technocloud-public/nginx-unit
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Router: client IP address replacement.

Browse Source 
This commit introduces the replacement of the client address based on the value
of a specified HTTP header.  This is intended for use when Unit is placed
behind a reverse proxy like nginx or a CDN.

You must specify the source addresses of the trusted proxies.  This can be
accomplished with any valid IP pattern supported by Unit's match block:

["10.0.0.1", "10.4.0.0/16", "!192.168.1.1"]

The feature is configured per listener.

The client address replacement functionality only operates when there is a
source IP match and the specified header is present.  Typically this would be
an 'X-Forwarded-For' header.

{
    "listeners": {
        "127.0.0.1:8080": {
            "client_ip": {
                "header": "X-Forwarded-For",
                "source": [
                    "10.0.0.0/8"
                ]
            },
            "pass": "applications/my_app"
        },
    }
}

If a request occurs and Unit receives a header like below:

"X-Forwarded-For: 84.123.23.23"

By default, Unit trusts the last rightmost IP in the header, so REMOTE_ADDR
will be set to 84.123.23.23 if the connection originated from 10.0.0.0/8.

If Unit runs behind consecutive reverse proxies and receives a header similar
to the following:

"X-Forwarded-For: 84.123.23.23, 10.0.0.254"

You will need to enable "recursive" checking, which walks the header from
last address to first and chooses the first non-trusted address it finds.

{
    "listeners": {
        "127.0.0.1:8080": {
            "client_ip": {
                "header": "X-Forwarded-For",
                "source": [
                    "10.0.0.0/8"
                ]
                "recursive": true,
            },
            "pass": "applications/my_app"
        },
    }
}

If a connection from 10.0.0.0/8 occurs, the chain is walked.  Here, 10.0.0.254
is also a trusted address so the client address will be replaced with
84.123.23.23.

If all IP addresses in the header are trusted, the client address is set to
the first address in the header:

If 10.0.0.0/8 is trusted and "X-Forwarded-For: 10.0.0.3, 10.0.0.2, 10.0.0.1",
the client address will be replaced with 10.0.0.3.
This commit is contained in:
Oisin Canty
2021-08-12 08:23:16 +00:00
parent 73ea6a1c3a
commit ca373aaccd
7 changed files with 288 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
docs/changes.xml
View File

@@ -49,6 +49,12 @@ application restart control.
</para>
</change>
<change type="feature">
<para>
client IP address replacement from specified HTTP header field.
</para>
</change>
<change type="bugfix">
<para>
TLS connection was rejected for configuration with more than one

25
src/nxt_conf_validation.c
View File

@@ -208,6 +208,7 @@ static nxt_conf_vldt_object_t nxt_conf_vldt_setting_members[];
static nxt_conf_vldt_object_t nxt_conf_vldt_http_members[];
static nxt_conf_vldt_object_t nxt_conf_vldt_websocket_members[];
static nxt_conf_vldt_object_t nxt_conf_vldt_static_members[];
static nxt_conf_vldt_object_t nxt_conf_vldt_client_ip_members[];
#if (NXT_TLS)
static nxt_conf_vldt_object_t nxt_conf_vldt_tls_members[];
static nxt_conf_vldt_object_t nxt_conf_vldt_session_members[];
@@ -351,6 +352,11 @@ static nxt_conf_vldt_object_t nxt_conf_vldt_listener_members[] = {
.name = nxt_string("application"),
.type = NXT_CONF_VLDT_STRING,
.validator = nxt_conf_vldt_app_name,
}, {
.name = nxt_string("client_ip"),
.type = NXT_CONF_VLDT_OBJECT,
.validator = nxt_conf_vldt_object,
.u.members = nxt_conf_vldt_client_ip_members
},
#if (NXT_TLS)
@@ -366,6 +372,25 @@ static nxt_conf_vldt_object_t nxt_conf_vldt_listener_members[] = {
};
static nxt_conf_vldt_object_t nxt_conf_vldt_client_ip_members[] = {
{
.name = nxt_string("source"),
.type = NXT_CONF_VLDT_STRING | NXT_CONF_VLDT_ARRAY,
.validator = nxt_conf_vldt_match_addrs,
.flags = NXT_CONF_VLDT_REQUIRED
}, {
.name = nxt_string("header"),
.type = NXT_CONF_VLDT_STRING,
.flags = NXT_CONF_VLDT_REQUIRED
}, {
.name = nxt_string("recursive"),
.type = NXT_CONF_VLDT_BOOLEAN,
},
NXT_CONF_VLDT_END
};
#if (NXT_TLS)
static nxt_conf_vldt_object_t nxt_conf_vldt_tls_members[] = {

13
src/nxt_http.h
View File

@@ -199,6 +199,7 @@ struct nxt_http_request_s {
typedef struct nxt_http_route_s nxt_http_route_t;
typedef struct nxt_http_route_rule_s nxt_http_route_rule_t;
typedef struct nxt_http_route_addr_rule_s nxt_http_route_addr_rule_t;
typedef struct {
@@ -254,6 +255,14 @@ typedef struct {
} nxt_http_proto_table_t;
struct nxt_http_client_ip_s {
nxt_http_route_addr_rule_t *source;
nxt_str_t *header;
uint32_t header_hash;
uint8_t recursive; /* 1 bit */
};
#define NXT_HTTP_DATE_LEN nxt_length("Wed, 31 Dec 1986 16:40:00 GMT")
nxt_inline u_char *
@@ -311,6 +320,10 @@ nxt_int_t nxt_http_pass_segments(nxt_mp_t *mp, nxt_str_t *pass,
nxt_str_t *segments, nxt_uint_t n);
nxt_http_action_t *nxt_http_pass_application(nxt_task_t *task,
nxt_router_conf_t *rtcf, nxt_str_t *name);
nxt_http_route_addr_rule_t *nxt_http_route_addr_rule_create(
nxt_task_t *task, nxt_mp_t *mp, nxt_conf_value_t *cv);
nxt_int_t nxt_http_route_addr_rule(nxt_http_request_t *r,
nxt_http_route_addr_rule_t *addr_rule, nxt_sockaddr_t *sockaddr);
nxt_http_route_rule_t *nxt_http_route_types_rule_create(nxt_task_t *task,
nxt_mp_t *mp, nxt_conf_value_t *types);
nxt_int_t nxt_http_route_test_rule(nxt_http_request_t *r,

150
src/nxt_http_request.c
View File

@@ -10,6 +10,10 @@
static nxt_int_t nxt_http_validate_host(nxt_str_t *host, nxt_mp_t *mp);
static void nxt_http_request_start(nxt_task_t *task, void *obj, void *data);
static nxt_int_t nxt_http_request_client_ip(nxt_task_t *task,
nxt_http_request_t *r);
static nxt_sockaddr_t *nxt_http_request_client_ip_sockaddr(
nxt_http_request_t *r, u_char *start, size_t len);
static void nxt_http_request_ready(nxt_task_t *task, void *obj, void *data);
static void nxt_http_request_proto_info(nxt_task_t *task,
nxt_http_request_t *r);
@@ -272,16 +276,162 @@ static const nxt_http_request_state_t nxt_http_request_init_state
static void
nxt_http_request_start(nxt_task_t *task, void *obj, void *data)
{
nxt_int_t ret;
nxt_http_request_t *r;
r = obj;
r->state = &nxt_http_request_body_state;
ret = nxt_http_request_client_ip(task, r);
if (nxt_slow_path(ret != NXT_OK)) {
nxt_http_request_error(task, r, NXT_HTTP_INTERNAL_SERVER_ERROR);
}
nxt_http_request_read_body(task, r);
}
static nxt_int_t
nxt_http_request_client_ip(nxt_task_t *task, nxt_http_request_t *r)
{
u_char *start, *p;
nxt_int_t ret, i, len;
nxt_str_t *header;
nxt_array_t *fields_arr; /* of nxt_http_field_t * */
nxt_sockaddr_t *sa, *prev_sa;
nxt_http_field_t *f, **fields;
nxt_http_client_ip_t *client_ip;
client_ip = r->conf->socket_conf->client_ip;
if (client_ip == NULL) {
return NXT_OK;
}
ret = nxt_http_route_addr_rule(r, client_ip->source, r->remote);
if (ret <= 0) {
return NXT_OK;
}
header = client_ip->header;
fields_arr = nxt_array_create(r->mem_pool, 2, sizeof(nxt_http_field_t *));
if (nxt_slow_path(fields_arr == NULL)) {
return NXT_ERROR;
}
nxt_list_each(f, r->fields) {
if (f->hash == client_ip->header_hash
&& f->name_length == client_ip->header->length
&& f->value_length > 0
&& nxt_memcasecmp(f->name, header->start, header->length) == 0)
{
fields = nxt_array_add(fields_arr);
if (nxt_slow_path(fields == NULL)) {
return NXT_ERROR;
}
*fields = f;
}
} nxt_list_loop;
prev_sa = r->remote;
fields = (nxt_http_field_t **) fields_arr->elts;
i = fields_arr->nelts;
while (i-- > 0) {
f = fields[i];
start = f->value;
len = f->value_length;
do {
for (p = start + len - 1; p > start; p--, len--) {
if (*p != ' ' && *p != ',') {
break;
}
}
for (/* void */; p > start; p--) {
if (*p == ' ' || *p == ',') {
p++;
break;
}
}
sa = nxt_http_request_client_ip_sockaddr(r, p, len - (p - start));
if (nxt_slow_path(sa == NULL)) {
if (prev_sa != NULL) {
r->remote = prev_sa;
}
return NXT_OK;
}
if (!client_ip->recursive) {
r->remote = sa;
return NXT_OK;
}
ret = nxt_http_route_addr_rule(r, client_ip->source, sa);
if (ret <= 0 || (i == 0 && p == start)) {
r->remote = sa;
return NXT_OK;
}
prev_sa = sa;
len = p - 1 - start;
} while (len > 0);
}
return NXT_OK;
}
static nxt_sockaddr_t *
nxt_http_request_client_ip_sockaddr(nxt_http_request_t *r, u_char *start,
size_t len)
{
nxt_str_t addr;
nxt_sockaddr_t *sa;
addr.start = start;
addr.length = len;
sa = nxt_sockaddr_parse_optport(r->mem_pool, &addr);
if (nxt_slow_path(sa == NULL)) {
return NULL;
}
switch (sa->u.sockaddr.sa_family) {
case AF_INET:
if (sa->u.sockaddr_in.sin_addr.s_addr == INADDR_ANY) {
return NULL;
}
break;
#if (NXT_INET6)
case AF_INET6:
if (IN6_IS_ADDR_UNSPECIFIED(&sa->u.sockaddr_in6.sin6_addr)) {
return NULL;
}
break;
#endif /* NXT_INET6 */
default:
return NULL;
}
return sa;
}
static const nxt_http_request_state_t nxt_http_request_body_state
nxt_aligned(64) =
{

12
src/nxt_http_route.c
View File

@@ -135,12 +135,12 @@ typedef struct {
} nxt_http_route_table_t;
typedef struct {
struct nxt_http_route_addr_rule_s {
/* The object must be the first field. */
nxt_http_route_object_t object:8;
uint32_t items;
nxt_http_route_addr_pattern_t addr_pattern[0];
} nxt_http_route_addr_rule_t;
};
typedef union {
@@ -194,8 +194,6 @@ static nxt_http_route_ruleset_t *nxt_http_route_ruleset_create(nxt_task_t *task,
static nxt_http_route_rule_t *nxt_http_route_rule_name_create(nxt_task_t *task,
nxt_mp_t *mp, nxt_conf_value_t *rule_cv, nxt_str_t *name,
nxt_bool_t case_sensitive, nxt_http_route_encoding_t encoding);
static nxt_http_route_addr_rule_t *nxt_http_route_addr_rule_create(
nxt_task_t *task, nxt_mp_t *mp, nxt_conf_value_t *cv);
static nxt_http_route_rule_t *nxt_http_route_rule_create(nxt_task_t *task,
nxt_mp_t *mp, nxt_conf_value_t *cv, nxt_bool_t case_sensitive,
nxt_http_route_pattern_case_t pattern_case,
@@ -237,8 +235,6 @@ static nxt_int_t nxt_http_route_table(nxt_http_request_t *r,
nxt_http_route_table_t *table);
static nxt_int_t nxt_http_route_ruleset(nxt_http_request_t *r,
nxt_http_route_ruleset_t *ruleset);
static nxt_int_t nxt_http_route_addr_rule(nxt_http_request_t *r,
nxt_http_route_addr_rule_t *addr_rule, nxt_sockaddr_t *sockaddr);
static nxt_int_t nxt_http_route_rule(nxt_http_request_t *r,
nxt_http_route_rule_t *rule);
static nxt_int_t nxt_http_route_header(nxt_http_request_t *r,
@@ -940,7 +936,7 @@ nxt_http_route_rule_create(nxt_task_t *task, nxt_mp_t *mp,
}
static nxt_http_route_addr_rule_t *
nxt_http_route_addr_rule_t *
nxt_http_route_addr_rule_create(nxt_task_t *task, nxt_mp_t *mp,
nxt_conf_value_t *cv)
{
@@ -1927,7 +1923,7 @@ nxt_http_route_addr_pattern_match(nxt_http_route_addr_pattern_t *p,
}
static nxt_int_t
nxt_int_t
nxt_http_route_addr_rule(nxt_http_request_t *r,
nxt_http_route_addr_rule_t *addr_rule, nxt_sockaddr_t *sa)
{

86
src/nxt_router.c
View File

@@ -107,6 +107,9 @@ static nxt_int_t nxt_router_conf_create(nxt_task_t *task,
nxt_router_temp_conf_t *tmcf, u_char *start, u_char *end);
static nxt_int_t nxt_router_conf_process_static(nxt_task_t *task,
nxt_router_conf_t *rtcf, nxt_conf_value_t *conf);
static nxt_int_t nxt_router_conf_process_client_ip(nxt_task_t *task,
nxt_router_temp_conf_t *tmcf, nxt_socket_conf_t *skcf,
nxt_conf_value_t *conf);
static nxt_app_t *nxt_router_app_find(nxt_queue_t *queue, nxt_str_t *name);
static nxt_int_t nxt_router_apps_hash_test(nxt_lvlhsh_query_t *lhq, void *data);
@@ -1450,7 +1453,7 @@ nxt_router_conf_create(nxt_task_t *task, nxt_router_temp_conf_t *tmcf,
nxt_conf_value_t *conf, *http, *value, *websocket;
nxt_conf_value_t *applications, *application;
nxt_conf_value_t *listeners, *listener;
nxt_conf_value_t *routes_conf, *static_conf;
nxt_conf_value_t *routes_conf, *static_conf, *client_ip_conf;
nxt_socket_conf_t *skcf;
nxt_http_routes_t *routes;
nxt_event_engine_t *engine;
@@ -1472,6 +1475,7 @@ nxt_router_conf_create(nxt_task_t *task, nxt_router_temp_conf_t *tmcf,
#endif
static nxt_str_t static_path = nxt_string("/settings/http/static");
static nxt_str_t websocket_path = nxt_string("/settings/http/websocket");
static nxt_str_t client_ip_path = nxt_string("/client_ip");
conf = nxt_conf_json_parse(tmcf->mem_pool, start, end, NULL);
if (conf == NULL) {
@@ -1843,6 +1847,13 @@ nxt_router_conf_create(nxt_task_t *task, nxt_router_temp_conf_t *tmcf,
t->length = nxt_strlen(t->start);
}
client_ip_conf = nxt_conf_get_path(listener, &client_ip_path);
ret = nxt_router_conf_process_client_ip(task, tmcf, skcf,
client_ip_conf);
if (nxt_slow_path(ret != NXT_OK)) {
return NXT_ERROR;
}
#if (NXT_TLS)
certificate = nxt_conf_get_path(listener, &certificate_path);
@@ -2085,6 +2096,79 @@ nxt_router_conf_process_static(nxt_task_t *task, nxt_router_conf_t *rtcf,
}
static nxt_int_t
nxt_router_conf_process_client_ip(nxt_task_t *task, nxt_router_temp_conf_t *tmcf,
nxt_socket_conf_t *skcf, nxt_conf_value_t *conf)
{
char c;
size_t i;
nxt_mp_t *mp;
uint32_t hash;
nxt_str_t header;
nxt_conf_value_t *source_conf, *header_conf, *recursive_conf;
nxt_http_client_ip_t *client_ip;
nxt_http_route_addr_rule_t *source;
static nxt_str_t header_path = nxt_string("/header");
static nxt_str_t source_path = nxt_string("/source");
static nxt_str_t recursive_path = nxt_string("/recursive");
if (conf == NULL) {
skcf->client_ip = NULL;
return NXT_OK;
}
mp = tmcf->router_conf->mem_pool;
source_conf = nxt_conf_get_path(conf, &source_path);
header_conf = nxt_conf_get_path(conf, &header_path);
recursive_conf = nxt_conf_get_path(conf, &recursive_path);
if (source_conf == NULL || header_conf == NULL) {
return NXT_ERROR;
}
client_ip = nxt_mp_zget(mp, sizeof(nxt_http_client_ip_t));
if (nxt_slow_path(client_ip == NULL)) {
return NXT_ERROR;
}
source = nxt_http_route_addr_rule_create(task, mp, source_conf);
if (nxt_slow_path(source == NULL)) {
return NXT_ERROR;
}
client_ip->source = source;
nxt_conf_get_string(header_conf, &header);
if (recursive_conf != NULL) {
client_ip->recursive = nxt_conf_get_boolean(recursive_conf);
}
client_ip->header = nxt_str_dup(mp, NULL, &header);
if (nxt_slow_path(client_ip->header == NULL)) {
return NXT_ERROR;
}
hash = NXT_HTTP_FIELD_HASH_INIT;
for (i = 0; i < client_ip->header->length; i++) {
c = client_ip->header->start[i];
hash = nxt_http_field_hash_char(hash, nxt_lowcase(c));
}
hash = nxt_http_field_hash_end(hash) & 0xFFFF;
client_ip->header_hash = hash;
skcf->client_ip = client_ip;
return NXT_OK;
}
static nxt_app_t *
nxt_router_app_find(nxt_queue_t *queue, nxt_str_t *name)
{

3
src/nxt_router.h
View File

@@ -18,6 +18,7 @@ typedef struct nxt_http_request_s nxt_http_request_t;
typedef struct nxt_http_action_s nxt_http_action_t;
typedef struct nxt_http_routes_s nxt_http_routes_t;
typedef struct nxt_http_client_ip_s nxt_http_client_ip_t;
typedef struct nxt_upstream_s nxt_upstream_t;
typedef struct nxt_upstreams_s nxt_upstreams_t;
typedef struct nxt_router_access_log_s nxt_router_access_log_t;
@@ -195,6 +196,8 @@ typedef struct {
uint8_t discard_unsafe_fields; /* 1 bit */
nxt_http_client_ip_t *client_ip;
#if (NXT_TLS)
nxt_tls_conf_t *tls;
#endif