[fix] Stopped trusting X-Forwarded-For for the client IP address

docs/user/settings.rst

@@ -1028,15 +1028,39 @@ Nginx
 ``NINGX_REAL_REMOTE_ADDR``
 ~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-- **Explanation:** The nginx header to get the value of the real IP
-  address of Access points. Example if a reverse proxy is used in your
-  cluster (Example if you are using an Ingress), then the real IP of the
-  AP is most likely the ``$http_x_forwarded_for``. If
-  ``$http_x_forwarded_for`` returns a list, you can use ``$real_ip`` for
-  getting first element of the list.
-- **Valid Values:** ``$remote_addr``, ``$http_x_forwarded_for``,
-  ``$realip_remote_addr``, ``$real_ip``.
-- **Default:** ``$real_ip``.
+- **Explanation:** The nginx variable passed to the application as the
+  client IP address (``REMOTE_ADDR``). ``$remote_addr`` is the address of
+  the connection to nginx and cannot be set by the client. If a reverse
+  proxy or an ingress is used in your cluster, keep ``$remote_addr`` and
+  set ``NGINX_TRUSTED_PROXIES`` instead.
+- **Valid Values:** ``$remote_addr``.
+- **Default:** ``$remote_addr``.
+
+.. warning::
+
+    ``$http_x_forwarded_for`` and ``$real_ip`` are read from the
+    ``X-Forwarded-For`` header, which can be set by any client. Do not use
+    them, as clients would be able to spoof their IP address.
+
+``NGINX_TRUSTED_PROXIES``
+~~~~~~~~~~~~~~~~~~~~~~~~~
+
+- **Explanation:** IP addresses or subnets of the reverse proxies placed
+  in front of nginx (e.g. a load balancer or an ingress). The client IP
+  address is read from the ``X-Forwarded-For`` header only when the
+  request comes from one of these addresses. The client IP address is also
+  used by the ``allow`` rules of ``NGINX_ADMIN_ALLOW_NETWORK`` and
+  ``NGINX_HTTPS_ALLOWED_IPS``.
+- **Valid Values:** A comma separated string of valid IP addresses or IP
+  networks.
+- **Default:** ``''`` (empty, ``X-Forwarded-For`` is ignored).
+- **Example:** ``192.0.2.10``.
+
+.. warning::
+
+    List only the addresses of your reverse proxies. Any host in these
+    networks, including the Docker network of the containers, can set its
+    own IP address through the ``X-Forwarded-For`` header.
 
 OpenVPN
 -------

images/common/init_command.sh

@@ -58,6 +58,26 @@ elif [ "$MODULE_NAME" = 'nginx' ]; then
 	# correctly into the nginx configuration template.
 	NGINX_EVENTS_BLOCK=$(printf "%b" "${NGINX_EVENTS_BLOCK:-}")
 	export NGINX_EVENTS_BLOCK
+	case "${NINGX_REAL_REMOTE_ADDR:-}" in
+	"\$real_ip" | "\$http_x_forwarded_for")
+		echo "WARNING: NINGX_REAL_REMOTE_ADDR=${NINGX_REAL_REMOTE_ADDR} lets clients spoof their IP address, use NGINX_TRUSTED_PROXIES instead." >&2
+		;;
+	esac
+	NGINX_REAL_IP_BLOCK=""
+	set -f
+	for proxy in $(echo "${NGINX_TRUSTED_PROXIES:-}" | tr ',' ' '); do
+		if ! echo "$proxy" | grep -Eq '^[0-9A-Fa-f:.]+(/[0-9]{1,3})?$'; then
+			echo "ERROR: invalid NGINX_TRUSTED_PROXIES entry: ${proxy}" >&2
+			exit 1
+		fi
+		NGINX_REAL_IP_BLOCK="${NGINX_REAL_IP_BLOCK}set_real_ip_from ${proxy};\n    "
+	done
+	set +f
+	if [ -n "$NGINX_REAL_IP_BLOCK" ]; then
+		NGINX_REAL_IP_BLOCK="${NGINX_REAL_IP_BLOCK}real_ip_header X-Forwarded-For;\n    real_ip_recursive on;"
+	fi
+	NGINX_REAL_IP_BLOCK=$(printf "%b" "$NGINX_REAL_IP_BLOCK")
+	export NGINX_REAL_IP_BLOCK
 	# Use a sentinel value when the variable is unset. Since envsubst cannot
 	# conditionally omit directives, we later remove any line containing this
 	# sentinel from the generated nginx.conf.

images/openwisp_nginx/Dockerfile

@@ -136,7 +136,8 @@ ENV MODULE_NAME=nginx \
     NGINX_WORKER_CONNECTIONS=1024 \
     NGINX_WORKER_RLIMIT_NOFILE=__UNSET__ \
     NGINX_EVENTS_BLOCK='' \
-    NINGX_REAL_REMOTE_ADDR='$real_ip' \
+    NINGX_REAL_REMOTE_ADDR='$remote_addr' \
+    NGINX_TRUSTED_PROXIES='' \
     NGINX_SSL_PORT=443 \
     # USWGI pass_port
     DASHBOARD_APP_PORT=8000 \

images/openwisp_nginx/nginx.template.conf

@@ -41,6 +41,8 @@ http {
         default ${DOLLAR}remote_addr;
     }
 
+    ${NGINX_REAL_IP_BLOCK}
+
     server_names_hash_bucket_size $NGINX_SERVER_NAME_HASH_BUCKET;
     server_tokens off;