ProxyPass and SiteAccess getting REMOTE_ADDR
Last week I was setting up an Apache VirtualHost to point to a Zope object tree using the ProxyPass directive and SiteAccess to get all the urls right (great stuff!). However, I noticed that the REMOTE_ADDR was always set to the proxy host. This makes sense because Zope just gets the host/port from the socket connection. But I needed the real remote_addr for logging and user admin. Adding 'Header's wouldn't pass the info to Zope. The Zope mail archives mentioned the problem a couple of times without a configuration fix. A simple fix to the proxy module (in proxy_http.c) will create a new header called 'Original-Addr' to contain the client's ip address. Here is a context diff against Apache 1.3.14 that should work even in the new 2.0 servers: *************** *** 397,402 **** --- 397,404 ---- ap_bvputs(f, reqhdrs[i].key, ": ", reqhdrs[i].val, CRLF, NULL); } + ap_bvputs(f, "Original-Addr: ", r->connection->remote_ip, CRLF, NULL); + ap_bputs(CRLF, f); /* send the request data, if any. */ When the request was proxied, the Zope REQUEST will now have a key 'HTTP_ORIGINAL_ADDR' containing the client address. This key is also now a good indication that the http request went to the VirtualHost address. I then made a small change to SiteRoot.py to turn off the url mapping if HTTP_ORIGINAL_ADDR is present. This is a context diff against the SiteRoot.py file shipped with Zope 2.3.0: *************** *** 108,113 **** --- 108,116 ---- if '_SUPPRESS_SITEROOT' in _swallow(request): request.setVirtualRoot(request.steps) return + # only run if passed through ProxyPass + t = request.environ.get('HTTP_ORIGINAL_ADDR',None) + if t == None : return srd = [None, None] for i in (0, 1): srp = ('SiteRootBASE', 'SiteRootPATH')[i] These two patches have worked well and solved several problems. I hope others will find them useful. --Bill Noon Northeast Regional Climate Center Cornell University
William Noon wrote:
Last week I was setting up an Apache VirtualHost to point to a Zope object tree using the ProxyPass directive and SiteAccess to get all the urls right (great stuff!).
However, I noticed that the REMOTE_ADDR was always set to the proxy host. This makes sense because Zope just gets the host/port from the socket connection. But I needed the real remote_addr for logging and user admin. Adding 'Header's wouldn't pass the info to Zope.
The Zope mail archives mentioned the problem a couple of times without a configuration fix.
A simple fix to the proxy module (in proxy_http.c) will create a new header called 'Original-Addr' to contain the client's ip address.
Also, take a look at mod_proxy_add_forward for Apache, and these other resources: http://www.zope.org/Members/stephen/ApacheProxyPatch http://modules.apache.org/search?id=124 ftp://ftp.netcetera.dk/pub/apache/mod_proxy_add_forward.c I believe there is some code in mod_proxy_add_forward to deal with getting the client's IP address from chains of proxies. -- Steve Alexander Software Engineer Cat-Box limited http://www.cat-box.net
Steve Alexander wrote:
Also, take a look at mod_proxy_add_forward for Apache, and these other resources:
http://www.zope.org/Members/stephen/ApacheProxyPatch http://modules.apache.org/search?id=124
ftp://ftp.netcetera.dk/pub/apache/mod_proxy_add_forward.c
I believe there is some code in mod_proxy_add_forward to deal with getting the client's IP address from chains of proxies.
We're actually phasing this hack out in favour of a Virtual Host Monster which seems like a much cleaner solution... cheers, Chris
From: "Chris Withers" <chrisw@nipltd.com>
We're actually phasing this hack out in favour of a Virtual Host Monster which seems like a much cleaner solution...
Sorry, Chris, VHM is irrelevent to this problem. If you want to know the original remote IP, you have two choices: 1. Use one of the Apache patches that have been posted. 2. Mangle it into URLs and extract it with an AccessRule. Neither one of these is really satisfactory at the moment, since medusa doesn't know either solution, and so z2.log doesn't get the proper IP addresses. I'm hoping that one of these days we can standardize on #1 and provide support in medusa. Cheers, Evan @ digicool & 4-am
On Mon, 12 Feb 2001, William Noon wrote:
A simple fix to the proxy module (in proxy_http.c) will create a new header called 'Original-Addr' to contain the client's ip address.
Here is a context diff against Apache 1.3.14 that should work even in the new 2.0 servers:
FYI, there is an apache module that already does this. I can't remember the name offhand, but it creates a similar header called something like X-Original-Addr. The module works in two parts and is both 'client' and 'server', so that if you have two apache processes one prxying to the other, the first will generate the header, and the second will recognise it and set the appropriate variables. -Matt -- Matt Hamilton matth@netsight.co.uk Netsight Internet Solutions, Ltd. Business Vision on the Internet http://www.netsight.co.uk +44 (0)117 9090901 Web Hosting | Web Design | Domain Names | Co-location | DB Integration
participants (5)
-
Chris Withers -
Evan Simpson -
Matt Hamilton -
Steve Alexander -
William Noon