Crawler ACLs issue - X-forwarded-for

[Nuranto]

Hello,

In VCL templates, client.ip should be replaced by std.ip(regsub(req.http.X-Forwarded-For, "^(^[^,]+),?.*$", "\1"), client.ip) when checking ACLs. Else it could use 127.0.0.1 as IP instead of real-user IP and cause troubles in softwares. Of course, this issue occurs only if you have a proxy on front of varnish (which is almost always the case, at least for dealing with https).

Example : Before :

if (client.ip ~ crawler_acl ||

After :

if (std.ip(regsub(req.http.X-Forwarded-For, "^(^[^,]+),?.*$", "\1"), client.ip) ~ crawler_acl ||

[bmalynovytch]

To complete @Nuranto's point: when Varnish is behind a local reverse proxy, ACLs are checked against ::1 which is useless and leads to strange behaviors.

[Nuranto]

Already spotted here : https://github.com/nexcess/magento-turpentine/issues/1390