Mercurial > hg > nginx
annotate src/http/modules/ngx_http_referer_module.c @ 5321:9806f7932474
Referer module: fixed regex matching against HTTPS referers.
When matching a compiled regex against value in the "Referer" header field,
the length was calculated incorrectly for strings that start from "https://".
This might cause matching to fail for regexes with end-of-line anchors.
Patch by Liangbin Li.
| author | Sergey Kandaurov <pluknet@nginx.com> |
|---|---|
| date | Tue, 13 Aug 2013 17:47:04 +0400 |
| parents | 8f74cf107137 |
| children | 9b8a634e348a |
| rev | line source |
|---|---|
| 577 | 1 |
| 2 /* | |
| 3 * Copyright (C) Igor Sysoev | |
| 4412 | 4 * Copyright (C) Nginx, Inc. |
| 577 | 5 */ |
| 6 | |
| 7 | |
| 8 #include <ngx_config.h> | |
| 9 #include <ngx_core.h> | |
| 10 #include <ngx_http.h> | |
| 11 | |
| 12 | |
| 595 | 13 #define NGX_HTTP_REFERER_NO_URI_PART ((void *) 4) |
| 14 | |
| 1785 | 15 #if !(NGX_PCRE) |
| 1388 | 16 |
| 17 #define ngx_regex_t void | |
| 18 | |
| 19 #endif | |
| 20 | |
| 21 | |
| 577 | 22 typedef struct { |
|
1253
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
23 ngx_hash_combined_t hash; |
| 577 | 24 |
| 1388 | 25 #if (NGX_PCRE) |
| 26 ngx_array_t *regex; | |
| 27 #endif | |
| 28 | |
| 593 | 29 ngx_flag_t no_referer; |
| 30 ngx_flag_t blocked_referer; | |
| 577 | 31 |
| 593 | 32 ngx_hash_keys_arrays_t *keys; |
|
3939
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
33 |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
34 ngx_uint_t referer_hash_max_size; |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
35 ngx_uint_t referer_hash_bucket_size; |
| 577 | 36 } ngx_http_referer_conf_t; |
| 37 | |
| 38 | |
| 39 static void * ngx_http_referer_create_conf(ngx_conf_t *cf); | |
| 40 static char * ngx_http_referer_merge_conf(ngx_conf_t *cf, void *parent, | |
| 41 void *child); | |
| 42 static char *ngx_http_valid_referers(ngx_conf_t *cf, ngx_command_t *cmd, | |
| 43 void *conf); | |
| 593 | 44 static char *ngx_http_add_referer(ngx_conf_t *cf, ngx_hash_keys_arrays_t *keys, |
| 595 | 45 ngx_str_t *value, ngx_str_t *uri); |
| 1388 | 46 static char *ngx_http_add_regex_referer(ngx_conf_t *cf, |
| 47 ngx_http_referer_conf_t *rlcf, ngx_str_t *name, ngx_regex_t *regex); | |
| 593 | 48 static int ngx_libc_cdecl ngx_http_cmp_referer_wildcards(const void *one, |
| 49 const void *two); | |
| 577 | 50 |
| 51 | |
| 52 static ngx_command_t ngx_http_referer_commands[] = { | |
| 53 | |
| 54 { ngx_string("valid_referers"), | |
| 55 NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_1MORE, | |
| 56 ngx_http_valid_referers, | |
| 57 NGX_HTTP_LOC_CONF_OFFSET, | |
| 58 0, | |
| 59 NULL }, | |
| 60 | |
|
3939
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
61 { ngx_string("referer_hash_max_size"), |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
62 NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1, |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
63 ngx_conf_set_num_slot, |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
64 NGX_HTTP_LOC_CONF_OFFSET, |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
65 offsetof(ngx_http_referer_conf_t, referer_hash_max_size), |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
66 NULL }, |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
67 |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
68 { ngx_string("referer_hash_bucket_size"), |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
69 NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1, |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
70 ngx_conf_set_num_slot, |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
71 NGX_HTTP_LOC_CONF_OFFSET, |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
72 offsetof(ngx_http_referer_conf_t, referer_hash_bucket_size), |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
73 NULL }, |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
74 |
| 577 | 75 ngx_null_command |
| 76 }; | |
| 77 | |
| 78 | |
| 79 static ngx_http_module_t ngx_http_referer_module_ctx = { | |
| 80 NULL, /* preconfiguration */ | |
| 81 NULL, /* postconfiguration */ | |
| 82 | |
| 83 NULL, /* create main configuration */ | |
| 84 NULL, /* init main configuration */ | |
| 85 | |
| 86 NULL, /* create server configuration */ | |
| 87 NULL, /* merge server configuration */ | |
| 88 | |
| 89 ngx_http_referer_create_conf, /* create location configuration */ | |
| 90 ngx_http_referer_merge_conf /* merge location configuration */ | |
| 91 }; | |
| 92 | |
| 93 | |
| 94 ngx_module_t ngx_http_referer_module = { | |
| 95 NGX_MODULE_V1, | |
| 96 &ngx_http_referer_module_ctx, /* module context */ | |
| 97 ngx_http_referer_commands, /* module directives */ | |
| 98 NGX_HTTP_MODULE, /* module type */ | |
| 99 NULL, /* init master */ | |
| 100 NULL, /* init module */ | |
| 101 NULL, /* init process */ | |
| 102 NULL, /* init thread */ | |
| 103 NULL, /* exit thread */ | |
| 104 NULL, /* exit process */ | |
| 105 NULL, /* exit master */ | |
| 106 NGX_MODULE_V1_PADDING | |
| 107 }; | |
| 108 | |
| 109 | |
| 110 static ngx_int_t | |
| 111 ngx_http_referer_variable(ngx_http_request_t *r, ngx_http_variable_value_t *v, | |
| 112 uintptr_t data) | |
| 113 { | |
| 1388 | 114 u_char *p, *ref, *last; |
| 115 size_t len; | |
| 116 ngx_str_t *uri; | |
| 117 ngx_uint_t i, key; | |
| 118 ngx_http_referer_conf_t *rlcf; | |
| 119 u_char buf[256]; | |
| 577 | 120 |
| 593 | 121 rlcf = ngx_http_get_module_loc_conf(r, ngx_http_referer_module); |
| 577 | 122 |
|
1253
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
123 if (rlcf->hash.hash.buckets == NULL |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
124 && rlcf->hash.wc_head == NULL |
| 1388 | 125 && rlcf->hash.wc_tail == NULL |
| 126 #if (NGX_PCRE) | |
| 127 && rlcf->regex == NULL | |
| 128 #endif | |
| 129 ) | |
|
1253
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
130 { |
| 595 | 131 goto valid; |
| 577 | 132 } |
| 133 | |
| 134 if (r->headers_in.referer == NULL) { | |
| 593 | 135 if (rlcf->no_referer) { |
| 595 | 136 goto valid; |
| 137 } | |
| 577 | 138 |
| 595 | 139 goto invalid; |
| 577 | 140 } |
| 141 | |
| 142 len = r->headers_in.referer->value.len; | |
| 143 ref = r->headers_in.referer->value.data; | |
| 144 | |
| 3459 | 145 if (len >= sizeof("http://i.ru") - 1) { |
| 146 last = ref + len; | |
| 147 | |
| 148 if (ngx_strncasecmp(ref, (u_char *) "http://", 7) == 0) { | |
| 149 ref += 7; | |
|
5321
9806f7932474
Referer module: fixed regex matching against HTTPS referers.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5221
diff
changeset
|
150 len -= 7; |
| 3459 | 151 goto valid_scheme; |
| 152 | |
| 153 } else if (ngx_strncasecmp(ref, (u_char *) "https://", 8) == 0) { | |
| 154 ref += 8; | |
|
5321
9806f7932474
Referer module: fixed regex matching against HTTPS referers.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5221
diff
changeset
|
155 len -= 8; |
| 3459 | 156 goto valid_scheme; |
| 595 | 157 } |
| 577 | 158 } |
| 159 | |
| 3459 | 160 if (rlcf->blocked_referer) { |
| 161 goto valid; | |
| 162 } | |
| 163 | |
| 164 goto invalid; | |
| 165 | |
| 166 valid_scheme: | |
| 167 | |
| 595 | 168 i = 0; |
| 169 key = 0; | |
| 577 | 170 |
| 595 | 171 for (p = ref; p < last; p++) { |
| 593 | 172 if (*p == '/' || *p == ':') { |
| 173 break; | |
| 577 | 174 } |
| 595 | 175 |
| 176 buf[i] = ngx_tolower(*p); | |
| 177 key = ngx_hash(key, buf[i++]); | |
| 178 | |
| 179 if (i == 256) { | |
| 180 goto invalid; | |
| 181 } | |
| 593 | 182 } |
| 577 | 183 |
| 1388 | 184 uri = ngx_hash_find_combined(&rlcf->hash, key, buf, p - ref); |
| 577 | 185 |
|
1253
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
186 if (uri) { |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
187 goto uri; |
| 577 | 188 } |
| 189 | |
| 1388 | 190 #if (NGX_PCRE) |
| 191 | |
| 192 if (rlcf->regex) { | |
| 1785 | 193 ngx_int_t rc; |
| 194 ngx_str_t referer; | |
| 1388 | 195 |
|
5321
9806f7932474
Referer module: fixed regex matching against HTTPS referers.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5221
diff
changeset
|
196 referer.len = len; |
| 1388 | 197 referer.data = ref; |
| 198 | |
| 1785 | 199 rc = ngx_regex_exec_array(rlcf->regex, &referer, r->connection->log); |
| 1388 | 200 |
| 1785 | 201 if (rc == NGX_OK) { |
| 1388 | 202 goto valid; |
| 203 } | |
| 1785 | 204 |
| 205 if (rc == NGX_ERROR) { | |
| 206 return rc; | |
| 207 } | |
| 208 | |
| 209 /* NGX_DECLINED */ | |
| 1388 | 210 } |
| 211 | |
| 212 #endif | |
| 213 | |
| 595 | 214 invalid: |
| 215 | |
| 577 | 216 *v = ngx_http_variable_true_value; |
| 217 | |
| 218 return NGX_OK; | |
| 595 | 219 |
| 220 uri: | |
| 221 | |
| 222 for ( /* void */ ; p < last; p++) { | |
| 223 if (*p == '/') { | |
| 224 break; | |
| 225 } | |
| 226 } | |
| 227 | |
| 228 len = last - p; | |
| 229 | |
| 230 if (uri == NGX_HTTP_REFERER_NO_URI_PART) { | |
| 231 goto valid; | |
| 232 } | |
| 233 | |
| 234 if (len < uri->len || ngx_strncmp(uri->data, p, uri->len) != 0) { | |
| 235 goto invalid; | |
| 236 } | |
| 237 | |
| 238 valid: | |
| 239 | |
| 240 *v = ngx_http_variable_null_value; | |
| 241 | |
| 242 return NGX_OK; | |
| 577 | 243 } |
| 244 | |
| 245 | |
| 246 static void * | |
| 247 ngx_http_referer_create_conf(ngx_conf_t *cf) | |
| 248 { | |
| 249 ngx_http_referer_conf_t *conf; | |
| 250 | |
| 593 | 251 conf = ngx_pcalloc(cf->pool, sizeof(ngx_http_referer_conf_t)); |
| 577 | 252 if (conf == NULL) { |
|
2912
c7d57b539248
return NULL instead of NGX_CONF_ERROR on a create conf failure
Igor Sysoev <igor@sysoev.ru>
parents:
1800
diff
changeset
|
253 return NULL; |
| 577 | 254 } |
| 255 | |
|
1782
db07cb9d1cbc
regex valid_referers were not inherited
Igor Sysoev <igor@sysoev.ru>
parents:
1704
diff
changeset
|
256 #if (NGX_PCRE) |
|
db07cb9d1cbc
regex valid_referers were not inherited
Igor Sysoev <igor@sysoev.ru>
parents:
1704
diff
changeset
|
257 conf->regex = NGX_CONF_UNSET_PTR; |
|
db07cb9d1cbc
regex valid_referers were not inherited
Igor Sysoev <igor@sysoev.ru>
parents:
1704
diff
changeset
|
258 #endif |
|
db07cb9d1cbc
regex valid_referers were not inherited
Igor Sysoev <igor@sysoev.ru>
parents:
1704
diff
changeset
|
259 |
| 577 | 260 conf->no_referer = NGX_CONF_UNSET; |
| 261 conf->blocked_referer = NGX_CONF_UNSET; | |
|
3939
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
262 conf->referer_hash_max_size = NGX_CONF_UNSET_UINT; |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
263 conf->referer_hash_bucket_size = NGX_CONF_UNSET_UINT; |
| 577 | 264 |
| 265 return conf; | |
| 266 } | |
| 267 | |
| 268 | |
| 269 static char * | |
| 270 ngx_http_referer_merge_conf(ngx_conf_t *cf, void *parent, void *child) | |
| 271 { | |
| 272 ngx_http_referer_conf_t *prev = parent; | |
| 273 ngx_http_referer_conf_t *conf = child; | |
| 274 | |
| 593 | 275 ngx_hash_init_t hash; |
| 276 | |
| 277 if (conf->keys == NULL) { | |
| 278 conf->hash = prev->hash; | |
| 279 | |
| 1800 | 280 #if (NGX_PCRE) |
|
1782
db07cb9d1cbc
regex valid_referers were not inherited
Igor Sysoev <igor@sysoev.ru>
parents:
1704
diff
changeset
|
281 ngx_conf_merge_ptr_value(conf->regex, prev->regex, NULL); |
| 1800 | 282 #endif |
| 577 | 283 ngx_conf_merge_value(conf->no_referer, prev->no_referer, 0); |
| 284 ngx_conf_merge_value(conf->blocked_referer, prev->blocked_referer, 0); | |
|
3939
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
285 ngx_conf_merge_uint_value(conf->referer_hash_max_size, |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
286 prev->referer_hash_max_size, 2048); |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
287 ngx_conf_merge_uint_value(conf->referer_hash_bucket_size, |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
288 prev->referer_hash_bucket_size, 64); |
| 593 | 289 |
| 290 return NGX_CONF_OK; | |
| 291 } | |
| 292 | |
| 603 | 293 if ((conf->no_referer == 1 || conf->blocked_referer == 1) |
|
1253
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
294 && conf->keys->keys.nelts == 0 |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
295 && conf->keys->dns_wc_head.nelts == 0 |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
296 && conf->keys->dns_wc_tail.nelts == 0) |
| 603 | 297 { |
| 298 ngx_log_error(NGX_LOG_EMERG, cf->log, 0, | |
| 299 "the \"none\" or \"blocked\" referers are specified " | |
| 300 "in the \"valid_referers\" directive " | |
| 301 "without any valid referer"); | |
| 302 return NGX_CONF_ERROR; | |
| 303 } | |
| 304 | |
|
3939
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
305 ngx_conf_merge_uint_value(conf->referer_hash_max_size, |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
306 prev->referer_hash_max_size, 2048); |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
307 ngx_conf_merge_uint_value(conf->referer_hash_bucket_size, |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
308 prev->referer_hash_bucket_size, 64); |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
309 conf->referer_hash_bucket_size = ngx_align(conf->referer_hash_bucket_size, |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
310 ngx_cacheline_size); |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
311 |
| 593 | 312 hash.key = ngx_hash_key_lc; |
|
3939
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
313 hash.max_size = conf->referer_hash_max_size; |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
314 hash.bucket_size = conf->referer_hash_bucket_size; |
|
4008
debb2f235aa3
Fix names of the referer hash size directives introduced in r3940.
Igor Sysoev <igor@sysoev.ru>
parents:
3939
diff
changeset
|
315 hash.name = "referer_hash"; |
| 593 | 316 hash.pool = cf->pool; |
| 317 | |
| 318 if (conf->keys->keys.nelts) { | |
|
1253
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
319 hash.hash = &conf->hash.hash; |
| 593 | 320 hash.temp_pool = NULL; |
| 321 | |
| 322 if (ngx_hash_init(&hash, conf->keys->keys.elts, conf->keys->keys.nelts) | |
| 323 != NGX_OK) | |
| 324 { | |
| 325 return NGX_CONF_ERROR; | |
| 326 } | |
| 327 } | |
| 328 | |
|
1253
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
329 if (conf->keys->dns_wc_head.nelts) { |
| 593 | 330 |
|
1253
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
331 ngx_qsort(conf->keys->dns_wc_head.elts, |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
332 (size_t) conf->keys->dns_wc_head.nelts, |
| 593 | 333 sizeof(ngx_hash_key_t), |
| 334 ngx_http_cmp_referer_wildcards); | |
| 335 | |
| 336 hash.hash = NULL; | |
| 337 hash.temp_pool = cf->temp_pool; | |
| 338 | |
|
1253
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
339 if (ngx_hash_wildcard_init(&hash, conf->keys->dns_wc_head.elts, |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
340 conf->keys->dns_wc_head.nelts) |
| 593 | 341 != NGX_OK) |
| 342 { | |
| 343 return NGX_CONF_ERROR; | |
| 344 } | |
| 345 | |
|
1253
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
346 conf->hash.wc_head = (ngx_hash_wildcard_t *) hash.hash; |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
347 } |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
348 |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
349 if (conf->keys->dns_wc_tail.nelts) { |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
350 |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
351 ngx_qsort(conf->keys->dns_wc_tail.elts, |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
352 (size_t) conf->keys->dns_wc_tail.nelts, |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
353 sizeof(ngx_hash_key_t), |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
354 ngx_http_cmp_referer_wildcards); |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
355 |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
356 hash.hash = NULL; |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
357 hash.temp_pool = cf->temp_pool; |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
358 |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
359 if (ngx_hash_wildcard_init(&hash, conf->keys->dns_wc_tail.elts, |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
360 conf->keys->dns_wc_tail.nelts) |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
361 != NGX_OK) |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
362 { |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
363 return NGX_CONF_ERROR; |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
364 } |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
365 |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
366 conf->hash.wc_tail = (ngx_hash_wildcard_t *) hash.hash; |
| 577 | 367 } |
| 368 | |
| 1800 | 369 #if (NGX_PCRE) |
|
1782
db07cb9d1cbc
regex valid_referers were not inherited
Igor Sysoev <igor@sysoev.ru>
parents:
1704
diff
changeset
|
370 ngx_conf_merge_ptr_value(conf->regex, prev->regex, NULL); |
| 1800 | 371 #endif |
|
1782
db07cb9d1cbc
regex valid_referers were not inherited
Igor Sysoev <igor@sysoev.ru>
parents:
1704
diff
changeset
|
372 |
| 577 | 373 if (conf->no_referer == NGX_CONF_UNSET) { |
| 374 conf->no_referer = 0; | |
| 375 } | |
| 376 | |
| 377 if (conf->blocked_referer == NGX_CONF_UNSET) { | |
| 378 conf->blocked_referer = 0; | |
| 379 } | |
| 380 | |
| 611 | 381 conf->keys = NULL; |
| 382 | |
| 577 | 383 return NGX_CONF_OK; |
| 384 } | |
| 385 | |
| 386 | |
| 387 static char * | |
| 388 ngx_http_valid_referers(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) | |
| 389 { | |
| 593 | 390 ngx_http_referer_conf_t *rlcf = conf; |
| 577 | 391 |
| 593 | 392 u_char *p; |
| 595 | 393 ngx_str_t *value, uri, name; |
| 593 | 394 ngx_uint_t i, n; |
| 577 | 395 ngx_http_variable_t *var; |
| 396 ngx_http_server_name_t *sn; | |
| 397 ngx_http_core_srv_conf_t *cscf; | |
| 398 | |
|
3516
dd1570b6f237
ngx_str_set() and ngx_str_null()
Igor Sysoev <igor@sysoev.ru>
parents:
3459
diff
changeset
|
399 ngx_str_set(&name, "invalid_referer"); |
| 577 | 400 |
|
5221
8f74cf107137
Referer module: added $invalid_referer to variables hash.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
401 var = ngx_http_add_variable(cf, &name, NGX_HTTP_VAR_CHANGEABLE); |
| 577 | 402 if (var == NULL) { |
| 403 return NGX_CONF_ERROR; | |
| 404 } | |
| 405 | |
| 637 | 406 var->get_handler = ngx_http_referer_variable; |
| 577 | 407 |
| 593 | 408 if (rlcf->keys == NULL) { |
| 409 rlcf->keys = ngx_pcalloc(cf->temp_pool, sizeof(ngx_hash_keys_arrays_t)); | |
| 410 if (rlcf->keys == NULL) { | |
| 411 return NGX_CONF_ERROR; | |
| 412 } | |
| 577 | 413 |
| 593 | 414 rlcf->keys->pool = cf->pool; |
| 415 rlcf->keys->temp_pool = cf->pool; | |
| 416 | |
| 417 if (ngx_hash_keys_array_init(rlcf->keys, NGX_HASH_SMALL) != NGX_OK) { | |
| 577 | 418 return NGX_CONF_ERROR; |
| 419 } | |
| 420 } | |
| 421 | |
| 422 value = cf->args->elts; | |
| 423 | |
| 424 for (i = 1; i < cf->args->nelts; i++) { | |
| 425 if (value[i].len == 0) { | |
| 426 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, | |
| 427 "invalid referer \"%V\"", &value[i]); | |
| 428 return NGX_CONF_ERROR; | |
| 429 } | |
| 430 | |
| 431 if (ngx_strcmp(value[i].data, "none") == 0) { | |
| 593 | 432 rlcf->no_referer = 1; |
| 577 | 433 continue; |
| 434 } | |
| 435 | |
| 436 if (ngx_strcmp(value[i].data, "blocked") == 0) { | |
| 593 | 437 rlcf->blocked_referer = 1; |
| 577 | 438 continue; |
| 439 } | |
| 440 | |
|
3516
dd1570b6f237
ngx_str_set() and ngx_str_null()
Igor Sysoev <igor@sysoev.ru>
parents:
3459
diff
changeset
|
441 ngx_str_null(&uri); |
| 595 | 442 |
| 577 | 443 if (ngx_strcmp(value[i].data, "server_names") == 0) { |
| 593 | 444 |
| 445 cscf = ngx_http_conf_get_module_srv_conf(cf, ngx_http_core_module); | |
| 577 | 446 |
| 593 | 447 sn = cscf->server_names.elts; |
| 448 for (n = 0; n < cscf->server_names.nelts; n++) { | |
| 1388 | 449 |
| 450 #if (NGX_PCRE) | |
| 451 if (sn[n].regex) { | |
| 452 | |
| 453 if (ngx_http_add_regex_referer(cf, rlcf, &sn[n].name, | |
| 3325 | 454 sn[n].regex->regex) |
| 1388 | 455 != NGX_OK) |
| 456 { | |
| 457 return NGX_CONF_ERROR; | |
| 458 } | |
| 459 | |
| 460 continue; | |
| 461 } | |
| 462 #endif | |
| 463 | |
| 595 | 464 if (ngx_http_add_referer(cf, rlcf->keys, &sn[n].name, &uri) |
| 465 != NGX_OK) | |
| 466 { | |
| 593 | 467 return NGX_CONF_ERROR; |
| 468 } | |
| 469 } | |
| 577 | 470 |
| 471 continue; | |
| 472 } | |
| 473 | |
| 1388 | 474 if (value[i].data[0] == '~') { |
| 475 if (ngx_http_add_regex_referer(cf, rlcf, &value[i], NULL) != NGX_OK) | |
| 476 { | |
| 477 return NGX_CONF_ERROR; | |
| 478 } | |
| 479 | |
| 480 continue; | |
| 481 } | |
| 482 | |
| 1242 | 483 p = (u_char *) ngx_strchr(value[i].data, '/'); |
| 577 | 484 |
| 593 | 485 if (p) { |
| 595 | 486 uri.len = (value[i].data + value[i].len) - p; |
| 487 uri.data = p; | |
| 593 | 488 value[i].len = p - value[i].data; |
| 577 | 489 } |
| 490 | |
| 595 | 491 if (ngx_http_add_referer(cf, rlcf->keys, &value[i], &uri) != NGX_OK) { |
| 577 | 492 return NGX_CONF_ERROR; |
| 493 } | |
| 494 } | |
| 495 | |
| 496 return NGX_CONF_OK; | |
| 497 } | |
| 593 | 498 |
| 499 | |
| 500 static char * | |
| 501 ngx_http_add_referer(ngx_conf_t *cf, ngx_hash_keys_arrays_t *keys, | |
| 595 | 502 ngx_str_t *value, ngx_str_t *uri) |
| 593 | 503 { |
|
1253
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
504 ngx_int_t rc; |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
505 ngx_str_t *u; |
| 593 | 506 |
| 595 | 507 if (uri->len == 0) { |
| 508 u = NGX_HTTP_REFERER_NO_URI_PART; | |
| 509 | |
| 510 } else { | |
| 511 u = ngx_palloc(cf->pool, sizeof(ngx_str_t)); | |
| 512 if (u == NULL) { | |
| 513 return NGX_CONF_ERROR; | |
| 514 } | |
| 515 | |
| 516 *u = *uri; | |
| 517 } | |
| 518 | |
|
1253
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
519 rc = ngx_hash_add_key(keys, value, u, NGX_HASH_WILDCARD_KEY); |
| 593 | 520 |
| 521 if (rc == NGX_OK) { | |
| 522 return NGX_CONF_OK; | |
| 523 } | |
| 524 | |
|
1253
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
525 if (rc == NGX_DECLINED) { |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
526 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
527 "invalid hostname or wildcard \"%V\"", value); |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
528 } |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
529 |
| 593 | 530 if (rc == NGX_BUSY) { |
| 531 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, | |
| 532 "conflicting parameter \"%V\"", value); | |
| 533 } | |
| 534 | |
| 535 return NGX_CONF_ERROR; | |
| 536 } | |
| 537 | |
| 538 | |
| 1388 | 539 static char * |
| 540 ngx_http_add_regex_referer(ngx_conf_t *cf, ngx_http_referer_conf_t *rlcf, | |
| 541 ngx_str_t *name, ngx_regex_t *regex) | |
| 542 { | |
| 543 #if (NGX_PCRE) | |
| 3325 | 544 ngx_regex_elt_t *re; |
| 545 ngx_regex_compile_t rc; | |
| 546 u_char errstr[NGX_MAX_CONF_ERRSTR]; | |
| 1388 | 547 |
|
3122
3e994ac670dc
test space between "~" and regex in server_name and invalid_referers
Igor Sysoev <igor@sysoev.ru>
parents:
3116
diff
changeset
|
548 if (name->len == 1) { |
|
3e994ac670dc
test space between "~" and regex in server_name and invalid_referers
Igor Sysoev <igor@sysoev.ru>
parents:
3116
diff
changeset
|
549 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, "empty regex in \"%V\"", name); |
|
3e994ac670dc
test space between "~" and regex in server_name and invalid_referers
Igor Sysoev <igor@sysoev.ru>
parents:
3116
diff
changeset
|
550 return NGX_CONF_ERROR; |
|
3e994ac670dc
test space between "~" and regex in server_name and invalid_referers
Igor Sysoev <igor@sysoev.ru>
parents:
3116
diff
changeset
|
551 } |
|
3e994ac670dc
test space between "~" and regex in server_name and invalid_referers
Igor Sysoev <igor@sysoev.ru>
parents:
3116
diff
changeset
|
552 |
|
1782
db07cb9d1cbc
regex valid_referers were not inherited
Igor Sysoev <igor@sysoev.ru>
parents:
1704
diff
changeset
|
553 if (rlcf->regex == NGX_CONF_UNSET_PTR) { |
| 1785 | 554 rlcf->regex = ngx_array_create(cf->pool, 2, sizeof(ngx_regex_elt_t)); |
| 1388 | 555 if (rlcf->regex == NULL) { |
| 556 return NGX_CONF_ERROR; | |
| 557 } | |
| 558 } | |
| 559 | |
| 1785 | 560 re = ngx_array_push(rlcf->regex); |
| 561 if (re == NULL) { | |
| 1388 | 562 return NGX_CONF_ERROR; |
| 563 } | |
| 564 | |
| 565 if (regex) { | |
| 1785 | 566 re->regex = regex; |
| 567 re->name = name->data; | |
| 1388 | 568 |
| 569 return NGX_CONF_OK; | |
| 570 } | |
| 571 | |
| 572 name->len--; | |
| 573 name->data++; | |
| 574 | |
| 3325 | 575 ngx_memzero(&rc, sizeof(ngx_regex_compile_t)); |
| 1388 | 576 |
| 3325 | 577 rc.pattern = *name; |
| 578 rc.pool = cf->pool; | |
| 579 rc.options = NGX_REGEX_CASELESS; | |
| 580 rc.err.len = NGX_MAX_CONF_ERRSTR; | |
| 581 rc.err.data = errstr; | |
| 582 | |
| 583 if (ngx_regex_compile(&rc) != NGX_OK) { | |
| 584 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, "%V", &rc.err); | |
| 1388 | 585 return NGX_CONF_ERROR; |
| 586 } | |
| 587 | |
| 3325 | 588 re->regex = rc.regex; |
| 1785 | 589 re->name = name->data; |
| 1388 | 590 |
| 591 return NGX_CONF_OK; | |
| 592 | |
| 593 #else | |
| 594 | |
| 595 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, | |
| 596 "the using of the regex \"%V\" requires PCRE library", | |
| 597 name); | |
| 598 | |
| 599 return NGX_CONF_ERROR; | |
| 600 | |
| 601 #endif | |
| 602 } | |
| 603 | |
| 604 | |
| 593 | 605 static int ngx_libc_cdecl |
| 606 ngx_http_cmp_referer_wildcards(const void *one, const void *two) | |
| 607 { | |
| 608 ngx_hash_key_t *first, *second; | |
| 609 | |
| 610 first = (ngx_hash_key_t *) one; | |
| 611 second = (ngx_hash_key_t *) two; | |
| 612 | |
|
3116
98e288c6dac3
If .domain.com, .sub.domain.com, and .domain-some.com were defined,
Igor Sysoev <igor@sysoev.ru>
parents:
2912
diff
changeset
|
613 return ngx_dns_strcmp(first->key.data, second->key.data); |
| 593 | 614 } |