Re: [PATCH] Allow tagging requests with server address and/or port

--===============1937658545816550634==
Content-Type: multipart/signed; micalg=pgp-sha256;
	boundary="Sig_/87tQ8PrjI3zlKvmhfgMYuTR";
	protocol="application/pgp-signature"

--Sig_/87tQ8PrjI3zlKvmhfgMYuTR
Content-Type: multipart/mixed; boundary="MP_/knwWQo/VmRkfhHMkLhOumei"

--MP_/knwWQo/VmRkfhHMkLhOumei
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

Fabian Keil <[email protected]> wrote:

> [email protected] wrote:
>=20
> > Fabian Keil <[email protected]> wrote: =20
> > > Unless I miss something, accept_connection() should be able to set th=
e a
> > > csp->listen_addr by using the socket index (the i in fds[i]) on
> > > csp->config->haddr[] and csp->config->hport[]. =20
> >=20
> > Oh, I totally missed that csp has a pointer to the config. Sadly, it is=
 NULL
> > when passing the client_state to accept_connection(). I solved this pro=
blem by
> > passing the config directly as argument from listen_loop().  Please see
> > attached patch. I also added documentation for the new '$server' featur=
e. =20
>=20
> Thanks for the updated patch. I intent to polish and commit it in the
> next days.

I attached the patch set I intend to commit before the weekend so
it can make it into the 3.0.25 release.

Please let me know if you see anything wrong with it or want to be
credited differently.

Fabian

--MP_/knwWQo/VmRkfhHMkLhOumei
Content-Type: text/x-patch
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment; filename=listen-address-variable.diff

=46rom 1a50313abe016f657ed73c1f44aa7367c217fe7e Mon Sep 17 00:00:00 2001
From: Fabian Keil <[email protected]>
Date: Sat, 30 Apr 2016 13:05:27 +0200
Subject: [PATCH 1/3] Add dynamic filter support for the listen-address
 variable

... which contains the the address the request came in on.
This is mostly useful for taggers.

Original patch contributed by pursievro.
---
 default.filter              |  3 ++-
 doc/source/user-manual.sgml | 13 ++++++++-----
 filters.c                   |  2 ++
 jbsockets.c                 | 20 ++++++++++++++++++++
 jcc.c                       |  8 ++++++++
 loaders.c                   |  1 +
 project.h                   |  4 ++++
 user.filter                 |  3 ++-
 8 files changed, 47 insertions(+), 7 deletions(-)

diff --git a/default.filter b/default.filter
index 157f394..9815fea 100644
--- a/default.filter
+++ b/default.filter
@@ -57,7 +57,8 @@
 #     quoting.
 #
 # 'D' (Dynamic) allows the use of variables. Supported variables are:
-#     $host, $origin (the IP address the request came from), $path and $ur=
l.
+#     $host, $listen-address, $origin (the IP address the request came
+#     from), $path and $url.
 #
 #     Note that '$' is a bad choice as delimiter for dynamic filters as you
 #     might end up with unintended variables if you use a variable name
diff --git a/doc/source/user-manual.sgml b/doc/source/user-manual.sgml
index 79d8f06..4151b42 100644
--- a/doc/source/user-manual.sgml
+++ b/doc/source/user-manual.sgml
@@ -6773,8 +6773,10 @@ stupid-server.example.com/</screen>
 <para>
  The non-standard option letter <literal>D</literal> (dynamic) allows
  to use the variables $host, $origin (the IP address the request came from=
),
- $path and $url. They will be replaced with the value they refer to before
- the filter is executed.
+ $path, $url and $listen-address (the address on which Privoxy accepted the
+ client request. Example: 127.0.0.1:8118).
+ They will be replaced with the value they refer to before the filter
+ is executed.
 </para>
=20
 <para>
@@ -7531,9 +7533,10 @@ pre-defined filters for your convenience:
 </para>
 <para>
  External filters read the content from STDIN and write the rewritten
- content to STDOUT. The environment variables PRIVOXY_URL, PRIVOXY_PATH,
- PRIVOXY_HOST, PRIVOXY_ORIGIN can be used to get some details about the
- client request.
+ content to STDOUT.
+ The environment variables PRIVOXY_URL, PRIVOXY_PATH, PRIVOXY_HOST,
+ PRIVOXY_ORIGIN, PRIVOXY_LISTEN_ADDRESS can be used to get some details
+ about the client request.
 </para>
 <para>
  &my-app; will temporary store the content to filter in the
diff --git a/filters.c b/filters.c
index a9a6a57..d4cec75 100644
--- a/filters.c
+++ b/filters.c
@@ -935,6 +935,7 @@ pcrs_job *compile_dynamic_pcrs_job_list(const struct cl=
ient_state *csp, const st
       {"path",   csp->http->path,  1},
       {"host",   csp->http->host,  1},
       {"origin", csp->ip_addr_str, 1},
+      {"listen-address", csp->listen_addr_str, 1},
       {NULL,     NULL,             1}
    };
=20
@@ -1771,6 +1772,7 @@ static void set_privoxy_variables(const struct client=
_state *csp)
       { "PRIVOXY_PATH",   csp->http->path  },
       { "PRIVOXY_HOST",   csp->http->host  },
       { "PRIVOXY_ORIGIN", csp->ip_addr_str },
+      { "PRIVOXY_LISTEN_ADDRESS", csp->listen_addr_str },
    };
=20
    for (i =3D 0; i < SZ(env); i++)
diff --git a/jbsockets.c b/jbsockets.c
index 2338423..f339346 100644
--- a/jbsockets.c
+++ b/jbsockets.c
@@ -1221,6 +1221,7 @@ int accept_connection(struct client_state * csp, jb_s=
ocket fds[])
    int max_selected_socket;
    fd_set selected_fds;
    jb_socket fd;
+   size_t listen_addr_size;
=20
    c_length =3D sizeof(client);
=20
@@ -1348,6 +1349,25 @@ int accept_connection(struct client_state * csp, jb_=
socket fds[])
    csp->ip_addr_long =3D ntohl(client.sin_addr.s_addr);
 #endif /* def HAVE_RFC2553 */
=20
+   /*
+    * Save the name and port of the accepting socket for later lookup.
+    *
+    * The string needs space for strlen(...) + 7 characters:
+    * strlen(haddr[i]) + 1 (':') + 5 (port digits) + 1 ('\0')
+    */
+   listen_addr_size =3D strlen(csp->config->haddr[i]) + 7;
+   csp->listen_addr_str =3D malloc_or_die(listen_addr_size);
+   retval =3D snprintf(csp->listen_addr_str, listen_addr_size,
+      "%s:%d", csp->config->haddr[i], csp->config->hport[i]);
+   if ((-1 =3D=3D retval) || listen_addr_size <=3D retval)
+   {
+      log_error(LOG_LEVEL_ERROR,
+         "Server name (%s) and port number (%d) ASCII decimal representati=
on"
+         "don't fit into %d bytes",
+         csp->config->haddr[i], csp->config->hport[i], listen_addr_size);
+      return -1;
+   }
+
    return 1;
=20
 }
diff --git a/jcc.c b/jcc.c
index 9158ce4..082bb02 100644
--- a/jcc.c
+++ b/jcc.c
@@ -3992,6 +3992,12 @@ static void listen_loop(void)
          "Waiting for the next client connection. Currently active threads=
: %d",
          active_threads);
=20
+      /*
+       * This config may be outdated, but for accept_connection()
+       * it's fresh enough.
+       */
+      csp->config =3D config;
+
       if (!accept_connection(csp, bfds))
       {
          log_error(LOG_LEVEL_CONNECT, "accept failed: %E");
@@ -4051,6 +4057,7 @@ static void listen_loop(void)
             "Connection from %s on socket %d dropped due to ACL", csp->ip_=
addr_str, csp->cfd);
          close_socket(csp->cfd);
          freez(csp->ip_addr_str);
+         freez(csp->listen_addr_str);
          freez(csp_list);
          continue;
       }
@@ -4066,6 +4073,7 @@ static void listen_loop(void)
             strlen(TOO_MANY_CONNECTIONS_RESPONSE));
          close_socket(csp->cfd);
          freez(csp->ip_addr_str);
+         freez(csp->listen_addr_str);
          freez(csp_list);
          continue;
       }
diff --git a/loaders.c b/loaders.c
index a4fb897..1fdeabf 100644
--- a/loaders.c
+++ b/loaders.c
@@ -185,6 +185,7 @@ unsigned int sweep(void)
 #ifdef FEATURE_CLIENT_TAGS
          freez(csp->client_address);
 #endif
+         freez(csp->listen_addr_str);
          freez(csp->client_iob->buf);
          freez(csp->iob->buf);
          freez(csp->error_message);
diff --git a/project.h b/project.h
index 2ce66d8..9214137 100644
--- a/project.h
+++ b/project.h
@@ -927,6 +927,10 @@ struct client_state
    unsigned long ip_addr_long;
 #endif /* def HAVE_RFC2553 */
=20
+   /** The host name and port (as a string of the form '<hostname>:<port>')
+       of the server socket to which the client connected. */
+   char *listen_addr_str;
+
    /** The URL that was requested */
    struct http_request http[1];
=20
diff --git a/user.filter b/user.filter
index 98de1c6..976953c 100644
--- a/user.filter
+++ b/user.filter
@@ -63,7 +63,8 @@
 #     quoting.
 #
 # 'D' (Dynamic) allows the use of variables. Supported variables are:
-#     $host, $origin (the IP address the request came from), $path and $ur=
l.
+#     $host, $listen-address, $origin (the IP address the request came
+#     from), $path and $url.
 #
 #     Note that '$' is a bad choice as delimiter for dynamic filters as you
 #     might end up with unintended variables if you use a variable name
--=20
2.7.4


=46rom ecfd811117b9933220cc25053dc456e6a3e1c855 Mon Sep 17 00:00:00 2001
From: Fabian Keil <[email protected]>
Date: Tue, 24 May 2016 17:25:04 +0200
Subject: [PATCH 2/3] listen_loop(): Include the listen-address in the log
 message when logging new requests

Patch contributed by pursievro.
---
 jcc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/jcc.c b/jcc.c
index 082bb02..c200902 100644
--- a/jcc.c
+++ b/jcc.c
@@ -4054,7 +4054,8 @@ static void listen_loop(void)
       if (block_acl(NULL,csp))
       {
          log_error(LOG_LEVEL_CONNECT,
-            "Connection from %s on socket %d dropped due to ACL", csp->ip_=
addr_str, csp->cfd);
+            "Connection from %s on %s (socket %d) dropped due to ACL",
+            csp->ip_addr_str, csp->listen_addr_str, csp->cfd);
          close_socket(csp->cfd);
          freez(csp->ip_addr_str);
          freez(csp->listen_addr_str);
--=20
2.7.4


=46rom 605cee7378277a654ba5293cd969e7370e878a52 Mon Sep 17 00:00:00 2001
From: Fabian Keil <[email protected]>
Date: Tue, 24 May 2016 16:44:49 +0200
Subject: [PATCH 3/3] Add 'listen-address' client-header-tagger

---
 default.filter | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/default.filter b/default.filter
index 9815fea..d85a945 100644
--- a/default.filter
+++ b/default.filter
@@ -815,6 +815,16 @@ s@^\w*\s+.*\s+HTTP/\d\.\d\s*@IP-ADDRESS: $origin@D
=20
 ##########################################################################=
#######
 #
+# listen-address: Tags the request with the listen-address on which the re=
quest
+#                 came in.
+#
+##########################################################################=
#######
+CLIENT-HEADER-TAGGER: listen-address Tags the request with the listen-addr=
ess on which the request came in.
+
+s@^\w*\s+.*\s+HTTP/\d\.\d\s*@LISTEN-ADDRESS: $listen-address@D
+
+##########################################################################=
#######
+#
 # http-method: Tags the request with its HTTP method.
 #
 ##########################################################################=
#######
--=20
2.7.4


--MP_/knwWQo/VmRkfhHMkLhOumei--

--Sig_/87tQ8PrjI3zlKvmhfgMYuTR
Content-Type: application/pgp-signature
Content-Description: OpenPGP digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJXRHSeAAoJEGkYIpGLojccYb4P/2cKNNPcqeEt+0f2PPR/D5Kq
FrRKc/0JFS1Awwa/2x3AvxrjscQF5S7K1KkVyRmJoz17PvyT6BGnnPembBySMzW8
yOOfpsyEBhvt+47r3tB7YiVJ7Zu0TRWeCvlWUpbhOXZdinYkdo0q0pWRnWgVjydY
Ls8ui5ZyN72Mp4sx/lMMmwiaelyAd38+SZsDG6IuZD0hBBqf5iBh1xUfRV9sSCg5
RfjENErXoyJ08Ps92PJpnRMIknbCv/lsMsMKKjjy7r8gmwU+/kn+7u7b1D/B14oH
Dm1yrQheWIsHiXsuz7VJ7zyRgifI82zf8ebKB0q5nxFRgTqcRcRewLrFSPasLEHV
zLksNNrkiEh54IEatVp+AV+aMO0fDJbzYlQwEGEd+fNzMJ2ANDpfS8+33sQ/SKO/
usx6St7i7tQkj/1wlnLQbtF3lX5SFY7CxdZZDjyk9dVGTcsj9zUatMjERomx8/L+
+oAVpcff0N8wXvq5xzf/Q5lDSxjbYyx4Xx3Y9jjVlowXpz6l0imtgPc/9obqjav5
XogN8zJcjYaJkT25B50JT3gObqla8sOD9ixQf8oxL2JDfhPtR6GSRRaRFN9olgyc
7/CNfwP9Wq9ICK6WeyBFi1W25JzCdgfYiswJwogbE7cKXOud/6y2SKCiHd+qnaHK
hA3guIR7epCBHqQUNQWR
=s8Yw
-----END PGP SIGNATURE-----

--Sig_/87tQ8PrjI3zlKvmhfgMYuTR--


--===============1937658545816550634==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------
Mobile security can be enabling, not merely restricting. Employees who
bring their own devices (BYOD) to work are irked by the imposition of MDM
restrictions. Mobile Device Manager Plus allows you to control only the
apps on BYO-devices by containerizing them, leaving personal data untouched!
https://ad.doubleclick.net/ddm/clk/304595813;131938128;j
--===============1937658545816550634==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Ijbswa-developers mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ijbswa-developers

--===============1937658545816550634==--