rays/ipx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 20 Wiki Activity

Revert the ::ffff: peer match: #209 was not a bug

Browse Source 
Caddy reports an IPv4 peer as plain IPv4 even on its dual-stack socket, so remote_ip
192.168.64.1 matched all along. The stripping seen came from testing on Tower itself, whose
requests reach the published port as 192.168.1.130, rightly not the tunnel. From
cloudflared's network a forged Access token reaches ipx's check and is refused.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Ray Slakinski
2026-10-12 14:20:02 +00:00
parent 3e58447f12
commit 0c820bbde1
2 changed files with 3 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
CHANGELOG.md
View File

@@ -20,10 +20,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
- `docker-compose.yml` is a sample to start from, ipx alone on SQLite with its folders beside the file, instead of a copy of the author's server (#208). - `docker-compose.yml` is a sample to start from, ipx alone on SQLite with its folders beside the file, instead of a copy of the author's server (#208).
- The source is a Cargo workspace: the daemon in `crates/ipx`, feed fetching and parsing in `crates/feed`. `cargo build --release` still makes `target/release/ipx` (#202). - The source is a Cargo workspace: the daemon in `crates/ipx`, feed fetching and parsing in `crates/feed`. `cargo build --release` still makes `target/release/ipx` (#202).
### Fixed
- Signing in through Cloudflare Access works behind ipx-web: Caddy took the tunnel's address for someone else's and dropped its sign-in headers (#209).
## [0.12.0] - 2026-10-11 ## [0.12.0] - 2026-10-11
### Added ### Added

8
web/Caddyfile
View File

@@ -2,7 +2,7 @@
# so the session cookie, live updates and Cloudflare Access work as they did when ipx served it. # so the session cookie, live updates and Cloudflare Access work as they did when ipx served it.
# IPX_UPSTREAM where ipx is, host:port (ipx:8099) # IPX_UPSTREAM where ipx is, host:port (ipx:8099)
# WEB_BIND where to listen (:8080) # WEB_BIND where to listen (:8080)
# TUNNEL_PEER the one IPv4 address whose Cf-Access-* headers are passed on: where cloudflared's # TUNNEL_PEER the one address whose Cf-Access-* headers are passed on: where cloudflared's
# requests come from. Nobody else's are, so nobody else can claim to be signed in # requests come from. Nobody else's are, so nobody else can claim to be signed in
# by Cloudflare. Unset passes none. # by Cloudflare. Unset passes none.
{ {
@@ -13,10 +13,8 @@
http://{$WEB_BIND::8080} { http://{$WEB_BIND::8080} {
root * {$WEB_ROOT:/srv} root * {$WEB_ROOT:/srv}
# Before anything else, so no page or API call sees them: only ipx sets these. Both forms of # Before anything else, so no page or API call sees them: only ipx sets these.
# the peer: Caddy listens dual-stack, so an IPv4 peer arrives as ::ffff:a.b.c.d, which the @forged not remote_ip {$TUNNEL_PEER:255.255.255.255}
# plain address does not match, and the tunnel's headers were stripped too (#209).
@forged not remote_ip {$TUNNEL_PEER:255.255.255.255} ::ffff:{$TUNNEL_PEER:255.255.255.255}
request_header @forged -Cf-Access-Authenticated-User-Email request_header @forged -Cf-Access-Authenticated-User-Email
request_header @forged -Cf-Access-Jwt-Assertion request_header @forged -Cf-Access-Jwt-Assertion