Reverse Proxies, REMOTE_ADDR spoofing patch

[Andy Armstrong <an...@apache.org>]

I've been playing around with using Apache 2 as a facade proxy behind 
which I'm hiding around 80 Apache 1.3 and Apache 2 instances. The back 
end servers are running mainly PHP content that I'm hosting for people 
and I want to get round the vulnerabilities that result from everything 
running as 'nobody'.

I'd like people's PHP and CGIs to work without changes which, in some 
cases, means spoofing the value of REMOTE_ADDR to be that of the 
original request (X-Forwarded-For). Having played around fruitlessly 
with SetEnv and mod_rewrite I had a look at the 1.3.33 source and 
concluded that REMOTE_ADDR is populated in ap_add_common_vars() and that 
there's no way to subvert the value that it gets.

I've patched 1.3.33 to provide a new boolean directive 
ProxyFakeRemoteAddr which, when enabled, plucks the value of any 
X-Forwarded-For header and populates REMOTE_ADDR with it. It also 
supresses any attempt to set REMOTE_HOST.

This seems to scratch an itch which I'm not alone in having, adds just a 
few lines and has no effect when its disabled. The one functional 
problem I can with it is that if you erroneously enable it on a server 
that isn't behind a proxy it allows REMOTE_ADDR to be spoofed by setting 
the X-Forwarded-For header.

If the consensus is that it's an ugly bodge I'll happily keep it to 
myself but, judging by the posts that periodically crop up on usenet, it 
would solve a problem for quite a few people.

Shall I post the patch?

-- 
Andy Armstrong

Re: Reverse Proxies, REMOTE_ADDR spoofing patch

[Andy Armstrong <an...@apache.org>]

Andrew Stribblehill wrote:
> Isn't this what mod_rpaf does?

Apparently so - thanks Andrew :)

I did spend longer unsuccessfully googling for that than I did writing 
the patch :)

Re: Reverse Proxies, REMOTE_ADDR spoofing patch

[Andrew Stribblehill <a....@durham.ac.uk>]

Lars Eilebrecht wrote:
>I've patched 1.3.33 to provide a new boolean directive 
>ProxyFakeRemoteAddr which, when enabled, plucks the value of any 
>X-Forwarded-For header and populates REMOTE_ADDR with it. It also 
>supresses any attempt to set REMOTE_HOST.

Isn't this what mod_rpaf does?

-- 
VIKING NORTH UTSIRE SOUTH UTSIRE
SOUTH OR SOUTHWEST 4 OR 5, VEERING WEST IN VIKING LATER. RAIN AT
TIMES. MODERATE OR GOOD

Re: Reverse Proxies, REMOTE_ADDR spoofing patch

[Andy Armstrong <an...@apache.org>]

Lars Eilebrecht wrote:
>>I've patched 1.3.33 to provide a new boolean directive 
>>ProxyFakeRemoteAddr which, when enabled, plucks the value of any 
>>X-Forwarded-For header and populates REMOTE_ADDR with it. It also 
>>supresses any attempt to set REMOTE_HOST.
> 
> 
> -1 for adding this to 1.3 (IIRC, we once decided to not add any
> new features to 1.3).
> 
> -0 for adding this to 2.x

Thanks Lars. I'll be doing a 2.x patch this evening. I'll report back.

Re: Reverse Proxies, REMOTE_ADDR spoofing patch

[Lars Eilebrecht <la...@hyperreal.org>]

According to Andy:

> I've patched 1.3.33 to provide a new boolean directive 
> ProxyFakeRemoteAddr which, when enabled, plucks the value of any 
> X-Forwarded-For header and populates REMOTE_ADDR with it. It also 
> supresses any attempt to set REMOTE_HOST.

-1 for adding this to 1.3 (IIRC, we once decided to not add any
new features to 1.3).

-0 for adding this to 2.x
 
ciao...
-- 
Lars Eilebrecht                 - Reality does not exist ... yet.
lars@hyperreal.org