umputun / reproxy
81%

DEFAULT BRANCH: master
Repo Added
Files 20
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH master
branch: master
CHANGE BRANCH
x

coverage: 81.071% (+0.6%) from 80.423%
40616822588

push

github

web-flow 
fix: take X-Real-IP from the TCP peer, add --trusted-proxy (#267)

* fix: take X-Real-IP from the TCP peer, add --trusted-proxy

X-Real-IP was the left-most public address of the client-supplied
X-Forwarded-For, so any client could set the address backends see. It is now
the TCP peer. With --trusted-proxy (IP or CIDR, repeatable), a request from a
trusted peer gets the client address by walking X-Forwarded-For right to left,
stopping at the first untrusted address or at a malformed entry.

- route allowlists use the same client address; --remote-lookup-headers is
  deprecated and reproxy refuses to start with it unless --trusted-proxy is set
- Forwarded and X-Forwarded-Host/Proto/Port from an untrusted peer are dropped
- ReverseProxy uses Rewrite instead of the deprecated Director, so a client
  can't strip the headers reproxy sets by naming them in Connection
- ssl.go lint fixes: strings.Cut, drop the ignored PreferServerCipherSuites

* fix: key per-user throttling on the resolved client address

tollbooth.NewLimiter looks up X-Forwarded-For first, then X-Real-IP, then
RemoteAddr, so a client could pick a new throttle bucket for every request by
changing either header. Both the per-route and the global user limiter now key
on the same client address reproxy sends in X-Real-IP: the TCP peer, or the
X-Forwarded-For walk when the peer is in --trusted-proxy.

Behind a CDN without --trusted-proxy, clients are grouped by the CDN's peer
address. README covers this, with a Cloudflare note linking #172.

* docs: note forwarding headers set by plugins follow the trusted-proxy rules

X-Real-IP, X-Forwarded-For, Forwarded and X-Forwarded-Host/Proto/Port that a
plugin sets through HeadersIn are written into the incoming request, so they
are handled like client-sent ones. A plugin's X-Forwarded-Proto reaches the
backend only when the request came from a trusted proxy.

151 of 156 new or added lines in 6 files covered. (96.79%)

2891 of 3566 relevant lines covered (81.07%)

87.34 hits per line

Relevant lines Covered
3566 RELEVANT LINES 2891 COVERED LINES
87.34 HITS PER LINE
Source Files on master

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
40616822588 master fix: take X-Real-IP from the TCP peer, add --trusted-proxy (#267) * fix: take X-Real-IP from the TCP peer, add --trusted-proxy X-Real-IP was the left-most public address of the client-supplied X-Forwarded-For, so any client could set the address... push web-flow github
81.07
40461204219 master fix: keep range responses intact under gzip, add --gzip-exclude (#266) * fix: keep range responses intact under gzip, add --gzip-exclude With --gzip on, compression ignored the response type and range headers. A 206 could go out gzipped while Co... push web-flow github
80.42
34050351647 master fix: keep Content-Encoding on gzip-compressed error responses (#265) * fix: keep Content-Encoding on compressed error responses With gzip enabled, the file server's error path (custom or default 404, 416) drops Content-Encoding while the body st... push web-flow github
79.88
32434321318 master fix: bound mapper cache and reuse host regexes (#262) push web-flow github
79.83
32434312810 master test: stabilize health handler timing (#263) push web-flow github
79.72
32434317301 master fix: match routes on canonical escaped paths (#261) push web-flow github
79.75
32349290866 master fix: make DNS-01 propagation timeout configurable (#260) * fix: make DNS-01 propagation timeout configurable CertMagic waits 2 minutes for challenge records to propagate and reproxy never set the field, so a zone publishing slower than that coul... push web-flow github
79.75
32327652867 master docs: backlog item for the four golangci-lint v2.13.0 findings pin at v2.12.2 is a version baseline, not a fix. Records the four findings and that the pin advance must ship in the same change as the fixes. push umputun github
79.73
32326507406 master ci: gate release publishers on tests (#259) * ci: gate release publishers on tests a failed tag build could still publish binaries while container publication was skipped. Keep both tag publishers behind one native test gate and restrict the pri... push web-flow github
79.73
29387698115 master test: fix flaky tests from getFreePort port-allocation race getFreePort bound 127.0.0.1:0, closed the listener, and returned only the port, so an httptest.NewServer created later in setup could grab that freed port. h.Run then failed to bind and ... push umputun github
79.67
See All Builds (716)