fen
f63efc6d88
clientIP() keyed rate-limit buckets on the rightmost X-Forwarded-For entry, assuming traefik appends the real client IP. The deployed ingress does not rewrite XFF, so rotating the header gave a fresh bucket per request (pentest H1: 8 creates with rotating XFF -> 6x201). Now the bucket keys on the actual peer address (RemoteAddr) by default; every client-supplied IP header is ignored. Deployments whose ingress overwrites a client-IP header can opt in via PALETTE_TRUSTED_IP_HEADER (e.g. CF-Connecting-IP behind Cloudflare) to restore per-client limits. Adds tests: rotating XFF no longer resets the bucket; the trusted header is honored only when explicitly configured.
58 lines
1.8 KiB
Go
58 lines
1.8 KiB
Go
package api
|
|
|
|
import (
|
|
"fmt"
|
|
"net/http/httptest"
|
|
"testing"
|
|
)
|
|
|
|
func TestClientIPUsesRemoteAddrNotXFF(t *testing.T) {
|
|
SetTrustedIPHeader("")
|
|
defer SetTrustedIPHeader("")
|
|
r := httptest.NewRequest("POST", "/api/pastes", nil)
|
|
r.RemoteAddr = "203.0.113.7:4432"
|
|
r.Header.Set("X-Forwarded-For", "1.2.3.4, 1.2.3.5, 203.0.113.9")
|
|
r.Header.Set("X-Real-Ip", "203.0.113.10")
|
|
if got := clientIP(r); got != "203.0.113.7" {
|
|
t.Fatalf("clientIP = %q, want peer 203.0.113.7", got)
|
|
}
|
|
}
|
|
|
|
func TestClientIPTrustedHeaderOnlyWhenConfigured(t *testing.T) {
|
|
SetTrustedIPHeader("")
|
|
defer SetTrustedIPHeader("")
|
|
r := httptest.NewRequest("POST", "/api/pastes", nil)
|
|
r.RemoteAddr = "10.0.1.47:9999"
|
|
r.Header.Set("CF-Connecting-IP", "198.51.100.9")
|
|
if got := clientIP(r); got != "10.0.1.47" {
|
|
t.Fatalf("unconfigured: clientIP = %q, want peer 10.0.1.47", got)
|
|
}
|
|
SetTrustedIPHeader("CF-Connecting-IP")
|
|
if got := clientIP(r); got != "198.51.100.9" {
|
|
t.Fatalf("configured: clientIP = %q, want CF-Connecting-IP value", got)
|
|
}
|
|
}
|
|
|
|
// Issue #280: rotating X-Forwarded-For must NOT reset the bucket. Pentest
|
|
// repro was 8 creates with rotating XFF -> 6x201.
|
|
func TestRotatingXFFDoesNotResetBucket(t *testing.T) {
|
|
globalLimiter = newLimiter()
|
|
defer SetTrustedIPHeader("")
|
|
SetTrustedIPHeader("")
|
|
s := defaultSettings(Config{}) // burst/limit defaults; any header values are ignored anyway
|
|
var allowed, limited int
|
|
for i := 0; i < 8; i++ {
|
|
r := httptest.NewRequest("POST", "/api/pastes", nil)
|
|
r.RemoteAddr = "198.51.100.1:5000"
|
|
r.Header.Set("X-Forwarded-For", fmt.Sprintf("9.9.9.%d", i))
|
|
if rateLimitCreate(r, s) {
|
|
allowed++
|
|
} else {
|
|
limited++
|
|
}
|
|
}
|
|
if float64(allowed) != s.RateLimitBurst || limited != 8-int(s.RateLimitBurst) {
|
|
t.Fatalf("rotating XFF: allowed=%d limited=%d, want allowed=%v (burst), limited=%d", allowed, limited, s.RateLimitBurst, 8-int(s.RateLimitBurst))
|
|
}
|
|
}
|