IBX-11181: Filtered client-supplied X-Forwarded-* headers in Varnish VCL

[vidarl]

🎫 Issue	IBX-11181

Caution

DO-NOT-MERGE : PR contains TMP commit with dependencies.json for making CI green

Related PRs:

• IBX-11181: Trusted Proxies is not set on Ibexa Cloud core#699
• IBX-11181: Added trusted_proxies ACL to Varnish setup docker#65
• IBX-11181: Filtered client-supplied X-Forwarded-* headers in Varnish VCL post-install#108
• IBX-11181: Filtered client-supplied X-Forwarded-* headers in Varnish VCL cloud#13

Description:

Follow-up to ibexa/core#699, which makes Ibexa DXP declare the peer a trusted proxy when a request
arrives via Fastly on Ibexa Cloud. Once trusted proxies are in play, every X-Forwarded-* header a
client sends is believed by Symfony, so Varnish has to stop them from reaching the application.

Until now the VCLs took X-Forwarded-Proto straight from the client and derived X-Forwarded-Port
from it, and never touched Forwarded, X-Forwarded-Host or X-Forwarded-Prefix. A client could
therefore spoof the scheme and host the application sees. Since X-Forwarded-* is not part of the
Varnish cache key, a spoofed value also poisons the cached object for everyone else.

vcl_recv now strips those headers for every client that is not listed in a new trusted_proxies
ACL in parameters.vcl, and overwrites X-Forwarded-For with the real client IP. X-Client-IP and
Client-Cdn are stripped too, so a client cannot fake the Ibexa Cloud detection added in
ibexa/core#699. A proxy that is in the ACL keeps passing everything through, which is what a TLS
terminator, load balancer or CDN in front of Varnish relies on.

Applies to varnish5.vcl, varnish6.vcl and varnish7.vcl. varnish9.vcl is deliberately left
out while its own PRs are open; it gets the same treatment once they land.

BC breaks:

varnish5/6/7.vcl now reference the trusted_proxies ACL, which lives in parameters.vcl. Varnish
resolves ACLs at VCL load time, so parameters.vcl and the VCL must be updated together - an
existing parameters.vcl without the ACL makes Varnish fail to load with
Symbol not found: 'trusted_proxies'. There is no way to make an ACL reference optional in VCL.

The ACL ships with localhost only. Anyone running a TLS terminator in front of Varnish has to add
its IP, otherwise the X-Forwarded-Proto it sets is discarded and URLs are generated as http://.
Documented in docs/varnish/README.md.

For QA:

Check that https URL generation still works behind a TLS terminator once its IP is added to the
trusted_proxies ACL, and that cache invalidation and the X-Cache debug headers are unaffected.
Easiest done using a custom controller that outputs those headers if they exists, maybe

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE