Rails Ruby on Rails → 2.x

Comments and changes to this ticket

• You flagged this item as spam.
  

  James Healy October 28th, 2008 @ 04:18 AM

  I'm running into this issue as well, although not with a T-mobile device.

  One of the regular users of our site is on a university campus that appears to use a broken proxy so they get this 500 error everytime they access our site.

  In the interim I've just commented this out, but it'd be nice to make the check configurable or something.

• You flagged this item as spam.
  

  Guillermo Álvarez October 28th, 2008 @ 12:04 PM

  • Tag set to “actionpack, bug, remote_ip, spoofing”

  I have the same problem.

  I think is a bug, since http://en.wikipedia.org/wiki/X-F... says that the first element of HTTP_X_FORWARDED_FOR must be the same of HTTP_CLIENT_IP

  The actual code is:

    if @env.include? 'HTTP_CLIENT_IP'
      if remote_ips && !remote_ips.include?(@env['HTTP_CLIENT_IP'])
        # We don't know which came from the proxy, and which from the user
        raise ActionControllerError.new(<<EOM)
  
  

  IP spoofing attack?! HTTP_CLIENT_IP=#{@env['HTTP_CLIENT_IP'].inspect} HTTP_X_FORWARDED_FOR=#{@env['HTTP_X_FORWARDED_FOR'].inspect} EOM

      end
  
      return @env['HTTP_CLIENT_IP']
    end
  
  

  And i think it must be something like these

    if @env.include? 'HTTP_CLIENT_IP'
      if remote_ips && @env['HTTP_CLIENT_IP'].strip != remote_ips[0]
  
  

  ...

• You flagged this item as spam.
  

  Guillermo Álvarez October 28th, 2008 @ 12:09 PM

  • Title changed from “"IP spoofing attack" breaks with some mobile phones” to “"IP spoofing attack" breaks with some proxies”

  I have the same problem.

  I think is a bug, since http://en.wikipedia.org/wiki/X-F... says that the first element of HTTP_X_FORWARDED_FOR must be the same of HTTP_CLIENT_IP

  The actual code is:

    if @env.include? 'HTTP_CLIENT_IP'
      if remote_ips && !remote_ips.include?(@env['HTTP_CLIENT_IP'])
        # We don't know which came from the proxy, and which from the user
        raise ActionControllerError.new(<<EOM)
  
  

  IP spoofing attack?! HTTP_CLIENT_IP=#{@env['HTTP_CLIENT_IP'].inspect} HTTP_X_FORWARDED_FOR=#{@env['HTTP_X_FORWARDED_FOR'].inspect} EOM

      end
  
      return @env['HTTP_CLIENT_IP']
    end
  
  

  And i think it must be something like these

    if @env.include? 'HTTP_CLIENT_IP'
      if remote_ips && @env['HTTP_CLIENT_IP'].strip != remote_ips[0]
  
  

  ...

• 

  DHH October 30th, 2008 @ 10:46 AM

  Please provide a full patch with tests. Thanks.

• You flagged this item as spam.
  

  Darren November 22nd, 2008 @ 06:20 PM

  • Tag changed from “actionpack, bug, remote_ip, spoofing” to “actionpack, bug, patch, remote_ip, spoofing”

  I think the issue with the IP Spoofing Check as it exists in the current code is that it assumes the client actually has an IP address. On Cell networks, this isn't the case. Expecting to get Cell companies to set non-standard headers properly is a leap of faith (IMHO).

  I have little issue with the keeping the spoofing check, as it seems reasonable for proxy administrators to configure their proxies in a reasonable matter. However, there are real issues when this check causes a lot of false positives.

  I have no real numbers from our own site, but I believe we see the majority of our requests from mobile devices fail this check, when it's left in place. In this case, being able to simply turn this check off would be useful (and we have simply commented out the check for the last couple releases of Rails).

  I've attached a patch, which I think is a reasonable change to allow people who want to avoid this check to turn it off. This is my first patch, and I apologize if I failed protocol. I am expecting at least some feedback (I'm not sure if I put the configurable property in the right place, and there should be more docs).

  • ip_spoof.diff 3.3 KB
• 

  Repository December 1st, 2008 @ 07:41 PM

  • State changed from “new” to “committed”

  (from [0a4a5f3129a137fc357e8444a08b135f0ad4fbe8]) Making the IP Spoofing check in AbstractRequest#remote_ip configurable.

  Certain groups of web proxies do not set these values properly. Notably, proxies for cell phones, which often do not set the remote IP information correctly (not surprisingly, since the clients do not have an IP address).

  Allowing this to be configurable makes it possible for developers to choose to ignore this simple spoofing check, when a significant amount of their traffic would result in false positives anyway.

  Signed-off-by: Michael Koziarski michael@koziarski.com

  [#1200 state:committed] http://github.com/rails/rails/co...

• You flagged this item as spam.
  

  sbwoodside December 1st, 2008 @ 09:21 PM

  Yay thanks.