+++ /dev/null
-/*!
- * proxy-addr
- * Copyright(c) 2014 Douglas Christopher Wilson
- * MIT Licensed
- */
-
-/**
- * Module exports.
- */
-
-module.exports = proxyaddr;
-module.exports.all = alladdrs;
-module.exports.compile = compile;
-
-/**
- * Module dependencies.
- */
-
-var forwarded = require('forwarded');
-var ipaddr = require('ipaddr.js');
-
-/**
- * Variables.
- */
-
-var digitre = /^[0-9]+$/;
-var isip = ipaddr.isValid;
-var parseip = ipaddr.parse;
-
-/**
- * Pre-defined IP ranges.
- */
-
-var ipranges = {
- linklocal: ['169.254.0.0/16', 'fe80::/10'],
- loopback: ['127.0.0.1/8', '::1/128'],
- uniquelocal: ['10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16', 'fc00::/7']
-};
-
-/**
- * Get all addresses in the request, optionally stopping
- * at the first untrusted.
- *
- * @param {Object} request
- * @param {Function|Array|String} [trust]
- * @api public
- */
-
-function alladdrs(req, trust) {
- // get addresses
- var addrs = forwarded(req);
-
- if (!trust) {
- // Return all addresses
- return addrs;
- }
-
- if (typeof trust !== 'function') {
- trust = compile(trust);
- }
-
- for (var i = 0; i < addrs.length - 1; i++) {
- if (trust(addrs[i], i)) continue;
-
- addrs.length = i + 1;
- }
-
- return addrs;
-}
-
-/**
- * Compile argument into trust function.
- *
- * @param {Array|String} val
- * @api private
- */
-
-function compile(val) {
- if (!val) {
- throw new TypeError('argument is required');
- }
-
- var trust = typeof val === 'string'
- ? [val]
- : val;
-
- if (!Array.isArray(trust)) {
- throw new TypeError('unsupported trust argument');
- }
-
- for (var i = 0; i < trust.length; i++) {
- val = trust[i];
-
- if (!ipranges.hasOwnProperty(val)) {
- continue;
- }
-
- // Splice in pre-defined range
- val = ipranges[val];
- trust.splice.apply(trust, [i, 1].concat(val));
- i += val.length - 1;
- }
-
- return compileTrust(compileRangeSubnets(trust));
-}
-
-/**
- * Compile `arr` elements into range subnets.
- *
- * @param {Array} arr
- * @api private
- */
-
-function compileRangeSubnets(arr) {
- var rangeSubnets = new Array(arr.length);
-
- for (var i = 0; i < arr.length; i++) {
- rangeSubnets[i] = parseipNotation(arr[i]);
- }
-
- return rangeSubnets;
-}
-
-/**
- * Compile range subnet array into trust function.
- *
- * @param {Array} rangeSubnets
- * @api private
- */
-
-function compileTrust(rangeSubnets) {
- // Return optimized function based on length
- var len = rangeSubnets.length;
- return len === 0
- ? trustNone
- : len === 1
- ? trustSingle(rangeSubnets[0])
- : trustMulti(rangeSubnets);
-}
-
-/**
- * Parse IP notation string into range subnet.
- *
- * @param {String} note
- * @api private
- */
-
-function parseipNotation(note) {
- var ip;
- var kind;
- var max;
- var pos = note.lastIndexOf('/');
- var range;
-
- ip = pos !== -1
- ? note.substring(0, pos)
- : note;
-
- if (!isip(ip)) {
- throw new TypeError('invalid IP address: ' + ip);
- }
-
- ip = parseip(ip);
-
- kind = ip.kind();
- max = kind === 'ipv6'
- ? 128
- : 32;
-
- range = pos !== -1
- ? note.substring(pos + 1, note.length)
- : max;
-
- if (typeof range !== 'number') {
- range = digitre.test(range)
- ? parseInt(range, 10)
- : isip(range)
- ? parseNetmask(range)
- : 0;
- }
-
- if (ip.kind() === 'ipv6' && ip.isIPv4MappedAddress()) {
- // Store as IPv4
- ip = ip.toIPv4Address();
- range = range <= max
- ? range - 96
- : range;
- }
-
- if (range <= 0 || range > max) {
- throw new TypeError('invalid range on address: ' + note);
- }
-
- return [ip, range];
-}
-
-/**
- * Parse netmask string into CIDR range.
- *
- * @param {String} note
- * @api private
- */
-
-function parseNetmask(netmask) {
- var ip = parseip(netmask);
- var parts;
- var size;
-
- switch (ip.kind()) {
- case 'ipv4':
- parts = ip.octets;
- size = 8;
- break;
- case 'ipv6':
- parts = ip.parts;
- size = 16;
- break;
- }
-
- var max = Math.pow(2, size) - 1;
- var part;
- var range = 0;
-
- for (var i = 0; i < parts.length; i++) {
- part = parts[i] & max;
-
- if (part === max) {
- range += size;
- continue;
- }
-
- while (part) {
- part = (part << 1) & max;
- range += 1;
- }
-
- break;
- }
-
- return range;
-}
-
-/**
- * Determine address of proxied request.
- *
- * @param {Object} request
- * @param {Function|Array|String} trust
- * @api public
- */
-
-function proxyaddr(req, trust) {
- if (!req) {
- throw new TypeError('req argument is required');
- }
-
- if (!trust) {
- throw new TypeError('trust argument is required');
- }
-
- var addrs = alladdrs(req, trust);
- var addr = addrs[addrs.length - 1];
-
- return addr;
-}
-
-/**
- * Static trust function to trust nothing.
- *
- * @api private
- */
-
-function trustNone() {
- return false;
-}
-
-/**
- * Compile trust function for multiple subnets.
- *
- * @param {Array} subnets
- * @api private
- */
-
-function trustMulti(subnets) {
- return function trust(addr) {
- if (!isip(addr)) return false;
-
- var ip = parseip(addr);
- var ipv4;
- var kind = ip.kind();
- var subnet;
- var subnetip;
- var subnetkind;
- var subnetrange;
- var trusted;
-
- for (var i = 0; i < subnets.length; i++) {
- subnet = subnets[i];
- subnetip = subnet[0];
- subnetkind = subnetip.kind();
- subnetrange = subnet[1];
- trusted = ip;
-
- if (kind !== subnetkind) {
- if (kind !== 'ipv6' || subnetkind !== 'ipv4' || !ip.isIPv4MappedAddress()) {
- continue;
- }
-
- // Store addr as IPv4
- ipv4 = ipv4 || ip.toIPv4Address();
- trusted = ipv4;
- }
-
- if (trusted.match(subnetip, subnetrange)) return true;
- }
-
- return false;
- };
-}
-
-/**
- * Compile trust function for single subnet.
- *
- * @param {Object} subnet
- * @api private
- */
-
-function trustSingle(subnet) {
- var subnetip = subnet[0];
- var subnetkind = subnetip.kind();
- var subnetisipv4 = subnetkind === 'ipv4';
- var subnetrange = subnet[1];
-
- return function trust(addr) {
- if (!isip(addr)) return false;
-
- var ip = parseip(addr);
- var kind = ip.kind();
-
- return kind === subnetkind
- ? ip.match(subnetip, subnetrange)
- : subnetisipv4 && kind === 'ipv6' && ip.isIPv4MappedAddress()
- ? ip.toIPv4Address().match(subnetip, subnetrange)
- : false;
- };
-}
Code Review / sdnc / oam.git / blobdiff