tcp+sni route with allow=ip:something does not seem to work

[KEZHwMlXV1vFzs6QvY8v5WjX5]

I added routes like this:

• route add from.intern.net from.intern.net/ http://10.0.1.3:30073/ opts "allow=ip:10.0.0.0/8"

Then from a host that is not in 10.0.0.0/8 I try a curl like this:

curl -v -k --resolve from.intern.net:443:$OUTEXTERNALIP https://from.intern.net

And fabio is happy to serve the request instead of denying it. Is this not compatible using tcp+sni? I thought that

https://github.com/fabiolb/fabio/blob/master/proxy/tcp/sni_proxy.go#L102

handled that?

[aaronhurt]

I’ll take a look today. Thank you for the report.

[aaronhurt]

@KEZHwMlXV1vFzs6QvY8v5WjX5 I can't reproduce the issue locally. I've created a branch with increased DEBUG level logging. Could you build that branch and report the results?

[aaronhurt]

The branch is here: https://github.com/fabiolb/fabio/tree/issue-576-ip-access

You should be able to checkout and make to build the binary. If you're on a mac and deploying to linux you will need to run make linux instead.

[KEZHwMlXV1vFzs6QvY8v5WjX5]

yep it does not even arrive at that part of the code. From what I can see it already stops here

fabio/route/access_rules.go

Line 77 in faf228d

return false

and in my case IP is nil and the allow opts is correctly set in the map

ip is already nil within AccessDeniedTCP while c.RemoteAddr().String() in that function is the public client IP:SourcePort

is it okay to feed https://golang.org/pkg/net/#ParseIP with an IP:PORT combo instead of only an IP?

-> no it's not ok. We might want something like this (found at https://stackoverflow.com/a/41602018)

if addr, ok := conn.RemoteAddr().(*net.TCPAddr); ok {
    fmt.Println(addr.IP.String())
}

[KEZHwMlXV1vFzs6QvY8v5WjX5]

ok when I change the function to this it works for me.

diff --git a/route/access_rules.go b/route/access_rules.go
index 3901042..b3ce639 100644
--- a/route/access_rules.go
+++ b/route/access_rules.go
@@ -64,7 +64,8 @@ func (t *Target) AccessDeniedHTTP(r *http.Request) bool {
 
 // AccessDeniedTCP checks rules on the target for TCP proxy routes.
 func (t *Target) AccessDeniedTCP(c net.Conn) bool {
-       ip := net.ParseIP(c.RemoteAddr().String())
+        addr := c.RemoteAddr().(*net.TCPAddr)
+        ip := net.ParseIP(addr.IP.String())
        if t.denyByIP(ip) {
                return true
        }

[aaronhurt]

@KEZHwMlXV1vFzs6QvY8v5WjX5 Nice catch. Doing the assertion to a net.TCPAddr pointer and checking the assertion is the correct.

[aaronhurt]

I pushed to the same branch and created #577
Let me know if that corrects the issue for you.

[KEZHwMlXV1vFzs6QvY8v5WjX5]

positive. It passed my checks.

[aaronhurt]

@KEZHwMlXV1vFzs6QvY8v5WjX5 awesome, I'll merge it. Thanks again.