Attachment #177905 for bug #209869




# $FreeBSD$

PORTNAME=	mod_rpaf
PORTVERSION=	0.8.4
DISTVERSIONPREFIX=	v
PORTREVISION=	3
CATEGORIES=	www
PKGNAMESUFFIX=	2


MAINTAINER=	apache@FreeBSD.org
COMMENT=	Make proxied requests appear with client IP

LICENSE=	APACHE20

USE_GITHUB=	yes
GH_ACCOUNT=	gnif
GH_TAGNAME=	v0.8.4

DOCS=	README.md

USE_APACHE=	22+
AP_FAST_BUILD=	yes
AP_GENPLIST=	yes
SHORTMODNAME=	rpaf

SRC_FILE=	mod_rpaf.c

APMOD_FILE=	200_mod_rpaf.conf.sample
PLIST_SUB+=	APMOD_FILE=${APMOD_FILE}
PLIST_FILES=	@sample\ %%APACHEETCDIR%%/modules.d/200_${PORTNAME}.conf.sample \
		%%APACHEMODDIR%%/${PORTNAME}.so
SUB_FILES=	${APMOD_FILE}

PORTDOCS=	README.md

.include <bsd.port.pre.mk>

post-install:
	@${MKDIR} ${STAGEDIR}${PREFIX}/${APACHEETCDIR}/modules.d ${STAGEDIR}${DOCSDIR}
	${INSTALL_DATA} ${WRKDIR}/${APMOD_FILE} ${STAGEDIR}${PREFIX}/${APACHEETCDIR}/modules.d
	${INSTALL_DATA} ${WRKSRC}/README.md ${STAGEDIR}${DOCSDIR}

.include <bsd.port.post.mk>

Lines 1-3 Link Here

(-)www/mod_rpaf2/distinfo (-3 / +3 lines)
1	TIMESTAMP = 1464785880	1	TIMESTAMP = 1464885904
2	SHA256 (gnif-mod_rpaf-v0.6.0_GH0.tar.gz) = f89e51d7331d336a00833d6dc1cc786430d9f9c53bbbac97f22a96dbe803c7e7	2	SHA256 (gnif-mod_rpaf-0.8.4-v0.8.4_GH0.tar.gz) = b78f292d7336f839527d6fb2213116c995a525ad9aa38c344c485abbd76848f5
3	SIZE (gnif-mod_rpaf-v0.6.0_GH0.tar.gz) = 7643	3	SIZE (gnif-mod_rpaf-0.8.4-v0.8.4_GH0.tar.gz) = 6458




LoadModule rpaf_module	%%APACHEMODDIR%%/mod_rpaf.so
<IfModule mod_rpaf>
  # Enable reverse proxy add forward
  #RPAF_Enable On

  # What IPs & bitmasked subnets to adjust requests for
  #RPAF_ProxyIPs 127.0.0.1 10.0.0.0/24

  # The header to use for the real IP address
  #RPAF_Header X-Forwarded-For

  # Update vhost name so ServerName & ServerAlias work
  #RPAF_SetHostName Off

  # Set the HTTPS environment variable
  # to the header value contained in
  # X-HTTPS, or X-Forwarded-HTTPS. For
  # best results make sure that mod_ssl
  # is NOT enabled.
  #RPAF_SetHTTPS Off

  # Set the server port to the header
  # value contained in X-Port, or
  # X-Forwarded-Port.
  # (see https://github.com/gnif/mod_rpaf/issues/12)
  #RPAF_SetPort Off

  # Option to forbid request if not from
  # trusted RPAF_ProxyIPs; otherwise
  # cannot be done with Allow/Deny after
  # remote addr substitution
  #RPAF_ForbidIfNotProxy Off
</IfModule>

Line 0 Link Here

(-)www/mod_rpaf2/files/patch-mod__rpaf.c (+11 lines)
	1	--- mod_rpaf.c.orig 2016-12-12 09:04:09 UTC
	2	+++ mod_rpaf.c
	3	@@ -114,7 +114,7 @@ static const char *rpaf_set_proxy_ip(cmd
	4
	5	if (rpaf_looks_like_ip(proxy_ip)) {
	6	ip = apr_pstrdup(cmd->temp_pool, proxy_ip);
	7	- if (mask = ap_strchr(ip, '/')) {
	8	+ if ((mask = ap_strchr(ip, '/'))) {
	9	*mask++ = '\0';
	10	}
	11	sub = (apr_ipsubnet_t **)apr_array_push(cfg->proxy_ips);




PR: ports/179525 	Fix for mod_rpaf2 compatibility with Apache 2.4
========================================================================
--- ./mod_rpaf-2.0.c.orig
+++ ./mod_rpaf-2.0.c
@@ -86,6 +86,23 @@
     request_rec *r;
 } rpaf_cleanup_rec;
 
+
+inline apr_sockaddr_t * rpaf_client_addr(conn_rec *c) {
+#if AP_SERVER_MAJORVERSION_NUMBER >= 2 && AP_SERVER_MINORVERSION_NUMBER >= 4
+  return c->client_addr;
+#else
+  return c->remote_addr;
+#endif
+}
+
+inline char * rpaf_client_ip(conn_rec *c) {
+#if AP_SERVER_MAJORVERSION_NUMBER >= 2 && AP_SERVER_MINORVERSION_NUMBER >= 4
+  return c->client_ip;
+#else
+  return c->remote_ip;
+#endif
+}
+
 static void *rpaf_create_server_cfg(apr_pool_t *p, server_rec *s) {
     rpaf_server_cfg *cfg = (rpaf_server_cfg *)apr_pcalloc(p, sizeof(rpaf_server_cfg));
     if (!cfg)
@@ -147,8 +164,9 @@
 
 static apr_status_t rpaf_cleanup(void *data) {
     rpaf_cleanup_rec *rcr = (rpaf_cleanup_rec *)data;
-    rcr->r->connection->remote_ip   = apr_pstrdup(rcr->r->connection->pool, rcr->old_ip);
-    rcr->r->connection->remote_addr->sa.sin.sin_addr.s_addr = apr_inet_addr(rcr->r->connection->remote_ip);
+    char *remote_ip = rpaf_client_ip(rcr->r->connection);
+    strcpy(remote_ip,apr_pstrdup(rcr->r->connection->pool, rcr->old_ip)); 
+    rpaf_client_addr(rcr->r->connection)->sa.sin.sin_addr.s_addr = apr_inet_addr(remote_ip);
     return APR_SUCCESS;
 }
 
@@ -160,8 +178,8 @@
 
     if (!cfg->enable)
         return DECLINED;
-
-    if (is_in_array(r->connection->remote_ip, cfg->proxy_ips) == 1) {
+    char *remote_ip = rpaf_client_ip(r->connection);
+    if (is_in_array(remote_ip, cfg->proxy_ips) == 1) {
         /* check if cfg->headername is set and if it is use
            that instead of X-Forwarded-For by default */
         if (cfg->headername && (fwdvalue = apr_table_get(r->headers_in, cfg->headername))) {
@@ -180,11 +198,11 @@
                 if (*fwdvalue != '\0')
                     ++fwdvalue;
             }
-            rcr->old_ip = apr_pstrdup(r->connection->pool, r->connection->remote_ip);
+            rcr->old_ip = apr_pstrdup(r->connection->pool, remote_ip);
             rcr->r = r;
             apr_pool_cleanup_register(r->pool, (void *)rcr, rpaf_cleanup, apr_pool_cleanup_null);
-            r->connection->remote_ip = apr_pstrdup(r->connection->pool, ((char **)arr->elts)[((arr->nelts)-1)]);
-            r->connection->remote_addr->sa.sin.sin_addr.s_addr = apr_inet_addr(r->connection->remote_ip);
+            strcpy(remote_ip,apr_pstrdup(r->connection->pool, ((char **)arr->elts)[((arr->nelts)-1)]));
+            rpaf_client_addr(r->connection)->sa.sin.sin_addr.s_addr = apr_inet_addr(remote_ip);
             if (cfg->sethostname) {
                 const char *hostvalue;
                 if (hostvalue = apr_table_get(r->headers_in, "X-Forwarded-Host")) {

Return to bug 209869

Lines 2-10 Link Here

(-)www/mod_rpaf2/Makefile (-6 / +23 lines)
2	# $FreeBSD$	2	# $FreeBSD$
3		3
4	PORTNAME= mod_rpaf	4	PORTNAME= mod_rpaf
5	PORTVERSION= 0.6.0	5	PORTVERSION= 0.8.4
6	DISTVERSIONPREFIX= v
7	PORTREVISION= 3
8	CATEGORIES= www	6	CATEGORIES= www
9	PKGNAMESUFFIX= 2	7	PKGNAMESUFFIX= 2
10		8
Lines 11-24 Link Here
11	MAINTAINER= apache@FreeBSD.org	9	MAINTAINER= apache@FreeBSD.org
12	COMMENT= Make proxied requests appear with client IP	10	COMMENT= Make proxied requests appear with client IP
13		11
		12	LICENSE= APACHE20
		13
14	USE_GITHUB= yes	14	USE_GITHUB= yes
15	GH_ACCOUNT= gnif	15	GH_ACCOUNT= gnif
		16	GH_TAGNAME= v0.8.4
16		17
		18	DOCS= README.md
		19
17	USE_APACHE= 22+	20	USE_APACHE= 22+
18	AP_FAST_BUILD= yes	21	AP_FAST_BUILD= yes
19	AP_GENPLIST= yes
20	SHORTMODNAME= rpaf	22	SHORTMODNAME= rpaf
21		23
22	SRC_FILE= mod_rpaf-2.0.c	24	SRC_FILE= mod_rpaf.c
23		25
24	.include <bsd.port.mk>	26	APMOD_FILE= 200_mod_rpaf.conf.sample
		27	PLIST_SUB+= APMOD_FILE=${APMOD_FILE}
		28	PLIST_FILES= @sample\ %%APACHEETCDIR%%/modules.d/200_${PORTNAME}.conf.sample \
		29	%%APACHEMODDIR%%/${PORTNAME}.so
		30	SUB_FILES= ${APMOD_FILE}
		31
		32	PORTDOCS= README.md
		33
		34	.include <bsd.port.pre.mk>
		35
		36	post-install:
		37	@${MKDIR} ${STAGEDIR}${PREFIX}/${APACHEETCDIR}/modules.d ${STAGEDIR}${DOCSDIR}
		38	${INSTALL_DATA} ${WRKDIR}/${APMOD_FILE} ${STAGEDIR}${PREFIX}/${APACHEETCDIR}/modules.d
		39	${INSTALL_DATA} ${WRKSRC}/README.md ${STAGEDIR}${DOCSDIR}
		40
		41	.include <bsd.port.post.mk>

Line 0 Link Here

(-)www/mod_rpaf2/files/200_mod_rpaf.conf.sample.in (+33 lines)
	1	LoadModule rpaf_module %%APACHEMODDIR%%/mod_rpaf.so
	2	<IfModule mod_rpaf>
	3	# Enable reverse proxy add forward
	4	#RPAF_Enable On
	5
	6	# What IPs & bitmasked subnets to adjust requests for
	7	#RPAF_ProxyIPs 127.0.0.1 10.0.0.0/24
	8
	9	# The header to use for the real IP address
	10	#RPAF_Header X-Forwarded-For
	11
	12	# Update vhost name so ServerName & ServerAlias work
	13	#RPAF_SetHostName Off
	14
	15	# Set the HTTPS environment variable
	16	# to the header value contained in
	17	# X-HTTPS, or X-Forwarded-HTTPS. For
	18	# best results make sure that mod_ssl
	19	# is NOT enabled.
	20	#RPAF_SetHTTPS Off
	21
	22	# Set the server port to the header
	23	# value contained in X-Port, or
	24	# X-Forwarded-Port.
	25	# (see https://github.com/gnif/mod_rpaf/issues/12)
	26	#RPAF_SetPort Off
	27
	28	# Option to forbid request if not from
	29	# trusted RPAF_ProxyIPs; otherwise
	30	# cannot be done with Allow/Deny after
	31	# remote addr substitution
	32	#RPAF_ForbidIfNotProxy Off
	33	</IfModule>

Lines 1-66 Link Here

(-)www/mod_rpaf2/files/patch-mod_rpaf-2.0.c (-66 lines)
1	PR: ports/179525 Fix for mod_rpaf2 compatibility with Apache 2.4
2	========================================================================
3	--- ./mod_rpaf-2.0.c.orig
4	+++ ./mod_rpaf-2.0.c
5	@@ -86,6 +86,23 @@
6	request_rec *r;
7	} rpaf_cleanup_rec;
8
9	+
10	+inline apr_sockaddr_t * rpaf_client_addr(conn_rec *c) {
11	+#if AP_SERVER_MAJORVERSION_NUMBER >= 2 && AP_SERVER_MINORVERSION_NUMBER >= 4
12	+ return c->client_addr;
13	+#else
14	+ return c->remote_addr;
15	+#endif
16	+}
17	+
18	+inline char * rpaf_client_ip(conn_rec *c) {
19	+#if AP_SERVER_MAJORVERSION_NUMBER >= 2 && AP_SERVER_MINORVERSION_NUMBER >= 4
20	+ return c->client_ip;
21	+#else
22	+ return c->remote_ip;
23	+#endif
24	+}
25	+
26	static void rpaf_create_server_cfg(apr_pool_t p, server_rec *s) {
27	rpaf_server_cfg cfg = (rpaf_server_cfg )apr_pcalloc(p, sizeof(rpaf_server_cfg));
28	if (!cfg)
29	@@ -147,8 +164,9 @@
30
31	static apr_status_t rpaf_cleanup(void *data) {
32	rpaf_cleanup_rec rcr = (rpaf_cleanup_rec )data;
33	- rcr->r->connection->remote_ip = apr_pstrdup(rcr->r->connection->pool, rcr->old_ip);
34	- rcr->r->connection->remote_addr->sa.sin.sin_addr.s_addr = apr_inet_addr(rcr->r->connection->remote_ip);
35	+ char *remote_ip = rpaf_client_ip(rcr->r->connection);
36	+ strcpy(remote_ip,apr_pstrdup(rcr->r->connection->pool, rcr->old_ip));
37	+ rpaf_client_addr(rcr->r->connection)->sa.sin.sin_addr.s_addr = apr_inet_addr(remote_ip);
38	return APR_SUCCESS;
39	}
40
41	@@ -160,8 +178,8 @@
42
43	if (!cfg->enable)
44	return DECLINED;
45	-
46	- if (is_in_array(r->connection->remote_ip, cfg->proxy_ips) == 1) {
47	+ char *remote_ip = rpaf_client_ip(r->connection);
48	+ if (is_in_array(remote_ip, cfg->proxy_ips) == 1) {
49	/* check if cfg->headername is set and if it is use
50	that instead of X-Forwarded-For by default */
51	if (cfg->headername && (fwdvalue = apr_table_get(r->headers_in, cfg->headername))) {
52	@@ -180,11 +198,11 @@
53	if (*fwdvalue != '\0')
54	++fwdvalue;
55	}
56	- rcr->old_ip = apr_pstrdup(r->connection->pool, r->connection->remote_ip);
57	+ rcr->old_ip = apr_pstrdup(r->connection->pool, remote_ip);
58	rcr->r = r;
59	apr_pool_cleanup_register(r->pool, (void *)rcr, rpaf_cleanup, apr_pool_cleanup_null);
60	- r->connection->remote_ip = apr_pstrdup(r->connection->pool, ((char **)arr->elts)[((arr->nelts)-1)]);
61	- r->connection->remote_addr->sa.sin.sin_addr.s_addr = apr_inet_addr(r->connection->remote_ip);
62	+ strcpy(remote_ip,apr_pstrdup(r->connection->pool, ((char **)arr->elts)[((arr->nelts)-1)]));
63	+ rpaf_client_addr(r->connection)->sa.sin.sin_addr.s_addr = apr_inet_addr(remote_ip);
64	if (cfg->sethostname) {
65	const char *hostvalue;
66	if (hostvalue = apr_table_get(r->headers_in, "X-Forwarded-Host")) {