Allow X-Forwarded-For to have multiple values

[kassner]

PR #1546 was closed because CLA issues, thus I'm resubmitting the changes.

Preconditions

1. HAProxy/Nginx offloading SSL and sending traffic to Varnish;
2. Varnish in front of Apache/Nginx.

Steps to reproduce

1. Place an order according to the preconditions.

Expected result

1. Current customer IP address stored into quote and order tables.

Actual result

1. Stored IP is Varnish/HAProxy IP address relative to the webserver (usually 127.0.0.1 or some internal IP, depends on network structure);

[ihor-sviziev]

Would be great to have some unit test for this case

[ishakhsuvarov]

@kassner Hi! Unfortunately, delivery of PR to the 2.1 brach is going to take some time.
Do you feel like opening a PR to the develop branch meanwhile?
Thanks.

[ishakhsuvarov]

@kassner I am closing this PR for now due to lack of activity.
Please reopen if you would like to continue.
Thank you.

[kassner]

@ishakhsuvarov @vrann can you reopen? GitHub allows to rebase the PR from the interface, so I changed the target branch here.

[kassner]

@vrann Done.

[ishakhsuvarov]

Hi @kassner
Could you please provide detailed steps to reproduce the issue (exact software and configs used), so we could test it.
Thanks

[adragus-inviqa]

You don't need this check. explode(',', 'abc') will give you an array nonetheless.

[adragus-inviqa]

@ishakhsuvarov - XFF can have multiple IPs and I don't think M2 can handle that situation.

Same problem here.

[kassner]

@ishakhsuvarov we can see that happening when we have HAProxy -> Varnish -> Apache. It is appended by Varnish (rightfully) before reaching Apache:

*   << Request  >> 44385980
-   Begin          req 44385979 rxreq
-   Timestamp      Start: 1494487201.309345 0.000000 0.000000
-   Timestamp      Req: 1494487201.309345 0.000000 0.000000
-   ReqStart       127.0.0.1 44276
-   ReqMethod      GET
-   ReqURL         /
-   ReqProtocol    HTTP/1.1
...
-   ReqHeader      X-Forwarded-Port: 443
-   ReqHeader      X-Forwarded-Proto: https
-   ReqHeader      X-Forwarded-For: 1.1.1.1
-   ReqUnset       X-Forwarded-For: 1.1.1.1
-   ReqHeader      X-Forwarded-For: 1.1.1.1, 127.0.0.1
-   VCL_call       RECV

I guess you can simulate it by forcing the header X-Forwarded-For on Chrome using some extension.

[magento-team]

@kassner thank you for your contribution to Magento 2 project

[Ctucker9233]

@magento-team This is merged but doesn't appear in 2.2.7. Why?

[ihor-sviziev]

Hi @Ctucker9233,
I just re-checked, this fix actually there! It was just little bit changed
https://github.com/magento/magento2/blob/2.2.7/lib/internal/Magento/Framework/HTTP/PhpEnvironment/RemoteAddress.php

[Ctucker9233]

@ihor-sviziev Perfect! Thank you.