Re: Help needed with X-Forwarded-For

2007-09-21 Thread Ian Holsman
Leo Soto M. wrote: > On 9/20/07, Deryck Hodge <[EMAIL PROTECTED]> wrote: > >> I completely agree you shouldn't use this middleware unless you know >> and trust the proxy setup, but I can easily imagine (large corporate >> networks) a situation where there could be multiple proxies. Seems to

Re: Help needed with X-Forwarded-For

2007-09-21 Thread Leo Soto M.
On 9/21/07, Deryck Hodge <[EMAIL PROTECTED]> wrote: [...] > Of course, this is straying a bit from the original topic. I still > think the middleware as reverted by Jacob is correct. Whether or not > you trust REMOTE_ADDR to be the actual client IP after using the > middleware is a matter of

Re: Help needed with X-Forwarded-For

2007-09-21 Thread Deryck Hodge
On 9/20/07, Chris Bennett <[EMAIL PROTECTED]> wrote: > > As an aside, is anyone talking about seriously using this for access > control? We've established that using X-F-F is a bad idea for that, in > fact, I'd say that even known REMOTE_ADDR based auth is a bad idea, so > why does it matter

Re: Help needed with X-Forwarded-For

2007-09-21 Thread Deryck Hodge
On 9/20/07, Leo Soto M. <[EMAIL PROTECTED]> wrote: > > On 9/20/07, Deryck Hodge <[EMAIL PROTECTED]> wrote: > > > > A quick Google search turns up that this is indeed easily configurable > > for both Squid and mod_proxy and the defaults look sane. > > What are those defaults?. > > My google-foo is

Re: Help needed with X-Forwarded-For

2007-09-20 Thread Chris Bennett
As an aside, is anyone talking about seriously using this for access control? We've established that using X-F-F is a bad idea for that, in fact, I'd say that even known REMOTE_ADDR based auth is a bad idea, so why does it matter whether it is "trustworthy"? Anyway - I use X-F-F for IP

Re: Help needed with X-Forwarded-For

2007-09-20 Thread Leo Soto M.
On 9/20/07, Deryck Hodge <[EMAIL PROTECTED]> wrote: > > A quick Google search turns up that this is indeed easily configurable > for both Squid and mod_proxy and the defaults look sane. What are those defaults?. My google-foo is very low today, and I only arrived at the squid FAQ[1], which says

Re: Help needed with X-Forwarded-For

2007-09-20 Thread Deryck Hodge
On 9/20/07, Leo Soto M. <[EMAIL PROTECTED]> wrote: > > On 9/20/07, Deryck Hodge <[EMAIL PROTECTED]> wrote: > > I guess I would challenge the notion, too, that you can't trust the > > client IP when you trust the proxy or proxies, at least in the sense > > of knowing trusted proxies versus

Re: Help needed with X-Forwarded-For

2007-09-20 Thread Leo Soto M.
On 9/20/07, Deryck Hodge <[EMAIL PROTECTED]> wrote: > I guess I would challenge the notion, too, that you can't trust the > client IP when you trust the proxy or proxies, at least in the sense > of knowing trusted proxies versus untrusted. For example, if my setup > has proxies p1 and p2: > >

Re: Help needed with X-Forwarded-For

2007-09-20 Thread Chris Bennett
Since there seems to be two use cases, might I suggest forking the secondary use case into a separate middleware class? Whether or not the trusted reverse proxy scenario is more common (though I believe it is), it's best to avoid breaking existing functionality, especially when the

Re: Help needed with X-Forwarded-For

2007-09-20 Thread Deryck Hodge
On 9/20/07, Leo Soto M. <[EMAIL PROTECTED]> wrote: > > On 9/20/07, Deryck Hodge <[EMAIL PROTECTED]> wrote: > [...] > > But what about the case of multiple trusted proxies (not the case of > > the client acting as a proxy)? Or what about if the proxy sends the > > XFF header as [CLIENTIP,

Re: Help needed with X-Forwarded-For

2007-09-20 Thread Leo Soto M.
On 9/20/07, Leo Soto M. <[EMAIL PROTECTED]> wrote: > Now, if having a reliable remote IP address is important, then a > setting (NUMBER_OF_TRUSTED_PROXY_SERVERS?) specifying how many values > you can trust is the only thing that occurs to me. (I'm not that > creative). Doh. That was a

Re: Help needed with X-Forwarded-For

2007-09-20 Thread Leo Soto M.
On 9/20/07, Deryck Hodge <[EMAIL PROTECTED]> wrote: [...] > But what about the case of multiple trusted proxies (not the case of > the client acting as a proxy)? Or what about if the proxy sends the > XFF header as [CLIENTIP, PROXYIP] which is what I believe the major > ones do and what cause

Re: Help needed with X-Forwarded-For

2007-09-20 Thread Deryck Hodge
On 9/20/07, Leo Soto M. <[EMAIL PROTECTED]> wrote: > > On 9/20/07, Deryck Hodge <[EMAIL PROTECTED]> wrote: > > I completely agree you shouldn't use this middleware unless you know > > and trust the proxy setup, but I can easily imagine (large corporate > > networks) a situation where there could

Re: Help needed with X-Forwarded-For

2007-09-20 Thread Leo Soto M.
On 9/20/07, Deryck Hodge <[EMAIL PROTECTED]> wrote: > I completely agree you shouldn't use this middleware unless you know > and trust the proxy setup, but I can easily imagine (large corporate > networks) a situation where there could be multiple proxies. Seems to > me its better to be clear of

Re: Help needed with X-Forwarded-For

2007-09-20 Thread Jacob Kaplan-Moss
On 9/20/07, Leo Soto M. <[EMAIL PROTECTED]> wrote: > Anyway, please *do not* revert it. Such change would make easy to fake > the remote address when using that middleware. If people are _really_ > using more than one trusted proxy (a transparent Squid getting in the > way maybe?), the middleware

Re: Help needed with X-Forwarded-For

2007-09-20 Thread Deryck Hodge
Hi, Leo. On 9/20/07, Leo Soto M. <[EMAIL PROTECTED]> wrote: > Wikipedia isn't confirming that the first IP should be taken. It says > that the first entry is the "farthest downstream client". But if you > are going to believe it, you are blindly trusting on every downstream > client who is

Re: Help needed with X-Forwarded-For

2007-09-20 Thread Leo Soto M.
On 9/20/07, Craig Ogg <[EMAIL PROTECTED]> wrote: > > On 9/20/07, Jacob Kaplan-Moss <[EMAIL PROTECTED]> wrote: > > Django's SetRemoteAddrFromForwardedFor middleware used to take the > > *first* item in the X-F-F header, but after > > http://code.djangoproject.com/ticket/3872 was filed we changed

Re: Help needed with X-Forwarded-For

2007-09-20 Thread Jacob Kaplan-Moss
On 9/20/07, Deryck Hodge <[EMAIL PROTECTED]> wrote: > In the comments for the article Simon cited on the ticket, Bob > confirms left most is client, right most is last proxy but he was > trying for the most trust worthy IP in the chain, not the client's IP. > I'm pretty sure this is the norm.

Re: Help needed with X-Forwarded-For

2007-09-20 Thread Leo Soto M.
On 9/20/07, Jacob Kaplan-Moss <[EMAIL PROTECTED]> wrote: > > Howdy folks -- > > So I need a bit of help figuring out how to handle X-Forwarded-For, > and specifically what to do in the presance of multiple IPs. > > Django's SetRemoteAddrFromForwardedFor middleware used to take the > *first* item

Re: Help needed with X-Forwarded-For

2007-09-20 Thread Deryck Hodge
On 9/20/07, Jacob Kaplan-Moss <[EMAIL PROTECTED]> wrote: > > Howdy folks -- > > So I need a bit of help figuring out how to handle X-Forwarded-For, > and specifically what to do in the presance of multiple IPs. > > Django's SetRemoteAddrFromForwardedFor middleware used to take the > *first* item

Re: Help needed with X-Forwarded-For

2007-09-20 Thread Craig Ogg
On 9/20/07, Jacob Kaplan-Moss <[EMAIL PROTECTED]> wrote: > Django's SetRemoteAddrFromForwardedFor middleware used to take the > *first* item in the X-F-F header, but after > http://code.djangoproject.com/ticket/3872 was filed we changed it to > take the *last* IP. > That ticket use this article

Help needed with X-Forwarded-For

2007-09-20 Thread Jacob Kaplan-Moss
Howdy folks -- So I need a bit of help figuring out how to handle X-Forwarded-For, and specifically what to do in the presance of multiple IPs. Django's SetRemoteAddrFromForwardedFor middleware used to take the *first* item in the X-F-F header, but after