ExtractIPFromRealIPHeader returns RemoteAddr instead of x-real-ip

[georgekarrv]

Issue Description

ExtractIPFromRealIPHeader does not return what was found in x-real-ip

echo/ip.go

Line 98 in a97052e

func ExtractIPFromRealIPHeader(options ...TrustOption) IPExtractor {

func ExtractIPFromRealIPHeader(options ...TrustOption) IPExtractor {
	checker := newIPChecker(options)
	return func(req *http.Request) string {
		directIP := ExtractIPDirect()(req)
		realIP := req.Header.Get(HeaderXRealIP)
		if realIP != "" {
			if ip := net.ParseIP(directIP); ip != nil && checker.trust(ip) {
				return realIP
			}
		}
		return directIP
	}
}

if realIP != "" should be if realIP == ""
because ultimately the logic that exists now is when you have real and direct ip it will return direct and not real

Checklist

• [ x] Dependencies installed
• [ x] No typos
• [ x] Searched existing issues and docs

Expected behaviour

when x-real-ip is present the IPExtractor should return that ip instead of the directIP from RemoteAddr

Actual behaviour

ExtractIPFromRealIPHeader returns RemoteAddr if both RemoteAddr and x-real-ip exist

Steps to reproduce

Working code to debug

package main

func main() {
}

Version/commit

[hemachandarv]

@georgekarrv Is this still valid? Can I take this issue up?

[yeyisan]

Hi @georgekarrv ,
In this case, directIP does not need to be parsed and trusted. Because directIP is always in a valid ip format. But realIP is a plain text value that taken from X-Real-IP header. So realIP needs parsing and trust checks instead of directIP.

The code block below will fix this erroneous situation.

// ExtractIPFromRealIPHeader extracts IP address using x-real-ip header.
// Use this if you put proxy which uses this header.
func ExtractIPFromRealIPHeader(options ...TrustOption) IPExtractor {
	checker := newIPChecker(options)
	return func(req *http.Request) string {
		directIP := ExtractIPDirect()(req)
		realIP := req.Header.Get(HeaderXRealIP)
		if realIP != "" {
			if ip := net.ParseIP(realIP); ip != nil && checker.trust(ip) {
				return realIP
			}
		}
		return directIP
	}
}

ExtractIPFromRealIPHeader returns realIP when realIP is a valid and trusted ip otherwise returns directIP.