Author: mdounin
Date: 2012-06-04 11:58:12 +0000 (Mon, 04 Jun 2012)
New Revision: 4669
URL: http://trac.nginx.org/nginx/changeset/4669/nginx

Log:
Merge of r4614, r4624-r4629, r4631: proxy recursive changes.

*) Added IPv6 and UNIX-domain socket support in "debug_connection"
directive.

*) New function ngx_http_get_forwarded_addr() to look up real client
address.

On input it takes an original address, string in the X-Forwarded-For format
and its length, list of trusted proxies, and a flag indicating to perform
the recursive search. On output it returns NGX_OK and the "deepest" valid
address in a chain, or NGX_DECLINED. It supports AF_INET and AF_INET6.
Additionally, original address and/or proxy may be specified as AF_UNIX.

*) Realip: chains of trusted proxies and IPv6 support.

The module now supports recursive search of client address through
the chain of trusted proxies, controlled by the "real_ip_recursive"
directive (closes #2). It also gets full IPv6 support (closes #44)
and canonical value of the $client_addr variable on address change.

Example:

real_ip_header X-Forwarded-For;
set_real_ip_from 127.0.0.0/8;
set_real_ip_from ::1;
set_real_ip_from unix:;
real_ip_recursive on;

*) Geo: chains of trusted proxies and partial IPv6 support.

The module now supports recursive search of client address through
the chain of trusted proxies, controlled by the "proxy_recursive"
directive in the "geo" block. It also gets partial IPv6 support:
now proxies may be specified with IPv6 addresses.

Example:

geo $test {
...
proxy 127.0.0.1;
proxy ::1;
proxy_recursive;
}

There's also a slight change in behavior. When original client
address (as specified by the "geo" directive) is one of the
trusted proxies, and the value of the X-Forwarded-For request
header cannot not be parsed as a valid address, an original client
address will be used for lookup. Previously, 255.255.255.255 was
used in this case.

*) Geoip: trusted proxies support and partial IPv6 support.

The module now supports recursive search of client address through the
chain of trusted proxies (closes #100), in the same scope as the geo
module. Proxies are listed by the "geoip_proxy" directive, recursive
search is enabled by the "geoip_proxy_recursive" directive. IPv6 is
partially supported: proxies may be specified with IPv6 addresses.

Example:

geoip_country .../GeoIP.dat;
geoip_proxy 127.0.0.1;
geoip_proxy ::1;
geoip_proxy 10.0.0.0/8;
geoip_proxy_recursive on;


Modified:
branches/stable-1.2/
branches/stable-1.2/src/event/ngx_event.c
branches/stable-1.2/src/event/ngx_event.h
branches/stable-1.2/src/event/ngx_event_accept.c
branches/stable-1.2/src/http/modules/ngx_http_geo_module.c
branches/stable-1.2/src/http/modules/ngx_http_geoip_module.c
branches/stable-1.2/src/http/modules/ngx_http_realip_module.c
branches/stable-1.2/src/http/ngx_http_core_module.c
branches/stable-1.2/src/http/ngx_http_core_module.h

Index: branches/stable-1.2
===================================================================
--- branches/stable-1.2 2012-06-04 11:21:58 UTC (rev 4668)
+++ branches/stable-1.2 2012-06-04 11:58:12 UTC (rev 4669)

Property changes on: branches/stable-1.2
___________________________________________________________________
Modified: svn:mergeinfo
## -1 +1 ##
-/trunk:4611-4613,4615-4623,4641
+/trunk:4611-4629,4631,4641
\ No newline at end of property
Modified: branches/stable-1.2/src/event/ngx_event.c
===================================================================
--- branches/stable-1.2/src/event/ngx_event.c 2012-06-04 11:21:58 UTC (rev 4668)
+++ branches/stable-1.2/src/event/ngx_event.c 2012-06-04 11:58:12 UTC (rev 4669)
@@ -1064,38 +1064,34 @@

ngx_int_t rc;
ngx_str_t *value;
- ngx_event_debug_t *dc;
struct hostent *h;
- ngx_cidr_t cidr;
+ ngx_cidr_t *cidr;

value = cf->args->elts;

- dc = ngx_array_push(&ecf->debug_connection);
- if (dc == NULL) {
+ cidr = ngx_array_push(&ecf->debug_connection);
+ if (cidr == NULL) {
return NGX_CONF_ERROR;
}

- rc = ngx_ptocidr(&value[1], &cidr);
+#if (NGX_HAVE_UNIX_DOMAIN)

+ if (ngx_strcmp(value[1].data, "unix:") == 0) {
+ cidr->family = AF_UNIX;
+ return NGX_CONF_OK;
+ }
+
+#endif
+
+ rc = ngx_ptocidr(&value[1], cidr);
+
if (rc == NGX_DONE) {
ngx_conf_log_error(NGX_LOG_WARN, cf, 0,
"low address bits of %V are meaningless", &value[1]);
- rc = NGX_OK;
+ return NGX_CONF_OK;
}

if (rc == NGX_OK) {
-
- /* AF_INET only */
-
- if (cidr.family != AF_INET) {
- ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
- "\"debug_connection\" supports IPv4 only");
- return NGX_CONF_ERROR;
- }
-
- dc->mask = cidr.u.in.mask;
- dc->addr = cidr.u.in.addr;
-
return NGX_CONF_OK;
}

@@ -1107,8 +1103,9 @@
return NGX_CONF_ERROR;
}

- dc->mask = 0xffffffff;
- dc->addr = *(in_addr_t *)(h->h_addr_list[0]);
+ cidr->family = AF_INET;
+ cidr->u.in.mask = 0xffffffff;
+ cidr->u.in.addr = *(in_addr_t *)(h->h_addr_list[0]);

#else

@@ -1142,7 +1139,7 @@
#if (NGX_DEBUG)

if (ngx_array_init(&ecf->debug_connection, cycle->pool, 4,
- sizeof(ngx_event_debug_t)) == NGX_ERROR)
+ sizeof(ngx_cidr_t)) == NGX_ERROR)
{
return NULL;
}

Modified: branches/stable-1.2/src/event/ngx_event.h
===================================================================
--- branches/stable-1.2/src/event/ngx_event.h 2012-06-04 11:21:58 UTC (rev 4668)
+++ branches/stable-1.2/src/event/ngx_event.h 2012-06-04 11:58:12 UTC (rev 4669)
@@ -222,12 +222,6 @@


typedef struct {
- in_addr_t mask;
- in_addr_t addr;
-} ngx_event_debug_t;
-
-
-typedef struct {
ngx_int_t (*add)(ngx_event_t *ev, ngx_int_t event, ngx_uint_t flags);
ngx_int_t (*del)(ngx_event_t *ev, ngx_int_t event, ngx_uint_t flags);


Modified: branches/stable-1.2/src/event/ngx_event_accept.c
===================================================================
--- branches/stable-1.2/src/event/ngx_event_accept.c 2012-06-04 11:21:58 UTC (rev 4668)
+++ branches/stable-1.2/src/event/ngx_event_accept.c 2012-06-04 11:58:12 UTC (rev 4669)
@@ -286,17 +286,56 @@
#if (NGX_DEBUG)
{

- in_addr_t i;
- ngx_event_debug_t *dc;
- struct sockaddr_in *sin;
+ struct sockaddr_in *sin;
+ ngx_cidr_t *cidr;
+ ngx_uint_t i;
+#if (NGX_HAVE_INET6)
+ struct sockaddr_in6 *sin6;
+ ngx_uint_t n;
+#endif

- sin = (struct sockaddr_in *) sa;
- dc = ecf->debug_connection.elts;
+ cidr = ecf->debug_connection.elts;
for (i = 0; i < ecf->debug_connection.nelts; i++) {
- if ((sin->sin_addr.s_addr & dc[i].mask) == dc[i].addr) {
- log->log_level = NGX_LOG_DEBUG_CONNECTION|NGX_LOG_DEBUG_ALL;
+ if (cidr[i].family != c->sockaddr->sa_family) {
+ goto next;
+ }
+
+ switch (cidr[i].family) {
+
+#if (NGX_HAVE_INET6)
+ case AF_INET6:
+ sin6 = (struct sockaddr_in6 *) c->sockaddr;
+ for (n = 0; n < 16; n++) {
+ if ((sin6->sin6_addr.s6_addr[n]
+ & cidr[i].u.in6.mask.s6_addr[n])
+ != cidr[i].u.in6.addr.s6_addr[n])
+ {
+ goto next;
+ }
+ }
break;
+#endif
+
+#if (NGX_HAVE_UNIX_DOMAIN)
+ case AF_UNIX:
+ break;
+#endif
+
+ default: /* AF_INET */
+ sin = (struct sockaddr_in *) c->sockaddr;
+ if ((sin->sin_addr.s_addr & cidr[i].u.in.mask)
+ != cidr[i].u.in.addr)
+ {
+ goto next;
+ }
+ break;
}
+
+ log->log_level = NGX_LOG_DEBUG_CONNECTION|NGX_LOG_DEBUG_ALL;
+ break;
+
+ next:
+ continue;
}

}

Modified: branches/stable-1.2/src/http/modules/ngx_http_geo_module.c
===================================================================
--- branches/stable-1.2/src/http/modules/ngx_http_geo_module.c 2012-06-04 11:21:58 UTC (rev 4668)
+++ branches/stable-1.2/src/http/modules/ngx_http_geo_module.c 2012-06-04 11:58:12 UTC (rev 4669)
@@ -51,6 +51,7 @@
unsigned outside_entries:1;
unsigned allow_binary_include:1;
unsigned binary_include:1;
+ unsigned proxy_recursive:1;
} ngx_http_geo_conf_ctx_t;


@@ -61,6 +62,7 @@
} u;

ngx_array_t *proxies;
+ unsigned proxy_recursive:1;

ngx_int_t index;
} ngx_http_geo_ctx_t;
@@ -68,8 +70,8 @@

static in_addr_t ngx_http_geo_addr(ngx_http_request_t *r,
ngx_http_geo_ctx_t *ctx);
-static in_addr_t ngx_http_geo_real_addr(ngx_http_request_t *r,
- ngx_http_geo_ctx_t *ctx);
+static ngx_int_t ngx_http_geo_real_addr(ngx_http_request_t *r,
+ ngx_http_geo_ctx_t *ctx, ngx_addr_t *addr);
static char *ngx_http_geo_block(ngx_conf_t *cf, ngx_command_t *cmd, void *conf);
static char *ngx_http_geo(ngx_conf_t *cf, ngx_command_t *dummy, void *conf);
static char *ngx_http_geo_range(ngx_conf_t *cf, ngx_http_geo_conf_ctx_t *ctx,
@@ -212,87 +214,60 @@
static in_addr_t
ngx_http_geo_addr(ngx_http_request_t *r, ngx_http_geo_ctx_t *ctx)
{
- u_char *p, *ip;
- size_t len;
- in_addr_t addr;
- ngx_uint_t i, n;
- ngx_in_cidr_t *proxies;
- ngx_table_elt_t *xfwd;
+ ngx_addr_t addr;
+ ngx_table_elt_t *xfwd;
+ struct sockaddr_in *sin;

- addr = ngx_http_geo_real_addr(r, ctx);
+ if (ngx_http_geo_real_addr(r, ctx, &addr) != NGX_OK) {
+ return INADDR_NONE;
+ }

xfwd = r->headers_in.x_forwarded_for;

- if (xfwd == NULL || ctx->proxies == NULL) {
- return addr;
+ if (xfwd != NULL && ctx->proxies != NULL) {
+ (void) ngx_http_get_forwarded_addr(r, &addr, xfwd->value.data,
+ xfwd->value.len, ctx->proxies,
+ ctx->proxy_recursive);
}

- proxies = ctx->proxies->elts;
- n = ctx->proxies->nelts;
+#if (NGX_HAVE_INET6)

- for (i = 0; i < n; i++) {
- if ((addr & proxies[i].mask) == proxies[i].addr) {
+ if (addr.sockaddr->sa_family == AF_INET6) {
+ struct in6_addr *inaddr6;

- len = xfwd->value.len;
- ip = xfwd->value.data;
+ inaddr6 = &((struct sockaddr_in6 *) addr.sockaddr)->sin6_addr;

- for (p = ip + len - 1; p > ip; p--) {
- if (*p == ' ' || *p == ',') {
- p++;
- len -= p - ip;
- ip = p;
- break;
- }
- }
-
- return ntohl(ngx_inet_addr(ip, len));
+ if (IN6_IS_ADDR_V4MAPPED(inaddr6)) {
+ return ntohl(*(in_addr_t *) &inaddr6->s6_addr[12]);
}
}

- return addr;
+#endif
+
+ if (addr.sockaddr->sa_family != AF_INET) {
+ return INADDR_NONE;
+ }
+
+ sin = (struct sockaddr_in *) addr.sockaddr;
+ return ntohl(sin->sin_addr.s_addr);
}


-static in_addr_t
-ngx_http_geo_real_addr(ngx_http_request_t *r, ngx_http_geo_ctx_t *ctx)
+static ngx_int_t
+ngx_http_geo_real_addr(ngx_http_request_t *r, ngx_http_geo_ctx_t *ctx,
+ ngx_addr_t *addr)
{
- struct sockaddr_in *sin;
ngx_http_variable_value_t *v;
-#if (NGX_HAVE_INET6)
- u_char *p;
- in_addr_t addr;
- struct sockaddr_in6 *sin6;
-#endif

if (ctx->index == -1) {
ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
"http geo started: %V", &r->connection->addr_text);

- switch (r->connection->sockaddr->sa_family) {
+ addr->sockaddr = r->connection->sockaddr;
+ addr->socklen = r->connection->socklen;
+ /* addr->name = r->connection->addr_text; */

- case AF_INET:
- sin = (struct sockaddr_in *) r->connection->sockaddr;
- return ntohl(sin->sin_addr.s_addr);
-
-#if (NGX_HAVE_INET6)
-
- case AF_INET6:
- sin6 = (struct sockaddr_in6 *) r->connection->sockaddr;
-
- if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
- p = sin6->sin6_addr.s6_addr;
- addr = p[12] << 24;
- addr += p[13] << 16;
- addr += p[14] << 8;
- addr += p[15];
-
- return addr;
- }
-
-#endif
- }
-
- return INADDR_NONE;
+ return NGX_OK;
}

v = ngx_http_get_flushed_variable(r, ctx->index);
@@ -301,13 +276,17 @@
ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
"http geo not found");

- return 0;
+ return NGX_ERROR;
}

ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
"http geo started: %v", v);

- return ntohl(ngx_inet_addr(v->data, v->len));
+ if (ngx_parse_addr(r->pool, addr, v->data, v->len) == NGX_OK) {
+ return NGX_OK;
+ }
+
+ return NGX_ERROR;
}


@@ -388,6 +367,7 @@
*cf = save;

geo->proxies = ctx.proxies;
+ geo->proxy_recursive = ctx.proxy_recursive;

if (ctx.high.low) {

@@ -493,6 +473,12 @@

goto done;
}
+
+ else if (ngx_strcmp(value[0].data, "proxy_recursive") == 0) {
+ ctx->proxy_recursive = 1;
+ rv = NGX_CONF_OK;
+ goto done;
+ }
}

if (cf->args->nelts != 2) {
@@ -926,6 +912,7 @@
}

if (ngx_strcmp(value[0].data, "default") == 0) {
+ /* cidr.family = AF_INET; */
cidr.u.in.addr = 0;
cidr.u.in.mask = 0;
net = &value[0];
@@ -944,6 +931,15 @@
return NGX_CONF_ERROR;
}

+ if (cidr.family != AF_INET) {
+ ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+ "\"geo\" supports IPv4 only");
+ return NGX_CONF_ERROR;
+ }
+
+ cidr.u.in.addr = ntohl(cidr.u.in.addr);
+ cidr.u.in.mask = ntohl(cidr.u.in.mask);
+
if (del) {
if (ngx_radix32tree_delete(ctx->tree, cidr.u.in.addr,
cidr.u.in.mask)
@@ -1052,10 +1048,10 @@
ngx_http_geo_add_proxy(ngx_conf_t *cf, ngx_http_geo_conf_ctx_t *ctx,
ngx_cidr_t *cidr)
{
- ngx_in_cidr_t *c;
+ ngx_cidr_t *c;

if (ctx->proxies == NULL) {
- ctx->proxies = ngx_array_create(ctx->pool, 4, sizeof(ngx_in_cidr_t));
+ ctx->proxies = ngx_array_create(ctx->pool, 4, sizeof(ngx_cidr_t));
if (ctx->proxies == NULL) {
return NGX_CONF_ERROR;
}
@@ -1066,8 +1062,7 @@
return NGX_CONF_ERROR;
}

- c->addr = cidr->u.in.addr;
- c->mask = cidr->u.in.mask;
+ *c = *cidr;

return NGX_CONF_OK;
}
@@ -1079,6 +1074,7 @@
ngx_int_t rc;

if (ngx_strcmp(net->data, "255.255.255.255") == 0) {
+ cidr->family = AF_INET;
cidr->u.in.addr = 0xffffffff;
cidr->u.in.mask = 0xffffffff;

@@ -1092,19 +1088,11 @@
return NGX_ERROR;
}

- if (cidr->family != AF_INET) {
- ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, "\"geo\" supports IPv4 only");
- return NGX_ERROR;
- }
-
if (rc == NGX_DONE) {
ngx_conf_log_error(NGX_LOG_WARN, cf, 0,
"low address bits of %V are meaningless", net);
}

- cidr->u.in.addr = ntohl(cidr->u.in.addr);
- cidr->u.in.mask = ntohl(cidr->u.in.mask);
-
return NGX_OK;
}


Modified: branches/stable-1.2/src/http/modules/ngx_http_geoip_module.c
===================================================================
--- branches/stable-1.2/src/http/modules/ngx_http_geoip_module.c 2012-06-04 11:21:58 UTC (rev 4668)
+++ branches/stable-1.2/src/http/modules/ngx_http_geoip_module.c 2012-06-04 11:58:12 UTC (rev 4669)
@@ -14,20 +14,24 @@


typedef struct {
- GeoIP *country;
- GeoIP *org;
- GeoIP *city;
+ GeoIP *country;
+ GeoIP *org;
+ GeoIP *city;
+ ngx_array_t *proxies; /* array of ngx_cidr_t */
+ ngx_flag_t proxy_recursive;
} ngx_http_geoip_conf_t;


typedef struct {
- ngx_str_t *name;
- uintptr_t data;
+ ngx_str_t *name;
+ uintptr_t data;
} ngx_http_geoip_var_t;


typedef const char *(*ngx_http_geoip_variable_handler_pt)(GeoIP *, u_long addr);

+static u_long ngx_http_geoip_addr(ngx_http_request_t *r,
+ ngx_http_geoip_conf_t *gcf);
static ngx_int_t ngx_http_geoip_country_variable(ngx_http_request_t *r,
ngx_http_variable_value_t *v, uintptr_t data);
static ngx_int_t ngx_http_geoip_org_variable(ngx_http_request_t *r,
@@ -44,12 +48,17 @@

static ngx_int_t ngx_http_geoip_add_variables(ngx_conf_t *cf);
static void *ngx_http_geoip_create_conf(ngx_conf_t *cf);
+static char *ngx_http_geoip_init_conf(ngx_conf_t *cf, void *conf);
static char *ngx_http_geoip_country(ngx_conf_t *cf, ngx_command_t *cmd,
void *conf);
static char *ngx_http_geoip_org(ngx_conf_t *cf, ngx_command_t *cmd,
void *conf);
static char *ngx_http_geoip_city(ngx_conf_t *cf, ngx_command_t *cmd,
void *conf);
+static char *ngx_http_geoip_proxy(ngx_conf_t *cf, ngx_command_t *cmd,
+ void *conf);
+static ngx_int_t ngx_http_geoip_cidr_value(ngx_conf_t *cf, ngx_str_t *net,
+ ngx_cidr_t *cidr);
static void ngx_http_geoip_cleanup(void *data);


@@ -76,6 +85,20 @@
0,
NULL },

+ { ngx_string("geoip_proxy"),
+ NGX_HTTP_MAIN_CONF|NGX_CONF_TAKE1,
+ ngx_http_geoip_proxy,
+ NGX_HTTP_MAIN_CONF_OFFSET,
+ 0,
+ NULL },
+
+ { ngx_string("geoip_proxy_recursive"),
+ NGX_HTTP_MAIN_CONF|NGX_CONF_FLAG,
+ ngx_conf_set_flag_slot,
+ NGX_HTTP_MAIN_CONF_OFFSET,
+ offsetof(ngx_http_geoip_conf_t, proxy_recursive),
+ NULL },
+
ngx_null_command
};

@@ -85,7 +108,7 @@
NULL, /* postconfiguration */

ngx_http_geoip_create_conf, /* create main configuration */
- NULL, /* init main configuration */
+ ngx_http_geoip_init_conf, /* init main configuration */

NULL, /* create server configuration */
NULL, /* merge server configuration */
@@ -182,40 +205,44 @@


static u_long
-ngx_http_geoip_addr(ngx_http_request_t *r)
+ngx_http_geoip_addr(ngx_http_request_t *r, ngx_http_geoip_conf_t *gcf)
{
- struct sockaddr_in *sin;
-#if (NGX_HAVE_INET6)
- u_char *p;
- u_long addr;
- struct sockaddr_in6 *sin6;
-#endif
+ ngx_addr_t addr;
+ ngx_table_elt_t *xfwd;
+ struct sockaddr_in *sin;

- switch (r->connection->sockaddr->sa_family) {
+ addr.sockaddr = r->connection->sockaddr;
+ addr.socklen = r->connection->socklen;
+ /* addr.name = r->connection->addr_text; */

- case AF_INET:
- sin = (struct sockaddr_in *) r->connection->sockaddr;
- return ntohl(sin->sin_addr.s_addr);
+ xfwd = r->headers_in.x_forwarded_for;

+ if (xfwd != NULL && gcf->proxies != NULL) {
+ (void) ngx_http_get_forwarded_addr(r, &addr, xfwd->value.data,
+ xfwd->value.len, gcf->proxies,
+ gcf->proxy_recursive);
+ }
+
#if (NGX_HAVE_INET6)

- case AF_INET6:
- sin6 = (struct sockaddr_in6 *) r->connection->sockaddr;
+ if (addr.sockaddr->sa_family == AF_INET6) {
+ struct in6_addr *inaddr6;

- if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
- p = sin6->sin6_addr.s6_addr;
- addr = p[12] << 24;
- addr += p[13] << 16;
- addr += p[14] << 8;
- addr += p[15];
+ inaddr6 = &((struct sockaddr_in6 *) addr.sockaddr)->sin6_addr;

- return addr;
+ if (IN6_IS_ADDR_V4MAPPED(inaddr6)) {
+ return ntohl(*(in_addr_t *) &inaddr6->s6_addr[12]);
}
+ }

#endif
+
+ if (addr.sockaddr->sa_family != AF_INET) {
+ return INADDR_NONE;
}

- return INADDR_NONE;
+ sin = (struct sockaddr_in *) addr.sockaddr;
+ return ntohl(sin->sin_addr.s_addr);
}


@@ -235,7 +262,7 @@
goto not_found;
}

- val = handler(gcf->country, ngx_http_geoip_addr(r));
+ val = handler(gcf->country, ngx_http_geoip_addr(r, gcf));

if (val == NULL) {
goto not_found;
@@ -273,7 +300,7 @@
goto not_found;
}

- val = handler(gcf->org, ngx_http_geoip_addr(r));
+ val = handler(gcf->org, ngx_http_geoip_addr(r, gcf));

if (val == NULL) {
goto not_found;
@@ -453,7 +480,7 @@
gcf = ngx_http_get_module_main_conf(r, ngx_http_geoip_module);

if (gcf->city) {
- return GeoIP_record_by_ipnum(gcf->city, ngx_http_geoip_addr(r));
+ return GeoIP_record_by_ipnum(gcf->city, ngx_http_geoip_addr(r, gcf));
}

return NULL;
@@ -490,6 +517,8 @@
return NULL;
}

+ conf->proxy_recursive = NGX_CONF_UNSET;
+
cln = ngx_pool_cleanup_add(cf->pool, 0);
if (cln == NULL) {
return NULL;
@@ -503,6 +532,17 @@


static char *
+ngx_http_geoip_init_conf(ngx_conf_t *cf, void *conf)
+{
+ ngx_http_geoip_conf_t *gcf = conf;
+
+ ngx_conf_init_value(gcf->proxy_recursive, 0);
+
+ return NGX_CONF_OK;
+}
+
+
+static char *
ngx_http_geoip_country(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
{
ngx_http_geoip_conf_t *gcf = conf;
@@ -652,6 +692,66 @@
}


+static char *
+ngx_http_geoip_proxy(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
+{
+ ngx_http_geoip_conf_t *gcf = conf;
+
+ ngx_str_t *value;
+ ngx_cidr_t cidr, *c;
+
+ value = cf->args->elts;
+
+ if (ngx_http_geoip_cidr_value(cf, &value[1], &cidr) != NGX_OK) {
+ return NGX_CONF_ERROR;
+ }
+
+ if (gcf->proxies == NULL) {
+ gcf->proxies = ngx_array_create(cf->pool, 4, sizeof(ngx_cidr_t));
+ if (gcf->proxies == NULL) {
+ return NGX_CONF_ERROR;
+ }
+ }
+
+ c = ngx_array_push(gcf->proxies);
+ if (c == NULL) {
+ return NGX_CONF_ERROR;
+ }
+
+ *c = cidr;
+
+ return NGX_CONF_OK;
+}
+
+static ngx_int_t
+ngx_http_geoip_cidr_value(ngx_conf_t *cf, ngx_str_t *net, ngx_cidr_t *cidr)
+{
+ ngx_int_t rc;
+
+ if (ngx_strcmp(net->data, "255.255.255.255") == 0) {
+ cidr->family = AF_INET;
+ cidr->u.in.addr = 0xffffffff;
+ cidr->u.in.mask = 0xffffffff;
+
+ return NGX_OK;
+ }
+
+ rc = ngx_ptocidr(net, cidr);
+
+ if (rc == NGX_ERROR) {
+ ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, "invalid network \"%V\"", net);
+ return NGX_ERROR;
+ }
+
+ if (rc == NGX_DONE) {
+ ngx_conf_log_error(NGX_LOG_WARN, cf, 0,
+ "low address bits of %V are meaningless", net);
+ }
+
+ return NGX_OK;
+}
+
+
static void
ngx_http_geoip_cleanup(void *data)
{

Modified: branches/stable-1.2/src/http/modules/ngx_http_realip_module.c
===================================================================
--- branches/stable-1.2/src/http/modules/ngx_http_realip_module.c 2012-06-04 11:21:58 UTC (rev 4668)
+++ branches/stable-1.2/src/http/modules/ngx_http_realip_module.c 2012-06-04 11:58:12 UTC (rev 4669)
@@ -16,13 +16,11 @@


typedef struct {
- ngx_array_t *from; /* array of ngx_in_cidr_t */
+ ngx_array_t *from; /* array of ngx_cidr_t */
ngx_uint_t type;
ngx_uint_t hash;
ngx_str_t header;
-#if (NGX_HAVE_UNIX_DOMAIN)
- ngx_uint_t unixsock; /* unsigned unixsock:2; */
-#endif
+ ngx_flag_t recursive;
} ngx_http_realip_loc_conf_t;


@@ -35,8 +33,8 @@


static ngx_int_t ngx_http_realip_handler(ngx_http_request_t *r);
-static ngx_int_t ngx_http_realip_set_addr(ngx_http_request_t *r, u_char *ip,
- size_t len);
+static ngx_int_t ngx_http_realip_set_addr(ngx_http_request_t *r,
+ ngx_addr_t *addr);
static void ngx_http_realip_cleanup(void *data);
static char *ngx_http_realip_from(ngx_conf_t *cf, ngx_command_t *cmd,
void *conf);
@@ -63,6 +61,13 @@
0,
NULL },

+ { ngx_string("real_ip_recursive"),
+ NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_FLAG,
+ ngx_conf_set_flag_slot,
+ NGX_HTTP_LOC_CONF_OFFSET,
+ offsetof(ngx_http_realip_loc_conf_t, recursive),
+ NULL },
+
ngx_null_command
};

@@ -105,10 +110,9 @@
u_char *ip, *p;
size_t len;
ngx_uint_t i, hash;
+ ngx_addr_t addr;
ngx_list_part_t *part;
ngx_table_elt_t *header;
- struct sockaddr_in *sin;
- ngx_in_cidr_t *from;
ngx_connection_t *c;
ngx_http_realip_ctx_t *ctx;
ngx_http_realip_loc_conf_t *rlcf;
@@ -121,12 +125,7 @@

rlcf = ngx_http_get_module_loc_conf(r, ngx_http_realip_module);

- if (rlcf->from == NULL
-#if (NGX_HAVE_UNIX_DOMAIN)
- && !rlcf->unixsock
-#endif
- )
- {
+ if (rlcf->from == NULL) {
return NGX_DECLINED;
}

@@ -152,15 +151,6 @@
len = r->headers_in.x_forwarded_for->value.len;
ip = r->headers_in.x_forwarded_for->value.data;

- for (p = ip + len - 1; p > ip; p--) {
- if (*p == ' ' || *p == ',') {
- p++;
- len -= p - ip;
- ip = p;
- break;
- }
- }
-
break;

default: /* NGX_HTTP_REALIP_HEADER */
@@ -204,42 +194,27 @@

ngx_log_debug1(NGX_LOG_DEBUG_HTTP, c->log, 0, "realip: \"%s\"", ip);

- /* AF_INET only */
+ addr.sockaddr = c->sockaddr;
+ addr.socklen = c->socklen;
+ /* addr.name = c->addr_text; */

- if (c->sockaddr->sa_family == AF_INET) {
- sin = (struct sockaddr_in *) c->sockaddr;
-
- from = rlcf->from->elts;
- for (i = 0; i < rlcf->from->nelts; i++) {
-
- ngx_log_debug3(NGX_LOG_DEBUG_HTTP, c->log, 0,
- "realip: %08XD %08XD %08XD",
- sin->sin_addr.s_addr, from[i].mask, from[i].addr);
-
- if ((sin->sin_addr.s_addr & from[i].mask) == from[i].addr) {
- return ngx_http_realip_set_addr(r, ip, len);
- }
- }
+ if (ngx_http_get_forwarded_addr(r, &addr, ip, len, rlcf->from,
+ rlcf->recursive)
+ == NGX_OK)
+ {
+ return ngx_http_realip_set_addr(r, &addr);
}

-#if (NGX_HAVE_UNIX_DOMAIN)
-
- if (c->sockaddr->sa_family == AF_UNIX && rlcf->unixsock) {
- return ngx_http_realip_set_addr(r, ip, len);
- }
-
-#endif
-
return NGX_DECLINED;
}


static ngx_int_t
-ngx_http_realip_set_addr(ngx_http_request_t *r, u_char *ip, size_t len)
+ngx_http_realip_set_addr(ngx_http_request_t *r, ngx_addr_t *addr)
{
+ size_t len;
u_char *p;
- ngx_int_t rc;
- ngx_addr_t addr;
+ u_char text[NGX_SOCKADDR_STRLEN];
ngx_connection_t *c;
ngx_pool_cleanup_t *cln;
ngx_http_realip_ctx_t *ctx;
@@ -254,15 +229,9 @@

c = r->connection;

- rc = ngx_parse_addr(c->pool, &addr, ip, len);
-
- switch (rc) {
- case NGX_DECLINED:
- return NGX_DECLINED;
- case NGX_ERROR:
+ len = ngx_sock_ntop(addr->sockaddr, text, NGX_SOCKADDR_STRLEN, 0);
+ if (len == 0) {
return NGX_HTTP_INTERNAL_SERVER_ERROR;
- default: /* NGX_OK */
- break;
}

p = ngx_pnalloc(c->pool, len);
@@ -270,7 +239,7 @@
return NGX_HTTP_INTERNAL_SERVER_ERROR;
}

- ngx_memcpy(p, ip, len);
+ ngx_memcpy(p, text, len);

cln->handler = ngx_http_realip_cleanup;

@@ -279,8 +248,8 @@
ctx->socklen = c->socklen;
ctx->addr_text = c->addr_text;

- c->sockaddr = addr.sockaddr;
- c->socklen = addr.socklen;
+ c->sockaddr = addr->sockaddr;
+ c->socklen = addr->socklen;
c->addr_text.len = len;
c->addr_text.data = p;

@@ -310,55 +279,45 @@

ngx_int_t rc;
ngx_str_t *value;
- ngx_cidr_t cidr;
- ngx_in_cidr_t *from;
+ ngx_cidr_t *cidr;

value = cf->args->elts;

-#if (NGX_HAVE_UNIX_DOMAIN)
-
- if (ngx_strcmp(value[1].data, "unix:") == 0) {
- rlcf->unixsock = 1;
- return NGX_CONF_OK;
- }
-
-#endif
-
if (rlcf->from == NULL) {
rlcf->from = ngx_array_create(cf->pool, 2,
- sizeof(ngx_in_cidr_t));
+ sizeof(ngx_cidr_t));
if (rlcf->from == NULL) {
return NGX_CONF_ERROR;
}
}

- from = ngx_array_push(rlcf->from);
- if (from == NULL) {
+ cidr = ngx_array_push(rlcf->from);
+ if (cidr == NULL) {
return NGX_CONF_ERROR;
}

- rc = ngx_ptocidr(&value[1], &cidr);
+#if (NGX_HAVE_UNIX_DOMAIN)

+ if (ngx_strcmp(value[1].data, "unix:") == 0) {
+ cidr->family = AF_UNIX;
+ return NGX_CONF_OK;
+ }
+
+#endif
+
+ rc = ngx_ptocidr(&value[1], cidr);
+
if (rc == NGX_ERROR) {
ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, "invalid parameter \"%V\"",
&value[1]);
return NGX_CONF_ERROR;
}

- if (cidr.family != AF_INET) {
- ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
- "\"set_real_ip_from\" supports IPv4 only");
- return NGX_CONF_ERROR;
- }
-
if (rc == NGX_DONE) {
ngx_conf_log_error(NGX_LOG_WARN, cf, 0,
"low address bits of %V are meaningless", &value[1]);
}

- from->mask = cidr.u.in.mask;
- from->addr = cidr.u.in.addr;
-
return NGX_CONF_OK;
}

@@ -409,9 +368,7 @@
*/

conf->type = NGX_CONF_UNSET_UINT;
-#if (NGX_HAVE_UNIX_DOMAIN)
- conf->unixsock = 2;
-#endif
+ conf->recursive = NGX_CONF_UNSET;

return conf;
}
@@ -427,13 +384,8 @@
conf->from = prev->from;
}

-#if (NGX_HAVE_UNIX_DOMAIN)
- if (conf->unixsock == 2) {
- conf->unixsock = (prev->unixsock == 2) ? 0 : prev->unixsock;
- }
-#endif
-
ngx_conf_merge_uint_value(conf->type, prev->type, NGX_HTTP_REALIP_XREALIP);
+ ngx_conf_merge_value(conf->recursive, prev->recursive, 0);

if (conf->header.len == 0) {
conf->hash = prev->hash;

Modified: branches/stable-1.2/src/http/ngx_http_core_module.c
===================================================================
--- branches/stable-1.2/src/http/ngx_http_core_module.c 2012-06-04 11:21:58 UTC (rev 4668)
+++ branches/stable-1.2/src/http/ngx_http_core_module.c 2012-06-04 11:58:12 UTC (rev 4669)
@@ -2699,6 +2699,109 @@
}


+ngx_int_t
+ngx_http_get_forwarded_addr(ngx_http_request_t *r, ngx_addr_t *addr,
+ u_char *xff, size_t xfflen, ngx_array_t *proxies, int recursive)
+{
+ u_char *p;
+ in_addr_t inaddr;
+ ngx_addr_t paddr;
+ ngx_cidr_t *cidr;
+ ngx_uint_t family, i;
+#if (NGX_HAVE_INET6)
+ ngx_uint_t n;
+ struct in6_addr *inaddr6;
+#endif
+
+#if (NGX_SUPPRESS_WARN)
+ inaddr = 0;
+#if (NGX_HAVE_INET6)
+ inaddr6 = NULL;
+#endif
+#endif
+
+ family = addr->sockaddr->sa_family;
+
+ if (family == AF_INET) {
+ inaddr = ((struct sockaddr_in *) addr->sockaddr)->sin_addr.s_addr;
+ }
+
+#if (NGX_HAVE_INET6)
+ else if (family == AF_INET6) {
+ inaddr6 = &((struct sockaddr_in6 *) addr->sockaddr)->sin6_addr;
+
+ if (IN6_IS_ADDR_V4MAPPED(inaddr6)) {
+ family = AF_INET;
+ inaddr = *(in_addr_t *) &inaddr6->s6_addr[12];
+ }
+ }
+#endif
+
+ for (cidr = proxies->elts, i = 0; i < proxies->nelts; i++) {
+ if (cidr[i].family != family) {
+ goto next;
+ }
+
+ switch (family) {
+
+#if (NGX_HAVE_INET6)
+ case AF_INET6:
+ for (n = 0; n < 16; n++) {
+ if ((inaddr6->s6_addr[n] & cidr[i].u.in6.mask.s6_addr[n])
+ != cidr[i].u.in6.addr.s6_addr[n])
+ {
+ goto next;
+ }
+ }
+ break;
+#endif
+
+#if (NGX_HAVE_UNIX_DOMAIN)
+ case AF_UNIX:
+ break;
+#endif
+
+ default: /* AF_INET */
+ if ((inaddr & cidr[i].u.in.mask) != cidr[i].u.in.addr) {
+ goto next;
+ }
+ break;
+ }
+
+ for (p = xff + xfflen - 1; p > xff; p--, xfflen--) {
+ if (*p != ' ' && *p != ',') {
+ break;
+ }
+ }
+
+ for ( /* void */ ; p > xff; p--) {
+ if (*p == ' ' || *p == ',') {
+ p++;
+ break;
+ }
+ }
+
+ if (ngx_parse_addr(r->pool, &paddr, p, xfflen - (p - xff)) != NGX_OK) {
+ return NGX_DECLINED;
+ }
+
+ *addr = paddr;
+
+ if (recursive && p > xff) {
+ (void) ngx_http_get_forwarded_addr(r, addr, xff, p - 1 - xff,
+ proxies, 1);
+ }
+
+ return NGX_OK;
+
+ next:
+ continue;
+ }
+
+ return NGX_DECLINED;
+}
+
+
static char *
ngx_http_core_server(ngx_conf_t *cf, ngx_command_t *cmd, void *dummy)
{

Modified: branches/stable-1.2/src/http/ngx_http_core_module.h
===================================================================
--- branches/stable-1.2/src/http/ngx_http_core_module.h 2012-06-04 11:21:58 UTC (rev 4668)
+++ branches/stable-1.2/src/http/ngx_http_core_module.h 2012-06-04 11:58:12 UTC (rev 4669)
@@ -513,7 +513,10 @@
ngx_int_t ngx_http_set_disable_symlinks(ngx_http_request_t *r,
ngx_http_core_loc_conf_t *clcf, ngx_str_t *path, ngx_open_file_info_t *of);

+ngx_int_t ngx_http_get_forwarded_addr(ngx_http_request_t *r, ngx_addr_t *addr,
+ u_char *xff, size_t xfflen, ngx_array_t *proxies, int recursive);

+
extern ngx_module_t ngx_http_core_module;

extern ngx_uint_t ngx_http_max_module;

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel