From ca48c72ce0d2c5901234cd7232cc026ca97a22b8 Mon Sep 17 00:00:00 2001 From: Tom Clegg Date: Tue, 2 Aug 2022 10:12:51 -0400 Subject: [PATCH] 17344: arvados-server boot: set X-External-Client header. Arvados-DCO-1.1-Signed-off-by: Tom Clegg --- lib/boot/nginx.go | 27 +++++++++++++++++++++++++++ sdk/python/tests/nginx.conf | 8 ++++++++ sdk/python/tests/run_test_server.py | 1 + 3 files changed, 36 insertions(+) diff --git a/lib/boot/nginx.go b/lib/boot/nginx.go index b391c4dc8c..9f1091eac3 100644 --- a/lib/boot/nginx.go +++ b/lib/boot/nginx.go @@ -5,6 +5,7 @@ package boot import ( + "bytes" "context" "fmt" "io/ioutil" @@ -17,6 +18,7 @@ import ( "strings" "git.arvados.org/arvados.git/sdk/go/arvados" + "github.com/sirupsen/logrus" ) // Run an Nginx process that proxies the supervisor's configured @@ -46,6 +48,7 @@ func (runNginx) Run(ctx context.Context, fail func(error), super *Supervisor) er vars := map[string]string{ "LISTENHOST": extListenHost, "UPSTREAMHOST": super.ListenHost, + "INTERNALSUBNETS": internalSubnets(super.logger), "SSLCERT": filepath.Join(super.tempdir, "server.crt"), "SSLKEY": filepath.Join(super.tempdir, "server.key"), "ACCESSLOG": filepath.Join(super.tempdir, "nginx_access.log"), @@ -150,3 +153,27 @@ func (runNginx) Run(ctx context.Context, fail func(error), super *Supervisor) er } return waitForConnect(ctx, testurl.Host) } + +// Return 0 or more local subnets as "geo" fragments for Nginx config, +// e.g., "1.2.3.0/24 0; 10.1.0.0/16 0;". +func internalSubnets(logger logrus.FieldLogger) string { + iproutes, err := exec.Command("ip", "route").CombinedOutput() + if err != nil { + logger.Warnf("treating all clients as external because `ip route` failed: %s (%q)", err, iproutes) + return "" + } + subnets := "" + for _, line := range bytes.Split(iproutes, []byte("\n")) { + fields := strings.Fields(string(line)) + if len(fields) > 2 && fields[1] == "dev" { + // lan example: + // 192.168.86.0/24 dev ens3 proto kernel scope link src 192.168.86.196 + // gcp example (private subnet): + // 10.47.0.0/24 dev eth0 proto kernel scope link src 10.47.0.5 + // gcp example (no private subnet): + // 10.128.0.1 dev ens4 scope link + subnets += fields[0] + " 0; " + } + } + return subnets +} diff --git a/sdk/python/tests/nginx.conf b/sdk/python/tests/nginx.conf index 4ad3eda420..a1a75bbcc2 100644 --- a/sdk/python/tests/nginx.conf +++ b/sdk/python/tests/nginx.conf @@ -15,6 +15,11 @@ http { fastcgi_temp_path "{{TMPDIR}}"; uwsgi_temp_path "{{TMPDIR}}"; scgi_temp_path "{{TMPDIR}}"; + geo $external_client { + default 1; + 127.0.0.0/8 0; + {{INTERNALSUBNETS}} + } upstream controller { server {{UPSTREAMHOST}}:{{CONTROLLERPORT}}; } @@ -26,7 +31,10 @@ http { client_max_body_size 0; location / { proxy_pass http://controller; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; proxy_set_header Host $http_host; + proxy_set_header X-External-Client $external_client; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto https; proxy_redirect off; diff --git a/sdk/python/tests/run_test_server.py b/sdk/python/tests/run_test_server.py index e32d385f73..7147c7aa8f 100644 --- a/sdk/python/tests/run_test_server.py +++ b/sdk/python/tests/run_test_server.py @@ -660,6 +660,7 @@ def run_nginx(): nginxconf['ACCESSLOG'] = _logfilename('nginx_access') nginxconf['ERRORLOG'] = _logfilename('nginx_error') nginxconf['TMPDIR'] = TEST_TMPDIR + '/nginx' + nginxconf['INTERNALSUBNETS'] = '169.254.0.0/16 0;' conftemplatefile = os.path.join(MY_DIRNAME, 'nginx.conf') conffile = os.path.join(TEST_TMPDIR, 'nginx.conf') -- 2.30.2