CitrixPot: NetScaler / Citrix ADC Gateway honeypot (initial public release)

test_client_ip.py

@@ -0,0 +1,40 @@
+"""Run: python3 test_client_ip.py. Real client IP is trusted only from configured proxy hops."""
+import http.client
+import threading
+
+from honeypot import Engine, Server
+from trusted_proxy import forwarded_client
+
+assert forwarded_client({'CF-Connecting-IP': '8.8.8.8'}) == ('8.8.8.8', 'CF-Connecting-IP')
+assert forwarded_client({'CF-Connecting-IP': '10.0.0.1', 'X-Forwarded-For': '1.1.1.1'}) == ('1.1.1.1', 'X-Forwarded-For')
+assert forwarded_client({'X-Forwarded-For': '10.0.0.1, 9.9.9.9, 10.0.0.2'}) == ('9.9.9.9', 'X-Forwarded-For')
+assert forwarded_client({'CF-Connecting-IP': 'not-an-ip'}) == (None, None)
+assert forwarded_client({}) == (None, None)
+
+
+def run(trusted):
+    rows = []
+    engine = Engine(lambda event, **data: rows.append(dict(event=event, **data)), delay=0)
+    server = Server(('127.0.0.1', 0), engine, trusted_forwarded=trusted)
+    thread = threading.Thread(target=server.serve_forever, daemon=True)
+    thread.start()
+    try:
+        connection = http.client.HTTPConnection('127.0.0.1', server.server_port, timeout=3)
+        connection.request('GET', '/', headers={'CF-Connecting-IP': '8.8.8.8',
+                                                 'X-Forwarded-For': '10.0.0.1, 1.1.1.1'})
+        assert connection.getresponse().status == 200
+        connection.close()
+    finally:
+        server.shutdown()
+        server.server_close()
+        thread.join(3)
+    return next(row for row in rows if row['event'] == 'request')
+
+
+# Untrusted hop: the spoofable header is ignored and the socket peer is authoritative.
+assert run(()).get('peer') == '127.0.0.1'
+# Trusted hop (loopback stands in for the edge proxy): the real client IP wins, proxy is retained.
+request = run(('127.0.0.0/8',))
+assert request['peer'] == '8.8.8.8' and request['client_ip_source'] == 'CF-Connecting-IP'
+assert request['proxy_peer'] == '127.0.0.1'
+print('PASS: forwarded client IP trusted only from configured proxies; spoofing rejected')