Merge commit from fork

Signed-off-by: Jan Larwig <jan@larwig.com>

pkg/middleware/redirect_to_https_test.go

@@ -6,6 +6,7 @@ import (
 	"net/http/httptest"
 
 	middlewareapi "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/middleware"
+	"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/ip"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 )
@@ -39,6 +40,10 @@ var _ = Describe("RedirectToHTTPS suite", func() {
 			scope := &middlewareapi.RequestScope{
 				ReverseProxy: in.reverseProxy,
 			}
+			if in.reverseProxy {
+				req.RemoteAddr = "127.0.0.1:4180"
+				scope.TrustedProxies = newRedirectTrustedProxySet("127.0.0.1")
+			}
 			req = middlewareapi.AddRequestScope(req, scope)
 
 			rw := httptest.NewRecorder()
@@ -207,3 +212,13 @@ var _ = Describe("RedirectToHTTPS suite", func() {
 		}),
 	)
 })
+
+func newRedirectTrustedProxySet(cidrs ...string) *ip.NetSet {
+	set := ip.NewNetSet()
+	for _, cidr := range cidrs {
+		ipNet := ip.ParseIPNet(cidr)
+		Expect(ipNet).ToNot(BeNil())
+		set.AddIPNet(*ipNet)
+	}
+	return set
+}

pkg/middleware/scope.go

@@ -6,14 +6,16 @@ import (
 	"github.com/google/uuid"
 	"github.com/justinas/alice"
 	middlewareapi "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/middleware"
+	"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/ip"
 )
 
-func NewScope(reverseProxy bool, idHeader string) alice.Constructor {
+func NewScope(reverseProxy bool, idHeader string, trustedProxies *ip.NetSet) alice.Constructor {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
 			scope := &middlewareapi.RequestScope{
-				ReverseProxy: reverseProxy,
-				RequestID:    genRequestID(req, idHeader),
+				ReverseProxy:   reverseProxy,
+				TrustedProxies: trustedProxies,
+				RequestID:      genRequestID(req, idHeader),
 			}
 			req = middlewareapi.AddRequestScope(req, scope)
 			next.ServeHTTP(rw, req)

pkg/middleware/scope_test.go

@@ -6,6 +6,7 @@ import (
 
 	"github.com/google/uuid"
 	middlewareapi "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/middleware"
+	"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/ip"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 )
@@ -32,7 +33,7 @@ var _ = Describe("Scope Suite", func() {
 
 		Context("ReverseProxy is false", func() {
 			BeforeEach(func() {
-				handler := NewScope(false, testRequestHeader)(
+				handler := NewScope(false, testRequestHeader, nil)(
 					http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 						nextRequest = r
 						w.WriteHeader(200)
@@ -60,8 +61,15 @@ var _ = Describe("Scope Suite", func() {
 		})
 
 		Context("ReverseProxy is true", func() {
+			var trustedProxies *ip.NetSet
+
 			BeforeEach(func() {
-				handler := NewScope(true, testRequestHeader)(
+				var err error
+
+				trustedProxies, err = ip.ParseNetSet([]string{"127.0.0.1"})
+				Expect(err).ToNot(HaveOccurred())
+
+				handler := NewScope(true, testRequestHeader, trustedProxies)(
 					http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 						nextRequest = r
 						w.WriteHeader(200)
@@ -74,12 +82,18 @@ var _ = Describe("Scope Suite", func() {
 				Expect(scope).ToNot(BeNil())
 				Expect(scope.ReverseProxy).To(BeTrue())
 			})
+
+			It("stores the trusted proxies on the scope", func() {
+				scope := middlewareapi.GetRequestScope(nextRequest)
+				Expect(scope).ToNot(BeNil())
+				Expect(scope.TrustedProxies).To(BeIdenticalTo(trustedProxies))
+			})
 		})
 
 		Context("Request ID header is present", func() {
 			BeforeEach(func() {
 				request.Header.Add(testRequestHeader, testRequestID)
-				handler := NewScope(false, testRequestHeader)(
+				handler := NewScope(false, testRequestHeader, nil)(
 					http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 						nextRequest = r
 						w.WriteHeader(200)
@@ -97,7 +111,7 @@ var _ = Describe("Scope Suite", func() {
 			BeforeEach(func() {
 				uuid.SetRand(mockRand{})
 
-				handler := NewScope(true, testRequestHeader)(
+				handler := NewScope(true, testRequestHeader, nil)(
 					http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 						nextRequest = r
 						w.WriteHeader(200)