search

un33k / node-ipware

Returns the real IP address of users in Node.js
MIT License
124 stars 17 forks source link

Wrong detection of loopback ip in some cases. #15

Closed serfimtic closed 5 years ago

serfimtic commented 5 years ago

Hi,

There is an issue in some cases, where ipware fail to identify an ip as loopback.

ipware.get_ip(req) sometimes returns {clientIP: '::ffff:127.0.0.1', clientIpRoutable: true}. And then ipware.is_loopback_ip(ip.clientIp) returns false.

::ffff: is the prefix indicating the IP is an IPv6 mapping an IPv4 address, in this case 127.0.0.1 (https://en.wikipedia.org/wiki/IPv6_address#Transition_from_IPv4).

SpeedyCraftah commented 5 years ago

owner abandoned project lol

un33k commented 5 years ago

Project is active. Just can’t react to issues workout solid steps to recreate and info such as env, os, framework etc.

PR is also preferred & appropriated. :)

serfimtic commented 5 years ago

Hello,

The issue can be easily reproduced by calling is_loopback_ip('::ffff:127.0.0.1'). It returns false when it should return true, since ::ffff:127.0.0.1 is indeed a loopback IP.

I simply worked around the issue this way, but it would be better to fix the lib directly:

    if (clientIp.startsWith('::ffff:')) {
        clientIp = clientIp.substring(7);
    }
    ipware.is_loopback_ip(clientIp))
un33k commented 5 years ago

@serfimtic IPV6 encapsulation support for IPV4 is added in https://github.com/un33k/node-ipware/pull/16

serfimtic commented 4 years ago

Hello, thanks for the fix.

Though, I've encountered another case where the issue happens. When get_ip or get_trusted_ip can't find the ip, they call get_local_ip, which doesn't call the new cleanup_ip.

I've made a PR for the fix https://github.com/un33k/node-ipware/pull/18