Bug 1471255 - X-Forwarded-For and related headers send the IPv6 form of the source IPv4 address
Summary: X-Forwarded-For and related headers send the IPv6 form of the source IPv4 add...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Routing
Version: 3.6.0
Hardware: Unspecified
OS: Unspecified
unspecified
urgent
Target Milestone: ---
: 3.7.0
Assignee: Phil Cameron
QA Contact: zhaozhanqi
URL:
Whiteboard:
Depends On:
Blocks: 1472976 1477673
TreeView+ depends on / blocked
 
Reported: 2017-07-14 20:16 UTC by Ben Bennett
Modified: 2017-11-28 22:01 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Cause: No doc change Consequence: Fix: Result:
Clone Of:
: 1472976 (view as bug list)
Environment:
Last Closed: 2017-11-28 22:01:28 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Origin (Github) 15229 None None None 2017-07-17 11:25:47 UTC
Origin (Github) 15566 None None None 2017-07-31 19:52:08 UTC
Red Hat Product Errata RHSA-2017:3188 normal SHIPPED_LIVE Moderate: Red Hat OpenShift Container Platform 3.7 security, bug, and enhancement update 2017-11-29 02:34:54 UTC

Description Ben Bennett 2017-07-14 20:16:37 UTC
Description of problem:

The X-Forwarded-For and related headers send the IPv6 form of the source IPv4 address.

e.g.:

	Forwarded: for=::ffff:172.17.0.3;host=hello-openshift-default.router.default.svc.cluster.local;proto=http
	X-Forwarded-For: ::ffff:172.17.0.3



Version-Release number of selected component (if applicable):

3.6.0


How reproducible:

Always


Steps to Reproduce:
1. Set up a router and a route
2. Run tcpdump to sniff the traffic on the target node, and watch for the http request from the proxy
3. curl --ipv4 172.17.0.3 -H 'Host: hello-openshift-default.router.default.svc.cluster.local'


Actual results:

	GET / HTTP/1.1
	User-Agent: curl/7.51.0
	Accept: */*
	Host: hello-openshift-default.router.default.svc.cluster.local
	X-Forwarded-Host: hello-openshift-default.router.default.svc.cluster.local
	X-Forwarded-Port: 80
	X-Forwarded-Proto: http
	Forwarded: for=::ffff:172.17.0.3;host=hello-openshift-default.router.default.svc.cluster.local;proto=http
	X-Forwarded-For: ::ffff:172.17.0.3



Expected results:

	GET / HTTP/1.1
	User-Agent: curl/7.51.0
	Accept: */*
	Host: hello-openshift-default.router.default.svc.cluster.local
	X-Forwarded-Host: hello-openshift-default.router.default.svc.cluster.local
	X-Forwarded-Port: 80
	X-Forwarded-Proto: http
	Forwarded: for=172.17.0.3;host=hello-openshift-default.router.default.svc.cluster.local;proto=http
	X-Forwarded-For: 172.17.0.3




Additional info:

Comment 1 Ben Bennett 2017-07-17 11:25:35 UTC
PR https://github.com/openshift/origin/pull/15229

Comment 2 openshift-github-bot 2017-07-21 05:59:13 UTC
Commit pushed to master at https://github.com/openshift/origin

https://github.com/openshift/origin/commit/7821bd5070fb167dfe455d017d338e22673d4cf3
Add an ENV to control ipv6 behavior in the router

This patch adds an environent variable called ROUTER_IP_V4_V6_MODE
which must be set to "v4" (the default), "v6", or "v4v6" to control
whether the router to binds to IPv4, IPv6, or both.

Note that when set to 'v6' or 'v4v6', the X-Forwarded-For and
Forwarded http headers will be in IPv6 form (even when the connection
was an IPv4 one, if set to 'v4v6').

Fixes bug 1471255 (https://bugzilla.redhat.com/show_bug.cgi?id=1471255)

Comment 3 Meng Bo 2017-07-31 07:36:21 UTC
The fix had been merged into latest ocp build, move it forward.

Comment 5 Ben Bennett 2017-07-31 19:53:05 UTC
Assigning this to @pcameron to shepherd in.  The PR is https://github.com/openshift/origin/pull/15566 to correct an issue.

Comment 7 Hongan Li 2017-10-09 05:21:03 UTC
verified in atomic-openshift-3.7.0-0.143.1.git.0.e152287 and the bug has been fixed.

1. ROUTER_IP_V4_V6_MODE=v4 (by default)
  forwarded: for=10.8.241.59;host=header-test-insecure-hongli.apps.1009-e6s.qe.rhcloud.com;proto=http
  x-forwarded-for: 10.8.241.59

2. ROUTER_IP_V4_V6_MODE=v4v6
  forwarded: for="[::ffff:10.8.241.59]";host=header-test-insecure-hongli.apps.1009-e6s.qe.rhcloud.com;proto=http
  x-forwarded-for: ::ffff:10.8.241.59

or
  forwarded: for="[3037::37]";host=header-test-insecure-hongli.apps.1009-e6s.qe.rhcloud.com;proto=http
  x-forwarded-for: 3037::37

2. ROUTER_IP_V4_V6_MODE=v6
  forwarded: for="[3037::37]";host=header-test-insecure-hongli.apps.1009-e6s.qe.rhcloud.com;proto=http
  x-forwarded-for: 3037::37

Comment 10 errata-xmlrpc 2017-11-28 22:01:28 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2017:3188


Note You need to log in before you can comment on or make changes to this bug.