naibaandcloudcode 18c044d959 fix(security): set real IP from peer in ConfigUsePeerIP gRPC mode ...

In ConfigUsePeerIP mode ctxWithRealIP validated connectingIp but never
assigned it to ip, so CtxKeyRealIP was left empty. model.CheckIP and
model.BlockIP short-circuit on an empty IP, which silently disabled the
gRPC WAF block table and brute-force token counters for every peer-IP
deployment — including the stream interceptors this path now backs.

Assign ip = connectingIp so the WAF and BlockIP observe the source. The
empty-header path is unchanged (it intentionally opts out of IP WAF).

Add rpc_test.go covering peer-IP IPv4/IPv6, the no-peer error, and the
no-header opt-out so the behaviours cannot be re-coupled.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

2026-05-31 07:45:23 +00:00

..

rpc_test.go

fix(security): set real IP from peer in ConfigUsePeerIP gRPC mode

2026-05-31 07:45:23 +00:00

rpc.go

fix(security): set real IP from peer in ConfigUsePeerIP gRPC mode

2026-05-31 07:45:23 +00:00