rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Accept CIDR ranges in proxy trusted-proxies configuration

Browse Source 
The HTTP middleware and proxy-protocol listeners both pinned trust
to exact IPs, which forced re-applying terraform every time AWS
rotated an ALB or NLB ENI. Trusted-proxies entries now accept CIDR
ranges in addition to plain IPs, so callers can trust whole subnets
(where the load balancer ENIs always live) and stop chasing
rotating IPs.

The HTTP middleware splits parsed entries into IPs and IPNets and
checks both. The proxy-protocol listeners switch from
TrustProxyHeaderFrom (IP-only, REJECT) to ConnStrictWhiteListPolicy
(IP or CIDR, REJECT) which preserves the existing reject-on-unknown
semantics.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>
This commit is contained in:
Bryan Frimin
2026-05-05 09:14:35 +02:00
parent f83b8ee3ca
commit 64e1a813fb
3 changed files with 208 additions and 123 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
pkg/probod/probod.go
View File

@@ -778,8 +778,12 @@ func (impl *Implm) runApiServer(
ctx, span := tracer.Start(ctx, "probod.runApiServer")
defer span.End()
trustedProxies := parseIPs(impl.cfg.Api.ProxyProtocol.TrustedProxies)
handler = trustedproxy.NewMiddleware(trustedProxies)(handler)
trustedProxyMiddleware, err := trustedproxy.NewMiddleware(impl.cfg.Api.ProxyProtocol.TrustedProxies)
if err != nil {
span.RecordError(err)
return fmt.Errorf("cannot build trusted proxy middleware: %w", err)
}
handler = trustedProxyMiddleware(handler)
apiServer := httpserver.NewServer(
impl.cfg.Api.Addr,
@@ -799,7 +803,11 @@ func (impl *Implm) runApiServer(
}
if len(impl.cfg.Api.ProxyProtocol.TrustedProxies) > 0 {
policy := proxyproto.TrustProxyHeaderFrom(parseIPs(impl.cfg.Api.ProxyProtocol.TrustedProxies)...)
policy, err := proxyproto.ConnStrictWhiteListPolicy(impl.cfg.Api.ProxyProtocol.TrustedProxies)
if err != nil {
span.RecordError(err)
return fmt.Errorf("cannot build proxy protocol policy: %w", err)
}
listener = &proxyproto.Listener{
Listener: listener,
@@ -972,7 +980,10 @@ func (impl *Implm) runTrustCenterServer(
defer func() { _ = listener.Close() }()
if len(impl.cfg.TrustCenter.ProxyProtocol.TrustedProxies) > 0 {
policy := proxyproto.TrustProxyHeaderFrom(parseIPs(impl.cfg.TrustCenter.ProxyProtocol.TrustedProxies)...)
policy, err := proxyproto.ConnStrictWhiteListPolicy(impl.cfg.TrustCenter.ProxyProtocol.TrustedProxies)
if err != nil {
return fmt.Errorf("cannot build proxy protocol policy: %w", err)
}
listener = &proxyproto.Listener{
Listener: listener,
@@ -1057,7 +1068,10 @@ func (impl *Implm) runTrustCenterServer(
defer func() { _ = listener.Close() }()
if len(impl.cfg.TrustCenter.ProxyProtocol.TrustedProxies) > 0 {
policy := proxyproto.TrustProxyHeaderFrom(parseIPs(impl.cfg.TrustCenter.ProxyProtocol.TrustedProxies)...)
policy, err := proxyproto.ConnStrictWhiteListPolicy(impl.cfg.TrustCenter.ProxyProtocol.TrustedProxies)
if err != nil {
return fmt.Errorf("cannot build proxy protocol policy: %w", err)
}
listener = &proxyproto.Listener{
Listener: listener,
@@ -1109,18 +1123,6 @@ func (impl *Implm) runTrustCenterServer(
return ctx.Err()
}
// parseIPs converts a slice of string IP addresses to net.IP.
// Invalid IPs are skipped.
func parseIPs(strs []string) []net.IP {
ips := make([]net.IP, 0, len(strs))
for _, s := range strs {
if ip := net.ParseIP(s); ip != nil {
ips = append(ips, ip)
}
}
return ips
}
func oauth2ServerOptions(cfg OAuth2ServerConfig) []oauth2server.Option {
var opts []oauth2server.Option