Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix checking whether source address in X-Forwarded-For is ipv4 or ipv6 #72

Merged
merged 5 commits into from
Feb 7, 2024
Merged

Fix checking whether source address in X-Forwarded-For is ipv4 or ipv6 #72

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
3ef5dc2
refactor: fix a typo in error message
hparzych Jan 29, 2024
368bb5f
fix: Remove using src address metadata in case of X-Forwarded-For
hparzych Jan 29, 2024
f7a517d
fix: Ignore request if X-Forwarded-For couldn't be parsed
hparzych Feb 1, 2024
8230bb5
Merge branch 'main' into fix/handling-mismatch-x-forwarded-for-src-addr
hparzych Feb 1, 2024
7293f1f
fix: Add error handling and logging
hparzych Feb 1, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 27 additions & 17 deletions libservice/src/Aggregator.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,43 +31,53 @@ static std::string getEndpoint(const std::string& host, const std::string& url)
static bool isIpv4ClientExternal(const IpAddressChecker& ipChecker, const std::string& addr) {
in_addr_t clientAddrBinary;
if (inet_pton(AF_INET, addr.c_str(), &clientAddrBinary) != 1) {
throw std::runtime_error("Cannot parse IPv4 client address: {}" + addr);
throw std::runtime_error("Couldn't parse IPv4 client address");
}
return ipChecker.isV4AddressExternal(clientAddrBinary);
}

static bool isIpv6ClientExternal(const IpAddressChecker& ipChecker, const std::string& addr) {
in6_addr clientAddrBinary{};
if (inet_pton(AF_INET6, addr.c_str(), &clientAddrBinary) != 1) {
throw std::runtime_error("Cannot parse IPv6 client address: {}" + addr);
throw std::runtime_error("Couldn't parse IPv6 client address");
}
return ipChecker.isV6AddressExternal(clientAddrBinary);
}

static bool isClientExternal(const IpAddressChecker& ipChecker, const std::string& addr, bool isIpV6) {
return isIpV6 ? isIpv6ClientExternal(ipChecker, addr) : isIpv4ClientExternal(ipChecker, addr);
static bool isClientExternal(const IpAddressChecker& ipChecker, const std::string& addr, bool isIpv6) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
static bool isClientExternal(const IpAddressChecker& ipChecker, const std::string& addr, bool isIpv6) {
static bool isClientExternal(const IpAddressChecker& ipChecker, const std::string& addr, bool isPossiblyIpv6) {

return isIpv6 ? isIpv6ClientExternal(ipChecker, addr) : isIpv4ClientExternal(ipChecker, addr);
}

static bool isClientExternal(const IpAddressChecker& ipChecker, const std::string& addr) {
bool isPossiblyIpv6{std::count(addr.begin(), addr.end(), ':') >= 2};
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think that Ipv6-checking logic should not be hidden inside a isClientExternal wrapper and should rather be called outside isClientExternal.

return isClientExternal(ipChecker, addr, isPossiblyIpv6);
}

static void incrementServiceClientsNumber(
const IpAddressChecker& ipChecker, Service& service, const httpparser::HttpRequest& request, const DiscoverySessionMeta& meta) {
bool isExternal{false};
std::string clientAddr;
if (!request.xForwardedFor.empty()) {
clientAddr = request.xForwardedFor.front();
} else if (discoverySessionFlagsIsIPv4(meta.flags)) {
clientAddr = ipv4ToString(meta.sourceIPData);
} else if (discoverySessionFlagsIsIPv6(meta.flags)) {
clientAddr = ipv6ToString(meta.sourceIPData);
}

try {
if (isClientExternal(ipChecker, clientAddr, discoverySessionFlagsIsIPv6(meta.flags))) {
++service.externalClientsNumber;
if (!request.xForwardedFor.empty()) {
clientAddr = request.xForwardedFor.front();
isExternal = isClientExternal(ipChecker, clientAddr);
} else if (discoverySessionFlagsIsIPv4(meta.flags)) {
clientAddr = ipv4ToString(meta.sourceIPData);
isExternal = isClientExternal(ipChecker, clientAddr, false);
} else if (discoverySessionFlagsIsIPv6(meta.flags)) {
clientAddr = ipv6ToString(meta.sourceIPData);
isExternal = isClientExternal(ipChecker, clientAddr, true);
} else {
++service.internalClientsNumber;
return;
}
} catch (const std::runtime_error& e) {
LOG_TRACE(e.what());
return;
LOG_TRACE("Couldn't determine if the client is external: {} (client address: {})", e.what(), clientAddr);
}

if (isExternal) {
++service.externalClientsNumber;
} else {
++service.internalClientsNumber;
}
}

Expand Down