v1.2.21 - Fix IP ban check: use pss->client_ip (proxy-aware) instead of raw socket IP to match failure recording

src/main.h

@@ -13,8 +13,8 @@
 // Using CRELAY_ prefix to avoid conflicts with nostr_core_lib VERSION macros
 #define CRELAY_VERSION_MAJOR 1
 #define CRELAY_VERSION_MINOR 2
-#define CRELAY_VERSION_PATCH 20
-#define CRELAY_VERSION "v1.2.20"
+#define CRELAY_VERSION_PATCH 21
+#define CRELAY_VERSION "v1.2.21"
 
 // Relay metadata (authoritative source for NIP-11 information)
 #define RELAY_NAME "C-Relay"

src/websockets.c

@@ -463,17 +463,6 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
             
         case LWS_CALLBACK_ESTABLISHED:
             DEBUG_TRACE("WebSocket connection established");
-
-            // Check IP ban before doing any work — reject banned IPs immediately
-            {
-                char check_ip[CLIENT_IP_MAX_LENGTH] = {0};
-                const char* fwd = lws_get_peer_simple(wsi, check_ip, sizeof(check_ip));
-                (void)fwd;
-                if (ip_ban_is_banned(check_ip)) {
-                    DEBUG_LOG("Rejecting banned IP %s at connection establishment", check_ip);
-                    return -1;  // Close connection immediately
-                }
-            }
             memset(pss, 0, sizeof(*pss));
             pthread_mutex_init(&pss->session_lock, NULL);
 
@@ -558,6 +547,14 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
             pss->challenge_created = 0;
             pss->challenge_expires = 0;
 
+            // Check IP ban using the resolved client IP (which may be from X-Forwarded-For).
+            // This must happen AFTER pss->client_ip is populated so the same IP string
+            // is used for both ban recording (at CLOSED) and ban checking (here).
+            if (ip_ban_is_banned(pss->client_ip)) {
+                DEBUG_LOG("Rejecting banned IP %s at connection establishment", pss->client_ip);
+                return -1;  // Close connection immediately — no challenge, no processing
+            }
+
             // Set libwebsockets auth timeout: if NIP-42 auth is required and the client
             // doesn't authenticate within nip42_auth_timeout_sec seconds, lws will close
             // the connection automatically — even if the client never sends a message.