External/roboco
1
0
Fork 0
mirror of https://github.com/rennf93/roboco.git synced 2026-08-03 07:23:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(guard): scope the internal-mesh whitelist to loopback + docker bridge

Browse Source 
The WAF/IP-ban/rate-limit exemption whitelisted all of RFC1918, so any
LAN client reaching the host-published nginx port resolved to its real
192.168.x.x and rode the exemption. Only the docker agent mesh needs it:
keep 127.0.0.1/::1 + 172.16.0.0/12, drop 10.0.0.0/8 and 192.168.0.0/16.
New middleware tests drive the real XFF resolution path (forwarded LAN
client blocked, direct bridge peer exempt); the remaining ceiling
(host-proxied traffic resolving to loopback/bridge-gateway under
depth-1 XFF trust) is documented instead of claimed away.
This commit is contained in:
Renn F
2026-07-22 03:30:32 +02:00
parent 34a4950918
commit 07bdef3db2
4 changed files with 70 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
motion/node_modules
-1
View File
@@ -1 +0,0 @@
/data/workspaces/roboco-api/ux_ui/ux-dev-1/motion/node_modules