rack-cloudflare 1.0.1 → 1.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 226fb49f7f04f287c5ad80d37f92547073049bc1d222054a082a09f2eb85d7e0
-  data.tar.gz: 2b196672e8bca43dfcd22f920ec69fc7250b71fced112aee3d01729c1b40976c
+  metadata.gz: 011cc369434439d481e71bd8010799cd88e87d982210c67981ac7105760aeff5
+  data.tar.gz: fe54456b3085e508bffffb3cab92a198bd0daba4ee91d9fd4166645bb6b2c8c3
 SHA512:
-  metadata.gz: a9c0b7967fa66302c86268e9f80d5e1eece2401b95e4ab0b6b1b91ab41070e4fed3ee554385fe6f5f34cdea8a5a809fa731ebaa6c0ce0ad114c8f2a020bdc285
-  data.tar.gz: 220c954ca1c7779bc811831168cfa15e44c72268917b3b8576eecc6b2794297c03a722a135fdb6710ae3e80d87a5f39d48fdbf46e1a729e4cf74a8a06ed3d212
+  metadata.gz: 63b836789620e7ea49f7f278077918177f51df466e6a7ebddf4eb9e2d8f11c9fc2f03cc923cdf2ddbb7d291d77e7a1a10d7885699b1fe450986a9f1349ca9c4f
+  data.tar.gz: ef8a50c433d5d64fe98ab645a7d3163615c5986ca00f17cb8a54517d3c5dffe6f0415c5fc8b4a6dbeb13b1374f0a8e601a975ae5442335f3b66c590924156bd8

data/README.md

@@ -27,11 +27,11 @@ You can block access to non-Cloudflare networks using `Rack::Cloudflare::Middlew
 ```ruby
 require 'rack/cloudflare'
 
-# In config.ru
+# In config.ru (recommended for Rails as well to preempt application loading)
 use Rack::Cloudflare::Middleware::AccessControl
 
-# In Rails config/application.rb
-config.middleware.use Rack::Cloudflare::Middleware::AccessControl
+# In Rails middleware: config/application.rb
+config.middleware.unshift Rack::Cloudflare::Middleware::AccessControl
 
 # Configure custom blocked message (defaults to "Forbidden")
 Rack::Cloudflare::Middleware::AccessControl.blocked_message = "You don't belong here..."
@@ -144,7 +144,7 @@ The list can be updated to Cloudflare's latest published IP lists in-memory:
 
 ```ruby
 # Fetches Rack::Cloudflare::IPs::V4_URL and Rack::Cloudflare::IPs::V6_URL
-Rack::Cloudflare::IPs.refresh!
+Rack::Cloudflare::IPs.update!
 
 # Updates cached list in-memory
 Rack::Cloudflare::IPs.list

data/data/ips_private.txt

@@ -0,0 +1,3 @@
+10.0.0.0/8
+172.16.0.0/12
+192.168.0.0/16

data/lib/rack/cloudflare/headers.rb

@@ -32,10 +32,6 @@ module Rack
         end
       end
 
-      self.backup                 = true
-      self.original_remote_addr   = 'ORIGINAL_REMOTE_ADDR'
-      self.original_forwarded_for = 'ORIGINAL_FORWARDED_FOR'
-
       def initialize(headers)
         @headers = headers
       end
@@ -68,17 +64,15 @@ module Rack
 
       # "Cf-Visitor: { \"scheme\":\"https\"}"
       def visitor
-        return unless has?(HTTP_CF_VISITOR)
-        ::JSON.parse @headers[HTTP_CF_VISITOR]
+        @visitor ||= ::JSON.parse @headers[HTTP_CF_VISITOR] if has?(HTTP_CF_VISITOR)
       end
 
       def remote_addr
         @remote_addr ||= IPs.parse(@headers[REMOTE_ADDR]).first
       end
 
-      # Indicates if the headers passed through Cloudflare
-      def trusted?
-        IPs.list.any? { |range| range.include? remote_addr }
+      def cloudflare_ip
+        @cloudflare_ip ||= IPs.private?(remote_addr) ? forwarded_for.last : remote_addr
       end
 
       def backup_headers
@@ -90,6 +84,12 @@ module Rack
         end
       end
 
+      # Headers that relate to Cloudflare
+      # See: https://support.cloudflare.com/hc/en-us/articles/200170986-How-does-Cloudflare-handle-HTTP-Request-headers-
+      def target_headers
+        @headers.select { |k, _| ALL.include? k }
+      end
+
       def rewritten_headers
         # Only rewrites headers if it's a Cloudflare request
         return {} unless trusted?
@@ -105,16 +105,10 @@ module Rack
           # Cloudflare will already have modified the header if
           # it was present in the original request.
           # See: https://support.cloudflare.com/hc/en-us/articles/200170986-How-does-Cloudflare-handle-HTTP-Request-headers-
-          headers[HTTP_X_FORWARDED_FOR] = "#{connecting_ip}, #{remote_addr}" if forwarded_for.none?
+          headers[HTTP_X_FORWARDED_FOR] = "#{connecting_ip}, #{cloudflare_ip}" if forwarded_for.none?
         end
       end
 
-      # Headers that relate to Cloudflare
-      # See: https://support.cloudflare.com/hc/en-us/articles/200170986-How-does-Cloudflare-handle-HTTP-Request-headers-
-      def target_headers
-        @headers.select { |k, _| ALL.include? k }
-      end
-
       def rewritten_target_headers
         target_headers.merge(rewritten_headers)
       end
@@ -123,9 +117,20 @@ module Rack
         @headers.merge(rewritten_headers)
       end
 
+      # Indicates if the headers passed through Cloudflare
+      def trusted?
+        @trusted ||= IPs.list.any? { |range| range.include? cloudflare_ip }
+      end
+
       def has?(header)
         @headers.key?(header)
       end
+
+      ### Configure
+
+      self.backup                 = true
+      self.original_remote_addr   = 'ORIGINAL_REMOTE_ADDR'
+      self.original_forwarded_for = 'ORIGINAL_FORWARDED_FOR'
     end
   end
 end

data/lib/rack/cloudflare/ips.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 require 'ipaddr'
-require 'net/http'
+require 'open-uri'
 
 module Rack
   class Cloudflare
@@ -14,13 +14,20 @@ module Rack
         # List of IPs to reference
         attr_accessor :list
 
-        # Refresh list of IPs in case local copy is outdated
-        def refresh!
+        def private?(ip)
+          PRIVATE.any? { |range| range.include? ip }
+        end
+
+        # Update list of IPs in-memory in case local copy is outdated
+        def update!
           self.list = fetch(V4_URL) + fetch(V6_URL)
         end
 
         def fetch(url)
-          parse ::Net::HTTP.get(URI(url))
+          parse URI(url).read
+        rescue OpenURI::HTTPError => ex
+          Cloudflare.error "[#{name}] #{ex.class.name} fetching #{url.inspect}: #{ex.message}"
+          []
         end
 
         def read(filename)
@@ -29,13 +36,13 @@ module Rack
 
         def parse(string)
           return [] if string.to_s.strip.empty?
-          string.split(/[,\s]+/).map { |ip| ::IPAddr.new(ip.strip) }
+          string.strip.split(/[,\s]+/).map { |ip| ::IPAddr.new(ip.strip) }
         end
       end
 
-      V4 = read("#{__dir__}/../../../data/ips_v4.txt")
-      V6 = read("#{__dir__}/../../../data/ips_v6.txt")
-
+      V4       = read("#{__dir__}/../../../data/ips_v4.txt")
+      V6       = read("#{__dir__}/../../../data/ips_v6.txt")
+      PRIVATE  = parse('10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16')
       DEFAULTS = V4 + V6
 
       ### Configure

data/lib/rack/cloudflare/version.rb

@@ -2,6 +2,6 @@
 
 module Rack
   class Cloudflare
-    VERSION = '1.0.1'
+    VERSION = '1.0.2'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rack-cloudflare
 version: !ruby/object:Gem::Version
-  version: 1.0.1
+  version: 1.0.2
 platform: ruby
 authors:
 - Joel Van Horn
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2018-09-14 00:00:00.000000000 Z
+date: 2018-09-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -96,6 +96,7 @@ files:
 - Rakefile
 - bin/console
 - bin/setup
+- data/ips_private.txt
 - data/ips_v4.txt
 - data/ips_v6.txt
 - lib/rack/cloudflare.rb