feat(net): trusted-proxy depth so real client IPs survive a proxy — #2453
test-go / test (push) Failing after 50s
test-web / test (push) Failing after 50s
test-go / integration (push) Failing after 2m19s

Fixes the defect the operator spotted in #370 immediately after it shipped:
auth.ClientIP ignored X-Forwarded-For whenever RemoteAddr was public, so a
proxy on a public address — a separate host, or a CDN, i.e. anyone running
this publicly, since public means TLS means a proxy — recorded the PROXY for
every session. created_ip and last_ip were then always equal and the
"Address changed" signal could never fire. The feature looked like it worked
and reported nothing.

Replaced with the standard trusted-hop model (Rails, Caddy, Traefik, nginx).
XFF grows left-to-right as each proxy appends the peer it received from, so
for client -> CDN -> own-proxy -> app the app sees [client, CDN] with
RemoteAddr = own-proxy, and the client sits at XFF[len - hops]:

  0  RemoteAddr, XFF ignored — no proxy
  1  the address your own proxy observed
  2  through a CDN in front of your proxy

Default 1, per the operator: publicly reachable means a TLS terminator in
front.

The cost is real and stated rather than hidden. hops >= 1 DECLARES that a
proxy exists; set it with no proxy, or deeper than the actual chain, and the
index reaches attacker-supplied entries, letting a visitor choose which
address their own session shows — defeating exactly the detection #370 is
for. That's inherent to the model, which is why 0 is a first-class value and
the admin card says "count your proxies, don't guess high" instead of just
exposing a number. Both mis-set shapes are pinned by tests so they stay known
consequences rather than surprises.

Migration 0053 + internal/netsettings, cached under an RWMutex. That's not an
optimisation: ClientIP runs in RequireUser for every authenticated request, so
a per-request query would put the database on the critical path of the whole
API. New() always returns a usable service so a boot-time DB hiccup degrades
to the default instead of breaking that path (rule #131), and Hops() is
nil-safe because test routers construct middleware without it.

RequireUser now takes a func() int rather than an int — the value is
operator-editable at runtime while the middleware is built once at boot, and
reading it per request is what makes a save take effect with no restart
(rule #25).

The admin card is verifiable, not just configurable: it reports the address
the CURRENT setting resolves THIS request to, the raw forwarded chain, and the
socket peer — so you set the number, save, and confirm the address matches the
machine you're on. It also counts the arriving chain and says how many proxies
that implies. GET/PUT both return that payload, PUT recomputed under the new
value, so the effect is visible without a reload.

Also fixes styling in the #370 card that CI could not catch: text-destructive
and bg-destructive don't exist in this Tailwind config — the palette is
colors.action.destructive — so the "Address changed" warning and the
sign-out-others button were rendering unstyled. Both now use
text-action-destructive / bg-action-destructive / text-action-fg.

Not done here: requestlog.go still logs raw RemoteAddr and will disagree with
the sessions UI about who connected. Left for its own change.
This commit is contained in:
2026-08-05 10:07:43 -04:00
parent bf649f3beb
commit 381e9cedb7
19 changed files with 788 additions and 130 deletions
+65
View File
@@ -0,0 +1,65 @@
package api
import (
"encoding/json"
"errors"
"net/http"
"git.fabledsword.com/bvandeusen/minstrel/internal/apierror"
"git.fabledsword.com/bvandeusen/minstrel/internal/auth"
"git.fabledsword.com/bvandeusen/minstrel/internal/netsettings"
)
type networkSettingsResp struct {
TrustedProxyHops int `json:"trusted_proxy_hops"`
MaxHops int `json:"max_hops"`
// DetectedClientIP is what the CURRENT setting resolves this very request
// to. It's the difference between a number the operator has to reason
// about and one they can verify: set the value, reload, and check the
// address matches the machine you're sitting at.
DetectedClientIP string `json:"detected_client_ip"`
// ForwardedChain is the raw X-Forwarded-For as received, so an operator
// whose detected address looks wrong can see how many hops actually
// arrived and count them rather than guess.
ForwardedChain string `json:"forwarded_chain"`
RemoteAddr string `json:"remote_addr"`
}
type updateNetworkSettingsReq struct {
TrustedProxyHops int `json:"trusted_proxy_hops"`
}
func (h *handlers) handleGetNetworkSettings(w http.ResponseWriter, r *http.Request) {
writeJSON(w, http.StatusOK, h.networkSettingsPayload(r))
}
func (h *handlers) handleUpdateNetworkSettings(w http.ResponseWriter, r *http.Request) {
var req updateNetworkSettingsReq
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
writeErr(w, apierror.BadRequest("invalid_body", "malformed JSON"))
return
}
if err := h.netSettings.SetHops(r.Context(), req.TrustedProxyHops); err != nil {
if errors.Is(err, netsettings.ErrHopsOutOfRange) {
writeErr(w, apierror.BadRequest("invalid_hops", err.Error()))
return
}
writeErrWithLog(w, h.logger, "admin network: update failed", apierror.Internal(err))
return
}
// Echo the payload recomputed under the NEW value, so the card can show
// immediately what the change did to this request's own address rather
// than making the operator reload to find out.
writeJSON(w, http.StatusOK, h.networkSettingsPayload(r))
}
func (h *handlers) networkSettingsPayload(r *http.Request) networkSettingsResp {
hops := h.netSettings.Hops()
return networkSettingsResp{
TrustedProxyHops: hops,
MaxHops: netsettings.MaxTrustedProxyHops,
DetectedClientIP: auth.ClientIP(r, hops),
ForwardedChain: r.Header.Get("X-Forwarded-For"),
RemoteAddr: r.RemoteAddr,
}
}
+10 -2
View File
@@ -20,6 +20,7 @@ import (
"git.fabledsword.com/bvandeusen/minstrel/internal/lidarrquarantine"
"git.fabledsword.com/bvandeusen/minstrel/internal/lidarrrequests"
"git.fabledsword.com/bvandeusen/minstrel/internal/mailer"
"git.fabledsword.com/bvandeusen/minstrel/internal/netsettings"
"git.fabledsword.com/bvandeusen/minstrel/internal/playevents"
"git.fabledsword.com/bvandeusen/minstrel/internal/playlists"
"git.fabledsword.com/bvandeusen/minstrel/internal/recsettings"
@@ -30,7 +31,7 @@ import (
// Mount attaches /api/* handlers to r. Public endpoints (login) are outside
// RequireUser; everything else is gated by the middleware. The events writer
// is shared with the Subsonic mount so /rest/scrobble feeds the same store.
func Mount(r chi.Router, pool *pgxpool.Pool, logger *slog.Logger, events *playevents.Writer, recCfg config.RecommendationConfig, recSettings *recsettings.Service, lidarrCfg *lidarrconfig.Service, lidarrReqs *lidarrrequests.Service, lidarrQuar *lidarrquarantine.Service, tracksSvc *tracks.Service, playlistsSvc *playlists.Service, coverEnricher *coverart.Enricher, coverSettings *coverart.SettingsService, tagSettings *tags.SettingsService, scanner *library.Scanner, scanCfg library.RunScanConfig, dataDir string, sender mailer.Sender, bus *eventbus.Bus, playlistScheduler *playlists.Scheduler, streamSecret []byte) {
func Mount(r chi.Router, pool *pgxpool.Pool, logger *slog.Logger, events *playevents.Writer, recCfg config.RecommendationConfig, recSettings *recsettings.Service, lidarrCfg *lidarrconfig.Service, lidarrReqs *lidarrrequests.Service, lidarrQuar *lidarrquarantine.Service, tracksSvc *tracks.Service, playlistsSvc *playlists.Service, coverEnricher *coverart.Enricher, coverSettings *coverart.SettingsService, tagSettings *tags.SettingsService, scanner *library.Scanner, scanCfg library.RunScanConfig, dataDir string, sender mailer.Sender, bus *eventbus.Bus, playlistScheduler *playlists.Scheduler, streamSecret []byte, netSettings *netsettings.Service) {
rng := rand.New(rand.NewSource(rand.Int63()))
h := &handlers{
pool: pool, logger: logger, events: events, recCfg: recCfg,
@@ -51,6 +52,7 @@ func Mount(r chi.Router, pool *pgxpool.Pool, logger *slog.Logger, events *playev
eventbus: bus,
playlistScheduler: playlistScheduler,
streamSecret: streamSecret,
netSettings: netSettings,
}
r.Route("/api", func(api chi.Router) {
@@ -74,7 +76,7 @@ func Mount(r chi.Router, pool *pgxpool.Pool, logger *slog.Logger, events *playev
api.With(auth.OptionalUser(pool, logger)).Get("/tracks/{id}/stream.{ext}", h.handleGetStream)
api.Group(func(authed chi.Router) {
authed.Use(auth.RequireUser(pool))
authed.Use(auth.RequireUser(pool, netSettings.Hops))
authed.Post("/auth/logout", h.handleLogout)
authed.Get("/me", h.handleGetMe)
authed.Get("/me/system-playlists-status", h.handleGetSystemPlaylistsStatus)
@@ -185,6 +187,9 @@ func Mount(r chi.Router, pool *pgxpool.Pool, logger *slog.Logger, events *playev
admin.Post("/albums/{id}/cover/refetch", h.handleAdminAlbumRefetchCover)
admin.Post("/covers/refetch-missing", h.handleAdminBulkRefetchCovers)
admin.Get("/network-settings", h.handleGetNetworkSettings)
admin.Put("/network-settings", h.handleUpdateNetworkSettings)
admin.Get("/scan/status", h.handleGetScanStatus)
admin.Post("/scan/run", h.handleTriggerScan)
@@ -264,6 +269,9 @@ type handlers struct {
mailer mailer.Sender
eventbus *eventbus.Bus
playlistScheduler *playlists.Scheduler
// netSettings caches the trusted reverse-proxy depth read by the auth
// middleware on every request and edited from the admin network card.
netSettings *netsettings.Service
// streamSecret is the HMAC key used by SignStreamToken /
// VerifyStreamToken to authenticate the UPnP-speaker stream path
// (see internal/api/stream_token.go and the design at
+82 -63
View File
@@ -6,51 +6,101 @@ import (
"strings"
)
// ClientIP returns the caller's address for the active-sessions surface (#370).
// ClientIP returns the caller's address, reading through trustedProxyHops
// reverse proxies (#2453).
//
// Both obvious implementations are wrong, and they're wrong in ways that
// matter specifically because this feeds a compromise-detection UI:
// X-Forwarded-For grows left-to-right: every proxy APPENDS the peer it
// received the request from. For client -> CDN -> own-proxy -> Minstrel the
// app sees XFF = [client, CDN] and RemoteAddr = own-proxy. Each trusted proxy
// therefore accounts for one entry counting from the right, and the first
// address we were NOT told to trust is the client:
//
// - r.RemoteAddr alone. Minstrel is normally behind a reverse proxy, so
// every session would show the proxy's address — noise shaped like data,
// hiding the exact thing the operator is looking for.
// - Trusting X-Forwarded-For. Any client can set that header, so an
// attacker could choose what appears in their victim's session list.
// A security surface an attacker can write to is worse than none.
// hops 0 -> RemoteAddr; XFF ignored entirely
// hops 1 -> XFF[1] = CDN — trusting only our own proxy, the most we can
// honestly claim is the address it told us about
// hops 2 -> XFF[0] = client
//
// So the header is trusted only when the request actually arrived from a
// proxy. If RemoteAddr is public, the caller reached us directly and its XFF
// is attacker-controlled, so it's ignored outright. If RemoteAddr is
// private/loopback, XFF is walked from the RIGHT — entries are appended as a
// request passes through infrastructure, so the rightmost end is the one our
// own proxies wrote — and the first address that isn't itself a proxy range
// wins. A client forging XFF can only prepend to the untrusted left end,
// which that walk never reaches.
// This replaces an earlier heuristic that ignored XFF whenever RemoteAddr was
// public. That was safe but useless in the deployment that matters: a proxy
// on a public address (separate host, or a CDN) meant every session recorded
// the proxy, so the active-sessions surface could never show an address
// change (#370).
//
// Known limitation, failing closed on purpose: if the proxy sits on a PUBLIC
// address (a separate host, or a CDN in front), RemoteAddr isn't in a proxy
// range, so we report the proxy rather than the end user. That's a true fact
// about where the request came from, which beats trusting a forgeable header.
// # What the operator is asserting
//
// Returns "" when nothing usable can be determined. Callers store that as-is
// and the UI renders "unknown" rather than inventing a value.
func ClientIP(r *http.Request) string {
// hops >= 1 is a DECLARATION that a proxy sits in front. Two ways to get it
// wrong, both worth understanding rather than papering over:
//
// - Set to 1+ with NO proxy: any client can forge X-Forwarded-For and pick
// what its own session row shows, defeating the compromise detection.
// - Set HIGHER than the real chain: the index runs past the proxy-written
// entries into attacker-supplied ones, same result.
//
// Both are inherent to the trusted-hop model — Rails, Caddy, Traefik and
// nginx all behave this way — which is why 0 is a first-class value and the
// admin card tells the operator to count their proxies.
func ClientIP(r *http.Request, trustedProxyHops int) string {
remote := hostOf(r.RemoteAddr)
ip := net.ParseIP(remote)
if ip == nil || !isProxyRange(ip) {
if trustedProxyHops <= 0 {
return remote
}
if forwarded := forwardedClient(r.Header.Get("X-Forwarded-For")); forwarded != "" {
return forwarded
chain := forwardedChain(r)
if len(chain) == 0 {
// No forwarding header: either there's genuinely no proxy, or one is
// misconfigured. The socket peer is the only thing we actually know.
return remote
}
// Some proxies set only X-Real-IP. The trust condition is already
// satisfied — we know this request came from a proxy range.
if real := net.ParseIP(strings.TrimSpace(r.Header.Get("X-Real-IP"))); real != nil {
return real.String()
// Clamp rather than reject: a chain shorter than the configured depth
// means the operator over-counted, and the leftmost entry is the closest
// thing to a client on offer. The caveat above covers the risk.
idx := len(chain) - trustedProxyHops
if idx < 0 {
idx = 0
}
if ip := net.ParseIP(chain[idx]); ip != nil {
return ip.String()
}
// A proxy wrote something that isn't an address. Positional meaning is
// lost, so fall back to what we can verify ourselves.
return remote
}
// forwardedChain returns the X-Forwarded-For entries in wire order, or the
// single X-Real-IP value when XFF is absent.
//
// Entries are kept verbatim, including unparseable ones: their POSITION is
// what carries meaning here, so silently dropping a malformed hop would
// shift every index and could hand back an attacker-supplied entry.
func forwardedChain(r *http.Request) []string {
raw := r.Header.Get("X-Forwarded-For")
if strings.TrimSpace(raw) == "" {
// Some proxies set only X-Real-IP, which by construction is a single
// hop — the address that proxy saw.
if real := strings.TrimSpace(r.Header.Get("X-Real-IP")); real != "" {
return []string{real}
}
return nil
}
parts := strings.Split(raw, ",")
out := make([]string, 0, len(parts))
for _, p := range parts {
if p = strings.TrimSpace(p); p != "" {
out = append(out, p)
}
}
return out
}
// hopsOf reads a trusted-depth accessor, treating a nil one as "trust
// nothing". Test contexts and any future caller that hasn't wired the
// settings service get the safe reading rather than a panic.
func hopsOf(fn func() int) int {
if fn == nil {
return 0
}
return fn()
}
// hostOf strips the port from a RemoteAddr, tolerating values that have none.
func hostOf(remoteAddr string) string {
host, _, err := net.SplitHostPort(remoteAddr)
@@ -59,34 +109,3 @@ func hostOf(remoteAddr string) string {
}
return host
}
// forwardedClient walks an X-Forwarded-For value right-to-left and returns
// the first address outside our proxy ranges — see ClientIP for why the
// direction matters. Returns "" if the header is absent, malformed, or
// contains nothing but proxy addresses.
func forwardedClient(header string) string {
parts := strings.Split(header, ",")
for i := len(parts) - 1; i >= 0; i-- {
ip := net.ParseIP(strings.TrimSpace(parts[i]))
if ip == nil || isProxyRange(ip) {
continue
}
return ip.String()
}
return ""
}
// isProxyRange reports whether ip is an address a reverse proxy would
// plausibly occupy in a self-hosted deployment: loopback, RFC1918 / ULA
// (both covered by IsPrivate), link-local, or unspecified.
//
// Deliberately not configurable. These ranges cover proxy-on-same-host and
// proxy-on-the-same-docker-network, which is essentially every self-hosted
// install, and it works with no setup at all (rule #26). An exotic topology
// can motivate a setting when one actually turns up.
func isProxyRange(ip net.IP) bool {
return ip.IsLoopback() ||
ip.IsPrivate() ||
ip.IsLinkLocalUnicast() ||
ip.IsUnspecified()
}
+106 -57
View File
@@ -5,99 +5,148 @@ import (
"testing"
)
// The spoofing cases below are the reason this function exists rather than a
// one-line r.RemoteAddr read, so they're asserted explicitly rather than
// folded into the happy-path table.
// The hop arithmetic is the whole feature, so the table is written as
// deployment topologies rather than abstract inputs.
func TestClientIP(t *testing.T) {
tests := []struct {
name string
hops int
remoteAddr string
forwarded string
realIP string
want string
}{
{
name: "direct connection, no proxy headers",
name: "no proxy configured, socket peer wins",
hops: 0,
remoteAddr: "203.0.113.5:51234",
want: "203.0.113.5",
},
{
// The attack this guards against: a client connecting straight to
// us claims to be someone else. RemoteAddr is public, so it did
// NOT come through our proxy, so its XFF is worthless.
name: "direct connection ignores forged X-Forwarded-For",
// hops 0 is the setting for a directly-exposed instance, and it
// must make forged headers inert.
name: "hops 0 ignores a forged forwarded header",
hops: 0,
remoteAddr: "203.0.113.5:51234",
forwarded: "198.51.100.99",
want: "203.0.113.5",
},
{
name: "direct connection ignores forged X-Real-IP",
// The common case: one TLS-terminating proxy. Note RemoteAddr is
// PUBLIC here — a proxy on its own host — which the previous
// private-range heuristic got wrong.
name: "one proxy on a public address yields the client",
hops: 1,
remoteAddr: "203.0.113.200:40000",
forwarded: "198.51.100.7",
want: "198.51.100.7",
},
{
name: "one proxy on a private address yields the client",
hops: 1,
remoteAddr: "172.18.0.1:40000",
forwarded: "198.51.100.7",
want: "198.51.100.7",
},
{
// client -> Cloudflare -> own proxy -> app.
// Trusting only our own proxy, the honest answer is Cloudflare:
// that's the address our proxy actually observed.
name: "cdn chain with hops 1 stops at the cdn",
hops: 1,
remoteAddr: "172.18.0.1:40000",
forwarded: "198.51.100.7, 203.0.113.50",
want: "203.0.113.50",
},
{
// Same chain, both hops trusted — now we reach the real client.
name: "cdn chain with hops 2 reaches the client",
hops: 2,
remoteAddr: "172.18.0.1:40000",
forwarded: "198.51.100.7, 203.0.113.50",
want: "198.51.100.7",
},
{
// A client prepending a lie is only reachable if the operator
// over-counts their proxies; at the correct depth it's skipped.
name: "forged prefix is not reached at the correct depth",
hops: 1,
remoteAddr: "172.18.0.1:40000",
forwarded: "1.2.3.4, 198.51.100.7",
want: "198.51.100.7",
},
{
// The documented mis-set failure, pinned so it stays a KNOWN
// consequence rather than a surprise: depth deeper than the real
// chain reads attacker-supplied input.
name: "hops set deeper than the chain clamps to the leftmost entry",
hops: 5,
remoteAddr: "172.18.0.1:40000",
forwarded: "1.2.3.4, 198.51.100.7",
want: "1.2.3.4",
},
{
name: "no forwarding header falls back to the socket peer",
hops: 1,
remoteAddr: "203.0.113.5:51234",
realIP: "198.51.100.99",
want: "203.0.113.5",
},
{
name: "behind proxy, single forwarded client",
name: "x-real-ip used when forwarded-for is absent",
hops: 1,
remoteAddr: "172.18.0.1:40000",
forwarded: "203.0.113.5",
want: "203.0.113.5",
realIP: "198.51.100.7",
want: "198.51.100.7",
},
{
// A client that prepends a lie to XFF only pollutes the LEFT end;
// the proxy appends the address it actually saw on the right. The
// right-to-left walk reaches the truth first.
name: "behind proxy, forged prefix is skipped for the appended truth",
remoteAddr: "10.0.0.2:40000",
forwarded: "198.51.100.99, 203.0.113.5",
want: "203.0.113.5",
},
{
name: "behind proxy chain, internal hops skipped",
remoteAddr: "10.0.0.2:40000",
forwarded: "203.0.113.5, 10.0.0.7, 172.18.0.3",
want: "203.0.113.5",
},
{
name: "behind proxy, X-Real-IP used when no forwarded header",
remoteAddr: "127.0.0.1:40000",
realIP: "203.0.113.5",
want: "203.0.113.5",
},
{
// LAN client through a LAN proxy: everything is private, so there
// is no public address to find. Reporting the peer is honest.
name: "behind proxy, all-private chain falls back to remote",
name: "forwarded-for wins over x-real-ip when both present",
hops: 1,
remoteAddr: "172.18.0.1:40000",
forwarded: "192.168.1.50, 172.18.0.3",
forwarded: "198.51.100.7",
realIP: "1.2.3.4",
want: "198.51.100.7",
},
{
// Positions are preserved, so a garbage hop can be selected —
// in which case we fall back rather than return nonsense.
name: "unparseable selected entry falls back to the socket peer",
hops: 1,
remoteAddr: "172.18.0.1:40000",
forwarded: "198.51.100.7, not-an-ip",
want: "172.18.0.1",
},
{
name: "behind proxy, malformed forwarded entries ignored",
remoteAddr: "172.18.0.1:40000",
forwarded: "not-an-ip, 203.0.113.5, also-garbage",
want: "203.0.113.5",
},
{
name: "remote addr without a port is tolerated",
remoteAddr: "203.0.113.5",
want: "203.0.113.5",
},
{
name: "ipv6 remote addr",
remoteAddr: "[2001:db8::1]:51234",
want: "2001:db8::1",
},
{
name: "ipv6 forwarded client behind proxy",
name: "ipv6 client through one proxy",
hops: 1,
remoteAddr: "[fd00::1]:40000",
forwarded: "2001:db8::5",
want: "2001:db8::5",
},
{
name: "ipv6 socket peer without proxy",
hops: 0,
remoteAddr: "[2001:db8::1]:51234",
want: "2001:db8::1",
},
{
name: "remote addr without a port is tolerated",
hops: 0,
remoteAddr: "203.0.113.5",
want: "203.0.113.5",
},
{
name: "empty remote addr yields empty",
hops: 1,
remoteAddr: "",
want: "",
},
{
name: "whitespace-only forwarded header is treated as absent",
hops: 1,
remoteAddr: "172.18.0.1:40000",
forwarded: " ",
want: "172.18.0.1",
},
}
for _, tc := range tests {
@@ -113,8 +162,8 @@ func TestClientIP(t *testing.T) {
if tc.realIP != "" {
r.Header.Set("X-Real-IP", tc.realIP)
}
if got := ClientIP(r); got != tc.want {
t.Errorf("ClientIP() = %q, want %q", got, tc.want)
if got := ClientIP(r, tc.hops); got != tc.want {
t.Errorf("ClientIP(hops=%d) = %q, want %q", tc.hops, got, tc.want)
}
})
}
+8 -2
View File
@@ -56,7 +56,13 @@ const SessionCookieName = "minstrel_session"
// bearer header and puts the dbq.User in request context via userCtxKey.
// Requests without a valid session return 401 with no body so callers don't
// leak whether the username existed (matches the /rest/* auth posture).
func RequireUser(pool *pgxpool.Pool) func(http.Handler) http.Handler {
//
// trustedHops supplies the reverse-proxy depth used to record the session's
// current address (#2453). It's a func rather than an int because the value
// is operator-editable at runtime and this middleware is constructed once at
// boot — reading it per request is what makes an admin change take effect
// without a restart. Passing nil means "trust nothing", i.e. the socket peer.
func RequireUser(pool *pgxpool.Pool, trustedHops func() int) func(http.Handler) http.Handler {
return func(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
token := sessionTokenFromRequest(r)
@@ -103,7 +109,7 @@ func RequireUser(pool *pgxpool.Pool) func(http.Handler) http.Handler {
// surface exists to show, and it costs nothing extra here.
if err := q.TouchSessionLastSeen(r.Context(), dbq.TouchSessionLastSeenParams{
ID: sess.ID,
LastIp: ClientIP(r),
LastIp: ClientIP(r, hopsOf(trustedHops)),
}); err != nil {
slog.Warn("api: touch session last_seen failed", "err", err)
}
+1 -1
View File
@@ -57,7 +57,7 @@ func TestRequireUser_RejectsWhenNoCookieOrBearer(t *testing.T) {
next := http.HandlerFunc(func(_ http.ResponseWriter, _ *http.Request) {
t.Fatal("handler must not be called")
})
h := RequireUser(nil)(next)
h := RequireUser(nil, nil)(next)
req := httptest.NewRequest(http.MethodGet, "/api/me", nil)
w := httptest.NewRecorder()
+5
View File
@@ -381,6 +381,11 @@ type LidarrRequest struct {
LidarrAddConfirmedAt pgtype.Timestamptz
}
type NetworkSetting struct {
ID bool
TrustedProxyHops int32
}
type PasswordReset struct {
Token string
UserID pgtype.UUID
+32
View File
@@ -0,0 +1,32 @@
// Code generated by sqlc. DO NOT EDIT.
// versions:
// sqlc v1.31.1
// source: network_settings.sql
package dbq
import (
"context"
)
const getNetworkSettings = `-- name: GetNetworkSettings :one
SELECT id, trusted_proxy_hops FROM network_settings WHERE id = true
`
func (q *Queries) GetNetworkSettings(ctx context.Context) (NetworkSetting, error) {
row := q.db.QueryRow(ctx, getNetworkSettings)
var i NetworkSetting
err := row.Scan(&i.ID, &i.TrustedProxyHops)
return i, err
}
const updateTrustedProxyHops = `-- name: UpdateTrustedProxyHops :one
UPDATE network_settings SET trusted_proxy_hops = $1 WHERE id = true RETURNING id, trusted_proxy_hops
`
func (q *Queries) UpdateTrustedProxyHops(ctx context.Context, trustedProxyHops int32) (NetworkSetting, error) {
row := q.db.QueryRow(ctx, updateTrustedProxyHops, trustedProxyHops)
var i NetworkSetting
err := row.Scan(&i.ID, &i.TrustedProxyHops)
return i, err
}
@@ -0,0 +1 @@
DROP TABLE network_settings;
@@ -0,0 +1,33 @@
-- Trusted reverse-proxy depth for client-IP extraction (#2453).
--
-- X-Forwarded-For grows left-to-right: each proxy APPENDS the peer it
-- received the request from. For client -> CDN -> own-proxy -> Minstrel the
-- app sees XFF = [client, CDN] with RemoteAddr = own-proxy. So the real
-- client sits at XFF[len - hops], where hops counts the proxies you trust:
--
-- 0 no proxy in front — use the socket peer, ignore XFF entirely
-- 1 one reverse proxy (nginx / Caddy / Traefik terminating TLS)
-- 2 a CDN in front of your own proxy (Cloudflare -> nginx -> Minstrel)
--
-- Default 1: a publicly reachable Minstrel needs a TLS terminator in front of
-- it, and recording that terminator's own address for every session makes the
-- active-sessions surface (#370) useless — created_ip and last_ip would both
-- be the proxy, so the "address changed" signal could never fire.
--
-- The cost, stated on the admin card rather than buried: hops >= 1 DECLARES
-- that a proxy exists. If one doesn't, a client can forge X-Forwarded-For and
-- choose what its own session row shows, which defeats exactly the compromise
-- detection #370 exists for. That is inherent to the trusted-hop model, which
-- is why 0 is a first-class setting and not a hidden escape hatch.
--
-- Upper bound 10 guards a typo turning into "trust the whole header"; no real
-- deployment chains ten proxies.
CREATE TABLE network_settings (
id boolean PRIMARY KEY DEFAULT true,
trusted_proxy_hops int NOT NULL DEFAULT 1,
CONSTRAINT network_settings_singleton CHECK (id = true),
CONSTRAINT network_settings_hops_range
CHECK (trusted_proxy_hops >= 0 AND trusted_proxy_hops <= 10)
);
INSERT INTO network_settings (id) VALUES (true) ON CONFLICT (id) DO NOTHING;
+5
View File
@@ -0,0 +1,5 @@
-- name: GetNetworkSettings :one
SELECT * FROM network_settings WHERE id = true;
-- name: UpdateTrustedProxyHops :one
UPDATE network_settings SET trusted_proxy_hops = $1 WHERE id = true RETURNING *;
+98
View File
@@ -0,0 +1,98 @@
// Package netsettings holds the DB-backed network settings the request path
// needs. Today that's the trusted reverse-proxy depth used to pull a real
// client address out of X-Forwarded-For (#2453).
//
// Values are cached under an RWMutex and refreshed on write. That isn't an
// optimisation: auth.ClientIP runs in the RequireUser middleware for every
// authenticated request, so a per-request query here would put the database
// on the critical path of the entire API.
package netsettings
import (
"context"
"errors"
"log/slog"
"sync"
"github.com/jackc/pgx/v5/pgxpool"
"git.fabledsword.com/bvandeusen/minstrel/internal/db/dbq"
)
const (
// DefaultTrustedProxyHops mirrors migration 0053's column default. One
// proxy, because anything publicly reachable needs a TLS terminator in
// front of it.
DefaultTrustedProxyHops = 1
// MaxTrustedProxyHops mirrors the CHECK in migration 0053.
MaxTrustedProxyHops = 10
)
// ErrHopsOutOfRange is returned by SetHops for values the CHECK would reject,
// so the API layer can answer 400 instead of surfacing a constraint violation.
var ErrHopsOutOfRange = errors.New("trusted proxy hops must be between 0 and 10")
// Service caches the network settings and owns their persistence.
type Service struct {
pool *pgxpool.Pool
logger *slog.Logger
mu sync.RWMutex
hops int
}
// New loads the settings once and caches them.
//
// It ALWAYS returns a usable Service, even alongside a non-nil error. The
// value it holds sits on the authenticated request path, so a boot-time
// database hiccup must degrade to the default rather than take every request
// down with it (rule #131). The error is returned so the caller can log that
// the cache holds a default rather than stored state.
func New(ctx context.Context, pool *pgxpool.Pool, logger *slog.Logger) (*Service, error) {
s := &Service{pool: pool, logger: logger, hops: DefaultTrustedProxyHops}
if pool == nil {
return s, nil
}
row, err := dbq.New(pool).GetNetworkSettings(ctx)
if err != nil {
return s, err
}
s.hops = int(row.TrustedProxyHops)
return s, nil
}
// Hops returns the cached trusted-proxy depth.
//
// Nil-safe: test contexts construct routers without this service, and a
// missing setting should mean "trust nothing" rather than a panic in
// middleware.
func (s *Service) Hops() int {
if s == nil {
return 0
}
s.mu.RLock()
defer s.mu.RUnlock()
return s.hops
}
// SetHops persists a new depth and refreshes the cache, so an admin change
// takes effect on the next request with no restart (rule #25).
func (s *Service) SetHops(ctx context.Context, hops int) error {
if s == nil || s.pool == nil {
// Mirrors Hops()'s nil-tolerance: handlers can be constructed without
// this service in tests, and a write attempt there should be an error
// rather than a panic in an HTTP handler.
return errors.New("network settings unavailable")
}
if hops < 0 || hops > MaxTrustedProxyHops {
return ErrHopsOutOfRange
}
row, err := dbq.New(s.pool).UpdateTrustedProxyHops(ctx, int32(hops))
if err != nil {
return err
}
s.mu.Lock()
s.hops = int(row.TrustedProxyHops)
s.mu.Unlock()
return nil
}
+55
View File
@@ -0,0 +1,55 @@
package netsettings
import (
"context"
"errors"
"testing"
)
// A nil service reaches middleware in test routers and anywhere the settings
// aren't wired. It must read as "trust nothing" rather than panic — the
// alternative is a nil dereference inside RequireUser, on every request.
func TestHops_NilServiceTrustsNothing(t *testing.T) {
var s *Service
if got := s.Hops(); got != 0 {
t.Errorf("(*Service)(nil).Hops() = %d, want 0", got)
}
}
func TestNew_NilPoolYieldsDefault(t *testing.T) {
s, err := New(context.Background(), nil, nil)
if err != nil {
t.Fatalf("New with nil pool: %v", err)
}
if s == nil {
t.Fatal("New returned nil service")
}
if got := s.Hops(); got != DefaultTrustedProxyHops {
t.Errorf("Hops() = %d, want %d", got, DefaultTrustedProxyHops)
}
}
// Range is rejected before the query so the API answers 400 rather than
// surfacing a CHECK violation as a 500.
func TestSetHops_RejectsOutOfRange(t *testing.T) {
s, _ := New(context.Background(), nil, nil)
for _, hops := range []int{-1, MaxTrustedProxyHops + 1, 999} {
if err := s.SetHops(context.Background(), hops); !errors.Is(err, ErrHopsOutOfRange) {
t.Errorf("SetHops(%d) error = %v, want ErrHopsOutOfRange", hops, err)
}
}
}
// In-range values with no pool must still fail, and must not mutate the
// cache — a write that didn't persist reporting success would leave the
// running process disagreeing with the database.
func TestSetHops_NoPoolFailsWithoutMutatingCache(t *testing.T) {
s, _ := New(context.Background(), nil, nil)
before := s.Hops()
if err := s.SetHops(context.Background(), 2); err == nil {
t.Error("SetHops with nil pool returned nil error")
}
if after := s.Hops(); after != before {
t.Errorf("cache changed from %d to %d despite a failed write", before, after)
}
}
+11 -2
View File
@@ -25,6 +25,7 @@ import (
"git.fabledsword.com/bvandeusen/minstrel/internal/lidarrquarantine"
"git.fabledsword.com/bvandeusen/minstrel/internal/lidarrrequests"
"git.fabledsword.com/bvandeusen/minstrel/internal/mailer"
"git.fabledsword.com/bvandeusen/minstrel/internal/netsettings"
"git.fabledsword.com/bvandeusen/minstrel/internal/playevents"
"git.fabledsword.com/bvandeusen/minstrel/internal/playlists"
"git.fabledsword.com/bvandeusen/minstrel/internal/recsettings"
@@ -164,13 +165,21 @@ func (s *Server) Router() http.Handler {
s.Logger.Error("server: recsettings boot failed", "err", err)
}
}
api.Mount(r, s.Pool, s.Logger, writer, s.RecommendationCfg, recSettings, lidarrCfg, lidarrReqs, lidarrQuar, tracksSvc, playlistsSvc, s.CoverEnricher, s.CoverSettings, s.TagSettings, s.LibraryScanner, s.ScanCfg, s.DataDir, smtpSender, bus, s.PlaylistScheduler, s.StreamSecret)
// Cached trusted-proxy depth (#2453). Constructed here rather than in
// main.go because nothing else needs it at boot, and New always hands
// back a usable service — a DB hiccup degrades to the default rather
// than breaking the authenticated request path that reads it.
netSettings, err := netsettings.New(context.Background(), s.Pool, s.Logger)
if err != nil {
s.Logger.Error("server: netsettings boot failed, using default hops", "err", err)
}
api.Mount(r, s.Pool, s.Logger, writer, s.RecommendationCfg, recSettings, lidarrCfg, lidarrReqs, lidarrQuar, tracksSvc, playlistsSvc, s.CoverEnricher, s.CoverSettings, s.TagSettings, s.LibraryScanner, s.ScanCfg, s.DataDir, smtpSender, bus, s.PlaylistScheduler, s.StreamSecret, netSettings)
// /api/admin/scan is the only admin route owned by the server package
// (it needs the Scanner). Register it as a single inline-middleware
// route — using r.Route("/api/admin", ...) here would create a second
// subtree that shadows every admin route registered by api.Mount.
if s.Scanner != nil {
r.With(auth.RequireUser(s.Pool), auth.RequireAdmin()).
r.With(auth.RequireUser(s.Pool, netSettings.Hops), auth.RequireAdmin()).
Post("/api/admin/scan", s.handleAdminScan)
}
subsonic.Mount(r, s.Pool, s.Logger, s.SubsonicCfg, writer)
+25
View File
@@ -644,3 +644,28 @@ export function createDiagnosticDevicesQuery(userId?: string) {
staleTime: 15_000
});
}
// Trusted-proxy depth (#2453) ---------------------------------------------
// detected_client_ip / forwarded_chain / remote_addr describe THIS request
// under the current setting, so the admin card can be verified rather than
// reasoned about: change the number, see what address you resolve to.
export type NetworkSettings = {
trusted_proxy_hops: number;
max_hops: number;
detected_client_ip: string;
forwarded_chain: string;
remote_addr: string;
};
export async function getNetworkSettings(): Promise<NetworkSettings> {
return api.get<NetworkSettings>('/api/admin/network-settings');
}
// Returns the payload recomputed under the new value, so the card can show
// the effect immediately instead of requiring a reload.
export async function updateNetworkSettings(hops: number): Promise<NetworkSettings> {
return api.put<NetworkSettings>('/api/admin/network-settings', {
trusted_proxy_hops: hops
});
}
+3 -3
View File
@@ -127,7 +127,7 @@
</p>
{#if loadError}
<p class="text-sm text-destructive">
<p class="text-sm text-action-destructive">
Couldn't load your sessions.
<button type="button" class="underline hover:no-underline" onclick={load}>Try again</button>
</p>
@@ -156,7 +156,7 @@
{/if}
{#if hasMoved(s)}
<span
class="inline-flex items-center gap-1 rounded px-1.5 py-0.5 text-xs text-destructive"
class="inline-flex items-center gap-1 rounded px-1.5 py-0.5 text-xs text-action-destructive"
>
<TriangleAlert size={12} aria-hidden="true" />
Address changed
@@ -195,7 +195,7 @@
</span>
<button
type="button"
class="rounded bg-destructive px-3 py-1 text-sm text-white
class="rounded bg-action-destructive px-3 py-1 text-sm text-action-fg
focus-visible:ring-2 focus-visible:ring-accent disabled:opacity-50"
disabled={busy}
onclick={onLogoutOthers}
@@ -0,0 +1,135 @@
<script lang="ts">
import { onMount } from 'svelte';
import { Save, TriangleAlert } from 'lucide-svelte';
import {
getNetworkSettings,
updateNetworkSettings,
type NetworkSettings
} from '$lib/api/admin';
import { pushToast } from '$lib/stores/toast.svelte';
let settings = $state<NetworkSettings | null>(null);
let hops = $state(1);
let saving = $state(false);
let loadError = $state(false);
const dirty = $derived(!!settings && hops !== settings.trusted_proxy_hops);
const chain = $derived(
(settings?.forwarded_chain ?? '')
.split(',')
.map((s) => s.trim())
.filter(Boolean)
);
// The operator can count their proxies from what actually arrived rather
// than guessing — one XFF entry per proxy in front of us.
const suggested = $derived(chain.length);
async function load() {
try {
settings = await getNetworkSettings();
hops = settings.trusted_proxy_hops;
loadError = false;
} catch {
loadError = true;
}
}
onMount(load);
async function save() {
saving = true;
try {
settings = await updateNetworkSettings(hops);
hops = settings.trusted_proxy_hops;
pushToast('Proxy depth saved.');
} catch {
pushToast("Couldn't save proxy depth.", 'error');
} finally {
saving = false;
}
}
</script>
<section class="space-y-4 rounded-xl border border-border bg-surface p-5">
<div>
<h3 class="font-display text-lg font-medium text-text-primary">Client IP detection</h3>
<p class="mt-1 text-sm text-text-secondary">
How many reverse proxies sit in front of Minstrel. This decides which address is
recorded for each sign-in on the <span class="whitespace-nowrap">Active sessions</span> card,
so getting it right is what makes an unfamiliar login visible.
</p>
</div>
{#if loadError}
<p class="text-sm text-action-destructive">
Couldn't load network settings.
<button type="button" class="underline hover:no-underline" onclick={load}>Try again</button>
</p>
{:else if settings === null}
<p class="text-sm text-text-secondary">Loading…</p>
{:else}
<div class="flex flex-wrap items-end gap-3">
<label class="flex flex-col gap-1">
<span class="text-sm text-text-secondary">Trusted proxies</span>
<input
type="number"
min="0"
max={settings.max_hops}
bind:value={hops}
class="w-24 rounded border border-border bg-background px-2 py-1
focus-visible:outline focus-visible:outline-2 focus-visible:outline-accent"
/>
</label>
<button
type="button"
class="inline-flex items-center gap-1.5 rounded-md border border-border px-3 py-1.5
text-sm hover:bg-surface-hover focus-visible:ring-2 focus-visible:ring-accent
disabled:opacity-50"
disabled={saving || !dirty}
onclick={save}
>
<Save size={14} aria-hidden="true" />
{saving ? 'Saving…' : 'Save'}
</button>
</div>
<!-- Verification, not decoration: the number is abstract, but "the address
Minstrel currently sees for YOU" is checkable against the machine
you're sitting at. -->
<dl class="grid gap-x-4 gap-y-1 text-sm sm:grid-cols-[auto_1fr]">
<dt class="text-text-secondary">Your address right now</dt>
<dd class="font-mono">{settings.detected_client_ip || 'unknown'}</dd>
<dt class="text-text-secondary">Direct connection from</dt>
<dd class="font-mono">{settings.remote_addr || 'unknown'}</dd>
<dt class="text-text-secondary">Forwarded chain</dt>
<dd class="font-mono break-all">{settings.forwarded_chain || '(none)'}</dd>
</dl>
{#if suggested > 0 && settings.trusted_proxy_hops !== suggested}
<p class="text-sm text-text-secondary">
This request arrived with {suggested}
{suggested === 1 ? 'forwarded address' : 'forwarded addresses'}, which usually means
{suggested}
{suggested === 1 ? 'proxy' : 'proxies'} in front of Minstrel.
</p>
{/if}
<div class="space-y-2 rounded border border-border bg-background p-3 text-sm">
<p class="flex items-start gap-2 text-text-secondary">
<TriangleAlert size={14} class="mt-0.5 flex-shrink-0 text-action-destructive" aria-hidden="true" />
<span>
Count your proxies — don't guess high. This number tells Minstrel how much of the
<span class="font-mono">X-Forwarded-For</span> header to believe, and that header is
written by whoever connects. Set it higher than your real chain, or above 0 with no
proxy at all, and a visitor can choose which address their own session shows — which
defeats the point of the sessions list.
</span>
</p>
<ul class="ml-6 list-disc space-y-1 text-text-secondary">
<li><strong>0</strong> — no proxy; Minstrel is reached directly.</li>
<li><strong>1</strong> — one reverse proxy, e.g. nginx, Caddy or Traefik terminating TLS.</li>
<li><strong>2</strong> — a CDN in front of your own proxy, e.g. Cloudflare → nginx.</li>
</ul>
</div>
{/if}
</section>
@@ -0,0 +1,106 @@
import { describe, expect, test, vi, beforeEach } from 'vitest';
import { render, screen, fireEvent, waitFor } from '@testing-library/svelte';
import NetworkSettingsCard from './NetworkSettingsCard.svelte';
const getNetworkSettings = vi.fn();
const updateNetworkSettings = vi.fn();
vi.mock('$lib/api/admin', () => ({
getNetworkSettings: () => getNetworkSettings(),
updateNetworkSettings: (hops: number) => updateNetworkSettings(hops)
}));
vi.mock('$lib/stores/toast.svelte', () => ({ pushToast: vi.fn() }));
function settings(over: Record<string, unknown> = {}) {
return {
trusted_proxy_hops: 1,
max_hops: 10,
detected_client_ip: '198.51.100.7',
forwarded_chain: '198.51.100.7',
remote_addr: '172.18.0.1:40000',
...over
};
}
beforeEach(() => {
vi.clearAllMocks();
});
describe('NetworkSettingsCard', () => {
// The detected address is the card's verification affordance — the number
// is abstract, this is checkable against the machine you're sitting at.
test('shows the address the current setting resolves to', async () => {
getNetworkSettings.mockResolvedValue(settings());
render(NetworkSettingsCard);
expect(await screen.findByText('198.51.100.7')).toBeTruthy();
expect(screen.getByText('172.18.0.1:40000')).toBeTruthy();
});
test('save is inert until the value actually changes', async () => {
getNetworkSettings.mockResolvedValue(settings({ trusted_proxy_hops: 1 }));
render(NetworkSettingsCard);
const save = await screen.findByRole('button', { name: /Save/ });
expect(save).toBeDisabled();
const input = screen.getByRole('spinbutton');
await fireEvent.input(input, { target: { value: '2' } });
await waitFor(() => expect(save).not.toBeDisabled());
});
test('saving sends the new depth and adopts the echoed value', async () => {
getNetworkSettings.mockResolvedValue(settings({ trusted_proxy_hops: 1 }));
updateNetworkSettings.mockResolvedValue(
settings({ trusted_proxy_hops: 2, detected_client_ip: '203.0.113.9' })
);
render(NetworkSettingsCard);
const input = await screen.findByRole('spinbutton');
await fireEvent.input(input, { target: { value: '2' } });
await fireEvent.click(screen.getByRole('button', { name: /Save/ }));
await waitFor(() => expect(updateNetworkSettings).toHaveBeenCalledWith(2));
// The recomputed address proves the change took effect on this request.
expect(await screen.findByText('203.0.113.9')).toBeTruthy();
});
// Counting proxies is the operator's job and the hint is how they do it
// without guessing.
test('hints the likely depth when it disagrees with the arriving chain', async () => {
getNetworkSettings.mockResolvedValue(
settings({ trusted_proxy_hops: 1, forwarded_chain: '198.51.100.7, 203.0.113.50' })
);
render(NetworkSettingsCard);
expect(await screen.findByText(/arrived with 2 forwarded addresses/)).toBeTruthy();
});
test('no hint when the setting already matches the chain length', async () => {
getNetworkSettings.mockResolvedValue(
settings({ trusted_proxy_hops: 1, forwarded_chain: '198.51.100.7' })
);
render(NetworkSettingsCard);
await screen.findByText('198.51.100.7');
expect(screen.queryByText(/arrived with/)).toBeNull();
});
test('states the mis-set risk rather than only exposing a number', async () => {
getNetworkSettings.mockResolvedValue(settings());
render(NetworkSettingsCard);
expect(await screen.findByText(/Count your proxies/)).toBeTruthy();
});
test('offers a retry when loading fails', async () => {
getNetworkSettings.mockRejectedValue(new Error('boom'));
render(NetworkSettingsCard);
const retry = await screen.findByRole('button', { name: 'Try again' });
getNetworkSettings.mockResolvedValue(settings());
await fireEvent.click(retry);
await screen.findByText('198.51.100.7');
});
});
@@ -27,6 +27,7 @@
import { errCode } from '$lib/api/errors';
import { pushToast } from '$lib/stores/toast.svelte';
import Modal from '$lib/components/Modal.svelte';
import NetworkSettingsCard from '$lib/components/NetworkSettingsCard.svelte';
import type { LidarrConfig, LidarrTestResult } from '$lib/api/types';
// Lidarr connection panel. The "saved api key" is masked as "***" on GET —
@@ -820,6 +821,12 @@
</button>
</div>
</section>
<!-- Client IP detection. Belongs here rather than in user Settings: it
describes how Minstrel sits behind other infrastructure, same as every
other card on this page, and it's an operator-wide setting rather than
a per-user preference. -->
<NetworkSettingsCard />
</div>
<Modal