[management,proxy,client] Add L4 capabilities (TLS/TCP/UDP) (#5530)

proxy/internal/proxy/trustedproxy.go

@@ -7,21 +7,11 @@ import (
 
 // IsTrustedProxy checks if the given IP string falls within any of the trusted prefixes.
 func IsTrustedProxy(ipStr string, trusted []netip.Prefix) bool {
-	if len(trusted) == 0 {
-		return false
-	}
-
 	addr, err := netip.ParseAddr(ipStr)
-	if err != nil {
+	if err != nil || len(trusted) == 0 {
 		return false
 	}
-
-	for _, prefix := range trusted {
-		if prefix.Contains(addr) {
-			return true
-		}
-	}
-	return false
+	return isTrustedAddr(addr.Unmap(), trusted)
 }
 
 // ResolveClientIP extracts the real client IP from X-Forwarded-For using the trusted proxy list.
@@ -30,10 +20,10 @@ func IsTrustedProxy(ipStr string, trusted []netip.Prefix) bool {
 //
 // If the trusted list is empty or remoteAddr is not trusted, it returns the
 // remoteAddr IP directly (ignoring any forwarding headers).
-func ResolveClientIP(remoteAddr, xff string, trusted []netip.Prefix) string {
-	remoteIP := extractClientIP(remoteAddr)
+func ResolveClientIP(remoteAddr, xff string, trusted []netip.Prefix) netip.Addr {
+	remoteIP := extractHostIP(remoteAddr)
 
-	if len(trusted) == 0 || !IsTrustedProxy(remoteIP, trusted) {
+	if len(trusted) == 0 || !isTrustedAddr(remoteIP, trusted) {
 		return remoteIP
 	}
 
@@ -47,14 +37,45 @@ func ResolveClientIP(remoteAddr, xff string, trusted []netip.Prefix) string {
 		if ip == "" {
 			continue
 		}
-		if !IsTrustedProxy(ip, trusted) {
-			return ip
+		addr, err := netip.ParseAddr(ip)
+		if err != nil {
+			continue
+		}
+		addr = addr.Unmap()
+		if !isTrustedAddr(addr, trusted) {
+			return addr
 		}
 	}
 
 	// All IPs in XFF are trusted; return the leftmost as best guess.
 	if first := strings.TrimSpace(parts[0]); first != "" {
-		return first
+		if addr, err := netip.ParseAddr(first); err == nil {
+			return addr.Unmap()
+		}
 	}
 	return remoteIP
 }
+
+// extractHostIP parses the IP from a host:port string and returns it unmapped.
+func extractHostIP(hostPort string) netip.Addr {
+	if ap, err := netip.ParseAddrPort(hostPort); err == nil {
+		return ap.Addr().Unmap()
+	}
+	if addr, err := netip.ParseAddr(hostPort); err == nil {
+		return addr.Unmap()
+	}
+	return netip.Addr{}
+}
+
+// isTrustedAddr checks if the given address falls within any of the trusted prefixes.
+func isTrustedAddr(addr netip.Addr, trusted []netip.Prefix) bool {
+	if !addr.IsValid() {
+		return false
+	}
+	for _, prefix := range trusted {
+		if prefix.Contains(addr) {
+			return true
+		}
+	}
+	return false
+}