->origin);
171
172 if (!conn)
173 goto out;
174
175 if (!conn_ctrl_ready(conn))
176 goto out;
177
178#ifdef TCP_QUICKACK
179 /* drain is needed only to send the quick ACK */
Willy Tarreau2ded48d2020-12-11 16:20:34 +0100180 conn_ctrl_drain(conn);
Willy Tarreauaeae66c2020-08-28 11:03:28 +0200181
182 /* re-enable quickack if it was disabled to ack all data and avoid
183 * retransmits from the client that might trigger a real reset.
184 */
Willy Tarreau4bfc6632021-03-31 08:45:47 +0200185 setsockopt(conn->handle.fd, IPPROTO_TCP, TCP_QUICKACK, &one, sizeof(one));
Willy Tarreauaeae66c2020-08-28 11:03:28 +0200186#endif
187 /* lingering must absolutely be disabled so that we don't send a
188 * shutdown(), this is critical to the TCP_REPAIR trick. When no stream
189 * is present, returning with ERR will cause lingering to be disabled.
190 */
191 if (strm)
192 strm->si[0].flags |= SI_FL_NOLINGER;
193
194 /* We're on the client-facing side, we must force to disable lingering to
195 * ensure we will use an RST exclusively and kill any pending data.
196 */
197 fdtab[conn->handle.fd].linger_risk = 1;
198
199#ifdef TCP_REPAIR
Willy Tarreau4bfc6632021-03-31 08:45:47 +0200200 if (setsockopt(conn->handle.fd, IPPROTO_TCP, TCP_REPAIR, &one, sizeof(one)) == 0) {
Willy Tarreauaeae66c2020-08-28 11:03:28 +0200201 /* socket will be quiet now */
202 goto out;
203 }
204#endif
205 /* either TCP_REPAIR is not defined or it failed (eg: permissions).
206 * Let's fall back on the TTL trick, though it only works for routed
207 * network and has no effect on local net.
208 */
209#ifdef IP_TTL
Willy Tarreauab79ee82021-03-30 17:23:50 +0200210 if (conn->src && conn->src->ss_family == AF_INET)
Willy Tarreau4bfc6632021-03-31 08:45:47 +0200211 setsockopt(conn->handle.fd, IPPROTO_IP, IP_TTL, &one, sizeof(one));
Willy Tarreauab79ee82021-03-30 17:23:50 +0200212#endif
213#ifdef IPV6_UNICAST_HOPS
Willy Tarreauda231952021-03-31 08:29:27 +0200214 if (conn->src && conn->src->ss_family == AF_INET6)
215 setsockopt(conn->handle.fd, IPPROTO_IPV6, IPV6_UNICAST_HOPS, &one, sizeof(one));
216#endif
Willy Tarreauaeae66c2020-08-28 11:03:28 +0200217 out:
218 /* kill the stream if any */
219 if (strm) {
220 channel_abort(&strm->req);
221 channel_abort(&strm->res);
222 strm->req.analysers &= AN_REQ_FLT_END;
223 strm->res.analysers &= AN_RES_FLT_END;
224 if (strm->flags & SF_BE_ASSIGNED)
225 _HA_ATOMIC_ADD(&strm->be->be_counters.denied_req, 1);
226 if (!(strm->flags & SF_ERR_MASK))
227 strm->flags |= SF_ERR_PRXCOND;
228 if (!(strm->flags & SF_FINST_MASK))
229 strm->flags |= SF_FINST_R;
230 }
231
232 _HA_ATOMIC_ADD(&sess->fe->fe_counters.denied_req, 1);
William Lallemand36119de2021-03-08 15:26:48 +0100233 if (sess->listener && sess->listener->counters)
Willy Tarreauaeae66c2020-08-28 11:03:28 +0200234 _HA_ATOMIC_ADD(&sess->listener->counters->denied_req, 1);
235
236 return ACT_RET_ABRT;
237}
238
239/* parse "set-{src,dst}[-port]" action */
240static enum act_parse_ret tcp_parse_set_src_dst(const char **args, int *orig_arg, struct proxy *px,
241 struct act_rule *rule, char **err)
242{
243 int cur_arg;
244 struct sample_expr *expr;
245 unsigned int where;
246
247 cur_arg = *orig_arg;
248 expr = sample_parse_expr((char **)args, &cur_arg, px->conf.args.file, px->conf.args.line, err, &px->conf.args, NULL);
249 if (!expr)
250 return ACT_RET_PRS_ERR;
251
252 where = 0;
253 if (px->cap & PR_CAP_FE)
254 where |= SMP_VAL_FE_HRQ_HDR;
255 if (px->cap & PR_CAP_BE)
256 where |= SMP_VAL_BE_HRQ_HDR;
257
258 if (!(expr->fetch->val & where)) {
259 memprintf(err,
260 "fetch method '%s' extracts information from '%s', none of which is available here",
261 args[cur_arg-1], sample_src_names(expr->fetch->use));
262 free(expr);
263 return ACT_RET_PRS_ERR;
264 }
265 rule->arg.expr = expr;
266 rule->action = ACT_CUSTOM;
267
Tim Duesterhuse5ff1412021-01-02 22:31:53 +0100268 if (strcmp(args[*orig_arg - 1], "set-src") == 0) {
Willy Tarreauaeae66c2020-08-28 11:03:28 +0200269 rule->action_ptr = tcp_action_req_set_src;
Tim Duesterhuse5ff1412021-01-02 22:31:53 +0100270 } else if (strcmp(args[*orig_arg - 1], "set-src-port") == 0) {
Willy Tarreauaeae66c2020-08-28 11:03:28 +0200271 rule->action_ptr = tcp_action_req_set_src_port;
Tim Duesterhuse5ff1412021-01-02 22:31:53 +0100272 } else if (strcmp(args[*orig_arg - 1], "set-dst") == 0) {
Willy Tarreauaeae66c2020-08-28 11:03:28 +0200273 rule->action_ptr = tcp_action_req_set_dst;
Tim Duesterhuse5ff1412021-01-02 22:31:53 +0100274 } else if (strcmp(args[*orig_arg - 1], "set-dst-port") == 0) {
Willy Tarreauaeae66c2020-08-28 11:03:28 +0200275 rule->action_ptr = tcp_action_req_set_dst_port;
276 } else {
277 return ACT_RET_PRS_ERR;
278 }
279
280 (*orig_arg)++;
281
282 return ACT_RET_PRS_OK;
283}
284
285
286/* Parse a "silent-drop" action. It takes no argument. It returns ACT_RET_PRS_OK on
287 * success, ACT_RET_PRS_ERR on error.
288 */
289static enum act_parse_ret tcp_parse_silent_drop(const char **args, int *orig_arg, struct proxy *px,
290 struct act_rule *rule, char **err)
291{
292 rule->action = ACT_CUSTOM;
293 rule->action_ptr = tcp_exec_action_silent_drop;
294 return ACT_RET_PRS_OK;
295}
296
297
298static struct action_kw_list tcp_req_conn_actions = {ILH, {
299 { "set-src", tcp_parse_set_src_dst },
300 { "set-src-port", tcp_parse_set_src_dst },
301 { "set-dst" , tcp_parse_set_src_dst },
302 { "set-dst-port", tcp_parse_set_src_dst },
303 { "silent-drop", tcp_parse_silent_drop },
304 { /* END */ }
305}};
306
307INITCALL1(STG_REGISTER, tcp_req_conn_keywords_register, &tcp_req_conn_actions);
308
309static struct action_kw_list tcp_req_sess_actions = {ILH, {
310 { "set-src", tcp_parse_set_src_dst },
311 { "set-src-port", tcp_parse_set_src_dst },
312 { "set-dst" , tcp_parse_set_src_dst },
313 { "set-dst-port", tcp_parse_set_src_dst },
314 { "silent-drop", tcp_parse_silent_drop },
315 { /* END */ }
316}};
317
318INITCALL1(STG_REGISTER, tcp_req_sess_keywords_register, &tcp_req_sess_actions);
319
320static struct action_kw_list tcp_req_cont_actions = {ILH, {
321 { "set-dst" , tcp_parse_set_src_dst },
322 { "set-dst-port", tcp_parse_set_src_dst },
323 { "silent-drop", tcp_parse_silent_drop },
324 { /* END */ }
325}};
326
327INITCALL1(STG_REGISTER, tcp_req_cont_keywords_register, &tcp_req_cont_actions);
328
329static struct action_kw_list tcp_res_cont_actions = {ILH, {
330 { "silent-drop", tcp_parse_silent_drop },
331 { /* END */ }
332}};
333
334INITCALL1(STG_REGISTER, tcp_res_cont_keywords_register, &tcp_res_cont_actions);
335
336static struct action_kw_list http_req_actions = {ILH, {
337 { "silent-drop", tcp_parse_silent_drop },
338 { "set-src", tcp_parse_set_src_dst },
339 { "set-src-port", tcp_parse_set_src_dst },
340 { "set-dst", tcp_parse_set_src_dst },
341 { "set-dst-port", tcp_parse_set_src_dst },
342 { /* END */ }
343}};
344
345INITCALL1(STG_REGISTER, http_req_keywords_register, &http_req_actions);
346
347static struct action_kw_list http_res_actions = {ILH, {
348 { "silent-drop", tcp_parse_silent_drop },
349 { /* END */ }
350}};
351
352INITCALL1(STG_REGISTER, http_res_keywords_register, &http_res_actions);
353
354
355/*
356 * Local variables:
357 * c-indent-level: 8
358 * c-basic-offset: 8
359 * End:
360 */