current cgisimple.c, 1.141, 1.142 client-tags.c, 1.5, 1.6 client-tags.h, 1.2, 1.3 jcc.c, 1.442, 1.443 loadcfg.c, 1.152, 1.153 loaders.c, 1.103, 1.104 project.h, 1.214, 1.215
Fabian Keil <[email protected]> Sun, 22 May 2016 12:43:09 +0000
| Newsgroups | gmane.comp.web.privoxy.cvs |
|---|---|
| Message-ID | <[email protected]> |
Update of /cvsroot/ijbswa/current
In directory sfp-cvs-1.v30.ch3.sourceforge.com:/tmp/cvs-serv15267
Modified Files:
cgisimple.c client-tags.c client-tags.h jcc.c loadcfg.c
loaders.c project.h
Log Message:
Optionally use the X-Forwarded-For header for client tags
... if it exists.
Sponsored by: Robert Klemme
Index: project.h
===================================================================
RCS file: /cvsroot/ijbswa/current/project.h,v
retrieving revision 1.214
retrieving revision 1.215
diff -C2 -d -r1.214 -r1.215
*** project.h 30 Mar 2016 11:13:25 -0000 1.214
--- project.h 22 May 2016 12:43:07 -0000 1.215
***************
*** 954,957 ****
--- 954,963 ----
/** List of all tags that apply to this client (assigned based on address) */
struct list client_tags[1];
+ /** The address of the client the request (presumably) came from.
+ * Either the address returned by accept(), or the address provided
+ * with the X-Forwarded-For header, provided Privoxy has been configured
+ * to use it.
+ */
+ char *client_address;
#endif
***************
*** 1348,1351 ****
--- 1354,1358 ----
unsigned int client_tag_lifetime;
#endif /* def FEATURE_CLIENT_TAGS */
+ int trust_x_forwarded_for;
#ifdef FEATURE_ACL
Index: client-tags.h
===================================================================
RCS file: /cvsroot/ijbswa/current/client-tags.h,v
retrieving revision 1.2
retrieving revision 1.3
diff -C2 -d -r1.2 -r1.3
*** client-tags.h 3 May 2016 13:21:42 -0000 1.2
--- client-tags.h 22 May 2016 12:43:07 -0000 1.3
***************
*** 41,44 ****
--- 41,46 ----
extern int client_has_requested_tag(const char *client_address,
const char *tag);
+ extern void set_client_address(struct client_state *csp,
+ const struct list *headers);
#define CLIENT_TAG_LENGTH_MAX 50
Index: loaders.c
===================================================================
RCS file: /cvsroot/ijbswa/current/loaders.c,v
retrieving revision 1.103
retrieving revision 1.104
diff -C2 -d -r1.103 -r1.104
*** loaders.c 8 May 2016 10:45:32 -0000 1.103
--- loaders.c 22 May 2016 12:43:07 -0000 1.104
***************
*** 183,186 ****
--- 183,189 ----
freez(csp->ip_addr_str);
+ #ifdef FEATURE_CLIENT_TAGS
+ freez(csp->client_address);
+ #endif
freez(csp->client_iob->buf);
freez(csp->iob->buf);
Index: client-tags.c
===================================================================
RCS file: /cvsroot/ijbswa/current/client-tags.c,v
retrieving revision 1.5
retrieving revision 1.6
diff -C2 -d -r1.5 -r1.6
*** client-tags.c 8 May 2016 10:46:05 -0000 1.5
--- client-tags.c 22 May 2016 12:43:07 -0000 1.6
***************
*** 43,46 ****
--- 43,47 ----
#include "miscutil.h"
#include "errlog.h"
+ #include "parsers.h"
struct client_specific_tag
***************
*** 492,506 ****
}
! if (client_has_requested_tag(csp->ip_addr_str, tag_name))
{
log_error(LOG_LEVEL_ERROR,
! "Tag '%s' already enabled for client '%s'", tag->name, csp->ip_addr_str);
}
else
{
! add_tag_for_client(csp->ip_addr_str, tag_name, time_to_live);
log_error(LOG_LEVEL_INFO,
"Tag '%s' enabled for client '%s'. TTL: %d.",
! tag->name, csp->ip_addr_str, time_to_live);
}
--- 493,507 ----
}
! if (client_has_requested_tag(csp->client_address, tag_name))
{
log_error(LOG_LEVEL_ERROR,
! "Tag '%s' already enabled for client '%s'", tag->name, csp->client_address);
}
else
{
! add_tag_for_client(csp->client_address, tag_name, time_to_live);
log_error(LOG_LEVEL_INFO,
"Tag '%s' enabled for client '%s'. TTL: %d.",
! tag->name, csp->client_address, time_to_live);
}
***************
*** 537,545 ****
}
! if (client_has_requested_tag(csp->ip_addr_str, tag_name))
{
! remove_tag_for_client(csp->ip_addr_str, tag_name);
log_error(LOG_LEVEL_INFO,
! "Tag '%s' disabled for client '%s'", tag->name, csp->ip_addr_str);
}
else
--- 538,546 ----
}
! if (client_has_requested_tag(csp->client_address, tag_name))
{
! remove_tag_for_client(csp->client_address, tag_name);
log_error(LOG_LEVEL_INFO,
! "Tag '%s' disabled for client '%s'", tag->name, csp->client_address);
}
else
***************
*** 547,551 ****
log_error(LOG_LEVEL_ERROR,
"Tag '%s' currently not set for client '%s'",
! tag->name, csp->ip_addr_str);
}
--- 548,552 ----
log_error(LOG_LEVEL_ERROR,
"Tag '%s' currently not set for client '%s'",
! tag->name, csp->client_address);
}
***************
*** 596,599 ****
--- 597,638 ----
}
+
+
+ /*********************************************************************
+ *
+ * Function : set_client_address
+ *
+ * Description : Sets the client address that will be used to enable,
+ * disable, or apply client tags.
+ *
+ * Parameters :
+ * 1 : csp = Current client state (buffers, headers, etc...)
+ * 2 : headers = Client headers
+ *
+ * Returns : void.
+ *
+ *********************************************************************/
+ void set_client_address(struct client_state *csp, const struct list *headers)
+ {
+ if (csp->config->trust_x_forwarded_for)
+ {
+ const char *client_address;
+
+ client_address = get_header_value(headers, "X-Forwarded-For:");
+ if (client_address != NULL)
+ {
+ csp->client_address = strdup_or_die(client_address);
+ log_error(LOG_LEVEL_HEADER,
+ "Got client address %s from X-Forwarded-For header",
+ csp->client_address);
+ }
+ }
+
+ if (csp->client_address == NULL)
+ {
+ csp->client_address = strdup_or_die(csp->ip_addr_str);
+ }
+ }
+
#else
#error Compiling client-tags.c without FEATURE_CLIENT_TAGS
Index: jcc.c
===================================================================
RCS file: /cvsroot/ijbswa/current/jcc.c,v
retrieving revision 1.442
retrieving revision 1.443
diff -C2 -d -r1.442 -r1.443
*** jcc.c 17 Mar 2016 10:40:53 -0000 1.442
--- jcc.c 22 May 2016 12:43:07 -0000 1.443
***************
*** 1679,1682 ****
--- 1679,1688 ----
}
+ #ifdef FEATURE_CLIENT_TAGS
+ /* XXX: If the headers were enlisted sooner, passing csp would do. */
+ set_client_address(csp, headers);
+ get_tag_list_for_client(csp->client_tags, csp->client_address);
+ #endif
+
/*
* Determine the actions for this URL
***************
*** 1849,1855 ****
http = csp->http;
- #if FEATURE_CLIENT_TAGS
- get_tag_list_for_client(csp->client_tags, csp->ip_addr_str);
- #endif
if (receive_client_request(csp) != JB_ERR_OK)
{
--- 1855,1858 ----
***************
*** 2825,2828 ****
--- 2828,2832 ----
#ifdef FEATURE_CLIENT_TAGS
destroy_list(csp->client_tags);
+ freez(csp->client_address);
#endif
free_current_action(csp->action);
Index: cgisimple.c
===================================================================
RCS file: /cvsroot/ijbswa/current/cgisimple.c,v
retrieving revision 1.141
retrieving revision 1.142
diff -C2 -d -r1.141 -r1.142
*** cgisimple.c 8 May 2016 10:46:29 -0000 1.141
--- cgisimple.c 22 May 2016 12:43:07 -0000 1.142
***************
*** 359,363 ****
return JB_ERR_MEMORY;
}
!
toggled_tag = lookup(parameters, "tag");
if (*toggled_tag != '\0')
--- 359,363 ----
return JB_ERR_MEMORY;
}
! assert(csp->client_address != NULL);
toggled_tag = lookup(parameters, "tag");
if (*toggled_tag != '\0')
***************
*** 397,401 ****
privoxy_mutex_lock(&client_tags_mutex);
! tag_state = client_has_requested_tag(csp->ip_addr_str, this_tag->name);
privoxy_mutex_unlock(&client_tags_mutex);
if (!err) err = string_append(&client_tag_status, "<tr><td>");
--- 397,401 ----
privoxy_mutex_lock(&client_tags_mutex);
! tag_state = client_has_requested_tag(csp->client_address, this_tag->name);
privoxy_mutex_unlock(&client_tags_mutex);
if (!err) err = string_append(&client_tag_status, "<tr><td>");
***************
*** 430,434 ****
}
! if (map(exports, "client-ip-addr", 1, csp->ip_addr_str, 1))
{
free_map(exports);
--- 430,434 ----
}
! if (map(exports, "client-ip-addr", 1, csp->client_address, 1))
{
free_map(exports);
Index: loadcfg.c
===================================================================
RCS file: /cvsroot/ijbswa/current/loadcfg.c,v
retrieving revision 1.152
retrieving revision 1.153
diff -C2 -d -r1.152 -r1.153
*** loadcfg.c 8 May 2016 10:46:55 -0000 1.152
--- loadcfg.c 22 May 2016 12:43:07 -0000 1.153
***************
*** 167,170 ****
--- 167,171 ----
#define hash_toggle 447966U /* "toggle" */
#define hash_trust_info_url 430331967U /* "trust-info-url" */
+ #define hash_trust_x_forwarded_for 2971537414U /* "trust-x-forwarded-for" */
#define hash_trustfile 56494766U /* "trustfile" */
#define hash_usermanual 1416668518U /* "user-manual" */
***************
*** 600,603 ****
--- 601,605 ----
config->client_tag_lifetime = 60;
#endif
+ config->trust_x_forwarded_for = 0;
/*
* 128 client sockets ought to be enough for everybody who can't
***************
*** 1589,1592 ****
--- 1591,1601 ----
/* *************************************************************************
+ * trust-x-forwarded-for (0|1)
+ * *************************************************************************/
+ case hash_trust_x_forwarded_for :
+ config->trust_x_forwarded_for = parse_toggle_state(cmd, arg);
+ break;
+
+ /* *************************************************************************
* trustfile filename
* (In confdir by default.)
------------------------------------------------------------------------------
Mobile security can be enabling, not merely restricting. Employees who
bring their own devices (BYOD) to work are irked by the imposition of MDM
restrictions. Mobile Device Manager Plus allows you to control only the
apps on BYO-devices by containerizing them, leaving personal data untouched!
https://ad.doubleclick.net/ddm/clk/304595813;131938128;j