PH10504: SERVLET REQUEST REMOTE ADDRESS VALUE IS INCORRECT WITH WAS 8.5.5.15 PLUGINS FIX PACK LEVEL

9.0.5.0: WebSphere Application Server traditional Version 9.0.5 Refresh Pack
9.0.5.1: WebSphere Application Server traditional Version 9.0.5 Fix Pack 1
9.0.5.2: WebSphere Application Server traditional Version 9.0.5 Fix Pack 2
8.5.5.17: WebSphere Application Server V8.5.5 Fix Pack 17
9.0.5.3: WebSphere Application Server traditional Version 9.0.5 Fix Pack 3
8.5.5.20: WebSphere Application Server V8.5.5.20
8.5.5.18: WebSphere Application Server V8.5.5 Fix Pack 18
8.5.5.19: WebSphere Application Server V8.5.5 Fix Pack 19
8.5.5.16: WebSphere Application Server V8.5.5 Fix Pack 16
8.5.5.21: WebSphere Application Server V8.5.5.21

APAR status

• Closed as program error.

Error description

• At 8.5.5.15 WAS Plugin fix level, the remote address retrieved
  is NULL from the call to mod_was_ap22_http.cb_get_extended_info.
    We also see the $WSRA request header is getting removed.  This
   causes the request.getRemoteAddr() ServletRequest method to
  return the IBM i OS Server IP address instead of the remote
  client IP address, as it should.
  
  At 8.5.5.14 WAS Plugin fix level, the remote address retrieved
  is the correct value of the client IP address, which also
  matches the remote host value.
  
  This issue applies to the different plugin fix pack levels only
  (8.5.5.15 v. 8.5.5.14 Plugin).  For example, the 8.5.5.15 server
  and 8.5.5.14 plugin configuration will return the correct remote
  address since 8.5.5.14 Plugin is used.  Vice versa, the issue
  can be recreated when the Web Server Plugin is at 8.5.5.15 and
  the sever fix level is at 8.5.5.14 since 8.5.5.15 Plugin is
  used.
  

Local fix

• Use the ServletRequest Remote Host value or connect directly to
  the WAS internal HTTP/HTTPS transport.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server V8.5 and V9.0.                       *
  ****************************************************************
  * PROBLEM DESCRIPTION: On IBM i,the "request.getRemoteAddr()"  *
  *                      Servlet API does not return the         *
  *                      remote client's IP address.             *
  ****************************************************************
  * RECOMMENDATION:  Apply fix pack 8.5.5.16 or fix pack         *
  *                  9.0.5.0.                                    *
  ****************************************************************
  On IBM i,the "request.getRemoteAddr()" Servlet API returns the
  IP address of the Application or Proxy server instead of the
  remote client's IP address.
  

Problem conclusion

• The WebSphere Application Server was updated to fix the
  problem.
  
  The fix for this APAR is currently targeted for inclusion in
  fix pack 8.5.5.16 and 9.0.5.0.  Please refer to the
  Recommended
  Updates
  page for delivery information:
  http://www.ibm.com/support/docview.wss?
  rs=180&uid=swg27004980
  

Temporary fix

• Roll back WebSphere Application Server to 8.5.5.14 or 9.0.0.10
  fix pack level.
  

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

  SE70910

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels

• R850 PSY

     UP