ENG-8083 trusted proxies #27
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
mmlb
suggested changes
Aug 19, 2020
mmlb
suggested changes
Aug 19, 2020
kqdeng
force-pushed
the
ENG-8083-trusted-proxies
branch
from
f467cb9 to
76244dc
Compare
mmlb
suggested changes
Aug 27, 2020
xff/xff.go
Outdated
| @@ -148,3 +147,21 @@ func New(l log.Logger, allowedSubnets []string) (grpc.StreamServerInterceptor, g | |||
| } | |||
| return streamer, unaryer | |||
| } | |||
|
|
|||
| func XFFHandler(l log.Logger, mux *http.ServeMux, allowedSubnets []string) http.Handler { | |||
There was a problem hiding this comment.
I think maybe HTTPHandler makes more sense.
Comment on lines
+161
to
+168
| handler = xffmw.Handler(mux) | ||
| } else { | ||
| handler = mux |
There was a problem hiding this comment.
I think it would be nice to handle mux being nil and then using http.DefaultServeMux
xff/xff.go
Outdated
Comment on lines
121
to
123
| // New returns a set of grpc interceptors that will replace peer.IP with X-FORWARDED-FOR value if the peer ip within a subnet in allowedSubnets | ||
| // If allowedSubnets is nil it will look for subents in the TRUSTED_PROXIES env var. | ||
| // If allowedSubnets is nil and TRUSTED_PROXIES is empty then X-FORWARDED-FOR will be ignored (no proxy is trusted). |
There was a problem hiding this comment.
Comment needs updating with the new name.
There was a problem hiding this comment.
🤦♀️ thanks for catching that
kqdeng
force-pushed
the
ENG-8083-trusted-proxies
branch
from
b77e5d7 to
0beccbe
Compare
Signed-off-by: Kelly Deng <[email protected]>
Signed-off-by: Kelly Deng <[email protected]>
Signed-off-by: Kelly Deng <[email protected]>
Signed-off-by: Kelly Deng <[email protected]>
kqdeng
force-pushed
the
ENG-8083-trusted-proxies
branch
from
0beccbe to
0de4348
Compare
mmlb
suggested changes
Aug 31, 2020
xff/xff.go
Outdated
| @@ -118,8 +118,8 @@ func ParseTrustedProxies() []string { | |||
| return result | |||
| } | |||
|
|
|||
| // New returns a set of grpc interceptors that will replace peer.IP with X-FORWARDED-FOR value if the peer ip within a subnet in allowedSubnets | |||
| // If allowedSubnets is nil it will look for subents in the TRUSTED_PROXIES env var. | |||
| // GRPCMiddlewares returns a set of grpc interceptors that will replace peer.IP with X-FORWARDED-FOR value if the peer ip within a subnet in allowedSubnets | |||
There was a problem hiding this comment.
Oh I just noticed some grammatical issue here from before, can you fix though? Maybe to read like:
if the peer IP is within one of the subents in allowedSubnets
There was a problem hiding this comment.
Signed-off-by: Kelly Deng <[email protected]>
kqdeng
force-pushed
the
ENG-8083-trusted-proxies
branch
from
6a1749a to
884567e
Compare
mmlb
approved these changes
Sep 1, 2020
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Handles the case when hegel is running behind a reverse proxy.
This was already handled for the grpc endpoints, so this pr is specifically for the http endpoints.
Why is this needed
Hegel looks up the remote user ip from the request, then passes that ip to retrieve the associated piece of hardware. If hegel is behind a proxy, then the remote user ip will be the proxy's ip (and hegel won't be able to get the correct piece of hardware).
Fixes: #
How Has This Been Tested?
How are existing users impacted? What migration steps/scripts do we need?
No migration needed.
Checklist:
I have: