Trust Cloudflare ranges for real client IP

Author: ersinkoc

internal/server/domainlog.go

@@ -15,11 +15,11 @@ import (
 )
 
 const (
-	defaultMaxLogSize    = 50 * 1024 * 1024 // 50MB per log file
-	defaultMaxBackups    = 5
-	defaultMaxAge        = 30 * 24 * time.Hour // 30 days
-	cleanupInterval      = 1 * time.Hour
-	rotatedTimeFormat    = "20060102-150405"
+	defaultMaxLogSize = 50 * 1024 * 1024 // 50MB per log file
+	defaultMaxBackups = 5
+	defaultMaxAge     = 30 * 24 * time.Hour // 30 days
+	cleanupInterval   = 1 * time.Hour
+	rotatedTimeFormat = "20060102-150405.000000000"
 )
 
 // domainLogManager manages per-domain access log files with rotation.
@@ -33,6 +33,7 @@ type domainLogManager struct {
 	mu    sync.RWMutex
 	files map[string]*domainLogFile
 	stop  chan struct{}
+	bg    sync.WaitGroup
 }
 
 type domainLogFile struct {
@@ -129,15 +130,23 @@ func (m *domainLogManager) rotateLocked(host string, dlf *domainLogFile) {
 	ts := time.Now().Format(rotatedTimeFormat)
 	rotatedName := fmt.Sprintf("%s.%s", dlf.path, ts)
 	if err := os.Rename(dlf.path, rotatedName); err == nil {
-		go compressFile(rotatedName) // compress in background
+		m.bg.Add(1)
+		go func() {
+			defer m.bg.Done()
+			compressFile(rotatedName)
+		}()
 	}
 
 	// Enforce max backups
 	maxBackups := dlf.rotate.MaxBackups
 	if maxBackups <= 0 {
 		maxBackups = defaultMaxBackups
 	}
-	go pruneBackups(dlf.path, maxBackups)
+	m.bg.Add(1)
+	go func() {
+		defer m.bg.Done()
+		pruneBackups(dlf.path, maxBackups)
+	}()
 
 	// Open fresh log file
 	f, err := os.OpenFile(dlf.path, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0644)
@@ -204,13 +213,14 @@ func (m *domainLogManager) cleanupOld() {
 func (m *domainLogManager) Close() {
 	close(m.stop)
 	m.mu.Lock()
-	defer m.mu.Unlock()
 	for _, dlf := range m.files {
 		dlf.mu.Lock()
 		dlf.f.Close()
 		dlf.mu.Unlock()
 	}
 	m.files = make(map[string]*domainLogFile)
+	m.mu.Unlock()
+	m.bg.Wait()
 }
 
 // compressFile gzips a file in-place (src → src.gz, then removes src).

internal/server/server.go

@@ -687,7 +687,7 @@ func (s *Server) buildMiddlewareChain() http.Handler {
 	mws := []middleware.Middleware{
 		middleware.Recovery(s.logger),
 		middleware.RequestID(),
-		middleware.RealIP(s.config.Global.TrustedProxies),
+		middleware.RealIP(s.realIPTrustedProxies()),
 		middleware.SecurityHeaders(),
 		middleware.Gzip(1024), // compress responses > 1KB
 	}
@@ -715,6 +715,15 @@ func (s *Server) buildMiddlewareChain() http.Handler {
 	return chain(http.HandlerFunc(s.handleRequest))
 }
 
+func (s *Server) realIPTrustedProxies() []string {
+	if s == nil || s.config == nil {
+		return nil
+	}
+	trusted := append([]string(nil), s.config.Global.TrustedProxies...)
+	trusted = append(trusted, s.config.Global.Cloudflare.IPRanges...)
+	return trusted
+}
+
 // Start starts all listeners and blocks until shutdown.
 func (s *Server) Start() error {
 	workers := runtime.NumCPU()
@@ -1091,15 +1100,7 @@ func (s *Server) handleRequest(w http.ResponseWriter, r *http.Request) {
 		isMonitor := r.UserAgent() == "UWAS-Monitor/1.0"
 		if s.admin != nil && !isMonitor && r.Host != "localhost:80" && r.Host != "localhost" {
 			elapsed := time.Since(start)
-			// Use real client IP from X-Forwarded-For or X-Real-IP
-			remoteIP := r.RemoteAddr
-			if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
-				if parts := strings.SplitN(xff, ",", 2); len(parts) > 0 {
-					remoteIP = strings.TrimSpace(parts[0])
-				}
-			} else if xri := r.Header.Get("X-Real-IP"); xri != "" {
-				remoteIP = xri
-			}
+			remoteIP := normalizedRemoteIP(r)
 			s.admin.RecordLog(admin.LogEntry{
 				Time:       start,
 				Host:       r.Host,
@@ -1658,6 +1659,16 @@ func (s *Server) handleRequest(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
+func normalizedRemoteIP(r *http.Request) string {
+	if r == nil {
+		return ""
+	}
+	if host, _, err := net.SplitHostPort(r.RemoteAddr); err == nil {
+		return host
+	}
+	return strings.TrimSpace(r.RemoteAddr)
+}
+
 func (s *Server) handleFileRequest(ctx *router.RequestContext, domain *config.Domain) {
 	// Save original URI before any rewriting (PHP needs this for SCRIPT_NAME)
 	if ctx.OriginalURI == "" {

internal/server/server_test.go

@@ -15,6 +15,7 @@ import (
 	"github.com/uwaserver/uwas/internal/cache"
 	"github.com/uwaserver/uwas/internal/config"
 	"github.com/uwaserver/uwas/internal/logger"
+	"github.com/uwaserver/uwas/internal/middleware"
 )
 
 func testConfig(root string) *config.Config {
@@ -997,7 +998,7 @@ RewriteRule . /index.php [L]
 		Global: config.GlobalConfig{WorkerCount: "1", LogLevel: "error", LogFormat: "text"},
 		Domains: []config.Domain{{
 			Host: "wp.test", Root: dir, Type: "php",
-			SSL: config.SSLConfig{Mode: "off"},
+			SSL:      config.SSLConfig{Mode: "off"},
 			Htaccess: config.HtaccessConfig{Mode: "import"},
 		}},
 	}
@@ -1259,7 +1260,7 @@ func TestHandleHTTPNonSSLServesContent(t *testing.T) {
 func TestHandleHTTPUnknownHostNonSSL(t *testing.T) {
 	// No domains configured — no fallback, unknown host is rejected.
 	cfg := &config.Config{
-		Global: config.GlobalConfig{LogLevel: "error", LogFormat: "text"},
+		Global:  config.GlobalConfig{LogLevel: "error", LogFormat: "text"},
 		Domains: []config.Domain{},
 	}
 	log := logger.New("error", "text")
@@ -1314,6 +1315,36 @@ func TestBuildMiddlewareChainWithRateLimit(t *testing.T) {
 	}
 }
 
+func TestRealIPTrustedProxiesIncludesCloudflareRanges(t *testing.T) {
+	cfg := &config.Config{
+		Global: config.GlobalConfig{
+			LogLevel:       "error",
+			LogFormat:      "text",
+			TrustedProxies: []string{"10.0.0.0/8"},
+			Cloudflare: config.CloudflareConfig{
+				IPRanges: []string{"203.0.113.0/24"},
+			},
+		},
+	}
+	log := logger.New("error", "text")
+	s := New(cfg, log)
+
+	captured := ""
+	h := middleware.RealIP(s.realIPTrustedProxies())(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		captured = r.RemoteAddr
+		w.WriteHeader(http.StatusNoContent)
+	}))
+
+	req := httptest.NewRequest("GET", "/", nil)
+	req.RemoteAddr = "203.0.113.44:443"
+	req.Header.Set("CF-Connecting-IP", "198.51.100.77")
+	h.ServeHTTP(httptest.NewRecorder(), req)
+
+	if captured != "198.51.100.77:0" {
+		t.Fatalf("captured RemoteAddr = %q, want real Cloudflare client IP", captured)
+	}
+}
+
 func TestBuildMiddlewareChainWithSecurityGuard(t *testing.T) {
 	cfg := &config.Config{
 		Global: config.GlobalConfig{LogLevel: "error", LogFormat: "text"},