You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@trafficserver.apache.org by "Van Doorn, Jan R" <Ja...@cable.comcast.com> on 2012/05/01 23:35:50 UTC
Restricting access to stats_over_http?
Hello,
I looked in the documentation, tried some different remap configs, but
can't make it do what I want...
I'd like to use the stats_over_http plugin, but restrict the clients
that can get to it to just a couple of addresses. Is that possible? What
is the best way to that?
Thanks,
JvD
RE: Restricting access to stats_over_http?
Posted by Nick Berry <nb...@linkedin.com>.
oh, true. I missed that Tom suggested using {stat}.
________________________________________
From: Leif Hedstrom [zwoop@apache.org]
Sent: Thursday, May 03, 2012 9:12 AM
To: users@trafficserver.apache.org
Cc: Nick Berry; Van Doorn, Jan R; tom ryan
Subject: Re: Restricting access to stats_over_http?
On 5/3/12 1:36 AM, Nick Berry wrote:
> I was able to use {stat} this way...
>
> records.config:
> CONFIG proxy.config.http_ui_enabled INT 2
> CONFIG proxy.config.http.enable_http_info INT 1
>
> remap.config
> map /_stat/ http://{stat} @action=allow @src_ip=127.0.0.1
>
> $ curl localhost:<port>/_stat/ -s
> <pre>
> proxy.config.proxy_name=<hostname>
> …
> proxy.process.update.state_machines=0
> </pre>
>
> I'm only using the output to parse and report metrics into monitoring, so I didn't require access outside of localhost.
Yeah, the core stat-pages can be used like this. But I think the OP was
asking about the JSON stats plugin?
-- Leif
Re: Restricting access to stats_over_http?
Posted by Leif Hedstrom <zw...@apache.org>.
On 5/3/12 1:36 AM, Nick Berry wrote:
> I was able to use {stat} this way...
>
> records.config:
> CONFIG proxy.config.http_ui_enabled INT 2
> CONFIG proxy.config.http.enable_http_info INT 1
>
> remap.config
> map /_stat/ http://{stat} @action=allow @src_ip=127.0.0.1
>
> $ curl localhost:<port>/_stat/ -s
> <pre>
> proxy.config.proxy_name=<hostname>
> …
> proxy.process.update.state_machines=0
> </pre>
>
> I'm only using the output to parse and report metrics into monitoring, so I didn't require access outside of localhost.
Yeah, the core stat-pages can be used like this. But I think the OP was
asking about the JSON stats plugin?
-- Leif
Re: Restricting access to stats_over_http?
Posted by Nick Berry <nb...@linkedin.com>.
I was able to use {stat} this way...
records.config:
CONFIG proxy.config.http_ui_enabled INT 2
CONFIG proxy.config.http.enable_http_info INT 1
remap.config
map /_stat/ http://{stat} @action=allow @src_ip=127.0.0.1
$ curl localhost:<port>/_stat/ -s
<pre>
proxy.config.proxy_name=<hostname>
…
proxy.process.update.state_machines=0
</pre>
I'm only using the output to parse and report metrics into monitoring, so I didn't require access outside of localhost.
On May 1, 2012, at 6:27 PM, Leif Hedstrom <zw...@apache.org> wrote:
> On 5/1/12 6:59 PM, Van Doorn, Jan R wrote:
>> On 05/01/2012 05:34 PM, Leif Hedstrom wrote:
>>> On 5/1/12 5:29 PM, tom ryan wrote:
>>>>>> Hello,
>>>>>>
>>>>>> I looked in the documentation, tried some different remap configs, but
>>>>>> can't make it do what I want...
>>>>>>
>>>>>> I'd like to use the stats_over_http plugin, but restrict the clients
>>>>>> that can get to it to just a couple of addresses. Is that possible?
>>>>>> What
>>>>>> is the best way to that?
>>>>>>
>>>>> No way at this point.
>>>> -snip-
>>>>
>>>> What's about the doc reference to rules like:
>>>>
>>>> map http://localhost/stat/ http://{stat}
>>>>
>>>> as seen in
>>>> https://cwiki.apache.org/TS/faq.html#FAQ-httpui
>>>>
>>> I don't think that will work, since this is a server intercept plugin
>>> (and therefore, doesn't require a remap). You can try it, and see what
>>> happens.
>>>
>> I tried a couple of variations like that, and couldn't make it work. I
>> really just need a simple client IP address check, so, I think I'm just
>> going to reuse some of the code from the redirect-1 plugin sample, like
>> in the diff below.
>>
>> Leif: your config suggestions with the X-TS-Stats-Auth* header seem
>> pretty cool to me, but, like I said - I just need a quick IP check for
>> now, and I would think the below is a safe and simple hack?
>>
>>
>
>
> Yeah, I intentionally wanted to avoid that, since managing IP ACLs is a PITA, and without support for IP-ranges etc. it's not particularly user friendly (and perhaps not even usable for a large portion of users). If we could expose the internal code that does already deal with this to our TSAPI's, that would be the way to go (since then you get all the optimized range support etc.).
>
>
> Alan, can we expose any of those IP ranges / filters you implemented in TSAPI ?
> -- leif
>
Re: Restricting access to stats_over_http?
Posted by Leif Hedstrom <zw...@apache.org>.
On 5/1/12 6:59 PM, Van Doorn, Jan R wrote:
> On 05/01/2012 05:34 PM, Leif Hedstrom wrote:
>> On 5/1/12 5:29 PM, tom ryan wrote:
>>>>> Hello,
>>>>>
>>>>> I looked in the documentation, tried some different remap configs, but
>>>>> can't make it do what I want...
>>>>>
>>>>> I'd like to use the stats_over_http plugin, but restrict the clients
>>>>> that can get to it to just a couple of addresses. Is that possible?
>>>>> What
>>>>> is the best way to that?
>>>>>
>>>> No way at this point.
>>> -snip-
>>>
>>> What's about the doc reference to rules like:
>>>
>>> map http://localhost/stat/ http://{stat}
>>>
>>> as seen in
>>> https://cwiki.apache.org/TS/faq.html#FAQ-httpui
>>>
>> I don't think that will work, since this is a server intercept plugin
>> (and therefore, doesn't require a remap). You can try it, and see what
>> happens.
>>
> I tried a couple of variations like that, and couldn't make it work. I
> really just need a simple client IP address check, so, I think I'm just
> going to reuse some of the code from the redirect-1 plugin sample, like
> in the diff below.
>
> Leif: your config suggestions with the X-TS-Stats-Auth* header seem
> pretty cool to me, but, like I said - I just need a quick IP check for
> now, and I would think the below is a safe and simple hack?
>
>
Yeah, I intentionally wanted to avoid that, since managing IP ACLs is a
PITA, and without support for IP-ranges etc. it's not particularly user
friendly (and perhaps not even usable for a large portion of users). If we
could expose the internal code that does already deal with this to our
TSAPI's, that would be the way to go (since then you get all the optimized
range support etc.).
Alan, can we expose any of those IP ranges / filters you implemented in TSAPI ?
-- leif
Re: Restricting access to stats_over_http?
Posted by "Van Doorn, Jan R" <Ja...@cable.comcast.com>.
On 05/01/2012 05:34 PM, Leif Hedstrom wrote:
> On 5/1/12 5:29 PM, tom ryan wrote:
>>>> Hello,
>>>>
>>>> I looked in the documentation, tried some different remap configs, but
>>>> can't make it do what I want...
>>>>
>>>> I'd like to use the stats_over_http plugin, but restrict the clients
>>>> that can get to it to just a couple of addresses. Is that possible?
>>>> What
>>>> is the best way to that?
>>>>
>>> No way at this point.
>> -snip-
>>
>> What's about the doc reference to rules like:
>>
>> map http://localhost/stat/ http://{stat}
>>
>> as seen in
>> https://cwiki.apache.org/TS/faq.html#FAQ-httpui
>>
>
> I don't think that will work, since this is a server intercept plugin
> (and therefore, doesn't require a remap). You can try it, and see what
> happens.
>
I tried a couple of variations like that, and couldn't make it work. I
really just need a simple client IP address check, so, I think I'm just
going to reuse some of the code from the redirect-1 plugin sample, like
in the diff below.
Leif: your config suggestions with the X-TS-Stats-Auth* header seem
pretty cool to me, but, like I said - I just need a quick IP check for
now, and I would think the below is a safe and simple hack?
Rgds,
JvD
--
diff:
36,45d35
< #if !defined (_WIN32)
< # include <unistd.h>
< # include <netinet/in.h>
< # include <arpa/inet.h>
< #else
< # include <windows.h>
< #endif
<
< static char *allow_ip;
<
238,261d227
< const struct sockaddr *addr = TSHttpTxnClientAddrGet(txnp);
<
< if (addr) {
< socklen_t addr_size = 0;
<
< if (addr->sa_family == AF_INET)
< addr_size = sizeof(struct sockaddr_in);
< else if (addr->sa_family == AF_INET6)
< addr_size = sizeof(struct sockaddr_in6);
< if (addr_size > 0) {
< char clientstring[INET6_ADDRSTRLEN];
<
< /* there's gotta be a better way than strcmp... Should really
be a addres/mask check thing. */
< if (NULL != inet_ntop(addr->sa_family, &(((struct sockaddr_in
*)addr)->sin_addr), clientstring, addr_size) &&
< !strcmp(allow_ip, clientstring) ) {
< TSDebug("istats", "clientip is %s --> PASS", clientstring);
< }
< else {
< TSDebug("istats", "clientip is %s --> FAIL", clientstring);
< goto notforme;
< }
< }
< }
<
329,332d294
< if (argc == 2)
< allow_ip = TSstrdup(argv[1]);
<
Re: Restricting access to stats_over_http?
Posted by Leif Hedstrom <zw...@apache.org>.
On 5/1/12 5:29 PM, tom ryan wrote:
>>> Hello,
>>>
>>> I looked in the documentation, tried some different remap configs, but
>>> can't make it do what I want...
>>>
>>> I'd like to use the stats_over_http plugin, but restrict the clients
>>> that can get to it to just a couple of addresses. Is that possible? What
>>> is the best way to that?
>>>
>> No way at this point.
> -snip-
>
> What's about the doc reference to rules like:
>
> map http://localhost/stat/ http://{stat}
>
> as seen in
> https://cwiki.apache.org/TS/faq.html#FAQ-httpui
>
I don't think that will work, since this is a server intercept plugin (and
therefore, doesn't require a remap). You can try it, and see what happens.
-- Leif
Re: Restricting access to stats_over_http?
Posted by tom ryan <to...@gmail.com>.
>> Hello,
>>
>> I looked in the documentation, tried some different remap configs, but
>> can't make it do what I want...
>>
>> I'd like to use the stats_over_http plugin, but restrict the clients
>> that can get to it to just a couple of addresses. Is that possible? What
>> is the best way to that?
>>
>
> No way at this point.
-snip-
What's about the doc reference to rules like:
map http://localhost/stat/ http://{stat}
as seen in
https://cwiki.apache.org/TS/faq.html#FAQ-httpui
?
Re: Restricting access to stats_over_http?
Posted by Leif Hedstrom <zw...@apache.org>.
On 5/1/12 3:35 PM, Van Doorn, Jan R wrote:
> Hello,
>
> I looked in the documentation, tried some different remap configs, but
> can't make it do what I want...
>
> I'd like to use the stats_over_http plugin, but restrict the clients
> that can get to it to just a couple of addresses. Is that possible? What
> is the best way to that?
>
No way at this point. I was thinking of adding a small config to this
plugin, which could allow for various levels of strength:
/__stats X-TS-Stats-Auth Secret
or (stronger)
/__stats X-TS-Stats-Auth-IP Secret
Where the header value is some cryptographic checksum of secret + client IP
(making replay attacks much harder). E.g. SHA1(secret+client-ip).
In the first case, the request would simply include e.g.
X-TS-Stats-Auth: A-Secret-String
and in the second, e.g.
X-TS-Stats-Auth-IP: abfd6a4da7ae42a126e915b55395838f7fe5efe2
The other option is to do some real authentication mechanisms around this,
but the above would be pretty close to trivial to implement (i.e. a few
hours at the most). Also, if done over HTTPS, it'd be difficult to intercept
even the simple, token secret (and, you can pick a path and header of your
own choosing to do more security by obscurity :).
Thoughts?
-- Leif