Skip to content

Commit 481b183

Browse files
salonichf5salonichf5
committed
update stream servers config
1 parent 209b920 commit 481b183

File tree

6 files changed

+99
-49
lines changed

6 files changed

+99
-49
lines changed

‎internal/mode/static/nginx/config/http/config.go

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,7 @@ type ProxySSLVerify struct {
110110
// ServerConfig holds configuration for an HTTP server and IP family to be used by NGINX.
111111
type ServerConfig struct {
112112
Servers []Server
113-
RewriteClientIP RewriteClientIPSettings
113+
RewriteClientIP shared.RewriteClientIPSettings
114114
IPFamily shared.IPFamily
115115
Plus bool
116116
}
@@ -120,11 +120,3 @@ type Include struct {
120120
Name string
121121
Content []byte
122122
}
123-
124-
// RewriteClientIP holds the configuration for the rewrite client IP settings.
125-
type RewriteClientIPSettings struct {
126-
RealIPHeader string
127-
RealIPFrom []string
128-
Recursive bool
129-
ProxyProtocol bool
130-
}

‎internal/mode/static/nginx/config/servers.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -909,8 +909,8 @@ func isNonSlashedPrefixPath(pathType dataplane.PathType, path string) bool {
909909
}
910910

911911
// getRewriteClientIPSettings returns the configuration for the rewriting client IP settings.
912-
func getRewriteClientIPSettings(rewriteIP dataplane.RewriteClientIPSettings) http.RewriteClientIPSettings {
913-
return http.RewriteClientIPSettings{
912+
func getRewriteClientIPSettings(rewriteIP dataplane.RewriteClientIPSettings) shared.RewriteClientIPSettings {
913+
return shared.RewriteClientIPSettings{
914914
Recursive: rewriteIP.IPRecursive,
915915
ProxyProtocol: rewriteIP.Mode == dataplane.RewriteIPModeProxyProtocol,
916916
RealIPFrom: rewriteIP.TrustedCIDRs,

‎internal/mode/static/nginx/config/servers_template.go

Lines changed: 23 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -15,13 +15,17 @@ server {
1515
listen [::]:{{ $s.Listen }} ssl default_server{{ $proxyProtocol }};
1616
{{- end }}
1717
ssl_reject_handshake on;
18-
{{- range $cidr := $.RewriteClientIP.RealIPFrom }}
18+
{{- if and ($.RewriteClientIP.ProxyProtocol) ($s.IsSocket)}}
19+
set_real_ip_from unix:;
20+
{{- else if (not $s.IsSocket)}}
21+
{{- range $cidr := $.RewriteClientIP.RealIPFrom }}
1922
set_real_ip_from {{ $cidr }};
20-
{{- end}}
21-
{{- if $.RewriteClientIP.RealIPHeader}}
23+
{{- end}}
24+
{{ end }}
25+
{{- if and ($.RewriteClientIP.RealIPHeader) (not $s.IsSocket)}}
2226
real_ip_header {{ $.RewriteClientIP.RealIPHeader }};
2327
{{- end}}
24-
{{- if $.RewriteClientIP.Recursive }}
28+
{{- if and ($.RewriteClientIP.Recursive) (not $s.IsSocket)}}
2529
real_ip_recursive on;
2630
{{ end }}
2731
}
@@ -33,13 +37,17 @@ server {
3337
{{- if $.IPFamily.IPv6 }}
3438
listen [::]:{{ $s.Listen }} default_server{{ $proxyProtocol }};
3539
{{- end }}
36-
{{- range $cidr := $.RewriteClientIP.RealIPFrom }}
40+
{{- if and ($.RewriteClientIP.ProxyProtocol) ($s.IsSocket)}}
41+
set_real_ip_from unix:;
42+
{{- else if (not $s.IsSocket)}}
43+
{{- range $cidr := $.RewriteClientIP.RealIPFrom }}
3744
set_real_ip_from {{ $cidr }};
38-
{{- end}}
39-
{{- if $.RewriteClientIP.RealIPHeader}}
45+
{{- end}}
46+
{{ end }}
47+
{{- if and ($.RewriteClientIP.RealIPHeader) (not $s.IsSocket)}}
4048
real_ip_header {{ $.RewriteClientIP.RealIPHeader }};
4149
{{- end}}
42-
{{- if $.RewriteClientIP.Recursive }}
50+
{{- if and ($.RewriteClientIP.Recursive) (not $s.IsSocket)}}
4351
real_ip_recursive on;
4452
{{ end }}
4553
default_type text/html;
@@ -79,13 +87,17 @@ server {
7987
include {{ $i.Name }};
8088
{{- end }}
8189
82-
{{- range $cidr := $.RewriteClientIP.RealIPFrom }}
90+
{{- if and ($.RewriteClientIP.ProxyProtocol) ($s.IsSocket)}}
91+
set_real_ip_from unix:;
92+
{{- else if (not $s.IsSocket)}}
93+
{{- range $cidr := $.RewriteClientIP.RealIPFrom }}
8394
set_real_ip_from {{ $cidr }};
8495
{{- end}}
85-
{{- if $.RewriteClientIP.RealIPHeader}}
96+
{{ end }}
97+
{{- if and ($.RewriteClientIP.RealIPHeader) (not $s.IsSocket)}}
8698
real_ip_header {{ $.RewriteClientIP.RealIPHeader }};
8799
{{- end}}
88-
{{- if $.RewriteClientIP.Recursive }}
100+
{{- if and ($.RewriteClientIP.Recursive) (not $s.IsSocket)}}
89101
real_ip_recursive on;
90102
{{ end }}
91103

‎internal/mode/static/nginx/config/servers_test.go

Lines changed: 61 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -284,37 +284,40 @@ func TestExecuteServers_IPFamily(t *testing.T) {
284284
}
285285

286286
func TestExecuteServers_RewriteClientIP(t *testing.T) {
287+
httpServers := []dataplane.VirtualServer{
288+
{
289+
IsDefault: true,
290+
Port: 8080,
291+
},
292+
{
293+
Hostname: "example.com",
294+
Port: 8080,
295+
},
296+
}
297+
298+
sslServers := []dataplane.VirtualServer{
299+
{
300+
IsDefault: true,
301+
Port: 8443,
302+
},
303+
{
304+
Hostname: "example.com",
305+
SSL: &dataplane.SSL{
306+
KeyPairID: "test-keypair",
307+
},
308+
Port: 8443,
309+
},
310+
}
287311
tests := []struct {
288312
msg string
289313
expectedHTTPConfig map[string]int
290314
config dataplane.Configuration
291315
}{
292316
{
293-
msg: "http and ssl servers with rewrite client IP settings",
317+
msg: "rewrite client IP settings configured with proxy protocol",
294318
config: dataplane.Configuration{
295-
HTTPServers: []dataplane.VirtualServer{
296-
{
297-
IsDefault: true,
298-
Port: 8080,
299-
},
300-
{
301-
Hostname: "example.com",
302-
Port: 8080,
303-
},
304-
},
305-
SSLServers: []dataplane.VirtualServer{
306-
{
307-
IsDefault: true,
308-
Port: 8443,
309-
},
310-
{
311-
Hostname: "example.com",
312-
SSL: &dataplane.SSL{
313-
KeyPairID: "test-keypair",
314-
},
315-
Port: 8443,
316-
},
317-
},
319+
HTTPServers: httpServers,
320+
SSLServers: sslServers,
318321
BaseHTTPConfig: dataplane.BaseHTTPConfig{
319322
IPFamily: dataplane.Dual,
320323
RewriteClientIPSettings: dataplane.RewriteClientIPSettings{
@@ -328,6 +331,7 @@ func TestExecuteServers_RewriteClientIP(t *testing.T) {
328331
"set_real_ip_from 0.0.0.0/0;": 4,
329332
"real_ip_header proxy_protocol;": 4,
330333
"real_ip_recursive on;": 4,
334+
"proxy_protocol on;": 0,
331335
"listen 8080 default_server proxy_protocol;": 1,
332336
"listen 8080 proxy_protocol;": 1,
333337
"listen 8443 ssl default_server proxy_protocol;": 1,
@@ -342,6 +346,39 @@ func TestExecuteServers_RewriteClientIP(t *testing.T) {
342346
"listen [::]:8443 ssl proxy_protocol;": 1,
343347
},
344348
},
349+
{
350+
msg: "rewrite client IP settings configured with x-forwarded-for",
351+
config: dataplane.Configuration{
352+
HTTPServers: httpServers,
353+
SSLServers: sslServers,
354+
BaseHTTPConfig: dataplane.BaseHTTPConfig{
355+
IPFamily: dataplane.Dual,
356+
RewriteClientIPSettings: dataplane.RewriteClientIPSettings{
357+
Mode: dataplane.RewriteIPModeXForwardedFor,
358+
TrustedCIDRs: []string{"0.0.0.0/0"},
359+
IPRecursive: true,
360+
},
361+
},
362+
},
363+
expectedHTTPConfig: map[string]int{
364+
"set_real_ip_from 0.0.0.0/0;": 4,
365+
"real_ip_header X-Forwarded-For;": 4,
366+
"real_ip_recursive on;": 4,
367+
"proxy_protocol on;": 0,
368+
"listen 8080 default_server;": 1,
369+
"listen 8080;": 1,
370+
"listen 8443 ssl default_server;": 1,
371+
"listen 8443 ssl;": 1,
372+
"server_name example.com;": 2,
373+
"ssl_certificate /etc/nginx/secrets/test-keypair.pem;": 1,
374+
"ssl_certificate_key /etc/nginx/secrets/test-keypair.pem;": 1,
375+
"ssl_reject_handshake on;": 1,
376+
"listen [::]:8080 default_server;": 1,
377+
"listen [::]:8080;": 1,
378+
"listen [::]:8443 ssl default_server;": 1,
379+
"listen [::]:8443 ssl;": 1,
380+
},
381+
},
345382
}
346383

347384
for _, test := range tests {

‎internal/mode/static/nginx/config/shared/config.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,3 +19,11 @@ type IPFamily struct {
1919
IPv4 bool
2020
IPv6 bool
2121
}
22+
23+
// RewriteClientIP holds the configuration for the rewrite client IP settings.
24+
type RewriteClientIPSettings struct {
25+
RealIPHeader string
26+
RealIPFrom []string
27+
Recursive bool
28+
ProxyProtocol bool
29+
}

‎internal/mode/static/nginx/config/stream/config.go

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,8 @@ type UpstreamServer struct {
2626

2727
// ServerConfig holds configuration for a stream server and IP family to be used by NGINX.
2828
type ServerConfig struct {
29-
Servers []Server
30-
IPFamily shared.IPFamily
31-
Plus bool
29+
Servers []Server
30+
RewriteClientIP shared.RewriteClientIPSettings
31+
IPFamily shared.IPFamily
32+
Plus bool
3233
}

0 commit comments

Comments
 (0)