apache - Varnish、Nginx、SSL - IP 检测问题

Question

您好，我有一个非常奇怪的问题，托管公司告诉我这不可能，我希望你们能提供帮助。

我有一个 nginx/varnish，它在我的网络服务器前面充当负载平衡器和缓存。我的网络服务器是标准的 Apache 网络服务器。

我在检测连接到系统的用户的真实 IP 地址时遇到问题。 $_SERVER["REMOTE_ADDR"] 显示负载均衡器/缓存的 IP 地址，而不是访问该站点的用户的 IP 地址。

我们已经编写了一个 hack，以便我们通过带有正确 IP 地址的 X-Forwarded-For header 发送 HTTP 流量，但我被告知这在 SSL 中是不可能的。

不幸的是，由于严格的安全要求，我们无法将 SSL 卸载到它必须转到 apache 的负载平衡器/缓存上。

有没有人知道我们如何在使用 SSL 时检测 IP 地址？

谢谢你的帮助，Si

--- VCL 配置---

import std;

C{
        #include <stdlib.h>
}C



sub vcl_recv {    
/* Add X-Forwarded-For header */
    if (req.restarts == 0) {
        if (req.http.X-Forwarded-For) {
            set req.http.X-Forwarded-For = req.http.X-Forwarded-For + ", " + client.ip;
        } else {
            set req.http.X-Forwarded-For = client.ip;
        }
    }



    /* Fix compression */
    if (req.http.Accept-Encoding) {
        if (req.url ~ "\.(ico|png|jpe?g|gif|xpm|swf|flv|pdf|mp3|ogg|zip|gz|tgz|bz2|xz|7z)$") {
            remove req.http.Accept-Encoding;
        } else if (req.http.Accept-Encoding ~ "gzip") {
            set req.http.Accept-Encoding = "gzip";
        } else if (req.http.Accept-Encoding ~ "deflate") {
            set req.http.Accept-Encoding = "deflate";
        } else {
            remove req.http.Accept-Encoding;
        }
    }

    /* Handle SSL offloading */
    if (client.ip == "127.0.0.1") {
        std.log("SSL offloading detected " + client.ip + " " + req.http.X-Real-IP);
        set client.identity = req.http.X-Real-IP;
    } else {
        set client.identity = client.ip;
    }

    if (req.http.Cookie) {
       set client.identity = req.http.Cookie;
    }


    set req.http.X-Varnish-XID = req.xid;
    set req.backend = lb231;

    if (req.backend.healthy) {
        set req.grace = 30s;
    } else {
        set req.grace = 1h;
    }

        call normalise_user_agent;

    if (req.request == "PURGE") {
        if (!client.ip ~ purge) {
            error 405 "Not allowed.";
        }
        return(lookup);
    }

    if (req.request != "GET" &&
       req.request != "HEAD" &&
       req.request != "PUT" &&
       req.request != "POST" &&
       req.request != "TRACE" &&
       req.request != "OPTIONS" &&
       req.request != "DELETE") {
        return (pipe);
    }

    if (req.http.Cookie) {
                set req.http.Cookie = ";" + req.http.Cookie;
                set req.http.Cookie = regsuball(req.http.Cookie, "; +", ";");
                set req.http.Cookie = regsuball(req.http.Cookie, ";(PHPSESSID)=", "; \1="); # Cookies to keep here
                set req.http.Cookie = regsuball(req.http.Cookie, ";[^ ][^;]*", "");
                set req.http.Cookie = regsuball(req.http.Cookie, "^[; ]+|[; ]+$", "");

                if (req.http.Cookie == "") {
                        remove req.http.Cookie;
                }
    }

    if (req.request != "GET" && req.request != "HEAD") {
         return (pass);
    }


    if (req.url ~ "/nocache") {
        set req.http.X-No-Cache = "true";
        return (pass);
    }

    if (req.request == "BAN") {
        if (client.ip ~ purge) {
            error 401 "Forbidden";
        }
        ban("req.http.Host == " + req.http.X-VCL-Ban-Host + " && req.url ~ " + req.http.X-VCL-Ban-URL);
        error 200 "Ban OK " + req.url + " " + req.http.Host;
    }

    if (req.request == "REFRESH") {
        set req.request = "GET";
        set req.hash_always_miss = true;
    }

    if (req.request != "GET" && req.request != "HEAD") {
        return (pass);
    }

    return (lookup);
}


    if (beresp.status >= 400) {
        /* Cache error pages for a short amount of time */
        set beresp.ttl = 5s;
        set beresp.grace = 5s;
        set beresp.http.Cache-Control = "max-age=5, must-revalidate";
        unset beresp.http.Cookie;
        unset beresp.http.Set-Cookie;
    }

    if (beresp.status == 503) {
        /* Do not cache 503s at all */
        set beresp.ttl = 0s;
        set beresp.http.Cache-Control = "no-store, no-cache, must-revalidate";
        set beresp.http.Pragma = "no-cache";
    }

     if (beresp.http.X-Varnish-TTL) {
        C{
            char *ttl;
            ttl = VRT_GetHdr(sp, HDR_BERESP, "\016X-Varnish-TTL:");
            VRT_l_beresp_ttl(sp, atoi(ttl));
        }C
        #unset beresp.http.X-Varnish-TTL;
    } else {
        set beresp.ttl = 0s;
    }

    if (beresp.ttl <= 0s) {
        set beresp.http.X-Cacheable = "No, not cacheable.";
    } elsif (req.http.Cookie ~ "(UserID|_session)") {
        set beresp.http.X-Cacheable = "No, got session.";
        return(hit_for_pass);
    } elsif (beresp.http.Cache-Control ~ "private") {
        set beresp.http.X-Cacheable = "No, Cache-Control=private";
        return(hit_for_pass);
    } else {
        set beresp.http.X-Cacheable = "Yes.";
        set beresp.grace = 1h;
    }
}

sub vcl_deliver {
    if (resp.http.reset-client-side-age) {
       unset resp.http.reset-client-side-age;
       set resp.http.Age = "0";
    }

    if (obj.hits > 0) {
        set resp.http.X-Cache = "Hit";
        set resp.http.X-Cache-Hits = obj.hits;
    } else {
        set resp.http.X-Cache = "Miss";
    }

    if (resp.http.Server == "Varnish") {
        set resp.http.Server = "OnCommerce Framework Ltd";
    }

    unset resp.http.X-Varnish;
    unset resp.http.X-Scrubbed-For;
}

sub vcl_hit {
    if (req.request == "PURGE") {
        purge;
        error 200 "Purged.";
    }
}

sub vcl_miss {
    if (req.request == "PURGE") {
        purge;
        error 200 "Purged.";
    }
}

sub vcl_pipe {
    set bereq.http.Connection = "close";
}

sub vcl_error {

}

sub normalise_user_agent
{
                if(req.http.user-agent ~ "Mobile"){
                                set req.http.X-UA = "mobile";
                }
                else if (req.http.user-agent ~ "Android")
                {
                                set req.http.X-UA = "android";
                }
                else if (req.http.user-agent ~ "Opera Mini/")
                {
                                set req.http.X-UA = "mobile";
                }
                else if (req.http.user-agent ~ "Opera Mobi/")
                {
                                set req.http.X-UA = "mobile";
                }
                else if (req.http.user-agent ~ "iP(ad|od|hone)/")
                {
                                set req.http.X-UA = "iOS";
                }
                else if (req.http.user-agent ~ "MSIE/")
                {
                                if(req.http.user-agent ~ "MSIE\s[1-7]/")
                                {
                                                set req.http.X-UA = "desktop-old";
                                }
                                else
                                {
                                                set req.http.X-UA = "desktop";
                                }
                }
                else if (req.http.user-agent ~ "Chrome/")
                {
                                set req.http.X-UA = "desktop";
                }
                else if (req.http.user-agent ~ "Firefox/")
                {
                                set req.http.X-UA = "desktop";
                }
                else if (req.http.user-agent ~ "Waterfox/")
                {
                                set req.http.X-UA = "desktop";
                }
                else if (req.http.user-agent ~ "Safari/")
                {
                                set req.http.X-UA = "desktop";
                }
                else if (req.http.user-agent ~ "Opera/")
                {
                                set req.http.X-UA = "desktop";
                }
                else if (req.http.user-agent ~ "curl/")
                {
                                set req.http.X-UA = "desktop";
                }
                else
                {
                                set req.http.X-UA = req.http.user-agent;
                }
}

Answer 1

在我的 default.vcl 文件中，我以这种方式重写了“X-Forwarded-For” header :

sub vcl_recv {

    # your code

    remove req.http.X-Forwarded-For;
    set req.http.X-Forwarded-For = client.ip;

    # your code again
}

不知道这是否是您所指的 hack，但这种方式对我们有用。删除实际 header 很重要，这样它就不会像新 header 一样被传输。

我们有 CloudFlare + Varnish，一切正常!