mod_log-any/1569: IP address incorrectly recorded in access_log

[Gerard Hickey <ge...@nsc.com>]

>Number:         1569
>Category:       mod_log-any
>Synopsis:       IP address incorrectly recorded in access_log
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    apache
>State:          open
>Class:          sw-bug
>Submitter-Id:   apache
>Arrival-Date:   Wed Dec 17 07:10:00 PST 1997
>Last-Modified:
>Originator:     gerard.hickey@nsc.com
>Organization:
apache
>Release:        1.2.4
>Environment:
SunOS thoreau 4.1.4 3 sun4m
gcc 2.7.2
>Description:
Just built 1.2.4 and had one client accessing the httpd process. The correct 
IP for the client is 139.187.190.155. httpd is configured not to resolv 
hostnames. Below is the access_log that was generated from a few accesses.

205.227.60.129 - - [17/Dec/1997:08:36:24 -0500] "GET / HTTP/1.0" 200 1316
205.227.60.129 - - [17/Dec/1997:08:36:25 -0500] "GET /apache_pb.gif HTTP/1.0" 20
0 2326
205.227.60.129 - - [17/Dec/1997:08:36:31 -0500] "GET /~hickey/ HTTP/1.0" 200 438
172.16.2.129 - - [17/Dec/1997:08:36:32 -0500] "GET /icons/blank.gif HTTP/1.0" 20
0 148
172.16.2.129 - - [17/Dec/1997:08:36:32 -0500] "GET /icons/text.gif HTTP/1.0" 200
 229
205.227.60.129 - - [17/Dec/1997:08:36:32 -0500] "GET /icons/back.gif HTTP/1.0" 2
00 216
205.227.60.129 - - [17/Dec/1997:08:36:39 -0500] "GET /~hickey/AcctInfo.html HTTP
/1.0" 200 13435
205.227.60.129 - - [17/Dec/1997:08:36:39 -0500] "GET /images/Return4DA.gif HTTP/
1.0" 404 173
205.227.60.129 - - [17/Dec/1997:08:37:33 -0500] "GET /perl5 HTTP/1.0" 301 182
139.187.190.155 - - [17/Dec/1997:08:37:34 -0500] "GET /perl5/ HTTP/1.0" 200 427
139.187.190.155 - - [17/Dec/1997:08:37:34 -0500] "GET /icons/back.gif HTTP/1.0" 
200 216
139.187.190.155 - - [17/Dec/1997:08:37:34 -0500] "GET /icons/folder.gif HTTP/1.0
" 200 225
139.187.190.155 - - [17/Dec/1997:08:37:34 -0500] "GET /icons/blank.gif HTTP/1.0"
 200 148
139.187.190.155 - - [17/Dec/1997:08:37:36 -0500] "GET /icons/unknown.gif HTTP/1.
0" 200 245
139.187.190.155 - - [17/Dec/1997:08:37:36 -0500] "GET /icons/text.gif HTTP/1.0" 
200 229
139.187.190.155 - - [17/Dec/1997:08:37:36 -0500] "GET /perl5/lib/ HTTP/1.0" 200 
14918
139.187.190.155 - - [17/Dec/1997:08:37:36 -0500] "GET /icons/p.gif HTTP/1.0" 200
 237
139.187.190.155 - - [17/Dec/1997:08:37:38 -0500] "GET /perl5/lib/AutoLoader.pm.h
tml HTTP/1.0" 200 647
139.187.190.155 - - [17/Dec/1997:08:38:28 -0500] "GET /~hickey/ HTTP/1.0" 200 55
9
139.187.190.155 - - [17/Dec/1997:08:38:31 -0500] "GET /~hickey/spanning-tree.htm
l HTTP/1.0" 200 3188
139.187.190.155 - - [17/Dec/1997:08:43:11 -0500] "GET /~hickey/spanning-tree.htm
l HTTP/1.0" 200 3298
172.16.2.129 - - [17/Dec/1997:09:08:47 -0500] "GET /~hickey/ HTTP/1.0" 200 670
172.16.2.129 - - [17/Dec/1997:09:08:55 -0500] "GET /~hickey/OUI.html HTTP/1.0" 2
00 62415
205.227.60.129 - - [17/Dec/1997:09:11:22 -0500] "GET /manual/ HTTP/1.0" 200 2207
172.16.2.129 - - [17/Dec/1997:09:11:26 -0500] "GET /manual/images/sub.gif HTTP/1
.0" 200 6083
172.16.2.129 - - [17/Dec/1997:09:11:27 -0500] "GET /manual/images/index.gif HTTP
/1.0" 200 1540
172.16.2.129 - - [17/Dec/1997:09:11:37 -0500] "GET /manual/new_features_1_2.html
 HTTP/1.0" 200 9409
205.227.60.129 - - [17/Dec/1997:09:53:33 -0500] "GET /~hickey/spanning-tree.html
 HTTP/1.0" 200 3298
>How-To-Repeat:
I assume that this is pretty repeatable on all platforms with no specific
URLs. My Configuration file can be sent if you need to rebuild a httpd 
to test again (if module conflicts are thought to be the issue).
>Fix:

>Audit-Trail:
>Unformatted:
[In order for any reply to be added to the PR database, ]
[you need to include <ap...@Apache.Org> in the Cc line ]
[and leave the subject line UNCHANGED.  This is not done]
[automatically because of the potential for mail loops. ]