https://bz.apache.org/bugzilla/show_bug.cgi?id=70295
Bug ID: 70295
Summary: REMOTE_PORT environment variable is invalid when using
mod_remoteip
Product: Apache httpd-2
Version: 2.4.69
Hardware: All
OS: All
Status: NEW
Severity: minor
Priority: P2
Component: Core
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
Created attachment 40241
--> https://bz.apache.org/bugzilla/attachment.cgi?id=40241&action=edit
patch against httpd-2.4.69 to correct calculation of REMOTE_PORT environment
variable
When mod_remoteip overrides the client IP structure (req->useragent_addr) with
an IP address pulled from an upstream proxy header (e.g., X-Forwarded-For), it
clears the port value, since it is not known:
req->useragent_addr->port = 0;
Unfortunately, server/util_script.c obtains the port number from the client
connection itself:
rport = c->client_addr->port;
resulting in an invalid combination of REMOTE_ADDR and REMOTE_PORT:
* REMOTE_ADDR is obtained from the XFF header
* REMOTE_PORT is retained from the connection
I believe that the behaviour in modules/mappers/mod_rewrite.c is correct:
/*...*/ if (!strcmp(var, "REMOTE_PORT")) {
return apr_itoa(r->pool, r->useragent_addr->port);
}
Also modules/loggers/mod_log_config.c has:
/*...*/ if (!strcasecmp(a, "remote")) {
port = r->useragent_addr->port;
}
The attached patch (which is somewhat trivial) modifies the generation of
REMOTE_PORT so that it uses the same method used by mod_rewrite and
mod_log_config.
It also fixes the generic expression engine to use the same method.
If this behaviour can be fixed I intend to submit an enhancement to
mod_remoteip, which should resolve to Bug#64812 by using more of the
information provided in the PROXY protocol.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
