Mercurial > hg > nginx
annotate src/http/modules/ngx_http_referer_module.c @ 9275:199dc0d6b05b default tip
Added max_headers directive.
The directive limits the number of request headers accepted from clients.
While the total amount of headers is believed to be sufficiently limited
by the existing buffer size limits (client_header_buffer_size and
large_client_header_buffers), the additional limit on the number of headers
might be beneficial to better protect backend servers.
Requested by Maksim Yevmenkin.
| author | Maxim Dounin <mdounin@mdounin.ru> |
|---|---|
| date | Fri, 24 May 2024 00:20:01 +0300 |
| parents | 7564a919d333 |
| children |
| rev | line source |
|---|---|
| 577 | 1 |
| 2 /* | |
| 3 * Copyright (C) Igor Sysoev | |
| 4412 | 4 * Copyright (C) Nginx, Inc. |
| 577 | 5 */ |
| 6 | |
| 7 | |
| 8 #include <ngx_config.h> | |
| 9 #include <ngx_core.h> | |
| 10 #include <ngx_http.h> | |
| 11 | |
| 12 | |
| 595 | 13 #define NGX_HTTP_REFERER_NO_URI_PART ((void *) 4) |
| 14 | |
| 1388 | 15 |
| 577 | 16 typedef struct { |
|
1253
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
17 ngx_hash_combined_t hash; |
| 577 | 18 |
| 1388 | 19 #if (NGX_PCRE) |
| 20 ngx_array_t *regex; | |
|
5350
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
21 ngx_array_t *server_name_regex; |
| 1388 | 22 #endif |
| 23 | |
| 593 | 24 ngx_flag_t no_referer; |
| 25 ngx_flag_t blocked_referer; | |
|
5351
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
26 ngx_flag_t server_names; |
| 577 | 27 |
| 593 | 28 ngx_hash_keys_arrays_t *keys; |
|
3939
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
29 |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
30 ngx_uint_t referer_hash_max_size; |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
31 ngx_uint_t referer_hash_bucket_size; |
| 577 | 32 } ngx_http_referer_conf_t; |
| 33 | |
| 34 | |
|
7079
7564a919d333
Referer: fixed $invalid_referer.
Ruslan Ermilov <ru@nginx.com>
parents:
6474
diff
changeset
|
35 static ngx_int_t ngx_http_referer_add_variables(ngx_conf_t *cf); |
| 577 | 36 static void * ngx_http_referer_create_conf(ngx_conf_t *cf); |
| 37 static char * ngx_http_referer_merge_conf(ngx_conf_t *cf, void *parent, | |
| 38 void *child); | |
| 39 static char *ngx_http_valid_referers(ngx_conf_t *cf, ngx_command_t *cmd, | |
| 40 void *conf); | |
|
5349
9b8a634e348a
Referer: fixed error type usage inconsistency for ngx_http_add*().
Sergey Kandaurov <pluknet@nginx.com>
parents:
5321
diff
changeset
|
41 static ngx_int_t ngx_http_add_referer(ngx_conf_t *cf, |
|
9b8a634e348a
Referer: fixed error type usage inconsistency for ngx_http_add*().
Sergey Kandaurov <pluknet@nginx.com>
parents:
5321
diff
changeset
|
42 ngx_hash_keys_arrays_t *keys, ngx_str_t *value, ngx_str_t *uri); |
|
9b8a634e348a
Referer: fixed error type usage inconsistency for ngx_http_add*().
Sergey Kandaurov <pluknet@nginx.com>
parents:
5321
diff
changeset
|
43 static ngx_int_t ngx_http_add_regex_referer(ngx_conf_t *cf, |
|
5350
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
44 ngx_http_referer_conf_t *rlcf, ngx_str_t *name); |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
45 #if (NGX_PCRE) |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
46 static ngx_int_t ngx_http_add_regex_server_name(ngx_conf_t *cf, |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
47 ngx_http_referer_conf_t *rlcf, ngx_http_regex_t *regex); |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
48 #endif |
| 593 | 49 static int ngx_libc_cdecl ngx_http_cmp_referer_wildcards(const void *one, |
| 50 const void *two); | |
| 577 | 51 |
| 52 | |
| 53 static ngx_command_t ngx_http_referer_commands[] = { | |
| 54 | |
| 55 { ngx_string("valid_referers"), | |
| 56 NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_1MORE, | |
| 57 ngx_http_valid_referers, | |
| 58 NGX_HTTP_LOC_CONF_OFFSET, | |
| 59 0, | |
| 60 NULL }, | |
| 61 | |
|
3939
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
62 { ngx_string("referer_hash_max_size"), |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
63 NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1, |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
64 ngx_conf_set_num_slot, |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
65 NGX_HTTP_LOC_CONF_OFFSET, |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
66 offsetof(ngx_http_referer_conf_t, referer_hash_max_size), |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
67 NULL }, |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
68 |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
69 { ngx_string("referer_hash_bucket_size"), |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
70 NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1, |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
71 ngx_conf_set_num_slot, |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
72 NGX_HTTP_LOC_CONF_OFFSET, |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
73 offsetof(ngx_http_referer_conf_t, referer_hash_bucket_size), |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
74 NULL }, |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
75 |
| 577 | 76 ngx_null_command |
| 77 }; | |
| 78 | |
| 79 | |
| 80 static ngx_http_module_t ngx_http_referer_module_ctx = { | |
|
7079
7564a919d333
Referer: fixed $invalid_referer.
Ruslan Ermilov <ru@nginx.com>
parents:
6474
diff
changeset
|
81 ngx_http_referer_add_variables, /* preconfiguration */ |
| 577 | 82 NULL, /* postconfiguration */ |
| 83 | |
| 84 NULL, /* create main configuration */ | |
| 85 NULL, /* init main configuration */ | |
| 86 | |
| 87 NULL, /* create server configuration */ | |
| 88 NULL, /* merge server configuration */ | |
| 89 | |
| 90 ngx_http_referer_create_conf, /* create location configuration */ | |
| 91 ngx_http_referer_merge_conf /* merge location configuration */ | |
| 92 }; | |
| 93 | |
| 94 | |
| 95 ngx_module_t ngx_http_referer_module = { | |
| 96 NGX_MODULE_V1, | |
| 97 &ngx_http_referer_module_ctx, /* module context */ | |
| 98 ngx_http_referer_commands, /* module directives */ | |
| 99 NGX_HTTP_MODULE, /* module type */ | |
| 100 NULL, /* init master */ | |
| 101 NULL, /* init module */ | |
| 102 NULL, /* init process */ | |
| 103 NULL, /* init thread */ | |
| 104 NULL, /* exit thread */ | |
| 105 NULL, /* exit process */ | |
| 106 NULL, /* exit master */ | |
| 107 NGX_MODULE_V1_PADDING | |
| 108 }; | |
| 109 | |
| 110 | |
|
7079
7564a919d333
Referer: fixed $invalid_referer.
Ruslan Ermilov <ru@nginx.com>
parents:
6474
diff
changeset
|
111 static ngx_str_t ngx_http_invalid_referer_name = ngx_string("invalid_referer"); |
|
7564a919d333
Referer: fixed $invalid_referer.
Ruslan Ermilov <ru@nginx.com>
parents:
6474
diff
changeset
|
112 |
|
7564a919d333
Referer: fixed $invalid_referer.
Ruslan Ermilov <ru@nginx.com>
parents:
6474
diff
changeset
|
113 |
| 577 | 114 static ngx_int_t |
| 115 ngx_http_referer_variable(ngx_http_request_t *r, ngx_http_variable_value_t *v, | |
| 6474 | 116 uintptr_t data) |
| 577 | 117 { |
| 1388 | 118 u_char *p, *ref, *last; |
| 119 size_t len; | |
| 120 ngx_str_t *uri; | |
| 121 ngx_uint_t i, key; | |
| 122 ngx_http_referer_conf_t *rlcf; | |
| 123 u_char buf[256]; | |
|
5350
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
124 #if (NGX_PCRE) |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
125 ngx_int_t rc; |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
126 ngx_str_t referer; |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
127 #endif |
| 577 | 128 |
| 593 | 129 rlcf = ngx_http_get_module_loc_conf(r, ngx_http_referer_module); |
| 577 | 130 |
|
1253
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
131 if (rlcf->hash.hash.buckets == NULL |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
132 && rlcf->hash.wc_head == NULL |
| 1388 | 133 && rlcf->hash.wc_tail == NULL |
| 134 #if (NGX_PCRE) | |
| 135 && rlcf->regex == NULL | |
|
5350
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
136 && rlcf->server_name_regex == NULL |
| 1388 | 137 #endif |
| 138 ) | |
|
1253
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
139 { |
| 595 | 140 goto valid; |
| 577 | 141 } |
| 142 | |
| 143 if (r->headers_in.referer == NULL) { | |
| 593 | 144 if (rlcf->no_referer) { |
| 595 | 145 goto valid; |
| 146 } | |
| 577 | 147 |
| 595 | 148 goto invalid; |
| 577 | 149 } |
| 150 | |
| 151 len = r->headers_in.referer->value.len; | |
| 152 ref = r->headers_in.referer->value.data; | |
| 153 | |
| 3459 | 154 if (len >= sizeof("http://i.ru") - 1) { |
| 155 last = ref + len; | |
| 156 | |
| 157 if (ngx_strncasecmp(ref, (u_char *) "http://", 7) == 0) { | |
| 158 ref += 7; | |
|
5321
9806f7932474
Referer module: fixed regex matching against HTTPS referers.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5221
diff
changeset
|
159 len -= 7; |
| 3459 | 160 goto valid_scheme; |
| 161 | |
| 162 } else if (ngx_strncasecmp(ref, (u_char *) "https://", 8) == 0) { | |
| 163 ref += 8; | |
|
5321
9806f7932474
Referer module: fixed regex matching against HTTPS referers.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5221
diff
changeset
|
164 len -= 8; |
| 3459 | 165 goto valid_scheme; |
| 595 | 166 } |
| 577 | 167 } |
| 168 | |
| 3459 | 169 if (rlcf->blocked_referer) { |
| 170 goto valid; | |
| 171 } | |
| 172 | |
| 173 goto invalid; | |
| 174 | |
| 175 valid_scheme: | |
| 176 | |
| 595 | 177 i = 0; |
| 178 key = 0; | |
| 577 | 179 |
| 595 | 180 for (p = ref; p < last; p++) { |
| 593 | 181 if (*p == '/' || *p == ':') { |
| 182 break; | |
| 577 | 183 } |
| 595 | 184 |
| 185 if (i == 256) { | |
| 186 goto invalid; | |
| 187 } | |
|
5352
ec0be12c8e29
Referer: fixed hostname buffer overflow check.
Valentin Bartenev <vbart@nginx.com>
parents:
5351
diff
changeset
|
188 |
|
ec0be12c8e29
Referer: fixed hostname buffer overflow check.
Valentin Bartenev <vbart@nginx.com>
parents:
5351
diff
changeset
|
189 buf[i] = ngx_tolower(*p); |
|
ec0be12c8e29
Referer: fixed hostname buffer overflow check.
Valentin Bartenev <vbart@nginx.com>
parents:
5351
diff
changeset
|
190 key = ngx_hash(key, buf[i++]); |
| 593 | 191 } |
| 577 | 192 |
| 1388 | 193 uri = ngx_hash_find_combined(&rlcf->hash, key, buf, p - ref); |
| 577 | 194 |
|
1253
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
195 if (uri) { |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
196 goto uri; |
| 577 | 197 } |
| 198 | |
| 1388 | 199 #if (NGX_PCRE) |
| 200 | |
|
5350
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
201 if (rlcf->server_name_regex) { |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
202 referer.len = p - ref; |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
203 referer.data = buf; |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
204 |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
205 rc = ngx_regex_exec_array(rlcf->server_name_regex, &referer, |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
206 r->connection->log); |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
207 |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
208 if (rc == NGX_OK) { |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
209 goto valid; |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
210 } |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
211 |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
212 if (rc == NGX_ERROR) { |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
213 return rc; |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
214 } |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
215 |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
216 /* NGX_DECLINED */ |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
217 } |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
218 |
| 1388 | 219 if (rlcf->regex) { |
|
5321
9806f7932474
Referer module: fixed regex matching against HTTPS referers.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5221
diff
changeset
|
220 referer.len = len; |
| 1388 | 221 referer.data = ref; |
| 222 | |
| 1785 | 223 rc = ngx_regex_exec_array(rlcf->regex, &referer, r->connection->log); |
| 1388 | 224 |
| 1785 | 225 if (rc == NGX_OK) { |
| 1388 | 226 goto valid; |
| 227 } | |
| 1785 | 228 |
| 229 if (rc == NGX_ERROR) { | |
| 230 return rc; | |
| 231 } | |
| 232 | |
| 233 /* NGX_DECLINED */ | |
| 1388 | 234 } |
| 235 | |
| 236 #endif | |
| 237 | |
| 595 | 238 invalid: |
| 239 | |
| 577 | 240 *v = ngx_http_variable_true_value; |
| 241 | |
| 242 return NGX_OK; | |
| 595 | 243 |
| 244 uri: | |
| 245 | |
| 246 for ( /* void */ ; p < last; p++) { | |
| 247 if (*p == '/') { | |
| 248 break; | |
| 249 } | |
| 250 } | |
| 251 | |
| 252 len = last - p; | |
| 253 | |
| 254 if (uri == NGX_HTTP_REFERER_NO_URI_PART) { | |
| 255 goto valid; | |
| 256 } | |
| 257 | |
| 258 if (len < uri->len || ngx_strncmp(uri->data, p, uri->len) != 0) { | |
| 259 goto invalid; | |
| 260 } | |
| 261 | |
| 262 valid: | |
| 263 | |
| 264 *v = ngx_http_variable_null_value; | |
| 265 | |
| 266 return NGX_OK; | |
| 577 | 267 } |
| 268 | |
| 269 | |
|
7079
7564a919d333
Referer: fixed $invalid_referer.
Ruslan Ermilov <ru@nginx.com>
parents:
6474
diff
changeset
|
270 static ngx_int_t |
|
7564a919d333
Referer: fixed $invalid_referer.
Ruslan Ermilov <ru@nginx.com>
parents:
6474
diff
changeset
|
271 ngx_http_referer_add_variables(ngx_conf_t *cf) |
|
7564a919d333
Referer: fixed $invalid_referer.
Ruslan Ermilov <ru@nginx.com>
parents:
6474
diff
changeset
|
272 { |
|
7564a919d333
Referer: fixed $invalid_referer.
Ruslan Ermilov <ru@nginx.com>
parents:
6474
diff
changeset
|
273 ngx_http_variable_t *var; |
|
7564a919d333
Referer: fixed $invalid_referer.
Ruslan Ermilov <ru@nginx.com>
parents:
6474
diff
changeset
|
274 |
|
7564a919d333
Referer: fixed $invalid_referer.
Ruslan Ermilov <ru@nginx.com>
parents:
6474
diff
changeset
|
275 var = ngx_http_add_variable(cf, &ngx_http_invalid_referer_name, |
|
7564a919d333
Referer: fixed $invalid_referer.
Ruslan Ermilov <ru@nginx.com>
parents:
6474
diff
changeset
|
276 NGX_HTTP_VAR_CHANGEABLE); |
|
7564a919d333
Referer: fixed $invalid_referer.
Ruslan Ermilov <ru@nginx.com>
parents:
6474
diff
changeset
|
277 if (var == NULL) { |
|
7564a919d333
Referer: fixed $invalid_referer.
Ruslan Ermilov <ru@nginx.com>
parents:
6474
diff
changeset
|
278 return NGX_ERROR; |
|
7564a919d333
Referer: fixed $invalid_referer.
Ruslan Ermilov <ru@nginx.com>
parents:
6474
diff
changeset
|
279 } |
|
7564a919d333
Referer: fixed $invalid_referer.
Ruslan Ermilov <ru@nginx.com>
parents:
6474
diff
changeset
|
280 |
|
7564a919d333
Referer: fixed $invalid_referer.
Ruslan Ermilov <ru@nginx.com>
parents:
6474
diff
changeset
|
281 var->get_handler = ngx_http_referer_variable; |
|
7564a919d333
Referer: fixed $invalid_referer.
Ruslan Ermilov <ru@nginx.com>
parents:
6474
diff
changeset
|
282 |
|
7564a919d333
Referer: fixed $invalid_referer.
Ruslan Ermilov <ru@nginx.com>
parents:
6474
diff
changeset
|
283 return NGX_OK; |
|
7564a919d333
Referer: fixed $invalid_referer.
Ruslan Ermilov <ru@nginx.com>
parents:
6474
diff
changeset
|
284 } |
|
7564a919d333
Referer: fixed $invalid_referer.
Ruslan Ermilov <ru@nginx.com>
parents:
6474
diff
changeset
|
285 |
|
7564a919d333
Referer: fixed $invalid_referer.
Ruslan Ermilov <ru@nginx.com>
parents:
6474
diff
changeset
|
286 |
| 577 | 287 static void * |
| 288 ngx_http_referer_create_conf(ngx_conf_t *cf) | |
| 289 { | |
| 290 ngx_http_referer_conf_t *conf; | |
| 291 | |
| 593 | 292 conf = ngx_pcalloc(cf->pool, sizeof(ngx_http_referer_conf_t)); |
| 577 | 293 if (conf == NULL) { |
|
2912
c7d57b539248
return NULL instead of NGX_CONF_ERROR on a create conf failure
Igor Sysoev <igor@sysoev.ru>
parents:
1800
diff
changeset
|
294 return NULL; |
| 577 | 295 } |
| 296 | |
|
5351
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
297 /* |
|
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
298 * set by ngx_pcalloc(): |
|
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
299 * |
|
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
300 * conf->hash = { NULL }; |
|
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
301 * conf->server_names = 0; |
|
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
302 * conf->keys = NULL; |
|
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
303 */ |
|
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
304 |
|
1782
db07cb9d1cbc
regex valid_referers were not inherited
Igor Sysoev <igor@sysoev.ru>
parents:
1704
diff
changeset
|
305 #if (NGX_PCRE) |
|
db07cb9d1cbc
regex valid_referers were not inherited
Igor Sysoev <igor@sysoev.ru>
parents:
1704
diff
changeset
|
306 conf->regex = NGX_CONF_UNSET_PTR; |
|
5350
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
307 conf->server_name_regex = NGX_CONF_UNSET_PTR; |
|
1782
db07cb9d1cbc
regex valid_referers were not inherited
Igor Sysoev <igor@sysoev.ru>
parents:
1704
diff
changeset
|
308 #endif |
|
db07cb9d1cbc
regex valid_referers were not inherited
Igor Sysoev <igor@sysoev.ru>
parents:
1704
diff
changeset
|
309 |
| 577 | 310 conf->no_referer = NGX_CONF_UNSET; |
| 311 conf->blocked_referer = NGX_CONF_UNSET; | |
|
3939
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
312 conf->referer_hash_max_size = NGX_CONF_UNSET_UINT; |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
313 conf->referer_hash_bucket_size = NGX_CONF_UNSET_UINT; |
| 577 | 314 |
| 315 return conf; | |
| 316 } | |
| 317 | |
| 318 | |
| 319 static char * | |
| 320 ngx_http_referer_merge_conf(ngx_conf_t *cf, void *parent, void *child) | |
| 321 { | |
| 322 ngx_http_referer_conf_t *prev = parent; | |
| 323 ngx_http_referer_conf_t *conf = child; | |
| 324 | |
|
5351
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
325 ngx_uint_t n; |
|
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
326 ngx_hash_init_t hash; |
|
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
327 ngx_http_server_name_t *sn; |
|
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
328 ngx_http_core_srv_conf_t *cscf; |
| 593 | 329 |
| 330 if (conf->keys == NULL) { | |
| 331 conf->hash = prev->hash; | |
| 332 | |
| 1800 | 333 #if (NGX_PCRE) |
|
1782
db07cb9d1cbc
regex valid_referers were not inherited
Igor Sysoev <igor@sysoev.ru>
parents:
1704
diff
changeset
|
334 ngx_conf_merge_ptr_value(conf->regex, prev->regex, NULL); |
|
5350
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
335 ngx_conf_merge_ptr_value(conf->server_name_regex, |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
336 prev->server_name_regex, NULL); |
| 1800 | 337 #endif |
| 577 | 338 ngx_conf_merge_value(conf->no_referer, prev->no_referer, 0); |
| 339 ngx_conf_merge_value(conf->blocked_referer, prev->blocked_referer, 0); | |
|
3939
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
340 ngx_conf_merge_uint_value(conf->referer_hash_max_size, |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
341 prev->referer_hash_max_size, 2048); |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
342 ngx_conf_merge_uint_value(conf->referer_hash_bucket_size, |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
343 prev->referer_hash_bucket_size, 64); |
| 593 | 344 |
| 345 return NGX_CONF_OK; | |
| 346 } | |
| 347 | |
|
5351
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
348 if (conf->server_names == 1) { |
|
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
349 cscf = ngx_http_conf_get_module_srv_conf(cf, ngx_http_core_module); |
|
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
350 |
|
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
351 sn = cscf->server_names.elts; |
|
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
352 for (n = 0; n < cscf->server_names.nelts; n++) { |
|
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
353 |
|
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
354 #if (NGX_PCRE) |
|
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
355 if (sn[n].regex) { |
|
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
356 |
|
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
357 if (ngx_http_add_regex_server_name(cf, conf, sn[n].regex) |
|
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
358 != NGX_OK) |
|
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
359 { |
|
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
360 return NGX_CONF_ERROR; |
|
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
361 } |
|
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
362 |
|
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
363 continue; |
|
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
364 } |
|
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
365 #endif |
|
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
366 |
|
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
367 if (ngx_http_add_referer(cf, conf->keys, &sn[n].name, NULL) |
|
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
368 != NGX_OK) |
|
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
369 { |
|
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
370 return NGX_CONF_ERROR; |
|
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
371 } |
|
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
372 } |
|
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
373 } |
|
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
374 |
| 603 | 375 if ((conf->no_referer == 1 || conf->blocked_referer == 1) |
|
1253
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
376 && conf->keys->keys.nelts == 0 |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
377 && conf->keys->dns_wc_head.nelts == 0 |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
378 && conf->keys->dns_wc_tail.nelts == 0) |
| 603 | 379 { |
| 380 ngx_log_error(NGX_LOG_EMERG, cf->log, 0, | |
| 381 "the \"none\" or \"blocked\" referers are specified " | |
| 382 "in the \"valid_referers\" directive " | |
| 383 "without any valid referer"); | |
| 384 return NGX_CONF_ERROR; | |
| 385 } | |
| 386 | |
|
3939
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
387 ngx_conf_merge_uint_value(conf->referer_hash_max_size, |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
388 prev->referer_hash_max_size, 2048); |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
389 ngx_conf_merge_uint_value(conf->referer_hash_bucket_size, |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
390 prev->referer_hash_bucket_size, 64); |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
391 conf->referer_hash_bucket_size = ngx_align(conf->referer_hash_bucket_size, |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
392 ngx_cacheline_size); |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
393 |
| 593 | 394 hash.key = ngx_hash_key_lc; |
|
3939
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
395 hash.max_size = conf->referer_hash_max_size; |
|
3cbbe86a7a95
referer_hash_max_size and referer_hash_bucket_size directives
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
396 hash.bucket_size = conf->referer_hash_bucket_size; |
|
4008
debb2f235aa3
Fix names of the referer hash size directives introduced in r3940.
Igor Sysoev <igor@sysoev.ru>
parents:
3939
diff
changeset
|
397 hash.name = "referer_hash"; |
| 593 | 398 hash.pool = cf->pool; |
| 399 | |
| 400 if (conf->keys->keys.nelts) { | |
|
1253
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
401 hash.hash = &conf->hash.hash; |
| 593 | 402 hash.temp_pool = NULL; |
| 403 | |
| 404 if (ngx_hash_init(&hash, conf->keys->keys.elts, conf->keys->keys.nelts) | |
| 405 != NGX_OK) | |
| 406 { | |
| 407 return NGX_CONF_ERROR; | |
| 408 } | |
| 409 } | |
| 410 | |
|
1253
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
411 if (conf->keys->dns_wc_head.nelts) { |
| 593 | 412 |
|
1253
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
413 ngx_qsort(conf->keys->dns_wc_head.elts, |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
414 (size_t) conf->keys->dns_wc_head.nelts, |
| 593 | 415 sizeof(ngx_hash_key_t), |
| 416 ngx_http_cmp_referer_wildcards); | |
| 417 | |
| 418 hash.hash = NULL; | |
| 419 hash.temp_pool = cf->temp_pool; | |
| 420 | |
|
1253
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
421 if (ngx_hash_wildcard_init(&hash, conf->keys->dns_wc_head.elts, |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
422 conf->keys->dns_wc_head.nelts) |
| 593 | 423 != NGX_OK) |
| 424 { | |
| 425 return NGX_CONF_ERROR; | |
| 426 } | |
| 427 | |
|
1253
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
428 conf->hash.wc_head = (ngx_hash_wildcard_t *) hash.hash; |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
429 } |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
430 |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
431 if (conf->keys->dns_wc_tail.nelts) { |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
432 |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
433 ngx_qsort(conf->keys->dns_wc_tail.elts, |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
434 (size_t) conf->keys->dns_wc_tail.nelts, |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
435 sizeof(ngx_hash_key_t), |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
436 ngx_http_cmp_referer_wildcards); |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
437 |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
438 hash.hash = NULL; |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
439 hash.temp_pool = cf->temp_pool; |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
440 |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
441 if (ngx_hash_wildcard_init(&hash, conf->keys->dns_wc_tail.elts, |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
442 conf->keys->dns_wc_tail.nelts) |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
443 != NGX_OK) |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
444 { |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
445 return NGX_CONF_ERROR; |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
446 } |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
447 |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
448 conf->hash.wc_tail = (ngx_hash_wildcard_t *) hash.hash; |
| 577 | 449 } |
| 450 | |
| 1800 | 451 #if (NGX_PCRE) |
|
1782
db07cb9d1cbc
regex valid_referers were not inherited
Igor Sysoev <igor@sysoev.ru>
parents:
1704
diff
changeset
|
452 ngx_conf_merge_ptr_value(conf->regex, prev->regex, NULL); |
|
5350
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
453 ngx_conf_merge_ptr_value(conf->server_name_regex, prev->server_name_regex, |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
454 NULL); |
| 1800 | 455 #endif |
|
1782
db07cb9d1cbc
regex valid_referers were not inherited
Igor Sysoev <igor@sysoev.ru>
parents:
1704
diff
changeset
|
456 |
| 577 | 457 if (conf->no_referer == NGX_CONF_UNSET) { |
| 458 conf->no_referer = 0; | |
| 459 } | |
| 460 | |
| 461 if (conf->blocked_referer == NGX_CONF_UNSET) { | |
| 462 conf->blocked_referer = 0; | |
| 463 } | |
| 464 | |
| 611 | 465 conf->keys = NULL; |
| 466 | |
| 577 | 467 return NGX_CONF_OK; |
| 468 } | |
| 469 | |
| 470 | |
| 471 static char * | |
| 472 ngx_http_valid_referers(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) | |
| 473 { | |
| 593 | 474 ngx_http_referer_conf_t *rlcf = conf; |
| 577 | 475 |
|
7079
7564a919d333
Referer: fixed $invalid_referer.
Ruslan Ermilov <ru@nginx.com>
parents:
6474
diff
changeset
|
476 u_char *p; |
|
7564a919d333
Referer: fixed $invalid_referer.
Ruslan Ermilov <ru@nginx.com>
parents:
6474
diff
changeset
|
477 ngx_str_t *value, uri; |
|
7564a919d333
Referer: fixed $invalid_referer.
Ruslan Ermilov <ru@nginx.com>
parents:
6474
diff
changeset
|
478 ngx_uint_t i; |
| 577 | 479 |
| 593 | 480 if (rlcf->keys == NULL) { |
| 481 rlcf->keys = ngx_pcalloc(cf->temp_pool, sizeof(ngx_hash_keys_arrays_t)); | |
| 482 if (rlcf->keys == NULL) { | |
| 483 return NGX_CONF_ERROR; | |
| 484 } | |
| 577 | 485 |
| 593 | 486 rlcf->keys->pool = cf->pool; |
| 487 rlcf->keys->temp_pool = cf->pool; | |
| 488 | |
| 489 if (ngx_hash_keys_array_init(rlcf->keys, NGX_HASH_SMALL) != NGX_OK) { | |
| 577 | 490 return NGX_CONF_ERROR; |
| 491 } | |
| 492 } | |
| 493 | |
| 494 value = cf->args->elts; | |
| 495 | |
| 496 for (i = 1; i < cf->args->nelts; i++) { | |
| 497 if (value[i].len == 0) { | |
| 498 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, | |
| 499 "invalid referer \"%V\"", &value[i]); | |
| 500 return NGX_CONF_ERROR; | |
| 501 } | |
| 502 | |
| 503 if (ngx_strcmp(value[i].data, "none") == 0) { | |
| 593 | 504 rlcf->no_referer = 1; |
| 577 | 505 continue; |
| 506 } | |
| 507 | |
| 508 if (ngx_strcmp(value[i].data, "blocked") == 0) { | |
| 593 | 509 rlcf->blocked_referer = 1; |
| 577 | 510 continue; |
| 511 } | |
| 512 | |
| 513 if (ngx_strcmp(value[i].data, "server_names") == 0) { | |
|
5351
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
514 rlcf->server_names = 1; |
| 577 | 515 continue; |
| 516 } | |
| 517 | |
| 1388 | 518 if (value[i].data[0] == '~') { |
|
5350
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
519 if (ngx_http_add_regex_referer(cf, rlcf, &value[i]) != NGX_OK) { |
| 1388 | 520 return NGX_CONF_ERROR; |
| 521 } | |
| 522 | |
| 523 continue; | |
| 524 } | |
| 525 | |
|
5351
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
526 ngx_str_null(&uri); |
|
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
527 |
| 1242 | 528 p = (u_char *) ngx_strchr(value[i].data, '/'); |
| 577 | 529 |
| 593 | 530 if (p) { |
| 595 | 531 uri.len = (value[i].data + value[i].len) - p; |
| 532 uri.data = p; | |
| 593 | 533 value[i].len = p - value[i].data; |
| 577 | 534 } |
| 535 | |
| 595 | 536 if (ngx_http_add_referer(cf, rlcf->keys, &value[i], &uri) != NGX_OK) { |
| 577 | 537 return NGX_CONF_ERROR; |
| 538 } | |
| 539 } | |
| 540 | |
| 541 return NGX_CONF_OK; | |
| 542 } | |
| 593 | 543 |
| 544 | |
|
5349
9b8a634e348a
Referer: fixed error type usage inconsistency for ngx_http_add*().
Sergey Kandaurov <pluknet@nginx.com>
parents:
5321
diff
changeset
|
545 static ngx_int_t |
| 593 | 546 ngx_http_add_referer(ngx_conf_t *cf, ngx_hash_keys_arrays_t *keys, |
| 595 | 547 ngx_str_t *value, ngx_str_t *uri) |
| 593 | 548 { |
|
1253
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
549 ngx_int_t rc; |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
550 ngx_str_t *u; |
| 593 | 551 |
|
5351
a2c772963b04
Referer: "server_names" parsing deferred to merge phase.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5350
diff
changeset
|
552 if (uri == NULL || uri->len == 0) { |
| 595 | 553 u = NGX_HTTP_REFERER_NO_URI_PART; |
| 554 | |
| 555 } else { | |
| 556 u = ngx_palloc(cf->pool, sizeof(ngx_str_t)); | |
| 557 if (u == NULL) { | |
|
5349
9b8a634e348a
Referer: fixed error type usage inconsistency for ngx_http_add*().
Sergey Kandaurov <pluknet@nginx.com>
parents:
5321
diff
changeset
|
558 return NGX_ERROR; |
| 595 | 559 } |
| 560 | |
| 561 *u = *uri; | |
| 562 } | |
| 563 | |
|
1253
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
564 rc = ngx_hash_add_key(keys, value, u, NGX_HASH_WILDCARD_KEY); |
| 593 | 565 |
| 566 if (rc == NGX_OK) { | |
|
5349
9b8a634e348a
Referer: fixed error type usage inconsistency for ngx_http_add*().
Sergey Kandaurov <pluknet@nginx.com>
parents:
5321
diff
changeset
|
567 return NGX_OK; |
| 593 | 568 } |
| 569 | |
|
1253
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
570 if (rc == NGX_DECLINED) { |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
571 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
572 "invalid hostname or wildcard \"%V\"", value); |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
573 } |
|
8ef04207c84f
the "www.example.*" wildcard hash support
Igor Sysoev <igor@sysoev.ru>
parents:
1242
diff
changeset
|
574 |
| 593 | 575 if (rc == NGX_BUSY) { |
| 576 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, | |
| 577 "conflicting parameter \"%V\"", value); | |
| 578 } | |
| 579 | |
|
5349
9b8a634e348a
Referer: fixed error type usage inconsistency for ngx_http_add*().
Sergey Kandaurov <pluknet@nginx.com>
parents:
5321
diff
changeset
|
580 return NGX_ERROR; |
| 593 | 581 } |
| 582 | |
| 583 | |
|
5349
9b8a634e348a
Referer: fixed error type usage inconsistency for ngx_http_add*().
Sergey Kandaurov <pluknet@nginx.com>
parents:
5321
diff
changeset
|
584 static ngx_int_t |
| 1388 | 585 ngx_http_add_regex_referer(ngx_conf_t *cf, ngx_http_referer_conf_t *rlcf, |
|
5350
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
586 ngx_str_t *name) |
| 1388 | 587 { |
| 588 #if (NGX_PCRE) | |
| 3325 | 589 ngx_regex_elt_t *re; |
| 590 ngx_regex_compile_t rc; | |
| 591 u_char errstr[NGX_MAX_CONF_ERRSTR]; | |
| 1388 | 592 |
|
3122
3e994ac670dc
test space between "~" and regex in server_name and invalid_referers
Igor Sysoev <igor@sysoev.ru>
parents:
3116
diff
changeset
|
593 if (name->len == 1) { |
|
3e994ac670dc
test space between "~" and regex in server_name and invalid_referers
Igor Sysoev <igor@sysoev.ru>
parents:
3116
diff
changeset
|
594 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, "empty regex in \"%V\"", name); |
|
5349
9b8a634e348a
Referer: fixed error type usage inconsistency for ngx_http_add*().
Sergey Kandaurov <pluknet@nginx.com>
parents:
5321
diff
changeset
|
595 return NGX_ERROR; |
|
3122
3e994ac670dc
test space between "~" and regex in server_name and invalid_referers
Igor Sysoev <igor@sysoev.ru>
parents:
3116
diff
changeset
|
596 } |
|
3e994ac670dc
test space between "~" and regex in server_name and invalid_referers
Igor Sysoev <igor@sysoev.ru>
parents:
3116
diff
changeset
|
597 |
|
1782
db07cb9d1cbc
regex valid_referers were not inherited
Igor Sysoev <igor@sysoev.ru>
parents:
1704
diff
changeset
|
598 if (rlcf->regex == NGX_CONF_UNSET_PTR) { |
| 1785 | 599 rlcf->regex = ngx_array_create(cf->pool, 2, sizeof(ngx_regex_elt_t)); |
| 1388 | 600 if (rlcf->regex == NULL) { |
|
5349
9b8a634e348a
Referer: fixed error type usage inconsistency for ngx_http_add*().
Sergey Kandaurov <pluknet@nginx.com>
parents:
5321
diff
changeset
|
601 return NGX_ERROR; |
| 1388 | 602 } |
| 603 } | |
| 604 | |
| 1785 | 605 re = ngx_array_push(rlcf->regex); |
| 606 if (re == NULL) { | |
|
5349
9b8a634e348a
Referer: fixed error type usage inconsistency for ngx_http_add*().
Sergey Kandaurov <pluknet@nginx.com>
parents:
5321
diff
changeset
|
607 return NGX_ERROR; |
| 1388 | 608 } |
| 609 | |
| 610 name->len--; | |
| 611 name->data++; | |
| 612 | |
| 3325 | 613 ngx_memzero(&rc, sizeof(ngx_regex_compile_t)); |
| 1388 | 614 |
| 3325 | 615 rc.pattern = *name; |
| 616 rc.pool = cf->pool; | |
| 617 rc.options = NGX_REGEX_CASELESS; | |
| 618 rc.err.len = NGX_MAX_CONF_ERRSTR; | |
| 619 rc.err.data = errstr; | |
| 620 | |
| 621 if (ngx_regex_compile(&rc) != NGX_OK) { | |
| 622 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, "%V", &rc.err); | |
|
5349
9b8a634e348a
Referer: fixed error type usage inconsistency for ngx_http_add*().
Sergey Kandaurov <pluknet@nginx.com>
parents:
5321
diff
changeset
|
623 return NGX_ERROR; |
| 1388 | 624 } |
| 625 | |
| 3325 | 626 re->regex = rc.regex; |
| 1785 | 627 re->name = name->data; |
| 1388 | 628 |
|
5349
9b8a634e348a
Referer: fixed error type usage inconsistency for ngx_http_add*().
Sergey Kandaurov <pluknet@nginx.com>
parents:
5321
diff
changeset
|
629 return NGX_OK; |
| 1388 | 630 |
| 631 #else | |
| 632 | |
| 633 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, | |
| 634 "the using of the regex \"%V\" requires PCRE library", | |
| 635 name); | |
| 636 | |
|
5349
9b8a634e348a
Referer: fixed error type usage inconsistency for ngx_http_add*().
Sergey Kandaurov <pluknet@nginx.com>
parents:
5321
diff
changeset
|
637 return NGX_ERROR; |
| 1388 | 638 |
| 639 #endif | |
| 640 } | |
| 641 | |
| 642 | |
|
5350
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
643 #if (NGX_PCRE) |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
644 |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
645 static ngx_int_t |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
646 ngx_http_add_regex_server_name(ngx_conf_t *cf, ngx_http_referer_conf_t *rlcf, |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
647 ngx_http_regex_t *regex) |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
648 { |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
649 ngx_regex_elt_t *re; |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
650 |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
651 if (rlcf->server_name_regex == NGX_CONF_UNSET_PTR) { |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
652 rlcf->server_name_regex = ngx_array_create(cf->pool, 2, |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
653 sizeof(ngx_regex_elt_t)); |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
654 if (rlcf->server_name_regex == NULL) { |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
655 return NGX_ERROR; |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
656 } |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
657 } |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
658 |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
659 re = ngx_array_push(rlcf->server_name_regex); |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
660 if (re == NULL) { |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
661 return NGX_ERROR; |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
662 } |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
663 |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
664 re->regex = regex->regex; |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
665 re->name = regex->name.data; |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
666 |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
667 return NGX_OK; |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
668 } |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
669 |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
670 #endif |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
671 |
|
8220e393c241
Referer: fixed server_name regex matching.
Sergey Kandaurov <pluknet@nginx.com>
parents:
5349
diff
changeset
|
672 |
| 593 | 673 static int ngx_libc_cdecl |
| 674 ngx_http_cmp_referer_wildcards(const void *one, const void *two) | |
| 675 { | |
| 676 ngx_hash_key_t *first, *second; | |
| 677 | |
| 678 first = (ngx_hash_key_t *) one; | |
| 679 second = (ngx_hash_key_t *) two; | |
| 680 | |
|
3116
98e288c6dac3
If .domain.com, .sub.domain.com, and .domain-some.com were defined,
Igor Sysoev <igor@sysoev.ru>
parents:
2912
diff
changeset
|
681 return ngx_dns_strcmp(first->key.data, second->key.data); |
| 593 | 682 } |