localghost 3.2.0__tar.gz → 3.2.1__tar.gz

{localghost-3.2.0 → localghost-3.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: localghost
-Version: 3.2.0
+Version: 3.2.1
 Summary: Localghost serves local applications at friendly .localhost URLs
 Keywords: localghost,localhost,docker,compose,traefik,development,proxy
 Author: SmileyChris

{localghost-3.2.0 → localghost-3.2.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "localghost"
-version = "3.2.0"
+version = "3.2.1"
 description = "Localghost serves local applications at friendly .localhost URLs"
 readme = "README.md"
 requires-python = ">=3.11"

{localghost-3.2.0 → localghost-3.2.1}/src/localghost/proxy_compose.yaml

@@ -19,6 +19,10 @@ services:
       - --providers.docker.exposedbydefault=false
       - --providers.docker.network=localghost
       - --experimental.localplugins.localghostFallback.modulename=github.com/SmileyChris/traefik-localghost-fallback
+      # Docker hands Traefik loopback connections from an address of its own;
+      # every request passes this middleware so applications see 127.0.0.1.
+      - --experimental.localplugins.localghostClient.modulename=github.com/SmileyChris/traefik-localghost-client
+      - --entrypoints.web.http.middlewares=localghost-client@docker
     healthcheck:
       test: [CMD, traefik, healthcheck, --ping]
       interval: 10s
@@ -49,6 +53,7 @@ services:
       - traefik.http.routers.localghost-fallback.middlewares=localghost-fallback
       - traefik.http.routers.localghost-fallback.service=noop@internal
       - traefik.http.middlewares.localghost-fallback.plugin.localghostFallback.registryPath=/var/lib/localghost-registry
+      - traefik.http.middlewares.localghost-client.plugin.localghostClient.routesPath=/proc/net/route
 
 networks:
   localghost:

{localghost-3.2.0 → localghost-3.2.1}/src/localghost/proxy_compose_https.yaml

@@ -46,6 +46,9 @@ services:
       - --experimental.abortonpluginfailure=true
       - --experimental.localplugins.localghostCA.modulename=github.com/SmileyChris/traefik-localghost-ca
       - --experimental.localplugins.localghostFallback.modulename=github.com/SmileyChris/traefik-localghost-fallback
+      - --experimental.localplugins.localghostClient.modulename=github.com/SmileyChris/traefik-localghost-client
+      - --entrypoints.web.http.middlewares=localghost-client@docker
+      - --entrypoints.websecure.http.middlewares=localghost-client@docker
     ports:
       - 127.0.0.1:${LOCALGHOST_HTTPS_PORT:-443}:443
     volumes:

{localghost-3.2.0 → localghost-3.2.1}/src/localghost/proxy_compose_tailscale.yaml

@@ -14,6 +14,16 @@ services:
       - --api.insecure=false
       - --entrypoints.web.address=:80
       - --entrypoints.websecure.address=:443
+      # The gateway speaks for tailnet clients: it replaces their forwarded
+      # headers on plain HTTP and names the peer in a PROXY header on the TLS
+      # passthrough. It sits on a Docker network, and everything else that
+      # reaches these loopback-published entrypoints is this machine, arriving
+      # from the Docker gateway -- all private addresses.
+      - --entrypoints.web.forwardedheaders.trustedips=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7
+      - --entrypoints.websecure.proxyprotocol.trustedips=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7
+      - --entrypoints.web.http.middlewares=localghost-client@docker
+      - --entrypoints.websecure.http.middlewares=localghost-client@docker
+      - --experimental.localplugins.localghostClient.modulename=github.com/SmileyChris/traefik-localghost-client
       - --global.checknewversion=false
       - --global.sendanonymoususage=false
       - --ping=true

{localghost-3.2.0 → localghost-3.2.1}/src/localghost/proxy_compose_tailscale_https.yaml

@@ -21,6 +21,7 @@ services:
       - --root-ca=/var/lib/localghost-root/rootCA.pem
       - --http-target=traefik:80
       - --https-target=traefik:443
+      - --https-proxy-protocol
     volumes:
       # The signer volume contains only the exported public root plus the
       # constrained online signer. The offline root volume must never be

{localghost-3.2.0 → localghost-3.2.1}/src/localghost/runner.py

@@ -578,6 +578,13 @@ def create_run_bridge_compose(
             ":8080",
             "--to",
             f"http://host.docker.internal:{host_port}",
+            # Traefik is the edge that saw the client. Caddy would otherwise
+            # replace the client address and scheme with its own view of this
+            # internal hop, so hand Traefik's values on unchanged.
+            "--header-up",
+            "X-Forwarded-For: {http.request.header.X-Forwarded-For}",
+            "--header-up",
+            "X-Forwarded-Proto: {http.request.header.X-Forwarded-Proto}",
         ]
     )
     service["extra_hosts"] = CommentedSeq(["host.docker.internal:host-gateway"])

{localghost-3.2.0 → localghost-3.2.1}/src/localghost/tailscale_gateway/main.go

@@ -43,7 +43,10 @@ type configuration struct {
 	rootCA      string
 	httpTarget  string
 	httpsTarget string
-	bootstrap   bool
+	// httpsProxyProtocol names each tailnet client to the HTTPS target in a
+	// PROXY protocol header; the hub's websecure entrypoint expects one.
+	httpsProxyProtocol bool
+	bootstrap          bool
 }
 
 // servesHTTPS reports whether the gateway fronts a TLS-terminating Traefik.
@@ -62,6 +65,7 @@ func main() {
 	flag.StringVar(&cfg.rootCA, "root-ca", "", "public root certificate; empty serves HTTP only")
 	flag.StringVar(&cfg.httpTarget, "http-target", "traefik:80", "HTTP proxy target")
 	flag.StringVar(&cfg.httpsTarget, "https-target", "", "HTTPS TCP target; required with --root-ca")
+	flag.BoolVar(&cfg.httpsProxyProtocol, "https-proxy-protocol", false, "name each tailnet client to the HTTPS target in a PROXY protocol v1 header")
 	flag.BoolVar(&cfg.bootstrap, "bootstrap", false, "enroll from an auth key on stdin, then exit")
 	healthProbe := flag.Bool("health-probe", false, "check the running gateway's health listener, then exit")
 	flag.Parse()
@@ -164,7 +168,7 @@ func run(ctx context.Context, cfg configuration) error {
 	startDNS(ctx, server, cfg.suffix, ip4, ip6, errCh)
 	startHTTP(ctx, server, cfg, errCh)
 	if cfg.servesHTTPS() {
-		startTCPProxy(ctx, server, ":443", cfg.httpsTarget, errCh)
+		startTCPProxy(ctx, server, ":443", cfg.httpsTarget, cfg.httpsProxyProtocol, errCh)
 	}
 	startHealth(ctx, errCh)
 
@@ -330,20 +334,45 @@ func startHealth(ctx context.Context, errCh chan<- error) {
 	}()
 }
 
+// newHTTPProxy forwards tailnet HTTP to target with the original Host header.
+// Traefik believes forwarded headers from the gateway, so whatever a tailnet
+// client claimed about itself is dropped and replaced with the address its
+// connection actually came from.
+func newHTTPProxy(target string) *httputil.ReverseProxy {
+	upstream := &url.URL{Scheme: "http", Host: target}
+	return &httputil.ReverseProxy{
+		Rewrite: func(request *httputil.ProxyRequest) {
+			request.SetURL(upstream)
+			request.Out.Host = request.In.Host
+			stripForwardedHeaders(request.Out.Header)
+			request.SetXForwarded()
+			if client := request.Out.Header.Get("X-Forwarded-For"); client != "" {
+				request.Out.Header.Set("X-Real-Ip", client)
+			}
+		},
+	}
+}
+
+// stripForwardedHeaders removes every header Traefik would take as a proxy's
+// word about the original request: the X-Forwarded-* family, X-Real-Ip, and
+// the standard Forwarded header.
+func stripForwardedHeaders(header http.Header) {
+	for name := range header {
+		if strings.HasPrefix(name, "X-Forwarded-") {
+			header.Del(name)
+		}
+	}
+	header.Del("X-Real-Ip")
+	header.Del("Forwarded")
+}
+
 func startHTTP(ctx context.Context, server *tsnet.Server, cfg configuration, errCh chan<- error) {
 	listener, err := server.Listen("tcp", ":80")
 	if err != nil {
 		errCh <- fmt.Errorf("listening for HTTP: %w", err)
 		return
 	}
-	target := &url.URL{Scheme: "http", Host: cfg.httpTarget}
-	proxy := httputil.NewSingleHostReverseProxy(target)
-	originalDirector := proxy.Director
-	proxy.Director = func(request *http.Request) {
-		host := request.Host
-		originalDirector(request)
-		request.Host = host
-	}
+	proxy := newHTTPProxy(cfg.httpTarget)
 	handler := http.HandlerFunc(func(w http.ResponseWriter, request *http.Request) {
 		if serveTrust(w, request, cfg) {
 			return
@@ -451,7 +480,7 @@ on the hosting machine.</p>
 `, cfg.suffix, command, fingerprint)
 }
 
-func startTCPProxy(ctx context.Context, server *tsnet.Server, address, target string, errCh chan<- error) {
+func startTCPProxy(ctx context.Context, server *tsnet.Server, address, target string, proxyProtocol bool, errCh chan<- error) {
 	listener, err := server.Listen("tcp", address)
 	if err != nil {
 		errCh <- fmt.Errorf("listening on %s: %w", address, err)
@@ -470,12 +499,16 @@ func startTCPProxy(ctx context.Context, server *tsnet.Server, address, target st
 				}
 				return
 			}
-			go proxyConnection(ctx, incoming, target)
+			go proxyConnection(ctx, incoming, target, proxyProtocol)
 		}
 	}()
 }
 
-func proxyConnection(ctx context.Context, incoming net.Conn, target string) {
+// proxyConnection relays one tailnet connection to target. With proxyProtocol
+// it first names the tailnet peer in a PROXY protocol v1 header: the stream is
+// TLS the gateway never opens, so this is the only way Traefik can learn who
+// connected rather than seeing the gateway itself.
+func proxyConnection(ctx context.Context, incoming net.Conn, target string, proxyProtocol bool) {
 	defer incoming.Close()
 	dialer := net.Dialer{Timeout: 10 * time.Second}
 	outgoing, err := dialer.DialContext(ctx, "tcp", target)
@@ -484,6 +517,13 @@ func proxyConnection(ctx context.Context, incoming net.Conn, target string) {
 		return
 	}
 	defer outgoing.Close()
+	if proxyProtocol {
+		header := proxyProtocolHeader(incoming.RemoteAddr(), incoming.LocalAddr())
+		if _, err := io.WriteString(outgoing, header); err != nil {
+			log.Printf("proxy header to %s failed: %v", target, err)
+			return
+		}
+	}
 	var wait sync.WaitGroup
 	wait.Add(2)
 	copyHalf := func(destination, source net.Conn) {
@@ -497,3 +537,25 @@ func proxyConnection(ctx context.Context, incoming net.Conn, target string) {
 	go copyHalf(incoming, outgoing)
 	wait.Wait()
 }
+
+// proxyProtocolHeader renders the PROXY protocol v1 line for a connection from
+// source to destination. v1 names one address family for both ends, so a pair
+// that disagrees, or an address that is not ip:port, is sent as UNKNOWN and
+// the receiver keeps the connection's own addresses.
+func proxyProtocolHeader(source, destination net.Addr) string {
+	from, errFrom := netip.ParseAddrPort(source.String())
+	to, errTo := netip.ParseAddrPort(destination.String())
+	if errFrom != nil || errTo != nil {
+		return "PROXY UNKNOWN\r\n"
+	}
+	fromIP := from.Addr().Unmap().WithZone("")
+	toIP := to.Addr().Unmap().WithZone("")
+	if fromIP.Is4() != toIP.Is4() {
+		return "PROXY UNKNOWN\r\n"
+	}
+	family := "TCP4"
+	if fromIP.Is6() {
+		family = "TCP6"
+	}
+	return fmt.Sprintf("PROXY %s %s %s %d %d\r\n", family, fromIP, toIP, from.Port(), to.Port())
+}

localghost-3.2.1/src/localghost/tailscale_gateway/proxy_test.go

@@ -0,0 +1,145 @@
+package main
+
+import (
+	"bufio"
+	"context"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+	"time"
+)
+
+func TestHTTPProxyReplacesWhatTheClientClaimsAboutItself(t *testing.T) {
+	seen := make(chan *http.Request, 1)
+	backend := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, request *http.Request) {
+		seen <- request
+	}))
+	defer backend.Close()
+	target, err := url.Parse(backend.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	request := httptest.NewRequest("GET", "http://demo.tail1234/", nil)
+	request.RemoteAddr = "100.101.102.103:4242"
+	request.Header.Set("X-Forwarded-For", "127.0.0.1")
+	request.Header.Set("X-Real-Ip", "127.0.0.1")
+	request.Header.Set("X-Forwarded-Port", "1")
+	request.Header.Set("Forwarded", "for=127.0.0.1")
+	newHTTPProxy(target.Host).ServeHTTP(httptest.NewRecorder(), request)
+
+	received := <-seen
+	if got := received.Header.Values("X-Forwarded-For"); len(got) != 1 || got[0] != "100.101.102.103" {
+		t.Fatalf("X-Forwarded-For = %q, want only the tailnet peer", got)
+	}
+	if got := received.Header.Get("X-Real-Ip"); got != "100.101.102.103" {
+		t.Fatalf("X-Real-Ip = %q, want the tailnet peer", got)
+	}
+	if got := received.Header.Get("X-Forwarded-Proto"); got != "http" {
+		t.Fatalf("X-Forwarded-Proto = %q, want http", got)
+	}
+	for _, name := range []string{"X-Forwarded-Port", "Forwarded"} {
+		if got := received.Header.Get(name); got != "" {
+			t.Fatalf("%s = %q, want the client's claim dropped", name, got)
+		}
+	}
+	if received.Host != "demo.tail1234" {
+		t.Fatalf("Host = %q, want the original host", received.Host)
+	}
+}
+
+func TestProxyProtocolHeaderNamesTheTailnetPeer(t *testing.T) {
+	tcp := func(ip string, port int) net.Addr {
+		return &net.TCPAddr{IP: net.ParseIP(ip), Port: port}
+	}
+	cases := []struct {
+		name        string
+		source      net.Addr
+		destination net.Addr
+		want        string
+	}{
+		{"ipv4", tcp("100.101.102.103", 4242), tcp("100.64.0.1", 443), "PROXY TCP4 100.101.102.103 100.64.0.1 4242 443\r\n"},
+		{"ipv6", tcp("fd7a:115c:a1e0::1", 4242), tcp("fd7a:115c:a1e0::2", 443), "PROXY TCP6 fd7a:115c:a1e0::1 fd7a:115c:a1e0::2 4242 443\r\n"},
+		{"mixed families", tcp("fd7a:115c:a1e0::1", 4242), tcp("100.64.0.1", 443), "PROXY UNKNOWN\r\n"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := proxyProtocolHeader(tc.source, tc.destination); got != tc.want {
+				t.Fatalf("got %q, want %q", got, tc.want)
+			}
+		})
+	}
+}
+
+// relayOnce accepts one connection on a fresh listener, relays it to a fresh
+// target, and returns the client end and the target's end of the stream.
+func relayOnce(t *testing.T, proxyProtocol bool) (client, upstream net.Conn) {
+	t.Helper()
+	target, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = target.Close() })
+	front, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = front.Close() })
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+	go func() {
+		incoming, err := front.Accept()
+		if err != nil {
+			return
+		}
+		proxyConnection(ctx, incoming, target.Addr().String(), proxyProtocol)
+	}()
+	client, err = net.Dial("tcp", front.Addr().String())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = client.Close() })
+	upstream, err = target.Accept()
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = upstream.Close() })
+	_ = upstream.SetReadDeadline(time.Now().Add(5 * time.Second))
+	return client, upstream
+}
+
+func TestProxyConnectionAnnouncesThePeerBeforeTheStream(t *testing.T) {
+	client, upstream := relayOnce(t, true)
+	if _, err := client.Write([]byte("hello")); err != nil {
+		t.Fatal(err)
+	}
+	reader := bufio.NewReader(upstream)
+	line, err := reader.ReadString('\n')
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := fmt.Sprintf("PROXY TCP4 127.0.0.1 127.0.0.1 %d %d\r\n",
+		client.LocalAddr().(*net.TCPAddr).Port, client.RemoteAddr().(*net.TCPAddr).Port)
+	if line != want {
+		t.Fatalf("header = %q, want %q", line, want)
+	}
+	payload := make([]byte, 5)
+	if _, err := io.ReadFull(reader, payload); err != nil || string(payload) != "hello" {
+		t.Fatalf("payload = %q (%v), want the client's bytes untouched", payload, err)
+	}
+}
+
+func TestProxyConnectionWithoutProxyProtocolRelaysOnlyTheStream(t *testing.T) {
+	client, upstream := relayOnce(t, false)
+	if _, err := client.Write([]byte("hello")); err != nil {
+		t.Fatal(err)
+	}
+	payload := make([]byte, 5)
+	if _, err := io.ReadFull(upstream, payload); err != nil || string(payload) != "hello" {
+		t.Fatalf("payload = %q (%v), want the client's bytes first", payload, err)
+	}
+}

localghost-3.2.1/src/localghost/traefik_plugin/src/github.com/SmileyChris/traefik-localghost-client/.traefik.yml

@@ -0,0 +1,7 @@
+displayName: Localghost Client Address
+type: middleware
+import: github.com/SmileyChris/traefik-localghost-client
+summary: Names requests from this machine as 127.0.0.1
+
+testData:
+  routesPath: /proc/net/route

localghost-3.2.1/src/localghost/traefik_plugin/src/github.com/SmileyChris/traefik-localghost-client/client.go

@@ -0,0 +1,143 @@
+// Package traefik_localghost_client implements a Traefik middleware plugin
+// that names requests from this machine as 127.0.0.1.
+//
+// The hub publishes its ports on loopback only, yet Docker hands Traefik those
+// connections from an address of its own: the bridge gateway on a native
+// daemon, the VM's gateway under Docker Desktop. Left alone, every
+// application would be told that address instead of the loopback the browser
+// used. Everything else that reaches Traefik is a container on one of its own
+// networks (the tailnet gateway among them) or a tailnet device named by the
+// gateway's PROXY header. So an IPv4 source that is the gateway, or is on
+// none of Traefik's networks and is not a Tailscale address, is this machine.
+package traefik_localghost_client
+
+import (
+	"bufio"
+	"context"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"os"
+	"strings"
+)
+
+type Config struct {
+	// RoutesPath is the kernel's IPv4 routing table inside the Traefik
+	// container: its default route names the host, and its directly
+	// connected routes name the networks containers arrive from.
+	RoutesPath string `json:"routesPath,omitempty"`
+}
+
+func CreateConfig() *Config { return &Config{RoutesPath: "/proc/net/route"} }
+
+// tailnet is Tailscale's IPv4 range. Tailnet devices are off every local
+// network, but they are anything but this machine.
+var tailnet = &net.IPNet{IP: net.IPv4(100, 64, 0, 0).To4(), Mask: net.CIDRMask(10, 32)}
+
+type client struct {
+	next     http.Handler
+	gateway  net.IP
+	networks []*net.IPNet
+}
+
+func New(_ context.Context, next http.Handler, config *Config, _ string) (http.Handler, error) {
+	if config == nil || config.RoutesPath == "" {
+		return nil, errors.New("localghost client: routesPath is required")
+	}
+	gateway, networks, err := readRoutes(config.RoutesPath)
+	if err != nil {
+		// Without its own networks to compare against, every source would
+		// look like this machine. Pass requests through untouched instead;
+		// applications then see Docker's address, as they would without us.
+		fmt.Fprintf(os.Stdout, "localghost client: leaving client addresses alone: %v\n", err)
+		return next, nil
+	}
+	return &client{next: next, gateway: gateway, networks: networks}, nil
+}
+
+func (c *client) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
+	host, port, err := net.SplitHostPort(req.RemoteAddr)
+	if err == nil && c.isThisMachine(net.ParseIP(host)) {
+		req.RemoteAddr = net.JoinHostPort("127.0.0.1", port)
+		// Traefik has already recorded the connection's address here. A value
+		// it kept from a trusted sender is that sender's claim; leave it be.
+		if req.Header.Get("X-Real-Ip") == host {
+			req.Header.Set("X-Real-Ip", "127.0.0.1")
+		}
+	}
+	c.next.ServeHTTP(rw, req)
+}
+
+func (c *client) isThisMachine(ip net.IP) bool {
+	// IPv6 is left alone: this table only lists IPv4 networks, so an IPv6
+	// container address would otherwise be mistaken for the host.
+	ip = ip.To4()
+	if ip == nil || ip.IsLoopback() {
+		return false
+	}
+	if ip.Equal(c.gateway) {
+		return true
+	}
+	if tailnet.Contains(ip) {
+		return false
+	}
+	for _, network := range c.networks {
+		if network.Contains(ip) {
+			return false
+		}
+	}
+	return true
+}
+
+// readRoutes returns the default gateway and the directly connected networks
+// from a /proc/net/route table.
+func readRoutes(path string) (net.IP, []*net.IPNet, error) {
+	file, err := os.Open(path)
+	if err != nil {
+		return nil, nil, err
+	}
+	defer file.Close()
+	var gateway net.IP
+	var networks []*net.IPNet
+	scanner := bufio.NewScanner(file)
+	scanner.Scan() // header row
+	for scanner.Scan() {
+		fields := strings.Fields(scanner.Text())
+		if len(fields) < 8 {
+			continue
+		}
+		destination, errDestination := parseHexIPv4(fields[1])
+		via, errVia := parseHexIPv4(fields[2])
+		mask, errMask := parseHexIPv4(fields[7])
+		if errDestination != nil || errVia != nil || errMask != nil {
+			continue
+		}
+		switch {
+		case destination.Equal(net.IPv4zero) && !via.Equal(net.IPv4zero):
+			gateway = via
+		case via.Equal(net.IPv4zero):
+			networks = append(networks, &net.IPNet{IP: destination, Mask: net.IPMask(mask)})
+		}
+	}
+	if err := scanner.Err(); err != nil {
+		return nil, nil, err
+	}
+	if gateway == nil || len(networks) == 0 {
+		return nil, nil, fmt.Errorf("no default gateway and connected network in %s", path)
+	}
+	return gateway, networks, nil
+}
+
+// parseHexIPv4 decodes a /proc/net/route address, which is little-endian hex.
+func parseHexIPv4(field string) (net.IP, error) {
+	raw, err := hex.DecodeString(field)
+	if err != nil {
+		return nil, err
+	}
+	if len(raw) != 4 {
+		return nil, fmt.Errorf("not an IPv4 route field: %q", field)
+	}
+	return net.IPv4(raw[3], raw[2], raw[1], raw[0]).To4(), nil
+}

localghost-3.2.1/src/localghost/traefik_plugin/src/github.com/SmileyChris/traefik-localghost-client/client_test.go

@@ -0,0 +1,118 @@
+package traefik_localghost_client
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// A Traefik container on one network, 172.19.0.0/16, whose host is 172.19.0.1.
+const routes = "Iface\tDestination\tGateway \tFlags\tRefCnt\tUse\tMetric\tMask\t\tMTU\tWindow\tIRTT\n" +
+	"eth0\t00000000\t010013AC\t0003\t0\t0\t0\t00000000\t0\t0\t0\n" +
+	"eth0\t000013AC\t00000000\t0001\t0\t0\t0\t0000FFFF\t0\t0\t0\n"
+
+func writeRoutes(t *testing.T, content string) string {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "route")
+	if err := os.WriteFile(path, []byte(content), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	return path
+}
+
+// serve runs one request through the middleware and returns what the next
+// handler saw as the client address and X-Real-Ip.
+func serve(t *testing.T, routesPath, remote, realIP string) (string, string) {
+	t.Helper()
+	var seenRemote, seenRealIP string
+	next := http.HandlerFunc(func(_ http.ResponseWriter, req *http.Request) {
+		seenRemote, seenRealIP = req.RemoteAddr, req.Header.Get("X-Real-Ip")
+	})
+	handler, err := New(context.Background(), next, &Config{RoutesPath: routesPath}, "localghost-client")
+	if err != nil {
+		t.Fatal(err)
+	}
+	req := httptest.NewRequest("GET", "http://demo.localhost/", nil)
+	req.RemoteAddr = remote
+	if realIP != "" {
+		req.Header.Set("X-Real-Ip", realIP)
+	}
+	handler.ServeHTTP(httptest.NewRecorder(), req)
+	return seenRemote, seenRealIP
+}
+
+func TestRequestsFromThisMachineAreNamedLoopback(t *testing.T) {
+	path := writeRoutes(t, routes)
+	cases := []struct {
+		name, remote string
+	}{
+		{"native daemon's bridge gateway", "172.19.0.1:40226"},
+		{"Docker Desktop's VM gateway", "192.168.65.1:40226"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			host := tc.remote[:len(tc.remote)-len(":40226")]
+			remote, realIP := serve(t, path, tc.remote, host)
+			if remote != "127.0.0.1:40226" || realIP != "127.0.0.1" {
+				t.Fatalf("got %s / %s, want 127.0.0.1:40226 / 127.0.0.1", remote, realIP)
+			}
+		})
+	}
+}
+
+func TestOtherClientsKeepTheirAddress(t *testing.T) {
+	path := writeRoutes(t, routes)
+	cases := []struct {
+		name, remote, realIP string
+	}{
+		{"a container on Traefik's network, such as the tailnet gateway", "172.19.0.3:5000", "172.19.0.3"},
+		{"a tailnet device named by a PROXY header", "100.101.102.103:5000", "100.101.102.103"},
+		{"an IPv6 peer", "[fd7a:115c:a1e0::1]:5000", "fd7a:115c:a1e0::1"},
+		{"loopback itself", "127.0.0.1:5000", "127.0.0.1"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			remote, realIP := serve(t, path, tc.remote, tc.realIP)
+			if remote != tc.remote || realIP != tc.realIP {
+				t.Fatalf("got %s / %s, want %s / %s untouched", remote, realIP, tc.remote, tc.realIP)
+			}
+		})
+	}
+}
+
+func TestATrustedSendersRealIPIsNotOverwritten(t *testing.T) {
+	remote, realIP := serve(t, writeRoutes(t, routes), "172.19.0.1:40226", "10.9.9.9")
+	if remote != "127.0.0.1:40226" || realIP != "10.9.9.9" {
+		t.Fatalf("got %s / %s, want the connection renamed and the claim kept", remote, realIP)
+	}
+}
+
+func TestUnreadableRoutesLeaveEveryAddressAlone(t *testing.T) {
+	for name, path := range map[string]string{
+		"missing table":    filepath.Join(t.TempDir(), "absent"),
+		"no default route": writeRoutes(t, "Iface\tDestination\tGateway\n"),
+	} {
+		t.Run(name, func(t *testing.T) {
+			remote, realIP := serve(t, path, "172.19.0.1:40226", "172.19.0.1")
+			if remote != "172.19.0.1:40226" || realIP != "172.19.0.1" {
+				t.Fatalf("got %s / %s, want the request passed through", remote, realIP)
+			}
+		})
+	}
+}
+
+func TestReadRoutesFindsTheHostAndTheLocalNetwork(t *testing.T) {
+	gateway, networks, err := readRoutes(writeRoutes(t, routes))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if gateway.String() != "172.19.0.1" {
+		t.Fatalf("gateway = %s, want 172.19.0.1", gateway)
+	}
+	if len(networks) != 1 || networks[0].String() != "172.19.0.0/16" {
+		t.Fatalf("networks = %v, want [172.19.0.0/16]", networks)
+	}
+}

localghost-3.2.1/src/localghost/traefik_plugin/src/github.com/SmileyChris/traefik-localghost-client/go.mod

@@ -0,0 +1,3 @@
+module github.com/SmileyChris/traefik-localghost-client
+
+go 1.22