You are viewing a plain text version of this content. The canonical link for it is here.
Posted to modperl@perl.apache.org by Haroon Rafique <ha...@utoronto.ca> on 2004/10/21 16:26:32 UTC
Re: [mp2] Report on mp2 accessors in apache_structures.map
Hi MP2 users,
I haven't kept up with mod_perl development for a little while so I
apologize in advance. I did a lot of RTFM, searching of mailing list
archives and some soul searching before posting this.
I looked at the Changes file for 1.99_15 and saw that a lot of
Apache::Connection fields were now readonly.
I followed the discussion at the thread:
http://marc.theaimsgroup.com/?t=109215131300005&r=1&w=2
or for a single-page view:
http://gossamer-threads.com/lists/modperl/dev/71393
Quoting, Stas's last message on this thread:
> Thanks Tom, but I'm still not convinced, that it's a goodness to expose
> those. Let's discuss each one separately.
I wanted to discuss making remote_ip settable (sorry no sub-test here -
don't know how to write one).
I am currently using read/write remote_ip (pre 1.99_15) in production
right now. Making it readonly breaks the following functionality.
If you search the modperl users' mailing list for the following search
terms:
x-forwarded-for remote_ip
here's a link to the search:
http://marc.theaimsgroup.com/?l=apache-modperl&w=2&r=1&s=x-forwarded-for+remote_ip&q=b
The most requested use for being able to set remote_ip is due to the very
popular reverse proxy setup for typical mod_perl installations. Light
apache in the front-end, heavy mod_perl apache in the back-end.
The front end has the following reverse proxy directives:
ProxyPass /perl/ http://localhost:8103/perl/
ProxyPassReverse /perl/ http://localhost:8103/perl/
Due to the reverse proxy setup, the original client IP is lost and all IP
addresses are reported as 127.0.0.1 (front-end). Since mod_proxy
conveniently adds a X-Forwarded-For header to the proxied requests
automatically, you can indeed grab the last value in that header and then
use it to "set" remote_ip to the client's IP so that the back-end receives
the client's IP.
Typical usage is to use, for e.g.:
PerlPostReadRequestHandler My::ProxyRemoteAddr
in your apache conf file.
and then in your startup.pl have something like:
# use the X-Forwarded-For header to recover the remote client's ip
sub My::ProxyRemoteAddr ($) {
my $r = shift;
# we'll only look at the X-Forwarded-For header if the requests
# comes from our proxy at localhost
return Apache::OK
unless
($r->connection->remote_ip =~
m#^(127.0.0.1|localhost.localdomain)$#)
and $r->header_in('X-Forwarded-For');
# Select last value in the chain -- original client's ip
if( my( $ip ) = $r->headers_in->{'X-Forwarded-For'} =~ /([^,\s]+)$/ )
{
$r->connection->remote_ip($ip);
}
return Apache::OK;
}
How would I achieve the same functionality without making remote_ip
read/write? How are you guys using post 1.99_15 in production and are
still able to get the original client IP to the back-end? Curious minds
wanna know....
Regards,
--
Haroon Rafique
<ha...@utoronto.ca>
--
Report problems: http://perl.apache.org/bugs/
Mail list info: http://perl.apache.org/maillist/modperl.html
List etiquette: http://perl.apache.org/maillist/email-etiquette.html
Re: [mp2] Report on mp2 accessors in apache_structures.map
Posted by Stas Bekman <st...@stason.org>.
Stas Bekman wrote:
[...]
>> To be really explicit, I have 2 requirements:
>>
>> 1) back-end server should log the client's IP address in the server logs.
>>
>> 2) All the mod_perl scripts on the back-end server should be able to
>> see the client's IP address without taking any extra steps.
>
>
> So yes, you have a solid case, Haroon. I'll re-enable back that field.
> Thank you.
The current cvs (and 1.99_18 when that comes out) have $c->remote_ip settable.
--
__________________________________________________________________
Stas Bekman JAm_pH ------> Just Another mod_perl Hacker
http://stason.org/ mod_perl Guide ---> http://perl.apache.org
mailto:stas@stason.org http://use.perl.org http://apacheweek.com
http://modperlbook.org http://apache.org http://ticketmaster.com
--
Report problems: http://perl.apache.org/bugs/
Mail list info: http://perl.apache.org/maillist/modperl.html
List etiquette: http://perl.apache.org/maillist/email-etiquette.html
Re: [mp2] Report on mp2 accessors in apache_structures.map
Posted by Stas Bekman <st...@stason.org>.
Haroon Rafique wrote:
> Hi Stas,
>
> On Yesterday at 9:14pm, SB=>Stas Bekman <st...@stason.org> wrote:
>
> SB>
> SB> but in apache2 it's built-in and no more requires a mod_perl module
> SB> for that. I don't have any examples but mod_proxy/mod_headers already
> SB> provide this functionality from what I've remember seeing on the
> SB> httpd-dev list.
>
> Maybe I'm misunderstanding here, but I did mention (didn't I?) that
> mod_proxy already adds the X-Forwarded-For header from the front-end
> server (automatically). So that's not the issue here.
My apologies if I've missed that.
> SB>
> SB> Actually, I've just found this example with google (requires
> SB> mod_headers):
> SB>
> SB> RequestHeader set X-Forwarded-For %{REMOTE_ADDR}
> SB>
> SB> Does it do the trick?
> SB>
>
> Not really. Unless I'm misunderstanding here again, your recipe above is
> doing what mod_proxy already does automatically on the front-end server.
> The back-end server is a whole different issue.
>
> The issue at stake is really the back-end server which ends up seeing
> nothing but 127.0.0.1 in the access_log. By using My::ProxyRemoteAddr, I
> was able to extract the last IP in the X-Forwarded-For header chain and
> use that last IP address for the $r->connection->remote_ip($ip) call. This
> way the "back-end" server would see the real IP server even in the
> access_log and in all the perl scripts as well without any other
> finagling.
so the X-Forwarded-For header is there at the back-end, but Apache won't
use it to set remote_ip, right? So I'm trying to figure out whether Apache
provides some internal mechanism for doing that. But I can't find any
Apache2 API that does that.
> To be really explicit, I have 2 requirements:
>
> 1) back-end server should log the client's IP address in the server logs.
>
> 2) All the mod_perl scripts on the back-end server should be able to
> see the client's IP address without taking any extra steps.
So yes, you have a solid case, Haroon. I'll re-enable back that field.
Thank you.
--
__________________________________________________________________
Stas Bekman JAm_pH ------> Just Another mod_perl Hacker
http://stason.org/ mod_perl Guide ---> http://perl.apache.org
mailto:stas@stason.org http://use.perl.org http://apacheweek.com
http://modperlbook.org http://apache.org http://ticketmaster.com
--
Report problems: http://perl.apache.org/bugs/
Mail list info: http://perl.apache.org/maillist/modperl.html
List etiquette: http://perl.apache.org/maillist/email-etiquette.html
Re: [mp2] Report on mp2 accessors in apache_structures.map
Posted by Haroon Rafique <ha...@utoronto.ca>.
Hi Stas,
On Yesterday at 9:14pm, SB=>Stas Bekman <st...@stason.org> wrote:
SB>
SB> but in apache2 it's built-in and no more requires a mod_perl module
SB> for that. I don't have any examples but mod_proxy/mod_headers already
SB> provide this functionality from what I've remember seeing on the
SB> httpd-dev list.
Maybe I'm misunderstanding here, but I did mention (didn't I?) that
mod_proxy already adds the X-Forwarded-For header from the front-end
server (automatically). So that's not the issue here.
SB>
SB> Actually, I've just found this example with google (requires
SB> mod_headers):
SB>
SB> RequestHeader set X-Forwarded-For %{REMOTE_ADDR}
SB>
SB> Does it do the trick?
SB>
Not really. Unless I'm misunderstanding here again, your recipe above is
doing what mod_proxy already does automatically on the front-end server.
The back-end server is a whole different issue.
The issue at stake is really the back-end server which ends up seeing
nothing but 127.0.0.1 in the access_log. By using My::ProxyRemoteAddr, I
was able to extract the last IP in the X-Forwarded-For header chain and
use that last IP address for the $r->connection->remote_ip($ip) call. This
way the "back-end" server would see the real IP server even in the
access_log and in all the perl scripts as well without any other
finagling.
To be really explicit, I have 2 requirements:
1) back-end server should log the client's IP address in the server logs.
2) All the mod_perl scripts on the back-end server should be able to
see the client's IP address without taking any extra steps.
Regards,
--
Haroon Rafique
<ha...@utoronto.ca>
--
Report problems: http://perl.apache.org/bugs/
Mail list info: http://perl.apache.org/maillist/modperl.html
List etiquette: http://perl.apache.org/maillist/email-etiquette.html
Re: [mp2] Report on mp2 accessors in apache_structures.map
Posted by Stas Bekman <st...@stason.org>.
Haroon Rafique wrote:
[...]
> x-forwarded-for remote_ip
[...]
> How would I achieve the same functionality without making remote_ip
> read/write? How are you guys using post 1.99_15 in production and are
> still able to get the original client IP to the back-end? Curious minds
> wanna know....
but in apache2 it's built-in and no more requires a mod_perl module for
that. I don't have any examples but mod_proxy/mod_headers already provide
this functionality from what I've remember seeing on the httpd-dev list.
Actually, I've just found this example with google (requires mod_headers):
RequestHeader set X-Forwarded-For %{REMOTE_ADDR}
Does it do the trick?
--
__________________________________________________________________
Stas Bekman JAm_pH ------> Just Another mod_perl Hacker
http://stason.org/ mod_perl Guide ---> http://perl.apache.org
mailto:stas@stason.org http://use.perl.org http://apacheweek.com
http://modperlbook.org http://apache.org http://ticketmaster.com
--
Report problems: http://perl.apache.org/bugs/
Mail list info: http://perl.apache.org/maillist/modperl.html
List etiquette: http://perl.apache.org/maillist/email-etiquette.html
Re: [mp2] Report on mp2 accessors in apache_structures.map
Posted by Haroon Rafique <ha...@utoronto.ca>.
On Today at 10:14am, RK=>Randy Kobes <ra...@theoryx5.uwinnipeg.ca> wrote:
RK>
RK> There's a discussion on perlmonks about this:
RK> http://www.perlmonks.org/?node_id=390160
RK> with reference to
RK> http://www.openinfo.co.uk/apache/
RK> With due care to determining trusted proxies, it shows that
RK> in the header
RK> X-Forwarded-For: client1, proxy1, proxy2
RK> the client's IP address is the left-most entry in this list.
RK>
Hi Randy,
Your analysis is correct. A typical X-Forwarded-For header would look
exactly as you said.
However, my case is a little different. In my case (reverse proxy), I will
have a typical request come in on the back-end server with:
$r->connection->remote_ip = 127.0.0.1
and a header:
X-Forwarded-For: client1, proxy1, proxy2, ip_as_seen_by_front_end
I am only really interested in ip_as_seen_by_front_end and not the client1
address (don't care about that - it could be spoofed for all I know).
That's why I chose to use the "last address" in the chain so that I am
able to set
$r->connection->remote_ip(ip_as_seen_by_front_end)
If I was indeed interested in client1, then I would pick the following:
$r->connection->remote_ip(client1)
I hope that explains my situation and reasoning.
Regards,
--
Haroon Rafique
<ha...@utoronto.ca>
--
Report problems: http://perl.apache.org/bugs/
Mail list info: http://perl.apache.org/maillist/modperl.html
List etiquette: http://perl.apache.org/maillist/email-etiquette.html
Re: [mp2] Report on mp2 accessors in apache_structures.map
Posted by Randy Kobes <ra...@theoryx5.uwinnipeg.ca>.
On Thu, 21 Oct 2004, Haroon Rafique wrote:
[ ... ]
> I wanted to discuss making remote_ip settable (sorry no sub-test here -
> don't know how to write one).
>
> I am currently using read/write remote_ip (pre 1.99_15) in production
> right now. Making it readonly breaks the following functionality.
>
> If you search the modperl users' mailing list for the following search
> terms:
>
> x-forwarded-for remote_ip
>
> here's a link to the search:
> http://marc.theaimsgroup.com/?l=apache-modperl&w=2&r=1&s=x-forwarded-for+remote_ip&q=b
>
> The most requested use for being able to set remote_ip is due to the very
> popular reverse proxy setup for typical mod_perl installations. Light
> apache in the front-end, heavy mod_perl apache in the back-end.
>
> The front end has the following reverse proxy directives:
>
> ProxyPass /perl/ http://localhost:8103/perl/
> ProxyPassReverse /perl/ http://localhost:8103/perl/
>
> Due to the reverse proxy setup, the original client IP is lost and all IP
> addresses are reported as 127.0.0.1 (front-end). Since mod_proxy
> conveniently adds a X-Forwarded-For header to the proxied requests
> automatically, you can indeed grab the last value in that header and then
> use it to "set" remote_ip to the client's IP so that the back-end receives
> the client's IP.
There's a discussion on perlmonks about this:
http://www.perlmonks.org/?node_id=390160
with reference to
http://www.openinfo.co.uk/apache/
With due care to determining trusted proxies, it shows that
in the header
X-Forwarded-For: client1, proxy1, proxy2
the client's IP address is the left-most entry in this list.
--
best regards,
randy
--
Report problems: http://perl.apache.org/bugs/
Mail list info: http://perl.apache.org/maillist/modperl.html
List etiquette: http://perl.apache.org/maillist/email-etiquette.html