server: trusted_proxies – X-Forwarded-For für Rate-Limit hinter Reverse-Proxy

internal/server/auth.go

@@ -103,14 +103,71 @@ func (l *limiter) Reset(key string) {
 	delete(l.hits, key)
 }
 
-func clientIP(r *http.Request) string {
+// clientIP returns the peer address. If the peer is a trusted proxy, the
+// right-most X-Forwarded-For entry that is not itself a trusted proxy is used.
+func (s *Server) clientIP(r *http.Request) string {
 	h, _, err := net.SplitHostPort(r.RemoteAddr)
 	if err != nil {
-		return r.RemoteAddr
+		h = r.RemoteAddr
+	}
+	if !s.isTrustedProxy(h) {
+		return h
+	}
+	var parts []string
+	for _, v := range r.Header.Values("X-Forwarded-For") {
+		for _, p := range strings.Split(v, ",") {
+			if p = strings.TrimSpace(p); p != "" {
+				parts = append(parts, p)
+			}
+		}
+	}
+	for i := len(parts) - 1; i >= 0; i-- {
+		if net.ParseIP(parts[i]) == nil {
+			break
+		}
+		if !s.isTrustedProxy(parts[i]) {
+			return parts[i]
+		}
 	}
 	return h
 }
 
+func (s *Server) isTrustedProxy(ip string) bool {
+	p := net.ParseIP(ip)
+	if p == nil {
+		return false
+	}
+	if len(s.TrustedProxies) == 0 {
+		return p.IsLoopback()
+	}
+	for _, c := range s.TrustedProxies {
+		if c.Contains(p) {
+			return true
+		}
+	}
+	return false
+}
+
+// ParseCIDRs turns IPs or CIDRs into networks (bare IPs become /32 or /128).
+func ParseCIDRs(in []string) ([]*net.IPNet, error) {
+	var out []*net.IPNet
+	for _, v := range in {
+		if !strings.Contains(v, "/") {
+			if ip := net.ParseIP(v); ip != nil && ip.To4() != nil {
+				v += "/32"
+			} else {
+				v += "/128"
+			}
+		}
+		_, n, err := net.ParseCIDR(v)
+		if err != nil {
+			return nil, err
+		}
+		out = append(out, n)
+	}
+	return out, nil
+}
+
 func (s *Server) initAuth() {
 	s.authOnce.Do(func() {
 		if s.limiter == nil {
@@ -194,7 +251,7 @@ func (s *Server) register(w http.ResponseWriter, r *http.Request) {
 		writeErr(w, http.StatusForbidden, "registration disabled")
 		return
 	}
-	ip := clientIP(r)
+	ip := s.clientIP(r)
 	if s.limiter.Blocked(ip) {
 		writeErr(w, http.StatusTooManyRequests, "too many attempts, try again later")
 		return
@@ -232,7 +289,7 @@ func (s *Server) register(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) login(w http.ResponseWriter, r *http.Request) {
 	s.initAuth()
-	ip := clientIP(r)
+	ip := s.clientIP(r)
 	if s.limiter.Blocked(ip) {
 		writeErr(w, http.StatusTooManyRequests, "too many attempts, try again later")
 		return