otto 2.6.0 → 2.7.0

data/lib/otto/security/rate_limiter.rb

@@ -80,9 +80,15 @@ class Otto
         # Log blocked requests if ActiveSupport is available
         return unless defined?(ActiveSupport::Notifications)
 
+        # Rack::Attack is mounted by the hosting app AHEAD of Otto, so this
+        # subscriber sees the raw peer regardless of where IPPrivacyMiddleware
+        # sits in Otto's own stack. Log a masked address, never req.ip: a
+        # deployment on the default :masked profile must not write raw client
+        # IPs to its logs every time a limit trips (issue #219).
         ActiveSupport::Notifications.subscribe('rack.attack') do |_name, _start, _finish, _request_id, payload|
           req = payload[:request]
-          Otto.logger.warn "[Otto] Rate limit #{payload[:match_type]} for #{req.ip}: #{payload[:matched]}"
+          ip  = Otto::LoggingHelpers.privacy_safe_ip(req.env, req.ip)
+          Otto.logger.warn "[Otto] Rate limit #{payload[:match_type]} for #{ip}: #{payload[:matched]}"
         end
       end
     end

data/lib/otto/utils.rb

@@ -320,5 +320,105 @@ class Otto
     rescue IPAddr::InvalidAddressError, IPAddr::AddressFamilyError
       false
     end
+
+    # Whether an address falls inside any of the given CIDR ranges.
+    #
+    # The general-purpose CIDR-set matcher (allowlists, denylists, network
+    # zones), sharing the semantics of the trusted-proxy matcher: the client
+    # address is normalized (port stripped, validated) and folded via
+    # IPAddr#native so an IPv4-mapped IPv6 peer (::ffff:203.0.113.7) matches
+    # an IPv4 range; ranges of the other address family are skipped rather
+    # than raising.
+    #
+    # Ranges are folded through #native too, so the fold is symmetric: a
+    # mapped-IPv6 CIDR (::ffff:10.0.0.0/104) matches a plain IPv4 client just
+    # as a mapped client matches a plain IPv4 range. Folding only one side
+    # made the family check reject the pair and silently drop the entry —
+    # wrong verdict, not a raise. #native returns self for ranges that are
+    # not IPv4-mapped/compatible, so ordinary IPv4 and IPv6 CIDRs are
+    # untouched, and it returns a new IPAddr rather than mutating, so
+    # pre-parsed entries in a caller's configuration array stay intact.
+    #
+    # The fold needs the prefix to cover the mapped marker — /96 or longer.
+    # ::ffff:10.0.0.0/104 folds to 10.0.0.0/8; ::ffff:10.0.0.0/64 does not
+    # fold at all, because masking zeroes the ffff marker, and so matches
+    # neither an IPv4 client nor a mapped one. Write mapped ranges at /96+,
+    # or just write the IPv4 CIDR. ::ffff:0:0/96 is the whole mapped space
+    # and therefore matches every IPv4 address. Deprecated IPv4-compatible
+    # notation (::a.b.c.d) folds on the same terms, on both sides.
+    #
+    # Asymmetric strictness, on purpose:
+    # - `ip` is runtime data — nil, blank, or malformed input returns false
+    #   (fail-closed for allowlist callers).
+    # - `cidrs` entries are configuration — an invalid CIDR string raises
+    #   IPAddr::InvalidAddressError, because silently skipping an entry
+    #   narrows an allowlist or widens a denylist. Validate entries at
+    #   write/boot time; pre-parsed IPAddr entries skip re-parsing here.
+    #
+    # @param ip [String, IPAddr, nil] address to test (runtime data)
+    # @param cidrs [Enumerable<String, IPAddr>, nil] CIDR ranges or host
+    #   addresses (configuration)
+    # @return [Boolean] true when ip is inside at least one range
+    # @raise [IPAddr::InvalidAddressError] if a cidrs entry is not a valid
+    #   IP or CIDR string
+    def ip_in_cidrs?(ip, cidrs)
+      return false if cidrs.nil?
+
+      client =
+        if ip.is_a?(IPAddr)
+          ip.native
+        else
+          candidate = normalize_ip(ip&.to_s)
+          return false unless candidate
+
+          IPAddr.new(candidate).native
+        end
+
+      cidrs.any? do |entry|
+        range = entry.is_a?(IPAddr) ? entry : IPAddr.new(entry.to_s)
+        # IPAddr#native builds its result with #clone, which carries frozen
+        # state over and then fails to mutate it. Callers who freeze their
+        # range configuration (or pass it through Ractor.make_shareable) would
+        # hit FrozenError, so hand #native an unfrozen receiver. Gating the dup
+        # on a foldable-range predicate would cost more than it saves:
+        # #ipv4_compat? is deprecated and warns under -w, and #native already
+        # short-circuits to self for anything that does not fold.
+        range = range.dup if range.frozen?
+        range = range.native
+        range.family == client.family && range.include?(client)
+      end
+    end
+
+    # Whether an address is on the loopback interface.
+    #
+    # This is the RAW SOCKET PEER test used to authenticate a direct local call
+    # (Otto::CaddyTLS::LocalhostGuard) — and, because IPPrivacyMiddleware now
+    # runs outermost and rewrites REMOTE_ADDR, the same test IPPrivacyMiddleware
+    # applies to the original peer and records as the leak-free boolean
+    # env['otto.peer_loopback']. Shared here so the pre-masking record and the
+    # guard's own fallback cannot drift.
+    #
+    # Fails closed: a blank or unparseable value is non-loopback rather than
+    # raising on the hot path.
+    #
+    # #native folds IPv4-mapped IPv6 (::ffff:127.0.0.1, which dual-stack servers
+    # commonly present) so it is recognized as loopback; plain IPAddr#loopback?
+    # returns false for the mapped form.
+    #
+    # Deliberately does NOT strip a ':port' suffix (unlike #private_ip?): a
+    # conforming Rack server reports the peer port in REMOTE_PORT, so an
+    # unexpected format means something upstream is non-standard and denying is
+    # safer than coercing.
+    #
+    # @param address [String, nil] raw socket peer address
+    # @return [Boolean]
+    def loopback_address?(address)
+      addr = address.to_s.strip
+      return false if addr.empty?
+
+      IPAddr.new(addr).native.loopback?
+    rescue IPAddr::InvalidAddressError, IPAddr::AddressFamilyError
+      false
+    end
   end
 end

data/lib/otto/version.rb

@@ -3,5 +3,5 @@
 # frozen_string_literal: true
 
 class Otto
-  VERSION = '2.6.0'
+  VERSION = '2.7.0'
 end

data/lib/otto.rb

@@ -226,11 +226,19 @@ class Otto
     # before first request (before configuration freezing)
     finalize_request_response_classes
 
-    # Add IP Privacy middleware first in stack (privacy by default for public IPs)
-    # Private/localhost IPs are automatically exempted from masking
+    # IP Privacy is the ENTRY POINT of the stack: the first middleware to touch
+    # a request, so everything else — Otto's own middleware, an :outermost pin,
+    # and anything the app adds via Otto#use — observes the masked REMOTE_ADDR
+    # and the canonical env['otto.client_ip'] (privacy by default for public
+    # IPs; private/localhost IPs are automatically exempted from masking).
+    #
+    # NOT position: :first, which is first-in-ARRAY and therefore INNERMOST —
+    # it put IP masking closest to the app and left every other middleware
+    # reading the raw peer address (issue #219). See
+    # MiddlewareStack#add_with_position for the full position vocabulary.
     @middleware.add_with_position(
       Otto::Security::Middleware::IPPrivacyMiddleware,
-      position: :first
+      position: :entrypoint
     )
   end
 

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: otto
 version: !ruby/object:Gem::Version
-  version: 2.6.0
+  version: 2.7.0
 platform: ruby
 authors:
 - Delano Mandelbaum
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-10 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby
@@ -144,6 +143,9 @@ files:
 - changelog.d/README.md
 - changelog.d/scriv.ini
 - docs/.gitignore
+- docs/1108-STREAMING_ARCHITECTURE_ANALYSIS.md
+- docs/1108-STREAMING_SUPPORT_SUMMARY.md
+- docs/geo-country.md
 - docs/ipaddr-encoding-quirk.md
 - docs/migrating/v2.0.0-pre1.md
 - docs/migrating/v2.0.0-pre2.md
@@ -327,7 +329,6 @@ licenses:
 - MIT
 metadata:
   rubygems_mfa_required: 'true'
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -345,8 +346,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.22
-signing_key:
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Define your rack-apps in plaintext.
 test_files: []