git.iko.soy/typeable/oauth2-proxy
on master help sign in
fix: handle Unix socket RemoteAddr in IP resolution (#3374)

* fix: handle Unix socket RemoteAddr in IP resolution When oauth2-proxy listens on a Unix socket, Go sets RemoteAddr to "@" instead of the usual "host:port" format. This caused net.SplitHostPort to fail on every request, flooding logs with errors: Error obtaining real IP for trusted IP list: unable to get ip and port from http.RemoteAddr (@) Fix by handling the "@" RemoteAddr at the source in getRemoteIP, returning nil without error since Unix sockets have no meaningful client IP. Also simplify the isTrustedIP guard and add a nil check in GetClientString to prevent calling String() on nil net.IP. Fixes #3373 Signed-off-by: h1net <ben@freshdevs.com> * docs: add changelog entry and Unix socket trusted IPs documentation Add changelog entry for #3374. Document that trusted IPs cannot match against RemoteAddr for Unix socket listeners since Go sets it to "@", and that IP-based trust still works via X-Forwarded-For with reverse-proxy. Signed-off-by: Ben Newbery <ben.newbery@gmail.com> Signed-off-by: h1net <ben@freshdevs.com> * doc: fix changelog entry for #3374 Signed-off-by: Jan Larwig <jan@larwig.com> * doc: add trusted ip a section to versioned docs as well Signed-off-by: Jan Larwig <jan@larwig.com> --------- Signed-off-by: h1net <ben@freshdevs.com> Signed-off-by: Ben Newbery <ben.newbery@gmail.com> Signed-off-by: Jan Larwig <jan@larwig.com> Co-authored-by: Jan Larwig <jan@larwig.com>

commita4d89036ec102509fbb0d393f77cc90af6d083c8 authorH1net <ben@freshdevs.com> dateMon 23 Mar 2026, 09:22 (6 months ago) parent9f09d54
7 files changed+56−4
compare with master
unifiedsplit
CHANGELOG.md+2 docs/docs/configuration/systemd_socket.md+8 docs/versioned_docs/version-7.15.x/configuration/systemd_socket.md+8 oauthproxy.go+1−3 oauthproxy_test.go+26 pkg/ip/realclientip.go+7−1 pkg/ip/realclientip_test.go+4
CHANGELOG.md+2
@@ -14,6 +14,8 @@
1414# V7.15.0
1515
1616- [#3382](https://github.com/oauth2-proxy/oauth2-proxy/pull/3382) chore(deps): update gomod and golangci/golangci-lint to v2.11.4 (@tuunit)
17+- [#3374](https://github.com/oauth2-proxy/oauth2-proxy/pull/3374) fix: handle Unix socket RemoteAddr in IP resolution (@H1net)
18+
1719
1820## Release Highlights
1921
docs/docs/configuration/systemd_socket.md+8
@@ -40,4 +40,12 @@ the listener it created onto the process, starting with file descriptor 3.
4040 --client-secret=...
4141```
4242
43+## Trusted IPs
44+
45+When listening on a Unix socket, Go sets `http.Request.RemoteAddr` to `"@"` instead of the usual `"host:port"` format. This means there is no client IP available from the connection itself.
46+
47+As a result, `--trusted-ip` entries cannot match against the direct connection address for Unix socket listeners. Requests arriving over a Unix socket will never be considered "trusted" based on their `RemoteAddr`. IP-based trust decisions will still work if a trusted reverse proxy sets `X-Forwarded-For` or `X-Real-IP` headers and `--reverse-proxy=true` is configured.
48+
49+## TLS
50+
4351Currently TLS is not supported (but it's doable).
docs/versioned_docs/version-7.15.x/configuration/systemd_socket.md+8
@@ -40,4 +40,12 @@ the listener it created onto the process, starting with file descriptor 3.
4040 --client-secret=...
4141```
4242
43+## Trusted IPs
44+
45+When listening on a Unix socket, Go sets `http.Request.RemoteAddr` to `"@"` instead of the usual `"host:port"` format. This means there is no client IP available from the connection itself.
46+
47+As a result, `--trusted-ip` entries cannot match against the direct connection address for Unix socket listeners. Requests arriving over a Unix socket will never be considered "trusted" based on their `RemoteAddr`. IP-based trust decisions will still work if a trusted reverse proxy sets `X-Forwarded-For` or `X-Real-IP` headers and `--reverse-proxy=true` is configured.
48+
49+## TLS
50+
4351Currently TLS is not supported (but it's doable).
oauthproxy.go+1−3
@@ -613,9 +613,7 @@ func (p *OAuthProxy) isAPIPath(req *http.Request) bool {
613613
614614// isTrustedIP is used to check if a request comes from a trusted client IP address.
615615func (p *OAuthProxy) isTrustedIP(req *http.Request) bool {
616− // RemoteAddr @ means unix socket
617− // https://github.com/golang/go/blob/0fa53e41f122b1661d0678a6d36d71b7b5ad031d/src/syscall/syscall_linux.go#L506-L511
618− if p.trustedIPs == nil && req.RemoteAddr != "@" {
616+ if p.trustedIPs == nil {
619617 return false
620618 }
621619
oauthproxy_test.go+26
@@ -2150,6 +2150,32 @@ func TestTrustedIPs(t *testing.T) {
21502150 }(),
21512151 expectTrusted: false,
21522152 },
2153+ // Check Unix socket with no trusted IPs configured does not error.
2154+ {
2155+ name: "UnixSocketWithoutTrustedIPs",
2156+ trustedIPs: nil,
2157+ reverseProxy: false,
2158+ realClientIPHeader: "X-Real-IP",
2159+ req: func() *http.Request {
2160+ req, _ := http.NewRequest("GET", "/", nil)
2161+ req.RemoteAddr = "@"
2162+ return req
2163+ }(),
2164+ expectTrusted: false,
2165+ },
2166+ // Check Unix socket with trusted IPs configured returns false (no IP to match).
2167+ {
2168+ name: "UnixSocketWithTrustedIPs",
2169+ trustedIPs: []string{"127.0.0.1"},
2170+ reverseProxy: false,
2171+ realClientIPHeader: "X-Real-IP",
2172+ req: func() *http.Request {
2173+ req, _ := http.NewRequest("GET", "/", nil)
2174+ req.RemoteAddr = "@"
2175+ return req
2176+ }(),
2177+ expectTrusted: false,
2178+ },
21532179 // Check using req.RemoteAddr (Options.ReverseProxy == false).
21542180 {
21552181 name: "WithRemoteAddr",
pkg/ip/realclientip.go+7−1
@@ -73,6 +73,12 @@ func GetClientIP(p ipapi.RealClientIPParser, req *http.Request) (net.IP, error)
7373
7474// getRemoteIP obtains the IP of the low-level connected network host
7575func getRemoteIP(req *http.Request) (net.IP, error) {
76+ // Unix domain sockets set RemoteAddr to "@" which has no meaningful IP.
77+ // https://github.com/golang/go/blob/0fa53e41f122b1661d0678a6d36d71b7b5ad031d/src/syscall/syscall_linux.go#L506-L511
78+ if req.RemoteAddr == "@" {
79+ return nil, nil
80+ }
81+
7682 //revive:disable:indent-error-flow
7783 if ipStr, _, err := net.SplitHostPort(req.RemoteAddr); err != nil {
7884 return nil, fmt.Errorf("unable to get ip and port from http.RemoteAddr (%s)", req.RemoteAddr)
@@ -94,7 +100,7 @@ func GetClientString(p ipapi.RealClientIPParser, req *http.Request, full bool) (
94100 }
95101
96102 var remoteIPStr string
97− if remoteIP, err := getRemoteIP(req); err == nil {
103+ if remoteIP, err := getRemoteIP(req); err == nil && remoteIP != nil {
98104 remoteIPStr = remoteIP.String()
99105 }
100106
pkg/ip/realclientip_test.go+4
@@ -112,6 +112,8 @@ func TestGetRemoteIP(t *testing.T) {
112112 errString string
113113 expectedIP net.IP
114114 }{
115+ // Unix domain sockets set RemoteAddr to "@"
116+ {"@", "", nil},
115117 {"", "unable to get ip and port from http.RemoteAddr ()", nil},
116118 {"nil", "unable to get ip and port from http.RemoteAddr (nil)", nil},
117119 {"235.28.129.186", "unable to get ip and port from http.RemoteAddr (235.28.129.186)", nil},
@@ -155,6 +157,8 @@ func TestGetClientString(t *testing.T) {
155157 }{
156158 // Should fail quietly, only printing warnings to the log
157159 {nil, "", "", "", ""},
160+ // Unix domain socket — no IP available
161+ {nil, "@", "", "", ""},
158162 {p, "127.0.0.1:11950", "", "127.0.0.1", "127.0.0.1"},
159163 {p, "[::1]:28660", "99.103.56.12", "99.103.56.12", "::1 (99.103.56.12)"},
160164 {nil, "10.254.244.165:62750", "", "10.254.244.165", "10.254.244.165"},