From 09177554bf39daf5f146659e621d8b393aee8445 Mon Sep 17 00:00:00 2001
From: Jonathan Bennett <jbennett@incomsystems.biz>
Date: Sat, 9 Apr 2016 11:03:16 -0500
Subject: [PATCH] Adds configuration option for X-Forwarded-For

---
 server/cmd_opts.h       | 1 +
 server/config_init.c    | 4 ++++
 server/fwknopd.conf     | 5 +++++
 server/fwknopd_common.h | 2 ++
 server/incoming_spa.c   | 2 +-
 5 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/server/cmd_opts.h b/server/cmd_opts.h
index b0b6646d..9986bd09 100644
--- a/server/cmd_opts.h
+++ b/server/cmd_opts.h
@@ -79,6 +79,7 @@ static char *config_map[NUMBER_OF_CONFIG_ENTRIES] = {
     //"EXTERNAL_CMD_ALARM",
     //"ENABLE_EXT_CMD_PREFIX",
     //"EXT_CMD_PREFIX",
+    "ENABLE_X_FORWARDED_FOR",
     "ENABLE_DESTINATION_RULE",
     "ENABLE_RULE_PREPEND",
     "ENABLE_NAT_DNS",
diff --git a/server/config_init.c b/server/config_init.c
index a7c436d1..ec653def 100644
--- a/server/config_init.c
+++ b/server/config_init.c
@@ -879,6 +879,10 @@ validate_options(fko_srv_options_t *opts)
 
 #endif /* FIREWALL type */
 
+    /* Disallow ENABLE_X_FORWARDED_FOR by default*/
+    if(opts->config[CONF_ENABLE_X_FORWARDED_FOR] == NULL)
+        set_config_entry(opts, CONF_ENABLE_X_FORWARDED_FOR, DEF_ENABLE_X_FORWARDED_FOR);
+
     /* Prepend firewall rules*/
     if(opts->config[CONF_ENABLE_PREPEND] == NULL)
         set_config_entry(opts, CONF_ENABLE_PREPEND, DEF_ENABLE_PREPEND);
diff --git a/server/fwknopd.conf b/server/fwknopd.conf
index d788c48e..cecb03fb 100644
--- a/server/fwknopd.conf
+++ b/server/fwknopd.conf
@@ -147,6 +147,11 @@
 # Allow fwknopd to resolve hostnames in NAT access messages
 #ENABLE_NAT_DNS              Y;
 
+# Allows using the X-Forwarded-for header from a captured packet as the
+# Source IP.
+#
+#ENABLE_X_FORWARDED_FOR      N;
+
 # Instead of appending new firewall rules to the bottom of the chain, this
 # option inserts rules at the top of the chain.  This causes later rules
 # to have precedence over earlier rules.
diff --git a/server/fwknopd_common.h b/server/fwknopd_common.h
index 8814cb4e..0da28244 100644
--- a/server/fwknopd_common.h
+++ b/server/fwknopd_common.h
@@ -94,6 +94,7 @@
 #define DEF_RULES_CHECK_THRESHOLD       "20"
 #define DEF_MAX_SNIFF_BYTES             "1500"
 #define DEF_GPG_HOME_DIR                "/root/.gnupg"
+#define DEF_ENABLE_X_FORWARDED_FOR      "N"
 #define DEF_ENABLE_PREPEND              "N"
 #define DEF_ENABLE_NAT_DNS              "Y"
 #ifdef  GPG_EXE
@@ -279,6 +280,7 @@ enum {
     //CONF_EXTERNAL_CMD_ALARM,
     //CONF_ENABLE_EXT_CMD_PREFIX,
     //CONF_EXT_CMD_PREFIX,
+    CONF_ENABLE_X_FORWARDED_FOR,
     CONF_ENABLE_DESTINATION_RULE,
     CONF_ENABLE_PREPEND,
     CONF_ENABLE_NAT_DNS,
diff --git a/server/incoming_spa.c b/server/incoming_spa.c
index 52e2554a..c8c00015 100644
--- a/server/incoming_spa.c
+++ b/server/incoming_spa.c
@@ -108,7 +108,7 @@ preprocess_spa_data(const fko_srv_options_t *opts, spa_pkt_info_t *spa_pkt, spa_
 
         xff = strcasestr(ndx, "X-Forwarded-For: ");
 
-        if (xff != NULL) {
+        if (xff != NULL && strncasecmp(opts->config[CONF_ENABLE_X_FORWARDED_FOR], "Y", 1) == 0) {
             xff += 17;
 
             for (i = 0; *xff != '\0'; i++)