repsheet/repsheet — pull request #32 by yippibrian (2014-01-31 22:08:48+00:00)
Title: 29: Implement XFF parsing so it works with nginx 1.4.0 and later.

Sorry for my previous comment suggesting the problem was that repsheet is trying to build an older version of nginx. That was not the problem. After some further work, I see that the internal data structures nginx uses for storing XFF changed in 1.4.0. This patch fixes the code with an "#if" so it works with nginx versions older than 1.4.0 as well as version 1.4.0 and later.

Note in 1.4.0 the structure was changed so that it keeps track of an array of XFF lines. This is used because the header can contains multiple XFF entries and each entry can contain a list of IP's separated by commas. For more details about how this works, refer here to the original nginx change request that introduced this difference:
http://forum.nginx.org/read.php?29,227703,227841#msg-227841

Anyway, this is why it is necessary to parse the xff value to grab the first value regardless of which version is used. This confused me for a while since I initially assumed that version 1.4.0 and later was separating each IP address into a separate array element, which is actually not the case.

I tested this with both version 1.4.2 that repsheet normally builds with and with version 1.2.9 which is what I am actually using. Works well in both in my testing.