Extended Remote IP functionality: Host, Port, "Protocol" (emulating HTTPS presence), etc. for running behind balancers/frontends

docs/manual/mod/mod_lua.html.en.utf8

@@ -517,7 +517,19 @@ end</pre>
           <td><code>is_https</code></td>
           <td>boolean</td>
           <td>no</td>
-          <td>Whether or not this request is done via HTTPS</td>
+          <td>Whether or not this request is done via HTTPS (alias to remote_is_https)</td>
+        </tr>
+<tr>
+          <td><code>remote_is_https</code></td>
+          <td>boolean</td>
+          <td>no</td>
+          <td>Whether or not this request is done via HTTPS locally or on frontend</td>
+        </tr>
+<tr class="odd">
+          <td><code>local_is_https</code></td>
+          <td>boolean</td>
+          <td>no</td>
+          <td>Whether or not the local connection is done via HTTPS</td>
         </tr>
 <tr>
           <td><code>is_initial_req</code></td>

docs/manual/mod/mod_lua.xml

@@ -484,7 +484,19 @@ end
           <td><code>is_https</code></td>
           <td>boolean</td>
           <td>no</td>
-          <td>Whether or not this request is done via HTTPS</td>
+          <td>Whether or not this request is done via HTTPS (alias to remote_is_https)</td>
+        </tr>
+        <tr>
+          <td><code>remote_is_https</code></td>
+          <td>boolean</td>
+          <td>no</td>
+          <td>Whether or not this request is done via HTTPS locally or on frontend</td>
+        </tr>
+        <tr>
+          <td><code>local_is_https</code></td>
+          <td>boolean</td>
+          <td>no</td>
+          <td>Whether or not the local connection is done via HTTPS</td>
         </tr>
         <tr>
           <td><code>is_initial_req</code></td>

include/ap_mmn.h

@@ -737,14 +737,15 @@
  * 20211221.29 (2.5.1-dev) Add ap_set_time_process_request() to scoreboard.h
  * 20211221.30 (2.5.1-dev) Add ap_stat_check() to httpd.h
  * 20211221.31 (2.5.1-dev) Add ap_*_timingsafe() to httpd.h
+ * 20211221.32 (2.5.1-dev) Add ap_remote_is_ssl() and hooks
  */
 
 #define MODULE_MAGIC_COOKIE 0x41503235UL /* "AP25" */
 
 #ifndef MODULE_MAGIC_NUMBER_MAJOR
 #define MODULE_MAGIC_NUMBER_MAJOR 20211221
 #endif
-#define MODULE_MAGIC_NUMBER_MINOR 31             /* 0...n */
+#define MODULE_MAGIC_NUMBER_MINOR 32             /* 0...n */
 
 /**
  * Determine if the server's current MODULE_MAGIC_NUMBER is at least a

include/http_request.h

@@ -622,6 +622,25 @@ AP_DECLARE_HOOK(int,force_authn,(request_rec *r))
  */
 AP_DECLARE_HOOK(apr_status_t,dirwalk_stat,(apr_finfo_t *finfo, request_rec *r, apr_int32_t wanted))
 
+/**
+ * This hook allows modules that virtualize SSL state (i.e. mod_remoteip)
+ * based on the data from remote frontend to register their inquiry function
+ * for checking if a remote frontend connection is using SSL for the request.
+ * @param r The current request
+ * @return OK iff the frontend connection is using SSL, DONE if not,
+ *         DECLINED iff the state is undefined (let later modules decide).
+ * @ingroup hooks
+ */
+AP_DECLARE_HOOK(int,remote_is_ssl,(request_rec *r))
+
+/**
+ * Return != 0 iff the frontend connection for the request is encrypted with SSL.
+ * If there is no data from the hook (DECLINED), falls back to ap_ssl_conn_is_ssl()
+ * and so corresponds to the local connection security state (we are the frontend).
+ * @param r The current request
+ */
+AP_DECLARE(int) ap_remote_is_ssl(request_rec *r);
+
 AP_DECLARE(int) ap_location_walk(request_rec *r);
 AP_DECLARE(int) ap_directory_walk(request_rec *r);
 AP_DECLARE(int) ap_file_walk(request_rec *r);

modules/lua/lua_request.c

@@ -754,6 +754,11 @@ static int req_ssl_is_https_field(request_rec *r)
     return ap_lua_ssl_is_https(r->connection);
 }
 
+static int req_remote_is_https_field(request_rec *r)
+{
+    return ap_lua_remote_is_https(r);
+}
+
 static int req_ap_get_server_port(request_rec *r)
 {
     return (int) ap_get_server_port(r);
@@ -2782,7 +2787,11 @@ void ap_lua_load_request_lmodule(lua_State *L, apr_pool_t *p)
     apr_hash_set(dispatch, "ssl_var_lookup", APR_HASH_KEY_STRING,
                  makefun(&req_ssl_var_lookup, APL_REQ_FUNTYPE_LUACFUN, p));
     apr_hash_set(dispatch, "is_https", APR_HASH_KEY_STRING,
+                 makefun(&req_remote_is_https_field, APL_REQ_FUNTYPE_BOOLEAN, p));
+    apr_hash_set(dispatch, "local_is_https", APR_HASH_KEY_STRING,
                  makefun(&req_ssl_is_https_field, APL_REQ_FUNTYPE_BOOLEAN, p));
+    apr_hash_set(dispatch, "remote_is_https", APR_HASH_KEY_STRING,
+                 makefun(&req_remote_is_https_field, APL_REQ_FUNTYPE_BOOLEAN, p));
     apr_hash_set(dispatch, "assbackwards", APR_HASH_KEY_STRING,
                  makefun(&req_assbackwards_field, APL_REQ_FUNTYPE_BOOLEAN, p));
     apr_hash_set(dispatch, "status", APR_HASH_KEY_STRING,

modules/lua/mod_lua.c

@@ -1715,6 +1715,11 @@ int ap_lua_ssl_is_https(conn_rec *c)
     return ap_ssl_conn_is_ssl(c);
 }
 
+int ap_lua_remote_is_https(request_rec *r)
+{
+    return ap_remote_is_ssl(r);
+}
+
 /*******************************/
 
 static const char *lua_authz_parse(cmd_parms *cmd, const char *require_line,

modules/lua/mod_lua.h

@@ -183,5 +183,6 @@ const char *ap_lua_ssl_val(apr_pool_t *p, server_rec *s, conn_rec *c,
                            request_rec *r, const char *var);
 
 int ap_lua_ssl_is_https(conn_rec *c);
+int ap_lua_remote_is_https(request_rec *r);
 
 #endif /* !_MOD_LUA_H_ */

modules/mappers/mod_rewrite.c

@@ -2086,7 +2086,7 @@ static char *lookup_variable(char *var, rewrite_ctx *ctx)
 
         case  5:
             if (!strcmp(var, "HTTPS")) {
-                int flag = ap_ssl_conn_is_ssl(r->connection);
+                int flag = ap_remote_is_ssl(r);
                 return apr_pstrdup(r->pool, flag ? "on" : "off");
             }
             break;
@@ -2195,6 +2195,13 @@ static char *lookup_variable(char *var, rewrite_ctx *ctx)
                 }
                 break;
 
+            case 'H':
+                if (!strcmp(var, "HTTPS_LOCAL")) {
+                    int flag = ap_ssl_conn_is_ssl(r->connection);
+                    return apr_pstrdup(r->pool, flag ? "on" : "off");
+                }
+                break;
+
             case 'I':
                 if (!strcmp(var, "API_VERSION")) {
                     return apr_psprintf(r->pool, "%d:%d",
@@ -2244,6 +2251,13 @@ static char *lookup_variable(char *var, rewrite_ctx *ctx)
 
         case 12:
             switch (var[3]) {
+            case 'H':
+                if (!strcmp(var, "HTTPS_REMOTE")) {
+                    int flag = ap_remote_is_ssl(r);
+                    return apr_pstrdup(r->pool, flag ? "on" : "off");
+                }
+                break;
+
             case 'I':
                 if (!strcmp(var, "SCRIPT_GROUP")) {
                     result = "<unknown>";