From: Christopher Faulet <cfaulet@haproxy.com>
Date: Fri, 13 Dec 2019 08:31:00 +0000 (+0100)
Subject: MINOR: tcp-rules: Kill connections when custom actions return ACT_RET_ERR
X-Git-Tag: v2.2-dev1~66
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=491ab5e2e5234c15fda964aa79e5a0be7e127365;p=thirdparty%2Fhaproxy.git

MINOR: tcp-rules: Kill connections when custom actions return ACT_RET_ERR

Thanks to the commit "MINOR: actions: Use ACT_RET_CONT code to ignore an error
from a custom action", it is now possible to trigger an error from a custom
action in tcp-content rules. Now, when a custom action returns the ACT_RET_ERR
code, it has the same behavior than a reject rules, the connection is killed.

Be careful if this patch is backported. The other mentioned patch must be
backported first.
---

diff --git a/src/tcp_rules.c b/src/tcp_rules.c
index e87b70b827..ce3900e6b9 100644
--- a/src/tcp_rules.c
+++ b/src/tcp_rules.c
@@ -158,6 +158,7 @@ resume_execution:
 				break;
 			}
 			else if (rule->action == ACT_ACTION_DENY) {
+			  deny:
 				si_must_kill_conn(chn_prod(req));
 				channel_abort(req);
 				channel_abort(&s->res);
@@ -235,6 +236,7 @@ resume_execution:
 
 				switch (rule->action_ptr(rule, s->be, s->sess, s, act_flags)) {
 				case ACT_RET_ERR:
+					goto deny;
 				case ACT_RET_CONT:
 					continue;
 				case ACT_RET_STOP:
@@ -336,6 +338,7 @@ resume_execution:
 				break;
 			}
 			else if (rule->action == ACT_ACTION_DENY) {
+			  deny:
 				si_must_kill_conn(chn_prod(rep));
 				channel_abort(rep);
 				channel_abort(&s->req);
@@ -370,6 +373,7 @@ resume_execution:
 
 				switch (rule->action_ptr(rule, s->be, s->sess, s, act_flags)) {
 				case ACT_RET_ERR:
+					goto deny;
 				case ACT_RET_CONT:
 					continue;
 				case ACT_RET_STOP: