From 083bc14972fcfd28caa90676ce92ef09100bbd77 Mon Sep 17 00:00:00 2001 From: Your Name Date: Mon, 23 Feb 2026 16:26:23 -0400 Subject: [PATCH] v1.2.21 - Fix IP ban check: use pss->client_ip (proxy-aware) instead of raw socket IP to match failure recording --- src/main.h | 4 ++-- src/websockets.c | 19 ++++++++----------- 2 files changed, 10 insertions(+), 13 deletions(-) diff --git a/src/main.h b/src/main.h index 10edb4a..229cfd9 100644 --- a/src/main.h +++ b/src/main.h @@ -13,8 +13,8 @@ // Using CRELAY_ prefix to avoid conflicts with nostr_core_lib VERSION macros #define CRELAY_VERSION_MAJOR 1 #define CRELAY_VERSION_MINOR 2 -#define CRELAY_VERSION_PATCH 20 -#define CRELAY_VERSION "v1.2.20" +#define CRELAY_VERSION_PATCH 21 +#define CRELAY_VERSION "v1.2.21" // Relay metadata (authoritative source for NIP-11 information) #define RELAY_NAME "C-Relay" diff --git a/src/websockets.c b/src/websockets.c index 75ef6c9..bbd2ee1 100644 --- a/src/websockets.c +++ b/src/websockets.c @@ -463,17 +463,6 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso case LWS_CALLBACK_ESTABLISHED: DEBUG_TRACE("WebSocket connection established"); - - // Check IP ban before doing any work — reject banned IPs immediately - { - char check_ip[CLIENT_IP_MAX_LENGTH] = {0}; - const char* fwd = lws_get_peer_simple(wsi, check_ip, sizeof(check_ip)); - (void)fwd; - if (ip_ban_is_banned(check_ip)) { - DEBUG_LOG("Rejecting banned IP %s at connection establishment", check_ip); - return -1; // Close connection immediately - } - } memset(pss, 0, sizeof(*pss)); pthread_mutex_init(&pss->session_lock, NULL); @@ -558,6 +547,14 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso pss->challenge_created = 0; pss->challenge_expires = 0; + // Check IP ban using the resolved client IP (which may be from X-Forwarded-For). + // This must happen AFTER pss->client_ip is populated so the same IP string + // is used for both ban recording (at CLOSED) and ban checking (here). + if (ip_ban_is_banned(pss->client_ip)) { + DEBUG_LOG("Rejecting banned IP %s at connection establishment", pss->client_ip); + return -1; // Close connection immediately — no challenge, no processing + } + // Set libwebsockets auth timeout: if NIP-42 auth is required and the client // doesn't authenticate within nip42_auth_timeout_sec seconds, lws will close // the connection automatically — even if the client never sends a message.