Mercurial > hg > nginx
annotate src/http/modules/ngx_http_realip_module.c @ 5356:acd51b0f6fd4
Disable symlinks: use O_PATH to open path components.
It was introduced in Linux 2.6.39, glibc 2.14 and allows to obtain
file descriptors without actually opening files. Thus made it possible
to traverse path with openat() syscalls without the need to have read
permissions for path components. It is effectively emulates O_SEARCH
which is missing on Linux.
O_PATH is used in combination with O_RDONLY. The last one is ignored
if O_PATH is used, but it allows nginx to not fail when it was built on
modern system (i.e. glibc 2.14+) and run with a kernel older than 2.6.39.
Then O_PATH is unknown to the kernel and ignored, while O_RDONLY is used.
Sadly, fstat() is not working with O_PATH descriptors till Linux 3.6.
As a workaround we fallback to fstatat() with the AT_EMPTY_PATH flag
that was introduced at the same time as O_PATH.
| author | Valentin Bartenev <vbart@nginx.com> |
|---|---|
| date | Mon, 02 Sep 2013 08:07:59 +0400 |
| parents | 05ba5bce31e0 |
| children | 3a72b1805c52 |
| rev | line source |
|---|---|
| 573 | 1 |
| 2 /* | |
| 3 * Copyright (C) Igor Sysoev | |
| 4412 | 4 * Copyright (C) Nginx, Inc. |
| 573 | 5 */ |
| 6 | |
| 7 | |
| 8 #include <ngx_config.h> | |
| 9 #include <ngx_core.h> | |
| 10 #include <ngx_http.h> | |
| 11 | |
| 12 | |
|
2257
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
13 #define NGX_HTTP_REALIP_XREALIP 0 |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
14 #define NGX_HTTP_REALIP_XFWD 1 |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
15 #define NGX_HTTP_REALIP_HEADER 2 |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
16 |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
17 |
| 573 | 18 typedef struct { |
|
4624
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
19 ngx_array_t *from; /* array of ngx_cidr_t */ |
|
2257
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
20 ngx_uint_t type; |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
21 ngx_uint_t hash; |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
22 ngx_str_t header; |
|
4624
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
23 ngx_flag_t recursive; |
| 573 | 24 } ngx_http_realip_loc_conf_t; |
| 25 | |
| 26 | |
|
2176
29d26406e1bd
restore connection address on request closure,
Igor Sysoev <igor@sysoev.ru>
parents:
2049
diff
changeset
|
27 typedef struct { |
| 3274 | 28 ngx_connection_t *connection; |
| 29 struct sockaddr *sockaddr; | |
| 30 socklen_t socklen; | |
| 31 ngx_str_t addr_text; | |
|
2176
29d26406e1bd
restore connection address on request closure,
Igor Sysoev <igor@sysoev.ru>
parents:
2049
diff
changeset
|
32 } ngx_http_realip_ctx_t; |
|
29d26406e1bd
restore connection address on request closure,
Igor Sysoev <igor@sysoev.ru>
parents:
2049
diff
changeset
|
33 |
|
29d26406e1bd
restore connection address on request closure,
Igor Sysoev <igor@sysoev.ru>
parents:
2049
diff
changeset
|
34 |
| 573 | 35 static ngx_int_t ngx_http_realip_handler(ngx_http_request_t *r); |
|
4624
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
36 static ngx_int_t ngx_http_realip_set_addr(ngx_http_request_t *r, |
|
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
37 ngx_addr_t *addr); |
|
2176
29d26406e1bd
restore connection address on request closure,
Igor Sysoev <igor@sysoev.ru>
parents:
2049
diff
changeset
|
38 static void ngx_http_realip_cleanup(void *data); |
| 573 | 39 static char *ngx_http_realip_from(ngx_conf_t *cf, ngx_command_t *cmd, |
| 40 void *conf); | |
|
2257
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
41 static char *ngx_http_realip(ngx_conf_t *cf, ngx_command_t *cmd, void *conf); |
| 573 | 42 static void *ngx_http_realip_create_loc_conf(ngx_conf_t *cf); |
| 43 static char *ngx_http_realip_merge_loc_conf(ngx_conf_t *cf, | |
| 44 void *parent, void *child); | |
| 681 | 45 static ngx_int_t ngx_http_realip_init(ngx_conf_t *cf); |
| 573 | 46 |
| 47 | |
| 48 static ngx_command_t ngx_http_realip_commands[] = { | |
| 49 | |
| 50 { ngx_string("set_real_ip_from"), | |
| 51 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1, | |
| 52 ngx_http_realip_from, | |
| 53 NGX_HTTP_LOC_CONF_OFFSET, | |
| 54 0, | |
| 55 NULL }, | |
| 56 | |
| 57 { ngx_string("real_ip_header"), | |
| 58 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1, | |
|
2257
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
59 ngx_http_realip, |
| 573 | 60 NGX_HTTP_LOC_CONF_OFFSET, |
|
2257
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
61 0, |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
62 NULL }, |
| 573 | 63 |
|
4624
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
64 { ngx_string("real_ip_recursive"), |
|
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
65 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_FLAG, |
|
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
66 ngx_conf_set_flag_slot, |
|
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
67 NGX_HTTP_LOC_CONF_OFFSET, |
|
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
68 offsetof(ngx_http_realip_loc_conf_t, recursive), |
|
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
69 NULL }, |
|
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
70 |
| 573 | 71 ngx_null_command |
| 72 }; | |
| 73 | |
| 74 | |
| 75 | |
| 667 | 76 static ngx_http_module_t ngx_http_realip_module_ctx = { |
| 573 | 77 NULL, /* preconfiguration */ |
| 681 | 78 ngx_http_realip_init, /* postconfiguration */ |
| 573 | 79 |
| 80 NULL, /* create main configuration */ | |
| 81 NULL, /* init main configuration */ | |
| 82 | |
| 83 NULL, /* create server configuration */ | |
| 84 NULL, /* merge server configuration */ | |
| 85 | |
| 86 ngx_http_realip_create_loc_conf, /* create location configuration */ | |
| 87 ngx_http_realip_merge_loc_conf /* merge location configuration */ | |
| 88 }; | |
| 89 | |
| 90 | |
| 91 ngx_module_t ngx_http_realip_module = { | |
| 92 NGX_MODULE_V1, | |
| 93 &ngx_http_realip_module_ctx, /* module context */ | |
| 94 ngx_http_realip_commands, /* module directives */ | |
| 95 NGX_HTTP_MODULE, /* module type */ | |
| 96 NULL, /* init master */ | |
| 681 | 97 NULL, /* init module */ |
| 573 | 98 NULL, /* init process */ |
| 99 NULL, /* init thread */ | |
| 100 NULL, /* exit thread */ | |
| 101 NULL, /* exit process */ | |
| 102 NULL, /* exit master */ | |
| 103 NGX_MODULE_V1_PADDING | |
| 104 }; | |
| 105 | |
| 106 | |
| 107 static ngx_int_t | |
| 108 ngx_http_realip_handler(ngx_http_request_t *r) | |
| 109 { | |
|
5084
f7fe817c92a2
Correctly handle multiple X-Forwarded-For headers (ticket #106).
Ruslan Ermilov <ru@nginx.com>
parents:
4624
diff
changeset
|
110 u_char *p; |
| 573 | 111 size_t len; |
|
5084
f7fe817c92a2
Correctly handle multiple X-Forwarded-For headers (ticket #106).
Ruslan Ermilov <ru@nginx.com>
parents:
4624
diff
changeset
|
112 ngx_str_t *value; |
|
2257
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
113 ngx_uint_t i, hash; |
|
4624
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
114 ngx_addr_t addr; |
|
5084
f7fe817c92a2
Correctly handle multiple X-Forwarded-For headers (ticket #106).
Ruslan Ermilov <ru@nginx.com>
parents:
4624
diff
changeset
|
115 ngx_array_t *xfwd; |
|
2257
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
116 ngx_list_part_t *part; |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
117 ngx_table_elt_t *header; |
|
2176
29d26406e1bd
restore connection address on request closure,
Igor Sysoev <igor@sysoev.ru>
parents:
2049
diff
changeset
|
118 ngx_connection_t *c; |
|
29d26406e1bd
restore connection address on request closure,
Igor Sysoev <igor@sysoev.ru>
parents:
2049
diff
changeset
|
119 ngx_http_realip_ctx_t *ctx; |
| 573 | 120 ngx_http_realip_loc_conf_t *rlcf; |
| 121 | |
|
2176
29d26406e1bd
restore connection address on request closure,
Igor Sysoev <igor@sysoev.ru>
parents:
2049
diff
changeset
|
122 ctx = ngx_http_get_module_ctx(r, ngx_http_realip_module); |
|
29d26406e1bd
restore connection address on request closure,
Igor Sysoev <igor@sysoev.ru>
parents:
2049
diff
changeset
|
123 |
|
29d26406e1bd
restore connection address on request closure,
Igor Sysoev <igor@sysoev.ru>
parents:
2049
diff
changeset
|
124 if (ctx) { |
|
986
68c85f283043
ngx_http_realip_module must return NGX_DECLINED
Igor Sysoev <igor@sysoev.ru>
parents:
681
diff
changeset
|
125 return NGX_DECLINED; |
| 573 | 126 } |
| 127 | |
| 128 rlcf = ngx_http_get_module_loc_conf(r, ngx_http_realip_module); | |
| 129 | |
|
4624
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
130 if (rlcf->from == NULL) { |
|
986
68c85f283043
ngx_http_realip_module must return NGX_DECLINED
Igor Sysoev <igor@sysoev.ru>
parents:
681
diff
changeset
|
131 return NGX_DECLINED; |
| 573 | 132 } |
| 133 | |
|
2257
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
134 switch (rlcf->type) { |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
135 |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
136 case NGX_HTTP_REALIP_XREALIP: |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
137 |
| 573 | 138 if (r->headers_in.x_real_ip == NULL) { |
|
986
68c85f283043
ngx_http_realip_module must return NGX_DECLINED
Igor Sysoev <igor@sysoev.ru>
parents:
681
diff
changeset
|
139 return NGX_DECLINED; |
| 573 | 140 } |
| 141 | |
|
5084
f7fe817c92a2
Correctly handle multiple X-Forwarded-For headers (ticket #106).
Ruslan Ermilov <ru@nginx.com>
parents:
4624
diff
changeset
|
142 value = &r->headers_in.x_real_ip->value; |
|
f7fe817c92a2
Correctly handle multiple X-Forwarded-For headers (ticket #106).
Ruslan Ermilov <ru@nginx.com>
parents:
4624
diff
changeset
|
143 xfwd = NULL; |
| 573 | 144 |
|
2257
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
145 break; |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
146 |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
147 case NGX_HTTP_REALIP_XFWD: |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
148 |
|
5084
f7fe817c92a2
Correctly handle multiple X-Forwarded-For headers (ticket #106).
Ruslan Ermilov <ru@nginx.com>
parents:
4624
diff
changeset
|
149 xfwd = &r->headers_in.x_forwarded_for; |
|
f7fe817c92a2
Correctly handle multiple X-Forwarded-For headers (ticket #106).
Ruslan Ermilov <ru@nginx.com>
parents:
4624
diff
changeset
|
150 |
|
f7fe817c92a2
Correctly handle multiple X-Forwarded-For headers (ticket #106).
Ruslan Ermilov <ru@nginx.com>
parents:
4624
diff
changeset
|
151 if (xfwd->elts == NULL) { |
|
986
68c85f283043
ngx_http_realip_module must return NGX_DECLINED
Igor Sysoev <igor@sysoev.ru>
parents:
681
diff
changeset
|
152 return NGX_DECLINED; |
| 573 | 153 } |
| 154 | |
|
5084
f7fe817c92a2
Correctly handle multiple X-Forwarded-For headers (ticket #106).
Ruslan Ermilov <ru@nginx.com>
parents:
4624
diff
changeset
|
155 value = NULL; |
| 573 | 156 |
|
2257
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
157 break; |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
158 |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
159 default: /* NGX_HTTP_REALIP_HEADER */ |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
160 |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
161 part = &r->headers_in.headers.part; |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
162 header = part->elts; |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
163 |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
164 hash = rlcf->hash; |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
165 len = rlcf->header.len; |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
166 p = rlcf->header.data; |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
167 |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
168 for (i = 0; /* void */ ; i++) { |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
169 |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
170 if (i >= part->nelts) { |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
171 if (part->next == NULL) { |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
172 break; |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
173 } |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
174 |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
175 part = part->next; |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
176 header = part->elts; |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
177 i = 0; |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
178 } |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
179 |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
180 if (hash == header[i].hash |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
181 && len == header[i].key.len |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
182 && ngx_strncmp(p, header[i].lowcase_key, len) == 0) |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
183 { |
|
5084
f7fe817c92a2
Correctly handle multiple X-Forwarded-For headers (ticket #106).
Ruslan Ermilov <ru@nginx.com>
parents:
4624
diff
changeset
|
184 value = &header[i].value; |
|
f7fe817c92a2
Correctly handle multiple X-Forwarded-For headers (ticket #106).
Ruslan Ermilov <ru@nginx.com>
parents:
4624
diff
changeset
|
185 xfwd = NULL; |
|
2257
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
186 |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
187 goto found; |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
188 } |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
189 } |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
190 |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
191 return NGX_DECLINED; |
| 573 | 192 } |
| 193 | |
|
2257
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
194 found: |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
195 |
|
2176
29d26406e1bd
restore connection address on request closure,
Igor Sysoev <igor@sysoev.ru>
parents:
2049
diff
changeset
|
196 c = r->connection; |
|
29d26406e1bd
restore connection address on request closure,
Igor Sysoev <igor@sysoev.ru>
parents:
2049
diff
changeset
|
197 |
|
4624
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
198 addr.sockaddr = c->sockaddr; |
|
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
199 addr.socklen = c->socklen; |
|
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
200 /* addr.name = c->addr_text; */ |
| 3274 | 201 |
|
5084
f7fe817c92a2
Correctly handle multiple X-Forwarded-For headers (ticket #106).
Ruslan Ermilov <ru@nginx.com>
parents:
4624
diff
changeset
|
202 if (ngx_http_get_forwarded_addr(r, &addr, xfwd, value, rlcf->from, |
|
4624
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
203 rlcf->recursive) |
|
5084
f7fe817c92a2
Correctly handle multiple X-Forwarded-For headers (ticket #106).
Ruslan Ermilov <ru@nginx.com>
parents:
4624
diff
changeset
|
204 != NGX_DECLINED) |
|
4624
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
205 { |
|
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
206 return ngx_http_realip_set_addr(r, &addr); |
| 3274 | 207 } |
| 208 | |
| 209 return NGX_DECLINED; | |
| 210 } | |
| 211 | |
| 573 | 212 |
| 3274 | 213 static ngx_int_t |
|
4624
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
214 ngx_http_realip_set_addr(ngx_http_request_t *r, ngx_addr_t *addr) |
| 3274 | 215 { |
|
4624
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
216 size_t len; |
| 3274 | 217 u_char *p; |
|
4624
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
218 u_char text[NGX_SOCKADDR_STRLEN]; |
| 3274 | 219 ngx_connection_t *c; |
| 220 ngx_pool_cleanup_t *cln; | |
| 221 ngx_http_realip_ctx_t *ctx; | |
| 573 | 222 |
| 3274 | 223 cln = ngx_pool_cleanup_add(r->pool, sizeof(ngx_http_realip_ctx_t)); |
| 224 if (cln == NULL) { | |
| 225 return NGX_HTTP_INTERNAL_SERVER_ERROR; | |
| 226 } | |
|
2176
29d26406e1bd
restore connection address on request closure,
Igor Sysoev <igor@sysoev.ru>
parents:
2049
diff
changeset
|
227 |
| 3274 | 228 ctx = cln->data; |
| 229 ngx_http_set_ctx(r, ctx, ngx_http_realip_module); | |
|
1114
3f354952e91d
fix broken values, debug logging, and style fix
Igor Sysoev <igor@sysoev.ru>
parents:
986
diff
changeset
|
230 |
| 3274 | 231 c = r->connection; |
| 232 | |
|
5263
05ba5bce31e0
Core: extended ngx_sock_ntop() with socklen parameter.
Vladimir Homutov <vl@nginx.com>
parents:
5084
diff
changeset
|
233 len = ngx_sock_ntop(addr->sockaddr, addr->socklen, text, |
|
05ba5bce31e0
Core: extended ngx_sock_ntop() with socklen parameter.
Vladimir Homutov <vl@nginx.com>
parents:
5084
diff
changeset
|
234 NGX_SOCKADDR_STRLEN, 0); |
|
4624
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
235 if (len == 0) { |
| 3274 | 236 return NGX_HTTP_INTERNAL_SERVER_ERROR; |
| 237 } | |
|
1114
3f354952e91d
fix broken values, debug logging, and style fix
Igor Sysoev <igor@sysoev.ru>
parents:
986
diff
changeset
|
238 |
| 3274 | 239 p = ngx_pnalloc(c->pool, len); |
| 240 if (p == NULL) { | |
| 241 return NGX_HTTP_INTERNAL_SERVER_ERROR; | |
| 242 } | |
|
1118
cec2866f29bd
a client address must be allocated from a connection pool
Igor Sysoev <igor@sysoev.ru>
parents:
1114
diff
changeset
|
243 |
|
4624
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
244 ngx_memcpy(p, text, len); |
|
2176
29d26406e1bd
restore connection address on request closure,
Igor Sysoev <igor@sysoev.ru>
parents:
2049
diff
changeset
|
245 |
| 3274 | 246 cln->handler = ngx_http_realip_cleanup; |
|
2176
29d26406e1bd
restore connection address on request closure,
Igor Sysoev <igor@sysoev.ru>
parents:
2049
diff
changeset
|
247 |
| 3274 | 248 ctx->connection = c; |
| 249 ctx->sockaddr = c->sockaddr; | |
| 250 ctx->socklen = c->socklen; | |
| 251 ctx->addr_text = c->addr_text; | |
| 573 | 252 |
|
4624
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
253 c->sockaddr = addr->sockaddr; |
|
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
254 c->socklen = addr->socklen; |
| 3274 | 255 c->addr_text.len = len; |
| 256 c->addr_text.data = p; | |
| 573 | 257 |
|
986
68c85f283043
ngx_http_realip_module must return NGX_DECLINED
Igor Sysoev <igor@sysoev.ru>
parents:
681
diff
changeset
|
258 return NGX_DECLINED; |
| 573 | 259 } |
| 260 | |
| 261 | |
|
2176
29d26406e1bd
restore connection address on request closure,
Igor Sysoev <igor@sysoev.ru>
parents:
2049
diff
changeset
|
262 static void |
|
29d26406e1bd
restore connection address on request closure,
Igor Sysoev <igor@sysoev.ru>
parents:
2049
diff
changeset
|
263 ngx_http_realip_cleanup(void *data) |
|
29d26406e1bd
restore connection address on request closure,
Igor Sysoev <igor@sysoev.ru>
parents:
2049
diff
changeset
|
264 { |
|
29d26406e1bd
restore connection address on request closure,
Igor Sysoev <igor@sysoev.ru>
parents:
2049
diff
changeset
|
265 ngx_http_realip_ctx_t *ctx = data; |
|
29d26406e1bd
restore connection address on request closure,
Igor Sysoev <igor@sysoev.ru>
parents:
2049
diff
changeset
|
266 |
|
3273
fe71be4a02f1
support IPv6 addresses in Real IP headers
Igor Sysoev <igor@sysoev.ru>
parents:
3267
diff
changeset
|
267 ngx_connection_t *c; |
|
2176
29d26406e1bd
restore connection address on request closure,
Igor Sysoev <igor@sysoev.ru>
parents:
2049
diff
changeset
|
268 |
|
29d26406e1bd
restore connection address on request closure,
Igor Sysoev <igor@sysoev.ru>
parents:
2049
diff
changeset
|
269 c = ctx->connection; |
|
29d26406e1bd
restore connection address on request closure,
Igor Sysoev <igor@sysoev.ru>
parents:
2049
diff
changeset
|
270 |
|
3273
fe71be4a02f1
support IPv6 addresses in Real IP headers
Igor Sysoev <igor@sysoev.ru>
parents:
3267
diff
changeset
|
271 c->sockaddr = ctx->sockaddr; |
|
fe71be4a02f1
support IPv6 addresses in Real IP headers
Igor Sysoev <igor@sysoev.ru>
parents:
3267
diff
changeset
|
272 c->socklen = ctx->socklen; |
|
2176
29d26406e1bd
restore connection address on request closure,
Igor Sysoev <igor@sysoev.ru>
parents:
2049
diff
changeset
|
273 c->addr_text = ctx->addr_text; |
|
29d26406e1bd
restore connection address on request closure,
Igor Sysoev <igor@sysoev.ru>
parents:
2049
diff
changeset
|
274 } |
|
29d26406e1bd
restore connection address on request closure,
Igor Sysoev <igor@sysoev.ru>
parents:
2049
diff
changeset
|
275 |
|
29d26406e1bd
restore connection address on request closure,
Igor Sysoev <igor@sysoev.ru>
parents:
2049
diff
changeset
|
276 |
| 573 | 277 static char * |
| 278 ngx_http_realip_from(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) | |
| 279 { | |
| 280 ngx_http_realip_loc_conf_t *rlcf = conf; | |
| 281 | |
|
2257
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
282 ngx_int_t rc; |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
283 ngx_str_t *value; |
|
4624
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
284 ngx_cidr_t *cidr; |
| 573 | 285 |
| 3274 | 286 value = cf->args->elts; |
| 287 | |
|
4624
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
288 if (rlcf->from == NULL) { |
|
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
289 rlcf->from = ngx_array_create(cf->pool, 2, |
|
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
290 sizeof(ngx_cidr_t)); |
|
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
291 if (rlcf->from == NULL) { |
|
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
292 return NGX_CONF_ERROR; |
|
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
293 } |
|
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
294 } |
|
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
295 |
|
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
296 cidr = ngx_array_push(rlcf->from); |
|
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
297 if (cidr == NULL) { |
|
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
298 return NGX_CONF_ERROR; |
|
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
299 } |
|
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
300 |
| 3274 | 301 #if (NGX_HAVE_UNIX_DOMAIN) |
| 302 | |
| 303 if (ngx_strcmp(value[1].data, "unix:") == 0) { | |
|
4624
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
304 cidr->family = AF_UNIX; |
| 3274 | 305 return NGX_CONF_OK; |
| 306 } | |
| 307 | |
| 308 #endif | |
| 309 | |
|
4624
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
310 rc = ngx_ptocidr(&value[1], cidr); |
|
1380
b590a528fd41
ignore meaningless bits in CIDR and warn about them
Igor Sysoev <igor@sysoev.ru>
parents:
1118
diff
changeset
|
311 |
|
b590a528fd41
ignore meaningless bits in CIDR and warn about them
Igor Sysoev <igor@sysoev.ru>
parents:
1118
diff
changeset
|
312 if (rc == NGX_ERROR) { |
| 573 | 313 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, "invalid parameter \"%V\"", |
| 314 &value[1]); | |
| 315 return NGX_CONF_ERROR; | |
| 316 } | |
| 317 | |
|
1380
b590a528fd41
ignore meaningless bits in CIDR and warn about them
Igor Sysoev <igor@sysoev.ru>
parents:
1118
diff
changeset
|
318 if (rc == NGX_DONE) { |
|
b590a528fd41
ignore meaningless bits in CIDR and warn about them
Igor Sysoev <igor@sysoev.ru>
parents:
1118
diff
changeset
|
319 ngx_conf_log_error(NGX_LOG_WARN, cf, 0, |
|
b590a528fd41
ignore meaningless bits in CIDR and warn about them
Igor Sysoev <igor@sysoev.ru>
parents:
1118
diff
changeset
|
320 "low address bits of %V are meaningless", &value[1]); |
|
b590a528fd41
ignore meaningless bits in CIDR and warn about them
Igor Sysoev <igor@sysoev.ru>
parents:
1118
diff
changeset
|
321 } |
|
b590a528fd41
ignore meaningless bits in CIDR and warn about them
Igor Sysoev <igor@sysoev.ru>
parents:
1118
diff
changeset
|
322 |
| 573 | 323 return NGX_CONF_OK; |
| 324 } | |
| 325 | |
| 326 | |
|
2257
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
327 static char * |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
328 ngx_http_realip(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
329 { |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
330 ngx_http_realip_loc_conf_t *rlcf = conf; |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
331 |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
332 ngx_str_t *value; |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
333 |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
334 value = cf->args->elts; |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
335 |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
336 if (ngx_strcmp(value[1].data, "X-Real-IP") == 0) { |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
337 rlcf->type = NGX_HTTP_REALIP_XREALIP; |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
338 return NGX_CONF_OK; |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
339 } |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
340 |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
341 if (ngx_strcmp(value[1].data, "X-Forwarded-For") == 0) { |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
342 rlcf->type = NGX_HTTP_REALIP_XFWD; |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
343 return NGX_CONF_OK; |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
344 } |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
345 |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
346 rlcf->type = NGX_HTTP_REALIP_HEADER; |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
347 rlcf->hash = ngx_hash_strlow(value[1].data, value[1].data, value[1].len); |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
348 rlcf->header = value[1]; |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
349 |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
350 return NGX_CONF_OK; |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
351 } |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
352 |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
353 |
| 573 | 354 static void * |
| 355 ngx_http_realip_create_loc_conf(ngx_conf_t *cf) | |
| 356 { | |
| 357 ngx_http_realip_loc_conf_t *conf; | |
| 358 | |
| 359 conf = ngx_pcalloc(cf->pool, sizeof(ngx_http_realip_loc_conf_t)); | |
| 360 if (conf == NULL) { | |
|
2912
c7d57b539248
return NULL instead of NGX_CONF_ERROR on a create conf failure
Igor Sysoev <igor@sysoev.ru>
parents:
2537
diff
changeset
|
361 return NULL; |
| 573 | 362 } |
| 363 | |
| 364 /* | |
| 365 * set by ngx_pcalloc(): | |
| 366 * | |
| 367 * conf->from = NULL; | |
|
2257
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
368 * conf->hash = 0; |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
369 * conf->header = { 0, NULL }; |
| 573 | 370 */ |
| 371 | |
|
2257
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
372 conf->type = NGX_CONF_UNSET_UINT; |
|
4624
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
373 conf->recursive = NGX_CONF_UNSET; |
| 573 | 374 |
| 375 return conf; | |
| 376 } | |
| 377 | |
| 378 | |
| 379 static char * | |
| 380 ngx_http_realip_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child) | |
| 381 { | |
| 382 ngx_http_realip_loc_conf_t *prev = parent; | |
| 383 ngx_http_realip_loc_conf_t *conf = child; | |
| 384 | |
| 385 if (conf->from == NULL) { | |
| 386 conf->from = prev->from; | |
|
3305
8017f9bda3f6
fix "set_real_ip_from unix:" inheritance
Igor Sysoev <igor@sysoev.ru>
parents:
3291
diff
changeset
|
387 } |
|
8017f9bda3f6
fix "set_real_ip_from unix:" inheritance
Igor Sysoev <igor@sysoev.ru>
parents:
3291
diff
changeset
|
388 |
|
2257
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
389 ngx_conf_merge_uint_value(conf->type, prev->type, NGX_HTTP_REALIP_XREALIP); |
|
4624
df93068953c0
realip: chains of trusted proxies and IPv6 support.
Ruslan Ermilov <ru@nginx.com>
parents:
4562
diff
changeset
|
390 ngx_conf_merge_value(conf->recursive, prev->recursive, 0); |
|
2257
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
391 |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
392 if (conf->header.len == 0) { |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
393 conf->hash = prev->hash; |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
394 conf->header = prev->header; |
|
74d270c8821e
real_ip_header supports any header
Igor Sysoev <igor@sysoev.ru>
parents:
2202
diff
changeset
|
395 } |
| 573 | 396 |
| 397 return NGX_CONF_OK; | |
| 398 } | |
| 399 | |
| 400 | |
| 401 static ngx_int_t | |
| 681 | 402 ngx_http_realip_init(ngx_conf_t *cf) |
| 573 | 403 { |
| 404 ngx_http_handler_pt *h; | |
| 405 ngx_http_core_main_conf_t *cmcf; | |
| 406 | |
| 681 | 407 cmcf = ngx_http_conf_get_module_main_conf(cf, ngx_http_core_module); |
| 573 | 408 |
| 409 h = ngx_array_push(&cmcf->phases[NGX_HTTP_POST_READ_PHASE].handlers); | |
| 410 if (h == NULL) { | |
| 411 return NGX_ERROR; | |
| 412 } | |
| 413 | |
| 414 *h = ngx_http_realip_handler; | |
| 415 | |
| 581 | 416 h = ngx_array_push(&cmcf->phases[NGX_HTTP_PREACCESS_PHASE].handlers); |
| 573 | 417 if (h == NULL) { |
| 418 return NGX_ERROR; | |
| 419 } | |
| 420 | |
| 421 *h = ngx_http_realip_handler; | |
| 422 | |
| 423 return NGX_OK; | |
| 424 } |