Buriburizaemon/nezha_domains
1
0
Fork 0
mirror of https://github.com/Buriburizaem0n/nezha_domains.git synced 2026-09-19 09:40:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): set real IP from peer in ConfigUsePeerIP gRPC mode

Browse Source 
In ConfigUsePeerIP mode ctxWithRealIP validated connectingIp but never
assigned it to ip, so CtxKeyRealIP was left empty. model.CheckIP and
model.BlockIP short-circuit on an empty IP, which silently disabled the
gRPC WAF block table and brute-force token counters for every peer-IP
deployment — including the stream interceptors this path now backs.

Assign ip = connectingIp so the WAF and BlockIP observe the source. The
empty-header path is unchanged (it intentionally opts out of IP WAF).

Add rpc_test.go covering peer-IP IPv4/IPv6, the no-peer error, and the
no-header opt-out so the behaviours cannot be re-coupled.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>
This commit is contained in:
naiba
2026-05-31 07:45:23 +00:00
co-authored by cloudcode
parent b1d84c6b2f
commit 18c044d959
2 changed files with 109 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/dashboard/rpc/rpc.go
+3
View File
@@ -66,6 +66,9 @@ func ctxWithRealIP(ctx context.Context) (context.Context, error) {
if connectingIp == "" {
return ctx, fmt.Errorf("connecting ip not found")
}
// Peer-IP mode: peer IP is the real IP. Leaving ip="" makes
// CheckIP/BlockIP short-circuit on empty IP, disabling the WAF.
ip = connectingIp
} else {
vals := metadata.ValueFromIncomingContext(ctx, singleton.Conf.AgentRealIPHeader)
if len(vals) == 0 {