When accessing URLs over HTTPS from my IPv6 connection, I get the following header:
Set-Cookie: GeoIP=NL::52.3667:4.9000:v4; Path=/; Domain=.wikinews.org
I'm obviously not in the Netherlands — this is geolocating esams' IPs (the cookie was introduced in https://gerrit.wikimedia.org/r/#/c/119014/ ).
Non-HTTPS hits do not exhibit the same issue, nor are non-IPv6. This explains why this has gone undetected for as long as it has.
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | BBlack | T121925 [EPIC] GeoIP lookup for IPv6 connections delays banner loading | |||
| Open | None | T121937 [EPIC] Fix and improve geolocation, and ensure it's working properly for FR campaigns | |||
| Resolved | BBlack | T100902 Get rid of geoiplookup service | |||
| Resolved | BBlack | T89688 Varnish GeoIP is broken for HTTPS+IPv6 traffic |
Hm, so this is an aside, but:
I would love it if we could figure out a way to standardize this algorithm across the organization. Analytics has at least one place where client ip extraction is done, and right now the algorithm is very naive. We should have a canonical implementation of this (maybe just in pseudo code on wikitech) that is the official way to get client ip out of XFF. Thoughts?
Well, we get different versions of XFF at different layers, and there are probably different considerations for whether we trust XFF's that came from the outside world, too. But the basics are to consider XFF + the real IP the XFF came in over as a stack of addresses, where the real IP is the virtual final element of the (possibly empty) list from XFF.
We have a pretty decent implementation in VCL for dealing with this from varnish-frontend's perspective for the Zero case that we could/should probably use everywhere to set our own custom internal header(s) to communicate the real client IP to MediaWiki and/or Analytics as appropriate. There are two views of that: one where we trust outside XFF-setting proxies, and one where we don't. It's probably ok to trust them for stats and GeoIP, but it might not be for other cases.
we could/should probably use everywhere to set our own custom internal header(s) to communicate the real client IP to MediaWiki and/or Analytics as appropriate.
That would be amazingly useful!
X-Analytics=ip=..... , and as discussed before, we should do T89838 to make proxy IP management easier
Basic isssue here seems resolved with https://gerrit.wikimedia.org/r/#/c/252442/ . Obviously, we still don't have good v6 data, but that's the mmdb upgrade in T99226