set engine.TrustedProxies For items that don't use gin.RUN #2692

yiranzai · 2021-04-15T06:19:02Z

#2632

#2675

#2675 causes the engine.prepareTrustedCIDRS to never execute if gin is not started via gin.RUN().

this pr set engine.TrustedProxies and execute engine.prepareTrustedCIDRS For items that don't use gin.RUN

Our project uses http.Handler to start the service instead of gin.Run

yiranzai · 2021-04-15T06:30:01Z

The failed is not my reason https://travis-ci.org/github/gin-gonic/gin/jobs/767120791

codecov · 2021-04-21T00:59:02Z

Codecov Report

Merging #2692 (60dfff7) into master (328d0b8) will increase coverage by 0.01%.
The diff coverage is 100.00%.

@@            Coverage Diff             @@
##           master    #2692      +/-   ##
==========================================
+ Coverage   98.68%   98.69%   +0.01%     
==========================================
  Files          41       41              
  Lines        2054     2070      +16     
==========================================
+ Hits         2027     2043      +16     
  Misses         15       15              
  Partials       12       12

Impacted Files	Coverage Δ
gin.go	`99.18% <100.00%> (+0.05%)`	⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 328d0b8...60dfff7. Read the comment docs.

thinkerou · 2021-04-21T01:52:44Z

gin.go

@@ -366,6 +366,23 @@ func (engine *Engine) prepareTrustedCIDRs() ([]*net.IPNet, error) {
 	return cidr, nil
 }

+// SetTrustedProxies  set Engine.TrustedProxies
+func (engine *Engine) SetTrustedProxies(trustedProxies []string) error {


please add some unit test, thanks!

yiranzai · 2021-04-21T02:18:07Z

context_test.go

 	assert.Equal(t, "20.20.20.20", c.ClientIP())

 	// Use hostname that resolves to all the proxies
-	c.engine.TrustedProxies = []string{"foo"}
-	resetTrustedCIDRs(c)
+	_ = c.engine.SetTrustedProxies([]string{"foo"})
 	assert.Equal(t, "40.40.40.40", c.ClientIP())


I passed the previous unit tests, but I don't understand why the foo bar bar would expect such a result

estroz · 2021-04-24T21:22:19Z

gin.go

@@ -326,11 +326,11 @@ func iterate(path, method string, routes RoutesInfo, root *node) RoutesInfo {
 func (engine *Engine) Run(addr ...string) (err error) {
 	defer func() { debugPrintError(err) }()

-	trustedCIDRs, err := engine.prepareTrustedCIDRs()
+	err = engine.parseTrustedProxies()


Why not add this to all Run* methods too?

Because the other RUN* didn't exist before.

My core idea was to be able to dynamically adjust the TurstedProxies.

Fix bugs caused by #2675

The bugs:

#2693

#2697

xpunch · 2021-04-30T08:34:34Z

TrustedProxies is set with []string{"0.0.0.0/0"} by default, you'd better give trustedCIDRs a default value. So we don't need to call SetTrustedProxies when we don't need to change it.

yiranzai · 2021-04-30T08:51:35Z

TrustedProxies is set with []string{"0.0.0.0/0"} by default, you'd better give trustedCIDRs a default value. So we don't need to call SetTrustedProxies when we don't need to change it.

@xpunch

I haven't changed any of the previous logic, this is a PR that avoids #2675 bug in a new way. As for what you said, gin.Run did that

xpunch · 2021-04-30T09:38:23Z

Your code is used to set custom TrustedProxies when don't use gin.Run.
I think the simplest way is set default value for trustedCIDRs.

func New() *Engine {
	...
        engine.trustedCIDRs = []*net.IPNet{{IP: net.IP{0x0, 0x0, 0x0, 0x0}, Mask: net.IPMask{0x0, 0x0, 0x0, 0x0}}}
        ...
}

Default value of trustedCIDRs is missing when gin.New() called, TrustedProxies is set to []string{"0.0.0.0/0"}, which means trustedCIDRs should also set a default value matchs TrustedProxies.

evanfuller · 2021-05-05T17:47:40Z

@yiranzai what is the status on this change? I would love to use it.

yiranzai · 2021-05-07T12:01:33Z

@evanfuller I don't know.

@thinkerou @estroz reviewer?

What else do I need to do?

atcharles · 2021-05-09T15:38:01Z

The easiest way:
Copy the following to add to the reverse proxy:
proxy_set_header X-Appengine-Remote-Addr $remote_addr;

FeodorFitsner · 2021-05-22T17:30:31Z

When this fix is planned for release?

gin-gonic/gin#2692

* Support Google App Engine * Output all request headers * PGLET_TRUSTED_PROXIES * Display remoteIP and trusted proxies * Temporary fix for content.ClientIP() gin-gonic/gin#2692 * Principal.IP fixed * Do not delete page if no clients connected * Support batched get

thinkerou

lgtm, thanks!

leafduo · 2021-07-16T11:13:55Z

This fix has 2 problems:

it's not backward-compatible
is doesn't update related documents

almas1992 · 2021-08-03T03:52:55Z

Is there any plan to release this change?

rbeuque74 · 2021-09-29T17:17:51Z

Hello,

Is there any plan to release this change?

I couldn't agree more. Our software have been bumped to v1.7 because we follow security advisories, and you published GHSA-h395-qcrw-5vmq. But at this time, without the release of SetTrustedProxies, we can't use the new version in production.
Would you mind to release v1.7.5 to fix that ?

Thanks,
Romain

Co-authored-by: Bo-Yi Wu <[email protected]>

…#2692) Co-authored-by: Bo-Yi Wu <[email protected]> (cherry picked from commit b5ca989)

Co-authored-by: Bo-Yi Wu <[email protected]>

…#2692) Co-authored-by: Bo-Yi Wu <[email protected]> (cherry picked from commit b5ca989)

Co-authored-by: Bo-Yi Wu <[email protected]>

gin 1.7.0 added a feature to accept/refuse proxy headers depending on the remote IP of the TCP connection. A fix of a data race in gin 1.7.1 made that feature inaccessible unless gin is started through gin.Run(), which we don't do in the fabric. A PR to fix this has not been approved for over a month (gin-gonic/gin#2692). Hence I implemented similar logic in our own helper, and consolidated with an existing helper (that we used in addition to the gin-specific functionality!). In addition, the client IP is cached in the gin context in order to improve performance (multiple middleware handlers use the client IP for logging, usage, geo lookups, redirect, etc.)

set engine.TrustedProxies For items that don't use gin.RUN

08dd235

yiranzai mentioned this pull request Apr 16, 2021

Use built-in graceful mode, can not read client ip from "X-Forwarded-For" header #2693

Open

Merge branch 'master' into set_trusted_proxy

16691a3

thinkerou reviewed Apr 21, 2021

View reviewed changes

context_test TestContextClientIP

936c45d

yiranzai commented Apr 21, 2021

View reviewed changes

estroz reviewed Apr 24, 2021

View reviewed changes

yiranzai mentioned this pull request Apr 30, 2021

c.ClientIP() #2697

Closed

add engine.parseTrustedProxies to all Run* methods

824f8dd

yiranzai added 2 commits May 7, 2021 20:23

unit test

3496c8a

code style fixed

126f8aa

yiranzai requested a review from thinkerou May 7, 2021 12:45

FeodorFitsner added a commit to pglet/pglet that referenced this pull request May 22, 2021

Temporary fix for content.ClientIP()

2d61631

gin-gonic/gin#2692

thinkerou requested review from manucorporat, appleboy, austinheap, javierprovecho and a team and removed request for a team May 23, 2021 02:00

thinkerou added the enhancement label May 23, 2021

thinkerou added this to the v1.8 milestone May 23, 2021

thinkerou approved these changes May 23, 2021

View reviewed changes

appleboy added 2 commits May 24, 2021 08:31

Merge branch 'master' into set_trusted_proxy

84244fe

Merge branch 'master' into set_trusted_proxy

60dfff7

appleboy approved these changes May 25, 2021

View reviewed changes

appleboy merged commit b5ca989 into gin-gonic:master May 25, 2021

yiranzai deleted the set_trusted_proxy branch May 25, 2021 08:55

zihengCat mentioned this pull request Jul 16, 2021

parseTrustedProxies not executed #2791

Closed

zihengCat mentioned this pull request Aug 13, 2021

Make TrustedProxies feature backward-compatible #2819

Closed

Bisstocuz mentioned this pull request Sep 22, 2021

Quick Fix c.ClientIP() Parse Error for TrustedProxies feature & NoMethod annotation #2832

Merged

Bisstocuz mentioned this pull request Sep 29, 2021

Tidy: Complete TrustedProxies feature #2887

Merged

thinkerou modified the milestones: v1.8, v1.7.5 Nov 21, 2021

thinkerou pushed a commit that referenced this pull request Nov 21, 2021

set engine.TrustedProxies For items that don't use gin.RUN (#2692)

bf218f9

Co-authored-by: Bo-Yi Wu <[email protected]>

Bisstocuz pushed a commit to Bisstocuz/gin that referenced this pull request Nov 22, 2021

set engine.TrustedProxies For items that don't use gin.RUN (gin-gonic…

c20834c

…#2692) Co-authored-by: Bo-Yi Wu <[email protected]> (cherry picked from commit b5ca989)

Bisstocuz pushed a commit to Bisstocuz/gin that referenced this pull request Nov 22, 2021

set engine.TrustedProxies For items that don't use gin.RUN (gin-gonic…

8be4cea

…#2692) Co-authored-by: Bo-Yi Wu <[email protected]> (cherry picked from commit b5ca989)

Bisstocuz pushed a commit to Bisstocuz/gin that referenced this pull request Nov 22, 2021

set engine.TrustedProxies For items that don't use gin.RUN (gin-gonic…

9de835e

…#2692) Co-authored-by: Bo-Yi Wu <[email protected]> (cherry picked from commit b5ca989)

Bisstocuz pushed a commit to Bisstocuz/gin that referenced this pull request Nov 22, 2021

set engine.TrustedProxies For items that don't use gin.RUN (gin-gonic…

0884ff9

…#2692) Co-authored-by: Bo-Yi Wu <[email protected]> (cherry picked from commit b5ca989)

thinkerou pushed a commit that referenced this pull request Nov 23, 2021

set engine.TrustedProxies For items that don't use gin.RUN (#2692)

7a2da70

Co-authored-by: Bo-Yi Wu <[email protected]>

Bisstocuz pushed a commit to Bisstocuz/gin that referenced this pull request Nov 23, 2021

set engine.TrustedProxies For items that don't use gin.RUN (gin-gonic…

ebd0a3c

…#2692) Co-authored-by: Bo-Yi Wu <[email protected]> (cherry picked from commit b5ca989)

thinkerou pushed a commit that referenced this pull request Nov 24, 2021

set engine.TrustedProxies For items that don't use gin.RUN (#2692)

0f44814

Co-authored-by: Bo-Yi Wu <[email protected]>

thinkerou pushed a commit that referenced this pull request Nov 24, 2021

set engine.TrustedProxies For items that don't use gin.RUN (#2692)

02c250f

Co-authored-by: Bo-Yi Wu <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

set engine.TrustedProxies For items that don't use gin.RUN #2692

set engine.TrustedProxies For items that don't use gin.RUN #2692

yiranzai commented Apr 15, 2021 •

edited

Loading

yiranzai commented Apr 15, 2021

codecov bot commented Apr 21, 2021 •

edited

Loading

thinkerou Apr 21, 2021

yiranzai Apr 21, 2021

yiranzai Apr 21, 2021

estroz Apr 24, 2021

yiranzai Apr 25, 2021

yiranzai Apr 25, 2021

xpunch commented Apr 30, 2021

yiranzai commented Apr 30, 2021 •

edited

Loading

xpunch commented Apr 30, 2021

evanfuller commented May 5, 2021

yiranzai commented May 7, 2021

atcharles commented May 9, 2021

FeodorFitsner commented May 22, 2021

thinkerou left a comment

leafduo commented Jul 16, 2021

almas1992 commented Aug 3, 2021

rbeuque74 commented Sep 29, 2021

set engine.TrustedProxies For items that don't use gin.RUN #2692

set engine.TrustedProxies For items that don't use gin.RUN #2692

Conversation

yiranzai commented Apr 15, 2021 • edited Loading

yiranzai commented Apr 15, 2021

codecov bot commented Apr 21, 2021 • edited Loading

Codecov Report

thinkerou Apr 21, 2021

Choose a reason for hiding this comment

yiranzai Apr 21, 2021

Choose a reason for hiding this comment

yiranzai Apr 21, 2021

Choose a reason for hiding this comment

estroz Apr 24, 2021

Choose a reason for hiding this comment

yiranzai Apr 25, 2021

Choose a reason for hiding this comment

yiranzai Apr 25, 2021

Choose a reason for hiding this comment

xpunch commented Apr 30, 2021

yiranzai commented Apr 30, 2021 • edited Loading

xpunch commented Apr 30, 2021

evanfuller commented May 5, 2021

yiranzai commented May 7, 2021

atcharles commented May 9, 2021

FeodorFitsner commented May 22, 2021

thinkerou left a comment

Choose a reason for hiding this comment

leafduo commented Jul 16, 2021

almas1992 commented Aug 3, 2021

rbeuque74 commented Sep 29, 2021

yiranzai commented Apr 15, 2021 •

edited

Loading

codecov bot commented Apr 21, 2021 •

edited

Loading

yiranzai commented Apr 30, 2021 •

edited

Loading