Simple program _setting_ REMOTE_ADDR

[Steve van der Burg <st...@lhsc.on.ca>]

In order to get a certain buggy, poorly-designed application from a well-known vendor to maintain its sessions in the face of the user's IP address changing (vendor doesn't understand that addresses may change between requests), I'd like to have Apache lie to the vendor's canned CGI app about it.
That is, I'd like to set REMOTE_ADDR like so:

<Location /cgi-bin/VENDOR>
# Feed vendor's crappy CGI code a fake address that won't change:
PerlSetEnv REMOTE_ADDR 1.2.3.4
</Location>

When I test this with a simple dump-the-environment script (/cgi-bin/VENDOR/test) still shows my real IP address!  I've tried doing it with Apache's SetEnvIf (OT here, I know), and that doesn't do it either.
A quick check of the Eagle book, and a search through dejanews didn't turn up anything, and this should be easy...

Help!

...Steve

-- 
Steve van der Burg
Information Services
London Health Sciences Centre
(519) 685-8300 ext 35559
steve.vanderburg@lhsc.on.ca

Re: Simple program _setting_ REMOTE_ADDR

[Vivek Khera <kh...@kciLink.com>]

>>>>> "SvdB" == Steve van der Burg <st...@lhsc.on.ca> writes:

SvdB> That is, I'd like to set REMOTE_ADDR like so:

SvdB> <Location /cgi-bin/VENDOR>
SvdB> # Feed vendor's crappy CGI code a fake address that won't change:
SvdB> PerlSetEnv REMOTE_ADDR 1.2.3.4
SvdB> </Location>

But is /cgi-bin running under Perl?

I think what you have to do is make a handler that calls Apache's
remote_ip() method with the proper value, then runs a sub-request for
your CGI program, taking care not to recurse on itself.

Your handler could be /foo/bar/VENDOR and then it sets the remote IP,
and calls the subrequest for /cgi-bin/VENDOR.  Just make sure nobody
calls /cgi-bin/VENDOR directly or you'll screw it up.

If they don't understand how an IP address can change on a client, do
they understand that clients can share the same IP?

These people should be taken out and shot if they don't understand
that their app fails this way.  Really.  Just shoot 'em.

-- 
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Vivek Khera, Ph.D.                Khera Communications, Inc.
Internet: khera@kciLink.com       Rockville, MD       +1-301-545-6996
GPG & MIME spoken here            http://www.khera.org/~vivek/