equivalent to ngx.var.remote_addr for hostnames ?

eva2000 · 2016-01-28T16:03:53+00:00

Hi guys! OpenResty 1.9.7.3 RC1 is now available for testing, which backports the latest patches to fix security issues in the NGINX core (CVE-2016-0742, CVE...

equivalent to ngx.var.remote_addr for hostnames ?

eva2000

For nginx lua is there an equivalent to checking ips with ngx.var.remote_addr for checking, allowing or blocking by hostnames ?

cheers

George

lazy.dogtown

nginx never sees dns-names when beeing accessed, just ips; you'd need to
reverse-rersolve each ip and afaik this is not possible in nginx, just
translate an hostname -> ip via resolver -directive.

reverse hostnames can be spoofed anyway










2016-01-28 9:03 GMT+01:00 George Liu <eva...@centminmod.com>:
> For nginx lua is there an equivalent to checking ips with
> ngx.var.remote_addr for checking, allowing or blocking by hostnames ?
>
> cheers
>
> George.

tim

George Liu <eva...@centminmod.com> wrote:

> For nginx lua is there an equivalent to checking ips
> with ngx.var.remote_addr for checking, allowing or blocking by hostnames ?

AFAIK, not directly.  You need to get the PTR record for
ngx.var.remote_addr and then do another look-up to check
that the A record of the returned hostname resolves back to
the IP address to avoid spoofing attacks.

Actually I'm working on something like that right now and
was surprised that there is no support for the native func-
tions gethostbyname(), etc.  Does one really need to use
resty.dns.resolver
(https://github.com/openresty/lua-resty-dns)?

Tim

agentzh

Hello!

On Thu, Jan 28, 2016 at 11:45 AM, Tim Landscheidt wrote:
> Actually I'm working on something like that right now and
> was surprised that there is no support for the native func-
> tions gethostbyname(), etc.  Does one really need to use
> resty.dns.resolver
> (https://github.com/openresty/lua-resty-dns)?

The gethostbyname() syscall can be blocking horribly and even the
nginx core does not use it at request time.

Yes, use of lua-resty-dns is recommended. BTW, the latest master now
supports `reverse_query()`.

Regards,
-agentzh