Return to extforward.txt CVS log

Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / lighttpd / doc / outdated

Annotation of embedaddon/lighttpd/doc/outdated/extforward.txt, revision 1.1

1.1     ! misho       1: ==============
        !             2: mod_extforward
        !             3: ==============
        !             4: 
        !             5: .. contents::
        !             6: 
        !             7: Overview
        !             8: ========
        !             9: 
        !            10: Comman Kang <comman.kang at gmail.com> sent me: ::
        !            11: 
        !            12:   Hello jan.
        !            13: 
        !            14:        I've made something rough but similar to mod_extract_forwarded for
        !            15:   Apache.  This module will extract the client's "real" ip from
        !            16:   X-Forwarded-For header which is added by squid or other proxies. It might be
        !            17:   useful for servers behind reverse proxy servers.
        !            18: 
        !            19:        However, this module is causing segfault with mod_ssl or
        !            20:   $HTTP{''socket"} directive,  crashing in config_check_cond while patching
        !            21:   connection ,  I do not understand architecture of the lighttpd well, does it
        !            22:   need to call patch_connection in either handle_request_done and
        !            23:   connection_reset ?
        !            24: 
        !            25: Lionel Elie Mamane <lionel@mamane.lu> improved the patch: ::
        !            26: 
        !            27:     I've taken lighttpd-1.4.10-mod_extforward.c from the wiki and I've
        !            28:   extended it. Here is the result.
        !            29: 
        !            30:   Major changes:
        !            31: 
        !            32:    - IPv6 support
        !            33: 
        !            34:    - Fixed at least one segfault with SERVER['socket']
        !            35: 
        !            36:    - Arrange things so that a url.access-deny under scope of a
        !            37:      HTTP['remoteip'] condition works well :)
        !            38: 
        !            39:   I've commented the code in some places, mostly where I wasn't sure
        !            40:   what was going on, or I didn't see what the original author meant to
        !            41:   do.
        !            42: 
        !            43: Options
        !            44: =======
        !            45: 
        !            46: extforward.forwarder
        !            47:   Sets trust level of proxy IP's.
        !            48: 
        !            49:   Default: empty
        !            50: 
        !            51:   Example: ::
        !            52: 
        !            53:     extforward.forwarder = ("10.0.0.232" => "trust")
        !            54: 
        !            55:   will translate ip addresses coming from 10.0.0.232 to real ip addresses extracted from "X-Forwarded-For" or "Forwarded-For" HTTP request header.
        !            56: 
        !            57: extforward.headers
        !            58:   Sets headers to search for finding the originl addresses.
        !            59: 
        !            60:   Example (for use with a Zeus ZXTM loadbalancer): ::
        !            61: 
        !            62:     extforward.headers = ("X-Cluster-Client-Ip")
        !            63: 
        !            64:   Default: empty, results in searching for "X-Forwarded-For" and "Forwarded-For"
        !            65: 
        !            66: Note
        !            67: =======
        !            68: 
        !            69: The effect of this module is variable on $HTTP["remotip"] directives and other module's remote ip dependent actions.
        !            70: Things done by modules before we change the remoteip or after we reset it will match on the proxy's IP.
        !            71: Things done in between these two moments will match on the real client's IP.
        !            72: The moment things are done by a module depends on in which hook it does things and within the same hook
        !            73: on whether they are before/after us in the module loading order
        !            74: (order in the server.modules directive in the config file).
        !            75: 
        !            76: Tested behaviours:
        !            77: 
        !            78:   mod_access: Will match on the real client.
        !            79: 
        !            80:   mod_accesslog:
        !            81:    In order to see the "real" ip address in access log ,
        !            82:    you'll have to load mod_extforward after mod_accesslog.
        !            83:    like this: ::
        !            84: 
        !            85:     server.modules  = (
        !            86:        .....
        !            87:        mod_accesslog,
        !            88:        mod_extforward
        !            89:     )
        !            90: 
        !            91: Samples
        !            92: =======
        !            93: 
        !            94: Trust proxy 10.0.0.232 and 10.0.0.232 ::
        !            95: 
        !            96:   extforward.forwarder = (
        !            97:      "10.0.0.232" => "trust",
        !            98:      "10.0.0.233" => "trust",
        !            99:   )
        !           100: 
        !           101: Trust all proxies  (NOT RECOMMENDED!) ::
        !           102: 
        !           103:   extforward.forwarder = ( "all" => "trust")
        !           104: 
        !           105: Note that "all" has precedence over specific entries, so "all except" setups will not work.