Ticket #1528: 1528.2.patch

src/mod_extforward.c

@@ -259 +259 @@
-*/
-static int is_proxy_trusted(const char *ipstr, plugin_data *p)
-{
-
+
+
-        if (allds) {
-
+ 
-                        return IP_TRUSTED;
-                else
-                        return IP_UNTRUSTED;
-        }
-
+
+
-}
-
+/*
+ * Return char *ip of last address of proxy that is not trusted.
+ */
+static const char *last_not_in_array(array *a, plugin_data *p)
+{
+        for (int i = a->used - 1; i >= 0; i--) {
+                data_string *ds = (data_string *)a->data[i];
+                const char *ip = ds->value->ptr;
+
+                if (IP_UNTRUSTED == is_proxy_trusted(ip, p)) {
+                        return ip;
+                }
+        }
+        return NULL;
+}
+
-struct addrinfo *ipstr_to_sockaddr(const char *host)
-{
-   struct addrinfo hints, *res0;
@@ -316 +334 @@
-        struct addrinfo *addrlist = NULL;
-#endif
-        const char *dst_addr_str = NULL;
-        int i;
-        array *forward_array = NULL;
-
+onst c
-#ifdef HAVE_IPV6
-#endif
-
@@ -342 +359 @@
-                return HANDLER_GO_ON;
-        }
-
-        /* if the remote ip itself is not trusted , then do nothing */
-#ifdef HAVE_IPV6
-        dst_addr_str = inet_ntop(con->dst_addr.plain.sa_family,
-                      con->dst_addr.plain.sa_family == AF_INET6 ?
@@ -353 +369 @@
-#else
-        dst_addr_str = inet_ntoa(con->dst_addr.ipv4.sin_addr);
-#endif
-
+
+
+
-                if (con->conf.log_request_handling) {
-                        log_error_write(srv, __FILE__, __LINE__, "s",
-                                        "remote address is NOT a trusted proxy, skipping");
@@ -362 +380 @@
-                return HANDLER_GO_ON;
-        }
-
+        /* build forward_array from forwarded data_string */
-        forward_array = extract_forward_array(forwarded->value);
+        real_remote_addr = last_not_in_array(forward_array, p);
-
-        /* Testing shows that multiple headers and multiple values in one header
-           come in _reverse_ order. So the first one we get is the last one in the request. */
-        for (i = forward_array->used - 1; i >= 0; i--) {
-                data_string *ds = (data_string *) forward_array->data[i];
-                if (ds) {
-                        real_remote_addr = ds->value->ptr;
-                        break;
-                } else {
-                        /* bug ?  bailing out here */
-                        break;
-                }
-        }
-
-        if (real_remote_addr != NULL) { /* parsed */
-                sock_addr sock;

tests/mod-extforward.conf

@@ -1 +1 @@
-debug.log-request-handling   = "enable"
-en
-en
+dis
+dis
-
-server.document-root         = env.SRCDIR + "/tmp/lighttpd/servers/www.example.org/pages/"
-server.pid-file              = env.SRCDIR + "/tmp/lighttpd/lighttpd.pid"
@@ -27 +27 @@
-
-extforward.forwarder = (
-        "127.0.0.1" => "trust",
+        "127.0.30.1" => "trust",
-)

tests/mod-extforward.t

@@ -8 +8 @@
-
-use strict;
-use IO::Socket;
-2
+5
-use LightyTest;
-
-my $tf = LightyTest->new();
@@ -27 +27 @@
-EOF
-);
-$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 200, 'HTTP-Content' => '127.0.10.1' } ];
-
+, from single ip
-
-$t->{REQUEST} = ( <<EOF
-GET /ip.pl HTTP/1.0
@@ -36 +36 @@
-EOF
-);
-$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 200, 'HTTP-Content' => '127.0.20.1' } ];
-
+, from two ips
-
+$t->{REQUEST} = ( <<EOF
+GET /ip.pl HTTP/1.0
+Host: www.example.org
+X-Forwarded-For: 127.0.10.1, 127.0.20.1, 127.0.30.1
+EOF
+);
+$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 200, 'HTTP-Content' => '127.0.20.1' } ];
+ok($tf->handle_http($t) == 0, 'expect 127.0.20.1, from chained proxies');
+
-ok($tf->stop_proc == 0, "Stopping lighttpd");