vpndetection-rails 2.0.12 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5d511872aa8a56af6ea3c30fb1eb836ed375675ea33a0b42034a2d2994fd0b5b
-  data.tar.gz: 6584b5f34d60360fa5238861dded3d02fd18b354294cb30f353a2d984c6e7d73
+  metadata.gz: 19aff4067906b1224611a73aa026e8e844cae8ac860603d738d40de3fc190c1a
+  data.tar.gz: f403e754f52b4c48bc0d45b9b9a4e6a3ba0d9c9a20b332dbd599034e6b0bfd3d
 SHA512:
-  metadata.gz: d451eb799f2ff065469f7e04d4ea256304fd0779da596f89e6388f94c6da2dcd3505bb179d88f6b9053067ffe10348e7261cd1365b3910ef94ca6a6d9dc16266
-  data.tar.gz: f0eb5bc90e4e58172d99f12e71b27817c41677b205d80de1f143f8cc32ce50aabc3022dbb5dc37cf3fb73fda7b74e1481e21ac4b7a534ad1075dea9303779f7a
+  metadata.gz: 15e492920cb49c87109e29adafe64bdf014810f693e1271862c11d34892efb3126222c22d0849cf9424b3dde90199ed1a88b67435f25530712f7f3af3bbf5f4b
+  data.tar.gz: 412e327c133f3c1053de33cc03adc42bb8d5ff711739365ab2f81bfefc4b864f280bf50656b01c52e534c8865e89888ecec720c3efa3034bf7ba595d7136fa54

data/README.md

@@ -70,7 +70,7 @@ on_blocked: ->(request, lookup) { [303, { "location" => "/no-vpn" }, []] }
 
 This is the setting that decides whether any of the above works, and it is the one thing only you can get right.
 
-**In Rails**, the default reads `env["action_dispatch.remote_ip"]` — the answer `ActionDispatch::RemoteIp` computed from `X-Forwarded-For` minus your `config.action_dispatch.trusted_proxies`. That is the right fix behind a load balancer: tell Rails which proxies are yours and it resolves the visitor for you. `Rack::Request#ip` does *not* read that entry, so reading Rails' own is what makes your `trusted_proxies` mean anything here. **With nothing in front of the app server, that default can be forged**: `RemoteIp` believes `X-Forwarded-For` without checking that the connection came from a proxy, so any visitor picks the address that gets looked up. There, pass `ip_selector: ->(request) { request.ip }`.
+**In Rails**, the default reads `env["action_dispatch.remote_ip"]` — the answer `ActionDispatch::RemoteIp` computed from `X-Forwarded-For` minus your `config.action_dispatch.trusted_proxies`. That is the right fix behind a load balancer: tell Rails which proxies are yours and it resolves the visitor for you. `Rack::Request#ip` does *not* read that entry, so reading Rails' own is what makes your `trusted_proxies` mean anything here. **With nothing in front of the app server, that default can be forged**: `RemoteIp` believes `X-Forwarded-For` without checking that the connection came from a proxy, so any visitor picks the address that gets looked up. There, pass `ip_selector: ->(request) { request.ip }`. The middleware warns once when it sees that setup: a request carrying `X-Forwarded-For` or `Client-IP` from a public address outside `trusted_proxies`.
 
 **In a bare Rack app** there is no such entry and the default falls back to `Rack::Request#ip`. Rack's `ip` returns the connecting address, `REMOTE_ADDR`, unless that is a trusted proxy, which by default means a loopback or private address. Only then does it read `X-Forwarded-For`, and it takes the right-most entry that is not a trusted proxy. The test suite pins both. Behind an edge on a public address, or one that appends rather than overwrites, name your edge's header instead:
 

data/lib/vpndetection/rails/middleware.rb

@@ -21,6 +21,9 @@ module VPNDetection
       def initialize(app, **options)
         @app = app
         @on_blocked = options.delete(:on_blocked) || method(:refuse)
+        # Only the default selector reads Rails' remote_ip.
+        @check_forgery = !options.key?(:ip_selector)
+        @on_warn = options[:on_warn]
         @core = VPNDetection::Middleware::Core.new(
           Rails.default_ip_selector, **options
         )
@@ -28,6 +31,7 @@ module VPNDetection
 
       def call(env)
         request = ::Rack::Request.new(env)
+        warn_forgeable(request) if @check_forgery
         lookup = @core.evaluate(request)
         return @app.call(env) if lookup.nil?
 
@@ -39,6 +43,20 @@ module VPNDetection
 
       private
 
+      # Once: the setup is the same on every request.
+      def warn_forgeable(request)
+        peer = Rails.forgeable_peer(request)
+        return if peer.nil?
+
+        @check_forgery = false
+        message = "a request carrying X-Forwarded-For came from #{peer}, a public address outside " \
+                  'config.action_dispatch.trusted_proxies, so Rails takes the visitor from that header, ' \
+                  'which anyone connecting directly can set. If a proxy sits in front of this app, ' \
+                  'add its addresses to trusted_proxies; if nothing does, pass ' \
+                  'ip_selector: ->(request) { request.ip }.'
+        @on_warn ? @on_warn.call(message) : Kernel.warn("[vpndetection] #{message}")
+      end
+
       def refuse(_request, _lookup)
         body = JSON.generate({ 'error' => 'access denied' })
         [403, { 'content-type' => 'application/json' }, [body]]

data/lib/vpndetection/rails/selectors.rb

@@ -25,12 +25,17 @@ module VPNDetection
     # and using Rack's alone would silently ignore the trusted_proxies you
     # configured.
     #
+    # **With nothing in front of the app server, Rails' answer can be forged**:
+    # `RemoteIp` believes `X-Forwarded-For` from any peer outside
+    # trusted_proxies, so a visitor names the address looked up. The middleware
+    # says so once when it sees that setup.
+    #
     # Outside Rails there is no such entry and this falls back to
-    # `Rack::Request#ip`. **Be aware that Rack's own `ip` already trusts
-    # `X-Forwarded-For`**: it returns the left-most entry after dropping
-    # private and loopback addresses, which is whatever the caller sent.
-    # Measured, not assumed. In a bare Rack app behind nothing, prefer
-    # {.header_ip_selector} or your own.
+    # `Rack::Request#ip`. Under Rack 3 that is the peer itself unless the peer
+    # is a trusted proxy (loopback or private by default). Rack 2 returned the
+    # left-most `X-Forwarded-For` entry after dropping private and loopback
+    # addresses, which is whatever the caller sent: there, behind nothing,
+    # prefer {.header_ip_selector} or your own.
     def default_ip_selector
       SELECTORS.default
     end
@@ -45,6 +50,39 @@ module VPNDetection
       request.ip
     end
 
+    # @api private
+    # The peer, when Rails' RemoteIp let a header that peer sent name the
+    # visitor: `X-Forwarded-For` or `Client-IP` from a public address outside
+    # the proxies RemoteIp trusts, its defaults or trusted_proxies.
+    def forgeable_peer(request)
+      remote_ip = request.get_header('action_dispatch.remote_ip')
+      return nil if remote_ip.nil? || !forwarded?(request)
+
+      peer = request.get_header('REMOTE_ADDR').to_s
+      return nil unless public_address?(peer)
+
+      # RemoteIp's own list, from the object it leaves in env; Rails has kept
+      # it there as @proxies since 4.0.
+      proxies = remote_ip.instance_variable_get(:@proxies)
+      return nil unless proxies.respond_to?(:any?)
+      return nil if proxies.any? { |proxy| proxy === peer } # rubocop:disable Style/CaseEquality
+
+      peer
+    end
+
+    # @api private
+    def forwarded?(request)
+      %w[HTTP_X_FORWARDED_FOR HTTP_CLIENT_IP].any? { |name| !request.get_header(name).to_s.empty? }
+    end
+
+    # @api private
+    def public_address?(ip)
+      IPAddr.new(ip)
+      !VPNDetection::Bogon.bogon?(ip)
+    rescue IPAddr::Error
+      false
+    end
+
     # An address from `X-Forwarded-For`, ignoring Rails' trusted-proxy list.
     #
     # The LEFT-MOST entry (depth 0) is whatever the caller sent, because proxies

data/lib/vpndetection/rails/version.rb

@@ -2,6 +2,6 @@
 
 module VPNDetection
   module Rails
-    VERSION = '2.0.12'
+    VERSION = '2.1.0'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: vpndetection-rails
 version: !ruby/object:Gem::Version
-  version: 2.0.12
+  version: 2.1.0
 platform: ruby
 authors:
 - Mslm Dev