Hi,
It is because it contains uppercase letters. According to RFC5952 section 4.3 “A Recommendation for IPv6 Address Text Representation”:
The characters “a”, “b”, “c”, “d”, “e”, and “f” in an IPv6 address MUST be represented in lowercase.
However, we will change rule 312 in the next release of NinjaFirewall and will make it case-insensitive because it seems there are many application that do not follow the RFC.
nintechnet,
Thanks for the clarification. Based on knowing that, I came up with a different solution on my end. I added the following directives to my Apache configuration:
RequestHeader edit* X-Forwarded-For A a
RequestHeader edit* X-Forwarded-For B b
RequestHeader edit* X-Forwarded-For C c
RequestHeader edit* X-Forwarded-For D d
RequestHeader edit* X-Forwarded-For E e
RequestHeader edit* X-Forwarded-For F f
This works in Apache 2.4 and maps the uppercase letters to lowercase letters. There may be a fancier way to make this change in one step but the PCRE replacement feature used by RequestHeader isn’t very advanced.
I agree that ideally CloudFlare should be following the proposed RFC and I’ll see about opening a ticket to let them know. I guess in their defense the RFC hasn’t been made a full standard yet but it has been 4 years.
Thanks again.
Hi,
You can also use the .htninja file:
<?php
/*
+=====================================================================+
| NinjaFirewall optional configuration file |
| |
| See: http://nintechnet.com/nfwp/1.1.3/ |
| |
+=====================================================================+
*/
// Lowercase X_FORWARDED_FOR IP :
if ( isset($_SERVER['HTTP_X_FORWARDED_FOR']) ) {
$_SERVER['HTTP_X_FORWARDED_FOR'] = strtolower($_SERVER['HTTP_X_FORWARDED_FOR']);
}
The PHP strtolower() function may be slightly faster than the RequestHeader regex.
All,
Last week a Cloudflare engineer told me they fixed the issue and would have the fix in production in the near future. Today I disabled the .htninja fix provided above and did not have any issues when I viewed my site. I confirmed that the request came through on IPv6 and I had all the firewall rules enabled. I am marking this topic as resolved. Thanks again.
Dan
