ΠΡΠ΅Π΄ΡΡΠ°Π²ΠΈΡΠ΅Π» Π½Π° Π½Π°ΡΠΈΡ ΠΊΠ»ΠΈΠ΅Π½Ρ, ΡΠΈΠΉΡΠΎ ΡΡΠ΅ΠΊ ΠΎΡ ΠΏΡΠΈΠ»ΠΎΠΆΠ΅Π½ΠΈΡ ΡΠ΅ Π½Π°ΠΌΠΈΡΠ° Π² ΠΎΠ±Π»Π°ΠΊΠ° Π½Π° Microsoft (Azure), Π°Π΄ΡΠ΅ΡΠΈΡΠ° ΠΏΡΠΎΠ±Π»Π΅ΠΌ: Π½Π°ΡΠΊΠΎΡΠΎ Π½ΡΠΊΠΎΠΈ Π·Π°ΡΠ²ΠΊΠΈ ΠΎΡ Π½ΡΠΊΠΎΠΈ ΠΊΠ»ΠΈΠ΅Π½ΡΠΈ ΠΎΡ ΠΠ²ΡΠΎΠΏΠ° Π·Π°ΠΏΠΎΡΠ½Π°Ρ
Π° Π΄Π° Π·Π°Π²ΡΡΡΠ²Π°Ρ Ρ Π³ΡΠ΅ΡΠΊΠ° 400 (
ΠΠ΄Π½ΠΎ ΠΎΡ ΠΏΡΠΈΠ»ΠΎΠΆΠ΅Π½ΠΈΡΡΠ° Π΅ API, ΠΏΡΠ΅Π· ΠΊΠΎΠ΅ΡΠΎ Π² ΠΊΡΠ°ΠΉΠ½Π° ΡΠΌΠ΅ΡΠΊΠ° ΠΈΠ΄Π²Π° ΡΠ΅Π»ΠΈΡΡ ΡΡΠ°ΡΠΈΠΊ. Π’ΠΎΠ·ΠΈ ΡΡΠ°ΡΠΈΠΊ ΡΠ΅ ΠΏΡΠΎΡΠ»ΡΡΠ²Π° ΠΎΡ HTTP ΡΡΡΠ²ΡΡΠ°
ΠΡΠ΅ΡΠΊΠ°ΡΠ° Π² Ingress ΠΈΠ·Π³Π»Π΅ΠΆΠ΄Π°ΡΠ΅ ΡΠ°ΠΊΠ°:
{
"number_fields":{
"status":400,
"request_time":0.001,
"bytes_sent":465,
"upstream_response_time":0,
"upstream_retries":0,
"bytes_received":2328
},
"stream":"stdout",
"string_fields":{
"ingress":"app",
"protocol":"HTTP/1.1",
"request_id":"f9ab8540407208a119463975afda90bc",
"path":"/api/sign-in",
"nginx_upstream_status":"400",
"service":"app",
"namespace":"production",
"location":"/front",
"scheme":"https",
"method":"POST",
"nginx_upstream_response_time":"0.000",
"nginx_upstream_bytes_received":"120",
"vhost":"api.app.example.com",
"host":"api.app.example.com",
"user":"",
"address":"83.41.81.250",
"nginx_upstream_addr":"10.240.0.110:80",
"referrer":"https://api.app.example.com/auth/login?long_encrypted_header",
"service_port":"http",
"user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36",
"time":"2019-03-06T18:29:16+00:00",
"content_kind":"cache-headers-not-present",
"request_query":""
},
"timestamp":"2019-03-06 18:29:16",
"labels":{
"app":"nginx",
"pod-template-generation":"6",
"controller-revision-hash":"1682636041"
},
"namespace":"kube-nginx-ingress",
"nsec":6726612,
"source":"kubernetes",
"host":"k8s-node-55555-0",
"pod_name":"nginx-v2hcb",
"container_name":"nginx",
"boolean_fields":{}
}
Π ΡΡΡΠΎΡΠΎ Π²ΡΠ΅ΠΌΠ΅ Kestrel Π΄Π°Π΄Π΅:
HTTP/1.1 400 Bad Request
Connection: close
Date: Wed, 06 Mar 2019 12:34:20 GMT
Server: Kestrel
Content-Length: 0
ΠΠΎΡΠΈ ΠΈ Ρ ΠΌΠ°ΠΊΡΠΈΠΌΠ°Π»Π½ΠΎ ΠΌΠ½ΠΎΠ³ΠΎΡΠ»ΠΎΠ²ΠΈΠ΅, Π³ΡΠ΅ΡΠΊΠ°ΡΠ° Kestrel ΡΡΠ΄ΡΡΠΆΠ°ΡΠ΅ ΠΈΠ·ΠΊΠ»ΡΡΠΈΡΠ΅Π»Π½ΠΎ ΠΌΠ°Π»ΠΊΠΎ ΠΏΠΎΠ»Π΅Π·Π½Π° ΠΈΠ½ΡΠΎΡΠΌΠ°ΡΠΈΡ:
{
"number_fields":{"ThreadId":76},
"stream":"stdout",
"string_fields":{
"EventId":"{"Id"=>17, "Name"=>"ConnectionBadRequest"}",
"SourceContext":"Microsoft.AspNetCore.Server.Kestrel",
"ConnectionId":"0HLL2VJSST5KV",
"@mt":"Connection id "{ConnectionId}" bad request data: "{message}"",
"@t":"2019-03-07T13:06:48.1449083Z",
"@x":"Microsoft.AspNetCore.Server.Kestrel.Core.BadHttpRequestException: Malformed request: invalid headers.n at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.Http1Connection.TryParseRequest(ReadResult result, Boolean& endConnection)n at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.<ProcessRequestsAsync>d__185`1.MoveNext()",
"message":"Malformed request: invalid headers."
},
"timestamp":"2019-03-07 13:06:48",
"labels":{
"pod-template-hash":"2368795483",
"service":"app"
},
"namespace":"production",
"nsec":145341848,
"source":"kubernetes",
"host":"k8s-node-55555-1",
"pod_name":"app-67bdcf98d7-mhktx",
"container_name":"app",
"boolean_fields":{}
}
ΠΠ·Π³Π»Π΅ΠΆΠ΄Π°, ΡΠ΅ ΡΠ°ΠΌΠΎ tcpdump ΡΠ΅ ΠΏΠΎΠΌΠΎΠ³Π½Π΅ Π·Π° ΡΠ΅ΡΠ°Π²Π°Π½Π΅ΡΠΎ Π½Π° ΡΠΎΠ·ΠΈ ΠΏΡΠΎΠ±Π»Π΅ΠΌ ... Π½ΠΎ ΡΠ΅ ΠΏΠΎΠ²ΡΠΎΡΡ Π·Π° Π²Π΅ΡΠΈΠ³Π°ΡΠ° Π½Π° ΡΡΠ°ΡΠΈΠΊΠ°:
ΡΠ°Π·ΡΠ»Π΅Π΄Π²Π°Π½Π΅
ΠΡΠ΅Π²ΠΈΠ΄Π½ΠΎ Π΅ ΠΏΠΎ-Π΄ΠΎΠ±ΡΠ΅ Π΄Π° ΡΠ»ΡΡΠ°ΡΠ΅ ΡΡΠ°ΡΠΈΠΊΠ° Π½Π° ΡΠΎΠ·ΠΈ ΠΊΠΎΠ½ΠΊΡΠ΅ΡΠ΅Π½ Π²ΡΠ·Π΅Π», ΠΊΡΠ΄Π΅ΡΠΎ Kubernetes Π΅ ΡΠ°Π·ΠΏΠΎΠ»ΠΎΠΆΠΈΠ» ΠΏΠΎΠ΄: ΠΎΠ±Π΅ΠΌΡΡ Π½Π° Π΄ΡΠΌΠΏΠ° ΡΠ΅ Π±ΡΠ΄Π΅ ΡΠ°ΠΊΡΠ², ΡΠ΅ ΡΠ΅ Π±ΡΠ΄Π΅ Π²ΡΠ·ΠΌΠΎΠΆΠ½ΠΎ Π΄Π° ΡΠ΅ Π½Π°ΠΌΠ΅ΡΠΈ ΠΏΠΎΠ½Π΅ Π½Π΅ΡΠΎ Π΄ΠΎΡΡΠ° Π±ΡΡΠ·ΠΎ. Π Π½Π°ΠΈΡΡΠΈΠ½Π°, ΠΏΡΠΈ ΡΠ°Π·Π³Π»Π΅ΠΆΠ΄Π°Π½Π΅ΡΠΎ ΠΌΡ ΡΠ΅ Π·Π°Π±Π΅Π»ΡΠ·Π° ΡΠ»Π΅Π΄Π½Π°ΡΠ° ΡΠ°ΠΌΠΊΠ°:
GET /back/user HTTP/1.1
Host: api.app.example.com
X-Request-ID: 27ceb14972da8c21a8f92904b3eff1e5
X-Real-IP: 83.41.81.250
X-Forwarded-For: 83.41.81.250
X-Forwarded-Host: api.app.example.com
X-Forwarded-Port: 443
X-Forwarded-Proto: https
X-Original-URI: /front/back/user
X-Scheme: https
X-Original-Forwarded-For: 83.41.81.250
X-Nginx-Geo-Client-Country: Spain
X-Nginx-Geo-Client-City: M.laga
Accept-Encoding: gzip
CF-IPCountry: ES
CF-RAY: 4b345cfd1c4ac691-MAD
CF-Visitor: {"scheme":"https"}
pragma: no-cache
cache-control: no-cache
accept: application/json, text/plain, */*
origin: https://app.example.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.119 Safari/537.36
referer: https://app.example.com/auth/login
accept-language: en-US,en;q=0.9,en-GB;q=0.8,pl;q=0.7
cookie: many_encrypted_cookies; .AspNetCore.Identity.Application=something_encrypted;
CF-Connecting-IP: 83.41.81.250
True-Client-IP: 83.41.81.250
CDN-Loop: cloudflare
HTTP/1.1 400 Bad Request
Connection: close
Date: Wed, 06 Mar 2019 12:34:20 GMT
Server: Kestrel
Content-Length: 0
ΠΡΠΈ ΠΏΠΎ-Π²Π½ΠΈΠΌΠ°ΡΠ΅Π»Π΅Π½ ΠΎΠ³Π»Π΅Π΄ Π½Π° ΡΠΌΠ΅ΡΠΈΡΠ΅ΡΠΎ Π΄ΡΠΌΠ°ΡΠ° Π΅ Π·Π°Π±Π΅Π»ΡΠ·Π°Π½Π° M.laga
. ΠΠ΅ΡΠ½ΠΎ Π΅ Π΄Π° ΡΠ΅ Π΄ΠΎΡΠ΅ΡΠΈΡΠ΅, ΡΠ΅ Π² ΠΡΠΏΠ°Π½ΠΈΡ Π½ΡΠΌΠ° Π³ΡΠ°Π΄ M.laga (Π½ΠΎ ΠΈΠΌΠ°
ingress.kubernetes.io/configuration-snippet: |
proxy_set_header X-Nginx-Geo-Client-Country $geoip_country_name;
proxy_set_header X-Nginx-Geo-Client-City $geoip_city;
Π‘Π»Π΅Π΄ Π΄Π΅Π°ΠΊΡΠΈΠ²ΠΈΡΠ°Π½Π΅ Π½Π° ΠΏΡΠ΅ΠΏΡΠ°ΡΠ°Π½Π΅ΡΠΎ Π½Π° ΡΠ΅Π·ΠΈ Ρ Π΅Π΄ΡΡΠΈ Π²ΡΠΈΡΠΊΠΎ ΡΠ΅ ΠΎΠΏΡΠ°Π²ΠΈ! (Π‘ΠΊΠΎΡΠΎ ΡΡΠ°Π½Π° ΡΡΠ½ΠΎ, ΡΠ΅ ΡΠ°ΠΌΠΎΡΠΎ ΠΏΡΠΈΠ»ΠΎΠΆΠ΅Π½ΠΈΠ΅ Π²Π΅ΡΠ΅ Π½Π΅ ΡΠ΅ Π½ΡΠΆΠ΄Π°Π΅ ΠΎΡ ΡΠ΅Π·ΠΈ Π·Π°Π³Π»Π°Π²ΠΊΠΈ.)
Π‘Π΅Π³Π° Π½Π΅ΠΊΠ° Π΄Π° ΡΠ°Π·Π³Π»Π΅Π΄Π°ΠΌΠ΅ ΠΏΡΠΎΠ±Π»Π΅ΠΌΠ° ΠΏΠΎ-ΠΎΠ±ΡΠΎ. ΠΠΎΠΆΠ΅ Π»Π΅ΡΠ½ΠΎ Π΄Π° ΡΠ΅ Π²ΡΠ·ΠΏΡΠΎΠΈΠ·Π²Π΅Π΄Π΅ Π²ΡΡΡΠ΅ Π² ΠΏΡΠΈΠ»ΠΎΠΆΠ΅Π½ΠΈΠ΅ΡΠΎ, ΠΊΠ°ΡΠΎ ΡΠ΅ Π½Π°ΠΏΡΠ°Π²ΠΈ telnet Π·Π°ΡΠ²ΠΊΠ° ΠΊΡΠΌ localhost:80
:
GET /back/user HTTP/1.1
Host: api.app.example.com
cache-control: no-cache
accept: application/json, text/plain, */*
origin: https://app.example.com
Cookie: test=Desiree
... ΡΠ΅ Π·Π°Π²ΡΡΡΠ° 401 Unauthorized
, ΠΊΠ°ΠΊΡΠΎ ΡΠ΅ ΠΎΡΠ°ΠΊΠ²Π°. ΠΠ°ΠΊΠ²ΠΎ ΡΠ΅ ΡΠ»ΡΡΠ²Π°, Π°ΠΊΠΎ Π½Π°ΠΏΡΠ°Π²ΠΈΠΌ:
GET /back/user HTTP/1.1
Host: api.app.example.com
cache-control: no-cache
accept: application/json, text/plain, */*
origin: https://app.example.com
Cookie: test=DΓ©sirΓ©e
?
Π©Π΅ ΡΠ΅ Π²ΡΡΠ½Π΅ 400 Bad request
β Π² ΡΠ΅Π³ΠΈΡΡΡΠ°ΡΠΈΠΎΠ½Π½ΠΈΡ ΡΠ°ΠΉΠ» Π½Π° ΠΏΡΠΈΠ»ΠΎΠΆΠ΅Π½ΠΈΠ΅ΡΠΎ ΡΠ΅ ΠΏΠΎΠ»ΡΡΠΈΠΌ Π³ΡΠ΅ΡΠΊΠ°, ΠΊΠΎΡΡΠΎ Π²Π΅ΡΠ΅ Π½ΠΈ Π΅ ΠΏΠΎΠ·Π½Π°ΡΠ°:
{
"@t":"2019-03-31T12:59:54.3746446Z",
"@mt":"Connection id "{ConnectionId}" bad request data: "{message}"",
"@x":"Microsoft.AspNetCore.Server.Kestrel.Core.BadHttpRequestException: Malformed request: invalid headers.n at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.Http1Connection.TryParseRequest(ReadResult result, Boolean& endConnection)n at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.<ProcessRequestsAsync>d__185`1.MoveNext()",
"ConnectionId":"0HLLLR1J974L9",
"message":"Malformed request: invalid headers.",
"EventId":{
"Id":17,
"Name":"ConnectionBadRequest"
},
"SourceContext":"Microsoft.AspNetCore.Server.Kestrel",
"ThreadId":71
}
Π Π΅Π·ΡΠ»ΡΠ°ΡΠΈ ΠΎΡ
ΠΠΎ-ΡΠΎΡΠ½ΠΎ Π²Π΅ΡΡΡΡΠΊΠ°
ΠΠΎΠΏΡΠ»Π½ΠΈΡΠ΅Π»Π΅Π½ ΡΠ°ΠΊΡΠΎΡ Π² Π½Π°ΡΠΈΡ ΡΠ»ΡΡΠ°ΠΉ Π΅, ΡΠ΅ ΠΊΠ»ΠΈΠ΅Π½ΡΡΡ Π² ΠΌΠΎΠΌΠ΅Π½ΡΠ° Π½Π΅ ΠΏΠ»Π°Π½ΠΈΡΠ° Π΄Π° ΠΏΡΠΎΠΌΠ΅Π½ΠΈ Π²Π½Π΅Π΄ΡΡΠ²Π°Π½Π΅ΡΠΎ Π½Π° Kestrel Π² ΠΏΡΠΈΠ»ΠΎΠΆΠ΅Π½ΠΈΠ΅ΡΠΎ. ΠΡΠΎΠ±Π»Π΅ΠΌΠΈ Π² ΡΠ°ΠΌΠΈΡ AspNetCore ΠΎΠ±Π°ΡΠ΅ (
ΠΠ° Π΄Π° ΠΎΠ±ΠΎΠ±ΡΠΈΠΌ: Π±Π΅Π»Π΅ΠΆΠΊΠ°ΡΠ° Π²Π΅ΡΠ΅ Π½Π΅ Π΅ Π·Π° ΠΊΠΎΠ½ΠΊΡΠ΅ΡΠ½ΠΈΡΠ΅ ΠΏΡΠΎΠ±Π»Π΅ΠΌΠΈ Π½Π° Kestrel ΠΈΠ»ΠΈ UTF-8 (ΠΏΡΠ΅Π· 2019?!), Π° Π·Π° ΡΠ°ΠΊΡΠ°, ΡΠ΅ Π²Π½ΠΈΠΌΠ°ΡΠ΅Π»Π½ΠΎΡΡ ΠΈ ΠΏΠΎΡΠ»Π΅Π΄ΠΎΠ²Π°ΡΠ΅Π»Π½ΠΎ ΠΈΠ·ΡΡΠ°Π²Π°Π½Π΅ ΠΡΡΠΊΠ° ΡΡΡΠΏΠΊΠ°, ΠΊΠΎΡΡΠΎ ΠΏΡΠ°Π²ΠΈΡΠ΅, Π΄ΠΎΠΊΠ°ΡΠΎ ΡΡΡΡΠΈΡΠ΅ ΠΏΡΠΎΠ±Π»Π΅ΠΌΠΈ, ΡΠ°Π½ΠΎ ΠΈΠ»ΠΈ ΠΊΡΡΠ½ΠΎ ΡΠ΅ Π΄Π°Π΄Π΅ ΠΏΠ»ΠΎΠ΄. ΠΡΡΠΌΠ΅Ρ!
PS
ΠΡΠΎΡΠ΅ΡΠ΅ΡΠ΅ ΡΡΡΠΎ Π² Π½Π°ΡΠΈΡ Π±Π»ΠΎΠ³:
- Β«
6 Π·Π°Π±Π°Π²Π½ΠΈ ΡΠΈΡΡΠ΅ΠΌΠ½ΠΈ Π³ΡΠ΅ΡΠΊΠΈ Π² ΡΠ°Π±ΠΎΡΠ°ΡΠ° Π½Π° Kubernetes [ΠΈ ΡΡΡ Π½ΠΎΡΠΎ ΡΠ΅ΡΠ΅Π½ΠΈΠ΅] Β»; - Β«
Π‘ΡΠ²Π΅ΡΠΈ ΠΈ ΡΡΠΈΠΊΠΎΠ²Π΅ Π½Π° Kubernetes: ΠΏΠ΅ΡΡΠΎΠ½Π°Π»ΠΈΠ·ΠΈΡΠ°Π½ΠΈ ΡΡΡΠ°Π½ΠΈΡΠΈ Π·Π° Π³ΡΠ΅ΡΠΊΠΈ Π² NGINX Ingress Β»; - Β«
ΠΡΠ΅Π³Π»Π΅Π΄ ΠΈ ΡΡΠ°Π²Π½Π΅Π½ΠΈΠ΅ Π½Π° Ingress ΠΊΠΎΠ½ΡΡΠΎΠ»Π΅ΡΠΈ Π·Π° Kubernetes Β»; - Β«
ΠΠΎΠ½ΠΈΡΠΎΡΠΈΠ½Π³ Π½Π° ping ΠΌΠ΅ΠΆΠ΄Ρ Π²ΡΠ·Π»ΠΈΡΠ΅ Π½Π° Kubernetes - Π½Π°ΡΠ°ΡΠ° ΡΠ΅ΡΠ΅ΠΏΡΠ° Β»; - Β«
3 Π½Π΅ΠΎΠ±ΠΈΡΠ°ΠΉΠ½ΠΈ ΡΠ»ΡΡΠ°Ρ Π·Π° ΠΌΡΠ΅ΠΆΠΎΠ²Π°ΡΠ° ΠΏΠΎΠ΄ΡΠΈΡΡΠ΅ΠΌΠ° Π½Π° Linux ".
ΠΠ·ΡΠΎΡΠ½ΠΈΠΊ: www.habr.com