Skip to content

Commit 48590d4

Browse files
sjbermansjberman
committed
Support IP and Hostname trusted addresses
Problem: Our initial implementation of rewriting client IP only supported CIDRs for the trusted addresses field. Solution: Add support for IP addresses and hostnames
1 parent d6a478d commit 48590d4

File tree

9 files changed

+242
-97
lines changed

9 files changed

+242
-97
lines changed

‎apis/v1alpha1/nginxproxy_types.go

Lines changed: 28 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -27,20 +27,6 @@ type NginxProxyList struct {
2727
Items []NginxProxy `json:"items"`
2828
}
2929

30-
// IPFamilyType specifies the IP family to be used by NGINX.
31-
//
32-
// +kubebuilder:validation:Enum=dual;ipv4;ipv6
33-
type IPFamilyType string
34-
35-
const (
36-
// Dual specifies that NGINX will use both IPv4 and IPv6.
37-
Dual IPFamilyType = "dual"
38-
// IPv4 specifies that NGINX will use only IPv4.
39-
IPv4 IPFamilyType = "ipv4"
40-
// IPv6 specifies that NGINX will use only IPv6.
41-
IPv6 IPFamilyType = "ipv6"
42-
)
43-
4430
// NginxProxySpec defines the desired state of the NginxProxy.
4531
type NginxProxySpec struct {
4632
// IPFamily specifies the IP family to be used by the NGINX.
@@ -154,11 +140,11 @@ type RewriteClientIP struct {
154140
// If no addresses are provided, NGINX will not rewrite the client IP information.
155141
// Sets NGINX directive set_real_ip_from: https://nginx.org/en/docs/http/ngx_http_realip_module.html#set_real_ip_from
156142
// This field is required if mode is set.
157-
// +kubebuilder:validation:MaxItems=16
158-
// +listType=map
159-
// +listMapKey=type
160143
//
161144
// +optional
145+
// +listType=map
146+
// +listMapKey=type
147+
// +kubebuilder:validation:MaxItems=16
162148
TrustedAddresses []Address `json:"trustedAddresses,omitempty"`
163149
}
164150

@@ -179,27 +165,40 @@ const (
179165
RewriteClientIPModeXForwardedFor RewriteClientIPModeType = "XForwardedFor"
180166
)
181167

168+
// IPFamilyType specifies the IP family to be used by NGINX.
169+
//
170+
// +kubebuilder:validation:Enum=dual;ipv4;ipv6
171+
type IPFamilyType string
172+
173+
const (
174+
// Dual specifies that NGINX will use both IPv4 and IPv6.
175+
Dual IPFamilyType = "dual"
176+
// IPv4 specifies that NGINX will use only IPv4.
177+
IPv4 IPFamilyType = "ipv4"
178+
// IPv6 specifies that NGINX will use only IPv6.
179+
IPv6 IPFamilyType = "ipv6"
180+
)
181+
182182
// Address is a struct that specifies address type and value.
183183
type Address struct {
184184
// Type specifies the type of address.
185-
// Default is "cidr" which specifies that the address is a CIDR block.
186-
//
187-
// +optional
188-
// +kubebuilder:default:=cidr
189-
Type AddressType `json:"type,omitempty"`
185+
Type AddressType `json:"type"`
190186

191187
// Value specifies the address value.
192-
//
193-
// +optional
194-
Value string `json:"value,omitempty"`
188+
Value string `json:"value"`
195189
}
196190

197191
// AddressType specifies the type of address.
198-
// +kubebuilder:validation:Enum=cidr
192+
// +kubebuilder:validation:Enum=CIDR;IPAddress;Hostname
199193
type AddressType string
200194

201195
const (
202-
// AddressTypeCIDR specifies that the address is a CIDR block.
203-
// kubebuilder:validation:Pattern=`^[\.a-zA-Z0-9:]*(\/([0-9]?[0-9]?[0-9]))$`
204-
AddressTypeCIDR AddressType = "cidr"
196+
// CIDRAddressType specifies that the address is a CIDR block.
197+
CIDRAddressType AddressType = "CIDR"
198+
199+
// IPAddressType specifies that the address is an IP address.
200+
IPAddressType AddressType = "IPAddress"
201+
202+
// HostnameAddressType specifies that the address is a Hostname.
203+
HostnameAddressType AddressType = "Hostname"
205204
)

‎charts/nginx-gateway-fabric/values.schema.json

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,47 @@
7373
"required": [],
7474
"type": "string"
7575
},
76+
"rewriteClientIP": {
77+
"description": "RewriteClientIP defines configuration for rewriting the client IP to the original client's IP.",
78+
"properties": {
79+
"mode": {
80+
"enum": [
81+
"ProxyProtocol",
82+
"XForwardedFor"
83+
],
84+
"required": [],
85+
"type": "string"
86+
},
87+
"setIPRecursively": {
88+
"required": [],
89+
"type": "boolean"
90+
},
91+
"trustedAddresses": {
92+
"items": {
93+
"properties": {
94+
"type": {
95+
"enum": [
96+
"CIDR",
97+
"IPAddress",
98+
"Hostname"
99+
],
100+
"required": [],
101+
"type": "string"
102+
},
103+
"value": {
104+
"required": [],
105+
"type": "string"
106+
}
107+
},
108+
"required": []
109+
},
110+
"required": [],
111+
"type": "array"
112+
}
113+
},
114+
"required": [],
115+
"type": "object"
116+
},
76117
"telemetry": {
77118
"description": "Telemetry specifies the OpenTelemetry configuration.",
78119
"properties": {

‎charts/nginx-gateway-fabric/values.yaml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,29 @@ nginx:
142142
# - ipv4
143143
# - ipv6
144144
# - dual
145+
# rewriteClientIP:
146+
# type: object
147+
# description: RewriteClientIP defines configuration for rewriting the client IP to the original client's IP.
148+
# properties:
149+
# mode:
150+
# type: string
151+
# enum:
152+
# - ProxyProtocol
153+
# - XForwardedFor
154+
# setIPRecursively:
155+
# type: boolean
156+
# trustedAddresses:
157+
# type: array
158+
# items:
159+
# properties:
160+
# type:
161+
# type: string
162+
# enum:
163+
# - CIDR
164+
# - IPAddress
165+
# - Hostname
166+
# value:
167+
# type: string
145168
# telemetry:
146169
# type: object
147170
# description: Telemetry specifies the OpenTelemetry configuration.

‎config/crd/bases/gateway.nginx.org_nginxproxies.yaml

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -105,16 +105,18 @@ spec:
105105
and value.
106106
properties:
107107
type:
108-
default: cidr
109-
description: |-
110-
Type specifies the type of address.
111-
Default is "cidr" which specifies that the address is a CIDR block.
108+
description: Type specifies the type of address.
112109
enum:
113-
- cidr
110+
- CIDR
111+
- IPAddress
112+
- Hostname
114113
type: string
115114
value:
116115
description: Value specifies the address value.
117116
type: string
117+
required:
118+
- type
119+
- value
118120
type: object
119121
maxItems: 16
120122
type: array

‎deploy/crds.yaml

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -690,16 +690,18 @@ spec:
690690
and value.
691691
properties:
692692
type:
693-
default: cidr
694-
description: |-
695-
Type specifies the type of address.
696-
Default is "cidr" which specifies that the address is a CIDR block.
693+
description: Type specifies the type of address.
697694
enum:
698-
- cidr
695+
- CIDR
696+
- IPAddress
697+
- Hostname
699698
type: string
700699
value:
701700
description: Value specifies the address value.
702701
type: string
702+
required:
703+
- type
704+
- value
703705
type: object
704706
maxItems: 16
705707
type: array

‎internal/mode/static/state/dataplane/configuration_test.go

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2201,7 +2201,7 @@ func TestBuildConfiguration(t *testing.T) {
22012201
SetIPRecursively: helpers.GetPointer(true),
22022202
TrustedAddresses: []ngfAPI.Address{
22032203
{
2204-
Type: ngfAPI.AddressTypeCIDR,
2204+
Type: ngfAPI.CIDRAddressType,
22052205
Value: "1.1.1.1/32",
22062206
},
22072207
},
@@ -3651,7 +3651,7 @@ func TestBuildRewriteIPSettings(t *testing.T) {
36513651
Mode: helpers.GetPointer(ngfAPI.RewriteClientIPModeProxyProtocol),
36523652
TrustedAddresses: []ngfAPI.Address{
36533653
{
3654-
Type: ngfAPI.AddressTypeCIDR,
3654+
Type: ngfAPI.CIDRAddressType,
36553655
Value: "10.9.9.4/32",
36563656
},
36573657
},
@@ -3678,7 +3678,7 @@ func TestBuildRewriteIPSettings(t *testing.T) {
36783678
Mode: helpers.GetPointer(ngfAPI.RewriteClientIPModeXForwardedFor),
36793679
TrustedAddresses: []ngfAPI.Address{
36803680
{
3681-
Type: ngfAPI.AddressTypeCIDR,
3681+
Type: ngfAPI.CIDRAddressType,
36823682
Value: "76.89.90.11/24",
36833683
},
36843684
},
@@ -3705,19 +3705,19 @@ func TestBuildRewriteIPSettings(t *testing.T) {
37053705
Mode: helpers.GetPointer(ngfAPI.RewriteClientIPModeXForwardedFor),
37063706
TrustedAddresses: []ngfAPI.Address{
37073707
{
3708-
Type: ngfAPI.AddressTypeCIDR,
3708+
Type: ngfAPI.CIDRAddressType,
37093709
Value: "5.5.5.5/12",
37103710
},
37113711
{
3712-
Type: ngfAPI.AddressTypeCIDR,
3712+
Type: ngfAPI.CIDRAddressType,
37133713
Value: "1.1.1.1/26",
37143714
},
37153715
{
3716-
Type: ngfAPI.AddressTypeCIDR,
3716+
Type: ngfAPI.CIDRAddressType,
37173717
Value: "2.2.2.2/32",
37183718
},
37193719
{
3720-
Type: ngfAPI.AddressTypeCIDR,
3720+
Type: ngfAPI.CIDRAddressType,
37213721
Value: "3.3.3.3/24",
37223722
},
37233723
},

‎internal/mode/static/state/graph/nginxproxy.go

Lines changed: 20 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -172,23 +172,33 @@ func validateRewriteClientIP(npCfg *ngfAPI.NginxProxy) field.ErrorList {
172172
}
173173

174174
for _, addr := range rewriteClientIP.TrustedAddresses {
175+
valuePath := trustedAddressesPath.Child("value")
176+
175177
switch addr.Type {
176-
case ngfAPI.AddressTypeCIDR:
177-
if err := k8svalidation.IsValidCIDR(trustedAddressesPath, addr.Value); err != nil {
178-
allErrs = append(
179-
allErrs,
180-
field.Invalid(trustedAddressesPath.Child(addr.Value),
181-
addr,
182-
err.ToAggregate().Error(),
183-
),
184-
)
178+
case ngfAPI.CIDRAddressType:
179+
if err := k8svalidation.IsValidCIDR(valuePath, addr.Value); err != nil {
180+
allErrs = append(allErrs, err...)
181+
}
182+
case ngfAPI.IPAddressType:
183+
if err := k8svalidation.IsValidIP(valuePath, addr.Value); err != nil {
184+
allErrs = append(allErrs, err...)
185+
}
186+
case ngfAPI.HostnameAddressType:
187+
if errs := k8svalidation.IsDNS1123Subdomain(addr.Value); len(errs) > 0 {
188+
for _, e := range errs {
189+
allErrs = append(allErrs, field.Invalid(valuePath, addr.Value, e))
190+
}
185191
}
186192
default:
187193
allErrs = append(
188194
allErrs,
189195
field.NotSupported(trustedAddressesPath.Child("type"),
190196
addr.Type,
191-
[]string{string(ngfAPI.AddressTypeCIDR)},
197+
[]string{
198+
string(ngfAPI.CIDRAddressType),
199+
string(ngfAPI.IPAddressType),
200+
string(ngfAPI.HostnameAddressType),
201+
},
192202
),
193203
)
194204
}

0 commit comments

Comments
 (0)