import ipcast;

This is a Varnish 3.0 VMOD for converting a string into an IP type in VCL.

Note that previously this VMOD overwrote the client.ip internal variable. This was an inherently flawed method and has since been abandoned.

For Varnish 4 use the built-in std.ip() function.

This VMOD is tested on Varnish 3.0.7.

Prototype

ip(STRING S, STRING fallback)

Return value

IP

Description

Parse the IPv4/IPv6 address in S and return that. If not successful, parse the string in fallback and return that.

When parsing fails the getaddrinfo() error output will be logged to varnishlog.

Caveat: If the fallback address is unparseable Varnish will crash.

set req.http.xff = regsub(req.http.X-Forwarded-For, "^(^[^,]+),?.*$", "\1");
if (ipcast.ip(req.http.xff, "198.51.100.255") == "198.51.100.255") { error 400 "Bad request"; }

set resp.http.x-parsed-ip = ipcast.ip("2001:db8::1", "198.51.100.255");

The source tree is based on autotools to configure the building, and does also have the necessary bits in place to do functional unit tests using the varnishtest tool.

Usage:

# only if you are building from a git clone.
./autogen.sh
./configure VARNISHSRC=DIR [VMODDIR=DIR]

VARNISHSRC is the directory of the Varnish source tree for which to compile your vmod. Both the VARNISHSRC and VARNISHSRC/include will be added to the include search paths for your module.

Optionally you can also set the vmod install directory by adding VMODDIR=DIR (defaults to the pkg-config discovered directory from your Varnish installation).

Make targets:

• make - builds the vmod
• make install - installs your vmod in VMODDIR
• make check - runs the unit tests in src/tests/*.vtc

In your VCL you could then use this vmod along the following lines:

import ipcast;
acl friendly_network {
    "192.0.2.0"/24;
}
sub vcl_recv {
    set req.http.xff = regsub(req.http.X-Forwarded-For, "^(^[^,]+),?.*$", "\1");
    if (ipcast.ip(req.http.xff, "198.51.100.255") == "198.51.100.255") {
        error 400 "Bad request";
    }

    if (ipcast.ip(req.http.xff, "198.51.100.255") !~ friendly_network) {
            error 403 "Forbidden";
    }
}

This document is licensed under the same license as the libvmod-ipcast project. See LICENSE for details.

• Copyright (c) 2011-2016 Varnish Software