Reverse HTTP proxies enabled on sicket.io connections

diff --git a/server/config.js b/server/config.js
index a04d18b93146ff79e9050aa7012eaa5676e9d0af..f4b07bfa42432995c7383200f7b10ac90a653065 100644 (file)
--- a/server/config.js
+++ b/server/config.js
@@ -61,6 +61,9 @@ conf.ip_as_username = [
 
 
 
+// Whitelisted HTTP proxies
+conf.http_proxies = ["127.0.0.1"];
+
 // Enabled transports for the client to use
 conf.transports = [
     "websocket",

diff --git a/server/weblistener.js b/server/weblistener.js
index b02454241e94ba7074e11852f7e83a5572199cb2..33e93ba8c755400d56d15d5db5306cb0c3d9062d 100644 (file)
--- a/server/weblistener.js
+++ b/server/weblistener.js
@@ -70,9 +70,11 @@ var WebListener = function (web_config, transports) {
     this.ws.set('transports', transports);
     this.ws.set('resource', (config.get().http_base_path || '') + '/transport');
 
-    this.ws.of('/kiwi').authorization(authoriseConnection).on('connection', function () {
-        newConnection.apply(that, arguments);
-    });
+    this.ws.of('/kiwi').authorization(authoriseConnection)
+        .on('connection', function () {
+            newConnection.apply(that, arguments);
+        }
+    );
     this.ws.of('/kiwi').on('error', console.log);
 };
 util.inherits(WebListener, events.EventEmitter);
@@ -94,13 +96,29 @@ function handleHttpRequest(request, response) {
  * Used later on for webirc, etc functionality
  */
 function authoriseConnection(handshakeData, callback) {
-    dns.reverse(handshakeData.address.address, function (err, domains) {
+    var address = handshakeData.address.address;
+
+    // If a forwarded-for header is found, switch the source address
+    if (handshakeData.headers['x-forwarded-for']) {
+        // Check we're connecting from a whitelisted proxy
+        if (!config.get().http_proxies || config.get().http_proxies.indexOf(address) < 0) {
+            console.log('Unlisted proxy:', address);
+            callback(null, false);
+            return;
+        }
+
+        // We're sent from a whitelisted proxy, replace the hosts
+        address = handshakeData.headers['x-forwarded-for'];
+    }
+
+    dns.reverse(address, function (err, domains) {
         if (err || domains.length === 0) {
-            handshakeData.revdns = handshakeData.address.address;
+            handshakeData.revdns = address;
         } else {
-            handshakeData.revdns = _.first(domains);
+            handshakeData.revdns = _.first(domains) || address;
         }
         
+        // All is well, authorise the connection
         callback(null, true);
     });
 }