RepoMirrors
/
haproxy
mirror of http://git.haproxy.org/git/haproxy.git/
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

MINOR: proto_reverse_connect: support source address setting 

Support backend configuration for explicit source address on
pre-connect. These settings can be specified via "source" backend
keyword or directly on the server line.

Previously, all source parameters triggered a BUG_ON() when binding a
reverse connect listener. This was done because some settings are
incompatible with reverse connect context : this is the case for all
source settings which do not specify a fixed address but rather rely on
a frontend connection. Indeed, in case of preconnect, connection is
initiated on its own without the existence of a previous frontend
connection.

This patch allows to use a source parameter with a fixed address. All
other settings (usesrc client/clientip/hdr_ip) are rejected on listener
binding. On connection init, alloc_bind_address() is used to set the
optional source address.
This commit is contained in:
Amaury Denoyelle 2023-10-02 17:17:46 +02:00
parent bd001ff346
commit 90873dc678
1 changed files with 14 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
src/proto_reverse_connect.c
View File

@ -50,14 +50,15 @@ struct protocol proto_reverse_connect = {
static struct connection *new_reverse_conn(struct listener *l, struct server *srv)
{
struct connection *conn = conn_new(srv);
struct sockaddr_storage *bind_addr = NULL;
if (!conn)
goto err;
conn_set_reverse(conn, &l->obj_type);
/* These options is incompatible with a reverse connection. */
BUG_ON(srv->conn_src.opts & CO_SRC_BIND);
BUG_ON(srv->proxy->conn_src.opts & CO_SRC_BIND);
if (alloc_bind_address(&bind_addr, srv, srv->proxy, NULL) != SRV_STATUS_OK)
goto err;
conn->src = bind_addr;
sockaddr_alloc(&conn->dst, 0, 0);
if (!conn->dst)
@ -247,6 +248,16 @@ int rev_bind_listener(struct listener *listener, char *errmsg, int errlen)
snprintf(errmsg, errlen, "Cannot reverse connect with server '%s/%s' unless HTTP/2 is activated on it with either proto or alpn keyword.", name, ist0(sv_name));
goto err;
}
/* Prevent dynamic source address settings. */
if (((srv->conn_src.opts & CO_SRC_TPROXY_MASK) &&
(srv->conn_src.opts & CO_SRC_TPROXY_MASK) != CO_SRC_TPROXY_ADDR) ||
((srv->proxy->conn_src.opts & CO_SRC_TPROXY_MASK) &&
(srv->proxy->conn_src.opts & CO_SRC_TPROXY_MASK) != CO_SRC_TPROXY_ADDR)) {
snprintf(errmsg, errlen, "Cannot reverse connect with server '%s/%s' which uses dynamic source address setting.", name, ist0(sv_name));
goto err;
}
ha_free(&name);
listener->rx.reverse_connect.srv = srv;