Fix trusted proxy client IP matching

[JasonLovesDoggo]

Impact

Defender previously evaluated r.RemoteAddr, the immediate peer address, instead of Caddy's resolved client_ip request variable. In deployments behind a trusted proxy, CDN, or load balancer, a blocked client could be allowed when the direct proxy address was not in a blocked range. This is a bypass of Defender's IP-based blocking policy for affected proxy deployments.

Patches

This patch makes Defender prefer Caddy's resolved client_ip value when present, with a fallback to RemoteAddr for direct request contexts. It also adds regression coverage for a blocked client_ip behind an unblocked direct peer.

Users should upgrade to the first release containing this patch.

Workarounds

Before upgrading, users can block the proxy or load balancer IP ranges directly, but that is usually too broad and may block legitimate traffic. Deployments that do not rely on trusted proxy client IP resolution are less exposed.

References

• Caddy request matcher documentation for client_ip and remote_ip: https://caddyserver.com/docs/caddyfile/matchers#client-ip
• Caddy trusted_proxies documentation: https://caddyserver.com/docs/caddyfile/options#trusted-proxies

Validation

• go test . -run TestDefenderServeHTTP_UsesCaddyClientIP -count=1
• go test ./...