bucket-policy: Add IPAddress/NotIPAddress conditions support (#4736)

cmd/object-handlers_test.go

@@ -3552,3 +3552,56 @@ func testAPIListObjectPartsHandler(obj ObjectLayer, instanceType, bucketName str
 	// `ExecObjectLayerAPINilTest` sets the Object Layer to `nil` and calls the handler.
 	ExecObjectLayerAPINilTest(t, nilBucket, nilObject, instanceType, apiRouter, nilReq)
 }
+
+// TestGetSourceIPAddress - check the source ip of a request is parsed correctly.
+func TestGetSourceIPAddress(t *testing.T) {
+	testCases := []struct {
+		request    *http.Request
+		expectedIP string
+	}{
+		{
+			// Test Case 1. Use only RemoteAddr as host and port.
+			request: &http.Request{
+				RemoteAddr: "127.0.0.1:9000",
+			},
+			expectedIP: "127.0.0.1",
+		},
+		{
+			// Test Case 2. Use both RemoteAddr and single header.
+			request: &http.Request{
+				RemoteAddr: "127.0.0.1:9000",
+				Header: map[string][]string{
+					"X-Real-Ip": {"54.240.143.0"},
+				},
+			},
+			expectedIP: "54.240.143.0", // Use headers before RemoteAddr.
+		},
+		{
+			// Test Case 3. Use both RemoteAddr and several header vals.
+			// Check that first val in header is used.
+			request: &http.Request{
+				RemoteAddr: "127.0.0.1:9000",
+				Header: map[string][]string{
+					"X-Real-Ip": {"54.240.143.0", "54.240.143.188"},
+				},
+			},
+			expectedIP: "54.240.143.0",
+		},
+		{
+			// Test Case 4. Use header and corrupt header value.
+			request: &http.Request{
+				RemoteAddr: "127.0.0.1:9000",
+				Header: map[string][]string{
+					"X-Real-Ip": {"54.240.143.188", "corrupt"},
+				},
+			},
+			expectedIP: "54.240.143.188",
+		},
+	}
+	for i, test := range testCases {
+		receivedIP := getSourceIPAddress(test.request)
+		if test.expectedIP != receivedIP {
+			t.Fatalf("Case %d: Expected the IP to be `%s`, but instead got `%s`", i+1, test.expectedIP, receivedIP)
+		}
+	}
+}