diff --git a/app/common/server_test.go b/app/common/server_test.go index cdcbd4d4f5..7ba4e25e85 100644 --- a/app/common/server_test.go +++ b/app/common/server_test.go @@ -66,6 +66,7 @@ func TestNewClientIPMiddleware(t *testing.T) { Source: config.ClientIPSourceXFF, TrustedIPPrefixes: []string{"10.0.0.0/8"}, }, func(r *http.Request) { + r.RemoteAddr = "10.0.0.2:1234" r.Header.Set("X-Forwarded-For", "203.0.113.7, 10.0.0.1") }) @@ -81,12 +82,40 @@ func TestNewClientIPMiddleware(t *testing.T) { TrustedIPPrefixes: []string{"10.0.0.0/8"}, TrustedProxies: 3, }, func(r *http.Request) { + r.RemoteAddr = "10.0.0.2:1234" r.Header.Set("X-Forwarded-For", "203.0.113.7, 10.0.0.1") }) require.Equal(t, "203.0.113.7", got) }) + t.Run("xff source with trusted prefixes ignores headers from untrusted peers", func(t *testing.T) { + // A trusted hop claimed in XFF cannot make an untrusted socket peer trusted. + got := resolveClientIP(t, config.ClientIPMiddlewareConfig{ + Source: config.ClientIPSourceXFF, + TrustedIPPrefixes: []string{"10.0.0.0/8"}, + }, func(r *http.Request) { + r.RemoteAddr = "198.51.100.9:1234" + r.Header.Set("X-Forwarded-For", "203.0.113.7, 10.0.0.1") + }) + + require.Equal(t, "198.51.100.9", got) + }) + + t.Run("xff source with trusted prefixes ignores headers from untrusted peers when trusted proxies is also set", func(t *testing.T) { + // The proxy count must not bypass the trusted-prefix check on the socket peer. + got := resolveClientIP(t, config.ClientIPMiddlewareConfig{ + Source: config.ClientIPSourceXFF, + TrustedIPPrefixes: []string{"10.0.0.0/8"}, + TrustedProxies: 1, + }, func(r *http.Request) { + r.RemoteAddr = "198.51.100.9:1234" + r.Header.Set("X-Forwarded-For", "203.0.113.7, 10.0.0.1") + }) + + require.Equal(t, "198.51.100.9", got) + }) + t.Run("xff source with trusted proxies resolves the proxy-added entry", func(t *testing.T) { got := resolveClientIP(t, config.ClientIPMiddlewareConfig{ Source: config.ClientIPSourceXFF, diff --git a/collector/go.mod b/collector/go.mod index 5fa200a7d1..7512301aa1 100644 --- a/collector/go.mod +++ b/collector/go.mod @@ -205,7 +205,7 @@ require ( github.com/generikvault/gvalstrings v0.0.0-20180926130504-471f38f0112a // indirect github.com/getkin/kin-openapi v0.149.0 // indirect github.com/getsentry/sentry-go v0.47.0 // indirect - github.com/go-chi/chi/v5 v5.3.2 // indirect + github.com/go-chi/chi/v5 v5.5.0 // indirect github.com/go-faker/faker/v4 v4.7.0 // indirect github.com/go-faster/city v1.0.1 // indirect github.com/go-faster/errors v0.7.1 // indirect diff --git a/collector/go.sum b/collector/go.sum index 5f75baf2a1..b8660f94e6 100644 --- a/collector/go.sum +++ b/collector/go.sum @@ -728,8 +728,8 @@ github.com/gin-gonic/gin v1.6.3/go.mod h1:75u5sXoLsGZoRN5Sgbi1eraJ4GU3++wFwWzhwv github.com/gin-gonic/gin v1.7.3/go.mod h1:jD2toBW3GZUr5UMcdrwQA10I7RuaFOl/SGeDjXkfUtY= github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c= github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU= -github.com/go-chi/chi/v5 v5.3.2 h1:5YQkICvTCSZ25hoRsyJazN0scjzKGiu4VAUc7H1o1nY= -github.com/go-chi/chi/v5 v5.3.2/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto= +github.com/go-chi/chi/v5 v5.5.0 h1:xdKQ1dJmVJsmgahrXSKhUx8NyVPzpwdlyrrQFpMPJgg= +github.com/go-chi/chi/v5 v5.5.0/go.mod h1:d1IG7GtKPSjPyBP365PH8sAGVHk3qfB/IhjFNRH1wWM= github.com/go-chi/render v1.0.3 h1:AsXqd2a1/INaIfUSKq3G5uA8weYx20FOsM7uSoCyyt4= github.com/go-chi/render v1.0.3/go.mod h1:/gr3hVkmYR0YlEy3LxCuVRFzEu9Ruok+gFqbIofjao0= github.com/go-co-op/gocron/v2 v2.22.0 h1:uEuH2F7k7VoESb1BYSaffuuV+T0kkpzsC0aXk7/z79I= diff --git a/e2e/go.mod b/e2e/go.mod index dcd4270a4d..58e2e4317f 100644 --- a/e2e/go.mod +++ b/e2e/go.mod @@ -9,7 +9,7 @@ replace github.com/openmeterio/openmeter/api/v3/client => ../api/v3/client require ( github.com/brianvoe/gofakeit/v6 v6.28.0 github.com/cloudevents/sdk-go/v2 v2.16.2 - github.com/go-chi/chi/v5 v5.3.2 + github.com/go-chi/chi/v5 v5.5.0 github.com/jackc/pgx/v5 v5.11.0 github.com/oklog/ulid/v2 v2.1.2 github.com/openmeterio/openmeter v0.0.0-00010101000000-000000000000 diff --git a/e2e/go.sum b/e2e/go.sum index 1c17e4a526..974464fb6f 100644 --- a/e2e/go.sum +++ b/e2e/go.sum @@ -76,8 +76,8 @@ github.com/forscht/namegen v1.0.1 h1:HipCEuyIKECsb1Yt68xaX7XTCDDrd+aDdEROoayY52I github.com/forscht/namegen v1.0.1/go.mod h1:Vnu8EC4fPGwaP7ogYi7kTPvRQHAUZUe1i1wN1RlgzII= github.com/getkin/kin-openapi v0.149.0 h1:ZbhmVJ4yq5RZDUsyP8lcBcGMsjsaTqXEFt6isdtMDfA= github.com/getkin/kin-openapi v0.149.0/go.mod h1:1+BHDzstro+P5CKtPy1X4PfofnFgmRe6uvMy9+r9fKY= -github.com/go-chi/chi/v5 v5.3.2 h1:5YQkICvTCSZ25hoRsyJazN0scjzKGiu4VAUc7H1o1nY= -github.com/go-chi/chi/v5 v5.3.2/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto= +github.com/go-chi/chi/v5 v5.5.0 h1:xdKQ1dJmVJsmgahrXSKhUx8NyVPzpwdlyrrQFpMPJgg= +github.com/go-chi/chi/v5 v5.5.0/go.mod h1:d1IG7GtKPSjPyBP365PH8sAGVHk3qfB/IhjFNRH1wWM= github.com/go-chi/render v1.0.3 h1:AsXqd2a1/INaIfUSKq3G5uA8weYx20FOsM7uSoCyyt4= github.com/go-chi/render v1.0.3/go.mod h1:/gr3hVkmYR0YlEy3LxCuVRFzEu9Ruok+gFqbIofjao0= github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA= diff --git a/go.mod b/go.mod index e95124c47d..c731c7d6b3 100644 --- a/go.mod +++ b/go.mod @@ -26,7 +26,7 @@ require ( github.com/confluentinc/confluent-kafka-go/v2 v2.16.0 github.com/forscht/namegen v1.0.1 github.com/getkin/kin-openapi v0.149.0 - github.com/go-chi/chi/v5 v5.3.2 + github.com/go-chi/chi/v5 v5.5.0 github.com/go-chi/cors v1.2.2 github.com/go-chi/render v1.0.3 github.com/go-co-op/gocron/v2 v2.22.0 diff --git a/go.sum b/go.sum index 674c78d2cd..1b43af4676 100644 --- a/go.sum +++ b/go.sum @@ -131,8 +131,8 @@ github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0= github.com/getkin/kin-openapi v0.149.0 h1:ZbhmVJ4yq5RZDUsyP8lcBcGMsjsaTqXEFt6isdtMDfA= github.com/getkin/kin-openapi v0.149.0/go.mod h1:1+BHDzstro+P5CKtPy1X4PfofnFgmRe6uvMy9+r9fKY= -github.com/go-chi/chi/v5 v5.3.2 h1:5YQkICvTCSZ25hoRsyJazN0scjzKGiu4VAUc7H1o1nY= -github.com/go-chi/chi/v5 v5.3.2/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto= +github.com/go-chi/chi/v5 v5.5.0 h1:xdKQ1dJmVJsmgahrXSKhUx8NyVPzpwdlyrrQFpMPJgg= +github.com/go-chi/chi/v5 v5.5.0/go.mod h1:d1IG7GtKPSjPyBP365PH8sAGVHk3qfB/IhjFNRH1wWM= github.com/go-chi/cors v1.2.2 h1:Jmey33TE+b+rB7fT8MUy1u0I4L+NARQlK6LhzKPSyQE= github.com/go-chi/cors v1.2.2/go.mod h1:sSbTewc+6wYHBBCW7ytsFSn836hqM7JxpglAy2Vzc58= github.com/go-chi/render v1.0.3 h1:AsXqd2a1/INaIfUSKq3G5uA8weYx20FOsM7uSoCyyt4=