Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix forwarded host parsing #3950

Merged
merged 1 commit into from
Mar 31, 2019
Merged

Fix forwarded host parsing #3950

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 11 additions & 4 deletions rootfs/etc/nginx/lua/lua_ingress.lua
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,16 @@ local function redirect_host()
return host_port[1];
end

local function parse_x_forwarded_host()
local hosts, err = ngx_re_split(ngx.var.http_x_forwarded_host, ",")
if err then
ngx.log(ngx.ERR, string_format("could not parse variable: %s", err))
return ""
end

return hosts[1]
end

function _M.init_worker()
randomseed()
end
Expand Down Expand Up @@ -96,10 +106,7 @@ function _M.rewrite(location_config)

-- Obtain best http host
if ngx.var.http_x_forwarded_host then
-- TODO(elvinefendi) https://github.com/kubernetes/ingress-nginx/issues/3790 can
-- be fixed here by splitting the value of ngx.var.http_x_forwarded_host by ','
-- and taking the first portion
ngx.var.best_http_host = ngx.var.http_x_forwarded_host
ngx.var.best_http_host = parse_x_forwarded_host()
end
end

Expand Down
17 changes: 17 additions & 0 deletions test/e2e/settings/forwarded_headers.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,6 +54,7 @@ var _ = framework.IngressNginxDescribe("X-Forwarded headers", func() {
return strings.Contains(server, "server_name forwarded-headers")
})

By("ensuring single values are parsed correctly")
resp, body, errs := gorequest.New().
Get(f.GetURL(framework.HTTP)).
Set("Host", host).
Expand All @@ -70,6 +71,22 @@ var _ = framework.IngressNginxDescribe("X-Forwarded headers", func() {
Expect(body).Should(ContainSubstring(fmt.Sprintf("x-forwarded-proto=myproto")))
Expect(body).Should(ContainSubstring(fmt.Sprintf("x-forwarded-port=1234")))
Expect(body).Should(ContainSubstring(fmt.Sprintf("x-forwarded-for=1.2.3.4")))

By("ensuring that first entry in X-Forwarded-Host is used as the best host")
resp, body, errs = gorequest.New().
Get(f.GetURL(framework.HTTP)).
Set("Host", host).
Set("X-Forwarded-Port", "1234").
Set("X-Forwarded-Proto", "myproto").
Set("X-Forwarded-For", "1.2.3.4").
Set("X-Forwarded-Host", "myhost.com, another.host,example.net").
End()

Expect(errs).Should(BeEmpty())
Expect(resp.StatusCode).Should(Equal(http.StatusOK))
Expect(body).Should(ContainSubstring(fmt.Sprintf("host=myhost.com")))
Expect(body).Should(ContainSubstring(fmt.Sprintf("x-forwarded-host=myhost.com")))

})
It("should not trust X-Forwarded headers when setting is false", func() {
host := "forwarded-headers"
Expand Down