You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2014/01/06 19:08:13 UTC
[Bug 55962] New: mod_remoteip should not allow an external proxy to
present an internal proxy
https://issues.apache.org/bugzilla/show_bug.cgi?id=55962
Bug ID: 55962
Summary: mod_remoteip should not allow an external proxy to
present an internal proxy
Product: Apache httpd-2
Version: 2.5-HEAD
Hardware: PC
OS: All
Status: NEW
Severity: normal
Priority: P2
Component: mod_remoteip
Assignee: bugs@httpd.apache.org
Reporter: mike.rumph@oracle.com
Presenting the following discussion from the Apache httpd dev mailing list as a
bug report:
-
http://mail-archives.apache.org/mod_mbox/httpd-dev/201312.mbox/%3C52B3426B.4060203%40oracle.com%3E
The remoteip_modify_request() function in mod_remoteip.c processes the value in
the RemoteIPHeader header in a while loop from right to left.
In the first pass the c->client_ip is taken as the user agent IP.
Then the user agent is compared against the trusted proxy list.
The elements in the trusted proxy list are of two types (internal or external)
from the RemoteIPInternalProxy and RemoteIPTrusted directives.
If the user agent matches an element in the proxy list,
then it is trusted to present the previous IP address in the RemoteIPHeader
header value.
The current code allows internal proxies to present external proxies and
external proxies to present internal proxies.
But an internal proxy presented by an external proxy should be considered
external.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 55962] mod_remoteip should not allow an external proxy to
present an internal proxy
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=55962
Mike Rumph <mi...@oracle.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Keywords| |FixedInTrunk
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 55962] mod_remoteip should not allow an external proxy to
present an internal proxy
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=55962
--- Comment #1 from Mike Rumph <mi...@oracle.com> ---
Created attachment 31175
--> https://issues.apache.org/bugzilla/attachment.cgi?id=31175&action=edit
Patch to prevent an external proxy from presenting an internal proxy.
I have attached a patch against mod_remoteip.c in httpd trunk.
This patch will prevent an external proxy from presenting an internal proxy.
The presented internal proxy will be considered external.
This patch documents the case where no RemoteIPInternalProxy or
RemoteIPTrustedProxy directive is configured.
The patch also includes the essential patch from bug 54651.
The patch can be verified with the following setup which are variations from
bug 55635:
This tests some internal-external-internal proxy combinations.
LogFormat "%h %a %{c}a xf=\"%{X-Forwarded-For}i\" %l %u %t \"%r\" %>s %b"
forward
CustomLog "logs/access_log" forward
<Location /test>
Order Deny,Allow
Deny from all
Allow from localhost 127.0.0.1 1.1.1.1
</Location>
RemoteIPHeader X-Forwarded-For
RemoteIPInternalProxy 10.1.2.3
RemoteIPInternalProxy 87.245.198.54
RemoteIPTrustedProxy 87.250.250.203
- $ curl -v -H "X-Forwarded-For: 1.1.1.2, 1.1.1.1, 87.245.198.54,
87.250.250.203" http://10.1.2.3:8080/test/
- $ curl -v -H "X-Forwarded-For: 1.1.1.2, 10.1.1.1, 87.245.198.54,
87.250.250.203" http://10.1.2.3:8080/test/
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 55962] mod_remoteip should not allow an external proxy to
present an internal proxy
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=55962
--- Comment #2 from Mike Rumph <mi...@oracle.com> ---
Committed to trunk in r1588330.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 55962] mod_remoteip should not allow an external proxy to
present an internal proxy
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=55962
Mike Rumph <mi...@oracle.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Severity|normal |enhancement
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 55962] mod_remoteip should not allow an external proxy to
present an internal proxy
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=55962
Mike Rumph <mi...@oracle.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Keywords| |PatchAvailable
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org