Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

return the same status code 403 as nginx does to refuse CONNECT method #251

Merged
merged 2 commits into from
Feb 9, 2023
Merged

return the same status code 403 as nginx does to refuse CONNECT method #251

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9609184
make it return the same status code as nginx does to refuse CONNECT m…
chobits Feb 7, 2023
3ea08c1
workflow: fixed dependence of lua-resty-core
chobits Feb 7, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion ngx_http_proxy_connect_module.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2342,7 +2342,7 @@ ngx_http_proxy_connect_post_read_handler(ngx_http_request_t *r)
if (!pclcf->accept_connect) {
ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
"proxy_connect: client sent connect method");
return NGX_HTTP_BAD_REQUEST;
return NGX_HTTP_NOT_ALLOWED;
Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

refer to nginx core logic:

ngx_http_process_request_header(ngx_http_request_t *r)
{
....

    if (r->method == NGX_HTTP_CONNECT) {
        ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
                      "client sent CONNECT method");
        ngx_http_finalize_request(r, NGX_HTTP_NOT_ALLOWED);
        return NGX_ERROR;
    }

...
}

}

/* init ctx */
Expand Down
2 changes: 1 addition & 1 deletion t/http_proxy_connect.t
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -176,7 +176,7 @@ like(http_connect_request('www.no-dns-reply.com', '80', '/'), qr/502/, '200 Conn
like(http_connect_request('127.0.0.1', '9999', '/'), qr/403/, '200 Connection Established not allowed port');
like(http_get('/'), qr/backend server/, 'Get method: proxy_pass');
like(http_get('/hello'), qr/world/, 'Get method: return 200');
like(http_connect_request('forbidden.example.com', '8080', '/'), qr/400 Bad Request/, 'forbid CONNECT request without proxy_connect command enabled');
like(http_connect_request('forbidden.example.com', '8080', '/'), qr/405 Not Allowed/, 'forbid CONNECT request without proxy_connect command enabled');

# proxy_remote_address directive supports dynamic domain resolving.
like(http_connect_request('proxy-remote-address-resolve-domain.com', '8081', '/'),
Expand Down