nginx日志中错误的real_ip头

Question

我在OKD 4.8中部署了nginx pod。问题是日志中显示的IP对应于运行入口控制器的虚拟机。

这是我的直通OKD路由的配置：

  - kind: Route
    apiVersion: route.openshift.io/v1
    metadata:
      name: app-cname
      labels:
        app: app
    spec:
      host: "app.dev.com"
      to:
        kind: Service
        name: app
        weight: 100
      port:
        targetPort: 8080-tcp
      tls:
        termination: passthrough
        insecureEdgeTerminationPolicy: Redirect

这是我当前的配置文件/etc/nginx/nginx.conf

        error_log /dev/stderr;
        pid /run/nginx.pid;
        worker_processes auto;
        include /usr/share/nginx/modules/*.conf;
        events {
            worker_connections 1024;
        }
        http {
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            set_real_ip_from 0.0.0.0/0;
            log_format  main  '$remote_addr forwarded for $http_x_real_ip - $remote_user [$time_local] "$request" '
                              '$status $body_bytes_sent "$http_referer" '
                              '"$http_user_agent" "$http_x_forwarded_for"';
            map $http_user_agent $logme {
                default            1;
                ~^kube-probe*      0; # do not log user-agent for ocp readiness probe
            }
            access_log /dev/stdout main if=$logme;
            sendfile            on;
            tcp_nopush          on;
            tcp_nodelay         on;
            keepalive_timeout   65;
            types_hash_max_size 2048;

            include             /etc/nginx/mime.types;
            default_type        application/octet-stream;
        
            # Allow up to 10 MiB payload, app defaults to 10 MiB.
            client_max_body_size 10M;

            include /etc/nginx/conf.d/*.conf;

            server {
                listen 8080 ssl; 
                listen [::]:8080 ssl;

                root /var/www/html;
                index index.php index.html index.htm;

                ssl_certificate /etc/nginx/ssl/app.crt;
                ssl_certificate_key /etc/nginx/ssl/app.key;

                ssl_protocols TLSv1.2;
                ssl_prefer_server_ciphers on;
                ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK;
                ssl_session_timeout 10m;
                ssl_session_cache shared:SSL:10m;
                ssl_session_tickets off;
                ssl_stapling on;
                ssl_stapling_verify on;

                resolver 8.8.8.8 8.8.4.4 valid=300s; # check with igor
                resolver_timeout 5s; # check with igor

                add_header Strict-Transport-Security max-age=63072000;

                add_header X-Frame-Options DENY;
                add_header X-Content-Type-Options nosniff;
                add_header X-XSS-Protection "1; mode=block";

                ssl_dhparam /etc/nginx/ssl/dhparam.pem;
                ssl_ecdh_curve secp384r1;

                add_header Cross-Origin-Embedder-Policy require-corp;
                add_header Cross-Origin-Resource-Policy same-origin;
                add_header Cross-Origin-Opener-Policy same-origin;
                add_header Referrer-Policy no-referrer;
                add_header X-Content-Type-Options nosniff;
                add_header X-Frame-Options deny;
                add_header X-XSS-Protection "1; mode=block";

                location / {
                    try_files $uri $uri/ /index.php$is_args$args;
                }

                location ~ \.(php|phar)(/.*)?$ {
                    fastcgi_split_path_info ^(.+\.(?:php|phar))(/.*)$;
                    fastcgi_intercept_errors on;
                    fastcgi_index  index.php;
                    include        fastcgi_params;
                    fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
                    fastcgi_param  PATH_INFO $fastcgi_path_info;
                    fastcgi_pass   php-fpm;

                    fastcgi_hide_header Cross-Origin-Embedder-Policy;
                    fastcgi_hide_header Cross-Origin-Resource-Policy;
                    fastcgi_hide_header Cross-Origin-Opener-Policy;
                    fastcgi_hide_header Referrer-Policy;
                    fastcgi_hide_header X-Content-Type-Options;
                    fastcgi_hide_header X-Frame-Options;
                    fastcgi_hide_header X-XSS-Protection;

                    # Prevent exposing nginx + version to $_SERVER
                    fastcgi_param SERVER_SOFTWARE "";
                }
            }
        }

有没有什么不合理的地方？

这是我的设置：

sh-4.4$ nginx -V
nginx version: nginx/1.14.1
built by gcc 8.2.1 20180905 (Red Hat 8.2.1-3) (GCC) 
built with OpenSSL 1.1.1 FIPS  11 Sep 2018 (running with OpenSSL 1.1.1g FIPS  21 Apr 2020)
TLS SNI support enabled
configure arguments: --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx --user=nginx --group=nginx --with-file-aio --with-ipv6 --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_addition_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_slice_module --with-http_stub_status_module --with-http_perl_module=dynamic --with-http_auth_request_module --with-mail=dynamic --with-mail_ssl_module --with-pcre --with-pcre-jit --with-stream=dynamic --with-stream_ssl_module --with-debug --with-cc-opt='-O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection' --with-ld-opt='-Wl,-z,relro -Wl,-z,-Wl,-E'

如何在nginx日志中显示真实的原始IP？

提前谢谢你，

Answer 1

我是OKD4的新手-但是当使用passthrough时，tcp流将在没有篡改的情况下传输，并且源ip是OpenShift路由器之一。

如果你想使用x-forwarded for，你必须将其改为"reencrypt“--当然，SSL会在路由器上终止，一个新的https会话会打开--如果你不需要端到端加密，那也没问题(当然，这会增加集群的负载)。