mirror of
https://github.com/apache/httpd.git
synced 2025-08-05 16:55:50 +03:00
Update transformations.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1214021 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
@@ -153,9 +153,9 @@
|
|||||||
<li>Modules that load other modules later than the EXEC_ON_READ config
|
<li>Modules that load other modules later than the EXEC_ON_READ config
|
||||||
reading stage need to call ap_reserve_module_slots() or
|
reading stage need to call ap_reserve_module_slots() or
|
||||||
ap_reserve_module_slots_directive() in their pre_config hook.</li>
|
ap_reserve_module_slots_directive() in their pre_config hook.</li>
|
||||||
<li>The client IP address per request can now be specified independently
|
<li>The useragent IP address per request can now be specified
|
||||||
of the peer IP address of the connection for the benefit of load
|
independently of the client IP address of the connection for
|
||||||
balancers</li>
|
the benefit of load balancers</li>
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
|
|
||||||
@@ -459,8 +459,8 @@
|
|||||||
<dd>This has been renamed to ap_unixd_config.</dd>
|
<dd>This has been renamed to ap_unixd_config.</dd>
|
||||||
|
|
||||||
<dt><code>conn_rec->remote_ip and conn_rec->remote_addr</code></dt>
|
<dt><code>conn_rec->remote_ip and conn_rec->remote_addr</code></dt>
|
||||||
<dd>In order to distinguish between the peer IP address of the
|
<dd>In order to distinguish between the client IP address of the
|
||||||
connection, and the client IP address of the request potentially
|
connection, and the useragent IP address of the request potentially
|
||||||
overridden by a load balancer or proxy, the above variables have
|
overridden by a load balancer or proxy, the above variables have
|
||||||
been renamed. If a module makes reference to either of the above
|
been renamed. If a module makes reference to either of the above
|
||||||
variables, they need to be replaced with one of the following two
|
variables, they need to be replaced with one of the following two
|
||||||
@@ -471,10 +471,10 @@
|
|||||||
separated from the server by a transparent load balancer or
|
separated from the server by a transparent load balancer or
|
||||||
proxy, use request_rec->useragent_ip and
|
proxy, use request_rec->useragent_ip and
|
||||||
request_rec->useragent_addr.</li>
|
request_rec->useragent_addr.</li>
|
||||||
<li>When you require the IP address of the peer that is
|
<li>When you require the IP address of the client that is
|
||||||
connected directly to the server, which might be the client or
|
connected directly to the server, which might be the useragent or
|
||||||
might be the load balancer or proxy itself, use
|
might be the load balancer or proxy itself, use
|
||||||
conn_rec->peer_ip and conn_rec->peer_addr.</li>
|
conn_rec->client_ip and conn_rec->client_addr.</li>
|
||||||
</ul>
|
</ul>
|
||||||
</dd>
|
</dd>
|
||||||
</dl>
|
</dl>
|
||||||
|
@@ -185,8 +185,8 @@ from Clients' networks in a proxy context.</dd>
|
|||||||
<dt><a href="mod_proxy_scgi.html">mod_proxy_scgi</a></dt><dd>SCGI gateway module for <code class="module"><a href="../mod/mod_proxy.html">mod_proxy</a></code></dd>
|
<dt><a href="mod_proxy_scgi.html">mod_proxy_scgi</a></dt><dd>SCGI gateway module for <code class="module"><a href="../mod/mod_proxy.html">mod_proxy</a></code></dd>
|
||||||
<dt><a href="mod_ratelimit.html" id="R" name="R">mod_ratelimit</a></dt><dd>Bandwidth Rate Limiting for Clients</dd>
|
<dt><a href="mod_ratelimit.html" id="R" name="R">mod_ratelimit</a></dt><dd>Bandwidth Rate Limiting for Clients</dd>
|
||||||
<dt><a href="mod_reflector.html">mod_reflector</a></dt><dd>Reflect a request body as a response via the output filter stack.</dd>
|
<dt><a href="mod_reflector.html">mod_reflector</a></dt><dd>Reflect a request body as a response via the output filter stack.</dd>
|
||||||
<dt><a href="mod_remoteip.html">mod_remoteip</a></dt><dd>Replaces the original peer IP address for the connection
|
<dt><a href="mod_remoteip.html">mod_remoteip</a></dt><dd>Replaces the original client IP address for the connection
|
||||||
with the client IP address list presented by a proxies or a load balancer
|
with the useragent IP address list presented by a proxies or a load balancer
|
||||||
via the request headers.
|
via the request headers.
|
||||||
</dd>
|
</dd>
|
||||||
<dt><a href="mod_reqtimeout.html">mod_reqtimeout</a></dt><dd>Set timeout and minimum data rate for receiving requests
|
<dt><a href="mod_reqtimeout.html">mod_reqtimeout</a></dt><dd>Set timeout and minimum data rate for receiving requests
|
||||||
|
@@ -24,8 +24,8 @@
|
|||||||
<p><span>Available Languages: </span><a href="../en/mod/mod_remoteip.html" title="English"> en </a> |
|
<p><span>Available Languages: </span><a href="../en/mod/mod_remoteip.html" title="English"> en </a> |
|
||||||
<a href="../fr/mod/mod_remoteip.html" hreflang="fr" rel="alternate" title="Fran<61>ais"> fr </a></p>
|
<a href="../fr/mod/mod_remoteip.html" hreflang="fr" rel="alternate" title="Fran<61>ais"> fr </a></p>
|
||||||
</div>
|
</div>
|
||||||
<table class="module"><tr><th><a href="module-dict.html#Description">Description:</a></th><td>Replaces the original peer IP address for the connection
|
<table class="module"><tr><th><a href="module-dict.html#Description">Description:</a></th><td>Replaces the original client IP address for the connection
|
||||||
with the client IP address list presented by a proxies or a load balancer
|
with the useragent IP address list presented by a proxies or a load balancer
|
||||||
via the request headers.
|
via the request headers.
|
||||||
</td></tr>
|
</td></tr>
|
||||||
<tr><th><a href="module-dict.html#Status">Status:</a></th><td>Base</td></tr>
|
<tr><th><a href="module-dict.html#Status">Status:</a></th><td>Base</td></tr>
|
||||||
@@ -33,26 +33,27 @@ via the request headers.
|
|||||||
<tr><th><a href="module-dict.html#SourceFile">Source<63>File:</a></th><td>mod_remoteip.c</td></tr></table>
|
<tr><th><a href="module-dict.html#SourceFile">Source<63>File:</a></th><td>mod_remoteip.c</td></tr></table>
|
||||||
<h3>Summary</h3>
|
<h3>Summary</h3>
|
||||||
|
|
||||||
<p>This module is used to treat the client which initiated the
|
<p>This module is used to treat the useragent which initiated the
|
||||||
request as the originating client as identified by httpd for the
|
request as the originating useragent as identified by httpd for the
|
||||||
purposes of authorization and logging, even where that client is
|
purposes of authorization and logging, even where that useragent is
|
||||||
behind a load balancer, front end server, or proxy server.</p>
|
behind a load balancer, front end server, or proxy server.</p>
|
||||||
|
|
||||||
<p>The module overrides the peer IP address for the connection
|
<p>The module overrides the client IP address for the connection
|
||||||
with the client IP address reported in the request header configured
|
with the useragent IP address reported in the request header configured
|
||||||
with the <code class="directive">RemoteIPHeader</code> directive.</p>
|
with the <code class="directive">RemoteIPHeader</code> directive.</p>
|
||||||
|
|
||||||
<p>Once replaced as instructed, this overridden client IP address is
|
<p>Once replaced as instructed, this overridden useragent IP address is
|
||||||
then used for the <code class="module"><a href="../mod/mod_authz_host.html">mod_authz_host</a></code>
|
then used for the <code class="module"><a href="../mod/mod_authz_host.html">mod_authz_host</a></code>
|
||||||
<code class="directive"><a href="../mod/mod_authz_host.html#require ip"><Require ip></a></code>
|
<code class="directive"><a href="../mod/mod_authz_host.html#require ip"><Require ip></a></code>
|
||||||
feature, is reported by <code class="module"><a href="../mod/mod_status.html">mod_status</a></code>, and is recorded by
|
feature, is reported by <code class="module"><a href="../mod/mod_status.html">mod_status</a></code>, and is recorded by
|
||||||
<code class="module"><a href="../mod/mod_log_config.html">mod_log_config</a></code> <code>%a</code> and <code class="module"><a href="../mod/core.html">core</a></code>
|
<code class="module"><a href="../mod/mod_log_config.html">mod_log_config</a></code> <code>%a</code> and <code class="module"><a href="../mod/core.html">core</a></code>
|
||||||
<code>%a</code> format strings. The underlying peer IP of the connection
|
<code>%a</code> format strings. The underlying client IP of the connection
|
||||||
is available in the <code>%{c}a</code> format string.</p>
|
is available in the <code>%{c}a</code> format string.</p>
|
||||||
|
|
||||||
<div class="warning">It is critical to only enable this behavior from
|
<div class="warning">It is critical to only enable this behavior from
|
||||||
intermediate hosts (proxies, etc) which are trusted by this server, since
|
intermediate hosts (proxies, etc) which are trusted by this server, since
|
||||||
it is trivial for the remote client to impersonate another client.</div>
|
it is trivial for the remote useragent to impersonate another
|
||||||
|
useragent.</div>
|
||||||
</div>
|
</div>
|
||||||
<div id="quickview"><h3 class="directives">Directives</h3>
|
<div id="quickview"><h3 class="directives">Directives</h3>
|
||||||
<ul id="toc">
|
<ul id="toc">
|
||||||
@@ -76,22 +77,22 @@ via the request headers.
|
|||||||
<div class="section">
|
<div class="section">
|
||||||
<h2><a name="processing" id="processing">Remote IP Processing</a></h2>
|
<h2><a name="processing" id="processing">Remote IP Processing</a></h2>
|
||||||
|
|
||||||
<p>Apache by default identifies the client with the connection's
|
<p>Apache by default identifies the useragent with the connection's
|
||||||
peer_ip value, and the connection remote_host and remote_logname are
|
client_ip value, and the connection remote_host and remote_logname are
|
||||||
derived from this value. These fields play a role in authentication,
|
derived from this value. These fields play a role in authentication,
|
||||||
authorization and logging and other purposes by other loadable
|
authorization and logging and other purposes by other loadable
|
||||||
modules.</p>
|
modules.</p>
|
||||||
|
|
||||||
<p>mod_remoteip overrides the peer IP of the connection with the
|
<p>mod_remoteip overrides the client IP of the connection with the
|
||||||
advertised client IP as provided by a proxy or load balancer, for
|
advertised useragent IP as provided by a proxy or load balancer, for
|
||||||
the duration of the request. A load balancer might establish a long
|
the duration of the request. A load balancer might establish a long
|
||||||
lived keepalive connection with the server, and each request will
|
lived keepalive connection with the server, and each request will
|
||||||
have the correct client IP, even though the underlying peer IP
|
have the correct useragent IP, even though the underlying client IP
|
||||||
address of the load balancer remains unchanged.</p>
|
address of the load balancer remains unchanged.</p>
|
||||||
|
|
||||||
<p>When multiple, comma delimited client IP addresses are listed in the
|
<p>When multiple, comma delimited useragent IP addresses are listed in the
|
||||||
header value, they are processed in Right-to-Left order. Processing
|
header value, they are processed in Right-to-Left order. Processing
|
||||||
halts when a given client IP address is not trusted to present the
|
halts when a given useragent IP address is not trusted to present the
|
||||||
preceding IP address. The header field is updated to this remaining
|
preceding IP address. The header field is updated to this remaining
|
||||||
list of unconfirmed IP addresses, or if all IP addresses were trusted,
|
list of unconfirmed IP addresses, or if all IP addresses were trusted,
|
||||||
this header is removed from the request altogether.</p>
|
this header is removed from the request altogether.</p>
|
||||||
@@ -117,7 +118,7 @@ via the request headers.
|
|||||||
<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
|
<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
|
||||||
<div class="directive-section"><h2><a name="RemoteIPHeader" id="RemoteIPHeader">RemoteIPHeader</a> <a name="remoteipheader" id="remoteipheader">Directive</a></h2>
|
<div class="directive-section"><h2><a name="RemoteIPHeader" id="RemoteIPHeader">RemoteIPHeader</a> <a name="remoteipheader" id="remoteipheader">Directive</a></h2>
|
||||||
<table class="directive">
|
<table class="directive">
|
||||||
<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Declare the header field which should be parsed for client IP addresses</td></tr>
|
<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Declare the header field which should be parsed for useragent IP addresses</td></tr>
|
||||||
<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>RemoteIPHeader <var>header-field</var></code></td></tr>
|
<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>RemoteIPHeader <var>header-field</var></code></td></tr>
|
||||||
<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr>
|
<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr>
|
||||||
<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
|
<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
|
||||||
@@ -125,8 +126,8 @@ via the request headers.
|
|||||||
</table>
|
</table>
|
||||||
<p>The <code class="directive">RemoteIPHeader</code> directive triggers
|
<p>The <code class="directive">RemoteIPHeader</code> directive triggers
|
||||||
<code class="module"><a href="../mod/mod_remoteip.html">mod_remoteip</a></code> to treat the value of the specified
|
<code class="module"><a href="../mod/mod_remoteip.html">mod_remoteip</a></code> to treat the value of the specified
|
||||||
<var>header-field</var> header as the client IP address, or list
|
<var>header-field</var> header as the useragent IP address, or list
|
||||||
of intermediate client IP addresses, subject to further configuration
|
of intermediate useragent IP addresses, subject to further configuration
|
||||||
of the <code class="directive">RemoteIPInternalProxy</code> and
|
of the <code class="directive">RemoteIPInternalProxy</code> and
|
||||||
<code class="directive">RemoteIPTrustedProxy</code> directives. Unless these
|
<code class="directive">RemoteIPTrustedProxy</code> directives. Unless these
|
||||||
other directives are used, <code class="module"><a href="../mod/mod_remoteip.html">mod_remoteip</a></code> will trust all
|
other directives are used, <code class="module"><a href="../mod/mod_remoteip.html">mod_remoteip</a></code> will trust all
|
||||||
@@ -152,7 +153,7 @@ via the request headers.
|
|||||||
</table>
|
</table>
|
||||||
<p>The <code class="directive">RemoteIPInternalProxy</code> directive adds one
|
<p>The <code class="directive">RemoteIPInternalProxy</code> directive adds one
|
||||||
or more addresses (or address blocks) to trust as presenting a valid
|
or more addresses (or address blocks) to trust as presenting a valid
|
||||||
RemoteIPHeader value of the client IP. Unlike the
|
RemoteIPHeader value of the useragent IP. Unlike the
|
||||||
<code class="directive">RemoteIPTrustedProxy</code> directive, any IP address
|
<code class="directive">RemoteIPTrustedProxy</code> directive, any IP address
|
||||||
presented in this header, including private intranet addresses, are
|
presented in this header, including private intranet addresses, are
|
||||||
trusted when passed from these proxies.</p>
|
trusted when passed from these proxies.</p>
|
||||||
@@ -175,7 +176,7 @@ via the request headers.
|
|||||||
</table>
|
</table>
|
||||||
<p>The <code class="directive">RemoteIPInternalProxyList</code> directive specifies
|
<p>The <code class="directive">RemoteIPInternalProxyList</code> directive specifies
|
||||||
a file parsed at startup, and builds a list of addresses (or address blocks)
|
a file parsed at startup, and builds a list of addresses (or address blocks)
|
||||||
to trust as presenting a valid RemoteIPHeader value of the client IP.</p>
|
to trust as presenting a valid RemoteIPHeader value of the useragent IP.</p>
|
||||||
|
|
||||||
<p>The '<code>#</code>' hash character designates a comment line, otherwise
|
<p>The '<code>#</code>' hash character designates a comment line, otherwise
|
||||||
each whitespace or newline separated entry is processed identically to
|
each whitespace or newline separated entry is processed identically to
|
||||||
@@ -204,7 +205,7 @@ via the request headers.
|
|||||||
</table>
|
</table>
|
||||||
<p>The <code class="directive">RemoteIPProxiesHeader</code> directive specifies
|
<p>The <code class="directive">RemoteIPProxiesHeader</code> directive specifies
|
||||||
a header into which <code class="module"><a href="../mod/mod_remoteip.html">mod_remoteip</a></code> will collect a list of
|
a header into which <code class="module"><a href="../mod/mod_remoteip.html">mod_remoteip</a></code> will collect a list of
|
||||||
all of the intermediate client IP addresses trusted to resolve the client
|
all of the intermediate client IP addresses trusted to resolve the useragent
|
||||||
IP of the request. Note that intermediate
|
IP of the request. Note that intermediate
|
||||||
<code class="directive">RemoteIPTrustedProxy</code> addresses are recorded in
|
<code class="directive">RemoteIPTrustedProxy</code> addresses are recorded in
|
||||||
this header, while any intermediate
|
this header, while any intermediate
|
||||||
@@ -227,11 +228,11 @@ via the request headers.
|
|||||||
</table>
|
</table>
|
||||||
<p>The <code class="directive">RemoteIPTrustedProxy</code> directive adds one
|
<p>The <code class="directive">RemoteIPTrustedProxy</code> directive adds one
|
||||||
or more addresses (or address blocks) to trust as presenting a valid
|
or more addresses (or address blocks) to trust as presenting a valid
|
||||||
RemoteIPHeader value of the client IP. Unlike the
|
RemoteIPHeader value of the useragent IP. Unlike the
|
||||||
<code class="directive">RemoteIPInternalProxy</code> directive, any intranet
|
<code class="directive">RemoteIPInternalProxy</code> directive, any intranet
|
||||||
or private IP address reported by such proxies, including the 10/8, 172.16/12,
|
or private IP address reported by such proxies, including the 10/8, 172.16/12,
|
||||||
192.168/16, 169.254/16 and 127/8 blocks (or outside of the IPv6 public
|
192.168/16, 169.254/16 and 127/8 blocks (or outside of the IPv6 public
|
||||||
2000::/3 block) are not trusted as the client IP, and are left in the
|
2000::/3 block) are not trusted as the useragent IP, and are left in the
|
||||||
<code class="directive">RemoteIPHeader</code> header's value.</p>
|
<code class="directive">RemoteIPHeader</code> header's value.</p>
|
||||||
|
|
||||||
<div class="example"><h3>Trusted (Load Balancer) Example</h3><p><code>
|
<div class="example"><h3>Trusted (Load Balancer) Example</h3><p><code>
|
||||||
@@ -252,7 +253,7 @@ via the request headers.
|
|||||||
</table>
|
</table>
|
||||||
<p>The <code class="directive">RemoteIPTrustedProxyList</code> directive specifies
|
<p>The <code class="directive">RemoteIPTrustedProxyList</code> directive specifies
|
||||||
a file parsed at startup, and builds a list of addresses (or address blocks)
|
a file parsed at startup, and builds a list of addresses (or address blocks)
|
||||||
to trust as presenting a valid RemoteIPHeader value of the client IP.</p>
|
to trust as presenting a valid RemoteIPHeader value of the useragent IP.</p>
|
||||||
|
|
||||||
<p>The '<code>#</code>' hash character designates a comment line, otherwise
|
<p>The '<code>#</code>' hash character designates a comment line, otherwise
|
||||||
each whitespace or newline seperated entry is processed identically to
|
each whitespace or newline seperated entry is processed identically to
|
||||||
|
@@ -704,7 +704,7 @@ a different URL</td></tr>
|
|||||||
<tr class="odd"><td><a href="mod_alias.html#redirecttemp">RedirectTemp <var>URL-path</var> <var>URL</var></a></td><td></td><td>svdh</td><td>B</td></tr><tr class="odd"><td class="descr" colspan="4">Sends an external temporary redirect asking the client to fetch
|
<tr class="odd"><td><a href="mod_alias.html#redirecttemp">RedirectTemp <var>URL-path</var> <var>URL</var></a></td><td></td><td>svdh</td><td>B</td></tr><tr class="odd"><td class="descr" colspan="4">Sends an external temporary redirect asking the client to fetch
|
||||||
a different URL</td></tr>
|
a different URL</td></tr>
|
||||||
<tr><td><a href="mod_reflector.html#reflectorheader">ReflectorHeader <var>inputheader</var> <var>[outputheader]</var></a></td><td></td><td>svdh</td><td>B</td></tr><tr><td class="descr" colspan="4">Reflect an input header to the output headers</td></tr>
|
<tr><td><a href="mod_reflector.html#reflectorheader">ReflectorHeader <var>inputheader</var> <var>[outputheader]</var></a></td><td></td><td>svdh</td><td>B</td></tr><tr><td class="descr" colspan="4">Reflect an input header to the output headers</td></tr>
|
||||||
<tr class="odd"><td><a href="mod_remoteip.html#remoteipheader">RemoteIPHeader <var>header-field</var></a></td><td></td><td>sv</td><td>B</td></tr><tr class="odd"><td class="descr" colspan="4">Declare the header field which should be parsed for client IP addresses</td></tr>
|
<tr class="odd"><td><a href="mod_remoteip.html#remoteipheader">RemoteIPHeader <var>header-field</var></a></td><td></td><td>sv</td><td>B</td></tr><tr class="odd"><td class="descr" colspan="4">Declare the header field which should be parsed for useragent IP addresses</td></tr>
|
||||||
<tr><td><a href="mod_remoteip.html#remoteipinternalproxy">RemoteIPInternalProxy <var>proxy-ip</var>|<var>proxy-ip/subnet</var>|<var>hostname</var> ...</a></td><td></td><td>sv</td><td>B</td></tr><tr><td class="descr" colspan="4">Declare client intranet IP addresses trusted to present the RemoteIPHeader value</td></tr>
|
<tr><td><a href="mod_remoteip.html#remoteipinternalproxy">RemoteIPInternalProxy <var>proxy-ip</var>|<var>proxy-ip/subnet</var>|<var>hostname</var> ...</a></td><td></td><td>sv</td><td>B</td></tr><tr><td class="descr" colspan="4">Declare client intranet IP addresses trusted to present the RemoteIPHeader value</td></tr>
|
||||||
<tr class="odd"><td><a href="mod_remoteip.html#remoteipinternalproxylist">RemoteIPInternalProxyList <var>filename</var></a></td><td></td><td>sv</td><td>B</td></tr><tr class="odd"><td class="descr" colspan="4">Declare client intranet IP addresses trusted to present the RemoteIPHeader value</td></tr>
|
<tr class="odd"><td><a href="mod_remoteip.html#remoteipinternalproxylist">RemoteIPInternalProxyList <var>filename</var></a></td><td></td><td>sv</td><td>B</td></tr><tr class="odd"><td class="descr" colspan="4">Declare client intranet IP addresses trusted to present the RemoteIPHeader value</td></tr>
|
||||||
<tr><td><a href="mod_remoteip.html#remoteipproxiesheader">RemoteIPProxiesHeader <var>HeaderFieldName</var></a></td><td></td><td>sv</td><td>B</td></tr><tr><td class="descr" colspan="4">Declare the header field which will record all intermediate IP addresses</td></tr>
|
<tr><td><a href="mod_remoteip.html#remoteipproxiesheader">RemoteIPProxiesHeader <var>HeaderFieldName</var></a></td><td></td><td>sv</td><td>B</td></tr><tr><td class="descr" colspan="4">Declare the header field which will record all intermediate IP addresses</td></tr>
|
||||||
|
Reference in New Issue
Block a user