Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 11, 17:15 UTC
reverseproxy: fix error when remote address is not an IP (#7429)
Paulo Henrique committed
Jan 13, 2026 at 16:52 UTC
62134d65af6847782a527612e71d8c1977119365
2 files changed
+44
-7
modules/caddyhttp/reverseproxy/headers_test.go
new
+34
@@ -0,0 +1,34 @@
1
+package reverseproxy
2
+
3
+import (
4
+ "context"
5
+ "net/http/httptest"
6
+ "testing"
7
+
8
+ "github.com/caddyserver/caddy/v2/modules/caddyhttp"
9
+)
10
+
11
+func TestAddForwardedHeadersNonIP(t *testing.T) {
12
+ h := Handler{}
13
+
14
+ // Simulate a request with a non-IP remote address (e.g. SCION, abstract socket, or hostname)
15
+ req := httptest.NewRequest("GET", "/", nil)
16
+ req.RemoteAddr = "my-weird-network:12345"
17
+
18
+ // Mock the context variables required by Caddy.
19
+ // We need to inject the variable map manually since we aren't running the full server.
20
+ vars := map[string]interface{}{
21
+ caddyhttp.TrustedProxyVarKey: false,
22
+ }
23
+ ctx := context.WithValue(req.Context(), caddyhttp.VarsCtxKey, vars)
24
+ req = req.WithContext(ctx)
25
+
26
+ // Execute the unexported function
27
+ err := h.addForwardedHeaders(req)
28
+
29
+ // Expectation: No error should be returned for non-IP addresses.
30
+ // The function should simply skip the trusted proxy check.
31
+ if err != nil {
32
+ t.Errorf("expected no error for non-IP address, got: %v", err)
33
+ }
34
+}
modules/caddyhttp/reverseproxy/reverseproxy.go
+10
-7
@@ -789,16 +789,19 @@ func (h Handler) addForwardedHeaders(req *http.Request) error {
789
// to pull that out before parsing the IP
790
clientIP, _, _ = strings.Cut(clientIP, "%")
791
ipAddr, err := netip.ParseAddr(clientIP)
792
- if err != nil {
793
- return fmt.Errorf("invalid IP address: '%s': %v", clientIP, err)
794
- }
792
793
// Check if the client is a trusted proxy
794
trusted := caddyhttp.GetVar(req.Context(), caddyhttp.TrustedProxyVarKey).(bool)
798
- for _, ipRange := range h.trustedProxies {
799
- if ipRange.Contains(ipAddr) {
800
- trusted = true
801
- break
795
+
796
+ // If ParseAddr fails (e.g. non-IP network like SCION), we cannot check
797
+ // if it is a trusted proxy by IP range. In this case, we ignore the
798
+ // error and treat the connection as untrusted (or retain existing status).
799
+ if err == nil {
800
+ for _, ipRange := range h.trustedProxies {
801
+ if ipRange.Contains(ipAddr) {
802
+ trusted = true
803
+ break
804
+ }
805
}
806
}
807