Add X-Forwarded-For IP extraction and rate limit logging

[Deniskore]

No description provided.

[Copilot]

Pull request overview

This PR introduces trusted X-Forwarded-For client IP extraction (guarded by a new http.trusted_proxy_cidrs config) and extends rate-limit/unauthorized request logging to include resolved client IP context, with accompanying test updates.

Changes:

• Add http.trusted_proxy_cidrs configuration (validated + parsed at runtime) and a shared client_ip resolver that can use X-Forwarded-For only when the immediate peer is trusted.
• Update rate-limit/whitelist/IP attribution code paths to use the new client IP resolver.
• Add/adjust integration tests around X-Forwarded-For behavior and reduce flakiness in a get_load missing-info test.

Reviewed changes

Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tests/common/real_harness.rs	Adds harness option to set trusted_proxy_cidrs in test configs.
tests/client_http_api/misc.rs	Makes the “missing gateway info” behavior test more tolerant of startup states.
tests/client_http_api/add_task.rs	Adds tests ensuring XFF cannot spoof without trusted proxy, and exercises trusted proxy XFF parsing.
src/http3/whitelist.rs	Switches whitelist checks to use resolved client IP (supports trusted XFF).
src/http3/response.rs	Logs client IP for error responses using resolved IP when available.
src/http3/rate_limits.rs	Uses resolved IP for rate limiting keys and adds rate-limit exceeded warnings (incl. optional user email).
src/http3/mod.rs	Exposes new client_ip module.
src/http3/handlers/task/add_task.rs	Uses resolved client IP for add_task peer attribution.
src/http3/handlers/result/add_result.rs	Uses resolved client IP for add_result peer attribution.
src/http3/handlers/core.rs	Adds warning logs for invalid/blocked API key attempts including source IP.
src/http3/handlers/common/peer.rs	Updates request_ip helper to use resolved client IP with trusted proxies.
src/http3/handlers/admin.rs	Uses resolved client IP for admin-key failure limiting key.
src/http3/client_ip.rs	New module implementing client IP resolution from remote addr + trusted XFF.
src/config.rs	Adds trusted_proxy_cidrs, validation, and CIDR/IP parsing into TrustedProxyRange.
src/config_runtime.rs	Parses trusted_proxy_cidrs into runtime snapshot for efficient lookup.
dev-env/config/config1.toml	Documents and adds trusted_proxy_cidrs to dev config.
dev-env/config/config2.toml	Documents and adds trusted_proxy_cidrs to dev config.
dev-env/config/config3.toml	Documents and adds trusted_proxy_cidrs to dev config.
dev-env/config/config-single.toml	Documents and adds trusted_proxy_cidrs to dev config.
Cargo.toml	Bumps several dependency versions.
Cargo.lock	Updates lockfile to match dependency bumps.

Comments suppressed due to low confidence (1)

src/http3/whitelist.rs:116

• Variable name remote_ip is now populated via client_ip(...) (potentially derived from X-Forwarded-For), so it’s no longer necessarily the remote socket IP. Renaming it (e.g., client_ip/resolved_ip) would avoid confusion when reading whitelist logic.

pub fn is_whitelisted_ip(req: &Request, state: &HttpState) -> bool {
    let cfg = state.config();
    let remote_ip = client_ip(req, cfg.trusted_proxy_cidrs());

    if let Some(ip) = remote_ip {
        return state.gateway_state().is_rate_limit_whitelisted_ip(&ip);
    }

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.