static int cloudflare_modify_connection(request_rec *r) { conn_rec *c = r->connection; cloudflare_config_t *config = (cloudflare_config_t *) ap_get_module_config(r->server->module_config, &cloudflare_module); cloudflare_conn_t *conn; #ifdef REMOTEIP_OPTIMIZED apr_sockaddr_t temp_sa_buff; apr_sockaddr_t *temp_sa = &temp_sa_buff; #else apr_sockaddr_t *temp_sa; #endif apr_status_t rv; char *remote = (char *) apr_table_get(r->headers_in, config->header_name); char *proxy_ips = NULL; char *parse_remote; char *eos; unsigned char *addrbyte; void *internal = NULL; apr_pool_userdata_get((void*)&conn, "mod_cloudflare-conn", c->pool); if (conn) { if (remote && (strcmp(remote, conn->prior_remote) == 0)) { /* TODO: Recycle r-> overrides from previous request */ goto ditto_request_rec; } else { /* TODO: Revert connection from previous request */ c->client_addr = conn->orig_addr; c->client_ip = (char *) conn->orig_ip; } } if (!remote) { if (config->deny_all) { return 403; } return OK; } remote = apr_pstrdup(r->pool, remote); #ifdef REMOTEIP_OPTIMIZED memcpy(&temp_sa, c->client_addr, sizeof(temp_sa)); temp_sa->pool = r->pool; #else temp_sa = c->client_addr; #endif while (remote) { /* verify c->client_addr is trusted if there is a trusted proxy list */ if (config->proxymatch_ip) { int i; cloudflare_proxymatch_t *match; match = (cloudflare_proxymatch_t *)config->proxymatch_ip->elts; for (i = 0; i < config->proxymatch_ip->nelts; ++i) { if (apr_ipsubnet_test(match[i].ip, c->client_addr)) { internal = match[i].internal; break; } } if (i && i >= config->proxymatch_ip->nelts) { if (config->deny_all) { return 403; } else { break; } } } if ((parse_remote = strrchr(remote, ',')) == NULL) { parse_remote = remote; remote = NULL; } else { *(parse_remote++) = '\0'; } while (*parse_remote == ' ') ++parse_remote; eos = parse_remote + strlen(parse_remote) - 1; while (eos >= parse_remote && *eos == ' ') *(eos--) = '\0'; if (eos < parse_remote) { if (remote) *(remote + strlen(remote)) = ','; else remote = parse_remote; break; } #ifdef REMOTEIP_OPTIMIZED /* Decode client_addr - sucks; apr_sockaddr_vars_set isn't 'public' */ if (inet_pton(AF_INET, parse_remote, &temp_sa_buff->sa.sin.sin_addr) > 0) { apr_sockaddr_vars_set(temp_sa, APR_INET, temp_sa.port); } #if APR_HAVE_IPV6 else if (inet_pton(AF_INET6, parse_remote, &temp_sa->sa.sin6.sin6_addr) > 0) { apr_sockaddr_vars_set(temp_sa, APR_INET6, temp_sa.port); } #endif else { rv = apr_get_netos_error(); #else /* !REMOTEIP_OPTIMIZED */ /* We map as IPv4 rather than IPv6 for equivilant host names * or IPV4OVERIPV6 */ rv = apr_sockaddr_info_get(&temp_sa, parse_remote, APR_UNSPEC, temp_sa->port, APR_IPV4_ADDR_OK, r->pool); if (rv != APR_SUCCESS) { #endif ap_log_rerror(APLOG_MARK, APLOG_DEBUG, rv, r, "RemoteIP: Header %s value of %s cannot be parsed " "as a client IP", config->header_name, parse_remote); if (remote) *(remote + strlen(remote)) = ','; else remote = parse_remote; break; } addrbyte = (unsigned char *) &temp_sa->sa.sin.sin_addr; /* For intranet (Internal proxies) ignore all restrictions below */ if (!internal && ((temp_sa->family == APR_INET /* For internet (non-Internal proxies) deny all * RFC3330 designated local/private subnets: * 10.0.0.0/8 169.254.0.0/16 192.168.0.0/16 * 127.0.0.0/8 172.16.0.0/12 */ && (addrbyte[0] == 10 || addrbyte[0] == 127 || (addrbyte[0] == 169 && addrbyte[1] == 254) || (addrbyte[0] == 172 && (addrbyte[1] & 0xf0) == 16) || (addrbyte[0] == 192 && addrbyte[1] == 168))) #if APR_HAVE_IPV6 || (temp_sa->family == APR_INET6 /* For internet (non-Internal proxies) we translated * IPv4-over-IPv6-mapped addresses as IPv4, above. * Accept only Global Unicast 2000::/3 defined by RFC4291 */ && ((temp_sa->sa.sin6.sin6_addr.s6_addr[0] & 0xe0) != 0x20)) #endif )) { ap_log_rerror(APLOG_MARK, APLOG_DEBUG, rv, r, "RemoteIP: Header %s value of %s appears to be " "a private IP or nonsensical. Ignored", config->header_name, parse_remote); if (remote) *(remote + strlen(remote)) = ','; else remote = parse_remote; break; } if (!conn) { conn = (cloudflare_conn_t *) apr_palloc(c->pool, sizeof(*conn)); apr_pool_userdata_set(conn, "mod_cloudflare-conn", NULL, c->pool); conn->orig_addr = c->client_addr; conn->orig_ip = c->client_ip; } /* Set client_ip string */ if (!internal) { if (proxy_ips) proxy_ips = apr_pstrcat(r->pool, proxy_ips, ", ", c->client_ip, NULL); else proxy_ips = c->client_ip; } c->client_addr = temp_sa; apr_sockaddr_ip_get(&c->client_ip, c->client_addr); } /* Nothing happened? */ if (!conn || (c->client_addr == conn->orig_addr)) return OK; /* Fixups here, remote becomes the new Via header value, etc * In the heavy operations above we used request scope, to limit * conn pool memory growth on keepalives, so here we must scope * the final results to the connection pool lifetime. * To limit memory growth, we keep recycling the same buffer * for the final apr_sockaddr_t in the remoteip conn rec. */ c->client_ip = apr_pstrdup(c->pool, c->client_ip); conn->proxied_ip = c->client_ip; r->useragent_ip = c->client_ip; r->useragent_addr = c->client_addr; memcpy(&conn->proxied_addr, &temp_sa, sizeof(temp_sa)); conn->proxied_addr.pool = c->pool; // Causing an error with mod_authz_host // c->client_addr = &conn->proxied_addr; if (remote) remote = apr_pstrdup(c->pool, remote); conn->proxied_remote = remote; conn->prior_remote = apr_pstrdup(c->pool, apr_table_get(r->headers_in, config->header_name)); if (proxy_ips) proxy_ips = apr_pstrdup(c->pool, proxy_ips); conn->proxy_ips = proxy_ips; /* Unset remote_host string DNS lookups */ c->remote_host = NULL; c->remote_logname = NULL; ditto_request_rec: // Why do we unset the headers here? //if (conn->proxied_remote) { // apr_table_setn(r->headers_in, config->header_name, conn->proxied_remote); //} else { // apr_table_unset(r->headers_in, config->header_name); // } if (conn->proxy_ips) { apr_table_setn(r->notes, "cloudflare-proxy-ip-list", conn->proxy_ips); if (config->proxies_header_name) apr_table_setn(r->headers_in, config->proxies_header_name, conn->proxy_ips); } ap_log_rerror(APLOG_MARK, APLOG_INFO|APLOG_NOERRNO, 0, r, conn->proxy_ips ? "Using %s as client's IP by proxies %s" : "Using %s as client's IP by internal proxies", conn->proxied_ip, conn->proxy_ips); return OK; } static const command_rec cloudflare_cmds[] = { AP_INIT_TAKE1("CloudFlareRemoteIPHeader", header_name_set, NULL, RSRC_CONF, "Specifies a request header to trust as the client IP, " "Overrides the default of CF-Connecting-IP"), AP_INIT_ITERATE("CloudFlareRemoteIPTrustedProxy", proxies_set, 0, RSRC_CONF, "Specifies one or more proxies which are trusted " "to present IP headers. Overrides the defaults."), AP_INIT_NO_ARGS("DenyAllButCloudFlare", deny_all_set, NULL, RSRC_CONF, "Return a 403 status to all requests which do not originate from " "a CloudFlareRemoteIPTrustedProxy."), { NULL } }; static void register_hooks(apr_pool_t *p) { // We need to run very early so as to not trip up mod_security. // Hence, this little trick, as mod_security runs at APR_HOOK_REALLY_FIRST. ap_hook_post_read_request(cloudflare_modify_connection, NULL, NULL, APR_HOOK_REALLY_FIRST - 10); }
return (NULL); } #endif /* DEBUG */ static const command_rec ipp_cmds[] = { AP_INIT_TAKE1("ipp-conformance", ipp_conformance, NULL, ACCESS_CONF, "IPP protocol conformance (loose/strict)"), AP_INIT_TAKE2("ipp-operation", ipp_operation, NULL, ACCESS_CONF, "IPP protocol operations to enable/disable)"), AP_INIT_TAKE1("ipp-default-user", ipp_default_user, NULL, ACCESS_CONF, "default user for various operations"), AP_INIT_TAKE1("ipp-default-service", ipp_default_svc, NULL, ACCESS_CONF, "default service for various operations"), #ifdef DEBUG AP_INIT_NO_ARGS("ipp-module-hang", ipp_module_hang, NULL, ACCESS_CONF, "hang the module until we can attach a debugger (no args)"), #endif { NULL } }; #ifdef APACHE2 /*ARGSUSED0*/ static const char * ipp_method(const request_rec *r) { return ("ipp"); } /*ARGSUSED0*/ static unsigned short ipp_port(const request_rec *r)
"DomainTreeCache", domaintree_init_cache, NULL, RSRC_CONF, "DomainTree server-wide host to directory cache; specify how many cache entries to allow (default: 0 = turned off)" ), AP_INIT_ITERATE( "DomainTreeIgnore", domaintree_init_ignore, NULL, RSRC_CONF, "DomainTree ignored hosts; uses the same matching alogrithm like DomainTreeAlias" ), AP_INIT_ITERATE( "DomainTreeForbid", domaintree_init_forbid, NULL, RSRC_CONF, "DomanTree forbidden hosts; uses the same matching algorithm like DomainTreeAlias" ), AP_INIT_NO_ARGS( "DomainTreeSuexec", domaintree_init_suexec, NULL, ACCESS_CONF, "DomainTree user home directory; enable suexec hook for domain based user-dir hosting in this directory" ), { NULL } }; /* }}} */ /* {{{ Module Administrativa */ module AP_MODULE_DECLARE_DATA domaintree_module = { STANDARD20_MODULE_STUFF, NULL, /* create per-dir */ NULL, /* merge per-dir */ domaintree_create_srv, /* create per-server */ domaintree_merge_srv, /* merge per-server */ domaintree_commands, /* config commands */