Add support for unix domain sockets

[fenichelar]

Adds support for unix domain sockets (i.e., req.socket.remoteAddress is undefined).

Checklist

• run npm run test && npm run benchmark --if-present
• tests and/or benchmarks are included
• documentation is changed or added
• commit message and code follows the Developer's Certification of Origin
  and the Code of conduct

[mcollina]

lgtm

[Tony133]

LGTM

Could you also update the README? It currently says that the returned array includes the socket address and that index 0 is the socket address. This is no longer accurate for Unix domain sockets after this change, since no socket address is included and the returned array can be empty.

[Tony133]

LGTM

[gurgunday]

This should be reverted, Fastify's CI is affected and there are issues with it

• When the socket has no remoteAddress, the trust function never gets to check the immediate peer. The client-supplied X-Forwarded-For value comes back as request.ip no matter what the trust setting is.
• trustProxy: '127.0.0.1' with a gone socket and X-Forwarded-For: 6.6.6.6 gives request.ip === '6.6.6.6'.
• It also defeats the numeric trustProxy fix in 5.x (8acfea7e).
• A missing remoteAddress happens on unix sockets, which is the use case of the new feature, and on destroyed sockets, for example reading request.ip after a client disconnects. Anything that uses request.ip for rate limiting, allowlists or audit logs can be spoofed in those cases.

Honestly, this was not the right place for the fix. It should be in proxy-addr

@fastify/plugins

[fenichelar]

@gurgunday

When the socket has no remoteAddress, the trust function never gets to check the immediate peer. The client-supplied X-Forwarded-For value comes back as request.ip no matter what the trust setting is.

If the reason the socket has no remoteAddress is because it is a unix domain socket, then what alterantive would you want to happen in this case?

trustProxy: '127.0.0.1' with a gone socket and X-Forwarded-For: 6.6.6.6 gives request.ip === '6.6.6.6'.

Again, if unix sockets are being used, this is likely the desired behavior.

A missing remoteAddress happens on unix sockets, which is the use case of the new feature, and on destroyed sockets, for example reading request.ip after a client disconnects. Anything that uses request.ip for rate limiting, allowlists or audit logs can be spoofed in those cases.

I agree the destroyed socket spoofing case is a concern but note that prior to this change when a socket was destroyed this library would return undefined so rate limiting, allowlists, or audit logs didn't work before either.

Honestly, this was not the right place for the fix. It should be in proxy-addr

I agree this is not the right place for this, but I also am not sure it can be fixed in just proxy-addr given how forwarded behaves in the case of an undefined remoteAddress.

[fenichelar]

PR submitted to proxy-addr: fastify/proxy-addr#119. Removed dependency on forwarded in order to be able to control whether the remoteAddress is used.