From 90873dc6780dd1ec8a8e0d07799f10cabbe8f423 Mon Sep 17 00:00:00 2001 From: Amaury Denoyelle Date: Mon, 2 Oct 2023 17:17:46 +0200 Subject: [PATCH] MINOR: proto_reverse_connect: support source address setting Support backend configuration for explicit source address on pre-connect. These settings can be specified via "source" backend keyword or directly on the server line. Previously, all source parameters triggered a BUG_ON() when binding a reverse connect listener. This was done because some settings are incompatible with reverse connect context : this is the case for all source settings which do not specify a fixed address but rather rely on a frontend connection. Indeed, in case of preconnect, connection is initiated on its own without the existence of a previous frontend connection. This patch allows to use a source parameter with a fixed address. All other settings (usesrc client/clientip/hdr_ip) are rejected on listener binding. On connection init, alloc_bind_address() is used to set the optional source address. --- src/proto_reverse_connect.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/src/proto_reverse_connect.c b/src/proto_reverse_connect.c index 61cf448065..ef9e40f469 100644 --- a/src/proto_reverse_connect.c +++ b/src/proto_reverse_connect.c @@ -50,14 +50,15 @@ struct protocol proto_reverse_connect = { static struct connection *new_reverse_conn(struct listener *l, struct server *srv) { struct connection *conn = conn_new(srv); + struct sockaddr_storage *bind_addr = NULL; if (!conn) goto err; conn_set_reverse(conn, &l->obj_type); - /* These options is incompatible with a reverse connection. */ - BUG_ON(srv->conn_src.opts & CO_SRC_BIND); - BUG_ON(srv->proxy->conn_src.opts & CO_SRC_BIND); + if (alloc_bind_address(&bind_addr, srv, srv->proxy, NULL) != SRV_STATUS_OK) + goto err; + conn->src = bind_addr; sockaddr_alloc(&conn->dst, 0, 0); if (!conn->dst) @@ -247,6 +248,16 @@ int rev_bind_listener(struct listener *listener, char *errmsg, int errlen) snprintf(errmsg, errlen, "Cannot reverse connect with server '%s/%s' unless HTTP/2 is activated on it with either proto or alpn keyword.", name, ist0(sv_name)); goto err; } + + /* Prevent dynamic source address settings. */ + if (((srv->conn_src.opts & CO_SRC_TPROXY_MASK) && + (srv->conn_src.opts & CO_SRC_TPROXY_MASK) != CO_SRC_TPROXY_ADDR) || + ((srv->proxy->conn_src.opts & CO_SRC_TPROXY_MASK) && + (srv->proxy->conn_src.opts & CO_SRC_TPROXY_MASK) != CO_SRC_TPROXY_ADDR)) { + snprintf(errmsg, errlen, "Cannot reverse connect with server '%s/%s' which uses dynamic source address setting.", name, ist0(sv_name)); + goto err; + } + ha_free(&name); listener->rx.reverse_connect.srv = srv;