100 lines
2.3 KiB
Go
100 lines
2.3 KiB
Go
package nginx
|
|
|
|
import (
|
|
"encoding/json"
|
|
"strings"
|
|
)
|
|
|
|
type TrustedProxyConfig struct {
|
|
Enabled bool `json:"enabled"`
|
|
Preset string `json:"preset"` // "", "cloudflare", "custom"
|
|
CIDRs []string `json:"cidrs,omitempty"`
|
|
Header string `json:"header,omitempty"` // CF-Connecting-IP, X-Real-IP, X-Forwarded-For
|
|
Recursive bool `json:"recursive,omitempty"`
|
|
}
|
|
|
|
var cloudflareIPv4 = []string{
|
|
"173.245.48.0/20",
|
|
"103.21.244.0/22",
|
|
"103.22.200.0/22",
|
|
"103.31.4.0/22",
|
|
"141.101.64.0/18",
|
|
"108.162.192.0/18",
|
|
"190.93.240.0/20",
|
|
"188.114.96.0/20",
|
|
"197.234.240.0/22",
|
|
"198.41.128.0/17",
|
|
"162.158.0.0/15",
|
|
"104.16.0.0/13",
|
|
"104.24.0.0/14",
|
|
"172.64.0.0/13",
|
|
"131.0.72.0/22",
|
|
}
|
|
|
|
var cloudflareIPv6 = []string{
|
|
"2400:cb00::/32",
|
|
"2606:4700::/32",
|
|
"2803:f800::/32",
|
|
"2405:b500::/32",
|
|
"2405:8100::/32",
|
|
"2a06:98c0::/29",
|
|
"2c0f:f248::/32",
|
|
}
|
|
|
|
func ParseTrustedProxyJSON(raw string) TrustedProxyConfig {
|
|
raw = strings.TrimSpace(raw)
|
|
if raw == "" || raw == "{}" {
|
|
return TrustedProxyConfig{}
|
|
}
|
|
var cfg TrustedProxyConfig
|
|
_ = json.Unmarshal([]byte(raw), &cfg)
|
|
return cfg
|
|
}
|
|
|
|
func (c TrustedProxyConfig) effectiveCIDRs() []string {
|
|
if !c.Enabled {
|
|
return nil
|
|
}
|
|
switch c.Preset {
|
|
case "cloudflare":
|
|
out := make([]string, 0, len(cloudflareIPv4)+len(cloudflareIPv6))
|
|
out = append(out, cloudflareIPv4...)
|
|
out = append(out, cloudflareIPv6...)
|
|
return out
|
|
default:
|
|
return c.CIDRs
|
|
}
|
|
}
|
|
|
|
func (c TrustedProxyConfig) effectiveHeader() string {
|
|
if c.Header != "" {
|
|
return c.Header
|
|
}
|
|
if c.Preset == "cloudflare" {
|
|
return "CF-Connecting-IP"
|
|
}
|
|
return "X-Forwarded-For"
|
|
}
|
|
|
|
func writeRealIPDirectives(b *strings.Builder, cfg TrustedProxyConfig) {
|
|
writeRealIPComment(b, cfg)
|
|
cidrs := cfg.effectiveCIDRs()
|
|
if len(cidrs) == 0 {
|
|
b.WriteString(" map $remote_addr $havline_client_ip {\n")
|
|
b.WriteString(" default $remote_addr;\n")
|
|
b.WriteString(" }\n\n")
|
|
return
|
|
}
|
|
for _, cidr := range cidrs {
|
|
b.WriteString(" set_real_ip_from " + cidr + ";\n")
|
|
}
|
|
header := cfg.effectiveHeader()
|
|
b.WriteString(" real_ip_header " + header + ";\n")
|
|
if cfg.Recursive || header == "X-Forwarded-For" {
|
|
b.WriteString(" real_ip_recursive on;\n")
|
|
}
|
|
b.WriteString("\n map $remote_addr $havline_client_ip {\n")
|
|
b.WriteString(" default $remote_addr;\n")
|
|
b.WriteString(" }\n\n")
|
|
}
|