mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2026-05-04 20:46:11 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MEDIUM: tcp: do not skip tracking rules on second pass

Browse Source 
The track-sc* tcp rules are bogus. The test to verify if the
tracked counter was already assigned is performed in the same
condition as the test for the action. The effect is that a
rule which tracks a counter that is already being tracked
is implicitly converted to an accept because the default
rule is an accept.

This bug only affects 1.5-dev releases.
This commit is contained in:
Willy Tarreau 2013-10-30 19:24:00 +01:00
parent ae727bf9b4
commit 44778ad87d
1 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/proto_tcp.c
View File

@ -939,13 +939,15 @@ int tcp_inspect_request(struct session *s, struct channel *req, int an_bit)
s->flags |= SN_FINST_R;
return 0;
}
else if ((rule->action >= TCP_ACT_TRK_SC0 && rule->action <= TCP_ACT_TRK_SCMAX) &&
!s->stkctr[tcp_trk_idx(rule->action)].entry) {
else if (rule->action >= TCP_ACT_TRK_SC0 && rule->action <= TCP_ACT_TRK_SCMAX) {
/* Note: only the first valid tracking parameter of each
* applies.
*/
struct stktable_key *key;
if (s->stkctr[tcp_trk_idx(rule->action)].entry)
continue;
t = rule->act_prm.trk_ctr.table.t;
key = stktable_fetch_key(t, s->be, s, &s->txn, SMP_OPT_DIR_REQ|SMP_OPT_FINAL, rule->act_prm.trk_ctr.expr);
@ -1099,13 +1101,15 @@ int tcp_exec_req_rules(struct session *s)
result = 0;
break;
}
else if ((rule->action >= TCP_ACT_TRK_SC0 && rule->action <= TCP_ACT_TRK_SCMAX) &&
!s->stkctr[tcp_trk_idx(rule->action)].entry) {
else if (rule->action >= TCP_ACT_TRK_SC0 && rule->action <= TCP_ACT_TRK_SCMAX) {
/* Note: only the first valid tracking parameter of each
* applies.
*/
struct stktable_key *key;
if (s->stkctr[tcp_trk_idx(rule->action)].entry)
continue;
t = rule->act_prm.trk_ctr.table.t;
key = stktable_fetch_key(t, s->be, s, &s->txn, SMP_OPT_DIR_REQ|SMP_OPT_FINAL, rule->act_prm.trk_ctr.expr);