10
Comman Kang <comman.kang at gmail.com> sent me: ::
14
I've made something rough but similar to mod_extract_forwarded for
15
Apache. This module will extract the client's "real" ip from
16
X-Forwarded-For header which is added by squid or other proxies. It might be
17
useful for servers behind reverse proxy servers.
19
However, this module is causing segfault with mod_ssl or
20
$HTTP{''socket"} directive, crashing in config_check_cond while patching
21
connection , I do not understand architecture of the lighttpd well, does it
22
need to call patch_connection in either handle_request_done and
25
Lionel Elie Mamane <lionel@mamane.lu> improved the patch: ::
27
I've taken lighttpd-1.4.10-mod_extforward.c from the wiki and I've
28
extended it. Here is the result.
34
- Fixed at least one segfault with SERVER['socket']
36
- Arrange things so that a url.access-deny under scope of a
37
HTTP['remoteip'] condition works well :)
39
I've commented the code in some places, mostly where I wasn't sure
40
what was going on, or I didn't see what the original author meant to
47
Sets trust level of proxy IP's.
53
extforward.forwarder = ("10.0.0.232" => "trust")
55
will translate ip addresses coming from 10.0.0.232 to real ip addresses extracted from X-Forwarded-For: HTTP request header.
60
The effect of this module is variable on $HTTP["remotip"] directives and other module's remote ip dependent actions.
61
Things done by modules before we change the remoteip or after we reset it will match on the proxy's IP.
62
Things done in between these two moments will match on the real client's IP.
63
The moment things are done by a module depends on in which hook it does things and within the same hook
64
on whether they are before/after us in the module loading order
65
(order in the server.modules directive in the config file).
69
mod_access: Will match on the real client.
72
In order to see the "real" ip address in access log ,
73
you'll have to load mod_extforward after mod_accesslog.
85
Trust proxy 10.0.0.232 and 10.0.0.232 ::
87
extforward.forwarder = (
88
"10.0.0.232" => "trust",
89
"10.0.0.233" => "trust",
92
Trust all proxies (NOT RECOMMENDED!) ::
94
extforward.forwarder = ( "all" => "trust")
96
Note that "all" has precedence over specific entries, so "all except" setups will not work.
added
removed
doc/extforward.txt
