Function TestProxy_trustedProxies

proxy/serverhttps_internal_test.go:72–129

(t *testing.T)

}

func TestProxy_trustedProxies(t *testing.T) {
	var (
		clientAddr = netip.MustParseAddr("1.2.3.4")
		proxyAddr  = netip.MustParseAddr("127.0.0.1")
	)

	doRequest := func(t *testing.T, addr, expectedClientIP netip.Addr) {
		var gotAddr netip.Addr
		reqHandler := &TestHandler{
			OnHandle: func(ctx context.Context, p *Proxy, d *DNSContext) (err error) {
				gotAddr = d.Addr.Addr()

				return p.Resolve(ctx, d)
			},
		}

		// Prepare the proxy server.
		tlsConf, caPem := newTLSConfig(t)
		httpConf := &HTTPConfig{
			ListenAddresses: []netip.AddrPort{localhostAnyPort},
		}
		dnsProxy := mustNew(t, &Config{
			Logger:         testLogger,
			UpstreamConfig: newTestUpstreamConfig(t, defaultTimeout, testDefaultUpstreamAddr),
			TrustedProxies: defaultTrustedProxies,
			RequestHandler: reqHandler,
			TLSConfig:      tlsConf,
			TLSListenAddr:  []*net.TCPAddr{net.TCPAddrFromAddrPort(localhostAnyPort)},
			QUICListenAddr: []*net.UDPAddr{net.UDPAddrFromAddrPort(localhostAnyPort)},
			HTTPConfig:     httpConf,
		})

		client := createTestHTTPClient(dnsProxy, caPem, false)

		msg := newTestMessage()

		dnsProxy.TrustedProxies = netip.PrefixFrom(addr, addr.BitLen())

		servicetest.RequireRun(t, dnsProxy, testTimeout)

		hdrs := map[string]string{
			"X-Forwarded-For": strings.Join([]string{clientAddr.String(), proxyAddr.String()}, ","),
		}

		resp := sendTestDoHMessage(t, client, msg, hdrs)
		requireResponse(t, msg, resp)

		require.Equal(t, expectedClientIP, gotAddr)
	}

	t.Run("success", func(t *testing.T) {
		doRequest(t, proxyAddr, clientAddr)
	})

	t.Run("not_in_trusted", func(t *testing.T) {
		doRequest(t, netip.MustParseAddr("127.0.0.2"), proxyAddr)
	})
}