mirror of
https://github.com/XTLS/Xray-core.git
synced 2026-10-22 17:24:26 +00:00
94 lines
2.6 KiB
Go
94 lines
2.6 KiB
Go
package http
|
|
|
|
import (
|
|
"context"
|
|
gonet "net"
|
|
"net/http"
|
|
"strconv"
|
|
"strings"
|
|
|
|
"github.com/xtls/xray-core/common/errors"
|
|
"github.com/xtls/xray-core/common/net"
|
|
)
|
|
|
|
func parseXForwardedFor(xff string) []net.Address {
|
|
list := strings.Split(xff, ",")
|
|
addrs := make([]net.Address, 0, len(list))
|
|
for _, proxy := range list {
|
|
addrs = append(addrs, net.ParseAddress(proxy))
|
|
}
|
|
return addrs
|
|
}
|
|
|
|
// ParseTrustedXForwardedFor parses forwarding headers only when a configured trusted header is present.
|
|
func ParseTrustedXForwardedFor(header http.Header, trusted []string, clientAddr gonet.Addr) []net.Address {
|
|
key := "X-Real-IP"
|
|
value := header.Get(key)
|
|
if value == "" {
|
|
key = "X-Forwarded-For"
|
|
value = header.Get(key)
|
|
}
|
|
if value == "" {
|
|
return nil
|
|
}
|
|
for _, t := range trusted {
|
|
if len(header.Values(t)) > 0 {
|
|
if key == "X-Real-IP" {
|
|
return []net.Address{net.ParseAddress(value)}
|
|
}
|
|
return parseXForwardedFor(value)
|
|
}
|
|
}
|
|
if len(trusted) == 0 {
|
|
errors.LogWarning(context.Background(), `received "`, key, `" from `, clientAddr, ` but "sockopt.trustedXForwardedFor" is not configured; ignoring it and using the real remote address`)
|
|
} else {
|
|
errors.LogError(context.Background(), `ignored potentially forged "`, key, `" from `, clientAddr, `: `, value)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// RemoveHopByHopHeaders removes hop by hop headers in http header list.
|
|
func RemoveHopByHopHeaders(header http.Header) {
|
|
// Strip hop-by-hop header based on RFC:
|
|
// http://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html#sec13.5.1
|
|
// https://www.mnot.net/blog/2011/07/11/what_proxies_must_do
|
|
|
|
header.Del("Proxy-Connection")
|
|
header.Del("Proxy-Authenticate")
|
|
header.Del("Proxy-Authorization")
|
|
header.Del("TE")
|
|
header.Del("Trailers")
|
|
header.Del("Transfer-Encoding")
|
|
header.Del("Upgrade")
|
|
|
|
connections := header.Get("Connection")
|
|
header.Del("Connection")
|
|
if connections == "" {
|
|
return
|
|
}
|
|
for _, h := range strings.Split(connections, ",") {
|
|
header.Del(strings.TrimSpace(h))
|
|
}
|
|
}
|
|
|
|
// ParseHost splits host and port from a raw string. Default port is used when raw string doesn't contain port.
|
|
func ParseHost(rawHost string, defaultPort net.Port) (net.Destination, error) {
|
|
port := defaultPort
|
|
host, rawPort, err := net.SplitHostPort(rawHost)
|
|
if err != nil {
|
|
if addrError, ok := err.(*net.AddrError); ok && strings.Contains(addrError.Err, "missing port") {
|
|
host = rawHost
|
|
} else {
|
|
return net.Destination{}, err
|
|
}
|
|
} else if len(rawPort) > 0 {
|
|
intPort, err := strconv.Atoi(rawPort)
|
|
if err != nil {
|
|
return net.Destination{}, err
|
|
}
|
|
port = net.Port(intPort)
|
|
}
|
|
|
|
return net.TCPDestination(net.ParseAddress(host), port), nil
|
|
}
|