chore: add wildcard trusted proxies

Signed-off-by: Henry <mail@henrygressmann.de>

Author: explodingcamera

CHANGELOG.md

@@ -22,14 +22,19 @@ Since this is not a library, this changelog focuses on the changes that are rele
 
 ### ⚠️ Breaking Changes
 
-- Client IP detection now defaults to `X-Forwarded-For` from IPv4 and IPv6 loopback proxies only. Other headers and proxies must be configured with the `trusted_headers` and `trusted_proxies` options. See the [configuration reference](https://liwan.dev/reference/configuration/) for details.
+Client IP detection now defaults to `X-Forwarded-For` from IPv4 and IPv6 loopback proxies only. Use `trusted_headers` (`LIWAN_TRUSTED_HEADERS`) to configure different headers and `trusted_proxies` (`LIWAN_TRUSTED_PROXIES`) to configure other proxy addresses or networks.
+
+For Docker deployments where the reverse proxy connects to Liwan through a Docker bridge, add the bridge subnet to `trusted_proxies`, for example `trusted_proxies = ["172.17.0.0/16"]`. If only trusted systems can connect to Liwan over an isolated network, you can set `trusted_proxies = "*"` instead.
+
+Without this configuration, forwarded client addresses from these proxies are ignored. This affects visitor grouping, GeoIP lookup, and rate limits for login and event requests. See the [configuration reference](https://liwan.dev/reference/configuration/) for details.
 
 ### Features
 
 - Added external authentication with OpenID Connect, Google, and Microsoft Entra ID, including optional user creation and provider access restrictions
 - Improved visit duration accuracy by tracking page exits
 - Added client IP header presets for Akamai, Cloudflare, CloudFront, Fastly, and Fly
 - Added GeoIP header mappings and presets for Akamai, Cloudflare, CloudFront, Netlify, and Vercel, with MaxMind results taking precedence when available
+- Added `*` support for `trusted_proxies` to trust forwarding headers from any direct peer
 - Tracker requests now avoid CORS preflight requests by sending JSON as `text/plain` and the event API accepts tracker JSON regardless of content type
 
 ### Security

README.md

@@ -11,6 +11,8 @@
 ![GitHub Release](https://img.shields.io/github/v/release/explodingcamera/liwan?style=flat-square)
 [![Container](https://img.shields.io/badge/Container-ghcr.io%2Fexplodingcamera%2Fliwan%3Alatest-blue?style=flat-square)](https://github.com/explodingcamera/liwan/pkgs/container/liwan)
 
+[Live demo](https://demo.liwan.dev/p/liwan.dev) · [Getting started](https://liwan.dev/getting-started/) · [Configuration](https://liwan.dev/reference/configuration/) · [Collected data](https://liwan.dev/collected-data/)
+
 </div>
 
 </div>

data/config.example.toml

@@ -15,6 +15,7 @@ listen = 9042  # The port to listen on (http)
 # trusted_headers = ["X-Forwarded-For"]
 
 ## Trusted reverse proxies (IP or CIDR), defaults to the IPv4 and IPv6 loopback ranges.
+## Use "*" to trust all direct peers only when network access to liwan is restricted.
 # trusted_proxies = ["127.0.0.1/8", "::1/128"]
 
 ## Hour of day, in the server's local timezone, when visitor grouping salts rotate.

src/config.rs

@@ -475,6 +475,17 @@ mod test {
         assert_eq!(config.trusted_headers.as_ref(), &[ClientIpHeaderSource::Header("x-client-ip".to_string())]);
     }
 
+    #[test]
+    fn test_wildcard_trusted_proxy() {
+        let env_config = Config::load(None, [("LIWAN_TRUSTED_PROXIES", "*")]).expect("failed to load config");
+        assert_eq!(env_config.trusted_proxies.as_ref(), &[TrustedProxy::All]);
+
+        let (_temp_dir, config_path) = temp_config("wildcard-proxy.config.toml", "trusted_proxies = \"*\"");
+        let file_config =
+            Config::load(Some(config_path), Vec::<(String, String)>::new()).expect("failed to load config");
+        assert_eq!(file_config.trusted_proxies.as_ref(), &[TrustedProxy::All]);
+    }
+
     #[test]
     fn test_header_presets_and_geoip_mappings() {
         let (_temp_dir, config_path) = temp_config(

src/utils/ip_headers.rs

@@ -134,22 +134,47 @@ pub fn parse_geoip_headers(headers: &http::HeaderMap, sources: &[GeoIpHeaderSour
     values
 }
 
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-#[serde(untagged)]
+#[derive(Debug, Clone, PartialEq, Eq)]
 pub enum TrustedProxy {
+    All,
     Ip(IpAddr),
     Cidr(IpNet),
 }
 
 impl TrustedProxy {
     pub fn contains(&self, ip: IpAddr) -> bool {
         match self {
+            TrustedProxy::All => true,
             TrustedProxy::Ip(proxy_ip) => *proxy_ip == ip,
             TrustedProxy::Cidr(net) => net.contains(&ip),
         }
     }
 }
 
+impl Serialize for TrustedProxy {
+    fn serialize<S: serde::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        match self {
+            Self::All => serializer.serialize_str("*"),
+            Self::Ip(ip) => serializer.collect_str(ip),
+            Self::Cidr(network) => serializer.collect_str(network),
+        }
+    }
+}
+
+impl<'de> Deserialize<'de> for TrustedProxy {
+    fn deserialize<D: serde::Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        let value = String::deserialize(deserializer)?;
+        let value = value.trim();
+        if value == "*" {
+            return Ok(Self::All);
+        }
+        if let Ok(ip) = value.parse() {
+            return Ok(Self::Ip(ip));
+        }
+        value.parse().map(Self::Cidr).map_err(serde::de::Error::custom)
+    }
+}
+
 pub fn parse_header_ip(headers: &http::HeaderMap, source: &ClientIpHeaderSource) -> Option<IpAddr> {
     let header = source.as_header_name();
     let value = headers.get(header)?.to_str().ok()?.trim();
@@ -258,6 +283,15 @@ mod tests {
         assert!(!should_trust_proxy_headers(Some("10.0.0.2".parse().unwrap()), &[]));
     }
 
+    #[test]
+    fn wildcard_trusts_all_proxy_addresses() {
+        let proxy: TrustedProxy = serde_json::from_str(r#""*""#).unwrap();
+
+        assert!(proxy.contains("192.0.2.1".parse().unwrap()));
+        assert!(proxy.contains("2001:db8::1".parse().unwrap()));
+        assert_eq!(serde_json::to_string(&proxy).unwrap(), r#""*""#);
+    }
+
     #[test]
     fn client_ip_walks_trusted_forwarded_chain() {
         let request = http::Request::builder().header("x-forwarded-for", "203.0.113.10, 10.0.0.1").body(()).unwrap();

src/web/mod.rs

@@ -4,11 +4,14 @@ pub mod webext;
 
 use std::net::{SocketAddr, ToSocketAddrs};
 use std::ops::Deref;
-use std::sync::Arc;
-use std::time::Duration;
+use std::sync::{Arc, Mutex};
+use std::time::{Duration, Instant};
 
 use anyhow::{Context, Result};
+use axum::extract::{ConnectInfo, Request, State};
 use axum::handler::{Handler, HandlerWithoutStateExt};
+use axum::middleware::Next;
+use axum::response::Response;
 use rust_embed::RustEmbed;
 
 use aide::{axum::ApiRouter, openapi};
@@ -26,6 +29,7 @@ use crate::app::{
     Liwan,
     models::{Event, EventExit},
 };
+use crate::utils::ip_headers::should_trust_proxy_headers;
 use crate::web::webext::serve;
 
 pub use session::MaybeSessionId;
@@ -45,6 +49,27 @@ pub struct RouterState {
     pub events: Sender<Event>,
     pub exits: Sender<EventExit>,
     pub report_permits: Arc<Semaphore>,
+    untrusted_proxy_warning: Arc<UntrustedProxyWarning>,
+}
+
+const PROXY_WARNING_INTERVAL: Duration = Duration::from_secs(60 * 60);
+
+#[derive(Default)]
+struct UntrustedProxyWarning {
+    last: Mutex<Option<Instant>>,
+}
+
+impl UntrustedProxyWarning {
+    fn should_warn(&self, now: Instant) -> bool {
+        let Ok(mut last) = self.last.lock() else {
+            return false;
+        };
+        if last.is_some_and(|last| now.duration_since(last) < PROXY_WARNING_INTERVAL) {
+            return false;
+        }
+        *last = Some(now);
+        true
+    }
 }
 
 /// Event ingestion queues used by the web server.
@@ -90,6 +115,32 @@ impl Deref for RouterState {
     }
 }
 
+async fn warn_untrusted_proxy_headers(State(state): State<RouterState>, request: Request, next: Next) -> Response {
+    let peer_ip = request.extensions().get::<ConnectInfo<SocketAddr>>().map(|ConnectInfo(addr)| addr.ip());
+    let is_private = peer_ip.is_some_and(|ip| {
+        ip.is_loopback()
+            || match ip {
+                std::net::IpAddr::V4(ip) => ip.is_private() || ip.is_link_local(),
+                std::net::IpAddr::V6(ip) => ip.is_unique_local() || ip.is_unicast_link_local(),
+            }
+    });
+    let has_client_ip_header =
+        state.config.trusted_headers.iter().any(|source| request.headers().contains_key(source.as_header_name()));
+
+    if is_private
+        && has_client_ip_header
+        && !should_trust_proxy_headers(peer_ip, &state.config.trusted_proxies)
+        && state.untrusted_proxy_warning.should_warn(Instant::now())
+    {
+        tracing::warn!(
+            peer_ip = %peer_ip.expect("private peer IP is present"),
+            "Ignoring client IP headers from an untrusted private proxy. Add its address or network to `trusted_proxies` or `LIWAN_TRUSTED_PROXIES` if it should be trusted"
+        );
+    }
+
+    next.run(request).await
+}
+
 pub fn router(app: Arc<Liwan>, queues: EventQueues) -> Result<(axum::Router<()>, openapi::OpenApi)> {
     aide::generate::in_context(|ctx| {
         ctx.schema = ctx.schema.settings().clone().with_transform(WrapSchemaRefs).into_generator();
@@ -143,6 +194,13 @@ pub fn router(app: Arc<Liwan>, queues: EventQueues) -> Result<(axum::Router<()>,
         .merge(routes::external_auth::router(&app.config))
         .merge(routes::dashboard::router());
 
+    let state = RouterState {
+        app: app.clone(),
+        events: queues.events,
+        exits: queues.exits,
+        report_permits: Arc::new(Semaphore::new(app.config.limits.report_max_concurrency)),
+        untrusted_proxy_warning: Arc::new(UntrustedProxyWarning::default()),
+    };
     let router = ApiRouter::new()
         .nest("/api", routes::event::router(&app.config).layer(event_cors))
         .nest("/api/dashboard", dashboard)
@@ -152,12 +210,8 @@ pub fn router(app: Arc<Liwan>, queues: EventQueues) -> Result<(axum::Router<()>,
         .layer(CompressionLayer::new())
         .layer(set_headers)
         .layer(TraceLayer::new_for_http())
-        .with_state(RouterState {
-            app: app.clone(),
-            events: queues.events,
-            exits: queues.exits,
-            report_permits: Arc::new(Semaphore::new(app.config.limits.report_max_concurrency)),
-        })
+        .layer(axum::middleware::from_fn_with_state(state.clone(), warn_untrusted_proxy_headers))
+        .with_state(state)
         .finish_api(&mut api);
 
     Ok((router, api))
@@ -212,3 +266,18 @@ pub async fn start_webserver(app: Arc<Liwan>, queues: EventQueues) -> Result<()>
     let service = router.0.into_make_service_with_connect_info::<SocketAddr>();
     axum::serve(listener, service).await.context("server exited unexpectedly")
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn untrusted_proxy_warning_is_rate_limited() {
+        let warning = UntrustedProxyWarning::default();
+        let now = Instant::now();
+
+        assert!(warning.should_warn(now));
+        assert!(!warning.should_warn(now + PROXY_WARNING_INTERVAL - Duration::from_secs(1)));
+        assert!(warning.should_warn(now + PROXY_WARNING_INTERVAL));
+    }
+}