vpndetection-rails 2.1.9 → 2.1.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: efd0d8ce8a4336646eff9df850508a28b46daaf4a135b17e37618db339c49ca0
-  data.tar.gz: a9e0cf4b803cac4de01c1220dd172885827bda07b129df9f82a00d82d13d53c0
+  metadata.gz: ffe89ccd6dcbfc2dce60cbb4db75d7aa929032b0c7e1e4f5346ff9e57de466c6
+  data.tar.gz: 8ee5639bc3a0ac71989c31b24e040b99553fef163cc164df2b090fadb1a21666
 SHA512:
-  metadata.gz: 4155080294c363b8e6c6e4b1d4991dee25223c9324241b647e4559a06520a800594e935cc2a2a4e7a9ceb84484ab7a6000d1b995a2e48923fd68ca3dd0bc90f7
-  data.tar.gz: ca8e10f432f1f463624b5bb7b093329f9c465f2f924bd3a0e2bc0aa57ed84c50c946bfb6d3f18da2fd4e93213864b0da74be9796a9774b9521eb41120af146a8
+  metadata.gz: b7ed6166a51da872c7910ae3cc745de7593090f8bd5d4004c3514cffcd813c38836b956bfe52da5aa8ade99e9447e5246f5046bdc6266100349be44970873f7f
+  data.tar.gz: 9cc1985e154a0f14fd0ce5366dcd92786abbff16987e5ec60a3df68f18732e35688382d8925cb4506f67e0c1a1ce0ca656d5bb5a252eb7e2035a9bc0ae852687

data/README.md

@@ -70,9 +70,9 @@ on_blocked: ->(request, lookup) { [303, { "location" => "/no-vpn" }, []] }
 
 This is the setting that decides whether any of the above works, and it is the one thing only you can get right.
 
-**In Rails**, the default reads `env["action_dispatch.remote_ip"]` — the answer `ActionDispatch::RemoteIp` computed from `X-Forwarded-For` minus your `config.action_dispatch.trusted_proxies`. That is the right fix behind a load balancer: tell Rails which proxies are yours and it resolves the visitor for you. `Rack::Request#ip` does *not* read that entry, so reading Rails' own is what makes your `trusted_proxies` mean anything here. **With nothing in front of the app server, that default can be forged**: `RemoteIp` believes `X-Forwarded-For` without checking that the connection came from a proxy, so any visitor picks the address that gets looked up. There, pass `ip_selector: ->(request) { request.ip }`. The middleware warns once when it sees that setup: a request carrying `X-Forwarded-For` or `Client-IP` from a public address outside `trusted_proxies`.
+**In Rails**, the default reads `env["action_dispatch.remote_ip"]` — the answer `ActionDispatch::RemoteIp` computed from `X-Forwarded-For` minus your `config.action_dispatch.trusted_proxies`. That is the right fix behind a load balancer: tell Rails which proxies are yours and it resolves the visitor for you. `Rack::Request#ip` does *not* read that entry, so reading Rails' own is what makes your `trusted_proxies` mean anything here. **With nothing in front of the app server, that default can be forged**: `RemoteIp` believes `X-Forwarded-For` without checking that the connection came from a proxy, so any visitor picks the address that gets looked up. There, pass `ip_selector: ->(request) { request.ip }`. The middleware warns once when it sees that setup: a request carrying `X-Forwarded-For`, `Client-IP` or `Forwarded` from a public address outside `trusted_proxies`.
 
-**In a bare Rack app** there is no such entry and the default falls back to `Rack::Request#ip`. Rack's `ip` returns the connecting address, `REMOTE_ADDR`, unless that is a trusted proxy, which by default means a loopback or private address. Only then does it read `X-Forwarded-For`, and it takes the right-most entry that is not a trusted proxy. The test suite pins both. Behind an edge on a public address, or one that appends rather than overwrites, name your edge's header instead:
+**In a bare Rack app** there is no such entry and the default falls back to `Rack::Request#ip`. Rack's `ip` returns the connecting address, `REMOTE_ADDR`, unless that is a trusted proxy, which by default means a loopback or private address. Only then does it read the forwarding headers, and it takes the right-most entry that is not a trusted proxy. The test suite pins both. Behind an edge on a public address, or one that appends rather than overwrites, name your edge's header instead:
 
 ```ruby
 ip_selector: VPNDetection::Rails.header_ip_selector("CF-Connecting-IP")
@@ -80,6 +80,14 @@ ip_selector: VPNDetection::Rails.header_ip_selector("CF-Connecting-IP")
 
 `VPNDetection::Rails.xff_ip_selector` reads `X-Forwarded-For` directly, and `xff_ip_selector(1)` counts one trusted hop from the right. Anything else, pass your own callable — it receives the Rack request and returns an address.
 
+**Behind a proxy that writes only `X-Forwarded-For`, a visitor's own `Forwarded` header names the address.** Rack 3 reads `Forwarded` first, for `Rack::Request#ip` and Rails' `remote_ip` alike, and nginx passes a visitor's copy through untouched, so a request sending `Forwarded: for=1.1.1.1` is looked up as `1.1.1.1`. Clear the header at the proxy, `proxy_set_header Forwarded "";` in nginx, or tell Rack to read `X-Forwarded-For` alone at the top of `config.ru`:
+
+```ruby
+Rack::Request.forwarded_priority = [:x_forwarded]
+```
+
+The middleware warns once when a request through a proxy carries both headers.
+
 If the address resolves to a private one, the middleware says so once. That is expected locally and is the signal to fix your configuration anywhere else.
 
 ## When a lookup fails

data/lib/vpndetection/rails/middleware.rb

@@ -21,8 +21,9 @@ module VPNDetection
       def initialize(app, **options)
         @app = app
         @on_blocked = options.delete(:on_blocked) || method(:refuse)
-        # Only the default selector reads Rails' remote_ip.
+        # Only the default selector reads Rails' remote_ip, or Rack's ip.
         @check_forgery = !options.key?(:ip_selector)
+        @check_passed_through = @check_forgery
         @on_warn = options[:on_warn]
         @core = VPNDetection::Middleware::Core.new(
           Rails.default_ip_selector, **options
@@ -32,6 +33,7 @@ module VPNDetection
       def call(env)
         request = ::Rack::Request.new(env)
         warn_forgeable(request) if @check_forgery
+        warn_passed_through(request) if @check_passed_through
         lookup = @core.evaluate(request)
         return @app.call(env) if lookup.nil?
 
@@ -49,11 +51,29 @@ module VPNDetection
         return if peer.nil?
 
         @check_forgery = false
-        message = "a request carrying X-Forwarded-For came from #{peer}, a public address outside " \
-                  'config.action_dispatch.trusted_proxies, so Rails takes the visitor from that header, ' \
-                  'which anyone connecting directly can set. If a proxy sits in front of this app, ' \
+        message = "a request carrying #{Rails.forwarding_header(request)} came from #{peer}, a public " \
+                  'address outside config.action_dispatch.trusted_proxies, so Rails takes the visitor ' \
+                  'from that header, which anyone connecting directly can set. If a proxy sits in front of this app, ' \
                   'add its addresses to trusted_proxies; if nothing does, pass ' \
                   'ip_selector: ->(request) { request.ip }.'
+        say(message)
+      end
+
+      # Once, as above.
+      def warn_passed_through(request)
+        proxy = Rails.passed_through_forwarded(request)
+        return if proxy.nil?
+
+        @check_passed_through = false
+        message = "a request through #{proxy} carries Forwarded beside X-Forwarded-For, and Rack " \
+                  'reads Forwarded first. A proxy that writes only X-Forwarded-For, as nginx does, ' \
+                  "passes a visitor's own Forwarded through, and that names the address looked up. " \
+                  'If yours does, clear the header there (nginx: proxy_set_header Forwarded "";), ' \
+                  'or set Rack::Request.forwarded_priority = [:x_forwarded] in config.ru.'
+        say(message)
+      end
+
+      def say(message)
         @on_warn ? @on_warn.call(message) : Kernel.warn("[vpndetection] #{message}")
       end
 

data/lib/vpndetection/rails/selectors.rb

@@ -52,11 +52,12 @@ module VPNDetection
 
     # @api private
     # The peer, when Rails' RemoteIp let a header that peer sent name the
-    # visitor: `X-Forwarded-For` or `Client-IP` from a public address outside
-    # the proxies RemoteIp trusts, its defaults or trusted_proxies.
+    # visitor: `X-Forwarded-For`, `Client-IP` or a `Forwarded` Rack reads, from
+    # a public address outside the proxies RemoteIp trusts, its defaults or
+    # trusted_proxies.
     def forgeable_peer(request)
       remote_ip = request.get_header('action_dispatch.remote_ip')
-      return nil if remote_ip.nil? || !forwarded?(request)
+      return nil if remote_ip.nil? || forwarding_header(request).nil?
 
       peer = request.get_header('REMOTE_ADDR').to_s
       return nil unless public_address?(peer)
@@ -71,8 +72,30 @@ module VPNDetection
     end
 
     # @api private
-    def forwarded?(request)
-      %w[HTTP_X_FORWARDED_FOR HTTP_CLIENT_IP].any? { |name| !request.get_header(name).to_s.empty? }
+    # The first header on the request that can name the visitor, or nil.
+    def forwarding_header(request)
+      names = { 'X-Forwarded-For' => 'HTTP_X_FORWARDED_FOR', 'Client-IP' => 'HTTP_CLIENT_IP' }
+      names['Forwarded'] = 'HTTP_FORWARDED' if forwarded_priority.include?(:forwarded)
+      names.find { |_, key| !request.get_header(key).to_s.empty? }&.first
+    end
+
+    # @api private
+    # The proxy, when a request through it carries `Forwarded` beside
+    # `X-Forwarded-For` and Rack reads `Forwarded` first, as Rack 3 does by
+    # default, and so does Rails' RemoteIp, which asks Rack. A proxy writing
+    # only `X-Forwarded-For`, as nginx does, passes the visitor's own
+    # `Forwarded` through, and that names the address looked up.
+    def passed_through_forwarded(request)
+      return nil unless forwarded_priority.first == :forwarded
+      return nil if %w[HTTP_FORWARDED HTTP_X_FORWARDED_FOR].any? { |name| request.get_header(name).to_s.empty? }
+
+      request.get_header('REMOTE_ADDR').to_s
+    end
+
+    # @api private
+    # Rack 2 reads only `X-Forwarded-For`, and has no such setting (2.2.24).
+    def forwarded_priority
+      ::Rack::Request.respond_to?(:forwarded_priority) ? ::Rack::Request.forwarded_priority : [:x_forwarded]
     end
 
     # @api private

data/lib/vpndetection/rails/version.rb

@@ -2,6 +2,6 @@
 
 module VPNDetection
   module Rails
-    VERSION = '2.1.9'
+    VERSION = '2.1.10'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: vpndetection-rails
 version: !ruby/object:Gem::Version
-  version: 2.1.9
+  version: 2.1.10
 platform: ruby
 authors:
 - Mslm Dev