Skip to content

Commit 4c0d31b

Browse files
baudneobaudneo
committed
Merge branch 'add_PROXY' into add_modsecurity_crowdsecurity
2 parents 4b3df04 + 2d681b8 commit 4c0d31b

22 files changed

+297
-21
lines changed

‎backend/internal/nginx.js

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -157,7 +157,11 @@ const internalNginx = {
157157
for (let i = 0; i < host.locations.length; i++) {
158158
let locationCopy = Object.assign({}, {access_list_id: host.access_list_id}, {certificate_id: host.certificate_id},
159159
{ssl_forced: host.ssl_forced}, {caching_enabled: host.caching_enabled}, {block_exploits: host.block_exploits},
160-
{allow_websocket_upgrade: host.allow_websocket_upgrade}, {http2_support: host.http2_support},
160+
{allow_websocket_upgrade: host.allow_websocket_upgrade}, {enable_proxy_protocol: host.enable_proxy_protocol},
161+
{stream_enable_proxy_protocol: host.stream_enable_proxy_protocol},
162+
{stream_allow_proxy_protocol: host.stream_allow_proxy_protocol},
163+
{stream_load_balancer_ip: host.stream_load_balancer_ip},
164+
{load_balancer_ip: host.load_balancer_ip}, {http2_support: host.http2_support},
161165
{hsts_enabled: host.hsts_enabled}, {hsts_subdomains: host.hsts_subdomains}, {access_list: host.access_list},
162166
{certificate: host.certificate}, host.locations[i]);
163167

‎backend/migrations/20221011000001_stream_proxy_protocol.js

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
const migrate_name = 'stream_proxy_protocol';
2+
const logger = require('../logger').migrate;
3+
4+
/**
5+
* Migrate
6+
*
7+
* @see http://knexjs.org/#Schema
8+
*
9+
* @param {Object} knex
10+
* @param {Promise} Promise
11+
* @returns {Promise}
12+
*/
13+
exports.up = function (knex/*, Promise*/) {
14+
knex.schema.table('stream', function (stream) {
15+
stream.dropColumn('stream_access_proxy_protocol');
16+
})
17+
.then(() => {
18+
logger.info('[' + migrate_name + '] stream Table altered - ERRANT Column fixed!');
19+
}).catch((err) => {
20+
logger.error('[' + migrate_name + '] stream Table error while removing errant column: ' + err);
21+
});
22+
23+
logger.info('[' + migrate_name + '] Migrating PROXY_HOST Table Up...');
24+
knex.schema.table('proxy_host', function (proxy_host) {
25+
proxy_host.integer('enable_proxy_protocol').notNull().unsigned().defaultTo(0);
26+
})
27+
.then(() => {
28+
logger.info('[' + migrate_name + '] proxy_host Table altered - "enable_proxy_protocol" added');
29+
}).catch((err) => {
30+
logger.error('[' + migrate_name + '] proxy_host Table error migrating up: ' + err);
31+
});
32+
knex.schema.table('proxy_host', function (proxy_host) {
33+
proxy_host.string('load_balancer_ip').notNull().defaultTo('');
34+
})
35+
.then(() => {
36+
logger.info('[' + migrate_name + '] proxy_host Table altered - "load_balancer_ip" added');
37+
}).catch((err) => {
38+
logger.error('[' + migrate_name + '] proxy_host Table error migrating up: ' + err);
39+
});
40+
41+
logger.info('[' + migrate_name + '] Migrating STREAM Table Up...');
42+
knex.schema.table('stream', function (stream) {
43+
stream.integer('stream_allow_proxy_protocol').notNull().unsigned().defaultTo(0);
44+
})
45+
.then(() => {
46+
logger.info('[' + migrate_name + '] stream Table altered - "stream_allow_proxy_protocol" added');
47+
}).catch((err) => {
48+
logger.error('[' + migrate_name + '] stream Table error migrating up: ' + err);
49+
});
50+
knex.schema.table('stream', function (stream) {
51+
stream.integer('stream_enable_proxy_protocol').notNull().unsigned().defaultTo(0);
52+
})
53+
.then(() => {
54+
logger.info('[' + migrate_name + '] stream Table altered - "stream_enable_proxy_protocol" added');
55+
}).catch((err) => {
56+
logger.error('[' + migrate_name + '] stream Table error migrating up: ' + err);
57+
});
58+
59+
knex.schema.table('stream', function (stream) {
60+
stream.string('stream_load_balancer_ip').notNull().defaultTo('');
61+
})
62+
.then(() => {
63+
logger.info('[' + migrate_name + '] stream Table altered - "stream_load_balancer_ip" added');
64+
}).catch((err) => {
65+
logger.error('[' + migrate_name + '] stream Table error migrating up: ' + err);
66+
});
67+
return Promise.resolve(true);
68+
};
69+
70+
/**
71+
* Undo Migrate
72+
*
73+
* @param {Object} knex
74+
* @param {Promise} Promise
75+
* @returns {Promise}
76+
*/
77+
exports.down = function (knex, Promise) {
78+
logger.warn('[' + migrate_name + '] You can\'t migrate down this one.');
79+
return Promise.resolve(true);
80+
};

‎backend/schema/endpoints/proxy-hosts.json

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,17 @@
5858
"example": true,
5959
"type": "boolean"
6060
},
61+
"enable_proxy_protocol": {
62+
"description": "Enable PROXY Protocol support (Pass through)",
63+
"example": true,
64+
"type": "boolean"
65+
},
66+
"load_balancer_ip": {
67+
"description": "Authorized TCP Load Balancer IP / CIDR for setting 'set_real_ip_from'",
68+
"type": "string",
69+
"minLength": 0,
70+
"maxLength": 255
71+
},
6172
"access_list_id": {
6273
"$ref": "../definitions.json#/definitions/access_list_id"
6374
},
@@ -155,6 +166,12 @@
155166
"allow_websocket_upgrade": {
156167
"$ref": "#/definitions/allow_websocket_upgrade"
157168
},
169+
"enable_proxy_protocol": {
170+
"$ref": "#/definitions/enable_proxy_protocol"
171+
},
172+
"load_balancer_ip": {
173+
"$ref": "#/definitions/load_balancer_ip"
174+
},
158175
"access_list_id": {
159176
"$ref": "#/definitions/access_list_id"
160177
},
@@ -245,6 +262,12 @@
245262
"allow_websocket_upgrade": {
246263
"$ref": "#/definitions/allow_websocket_upgrade"
247264
},
265+
"enable_proxy_protocol": {
266+
"$ref": "#/definitions/enable_proxy_protocol"
267+
},
268+
"load_balancer_ip": {
269+
"$ref": "#/definitions/load_balancer_ip"
270+
},
248271
"access_list_id": {
249272
"$ref": "#/definitions/access_list_id"
250273
},
@@ -318,6 +341,12 @@
318341
"allow_websocket_upgrade": {
319342
"$ref": "#/definitions/allow_websocket_upgrade"
320343
},
344+
"enable_proxy_protocol": {
345+
"$ref": "#/definitions/enable_proxy_protocol"
346+
},
347+
"load_balancer_ip": {
348+
"$ref": "#/definitions/load_balancer_ip"
349+
},
321350
"access_list_id": {
322351
"$ref": "#/definitions/access_list_id"
323352
},

‎backend/schema/endpoints/streams.json

Lines changed: 46 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,21 @@
4646
"udp_forwarding": {
4747
"type": "boolean"
4848
},
49+
"stream_enable_proxy_protocol": {
50+
"description": "Enable PROXY Protocol creation and override",
51+
"example": true,
52+
"type": "boolean"
53+
},
54+
"stream_allow_proxy_protocol": {
55+
"description": "Enable PROXY Protocol pass through",
56+
"example": true,
57+
"type": "boolean"
58+
},
59+
"stream_load_balancer_ip": {
60+
"type": "string",
61+
"minLength": 0,
62+
"maxLength": 255
63+
},
4964
"enabled": {
5065
"$ref": "../definitions.json#/definitions/enabled"
5166
},
@@ -78,6 +93,15 @@
7893
"udp_forwarding": {
7994
"$ref": "#/definitions/udp_forwarding"
8095
},
96+
"stream_allow_proxy_protocol": {
97+
"$ref": "#/definitions/stream_allow_proxy_protocol"
98+
},
99+
"stream_enable_proxy_protocol": {
100+
"$ref": "#/definitions/stream_enable_proxy_protocol"
101+
},
102+
"stream_load_balancer_ip": {
103+
"$ref": "#/definitions/stream_load_balancer_ip"
104+
},
81105
"enabled": {
82106
"$ref": "#/definitions/enabled"
83107
},
@@ -88,7 +112,7 @@
88112
"links": [
89113
{
90114
"title": "List",
91-
"description": "Returns a list of Steams",
115+
"description": "Returns a list of Streams",
92116
"href": "/nginx/streams",
93117
"access": "private",
94118
"method": "GET",
@@ -137,6 +161,15 @@
137161
"udp_forwarding": {
138162
"$ref": "#/definitions/udp_forwarding"
139163
},
164+
"stream_allow_proxy_protocol": {
165+
"$ref": "#/definitions/stream_allow_proxy_protocol"
166+
},
167+
"stream_enable_proxy_protocol": {
168+
"$ref": "#/definitions/stream_enable_proxy_protocol"
169+
},
170+
"stream_load_balancer_ip": {
171+
"$ref": "#/definitions/stream_load_balancer_ip"
172+
},
140173
"meta": {
141174
"$ref": "#/definitions/meta"
142175
}
@@ -177,6 +210,15 @@
177210
"udp_forwarding": {
178211
"$ref": "#/definitions/udp_forwarding"
179212
},
213+
"stream_allow_proxy_protocol": {
214+
"$ref": "#/definitions/stream_allow_proxy_protocol"
215+
},
216+
"stream_enable_proxy_protocol": {
217+
"$ref": "#/definitions/stream_enable_proxy_protocol"
218+
},
219+
"stream_load_balancer_ip": {
220+
"$ref": "#/definitions/stream_load_balancer_ip"
221+
},
180222
"meta": {
181223
"$ref": "#/definitions/meta"
182224
}
@@ -190,7 +232,7 @@
190232
},
191233
{
192234
"title": "Delete",
193-
"description": "Deletes a existing Stream",
235+
"description": "Deletes an existing Stream",
194236
"href": "/nginx/streams/{definitions.identity.example}",
195237
"access": "private",
196238
"method": "DELETE",
@@ -204,7 +246,7 @@
204246
},
205247
{
206248
"title": "Enable",
207-
"description": "Enables a existing Stream",
249+
"description": "Enables an existing Stream",
208250
"href": "/nginx/streams/{definitions.identity.example}/enable",
209251
"access": "private",
210252
"method": "POST",
@@ -218,7 +260,7 @@
218260
},
219261
{
220262
"title": "Disable",
221-
"description": "Disables a existing Stream",
263+
"description": "Disables an existing Stream",
222264
"href": "/nginx/streams/{definitions.identity.example}/disable",
223265
"access": "private",
224266
"method": "POST",

‎backend/templates/_listen.conf

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,25 @@
1+
{% if enable_proxy_protocol == 1 or enable_proxy_protocol == true%}
2+
listen 88 proxy_protocol;
3+
{% if ipv6 -%}
4+
listen [::]:88 proxy_protocol;
5+
{% endif %}
6+
{% else -%}
17
listen 80;
28
{% if ipv6 -%}
39
listen [::]:80;
4-
{% else -%}
5-
#listen [::]:80;
10+
{% endif %}
611
{% endif %}
712
{% if certificate -%}
13+
{% if enable_proxy_protocol == 1 or enable_proxy_protocol == true%}
14+
listen 444 ssl{% if http2_support %} http2{% endif %} proxy_protocol;
15+
{% if ipv6 -%}
16+
listen [::]:444 ssl{% if http2_support %} http2{% endif %} proxy_protocol;
17+
{% endif %}
18+
{% else -%}
819
listen 443 ssl{% if http2_support %} http2{% endif %};
920
{% if ipv6 -%}
1021
listen [::]:443 ssl{% if http2_support %} http2{% endif %};
11-
{% else -%}
12-
#listen [::]:443;
22+
{% endif %}
1323
{% endif %}
1424
{% endif %}
1525
server_name {{ domain_names | join: " " }};

‎backend/templates/_proxy_protocol.conf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{% if enable_proxy_protocol == 1 or enable_proxy_protocol == true %}
2+
{% if load_balancer_ip != '' %}
3+
set_real_ip_from {{ load_balancer_ip }};
4+
real_ip_header proxy_protocol;
5+
{% endif %}
6+
{% endif %}

‎backend/templates/_stream_proxy_protocol.conf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
{%if stream_allow_proxy_protocol == 1 or stream_allow_proxy_protocol == true %}
2+
{% if stream_load_balancer_ip != '' %}
3+
set_real_ip_from {{ stream_load_balancer_ip }};
4+
{% endif %}
5+
{% endif %}

‎backend/templates/dead_host.conf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ server {
66
{% include "_certificates.conf" %}
77
{% include "_hsts.conf" %}
88
{% include "_forced_ssl.conf" %}
9+
{% include "_proxy_protocol.conf" %}
910

1011
access_log /data/logs/dead-host-{{ id }}_access.log standard;
1112
error_log /data/logs/dead-host-{{ id }}_error.log warn;

‎backend/templates/default.conf

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,19 +2,25 @@
22
# Default Site
33
# ------------------------------------------------------------
44
{% if value == "congratulations" %}
5-
# Skipping output, congratulations page configration is baked in.
5+
# Skipping output, congratulations page configuration is baked in.
66
{%- else %}
77
server {
8+
{% if enable_proxy_protocol == 1 or enable_proxy_protocol == true%}
9+
listen 88 proxy_protocol;
10+
{% if ipv6 -%}
11+
listen [::]:88 proxy_protocol;
12+
{% endif %}
13+
{% else -%}
814
listen 80 default;
915
{% if ipv6 -%}
1016
listen [::]:80 default;
11-
{% else -%}
12-
#listen [::]:80 default;
17+
{% endif %}
1318
{% endif %}
1419
server_name default-host.localhost;
1520
access_log /data/logs/default-host_access.log combined;
1621
error_log /data/logs/default-host_error.log warn;
1722
{% include "_exploits.conf" %}
23+
{% include "_proxy_protocol.conf"}
1824

1925
include conf.d/include/letsencrypt-acme-challenge.conf;
2026

‎backend/templates/proxy_host.conf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ server {
1212
{% include "_exploits.conf" %}
1313
{% include "_hsts.conf" %}
1414
{% include "_forced_ssl.conf" %}
15+
{% include "_proxy_protocol.conf" %}
1516

1617
{% if allow_websocket_upgrade == 1 or allow_websocket_upgrade == true %}
1718
proxy_set_header Upgrade $http_upgrade;

0 commit comments

Comments
 (0)