diff --git a/src/Illuminate/Http/Middleware/TrustProxies.php b/src/Illuminate/Http/Middleware/TrustProxies.php index e7e526374fae..d8a43bec3451 100644 --- a/src/Illuminate/Http/Middleware/TrustProxies.php +++ b/src/Illuminate/Http/Middleware/TrustProxies.php @@ -112,14 +112,14 @@ protected function setTrustedProxyIpAddressesToSpecificIps(Request $request, arr } /** - * Set the trusted proxy to be the IP address calling this servers. + * Set the trusted proxies to catchall addresses for IPv4 and IPv6. * * @param \Illuminate\Http\Request $request * @return void */ protected function setTrustedProxyIpAddressesToTheCallingIp(Request $request) { - $request->setTrustedProxies([$request->server->get('REMOTE_ADDR')], $this->getTrustedHeaderNames()); + $request->setTrustedProxies(['0.0.0.0/0', '::/0'], $this->getTrustedHeaderNames()); } /** diff --git a/tests/Http/Middleware/TrustProxiesTest.php b/tests/Http/Middleware/TrustProxiesTest.php index eeb4dac7d5be..8d83bb338249 100644 --- a/tests/Http/Middleware/TrustProxiesTest.php +++ b/tests/Http/Middleware/TrustProxiesTest.php @@ -79,6 +79,24 @@ public function test_trusted_proxy_sets_trusted_proxies_with_double_wildcard_for }); } + /** + * Test that the wildcard trusts proxies in an IPv6 forwarded chain, so the + * left-most client IP is returned rather than an intermediate IPv6 proxy. + */ + public function test_trusted_proxy_sets_trusted_proxies_with_wildcard_and_ipv6_chain() + { + $trustedProxy = $this->createTrustedProxy($this->headerAll, '*'); + $request = $this->createProxiedRequest([ + 'REMOTE_ADDR' => '2001:db8::1', + 'HTTP_X_FORWARDED_FOR' => '173.174.200.38, 2001:db8::2, 2001:db8::3', + ]); + + $trustedProxy->handle($request, function ($request) { + $this->assertSame('173.174.200.38', $request->getClientIp(), + 'Assert IPv6 proxies in the forwarded chain are trusted with wildcard proxy setting'); + }); + } + /** * Test the next most typical usage of TrustedProxies: * Trusted X-Forwarded-For header, REMOTE_ADDR for TrustedProxies. @@ -163,9 +181,9 @@ public function test_get_client_ip_with_multiple_ip_addresses_all_proxies_are_tr $forwardedFor = [ '192.0.2.2', - '192.0.2.199, 192.0.2.2', - '192.0.2.199,192.0.2.2', - '99.99.99.99,192.0.2.199,192.0.2.2', + '192.0.2.2, 192.0.2.199', + '192.0.2.2,192.0.2.199', + '192.0.2.2,99.99.99.99,192.0.2.199', ]; foreach ($forwardedFor as $forwardedForHeader) { @@ -177,6 +195,28 @@ public function test_get_client_ip_with_multiple_ip_addresses_all_proxies_are_tr } } + /** + * Test Forwarded header with multiple IP addresses, with * wildcard trusting of all proxies. + */ + public function test_get_client_ip_with_multiple_ip_addresses_all_proxies_are_trusted_using_forwarded_header() + { + $trustedProxy = $this->createTrustedProxy(Request::HEADER_FORWARDED, '*'); + + $forwarded = [ + 'for=192.0.2.2', + 'for=192.0.2.2,for=192.0.2.199', + 'for=192.0.2.2,for=99.99.99.99,for=192.0.2.199', + ]; + + foreach ($forwarded as $forwardedHeader) { + $request = $this->createProxiedRequest(['HTTP_FORWARDED' => $forwardedHeader, 'HTTP_X_FORWARDED_FOR' => '']); + + $trustedProxy->handle($request, function ($request) use ($forwardedHeader) { + $this->assertSame('192.0.2.2', $request->getClientIp(), 'Assert sets the '.$forwardedHeader); + }); + } + } + /** * Test distrusting a header. */