]> git.ipfire.org Git - thirdparty/pdns.git/commit
dnsdist: Handle missing X-Forwarded-For on existing DoH connection
authorRemi Gacogne <remi.gacogne@powerdns.com>
Thu, 16 Apr 2026 09:18:17 +0000 (11:18 +0200)
committerRemi Gacogne <remi.gacogne@powerdns.com>
Thu, 16 Apr 2026 09:18:17 +0000 (11:18 +0200)
commit421aa2e6cdddf329f4b8e8d50fdbcb6d88ad6d72
treeab1b282809087a7e825eea3133c0c4a660d297fe
parentf216e1f155b36241306cb71c68189b756919e1c9
dnsdist: Handle missing X-Forwarded-For on existing DoH connection

If `trustForwardedForHeader` is enabled, meaning we trust an upstream
reverse-proxy to fill it with the address of the initial client, and
the header was set on at least one previous query of the current DoH
connection, but is missing from the current query, we should fall back
to the address the connection is coming from instead of using the value
of the last received `X-Forwarded-For` header.
This should never happen in practice: if we trust the reverse proxy
to set the `X-Forwarded-For` header it should always do so. But let's
handle the case nevertheless, or we will get an endless stream of
reports from LLMs about it.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>
pdns/dnsdistdist/dnsdist-nghttp2-in.cc
regression-tests.dnsdist/test_DOH.py