Log X-Forwarded-For (or similar) for every request

middleware/source_ips.go

@@ -12,11 +12,8 @@ import (
 
 var (
 	// De-facto standard header keys.
-	xForwardedFor    = http.CanonicalHeaderKey("X-Forwarded-For")
-	xForwardedHost   = http.CanonicalHeaderKey("X-Forwarded-Host")
-	xForwardedProto  = http.CanonicalHeaderKey("X-Forwarded-Proto")
-	xForwardedScheme = http.CanonicalHeaderKey("X-Forwarded-Scheme")
-	xRealIP          = http.CanonicalHeaderKey("X-Real-IP")
+	xForwardedFor = http.CanonicalHeaderKey("X-Forwarded-For")
+	xRealIP       = http.CanonicalHeaderKey("X-Real-IP")
 )
 
 var (
@@ -27,9 +24,6 @@ var (
 	// Allows for a sub-match of the first value after 'for=' to the next
 	// comma, semi-colon or space. The match is case-insensitive.
 	forRegex = regexp.MustCompile(`(?i)(?:for=)([^(;|,| )]+)`)
-	// Allows for a sub-match for the first instance of scheme (http|https)
-	// prefixed by 'proto='. The match is case-insensitive.
-	protoRegex = regexp.MustCompile(`(?i)(?:proto=)(https|http)`)
 )
 
 // SourceIPExtractor extracts the source IPs from a HTTP request
@@ -106,7 +100,7 @@ func (sips SourceIPExtractor) getIP(r *http.Request) string {
 			return ""
 		}
 		allMatches := sips.regex.FindAllStringSubmatch(hdr, 1)
-		if allMatches == nil {
+		if len(allMatches) == 0 {
 			return ""
 		}
 		firstMatch := allMatches[0]
@@ -132,11 +126,11 @@ func (sips SourceIPExtractor) getIP(r *http.Request) string {
 		// X-Real-IP should only contain one IP address (the client making the
 		// request).
 		addr = fwd
-	} else if fwd := r.Header.Get(xForwardedFor); fwd != "" {
+	} else if fwd := strings.ReplaceAll(r.Header.Get(xForwardedFor), " ", ""); fwd != "" {
 		// Only grab the first (client) address. Note that '192.168.0.1,
 		// 10.1.1.1' is a valid key for X-Forwarded-For where addresses after
 		// the first may represent forwarding proxies earlier in the chain.
-		s := strings.Index(fwd, ", ")
+		s := strings.Index(fwd, ",")
 		if s == -1 {
 			s = len(fwd)
 		}

middleware/source_ips_test.go

@@ -77,6 +77,16 @@ func TestGetSourceIPs(t *testing.T) {
 			},
 			want: "172.16.1.1, 192.168.1.100",
 		},
+		{
+			name: "multiple X-Forwarded-For with remote and no spaces",
+			req: &http.Request{
+				RemoteAddr: "192.168.1.100:3454",
+				Header: map[string][]string{
+					http.CanonicalHeaderKey(xForwardedFor): {"172.16.1.1,10.10.13.20,10.11.16.46"},
+				},
+			},
+			want: "172.16.1.1, 192.168.1.100",
+		},
 		{
 			name: "multiple X-Forwarded-For with IPv6 remote",
 			req: &http.Request{

server/server.go

@@ -79,7 +79,7 @@ type Config struct {
 	LogFormat          logging.Format    `yaml:"log_format"`
 	LogLevel           logging.Level     `yaml:"log_level"`
 	Log                logging.Interface `yaml:"-"`
-	LogSourceIPs       bool              `yaml:"log_source_ips"`
+	LogSourceIPs       bool              `yaml:"log_source_ips_enabled"`
 	LogSourceIPsHeader string            `yaml:"log_source_ips_header"`
 	LogSourceIPsRegex  string            `yaml:"log_source_ips_regex"`
 
@@ -123,9 +123,9 @@ func (cfg *Config) RegisterFlags(f *flag.FlagSet) {
 	f.StringVar(&cfg.PathPrefix, "server.path-prefix", "", "Base path to serve all API routes from (e.g. /v1/)")
 	cfg.LogFormat.RegisterFlags(f)
 	cfg.LogLevel.RegisterFlags(f)
-	f.BoolVar(&cfg.LogSourceIPs, "server.log-source-ips", false, "Log the source IPs")
-	f.StringVar(&cfg.LogSourceIPsHeader, "server.log-source-ips-header", "", "Header field storing the source IPs")
-	f.StringVar(&cfg.LogSourceIPsRegex, "server.log-source-ips-regex", "", "Regex for matching the source IPs")
+	f.BoolVar(&cfg.LogSourceIPs, "server.log-source-ips-enabled", false, "Optionally log the source IPs. Default: false")
+	f.StringVar(&cfg.LogSourceIPsHeader, "server.log-source-ips-header", "", "Header field storing the source IPs. Only used if server.log-source-ips-enabled is true. If not set the default Forwarded, X-Real-IP and X-Forwarded-For headers are used")
+	f.StringVar(&cfg.LogSourceIPsRegex, "server.log-source-ips-regex", "", "Regex for matching the source IPs. Only used if server.log-source-ips-enabled is true. If not set the default Forwarded, X-Real-IP and X-Forwarded-For headers are used")
 }
 
 // Server wraps a HTTP and gRPC server, and some common initialization.

server/server_test.go

@@ -375,16 +375,46 @@ func TestTLSServer(t *testing.T) {
 	require.EqualValues(t, &empty, grpcRes)
 }
 
+type FakeLogger struct {
+	sourceIPs string
+}
+
+func (f FakeLogger) Debugf(format string, args ...interface{}) {}
+func (f FakeLogger) Debugln(args ...interface{})               {}
+
+func (f FakeLogger) Infof(format string, args ...interface{}) {}
+func (f FakeLogger) Infoln(args ...interface{})               {}
+
+func (f FakeLogger) Errorf(format string, args ...interface{}) {}
+func (f FakeLogger) Errorln(args ...interface{})               {}
+
+func (f FakeLogger) Warnf(format string, args ...interface{}) {}
+func (f FakeLogger) Warnln(args ...interface{})               {}
+
+func (f *FakeLogger) WithField(key string, value interface{}) logging.Interface {
+	if key == "sourceIPs" {
+		f.sourceIPs = value.(string)
+	}
+
+	return f
+}
+
+func (f *FakeLogger) WithFields(fields logging.Fields) logging.Interface {
+	return f
+}
+
 func TestLogSourceIPs(t *testing.T) {
 	var level logging.Level
 	level.Set("debug")
+	fake := FakeLogger{}
 	cfg := Config{
 		HTTPListenAddress: "localhost",
 		HTTPListenPort:    9195,
 		GRPCListenAddress: "localhost",
 		HTTPMiddleware:    []middleware.Interface{middleware.Logging},
 		MetricsNamespace:  "testing_mux",
 		LogLevel:          level,
+		Log:               &fake,
 		LogSourceIPs:      true,
 	}
 	server, err := New(cfg)
@@ -397,9 +427,13 @@ func TestLogSourceIPs(t *testing.T) {
 	go server.Run()
 	defer server.Shutdown()
 
+	require.Empty(t, fake.sourceIPs)
+
 	req, err := http.NewRequest("GET", "http://127.0.0.1:9195/error500", nil)
 	require.NoError(t, err)
 	http.DefaultClient.Do(req)
+
+	require.NotEmpty(t, fake.sourceIPs)
 }
 
 func TestStopWithDisabledSignalHandling(t *testing.T) {