starred/AdGuardHome

Fork 0

mirror of https://github.com/AdguardTeam/AdGuardHome.git synced 2026-03-04 00:01:12 -05:00

AGH accepts all XFF headers without restriction #2551

New issue

Closed

opened 2026-03-04 02:07:01 -05:00 by deekerman · 4 comments

deekerman commented

2026-03-04 02:07:01 -05:00

Owner

Originally created by @ZeroClover on GitHub (Mar 10, 2021).

Originally assigned to: @EugeneOne1 on GitHub.

In #1220, AGH accepts some HTTP headers to get the visitor's raw IP.

However, the AGH does not restrict which IPs can send these headers, but accepts them from all IPs.

This means that when the AGH is deployed publicly and uses DoH, rate limiting may be completely useless. The AGH administrator will not be able to use the AGH's own functionality to block malicious users.

I constructed some malicious requests on my AGH server to illustrate the problem more clearly. Obviously, Cloudflare and Google could not have used my server as an upstream.

Screenshot:

I recommend that AGH add a separate configuration to allow users to set trusted IPs and trust the local loopback by default (127.0.0.1).

Originally created by @ZeroClover on GitHub (Mar 10, 2021). Originally assigned to: @EugeneOne1 on GitHub. In #1220, AGH accepts some HTTP headers to get the visitor's raw IP. However, the AGH does not restrict which IPs can send these headers, but accepts them from all IPs. This means that when the AGH is deployed publicly and uses DoH, rate limiting may be completely useless. The AGH administrator will not be able to use the AGH's own functionality to block malicious users. I constructed some malicious requests on my AGH server to illustrate the problem more clearly. Obviously, Cloudflare and Google could not have used my server as an upstream. <details><summary>Screenshot:</summary> <img width="1168" alt="1" src="https://user-images.githubusercontent.com/13190004/110677495-311cf100-8210-11eb-8dd1-8a106dc19d9b.png"> <img width="1232" alt="2" src="https://user-images.githubusercontent.com/13190004/110677504-337f4b00-8210-11eb-9ffe-721fab8ecb7a.png"> </details> I recommend that AGH add a separate configuration to allow users to set trusted IPs and trust the local loopback by default (127.0.0.1).

deekerman

2026-03-04 02:07:01 -05:00

closed this issue
added the
enhancement

P3: Medium

external libs
labels

deekerman commented

2026-03-04 02:07:08 -05:00

Author

Owner

@SukkaW commented on GitHub (Mar 12, 2021):

@ainar-g

I am afraid it is not a feature request. It should be considered as a security issue.

AGH should implement a restriction to prevent "faking IP".

@SukkaW commented on GitHub (Mar 12, 2021): @ainar-g I am afraid it is not a feature request. It should be considered as a security issue. AGH should implement a restriction to prevent "faking IP".

deekerman commented

2026-03-04 02:07:08 -05:00

Author

Owner

@ameshkov commented on GitHub (Mar 12, 2021):

rate limiting may be completely useless

The thing is that rate-limiting currently only works for UDP, it is a measure for mitigating DNS amplification attacks, and other protocols aren't used for that.

This issue does make Access settings useless, though. It's labeled as "enhancement" (which is not a feature request) since it adds functionality (trusted IPs list).

@ameshkov commented on GitHub (Mar 12, 2021): > rate limiting may be completely useless The thing is that rate-limiting currently only works for UDP, it is a measure for mitigating DNS amplification attacks, and other protocols aren't used for that. This issue does make Access settings useless, though. It's labeled as "enhancement" (which is not a feature request) since it adds functionality (trusted IPs list).

deekerman commented

2026-03-04 02:07:08 -05:00

Author

Owner

@EugeneOne1 commented on GitHub (Jul 26, 2021):

@ZeroClover, there is a new build in the edge channel available. It implements the trusted proxies feature. It's also documented in an appropriate wiki section. Could you please check if it works for you?

@EugeneOne1 commented on GitHub (Jul 26, 2021): @ZeroClover, there is a new build in the edge channel available. It implements the trusted proxies feature. It's also documented in an appropriate [wiki section](https://github.com/AdguardTeam/AdGuardHome/wiki/Encryption#using-with-reverse-proxy). Could you please check if it works for you?

deekerman commented

2026-03-04 02:07:08 -05:00

Author

Owner

@EugeneOne1 commented on GitHub (Jul 30, 2021):

We'll close the issue for now. You're welcome to open the new issues in case of encounter those.

@EugeneOne1 commented on GitHub (Jul 30, 2021): We'll close the issue for now. You're welcome to open the new issues in case of encounter those.

deekerman referenced this issue

2026-03-04 03:17:57 -05:00

从 v0.107.0-b.14 起，没有正确查询域名 #3257

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/AdGuardHome#2551

No description provided.

Rows
Columns