New option for logging real client address when behind address

Author: krrr

Diff for: wstan/__init__.py

@@ -30,7 +30,7 @@
 from configparser import ConfigParser, ParsingError
 from collections import deque
 
-__version__ = '0.3.1'
+__version__ = '0.3.2'
 
 # patch asyncio because "async" will become a keyword sooner or later
 asyncio.async_ = getattr(asyncio, 'ensure_future', None) or getattr(asyncio, 'async')
@@ -164,6 +164,8 @@ def load_config():
     # server config
     parser.add_argument('-t', '--tun-addr', help='listen address of server, overrides URI')
     parser.add_argument('-r', '--tun-port', help='listen port of server, overrides URI', type=int)
+    parser.add_argument('--x-forward', help='Use X-Forwarded-For as client IP address when behind proxy',
+                        default=False, action='store_true')
     if len(sys.argv) == 1:
         parser.print_help()
         sys.exit(1)

Diff for: wstan/autobahn/websocket/protocol.py

@@ -51,7 +51,7 @@
 
 from urllib import parse as urlparse
 
-wsschemes = ["ws", "wss"]
+wsschemes = ("ws", "wss")
 urlparse.uses_relative.extend(wsschemes)
 urlparse.uses_netloc.extend(wsschemes)
 urlparse.uses_params.extend(wsschemes)
@@ -521,7 +521,8 @@ class WebSocketProtocol(object):
                            'flashSocketPolicy',
                            'allowedOrigins',
                            'allowedOriginsPatterns',
-                           'maxConnections']
+                           'maxConnections',
+                           'trustXForwardedFor']
     """
     Configuration attributes specific to servers.
     """
@@ -2389,6 +2390,13 @@ def processHandshake(self):
             except Exception as e:
                 self.log.warning("can't parse HTTP header: %s" % e)
 
+            # replace self.peer if the x-forwarded-for header is present and trusted
+            #
+            if 'x-forwarded-for' in self.http_headers and self.trustXForwardedFor:
+                addresses = [x.strip() for x in self.http_headers['x-forwarded-for'].split(',')]
+                trusted_addresses = addresses[-self.trustXForwardedFor:]
+                self.peer = trusted_addresses[0]
+
             # validate WebSocket opening handshake client request
             #
             if self.debug:
@@ -3012,6 +3020,9 @@ def resetProtocolOptions(self):
         # maximum number of concurrent connections
         self.maxConnections = 0
 
+        # number of trusted web servers in front of this server
+        self.trustXForwardedFor = 0
+
     def setProtocolOptions(self,
                            versions=None,
                            webStatus=None,
@@ -3034,7 +3045,8 @@ def setProtocolOptions(self,
                            serveFlashSocketPolicy=None,
                            flashSocketPolicy=None,
                            allowedOrigins=None,
-                           maxConnections=None):
+                           maxConnections=None,
+                           trustXForwardedFor=None):
         """
         Set WebSocket protocol options used as defaults for new protocol instances.
 
@@ -3161,6 +3173,11 @@ def setProtocolOptions(self,
             assert(maxConnections >= 0)
             self.maxConnections = maxConnections
 
+        if trustXForwardedFor is not None and trustXForwardedFor != self.trustXForwardedFor:
+            assert(type(trustXForwardedFor) is int)
+            assert(trustXForwardedFor >= 0)
+            self.trustXForwardedFor = trustXForwardedFor
+
     def getConnectionCount(self):
         """
         Get number of currently connected clients.

Diff for: wstan/relay.py

@@ -24,7 +24,7 @@ def _get_digest(dat):
 def _on_pushToTunTaskDone(task):
     # suppress annoying "CancelledError exception not retrieved" error on Py3.5+
     try:
-        if not isinstance(task.exception(), CancelledError):
+        if isinstance(task.exception(), CancelledError):
             logging.error("pushToTunTask exception: %s" % type(task.exception()))
     except CancelledError:  # doc says it will raise this if canceled, but...
         pass

Diff for: wstan/server.py

@@ -22,12 +22,10 @@ class WSTunServerProtocol(WebSocketServerProtocol, RelayMixin):
     def __init__(self):
         WebSocketServerProtocol.__init__(self)
         RelayMixin.__init__(self)
-        self.clientInfo = None
         self.connectTargetTask = None
         self._dataToTarget = bytearray()
 
     def onConnect(self, request):
-        self.clientInfo = '{0}:{1}'.format(*self.transport.get_extra_info('peername'))
         # ----- init decryptor -----
         if not config.tun_ssl:
             if config.compatible:
@@ -60,14 +58,14 @@ def onConnect(self, request):
                 raise ValueError('wrong command %s' % cmd)
         except (ValueError, Base64Error) as e:
             logging.error('invalid request: %s (from %s), path: %s' %
-                          (e, self.clientInfo, path))
+                          (e, self.peer, path))
             raise ConnectionDeny(400)
 
         if not config.tun_ssl:
             # filter replay attack
             seen = seenNonceByTime[timestamp // 10]
             if nonce in seen:
-                logging.warning('replay attack detected (from %s)' % self.clientInfo)
+                logging.warning('replay attack detected (from %s)' % self.peer)
                 raise ConnectionDeny(400)
             seen.add(nonce)
 
@@ -86,11 +84,11 @@ def onConnect(self, request):
 
     @coroutine
     def connectTarget(self, addr, port, data):
-        logging.info('requested %s <--> %s:%s' % (self.clientInfo, addr, port))
+        logging.info('requested %s <--> %s:%s' % (self.peer, addr, port))
         try:
             reader, writer = yield from open_connection(addr, port)
         except (ConnectionError, OSError, TimeoutError) as e:
-            logging.info("can't connect to %s:%s (from %s)" % (addr, port, self.clientInfo))
+            logging.info("can't connect to %s:%s (from %s)" % (addr, port, self.peer))
             return self.resetTunnel(reason="can't connect to target: %s" % e)
         self.setProxy(reader, writer)
         if data:
@@ -127,15 +125,15 @@ def onResetTunnel(self):
     @coroutine
     def onMessage(self, dat, isBinary):
         if not isBinary:
-            logging.error('non binary ws message received (from %s)' % self.clientInfo)
+            logging.error('non binary ws message received (from %s)' % self.peer)
             return self.sendClose(3000)
 
         cmd = ord(self.decrypt(dat[:1]))
         if cmd == self.CMD_RST:
             try:
                 msg = self.parseResetMessage(dat)
             except ValueError as e:
-                logging.error('invalid reset message: %s (from %s)' % (e, self.clientInfo))
+                logging.error('invalid reset message: %s (from %s)' % (e, self.peer))
                 return self.sendClose(3000)
             if not msg.startswith('  '):
                 logging.info('tunnel abnormal reset: %s' % msg)
@@ -146,7 +144,7 @@ def onMessage(self, dat, isBinary):
                     raise Exception('reset received when not idle')
                 addr, port, remainData, __ = self.parseRelayHeader(dat)
             except Exception as e:
-                logging.error('invalid request in reused tun: %s (from %s)' % (e, self.clientInfo))
+                logging.error('invalid request in reused tun: %s (from %s)' % (e, self.peer))
                 return self.sendClose(3000)
             self.connectTargetTask = async_(self.connectTarget(addr, port, remainData))
         elif cmd == self.CMD_DAT:
@@ -158,7 +156,7 @@ def onMessage(self, dat, isBinary):
                 return
             self._writer.write(dat)
         else:
-            logging.error('wrong command: %s (from %s)' % (cmd, self.clientInfo))
+            logging.error('wrong command: %s (from %s)' % (cmd, self.peer))
             self.sendClose(3000)
 
     def sendServerStatus(self, redirectUrl=None, redirectAfter=0):
@@ -168,8 +166,7 @@ def onClose(self, wasClean, code, reason, logWarn=True):
         """Logging failed requests."""
         logWarn = True
         if reason and not self.tunOpen.done():
-            peer = '{0}:{1}'.format(*self.transport.get_extra_info('peername'))  # self.clientInfo is None
-            logging.warning(reason + ' (from %s)' % peer)
+            logging.warning(reason + ' (from %s)' % self.peer)
             logWarn = False
 
         RelayMixin.onClose(self, wasClean, code, reason, logWarn=logWarn)
@@ -198,6 +195,7 @@ def silent_timeout_err_handler(loop_, context):
 factory.autoPingInterval = 400  # only used to clear half-open connections
 factory.autoPingTimeout = 30
 factory.openHandshakeTimeout = 8  # timeout after TCP established and before succeeded WS handshake
+factory.trustXForwardedFor = 1 if config.x_forward else 0
 factory.closeHandshakeTimeout = 4