Method intercept

pkg/rpcmiddleware/proxy_headers.go:105–142

(ctx context.Context)

}

func (h *ProxyHeaders) intercept(ctx context.Context) (context.Context, metadata.MD) {
	md, _ := metadata.FromIncomingContext(ctx)

	p, ok := peer.FromContext(ctx)
	if !ok {
		// The gRPC server should always set this.
		panic(fmt.Errorf("no peer in gRPC context"))
	}
	remoteAddr := p.Addr.String()
	if remoteAddr == "pipe" {
		remoteAddr = "127.0.0.0:0"
	}
	remoteIP, _, err := net.SplitHostPort(remoteAddr)
	if err != nil {
		// Either the gRPC server should have set the peer address to "IP:port"
		// or we have converted the pipe address to localhost above.
		panic(fmt.Errorf("invalid peer %q in gRPC context: %w", remoteAddr, err))
	}
	if h.trustedIP(net.ParseIP(remoteIP)) {
		// We trust the proxy, so we parse the headers if present.
		forwardedFor, _, _ := parseForwardedHeaders(getLastFromMD(md)) // ignore forwardedScheme and forwardedHost.
		if forwardedFor != "" {
			md.Set(headerXRealIP, strings.TrimSpace(strings.Split(forwardedFor, ",")[0]))
		}
		if cert, ok, err := mtls.FromProxyHeaders(getLastFromMD(md)); err != nil {
			log.FromContext(ctx).WithError(err).Warn("Failed to parse client certificate from proxy headers")
		} else if ok {
			ctx = mtls.NewContextWithClientCertificate(ctx, cert)
		}
	} else {
		// We don't trust the proxy, remove its headers.
		for _, header := range proxyHeaders {
			delete(md, header)
		}
		md.Set(headerXRealIP, remoteIP)
	}
	return ctx, md
}

type getLastFromMD metadata.MD