Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 12, 17:00 UTC
matchers: Drop `forwarded` option from `remote_ip` matcher (#6085)
Francis Lavoie committed
Feb 7, 2024 at 10:09 UTC
8c2a72ad07578ceba74ce04a9cdc45f1c6e2faeb
2 files changed
+3
-43
modules/caddyhttp/celmatcher_test.go
-16
@@ -373,22 +373,6 @@ eqp31wM9il1n+guTNyxJd+FzVAH+hCZE5K+tCgVDdVFUlDEHHbS/wqb2PSIoouLV
373
urlTarget: "https://example.com/foo",
374
wantResult: true,
375
},
376
- {
377
- name: "remote_ip forwarded (MatchRemoteIP)",
378
- expression: &MatchExpression{
379
- Expr: `remote_ip('forwarded', '192.0.2.1')`,
380
- },
381
- urlTarget: "https://example.com/foo",
382
- wantResult: true,
383
- },
384
- {
385
- name: "remote_ip forwarded not first (MatchRemoteIP)",
386
- expression: &MatchExpression{
387
- Expr: `remote_ip('192.0.2.1', 'forwarded')`,
388
- },
389
- urlTarget: "https://example.com/foo",
390
- wantErr: true,
391
- },
376
}
377
)
378
modules/caddyhttp/ip_matchers.go
+3
-27
@@ -37,13 +37,6 @@ type MatchRemoteIP struct {
37
// The IPs or CIDR ranges to match.
38
Ranges []string `json:"ranges,omitempty"`
39
40
- // If true, prefer the first IP in the request's X-Forwarded-For
41
- // header, if present, rather than the immediate peer's IP, as
42
- // the reference IP against which to match. Note that it is easy
43
- // to spoof request headers. Default: false
44
- // DEPRECATED: This is insecure, MatchClientIP should be used instead.
45
- Forwarded bool `json:"forwarded,omitempty"`
46
-
40
// cidrs and zones vars should aligned always in the same
41
// length and indexes for matching later
42
cidrs []*netip.Prefix
@@ -82,11 +75,7 @@ func (m *MatchRemoteIP) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
75
d.Next() // consume matcher name
76
for d.NextArg() {
77
if d.Val() == "forwarded" {
85
- if len(m.Ranges) > 0 {
86
- return d.Err("if used, 'forwarded' must be first argument")
87
- }
88
- m.Forwarded = true
89
- continue
78
+ return d.Err("the 'forwarded' option is no longer supported; use the 'client_ip' matcher instead")
79
}
80
if d.Val() == "private_ranges" {
81
m.Ranges = append(m.Ranges, PrivateRangesCIDR()...)
@@ -105,7 +94,7 @@ func (m *MatchRemoteIP) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
94
//
95
// Example:
96
//
108
-// expression remote_ip('forwarded', '192.168.0.0/16', '172.16.0.0/12', '10.0.0.0/8')
97
+// expression remote_ip('192.168.0.0/16', '172.16.0.0/12', '10.0.0.0/8')
98
func (MatchRemoteIP) CELLibrary(ctx caddy.Context) (cel.Library, error) {
99
return CELMatcherImpl(
100
// name of the macro, this is the function name that users see when writing expressions.
@@ -126,11 +115,7 @@ func (MatchRemoteIP) CELLibrary(ctx caddy.Context) (cel.Library, error) {
115
116
for _, input := range strList.([]string) {
117
if input == "forwarded" {
129
- if len(m.Ranges) > 0 {
130
- return nil, errors.New("if used, 'forwarded' must be first argument")
131
- }
132
- m.Forwarded = true
133
- continue
118
+ return nil, errors.New("the 'forwarded' option is no longer supported; use the 'client_ip' matcher instead")
119
}
120
m.Ranges = append(m.Ranges, input)
121
}
@@ -151,21 +136,12 @@ func (m *MatchRemoteIP) Provision(ctx caddy.Context) error {
136
m.cidrs = cidrs
137
m.zones = zones
138
154
- if m.Forwarded {
155
- m.logger.Warn("remote_ip's forwarded mode is deprecated; use the 'client_ip' matcher instead")
156
- }
157
-
139
return nil
140
}
141
142
// Match returns true if r matches m.
143
func (m MatchRemoteIP) Match(r *http.Request) bool {
144
address := r.RemoteAddr
164
- if m.Forwarded {
165
- if fwdFor := r.Header.Get("X-Forwarded-For"); fwdFor != "" {
166
- address = strings.TrimSpace(strings.Split(fwdFor, ",")[0])
167
- }
168
- }
145
clientIP, zoneID, err := parseIPZoneFromString(address)
146
if err != nil {
147
m.logger.Error("getting remote IP", zap.Error(err))