Skip to content

Commit 64f1278

Browse files
salonichf5salonichf5
committed
update stream servers config
1 parent 72d840b commit 64f1278

File tree

9 files changed

+222
-43
lines changed

9 files changed

+222
-43
lines changed

‎internal/mode/static/nginx/config/http/config.go

+1-9
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,7 @@ type ProxySSLVerify struct {
110110
// ServerConfig holds configuration for an HTTP server and IP family to be used by NGINX.
111111
type ServerConfig struct {
112112
Servers []Server
113-
RewriteClientIP RewriteClientIPSettings
113+
RewriteClientIP shared.RewriteClientIPSettings
114114
IPFamily shared.IPFamily
115115
Plus bool
116116
}
@@ -120,11 +120,3 @@ type Include struct {
120120
Name string
121121
Content []byte
122122
}
123-
124-
// RewriteClientIP holds the configuration for the rewrite client IP settings.
125-
type RewriteClientIPSettings struct {
126-
RealIPHeader string
127-
RealIPFrom []string
128-
Recursive bool
129-
ProxyProtocol bool
130-
}

‎internal/mode/static/nginx/config/servers.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -909,8 +909,8 @@ func isNonSlashedPrefixPath(pathType dataplane.PathType, path string) bool {
909909
}
910910

911911
// getRewriteClientIPSettings returns the configuration for the rewriting client IP settings.
912-
func getRewriteClientIPSettings(rewriteIP dataplane.RewriteClientIPSettings) http.RewriteClientIPSettings {
913-
return http.RewriteClientIPSettings{
912+
func getRewriteClientIPSettings(rewriteIP dataplane.RewriteClientIPSettings) shared.RewriteClientIPSettings {
913+
return shared.RewriteClientIPSettings{
914914
Recursive: rewriteIP.IPRecursive,
915915
ProxyProtocol: rewriteIP.Mode == dataplane.RewriteIPModeProxyProtocol,
916916
RealIPFrom: rewriteIP.TrustedCIDRs,

‎internal/mode/static/nginx/config/servers_template.go

+9
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,9 @@ server {
2424
{{- if $.RewriteClientIP.Recursive }}
2525
real_ip_recursive on;
2626
{{ end }}
27+
{{ if $.RewriteClientIP.ProxyProtocol }}
28+
proxy_protocol on;
29+
{{ end }}
2730
}
2831
{{- else if $s.IsDefaultHTTP }}
2932
server {
@@ -42,6 +45,9 @@ server {
4245
{{- if $.RewriteClientIP.Recursive }}
4346
real_ip_recursive on;
4447
{{ end }}
48+
{{ if $.RewriteClientIP.ProxyProtocol }}
49+
proxy_protocol on;
50+
{{ end }}
4551
default_type text/html;
4652
return 404;
4753
}
@@ -88,6 +94,9 @@ server {
8894
{{- if $.RewriteClientIP.Recursive }}
8995
real_ip_recursive on;
9096
{{ end }}
97+
{{ if $.RewriteClientIP.ProxyProtocol }}
98+
proxy_protocol on;
99+
{{ end }}
91100
92101
{{ range $l := $s.Locations }}
93102
location {{ $l.Path }} {

‎internal/mode/static/nginx/config/servers_test.go

+62-24
Original file line numberDiff line numberDiff line change
@@ -284,37 +284,40 @@ func TestExecuteServers_IPFamily(t *testing.T) {
284284
}
285285

286286
func TestExecuteServers_RewriteClientIP(t *testing.T) {
287+
httpServers := []dataplane.VirtualServer{
288+
{
289+
IsDefault: true,
290+
Port: 8080,
291+
},
292+
{
293+
Hostname: "example.com",
294+
Port: 8080,
295+
},
296+
}
297+
298+
sslServers := []dataplane.VirtualServer{
299+
{
300+
IsDefault: true,
301+
Port: 8443,
302+
},
303+
{
304+
Hostname: "example.com",
305+
SSL: &dataplane.SSL{
306+
KeyPairID: "test-keypair",
307+
},
308+
Port: 8443,
309+
},
310+
}
287311
tests := []struct {
288312
msg string
289313
expectedHTTPConfig map[string]int
290314
config dataplane.Configuration
291315
}{
292316
{
293-
msg: "http and ssl servers with rewrite client IP settings",
317+
msg: "rewrite client IP settings configured with proxy protocol",
294318
config: dataplane.Configuration{
295-
HTTPServers: []dataplane.VirtualServer{
296-
{
297-
IsDefault: true,
298-
Port: 8080,
299-
},
300-
{
301-
Hostname: "example.com",
302-
Port: 8080,
303-
},
304-
},
305-
SSLServers: []dataplane.VirtualServer{
306-
{
307-
IsDefault: true,
308-
Port: 8443,
309-
},
310-
{
311-
Hostname: "example.com",
312-
SSL: &dataplane.SSL{
313-
KeyPairID: "test-keypair",
314-
},
315-
Port: 8443,
316-
},
317-
},
319+
HTTPServers: httpServers,
320+
SSLServers: sslServers,
318321
BaseHTTPConfig: dataplane.BaseHTTPConfig{
319322
IPFamily: dataplane.Dual,
320323
RewriteClientIPSettings: dataplane.RewriteClientIPSettings{
@@ -328,6 +331,7 @@ func TestExecuteServers_RewriteClientIP(t *testing.T) {
328331
"set_real_ip_from 0.0.0.0/0;": 4,
329332
"real_ip_header proxy_protocol;": 4,
330333
"real_ip_recursive on;": 4,
334+
"proxy_protocol on;": 4,
331335
"listen 8080 default_server proxy_protocol;": 1,
332336
"listen 8080 proxy_protocol;": 1,
333337
"listen 8443 ssl default_server proxy_protocol;": 1,
@@ -342,6 +346,39 @@ func TestExecuteServers_RewriteClientIP(t *testing.T) {
342346
"listen [::]:8443 ssl proxy_protocol;": 1,
343347
},
344348
},
349+
{
350+
msg: "rewrite client IP settings configured with x-forwarded-for",
351+
config: dataplane.Configuration{
352+
HTTPServers: httpServers,
353+
SSLServers: sslServers,
354+
BaseHTTPConfig: dataplane.BaseHTTPConfig{
355+
IPFamily: dataplane.Dual,
356+
RewriteClientIPSettings: dataplane.RewriteClientIPSettings{
357+
Mode: dataplane.RewriteIPModeXForwardedFor,
358+
TrustedCIDRs: []string{"0.0.0.0/0"},
359+
IPRecursive: true,
360+
},
361+
},
362+
},
363+
expectedHTTPConfig: map[string]int{
364+
"set_real_ip_from 0.0.0.0/0;": 4,
365+
"real_ip_header X-Forwarded-For;": 4,
366+
"real_ip_recursive on;": 4,
367+
"proxy_protocol on;": 0,
368+
"listen 8080 default_server;": 1,
369+
"listen 8080;": 1,
370+
"listen 8443 ssl default_server;": 1,
371+
"listen 8443 ssl;": 1,
372+
"server_name example.com;": 2,
373+
"ssl_certificate /etc/nginx/secrets/test-keypair.pem;": 1,
374+
"ssl_certificate_key /etc/nginx/secrets/test-keypair.pem;": 1,
375+
"ssl_reject_handshake on;": 1,
376+
"listen [::]:8080 default_server;": 1,
377+
"listen [::]:8080;": 1,
378+
"listen [::]:8443 ssl default_server;": 1,
379+
"listen [::]:8443 ssl;": 1,
380+
},
381+
},
345382
}
346383

347384
for _, test := range tests {
@@ -355,6 +392,7 @@ func TestExecuteServers_RewriteClientIP(t *testing.T) {
355392
httpMatchConf := string(results[1].data)
356393
g.Expect(httpMatchConf).To(Equal("{}"))
357394

395+
fmt.Println(serverConf)
358396
for expSubStr, expCount := range test.expectedHTTPConfig {
359397
g.Expect(strings.Count(serverConf, expSubStr)).To(Equal(expCount))
360398
}

‎internal/mode/static/nginx/config/shared/config.go

+8
Original file line numberDiff line numberDiff line change
@@ -19,3 +19,11 @@ type IPFamily struct {
1919
IPv4 bool
2020
IPv6 bool
2121
}
22+
23+
// RewriteClientIP holds the configuration for the rewrite client IP settings.
24+
type RewriteClientIPSettings struct {
25+
RealIPHeader string
26+
RealIPFrom []string
27+
Recursive bool
28+
ProxyProtocol bool
29+
}

‎internal/mode/static/nginx/config/stream/config.go

+4-3
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,8 @@ type UpstreamServer struct {
2626

2727
// ServerConfig holds configuration for a stream server and IP family to be used by NGINX.
2828
type ServerConfig struct {
29-
Servers []Server
30-
IPFamily shared.IPFamily
31-
Plus bool
29+
Servers []Server
30+
RewriteClientIP shared.RewriteClientIPSettings
31+
IPFamily shared.IPFamily
32+
Plus bool
3233
}

‎internal/mode/static/nginx/config/stream_servers.go

+4-3
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,10 @@ func (g GeneratorImpl) executeStreamServers(conf dataplane.Configuration) []exec
1515
streamServers := createStreamServers(conf)
1616

1717
streamServerConfig := stream.ServerConfig{
18-
Servers: streamServers,
19-
IPFamily: getIPFamily(conf.BaseHTTPConfig),
20-
Plus: g.plus,
18+
Servers: streamServers,
19+
IPFamily: getIPFamily(conf.BaseHTTPConfig),
20+
Plus: g.plus,
21+
RewriteClientIP: getRewriteClientIPSettings(conf.BaseHTTPConfig.RewriteClientIPSettings),
2122
}
2223

2324
streamServerResult := executeResult{

‎internal/mode/static/nginx/config/stream_servers_template.go

+17-2
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,28 @@
11
package config
22

33
const streamServersTemplateText = `
4+
{{ $proxyProtocol := "" }}
5+
{{ if $.RewriteClientIP.ProxyProtocol }}{{ $proxyProtocol = " proxy_protocol" }}{{ end }}
6+
47
{{- range $s := .Servers }}
58
server {
69
{{- if or ($.IPFamily.IPv4) ($s.IsSocket) }}
7-
listen {{ $s.Listen }};
10+
listen {{ $s.Listen }}{{ $proxyProtocol }};
811
{{- end }}
912
{{- if and ($.IPFamily.IPv6) (not $s.IsSocket) }}
10-
listen [::]:{{ $s.Listen }};
13+
listen [::]:{{ $s.Listen }}{{ $proxyProtocol }};
14+
{{- end }}
15+
16+
{{- if and ($.RewriteClientIP.ProxyProtocol) ($s.IsSocket)}}
17+
set_real_ip_from unix:;
18+
{{- else if (not $s.IsSocket)}}
19+
{{- range $cidr := $.RewriteClientIP.RealIPFrom }}
20+
set_real_ip_from {{ $cidr }};
21+
{{- end}}
22+
{{ end }}
23+
24+
{{- if and ($.RewriteClientIP.ProxyProtocol) (not $s.IsSocket)}}
25+
proxy_protocol on;
1126
{{- end }}
1227
1328
{{- if $.Plus }}

‎internal/mode/static/nginx/config/stream_servers_test.go

+115
Original file line numberDiff line numberDiff line change
@@ -308,3 +308,118 @@ func TestCreateStreamServersWithNone(t *testing.T) {
308308

309309
g.Expect(streamServers).To(BeNil())
310310
}
311+
312+
func TestExecuteStreamServers_RewriteClientIP(t *testing.T) {
313+
passThroughServers := []dataplane.Layer4VirtualServer{
314+
{
315+
UpstreamName: "backend1",
316+
Hostname: "cafe.example.com",
317+
Port: 8443,
318+
},
319+
{
320+
UpstreamName: "backend2",
321+
Hostname: "tea.example.com",
322+
Port: 8443,
323+
},
324+
}
325+
streamUpstreams := []dataplane.Upstream{
326+
{
327+
Name: "backend1",
328+
Endpoints: []resolver.Endpoint{
329+
{
330+
Address: "1.1.1.1",
331+
},
332+
},
333+
},
334+
{
335+
Name: "backend2",
336+
Endpoints: []resolver.Endpoint{
337+
{
338+
Address: "1.1.1.1",
339+
},
340+
},
341+
},
342+
}
343+
344+
tests := []struct {
345+
msg string
346+
expectedServerConfig map[string]int
347+
config dataplane.Configuration
348+
}{
349+
{
350+
msg: "tls servers with no rewrite client IP settings",
351+
config: dataplane.Configuration{
352+
BaseHTTPConfig: dataplane.BaseHTTPConfig{},
353+
TLSPassthroughServers: passThroughServers,
354+
StreamUpstreams: streamUpstreams,
355+
},
356+
expectedServerConfig: map[string]int{
357+
"listen 8443;": 1,
358+
"listen unix:/var/run/nginx/cafe.example.com-8443.sock;": 1,
359+
},
360+
},
361+
{
362+
msg: "tls servers with rewrite client IP settings configured with proxy protocol",
363+
config: dataplane.Configuration{
364+
BaseHTTPConfig: dataplane.BaseHTTPConfig{
365+
RewriteClientIPSettings: dataplane.RewriteClientIPSettings{
366+
Mode: dataplane.RewriteIPModeProxyProtocol,
367+
TrustedCIDRs: []string{"1.1.1.1/32"},
368+
IPRecursive: true,
369+
},
370+
},
371+
TLSPassthroughServers: passThroughServers,
372+
StreamUpstreams: streamUpstreams,
373+
},
374+
expectedServerConfig: map[string]int{
375+
"listen 8443 proxy_protocol;": 1,
376+
" listen [::]:8443 proxy_protocol;": 1,
377+
"listen unix:/var/run/nginx/cafe.example.com-8443.sock proxy_protocol;": 1,
378+
"set_real_ip_from unix:;": 2,
379+
"real_ip_header proxy_protocol;": 0,
380+
"real_ip_recursive on;": 0,
381+
"set_real_ip_from 1.1.1.1/32;": 1,
382+
"proxy_protocol on;": 1,
383+
},
384+
},
385+
{
386+
msg: "tls servers with rewrite client IP settings configured with xforwardedfor",
387+
config: dataplane.Configuration{
388+
BaseHTTPConfig: dataplane.BaseHTTPConfig{
389+
RewriteClientIPSettings: dataplane.RewriteClientIPSettings{
390+
Mode: dataplane.RewriteIPModeXForwardedFor,
391+
TrustedCIDRs: []string{"1.1.1.1/32"},
392+
IPRecursive: true,
393+
},
394+
},
395+
TLSPassthroughServers: passThroughServers,
396+
StreamUpstreams: streamUpstreams,
397+
},
398+
expectedServerConfig: map[string]int{
399+
"listen 8443;": 1,
400+
" listen [::]:8443;": 1,
401+
"listen unix:/var/run/nginx/cafe.example.com-8443.sock;": 1,
402+
"set_real_ip_from unix:;": 0,
403+
"real_ip_header X-Forwarded-For;": 0,
404+
"real_ip_recursive on;": 0,
405+
"set_real_ip_from 1.1.1.1/32;": 1,
406+
"proxy_protocol on;": 0,
407+
},
408+
},
409+
}
410+
411+
for _, test := range tests {
412+
t.Run(test.msg, func(t *testing.T) {
413+
g := NewWithT(t)
414+
415+
gen := GeneratorImpl{}
416+
results := gen.executeStreamServers(test.config)
417+
g.Expect(results).To(HaveLen(1))
418+
serverConf := string(results[0].data)
419+
420+
for expSubStr, expCount := range test.expectedServerConfig {
421+
g.Expect(strings.Count(serverConf, expSubStr)).To(Equal(expCount))
422+
}
423+
})
424+
}
425+
}

0 commit comments

Comments
 (0)