mirror of
https://github.com/versity/versitygw.git
synced 2026-10-22 06:12:39 +00:00
Tung Lam
e63998fb31
Behind a reverse proxy the request log and the S3, admin, website and WebUI access logs record the proxy's address instead of the client's. Add a client-ip-header option that takes the logged address from X-Forwarded-For or X-Real-Ip. It is off by default, so an existing deployment logs exactly what it logged before. The header is only honoured when the connecting peer is listed in the new trusted-proxies list of IPs and CIDRs. Without that, the value is whatever the client sent: nginx's standard proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for appends to a client-supplied header, leaving the client's own address leftmost. X-Forwarded-For is walked right to left, skipping the listed proxies, so the first unlisted address is the client and a forged leftmost entry is never reached; the two-proxy case from #2243 works once both proxies are listed. Every header line is walked (a proxy may add its own line instead of appending), ip:port entries are accepted, and a request from an unlisted peer keeps the socket address. Setting the header with an empty trusted-proxies list fails startup rather than silently trusting every peer. X-Real-Ip reads the last header line, so a proxy that adds a line rather than replacing the client's is the one that speaks. An address carrying an IPv6 zone is rejected: the zone is free text that the space-delimited access log would write verbatim, shifting every field after RemoteIP. When every hop in X-Forwarded-For is a trusted proxy, the leftmost hop is logged, as nginx's real_ip_recursive does, since the socket peer is then the nearest proxy. The trusted-proxies list accepts the entry "unix" to trust the peer of a listener bound to a unix socket path, which fasthttp reports as 0.0.0.0. The resolver, middleware, log tag and parsers live in internal/clientip, shared by s3api, iamapi, website and webui; s3api/utils re-exports them for the S3 callers, so the standalone IAM service no longer pulls in the S3 side. On this branch go list -deps ./iamapi drops from 375 to 299 packages, against 298 on main. ctx.IP() is unchanged and still returns the socket peer address, because it feeds aws:SourceIp in IAM policy conditions and SourceIP in policy evaluation; only the address written to the logs and S3 event records comes from the header. Fixes #2243.
53 lines
1.6 KiB
Go
53 lines
1.6 KiB
Go
// Copyright 2026 Versity Software
|
|
// This file is licensed under the Apache License, Version 2.0
|
|
// (the "License"); you may not use this file except in compliance
|
|
// with the License. You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing,
|
|
// software distributed under the License is distributed on an
|
|
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
// KIND, either express or implied. See the License for the
|
|
// specific language governing permissions and limitations
|
|
// under the License.
|
|
|
|
package s3log
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"github.com/gofiber/fiber/v3"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
"github.com/versity/versitygw/s3api/utils"
|
|
)
|
|
|
|
// TestFileLoggerRemoteIP verifies that the access log records the address
|
|
// resolved by the client IP middleware rather than the socket peer address.
|
|
func TestFileLoggerRemoteIP(t *testing.T) {
|
|
logfile := filepath.Join(t.TempDir(), "access.log")
|
|
logger, err := InitFileLogger(logfile)
|
|
require.NoError(t, err)
|
|
defer logger.Shutdown()
|
|
|
|
app := fiber.New()
|
|
app.Get("/", func(ctx fiber.Ctx) error {
|
|
utils.ContextKeyClientIP.Set(ctx, "203.0.113.7")
|
|
logger.Log(ctx, nil, nil, LogMeta{})
|
|
return ctx.SendStatus(http.StatusNoContent)
|
|
})
|
|
|
|
resp, err := app.Test(httptest.NewRequest(http.MethodGet, "/", nil))
|
|
require.NoError(t, err)
|
|
resp.Body.Close()
|
|
|
|
content, err := os.ReadFile(logfile)
|
|
require.NoError(t, err)
|
|
assert.Contains(t, string(content), " 203.0.113.7 ")
|
|
}
|