Author: Wolfgang Nothdurft <wolfgang@linogate.de>

Bug 2731: Add follow_x_forwarded_for support to ICAP

Pass the indirect client address to the ICAP server using X-Client-IP.

diff --git a/src/adaptation/Config.h b/src/adaptation/Config.h
index 711dcc96ef80ca078d81a6063b1bd8021ccb5c69..d35da51817b94359e8f763c7669eaec1be9e774b 100644 (file)
--- a/src/adaptation/Config.h
+++ b/src/adaptation/Config.h
@@ -39,6 +39,7 @@ public:
     int send_client_username;
     int service_failure_limit;
     int service_revival_delay;
+    int icap_uses_indirect_client;
 
     Vector<ServiceConfig*> serviceConfigs;
 

diff --git a/src/adaptation/icap/ModXact.cc b/src/adaptation/icap/ModXact.cc
index 42f05709fa33156c6fc891cf6d862170a6648f23..bddee51219b60c2e667bd3d2d8c539deb8daff8b 100644 (file)
--- a/src/adaptation/icap/ModXact.cc
+++ b/src/adaptation/icap/ModXact.cc
@@ -1249,9 +1249,17 @@ void Adaptation::Icap::ModXact::makeRequestHeaders(MemBuf &buf)
             virginBodySending.plan();
     }
 
-    if (TheConfig.send_client_ip && request)
-        if (!request->client_addr.IsAnyAddr() && !request->client_addr.IsNoAddr())
-            buf.Printf("X-Client-IP: %s\r\n", request->client_addr.NtoA(ntoabuf,MAX_IPSTRLEN));
+    if (TheConfig.send_client_ip && request) {
+        IpAddress client_addr;
+#if FOLLOW_X_FORWARDED_FOR
+        if (TheConfig.icap_uses_indirect_client) {
+            client_addr = request->indirect_client_addr;
+        } else
+#endif
+            client_addr = request->client_addr;
+        if (!client_addr.IsAnyAddr() && !client_addr.IsNoAddr())
+            buf.Printf("X-Client-IP: %s\r\n", client_addr.NtoA(ntoabuf,MAX_IPSTRLEN));
+    }
 
     if (TheConfig.send_client_username && request)
         makeUsernameHeader(request, buf);

diff --git a/src/cf.data.pre b/src/cf.data.pre
index 5bcc7182f6fd910a53c9e155849db44791d5a9be..2412d741194477cf7c9c6adf0e941d2fd7b4de76 100644 (file)
--- a/src/cf.data.pre
+++ b/src/cf.data.pre
@@ -750,10 +750,10 @@ DOC_START
 
        The end result of this process is an IP address that we will
        refer to as the indirect client address.  This address may
-       be treated as the client address for access control, delay
+       be treated as the client address for access control, ICAP, delay
        pools and logging, depending on the acl_uses_indirect_client,
-       delay_pool_uses_indirect_client and log_uses_indirect_client
-       options.
+       icap_uses_indirect_client, delay_pool_uses_indirect_client and
+       log_uses_indirect_client options.
 
        This clause only supports fast acl types.
        See http://wiki.squid-cache.org/SquidFaq/SquidAcl for details.
@@ -3563,6 +3563,19 @@ Example:
  broken_posts allow buggy_server
 DOC_END
 
+NAME: icap_uses_indirect_client
+COMMENT: on|off
+TYPE: onoff
+IFDEF: FOLLOW_X_FORWARDED_FOR
+DEFAULT: on
+LOC: Adaptation::Icap::TheConfig.icap_uses_indirect_client
+DOC_START
+   Controls whether the indirect client address
+   (see follow_x_forwarded_for) instead of the
+   direct client address is passed to an ICAP
+   server as "X-Client-IP".
+DOC_END
+
 NAME: via
 IFDEF: HTTP_VIOLATIONS
 COMMENT: on|off

diff --git a/src/client_side_request.cc b/src/client_side_request.cc
index 318cc174aa021292ebef56bc0d05aa01bb6c6c39..d46353d72b002bacfac18cefad1b4d47b9a89af1 100644 (file)
--- a/src/client_side_request.cc
+++ b/src/client_side_request.cc
@@ -399,13 +399,13 @@ ClientRequestContext::httpStateIsValid()
 
 #if FOLLOW_X_FORWARDED_FOR
 /**
- * clientFollowXForwardedForCheck() checks the content of X-Forwarded-For: 
+ * clientFollowXForwardedForCheck() checks the content of X-Forwarded-For:
  * against the followXFF ACL, or cleans up and passes control to
  * clientAccessCheck().
  *
  * The trust model here is a little ambiguous. So to clarify the logic:
  * - we may always use the direct client address as the client IP.
- * - these trust tests merey tell whether we trust given IP enough to believe the 
+ * - these trust tests merey tell whether we trust given IP enough to believe the
  *   IP string which it appended to the X-Forwarded-For: header.
  * - if at any point we don't trust what an IP adds we stop looking.
  * - at that point the current contents of indirect_client_addr are the value set