From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) by lore.proxmox.com (Postfix) with ESMTPS id E4AF81FF161 for ; Tue, 10 Sep 2024 02:30:58 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 3A98C1BCB3; Tue, 10 Sep 2024 02:30:53 +0200 (CEST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1725928243; x=1726533043; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=anodw3T0IeFQnUMtzjy7+TSl9weFHtVW8bb3MGE1kLk=; b=ErD5J0b/TE5yrRcMz5+XvXdLoM0WTXOrOSB3MZqBJxTj0LVjz/T7Fgolrk3mVlz/9a h1tqmX1fFwlEbGqhiVZMaIrVZQFf3YQIcBQD3uyJJdhmsxBLliO3tKf9xkfqtm+Rdvqc EvY8Nn32A7DQsqjn+M4ZS3ALlTMEbQg0rH5BwbFK3K0A555hKLX5x6wq6vtedg7ZpOGJ vaHvmnE9LMxW70tKQmAqYSlYR3glT9kHubV+Jl3Xcs2DALXjy3Cr0ztdKSgp6c1VjiEd UvzjBNe3EOwN2wV/2xmy9zjAIWdLzFXaArfPOE8zZ2+dBCzi8rcnjqK8NfTQFAwObHgi U0iw== X-Gm-Message-State: AOJu0YwyQWo+eTcNzQ6Akfcj8+zGu11JJJe7Va6sFArHNrin/sGv1gNA GDMxTsFT5JpgCGYTWOizSLi/tGfxYCDHzJ7kQjxEg85Stfzh5WucmYLj8g== X-Google-Smtp-Source: AGHT+IGQJ57kf/afYa5dELbK04fjxYXgrbyT5INxi3LAxyiXrMVzBWZuGOP1AL/fF0YUagf02YwcSg== X-Received: by 2002:a05:6902:1549:b0:e1a:9336:8b62 with SMTP id 3f1490d57ef6-e1d34898b47mr11843807276.32.1725928243419; Mon, 09 Sep 2024 17:30:43 -0700 (PDT) From: Thomas Skinner To: pve-devel@lists.proxmox.com Date: Mon, 9 Sep 2024 19:30:25 -0500 Message-Id: <20240910003026.667328-3-thomas@atskinner.net> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20240910003026.667328-1-thomas@atskinner.net> References: <20240910003026.667328-1-thomas@atskinner.net> MIME-Version: 1.0 X-SPAM-LEVEL: Spam detection results: 0 AWL -0.003 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy FREEMAIL_FORGED_FROMDOMAIN 0.001 2nd level domains in From and EnvelopeFrom freemail headers are different FREEMAIL_FROM 0.001 Sender email is commonly abused enduser mail provider HEADER_FROM_DIFFERENT_DOMAINS 0.249 From and EnvelopeFrom 2nd level mail domains are different KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment RCVD_IN_DNSWL_NONE -0.0001 Sender listed at https://www.dnswl.org/, no trust RCVD_IN_MSPIKE_H2 -0.001 Average reputation (+2) SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Subject: [pve-devel] [PATCH http-server 1/1] fix #5699: pveproxy: add library methods for real IP support X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox VE development discussion Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pve-devel-bounces@lists.proxmox.com Sender: "pve-devel" --- src/PVE/APIServer/AnyEvent.pm | 43 ++++++++++++++++++++++++++++++++--- src/PVE/APIServer/Utils.pm | 15 ++++++++++++ 2 files changed, 55 insertions(+), 3 deletions(-) diff --git a/src/PVE/APIServer/AnyEvent.pm b/src/PVE/APIServer/AnyEvent.pm index a8d60c1..c2afb4d 100644 --- a/src/PVE/APIServer/AnyEvent.pm +++ b/src/PVE/APIServer/AnyEvent.pm @@ -85,20 +85,21 @@ sub log_request { my $loginfo = $reqstate->{log}; - # like apache2 common log format - # LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" + # like apache2 common log format + client IP address + # LogFormat "%a %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" return if $loginfo->{written}; # avoid duplicate logs $loginfo->{written} = 1; my $peerip = $reqstate->{peer_host} || '-'; + my $realip = $loginfo->{real_ip} || $peerip; my $userid = $loginfo->{userid} || '-'; my $content_length = defined($loginfo->{content_length}) ? $loginfo->{content_length} : '-'; my $code = $loginfo->{code} || 500; my $requestline = $loginfo->{requestline} || '-'; my $timestr = strftime("%d/%m/%Y:%H:%M:%S %z", localtime()); - my $msg = "$peerip - $userid [$timestr] \"$requestline\" $code $content_length\n"; + my $msg = "$realip $peerip - $userid [$timestr] \"$requestline\" $code $content_length\n"; $self->write_log($msg); } @@ -1462,6 +1463,14 @@ sub authenticate_and_handle_request { my $auth = {}; + if ($self->{proxy_real_ip_header} && $request->header($self->{proxy_real_ip_header})) { + my $real_ip = Net::IP->new($request->header($self->{proxy_real_ip_header})) || undef; + $reqstate->{log}->{real_ip} = Net::IP::ip_compress_address( + $real_ip->ip(), + $real_ip->version(), + ) if defined($real_ip) && $self->check_trusted_proxy($reqstate->{peer_host}); + } + if ($self->{spiceproxy}) { my $connect_str = $request->header('Host'); my ($vmid, $node, $port) = $self->verify_spice_connect_url($connect_str); @@ -1801,6 +1810,34 @@ sub check_host_access { return $match_allow; } +sub check_trusted_proxy { + my ($self, $clientip) = @_; + + $clientip = PVE::APIServer::Utils::normalize_v4_in_v6($clientip); + my $cip = Net::IP->new($clientip); + + if (!$cip) { + $self->dprint("client IP not parsable: $@"); + return 0; + } + + my $match_trusted_proxy = 0; + + if ($self->{trusted_proxy_ips}) { + foreach my $t (@{$self->{trusted_proxy_ips}}) { + if ($t->overlaps($cip)) { + $match_trusted_proxy = 1; + $self->dprint("client IP in trusted proxies: ". $t->print()); + last; + } + } + } else { + $match_trusted_proxy = 1; + } + + return $match_trusted_proxy; +} + sub accept_connections { my ($self) = @_; diff --git a/src/PVE/APIServer/Utils.pm b/src/PVE/APIServer/Utils.pm index 5728d97..f7cff29 100644 --- a/src/PVE/APIServer/Utils.pm +++ b/src/PVE/APIServer/Utils.pm @@ -26,6 +26,8 @@ sub read_proxy_config { $shcmd .= 'echo \"COMPRESSION:\$COMPRESSION\";'; $shcmd .= 'echo \"DISABLE_TLS_1_2:\$DISABLE_TLS_1_2\";'; $shcmd .= 'echo \"DISABLE_TLS_1_3:\$DISABLE_TLS_1_3\";'; + $shcmd .= 'echo \"PROXY_REAL_IP_HEADER:\$PROXY_REAL_IP_HEADER\";'; + $shcmd .= 'echo \"TRUSTED_PROXY_IPS:\$TRUSTED_PROXY_IPS\";'; my $data = -f $conffile ? `bash -c "$shcmd"` : ''; @@ -65,6 +67,19 @@ sub read_proxy_config { $res->{$key} = $value; } elsif ($key eq 'TLS_KEY_FILE') { $res->{$key} = $value; + } elsif ($key eq 'PROXY_REAL_IP_HEADER') { + $res->{$key} = $value; + } elsif ($key eq 'TRUSTED_PROXY_IPS') { + my $ips = []; + foreach my $ip (split(/,/, $value)) { + if ($ip eq 'all') { + push @$ips, Net::IP->new('0/0') || die Net::IP::Error() . "\n"; + push @$ips, Net::IP->new('::/0') || die Net::IP::Error() . "\n"; + next; + } + push @$ips, Net::IP->new(normalize_v4_in_v6($ip)) || die Net::IP::Error() . "\n"; + } + $res->{$key} = $ips; } elsif (grep { $key eq $_ } @$boolean_options) { die "unknown value '$value' - use 0 or 1\n" if $value !~ m/^(0|1)$/; $res->{$key} = $value; -- 2.39.2 _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel