fix: only trust forwarded IP header from configured trusted proxies

Author: kanishka0411

CONFIGURATION.md

@@ -73,6 +73,7 @@ Running `nostream` for the first time creates the settings file in `<project_roo
 | info.contact                                | Relay operator's contact. (e.g. mailto:operator@relay-your-domain.com) |
 | network.maxPayloadSize                      | Maximum number of bytes accepted per WebSocket frame |
 | network.remoteIpHeader                      | HTTP header from proxy containing IP address from client. |
+| network.trustedProxies                      | Optional allow-list of proxy IPs allowed to set `network.remoteIpHeader`; otherwise socket remote IP is used. |
 | payments.enabled                            | Enabled payments. Defaults to false. |
 | payments.processor                          | Either `zebedee`, `lnbits`, `lnurl`. |
 | payments.feeSchedules.admission[].enabled   | Enables admission fee. Defaults to false. |
@@ -119,4 +120,4 @@ Running `nostream` for the first time creates the settings file in `<project_roo
 | limits.message.ipWhitelist                  | List of IPs (IPv4 or IPv6) to ignore rate limits. |
 | limits.admissionCheck.rateLimits[].period          | Rate limit period in milliseconds. |
 | limits.admissionCheck.rateLimits[].rate            | Maximum number of admission checks during period. |
-| limits.admissionCheck.ipWhitelist                  | List of IPs (IPv4 or IPv6) to ignore rate limits. |
+| limits.admissionCheck.ipWhitelist                  | List of IPs (IPv4 or IPv6) to ignore rate limits. |

resources/default-settings.yaml

@@ -39,6 +39,8 @@ network:
   maxPayloadSize: 524288
   # Comment the next line if using CloudFlare proxy
   remoteIpHeader: x-forwarded-for
+  # Optional: only trust forwarding headers from these proxy IPs
+  trustedProxies: []
   # Uncomment the next line if using CloudFlare proxy
   # remoteIpHeader: cf-connecting-ip
 workers:

src/@types/settings.ts

@@ -14,6 +14,7 @@ export interface Info {
 export interface Network {
   maxPayloadSize?: number
   remoteIpHeader?: string
+  trustedProxies?: string[]
 }
 
 export interface RateLimit {

src/utils/http.ts

@@ -2,6 +2,28 @@ import { IncomingMessage } from 'http'
 
 import { Settings } from '../@types/settings'
 
+const normalizeIpAddress = (input: string): string => {
+  if (input.startsWith('::ffff:')) {
+    return input.slice(7)
+  }
+
+  return input
+}
+
+const isTrustedProxy = (ipAddress: string, settings: Settings): boolean => {
+  const trustedProxies = settings.network?.trustedProxies
+
+  if (!Array.isArray(trustedProxies) || trustedProxies.length === 0) {
+    return false
+  }
+
+  const normalizedRemote = normalizeIpAddress(ipAddress)
+
+  return trustedProxies.some((trustedProxy) => {
+    return normalizeIpAddress(trustedProxy) === normalizedRemote
+  })
+}
+
 export const getRemoteAddress = (request: IncomingMessage, settings: Settings): string => {
   let header: string | undefined
   // TODO: Remove deprecation warning
@@ -13,7 +35,22 @@ export const getRemoteAddress = (request: IncomingMessage, settings: Settings):
     header = settings.network.remoteIpHeader as string
   }
 
-  const result = (request.headers[header] ?? request.socket.remoteAddress) as string
+  const trustedProxies = settings.network?.trustedProxies
+  if (header && (!Array.isArray(trustedProxies) || trustedProxies.length === 0)) {
+    console.warn('WARNING: network.remoteIpHeader is set but network.trustedProxies is empty. Forwarded headers will be ignored. Add your proxy IP to network.trustedProxies.')
+  }
+
+  const headerAddress = header
+    ? request.headers[header]
+    : undefined
+  const socketAddress = request.socket.remoteAddress
+
+  const trustedProxy = typeof socketAddress === 'string'
+    && isTrustedProxy(socketAddress, settings)
+
+  const result = trustedProxy && typeof headerAddress === 'string'
+    ? headerAddress
+    : socketAddress
 
-  return result.split(',')[0]
+  return (result as string).split(',')[0].trim()
 }

test/unit/utils/http.spec.ts

@@ -25,7 +25,7 @@ describe('getRemoteAddress', () => {
     expect(
       getRemoteAddress(
         request,
-        { network: { 'remote_ip_header': header } } as any,
+        { network: { 'remote_ip_header': header, trustedProxies: [socketAddress] } } as any,
       )
     ).to.equal(address)
   })
@@ -34,7 +34,32 @@ describe('getRemoteAddress', () => {
     expect(
       getRemoteAddress(
         request,
-        { network: { remoteIpHeader: header } } as any,
+        { network: { remoteIpHeader: header, trustedProxies: [socketAddress] } } as any,
+      )
+    ).to.equal(address)
+  })
+
+  it('returns socket address when proxy is not trusted', () => {
+    expect(
+      getRemoteAddress(
+        request,
+        { network: { remoteIpHeader: header, trustedProxies: ['1.1.1.1'] } } as any,
+      )
+    ).to.equal(socketAddress)
+  })
+
+  it('normalizes ipv4-mapped trusted proxy addresses', () => {
+    expect(
+      getRemoteAddress(
+        {
+          headers: {
+            [header]: address,
+          },
+          socket: {
+            remoteAddress: '::ffff:127.0.0.1',
+          },
+        } as any,
+        { network: { remoteIpHeader: header, trustedProxies: ['127.0.0.1'] } } as any,
       )
     ).to.equal(address)
   })