/[gentoo-x86]/net-misc/stunnel/files/stunnel-4.44-xforwarded-for.diff
Gentoo

Contents of /net-misc/stunnel/files/stunnel-4.44-xforwarded-for.diff

Parent Directory Parent Directory | Revision Log Revision Log


Revision 1.1 - (show annotations) (download)
Tue Oct 11 21:00:16 2011 UTC (2 years, 6 months ago) by robbat2
Branch: MAIN
CVS Tags: HEAD
File MIME type: text/plain
Respin x-forwarded-for and listen-queue patches.

(Portage version: 2.2.0_alpha60/cvs/Linux x86_64)

1 diff -Nuar --exclude '*.orig' --exclude '*.rej' stunnel-4.44.orig/doc/stunnel.8 stunnel-4.44/doc/stunnel.8
2 --- stunnel-4.44.orig/doc/stunnel.8 2011-09-07 20:21:06.000000000 +0000
3 +++ stunnel-4.44/doc/stunnel.8 2011-10-11 20:57:06.327897530 +0000
4 @@ -578,6 +578,10 @@
5 .IP "\fBTIMEOUTidle\fR = seconds" 4
6 .IX Item "TIMEOUTidle = seconds"
7 time to keep an idle connection
8 +.IP "\fBxforwardedfor\fR = yes | no" 4
9 +.IX Item "xforwardedfor = yes | no"
10 +append an 'X-Forwarded-For:' HTTP request header providing the
11 +client's IP address to the server.
12 .IP "\fBtransparent\fR = none | source | destination | both (Unix only)" 4
13 .IX Item "transparent = none | source | destination | both (Unix only)"
14 enable transparent proxy support on selected platforms
15 diff -Nuar --exclude '*.orig' --exclude '*.rej' stunnel-4.44.orig/doc/stunnel.fr.8 stunnel-4.44/doc/stunnel.fr.8
16 --- stunnel-4.44.orig/doc/stunnel.fr.8 2011-09-07 20:21:06.000000000 +0000
17 +++ stunnel-4.44/doc/stunnel.fr.8 2011-10-11 20:57:06.327897530 +0000
18 @@ -390,6 +390,10 @@
19 .IP "\fBTIMEOUTidle\fR = secondes" 4
20 .IX Item "TIMEOUTidle = secondes"
21 Durée d'attente sur une connexion inactive
22 +.IP "\fBxforwardedfor\fR = yes | no" 4
23 +.IX Item "xforwardedfor = yes | no"
24 +Ajoute un en-tête 'X-Forwarded-For:' dans la requête HTTP fournissant
25 +au serveur l'adresse IP du client.
26 .IP "\fBtransparent\fR = yes | no (Unix seulement)" 4
27 .IX Item "transparent = yes | no (Unix seulement)"
28 Mode mandataire transparent
29 diff -Nuar --exclude '*.orig' --exclude '*.rej' stunnel-4.44.orig/src/client.c stunnel-4.44/src/client.c
30 --- stunnel-4.44.orig/src/client.c 2011-09-07 20:00:10.000000000 +0000
31 +++ stunnel-4.44/src/client.c 2011-10-11 20:57:06.327897530 +0000
32 @@ -81,6 +81,12 @@
33 }
34 str_detach(c);
35 c->opt=opt;
36 + /* some options need space to add some information */
37 + if (c->opt->option.xforwardedfor)
38 + c->buffsize = BUFFSIZE - BUFF_RESERVED;
39 + else
40 + c->buffsize = BUFFSIZE;
41 + c->crlf_seen=0;
42 c->local_rfd.fd=rfd;
43 c->local_wfd.fd=wfd;
44 return c;
45 @@ -383,6 +389,28 @@
46 }
47 }
48
49 +/* Moves all data from the buffer <buffer> between positions <start> and <stop>
50 + * to insert <string> of length <len>. <start> and <stop> are updated to their
51 + * new respective values, and the number of characters inserted is returned.
52 + * If <len> is too long, nothing is done and -1 is returned.
53 + * Note that neither <string> nor <buffer> can be NULL.
54 + */
55 +static int buffer_insert_with_len(char *buffer, int *start, int *stop, int limit, char *string, int len) {
56 + if (len > limit - *stop)
57 + return -1;
58 + if (*start > *stop)
59 + return -1;
60 + memmove(buffer + *start + len, buffer + *start, *stop - *start);
61 + memcpy(buffer + *start, string, len);
62 + *start += len;
63 + *stop += len;
64 + return len;
65 +}
66 +
67 +static int buffer_insert(char *buffer, int *start, int *stop, int limit, char *string) {
68 + return buffer_insert_with_len(buffer, start, stop, limit, string, strlen(string));
69 +}
70 +
71 /****************************** transfer data */
72 static void transfer(CLI *c) {
73 int watchdog=0; /* a counter to detect an infinite loop */
74 @@ -401,7 +429,7 @@
75 do { /* main loop of client data transfer */
76 /****************************** initialize *_wants_* */
77 read_wants_read=
78 - ssl_open_rd && c->ssl_ptr<BUFFSIZE && !read_wants_write;
79 + ssl_open_rd && c->ssl_ptr<c->buffsize && !read_wants_write;
80 write_wants_write=
81 ssl_open_wr && c->sock_ptr && !write_wants_read;
82
83 @@ -410,7 +438,7 @@
84 /* for plain socket open data strem = open file descriptor */
85 /* make sure to add each open socket to receive exceptions! */
86 if(sock_open_rd)
87 - s_poll_add(&c->fds, c->sock_rfd->fd, c->sock_ptr<BUFFSIZE, 0);
88 + s_poll_add(&c->fds, c->sock_rfd->fd, c->sock_ptr<c->buffsize, 0);
89 if(sock_open_wr)
90 s_poll_add(&c->fds, c->sock_wfd->fd, 0, c->ssl_ptr);
91 /* for SSL assume that sockets are open if there any pending requests */
92 @@ -544,7 +572,7 @@
93 /****************************** read from socket */
94 if(sock_open_rd && sock_can_rd) {
95 num=readsocket(c->sock_rfd->fd,
96 - c->sock_buff+c->sock_ptr, BUFFSIZE-c->sock_ptr);
97 + c->sock_buff+c->sock_ptr, c->buffsize-c->sock_ptr);
98 switch(num) {
99 case -1:
100 parse_socket_error(c, "readsocket");
101 @@ -580,7 +608,7 @@
102 /****************************** update *_wants_* based on new *_ptr */
103 /* this update is also required for SSL_pending() to be used */
104 read_wants_read=
105 - ssl_open_rd && c->ssl_ptr<BUFFSIZE && !read_wants_write;
106 + ssl_open_rd && c->ssl_ptr<c->buffsize && !read_wants_write;
107 write_wants_write=
108 ssl_open_wr && c->sock_ptr && !write_wants_read;
109
110 @@ -590,10 +618,71 @@
111 * writesocket() above made some room in c->ssl_buff */
112 (read_wants_write && ssl_can_wr)) {
113 read_wants_write=0;
114 - num=SSL_read(c->ssl, c->ssl_buff+c->ssl_ptr, BUFFSIZE-c->ssl_ptr);
115 + num=SSL_read(c->ssl, c->ssl_buff+c->ssl_ptr, c->buffsize-c->ssl_ptr);
116 switch(err=SSL_get_error(c->ssl, num)) {
117 case SSL_ERROR_NONE:
118 - c->ssl_ptr+=num;
119 + if (c->buffsize != BUFFSIZE && c->opt->option.xforwardedfor) { /* some work left to do */
120 + int last = c->ssl_ptr;
121 + c->ssl_ptr += num;
122 +
123 + /* Look for end of HTTP headers between last and ssl_ptr.
124 + * To achieve this reliably, we have to count the number of
125 + * successive [CR]LF and to memorize it in case it's spread
126 + * over multiple segments. --WT.
127 + */
128 + while (last < c->ssl_ptr) {
129 + if (c->ssl_buff[last] == '\n') {
130 + if (++c->crlf_seen == 2)
131 + break;
132 + } else if (last < c->ssl_ptr - 1 &&
133 + c->ssl_buff[last] == '\r' &&
134 + c->ssl_buff[last+1] == '\n') {
135 + if (++c->crlf_seen == 2)
136 + break;
137 + last++;
138 + } else if (c->ssl_buff[last] != '\r')
139 + /* don't refuse '\r' because we may get a '\n' on next read */
140 + c->crlf_seen = 0;
141 + last++;
142 + }
143 + if (c->crlf_seen >= 2) {
144 + /* We have all the HTTP headers now. We don't need to
145 + * reserve any space anymore. <ssl_ptr> points to the
146 + * first byte of unread data, and <last> points to the
147 + * exact location where we want to insert our headers,
148 + * which is right before the empty line.
149 + */
150 + c->buffsize = BUFFSIZE;
151 +
152 + if (c->opt->option.xforwardedfor) {
153 + /* X-Forwarded-For: xxxx \r\n\0 */
154 + char xforw[17 + IPLEN + 3];
155 +
156 + /* We will insert our X-Forwarded-For: header here.
157 + * We need to write the IP address, but if we use
158 + * sprintf, it will pad with the terminating 0.
159 + * So we will pass via a temporary buffer allocated
160 + * on the stack.
161 + */
162 + memcpy(xforw, "X-Forwarded-For: ", 17);
163 + if (getnameinfo(&c->peer_addr.addr[0].sa,
164 + addr_len(c->peer_addr.addr[0]),
165 + xforw + 17, IPLEN, NULL, 0,
166 + NI_NUMERICHOST) == 0) {
167 + strcat(xforw + 17, "\r\n");
168 + buffer_insert(c->ssl_buff, &last, &c->ssl_ptr,
169 + c->buffsize, xforw);
170 + }
171 + /* last still points to the \r\n and ssl_ptr to the
172 + * end of the buffer, so we may add as many headers
173 + * as wee need to.
174 + */
175 + }
176 + }
177 + }
178 + else
179 + c->ssl_ptr+=num;
180 +
181 watchdog=0; /* reset watchdog */
182 break;
183 case SSL_ERROR_WANT_WRITE:
184 diff -Nuar --exclude '*.orig' --exclude '*.rej' stunnel-4.44.orig/src/common.h stunnel-4.44/src/common.h
185 --- stunnel-4.44.orig/src/common.h 2011-09-10 18:26:34.000000000 +0000
186 +++ stunnel-4.44/src/common.h 2011-10-11 20:57:06.327897530 +0000
187 @@ -52,6 +52,9 @@
188 /* I/O buffer size */
189 #define BUFFSIZE 16384
190
191 +/* maximum space reserved for header insertion in BUFFSIZE */
192 +#define BUFF_RESERVED 1024
193 +
194 /* IP address and TCP port textual representation length */
195 #define IPLEN 128
196
197 diff -Nuar --exclude '*.orig' --exclude '*.rej' stunnel-4.44.orig/src/options.c stunnel-4.44/src/options.c
198 --- stunnel-4.44.orig/src/options.c 2011-09-10 16:44:16.000000000 +0000
199 +++ stunnel-4.44/src/options.c 2011-10-11 20:57:06.331230851 +0000
200 @@ -811,6 +811,29 @@
201 }
202 #endif
203
204 + /* xforwardedfor */
205 + switch(cmd) {
206 + case CMD_INIT:
207 + section->option.xforwardedfor=0;
208 + break;
209 + case CMD_EXEC:
210 + if(strcasecmp(opt, "xforwardedfor"))
211 + break;
212 + if(!strcasecmp(arg, "yes"))
213 + section->option.xforwardedfor=1;
214 + else if(!strcasecmp(arg, "no"))
215 + section->option.xforwardedfor=0;
216 + else
217 + return "argument should be either 'yes' or 'no'";
218 + return NULL; /* OK */
219 + case CMD_DEFAULT:
220 + break;
221 + case CMD_HELP:
222 + s_log(LOG_NOTICE, "%-15s = yes|no append an HTTP X-Forwarded-For header",
223 + "xforwardedfor");
224 + break;
225 + }
226 +
227 /* exec */
228 switch(cmd) {
229 case CMD_INIT:
230 diff -Nuar --exclude '*.orig' --exclude '*.rej' stunnel-4.44.orig/src/prototypes.h stunnel-4.44/src/prototypes.h
231 --- stunnel-4.44.orig/src/prototypes.h 2011-09-13 13:36:52.000000000 +0000
232 +++ stunnel-4.44/src/prototypes.h 2011-10-11 20:57:33.687962098 +0000
233 @@ -183,6 +183,7 @@
234 unsigned int accept:1; /* endpoint: accept */
235 unsigned int client:1;
236 unsigned int delayed_lookup:1;
237 + unsigned int xforwardedfor:1;
238 #ifdef USE_LIBWRAP
239 unsigned int libwrap:1;
240 #endif
241 @@ -385,6 +386,8 @@
242 FD *ssl_rfd, *ssl_wfd; /* read and write SSL descriptors */
243 int sock_bytes, ssl_bytes; /* bytes written to socket and SSL */
244 s_poll_set fds; /* file descriptors */
245 + int buffsize; /* current buffer size, may be lower than BUFFSIZE */
246 + int crlf_seen; /* the number of successive CRLF seen */
247 } CLI;
248
249 CLI *alloc_client_session(SERVICE_OPTIONS *, int, int);

  ViewVC Help
Powered by ViewVC 1.1.20