Revision 20080402011408-49d33-de0885...

    # HTTP_X_FORWARDED_FOR are set by proxies so check for these before

    # HTTP_X_FORWARDED_FOR are set by proxies so check for these if

    # falling back to REMOTE_ADDR.  HTTP_X_FORWARDED_FOR may be a comma-

    # REMOTE_ADDR is a proxy.  HTTP_X_FORWARDED_FOR may be a comma-

    # delimited list in the case of multiple chained proxies; the first is

    # delimited list in the case of multiple chained proxies; the last

    # the originating IP.

    # address which is not trusted is the originating IP.

    #

    # Security note: do not use if IP spoofing is a concern for your

    # application. Since remote_ip checks HTTP headers for addresses forwarded

    # by proxies, the client may send any IP. remote_addr can't be spoofed but

    # also doesn't work behind a proxy, since it's always the proxy's IP.

      return @env['HTTP_CLIENT_IP'] if @env.include? 'HTTP_CLIENT_IP'

      if TRUSTED_PROXIES !~ @env['REMOTE_ADDR']

        return @env['REMOTE_ADDR']

      end

      if @env.include? 'HTTP_CLIENT_IP'

        if @env.include? 'HTTP_X_FORWARDED_FOR'

          # We don't know which came from the proxy, and which from the user

          raise ActionControllerError.new(<<EOM)

IP spoofing attack?!

HTTP_CLIENT_IP=#{@env['HTTP_CLIENT_IP'].inspect}

HTTP_X_FORWARDED_FOR=#{@env['HTTP_X_FORWARDED_FOR'].inspect}

EOM

        end

        return @env['HTTP_CLIENT_IP']

      end

        remote_ips = @env['HTTP_X_FORWARDED_FOR'].split(',').reject do |ip|

        remote_ips = @env['HTTP_X_FORWARDED_FOR'].split(',')

          ip.strip =~ /^unknown$|^(10|172\.(1[6-9]|2[0-9]|30|31)|192\.168)\./i

        while remote_ips.size > 1 && TRUSTED_PROXIES =~ remote_ips.last.strip

          remote_ips.pop

        return remote_ips.first.strip unless remote_ips.empty?

        return remote_ips.last.strip

    assert_equal '127.0.0.1', @request.remote_ip

    assert_equal '3.4.5.6', @request.remote_ip

    assert_equal '1.2.3.4', @request.remote_ip

    assert_equal 'unknown', @request.remote_ip

    @request.env['HTTP_X_FORWARDED_FOR'] = '9.9.9.9, 3.4.5.6, 10.0.0.1, 172.31.4.4'

    assert_equal '3.4.5.6', @request.remote_ip

    @request.env['HTTP_CLIENT_IP'] = '8.8.8.8'

    e = assert_raises(ActionController::ActionControllerError) {

      @request.remote_ip

    }

    assert_match /IP spoofing attack/, e.message

    assert_match /HTTP_X_FORWARDED_FOR="9.9.9.9, 3.4.5.6, 10.0.0.1, 172.31.4.4"/, e.message

    assert_match /HTTP_CLIENT_IP="8.8.8.8"/, e.message

    @request.env.delete 'HTTP_CLIENT_IP'