matomo-org/matomo

IP::getNonProxyIpFromHeader retrieves final proxy instead of client

Open

#7,060 opened on Jan 21, 2015

View on GitHub
 (8 comments) (0 reactions) (0 assignees)PHP (2,847 forks)batch import
BugHelp wanted

Repository metrics

Stars
 (21,513 stars)
PR merge metrics
 (Avg merge 8d 11h) (106 merged PRs in 30d)

Description

IP::getNonProxyIpFromHeader attempts to retrieve the client IP address from headers configured in proxy_client_headers[]. This calls IP::getLastIpFromList, excluding proxies configured via proxy_ips[].

What I do not understand is why by default this returns the last IP, whereas the format for X-Forwarded-For is client, proxy1, proxy2, ...: http://en.wikipedia.org/wiki/X-Forwarded-For#Format

This only becomes an issue when running Piwik behind multiple proxies; for example the configuration in question is:

[Enterprise Appliance] => [IIS ARR] => [Piwik]

So Piwik sees:

X-Forwarded-For: <client>, <enterprise_appliance>

Basically the current behavior would seem to select the IP of the last proxy by default. This would be problematic in a scenario with variable proxy IPs.

Contributor guide

Research direction
Examine the IP::getNonProxyIpFromHeader function and trace how it filters proxy IPs. Understand why it returns the last IP instead of the first client IP behind multiple proxies.
Tech stack
php
Domain
backendanalytics
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Mostly clear
Prerequisites
PHPHTTP headers
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
60