What happened? Hi! I'm trying to setup EMQX in Kubernetes, and I w

peer_cert_as_username when using proxy protocol v2 about emqx HOT 1 CLOSED

ViktorWb commented on May 23, 2024

peer_cert_as_username when using proxy protocol v2

from emqx.

Comments (1)

zmstone commented on May 23, 2024

The proxy might not be strictly following the spec?
It should send type 32 (0x20) and subtype 34(0x22)

However the raw bytes you shared has type (not subtype) 34, which is unknown to EMQX.

Tried to send the raw bytes you provided and traced the ppv2 header parse results as below

                                   {proxy_socket,inet4,#Port<0.58>,
                                    {83,251,192,246},
                                    {34,36,135,60},
                                    48046,1883,
                                    [{pp2_ssl,
                                      [{pp2_ssl_client,true},
                                       {pp2_ssl_client_cert_conn,true},
                                       {pp2_ssl_client_cert_sess,true},
                                       {pp2_ssl_verify,success}]},
                                     {{pp2_raw,33},<<"TLSv1_3">>},
                                     {{pp2_raw,34},
                                      <<"test-username-from-common-name">>},
                                     {{pp2_raw,35},
                                      <<"ECDHE-RSA-AES128-GCM-SHA256">>},
                                     {{pp2_raw,36},<<"SHA256">>},
                                     {{pp2_raw,37},<<"RSA2048">>}]}}

For compare, my test (see details at the end of this post) is traced as below:

% 08:30:44 <0.5223.0>({emqx_connection,init,4})
% esockd_proxy_protocol:parse_v2(1, 1, <<172,19,0,1,172,19,0,4,180,156,34,179,32,0,24,7,0,0,0,0,33,0,7,84,76,83,118,
  49,46,51,34,0,6,67,108,105,101,110,116>>, {proxy_socket,inet4,#Port<0.60>,undefined,undefined,undefined,undefined,[]})

% 08:30:44 <0.5223.0>({emqx_connection,init,4})
% esockd_proxy_protocol:parse_v2/4 -> {ok,
                                       {proxy_socket,inet4,#Port<0.60>,
                                        {172,19,0,1},
                                        {172,19,0,4},
                                        46236,8883,
                                        [{pp2_ssl,
                                          [{pp2_ssl_client,true},
                                           {pp2_ssl_client_cert_conn,true},
                                           {pp2_ssl_client_cert_sess,true},
                                           {pp2_ssl_verify,success},
                                           {pp2_ssl_version,<<"TLSv1.3">>},
                                           {pp2_ssl_cn,<<"Client">>}]}]}}

Tested with this script: https://github.com/emqx/emqx/blob/v5.6.0/scripts/test/start-two-nodes-in-docker.sh
and patched with:

--- a/scripts/test/start-two-nodes-in-docker.sh
+++ b/scripts/test/start-two-nodes-in-docker.sh
@@ -84,6 +84,7 @@ docker run -d -t --restart=always --name "$NODE1" \
   -e EMQX_listeners__wss__default__enable=false \
   -e EMQX_listeners__tcp__default__proxy_protocol=true \
   -e EMQX_listeners__ws__default__proxy_protocol=true \
+  -e EMQX_mqtt__peer_cert_as_username=cn \
   "$IMAGE1"

 docker run -d -t --restart=always --name "$NODE2" \
@@ -98,6 +99,7 @@ docker run -d -t --restart=always --name "$NODE2" \
   -e EMQX_listeners__wss__default__enable=false \
   -e EMQX_listeners__tcp__default__proxy_protocol=true \
   -e EMQX_listeners__ws__default__proxy_protocol=true \
+  -e EMQX_mqtt__peer_cert_as_username=cn \
   "$IMAGE2"

 mkdir -p tmp

To trace the parse functions your self:

run emqx remote_consol
in erlang console, evaluate this expression redbug:start("esockd_proxy_protocol:parse_v2 -> return",[{msgs,1000},{time,60000}]).
this will give you 60 seconds to observe the inputs and outputs of ppv2 parse function.

from emqx.

Recommend Projects