You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by "markokocic (via GitHub)" <gi...@apache.org> on 2023/10/05 09:17:03 UTC
[I] Accessing upstream using a http or https proxy [apisix]
markokocic opened a new issue, #10292:
URL: https://github.com/apache/apisix/issues/10292
### Description
In many cases, where Apisix is running behind a corporate firewall, the only way to access some external or internal endpoints is through a http or https_proxy or sockes_proxy. Is it / how it is possible to define a proxy for an upsteam?
- `http_proxy`, `https_proxy`, `sockes_proxy`, `all_proxy` and `no_proxy` environment variables are ignored
- there's no proxy configuration option in `upstream`
- I couldn't found any documentation related to setting proxy, only in open_id_plugin, but looks like it's the only place
How are you dealing with proxies?
Could some documentation be added on the topic?
### Environment
- APISIX 3.5 Docker
- Operating system Windows and Linux
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Accessing upstream using a http or https proxy [apisix]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #10292:
URL: https://github.com/apache/apisix/issues/10292#issuecomment-2585190500
This issue has been marked as stale due to 350 days of inactivity. It will be closed in 2 weeks if no further activity occurs. If this issue is still relevant, please simply write any comment. Even if closed, you can still revive the issue at any time or discuss it on the dev@apisix.apache.org list. Thank you for your contributions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Accessing upstream using a http or https proxy [apisix]
Posted by "markokocic (via GitHub)" <gi...@apache.org>.
markokocic commented on issue #10292:
URL: https://github.com/apache/apisix/issues/10292#issuecomment-1750470172
> Depending on what you're using as the proxy server, you'll have to configure both apisix and proxy server.
There's nothing to configure on the proxy server. It's the same standard regular http proxy server that you put in your browser network setting to connect to the internet, or in a `http_proxy` and `https_proxy` environment variables in a Linux shell, so that `curl`, `wget` and other utilities can pick it up. Apisix/Nginx doesn't pick the environment variables and doesn't provide a way to configure `http_proxy` for accessing network. Or at least I couldn't find it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Accessing upstream using a http or https proxy [apisix]
Posted by "markokocic (via GitHub)" <gi...@apache.org>.
markokocic commented on issue #10292:
URL: https://github.com/apache/apisix/issues/10292#issuecomment-1755722607
I found that `openid-connect` plugin has configurable `proxy_opts` to access OpenID server through http_proxy.
https://apisix.apache.org/docs/apisix/plugins/openid-connect/
That's exactly what we would need for `upstream` to allow us to configure upstreams that are only accessible through proxy.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Accessing upstream using a http or https proxy [apisix]
Posted by "oyiadin (via GitHub)" <gi...@apache.org>.
oyiadin commented on issue #10292:
URL: https://github.com/apache/apisix/issues/10292#issuecomment-1763107385
When it comes to `http_proxy`, you can configure APISIX as follows: create an upstream with `pass_host="pass"` and set `nodes[].host` to your proxy's IP address. The HTTP proxy server could just handle it well.
As for `https_proxy`, please note that APISIX (which is essentially based on Nginx) doesn't support forwarding the HTTP CONNECT method. So achieving this functionality might require modifying the code of APISIX, and potentially even Nginx itself.
It's important to understand that `proxy_opts` controls the request sent by lua codes of `openid-connect`, rather than the "forwarded request" sent by Nginx to the upstream. The reason the former can be controlled is that it's constructed and sent from Lua code. However, the latter is constructed and sent from the original Nginx code, and there are no any related parameters available for it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Accessing upstream using a http or https proxy [apisix]
Posted by "markokocic (via GitHub)" <gi...@apache.org>.
markokocic commented on issue #10292:
URL: https://github.com/apache/apisix/issues/10292#issuecomment-1764309421
Ok, since APISIX upstreams relies on Nginx, looks like it will never support `https_proxy`, since Nginx doesn't have any plans to add it.
The only solution so far that I found working is to use an external relay application like **redsocks** that will intercept outgoing https requests and forward them to the actual HTTP CONNECT proxy. That redirection can be set up on Linux level using `iptables`.
I used https://github.com/ncarlier/dockerfiles/tree/master/redsocks as a starting point to implement proxying upstreams.
Maybe it would be good to update `upstream` documentation to explicitly mention that proxies are not supported, and a possible workaround.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Accessing upstream using a http or https proxy [apisix]
Posted by "markokocic (via GitHub)" <gi...@apache.org>.
markokocic commented on issue #10292:
URL: https://github.com/apache/apisix/issues/10292#issuecomment-6414768280
This still stays an Apisix limitation.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Accessing upstream using a http or https proxy [apisix]
Posted by "wojja (via GitHub)" <gi...@apache.org>.
wojja commented on issue #10292:
URL: https://github.com/apache/apisix/issues/10292#issuecomment-1911844331
I also stumbled accross this problem. I would actually be fine to use `http_proxy`.
@oyiadin could you please elobarate on your suggestion?
> When it comes to http_proxy, you can configure APISIX as follows: create an upstream with pass_host="pass" and set nodes[].host to your proxy's IP address. The HTTP proxy server could just handle it well.
I do not really unterstand how this is supposed to work. If I set up a route and upstream in `apisix.yaml` like this, how does the HTTP proxy knows that it should forward the request to https://apisix.apache.org?
```
routes:
-
uri: "/apisix"
upstream_id: 1
upstreams:
-
id: 1
nodes:
"company.proxy": 1
scheme: "http"
pass_host: "pass"
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Accessing upstream using a http or https proxy [apisix]
Posted by "abhishekb91 (via GitHub)" <gi...@apache.org>.
abhishekb91 commented on issue #10292:
URL: https://github.com/apache/apisix/issues/10292#issuecomment-3458133954
Is there a recommended solution for this scenario? We have a similar setup where the API gateway is deployed within a closed network, and all public internet traffic must be routed through a proxy server.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Accessing upstream using a http or https proxy [apisix]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #10292:
URL: https://github.com/apache/apisix/issues/10292#issuecomment-6414282262
This issue has been marked as stale due to 350 days of inactivity. It will be closed in 2 weeks if no further activity occurs. If this issue is still relevant, please simply write any comment. Even if closed, you can still revive the issue at any time or discuss it on the dev@apisix.apache.org list. Thank you for your contributions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Accessing upstream using a http or https proxy [apisix]
Posted by "Revolyssup (via GitHub)" <gi...@apache.org>.
Revolyssup commented on issue #10292:
URL: https://github.com/apache/apisix/issues/10292#issuecomment-1750453077
Well if some traffic comes and goes through the proxy server, then the proxy server will act as the upstream and client for apisix for that traffic. Depending on what you're using as the proxy server, you'll have to configure both apisix and proxy server. In your case, what are you using as proxy server?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Accessing upstream using a http or https proxy [apisix]
Posted by "markokocic (via GitHub)" <gi...@apache.org>.
markokocic commented on issue #10292:
URL: https://github.com/apache/apisix/issues/10292#issuecomment-3458172926
Apisix as it is today is just not capable to be used in such scenario. I don't have a solution for this, only workarounds which are not generally shareable.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Accessing upstream using a http or https proxy [apisix]
Posted by "markokocic (via GitHub)" <gi...@apache.org>.
markokocic commented on issue #10292:
URL: https://github.com/apache/apisix/issues/10292#issuecomment-2585261290
SSH also doesn't support proxies natively, but it can use external programs like socat, netcat, nc and similar to establish connection using the ProxyCommand option or config parameter.
Providing a similarly convenient way for Apisix would make this problem solved. For example proxy_command parameter to upstream that would do tunneling in a similar way as SSH.
As a reference, here's how SSH does it https://unix.stackexchange.com/questions/68826/connecting-to-host-by-ssh-client-in-linux-by-proxy#68842
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org