Golang笔记-10-X-Forwarded-For

1X-Forwarded-For: clientIP
2X-Forwarded-For: clientIP,proxy-1
3X-Forwarded-For: clientIP,proxy-1,proxy-2
4X-Forwarded-For: clientIP,proxy-1,proxy-2,proxy-3

 1// New returns a new blank Engine instance without any middleware attached.
 2// By default the configuration is:
 3// - RedirectTrailingSlash:  true
 4// - RedirectFixedPath:      false
 5// - HandleMethodNotAllowed: false
 6// - ForwardedByClientIP:    true
 7// - UseRawPath:             false
 8// - UnescapePathValues:     true
 9func New() *Engine {
10	debugPrintWARNINGNew()
11	engine := &Engine{
12		RouterGroup: RouterGroup{
13			Handlers: nil,
14			basePath: "/",
15			root:     true,
16		},
17		FuncMap:                template.FuncMap{},
18		RedirectTrailingSlash:  true,
19		RedirectFixedPath:      false,
20		HandleMethodNotAllowed: false,
21		ForwardedByClientIP:    true,
22		RemoteIPHeaders:        []string{"X-Forwarded-For", "X-Real-IP"},
23		TrustedPlatform:        defaultPlatform,
24		UseRawPath:             false,
25		RemoveExtraSlash:       false,
26		UnescapePathValues:     true,
27		MaxMultipartMemory:     defaultMultipartMemory,
28		trees:                  make(methodTrees, 0, 9),
29		delims:                 render.Delims{Left: "{{", Right: "}}"},
30		secureJSONPrefix:       "while(1);",
31		trustedProxies:         []string{"0.0.0.0/0"},
32		trustedCIDRs:           defaultTrustedCIDRs,
33	}
34	engine.RouterGroup.engine = engine
35	engine.pool.New = func() interface{} {
36		return engine.allocateContext()
37	}
38	return engine
39}

 1// ClientIP implements one best effort algorithm to return the real client IP.
 2// It called c.RemoteIP() under the hood, to check if the remote IP is a trusted proxy or not.
 3// If it is it will then try to parse the headers defined in Engine.RemoteIPHeaders (defaulting to [X-Forwarded-For, X-Real-Ip]).
 4// If the headers are not syntactically valid OR the remote IP does not correspond to a trusted proxy,
 5// the remote IP (coming form Request.RemoteAddr) is returned.
 6func (c *Context) ClientIP() string {
 7	// Check if we're running on a trusted platform, continue running backwards if error
 8	if c.engine.TrustedPlatform != "" {
 9		// Developers can define their own header of Trusted Platform or use predefined constants
10		if addr := c.requestHeader(c.engine.TrustedPlatform); addr != "" {
11			return addr
12		}
13	}
14
15	// Legacy "AppEngine" flag
16	if c.engine.AppEngine {
17		log.Println(`The AppEngine flag is going to be deprecated. Please check issues #2723 and #2739 and use 'TrustedPlatform: gin.PlatformGoogleAppEngine' instead.`)
18		if addr := c.requestHeader("X-Appengine-Remote-Addr"); addr != "" {
19			return addr
20		}
21	}
22
23	remoteIP, trusted := c.RemoteIP()
24	if remoteIP == nil {
25		return ""
26	}
27
28	if trusted && c.engine.ForwardedByClientIP && c.engine.RemoteIPHeaders != nil {
29		for _, headerName := range c.engine.RemoteIPHeaders {
30			ip, valid := c.engine.validateHeader(c.requestHeader(headerName))
31			if valid {
32				return ip
33			}
34		}
35	}
36	return remoteIP.String()
37}
38
39// RemoteIP parses the IP from Request.RemoteAddr, normalizes and returns the IP (without the port).
40// It also checks if the remoteIP is a trusted proxy or not.
41// In order to perform this validation, it will see if the IP is contained within at least one of the CIDR blocks
42// defined by Engine.SetTrustedProxies()
43func (c *Context) RemoteIP() (net.IP, bool) {
44	ip, _, err := net.SplitHostPort(strings.TrimSpace(c.Request.RemoteAddr))
45	if err != nil {
46		return nil, false
47	}
48	remoteIP := net.ParseIP(ip)
49	if remoteIP == nil {
50		return nil, false
51	}
52
53	return remoteIP, c.engine.isTrustedProxy(remoteIP)
54}
55
56func (e *Engine) isTrustedProxy(ip net.IP) bool {
57	if e.trustedCIDRs != nil {
58		for _, cidr := range e.trustedCIDRs {
59			if cidr.Contains(ip) {
60				return true
61			}
62		}
63	}
64	return false
65}
66
67func (e *Engine) validateHeader(header string) (clientIP string, valid bool) {
68	if header == "" {
69		return "", false
70	}
71	items := strings.Split(header, ",")
72	for i := len(items) - 1; i >= 0; i-- {
73		ipStr := strings.TrimSpace(items[i])
74		ip := net.ParseIP(ipStr)
75		if ip == nil {
76			return "", false
77		}
78
79		// X-Forwarded-For is appended by proxy
80		// Check IPs in reverse order and stop when find untrusted proxy
81		if (i == 0) || (!e.isTrustedProxy(ip)) {
82			return ipStr, true
83		}
84	}
85	return
86}

1// 初始化
2g := gin.New()
3// 信赖所有IPv4及IPv6地址段
4g.SetTrustedProxies([]string{"0.0.0.0/0", "::/0"})