some proxies may add port number to X-Forwarded-For header.

xrayhttp/handler.go

@@ -157,26 +157,50 @@ func getURL(r *http.Request) string {
 	return proto + "://" + r.Host + r.URL.Path
 }
 
+// clientIP returns the client IP address from the request.
+//
+// If the request passes through a proxy, clientIP parses
+// the Forwarded header and the X-Forwarded-For header to
+// find the client IP address.
+// The clientIP always trusts the values of the Forwarded header
+// and the X-Forwarded-For header. Please note
+// that if these headers have been altered by an attacker,
+// there is a possibility of returning incorrect results.
 func clientIP(r *http.Request) (string, bool) {
+	// Parse Forwarded header.
+	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Forwarded
 	forwarded, err := forwardedheader.Parse(r.Header.Values("Forwarded"))
 	if err == nil && len(forwarded) > 0 {
 		ip := forwarded[0].For.IP
 		if ip.IsValid() {
 			return ip.String(), true
 		}
 	}
+
+	// Parse X-Forwarded-For header.
+	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For
 	forwardedFor := r.Header.Get("X-Forwarded-For")
 	if forwardedFor != "" {
 		if idx := strings.IndexByte(forwardedFor, ','); idx > 0 {
 			forwardedFor = forwardedFor[:idx]
 		}
-		return strings.TrimSpace(forwardedFor), true
+		forwardedFor = strings.TrimSpace(forwardedFor)
+
+		// some proxies may add port number to X-Forwarded-For header.
+		// e.g. AWS ALB: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/x-forwarded-headers.html
+		return getHost(forwardedFor), true
 	}
-	ip, _, err := net.SplitHostPort(r.RemoteAddr)
+	return getHost(r.RemoteAddr), false
+}
+
+// getHost splits host and port from s.
+// if s doesn't contain port, it returns s.
+func getHost(s string) string {
+	ip, _, err := net.SplitHostPort(s)
 	if err != nil {
-		return r.RemoteAddr, false
+		return s
 	}
-	return ip, false
+	return ip
 }
 
 type rwUnwrapper interface {

xrayhttp/handler_test.go

@@ -681,6 +681,39 @@ func TestClientIP(t *testing.T) {
 			wantIP:    "198.51.100.1",
 			forwarded: true,
 		},
+		{
+			name: "xff-ipv6",
+			req: &http.Request{
+				Header: http.Header{
+					"X-Forwarded-For": []string{"2001:db8::1"},
+				},
+				RemoteAddr: "192.0.2.1:48011",
+			},
+			wantIP:    "2001:db8::1",
+			forwarded: true,
+		},
+		{
+			name: "multiple-xff",
+			req: &http.Request{
+				Header: http.Header{
+					"X-Forwarded-For": []string{"198.51.100.1, 198.51.100.2"},
+				},
+				RemoteAddr: "192.0.2.1:48011",
+			},
+			wantIP:    "198.51.100.1",
+			forwarded: true,
+		},
+		{
+			name: "xff-with-port",
+			req: &http.Request{
+				Header: http.Header{
+					"X-Forwarded-For": []string{"198.51.100.1:48013, 198.51.100.2:48012"},
+				},
+				RemoteAddr: "192.0.2.1:48011",
+			},
+			wantIP:    "198.51.100.1",
+			forwarded: true,
+		},
 		{
 			name: "forwarded-header",
 			req: &http.Request{