rproxy: remove every X-Forwarded- header from an untrusted peer (closes #325)

For a peer outside `SWRP_TRUSTED_PROXIES`, `rproxy` now removes every header whose name starts with `X-Forwarded-`, in any letter case, before it sets `X-Forwarded-For`, `X-Forwarded-Host` and `X-Forwarded-Proto`; `Forwarded` and `X-Real-IP` are removed as before. Until now only traefik's names were removed, so a client connecting directly could send `X-Forwarded-Ssl: on` or `X-Forwarded-Scheme: https` and make an app take a plain request for a secure one. A trusted peer's headers pass on unchanged. `SPEC.md` says so.

Model: opus-5-5

SPEC.md

@@ -2324,8 +2324,9 @@ but for these headers:
   on.
 - For a peer outside `SWRP_TRUSTED_PROXIES`, its forwarded headers are its own
   claims and are replaced. `X-Forwarded-For` names the peer, `X-Forwarded-Host`
-  the host it asked for, and `X-Forwarded-Proto` plain `http`. The other headers
-  in which traefik tells an app about a visitor are removed.
+  the host it asked for, and `X-Forwarded-Proto` plain `http`. Every other
+  header whose name starts with `X-Forwarded-` is removed, and so are
+  `Forwarded` and `X-Real-IP`.
 - `X-Request-ID`, which carries the fresh id.
 - `X-Client-ASN` and `X-Client-Country`, which carry what `waf` answered. A
   header it did not give is left out. Any of the two the visitor sent is

internal/rproxy/client.go

@@ -105,17 +105,17 @@ func setForwardedHeaders(in, out *http.Request, peer netip.Addr, trusted bool) {
 		return
 	}
 
-	// ReverseProxy has removed Forwarded and the three set below; these are the
-	// other headers in which traefik tells the app about the visitor and its
-	// request.
-	for _, name := range []string{
-		"X-Forwarded-Port", "X-Forwarded-Server", "X-Forwarded-Uri",
-		"X-Forwarded-Method", "X-Forwarded-Prefix", "X-Forwarded-Tls-Client-Cert",
-		"X-Forwarded-Tls-Client-Cert-Info", "X-Real-Ip",
-	} {
-		out.Header.Del(name)
+	// ReverseProxy has removed Forwarded and the three set below. Go's server
+	// gives header names in canonical form, so the prefix matches the name in
+	// any letter case.
+	for name := range out.Header {
+		if strings.HasPrefix(name, "X-Forwarded-") {
+			delete(out.Header, name)
+		}
 	}
 
+	out.Header.Del("X-Real-IP")
+
 	out.Header.Set("X-Forwarded-For", forwardedFor)
 	out.Header.Set("X-Forwarded-Host", in.Host)
 	out.Header.Set("X-Forwarded-Proto", "http")

internal/rproxy/rproxy_test.go

@@ -559,6 +559,8 @@ func TestAPeerNotTrustedHasItsForwardedHeadersReplaced(t *testing.T) {
 		"X-Forwarded-Port", "X-Forwarded-Server", "X-Forwarded-Uri",
 		"X-Forwarded-Method", "X-Forwarded-Prefix", "X-Forwarded-Tls-Client-Cert",
 		"X-Forwarded-Tls-Client-Cert-Info", "X-Real-Ip",
+		"X-Forwarded-Scheme", "X-Forwarded-Ssl", "X-Forwarded-Protocol",
+		"X-Forwarded-Path", "X-Forwarded-Client-Cert",
 	}
 
 	standIn := startWAF(t, allow)
@@ -582,6 +584,9 @@ func TestAPeerNotTrustedHasItsForwardedHeadersReplaced(t *testing.T) {
 		req.Header.Set(name, "claimed")
 	}
 
+	// A made-up name, sent in lower case.
+	req.Header["x-forwarded-made-up"] = []string{"claimed"}
+
 	wantGreeting(t, visit(t, req))
 
 	header := <-seen
@@ -596,7 +601,7 @@ func TestAPeerNotTrustedHasItsForwardedHeadersReplaced(t *testing.T) {
 		}
 	}
 
-	for _, name := range removed {
+	for _, name := range append(removed, "X-Forwarded-Made-Up") {
 		if got := header.Values(name); len(got) != 0 {
 			t.Errorf("the app saw %s %q, want none", name, got)
 		}
@@ -622,6 +627,7 @@ func TestATrustedProxysForwardedHeadersPassOn(t *testing.T) {
 		"X-Forwarded-Host":   "public.example",
 		forwardedProtoHeader: "https",
 		"X-Real-Ip":          "198.51.100.1",
+		"X-Forwarded-Ssl":    "on",
 	}
 
 	req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)