Nginx + apache : REMOTE_ADDR and REMOTE_HOST bug

Server NGINX
1

Hello,
i’ve got a “funny” bug.

My installation is Nginx 1.0 and apache ( httpd ) behind.

Apache got’s mod_rpaf activated and HostNameLookups On.

When testing a php script i find this problem :

_SERVER[“REMOTE_HOST”]************<= my webserver hostname
_SERVER[“REMOTE_ADDR”]82.125.151.3<= my ip

Any idea ??? it’s really strange.

Thank you

2

Hello!

On Tue, Aug 30, 2011 at 06:06:37PM +0200, Albuquerque R. wrote:

_SERVER[“REMOTE_ADDR”]82.125.151.3<= my ip
I.e. client’s ip is correct, but client’s hostname still points to
your webserver, right? This looks like problem in mod_rpaf.

Maxim D.

3

Yes that’s right. It’s really strange that i’m the only one having this
problem with mod_rpaf 0.6 :frowning: :frowning: :frowning:

2011/8/30 Maxim D. [email protected]

4

BTW it’s not good idea to use HostNameLookups on production site since
these lookups may take long enough time.

–
Igor S.

30.08.2011, 20:23, Albuquerque R. [email protected] ():

5

Tha’s right but i really need this info… :frowning:

2011/8/30 Igor S. [email protected]

6

proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For
$proxy_add_x_forwarded_for;

And on apache :

LoadModule rpaf_module modules/mod_rpaf-2.0.so
RPAFenable On
RPAFsethostname On
RPAFproxy_ips 127.0.0.1
RPAFheader X-Forwarded-For

2011/8/30 Jim O. [email protected]

7

On 8/30/11 12:23 PM, Albuquerque R. wrote:

> Hello,

I.e. client's ip is correct, but client's hostname still points to
your webserver, right?  This looks like problem in mod_rpaf.

It looks like it’s reporting his IP, not that of the client and Apache
is doing a look up on that IP?

How are you passing the remote IP from nginx to Apache?

nginx mailing list
[email protected]
nginx Info Page

–
Jim O.

8

On 8/30/11 12:47 PM, Albuquerque R. wrote:

RPAFenable On
RPAFsethostname On
RPAFproxy_ips 127.0.0.1
RPAFheader X-Forwarded-For

Please do not top post. It makes following a thread much more difficult.

We use the following in Apache:

RPAFenable On
RPAFsethostname On
RPAFproxy_ips 127.0.0.1

First thing I would suggest is running a phpinfo script and seeing what
the value of _SERVER[“REMOTE_ADDR”] is.

Then comment out the line that begins with “RPAF header”, restart Apache
and run again and see if the value changes.

this
>
>     > _SERVER["REMOTE_ADDR"]82.125.151.3<= my ip
>
>
nginx mailing list
[email protected] <mailto:[email protected]>
http://mailman.nginx.org/mailman/listinfo/nginx

nginx mailing list
[email protected]
nginx Info Page

–
Jim O.

9

2011/8/30 Jim O. [email protected]

LoadModule rpaf_module modules/mod_rpaf-2.0.so http://mod_rpaf-2.0.so
RPAFenable On
RPAFsethostname On
RPAFproxy_ips 127.0.0.1

First thing I would suggest is running a phpinfo script and seeing what
the value of _SERVER[“REMOTE_ADDR”] is.

Changes done, nothing changed… Still the same problem…The fact is that
it seems mod_rpaf is working well because REMOTE_ADDR is good, but
REMOTE_HOST is not good :frowning: :frowning: :frowning:

10

On 8/30/11 2:29 PM, Albuquerque R. wrote:

>

Changes done, nothing changed… Still the same problem…The fact is
that it seems mod_rpaf is working well because REMOTE_ADDR is good, but
REMOTE_HOST is not good :frowning: :frowning: :frowning:

I agree. It is not resolving the IP incorrectly. It is not an issue with
nginx or with mod_rpaf.

>
>     >
Rui wrote:
>     >     > _SERVER["REMOTE_HOST"]************<= my webserver hostname
>     How are you passing the remote IP from nginx to Apache?
<mailto:[email protected] <mailto:[email protected]>>>
>
>

[email protected]
nginx Info Page

–
Jim O.

11

On 8/30/11 5:50 PM, Maxim D. wrote:

REMOTE_HOST is not good :frowning: :frowning: :frowning:
… this is obviously a problem in mod_rpaf. It fails to change
ip before resolving happens in Apache. (No idea if it’s actually
possible to implement this correctly though.)

Maxim, we could argue this pedantically all night long and never agree.
However, mod_rpaf is doing exactly what it’s designed to do which is to
report the remote IP address correctly. HostNameLookups is not a
function of mod_rpaf, it is a function of Apache core.

However… the function works properly in my testing as follows.

I created a small php script as follows:

<?php print ('Your IP is "'.$_SERVER['REMOTE_ADDR'].'". '); print ('Your Host is "'.$_SERVER["REMOTE_HOST"].'".'); ?>

I turned on “HostNameLookups” in Apache.

Attached is the result.

This is indeed my IP and host.

Why it’s not working for the OP I cannot explain, but it does seem to
work correctly as does “HostNameLookups” directive.

12

2011/8/31 Jim O. [email protected]

that it seems mod_rpaf is working well because REMOTE_ADDR is good, but
> > your webserver, right? This looks like problem in

?>

While accessing the page directly from apache i’ve got the good values
too. But when i pass by nginx then apache ( mod_rpaf ) the hostname is
not
right :frowning:

13

Hello!

On Tue, Aug 30, 2011 at 04:17:52PM -0400, Jim O. wrote:

On 8/30/11 2:29 PM, Albuquerque R. wrote:

[…]

Changes done, nothing changed… Still the same problem…The fact is
that it seems mod_rpaf is working well because REMOTE_ADDR is good, but
REMOTE_HOST is not good :frowning: :frowning: :frowning:

I agree. It is not resolving the IP incorrectly. It is not an issue with
nginx or with mod_rpaf.

As I wrote in my original reply…

>     >     I.e. client's ip is correct, but client's hostname still

points to

>     >     your webserver, right?  This looks like problem in mod_rpaf.

… this is obviously a problem in mod_rpaf. It fails to change
ip before resolving happens in Apache. (No idea if it’s actually
possible to implement this correctly though.)

Maxim D.

14

2011/8/31 Albuquerque R. [email protected]

nginx or with mod_rpaf.
possible to implement this correctly though.)

<?php

I’ve patched the thing with a php script. In fact i don’t really need
hostname everywhere and hostnamelookups is activated only for some
vhosts.
So this is the patch :

15

On 31.08.2011 10:03, Albuquerque R. wrote:

While accessing the page directly from apache i’ve got the good
values too. But when i pass by nginx then apache ( mod_rpaf ) the
hostname is not right :frowning:

in request from nginx to apache backend - you set correct
client hostname in the X-Forwarded-Host or X-Host header?

RPAFsethostname on;

means what you must provide desirable client hostname:

source of mod_rpaf-0.6\mod_rpaf-2.0.c

if (cfg->sethostname) {
const char hostvalue;
if (hostvalue = apr_table_get(r->headers_in, “X-Forwarded-Host”)) {
/ 2.0 proxy frontend or 1.3 => 1.3.25 proxy frontend /
apr_table_set(r->headers_in, “Host”, apr_pstrdup(r->pool,
hostvalue));
r->hostname = apr_pstrdup(r->pool, hostvalue);
ap_update_vhost_from_headers®;
} else if (hostvalue = apr_table_get(r->headers_in, “X-Host”)) {
/ 1.3 proxy frontend with mod_proxy_add_forward */
apr_table_set(r->headers_in, “Host”, apr_pstrdup(r->pool,
hostvalue));
r->hostname = apr_pstrdup(r->pool, hostvalue);
ap_update_vhost_from_headers®;
}
}

–
Best regards,
Gena

16

2011/8/31 Gena M. [email protected]

RPAFsethostname on;
apr_table_set(r->headers_in, “Host”, apr_pstrdup(r->pool,
}

In fact event with RPAFsethostname on; commented, there’s a problem. In
this
case we are talking about client remote hostname…

17

On 31.08.2011 14:57, Albuquerque R. wrote:

While accessing the page directly from apache i’ve got the good
values too. But when i pass by nginx then apache ( mod_rpaf ) the
hostname is not right :frowning:

[…]

In this case we are talking about client remote hostname…

probably this is bug / misfeature in mod_rpaf / apache+mod_rpaf.
and obviously such behavior of apache+mod_rpaf is not nginx bug.

mod_rpaf change only client IP and not change client hostname
see details in fuction “change_remote_ip” in mod_rpaf sources

p.s. most probably this is mod_rpaf bug / misfeature.
may be try ask support in mod_rpaf/apache mail lists?

–
Best regards,
Gena