Problem:
If i proxy requests from nodes to /userdata/user-data via SmartProxy the SmartProxy should take the REMOTE_ADDR and place it into a X-Forwarded-For Header.
Well, it does exactly that, but that Header seems to be ignored by Foreman. I made two tests from a remote node to the SmartProxy, one without supplying the header to curl and one with.
Here is the Debuglog of these requests:
curl -D - http://192.168.7.150:8000/userdata/user-data
-->
2022-04-26T11:09:21 03013c20 [I] Started GET /userdata/user-data
2022-04-26T11:09:21 03013c20 [D] Template: request for userdata/user-data using {"url"=>"http://foreman.xxx.dev.xxx.xxx:8000"} at foreman.xxx.dev.xxx.xxx
2022-04-26T11:09:21 03013c20 [D] Retrieving a template from https://foreman.xxx.dev.xxx.xxx//userdata/user-data?url=http%3A%2F%2Fforeman.xxx.dev.xxx.xxx%3A8000
2022-04-26T11:09:21 03013c20 [D] HTTP headers: {"USER_AGENT"=>"curl/7.68.0", "ACCEPT"=>"*/*", "X-Forwarded-For"=>"192.168.7.161"}
2022-04-26T11:09:21 03013c20 [I] Finished GET /userdata/user-data with 200 (79.82 ms)
curl -D - -H 'X-Forwarded-For: 192.168.7.161' http://192.168.7.150:80/userdata/user-data
-->
2022-04-26T11:10:11 eec4ebb3 [I] Started GET /userdata/user-data
2022-04-26T11:10:11 eec4ebb3 [D] Template: request for userdata/user-data using {"url"=>"http://foreman.xxx.dev.xxx.xxx:8000"} at foreman.xxx.dev.xxx.xxx
2022-04-26T11:10:11 eec4ebb3 [D] Retrieving a template from https://foreman.xxx.dev.xxx.xxx//userdata/user-data?url=http%3A%2F%2Fforeman.xxx.dev.xxx.xxx%3A8000
2022-04-26T11:10:11 eec4ebb3 [D] HTTP headers: {"USER_AGENT"=>"curl/7.68.0", "ACCEPT"=>"*/*", "X_FORWARDED_FOR"=>"192.168.7.161", "X-Forwarded-For"=>"192.168.7.161"}
2022-04-26T11:10:11 eec4ebb3 [I] Finished GET /userdata/user-data with 200 (89.45 ms)
So it seems Foreman is not responding to the X-Forwarded-For header but to the X_FOWARDED_FOR Header which the proxy seems to generate from a X-Forwarded-For header sent by curl.
If i change this line
proxy_headers["X_Forwarded_For"] = env['REMOTE_ADDR']
to this one
proxy_headers["X_Forwarded_For"] = env['REMOTE_ADDR']
in modules/templates/proxy_request.rb it works as expected but I can no longer forge the address for debugging…
Some checking is needed if the original request already contains a forwarded header or the ordering should be changed:
proxy_headers["X_FORWARDED_FOR"] = env['REMOTE_ADDR'] if ! proxy_headers["X_FORWARDED_FOR"]
Expected outcome:
The SmartProxy should take the REMOTE_ADDR header and put it into a header that Foreman recognises and uses.
Foreman and Proxy versions:
foreman 3.2.0-1
foreman-proxy 3.2.0-1
Foreman and Proxy plugin versions:
Distribution and version:
| Distributor ID: | Ubuntu |
|---|---|
| Description: | Ubuntu 20.04.4 LTS |
| Release: | 20.04 |
| Codename: | focal |
Other relevant data: