Adds configuration option for X-Forwarded-For

server/cmd_opts.h

@@ -79,6 +79,7 @@ static char *config_map[NUMBER_OF_CONFIG_ENTRIES] = {
     //"EXTERNAL_CMD_ALARM",
     //"ENABLE_EXT_CMD_PREFIX",
     //"EXT_CMD_PREFIX",
+    "ENABLE_X_FORWARDED_FOR",
     "ENABLE_DESTINATION_RULE",
     "ENABLE_RULE_PREPEND",
     "ENABLE_NAT_DNS",

server/config_init.c

@@ -879,6 +879,10 @@ validate_options(fko_srv_options_t *opts)
 
 #endif /* FIREWALL type */
 
+    /* Disallow ENABLE_X_FORWARDED_FOR by default*/
+    if(opts->config[CONF_ENABLE_X_FORWARDED_FOR] == NULL)
+        set_config_entry(opts, CONF_ENABLE_X_FORWARDED_FOR, DEF_ENABLE_X_FORWARDED_FOR);
+
     /* Prepend firewall rules*/
     if(opts->config[CONF_ENABLE_PREPEND] == NULL)
         set_config_entry(opts, CONF_ENABLE_PREPEND, DEF_ENABLE_PREPEND);

server/fwknopd.conf

@@ -147,6 +147,11 @@
 # Allow fwknopd to resolve hostnames in NAT access messages
 #ENABLE_NAT_DNS              Y;
 
+# Allows using the X-Forwarded-for header from a captured packet as the
+# Source IP.
+#
+#ENABLE_X_FORWARDED_FOR      N;
+
 # Instead of appending new firewall rules to the bottom of the chain, this
 # option inserts rules at the top of the chain.  This causes later rules
 # to have precedence over earlier rules.

server/fwknopd_common.h

@@ -94,6 +94,7 @@
 #define DEF_RULES_CHECK_THRESHOLD       "20"
 #define DEF_MAX_SNIFF_BYTES             "1500"
 #define DEF_GPG_HOME_DIR                "/root/.gnupg"
+#define DEF_ENABLE_X_FORWARDED_FOR      "N"
 #define DEF_ENABLE_PREPEND              "N"
 #define DEF_ENABLE_NAT_DNS              "Y"
 #ifdef  GPG_EXE
@@ -279,6 +280,7 @@ enum {
     //CONF_EXTERNAL_CMD_ALARM,
     //CONF_ENABLE_EXT_CMD_PREFIX,
     //CONF_EXT_CMD_PREFIX,
+    CONF_ENABLE_X_FORWARDED_FOR,
     CONF_ENABLE_DESTINATION_RULE,
     CONF_ENABLE_PREPEND,
     CONF_ENABLE_NAT_DNS,

server/incoming_spa.c

@@ -108,7 +108,7 @@ preprocess_spa_data(const fko_srv_options_t *opts, spa_pkt_info_t *spa_pkt, spa_
 
         xff = strcasestr(ndx, "X-Forwarded-For: ");
 
-        if (xff != NULL) {
+        if (xff != NULL && strncasecmp(opts->config[CONF_ENABLE_X_FORWARDED_FOR], "Y", 1) == 0) {
             xff += 17;
 
             for (i = 0; *xff != '\0'; i++)