🐛 bug: Handle Unix sockets explicitly in IsFromLocal()#4090
🐛 bug: Handle Unix sockets explicitly in IsFromLocal()#4090gaby merged 4 commits intoupdate-proxy-trust-logic-in-req.gofrom
Conversation
Co-authored-by: gaby <835733+gaby@users.noreply.github.com>
Co-authored-by: gaby <835733+gaby@users.noreply.github.com>
|
Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## update-proxy-trust-logic-in-req.go #4090 +/- ##
======================================================================
- Coverage 91.03% 90.98% -0.06%
======================================================================
Files 119 119
Lines 11317 11320 +3
======================================================================
- Hits 10302 10299 -3
- Misses 643 648 +5
- Partials 372 373 +1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Pull request overview
Fixes IsFromLocal() incorrectly returning false for Unix domain socket connections by explicitly treating *net.UnixAddr as local, aligning behavior with existing Unix-socket handling in IsProxyTrusted().
Changes:
- Add an early return in
DefaultReq.IsFromLocal()whenfasthttp.RemoteAddr()is a*net.UnixAddr. - Add a unit test covering Unix socket remote addresses for
Ctx.IsFromLocal().
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| req.go | Treat Unix domain socket remote addresses as inherently local in IsFromLocal() to avoid 0.0.0.0 loopback misclassification. |
| ctx_test.go | Add coverage ensuring Unix-socket-based remote addresses result in IsFromLocal() == true. |
|
@copilot apply changes based on the comments in this thread |
Co-authored-by: gaby <835733+gaby@users.noreply.github.com>
Description
Unix socket connections are inherently local—only processes on the same host can connect via Unix domain sockets. However,
IsFromLocal()returnedfalsefor them becausefasthttp.RemoteIP()returns0.0.0.0for Unix sockets, and0.0.0.0.IsLoopback()returnsfalse.This PR adds explicit
*net.UnixAddrhandling toIsFromLocal(), consistent withIsProxyTrusted().Changes introduced
*net.UnixAddrthat returnstruebefore the IP loopback check, with properly formatted inline commenttrue, plus addeddefer app.ReleaseCtx(c)to all test blocks to prevent context leaksIsFromLocal()returningfalsefor Unix socket connectionsType of change
Checklist
/docs/directory for Fiber's documentation.💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.