Changeset 2061

Timestamp:

01/21/2008 08:21:20 AM (4 months ago)

Author:

glen

Message:

- support chained proxies in mod_extforward (#1528)

Files:

• branches/lighttpd-1.4.x/NEWS (modified) (1 diff)
• branches/lighttpd-1.4.x/src/mod_extforward.c (modified) (11 diffs)
• branches/lighttpd-1.4.x/tests/docroot/www/ip.pl (modified) (1 diff)
• branches/lighttpd-1.4.x/tests/mod-extforward.conf (modified) (2 diffs)
• branches/lighttpd-1.4.x/tests/mod-extforward.t (modified) (4 diffs)

branches/lighttpd-1.4.x/NEWS

@@ -21 +21 @@
-  * generate ETag and Last-Modified headers for mod_ssi based on newest modified include (#1491)
-  * support letterhomes in mod_userdir (#1473)
+  * support chained proxies in mod_extforward (#1528)
-
-- 1.4.18 - 2007-09-09

branches/lighttpd-1.4.x/src/mod_extforward.c

@@ -21 +21 @@
- * mod_extforward.c for lighttpd, by comman.kang <at> gmail <dot> com
- *                  extended, modified by Lionel Elie Mamane (LEM), lionel <at> mamane <dot> lu
+ *                  support chained proxies by glen@delfi.ee, #1528
- *
- * Config example:
@@ -33 +34 @@
- *       Note that "all" has precedence over specific entries,
- *       so "all except" setups will not work.
+ *
+ *       In case you have chained proxies, you can add all their IP's to the
+ *       config. However "all" has effect only on connecting IP, as the
+ *       X-Forwarded-For header can not be trusted.
- *
- * Note: The effect of this module is variable on $HTTP["remotip"] directives and
@@ -226 +231 @@
-                /* state variable, 0 means not in string, 1 means in string */
-                int in_str = 0;
-
-
+
-                        if (in_str) {
- (*curr > '9' || *curr < '0') && *curr != '.' && *curr != ':' 
+(*curr > '9' || *curr < '0') && *curr != '.' && *curr != ':'
-                                        /* found an separator , insert value into result array */
--
+ - 
-                                        /* change state to not in string */
-                                        in_str = 0;
-                                }
-                        } else {
-
-
+
-                                        /* found leading char of an IP address, move base pointer and change state */
-                                        base = curr;
@@ -245 +248 @@
-                }
-                /* if breaking out while in str, we got to the end of string, so add it */
-
-
-
+
+
-                }
-        }
@@ -256 +258 @@
-#define IP_UNTRUSTED 0
-/*
- 
-
+*
+ 
-static int is_proxy_trusted(const char *ipstr, plugin_data *p)
-{
-
+
+
-        if (allds) {
-"trust") == 0)
+ "trust") == 0) {
-                        return IP_TRUSTED;
-else
+} else {
-                        return IP_UNTRUSTED;
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-}
-
@@ -317 +341 @@
-#endif
-        const char *dst_addr_str = NULL;
-        int i;
-        array *forward_array = NULL;
-
+onst c
-#ifdef HAVE_IPV6
-#endif
@@ -343 +366 @@
-        }
-
-        /* if the remote ip itself is not trusted , then do nothing */
-#ifdef HAVE_IPV6
-        dst_addr_str = inet_ntop(con->dst_addr.plain.sa_family,
@@ -354 +376 @@
-        dst_addr_str = inet_ntoa(con->dst_addr.ipv4.sin_addr);
-#endif
-
+
+
+
-                if (con->conf.log_request_handling) {
-                        log_error_write(srv, __FILE__, __LINE__, "s",
@@ -363 +387 @@
-        }
-
+        /* build forward_array from forwarded data_string */
-        forward_array = extract_forward_array(forwarded->value);
-
-
-
-
-
-
-
-
-
-
-
-
-
+
-
-        if (real_remote_addr != NULL) { /* parsed */
@@ -382 +395 @@
-                struct addrinfo *addrs_left;
-                server_socket *srv_sock = con->srv_socket;
- array_get_element(con->request.headers,
-
-
+array_get_element(con->request.headers, 
+
+ {
-                        srv_sock->is_proxy_ssl = 1;
-else
+} else {
-                        srv_sock->is_proxy_ssl = 0;
+                }
-
-                if (con->conf.log_request_handling) {
-
-
+
-                }
-#ifdef HAVE_IPV6
-                addrlist = ipstr_to_sockaddr(real_remote_addr);
-                sock.plain.sa_family = AF_UNSPEC;
-
-
+
-                        sock.plain.sa_family = addrs_left->ai_family;
- sock.plain.sa_family == AF_INET 
+sock.plain.sa_family == AF_INET
-                                sock.ipv4.sin_addr = ((struct sockaddr_in*)addrs_left->ai_addr)->sin_addr;
-                                break;
- sock.plain.sa_family == AF_INET6 
+sock.plain.sa_family == AF_INET6
-                                sock.ipv6.sin6_addr = ((struct sockaddr_in6*)addrs_left->ai_addr)->sin6_addr;
-                                break;
@@ -437 +449 @@
-#endif
-        }
-   
+
-
-        /* not found */

branches/lighttpd-1.4.x/tests/docroot/www/ip.pl

@@ -3 +3 @@
-print $ENV{'REMOTE_ADDR'};
-
+if ($ENV{'QUERY_STRING'} eq 'info') {
+        print "\nF:",$ENV{'HTTP_X_FORWARDED_FOR'},"\n";
+
+        while (my($key, $value) = each %ENV) {
+                printf "%s => %s\n", $key, $value;
+        }
+}
+
-0;

branches/lighttpd-1.4.x/tests/mod-extforward.conf

@@ -1 +1 @@
-debug.log-request-handling   = "enable"
-en
-en
+dis
+dis
-
-server.document-root         = env.SRCDIR + "/tmp/lighttpd/servers/www.example.org/pages/"
@@ -28 +28 @@
-extforward.forwarder = (
-        "127.0.0.1" => "trust",
+        "127.0.30.1" => "trust",
-)

branches/lighttpd-1.4.x/tests/mod-extforward.t

@@ -9 +9 @@
-use strict;
-use IO::Socket;
-2
+5
-use LightyTest;
-
@@ -19 +19 @@
-ok($tf->start_proc == 0, "Starting lighttpd") or die();
-
-## check if If-Modified-Since, If-None-Match works
-
-$t->{REQUEST} = ( <<EOF
-GET /ip.pl HTTP/1.0
@@ -28 +26 @@
-);
-$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 200, 'HTTP-Content' => '127.0.10.1' } ];
-
+, from single ip
-
-$t->{REQUEST} = ( <<EOF
@@ -37 +35 @@
-);
-$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 200, 'HTTP-Content' => '127.0.20.1' } ];
-
+
+
+
+
+
+
+
+
+
+
-
-ok($tf->stop_proc == 0, "Stopping lighttpd");