Use trusted_proxies and client_ip_headers to parse trusted client…

… IP headers.
Jigsaw-Code · Feb 8, 2025 · 9582c31 · 9582c31
1 parent 215f54a
commit 9582c31
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 9 deletions.
diff --git a/outlinecaddy/examples/websocket.yml b/outlinecaddy/examples/websocket.yml
@@ -61,6 +61,12 @@ apps:
           - handler: ws2outline
             type: packet
             connection_handler: ss1
+        trusted_proxies:
+          source: static
+          ranges:
+            - 127.0.0.1
+        client_ip_headers:
+          - "X-Forwarded-For"
   layer4:
     servers:
       '1':

diff --git a/outlinecaddy/ws2outline_handler.go b/outlinecaddy/ws2outline_handler.go
@@ -126,15 +126,17 @@ func (h WebSocketHandler) ServeHTTP(w http.ResponseWriter, r *http.Request, _ ca
 		h.logger.Error("failed to upgrade", "err", err)
 	}
 	defer conn.Close()
-	clientAddrPort, clientIpErr := onet.ParseAddrPortOrIP(r.RemoteAddr)
-	switch h.Type {
-	case StreamConnectionType:
-		if clientIpErr == nil {
-			conn = &replaceAddrConn{StreamConn: conn, raddr: net.TCPAddrFromAddrPort(clientAddrPort)}
-		}
-	case PacketConnectionType:
-		if clientIpErr == nil {
-			conn = &replaceAddrConn{StreamConn: conn, raddr: net.UDPAddrFromAddrPort(clientAddrPort)}
+	if clientIp, ok := caddyhttp.GetVar(r.Context(), caddyhttp.ClientIPVarKey).(string); ok {
+		clientAddrPort, clientIpErr := onet.ParseAddrPortOrIP(clientIp)
+		switch h.Type {
+		case StreamConnectionType:
+			if clientIpErr == nil {
+				conn = &replaceAddrConn{StreamConn: conn, raddr: net.TCPAddrFromAddrPort(clientAddrPort)}
+			}
+		case PacketConnectionType:
+			if clientIpErr == nil {
+				conn = &replaceAddrConn{StreamConn: conn, raddr: net.UDPAddrFromAddrPort(clientAddrPort)}
+			}
 		}
 	}
 	cx := layer4.WrapConnection(conn, []byte{}, h.zlogger)