ClientIP: check every proxy for trustiness #2844

agmt · 2021-08-24T11:39:08Z

Fix for #2473

Despite it is marked as fixed by #2632 , it is not.
X-Forwarded-For is a chain of previous remote addresses, appended by each proxy. It means that this list should be parsed in reverse order and parsing should be stopped once untrusted IP found. If we find an untrusted IP in the middle of X-Forwarded-For list, then all IPs to the left may be a fake and the rightmost untrusted IP is a real client IP.

agmt · 2021-08-24T11:46:47Z

@sorenisanerd May you please help, does this PR fix the issue you raised?

sorenisanerd · 2021-09-08T07:15:04Z

Honestly, I don't know. I provided a fix. They ignored it for 6 months, then messed it up so that it didn't pass the tests. To address that, they changed the tests. Then I wrote them a library they could use. They ignored that, too. I have no reason to believe that they'll act any differently now. I will not be using Gin. If this is their attitude towards security problems, there's no way I'm exposing it to a network.

Bisstocuz

Check out my comments below plz.

jim3ma · 2021-09-24T06:36:58Z

@appleboy Can you review this PR and try to merge it ?

agmt · 2021-09-27T17:25:04Z

context.go

@@ -779,35 +790,25 @@ func (c *Context) RemoteIP() (net.IP, bool) {
 		return nil, false
 	}

-	if c.engine.trustedCIDRs != nil {


@Bisstocuz such check is already in isTrustedProxy(): context.go:769 . Are you suggesting to copy this check to have in both places?

appleboy · 2021-09-28T00:55:44Z

need @sorenisanerd to help or confirm the PR.

Bisstocuz

As usual in this project, I think putting (e *Engine) front is more reasonable.

And, #2887 was merged.
Please merge from upstream and handle conflicts.

Bisstocuz · 2021-10-07T04:23:24Z

context.go

@@ -765,6 +765,17 @@ func (c *Context) ClientIP() string {
 	return remoteIP.String()
 }

+func isTrustedProxy(ip net.IP, e *Engine) bool {


func (e *Engine) isTrustedProxy(ip net.IP) bool { }

Bisstocuz · 2021-10-07T04:23:28Z

context.go

 }

-func validateHeader(header string) (clientIP string, valid bool) {
+func validateHeader(header string, e *Engine) (clientIP string, valid bool) {


func (e *Engine) validateHeader(header string) (clientIP string, valid bool) { }

Fix for: 55ad88a

agmt · 2021-10-07T15:21:09Z

@Bisstocuz rebased on master, put (e *Engine) into front.

Bisstocuz · 2021-10-08T05:24:23Z

@appleboy @thinkerou Hi, could you please run the tests?

codecov · 2021-10-09T00:08:39Z

Codecov Report

Merging #2844 (0d63d79) into master (21125bb) will increase coverage by 98.72%.
The diff coverage is 100.00%.

@@             Coverage Diff             @@
##           master    #2844       +/-   ##
===========================================
+ Coverage        0   98.72%   +98.72%     
===========================================
  Files           0       41       +41     
  Lines           0     3066     +3066     
===========================================
+ Hits            0     3027     +3027     
- Misses          0       27       +27     
- Partials        0       12       +12

Flag	Coverage Δ
go-1.13	`98.72% <100.00%> (?)`
go-1.14	`98.56% <100.00%> (?)`
go-1.15	`98.56% <100.00%> (?)`
go-1.16	`98.56% <100.00%> (?)`
go-1.17	`98.46% <100.00%> (?)`
macos-latest	`98.72% <100.00%> (?)`
nomsgpack	`98.70% <100.00%> (?)`
ubuntu-latest	`98.72% <100.00%> (?)`

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
context.go	`97.82% <100.00%> (ø)`
utils.go	`96.80% <0.00%> (ø)`
binding/query.go	`100.00% <0.00%> (ø)`
render/yaml.go	`100.00% <0.00%> (ø)`
binding/default_validator.go	`100.00% <0.00%> (ø)`
logger.go	`100.00% <0.00%> (ø)`
render/json.go	`83.14% <0.00%> (ø)`
binding/binding_nomsgpack.go	`100.00% <0.00%> (ø)`
path.go	`100.00% <0.00%> (ø)`
render/protobuf.go	`100.00% <0.00%> (ø)`
... and 32 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 21125bb...0d63d79. Read the comment docs.

appleboy · 2021-10-09T00:17:54Z

@thinkerou need your review.

thinkerou

lgtm

mrgadgil · 2021-11-16T01:38:28Z

@appleboy @thinkerou I am using the latest release v1.7.4, our Image vulnerability scanner complains about CVE-2020-28483`` Is the CVE-2020-28483` fixed? From the pull request it looks like the CVE-2020-28483 is fixed. Want to know if it is just a matter of creating a new release?

(cherry picked from commit 5929d52)

agmt changed the title ~~ClientIP: check every proxy for trustness~~ ClientIP: check every proxy for trustiness Aug 24, 2021

rwos mentioned this pull request Sep 7, 2021

X-Forwarded-For handling is still unsafe, CVE-2020-28483 is NOT fixed #2862

Closed

Bisstocuz approved these changes Sep 22, 2021

View reviewed changes

agmt commented Sep 27, 2021

View reviewed changes

appleboy added the bug label Sep 28, 2021

appleboy added this to the v1.7.5 milestone Sep 28, 2021

Bisstocuz approved these changes Sep 28, 2021

View reviewed changes

Bisstocuz mentioned this pull request Sep 29, 2021

Tidy: Complete TrustedProxies feature #2887

Merged

Bisstocuz suggested changes Oct 7, 2021

View reviewed changes

agmt force-pushed the fix/fix-client-ip-cve branch from 0112747 to dd71c72 Compare October 7, 2021 15:05

ClientIP: check every proxy for trustness

0d63d79

Fix for: 55ad88a

agmt force-pushed the fix/fix-client-ip-cve branch from dd71c72 to 0d63d79 Compare October 7, 2021 15:17

Bisstocuz approved these changes Oct 8, 2021

View reviewed changes

appleboy approved these changes Oct 9, 2021

View reviewed changes

appleboy requested a review from thinkerou October 9, 2021 00:18

thinkerou approved these changes Oct 9, 2021

View reviewed changes

appleboy merged commit 5929d52 into gin-gonic:master Oct 9, 2021

Bisstocuz mentioned this pull request Nov 19, 2021

update version to v1.7.5 #2943

Closed

thinkerou pushed a commit that referenced this pull request Nov 20, 2021

ClientIP: check every proxy for trustiness (#2844)

7890538

Bisstocuz pushed a commit to Bisstocuz/gin that referenced this pull request Nov 22, 2021

ClientIP: check every proxy for trustiness (gin-gonic#2844)

35c002c

(cherry picked from commit 5929d52)

Bisstocuz pushed a commit to Bisstocuz/gin that referenced this pull request Nov 22, 2021

ClientIP: check every proxy for trustiness (gin-gonic#2844)

87e91ab

(cherry picked from commit 5929d52)

Bisstocuz pushed a commit to Bisstocuz/gin that referenced this pull request Nov 22, 2021

ClientIP: check every proxy for trustiness (gin-gonic#2844)

170c6b6

(cherry picked from commit 5929d52)

Bisstocuz pushed a commit to Bisstocuz/gin that referenced this pull request Nov 22, 2021

ClientIP: check every proxy for trustiness (gin-gonic#2844)

2320b87

(cherry picked from commit 5929d52)

thinkerou pushed a commit that referenced this pull request Nov 23, 2021

ClientIP: check every proxy for trustiness (#2844)

d2d0bfa

Bisstocuz pushed a commit to Bisstocuz/gin that referenced this pull request Nov 23, 2021

ClientIP: check every proxy for trustiness (gin-gonic#2844)

d72c9a9

(cherry picked from commit 5929d52)

thinkerou pushed a commit that referenced this pull request Nov 24, 2021

ClientIP: check every proxy for trustiness (#2844)

b4549a5

thinkerou pushed a commit that referenced this pull request Nov 24, 2021

ClientIP: check every proxy for trustiness (#2844)

3b555a5

daheige pushed a commit to daheige/gin that referenced this pull request Apr 18, 2022

ClientIP: check every proxy for trustiness (gin-gonic#2844)

fa93faa

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ClientIP: check every proxy for trustiness #2844

ClientIP: check every proxy for trustiness #2844

agmt commented Aug 24, 2021 •

edited

Loading

agmt commented Aug 24, 2021 •

edited

Loading

sorenisanerd commented Sep 8, 2021

Bisstocuz left a comment •

edited

Loading

jim3ma commented Sep 24, 2021

agmt Sep 27, 2021

appleboy commented Sep 28, 2021

Bisstocuz left a comment

Bisstocuz Oct 7, 2021

Bisstocuz Oct 7, 2021

agmt commented Oct 7, 2021

Bisstocuz commented Oct 8, 2021

codecov bot commented Oct 9, 2021 •

edited

Loading

appleboy commented Oct 9, 2021

thinkerou left a comment

mrgadgil commented Nov 16, 2021

ClientIP: check every proxy for trustiness #2844

ClientIP: check every proxy for trustiness #2844

Conversation

agmt commented Aug 24, 2021 • edited Loading

agmt commented Aug 24, 2021 • edited Loading

sorenisanerd commented Sep 8, 2021

Bisstocuz left a comment • edited Loading

Choose a reason for hiding this comment

jim3ma commented Sep 24, 2021

agmt Sep 27, 2021

Choose a reason for hiding this comment

appleboy commented Sep 28, 2021

Bisstocuz left a comment

Choose a reason for hiding this comment

Bisstocuz Oct 7, 2021

Choose a reason for hiding this comment

Bisstocuz Oct 7, 2021

Choose a reason for hiding this comment

agmt commented Oct 7, 2021

Bisstocuz commented Oct 8, 2021

codecov bot commented Oct 9, 2021 • edited Loading

Codecov Report

appleboy commented Oct 9, 2021

thinkerou left a comment

Choose a reason for hiding this comment

mrgadgil commented Nov 16, 2021

agmt commented Aug 24, 2021 •

edited

Loading

agmt commented Aug 24, 2021 •

edited

Loading

Bisstocuz left a comment •

edited

Loading

codecov bot commented Oct 9, 2021 •

edited

Loading