manage real client IP behind nginx https termination

[brisk.git] / web / Obj / sac-a-push.phh

diff --git a/web/Obj/sac-a-push.phh b/web/Obj/sac-a-push.phh
index a3fe932..3771d4d 100644 (file)
--- a/web/Obj/sac-a-push.phh
+++ b/web/Obj/sac-a-push.phh
@@ -35,7 +35,7 @@ $_globals_list = array(
 'G_admin_mail', 'G_alarm_passwd', 'G_all_points', 'G_ban_list', 'G_base',
 'G_black_list', 'G_brisk_version', 'G_btrace_pref_sub', 'G_cloud_smasher',
 'G_crypt_key', 'G_dbasetype', 'G_dbauth', 'G_dbpfx', 'G_doc_path',
-'G_domain', 'G_donors_all', 'G_donors_cur', 'G_is_local', 'G_lang', 'G_lng',
+'G_proto', 'G_domain', 'G_donors_all', 'G_donors_cur', 'G_is_local', 'G_lang', 'G_lng',
 'G_mail_seed', 'G_notguar_code', 'G_PG_cons', 'G_PG_cons_n', 'G_PG_vow',
 'G_PG_vow_n', 'G_poll_entries', 'G_poll_name', 'G_poll_title',
 'G_provider_proxy', 'G_proxy_white_list', 'G_room_about', 'G_room_help',
@@ -571,7 +571,7 @@ class Sac_a_push {
 
     function pendpage_try_addcont(&$new_socket, $tout, $method, $header, $get, $post, $cookie, $path, $addr, $rest, $cont)
     {
-        $pendpage = PendingPage::pendingpage_continue(&$new_socket, $this->curtime, $tout, $method,
+        $pendpage = PendingPage::pendingpage_continue( $new_socket, $this->curtime, $tout, $method,
                                                            $header,           $get, $post, $cookie,
                                                              $path,          $addr, $rest, $cont);
 
@@ -631,14 +631,18 @@ class Sac_a_push {
         foreach ($this->socks as $k => $sock) {
             $id = intval($sock);
             if (isset($this->s2u[$id])) {
-                if ($this->s2u[$id]->the_end) {
-                    if ($this->s2u[$id]->rd_socket_get() != NULL) {
-                        $this->s2u[$id]->rd_socket_set(NULL);
+                $user = $this->s2u[$id];
+                if ($user->the_end) {
+                    if (($user->rd_toflush == FALSE && $user->rd_step == $user->step)
+                        || $user->rd_endtime_is_expired($this->curtime)) {
+                        if ($user->rd_socket_get() != NULL) {
+                            $user->rd_socket_set(NULL);
+                        }
+                        unset($this->socks[$id]);
+                        unset($this->s2u[$id]);
+                        fclose($sock);
+                        printf("CLOSE ON GARBAGE MANAGER\n");
                     }
-                    unset($this->socks[$id]);
-                    unset($this->s2u[$id]);
-                    fclose($sock);
-                    printf("CLOSE ON GARBAGE MANAGER\n");
                 }
             }
         }
@@ -746,15 +750,25 @@ class Sac_a_push {
                         if (($new_socket = ancillary_getstream($new_unix, $stream_info)) !== FALSE) {
                             printf("NEW_SOCKET: %d\n", intval($new_socket));
                             stream_set_blocking($new_socket, $this->blocking_mode); // Set the stream to non-blocking
-                            printf("RECEIVED HEADER:\n%s", $stream_info);
+                            // error_log(sprintf("RECEIVED HEADER:\n%s", $stream_info));
                             if (($path = spu_process_info($stream_info, $method, $header,
                                                           $get, $post, $cookie, $rest, $cont))
                                 == FALSE) {
                                 fprintf(STDERR, "TODO: fix wrong header management\n");
                             }
-                            $addr_full = stream_socket_get_name($new_socket, TRUE);
+
+                            // We try to get real IP from header (passed by proxy) and then fallback to direct connection IP
+                            // error_log(sprintf("addr: [%s]", $addr));
+                            // error_log(sprintf("X-Real-Ip: [%s]", array_key_exists('X-Real-Ip', $header) ? $header['X-Real-Ip'] : "Not exists"));
+                            if (array_key_exists('X-Real-Ip', $header)) {
+                                $addr = $header['X-Real-Ip'];
+                            }
+                            else {
+                                $addr = addrtoipv4(stream_socket_get_name($new_socket, TRUE));
+                            }
+
                             // FOR TEST $header['X-Forwarded-For'] = '154.155.22.33';
-                            $addr = $this->pproxy_realip($header, addrtoipv4($addr_full));
+                            $addr = $this->pproxy_realip($header, $addr);
 
                             printf("PATH: [%s] [%s]\n", $path, print_r($header, TRUE));
                             if ($method == "POST" && $rest > 0) {
@@ -1033,7 +1047,7 @@ class Sac_a_push {
                 return cmd_return(401, 'malformed cmd');
             }
             $idx = -1;
-            if (($user = $this->app->get_user($cmd['sess'], &$idx)) == FALSE)
+            if (($user = $this->app->get_user($cmd['sess'], $idx)) == FALSE)
                 return cmd_return(402, 'user not found');
 
             if (($user->flags & USER_FLAG_TY_ADMIN) == 0x00)