BUG/MEDIUM: tcp-check: single connect rule can't detect DOWN servers

When tcpcheck is used to do TCP port monitoring only and the script is
composed by a single "tcp-check connect" rule (whatever port and ssl
options enabled), then the server can't be seen as DOWN.
Simple configuration to reproduce:

  backend b
    [...]
    option tcp-check
    tcp-check connect
    server s1 127.0.0.1:22 check

The main reason for this issue is that the piece of code which validates
that we're not at the end of the chained list (of rules) prevents
executing the validation of the establishment of the TCP connection.
Since validation is not executed, the rule is terminated and the report
says no errors were encountered, hence the server is UP all the time.

The workaround is simple: move the connection validation outsied the
CONNECT rule processing loop, into the main function.
That way, if the connection status is not CONNECTED, then HAProxy will
now add more time to wait for it. If the time is expired, an error is
now well reported.

Backport status: 1.8

diff --git a/src/checks.c b/src/checks.c
index 0d4893e693663053e623862154d976993bee8f02..8ca2089546bd4aa8f4f68899ff27a2ac8ddff939 100644 (file)
--- a/src/checks.c
+++ b/src/checks.c
@@ -2834,25 +2834,6 @@ static int tcpcheck_main(struct check *check)
                        if (&check->current_step->list == head)
                                break;
 
-                       /* don't do anything until the connection is established */
-                       if (!(conn->flags & CO_FL_CONNECTED)) {
-                               /* update expire time, should be done by process_chk */
-                               /* we allow up to min(inter, timeout.connect) for a connection
-                                * to establish but only when timeout.check is set
-                                * as it may be to short for a full check otherwise
-                                */
-                               while (tick_is_expired(t->expire, now_ms)) {
-                                       int t_con;
-
-                                       t_con = tick_add(t->expire, s->proxy->timeout.connect);
-                                       t->expire = tick_add(t->expire, MS_TO_TICKS(check->inter));
-
-                                       if (s->proxy->timeout.check)
-                                               t->expire = tick_first(t->expire, t_con);
-                               }
-                               goto out;
-                       }
-
                } /* end 'connect' */
                else if (check->current_step->action == TCPCHK_ACT_SEND) {
                        /* mark the step as started */
@@ -3040,6 +3021,25 @@ static int tcpcheck_main(struct check *check)
                } /* end expect */
        } /* end loop over double chained step list */
 
+       /* don't do anything until the connection is established */
+       if (!(conn->flags & CO_FL_CONNECTED)) {
+               /* update expire time, should be done by process_chk */
+               /* we allow up to min(inter, timeout.connect) for a connection
+                * to establish but only when timeout.check is set
+                * as it may be to short for a full check otherwise
+                */
+               while (tick_is_expired(t->expire, now_ms)) {
+                       int t_con;
+
+                       t_con = tick_add(t->expire, s->proxy->timeout.connect);
+                       t->expire = tick_add(t->expire, MS_TO_TICKS(check->inter));
+
+                       if (s->proxy->timeout.check)
+                               t->expire = tick_first(t->expire, t_con);
+               }
+               goto out;
+       }
+
        /* We're waiting for some I/O to complete, we've reached the end of the
         * rules, or both. Do what we have to do, otherwise we're done.
         */