| 33 | } // end anonymous namespace |
| 34 | |
| 35 | bool |
| 36 | HttpSessionAccept::accept(NetVConnection *netvc, MIOBuffer *iobuf, IOBufferReader *reader) |
| 37 | { |
| 38 | sockaddr const *client_ip = nullptr; |
| 39 | IpAllow::ACL acl; |
| 40 | ip_port_text_buffer ipb; |
| 41 | |
| 42 | for (int i = 0; i < IpAllow::Subject::MAX_SUBJECTS; ++i) { |
| 43 | if (IpAllow::Subject::PEER == IpAllow::subjects[i]) { |
| 44 | client_ip = netvc->get_remote_addr(); |
| 45 | break; |
| 46 | } else if (IpAllow::Subject::PROXY == IpAllow::subjects[i] && |
| 47 | netvc->get_proxy_protocol_version() != ProxyProtocolVersion::UNDEFINED) { |
| 48 | client_ip = netvc->get_proxy_protocol_src_addr(); |
| 49 | break; |
| 50 | } |
| 51 | } |
| 52 | |
| 53 | if (client_ip == nullptr) { |
| 54 | // Use addresses from peer if none of the configured sources are avaialable |
| 55 | client_ip = netvc->get_remote_addr(); |
| 56 | } |
| 57 | |
| 58 | if (ats_is_ip(client_ip)) { |
| 59 | acl = IpAllow::match(client_ip, IpAllow::SRC_ADDR); |
| 60 | if (!acl.isValid()) { // if there's no ACL, it's a hard deny. |
| 61 | Warning("client '%s' prohibited by ip-allow policy", ats_ip_ntop(client_ip, ipb, sizeof(ipb))); |
| 62 | return false; |
| 63 | } |
| 64 | } else { |
| 65 | // If IP address is not available (e.g. UDS), IP-based ACLs are not relevant |
| 66 | acl = IpAllow::makeAllowAllACL(); |
| 67 | } |
| 68 | |
| 69 | // Set the transport type if not already set |
| 70 | if (HttpProxyPort::TRANSPORT_NONE == netvc->attributes) { |
| 71 | netvc->attributes = transport_type; |
| 72 | } |
| 73 | |
| 74 | if (dbg_ctl_http_seq.on()) { |
| 75 | Dbg(dbg_ctl_http_seq, "[HttpSessionAccept:mainEvent %p] accepted connection from %s transport type = %d", netvc, |
| 76 | ats_ip_nptop(client_ip, ipb, sizeof(ipb)), netvc->attributes); |
| 77 | } |
| 78 | |
| 79 | Http1ClientSession *new_session = THREAD_ALLOC_INIT(http1ClientSessionAllocator, this_ethread()); |
| 80 | |
| 81 | new_session->accept_options = static_cast<Options *>(this); |
| 82 | new_session->acl = std::move(acl); |
| 83 | |
| 84 | // Pin session to current ET_NET thread |
| 85 | new_session->setThreadAffinity(this_ethread()); |
| 86 | new_session->new_connection(netvc, iobuf, reader); |
| 87 | |
| 88 | return true; |
| 89 | } |
| 90 | |
| 91 | int |
| 92 | HttpSessionAccept::mainEvent(int event, void *data) |
no test coverage detected