umputun / reproxy / 40616822588

81%

push

github

fix: take X-Real-IP from the TCP peer, add --trusted-proxy (#267)

* fix: take X-Real-IP from the TCP peer, add --trusted-proxy

X-Real-IP was the left-most public address of the client-supplied
X-Forwarded-For, so any client could set the address backends see. It is now
the TCP peer. With --trusted-proxy (IP or CIDR, repeatable), a request from a
trusted peer gets the client address by walking X-Forwarded-For right to left,
stopping at the first untrusted address or at a malformed entry.

- route allowlists use the same client address; --remote-lookup-headers is
  deprecated and reproxy refuses to start with it unless --trusted-proxy is set
- Forwarded and X-Forwarded-Host/Proto/Port from an untrusted peer are dropped
- ReverseProxy uses Rewrite instead of the deprecated Director, so a client
  can't strip the headers reproxy sets by naming them in Connection
- ssl.go lint fixes: strings.Cut, drop the ignored PreferServerCipherSuites

* fix: key per-user throttling on the resolved client address

tollbooth.NewLimiter looks up X-Forwarded-For first, then X-Real-IP, then
RemoteAddr, so a client could pick a new throttle bucket for every request by
changing either header. Both the per-route and the global user limiter now key
on the same client address reproxy sends in X-Real-IP: the TCP peer, or the
X-Forwarded-For walk when the peer is in --trusted-proxy.

Behind a CDN without --trusted-proxy, clients are grouped by the CDN's peer
address. README covers this, with a Cloudflare note linking #172.

* docs: note forwarding headers set by plugins follow the trusted-proxy rules

X-Real-IP, X-Forwarded-For, Forwarded and X-Forwarded-Host/Proto/Port that a
plugin sets through HeadersIn are written into the incoming request, so they
are handled like client-sent ones. A plugin's X-Forwarded-Proto reaches the
backend only when the request came from a trusted proxy.

151 of 156 new or added lines in 6 files covered. (96.79%)

2891 of 3566 relevant lines covered (81.07%)

87.34 hits per line