From 6572b472c3d64432c36f063bc08003c1cbaec06d Mon Sep 17 00:00:00 2001 From: Chris Lu Date: Thu, 30 Apr 2026 15:19:04 -0700 Subject: [PATCH] fix(s3): honor X-Forwarded-For in audit log remote_ip (#9295) * fix(s3): honor X-Forwarded-For in audit log remote_ip When SeaweedFS S3 sits behind a reverse proxy (e.g., Caddy), the audit log's `remote_ip` was reporting the proxy's address because only `X-Real-IP` and `r.RemoteAddr` were consulted. Caddy and most other proxies set `X-Forwarded-For` by default but not `X-Real-IP`, so the real client IP was lost. Check `X-Forwarded-For` first (using the left-most non-empty entry as the originating client), then fall back to `X-Real-IP`, then `r.RemoteAddr`. Fixes #9293 * fix(s3): strip port from RemoteAddr fallback in audit log Address PR review: the X-Forwarded-For and X-Real-IP paths return host-only values, while the RemoteAddr fallback was returning "host:port", making the remote_ip field inconsistent with both the other code paths and the "192.0.2.3" example in the AccessLog struct. Use net.SplitHostPort to strip the port, falling back to the raw RemoteAddr for non-IP markers (e.g., "@" for unix sockets). --- weed/s3api/s3err/audit_fluent.go | 29 ++++++++++-- weed/s3api/s3err/audit_fluent_test.go | 68 +++++++++++++++++++++++++++ 2 files changed, 93 insertions(+), 4 deletions(-) diff --git a/weed/s3api/s3err/audit_fluent.go b/weed/s3api/s3err/audit_fluent.go index ad101cca2..69a8ad54e 100644 --- a/weed/s3api/s3err/audit_fluent.go +++ b/weed/s3api/s3err/audit_fluent.go @@ -3,8 +3,10 @@ package s3err import ( "encoding/json" "fmt" + "net" "net/http" "os" + "strings" "time" "github.com/fluent/fluent-logger-golang/fluent" @@ -82,6 +84,28 @@ func InitAuditLog(config string) { } } +// getRemoteIP returns the client IP for the audit log, honoring forwarding +// headers set by reverse proxies. Preference order: X-Forwarded-For (first +// non-empty entry), X-Real-IP, then r.RemoteAddr. Headers are trusted as-is; +// operators who expose the S3 endpoint directly to untrusted networks should +// strip these headers at the proxy boundary so clients cannot spoof them. +func getRemoteIP(r *http.Request) string { + if forwardedFor := r.Header.Get("X-Forwarded-For"); forwardedFor != "" { + for _, entry := range strings.Split(forwardedFor, ",") { + if ip := strings.TrimSpace(entry); ip != "" { + return ip + } + } + } + if realIP := strings.TrimSpace(r.Header.Get("X-Real-IP")); realIP != "" { + return realIP + } + if host, _, err := net.SplitHostPort(r.RemoteAddr); err == nil { + return host + } + return r.RemoteAddr +} + func getREST(httpMetod string, resourceType string) string { return fmt.Sprintf("REST.%s.%s", httpMetod, resourceType) } @@ -134,10 +158,7 @@ func GetAccessLog(r *http.Request, HTTPStatusCode int, s3errCode ErrorCode) *Acc if s3errCode != ErrNone { errorCode = GetAPIError(s3errCode).Code } - remoteIP := r.Header.Get("X-Real-IP") - if len(remoteIP) == 0 { - remoteIP = r.RemoteAddr - } + remoteIP := getRemoteIP(r) hostHeader := r.Header.Get("X-Forwarded-Host") if len(hostHeader) == 0 { hostHeader = r.Host diff --git a/weed/s3api/s3err/audit_fluent_test.go b/weed/s3api/s3err/audit_fluent_test.go index bfe2e788f..4d06ecdb4 100644 --- a/weed/s3api/s3err/audit_fluent_test.go +++ b/weed/s3api/s3err/audit_fluent_test.go @@ -17,3 +17,71 @@ func TestGetAccessLogUsesAmzRequestID(t *testing.T) { assert.Equal(t, "req-123", log.RequestID) } + +func TestGetAccessLogRemoteIP(t *testing.T) { + tests := []struct { + name string + remoteAddr string + xRealIP string + xForwardedFor string + expectedRemote string + }{ + { + name: "falls back to RemoteAddr (port stripped) when no headers set", + remoteAddr: "10.89.0.1:35832", + expectedRemote: "10.89.0.1", + }, + { + name: "preserves IPv6 host from RemoteAddr", + remoteAddr: "[2001:db8::1]:35832", + expectedRemote: "2001:db8::1", + }, + { + name: "returns RemoteAddr unchanged when no port present", + remoteAddr: "@", + expectedRemote: "@", + }, + { + name: "uses X-Real-IP when X-Forwarded-For is absent", + remoteAddr: "10.89.0.1:35832", + xRealIP: "203.0.113.7", + expectedRemote: "203.0.113.7", + }, + { + name: "prefers X-Forwarded-For over X-Real-IP", + remoteAddr: "10.89.0.1:35832", + xRealIP: "203.0.113.7", + xForwardedFor: "198.51.100.42", + expectedRemote: "198.51.100.42", + }, + { + name: "uses first hop in X-Forwarded-For chain", + remoteAddr: "10.89.0.1:35832", + xForwardedFor: "198.51.100.42, 10.0.0.5, 10.89.0.1", + expectedRemote: "198.51.100.42", + }, + { + name: "skips empty leading entries in X-Forwarded-For", + remoteAddr: "10.89.0.1:35832", + xForwardedFor: ", 198.51.100.42", + expectedRemote: "198.51.100.42", + }, + } + + for _, tc := range tests { + t.Run(tc.name, func(t *testing.T) { + req := httptest.NewRequest(http.MethodGet, "/bucket/object", nil) + req.RemoteAddr = tc.remoteAddr + if tc.xRealIP != "" { + req.Header.Set("X-Real-IP", tc.xRealIP) + } + if tc.xForwardedFor != "" { + req.Header.Set("X-Forwarded-For", tc.xForwardedFor) + } + + log := GetAccessLog(req, http.StatusOK, ErrNone) + + assert.Equal(t, tc.expectedRemote, log.RemoteIP) + }) + } +}