-
Notifications
You must be signed in to change notification settings - Fork 887
feat: Support x-forwarded-for headers for IPs #4684
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Changes from all commits
Commits
Show all changes
4 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,225 @@ | ||
| package httpmw | ||
|
|
||
| import ( | ||
| "context" | ||
| "net" | ||
| "net/http" | ||
| "strings" | ||
|
|
||
| "golang.org/x/xerrors" | ||
|
|
||
| "github.com/coder/coder/coderd/httpapi" | ||
| ) | ||
|
|
||
| const ( | ||
| headerXForwardedFor string = "X-Forwarded-For" | ||
| headerXForwardedProto string = "X-Forwarded-Proto" | ||
| ) | ||
|
|
||
| // RealIPConfig configures the search order for the function, which controls | ||
| // which headers to consider trusted. | ||
| type RealIPConfig struct { | ||
| // TrustedOrigins is a list of networks that will be trusted. If | ||
| // any non-trusted address supplies these headers, they will be | ||
| // ignored. | ||
| TrustedOrigins []*net.IPNet | ||
|
|
||
| // TrustedHeaders lists headers that are trusted for forwarding | ||
| // IP addresses. e.g. "CF-Connecting-IP", "True-Client-IP", etc. | ||
| TrustedHeaders []string | ||
| } | ||
|
|
||
| // ExtractRealIP is a middleware that uses headers from reverse proxies to | ||
| // propagate origin IP address information, when configured to do so. | ||
| func ExtractRealIP(config *RealIPConfig) func(next http.Handler) http.Handler { | ||
| return func(next http.Handler) http.Handler { | ||
| return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) { | ||
| // Preserve the original TLS connection state and RemoteAddr | ||
| req = req.WithContext(context.WithValue(req.Context(), ctxKey{}, &RealIPState{ | ||
| Config: config, | ||
| OriginalRemoteAddr: req.RemoteAddr, | ||
| })) | ||
|
|
||
| info, err := ExtractRealIPAddress(config, req) | ||
| if err != nil { | ||
| httpapi.InternalServerError(w, err) | ||
| return | ||
| } | ||
| req.RemoteAddr = info.String() | ||
|
|
||
| next.ServeHTTP(w, req) | ||
| }) | ||
| } | ||
| } | ||
|
|
||
| // ExtractRealIPAddress returns the original client address according to the | ||
| // configuration and headers. It does not mutate the original request. | ||
| func ExtractRealIPAddress(config *RealIPConfig, req *http.Request) (net.IP, error) { | ||
| if config == nil { | ||
| config = &RealIPConfig{} | ||
| } | ||
|
|
||
| cf := isContainedIn(config.TrustedOrigins, getRemoteAddress(req.RemoteAddr)) | ||
| if !cf { | ||
| // Address is not valid or the origin is not trusted; use the | ||
| // original address | ||
| return getRemoteAddress(req.RemoteAddr), nil | ||
| } | ||
|
|
||
| for _, trustedHeader := range config.TrustedHeaders { | ||
| addr := getRemoteAddress(req.Header.Get(trustedHeader)) | ||
| if addr != nil { | ||
| return addr, nil | ||
| } | ||
| } | ||
|
|
||
| return getRemoteAddress(req.RemoteAddr), nil | ||
| } | ||
|
|
||
| // FilterUntrustedOriginHeaders removes all known proxy headers from the | ||
| // request for untrusted origins, and ensures that only one copy | ||
| // of each proxy header is set. | ||
| func FilterUntrustedOriginHeaders(config *RealIPConfig, req *http.Request) { | ||
| if config == nil { | ||
| config = &RealIPConfig{} | ||
| } | ||
|
|
||
| cf := isContainedIn(config.TrustedOrigins, getRemoteAddress(req.RemoteAddr)) | ||
| if !cf { | ||
| // Address is not valid or the origin is not trusted; clear | ||
| // all known proxy headers and return | ||
| for _, header := range config.TrustedHeaders { | ||
| req.Header.Del(header) | ||
| } | ||
| return | ||
| } | ||
|
|
||
| for _, header := range config.TrustedHeaders { | ||
| req.Header.Set(header, req.Header.Get(header)) | ||
| } | ||
| } | ||
|
|
||
| // EnsureXForwardedForHeader ensures that the request has an X-Forwarded-For | ||
| // header. It uses the following logic: | ||
| // | ||
| // 1. If we have a direct connection (remoteAddr == proxyAddr), then | ||
| // set it to remoteAddr | ||
| // 2. If we have a proxied connection (remoteAddr != proxyAddr) and | ||
| // X-Forwarded-For doesn't begin with remoteAddr, then overwrite | ||
| // it with remoteAddr,proxyAddr | ||
| // 3. If we have a proxied connection (remoteAddr != proxyAddr) and | ||
| // X-Forwarded-For begins with remoteAddr, then append proxyAddr | ||
| // to the original X-Forwarded-For header | ||
| // 4. If X-Forwarded-Proto is not set, then it will be set to "https" | ||
| // if req.TLS != nil, otherwise it will be set to "http" | ||
| func EnsureXForwardedForHeader(req *http.Request) error { | ||
| state := RealIP(req.Context()) | ||
| if state == nil { | ||
| return xerrors.New("request does not contain realip.State; was it processed by httpmw.ExtractRealIP?") | ||
| } | ||
|
|
||
| remoteAddr := getRemoteAddress(req.RemoteAddr) | ||
| if remoteAddr == nil { | ||
| return xerrors.Errorf("failed to parse remote address: %s", remoteAddr) | ||
| } | ||
|
|
||
| proxyAddr := getRemoteAddress(state.OriginalRemoteAddr) | ||
| if proxyAddr == nil { | ||
| return xerrors.Errorf("failed to parse original address: %s", proxyAddr) | ||
| } | ||
|
|
||
| if remoteAddr.Equal(proxyAddr) { | ||
| req.Header.Set(headerXForwardedFor, remoteAddr.String()) | ||
| } else { | ||
| forwarded := req.Header.Get(headerXForwardedFor) | ||
| if forwarded == "" || !remoteAddr.Equal(getRemoteAddress(forwarded)) { | ||
| req.Header.Set(headerXForwardedFor, remoteAddr.String()+","+proxyAddr.String()) | ||
| } else { | ||
| req.Header.Set(headerXForwardedFor, forwarded+","+proxyAddr.String()) | ||
| } | ||
| } | ||
|
|
||
| if req.Header.Get(headerXForwardedProto) == "" { | ||
| if req.TLS != nil { | ||
| req.Header.Set(headerXForwardedProto, "https") | ||
| } else { | ||
| req.Header.Set(headerXForwardedProto, "http") | ||
| } | ||
| } | ||
|
|
||
| return nil | ||
| } | ||
|
|
||
| // getRemoteAddress extracts the IP address from the given string. If | ||
| // the string contains commas, it assumes that the first part is the | ||
| // original address. | ||
| func getRemoteAddress(address string) net.IP { | ||
| // X-Forwarded-For may contain multiple addresses, in case the | ||
| // proxies are chained; the first value is the client address | ||
| i := strings.IndexByte(address, ',') | ||
| if i == -1 { | ||
| i = len(address) | ||
| } | ||
|
|
||
| // If the address contains a port, remove it | ||
| firstAddress := address[:i] | ||
| host, _, err := net.SplitHostPort(firstAddress) | ||
| if err != nil { | ||
| // This will error if there is no port, so try to parse the address | ||
| return net.ParseIP(firstAddress) | ||
| } | ||
| return net.ParseIP(host) | ||
| } | ||
|
|
||
| // isContainedIn checks that the given address is contained in the given | ||
| // network. | ||
| func isContainedIn(networks []*net.IPNet, address net.IP) bool { | ||
| for _, network := range networks { | ||
| if network.Contains(address) { | ||
| return true | ||
| } | ||
| } | ||
|
|
||
| return false | ||
| } | ||
|
|
||
| // RealIPState is the original state prior to modification by this middleware, | ||
| // useful for getting information about the connecting client if needed. | ||
| type RealIPState struct { | ||
| // Config is the configuration applied in the middleware. Consider | ||
| // this read-only and do not modify. | ||
| Config *RealIPConfig | ||
|
|
||
| // OriginalRemoteAddr is the original RemoteAddr for the request. | ||
| OriginalRemoteAddr string | ||
| } | ||
|
|
||
| type ctxKey struct{} | ||
|
|
||
| // FromContext retrieves the state from the given context.Context. | ||
| func RealIP(ctx context.Context) *RealIPState { | ||
| state, ok := ctx.Value(ctxKey{}).(*RealIPState) | ||
| if !ok { | ||
| return nil | ||
| } | ||
| return state | ||
| } | ||
|
|
||
| // ParseRealIPConfig takes a raw string array of headers and origins | ||
| // to produce a config. | ||
| func ParseRealIPConfig(headers, origins []string) (*RealIPConfig, error) { | ||
| config := &RealIPConfig{} | ||
| for _, origin := range origins { | ||
| _, network, err := net.ParseCIDR(origin) | ||
| if err != nil { | ||
| return nil, xerrors.Errorf("parse proxy origin %q: %w", origin, err) | ||
| } | ||
| config.TrustedOrigins = append(config.TrustedOrigins, network) | ||
| } | ||
| for index, header := range headers { | ||
| headers[index] = http.CanonicalHeaderKey(header) | ||
| } | ||
| config.TrustedHeaders = headers | ||
|
|
||
| return config, nil | ||
| } |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
nit: will a use know what
real ip configmeans here? wondering if we can make that friendlier