diff --git a/.changeset/fix-tcp-regression-connect-pass-through.md b/.changeset/fix-tcp-regression-connect-pass-through.md new file mode 100644 index 000000000000..c462ba6f23f0 --- /dev/null +++ b/.changeset/fix-tcp-regression-connect-pass-through.md @@ -0,0 +1,6 @@ +--- +"miniflare": patch +"wrangler": patch +--- + +Strip the `CF-Connecting-IP` header from outgoing fetches diff --git a/packages/miniflare/src/plugins/core/index.ts b/packages/miniflare/src/plugins/core/index.ts index f2202981b0b5..7227ce3c6902 100644 --- a/packages/miniflare/src/plugins/core/index.ts +++ b/packages/miniflare/src/plugins/core/index.ts @@ -165,9 +165,7 @@ const CoreOptionsSchemaInput = z.intersection( tails: z.array(ServiceDesignatorSchema).optional(), // Strip the CF-Connecting-IP header from outbound fetches - // There is an issue with the connect() API and the globalOutbound workerd setting that impacts TCP ingress - // We should default it to true once https://github.com/cloudflare/workerd/pull/4145 is resolved - stripCfConnectingIp: z.boolean().default(false), + stripCfConnectingIp: z.boolean().default(true), }) ); export const CoreOptionsSchema = CoreOptionsSchemaInput.transform((value) => { @@ -839,6 +837,7 @@ export const CORE_PLUGIN: Plugin< }, ], compatibilityDate: "2025-01-01", + compatibilityFlags: ["connect_pass_through", "experimental"], globalOutbound: getGlobalOutbound(workerIndex, options), }, }); diff --git a/packages/miniflare/test/index.spec.ts b/packages/miniflare/test/index.spec.ts index 410de91274a7..1c2376861ff7 100644 --- a/packages/miniflare/test/index.spec.ts +++ b/packages/miniflare/test/index.spec.ts @@ -3035,7 +3035,6 @@ test("Miniflare: strips CF-Connecting-IP", async (t) => { const client = new Miniflare({ script: `export default { fetch(request) { return fetch('${serverUrl.href}', {headers: {"CF-Connecting-IP":"fake-value"}}) } }`, modules: true, - stripCfConnectingIp: true, }); t.teardown(() => client.dispose()); t.teardown(() => server.dispose()); diff --git a/packages/unenv-preset/package.json b/packages/unenv-preset/package.json index 78a3fb2f47f5..07fa6b160a3d 100644 --- a/packages/unenv-preset/package.json +++ b/packages/unenv-preset/package.json @@ -54,7 +54,7 @@ }, "peerDependencies": { "unenv": "2.0.0-rc.17", - "workerd": "^1.20250508.0" + "workerd": "^1.20250521.0" }, "peerDependenciesMeta": { "workerd": { diff --git a/packages/wrangler/src/__tests__/api/startDevWorker/startWorker.test.ts b/packages/wrangler/src/__tests__/api/startDevWorker/startWorker.test.ts deleted file mode 100644 index 88cc48988950..000000000000 --- a/packages/wrangler/src/__tests__/api/startDevWorker/startWorker.test.ts +++ /dev/null @@ -1,60 +0,0 @@ -import http from "node:http"; -import path from "node:path"; -import dedent from "ts-dedent"; -import { startWorker } from "../../../api/startDevWorker"; -import { runInTempDir } from "../../helpers/run-in-tmp"; -import { seed } from "../../helpers/seed"; - -describe("startWorker", () => { - runInTempDir(); - - // We do not inject the `CF-Connecting-IP` header on Windows at the moment. - // See https://github.com/cloudflare/workerd/issues/3310 - it.skipIf(process.platform === "win32")( - "strips the CF-Connecting-IP header from all outbound requests", - async (t) => { - const server = http.createServer((req, res) => { - res.writeHead(200); - res.end( - req.headers["cf-connecting-ip"] ?? "CF-Connecting-IP header stripped" - ); - }); - - t.onTestFinished(() => { - server.close(); - }); - - const address = server.listen(0).address(); - - if (address === null || typeof address === "string") { - expect.fail("Failed to get server address"); - } - - await seed({ - "src/index.ts": dedent` - export default { - fetch(request) { - if (request.headers.has('CF-Connecting-IP')) { - return fetch(request); - } - - return new Response("No CF-Connecting-IP header"); - } - } - `, - }); - - const worker = await startWorker({ - name: "test-worker", - entrypoint: path.resolve("src/index.ts"), - }); - - t.onTestFinished(() => worker.dispose()); - - const response = await worker.fetch(`http://127.0.0.1:${address.port}`); - await expect(response.text()).resolves.toEqual( - "CF-Connecting-IP header stripped" - ); - } - ); -}); diff --git a/packages/wrangler/src/deployment-bundle/bundle.ts b/packages/wrangler/src/deployment-bundle/bundle.ts index 5a0b289d4f67..72e8ebb79d40 100644 --- a/packages/wrangler/src/deployment-bundle/bundle.ts +++ b/packages/wrangler/src/deployment-bundle/bundle.ts @@ -261,32 +261,6 @@ export async function bundleWorker( inject.push(checkedFetchFileToInject); } - // We injected the `CF-Connecting-IP` header in the entry worker on Miniflare. - // It used to be stripped by Miniflare, but that caused TCP ingress failures - // because of the global outbound setup. This is a temporary workaround until - // a proper fix is landed in Workerd. - // See https://github.com/cloudflare/workers-sdk/issues/9238 for more details. - if (targetConsumer === "dev" && local) { - const stripCfConnectingIpHeaderFileToInject = path.join( - tmpDir.path, - "strip-cf-connecting-ip-header.js" - ); - - if (!fs.existsSync(stripCfConnectingIpHeaderFileToInject)) { - fs.writeFileSync( - stripCfConnectingIpHeaderFileToInject, - fs.readFileSync( - path.resolve( - getBasePath(), - "templates/strip-cf-connecting-ip-header.js" - ) - ) - ); - } - - inject.push(stripCfConnectingIpHeaderFileToInject); - } - // When multiple workers are running we need some way to disambiguate logs between them. Inject a patched version of `globalThis.console` that prefixes logs with the worker name if (getFlag("MULTIWORKER")) { middlewareToLoad.push({ diff --git a/packages/wrangler/templates/strip-cf-connecting-ip-header.js b/packages/wrangler/templates/strip-cf-connecting-ip-header.js deleted file mode 100644 index a011710ccf80..000000000000 --- a/packages/wrangler/templates/strip-cf-connecting-ip-header.js +++ /dev/null @@ -1,13 +0,0 @@ -function stripCfConnectingIPHeader(input, init) { - const request = new Request(input, init); - request.headers.delete("CF-Connecting-IP"); - return request; -} - -globalThis.fetch = new Proxy(globalThis.fetch, { - apply(target, thisArg, argArray) { - return Reflect.apply(target, thisArg, [ - stripCfConnectingIPHeader.apply(null, argArray), - ]); - }, -}); diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 32217a7993bc..69b528ec09e7 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -2011,8 +2011,8 @@ importers: specifier: 2.0.0-rc.17 version: 2.0.0-rc.17 workerd: - specifier: ^1.20250508.0 - version: 1.20250508.0 + specifier: ^1.20250521.0 + version: 1.20250612.0 devDependencies: '@types/node-unenv': specifier: npm:@types/node@^22.14.0 @@ -2037,7 +2037,7 @@ importers: dependencies: '@cloudflare/unenv-preset': specifier: 2.3.3 - version: 2.3.3(unenv@2.0.0-rc.17)(workerd@1.20250604.0) + version: 2.3.3(unenv@2.0.0-rc.17)(workerd@1.20250612.0) '@mjackson/node-fetch-server': specifier: ^0.6.1 version: 0.6.1 @@ -3336,7 +3336,7 @@ importers: version: link:../kv-asset-handler '@cloudflare/unenv-preset': specifier: 2.3.3 - version: 2.3.3(unenv@2.0.0-rc.17)(workerd@1.20250604.0) + version: 2.3.3(unenv@2.0.0-rc.17)(workerd@1.20250612.0) blake3-wasm: specifier: 2.1.5 version: 2.1.5 @@ -4255,12 +4255,6 @@ packages: cpu: [x64] os: [darwin] - '@cloudflare/workerd-darwin-64@1.20250508.0': - resolution: {integrity: sha512-9x09MrA9Y5RQs3zqWvWns8xHgM2pVNXWpeJ+3hQYu4PrwPFZXtTD6b/iMmOnlYKzINlREq1RGeEybMFyWEUlUg==} - engines: {node: '>=16'} - cpu: [x64] - os: [darwin] - '@cloudflare/workerd-darwin-64@1.20250612.0': resolution: {integrity: sha512-IpL/tOvNY04n2hvp/XGdOGjeMDycEjbwJL8gJ0kenBFBa13EE82I61ceA56kuCiEdb1vBv3O+xiD9zN6AuQlmQ==} engines: {node: '>=16'} @@ -4279,12 +4273,6 @@ packages: cpu: [arm64] os: [darwin] - '@cloudflare/workerd-darwin-arm64@1.20250508.0': - resolution: {integrity: sha512-0Ili+nE2LLRzYue/yPc1pepSyNNg6LxR3/ng/rlQzVQUxPXIXldHFkJ/ynsYwQnAcf6OxasSi/kbTm6yvDoSAQ==} - engines: {node: '>=16'} - cpu: [arm64] - os: [darwin] - '@cloudflare/workerd-darwin-arm64@1.20250612.0': resolution: {integrity: sha512-Hb9GWzLT4ydBYfGE29jxZFkx58NEA+oRMuGP358A6PUZ9UEDYWTDhskVQovhjELZMgOppUYXN2v/Je3sO1anpg==} engines: {node: '>=16'} @@ -4303,12 +4291,6 @@ packages: cpu: [x64] os: [linux] - '@cloudflare/workerd-linux-64@1.20250508.0': - resolution: {integrity: sha512-5saVrZ3uVwYxvBa7BaonXjeqB6X0YF3ak05qvBaWcmZ3FNmnarMm2W8842cnbhnckDVBpB/iDo51Sy6Y7y1jcw==} - engines: {node: '>=16'} - cpu: [x64] - os: [linux] - '@cloudflare/workerd-linux-64@1.20250612.0': resolution: {integrity: sha512-7kOA1sCfl9m2osolplDM9XqyBPf5KupvDs4UbD2kQq0zfd+u6acLz/YB9Q5tsVQIyhQoP32Oe+kr6IZJBImq9A==} engines: {node: '>=16'} @@ -4327,12 +4309,6 @@ packages: cpu: [arm64] os: [linux] - '@cloudflare/workerd-linux-arm64@1.20250508.0': - resolution: {integrity: sha512-muQe1pkxRi3eaq1Q417xvfGd2SlktbLTzNhT5Yftsx8OecWrYuB8i4ttR6Nr5ER06bfEj0FqQjqJJhcp6wLLUQ==} - engines: {node: '>=16'} - cpu: [arm64] - os: [linux] - '@cloudflare/workerd-linux-arm64@1.20250612.0': resolution: {integrity: sha512-x2UsZhfacZftD/kpDE2mtAlrLZPmkwRInFHJc7uIl8mvovQqVKMBkexH7dkfrgvBV98S2hOjxqFKP9mETuQQAQ==} engines: {node: '>=16'} @@ -4351,12 +4327,6 @@ packages: cpu: [x64] os: [win32] - '@cloudflare/workerd-windows-64@1.20250508.0': - resolution: {integrity: sha512-EJj8iTWFMqjgvZUxxNvzK7frA1JMFi3y/9eDIdZPL/OaQh3cmk5Lai5DCXsKYUxfooMBZWYTp53zOLrvuJI8VQ==} - engines: {node: '>=16'} - cpu: [x64] - os: [win32] - '@cloudflare/workerd-windows-64@1.20250612.0': resolution: {integrity: sha512-CeYe4OM5doIVGsOtrmDTrIBV2/wa/SPREEXH/N7ZCEs7mRhsTNFOwmctC0CYe3ZiutJ02dJmmyh/CIij2mkOLQ==} engines: {node: '>=16'} @@ -7830,15 +7800,6 @@ packages: typescript: optional: true - capnp-es@0.0.7: - resolution: {integrity: sha512-gjDJBgNbdPA2PilGjAixf5op2HTI7jaBGc5Gs0zrAjfG9/6hqPwjTIC7dGPxrU4Y0a3WnzX1I5r/XUa9jVRSWw==} - hasBin: true - peerDependencies: - typescript: ^5.7.3 - peerDependenciesMeta: - typescript: - optional: true - caseless@0.12.0: resolution: {integrity: sha512-4tYFyifaFfGacoiObjJegolkwSU4xQNGbVgUiNYVUxbQ2x2lUsFvY4hVgVzGiIe6WLOPqycWXA40l+PWsxthUw==} @@ -12923,11 +12884,6 @@ packages: engines: {node: '>=16'} hasBin: true - workerd@1.20250508.0: - resolution: {integrity: sha512-ffLxe7dXSuGoA6jb3Qx2SClIV1aLHfJQ6RhGhzYHjQgv7dL6fdUOSIIGgzmu2mRKs+WFSujp6c8WgKquco6w3w==} - engines: {node: '>=16'} - hasBin: true - workerd@1.20250612.0: resolution: {integrity: sha512-YWCjj4uZf3eH32epQy/c7tKWOInAswgFRAJoH6I/EY08OJKDfoJtKvRZj5f675KoJlKTPAoJ1ig/oE+RUKP3uw==} engines: {node: '>=16'} @@ -14281,7 +14237,7 @@ snapshots: optionalDependencies: workerd: 1.20250417.0 - '@cloudflare/unenv-preset@2.3.3(unenv@2.0.0-rc.17)(workerd@1.20250604.0)': + '@cloudflare/unenv-preset@2.3.3(unenv@2.0.0-rc.17)(workerd@1.20250612.0)': dependencies: unenv: 2.0.0-rc.17 optionalDependencies: @@ -14343,9 +14299,6 @@ snapshots: '@cloudflare/workerd-darwin-64@1.20250417.0': optional: true - '@cloudflare/workerd-darwin-64@1.20250508.0': - optional: true - '@cloudflare/workerd-darwin-64@1.20250612.0': optional: true @@ -14355,9 +14308,6 @@ snapshots: '@cloudflare/workerd-darwin-arm64@1.20250417.0': optional: true - '@cloudflare/workerd-darwin-arm64@1.20250508.0': - optional: true - '@cloudflare/workerd-darwin-arm64@1.20250612.0': optional: true @@ -14367,9 +14317,6 @@ snapshots: '@cloudflare/workerd-linux-64@1.20250417.0': optional: true - '@cloudflare/workerd-linux-64@1.20250508.0': - optional: true - '@cloudflare/workerd-linux-64@1.20250612.0': optional: true @@ -14379,9 +14326,6 @@ snapshots: '@cloudflare/workerd-linux-arm64@1.20250417.0': optional: true - '@cloudflare/workerd-linux-arm64@1.20250508.0': - optional: true - '@cloudflare/workerd-linux-arm64@1.20250612.0': optional: true @@ -14391,9 +14335,6 @@ snapshots: '@cloudflare/workerd-windows-64@1.20250417.0': optional: true - '@cloudflare/workerd-windows-64@1.20250508.0': - optional: true - '@cloudflare/workerd-windows-64@1.20250612.0': optional: true @@ -18011,10 +17952,6 @@ snapshots: optionalDependencies: typescript: 5.7.3 - capnp-es@0.0.7(typescript@5.7.3): - optionalDependencies: - typescript: 5.7.3 - caseless@0.12.0: {} cbor@9.0.2: @@ -23639,14 +23576,6 @@ snapshots: '@cloudflare/workerd-linux-arm64': 1.20250417.0 '@cloudflare/workerd-windows-64': 1.20250417.0 - workerd@1.20250508.0: - optionalDependencies: - '@cloudflare/workerd-darwin-64': 1.20250508.0 - '@cloudflare/workerd-darwin-arm64': 1.20250508.0 - '@cloudflare/workerd-linux-64': 1.20250508.0 - '@cloudflare/workerd-linux-arm64': 1.20250508.0 - '@cloudflare/workerd-windows-64': 1.20250508.0 - workerd@1.20250612.0: optionalDependencies: '@cloudflare/workerd-darwin-64': 1.20250612.0