https://bz.apache.org/bugzilla/show_bug.cgi?id=70207
Bug ID: 70207
Summary: RemoteIPTrustedProxyList / RemoteIPInternalProxyList
entries silently ignored at request time
Product: Apache httpd-2
Version: 2.4.6
Hardware: Other
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: mod_remoteip
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
It seems that combining RemoteIPTrustedProxy and RemoteIPTrustedProxyList does
not work, I could not find anything in the documentation regarding mixing these
directives so I am not sure if this is a bug or not.
Because the cdn ips change regularly i have a script in place that gets the
list of trusted ips via an api call and writes a TrustedProxyList.
Environment:
Apache HTTP Server: 2.4.68 (Debian, package apache2_2.4.68-1~deb13u1)
OS: Debian 13 ("trixie")
Relevant modules: mod_remoteip
Deployment topology: CDN (bunny.net) → Hetzner Cloud Load Balancer
(TLS-offloading) → Apache origin, using X-Forwarded-For as RemoteIPHeader
Configuration:
LogLevel remoteip:trace1
RemoteIPHeader X-Forwarded-For
RemoteIPInternalProxy 10.142.1.99
RemoteIPTrustedProxyList /etc/apache2/bunny-trusted-ips.lst
LogFormat "%t xff=\"%{X-Forwarded-For}i\" resolved=%a
proxylist=\"%{remoteip-proxy-ip-list}n\" status=%s uri=%U" xff_debug
CustomLog /var/log/apache2/xff-debug.log xff_debug
/etc/apache2/bunny-trusted-ips.lst contains one IP per line, confirmed to be a
clean Unix text file (file reports "ASCII text", no CRLF), e.g.:
185.111.111.155
Result with RemoteIPTrustedProxyList (broken)
xff="<client-ip>" resolved=185.111.111.155 proxylist="-"
The header was correctly stripped down to the real client IP, proving the
module read and processed the header content itself correctly — but %a
(resolved) still reports the CDN edge IP that should have been trusted and
walked past, and remoteip-proxy-ip-list is empty, showing the list-file entries
were never consulted for the trust check.
When i set the cdn edge ip as TrustedProxy it works:
RemoteIPHeader X-Forwarded-For
RemoteIPInternalProxy 10.142.1.99
RemoteIPTrustedProxy 185.111.111.155
Result: xff="-" resolved=<client-ip> proxylist="185.111.111.155"
Reproduced with a minimal single-entry file (echo "185.111.111.155" >
bunny-trusted-ips.lst) — same failure.
For now i updated the script to include the internal LB IP and just load the
TrustedProxyList which works also, just combining the directives seems to make
problems.
Kind regards
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
