fix(wolf-rbac): use trusted client IP source for access_check#13329
Open
shreemaan-abhishek wants to merge 2 commits intoapache:masterfrom
Open
fix(wolf-rbac): use trusted client IP source for access_check#13329shreemaan-abhishek wants to merge 2 commits intoapache:masterfrom
shreemaan-abhishek wants to merge 2 commits intoapache:masterfrom
Conversation
The plugin previously read the raw `X-Real-IP` request header to populate the `clientIP` parameter sent to wolf-server, falling back to `core.request.get_ip` only if the header was absent. Reading the raw header bypasses nginx's `real_ip` module, so any client could supply an arbitrary value regardless of the configured `real_ip_from` trusted proxy chain. Switch to `core.request.get_remote_client_ip`, which returns `$remote_addr` after `real_ip` processing — both correct when APISIX is behind a trusted proxy and unspoofable from untrusted sources.
dosubot
Bot
added
size:XS
Add regression coverage for the IP source change in wolf-rbac: - Mock wolf-server now logs the `clientIP` query arg it receives, so tests can assert what the plugin forwarded. - TEST 41: when the source is in `set_real_ip_from`, an `X-Real-IP` header is honored and forwarded to wolf-server. - TEST 42: when the source is NOT in `set_real_ip_from`, a spoofed `X-Real-IP` is ignored and the actual peer address is forwarded.
dosubot
Bot
added
size:M
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The wolf-rbac plugin populates the
clientIPparameter sent to wolf-server's/wolf/rbac/access_checkendpoint by readingctx.var.http_x_real_ip, the rawX-Real-IPrequest header. This bypasses nginx'sreal_ipmodule: even though APISIX configuresreal_ip_from = { "127.0.0.1", "unix:" }by default — meaning nginx correctly rejectsX-Real-IPfrom untrusted sources when computing$remote_addr— the plugin reads the original header directly, so any external client can supply an arbitraryclientIPvalue.This change replaces the raw-header read with
core.request.get_remote_client_ip(ctx), which returns$remote_addrafterreal_ipprocessing. The new behavior is:real_ip_from): forwards the real client IP from the trusted header — same behavior the previous code intended.Which issue(s) this PR fixes:
Fixes #
Checklist