Honour forwarded headers only from trusted proxies (closes #259)

Before, the server took the client's address from X-Forwarded-For or X-Real-IP whoever sent them, so a direct client could get past the login rate limit and choose the address and hostname recorded for its session.

A new ClientIP middleware, run before request logging, resolves the address once: forwarded headers count only when the peer is in TRUSTED_PROXIES, which defaults to the RFC 1918 ranges. A set list replaces the default, the empty string trusts nothing, and an invalid entry stops startup. The request log, login rate limiter and session creation all use the resolved address.

A proxy on the same host as a server outside Docker connects from 127.0.0.1 or ::1, which the default does not trust; the README says to list it.

Model: opus-5-5

internal/middleware/middleware.go

@@ -5,6 +5,9 @@ import (
 	"log/slog"
 	"net"
 	"net/http"
+	"net/netip"
+	"slices"
+	"strings"
 	"time"
 
 	basicauth "github.com/99designs/basicauth-go"
@@ -15,6 +18,7 @@ import (
 	"github.com/slok/go-http-metrics/middleware/std"
 	"github.com/spf13/viper"
 	"go.uber.org/fx"
+	"go4.org/netipx"
 	"sneak.berlin/go/neoirc/internal/config"
 	"sneak.berlin/go/neoirc/internal/globals"
 	"sneak.berlin/go/neoirc/internal/logger"
@@ -62,6 +66,77 @@ func ipFromHostPort(hostPort string) string {
 	return host
 }
 
+// ClientIP returns middleware that replaces request.RemoteAddr with the
+// client's address and keeps the port of the TCP connection. The
+// X-Forwarded-For and X-Real-IP headers count only when the connection
+// comes from an address in TRUSTED_PROXIES.
+func (mware *Middleware) ClientIP() func(http.Handler) http.Handler {
+	trusted := mware.params.Config.TrustedProxies
+
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(
+			func(
+				writer http.ResponseWriter,
+				request *http.Request,
+			) {
+				peer, err := netip.ParseAddrPort(request.RemoteAddr)
+				if err == nil {
+					client := clientAddr(
+						peer.Addr().Unmap(), request.Header, trusted,
+					)
+					request.RemoteAddr = netip.AddrPortFrom(
+						client, peer.Port(),
+					).String()
+				}
+
+				next.ServeHTTP(writer, request)
+			})
+	}
+}
+
+// clientAddr returns the client's address for a request from peer. A
+// peer outside trusted is the client, whatever its headers say. A
+// trusted peer is a proxy. Its X-Forwarded-For list is read from the
+// right, past the trusted addresses, to the first untrusted one; when
+// all are trusted, the client is the leftmost. Without X-Forwarded-For,
+// the client is X-Real-IP. An entry that is not an IP address gives
+// peer.
+func clientAddr(
+	peer netip.Addr, header http.Header, trusted *netipx.IPSet,
+) netip.Addr {
+	if !trusted.Contains(peer) {
+		return peer
+	}
+
+	forwarded := strings.Join(header.Values("X-Forwarded-For"), ",")
+	if forwarded == "" {
+		realIP, err := netip.ParseAddr(
+			strings.TrimSpace(header.Get("X-Real-IP")),
+		)
+		if err != nil {
+			return peer
+		}
+
+		return realIP.Unmap()
+	}
+
+	client := peer
+
+	for _, entry := range slices.Backward(strings.Split(forwarded, ",")) {
+		addr, err := netip.ParseAddr(strings.TrimSpace(entry))
+		if err != nil {
+			return peer
+		}
+
+		client = addr.Unmap()
+		if !trusted.Contains(client) {
+			break
+		}
+	}
+
+	return client
+}
+
 type loggingResponseWriter struct {
 	http.ResponseWriter