proxmox-mirrors/pve-http-server
1
0
Fork 0
mirror of https://git.proxmox.com/git/pve-http-server synced 2025-07-17 19:41:45 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix #5699: pveproxy: add library methods for real IP support

Browse Source 
Signed-off-by: Thomas Skinner <thomas@atskinner.net>
This commit is contained in:
Thomas Skinner 2024-12-11 21:27:05 -06:00 committed by Fabian Grünbichler
parent c03f5d7319
commit fe9d61a83d
2 changed files with 52 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
src/PVE/APIServer/AnyEvent.pm
View File

@ -92,13 +92,14 @@ sub log_request {
$loginfo->{written} = 1; $loginfo->{written} = 1;
my $peerip = $reqstate->{peer_host} || '-'; my $peerip = $reqstate->{peer_host} || '-';
my $realip = $loginfo->{real_ip} || $peerip;
my $userid = $loginfo->{userid} || '-'; my $userid = $loginfo->{userid} || '-';
my $content_length = defined($loginfo->{content_length}) ? $loginfo->{content_length} : '-'; my $content_length = defined($loginfo->{content_length}) ? $loginfo->{content_length} : '-';
my $code = $loginfo->{code} || 500; my $code = $loginfo->{code} || 500;
my $requestline = $loginfo->{requestline} || '-'; my $requestline = $loginfo->{requestline} || '-';
my $timestr = strftime("%d/%m/%Y:%H:%M:%S %z", localtime()); my $timestr = strftime("%d/%m/%Y:%H:%M:%S %z", localtime());
my $msg = "$peerip - $userid [$timestr] \"$requestline\" $code $content_length\n"; my $msg = "$realip - $userid [$timestr] \"$requestline\" $code $content_length\n";
$self->write_log($msg); $self->write_log($msg);
} }
@ -1474,6 +1475,18 @@ sub authenticate_and_handle_request {
my $auth = {}; my $auth = {};
if (my $proxy_real_ip_header = $self->{proxy_real_ip_header}) {
if (my $proxy_real_ip_value = $request->header($proxy_real_ip_header)) {
my $real_ip = Net::IP->new($proxy_real_ip_value);
if (defined($real_ip) && $self->check_allowed_proxy($reqstate->{peer_host})) {
$reqstate->{log}->{real_ip} = Net::IP::ip_compress_address(
$real_ip->ip(),
$real_ip->version(),
);
}
}
}
if ($self->{spiceproxy}) { if ($self->{spiceproxy}) {
my $connect_str = $request->header('Host'); my $connect_str = $request->header('Host');
my ($vmid, $node, $port) = $self->verify_spice_connect_url($connect_str); my ($vmid, $node, $port) = $self->verify_spice_connect_url($connect_str);
@ -1813,6 +1826,29 @@ sub check_host_access {
return $match_allow; return $match_allow;
} }
sub check_allowed_proxy {
my ($self, $client_ip) = @_;
$client_ip = PVE::APIServer::Utils::normalize_v4_in_v6($client_ip);
my $client_ip_object = Net::IP->new($client_ip);
if (!$client_ip_object) {
$self->dprint("client IP not parsable: $@");
return 0;
}
if (my $proxy_real_ip_allow_from = $self->{proxy_real_ip_allow_from}) {
for my $allowed_net ($proxy_real_ip_allow_from->@*) {
if ($allowed_net->overlaps($client_ip_object)) {
$self->dprint("client IP in allowed proxies: ". $allowed_net->print());
return 1;
}
}
return 0;
}
return 1;
}
sub accept_connections { sub accept_connections {
my ($self) = @_; my ($self) = @_;

15
src/PVE/APIServer/Utils.pm
View File

@ -26,6 +26,8 @@ sub read_proxy_config {
$shcmd .= 'echo \"COMPRESSION:\$COMPRESSION\";'; $shcmd .= 'echo \"COMPRESSION:\$COMPRESSION\";';
$shcmd .= 'echo \"DISABLE_TLS_1_2:\$DISABLE_TLS_1_2\";'; $shcmd .= 'echo \"DISABLE_TLS_1_2:\$DISABLE_TLS_1_2\";';
$shcmd .= 'echo \"DISABLE_TLS_1_3:\$DISABLE_TLS_1_3\";'; $shcmd .= 'echo \"DISABLE_TLS_1_3:\$DISABLE_TLS_1_3\";';
$shcmd .= 'echo \"PROXY_REAL_IP_HEADER:\$PROXY_REAL_IP_HEADER\";';
$shcmd .= 'echo \"PROXY_REAL_IP_ALLOW_FROM:\$PROXY_REAL_IP_ALLOW_FROM\";';
my $data = -f $conffile ? `bash -c "$shcmd"` : ''; my $data = -f $conffile ? `bash -c "$shcmd"` : '';
@ -65,6 +67,19 @@ sub read_proxy_config {
$res->{$key} = $value; $res->{$key} = $value;
} elsif ($key eq 'TLS_KEY_FILE') { } elsif ($key eq 'TLS_KEY_FILE') {
$res->{$key} = $value; $res->{$key} = $value;
} elsif ($key eq 'PROXY_REAL_IP_HEADER') {
$res->{$key} = $value;
} elsif ($key eq 'PROXY_REAL_IP_ALLOW_FROM') {
my $ips = [];
for my $ip (split(/,/, $value)) {
if ($ip eq 'all') {
push @$ips, Net::IP->new('0/0') || die Net::IP::Error() . "\n";
push @$ips, Net::IP->new('::/0') || die Net::IP::Error() . "\n";
next;
}
push @$ips, Net::IP->new(normalize_v4_in_v6($ip)) || die Net::IP::Error() . "\n";
}
$res->{$key} = $ips;
} elsif (grep { $key eq $_ } @$boolean_options) { } elsif (grep { $key eq $_ } @$boolean_options) {
die "unknown value '$value' - use 0 or 1\n" if $value !~ m/^(0|1)$/; die "unknown value '$value' - use 0 or 1\n" if $value !~ m/^(0|1)$/;
$res->{$key} = $value; $res->{$key} = $value;