IP matching issue

[Anonymous]

Hi,

Just found your module (after a lot of searching!) it looks ideal for my purposes.

One thing I noted though is a potential problem with the IP matching. There are obvious benefits to matching the IP address to the session, however there are a lot of service providers whom will route requests via load balanced servers (not to mention the possibility of load balancing proxies at the server end). Perhaps a better solution would be to match the first (N-Auth_memCookie_MatchIP_ignoreBits) bits of the IP address where N = strchr(szRemoteIP,':') ? 128 : 32

C.

[Anonymous]

Something like…

- if (strcmp(szRemoteIP ,apr_table_get(pAuthSession,"RemoteIP"))) {
+ if (Auth_memCookie_cmp_ip(szRemoteIP ,apr_table_get(pAuthSession,"RemoteIP"), bits_to_ignore, r)) {
...
static int Auth_memCookie_cmp_ip(char *request_ip, char *stored_ip, int bits_to_ignore, request_rec *r)
{
   if (!bits_to_ignore) {
      return strcmp(request_ip, stored_ip);
   }
   apr_sockaddr_t requestSA;
   apr_ipsubnet_t *storedSubnet;
   apr_sockaddr_ip_set(&requestSA, request_ip);
   char *n = strchr(request_ip,':') ? "128" : "32";
   apr_ipsubnet_create(&storedSubnet, stored_ip, n, r);
   return apr_ipsubnet_test(storedSubnet, &requestSA);
}

[Anonymous]

(spot the deliberate bug! - need to substract bits_to_ignore from an integer value for n then create a string value to use in apr_ipsubnet_create)

[Anonymous]

A slightly less buggy version:

static int Auth_memCookie_cmp_ip(char *request_ip, char *stored_ip, int bits_to_ignore, request_rec *r)
{
   if (!bits_to_ignore) {
      return strcmp(request_ip, stored_ip);
   }
   apr_sockaddr_t requestSA;
   apr_ipsubnet_t *storedSubnet;
   char buf[10];
   
   apr_sockaddr_ip_set(&requestSA, request_ip);
   int n = strchr(request_ip,':') ? 128 : 32;
   sprintf(buf, "%d", (n-bits_to_ignore));
   apr_ipsubnet_create(&storedSubnet, stored_ip, buf, r);
   return apr_ipsubnet_test(&storedSubnet, &requestSA);
}

[Anonymous]

I should probably read the crap I write before posting it….

static int Auth_memCookie_cmp_ip(char *request_ip, char *stored_ip, int bits_to_ignore, request_rec *r)
{
   if (!bits_to_ignore) {
      return strcmp(request_ip, stored_ip);
   }
   apr_sockaddr_t requestSA;
   apr_ipsubnet_t *storedSubnet;
   char buf;
  
   apr_sockaddr_ip_set(&requestSA, request_ip);
   int n = strchr(request_ip,':') ? 128 : 32;
   sprintf(buf, "%d", (n-bits_to_ignore));
   apr_ipsubnet_create(&storedSubnet, stored_ip, buf, r);
   return apr_ipsubnet_test(storedSubnet, &requestSA);
}