matomo-org/matomo

IP::getNonProxyIpFromHeader retrieves final proxy instead of client

Open

#7060 opened on Jan 21, 2015

View on GitHub
 (8 comments) (0 reactions) (0 assignees)PHP (21,513 stars) (2,847 forks)batch import
BugHelp wanted

Description

IP::getNonProxyIpFromHeader attempts to retrieve the client IP address from headers configured in proxy_client_headers[]. This calls IP::getLastIpFromList, excluding proxies configured via proxy_ips[].

What I do not understand is why by default this returns the last IP, whereas the format for X-Forwarded-For is client, proxy1, proxy2, ...: http://en.wikipedia.org/wiki/X-Forwarded-For#Format

This only becomes an issue when running Piwik behind multiple proxies; for example the configuration in question is:

[Enterprise Appliance] => [IIS ARR] => [Piwik]

So Piwik sees:

X-Forwarded-For: <client>, <enterprise_appliance>

Basically the current behavior would seem to select the IP of the last proxy by default. This would be problematic in a scenario with variable proxy IPs.

Contributor guide

Tech stack
php
Domain
backend
Issue type
bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
PHPX Forwarded For header formatproxy configuration
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
45
Research direction
Examine the implementation of `IP::getNonProxyIpFromHeader` and `IP::getLastIpFromList` in core/IP.php. Understand the expected format of X Forwarded For (client, proxy1, proxy2). The current code returns the last IP, which is the proxy; it should return the first IP (client). Consider modifying the logic to retrieve the first IP instead of the last, ensuring any proxy IPs are still excluded. Check for any existing tests related to IP handling.