Support X-Forwarded-For and X-Real-IP in AccessControl

[getroot]

OvenMediaEngine often runs behind a proxy server. In this case, AdmissionWebhooks and SignedPolicy have the disadvantage of not being able to identify real users because they only check the IP of the client that actually accessed OME. Therefore, there has been a request for support for the X-Forwarded-For and X-Real-IP headers supported by Nginx for a long time.

Sorry for being so late. I finally added this feature.

In SignedPolicy, you can add real_ip to the policy as follows.

{
"url_activate":1399711581,
"url_expire":1399721581,
"stream_expire":1399821581,
"allow_ip":"192.168.100.5/32"
"real_ip": "111.111.111.111/32"
}

allow_ip is the IP address of the client that actually connected OME, just like before.

If real_ip is in the policy, OME searches for and checks the values ​​in the following order.

1. The value of the X-REAL-IP header
2. The value of the first item of X-FORWARDED-FOR
3. The IP of the client that actually connected

Therefore, to enhance security, it is best to set the IP of your proxy server in allow_ip and the IP of the client you allow in real_ip.

In AdmissionWebhooks, real_ip is added to the client object as follows.

{
"client":
{
"address": "211.233.58.86",
"real_ip": "192.0.2.43",
"port": 29291,
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36"
},
.......

As with the SignedPolicy policy, address is the IP address of the client that actually connected to OME. real_ip is inserted as the value of the X-REAL-IP header or the first value of the X-FORWARDED-FOR header, or the IP address of the client that actually connected.
You can enhance security by checking if the address is your proxy server and if the real_ip is the IP of a client you have allowed.

In the future, if needed, we also plan to support https://datatracker.ietf.org/doc/html/rfc7239 (I haven't found a use case yet, but if you do, please let me know.)

Any feedback is appreciated. Thanks.