You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2025/05/05 22:29:29 UTC
[Bug 69672] New: mod_remoteip rejecting valid IPv4-mapped IPv6 addresses
https://bz.apache.org/bugzilla/show_bug.cgi?id=69672
Bug ID: 69672
Summary: mod_remoteip rejecting valid IPv4-mapped IPv6
addresses
Product: Apache httpd-2
Version: 2.4.63
Hardware: PC
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: mod_remoteip
Assignee: bugs@httpd.apache.org
Reporter: bjoern@j3e.de
Target Milestone: ---
I'm having a haproxy, which uses the proxy protocol to report the client IP
addresses to the backend server, which is Apache with mod_remoteip and
"RemoteIPProxyProtocol on". IPv4 connections are by default and intentionally
IPv4-mapped IPv6 addresses. mod_remoteip however refuses those IPs and all
those connections fail:
[Tue May 06 00:22:55.500263 2025] [remoteip:error] [pid 93692:tid 93709]
[client 192.168.4.1:36328] AH03500: RemoteIPProxyProtocol: invalid
client-address '::ffff:123.168.1.123' found in header 'PROXY TCP6
::ffff:123.168.110.148 ::ffff:99.243.150.199 31875 443'
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 69672] mod_remoteip rejecting valid IPv4-mapped IPv6 addresses
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69672
Peter Meiser <pe...@gmx.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |peter.meiser@gmx.com
--- Comment #4 from Peter Meiser <pe...@gmx.com> ---
Created attachment 40139
--> https://bz.apache.org/bugzilla/attachment.cgi?id=40139&action=edit
support IPv4-mapped IPv6 addresses (RFC 4291, chapter 2.5.5.2)
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 69672] mod_remoteip rejecting valid IPv4-mapped IPv6 addresses
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69672
--- Comment #3 from Peter Meiser <pe...@gmx.com> ---
If I'm not mistaken, the address check fails because "." (dot) is not included
in "valid_addr_chars" so that v4-mapped IPv6 addresses are validated properly.
At
https://github.com/apache/httpd/blob/806e1f383c1601358c29c70c308c6bf3e2c2f4d5/modules/metadata/mod_remoteip.c#L816
valid_addr_chars = "0123456789abcdefABCDEF:";
should be
valid_addr_chars = "0123456789abcdefABCDEF:.";
so that the check at
https://github.com/apache/httpd/blob/806e1f383c1601358c29c70c308c6bf3e2c2f4d5/modules/metadata/mod_remoteip.c#L833
succeeds.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 69672] mod_remoteip rejecting valid IPv4-mapped IPv6 addresses
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69672
--- Comment #1 from OpenGateway <fd...@opengateway.fr> ---
Hi,
This happens because on the HAProxy frontend, you need to have an
IPv4-over-IPV6 binding like this:
bind :::443 v4v6
If you access IPv6 => it works.
If you are accessing IPv4 => RemoteIPProxyProtocol : invalid client-address
To resolve this problem, you need to change the bind on the HAproxy frontend as
follows:
bind *:443 v4v6
bind :::443 v6only
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 69672] mod_remoteip rejecting valid IPv4-mapped IPv6 addresses
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69672
Peter Meiser <pe...@gmx.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Keywords| |PatchAvailable
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 69672] mod_remoteip rejecting valid IPv4-mapped IPv6 addresses
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69672
Kaarle Ritvanen <ka...@datakunkku.fi> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |kaarle.ritvanen@datakunkku.
| |fi
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 69672] mod_remoteip rejecting valid IPv4-mapped IPv6 addresses
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69672
--- Comment #2 from Björn Jacke <bj...@j3e.de> ---
I know that this is a workaround for the problem.
But this workaround doesn't mean that it's a bug that mod_remoteip does not
know how to deal with IPv6 mapped IPv4 addresse. IPv6 mapped IPv4 addresses are
well known valid IP addresses
(https://www.rfc-editor.org/rfc/rfc4291.html#section-2.2) and mod_remoteip
should not refuse connections with those IPs in the proxy protocol.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 69672] mod_remoteip rejecting valid IPv4-mapped IPv6 addresses
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69672
Giovanni Bechis <gi...@paclan.it> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|--- |FIXED
Status|NEW |RESOLVED
--- Comment #5 from Giovanni Bechis <gi...@paclan.it> ---
committed in r1933436, thanks.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org