The connection log is generated using the handlers.CombinedLoggingHandler library function as can be seen here..

You're right that this currently doesn't respect X-Forwarded-For headers. I think an easy way to update this would be to wrap the handler CombinedLoggingHandler receives in a call to handlers.ProxyHeaders. Something like this:

...
adminHandler = gzipWrapper(adminHandler)

// Respect X-Forwarded-For and X-Real-IP headers in case we're behind a
// reverse proxy.
adminHandler = handlers.ProxyHeaders(adminHandler)

// Setup logging
adminHandler = handlers.CombinedLoggingHandler(log.Writer(), adminHandler)
...

Note that this would need to be done in both admin.go and phish.go (for now until I finally get around to pushing out my refactoring that combines some of this stuff!)

I had some time so I went ahead and knocked it out. Let me know if that works for you!

Hi @jordan-wright, thanks for the help!

This almost works, I'm getting the real IP, but as an unwanted bonus a 500 internal server error too:

time="2020-10-11T19:31:51Z" level=info msg="x.x.x.167 - - [11/Oct/2020:19:31:51 +0000] \"GET / HTTP/1.1\" 307 51 \"\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36\""
time="2020-10-11T19:31:51Z" level=error msg="Unable to determine client IP address: address x.x.x.167: missing port in address"```

No worries at all! I'm also debugging on my side. Trying to replicate the error with some curl commands.

This seems to cause the crash:

curl -i -H "X-Real-Ip: 1.2.3.167"  http://localhost:3333/login 

HTTP/1.1 500 Internal Server Error
Content-Security-Policy: frame-ancestors 'none';
Content-Type: text/plain; charset=utf-8
Set-Cookie: _gorilla_csrf=x-JxXsQ6AB3iWZwXpAlr; Expires=Mon, 12 Oct 2020 08:28:15 GMT; Max-Age=43200; HttpOnly; SameSite
Vary: Accept-Encoding
Vary: Cookie
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Date: Sun, 11 Oct 2020 20:28:15 GMT
Content-Length: 22

Internal Server Error

gophish console:

time="2020-10-11T20:30:18Z" level=error msg="Unable to determine client IP address: address 1.2.3.167: missing port in address"
time="2020-10-11T20:30:18Z" level=info msg="1.2.3.167 - - [11/Oct/2020:20:30:18 +0000] \"GET /login HTTP/1.1\" 500 22 \"\" \"curl/7.58.0\""

Tested on remote Ubuntu server as well as local Mac.

Adding a port seems to result in no crash:

curl -i -H "X-Real-Ip: 1.2.3.167:1234" http://localhost:3333/login

Ok, should be fixed with 2315412. The ratelimiter was getting upset that the IP didn't have a port, so I just removed that check to handle things more gracefully.

Feel free to reopen if you still don't see this fixing the bug. Sorry again for the hassle!