feat(ip-restriction): Add TCP support (#6679) #10229
Conversation
|
|
|
Michael Russo seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account. You have signed the CLA already but the status is still pending? Let us recheck it. |
merusso
force-pushed
the
feat/ip-restriction-support-tcp
branch
from
6ed6bfa to
43b93a7
Compare
| end | ||
|
|
||
| local status = conf.status or 403 | ||
| local message = conf.message or "Your IP address is not allowed" | ||
| local message = conf.message or string.format("IP address not allowed: %s", ngx.var.remote_addr) |
There was a problem hiding this comment.
I forgot to note that we updated the rejection message format also. This is causing tests to fail.
Will this string format change be accepted? It is technically unrelated to enabling TCP, but it helps us troubleshoot issues with rejected requests.
|
Can you please rebase this on top of 'master' and target it for 'master'? |
We have a separate PR for master. The code has changed a bit between the 2 versions. |
|
In that case, please get the other PR merged first and then we will move forward with this. |
| local binary_remote_addr = ngx.var.binary_remote_addr | ||
| if not binary_remote_addr then | ||
| return kong.response.error(403, "Cannot identify the client IP address, unix domain sockets are not supported.") | ||
| local status = 403 |
There was a problem hiding this comment.
Why does this line overwrite the conf.status value?
There was a problem hiding this comment.
Good question. This preserves the existing behavior which also uses a hardcoded status 403 instead of conf.status.
I'm happy to target a |
|
Let's first get the PR targeting the master branch merged. We can then cherry-pick it back. |
|
Sounds good. We'll continue working on PR #10245. |
Resolves Kong#6679 This change adds TCP support to the ip-restriction plugin by implementing the Stream module's preread function. When a TCP connection is rejected due to IP restriction rules, a JSON error response is written to the stream and the connection is closed.
hanshuebner
force-pushed
the
feat/ip-restriction-support-tcp
branch
from
43b93a7 to
25266ae
Compare
|
Closing as we intend to backport #10245 instead. |
Summary
This change adds TCP support to the ip-restriction plugin by implementing the Stream module's preread function.
When a TCP connection is rejected due to IP restriction rules, a JSON error response is written to the stream and the connection is closed.
Note: This change is based on branch
release/2.8.xso it targets this branch. However, since it is a new feature, it would probably be added in a 2.9.x release instead. There isn't currently arelease/2.9.xorrelease/2.xbranch.Checklist
Full changelog
Issue reference
Fix #6679