Oggolow xiriirka TLS passthrough ee macnaha stream ee NGINX

NGINX waxay diidi kartaa gudbinta TCP TLS iyada oo aan TLS dhamaysan. Ku dheji qaanuunka fasaxa stream, ma aha HTTP location, oo hubi ciwaanka peer ee yimaada.

Gudbinta bytes sir ah iyada oo aan waligeed la hayn shahaadada waa waxa sameeya TLS passthrough relay, nidaamkana waa mid ku habboon oo xoogaa jahawareer ah isla waqti. Maaddaama aan waxba la furin, ma jiro wax qaab HTTP ah oo la shaandheeyo, sidaas darteed block location caadiga ah iyo qaanuunka gelitaanka wax faa’iido ah kuma laha halkan. Go’aanka NGINX haysato wuxuu khuseeyaa xiriirka laftiisa: peer-ka shabakadee ayaa garaacay, iyo in peer-kaas gudbin la sameeyo.

Go’aanku wuxuu ku jiraa stream, ma aha HTTP

Macnaha stream NGINX waxay la shaqaysaa fadhiyada TCP. Waxay aragtaa ciwaanka peer ee xiriirka oo waxay ku dabaqi kartaa qaanuunno allow iyo deny oo habaysan ka hor inta aan byte uun gaarin backend. Kani waa go’aan gelitaan buuxa oo uma baahna fure gaar ah, shahaado ama falanqayn HTTP.

MechanismWhat it decidesWhere it lives
stream allow/denyWhether this TCP peer is relayedstream server block
ssl_preread mapWhich backend a named connection goes tostream, with the preread module
HTTP location ruleWhether an HTTP request is servedhttp server block

Saddexdaas saf ma beddelaan midba midka kale. Koobista tilmaanta gelitaanka HTTP fayl kasta oo xuso dekedda 443 waxba ma beddelo, sababtoo ah server-ka stream waligiis ma akhriyo macnaha http.

Aqbal xiriirka ka hor inta aad gudbin

Ka fikiri rakibaad jira oo leh modules stream iyo stream-access, macaamiisha VPN oo haysta ciwaannada isha 10.90.0.0/24, iyo backend ku yaal 192.168.50.20:443 oo horey u bixiya aqoonsiga HTTPS ee la doonayo.

stream {
    server {
        listen 443;

        allow 10.90.0.0/24;
        deny all;

        proxy_pass 192.168.50.20:443;
    }
}

U akhri tan qayb ka mid ah listener cusub, ma aha beddelka tooska ah ee qaabeynta shaqaynaysa. Marka hore dib u eeg listeners iyo include ee jira, sababtoo ah listener labaad oo ku yaal deked horey loo qabsaday wuu guuldareystaa reload, ma aha waqtiga codsiga.

Ogeysii waxa maqan: ma jiro listen ... ssl, ma jiro tilmaan shahaado. NGINX waxay gudbisaa qulqulka sir ah, backend-na wuxuu dhammeeyaa TLS oo soo bandhigaa shahaadada macmiilku xaqiijiyo. Macmiil ku guuldareysta allowlist waxaa laga diidayaa fadhigiisa TCP, ma aha bog HTTP 403, qalab kasta oo filaya koodh xaalad wuxuu soo sheegayaa wax aan faa’iido lahayn.

Waxa allowlist daboolto iyo waxa aanay daboolin

Haddii relay horey u doorto backend-yada magaca server-ka, ssl_preread iyo map waxay sii wadi karaan shaqaas, haddii module-ku diyaar yahay. Magaca wali macmiilka ayaa bixiya, waxna ku saabsan soo bandhigista magac ma caddeeyo in macmiilku ku biiray VPN.

Qaanuunka tusaalaha wuxuu daboolaa listener-ka stream oo dhan. Taas waxay ka dhigtaa mid aan ku habboonayn hal barta gelitaan oo u adeegta isku darka site-yada dadweynaha iyo site-yada VPN-kaliya, halkaas oo laga doonayo ka-reebis magac kasta; listeners gooni ah ayaa caadi ahaan ka cad siyaasad ku tiirsan magac oo aan cidna akhrin karin.

Laba meelood oo kale ayaa mudan in la xuso. Isku mid ahaanshaha prefix waxba ma sheegto ku saabsan interface-ka packet-ku ka yimid, qaanuun HTTP meel kale ma xaddidi karo listener-kan. Labaduba waa sababaha lagu hayo siyaasadda gelitaanka heer host sawirka halkii loo tixgelin lahaa hal saf allow oo ah xadka oo dhan. Qor xadka laba kontorool oo waa inay is waafaqaan, si isbeddel ku yimaada mid kasta laga dib u eego.

NGINX yaa ciwaankiisa run ahaan arka?

Isku-dheellitirka culeyska, proxy kale ama source NAT waxay NGINX hortiisa dhigi karaan dhexdhexaadiye, sidaas darteed peer-ka la arko ma aha ciwaanka gudaha ee macmiilka VPN. Baadh jidka dhabta ah ka hor inta aad dooran prefix, sababtoo ah allowlist loo qoray ciwaanka khaldan ama wuxuu ogolaanayaa qof kasta oo ka dambeeya turjumaanka ama qofna.

Borotokoolka PROXY iyo maaraynta IP dhabta ah waa jawaabo sharci ah, waana in loo habeeyaa kaliya diridayaal is waafaqsan oo si cad loo aamini karo. Labada habba waxay aaminsan yihiin waxa diriduhu sheego, taasina waa sababta liiska diridayaashu u yahay mid gaaban. Aaminaadda cinwaanka aqoonsiga ee macmiil internet kasta ma samayso macluumaadka isha mid mar kale la aamini karo; waxay u beddelaysaa diidmo sax ah aqbal been abuur ah.

Tijaabi labada natiijo ka hor reload

Xaqiiji qaabeynta, samee reload, ka dibna laba jeer tijaabi: fadhi cusub oo la ogolaaday oo waa inuu shaqeeyaa, iyo mid la diiday oo aanay ahayn inuu shaqeeyo. Hayso xaqiijinta shahaadada backend caadiga ah tijaabada la ogolaaday, sababtoo ah relay isku xira laakiin aan xaqiijin karin backend wuxuu xalliyay hal dhibaato oo abuuray mid kale.

nginx -t
ss -tnp | grep ':443'

Sidoo kale si gooni ah u hubi jidka backend-ka iyo jawaabta. Dhaafista allowlist waxay caddaynaysaa kaliya in NGINX uu aqbalay fadhiga; ma qasbi karo backend aan la gaari karin inuu jawaabo, mana hagaajin karo jidka soo noqodka oo maqnaa ka hor inta aadan bilaabin.

Maqaallo la xiriira