如何自动确定Kubernetes中运行的ASP.NET核心应用程序的KnownNetworks(使用集群内反向代理)?

hof1towb  于 2022-11-21  发布在  Kubernetes
关注(0)|答案(1)|浏览(188)

我在Kubernetes中运行一个ASP.NET核心API,它位于发送X-Forwarded-ForX-Forwarded-ProtoX-Forwarded-Host头的反向代理后面。
我发现我需要使用UseForwardedHeaders()来接受来自代理的值,因此我编写了以下代码:

var forwardedOptions = new ForwardedHeadersOptions()
{
    ForwardedHeaders = Microsoft.AspNetCore.HttpOverrides.ForwardedHeaders.All
};
forwardedOptions.KnownNetworks.Add(new IPNetwork(IPAddress.Parse(configuration["network:address"]), int.Parse(configuration["network:cidrMask"])));
app.UseForwardedHeaders(forwardedOptions);

我在Kubernetes中运行我的API和反向代理,并且API只在集群中可见。因此,我不担心集群网络中的某个人欺骗报头。我想做的是自动检测集群的内部子网,并将其添加到KnownNetworks列表中。这可能吗?如果可以,怎么做?

jgwigjjp

jgwigjjp1#

我 创建 了 一 种 方法 , 用于 计算 范围 的 起始 值 和 每个 活动 接口 的 CIDR 子网 掩码 :

private static IEnumerable<IPNetwork> GetNetworks(NetworkInterfaceType type)
{

    foreach (var item in NetworkInterface.GetAllNetworkInterfaces()
        .Where(n => n.NetworkInterfaceType == type && n.OperationalStatus == OperationalStatus.Up)  // get all operational networks of a given type
        .Select(n => n.GetIPProperties())   // get the IPs
        .Where(n => n.GatewayAddresses.Any())) // where the IPs have a gateway defined
    {
        var ipInfo = item.UnicastAddresses.FirstOrDefault(i => i.Address.AddressFamily == System.Net.Sockets.AddressFamily.InterNetwork); // get the first cluster-facing IP address
        if (ipInfo == null) { continue; }

        // convert the mask to bits
        var maskBytes = ipInfo.IPv4Mask.GetAddressBytes();
        if (!BitConverter.IsLittleEndian)
        {
            Array.Reverse(maskBytes);
        }
        var maskBits = new BitArray(maskBytes);

        // count the number of "true" bits to get the CIDR mask
        var cidrMask = maskBits.Cast<bool>().Count(b => b); 

        // convert my application's ip address to bits
        var ipBytes = ipInfo.Address.GetAddressBytes();
        if (!BitConverter.IsLittleEndian)
        {
            Array.Reverse(maskBytes);
        }
        var ipBits = new BitArray(ipBytes);

        // and the bits with the mask to get the start of the range
        var maskedBits = ipBits.And(maskBits);

        // Convert the masked IP back into an IP address
        var maskedIpBytes = new byte[4];
        maskedBits.CopyTo(maskedIpBytes, 0);
        if (!BitConverter.IsLittleEndian)
        {
            Array.Reverse(maskedIpBytes);
        }
        var rangeStartIp = new IPAddress(maskedIpBytes);

        // return the start IP and CIDR mask
        yield return new IPNetwork(rangeStartIp, cidrMask);
    }
}

中 的 每 一 个
示例 :

  • 192.168.1.33 with mask 255.255.255.252 returns 192.168.1.32/30
  • 10.50.28.77 with mask 255.252.0.0 returns 10.50.0.0/14

然后 , 我 将 选项 代码 更改 为 如下 所 示 :

var forwardedOptions = new ForwardedHeadersOptions()
{
    ForwardedHeaders = Microsoft.AspNetCore.HttpOverrides.ForwardedHeaders.All
};
foreach (var network in GetNetworks(NetworkInterfaceType.Ethernet))
{
    forwardedOptions.KnownNetworks.Add(network);
}
app.UseForwardedHeaders(forwardedOptions);

格式

相关问题