TT-14891 - adds client ip from XFF by depth

cli/linter/schema.json

@@ -692,6 +692,9 @@
         },
         "max_response_body_size": {
           "type": "integer"
+        },
+        "xff_depth": {
+          "type": "integer"
         }
       }
     },
@@ -1333,12 +1336,9 @@
         }
       }
     },
     "secrets": {
       "type": ["array", "null"]
     },
-    "enable_http_profiler": {
-      "type": "boolean"
-    },
     "liveness_check": {
       "type": ["object", "null"],
       "additionalProperties": false,

config/config.go

@@ -571,6 +571,14 @@
 	// https://tyk.io/docs/api-management/traffic-transformation/#request-size-limits
 	MaxRequestBodySize int64 `json:"max_request_body_size"`
 
+	// XFFDepth controls which position in the X-Forwarded-For chain to use for determining client IP address.
+	// A value of 0 means using the first IP (default). this is way the Gateway has calculated the client IP historically,
+	// the most common case, and will be used when this config is not set.
+	// However, any non-zero value will use that position from the right in the X-Forwarded-For chain.
+	// This is a security feature to prevent against IP spoofing attacks, and is recommended to be set to a non-zero value.
+	// A value of 1 means using the last IP, 2 means second to last, and so on.
+	XFFDepth int `json:"xff_depth"`
+
 	// MaxResponseBodySize configures an upper limit for the size of the response body (payload) in bytes.
 	//
 	// This limit is currently applied only if the Response Body Transform middleware is enabled.

gateway/server.go

@@ -73,6 +73,7 @@ import (
 	"github.com/TykTechnologies/tyk/internal/model"
 	"github.com/TykTechnologies/tyk/internal/netutil"
 	"github.com/TykTechnologies/tyk/internal/service/newrelic"
+	"github.com/TykTechnologies/tyk/request"
 )
 
 var (
@@ -400,6 +401,10 @@ func (gw *Gateway) setupGlobals() {
 	checkup.Run(&gwConfig)
 
 	gw.SetConfig(gwConfig)
+
+	// Initialize the Global function in the request package to access the gateway config
+	request.Global = gw.GetConfig
+
 	gw.dnsCacheManager = dnscache.NewDnsCacheManager(gwConfig.DnsCache.MultipleIPsHandleStrategy)
 
 	if gwConfig.DnsCache.Enabled {

request/real_ip.go

@@ -5,9 +5,12 @@
 	"net/http"
 	"strings"
 
+	"github.com/TykTechnologies/tyk/config"
 	"github.com/TykTechnologies/tyk/header"
 )
 
+var Global func() config.Config
+
 // RealIP takes a request object, and returns the real Client IP address.
 func RealIP(r *http.Request) string {
 
@@ -22,14 +25,37 @@
 	}
 
 	if fw := r.Header.Get(header.XForwardFor); fw != "" {
-		// X-Forwarded-For has no port
-		if i := strings.IndexByte(fw, ','); i >= 0 {
-			fw = fw[:i]
+		xffs := strings.Split(fw, ",")
+
+		// Get depth from config, default to 0 (first IP in chain)
+		var depth int
+		if Global != nil {
+			depth = Global().HttpServerOptions.XFFDepth
+		}
+
+		// The following check for invalid depth configs.
+		// It's more secure to return empty if depth is invalid.
+		// Defaulting to an IP from the request would be
+		// burying a configuration failure.
+		if depth < 0 || depth > len(xffs) {
+			return ""
+		}
+
+		// Choose the appropriate IP based on depth
+		// depth=0 means first IP (leftmost), depth=1 means last IP, depth=2 means second to last, etc.
+		// Negative depth is invalid and treated same as 0/unset.
+		var ip string
+		if depth == 0 {
+			ip = strings.TrimSpace(xffs[0])
+		} else {
+			ip = strings.TrimSpace(xffs[len(xffs)-depth])
 		}
 
-		if fwIP := net.ParseIP(fw); fwIP != nil {
-			return fwIP.String()
+		// Validate that the IP is properly formatted before returning it
+		if parsedIP := net.ParseIP(ip); parsedIP != nil {
+			return parsedIP.String()
 		}
+		// If IP is invalid, fall through to use RemoteAddr
 	}
 
 	// From net/http.Request.RemoteAddr:

request/real_ip_test.go

@@ -4,6 +4,8 @@ import (
 	"context"
 	"net/http"
 	"testing"
+
+	"github.com/TykTechnologies/tyk/config"
 )
 
 var ipHeaderTests = []struct {
@@ -22,11 +24,20 @@ var ipHeaderTests = []struct {
 }
 
 func TestRealIP(t *testing.T) {
+	// Initialize the Global function with a mock config that has XFFDepth set to 0 (first IP in chain)
+	mockConfig := config.Config{}
+	mockConfig.HttpServerOptions.XFFDepth = 0
+	Global = func() config.Config {
+		return mockConfig
+	}
 
 	for _, test := range ipHeaderTests {
 		t.Log(test.comment)
 
-		r, _ := http.NewRequest(http.MethodGet, "http://abc.com:8080", nil)
+		r, err := http.NewRequest(http.MethodGet, "http://abc.com:8080", nil)
+		if err != nil {
+			t.Fatal(err)
+		}
 		r.Header.Set(test.key, test.value)
 		r.RemoteAddr = test.remoteAddr
 
@@ -38,7 +49,10 @@ func TestRealIP(t *testing.T) {
 	}
 
 	t.Log("Context")
-	r, _ := http.NewRequest(http.MethodGet, "http://abc.com:8080", nil)
+	r, err := http.NewRequest(http.MethodGet, "http://abc.com:8080", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
 
 	ctx := context.WithValue(r.Context(), "remote_addr", "10.0.0.5")
 	r = r.WithContext(ctx)
@@ -47,12 +61,52 @@ func TestRealIP(t *testing.T) {
 	if ip != "10.0.0.5" {
 		t.Errorf("\texpected %s got %s", "10.0.0.5", ip)
 	}
+
+	// Test with XFFDepth = 1 (last IP in chain)
+	t.Log("XFFDepth=1 (last IP)")
+	mockConfig.HttpServerOptions.XFFDepth = 1
+
+	r, err = http.NewRequest(http.MethodGet, "http://abc.com:8080", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	r.Header.Set("X-Forwarded-For", "10.0.0.3, 10.0.0.2, 10.0.0.1")
+
+	ip = RealIP(r)
+	if ip != "10.0.0.1" {
+		t.Errorf("\texpected %s got %s", "10.0.0.1", ip)
+	}
+
+	// Test with XFFDepth = 2 (second to last IP in chain)
+	t.Log("XFFDepth=2 (second to last IP)")
+	mockConfig.HttpServerOptions.XFFDepth = 2
+
+	r, err = http.NewRequest(http.MethodGet, "http://abc.com:8080", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	r.Header.Set("X-Forwarded-For", "10.0.0.3, 10.0.0.2, 10.0.0.1")
+
+	ip = RealIP(r)
+	if ip != "10.0.0.2" {
+		t.Errorf("\texpected %s got %s", "10.0.0.2", ip)
+	}
 }
 
 func BenchmarkRealIP_RemoteAddr(b *testing.B) {
 	b.ReportAllocs()
 
-	r, _ := http.NewRequest(http.MethodGet, "http://abc.com:8080", nil)
+	// Initialize the Global function for benchmark
+	mockConfig := config.Config{}
+	mockConfig.HttpServerOptions.XFFDepth = 0
+	Global = func() config.Config {
+		return mockConfig
+	}
+
+	r, err := http.NewRequest(http.MethodGet, "http://abc.com:8080", nil)
+	if err != nil {
+		b.Fatal(err)
+	}
 	r.RemoteAddr = "10.0.1.4:8081"
 
 	for n := 0; n < b.N; n++ {
@@ -66,7 +120,17 @@ func BenchmarkRealIP_RemoteAddr(b *testing.B) {
 func BenchmarkRealIP_ForwardedFor(b *testing.B) {
 	b.ReportAllocs()
 
-	r, _ := http.NewRequest(http.MethodGet, "http://abc.com:8080", nil)
+	// Initialize the Global function for benchmark
+	mockConfig := config.Config{}
+	mockConfig.HttpServerOptions.XFFDepth = 0
+	Global = func() config.Config {
+		return mockConfig
+	}
+
+	r, err := http.NewRequest(http.MethodGet, "http://abc.com:8080", nil)
+	if err != nil {
+		b.Fatal(err)
+	}
 	r.Header.Set("X-Forwarded-For", "10.0.0.3, 10.0.0.2, 10.0.0.1")
 
 	for n := 0; n < b.N; n++ {
@@ -80,7 +144,17 @@ func BenchmarkRealIP_ForwardedFor(b *testing.B) {
 func BenchmarkRealIP_RealIP(b *testing.B) {
 	b.ReportAllocs()
 
-	r, _ := http.NewRequest(http.MethodGet, "http://abc.com:8080", nil)
+	// Initialize the Global function for benchmark
+	mockConfig := config.Config{}
+	mockConfig.HttpServerOptions.XFFDepth = 0
+	Global = func() config.Config {
+		return mockConfig
+	}
+
+	r, err := http.NewRequest(http.MethodGet, "http://abc.com:8080", nil)
+	if err != nil {
+		b.Fatal(err)
+	}
 	r.Header.Set("X-Real-IP", "10.0.0.1")
 
 	for n := 0; n < b.N; n++ {
@@ -94,7 +168,17 @@ func BenchmarkRealIP_RealIP(b *testing.B) {
 func BenchmarkRealIP_Context(b *testing.B) {
 	b.ReportAllocs()
 
-	r, _ := http.NewRequest(http.MethodGet, "http://abc.com:8080", nil)
+	// Initialize the Global function for benchmark
+	mockConfig := config.Config{}
+	mockConfig.HttpServerOptions.XFFDepth = 0
+	Global = func() config.Config {
+		return mockConfig
+	}
+
+	r, err := http.NewRequest(http.MethodGet, "http://abc.com:8080", nil)
+	if err != nil {
+		b.Fatal(err)
+	}
 	r.Header.Set("X-Real-IP", "10.0.0.1")
 	ctx := context.WithValue(r.Context(), "remote_addr", "10.0.0.5")
 	r = r.WithContext(ctx)
@@ -106,3 +190,109 @@ func BenchmarkRealIP_Context(b *testing.B) {
 		}
 	}
 }
+
+func TestXFFDepth(t *testing.T) {
+	// Define test cases for XFFDepth
+	testCases := []struct {
+		name     string
+		xffValue string
+		depth    int
+		expected string
+	}{
+		{
+			name:     "Depth 1 (last IP)",
+			xffValue: "10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1",
+			depth:    1,
+			expected: "13.0.0.1",
+		},
+		{
+			name:     "Depth 2 (second to last IP)",
+			xffValue: "10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1",
+			depth:    2,
+			expected: "12.0.0.1",
+		},
+		{
+			name:     "Depth 3 (third to last IP)",
+			xffValue: "10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1",
+			depth:    3,
+			expected: "11.0.0.1",
+		},
+		{
+			name:     "Depth 4 (fourth to last IP)",
+			xffValue: "10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1",
+			depth:    4,
+			expected: "10.0.0.1",
+		},
+		{
+			name:     "Depth 5 (exceeds chain length)",
+			xffValue: "10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1",
+			depth:    5,
+			expected: "",
+		},
+		{
+			name:     "Depth 0 (first IP)",
+			xffValue: "10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1",
+			depth:    0,
+			expected: "10.0.0.1",
+		},
+		{
+			name:     "Depth -5 (Negative Depth uses same as NO depth)",
+			xffValue: "10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1",
+			depth:    -5,
+			expected: "",
+		},
+		{
+			name:     "Header with spaces",
+			xffValue: "10.0.0.1, 11.0.0.1, 12.0.0.1, 13.0.0.1",
+			depth:    2,
+			expected: "12.0.0.1",
+		},
+		{
+			name:     "Header with mixed format",
+			xffValue: "10.0.0.1,11.0.0.1, 12.0.0.1,  13.0.0.1",
+			depth:    3,
+			expected: "11.0.0.1",
+		},
+		{
+			name:     "Empty header",
+			xffValue: "",
+			depth:    0,
+			expected: "192.168.1.1", // Should fall back to RemoteAddr
+		},
+		{
+			name:     "Invalid IP at selected depth",
+			xffValue: "10.0.0.1,invalid-ip,12.0.0.1,13.0.0.1",
+			depth:    3,
+			expected: "192.168.1.1", // Should fall back to RemoteAddr
+		},
+	}
+
+	// Initialize mock config for tests
+	mockConfig := config.Config{}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			// Set the XFFDepth for this test case
+			mockConfig.HttpServerOptions.XFFDepth = tc.depth
+			Global = func() config.Config {
+				return mockConfig
+			}
+
+			// Create request with X-Forwarded-For header
+			r, err := http.NewRequest(http.MethodGet, "http://example.com", nil)
+			if err != nil {
+				t.Fatal(err)
+			}
+			r.Header.Set("X-Forwarded-For", tc.xffValue)
+			r.RemoteAddr = "192.168.1.1:8080" // Fallback IP if XFF processing fails
+
+			// Get client IP
+			ip := RealIP(r)
+
+			// Check result
+			if ip != tc.expected {
+				t.Errorf("Expected IP %q, got %q", tc.expected, ip)
+			}
+		})
+	}
+}