Skip to content

Commit abb8760

Browse files
salonichf5salonichf5
committed
updates based on reviews
1 parent 3190e74 commit abb8760

File tree

8 files changed

+32
-28
lines changed

8 files changed

+32
-28
lines changed

‎config/crd/bases/gateway.nginx.org_nginxproxies.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -95,8 +95,8 @@ spec:
9595
If a request comes from a trusted address, NGINX will rewrite the client IP information,
9696
and forward it to the backend in the X-Forwarded-For* and X-Real-IP headers.
9797
If the request does not come from a trusted address, NGINX will not rewrite the client IP information.
98-
Addresses must be provided as CIDR blocks or IP address: 10.0.0.0, 192.33.21/24, fe80::1/128.
99-
To trust all addresses (not recommended), set to 0.0.0.0/0.
98+
Addresses must be provided as CIDR blocks or IP addresses: 10.0.0.0, 192.33.21/24, fe80::1/128.
99+
To trust all addresses (not recommended for production), set to 0.0.0.0/0.
100100
If no addresses are provided, NGINX will not rewrite the client IP information.
101101
Sets NGINX directive set_real_ip_from: https://nginx.org/en/docs/http/ngx_http_realip_module.html#set_real_ip_from
102102
This field is required if mode is set.

‎deploy/crds.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -680,8 +680,8 @@ spec:
680680
If a request comes from a trusted address, NGINX will rewrite the client IP information,
681681
and forward it to the backend in the X-Forwarded-For* and X-Real-IP headers.
682682
If the request does not come from a trusted address, NGINX will not rewrite the client IP information.
683-
Addresses must be provided as CIDR blocks or IP address: 10.0.0.0, 192.33.21/24, fe80::1/128.
684-
To trust all addresses (not recommended), set to 0.0.0.0/0.
683+
Addresses must be provided as CIDR blocks or IP addresses: 10.0.0.0, 192.33.21/24, fe80::1/128.
684+
To trust all addresses (not recommended for production), set to 0.0.0.0/0.
685685
If no addresses are provided, NGINX will not rewrite the client IP information.
686686
Sets NGINX directive set_real_ip_from: https://nginx.org/en/docs/http/ngx_http_realip_module.html#set_real_ip_from
687687
This field is required if mode is set.

‎internal/mode/static/nginx/config/servers.go

Lines changed: 17 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -830,23 +830,25 @@ func generateProxySetHeaders(filters *dataplane.HTTPFilters, grpc bool) []http.H
830830
}
831831

832832
func setHeaderForHTTPSRedirect(filters *dataplane.HTTPFilters, headers []http.Header) {
833-
if filters != nil {
834-
if filters.RequestURLRewrite != nil && filters.RequestURLRewrite.Hostname != nil {
835-
for i, header := range headers {
836-
if header.Name == "Host" {
837-
headers[i].Value = *filters.RequestURLRewrite.Hostname
838-
break
839-
}
833+
if filters == nil {
834+
return
835+
}
836+
837+
if filters.RequestURLRewrite != nil && filters.RequestURLRewrite.Hostname != nil {
838+
for i, header := range headers {
839+
if header.Name == "Host" {
840+
headers[i].Value = *filters.RequestURLRewrite.Hostname
841+
break
840842
}
841843
}
842-
if filters.RequestRedirect != nil &&
843-
filters.RequestRedirect.Scheme != nil &&
844-
*filters.RequestRedirect.Scheme == http.HTTPSScheme {
845-
for i, header := range headers {
846-
if header.Name == "X-Forwarded-Proto" {
847-
headers[i].Value = http.HTTPSScheme
848-
return
849-
}
844+
}
845+
if filters.RequestRedirect != nil &&
846+
filters.RequestRedirect.Scheme != nil &&
847+
*filters.RequestRedirect.Scheme == http.HTTPSScheme {
848+
for i, header := range headers {
849+
if header.Name == "X-Forwarded-Proto" {
850+
headers[i].Value = http.HTTPSScheme
851+
return
850852
}
851853
}
852854
}

‎internal/mode/static/nginx/config/servers_test.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -342,6 +342,7 @@ func TestExecuteServers_RewriteClientIP(t *testing.T) {
342342
"listen [::]:8080 proxy_protocol;": 1,
343343
"listen [::]:8443 ssl default_server proxy_protocol;": 1,
344344
"listen [::]:8443 ssl proxy_protocol;": 1,
345+
"real_ip_recursive on;": 0,
345346
},
346347
},
347348
{

‎internal/mode/static/nginx/config/stream_servers.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,7 @@ func createStreamServers(conf dataplane.Configuration) []stream.Server {
6767

6868
portSet[server.Port] = struct{}{}
6969

70+
// we do not evaluate rewriteClientIP settings for non-socket stream servers
7071
streamServer := stream.Server{
7172
Listen: fmt.Sprint(server.Port),
7273
StatusZone: server.Hostname,

‎internal/mode/static/state/dataplane/configuration.go

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -863,8 +863,8 @@ func buildBaseHTTPConfig(g *graph.Graph) BaseHTTPConfig {
863863
}
864864

865865
if len(g.NginxProxy.Source.Spec.RewriteClientIP.TrustedAddresses) > 0 {
866-
trustedAddresses := convertTrustedAddresses(g)
867-
baseConfig.RewriteClientIPSettings.TrustedAddresses = convertTrustedAddresses(g)
866+
trustedAddresses := convertTrustedAddresses(g.NginxProxy.Source.Spec.RewriteClientIP.TrustedAddresses)
867+
baseConfig.RewriteClientIPSettings.TrustedAddresses = trustedAddresses
868868
}
869869

870870
if g.NginxProxy.Source.Spec.RewriteClientIP.SetIPRecursively != nil {
@@ -893,9 +893,9 @@ func buildPolicies(graphPolicies []*graph.Policy) []policies.Policy {
893893
return finalPolicies
894894
}
895895

896-
func convertTrustedAddresses(g *graph.Graph) []string {
897-
trustedAddresses := make([]string, len(g.NginxProxy.Source.Spec.RewriteClientIP.TrustedAddresses))
898-
for i, addr := range g.NginxProxy.Source.Spec.RewriteClientIP.TrustedAddresses {
896+
func convertTrustedAddresses(addresses []ngfAPI.TrustedAddress) []string {
897+
trustedAddresses := make([]string, len(addresses))
898+
for i, addr := range addresses {
899899
trustedAddresses[i] = string(addr)
900900
}
901901
return trustedAddresses

‎site/content/how-to/monitoring/troubleshooting.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -465,7 +465,7 @@ If you check your _nginx_ container logs and see the following error:
465465

466466
It indicates that `proxy_protocol` is enabled for the gateway listeners, but the request sent to the application endpoint does not contain proxy information. To **resolve** this, you can do one of the following:
467467

468-
- Disable field [`rewriteClientIP.mode`](({{< relref "reference/api.md" >}})) in the NginxProxy configuration.
468+
- Unassign the field [`rewriteClientIP.mode`](({{< relref "reference/api.md" >}})) in the NginxProxy configuration.
469469

470470
- Send valid proxy information with requests being handled by your application.
471471

‎site/content/reference/api.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1112,8 +1112,8 @@ Sets NGINX directive real_ip_recursive: <a href="https://nginx.org/en/docs/http/
11121112
If a request comes from a trusted address, NGINX will rewrite the client IP information,
11131113
and forward it to the backend in the X-Forwarded-For* and X-Real-IP headers.
11141114
If the request does not come from a trusted address, NGINX will not rewrite the client IP information.
1115-
Addresses must be provided as CIDR blocks or IP address: 10.0.0.0, 192.33.<sup>21</sup>&frasl;<sub>24</sub>, fe80::<sup>1</sup>&frasl;<sub>128</sub>.
1116-
To trust all addresses (not recommended), set to 0.0.0.0/0.
1115+
Addresses must be provided as CIDR blocks or IP addresses: 10.0.0.0, 192.33.<sup>21</sup>&frasl;<sub>24</sub>, fe80::<sup>1</sup>&frasl;<sub>128</sub>.
1116+
To trust all addresses (not recommended for production), set to 0.0.0.0/0.
11171117
If no addresses are provided, NGINX will not rewrite the client IP information.
11181118
Sets NGINX directive set_real_ip_from: <a href="https://nginx.org/en/docs/http/ngx_http_realip_module.html#set_real_ip_from">https://nginx.org/en/docs/http/ngx_http_realip_module.html#set_real_ip_from</a>
11191119
This field is required if mode is set.</p>
@@ -1141,7 +1141,7 @@ This field is required if mode is set.</p>
11411141
<tbody><tr><td><p>&#34;ProxyProtocol&#34;</p></td>
11421142
<td><p>RewriteClientIPModeProxyProtocol configures NGINX to accept PROXY protocol and
11431143
set the client&rsquo;s IP address to the IP address in the PROXY protocol header.
1144-
Sets the proxy_protocol parameter to the listen directive on all servers, and sets real_ip_header
1144+
Sets the proxy_protocol parameter on the listen directive of all servers and sets real_ip_header
11451145
to proxy_protocol: <a href="https://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_header">https://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_header</a>.</p>
11461146
</td>
11471147
</tr><tr><td><p>&#34;XForwardedFor&#34;</p></td>

0 commit comments

Comments
 (0)