MEDIUM: config: report it when tcp-request rules are misplaced

A config where a tcp-request rule appears after an http-request rule
might seem valid but it is not. So let's report a warning about this
since this case is hard to detect by the naked eye.

diff --git a/include/common/cfgparse.h b/include/common/cfgparse.h
index 80310aea4f165abe2b7e8d899e9c39df991da8fa..86a0035145ffc96357951c013be6866f29a7c994 100644 (file)
--- a/include/common/cfgparse.h
+++ b/include/common/cfgparse.h
@@ -73,6 +73,8 @@ int check_config_validity();
 int str2listener(char *str, struct proxy *curproxy, struct bind_conf *bind_conf, const char *file, int line, char **err);
 int cfg_register_section(char *section_name,
                          int (*section_parser)(const char *, int, char **, int));
+int warnif_misplaced_tcp_conn(struct proxy *proxy, const char *file, int line, const char *arg);
+int warnif_misplaced_tcp_cont(struct proxy *proxy, const char *file, int line, const char *arg);
 
 /*
  * Sends a warning if proxy <proxy> does not have at least one of the

diff --git a/src/cfgparse.c b/src/cfgparse.c
index 970d353e04d330510738dadbce7c13c0e573a13f..106bf7f6d6d7e4af511f1b815cf3cd652e8fd9b6 100644 (file)
--- a/src/cfgparse.c
+++ b/src/cfgparse.c
@@ -317,6 +317,19 @@ int str2listener(char *str, struct proxy *curproxy, struct bind_conf *bind_conf,
        return 0;
 }
 
+/* Report a warning if a rule is placed after a 'tcp-request content' rule.
+ * Return 1 if the warning has been emitted, otherwise 0.
+ */
+int warnif_rule_after_tcp_cont(struct proxy *proxy, const char *file, int line, const char *arg)
+{
+       if (!LIST_ISEMPTY(&proxy->tcp_req.inspect_rules)) {
+               Warning("parsing [%s:%d] : a '%s' rule placed after a 'tcp-request content' rule will still be processed before.\n",
+                       file, line, arg);
+               return 1;
+       }
+       return 0;
+}
+
 /* Report a warning if a rule is placed after a 'block' rule.
  * Return 1 if the warning has been emitted, otherwise 0.
  */
@@ -408,6 +421,31 @@ int warnif_rule_after_use_server(struct proxy *proxy, const char *file, int line
        return 0;
 }
 
+/* report a warning if a "tcp request connection" rule is dangerously placed */
+int warnif_misplaced_tcp_conn(struct proxy *proxy, const char *file, int line, const char *arg)
+{
+       return  warnif_rule_after_tcp_cont(proxy, file, line, arg) ||
+               warnif_rule_after_block(proxy, file, line, arg) ||
+               warnif_rule_after_http_req(proxy, file, line, arg) ||
+               warnif_rule_after_reqxxx(proxy, file, line, arg) ||
+               warnif_rule_after_reqadd(proxy, file, line, arg) ||
+               warnif_rule_after_redirect(proxy, file, line, arg) ||
+               warnif_rule_after_use_backend(proxy, file, line, arg) ||
+               warnif_rule_after_use_server(proxy, file, line, arg);
+}
+
+/* report a warning if a "tcp request content" rule is dangerously placed */
+int warnif_misplaced_tcp_cont(struct proxy *proxy, const char *file, int line, const char *arg)
+{
+       return  warnif_rule_after_block(proxy, file, line, arg) ||
+               warnif_rule_after_http_req(proxy, file, line, arg) ||
+               warnif_rule_after_reqxxx(proxy, file, line, arg) ||
+               warnif_rule_after_reqadd(proxy, file, line, arg) ||
+               warnif_rule_after_redirect(proxy, file, line, arg) ||
+               warnif_rule_after_use_backend(proxy, file, line, arg) ||
+               warnif_rule_after_use_server(proxy, file, line, arg);
+}
+
 /* report a warning if a block rule is dangerously placed */
 int warnif_misplaced_block(struct proxy *proxy, const char *file, int line, const char *arg)
 {

diff --git a/src/proto_tcp.c b/src/proto_tcp.c
index 72dc92b2278eeaba24dadcbd3f9477aab1fcd44f..940c3f1142de10804a9b86e691faf5ab8527bd48 100644 (file)
--- a/src/proto_tcp.c
+++ b/src/proto_tcp.c
@@ -1711,6 +1711,8 @@ static int tcp_parse_tcp_req(char **args, int section_type, struct proxy *curpx,
                        warn++;
                }
 
+               /* the following function directly emits the warning */
+               warnif_misplaced_tcp_cont(curpx, file, line, args[0]);
                LIST_ADDQ(&curpx->tcp_req.inspect_rules, &rule->list);
        }
        else if (strcmp(args[1], "connection") == 0) {
@@ -1754,6 +1756,8 @@ static int tcp_parse_tcp_req(char **args, int section_type, struct proxy *curpx,
                        warn++;
                }
 
+               /* the following function directly emits the warning */
+               warnif_misplaced_tcp_conn(curpx, file, line, args[0]);
                LIST_ADDQ(&curpx->tcp_req.l4_rules, &rule->list);
        }
        else {