Ticket #1528: 1528.3.patch

src/mod_extforward.c

@@ -20 +20 @@
-/**
- * mod_extforward.c for lighttpd, by comman.kang <at> gmail <dot> com
- *                  extended, modified by Lionel Elie Mamane (LEM), lionel <at> mamane <dot> lu
+ *                  support chained proxies by glen@delfi.ee, #1528
- *
- * Config example:
- *
@@ -33 +34 @@
- *       Note that "all" has precedence over specific entries,
- *       so "all except" setups will not work.
- *
+ *       In case you have chained proxies, you can add all their IP's to the
+ *       config. However "all" has effect only on connecting IP, as the
+ *       X-Forwarded-For header can not be trusted.
+ *
- * Note: The effect of this module is variable on $HTTP["remotip"] directives and
- *       other module's remote ip dependent actions.
- *  Things done by modules before we change the remoteip or after we reset it will match on the proxy's IP.
@@ -225 +230 @@
-                char *base, *curr;
-                /* state variable, 0 means not in string, 1 means in string */
-                int in_str = 0;
-
-
+
-                        if (in_str) {
- (*curr > '9' || *curr < '0') && *curr != '.' && *curr != ':' 
+(*curr > '9' || *curr < '0') && *curr != '.' && *curr != ':'
-                                        /* found an separator , insert value into result array */
--
+ - 
-                                        /* change state to not in string */
-                                        in_str = 0;
-                                }
-                        } else {
-
-
+
-                                        /* found leading char of an IP address, move base pointer and change state */
-                                        base = curr;
-                                        in_str = 1;
@@ -244 +247 @@
-                        }
-                }
-                /* if breaking out while in str, we got to the end of string, so add it */
-
-
-
+
+
-                }
-        }
-        return result;
@@ -255 +257 @@
-#define IP_TRUSTED 1
-#define IP_UNTRUSTED 0
-/*
- 
-
+*
+ 
-static int is_proxy_trusted(const char *ipstr, plugin_data *p)
-{
-
+
+
-        if (allds) {
-"trust") == 0)
+ "trust") == 0) {
-                        return IP_TRUSTED;
-else
+} else {
-                        return IP_UNTRUSTED;
+                }
-        }
-
+
+
-}
-
+/*
+ * Return char *ip of last address of proxy that is not trusted.
+ * Do not accept "all" keyword here.
+ */
+static const char *last_not_in_array(array *a, plugin_data *p)
+{
+        for (int i = a->used - 1; i >= 0; i--) {
+                data_string *ds = (data_string *)a->data[i];
+                const char *ip = ds->value->ptr;
+
+                if (IP_UNTRUSTED == is_proxy_trusted(ip, p)) {
+                        return ip;
+                }
+        }
+        return NULL;
+}
+
-struct addrinfo *ipstr_to_sockaddr(const char *host)
-{
-   struct addrinfo hints, *res0;
@@ -316 +338 @@
-        struct addrinfo *addrlist = NULL;
-#endif
-        const char *dst_addr_str = NULL;
-        int i;
-        array *forward_array = NULL;
-
+onst c
-#ifdef HAVE_IPV6
-#endif
-
@@ -342 +363 @@
-                return HANDLER_GO_ON;
-        }
-
-        /* if the remote ip itself is not trusted , then do nothing */
-#ifdef HAVE_IPV6
-        dst_addr_str = inet_ntop(con->dst_addr.plain.sa_family,
-                      con->dst_addr.plain.sa_family == AF_INET6 ?
@@ -353 +373 @@
-#else
-        dst_addr_str = inet_ntoa(con->dst_addr.ipv4.sin_addr);
-#endif
-
+
+
+
-                if (con->conf.log_request_handling) {
-                        log_error_write(srv, __FILE__, __LINE__, "s",
-                                        "remote address is NOT a trusted proxy, skipping");
@@ -362 +384 @@
-                return HANDLER_GO_ON;
-        }
-
+        /* build forward_array from forwarded data_string */
-        forward_array = extract_forward_array(forwarded->value);
+        real_remote_addr = last_not_in_array(forward_array, p);
+        array_free(forward_array);
-
-        /* Testing shows that multiple headers and multiple values in one header
-           come in _reverse_ order. So the first one we get is the last one in the request. */
-        for (i = forward_array->used - 1; i >= 0; i--) {
-                data_string *ds = (data_string *) forward_array->data[i];
-                if (ds) {
-                        real_remote_addr = ds->value->ptr;
-                        break;
-                } else {
-                        /* bug ?  bailing out here */
-                        break;
-                }
-        }
-
-        if (real_remote_addr != NULL) { /* parsed */
-                sock_addr sock;
-                struct addrinfo *addrs_left;
-                server_socket *srv_sock = con->srv_socket;
- array_get_element(con->request.headers,
+array_get_element(con->request.headers, 
-
-
+ {
-                        srv_sock->is_proxy_ssl = 1;
-else
+} else {
-                        srv_sock->is_proxy_ssl = 0;
+                }
-
-                if (con->conf.log_request_handling) {
-
-
+
-                }
-#ifdef HAVE_IPV6
-                addrlist = ipstr_to_sockaddr(real_remote_addr);
-                sock.plain.sa_family = AF_UNSPEC;
-
-
+
-                        sock.plain.sa_family = addrs_left->ai_family;
- sock.plain.sa_family == AF_INET 
+sock.plain.sa_family == AF_INET
-                                sock.ipv4.sin_addr = ((struct sockaddr_in*)addrs_left->ai_addr)->sin_addr;
-                                break;
- sock.plain.sa_family == AF_INET6 
+sock.plain.sa_family == AF_INET6
-                                sock.ipv6.sin6_addr = ((struct sockaddr_in6*)addrs_left->ai_addr)->sin6_addr;
-                                break;
-                        }
@@ -436 +447 @@
-                if (addrlist != NULL ) freeaddrinfo(addrlist);
-#endif
-        }
-        array_free(forward_array);
-
-        /* not found */
-        return HANDLER_GO_ON;

tests/mod-extforward.conf

@@ -1 +1 @@
-debug.log-request-handling   = "enable"
-en
-en
+dis
+dis
-
-server.document-root         = env.SRCDIR + "/tmp/lighttpd/servers/www.example.org/pages/"
-server.pid-file              = env.SRCDIR + "/tmp/lighttpd/lighttpd.pid"
@@ -27 +27 @@
-
-extforward.forwarder = (
-        "127.0.0.1" => "trust",
+        "127.0.30.1" => "trust",
-)

tests/mod-extforward.t

@@ -8 +8 @@
-
-use strict;
-use IO::Socket;
-2
+5
-use LightyTest;
-
-my $tf = LightyTest->new();
@@ -18 +18 @@
-
-ok($tf->start_proc == 0, "Starting lighttpd") or die();
-
-## check if If-Modified-Since, If-None-Match works
-
-$t->{REQUEST} = ( <<EOF
-GET /ip.pl HTTP/1.0
-Host: www.example.org
@@ -27 +25 @@
-EOF
-);
-$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 200, 'HTTP-Content' => '127.0.10.1' } ];
-
+, from single ip
-
-$t->{REQUEST} = ( <<EOF
-GET /ip.pl HTTP/1.0
@@ -36 +34 @@
-EOF
-);
-$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 200, 'HTTP-Content' => '127.0.20.1' } ];
-
+, from two ips
-
+$t->{REQUEST} = ( <<EOF
+GET /ip.pl HTTP/1.0
+Host: www.example.org
+X-Forwarded-For: 127.0.10.1, 127.0.20.1, 127.0.30.1
+EOF
+);
+$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 200, 'HTTP-Content' => '127.0.20.1' } ];
+ok($tf->handle_http($t) == 0, 'expect 127.0.20.1, from chained proxies');
+
-ok($tf->stop_proc == 0, "Stopping lighttpd");

tests/docroot/www/ip.pl

@@ -2 +2 @@
-print "Content-Type: text/html\r\n\r\n";
-print $ENV{'REMOTE_ADDR'};
-
+if ($ENV{'QUERY_STRING'} eq 'info') {
+        print "\nF:",$ENV{'HTTP_X_FORWARDED_FOR'},"\n";
+
+        while (my($key, $value) = each %ENV) {
+                printf "%s => %s\n", $key, $value;
+        }
+}
+
-0;

NEWS

@@ -20 +20 @@
-  * HTTPS env var should be "on" when using mod_extforward and the X-Forwarded-Proto header is set. (#1499)
-  * generate ETag and Last-Modified headers for mod_ssi based on newest modified include (#1491)
-  * support letterhomes in mod_userdir (#1473)
+  * support chained proxies in mod_extforward (#1528)
-
-- 1.4.18 - 2007-09-09
-