Skip to content

Commit 5dfc6f7

Browse files
jandro996jandro996
authored
Add Forwarded header as a source to client IP resolution (#9310)
What Does This Do Updates the resolver to include forwarded as one of the evaluated headers Follow the parsing order for headers defined in https://datadoghq.atlassian.net/wiki/spaces/SAAL/pages/2118779066 forwarded header should be parsed between x-client-ip and forwarded-for Motivation Additional Notes Rollback #7946 but changing X-forwarded for forwarded that is the correct one
1 parent a3d32f9 commit 5dfc6f7

File tree

8 files changed

+40
-0
lines changed

8 files changed

+40
-0
lines changed

‎dd-java-agent/agent-bootstrap/src/main/java/datadog/trace/bootstrap/instrumentation/decorator/http/ClientIpAddressResolver.java‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,14 @@ private static InetAddress doResolve(AgentSpanContext.Extracted context, Mutable
9292
result = coalesce(result, addr);
9393
}
9494

95+
addr = tryHeader(context.getForwarded(), FORWARDED_PARSER);
96+
if (addr != null) {
97+
if (!isIpAddrPrivate(addr)) {
98+
return addr;
99+
}
100+
result = coalesce(result, addr);
101+
}
102+
95103
addr = tryHeader(context.getForwardedFor(), PLAIN_IP_ADDRESS_PARSER);
96104
if (addr != null) {
97105
if (!isIpAddrPrivate(addr)) {

‎dd-java-agent/agent-bootstrap/src/test/groovy/datadog/trace/bootstrap/instrumentation/decorator/http/ClientIpAddressResolverSpecification.groovy‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,22 @@ class ClientIpAddressResolverSpecification extends Specification {
7070
'fastly-client-ip' | '3.3.3.3' | '3.3.3.3'
7171
'cf-connecting-ip' | '4.4.4.4' | '4.4.4.4'
7272
'cf-connecting-ipv6' | '2001::2' | '2001::2'
73+
74+
'forwarded' | 'for="[2001::1]:1111"' | '2001::1'
75+
'forwarded' | 'fOr="[2001::1]:1111"' | '2001::1'
76+
'forwarded' | 'for=some_host' | null
77+
'forwarded' | 'for=127.0.0.1, FOR=1.1.1.1' | '1.1.1.1'
78+
'forwarded' |'for="\"foobar";proto=http,FOR="1.1.1.1"' | '1.1.1.1'
79+
'forwarded' | 'for="8.8.8.8:2222",' | '8.8.8.8'
80+
'forwarded' | 'for="8.8.8.8' | null // quote not closed
81+
'forwarded' | 'far="8.8.8.8",for=4.4.4.4;' | '4.4.4.4'
82+
'forwarded' | ' for=127.0.0.1,for= for=,for=;"for = for="" ,; for=8.8.8.8;' | '8.8.8.8'
83+
'forwarded' | 'for=192.0.2.60;proto=http;by=203.0.113.43' | '192.0.2.60'
84+
'forwarded' | 'For="[2001:db8:cafe::17]:4711"' | '2001:db8:cafe::17'
85+
'forwarded' | 'for=192.0.2.43;proto=https;by=203.0.113.43' | '192.0.2.43'
86+
'forwarded' | 'for="_gazonk"' | null
87+
'forwarded' | 'for=unknown, for=8.8.8.8' | '8.8.8.8'
88+
'forwarded' | 'for="[::ffff:192.0.2.128]";proto=http' | '192.0.2.128'
7389
}
7490

7591
void 'test recognition strategy with custom header'() {
@@ -110,6 +126,9 @@ class ClientIpAddressResolverSpecification extends Specification {
110126
then:
111127
1 * context.getXClientIp() >> null
112128

129+
then:
130+
1 * context.getForwarded() >> null
131+
113132
then:
114133
1 * context.getForwardedFor() >> null
115134

@@ -162,6 +181,7 @@ class ClientIpAddressResolverSpecification extends Specification {
162181
1 * context.getXForwardedFor() >> '127.0.0.1'
163182
1 * context.getXRealIp() >> '127.0.0.2'
164183
1 * context.getXClientIp() >> '127.0.0.3'
184+
1 * context.getForwarded() >> 'for=127.0.0.4'
165185
1 * context.getXClusterClientIp() >> '127.0.0.5'
166186
1 * context.getForwardedFor() >> '127.0.0.6'
167187
1 * context.getTrueClientIp() >> '127.0.0.9'

‎dd-trace-core/src/test/groovy/datadog/trace/core/propagation/B3HttpExtractorTest.groovy‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -367,6 +367,7 @@ class B3HttpExtractorTest extends DDSpecification {
367367
(HttpCodec.X_CLIENT_IP_KEY): '3.3.3.3',
368368
(HttpCodec.TRUE_CLIENT_IP_KEY): '4.4.4.4',
369369
(HttpCodec.FORWARDED_FOR_KEY): '5.5.5.5',
370+
(HttpCodec.FORWARDED_KEY): '6.6.6.6',
370371
(HttpCodec.FASTLY_CLIENT_IP_KEY): '7.7.7.7',
371372
(HttpCodec.CF_CONNECTING_IP_KEY): '8.8.8.8',
372373
(HttpCodec.CF_CONNECTING_IP_V6_KEY): '9.9.9.9',
@@ -382,6 +383,7 @@ class B3HttpExtractorTest extends DDSpecification {
382383
assert context.XClientIp == '3.3.3.3'
383384
assert context.trueClientIp == '4.4.4.4'
384385
assert context.forwardedFor == '5.5.5.5'
386+
assert context.forwarded == '6.6.6.6'
385387
assert context.fastlyClientIp == '7.7.7.7'
386388
assert context.cfConnectingIp == '8.8.8.8'
387389
assert context.cfConnectingIpv6 == '9.9.9.9'

‎dd-trace-core/src/test/groovy/datadog/trace/core/propagation/DatadogHttpExtractorTest.groovy‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -438,6 +438,7 @@ class DatadogHttpExtractorTest extends DDSpecification {
438438
(HttpCodec.X_CLIENT_IP_KEY): '3.3.3.3',
439439
(HttpCodec.TRUE_CLIENT_IP_KEY): '4.4.4.4',
440440
(HttpCodec.FORWARDED_FOR_KEY): '5.5.5.5',
441+
(HttpCodec.FORWARDED_KEY): '6.6.6.6',
441442
(HttpCodec.FASTLY_CLIENT_IP_KEY): '7.7.7.7',
442443
(HttpCodec.CF_CONNECTING_IP_KEY): '8.8.8.8',
443444
(HttpCodec.CF_CONNECTING_IP_V6_KEY): '9.9.9.9',
@@ -453,6 +454,7 @@ class DatadogHttpExtractorTest extends DDSpecification {
453454
assert context.XClientIp == '3.3.3.3'
454455
assert context.trueClientIp == '4.4.4.4'
455456
assert context.forwardedFor == '5.5.5.5'
457+
assert context.forwarded == '6.6.6.6'
456458
assert context.fastlyClientIp == '7.7.7.7'
457459
assert context.cfConnectingIp == '8.8.8.8'
458460
assert context.cfConnectingIpv6 == '9.9.9.9'

‎dd-trace-core/src/test/groovy/datadog/trace/core/propagation/HaystackHttpExtractorTest.groovy‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -300,6 +300,7 @@ class HaystackHttpExtractorTest extends DDSpecification {
300300
(HttpCodec.X_CLIENT_IP_KEY): '3.3.3.3',
301301
(HttpCodec.TRUE_CLIENT_IP_KEY): '4.4.4.4',
302302
(HttpCodec.FORWARDED_FOR_KEY): '5.5.5.5',
303+
(HttpCodec.FORWARDED_KEY): '6.6.6.6',
303304
(HttpCodec.FASTLY_CLIENT_IP_KEY): '7.7.7.7',
304305
(HttpCodec.CF_CONNECTING_IP_KEY): '8.8.8.8',
305306
(HttpCodec.CF_CONNECTING_IP_V6_KEY): '9.9.9.9',
@@ -315,6 +316,7 @@ class HaystackHttpExtractorTest extends DDSpecification {
315316
assert context.XClientIp == '3.3.3.3'
316317
assert context.trueClientIp == '4.4.4.4'
317318
assert context.forwardedFor == '5.5.5.5'
319+
assert context.forwarded == '6.6.6.6'
318320
assert context.fastlyClientIp == '7.7.7.7'
319321
assert context.cfConnectingIp == '8.8.8.8'
320322
assert context.cfConnectingIpv6 == '9.9.9.9'

‎dd-trace-core/src/test/groovy/datadog/trace/core/propagation/NoneHttpExtractorTest.groovy‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -303,6 +303,7 @@ class NoneHttpExtractorTest extends DDSpecification {
303303
(HttpCodec.X_CLIENT_IP_KEY): '3.3.3.3',
304304
(HttpCodec.TRUE_CLIENT_IP_KEY): '4.4.4.4',
305305
(HttpCodec.FORWARDED_FOR_KEY): '5.5.5.5',
306+
(HttpCodec.FORWARDED_KEY): '6.6.6.6',
306307
(HttpCodec.FASTLY_CLIENT_IP_KEY): '7.7.7.7',
307308
(HttpCodec.CF_CONNECTING_IP_KEY): '8.8.8.8',
308309
(HttpCodec.CF_CONNECTING_IP_V6_KEY): '9.9.9.9',
@@ -318,6 +319,7 @@ class NoneHttpExtractorTest extends DDSpecification {
318319
assert context.XClientIp == '3.3.3.3'
319320
assert context.trueClientIp == '4.4.4.4'
320321
assert context.forwardedFor == '5.5.5.5'
322+
assert context.forwarded == '6.6.6.6'
321323
assert context.fastlyClientIp == '7.7.7.7'
322324
assert context.cfConnectingIp == '8.8.8.8'
323325
assert context.cfConnectingIpv6 == '9.9.9.9'

‎dd-trace-core/src/test/groovy/datadog/trace/core/propagation/W3CHttpExtractorTest.groovy‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -365,6 +365,7 @@ class W3CHttpExtractorTest extends DDSpecification {
365365
(HttpCodec.X_CLIENT_IP_KEY): '3.3.3.3',
366366
(HttpCodec.TRUE_CLIENT_IP_KEY): '4.4.4.4',
367367
(HttpCodec.FORWARDED_FOR_KEY): '5.5.5.5',
368+
(HttpCodec.FORWARDED_KEY): '6.6.6.6',
368369
(HttpCodec.FASTLY_CLIENT_IP_KEY): '7.7.7.7',
369370
(HttpCodec.CF_CONNECTING_IP_KEY): '8.8.8.8',
370371
(HttpCodec.CF_CONNECTING_IP_V6_KEY): '9.9.9.9',
@@ -380,6 +381,7 @@ class W3CHttpExtractorTest extends DDSpecification {
380381
assert context.XClientIp == '3.3.3.3'
381382
assert context.trueClientIp == '4.4.4.4'
382383
assert context.forwardedFor == '5.5.5.5'
384+
assert context.forwarded == '6.6.6.6'
383385
assert context.fastlyClientIp == '7.7.7.7'
384386
assert context.cfConnectingIp == '8.8.8.8'
385387
assert context.cfConnectingIpv6 == '9.9.9.9'

‎dd-trace-core/src/test/groovy/datadog/trace/core/propagation/XRayHttpExtractorTest.groovy‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -256,6 +256,7 @@ class XRayHttpExtractorTest extends DDSpecification {
256256
(HttpCodec.X_CLIENT_IP_KEY): '3.3.3.3',
257257
(HttpCodec.TRUE_CLIENT_IP_KEY): '4.4.4.4',
258258
(HttpCodec.FORWARDED_FOR_KEY): '5.5.5.5',
259+
(HttpCodec.FORWARDED_KEY): '6.6.6.6',
259260
(HttpCodec.FASTLY_CLIENT_IP_KEY): '7.7.7.7',
260261
(HttpCodec.CF_CONNECTING_IP_KEY): '8.8.8.8',
261262
(HttpCodec.CF_CONNECTING_IP_V6_KEY): '9.9.9.9',
@@ -271,6 +272,7 @@ class XRayHttpExtractorTest extends DDSpecification {
271272
assert context.XClientIp == '3.3.3.3'
272273
assert context.trueClientIp == '4.4.4.4'
273274
assert context.forwardedFor == '5.5.5.5'
275+
assert context.forwarded == '6.6.6.6'
274276
assert context.fastlyClientIp == '7.7.7.7'
275277
assert context.cfConnectingIp == '8.8.8.8'
276278
assert context.cfConnectingIpv6 == '9.9.9.9'

0 commit comments

Comments
 (0)