Skip to content

Commit 5df9abe

Browse files
mickael-garridomickael-garrido
committed
fix: for SCAR
1 parent 0a78dd5 commit 5df9abe

File tree

4 files changed

+123
-39
lines changed

4 files changed

+123
-39
lines changed

‎Dockerfile.openresty‎

Lines changed: 22 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -6,32 +6,37 @@ ARG NGX_HTTP_PROXY_CONNECT_MODULE_VERSION=0.0.7
66
ARG OPENRESTY_VERSION=1.27.1.2
77
ARG PATCH_VERSION=proxy_connect_rewrite_102101.patch
88

9+
ARG OPENRESTY_HASH=74f076f7e364b2a99a6c5f9bb531c27610c78985abe956b442b192a2295f7548
10+
ARG NGX_HTTP_PROXY_CONNECT_MODULE_HASH=b1502309b0afc3e24bdfb02aa8e7028014d06f3f4e3c99a4a867de81d9c0e47d
11+
912
RUN apk add --no-cache --update --virtual .build-deps gcc libc-dev make openssl-dev pcre-dev zlib-dev linux-headers patch curl git perl \
1013
&& curl -fSL https://github.com/chobits/ngx_http_proxy_connect_module/archive/refs/tags/v${NGX_HTTP_PROXY_CONNECT_MODULE_VERSION}.tar.gz -o ngx_http_proxy_connect_module.tar.gz \
14+
&& (echo "${NGX_HTTP_PROXY_CONNECT_MODULE_HASH} ngx_http_proxy_connect_module.tar.gz" | sha256sum -c -s) \
1115
&& mkdir -p /usr/src \
1216
&& tar zxC /usr/src/ -f ngx_http_proxy_connect_module.tar.gz \
1317
&& curl -fSL https://openresty.org/download/openresty-${OPENRESTY_VERSION}.tar.gz -o openresty.tar.gz \
18+
&& (echo "${OPENRESTY_HASH} openresty.tar.gz" | sha256sum -c -s) \
1419
&& tar zxC /usr/src/ -f openresty.tar.gz \
1520
&& patch -d /usr/src/openresty-${OPENRESTY_VERSION}/bundle/nginx-${OPENRESTY_VERSION%.*}/ -p 1 < /usr/src/ngx_http_proxy_connect_module-${NGX_HTTP_PROXY_CONNECT_MODULE_VERSION}/patch/${PATCH_VERSION} \
1621
&& cd /usr/src/openresty-${OPENRESTY_VERSION} \
1722
&& ./configure --prefix=/opt/openresty \
18-
--without-http_ssi_module \
19-
--without-http_userid_module \
20-
--without-mail_pop3_module \
21-
--without-mail_imap_module \
22-
--without-mail_smtp_module \
23-
--with-http_sub_module \
24-
--with-http_ssl_module \
25-
--with-http_v2_module \
26-
--with-http_gzip_static_module \
27-
--with-http_gunzip_module \
28-
--with-http_realip_module \
29-
--with-http_stub_status_module \
30-
--with-select_module \
31-
--with-poll_module \
32-
--with-file-aio \
33-
--with-pcre-jit \
34-
--add-module=/usr/src/ngx_http_proxy_connect_module-${NGX_HTTP_PROXY_CONNECT_MODULE_VERSION} \
23+
--without-http_ssi_module \
24+
--without-http_userid_module \
25+
--without-mail_pop3_module \
26+
--without-mail_imap_module \
27+
--without-mail_smtp_module \
28+
--with-http_sub_module \
29+
--with-http_ssl_module \
30+
--with-http_v2_module \
31+
--with-http_gzip_static_module \
32+
--with-http_gunzip_module \
33+
--with-http_realip_module \
34+
--with-http_stub_status_module \
35+
--with-select_module \
36+
--with-poll_module \
37+
--with-file-aio \
38+
--with-pcre-jit \
39+
--add-module=/usr/src/ngx_http_proxy_connect_module-${NGX_HTTP_PROXY_CONNECT_MODULE_VERSION} \
3540
&& make install \
3641
&& strip /opt/openresty/nginx/sbin/nginx \
3742
&& ln -sf /dev/stdout /opt/openresty/nginx/logs/access.log \

‎nginx.conf‎

Lines changed: 16 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,9 @@ http {
2424
scgi_temp_path "/opt/openresty/nginx/tmp/scgi" 1 2;
2525
uwsgi_temp_path "/opt/openresty/nginx/tmp/uwsgi" 1 2;
2626

27+
server_tokens off;
28+
more_clear_headers Server;
29+
2730
# Use a debug-oriented logging format.
2831
log_format debugging escape=json
2932
'{'
@@ -135,20 +138,6 @@ http {
135138
default "$connect_addr"; # $connect_addr is 'IP address and port of the remote host, e.g. "192.168.1.5:12345". IP address is resolved from host name of CONNECT request line.'
136139
}
137140

138-
139-
# These maps parse the original Host and URI from a /forcecache redirect.
140-
map $request_uri $realHost {
141-
~/forcecacheinsecure/([^:/]+)/originalwas(/.+) $1;
142-
~/forcecachesecure/([^:/]+)/originalwas(/.+) $1;
143-
default "DID_NOT_MATCH_HOST";
144-
}
145-
146-
map $request_uri $realPath {
147-
~/forcecacheinsecure/([^:/]+)/originalwas(/.+) $2;
148-
~/forcecachesecure/([^:/]+)/originalwas(/.+) $2;
149-
default "DID_NOT_MATCH_PATH";
150-
}
151-
152141
map $interceptedHost $loggable {
153142
default 1;
154143
127.0.0.1:8443 0;
@@ -181,10 +170,9 @@ http {
181170

182171
include /opt/openresty/nginx/conf/forbid_unknown_registries.conf;
183172

184-
# forward proxy for non-CONNECT request
173+
# Unauthorized
185174
location / {
186-
add_header "Content-type" "text/plain" always;
187-
return 200 "docker-registry-proxy: The docker caching proxy is working!";
175+
return 401;
188176
}
189177
} # end server
190178

@@ -255,14 +243,16 @@ http {
255243
}
256244

257245
# For blob requests by digest, do cache, and treat redirects.
258-
location ~ ^/v2/(.*)/blobs/sha256:(.*) {
246+
#location ~ ^/v2/(.*)/blobs/sha256:(.*) {
247+
location ~ ^/v2/([\w\-]+(?:(?:\/[\w\-]+)+|(?:[\w\-]+)+))/blobs/sha256:([0-9a-f]+) {
259248
set $docker_proxy_request_type "blob-by-digest";
260249
include "/opt/openresty/nginx/conf/nginx.manifest.common.conf";
261250
}
262251

263252
# For manifest requests by digest, do cache, and treat redirects.
264253
# These are some of the requests that DockerHub will throttle.
265-
location ~ ^/v2/(.*)/manifests/sha256:(.*) {
254+
#location ~ ^/v2/(.*)/manifests/sha256:([0-9a-f])*(.*) {
255+
location ~ ^/v2/([\w\-]+(?:(?:\/[\w\-]+)+|(?:[\w\-]+)+))/manifests/sha256:([0-9a-f]+) {
266256
set $docker_proxy_request_type "manifest-by-digest";
267257
include "/opt/openresty/nginx/conf/nginx.manifest.common.conf";
268258
}
@@ -274,7 +264,7 @@ http {
274264

275265
# Cache blobs requests that are not by digest
276266
# Since these are mutable, we invalidate them immediately and keep them only in case the backend is down
277-
location ~ ^/v2/(.*)/blobs/ {
267+
location ~ ^/v2/([\w\-]+(?:(?:\/[\w\-]+)+|(?:[\w\-]+)+))/blobs/ {
278268
set $docker_proxy_request_type "blob-mutable";
279269
proxy_cache_valid 0s;
280270
include "/opt/openresty/nginx/conf/nginx.manifest.stale.conf";
@@ -305,11 +295,15 @@ http {
305295
proxy_cache_key $original_uri;
306296
}
307297

308-
# by default, dont cache anything.
309-
location / {
298+
location ~ ^\/v2(\/|\/_catalog)?$ {
310299
# nosemgrep
311300
proxy_pass $targetScheme://$targetHost;
312301
proxy_cache off;
313302
}
303+
304+
location / {
305+
add_header "Content-type" "text/plain" always;
306+
return 406 "docker-registry-proxy: request not acceptable!";
307+
}
314308
}
315309
}

‎tests/docker_test.sh‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,27 @@
11
#!/usr/bin/env bash
22

3+
function test_failed_docker_login_with_wrong_creds() {
4+
function foo() {
5+
return 0
6+
}
7+
8+
# nosemgrep
9+
docker login my-registry.local:443 -u test -p test
10+
11+
assert_unsuccessful_code
12+
}
13+
14+
function test_success_docker_login() {
15+
function foo() {
16+
return 0
17+
}
18+
19+
# nosemgrep
20+
docker login my-registry.local:443 -u user1 -p password1
21+
22+
assert_successful_code
23+
}
24+
325
function test_success_docker_debian_pull() {
426
function foo() {
527
return 0
@@ -65,6 +87,7 @@ function test_failed_curl_request_to_unknwon_registry_through_proxy() {
6587
return 0
6688
}
6789

90+
# nosemgrep
6891
assert_equals "403" "$(curl -I -x https://user1:password1@my-proxy.local:3128 https://my-registry-x.local:443/v2/_catalog 2> /dev/null | head -n 1 | cut -d' ' -f2)"
6992
}
7093

@@ -73,6 +96,7 @@ function test_failed_curl_request_to_proxy_without_user() {
7396
return 0
7497
}
7598

99+
# nosemgrep
76100
assert_equals "407" "$(curl -I -x https://my-proxy.local:3128 https://my-registry.local:443/v2/_catalog 2> /dev/null | head -n 1 | cut -d' ' -f2)"
77101
}
78102

@@ -81,5 +105,52 @@ function test_failed_curl_request_to_proxy_with_wrong_creds() {
81105
return 0
82106
}
83107

108+
# nosemgrep
84109
assert_equals "401" "$(curl -I -x https://user1:dummy@my-proxy.local:3128 https://my-registry.local:443/v2/_catalog 2> /dev/null | head -n 1 | cut -d' ' -f2)"
85110
}
111+
112+
function test_failed_curl_request_to_proxy_without_tls() {
113+
function foo() {
114+
return 0
115+
}
116+
117+
# nosemgrep
118+
assert_equals "400" "$(curl -I -x http://user1:dummy@my-proxy.local:3128 https://my-registry.local:443/v2/_catalog 2> /dev/null | head -n 1 | cut -d' ' -f2)"
119+
}
120+
121+
function test_failed_curl_request_to_registry_for_unauthorized_uri() {
122+
function foo() {
123+
return 0
124+
}
125+
126+
# nosemgrep
127+
assert_equals "406" "$(curl -s -w "%{http_code}\n" -o /dev/null -x https://user1:password1@my-proxy.local:3128 https://my-registry.local:443/test)"
128+
}
129+
130+
function test_failed_curl_request_to_registry_v1() {
131+
function foo() {
132+
return 0
133+
}
134+
135+
# nosemgrep
136+
assert_equals "405" "$(curl -s -w "%{http_code}\n" -o /dev/null -x https://user1:password1@my-proxy.local:3128 https://my-registry.local:443/v1)"
137+
}
138+
139+
function test_success_curl_request_to_registry_v2_catalog() {
140+
function foo() {
141+
return 0
142+
}
143+
144+
# nosemgrep
145+
assert_equals "200" "$(curl -u 'user1:password1' -s -w "%{http_code}\n" -o /dev/null -x https://user1:password1@my-proxy.local:3128 https://my-registry.local:443/v2/_catalog)"
146+
}
147+
148+
function test_success_docker_logout() {
149+
function foo() {
150+
return 0
151+
}
152+
153+
docker logout my-registry.local:443
154+
155+
assert_successful_code
156+
}

‎tests/vagrant-deploy.sh‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
# Vars
44
CERTS_PATH="/root/certs"
5+
HTPASSWD_PATH="/root/htpasswd"
56
DOCKER_PATH="/var/lib/docker"
67
DOCKER_MIRROR_CACHE_PATH="/docker_mirror_cache"
78

@@ -23,6 +24,13 @@ apt-get install -y docker.io docker-compose docker-buildx apache2-utils
2324
systemctl is-active --quiet docker || systemctl enable docker
2425
systemctl is-active --quiet docker || systemctl start docker
2526

27+
if [ ! -f ${HTPASSWD_PATH}/htpasswd ]; then
28+
# Generate htpasswd for local registry
29+
mkdir -p ${HTPASSWD_PATH}
30+
# nosemgrep
31+
htpasswd -bnB user1 password1 > ${HTPASSWD_PATH}/htpasswd
32+
fi
33+
2634
if [ ! -f ${CERTS_PATH}/custom_ca.key ]; then
2735
# Generate certificates
2836
mkdir -p ${CERTS_PATH}
@@ -70,11 +78,16 @@ docker network inspect registry >/dev/null 2>&1 || docker network create registr
7078
if [ ! "$(docker ps -a -q -f name=my-registry)" ]; then
7179
docker run -dit --name my-registry \
7280
--hostname my-registry.local \
81+
--restart always \
7382
-v ${CERTS_PATH}:/certs \
7483
-v ${DOCKER_MIRROR_CACHE_PATH}/docker-registry:/var/lib/registry \
84+
-v ${HTPASSWD_PATH}/htpasswd:/auth/htpasswd \
7585
-e REGISTRY_HTTP_ADDR=0.0.0.0:443 \
7686
-e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/server.crt \
7787
-e REGISTRY_HTTP_TLS_KEY=/certs/server.key \
88+
-e REGISTRY_AUTH=htpasswd \
89+
-e REGISTRY_AUTH_HTPASSWD_REALM="Registry Realm" \
90+
-e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
7891
--network registry \
7992
registry:2
8093
fi
@@ -85,6 +98,7 @@ if [ ! "$(docker ps -a -q -f name=openresty_docker_registry_proxy)" ]; then
8598
chown 1001:1001 ${DOCKER_MIRROR_CACHE_PATH}/docker-cache/
8699
chown 1001:1001 ${CERTS_PATH}/*server.{crt,key}
87100
docker run -dit --name openresty_docker_registry_proxy \
101+
--restart always \
88102
-p 3128:3128 \
89103
-v ${DOCKER_MIRROR_CACHE_PATH}/docker-cache/:/docker_mirror_cache \
90104
-v ${CERTS_PATH}:/certs \

0 commit comments

Comments
 (0)