Microsoft cloud (Azure) ááœáẠá¡ááá®áá±ážááŸááºáž á¡á
á¯á¡áá±ážááœáẠááŸááá±áá±á¬ áá»áœááºá¯ááºááá¯á·ááá±á¬ááºáááºá ááá¯ááºá
á¬ážááŸááºáá
áºáŠážááẠááŒá¿áá¬áá
áºáá¯ááᯠááŒá±ááŸááºážáá²á·áááº- áááŒá¬áá±ážáá®á á¥áá±á¬áá០á¡áá»áá¯á·áá±á¬áá±á¬ááºáááºáá»á¬ážáá¶á០áá±á¬ááºážááá¯áá»ááºá¡áá»áá¯á·ááẠá¡ááŸá¬ážá¡ááœááºáž 400 (á¡ááŸá¬áž XNUMX) ááŒáá·áº á¡áá¯á¶ážáááºááœá¬ážáá²á·áááºá) á¡ááá®áá±ážááŸááºážá¡á¬ážáá¯á¶ážááᯠKubernetes ááœáẠááŒáá·áºáá»ááºáá¬ážááŒá®áž .NET ááŒáá·áº áá±ážáá¬ážáá¬ážáááºá
á¡ááá®áá±ážááŸááºážáá»á¬ážáá²á០áá áºáá¯ááẠá¡ááœá¬ážá¡áá¬á¡á¬ážáá¯á¶áž á¡áá¯á¶ážááœáẠáá±á¬ááºáá¬ááá·áº API ááŒá áºáááºá á€á¡ááœá¬ážá¡áá¬ááᯠHTTP áá¬áá¬á០áá¬ážáá±á¬ááºáááºá .NET áááá¯ááºážááá·áºá á á®á ááºááŒá®áž áá±á«á·ááºáá áºáá¯ááœáẠáááºáá¶áá¬ážáááºá á¡ááŸá¬ážááŸá¬ááŒááºááŒááºážááŒáá·áºá ááŒá¿áá¬ááᯠáááááºáááºáž ááŒááºáá¯ááºáá±ážááá·áº áááºáááºááŸááºááŸááºá¡áá¯á¶ážááŒá¯áá°áá áºáŠážááŸáááŒááºážá¡ááœáẠáá»áœááºá¯ááºááá¯á· áá¶áá±á¬ááºážáá²á·áá«áááºá ááá¯á·áá±á¬áºá áá¬ááºááŒá±á¬á¡ááœá¬ážá¡áᬠááœááºážáááºááŒá±á¬áá·áº á¡áá¬á¡á¬ážáá¯á¶áž ááŸá¯ááºááœá±ážáá²á·áááº-
Ingress ááœáẠá¡ááŸá¬ážá¡ááœááºážááẠá€áá²á·ááá¯á·ááŒá
áºáááº-
{
"number_fields":{
"status":400,
"request_time":0.001,
"bytes_sent":465,
"upstream_response_time":0,
"upstream_retries":0,
"bytes_received":2328
},
"stream":"stdout",
"string_fields":{
"ingress":"app",
"protocol":"HTTP/1.1",
"request_id":"f9ab8540407208a119463975afda90bc",
"path":"/api/sign-in",
"nginx_upstream_status":"400",
"service":"app",
"namespace":"production",
"location":"/front",
"scheme":"https",
"method":"POST",
"nginx_upstream_response_time":"0.000",
"nginx_upstream_bytes_received":"120",
"vhost":"api.app.example.com",
"host":"api.app.example.com",
"user":"",
"address":"83.41.81.250",
"nginx_upstream_addr":"10.240.0.110:80",
"referrer":"https://api.app.example.com/auth/login?long_encrypted_header",
"service_port":"http",
"user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36",
"time":"2019-03-06T18:29:16+00:00",
"content_kind":"cache-headers-not-present",
"request_query":""
},
"timestamp":"2019-03-06 18:29:16",
"labels":{
"app":"nginx",
"pod-template-generation":"6",
"controller-revision-hash":"1682636041"
},
"namespace":"kube-nginx-ingress",
"nsec":6726612,
"source":"kubernetes",
"host":"k8s-node-55555-0",
"pod_name":"nginx-v2hcb",
"container_name":"nginx",
"boolean_fields":{}
}áá áºáá»áááºáááºážááŸá¬ááẠKestrel áááº
HTTP/1.1 400 Bad Request
Connection: close
Date: Wed, 06 Mar 2019 12:34:20 GMT
Server: Kestrel
Content-Length: 0á áá¬ážáá¯á¶ážá¡áá¯á¶ážá¡ááŸá¯ááºážá¡áá»á¬ážáá¯á¶ážááŒáá·áºáááºá Kestrel á¡ááŸá¬ážááẠá¡ááœááºá¡áááºážáá«ááŸááááºá á¡áá¯á¶ážáááºáá²á· á¡áá»ááºá¡áááºáá±ážááœá±áá«á:
{
"number_fields":{"ThreadId":76},
"stream":"stdout",
"string_fields":{
"EventId":"{"Id"=>17, "Name"=>"ConnectionBadRequest"}",
"SourceContext":"Microsoft.AspNetCore.Server.Kestrel",
"ConnectionId":"0HLL2VJSST5KV",
"@mt":"Connection id "{ConnectionId}" bad request data: "{message}"",
"@t":"2019-03-07T13:06:48.1449083Z",
"@x":"Microsoft.AspNetCore.Server.Kestrel.Core.BadHttpRequestException: Malformed request: invalid headers.n at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.Http1Connection.TryParseRequest(ReadResult result, Boolean& endConnection)n at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.<ProcessRequestsAsync>d__185`1.MoveNext()",
"message":"Malformed request: invalid headers."
},
"timestamp":"2019-03-07 13:06:48",
"labels":{
"pod-template-hash":"2368795483",
"service":"app"
},
"namespace":"production",
"nsec":145341848,
"source":"kubernetes",
"host":"k8s-node-55555-1",
"pod_name":"app-67bdcf98d7-mhktx",
"container_name":"app",
"boolean_fields":{}
}tcpdump ááᬠáá®ááŒá¿áá¬ááᯠááŒá±ááŸááºážááá¯ááºáááºááá¯á· áááºááá±ááá·áº traffic chain á¡ááŒá±á¬ááºáž áááºáá«ááá²áá² ááŒá±á¬áá«áŠážáááºá
á á¯á¶á ááºážá á áºáá±ážááŸá¯
á¡ááœá¬ážá¡áᬠáá¬ážáá±á¬ááºáá¬á ááá¯áá±á¬ááºážáá«áááºá á¡á²áá® áá®ážááŒá¬áž node áá±á«áºááŸá¬Kubernetes á pod áá áºáá¯ááᯠááŒáá·áºáá»ááºáá¬ážáá¬á á¡ááŸáá¯ááºáá¯á¶ááŒá®ážá ááá¬áááẠá¡áááºážáá¯á¶áž áá áºáá¯áá¯ááᯠáá»ááºááŒááºá áœá¬ ááŸá¬ááœá±á·ááá¯ááºáááºááŒá áºááẠá á¡ááŸááºáááºá áááºážááá¯á á áºáá±ážáá±á¬á¡áá«á á¡á±á¬ááºáá«áá±á¬ááºááᯠáááááŒá¯áááááº-
GET /back/user HTTP/1.1
Host: api.app.example.com
X-Request-ID: 27ceb14972da8c21a8f92904b3eff1e5
X-Real-IP: 83.41.81.250
X-Forwarded-For: 83.41.81.250
X-Forwarded-Host: api.app.example.com
X-Forwarded-Port: 443
X-Forwarded-Proto: https
X-Original-URI: /front/back/user
X-Scheme: https
X-Original-Forwarded-For: 83.41.81.250
X-Nginx-Geo-Client-Country: Spain
X-Nginx-Geo-Client-City: M.laga
Accept-Encoding: gzip
CF-IPCountry: ES
CF-RAY: 4b345cfd1c4ac691-MAD
CF-Visitor: {"scheme":"https"}
pragma: no-cache
cache-control: no-cache
accept: application/json, text/plain, */*
origin: https://app.example.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.119 Safari/537.36
referer: https://app.example.com/auth/login
accept-language: en-US,en;q=0.9,en-GB;q=0.8,pl;q=0.7
cookie: many_encrypted_cookies; .AspNetCore.Identity.Application=something_encrypted;
CF-Connecting-IP: 83.41.81.250
True-Client-IP: 83.41.81.250
CDN-Loop: cloudflare
HTTP/1.1 400 Bad Request
Connection: close
Date: Wed, 06 Mar 2019 12:34:20 GMT
Server: Kestrel
Content-Length: 0
á¡ááŸáá¯ááºáá¯á¶ááŒá®ážá¡á¬áž á¡áá®ážáááºá
á
áºáá±ážááŒáá·áºáá±á¬á¡áá« á
áá¬ážáá¯á¶ážááᯠááááá¬ážáááááºá M.laga. á
ááááºááœáẠM.laga ááŒáá¯á·áááŸááᯠááá·áºááŸááºážáááœááºáá°ááẠ(ááá¯á·áá±á¬áº ááŸááá«áááºá ) á€á¡ááŒá¶á¡á
ááºááá¯ááá°ááŒá®áž ááœááºáá²á·ááá·áºáá
áºáá ááá·áºááœááºážáá¬ážááẠ(áá±á¬ááºáááºááá±á¬ááºážááá¯áá»ááºá¡á) ááá·áºááœááºážáá¬ážáááºááᯠáá»áœááºá¯ááºááá¯á·ááœá±á·áá²á·ááá·áº Ingress configs áá»á¬ážááᯠááŒáá·áºááŸá¯áá²á·áááºá "á¡áá¹ááá¬ááºáááŸá" á¡ááá¯á¡ááœá¬:
ingress.kubernetes.io/configuration-snippet: |
proxy_set_header X-Nginx-Geo-Client-Country $geoip_country_name;
proxy_set_header X-Nginx-Geo-Client-City $geoip_city;á€áá±á«ááºážá á®ážáá»á¬ážááᯠáááºááá·áºááá¯á·ááŒááºážááᯠááááºááŒá®ážáá±á¬ááºá á¡á¬ážáá¯á¶áž á¡áááºááŒá±ááœá¬ážáá«áááºá (á¡ááá®áá±ážááŸááºážááá¯ááºááá¯ááºá áá®áá±á«ááºážá á®ážááœá±ááᯠáááá¯á¡ááºáá±á¬á·áá°ážááá¯áᬠáááŒá¬áááºááŸá¬ ááŸááºážáá«áááºá)
á¡áᯠááŒá¿áá¬ááᯠááŒáá·áºáá¡á±á¬áẠááá¯áá±áá¯áá»á¡á¬ážááŒáá·áº. telnet áá±á¬ááºážááá¯ááŸá¯ááŒá¯áá¯ááºááŒááºážááŒáá·áº áááºážááᯠá¡ááá®áá±ážááŸááºážá¡ááœááºážááœáẠá¡ááœááºááá° ááŒááºáááºáá¯ááºáá¯ááºááá¯ááºáááºá localhost:80:
GET /back/user HTTP/1.1
Host: api.app.example.com
cache-control: no-cache
accept: application/json, text/plain, */*
origin: https://app.example.com
Cookie: test=Desiree
...ááŒááºáá¬ááẠ401 Unauthorizedáá»áŸá±á¬áºááá·áºáá¬ážááá·áºá¡ááá¯ááºážá áá«ááá¯á·áá¯ááºááẠáá¬ááŒá
áºááá²á
GET /back/user HTTP/1.1
Host: api.app.example.com
cache-control: no-cache
accept: application/json, text/plain, */*
origin: https://app.example.com
Cookie: test=Désirée?
ááŒááºáá¬ááŒááááºá·ááẠ400 Bad request â á¡ááá®áá±ážááŸááºážááŸááºáááºážááœáẠáá»áœááºá¯ááºááá¯á·ááŸáá·áºáááºážááŸá®ážááŒá®ážáá¬ážááŒá
áºáá±á¬ á¡ááŸá¬ážáá
áºáá¯ááᯠáá»áœááºá¯ááºááá¯á·áááºáá¶áááŸááááá·áºáááº-
{
"@t":"2019-03-31T12:59:54.3746446Z",
"@mt":"Connection id "{ConnectionId}" bad request data: "{message}"",
"@x":"Microsoft.AspNetCore.Server.Kestrel.Core.BadHttpRequestException: Malformed request: invalid headers.n at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.Http1Connection.TryParseRequest(ReadResult result, Boolean& endConnection)n at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.<ProcessRequestsAsync>d__185`1.MoveNext()",
"ConnectionId":"0HLLLR1J974L9",
"message":"Malformed request: invalid headers.",
"EventId":{
"Id":17,
"Name":"ConnectionBadRequest"
},
"SourceContext":"Microsoft.AspNetCore.Server.Kestrel",
"ThreadId":71
}ááááºáá»á¬ážááá¯
á¡áá°ážáááŒáá·áº Kestrel UTF-8 ááœáẠááŸááºáááºáá±á¬ á¡áá¹ááá¬áá»á¬ážááŒáá·áº HTTP áá±á«ááºážá á®ážáá»á¬ážááᯠááŸááºáááºá áœá¬ áá¯ááºáá±á¬ááºááŒá®áž ááŒáá¯á·ááŒá®ážá¡áá»á¬ážá¡ááŒá¬ážá á¡áááºáá»á¬ážááœááºáá«ááŸááááºá
áá»áœááºá¯ááºááá¯á·áááá á¹á ááœáẠáá±á¬ááºáááºá¡áá»ááºáá áºáá¯ááŸá¬ áá¯á¶ážá áœá²áá°ááẠá¡ááá®áá±ážááŸááºážááœáẠKestrel áá¡áá±á¬ááºá¡áááºáá±á¬áºááŸá¯ááᯠááŒá±á¬ááºážáá²ááẠáá±á¬áá±á¬ááẠá¡á á®á¡á ááºáááŸááá±ážáá±á¬ááŒá±á¬áá·áºááŒá áºáááºá ááá¯á·áá±á¬áº AspNetCore ááá¯ááºááá¯ááºá ááŒá¿áá¬áá»á¬áž (, ) á¡á²áá«á á¡áá±á¬ááºá¡áá°áááŒá áºáá°ážááá¯á· ááŒá±á¬ááŒáááº...
á¡áá»ááºážáá»á¯ááºááŒá±á¬ááá»áŸááº- ááŸááºá á¯ááẠKestrel ááá¯á·ááá¯áẠUTF-8 (2019 ááœááº?!) á áá®ážááŒá¬ážááŒá¿áá¬áá»á¬ážá¡ááŒá±á¬ááºáž ááá¯ááºáá±á¬á·áá²á ááá¯á¡áá»ááºááŸáá·áºáááºáááºá áááááá¹áá¬ááºáá²á· áááááºáááºáž áá±á·áá¬áááºá ááŒá¿áá¬ááœá±ááᯠááŸá¬ááœá±áááºáž áááºáá»áŸá±á¬ááºááŸááºážáá²á· ááŒá±ááŸááºážááá¯ááºážáᬠá¡ááŸá±ážáá²á·á¡ááŒááºááá¯áááᯠá¡áá®ážá¡ááœáá·áºááœá± ááŒá áºááœááºážáá¬áá«áááá·áºáááºá áá¶áá±á¬ááºážáá«á á±!
PS
áá»áœááºá¯ááºááá¯á·áááá±á¬á·ááºááœááºáááºážáááºáá«
- «";
- «";
- «";
- «";
- «"á
source: www.habr.com