commit: first draft of hostname preservation

lib.d/generate-bw-code.pl

@@ -1,8 +1,8 @@
 #!/usr/bin/perl
 
 $warning = "(generated)";
-$begin = "# ---- BEGIN GENERATED CODE ---- -*- awk -*-\n\n";
-$end = "# ---- END GENERATED CODE ----\n";
+$begin = "# ---- BEGIN CODE GENERATED BY $0 ---- -*- awk -*-\n\n";
+$end   = "# ---- END CODE GENERATED BY $0 ----\n";
 
 $indent = "  ";
 @polite = ();
@@ -11,7 +11,6 @@ $indent = "  ";
 @white = ();
 @tail = ();
 
-
 sub blackwhite {
     my ($operator, $lc_what, $a, $b) = @_;
     my $uc_what = uc($lc_what);
@@ -88,9 +87,12 @@ while (<DATA>) {
     elsif ($how eq "redirect") {
         my $uc_what = uc($lc_what);
         push(@redirect, "%%IF %$uc_what%\n");
-        push(@redirect, "# redirect $lc_what: 1=regexp,2=code,3=dest $warning\n");
+        push(@redirect, "# redirect $lc_what: 1=regexp,2=code,3=dest (REQUEST_URI will be appended) $warning\n");
         push(@redirect, "%%CSV %$uc_what%\n");
-        push(@redirect, "$condition { return %2% %3%\$request_uri; }\n");
+        push(@redirect, "$condition {\n");
+        push(@redirect, "  set \$onionify_response_headers 0;\n") if ($uc_what =~ /_HOST/); # this is a horrible kludge
+        push(@redirect, "  return %2% %3%\$request_uri;\n");
+        push(@redirect, "}\n");
         push(@redirect, "%%ENDCSV\n");
         push(@redirect, "%%ELSE\n");
         push(@redirect, "# no $lc_what\n");
@@ -99,20 +101,12 @@ while (<DATA>) {
     elsif ($how eq "fixed-redirect") {
         my $uc_what = uc($lc_what);
         push(@redirect, "%%IF %$uc_what%\n");
-        push(@redirect, "# fixed_redirect $lc_what: 1=regexp,2=code,3=dest (NO REQUEST_URI APPENDED) $warning\n");
+        push(@redirect, "# fixed_redirect $lc_what: 1=regexp,2=code,3=dest (REQUEST_URI will NOT be appended) $warning\n");
         push(@redirect, "%%CSV %$uc_what%\n");
-        push(@redirect, "$condition { return %2% %3%; }\n");
-        push(@redirect, "%%ENDCSV\n");
-        push(@redirect, "%%ELSE\n");
-        push(@redirect, "# no $lc_what\n");
-        push(@redirect, "%%ENDIF\n");
-    }
-    elsif ($how eq "legacy-redirect") {
-        my $uc_what = uc($lc_what);
-        push(@redirect, "%%IF %$uc_what%\n");
-        push(@redirect, "# legacy-redirect $lc_what: 1=regexp,2=dest,3=code $warning\n");
-        push(@redirect, "%%CSV %$uc_what%\n");
-        push(@redirect, "$condition { return %3% %2%\$request_uri; }\n");
+        push(@redirect, "$condition {\n");
+        push(@redirect, "  set \$onionify_response_headers 0;\n") if ($uc_what =~ /_HOST/); # this is a horrible kludge
+        push(@redirect, "  return %2% %3%;\n");
+        push(@redirect, "}\n");
         push(@redirect, "%%ENDCSV\n");
         push(@redirect, "%%ELSE\n");
         push(@redirect, "# no $lc_what\n");
@@ -198,16 +192,17 @@ block block_host if ( $http_host = "%0%" )
 block block_host_re if ( $http_host ~* "%0%" )
 block block_path if ( $uri = "%0%" )
 block block_path_re if ( $uri ~* "%0%" )
-## legacy
 block block_location location %0%
 block block_location_re location ~* "%0%"
-## query parameters
+
+# blocks on query parameters
 block block_param if ( $arg_%1% = "%2%" )
 block block_param_re if ( $arg_%1% ~* "%2%" )
 
 # redirects preserving the request_uri path
 redirect redirect_host if ( $host ~* "%1%" )
 redirect redirect_path if ( $uri ~* "%1%" )
+
 # redirects to a fixed url/path
 fixed-redirect redirect_fixed_host if ( $host ~* "%1%" )
 fixed-redirect redirect_fixed_path if ( $uri ~* "%1%" )

templates.d/nginx-generated-blocks.conf

@@ -1,4 +1,4 @@
-    # ---- BEGIN GENERATED CODE ---- -*- awk -*-
+    # ---- BEGIN CODE GENERATED BY ../lib.d/generate-bw-code.pl ---- -*- awk -*-
 
     # blacklists (generated)
     %%IF %USER_AGENT_BLACKLIST%
@@ -222,33 +222,43 @@
 
     # redirects (generated)
     %%IF %REDIRECT_HOST%
-    # redirect redirect_host: 1=regexp,2=code,3=dest (generated)
+    # redirect redirect_host: 1=regexp,2=code,3=dest (REQUEST_URI will be appended) (generated)
     %%CSV %REDIRECT_HOST%
-    if ( $host ~* "%1%" ) { return %2% %3%$request_uri; }
+    if ( $host ~* "%1%" ) {
+      set $onionify_response_headers 0;
+      return %2% %3%$request_uri;
+    }
     %%ENDCSV
     %%ELSE
     # no redirect_host
     %%ENDIF
     %%IF %REDIRECT_PATH%
-    # redirect redirect_path: 1=regexp,2=code,3=dest (generated)
+    # redirect redirect_path: 1=regexp,2=code,3=dest (REQUEST_URI will be appended) (generated)
     %%CSV %REDIRECT_PATH%
-    if ( $uri ~* "%1%" ) { return %2% %3%$request_uri; }
+    if ( $uri ~* "%1%" ) {
+      return %2% %3%$request_uri;
+    }
     %%ENDCSV
     %%ELSE
     # no redirect_path
     %%ENDIF
     %%IF %REDIRECT_FIXED_HOST%
-    # fixed_redirect redirect_fixed_host: 1=regexp,2=code,3=dest (NO REQUEST_URI APPENDED) (generated)
+    # fixed_redirect redirect_fixed_host: 1=regexp,2=code,3=dest (REQUEST_URI will NOT be appended) (generated)
     %%CSV %REDIRECT_FIXED_HOST%
-    if ( $host ~* "%1%" ) { return %2% %3%; }
+    if ( $host ~* "%1%" ) {
+      set $onionify_response_headers 0;
+      return %2% %3%;
+    }
     %%ENDCSV
     %%ELSE
     # no redirect_fixed_host
     %%ENDIF
     %%IF %REDIRECT_FIXED_PATH%
-    # fixed_redirect redirect_fixed_path: 1=regexp,2=code,3=dest (NO REQUEST_URI APPENDED) (generated)
+    # fixed_redirect redirect_fixed_path: 1=regexp,2=code,3=dest (REQUEST_URI will NOT be appended) (generated)
     %%CSV %REDIRECT_FIXED_PATH%
-    if ( $uri ~* "%1%" ) { return %2% %3%; }
+    if ( $uri ~* "%1%" ) {
+      return %2% %3%;
+    }
     %%ENDCSV
     %%ELSE
     # no redirect_fixed_path
@@ -364,4 +374,4 @@
     # no param_whitelist_re
     %%ENDIF
 
-    # ---- END GENERATED CODE ----
+    # ---- END CODE GENERATED BY ../lib.d/generate-bw-code.pl ----

templates.d/nginx-generated-checks.conf

@@ -1,4 +1,4 @@
-      # ---- BEGIN GENERATED CODE ---- -*- awk -*-
+      # ---- BEGIN CODE GENERATED BY ../lib.d/generate-bw-code.pl ---- -*- awk -*-
 
       # whitelist checks (generated)
       %%IF %USER_AGENT_WHITELIST%
@@ -74,4 +74,4 @@
       # no param_whitelist_re
       %%ENDIF
 
-      # ---- END GENERATED CODE ----
+      # ---- END CODE GENERATED BY ../lib.d/generate-bw-code.pl ----

templates.d/nginx.conf.txt

@@ -348,11 +348,15 @@ http {
       "Timing-Allow-Origin"
     }
 
-    local i, k
-    for i, k in ipairs(origin_rewrites) do
-      local v = ngx.header[k]
-      if v then
-        ngx.header[k] = dns_to_onion(v)
+    -- shall we onionify the response headers? probably "yes"
+    -- but we need to doublecheck because of REDIRECT_HOST, etc...
+    if ngx.var.onionify_response_headers do
+      local i, k
+      for i, k in ipairs(origin_rewrites) do
+        local v = ngx.header[k]
+        if v then
+          ngx.header[k] = dns_to_onion(v)
+        end
       end
     end
 
@@ -654,6 +658,11 @@ http {
       # no deonionify_post_bodies
       %%ENDIF
 
+      # onionify response headers; this should is default for 99%+ of
+      # requests, however you may in some circumstances want users to
+      # (eg:) escape or be redirected to the non-onionified site.
+      set $onionify_response_headers 1;
+
       # note use of both $scheme and the deonionified uri (both path and args)
       set $new_url "$scheme://${servernamesubdomain}%DNS_DOMAIN%$request_uri2";
       proxy_pass $new_url;