add rfc1918 filter check

[project/uhttpd.git] / client.c

diff --git a/client.c b/client.c
index 483a1a4..3dc40e8 100644 (file)
--- a/client.c
+++ b/client.c
@@ -59,7 +59,7 @@ void uh_http_header(struct client *cl, int code, const char *summary)
 
 static void uh_connection_close(struct client *cl)
 {
-       cl->state = CLIENT_STATE_DONE;
+       cl->state = CLIENT_STATE_CLOSE;
        cl->us->eof = true;
        ustream_state_change(cl->us);
 }
@@ -172,25 +172,45 @@ static bool client_init_cb(struct client *cl, char *buf, int len)
        return true;
 }
 
+static bool rfc1918_filter_check(struct client *cl)
+{
+       if (!conf.rfc1918_filter)
+               return true;
+
+       if (!uh_addr_rfc1918(&cl->peer_addr) || uh_addr_rfc1918(&cl->srv_addr))
+               return true;
+
+       uh_client_error(cl, 403, "Forbidden",
+                       "Rejected request from RFC1918 IP "
+                       "to public server address");
+       return false;
+}
+
 static void client_header_complete(struct client *cl)
 {
+       if (!rfc1918_filter_check(cl))
+               return;
+
        uh_handle_request(cl);
 }
 
-static int client_parse_header(struct client *cl, char *data)
+static void client_parse_header(struct client *cl, char *data)
 {
        char *name;
        char *val;
 
        if (!*data) {
                uloop_timeout_cancel(&cl->timeout);
+               cl->state = CLIENT_STATE_DATA;
                client_header_complete(cl);
-               return CLIENT_STATE_DATA;
+               return;
        }
 
        val = uh_split_header(data);
-       if (!val)
-               return CLIENT_STATE_DONE;
+       if (!val) {
+               cl->state = CLIENT_STATE_DONE;
+               return;
+       }
 
        for (name = data; *name; name++)
                if (isupper(*name))
@@ -198,7 +218,7 @@ static int client_parse_header(struct client *cl, char *data)
 
        blobmsg_add_string(&cl->hdr, data, val);
 
-       return CLIENT_STATE_HEADER;
+       cl->state = CLIENT_STATE_HEADER;
 }
 
 static bool client_data_cb(struct client *cl, char *buf, int len)
@@ -216,7 +236,7 @@ static bool client_header_cb(struct client *cl, char *buf, int len)
                return false;
 
        *newline = 0;
-       cl->state = client_parse_header(cl, buf);
+       client_parse_header(cl, buf);
        line_len = newline + 2 - buf;
        ustream_consume(cl->us, line_len);
        if (cl->state == CLIENT_STATE_DATA)
@@ -286,9 +306,30 @@ static void client_notify_state(struct ustream *s)
 {
        struct client *cl = container_of(s, struct client, sfd);
 
-       if (cl->state == CLIENT_STATE_CLOSE ||
-               (s->eof && !s->w.data_bytes) || s->write_error)
-               return client_close(cl);
+       if (!s->write_error) {
+               if (cl->state == CLIENT_STATE_DATA)
+                       return;
+
+               if (!s->eof || s->w.data_bytes)
+                       return;
+       }
+
+       return client_close(cl);
+}
+
+static void set_addr(struct uh_addr *addr, void *src)
+{
+       struct sockaddr_in *sin = src;
+       struct sockaddr_in6 *sin6 = src;
+
+       addr->family = sin->sin_family;
+       if (addr->family == AF_INET) {
+               addr->port = ntohs(sin->sin_port);
+               memcpy(&addr->in, &sin->sin_addr, sizeof(addr->in));
+       } else {
+               addr->port = ntohs(sin6->sin6_port);
+               memcpy(&addr->in6, &sin6->sin6_addr, sizeof(addr->in6));
+       }
 }
 
 void uh_accept_client(int fd)
@@ -298,19 +339,22 @@ void uh_accept_client(int fd)
        unsigned int sl;
        int sfd;
        static int client_id = 0;
+       struct sockaddr_in6 addr;
 
        if (!next_client)
                next_client = calloc(1, sizeof(*next_client));
 
        cl = next_client;
 
-       sl = sizeof(cl->peeraddr);
-       sfd = accept(fd, (struct sockaddr *) &cl->peeraddr, &sl);
+       sl = sizeof(addr);
+       sfd = accept(fd, (struct sockaddr *) &addr, &sl);
        if (sfd < 0)
                return;
 
-       sl = sizeof(cl->servaddr);
-       getsockname(fd, (struct sockaddr *) &cl->servaddr, &sl);
+       set_addr(&cl->peer_addr, &addr);
+       sl = sizeof(addr);
+       getsockname(fd, (struct sockaddr *) &addr, &sl);
+       set_addr(&cl->srv_addr, &addr);
        cl->us = &cl->sfd.stream;
        cl->us->string_data = true;
        cl->us->notify_read = client_ustream_read_cb;