Trust reverse proxy client IP headers

tests/test_security.py

@@ -268,6 +268,67 @@ def test_trusted_proxy_uses_cloudflare_connecting_ip(tmp_path: Path) -> None:
     assert response.json()["ip"] == "198.51.100.20"
 
 
+def test_private_reverse_proxy_uses_cloudflare_connecting_ip_by_default(tmp_path: Path) -> None:
+    settings = DdnsSettings(
+        database_path=tmp_path / "ddns.sqlite3",
+        admin_password="admin",
+    )
+    app = make_app(settings)
+
+    @app.get("/debug-ip", include_in_schema=False)
+    def debug_ip(request: Request) -> dict[str, str]:
+        return {"ip": client_ip(request, settings)}
+
+    client = TestClient(app, client=("172.18.0.5", 12345))
+    response = client.get(
+        "/debug-ip",
+        headers={
+            "cf-connecting-ip": "8.8.8.8",
+            "x-forwarded-for": "1.1.1.1",
+        },
+    )
+
+    assert response.status_code == 200
+    assert response.json()["ip"] == "8.8.8.8"
+
+
+def test_private_reverse_proxy_uses_forwarded_for_without_cloudflare_header(tmp_path: Path) -> None:
+    settings = DdnsSettings(
+        database_path=tmp_path / "ddns.sqlite3",
+        admin_password="admin",
+    )
+    app = make_app(settings)
+
+    @app.get("/debug-ip", include_in_schema=False)
+    def debug_ip(request: Request) -> dict[str, str]:
+        return {"ip": client_ip(request, settings)}
+
+    client = TestClient(app, client=("172.18.0.5", 12345))
+    response = client.get("/debug-ip", headers={"x-forwarded-for": "8.8.4.4, 172.18.0.5"})
+
+    assert response.status_code == 200
+    assert response.json()["ip"] == "8.8.4.4"
+
+
+def test_private_reverse_proxy_trust_can_be_disabled(tmp_path: Path) -> None:
+    settings = DdnsSettings(
+        database_path=tmp_path / "ddns.sqlite3",
+        admin_password="admin",
+        trust_private_proxy_headers=False,
+    )
+    app = make_app(settings)
+
+    @app.get("/debug-ip", include_in_schema=False)
+    def debug_ip(request: Request) -> dict[str, str]:
+        return {"ip": client_ip(request, settings)}
+
+    client = TestClient(app, client=("172.18.0.5", 12345))
+    response = client.get("/debug-ip", headers={"cf-connecting-ip": "8.8.8.8"})
+
+    assert response.status_code == 200
+    assert response.json()["ip"] == "172.18.0.5"
+
+
 def test_untrusted_proxy_headers_are_ignored(tmp_path: Path) -> None:
     settings = DdnsSettings(
         database_path=tmp_path / "ddns.sqlite3",

tests/test_ui.py

@@ -89,8 +89,8 @@ def test_hostname_without_login_generates_update_and_dashboard_links(tmp_path: P
     assert "Copy setup values" not in response.text
     assert "Paste this exact URL into the FRITZ!Box" in response.text
     assert "Copy manual update commands" in response.text
-    assert response.text.count("Secret") >= 3
-    assert response.text.count("Public") >= 3
+    assert response.text.count("copy-field-secret") >= 3
+    assert response.text.count("copy-field-public") >= 2
     assert ".ddns.example.net" in response.text
     assert 'type="password"' not in response.text
 
@@ -116,6 +116,27 @@ def test_public_examples_use_visitor_public_ip(tmp_path: Path) -> None:
     assert "myip=8.8.8.8" in created.text
 
 
+def test_public_examples_use_cloudflare_ip_from_private_reverse_proxy(tmp_path: Path) -> None:
+    app = make_app(
+        DdnsSettings(
+            database_path=tmp_path / "ddns.sqlite3",
+            admin_password="admin",
+            hostname_suffix="ddns.example.net",
+            public_base_url="https://karldns.de",
+        )
+    )
+    client = TestClient(app, client=("172.18.0.5", 12345))
+
+    home = client.get("/", headers={"cf-connecting-ip": "8.8.4.4"})
+    created = client.post("/", headers={"x-forwarded-for": "8.8.4.4, 172.18.0.5"})
+
+    assert home.status_code == 200
+    assert created.status_code == 200
+    assert "myip=8.8.4.4" in home.text
+    assert "good 8.8.4.4" in home.text
+    assert "myip=8.8.4.4" in created.text
+
+
 def test_generated_hostname_must_be_activated_before_updates_work(tmp_path: Path) -> None:
     database_path = tmp_path / "ddns.sqlite3"
     app = make_app(