Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

return the same status code 403 as nginx does to refuse CONNECT method #251

Merged
merged 2 commits into from
Feb 9, 2023
Merged

return the same status code 403 as nginx does to refuse CONNECT method #251

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9609184
make it return the same status code as nginx does to refuse CONNECT m…
chobits Feb 7, 2023
3ea08c1
workflow: fixed dependence of lua-resty-core
chobits Feb 7, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,7 @@ jobs:
pwd
git clone https://github.com/openresty/lua-resty-core.git
cd lua-resty-core
git checkout d2179dbcb3d6d77127462cadd40cca103d89a52a
sudo make install PREFIX=/opt/nginx
cd ..
git clone https://github.com/openresty/lua-resty-lrucache.git
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test_nginx_lastest_commit.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,7 @@ jobs:
pwd
git clone https://github.com/openresty/lua-resty-core.git
cd lua-resty-core
git checkout d2179dbcb3d6d77127462cadd40cca103d89a52a
Copy link
Owner Author

@chobits chobits Feb 7, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

try to fix error in github workflow

/opt/nginx/lib/lua/resty/core/base.lua:24: ngx_http_lua_module 0.10.23 required) in /tmp/nginx-test-LEG22dEa9Q/nginx.conf:93
nginx: [alert] failed to load the 'resty.core' module (https://github.com/openresty/lua-resty-core); ensure you are using an OpenResty release from https://openresty.org/en/download.html (reason: /opt/nginx/lib/lua/resty/core/base.lua:24: ngx_http_lua_module 0.10.23 required) in /tmp/nginx-test-LEG22dEa9Q/nginx.conf:93
Can't start nginx at /home/runner/work/ngx_http_proxy_connect_module/ngx_http_proxy_connect_module/nginx/../nginx-tests/lib/Test/Nginx.pm line 350.

sudo make install PREFIX=/opt/nginx
cd ..
git clone https://github.com/openresty/lua-resty-lrucache.git
Expand Down
2 changes: 1 addition & 1 deletion ngx_http_proxy_connect_module.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2342,7 +2342,7 @@ ngx_http_proxy_connect_post_read_handler(ngx_http_request_t *r)
if (!pclcf->accept_connect) {
ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
"proxy_connect: client sent connect method");
return NGX_HTTP_BAD_REQUEST;
return NGX_HTTP_NOT_ALLOWED;
Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

refer to nginx core logic:

ngx_http_process_request_header(ngx_http_request_t *r)
{
....

    if (r->method == NGX_HTTP_CONNECT) {
        ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
                      "client sent CONNECT method");
        ngx_http_finalize_request(r, NGX_HTTP_NOT_ALLOWED);
        return NGX_ERROR;
    }

...
}

}

/* init ctx */
Expand Down
2 changes: 1 addition & 1 deletion t/http_proxy_connect.t
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -176,7 +176,7 @@ like(http_connect_request('www.no-dns-reply.com', '80', '/'), qr/502/, '200 Conn
like(http_connect_request('127.0.0.1', '9999', '/'), qr/403/, '200 Connection Established not allowed port');
like(http_get('/'), qr/backend server/, 'Get method: proxy_pass');
like(http_get('/hello'), qr/world/, 'Get method: return 200');
like(http_connect_request('forbidden.example.com', '8080', '/'), qr/400 Bad Request/, 'forbid CONNECT request without proxy_connect command enabled');
like(http_connect_request('forbidden.example.com', '8080', '/'), qr/405 Not Allowed/, 'forbid CONNECT request without proxy_connect command enabled');

# proxy_remote_address directive supports dynamic domain resolving.
like(http_connect_request('proxy-remote-address-resolve-domain.com', '8081', '/'),
Expand Down