]> git.ipfire.org Git - thirdparty/haproxy.git/commitdiff
MINOR: cfgparse: forbid mixing reverse and standard listeners
authorAmaury Denoyelle <adenoyelle@haproxy.com>
Thu, 19 Oct 2023 10:05:31 +0000 (12:05 +0200)
committerAmaury Denoyelle <adenoyelle@haproxy.com>
Fri, 20 Oct 2023 12:44:37 +0000 (14:44 +0200)
Reverse HTTP listeners are very specific and share only a very limited
subset of keywords with other listeners. As such, it is probable
meaningless to mix standard and reverse addresses on the same bind line.
This patch emits a fatal error during configuration parsing if this is
the case.

include/haproxy/listener-t.h
src/cfgparse.c

index 8c66dd00c1c261f50753488dd5fa36dbba7c4055..8f7cbb13e7a38c2f1651cacd21ed700dc11ce7b4 100644 (file)
@@ -111,6 +111,7 @@ enum li_status {
 #define BC_O_ACC_CIP            0x00001000 /* find the proxied address in the NetScaler Client IP header */
 #define BC_O_UNLIMITED          0x00002000 /* listeners not subject to global limits (peers & stats socket) */
 #define BC_O_NOSTOP             0x00004000 /* keep the listeners active even after a soft stop */
+#define BC_O_REVERSE_HTTP       0x00008000 /* a reverse HTTP bind is used */
 
 
 /* flags used with bind_conf->ssl_options */
index ef18bfbeefb20451ed848bdc333f2cd60ca18d71..99d6d6bf98433b7545f71d73973fcbf8b84e6d05 100644 (file)
@@ -162,6 +162,32 @@ int str2listener(char *str, struct proxy *curproxy, struct bind_conf *bind_conf,
                if (!ss2)
                        goto fail;
 
+               if (ss2->ss_family == AF_CUST_REV_SRV) {
+                       /* Check if a previous non reverse HTTP present is
+                        * already defined. If DGRAM or STREAM is set, this
+                        * indicates that we are currently parsing the second
+                        * or more address.
+                        */
+                       if (bind_conf->options & (BC_O_USE_SOCK_DGRAM|BC_O_USE_SOCK_STREAM) &&
+                           !(bind_conf->options & BC_O_REVERSE_HTTP)) {
+                               memprintf(err, "Cannot mix reverse HTTP bind with others.\n");
+                               goto fail;
+                       }
+
+                       bind_conf->reverse_srvname = strdup(str + strlen("rev@"));
+                       if (!bind_conf->reverse_srvname) {
+                               memprintf(err, "Cannot allocate reverse HTTP bind.\n");
+                               goto fail;
+                       }
+
+                       bind_conf->options |= BC_O_REVERSE_HTTP;
+               }
+               else if (bind_conf->options & BC_O_REVERSE_HTTP) {
+                       /* Standard address mixed with a previous reverse HTTP one. */
+                       memprintf(err, "Cannot mix reverse HTTP bind with others.\n");
+                       goto fail;
+               }
+
                /* OK the address looks correct */
                if (proto->proto_type == PROTO_TYPE_DGRAM)
                        bind_conf->options |= BC_O_USE_SOCK_DGRAM;
@@ -173,10 +199,6 @@ int str2listener(char *str, struct proxy *curproxy, struct bind_conf *bind_conf,
                else
                        bind_conf->options |= BC_O_USE_XPRT_STREAM;
 
-               if (ss2->ss_family == AF_CUST_REV_SRV) {
-                       bind_conf->reverse_srvname = strdup(str + strlen("rev@"));
-               }
-
                if (!create_listeners(bind_conf, ss2, port, end, fd, proto, err)) {
                        memprintf(err, "%s for address '%s'.\n", *err, str);
                        goto fail;