X-Forwarded-For handler for labstack echo and Fastly

tracing/tracing.go

@@ -2,6 +2,8 @@ package tracing
 
 import (
 	"context"
+	"crypto/tls"
+	"crypto/x509"
 	"os"
 
 	"go.ntppool.org/common/logger"
@@ -26,9 +28,18 @@ func Tracer() trace.Tracer {
 	return traceProvider.Tracer("ntppool-tracer")
 }
 
+func Start(ctx context.Context, spanName string, opts ...trace.SpanStartOption) (context.Context, trace.Span) {
+	return Tracer().Start(ctx, spanName, opts...)
+}
+
+type GetClientCertificate func(*tls.CertificateRequestInfo) (*tls.Certificate, error)
+
 type TracerConfig struct {
 	ServiceName string
 	Environment string
+
+	CertificateProvider GetClientCertificate
+	RootCAs             *x509.CertPool
 }
 
 var emptyTpShutdownFunc = func(_ context.Context) error {
@@ -45,7 +56,7 @@ func InitTracer(ctx context.Context, cfg *TracerConfig) (TpShutdownFunc, error)
 	var exporter otelsdktrace.SpanExporter
 
 	if otlpEndPoint := os.Getenv("OTEL_EXPORTER_OTLP_ENDPOINT"); len(otlpEndPoint) > 0 {
-		exporter, err = newOLTPExporter(ctx)
+		exporter, err = newOLTPExporter(ctx, cfg)
 	}
 
 	if err != nil {
@@ -69,8 +80,18 @@ func InitTracer(ctx context.Context, cfg *TracerConfig) (TpShutdownFunc, error)
 	return tp.Shutdown, nil
 }
 
-func newOLTPExporter(ctx context.Context) (otelsdktrace.SpanExporter, error) {
-	client := otlptracehttp.NewClient()
+func newOLTPExporter(ctx context.Context, cfg *TracerConfig) (otelsdktrace.SpanExporter, error) {
+
+	opts := []otlptracehttp.Option{otlptracehttp.WithCompression(otlptracehttp.GzipCompression)}
+
+	if cfg.CertificateProvider != nil {
+		opts = append(opts, otlptracehttp.WithTLSClientConfig(&tls.Config{
+			GetClientCertificate: cfg.CertificateProvider,
+			RootCAs:              cfg.RootCAs,
+		}))
+	}
+
+	client := otlptracehttp.NewClient(opts...)
 	exporter, err := otlptrace.New(ctx, client)
 	if err != nil {
 		logger.Setup().Error("creating OTLP trace exporter", "err", err)

xff/fastlyxff/fastly.json

@@ -0,0 +1 @@
+{"addresses":["23.235.32.0/20","43.249.72.0/22","103.244.50.0/24","103.245.222.0/23","103.245.224.0/24","104.156.80.0/20","140.248.64.0/18","140.248.128.0/17","146.75.0.0/17","151.101.0.0/16","157.52.64.0/18","167.82.0.0/17","167.82.128.0/20","167.82.160.0/20","167.82.224.0/20","172.111.64.0/18","185.31.16.0/22","199.27.72.0/21","199.232.0.0/16"],"ipv6_addresses":["2a04:4e40::/32","2a04:4e42::/32"]}

xff/fastlyxff/xff.go

@@ -0,0 +1,51 @@
+package fastlyxff
+
+import (
+	"encoding/json"
+	"net"
+	"net/netip"
+	"os"
+
+	"github.com/labstack/echo/v4"
+)
+
+type FastlyXFF struct {
+	IPv4 []string `json:"addresses"`
+	IPv6 []string `json:"ipv6_addresses"`
+}
+
+type TrustedNets struct {
+	prefixes []netip.Prefix
+}
+
+func New(fileName string) (*FastlyXFF, error) {
+	b, err := os.ReadFile(fileName)
+	if err != nil {
+		return nil, err
+	}
+
+	d := FastlyXFF{}
+
+	err = json.Unmarshal(b, &d)
+	if err != nil {
+		return nil, err
+	}
+
+	return &d, nil
+}
+
+func (xff *FastlyXFF) EchoTrustOption() ([]echo.TrustOption, error) {
+	ranges := []echo.TrustOption{}
+
+	for _, s := range append(xff.IPv4, xff.IPv6...) {
+		_, cidr, err := net.ParseCIDR(s)
+		if err != nil {
+			return nil, err
+		}
+
+		trust := echo.TrustIPRange(cidr)
+		ranges = append(ranges, trust)
+	}
+
+	return ranges, nil
+}

xff/fastlyxff/xff_test.go

@@ -0,0 +1,23 @@
+package fastlyxff
+
+import "testing"
+
+func TestFastlyIPRanges(t *testing.T) {
+
+	fastlyxff, err := New("fastly.json")
+	if err != nil {
+		t.Fatalf("could not load test data: %s", err)
+	}
+
+	data, err := fastlyxff.EchoTrustOption()
+
+	if err != nil {
+		t.Fatalf("could not parse test data: %s", err)
+	}
+
+	if len(data) < 10 {
+		t.Logf("only got %d prefixes, expected more", len(data))
+		t.Fail()
+	}
+
+}