mirror of
https://github.com/clusterio/clusterio.git
synced 2026-11-12 07:04:52 +09:00
Hornwitser
5f25aad273
If the controller is behind a proxy then the socket.remoteAddress will be that of the proxy instead of the end client that connected. In this case the X-Forwarded-For header will contain the address of the end client, but this should only be relied upon if the party connecting is a trusted proxy, otherwise a malicious user could spoof the IP address that is logged by providing a forged X-Forwarded-For header. Implement a trusted proxy list consisting of a configured list of IP addresses and/or CIDR blocks and use the last address[1] in the X-Forwarded-For header if the remoteAddress address of the connecting party is in the trusted proxy list. [1]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For
74 lines
2.1 KiB
JavaScript
74 lines
2.1 KiB
JavaScript
"use strict";
|
|
const assert = require("assert").strict;
|
|
const { Controller, WsServer } = require("@clusterio/controller");
|
|
const { ControllerConfig } = require("@clusterio/lib");
|
|
|
|
describe("controller/src/WsServer", function() {
|
|
describe("class WsServer", function() {
|
|
/** @type {WsServer} */
|
|
let wsServer;
|
|
before(function() {
|
|
let config = new ControllerConfig("controller");
|
|
config.set("controller.trusted_proxies", "127.0.0.0/8, ::1");
|
|
let controller = new Controller({}, [], "", config);
|
|
wsServer = controller.wsServer;
|
|
});
|
|
describe(".remoteAddr()", function() {
|
|
it("should resolve X-Forward-For header for trusted proxies", function() {
|
|
const ipv4 = wsServer.remoteAddr({
|
|
socket: {
|
|
remoteAddress: "127.0.0.1",
|
|
remoteFamily: "IPv4",
|
|
},
|
|
headers: { "x-forwarded-for": "1.2.3.4" },
|
|
});
|
|
assert.equal(ipv4, "1.2.3.4");
|
|
const ipv6 = wsServer.remoteAddr({
|
|
socket: {
|
|
remoteAddress: "::1",
|
|
remoteFamily: "IPv6",
|
|
},
|
|
headers: { "x-forwarded-for": "2000::1" },
|
|
});
|
|
assert.equal(ipv6, "2000::1");
|
|
});
|
|
it("should pick the last address in X-Forward-For header for trusted proxies", function() {
|
|
const ipv4 = wsServer.remoteAddr({
|
|
socket: {
|
|
remoteAddress: "127.0.0.1",
|
|
remoteFamily: "IPv4",
|
|
},
|
|
headers: { "x-forwarded-for": "1.0.0.0, 2.0.0.0, 1.2.3.4" },
|
|
});
|
|
assert.equal(ipv4, "1.2.3.4");
|
|
const ipv6 = wsServer.remoteAddr({
|
|
socket: {
|
|
remoteAddress: "::1",
|
|
remoteFamily: "IPv6",
|
|
},
|
|
headers: { "x-forwarded-for": "2001::, 2002::, 2000::1" },
|
|
});
|
|
assert.equal(ipv6, "2000::1");
|
|
});
|
|
it("should not resolve X-Forward-For header for untrusted proxies", function() {
|
|
const ipv4 = wsServer.remoteAddr({
|
|
socket: {
|
|
remoteAddress: "1.2.3.4",
|
|
remoteFamily: "IPv4",
|
|
},
|
|
headers: { "x-forwarded-for": "127.0.0.1" },
|
|
});
|
|
assert.equal(ipv4, "1.2.3.4");
|
|
const ipv6 = wsServer.remoteAddr({
|
|
socket: {
|
|
remoteAddress: "2000::1",
|
|
remoteFamily: "IPv6",
|
|
},
|
|
headers: { "x-forwarded-for": "::1" },
|
|
});
|
|
assert.equal(ipv6, "2000::1");
|
|
});
|
|
});
|
|
});
|
|
});
|