HAProxy Lua can't add action on <tcp-request connect> - haproxy

Question

I have lua script for haproxy which check ip in whitelist and i need add this to haproxy config.
I need do this on tcp connection, and as the haproxy blog post says - i can do this.
tcp-request connection <action>
tcp-request content <action>
tcp-response content <action>
http-request <action>
http-response <action>
But if i use tcp-request connection lua.checkip - haproxy can't start with error message:
haproxy[9384]: [ALERT] 124/000121 (9384) : parsing [/etc/haproxy/haproxy.cfg:42] : 'tcp-request connection' expects 'accept', 'reject', 'track-sc0' ... 'track-sc2', 'sc-inc-gpc0(*)', 'sc-inc-gpc1(*)', 'sc-set-gpt0(*)', 'set-src', 'set-src-port', 'set-dst', 'set-dst-port', 'silent-drop' in frontend 'haproxy_rserve' (got 'lua.checkip').
But i can use tcp-request content lua.checkip and this working.
As far as I understand these 2 functions must have differences and for me best solution is connetion or can I use content ?
I'm trying to build a highly loaded system, so I would not want to screw up at the configuration stage.
This lines i try add to frontend:
tcp-request inspect-delay 5s
tcp-request connection lua.checkip
tcp-request connection reject if { var(req.blocked) -m bool }

Answer 1

A look at the source reveals that registering a Lua tcp-req action is indeed just for content, and there's no way to register a Lua action for a connection:
if (strcmp(lua_tostring(L, -1), "tcp-req") == 0)
tcp_req_cont_keywords_register(akl);
else if (strcmp(lua_tostring(L, -1), "tcp-res") == 0)
tcp_res_cont_keywords_register(akl);
else if (strcmp(lua_tostring(L, -1), "http-req") == 0)
http_req_keywords_register(akl);
else if (strcmp(lua_tostring(L, -1), "http-res") == 0)
http_res_keywords_register(akl);
else
WILL_LJMP(luaL_error(L, "Lua action environment '%s' is unknown. "
"'tcp-req', 'tcp-res', 'http-req' or 'http-res' "
"are expected.", lua_tostring(L, -1)));
The function that it'd need to call is tcp_req_conn_keywords_register, but unfortunately that's not exposed to Lua. The only callers of that function are for some hardcoded actions in proto_tcp.c and stick_table.c:
static struct action_kw_list tcp_req_conn_actions = {ILH, {
{ "set-src", tcp_parse_set_src_dst },
{ "set-src-port", tcp_parse_set_src_dst },
{ "set-dst" , tcp_parse_set_src_dst },
{ "set-dst-port", tcp_parse_set_src_dst },
{ "silent-drop", tcp_parse_silent_drop },
{ /* END */ }
}};
INITCALL1(STG_REGISTER, tcp_req_conn_keywords_register, &tcp_req_conn_actions);
static struct action_kw_list tcp_conn_kws = { { }, {
{ "sc-inc-gpc0", parse_inc_gpc0, 1 },
{ "sc-inc-gpc1", parse_inc_gpc1, 1 },
{ "sc-set-gpt0", parse_set_gpt0, 1 },
{ /* END */ }
}};
INITCALL1(STG_REGISTER, tcp_req_conn_keywords_register, &tcp_conn_kws);
However, I once again have two pieces of good news:
If you can put your whitelist in a file, you can use tcp-request connection reject unless { src -f /etc/haproxy/whitelist.lst } rather than needing to use Lua at all.
Nothing jumps out at me as a critical reason that this couldn't be supported from Lua, so it may be able to be added to a future release.