Repository navigation
fix(ip): handle scoped IPv6 proxy addresses in XFF - #3195
Open
jipeng6036-del wants to merge 4 commits into
Open
jipeng6036-del wants to merge 4 commits into
jipeng6036-del wants to merge 4 commits into
Conversation
(cherry picked from commit 9e2add6)
(cherry picked from commit f65d3af)
Use netip.ParseAddr so an IPv4 address with a "%" suffix (e.g. 127.0.0.2%garbage) is still rejected. Return the direct IP unchanged when the peer itself is untrusted, so RealIP() is the same with or without an X-Forwarded-For header. (cherry picked from commit db18e4b)
Preserve strict IPv6 parsing and slice the validated address before its zone. Add public RealIP and Scheme coverage through actual TCP HTTP requests, including explicit trust ranges and malformed forwarding inputs.
agammann
approved these changes
Nov 1, 2026
agammann
left a comment
agammann
left a comment
There was a problem hiding this comment.
I followed the trust decision through the new helper and XFF loop. A valid scoped IPv6 address is parsed before its zone is removed for CIDR checks; malformed scopes and IPv4 zone-like suffixes still fail parsing, and an untrusted direct peer keeps its original zone-bearing address. The HTTP regression cases and all three package test suites pass on this head (go test ./... -count=1). The HTTP fixture substitutes RemoteAddr, so this does not establish live link-local routing behavior.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Trusted IPv6 proxies can supply an address with a zone, such as
fe80::1%eth0.ExtractIPFromXFFHeadercurrently rejects that address and returns the proxy instead of continuing through the forwarded chain. Parse the scoped address strictly before dropping its zone, preserve untrusted peers unchanged, and share that validation with scheme extraction.Based on #3180, retaining Bharat Kaurav's three commits and their source attribution. This version adds eight TCP HTTP regressions through
Context.RealIP/Context.Scheme, including explicit trust ranges, repeated XFF fields and malformed inputs. It also avoids an extra formatting allocation after validation.Fixes #3179.
Validation:
replace: eight scenarios passed on Windows and Linux (-race); current master fails three and passes five controls under the same conditions.RemoteAddrfixture. They exercise real TCP requests through Echo, without claiming OS link-local routing. Local Windows IPv6 permission failures and benchmark limitations are documented in the evidence.Reproduction, exact source/artifact hashes and validation logs
Prepared and validated with Codex.