Skip to content

Commit a531369

Browse files
salonichf5salonichf5
committed
add support for preserving clientIP
1 parent 34654d7 commit a531369

File tree

16 files changed

+766
-38
lines changed

16 files changed

+766
-38
lines changed

‎apis/v1alpha1/nginxproxy_types.go

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,12 @@ type NginxProxySpec struct {
5353
//
5454
// +optional
5555
Telemetry *Telemetry `json:"telemetry,omitempty"`
56+
// RewriteClientIP defines configuration for rewriting the client IP to the original client's IP.
57+
// +kubebuilder:validation:XValidation:message="if mode is set, trustedAddresses is a required field",rule="!(has(self.mode) && !has(self.trustedAddresses))"
58+
//
59+
// +optional
60+
//nolint:lll
61+
RewriteClientIP *RewriteClientIP `json:"rewriteClientIP,omitempty"`
5662
// DisableHTTP2 defines if http2 should be disabled for all servers.
5763
// Default is false, meaning http2 will be enabled for all servers.
5864
//
@@ -114,3 +120,56 @@ type TelemetryExporter struct {
114120
// +kubebuilder:validation:Pattern=`^(?:http?:\/\/)?[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*(?::\d{1,5})?$`
115121
Endpoint string `json:"endpoint"`
116122
}
123+
124+
// RewriteClientIP specifies the configuration for rewriting the client's IP address.
125+
type RewriteClientIP struct {
126+
// Mode defines how NGINX will rewrite the client's IP address.
127+
// Possible modes: ProxyProtocol, XForwardedFor.
128+
//
129+
// +optional
130+
Mode *RewriteClientIPModeType `json:"mode,omitempty"`
131+
132+
// SetIPRecursively configures whether recursive search is used for selecting client's
133+
// address from the X-Forwarded-For header and used in conjunction with TrustedAddresses.
134+
// If enabled, NGINX will recurse on the values in X-Forwarded-Header from the end of
135+
// array to start of array and select the first untrusted IP.
136+
//
137+
// +optional
138+
SetIPRecursively *bool `json:"setIPRecursively,omitempty"`
139+
140+
// TrustedAddresses specifies the addresses that are trusted to send correct client IP information.
141+
// If a request comes from a trusted address, NGINX will rewrite the client IP information,
142+
// and forward it to the backend in the X-Forwarded-For* and X-Real-IP headers.
143+
// This field is required if mode is set.
144+
// +kubebuilder:validation:MaxItems=16
145+
// +listType=atomic
146+
//
147+
//
148+
// +optional
149+
TrustedAddresses []TrustedAddress `json:"trustedAddresses,omitempty"`
150+
}
151+
152+
// RewriteClientIPModeType defines how NGINX Gateway Fabric will determine the client's original IP address.
153+
// +kubebuilder:validation:Enum=ProxyProtocol;XForwardedFor
154+
type RewriteClientIPModeType string
155+
156+
const (
157+
// RewriteClientIPModeProxyProtocol configures NGINX to accept PROXY protocol and,
158+
// set the client's IP address to the IP address in the PROXY protocol header.
159+
// Sets the proxy_protocol parameter to the listen directive on all servers, and sets real_ip_header
160+
// to proxy_protocol: https://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_header.
161+
RewriteClientIPModeProxyProtocol RewriteClientIPModeType = "ProxyProtocol"
162+
163+
// RewriteClientIPModeXForwardedFor configures NGINX to set the client's IP address to the
164+
// IP address in the X-Forwarded-For HTTP header.
165+
// https://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_header.
166+
RewriteClientIPModeXForwardedFor RewriteClientIPModeType = "XForwardedFor"
167+
)
168+
169+
// TrustedAddress is a string value representing a CIDR block.
170+
// Examples: 0.0.0.0/0
171+
//
172+
// +kubebuilder:validation:Pattern=`^(?:(?:[0-9]{1,3}\.){3}[0-9]{1,3}(?:\/(?:[0-9]|[12][0-9]|3[0-2]))?|(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}(?:\/(?:[0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8]))?)$`
173+
//
174+
//nolint:lll
175+
type TrustedAddress string

‎apis/v1alpha1/zz_generated.deepcopy.go

Lines changed: 35 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎charts/nginx-gateway-fabric/values.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,10 @@ nginx:
9393
{}
9494
# disableHTTP2: false
9595
# ipFamily: dual
96+
# rewriteClientIP:
97+
# mode: "ProxyProtocol"
98+
# trustedAddresses: ["0.0.0.0/0"]
99+
# setIPRecursively: true
96100
# telemetry:
97101
# exporter:
98102
# endpoint: otel-collector.default.svc:4317

‎config/crd/bases/gateway.nginx.org_nginxproxies.yaml

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,44 @@ spec:
6262
- ipv4
6363
- ipv6
6464
type: string
65+
rewriteClientIP:
66+
description: RewriteClientIP defines configuration for rewriting the
67+
client IP to the original client's IP.
68+
properties:
69+
mode:
70+
description: |-
71+
Mode defines how NGINX will rewrite the client's IP address.
72+
Possible modes: ProxyProtocol, XForwardedFor.
73+
enum:
74+
- ProxyProtocol
75+
- XForwardedFor
76+
type: string
77+
setIPRecursively:
78+
description: |-
79+
SetIPRecursively configures whether recursive search is used for selecting client's
80+
address from the X-Forwarded-For header and used in conjunction with TrustedAddresses.
81+
If enabled, NGINX will recurse on the values in X-Forwarded-Header from the end of
82+
array to start of array and select the first untrusted IP.
83+
type: boolean
84+
trustedAddresses:
85+
description: |-
86+
TrustedAddresses specifies the addresses that are trusted to send correct client IP information.
87+
If a request comes from a trusted address, NGINX will rewrite the client IP information,
88+
and forward it to the backend in the X-Forwarded-For* and X-Real-IP headers.
89+
This field is required if mode is set.
90+
items:
91+
description: |-
92+
TrustedAddress is a string value representing a CIDR block.
93+
Examples: 0.0.0.0/0
94+
pattern: ^(?:(?:[0-9]{1,3}\.){3}[0-9]{1,3}(?:\/(?:[0-9]|[12][0-9]|3[0-2]))?|(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}(?:\/(?:[0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8]))?)$
95+
type: string
96+
maxItems: 16
97+
type: array
98+
x-kubernetes-list-type: atomic
99+
type: object
100+
x-kubernetes-validations:
101+
- message: if mode is set, trustedAddresses is a required field
102+
rule: '!(has(self.mode) && !has(self.trustedAddresses))'
65103
telemetry:
66104
description: Telemetry specifies the OpenTelemetry configuration.
67105
properties:

‎deploy/crds.yaml

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -707,6 +707,44 @@ spec:
707707
- ipv4
708708
- ipv6
709709
type: string
710+
rewriteClientIP:
711+
description: RewriteClientIP defines configuration for rewriting the
712+
client IP to the original client's IP.
713+
properties:
714+
mode:
715+
description: |-
716+
Mode defines how NGINX will rewrite the client's IP address.
717+
Possible modes: ProxyProtocol, XForwardedFor.
718+
enum:
719+
- ProxyProtocol
720+
- XForwardedFor
721+
type: string
722+
setIPRecursively:
723+
description: |-
724+
SetIPRecursively configures whether recursive search is used for selecting client's
725+
address from the X-Forwarded-For header and used in conjunction with TrustedAddresses.
726+
If enabled, NGINX will recurse on the values in X-Forwarded-Header from the end of
727+
array to start of array and select the first untrusted IP.
728+
type: boolean
729+
trustedAddresses:
730+
description: |-
731+
TrustedAddresses specifies the addresses that are trusted to send correct client IP information.
732+
If a request comes from a trusted address, NGINX will rewrite the client IP information,
733+
and forward it to the backend in the X-Forwarded-For* and X-Real-IP headers.
734+
This field is required if mode is set.
735+
items:
736+
description: |-
737+
TrustedAddress is a string value representing a CIDR block.
738+
Examples: 0.0.0.0/0
739+
pattern: ^(?:(?:[0-9]{1,3}\.){3}[0-9]{1,3}(?:\/(?:[0-9]|[12][0-9]|3[0-2]))?|(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}(?:\/(?:[0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8]))?)$
740+
type: string
741+
maxItems: 16
742+
type: array
743+
x-kubernetes-list-type: atomic
744+
type: object
745+
x-kubernetes-validations:
746+
- message: if mode is set, trustedAddresses is a required field
747+
rule: '!(has(self.mode) && !has(self.trustedAddresses))'
710748
telemetry:
711749
description: Telemetry specifies the OpenTelemetry configuration.
712750
properties:

‎internal/mode/static/nginx/config/http/config.go

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -109,13 +109,22 @@ type ProxySSLVerify struct {
109109

110110
// ServerConfig holds configuration for an HTTP server and IP family to be used by NGINX.
111111
type ServerConfig struct {
112-
Servers []Server
113-
IPFamily shared.IPFamily
114-
Plus bool
112+
Servers []Server
113+
RewriteClientIP RewriteClientIPSettings
114+
IPFamily shared.IPFamily
115+
Plus bool
115116
}
116117

117118
// Include defines a file that's included via the include directive.
118119
type Include struct {
119120
Name string
120121
Content []byte
121122
}
123+
124+
// RewriteClientIP holds the configuration for the rewrite client IP settings.
125+
type RewriteClientIPSettings struct {
126+
RealIPHeader string
127+
RealIPFrom []string
128+
Recursive bool
129+
ProxyProtocol bool
130+
}

‎internal/mode/static/nginx/config/servers.go

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -69,9 +69,10 @@ func (g GeneratorImpl) executeServers(conf dataplane.Configuration, generator po
6969
servers, httpMatchPairs := createServers(conf.HTTPServers, conf.SSLServers, conf.TLSPassthroughServers, generator)
7070

7171
serverConfig := http.ServerConfig{
72-
Servers: servers,
73-
IPFamily: getIPFamily(conf.BaseHTTPConfig),
74-
Plus: g.plus,
72+
Servers: servers,
73+
IPFamily: getIPFamily(conf.BaseHTTPConfig),
74+
Plus: g.plus,
75+
RewriteClientIP: getRewriteClientIPSettings(conf.BaseHTTPConfig.RewriteClientIPSettings),
7576
}
7677

7778
serverResult := executeResult{
@@ -874,3 +875,18 @@ func createDefaultRootLocation() http.Location {
874875
func isNonSlashedPrefixPath(pathType dataplane.PathType, path string) bool {
875876
return pathType == dataplane.PathTypePrefix && !strings.HasSuffix(path, "/")
876877
}
878+
879+
// getRewriteClientIPSettings returns the configuration for the rewriting client IP settings.
880+
func getRewriteClientIPSettings(rewriteIP dataplane.RewriteClientIPSettings) http.RewriteClientIPSettings {
881+
var proxyProtocol bool
882+
if rewriteIP.Mode == dataplane.RewriteIPModeProxyProtocol {
883+
proxyProtocol = true
884+
}
885+
886+
return http.RewriteClientIPSettings{
887+
Recursive: rewriteIP.IPRecursive,
888+
ProxyProtocol: proxyProtocol,
889+
RealIPFrom: rewriteIP.TrustedCIDRs,
890+
RealIPHeader: string(rewriteIP.Mode),
891+
}
892+
}

‎internal/mode/static/nginx/config/servers_template.go

Lines changed: 41 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -2,38 +2,57 @@ package config
22

33
const serversTemplateText = `
44
js_preload_object matches from /etc/nginx/conf.d/matches.json;
5-
{{ range $s := .Servers -}}
5+
{{ $proxyProtocol := "" }}
6+
{{ if $.RewriteClientIP.ProxyProtocol }}{{ $proxyProtocol = " proxy_protocol" }}{{ end }}
7+
8+
{{- range $s := .Servers -}}
69
{{ if $s.IsDefaultSSL -}}
710
server {
8-
{{- if or ($.IPFamily.IPv4) ($s.IsSocket) }}
9-
listen {{ $s.Listen }} ssl default_server;
11+
{{- if or ($.IPFamily.IPv4) ($s.IsSocket) }}
12+
listen {{ $s.Listen }} ssl default_server{{ $proxyProtocol }};
1013
{{- end }}
1114
{{- if and ($.IPFamily.IPv6) (not $s.IsSocket) }}
12-
listen [::]:{{ $s.Listen }} ssl default_server;
15+
listen [::]:{{ $s.Listen }} ssl default_server{{ $proxyProtocol }};
1316
{{- end }}
14-
1517
ssl_reject_handshake on;
18+
{{- range $cidr := $.RewriteClientIP.RealIPFrom }}
19+
set_real_ip_from {{ $cidr }};
20+
{{- end}}
21+
{{- if $.RewriteClientIP.RealIPHeader}}
22+
real_ip_header {{ $.RewriteClientIP.RealIPHeader }};
23+
{{- end}}
24+
{{- if $.RewriteClientIP.Recursive }}
25+
real_ip_recursive on;
26+
{{ end }}
1627
}
1728
{{- else if $s.IsDefaultHTTP }}
1829
server {
1930
{{- if $.IPFamily.IPv4 }}
20-
listen {{ $s.Listen }} default_server;
31+
listen {{ $s.Listen }} default_server{{ $proxyProtocol }};
2132
{{- end }}
2233
{{- if $.IPFamily.IPv6 }}
23-
listen [::]:{{ $s.Listen }} default_server;
34+
listen [::]:{{ $s.Listen }} default_server{{ $proxyProtocol }};
2435
{{- end }}
25-
36+
{{- range $cidr := $.RewriteClientIP.RealIPFrom }}
37+
set_real_ip_from {{ $cidr }};
38+
{{- end}}
39+
{{- if $.RewriteClientIP.RealIPHeader}}
40+
real_ip_header {{ $.RewriteClientIP.RealIPHeader }};
41+
{{- end}}
42+
{{- if $.RewriteClientIP.Recursive }}
43+
real_ip_recursive on;
44+
{{ end }}
2645
default_type text/html;
2746
return 404;
2847
}
2948
{{- else }}
3049
server {
3150
{{- if $s.SSL }}
3251
{{- if or ($.IPFamily.IPv4) ($s.IsSocket) }}
33-
listen {{ $s.Listen }} ssl;
52+
listen {{ $s.Listen }} ssl{{ $proxyProtocol }};
3453
{{- end }}
3554
{{- if and ($.IPFamily.IPv6) (not $s.IsSocket) }}
36-
listen [::]:{{ $s.Listen }} ssl;
55+
listen [::]:{{ $s.Listen }} ssl{{ $proxyProtocol }};
3756
{{- end }}
3857
ssl_certificate {{ $s.SSL.Certificate }};
3958
ssl_certificate_key {{ $s.SSL.CertificateKey }};
@@ -43,10 +62,10 @@ server {
4362
}
4463
{{- else }}
4564
{{- if $.IPFamily.IPv4 }}
46-
listen {{ $s.Listen }};
65+
listen {{ $s.Listen }}{{ $proxyProtocol }};
4766
{{- end }}
4867
{{- if $.IPFamily.IPv6 }}
49-
listen [::]:{{ $s.Listen }};
68+
listen [::]:{{ $s.Listen }}{{ $proxyProtocol }};
5069
{{- end }}
5170
{{- end }}
5271
@@ -60,6 +79,16 @@ server {
6079
include {{ $i.Name }};
6180
{{- end }}
6281
82+
{{- range $cidr := $.RewriteClientIP.RealIPFrom }}
83+
set_real_ip_from {{ $cidr }};
84+
{{- end}}
85+
{{- if $.RewriteClientIP.RealIPHeader}}
86+
real_ip_header {{ $.RewriteClientIP.RealIPHeader }};
87+
{{- end}}
88+
{{- if $.RewriteClientIP.Recursive }}
89+
real_ip_recursive on;
90+
{{ end }}
91+
6392
{{ range $l := $s.Locations }}
6493
location {{ $l.Path }} {
6594
{{ if eq $l.Type "internal" -}}

0 commit comments

Comments
 (0)