Add trusted whitelist proxy protocol #2234
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
emilevauge
added
area/middleware
kind/enhancement
emilevauge
force-pushed
the
add-trust-whitelist-proxy-protocol
branch
2 times, most recently
from
7ab6ed0
to
264ef16
Compare
ldez
suggested changes
Oct 10, 2017
middlewares/ip_whitelister.go
Outdated
| } | ||
|
|
||
| func (whitelister *IPWhitelister) handle(w http.ResponseWriter, r *http.Request, next http.HandlerFunc) { | ||
| remoteIP, err := ipFromRemoteAddr(r.RemoteAddr) | ||
| func (whiteLister *IPWhiteLister) handle(w http.ResponseWriter, r *http.Request, next http.HandlerFunc) { |
There was a problem hiding this comment.
func(whiteLister *IPWhiteLister) -> func(wl *IPWhiteLister)
middlewares/ip_whitelister.go
Outdated
| reject(w) | ||
| } | ||
|
|
||
| func (whiteLister *IPWhiteLister) ServeHTTP(rw http.ResponseWriter, r *http.Request, next http.HandlerFunc) { |
There was a problem hiding this comment.
func(whiteLister *IPWhiteLister) -> func(wl *IPWhiteLister)
server/server.go
Outdated
| @@ -19,6 +19,7 @@ import ( | |||
| "sync" | |||
| "time" | |||
|
|
|||
| "fmt" | |||
configuration/configuration.go
Outdated
|
|
||
| var proxyProtocol *ProxyProtocol | ||
| if len(result["ProxyProtocol"]) > 0 { | ||
| trustedIPs := []string{} |
server/server.go
Outdated
| if !ok { | ||
| return false, fmt.Errorf("Type error %v", addr) | ||
| } | ||
| contains, err := IPs.ContainsIP(ip.IP) |
There was a problem hiding this comment.
You can replace this block:
contains, err := IPs.ContainsIP(ip.IP)
if err != nil {
return false, err
}
if contains {
return true, nil
}
return false, nilby:
return IPs.ContainsIP(ip.IP)
configuration/configuration_test.go
Outdated
| @@ -142,7 +142,7 @@ func TestEntryPoints_Set(t *testing.T) { | |||
| }{ | |||
| { | |||
| name: "all parameters", | |||
| expression: "Name:foo Address:bar TLS:goo,gii TLS CA:car Redirect.EntryPoint:RedirectEntryPoint Redirect.Regex:RedirectRegex Redirect.Replacement:RedirectReplacement Compress:true WhiteListSourceRange:Range ProxyProtocol:true", | |||
| expression: "Name:foo Address:bar TLS:goo,gii TLS CA:car Redirect.EntryPoint:RedirectEntryPoint Redirect.Regex:RedirectRegex Redirect.Replacement:RedirectReplacement Compress:true WhiteListSourceRange:Range ProxyProtocol:192.168.0.1", | |||
There was a problem hiding this comment.
Instead of ProxyProtocol:192.168.0.1 I think we can use ProxyProtocol.TrustedIPs:192.168.0.1
emilevauge
force-pushed
the
add-trust-whitelist-proxy-protocol
branch
2 times, most recently
from
510e6b8
to
13869a1
Compare
ldez
force-pushed
the
add-trust-whitelist-proxy-protocol
branch
from
13869a1
to
143dbd2
Compare
Signed-off-by: Emile Vauge <[email protected]>
Signed-off-by: Emile Vauge <[email protected]>
Signed-off-by: Emile Vauge <[email protected]>
traefiker
force-pushed
the
add-trust-whitelist-proxy-protocol
branch
from
143dbd2
to
21df2dc
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR adds mandatory trusted IP ranges declaration while enabling proxy protocol.
⚠️ This change will break any
1.4.0-rcxconfig with proxy protocol enabled.You need to update your config from:
to
with
10.5.0.2being the IP address of your front load balancer.I'm working on adding an integration test.