Skip to content

Commit 71f3a1b

Browse files
salonichf5salonichf5
committed
change trustedAddress type to struct
1 parent e31fa4d commit 71f3a1b

File tree

12 files changed

+289
-109
lines changed

12 files changed

+289
-109
lines changed

‎apis/v1alpha1/nginxproxy_types.go

Lines changed: 28 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -137,7 +137,7 @@ type RewriteClientIP struct {
137137
// If enabled, NGINX will recurse on the values in X-Forwarded-Header from the end of array
138138
// to start of array and select the first untrusted IP.
139139
// For example, if X-Forwarded-For is [11.11.11.11, 22.22.22.22, 55.55.55.1],
140-
// and TrustedAddresses is set to 55.55.55.1, NGINX will rewrite the client IP to 22.22.22.22.
140+
// and TrustedAddresses is set to 55.55.55.1/32, NGINX will rewrite the client IP to 22.22.22.22.
141141
// If disabled, NGINX will select the IP at the end of the array.
142142
// In the previous example, 55.55.55.1 would be selected.
143143
// Sets NGINX directive real_ip_recursive: https://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_recursive
@@ -149,17 +149,17 @@ type RewriteClientIP struct {
149149
// If a request comes from a trusted address, NGINX will rewrite the client IP information,
150150
// and forward it to the backend in the X-Forwarded-For* and X-Real-IP headers.
151151
// If the request does not come from a trusted address, NGINX will not rewrite the client IP information.
152-
// Addresses must be provided as CIDR blocks or IP addresses: 10.0.0.0, 192.33.21/24, fe80::1/128.
152+
// TrustedAddresses only supports CIDR blocks: 192.33.21.1/24, fe80::1/64.
153153
// To trust all addresses (not recommended for production), set to 0.0.0.0/0.
154154
// If no addresses are provided, NGINX will not rewrite the client IP information.
155155
// Sets NGINX directive set_real_ip_from: https://nginx.org/en/docs/http/ngx_http_realip_module.html#set_real_ip_from
156156
// This field is required if mode is set.
157157
// +kubebuilder:validation:MaxItems=16
158-
// +listType=set
158+
// +listType=atomic
159159
//
160160
//
161161
// +optional
162-
TrustedAddresses []TrustedAddress `json:"trustedAddresses,omitempty"`
162+
TrustedAddresses []Address `json:"trustedAddresses,omitempty"`
163163
}
164164

165165
// RewriteClientIPModeType defines how NGINX Gateway Fabric will determine the client's original IP address.
@@ -179,10 +179,27 @@ const (
179179
RewriteClientIPModeXForwardedFor RewriteClientIPModeType = "XForwardedFor"
180180
)
181181

182-
// TrustedAddress is a string value representing a CIDR block or an IP address.
183-
// Examples: 10.0.0.2/32, 10.0.0.1, fe80::1/128, ::1/24.
184-
//
185-
// +kubebuilder:validation:Pattern=`^(?:(?:[0-9]{1,3}\.){3}[0-9]{1,3}(?:\/(?:[0-9]|[12][0-9]|3[0-2]))?|(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}(?:\/(?:[0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8]))?)$`
186-
//
187-
//nolint:lll
188-
type TrustedAddress string
182+
// Address is a struct that specifies address type and value.
183+
type Address struct {
184+
// Type specifies the type of address.
185+
// Default is "cidr" which specifies that the address is a CIDR block.
186+
//
187+
// +optional
188+
// +kubebuilder:default:=cidr
189+
Type AddressType `json:"type,omitempty"`
190+
191+
// Value specifies the address value.
192+
//
193+
// +optional
194+
Value string `json:"value,omitempty"`
195+
}
196+
197+
// AddressType specifies the type of address.
198+
// +kubebuilder:validation:Enum=cidr
199+
type AddressType string
200+
201+
const (
202+
// AddressTypeCIDR specifies that the address is a CIDR block.
203+
// kubebuilder:validation:Pattern=`(\/([0-9]?[0-9]?[0-8]))$`
204+
AddressTypeCIDR AddressType = "cidr"
205+
)

‎apis/v1alpha1/zz_generated.deepcopy.go

Lines changed: 16 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎charts/nginx-gateway-fabric/values.yaml

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -94,10 +94,15 @@ nginx:
9494
# disableHTTP2: false
9595
# ipFamily: dual
9696
# rewriteClientIP:
97-
# mode: "XForwardedFor"
98-
# # -- Set to the CIDR range or IP of the proxy that sits in front of NGINX Gateway Fabric.
99-
# trustedAddresses: []
100-
# setIPRecursively: true
97+
# mode: "ProxyProtocol"
98+
# # -- The trusted addresses field needs to be replaced with the load balancer's IP address and type.
99+
# trustedAddresses: [
100+
# {
101+
# # -- The IP address of the load balancer.
102+
# value: "",
103+
# type: "cidr",
104+
# }
105+
# ]
101106
# telemetry:
102107
# exporter:
103108
# endpoint: otel-collector.default.svc:4317

‎config/crd/bases/gateway.nginx.org_nginxproxies.yaml

Lines changed: 18 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ spec:
8484
If enabled, NGINX will recurse on the values in X-Forwarded-Header from the end of array
8585
to start of array and select the first untrusted IP.
8686
For example, if X-Forwarded-For is [11.11.11.11, 22.22.22.22, 55.55.55.1],
87-
and TrustedAddresses is set to 55.55.55.1, NGINX will rewrite the client IP to 22.22.22.22.
87+
and TrustedAddresses is set to 55.55.55.1/32, NGINX will rewrite the client IP to 22.22.22.22.
8888
If disabled, NGINX will select the IP at the end of the array.
8989
In the previous example, 55.55.55.1 would be selected.
9090
Sets NGINX directive real_ip_recursive: https://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_recursive
@@ -95,20 +95,30 @@ spec:
9595
If a request comes from a trusted address, NGINX will rewrite the client IP information,
9696
and forward it to the backend in the X-Forwarded-For* and X-Real-IP headers.
9797
If the request does not come from a trusted address, NGINX will not rewrite the client IP information.
98-
Addresses must be provided as CIDR blocks or IP addresses: 10.0.0.0, 192.33.21/24, fe80::1/128.
98+
TrustedAddresses only supports CIDR blocks: 192.33.21.1/24, fe80::1/64.
9999
To trust all addresses (not recommended for production), set to 0.0.0.0/0.
100100
If no addresses are provided, NGINX will not rewrite the client IP information.
101101
Sets NGINX directive set_real_ip_from: https://nginx.org/en/docs/http/ngx_http_realip_module.html#set_real_ip_from
102102
This field is required if mode is set.
103103
items:
104-
description: |-
105-
TrustedAddress is a string value representing a CIDR block or an IP address.
106-
Examples: 10.0.0.2/32, 10.0.0.1, fe80::1/128, ::1/24.
107-
pattern: ^(?:(?:[0-9]{1,3}\.){3}[0-9]{1,3}(?:\/(?:[0-9]|[12][0-9]|3[0-2]))?|(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}(?:\/(?:[0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8]))?)$
108-
type: string
104+
description: Address is a struct that specifies address type
105+
and value.
106+
properties:
107+
type:
108+
default: cidr
109+
description: |-
110+
Type specifies the type of address.
111+
Default is "cidr" which specifies that the address is a CIDR block.
112+
enum:
113+
- cidr
114+
type: string
115+
value:
116+
description: Value specifies the address value.
117+
type: string
118+
type: object
109119
maxItems: 16
110120
type: array
111-
x-kubernetes-list-type: set
121+
x-kubernetes-list-type: atomic
112122
type: object
113123
x-kubernetes-validations:
114124
- message: if mode is set, trustedAddresses is a required field

‎deploy/crds.yaml

Lines changed: 18 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -669,7 +669,7 @@ spec:
669669
If enabled, NGINX will recurse on the values in X-Forwarded-Header from the end of array
670670
to start of array and select the first untrusted IP.
671671
For example, if X-Forwarded-For is [11.11.11.11, 22.22.22.22, 55.55.55.1],
672-
and TrustedAddresses is set to 55.55.55.1, NGINX will rewrite the client IP to 22.22.22.22.
672+
and TrustedAddresses is set to 55.55.55.1/32, NGINX will rewrite the client IP to 22.22.22.22.
673673
If disabled, NGINX will select the IP at the end of the array.
674674
In the previous example, 55.55.55.1 would be selected.
675675
Sets NGINX directive real_ip_recursive: https://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_recursive
@@ -680,20 +680,30 @@ spec:
680680
If a request comes from a trusted address, NGINX will rewrite the client IP information,
681681
and forward it to the backend in the X-Forwarded-For* and X-Real-IP headers.
682682
If the request does not come from a trusted address, NGINX will not rewrite the client IP information.
683-
Addresses must be provided as CIDR blocks or IP addresses: 10.0.0.0, 192.33.21/24, fe80::1/128.
683+
TrustedAddresses only supports CIDR blocks: 192.33.21.1/24, fe80::1/64.
684684
To trust all addresses (not recommended for production), set to 0.0.0.0/0.
685685
If no addresses are provided, NGINX will not rewrite the client IP information.
686686
Sets NGINX directive set_real_ip_from: https://nginx.org/en/docs/http/ngx_http_realip_module.html#set_real_ip_from
687687
This field is required if mode is set.
688688
items:
689-
description: |-
690-
TrustedAddress is a string value representing a CIDR block or an IP address.
691-
Examples: 10.0.0.2/32, 10.0.0.1, fe80::1/128, ::1/24.
692-
pattern: ^(?:(?:[0-9]{1,3}\.){3}[0-9]{1,3}(?:\/(?:[0-9]|[12][0-9]|3[0-2]))?|(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}(?:\/(?:[0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8]))?)$
693-
type: string
689+
description: Address is a struct that specifies address type
690+
and value.
691+
properties:
692+
type:
693+
default: cidr
694+
description: |-
695+
Type specifies the type of address.
696+
Default is "cidr" which specifies that the address is a CIDR block.
697+
enum:
698+
- cidr
699+
type: string
700+
value:
701+
description: Value specifies the address value.
702+
type: string
703+
type: object
694704
maxItems: 16
695705
type: array
696-
x-kubernetes-list-type: set
706+
x-kubernetes-list-type: atomic
697707
type: object
698708
x-kubernetes-validations:
699709
- message: if mode is set, trustedAddresses is a required field

‎internal/mode/static/nginx/config/servers_template.go

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,8 @@ server {
1313
listen [::]:{{ $s.Listen }} ssl default_server{{ $.RewriteClientIP.ProxyProtocol }};
1414
{{- end }}
1515
ssl_reject_handshake on;
16-
{{- range $cidr := $.RewriteClientIP.RealIPFrom }}
17-
set_real_ip_from {{ $cidr }};
16+
{{- range $address := $.RewriteClientIP.RealIPFrom }}
17+
set_real_ip_from {{ $address }};
1818
{{- end}}
1919
{{- if $.RewriteClientIP.RealIPHeader}}
2020
real_ip_header {{ $.RewriteClientIP.RealIPHeader }};
@@ -31,8 +31,8 @@ server {
3131
{{- if $.IPFamily.IPv6 }}
3232
listen [::]:{{ $s.Listen }} default_server{{ $.RewriteClientIP.ProxyProtocol }};
3333
{{- end }}
34-
{{- range $cidr := $.RewriteClientIP.RealIPFrom }}
35-
set_real_ip_from {{ $cidr }};
34+
{{- range $address := $.RewriteClientIP.RealIPFrom }}
35+
set_real_ip_from {{ $address }};
3636
{{- end}}
3737
{{- if $.RewriteClientIP.RealIPHeader}}
3838
real_ip_header {{ $.RewriteClientIP.RealIPHeader }};
@@ -77,8 +77,8 @@ server {
7777
include {{ $i.Name }};
7878
{{- end }}
7979
80-
{{- range $cidr := $.RewriteClientIP.RealIPFrom }}
81-
set_real_ip_from {{ $cidr }};
80+
{{- range $address := $.RewriteClientIP.RealIPFrom }}
81+
set_real_ip_from {{ $address }};
8282
{{- end}}
8383
{{- if $.RewriteClientIP.RealIPHeader}}
8484
real_ip_header {{ $.RewriteClientIP.RealIPHeader }};

‎internal/mode/static/nginx/config/stream_servers_template.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,8 @@ server {
1010
listen [::]:{{ $s.Listen }};
1111
{{- end }}
1212
13-
{{- range $cidr := $s.RewriteClientIP.RealIPFrom }}
14-
set_real_ip_from {{ $cidr }};
13+
{{- range $address := $s.RewriteClientIP.RealIPFrom }}
14+
set_real_ip_from {{ $address }};
1515
{{- end}}
1616
{{- if $.Plus }}
1717
status_zone {{ $s.StatusZone }};

‎internal/mode/static/state/dataplane/configuration.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -863,7 +863,7 @@ func buildBaseHTTPConfig(g *graph.Graph) BaseHTTPConfig {
863863
}
864864

865865
if len(g.NginxProxy.Source.Spec.RewriteClientIP.TrustedAddresses) > 0 {
866-
baseConfig.RewriteClientIPSettings.TrustedAddresses = convertTrustedAddresses(
866+
baseConfig.RewriteClientIPSettings.TrustedAddresses = convertAddresses(
867867
g.NginxProxy.Source.Spec.RewriteClientIP.TrustedAddresses,
868868
)
869869
}
@@ -894,10 +894,10 @@ func buildPolicies(graphPolicies []*graph.Policy) []policies.Policy {
894894
return finalPolicies
895895
}
896896

897-
func convertTrustedAddresses(addresses []ngfAPI.TrustedAddress) []string {
897+
func convertAddresses(addresses []ngfAPI.Address) []string {
898898
trustedAddresses := make([]string, len(addresses))
899899
for i, addr := range addresses {
900-
trustedAddresses[i] = string(addr)
900+
trustedAddresses[i] = addr.Value
901901
}
902902
return trustedAddresses
903903
}

‎internal/mode/static/state/dataplane/configuration_test.go

Lines changed: 43 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -2198,8 +2198,13 @@ func TestBuildConfiguration(t *testing.T) {
21982198
Spec: ngfAPI.NginxProxySpec{
21992199
RewriteClientIP: &ngfAPI.RewriteClientIP{
22002200
SetIPRecursively: helpers.GetPointer(true),
2201-
TrustedAddresses: []ngfAPI.TrustedAddress{"1.1.1.1/32"},
2202-
Mode: helpers.GetPointer(ngfAPI.RewriteClientIPModeProxyProtocol),
2201+
TrustedAddresses: []ngfAPI.Address{
2202+
{
2203+
Type: ngfAPI.AddressTypeCIDR,
2204+
Value: "1.1.1.1/32",
2205+
},
2206+
},
2207+
Mode: helpers.GetPointer(ngfAPI.RewriteClientIPModeProxyProtocol),
22032208
},
22042209
},
22052210
},
@@ -3619,8 +3624,13 @@ func TestBuildRewriteIPSettings(t *testing.T) {
36193624
Source: &ngfAPI.NginxProxy{
36203625
Spec: ngfAPI.NginxProxySpec{
36213626
RewriteClientIP: &ngfAPI.RewriteClientIP{
3622-
Mode: helpers.GetPointer(ngfAPI.RewriteClientIPModeProxyProtocol),
3623-
TrustedAddresses: []ngfAPI.TrustedAddress{"10.9.9.4"},
3627+
Mode: helpers.GetPointer(ngfAPI.RewriteClientIPModeProxyProtocol),
3628+
TrustedAddresses: []ngfAPI.Address{
3629+
{
3630+
Type: ngfAPI.AddressTypeCIDR,
3631+
Value: "10.9.9.4/32",
3632+
},
3633+
},
36243634
SetIPRecursively: helpers.GetPointer(true),
36253635
},
36263636
},
@@ -3629,7 +3639,7 @@ func TestBuildRewriteIPSettings(t *testing.T) {
36293639
},
36303640
expRewriteIPSettings: RewriteClientIPSettings{
36313641
Mode: RewriteIPModeProxyProtocol,
3632-
TrustedAddresses: []string{"10.9.9.4"},
3642+
TrustedAddresses: []string{"10.9.9.4/32"},
36333643
IPRecursive: true,
36343644
},
36353645
},
@@ -3641,8 +3651,13 @@ func TestBuildRewriteIPSettings(t *testing.T) {
36413651
Source: &ngfAPI.NginxProxy{
36423652
Spec: ngfAPI.NginxProxySpec{
36433653
RewriteClientIP: &ngfAPI.RewriteClientIP{
3644-
Mode: helpers.GetPointer(ngfAPI.RewriteClientIPModeXForwardedFor),
3645-
TrustedAddresses: []ngfAPI.TrustedAddress{"76.89.90.11"},
3654+
Mode: helpers.GetPointer(ngfAPI.RewriteClientIPModeXForwardedFor),
3655+
TrustedAddresses: []ngfAPI.Address{
3656+
{
3657+
Type: ngfAPI.AddressTypeCIDR,
3658+
Value: "76.89.90.11/24",
3659+
},
3660+
},
36463661
SetIPRecursively: helpers.GetPointer(true),
36473662
},
36483663
},
@@ -3651,7 +3666,7 @@ func TestBuildRewriteIPSettings(t *testing.T) {
36513666
},
36523667
expRewriteIPSettings: RewriteClientIPSettings{
36533668
Mode: RewriteIPModeXForwardedFor,
3654-
TrustedAddresses: []string{"76.89.90.11"},
3669+
TrustedAddresses: []string{"76.89.90.11/24"},
36553670
IPRecursive: true,
36563671
},
36573672
},
@@ -3663,8 +3678,25 @@ func TestBuildRewriteIPSettings(t *testing.T) {
36633678
Source: &ngfAPI.NginxProxy{
36643679
Spec: ngfAPI.NginxProxySpec{
36653680
RewriteClientIP: &ngfAPI.RewriteClientIP{
3666-
Mode: helpers.GetPointer(ngfAPI.RewriteClientIPModeXForwardedFor),
3667-
TrustedAddresses: []ngfAPI.TrustedAddress{"5.5.5.5", "1.1.1.1/32", "2.2.2.2/32", "3.3.3.3/24"},
3681+
Mode: helpers.GetPointer(ngfAPI.RewriteClientIPModeXForwardedFor),
3682+
TrustedAddresses: []ngfAPI.Address{
3683+
{
3684+
Type: ngfAPI.AddressTypeCIDR,
3685+
Value: "5.5.5.5/12",
3686+
},
3687+
{
3688+
Type: ngfAPI.AddressTypeCIDR,
3689+
Value: "1.1.1.1/26",
3690+
},
3691+
{
3692+
Type: ngfAPI.AddressTypeCIDR,
3693+
Value: "2.2.2.2/32",
3694+
},
3695+
{
3696+
Type: ngfAPI.AddressTypeCIDR,
3697+
Value: "3.3.3.3/24",
3698+
},
3699+
},
36683700
SetIPRecursively: helpers.GetPointer(false),
36693701
},
36703702
},
@@ -3673,7 +3705,7 @@ func TestBuildRewriteIPSettings(t *testing.T) {
36733705
},
36743706
expRewriteIPSettings: RewriteClientIPSettings{
36753707
Mode: RewriteIPModeXForwardedFor,
3676-
TrustedAddresses: []string{"5.5.5.5", "1.1.1.1/32", "2.2.2.2/32", "3.3.3.3/24"},
3708+
TrustedAddresses: []string{"5.5.5.5/12", "1.1.1.1/26", "2.2.2.2/32", "3.3.3.3/24"},
36773709
IPRecursive: false,
36783710
},
36793711
},

‎internal/mode/static/state/graph/nginxproxy.go

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -172,15 +172,12 @@ func validateRewriteClientIP(npCfg *ngfAPI.NginxProxy) field.ErrorList {
172172
}
173173

174174
for _, addr := range rewriteClientIP.TrustedAddresses {
175-
cidrError := k8svalidation.IsValidCIDR(trustedAddressesPath, string(addr))
176-
ipError := k8svalidation.IsValidIP(trustedAddressesPath, string(addr))
177-
178-
if cidrError != nil && ipError != nil {
175+
if err := k8svalidation.IsValidCIDR(trustedAddressesPath, addr.Value); err != nil {
179176
allErrs = append(
180177
allErrs,
181-
field.Invalid(trustedAddressesPath.Child(string(addr)),
178+
field.Invalid(trustedAddressesPath.Child(addr.Value),
182179
addr,
183-
"must be a valid IP address or CIDR range",
180+
err.ToAggregate().Error(),
184181
),
185182
)
186183
}

0 commit comments

Comments
 (0)