From 0f9cd7b196073f6d3a3826049b985edcd20c18be Mon Sep 17 00:00:00 2001
From: Willy Tarreau <w@1wt.eu>
Date: Thu, 31 Jan 2019 19:02:43 +0100
Subject: [PATCH] MINOR: stream-int: add a new flag to mention that we want the
 connection to be killed

The new flag SI_FL_KILL_CONN is now set by the rare actions which
deliberately want the whole connection (and not just the stream) to be
killed. This is only used for "tcp-request content reject",
"tcp-response content reject", "tcp-response content close" and
"http-request reject". The purpose is to desambiguate the close from
a regular shutdown. This will be used by the next patches.
---
 include/proto/stream_interface.h | 6 ++++++
 include/types/stream_interface.h | 2 +-
 src/http_act.c                   | 2 ++
 src/tcp_rules.c                  | 3 +++
 4 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/include/proto/stream_interface.h b/include/proto/stream_interface.h
index 5800c1e9d..3cccc8fce 100644
--- a/include/proto/stream_interface.h
+++ b/include/proto/stream_interface.h
@@ -420,6 +420,12 @@ static inline void si_shutw(struct stream_interface *si)
 	si->ops->shutw(si);
 }
 
+/* Marks on the stream-interface that next shutw must kill the whole connection */
+static inline void si_must_kill_conn(struct stream_interface *si)
+{
+	si->flags |= SI_FL_KILL_CONN;
+}
+
 /* This is to be used after making some room available in a channel. It will
  * return without doing anything if the stream interface's RX path is blocked.
  * It will automatically mark the stream interface as busy processing the end
diff --git a/include/types/stream_interface.h b/include/types/stream_interface.h
index eab1fba1d..8be3ee98b 100644
--- a/include/types/stream_interface.h
+++ b/include/types/stream_interface.h
@@ -64,7 +64,7 @@ enum {
 	SI_FL_NONE       = 0x00000000,  /* nothing */
 	SI_FL_EXP        = 0x00000001,  /* timeout has expired */
 	SI_FL_ERR        = 0x00000002,  /* a non-recoverable error has occurred */
-	/* unused:         0x00000004 */
+	SI_FL_KILL_CONN  = 0x00000004,  /* next shutw must kill the whole conn, not just the stream */
 	SI_FL_WAIT_DATA  = 0x00000008,  /* stream-int waits for more outgoing data to send */
 	SI_FL_ISBACK     = 0x00000010,  /* 0 for front-side SI, 1 for back-side */
 	SI_FL_DONT_WAKE  = 0x00000020,  /* resync in progress, don't wake up */
diff --git a/src/http_act.c b/src/http_act.c
index 37cf4350a..4f51d4a2e 100644
--- a/src/http_act.c
+++ b/src/http_act.c
@@ -34,6 +34,7 @@
 #include <proto/http_rules.h>
 #include <proto/log.h>
 #include <proto/proto_http.h>
+#include <proto/stream_interface.h>
 
 
 /* This function executes one of the set-{method,path,query,uri} actions. It
@@ -185,6 +186,7 @@ static enum act_parse_ret parse_http_set_status(const char **args, int *orig_arg
 static enum act_return http_action_reject(struct act_rule *rule, struct proxy *px,
                                           struct session *sess, struct stream *s, int flags)
 {
+	si_must_kill_conn(chn_prod(&s->req));
 	channel_abort(&s->req);
 	channel_abort(&s->res);
 	s->req.analysers = 0;
diff --git a/src/tcp_rules.c b/src/tcp_rules.c
index 602749c49..91f98b0bd 100644
--- a/src/tcp_rules.c
+++ b/src/tcp_rules.c
@@ -163,6 +163,7 @@ resume_execution:
 				break;
 			}
 			else if (rule->action == ACT_ACTION_DENY) {
+				si_must_kill_conn(chn_prod(req));
 				channel_abort(req);
 				channel_abort(&s->res);
 				req->analysers = 0;
@@ -342,6 +343,7 @@ resume_execution:
 				break;
 			}
 			else if (rule->action == ACT_ACTION_DENY) {
+				si_must_kill_conn(chn_prod(rep));
 				channel_abort(rep);
 				channel_abort(&s->req);
 				rep->analysers = 0;
@@ -359,6 +361,7 @@ resume_execution:
 			}
 			else if (rule->action == ACT_TCP_CLOSE) {
 				chn_prod(rep)->flags |= SI_FL_NOLINGER | SI_FL_NOHALF;
+				si_must_kill_conn(chn_prod(rep));
 				si_shutr(chn_prod(rep));
 				si_shutw(chn_prod(rep));
 				break;