Repository: envoyproxy/envoy
File: api/envoy/extensions/http/original_ip_detection/xff/v3/xff.proto (Protocol Buffers)

Code before:
  // is false, otherwise :ref:`skip_xff_append
  // <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.skip_xff_append>`
  // applies.
  google.protobuf.BoolValue skip_xff_append = 3;

  // If set to true, in addition to checking addresses against the ``xff_trusted_cidrs``,
  // private IP address ranges will also be skipped when determining the original client address.
  // This includes:
  //
  // - IPv4: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8
  // - IPv6: fc00::/7, ::1/128
  //
  // When enabled, the extension will iterate through the x-forwarded-for header from right to left
  // and return the first address that is neither in the trusted CIDR list nor a private address.
  // If all addresses are either trusted or private, the leftmost address will be returned.
  //
  // This setting is useful when you want to automatically skip private IP addresses without
  // explicitly adding them to the ``xff_trusted_cidrs`` list, which was the default behavior
  // prior to Envoy 1.33.0.
  //
  // .. note::
  //   This option only applies when ``xff_trusted_cidrs`` is configured. It has no effect
  //   when using ``xff_num_trusted_hops``.
  //
  // Defaults to false.
  bool skip_private_addresses = 4;
}

message XffTrustedCidrs {
  // The list of `CIDRs <https://tools.ietf.org/html/rfc4632>`_ from which remote
  // connections are considered trusted.
  repeated config.core.v3.CidrRange cidrs = 1;
}


Review comment (suggestion):
I think we can simply configure the private addresses cidr in the `xff_trusted_cidrs` and then could achieve same target? That's say we needn't do any code change but only update the document to tell users how to do that? WDYT?

/wait-any

Code after:
  //           prefix_len: 128
  //
  //   See :ref:`internal_address_config
  //   <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.internal_address_config>`
  //   for more information about the v1.33.0 behavior change.
  //
  // This is typically used when requests are proxied by a
  // `CDN <https://en.wikipedia.org/wiki/Content_delivery_network>`_.
  //
  // Only one of ``xff_num_trusted_hops`` and ``xff_trusted_cidrs`` can be set.
  XffTrustedCidrs xff_trusted_cidrs = 2;

  // If set, Envoy will not append the remote address to the
  // :ref:`config_http_conn_man_headers_x-forwarded-for` HTTP header.
  //
  // .. attention::
  //
  //   For proper proxy behaviour it is not recommended to set this option.
  //   For backwards compatibility, if this option is unset it defaults to true.
  //
  // This only applies when :ref:`use_remote_address
  // <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.use_remote_address>`
  // is false, otherwise :ref:`skip_xff_append
  // <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.skip_xff_append>`
  // applies.
  google.protobuf.BoolValue skip_xff_append = 3;
}

message XffTrustedCidrs {
  // The list of `CIDRs <https://tools.ietf.org/html/rfc4632>`_ from which remote
  // connections are considered trusted.
  repeated config.core.v3.CidrRange cidrs = 1;
}