Message-Id: <199907311549.LAA32291@eclectic.kluge.net>
To: coar@apache.org
cc: apache-bugdb@apache.org
Subject: Re: mod_status/4744: Visiting server-status logs the hostname of the
 client regardless of HostnameLookup. 
In-Reply-To: Message from coar@apache.org
   of "26 Jul 1999 11:19:42 -0000." <19990726111942.20663.qmail@hyperreal.org>
Date: Sat, 31 Jul 1999 11:49:17 -0400
From: Theo Van Dinter <felicity@kluge.net>
Sender: apache-bugdb-owner@apache.org
Precedence: bulk

|Do you have your /server-status Location protected by
|something like "Deny from all","Allow from .kluge.net"?
|If so, that's the cause -- on name-based access
|restrictions, Apache *always* does a double-reverse
|lookup, which will result in the client name being stored
|in the appropriate structures and hence available (and
|used) for logging.

Ok, that does explain it.  I would still classify it as a bug though:  The
whole point of "HostnameLookup off" is so that the IP is the only client
identifier in the logs/passed to CGIs/etc.  Since the current scheme doesn't
always do what you expect (named-based access controls causes hostname to be
used instead of IP), it should be fixed, or minimally at least documented w/
"Hostnamelookup" (it's hinted to, but not clearly indicated).

Would it be possible to say something like: (pseudo-ish code...)

if ( configuration.hostnamelookup == 0 )
	Log(request.clientIP);
else {
	if ( request.clientname[0] != '\0' )
		Log(request.clientname);
	else
		Log(request.clientIP);
}

??

thanks.