Skip to content

Commit 56fab9e

Browse files
PDowneyPDowney
authored
Bug Fix
1 parent 1c323ce commit 56fab9e

3 files changed

Lines changed: 48 additions & 4 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,16 @@ Changes are organized by date, with the most recent changes listed first.
6363
- **Auto-Upgrade Cleanup**: Added automatic removal of existing EngineScript logrotate configurations during upgrades
6464
- **Selective Approach**: Maintains logrotate for nginx, domains, opcache, and PHP-FPM logs only
6565

66+
### 🌐 CLOUDFLARE IP UPDATER FIXES
67+
68+
- **Missing IP Range Detection**: Fixed critical bug where last IP ranges from Cloudflare's lists were being skipped
69+
- **Root Cause**: Bash `while read` loops don't process final line if it lacks trailing newline character
70+
- **Technical Fix**: Implemented `while IFS= read -r ip || [[ -n "$ip" ]]` pattern for proper last-line handling
71+
- **Complete Coverage**: Now processes all 15 IPv4 ranges (including `131.0.72.0/22`) and 7 IPv6 ranges (including `2c0f:f248::/32`)
72+
- **Debug Enhancement**: Added comprehensive logging and validation counters for troubleshooting
73+
- **Real IP Detection**: Ensures complete Cloudflare edge server IP coverage for accurate client IP detection
74+
- **Auto-Upgrade Integration**: Added automatic Cloudflare IP updates during EngineScript upgrades
75+
6676
## 2025-08-30
6777

6878
### 🔒 UBUNTU PRO SECURITY ENHANCEMENTS

‎scripts/functions/auto-upgrade/normal-auto-upgrade.sh‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,3 +91,10 @@ if [[ -f "/etc/logrotate.d/enginescript" ]]; then
9191
echo "✓ Removed EngineScript logrotate configuration (preserves install logs)"
9292
fi
9393

94+
# Update Cloudflare IP ranges to ensure complete coverage (September 2025)
95+
if [[ -f "/usr/local/bin/enginescript/scripts/install/nginx/nginx-cloudflare-ip-updater.sh" ]]; then
96+
echo "Updating Cloudflare IP ranges..."
97+
bash /usr/local/bin/enginescript/scripts/install/nginx/nginx-cloudflare-ip-updater.sh
98+
echo "✓ Updated Cloudflare IP ranges (complete coverage including latest ranges)"
99+
fi
100+

‎scripts/install/nginx/nginx-cloudflare-ip-updater.sh‎

Lines changed: 31 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -39,8 +39,10 @@ TEMP_FILE_IPV6="/tmp/cloudflare-ipv6"
3939
# Validate IPv4 CIDR addresses
4040
validateIPv4() {
4141
regex="^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$"
42-
while read ip
42+
while IFS= read -r ip || [[ -n "$ip" ]]
4343
do
44+
# Skip empty lines
45+
[[ -z "$ip" ]] && continue
4446
if [[ ! "$ip" =~ $regex ]]; then
4547
echo "FAILED. Reason: Invalid IPv4 address [$ip]"
4648
exit 1
@@ -51,8 +53,10 @@ validateIPv4() {
5153
# Validate IPv6 CIDR addresses
5254
validateIPv6() {
5355
regex="^s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:)))(%.+)?s*(\/([0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8]))?$"
54-
while read ip
56+
while IFS= read -r ip || [[ -n "$ip" ]]
5557
do
58+
# Skip empty lines
59+
[[ -z "$ip" ]] && continue
5660
if [[ ! "$ip" =~ $regex ]]; then
5761
echo "FAILED. Reason: Invalid IPv6 address [$ip]"
5862
exit 1
@@ -81,27 +85,50 @@ else
8185
fi
8286

8387
# Validate IP addresses
88+
echo "Validating downloaded IP addresses..."
8489
validateIPv4
8590
validateIPv6
91+
echo "✓ IP validation completed successfully"
92+
93+
# Count downloaded IPs for verification
94+
IPV4_COUNT=$(wc -l < "$TEMP_FILE_IPV4")
95+
IPV6_COUNT=$(wc -l < "$TEMP_FILE_IPV6")
96+
echo "Downloaded $IPV4_COUNT IPv4 ranges and $IPV6_COUNT IPv6 ranges"
97+
98+
# Debug: Show what was actually downloaded
99+
echo "Debug: IPv4 ranges downloaded:"
100+
cat "$TEMP_FILE_IPV4"
101+
echo "Debug: IPv6 ranges downloaded:"
102+
cat "$TEMP_FILE_IPV6"
86103

87104
# Generate the new config file with the latest IPs
88105
echo "# CloudFlare IP addresses" > $CLOUDFLARE_NGINX_CONFIG
89106
echo "# > IPv4" >> $CLOUDFLARE_NGINX_CONFIG
90107

91-
while read ip
108+
IPV4_PROCESSED=0
109+
while IFS= read -r ip || [[ -n "$ip" ]]
92110
do
111+
# Skip empty lines
112+
[[ -z "$ip" ]] && continue
93113
echo "set_real_ip_from $ip;" >> $CLOUDFLARE_NGINX_CONFIG
114+
((IPV4_PROCESSED++))
94115
done< "$TEMP_FILE_IPV4"
95116

96117
echo "# > IPv6" >> $CLOUDFLARE_NGINX_CONFIG
97118

98-
while read ip
119+
IPV6_PROCESSED=0
120+
while IFS= read -r ip || [[ -n "$ip" ]]
99121
do
122+
# Skip empty lines
123+
[[ -z "$ip" ]] && continue
100124
echo "set_real_ip_from $ip;" >> $CLOUDFLARE_NGINX_CONFIG
125+
((IPV6_PROCESSED++))
101126
done < "$TEMP_FILE_IPV6"
102127

103128
echo "real_ip_header CF-Connecting-IP;" >> $CLOUDFLARE_NGINX_CONFIG
104129

130+
echo "Processed $IPV4_PROCESSED IPv4 ranges and $IPV6_PROCESSED IPv6 ranges into config file"
131+
105132
# Clean-up temporary files
106133
rm $TEMP_FILE_IPV4 $TEMP_FILE_IPV6
107134

0 commit comments

Comments
 (0)