You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by GitBox <gi...@apache.org> on 2022/03/08 02:49:38 UTC
[GitHub] [apisix] kingmouse-yx opened a new issue #6537: bug: The function of ip-restriction is contrary
kingmouse-yx opened a new issue #6537:
URL: https://github.com/apache/apisix/issues/6537
### Issue description
when I test the white list, the routing configuration information is as follows
```json
{
"uri": "/mock/521171/aa",
"name": "API-test",
"methods": [
"POST"
],
"plugins": {
"ip-restriction": {
"disable": false,
"whitelist": [
"127.0.0.1"
]
}
},
"upstream_id": "396931816625275591",
"labels": {
"demo": "demo1"
},
"status": 1
}
```
At this point, I hope 127.0.0.1 can pass. But the actual return result is as follows.
```json
{"message":"Your IP address is not allowed"}
```
when I test the black list, the routing configuration information is as follows
```json
{
"uri": "/mock/521171/aa",
"name": "API-test",
"methods": [
"POST"
],
"plugins": {
"ip-restriction": {
"blacklist": [
"127.0.0.1"
],
"disable": false
}
},
"upstream_id": "396931816625275591",
"labels": {
"demo": "demo1"
},
"status": 1
}
```
At this point, I don't want 127.0.0.1 to pass. But the actual return result is as follows.
```json
{
"tag": {
"certStatus": "1",
"certTp": "01"
},
"data": {
"a_name": "xxx",
"a_age": "29"
},
"certId": "341126197709218366",
"userid": "xxxxxxxxxxxx01",
"realname": "test",
"caseId": "11111111999999990000009909"
}
```
This is completely contrary to my expectation
### Environment
- apisix version (cmd: `apisix version`): 2.12.1
- OS (cmd: `uname -a`): Linux node-15 3.10.0-862.51.1.el7.x86_64 #1 SMP Sun Sep 27 11:41:03 CST 2020 x86_64 x86_64 x86_64 GNU/Linux
- OpenResty / Nginx version (cmd: `nginx -V` or `openresty -V`): openresty/1.19.3.1
- etcd version, if have (cmd: run `curl http://127.0.0.1:9090/v1/server_info` to get the info from server-info API): 3.4.0
- apisix-dashboard version, if have: 2.10.1
- the plugin runner version, if the issue is about a plugin runner (cmd: depended on the kind of runner):
- luarocks version, if the issue is about installation (cmd: `luarocks --version`):
### Steps to reproduce
1.add upstream
2.add route, setting ip-restriction with whitelist or blacklist
3.access with apisix
4.Or use following cmd and access the service
### Actual result
1. The whitelist cannot be passed
2. The blacklist can be passed
### Error log
2022/03/08 02:10:02 [warn] 43#43: *160645 [lua] plugin.lua:658: run_plugin(): ip-restriction exits with http status code 403, client: 172.18.0.1, server: _, request: "POST /mock/521171/aa HTTP/1.1", host: "127.0.0.1:9080"
### Expected result
1. The blacklist cannot be passed
2. The whitelist can be passed
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] kingmouse-yx commented on issue #6537: bug: The function of ip-restriction is contrary
Posted by GitBox <gi...@apache.org>.
kingmouse-yx commented on issue #6537:
URL: https://github.com/apache/apisix/issues/6537#issuecomment-1061366703
> > > > 是直接访问Apisix，还是加代理，比如Nginx或者SLB
> > > > 参考：#4712
> > >
> > >
> > > 我直接访问 API6。
> >
> >
> > 你是如何验证的？卷曲？
>
> 是的
curl --location --request POST '127.0.0.1:9080/mock/521171/aa' --data-raw ''
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] liangliang4ward commented on issue #6537: bug: The function of ip-restriction is contrary
Posted by GitBox <gi...@apache.org>.
liangliang4ward commented on issue #6537:
URL: https://github.com/apache/apisix/issues/6537#issuecomment-1061358955
> > 是直接访问Apisix，还是加一层代理，比如Nginx或者SLB
> > 参考：#4712
>
> I access Apisix directly.
How did you verify that? curl?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] kingmouse-yx commented on issue #6537: bug: The function of ip-restriction is contrary
Posted by GitBox <gi...@apache.org>.
kingmouse-yx commented on issue #6537:
URL: https://github.com/apache/apisix/issues/6537#issuecomment-1061361931
>
yes
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] liangliang4ward commented on issue #6537: bug: The function of ip-restriction is contrary
Posted by GitBox <gi...@apache.org>.
liangliang4ward commented on issue #6537:
URL: https://github.com/apache/apisix/issues/6537#issuecomment-1061425323
>
Perhaps you can restrict the IP and use the actual Linux IP
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] liangliang4ward commented on issue #6537: bug: The function of ip-restriction is contrary
Posted by GitBox <gi...@apache.org>.
liangliang4ward commented on issue #6537:
URL: https://github.com/apache/apisix/issues/6537#issuecomment-1061373654
> > > > > > Do you access Apisix directly, or do you add a layer of proxies, such as Nginx or SLB
> > > > > > ref：#4712
> > > > >
> > > > >
> > > > > I access Apisix directly.
> > > >
> > > >
> > > > How did you verify that? curl?
> > >
> > >
> > > yes
> >
> >
> > pls show you cmd
>
> curl --location --request POST '127.0.0.1:9080/mock/521171/aa' --data-raw ''
```yaml
{
"uri": "/mock/521171/aa",
"name": "test1111",
"methods": [
"POST"
],
"plugins": {
"ip-restriction": {
"blacklist": [
"127.0.0.1"
],
"disable": false
}
},
"upstream": {
"nodes": [
{
"host": "127.0.0.1",
"port": 80,
"weight": 1
}
],
"timeout": {
"connect": 6,
"send": 6,
"read": 6
},
"type": "roundrobin",
"scheme": "http",
"pass_host": "pass",
"keepalive_pool": {
"idle_timeout": 60,
"requests": 1000,
"size": 320
}
},
"status": 1
}
```
```shell
curl --location --request POST '127.0.0.1:9080/mock/521171/aa' --data ''
```
```result
{"message":"Your IP address is not allowed"}
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] liangliang4ward commented on issue #6537: bug: The function of ip-restriction is contrary
Posted by GitBox <gi...@apache.org>.
liangliang4ward commented on issue #6537:
URL: https://github.com/apache/apisix/issues/6537#issuecomment-1061353132
Do you access Apisix directly, or do you add a layer of proxies, such as Nginx or SLB
ref: https://github.com/apache/apisix/issues/4712
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] kingmouse-yx closed issue #6537: bug: The function of ip-restriction is contrary
Posted by GitBox <gi...@apache.org>.
kingmouse-yx closed issue #6537:
URL: https://github.com/apache/apisix/issues/6537
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] kingmouse-yx commented on issue #6537: bug: The function of ip-restriction is contrary
Posted by GitBox <gi...@apache.org>.
kingmouse-yx commented on issue #6537:
URL: https://github.com/apache/apisix/issues/6537#issuecomment-1061371114
> > > > > Do you access Apisix directly, or do you add a layer of proxies, such as Nginx or SLB
> > > > > ref：#4712
> > > >
> > > >
> > > > I access Apisix directly.
> > >
> > >
> > > How did you verify that? curl?
> >
> >
> > yes
>
> pls show you cmd
curl --location --request POST '127.0.0.1:9080/mock/521171/aa' --data-raw ''
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] liangliang4ward commented on issue #6537: bug: The function of ip-restriction is contrary
Posted by GitBox <gi...@apache.org>.
liangliang4ward commented on issue #6537:
URL: https://github.com/apache/apisix/issues/6537#issuecomment-1061364011
> > > > 是直接访问Apisix，还是加代理，比如Nginx或者SLB
> > > > 参考：#4712
> > >
> > >
> > > 我直接访问 APIsix。
> >
> >
> > 你是如何验证的？卷曲？
>
> yes
pls show you cmd
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] tokers commented on issue #6537: bug: The function of ip-restriction is contrary
Posted by GitBox <gi...@apache.org>.
tokers commented on issue #6537:
URL: https://github.com/apache/apisix/issues/6537#issuecomment-1061583750
> So if I run it with docker, do I need to ref: https://github.com/apache/apisix/issues/4712?
YES.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] kingmouse-yx removed a comment on issue #6537: bug: The function of ip-restriction is contrary
Posted by GitBox <gi...@apache.org>.
kingmouse-yx removed a comment on issue #6537:
URL: https://github.com/apache/apisix/issues/6537#issuecomment-1061361931
>
yes
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] kingmouse-yx commented on issue #6537: bug: The function of ip-restriction is contrary
Posted by GitBox <gi...@apache.org>.
kingmouse-yx commented on issue #6537:
URL: https://github.com/apache/apisix/issues/6537#issuecomment-1061363541
> > > 是直接访问Apisix，还是加代理，比如Nginx或者SLB
> > > 参考：#4712
> >
> >
> > 我直接访问 APIsix。
>
> 你是如何验证的？卷曲？
yes
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] kingmouse-yx removed a comment on issue #6537: bug: The function of ip-restriction is contrary
Posted by GitBox <gi...@apache.org>.
kingmouse-yx removed a comment on issue #6537:
URL: https://github.com/apache/apisix/issues/6537#issuecomment-1061366703
> > > > 是直接访问Apisix，还是加代理，比如Nginx或者SLB
> > > > 参考：#4712
> > >
> > >
> > > 我直接访问 API6。
> >
> >
> > 你是如何验证的？卷曲？
>
> 是的
curl --location --request POST '127.0.0.1:9080/mock/521171/aa' --data-raw ''
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] kingmouse-yx commented on issue #6537: bug: The function of ip-restriction is contrary
Posted by GitBox <gi...@apache.org>.
kingmouse-yx commented on issue #6537:
URL: https://github.com/apache/apisix/issues/6537#issuecomment-1061355786
> 是直接访问Apisix，还是加一层代理，比如Nginx或者SLB
>
> 参考：#4712
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] kingmouse-yx commented on issue #6537: bug: The function of ip-restriction is contrary
Posted by GitBox <gi...@apache.org>.
kingmouse-yx commented on issue #6537:
URL: https://github.com/apache/apisix/issues/6537#issuecomment-1061356158
> 是直接访问Apisix，还是加一层代理，比如Nginx或者SLB
>
> 参考：#4712
I access Apisix directly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] kingmouse-yx commented on issue #6537: bug: The function of ip-restriction is contrary
Posted by GitBox <gi...@apache.org>.
kingmouse-yx commented on issue #6537:
URL: https://github.com/apache/apisix/issues/6537#issuecomment-1061380537
> > > > > > > Do you access Apisix directly, or do you add a layer of proxies, such as Nginx or SLB
> > > > > > > ref：#4712
> > > > > >
> > > > > >
> > > > > > I access Apisix directly.
> > > > >
> > > > >
> > > > > How did you verify that? curl?
> > > >
> > > >
> > > > yes
> > >
> > >
> > > pls show you cmd
> >
> >
> > curl --location --request POST '127.0.0.1:9080/mock/521171/aa' --data-raw ''
>
> ```yaml
> {
> "uri": "/mock/521171/aa",
> "name": "test1111",
> "methods": [
> "POST"
> ],
> "plugins": {
> "ip-restriction": {
> "blacklist": [
> "127.0.0.1"
> ],
> "disable": false
> }
> },
> "upstream": {
> "nodes": [
> {
> "host": "127.0.0.1",
> "port": 80,
> "weight": 1
> }
> ],
> "timeout": {
> "connect": 6,
> "send": 6,
> "read": 6
> },
> "type": "roundrobin",
> "scheme": "http",
> "pass_host": "pass",
> "keepalive_pool": {
> "idle_timeout": 60,
> "requests": 1000,
> "size": 320
> }
> },
> "status": 1
> }
> ```
>
> ```shell
> curl --location --request POST '127.0.0.1:9080/mock/521171/aa' --data ''
> ```
>
> ```
> {"message":"Your IP address is not allowed"}
> ```
I guess I understand.
I use docker to run apisix, when I enter the container, I find that it’s the same as my expectation.
But when I test it directly on the Linux host, it is completely contrary to my expectation.
So if I run it with docker, do I need to ref: #4712?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org