The real-client-IP lookup used by the --trusted-ip auth-bypass allowlist
blindly trusted the leftmost value in X-Forwarded-For (or other
configured --real-client-ip-header). When trusting X-Forwarded-For (which
is the only header set by AWS ALB for example) the connecting peer's
address is appended to X-Forwarded-For rather than replacing the header,
and a client could set X-Forwarded-For to an allowlisted IP and have it
trusted regardless of who actually connected to the proxy.
The parser now walks the hop chain from the newest (rightmost) entry
inward, skipping hops that are themselves trusted proxies, and returns
the first entry that isn't. If the direct connecting peer isn't itself a
trusted proxy, the header is ignored entirely. This reuses the existing
--trusted-proxy-ip configuration, so behavior for deployments that leave
it unset (today's documented trust-all default) is unchanged.
Signed-off-by: Georgi Georgiev <310867+chutzimir@users.noreply.github.com>
08ce94d1c0