timamsk/sing-box
1
0
Fork 0
mirror of https://github.com/SagerNet/sing-box.git synced 2026-04-13 20:28:32 +10:00
Code Issues Packages Projects Releases Wiki Activity

ccm,ocm: strip reverse proxy headers before forwarding to upstream

Browse Source
This commit is contained in:
世界
2026-03-13 04:54:11 +08:00
parent 8d852bba9b
commit 283a5aacee
7 changed files with 31 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
service/ccm/credential_external.go
View File

@@ -236,7 +236,7 @@ func (c *externalCredential) buildProxyRequest(ctx context.Context, original *ht
}
for key, values := range original.Header {
if !isHopByHopHeader(key) && key != "Authorization" {
if !isHopByHopHeader(key) && !isReverseProxyHeader(key) && key != "Authorization" {
proxyRequest.Header[key] = values
}
}

2
service/ccm/credential_state.go
View File

@@ -674,7 +674,7 @@ func (c *defaultCredential) buildProxyRequest(ctx context.Context, original *htt
}
for key, values := range original.Header {
if !isHopByHopHeader(key) && key != "Authorization" {
if !isHopByHopHeader(key) && !isReverseProxyHeader(key) && key != "Authorization" {
proxyRequest.Header[key] = values
}
}

13
service/ccm/service.go
View File

@@ -128,6 +128,19 @@ func isHopByHopHeader(header string) bool {
}
}
func isReverseProxyHeader(header string) bool {
lowerHeader := strings.ToLower(header)
if strings.HasPrefix(lowerHeader, "cf-") {
return true
}
switch lowerHeader {
case "cdn-loop", "true-client-ip", "x-forwarded-for", "x-forwarded-proto", "x-real-ip":
return true
default:
return false
}
}
const (
weeklyWindowSeconds = 604800
weeklyWindowMinutes = weeklyWindowSeconds / 60

2
service/ocm/credential_external.go
View File

@@ -241,7 +241,7 @@ func (c *externalCredential) buildProxyRequest(ctx context.Context, original *ht
}
for key, values := range original.Header {
if !isHopByHopHeader(key) && key != "Authorization" {
if !isHopByHopHeader(key) && !isReverseProxyHeader(key) && key != "Authorization" {
proxyRequest.Header[key] = values
}
}

2
service/ocm/credential_state.go
View File

@@ -736,7 +736,7 @@ func (c *defaultCredential) buildProxyRequest(ctx context.Context, original *htt
}
for key, values := range original.Header {
if !isHopByHopHeader(key) && key != "Authorization" {
if !isHopByHopHeader(key) && !isReverseProxyHeader(key) && key != "Authorization" {
proxyRequest.Header[key] = values
}
}

13
service/ocm/service.go
View File

@@ -136,6 +136,19 @@ func isHopByHopHeader(header string) bool {
}
}
func isReverseProxyHeader(header string) bool {
lowerHeader := strings.ToLower(header)
if strings.HasPrefix(lowerHeader, "cf-") {
return true
}
switch lowerHeader {
case "cdn-loop", "true-client-ip", "x-forwarded-for", "x-forwarded-proto", "x-real-ip":
return true
default:
return false
}
}
func normalizeRateLimitIdentifier(limitIdentifier string) string {
trimmedIdentifier := strings.TrimSpace(strings.ToLower(limitIdentifier))
if trimmedIdentifier == "" {

2
service/ocm/service_websocket.go
View File

@@ -65,7 +65,7 @@ func isForwardableResponseHeader(key string) bool {
}
func isForwardableWebSocketRequestHeader(key string) bool {
if isHopByHopHeader(key) {
if isHopByHopHeader(key) || isReverseProxyHeader(key) {
return false
}