feat(gateway): trust forwarded IPs only from trusted proxies

[seonghobae]

Superseded by clean Draft replacement #157.

The reviewed trusted-proxy semantic head 65a2b7fbf2827f69ae1aa288696b6c5630af28c4 is preserved unchanged in #157, but this PR's base branch #149 was later contaminated by an unrelated auth merge. #157 restores the intended stack on clean runner prerequisite #153 without transferring predecessor checks/reviews.

[coderabbitai]

📝 Walkthrough

Walkthrough

신뢰 프록시 CIDR credential과 환경 설정을 추가했습니다. Gateway는 피어 소켓 주소와 신뢰 목록을 사용해 forwarded client IP를 fail closed 방식으로 판별합니다. 서버 실행과 셧다운 오류 처리를 변경하고, 테스트와 fuzz 검증을 확장했습니다.

Changes

신뢰 프록시 클라이언트 IP 처리

Layer / File(s)	Summary
Credential 및 trusted-proxy 설정 src/credentials.rs, src/lib.rs, docs/runbooks/operations.md	TRUSTED_PROXY_CIDRS credential과 IpNet 설정을 추가했습니다. CIDR 파싱, IPv4-mapped IPv6 정규화, 환경 설정 오류 처리를 구현했습니다.
피어 기반 Gateway 처리 src/lib.rs	Gateway가 ConnectInfo<SocketAddr>를 요구하도록 변경했습니다. 신뢰된 피어의 X-Forwarded-For 체인을 오른쪽에서 왼쪽으로 검사하고, malformed chain은 직접 피어 주소로 처리합니다. serve 경로와 기존 요청 테스트를 갱신했습니다.
셧다운 신호 초기화 src/main.rs	셧다운 핸들러 등록 오류를 Result로 반환하도록 변경했습니다. Unix 및 비-Unix 경로의 등록 시점과 오류 전파를 테스트했습니다.
Fail-closed 검증 및 Fuzz 범위 tests/*, fuzz/*, .github/workflows/fuzz.yml	malformed 또는 빈 hop, X-Real-IP 처리, trusted 및 untrusted peer, IPv4-mapped IPv6 동작을 테스트했습니다. 새 fuzz target, corpus, CI 매트릭스를 추가했습니다.

Estimated code review effort: 4 (Complex) | ~60 minutes

Merge Risk: 🟠 High · up to cd394

The change still allows malformed forwarded-IP input from an admitted proxy to influence client identity and downstream security controls, while direct router users can receive HTTP 500 when peer metadata is unavailable. These are concrete current-head security and availability risks that should be fixed before merge.

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant serve
  participant gateway
  participant effective_client_ip
  participant RateLimiter
  Client->>serve: TCP 요청과 SocketAddr 전달
  serve->>gateway: ConnectInfo<SocketAddr>가 포함된 Request 전달
  gateway->>effective_client_ip: peer_ip와 forwarded headers 전달
  effective_client_ip-->>gateway: 유효한 client IP 반환
  gateway->>RateLimiter: client IP로 rate limit 적용

Loading

🚥 Pre-merge checks | ✅ 2 | ❌ 3

❌ Failed checks (3 warnings)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	PR은 직접 연결된 이슈 #147의 Ubuntu 러너 이미지 고정 요구사항을 주된 변경으로 구현하지 않습니다. 또한 #147은 superseded 상태이며 이 PR을 종료하고 #149와 #150에서 검증하도록 명시합니다.	이 PR을 종료하고 러너 이미지 변경은 #149에서 처리하십시오. 신뢰된 프록시 게이트웨이 변경은 해당 목적에 맞는 이슈에 연결한 별도 PR로 분리하십시오.
Out of Scope Changes check	⚠️ Warning	신뢰된 프록시 처리, 자격 증명, 종료 신호, 퍼즈 대상, 퍼즈 코퍼스, 운영 문서 및 회귀 테스트 변경은 #147의 Ubuntu 러너 이미지 고정 범위를 벗어납니다.	#147과 무관한 게이트웨이 및 지원 변경을 제거하거나 별도 PR로 분리하십시오. #147에는 명시적인 Ubuntu 러너 이미지 고정 변경만 남기십시오.
Docstring Coverage	⚠️ Warning	Docstring coverage is 79.28% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 111 functions across 7 files. (7 skipped:…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 신뢰된 프록시에서만 전달된 IP를 신뢰하도록 게이트웨이 클라이언트 IP 처리를 변경한 PR의 주요 내용을 정확하고 간결하게 설명합니다.

Full details: Docstring Coverage

Explanation

Docstring coverage is 79.28% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 111 functions across 7 files. (7 skipped: 7 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/trusted-proxy-admission-v3

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[devin-ai-integration]

Note

This report is out of date. Scroll down for Devin Review's latest report on this PR.

Devin Review found 0 new potential issues.

[seonghobae]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[devin-ai-integration]

Note

This report is out of date. Scroll down for Devin Review's latest report on this PR.

Devin Review found 0 new potential issues.

[devin-ai-integration]

Note

This report is out of date. Scroll down for Devin Review's latest report on this PR.

Devin Review found 0 new potential issues.

[devin-ai-integration]

Devin Review found 0 new potential issues.