Commit 1618a30e authored by Jim Jagielski's avatar Jim Jagielski
Browse files

Merge r1588330 from trunk: 

Prevent an external proxy from presenting an internal proxy
in mod_remoteip.c. PR 55962.

Submitted by: mrumph
Reviewed/backported by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1730684 13f79535-47bb-0310-9956-ffa450edef68
parent b2858210

CHANGES

+3 −0
Original line number Diff line number Diff line
@@ -4,6 +4,9 @@ Changes with Apache 2.4.19 
  *) core: Add expression support to SetHandler.

     [Eric Covener]



  *) mod_remoteip: Prevent an external proxy from presenting an internal

     proxy. PR 55962. [Mike Rumph]



  *) core: Prevent a server crash in case of an invalid CONNECT request with

     a custom error page for status code 400 that uses server side includes.

     PR 58929 [Ruediger Pluem]

STATUS

+0 −6
Original line number Diff line number Diff line
@@ -112,12 +112,6 @@ RELEASE SHOWSTOPPERS: 
PATCHES ACCEPTED TO BACKPORT FROM TRUNK:

  [ start all new proposals below, under PATCHES PROPOSED. ]



  *) mod_remoteip: Prevent an external proxy from presenting an internal proxy

     PR 55962.

     Trunk version of patch:

         http://svn.apache.org/r1588330

     Trunk patch applies clean, modulo CHANGES

     +1: wrowe, mrumph, jim





PATCHES PROPOSED TO BACKPORT FROM TRUNK:

modules/metadata/mod_remoteip.c

+20 −1
Original line number Diff line number Diff line
@@ -230,12 +230,25 @@ static int remoteip_modify_request(request_rec *r) 
    char *parse_remote;

    char *eos;

    unsigned char *addrbyte;



    /* If no RemoteIPInternalProxy, RemoteIPInternalProxyList, RemoteIPTrustedProxy

       or RemoteIPTrustedProxyList directive is configured,

       all proxies will be considered as external trusted proxies.

     */

    void *internal = NULL;



    if (!config->header_name) {

        return DECLINED;

    }

 

    if (config->proxymatch_ip) {

        /* This indicates that a RemoteIPInternalProxy, RemoteIPInternalProxyList, RemoteIPTrustedProxy

           or RemoteIPTrustedProxyList directive is configured.

           In this case, default to internal proxy.

         */

        internal = (void *) 1;

    }



    remote = (char *) apr_table_get(r->headers_in, config->header_name);

    if (!remote) {

        return OK;
@@ -254,7 +267,13 @@ static int remoteip_modify_request(request_rec *r) 
            match = (remoteip_proxymatch_t *)config->proxymatch_ip->elts;

            for (i = 0; i < config->proxymatch_ip->nelts; ++i) {

                if (apr_ipsubnet_test(match[i].ip, temp_sa)) {

                    if (internal) {

                        /* Allow an internal proxy to present an external proxy,

                           but do not allow an external proxy to present an internal proxy.

                           In this case, the presented internal proxy will be considered external.

                         */

                        internal = match[i].internal;

                    }

                    break;

                }

            }