Bug #64489: rgw: pick the last ip in x-forwarded-for chain - rgw - Ceph

Actions

Copy link

Bug #64489

open

rgw: pick the last ip in x-forwarded-for chain

Added by Seena Fallah 3 months ago. Updated 2 months ago.

Status:

Fix Under Review

Priority:

Normal

Assignee:

Seena Fallah

Target version:

% Done:

Source:

Tags:

proxy policy security

Backport:

quincy reef squid

Regression:

Severity:

3 - minor

Reviewed:

Affected Versions:

ceph-qa-suite:

Pull request ID:

55646

Crash signature (v1):

Crash signature (v2):

Description

Currently, when rgw_remote_addr_param is set to HTTP_X_FORWARDED_FOR, it will pick the first IP from the chain. As described here (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For) it needs to pick the last one otherwise it can be manipulated by the client and cause access to a bucket (which is protected by a bucket policy based on aws:SourceIP).