Mercurial > hg > nginx-vendor-current

comparison src/http/modules/ngx_http_realip_module.c @ 674:4dcaf40cc702 NGINX_1_3_0

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
nginx 1.3.0 *) Feature: the "debug_connection" directive now supports IPv6 addresses and the "unix:" parameter. *) Feature: the "set_real_ip_from" directive and the "proxy" parameter of the "geo" directive now support IPv6 addresses. *) Feature: the "real_ip_recursive", "geoip_proxy", and "geoip_proxy_recursive" directives. *) Feature: the "proxy_recursive" parameter of the "geo" directive. *) Bugfix: a segmentation fault might occur in a worker process if the "resolver" directive was used. *) Bugfix: a segmentation fault might occur in a worker process if the "fastcgi_pass", "scgi_pass", or "uwsgi_pass" directives were used and backend returned incorrect response. *) Bugfix: a segmentation fault might occur in a worker process if the "rewrite" directive was used and new request arguments in a replacement used variables. *) Bugfix: nginx might hog CPU if the open file resource limit was reached. *) Bugfix: nginx might loop infinitely over backends if the "proxy_next_upstream" directive with the "http_404" parameter was used and there were backup servers specified in an upstream block. *) Bugfix: adding the "down" parameter of the "server" directive might cause unneeded client redistribution among backend servers if the "ip_hash" directive was used. *) Bugfix: socket leak. Thanks to Yichun Zhang. *) Bugfix: in the ngx_http_fastcgi_module.
author Igor Sysoev <http://sysoev.ru>
date Tue, 15 May 2012 00:00:00 +0400
parents 9fbf3ad94cbf
children
comparison
equal deleted inserted replaced
673:1e5c7a976f48 674:4dcaf40cc702
14 #define NGX_HTTP_REALIP_XFWD 1 14 #define NGX_HTTP_REALIP_XFWD 1
15 #define NGX_HTTP_REALIP_HEADER 2 15 #define NGX_HTTP_REALIP_HEADER 2
16 16
17 17
18 typedef struct { 18 typedef struct {
19 ngx_array_t *from; /* array of ngx_in_cidr_t */ 19 ngx_array_t *from; /* array of ngx_cidr_t */
20 ngx_uint_t type; 20 ngx_uint_t type;
21 ngx_uint_t hash; 21 ngx_uint_t hash;
22 ngx_str_t header; 22 ngx_str_t header;
23 #if (NGX_HAVE_UNIX_DOMAIN) 23 ngx_flag_t recursive;
24 ngx_uint_t unixsock; /* unsigned unixsock:2; */
25 #endif
26 } ngx_http_realip_loc_conf_t; 24 } ngx_http_realip_loc_conf_t;
27 25
28 26
29 typedef struct { 27 typedef struct {
30 ngx_connection_t *connection; 28 ngx_connection_t *connection;
33 ngx_str_t addr_text; 31 ngx_str_t addr_text;
34 } ngx_http_realip_ctx_t; 32 } ngx_http_realip_ctx_t;
35 33
36 34
37 static ngx_int_t ngx_http_realip_handler(ngx_http_request_t *r); 35 static ngx_int_t ngx_http_realip_handler(ngx_http_request_t *r);
38 static ngx_int_t ngx_http_realip_set_addr(ngx_http_request_t *r, u_char *ip, 36 static ngx_int_t ngx_http_realip_set_addr(ngx_http_request_t *r,
39 size_t len); 37 ngx_addr_t *addr);
40 static void ngx_http_realip_cleanup(void *data); 38 static void ngx_http_realip_cleanup(void *data);
41 static char *ngx_http_realip_from(ngx_conf_t *cf, ngx_command_t *cmd, 39 static char *ngx_http_realip_from(ngx_conf_t *cf, ngx_command_t *cmd,
42 void *conf); 40 void *conf);
43 static char *ngx_http_realip(ngx_conf_t *cf, ngx_command_t *cmd, void *conf); 41 static char *ngx_http_realip(ngx_conf_t *cf, ngx_command_t *cmd, void *conf);
44 static void *ngx_http_realip_create_loc_conf(ngx_conf_t *cf); 42 static void *ngx_http_realip_create_loc_conf(ngx_conf_t *cf);
59 { ngx_string("real_ip_header"), 57 { ngx_string("real_ip_header"),
60 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1, 58 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
61 ngx_http_realip, 59 ngx_http_realip,
62 NGX_HTTP_LOC_CONF_OFFSET, 60 NGX_HTTP_LOC_CONF_OFFSET,
63 0, 61 0,
62 NULL },
63
64 { ngx_string("real_ip_recursive"),
65 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_FLAG,
66 ngx_conf_set_flag_slot,
67 NGX_HTTP_LOC_CONF_OFFSET,
68 offsetof(ngx_http_realip_loc_conf_t, recursive),
64 NULL }, 69 NULL },
65 70
66 ngx_null_command 71 ngx_null_command
67 }; 72 };
68 73
103 ngx_http_realip_handler(ngx_http_request_t *r) 108 ngx_http_realip_handler(ngx_http_request_t *r)
104 { 109 {
105 u_char *ip, *p; 110 u_char *ip, *p;
106 size_t len; 111 size_t len;
107 ngx_uint_t i, hash; 112 ngx_uint_t i, hash;
113 ngx_addr_t addr;
108 ngx_list_part_t *part; 114 ngx_list_part_t *part;
109 ngx_table_elt_t *header; 115 ngx_table_elt_t *header;
110 struct sockaddr_in *sin;
111 ngx_in_cidr_t *from;
112 ngx_connection_t *c; 116 ngx_connection_t *c;
113 ngx_http_realip_ctx_t *ctx; 117 ngx_http_realip_ctx_t *ctx;
114 ngx_http_realip_loc_conf_t *rlcf; 118 ngx_http_realip_loc_conf_t *rlcf;
115 119
116 ctx = ngx_http_get_module_ctx(r, ngx_http_realip_module); 120 ctx = ngx_http_get_module_ctx(r, ngx_http_realip_module);
119 return NGX_DECLINED; 123 return NGX_DECLINED;
120 } 124 }
121 125
122 rlcf = ngx_http_get_module_loc_conf(r, ngx_http_realip_module); 126 rlcf = ngx_http_get_module_loc_conf(r, ngx_http_realip_module);
123 127
124 if (rlcf->from == NULL 128 if (rlcf->from == NULL) {
125 #if (NGX_HAVE_UNIX_DOMAIN)
126 && !rlcf->unixsock
127 #endif
128 )
129 {
130 return NGX_DECLINED; 129 return NGX_DECLINED;
131 } 130 }
132 131
133 switch (rlcf->type) { 132 switch (rlcf->type) {
134 133
149 return NGX_DECLINED; 148 return NGX_DECLINED;
150 } 149 }
151 150
152 len = r->headers_in.x_forwarded_for->value.len; 151 len = r->headers_in.x_forwarded_for->value.len;
153 ip = r->headers_in.x_forwarded_for->value.data; 152 ip = r->headers_in.x_forwarded_for->value.data;
154
155 for (p = ip + len - 1; p > ip; p--) {
156 if (*p == ' ' || *p == ',') {
157 p++;
158 len -= p - ip;
159 ip = p;
160 break;
161 }
162 }
163 153
164 break; 154 break;
165 155
166 default: /* NGX_HTTP_REALIP_HEADER */ 156 default: /* NGX_HTTP_REALIP_HEADER */
167 157
202 192
203 c = r->connection; 193 c = r->connection;
204 194
205 ngx_log_debug1(NGX_LOG_DEBUG_HTTP, c->log, 0, "realip: \"%s\"", ip); 195 ngx_log_debug1(NGX_LOG_DEBUG_HTTP, c->log, 0, "realip: \"%s\"", ip);
206 196
207 /* AF_INET only */ 197 addr.sockaddr = c->sockaddr;
208 198 addr.socklen = c->socklen;
209 if (c->sockaddr->sa_family == AF_INET) { 199 /* addr.name = c->addr_text; */
210 sin = (struct sockaddr_in *) c->sockaddr; 200
211 201 if (ngx_http_get_forwarded_addr(r, &addr, ip, len, rlcf->from,
212 from = rlcf->from->elts; 202 rlcf->recursive)
213 for (i = 0; i < rlcf->from->nelts; i++) { 203 == NGX_OK)
214 204 {
215 ngx_log_debug3(NGX_LOG_DEBUG_HTTP, c->log, 0, 205 return ngx_http_realip_set_addr(r, &addr);
216 "realip: %08XD %08XD %08XD", 206 }
217 sin->sin_addr.s_addr, from[i].mask, from[i].addr);
218
219 if ((sin->sin_addr.s_addr & from[i].mask) == from[i].addr) {
220 return ngx_http_realip_set_addr(r, ip, len);
221 }
222 }
223 }
224
225 #if (NGX_HAVE_UNIX_DOMAIN)
226
227 if (c->sockaddr->sa_family == AF_UNIX && rlcf->unixsock) {
228 return ngx_http_realip_set_addr(r, ip, len);
229 }
230
231 #endif
232 207
233 return NGX_DECLINED; 208 return NGX_DECLINED;
234 } 209 }
235 210
236 211
237 static ngx_int_t 212 static ngx_int_t
238 ngx_http_realip_set_addr(ngx_http_request_t *r, u_char *ip, size_t len) 213 ngx_http_realip_set_addr(ngx_http_request_t *r, ngx_addr_t *addr)
239 { 214 {
215 size_t len;
240 u_char *p; 216 u_char *p;
241 ngx_int_t rc; 217 u_char text[NGX_SOCKADDR_STRLEN];
242 ngx_addr_t addr;
243 ngx_connection_t *c; 218 ngx_connection_t *c;
244 ngx_pool_cleanup_t *cln; 219 ngx_pool_cleanup_t *cln;
245 ngx_http_realip_ctx_t *ctx; 220 ngx_http_realip_ctx_t *ctx;
246 221
247 cln = ngx_pool_cleanup_add(r->pool, sizeof(ngx_http_realip_ctx_t)); 222 cln = ngx_pool_cleanup_add(r->pool, sizeof(ngx_http_realip_ctx_t));
252 ctx = cln->data; 227 ctx = cln->data;
253 ngx_http_set_ctx(r, ctx, ngx_http_realip_module); 228 ngx_http_set_ctx(r, ctx, ngx_http_realip_module);
254 229
255 c = r->connection; 230 c = r->connection;
256 231
257 rc = ngx_parse_addr(c->pool, &addr, ip, len); 232 len = ngx_sock_ntop(addr->sockaddr, text, NGX_SOCKADDR_STRLEN, 0);
258 233 if (len == 0) {
259 switch (rc) {
260 case NGX_DECLINED:
261 return NGX_DECLINED;
262 case NGX_ERROR:
263 return NGX_HTTP_INTERNAL_SERVER_ERROR; 234 return NGX_HTTP_INTERNAL_SERVER_ERROR;
264 default: /* NGX_OK */
265 break;
266 } 235 }
267 236
268 p = ngx_pnalloc(c->pool, len); 237 p = ngx_pnalloc(c->pool, len);
269 if (p == NULL) { 238 if (p == NULL) {
270 return NGX_HTTP_INTERNAL_SERVER_ERROR; 239 return NGX_HTTP_INTERNAL_SERVER_ERROR;
271 } 240 }
272 241
273 ngx_memcpy(p, ip, len); 242 ngx_memcpy(p, text, len);
274 243
275 cln->handler = ngx_http_realip_cleanup; 244 cln->handler = ngx_http_realip_cleanup;
276 245
277 ctx->connection = c; 246 ctx->connection = c;
278 ctx->sockaddr = c->sockaddr; 247 ctx->sockaddr = c->sockaddr;
279 ctx->socklen = c->socklen; 248 ctx->socklen = c->socklen;
280 ctx->addr_text = c->addr_text; 249 ctx->addr_text = c->addr_text;
281 250
282 c->sockaddr = addr.sockaddr; 251 c->sockaddr = addr->sockaddr;
283 c->socklen = addr.socklen; 252 c->socklen = addr->socklen;
284 c->addr_text.len = len; 253 c->addr_text.len = len;
285 c->addr_text.data = p; 254 c->addr_text.data = p;
286 255
287 return NGX_DECLINED; 256 return NGX_DECLINED;
288 } 257 }
308 { 277 {
309 ngx_http_realip_loc_conf_t *rlcf = conf; 278 ngx_http_realip_loc_conf_t *rlcf = conf;
310 279
311 ngx_int_t rc; 280 ngx_int_t rc;
312 ngx_str_t *value; 281 ngx_str_t *value;
313 ngx_cidr_t cidr; 282 ngx_cidr_t *cidr;
314 ngx_in_cidr_t *from;
315 283
316 value = cf->args->elts; 284 value = cf->args->elts;
317
318 #if (NGX_HAVE_UNIX_DOMAIN)
319
320 if (ngx_strcmp(value[1].data, "unix:") == 0) {
321 rlcf->unixsock = 1;
322 return NGX_CONF_OK;
323 }
324
325 #endif
326 285
327 if (rlcf->from == NULL) { 286 if (rlcf->from == NULL) {
328 rlcf->from = ngx_array_create(cf->pool, 2, 287 rlcf->from = ngx_array_create(cf->pool, 2,
329 sizeof(ngx_in_cidr_t)); 288 sizeof(ngx_cidr_t));
330 if (rlcf->from == NULL) { 289 if (rlcf->from == NULL) {
331 return NGX_CONF_ERROR; 290 return NGX_CONF_ERROR;
332 } 291 }
333 } 292 }
334 293
335 from = ngx_array_push(rlcf->from); 294 cidr = ngx_array_push(rlcf->from);
336 if (from == NULL) { 295 if (cidr == NULL) {
337 return NGX_CONF_ERROR; 296 return NGX_CONF_ERROR;
338 } 297 }
339 298
340 rc = ngx_ptocidr(&value[1], &cidr); 299 #if (NGX_HAVE_UNIX_DOMAIN)
300
301 if (ngx_strcmp(value[1].data, "unix:") == 0) {
302 cidr->family = AF_UNIX;
303 return NGX_CONF_OK;
304 }
305
306 #endif
307
308 rc = ngx_ptocidr(&value[1], cidr);
341 309
342 if (rc == NGX_ERROR) { 310 if (rc == NGX_ERROR) {
343 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, "invalid parameter \"%V\"", 311 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, "invalid parameter \"%V\"",
344 &value[1]); 312 &value[1]);
345 return NGX_CONF_ERROR; 313 return NGX_CONF_ERROR;
346 } 314 }
347 315
348 if (cidr.family != AF_INET) {
349 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
350 "\"set_real_ip_from\" supports IPv4 only");
351 return NGX_CONF_ERROR;
352 }
353
354 if (rc == NGX_DONE) { 316 if (rc == NGX_DONE) {
355 ngx_conf_log_error(NGX_LOG_WARN, cf, 0, 317 ngx_conf_log_error(NGX_LOG_WARN, cf, 0,
356 "low address bits of %V are meaningless", &value[1]); 318 "low address bits of %V are meaningless", &value[1]);
357 } 319 }
358
359 from->mask = cidr.u.in.mask;
360 from->addr = cidr.u.in.addr;
361 320
362 return NGX_CONF_OK; 321 return NGX_CONF_OK;
363 } 322 }
364 323
365 324
407 * conf->hash = 0; 366 * conf->hash = 0;
408 * conf->header = { 0, NULL }; 367 * conf->header = { 0, NULL };
409 */ 368 */
410 369
411 conf->type = NGX_CONF_UNSET_UINT; 370 conf->type = NGX_CONF_UNSET_UINT;
412 #if (NGX_HAVE_UNIX_DOMAIN) 371 conf->recursive = NGX_CONF_UNSET;
413 conf->unixsock = 2;
414 #endif
415 372
416 return conf; 373 return conf;
417 } 374 }
418 375
419 376
425 382
426 if (conf->from == NULL) { 383 if (conf->from == NULL) {
427 conf->from = prev->from; 384 conf->from = prev->from;
428 } 385 }
429 386
430 #if (NGX_HAVE_UNIX_DOMAIN)
431 if (conf->unixsock == 2) {
432 conf->unixsock = (prev->unixsock == 2) ? 0 : prev->unixsock;
433 }
434 #endif
435
436 ngx_conf_merge_uint_value(conf->type, prev->type, NGX_HTTP_REALIP_XREALIP); 387 ngx_conf_merge_uint_value(conf->type, prev->type, NGX_HTTP_REALIP_XREALIP);
388 ngx_conf_merge_value(conf->recursive, prev->recursive, 0);
437 389
438 if (conf->header.len == 0) { 390 if (conf->header.len == 0) {
439 conf->hash = prev->hash; 391 conf->hash = prev->hash;
440 conf->header = prev->header; 392 conf->header = prev->header;
441 } 393 }