Trust reverse proxies at private addresses by default (closes #198)

With TRUSTED_PROXIES unset, the server now trusts reverse proxies in the
private ranges of RFC 1918. A proxy such as traefik on a Docker network is
then believed. /ip/, the home page's curl card and the request log give the
client's address from X-Forwarded-For instead of the proxy's address.

A list in TRUSTED_PROXIES replaces the default. TRUSTED_PROXIES set but
empty trusts no proxy, so the config package reads it with os.LookupEnv.
A direct client at a public address still cannot choose its address with
a forged header.

Model: opus-5-5

internal/config/config.go

@@ -30,6 +30,14 @@ const (
 	maxPort = 65535
 )
 
+// The private address ranges of RFC 1918. The HTTP server trusts a reverse
+// proxy in any of them when TRUSTED_PROXIES is not set.
+const (
+	privateRange10  = "10.0.0.0/8"
+	privateRange172 = "172.16.0.0/12"
+	privateRange192 = "192.168.0.0/16"
+)
+
 var (
 	errRelativeXDGDataHome = errors.New("XDG_DATA_HOME must be an absolute path")
 	errUnsupportedOS       = errors.New("unsupported operating system")
@@ -159,11 +167,21 @@ func getPort() (int, error) {
 	return int(port), nil
 }
 
-// getTrustedProxies returns the addresses and CIDR ranges listed in
-// TRUSTED_PROXIES, such as "10.0.0.0/8,192.0.2.1", or none when it is not set.
-// An address is returned as a range holding only that address.
+// getTrustedProxies returns the reverse proxies the HTTP server trusts. When
+// TRUSTED_PROXIES is not set, they are the private ranges of RFC 1918. When it
+// is set, they are the addresses and CIDR ranges it lists, such as
+// "10.0.0.0/8,192.0.2.1", and none when it is empty. An address is returned as
+// a range holding only that address.
 func getTrustedProxies() ([]netip.Prefix, error) {
-	value := os.Getenv("TRUSTED_PROXIES")
+	value, set := os.LookupEnv("TRUSTED_PROXIES")
+	if !set {
+		return []netip.Prefix{
+			netip.MustParsePrefix(privateRange10),
+			netip.MustParsePrefix(privateRange172),
+			netip.MustParsePrefix(privateRange192),
+		}, nil
+	}
+
 	if value == "" {
 		return nil, nil
 	}

internal/config/config_internal_test.go

@@ -2,6 +2,7 @@ package config
 
 import (
 	"net/netip"
+	"os"
 	"runtime"
 	"slices"
 	"testing"
@@ -46,25 +47,47 @@ func TestNewRefusesInvalidPort(t *testing.T) {
 	}
 }
 
-func TestNewReadsTrustedProxies(t *testing.T) {
+// TestNewTrustsPrivateRangesByDefault checks that with TRUSTED_PROXIES unset
+// the trusted proxies are the private ranges of RFC 1918. Before the fix no
+// proxy was trusted, so a reverse proxy at a private address was taken for the
+// client (https://git.eeqj.de/sneak/routewatch/issues/198).
+func TestNewTrustsPrivateRangesByDefault(t *testing.T) {
 	t.Setenv("PORT", "")
 	t.Setenv("XDG_DATA_HOME", "")
 
+	// t.Setenv puts the variable back when the test ends.
 	t.Setenv("TRUSTED_PROXIES", "")
 
+	err := os.Unsetenv("TRUSTED_PROXIES")
+	if err != nil {
+		t.Fatal(err)
+	}
+
 	cfg, err := New()
 	if err != nil {
 		t.Fatalf("New() without TRUSTED_PROXIES: %v", err)
 	}
 
-	if len(cfg.TrustedProxies) != 0 {
-		t.Errorf("New() without TRUSTED_PROXIES: TrustedProxies = %v, want none",
-			cfg.TrustedProxies)
+	want := []netip.Prefix{
+		netip.MustParsePrefix("10.0.0.0/8"),
+		netip.MustParsePrefix("172.16.0.0/12"),
+		netip.MustParsePrefix("192.168.0.0/16"),
 	}
+	if !slices.Equal(cfg.TrustedProxies, want) {
+		t.Errorf("New() without TRUSTED_PROXIES: TrustedProxies = %v, want %v",
+			cfg.TrustedProxies, want)
+	}
+}
+
+// TestNewReadsTrustedProxies checks that a list in TRUSTED_PROXIES replaces
+// the default, and that TRUSTED_PROXIES set but empty trusts no proxy.
+func TestNewReadsTrustedProxies(t *testing.T) {
+	t.Setenv("PORT", "")
+	t.Setenv("XDG_DATA_HOME", "")
 
 	t.Setenv("TRUSTED_PROXIES", "10.0.0.0/8, 192.0.2.1,2001:db8::/32")
 
-	cfg, err = New()
+	cfg, err := New()
 	if err != nil {
 		t.Fatalf("New() with TRUSTED_PROXIES: %v", err)
 	}
@@ -77,6 +100,18 @@ func TestNewReadsTrustedProxies(t *testing.T) {
 	if !slices.Equal(cfg.TrustedProxies, want) {
 		t.Errorf("TrustedProxies = %v, want %v", cfg.TrustedProxies, want)
 	}
+
+	t.Setenv("TRUSTED_PROXIES", "")
+
+	cfg, err = New()
+	if err != nil {
+		t.Fatalf("New() with TRUSTED_PROXIES set but empty: %v", err)
+	}
+
+	if len(cfg.TrustedProxies) != 0 {
+		t.Errorf("New() with TRUSTED_PROXIES set but empty: TrustedProxies = %v, "+
+			"want none", cfg.TrustedProxies)
+	}
 }
 
 func TestNewRefusesInvalidTrustedProxies(t *testing.T) {