Merge lp:~vishvananda/nova/lp692317 into lp:~hudson-openstack/nova/trunk

[Vish Ishaya]

Adds a flag to use the X-Forwarded-For header to find the ip of the remote server. This is needed when you have multiple api servers with a load balancing proxy in front. It is a flag that defaults to False because if you don't have a sanitizing proxy in front, users could masquerade as other ips by passing in the header manually.

[Jay Pipes (jaypipes)]

Should this also be done for the openstack API?

review: Needs Information

[Vish Ishaya (vishvananda)]

> Should this also be done for the openstack API?

I can't see anywhere where the openstack api is using req.remote_addr. I'm assuming that it is ip agnostic. It is only used in ec2 api for metadata and logging.

[Devin Carlen (devcamcar)]

Approve, this is apparently not used by openstack API. Seems like openstack API should be making use of this but that is part of a larger problem that should be tracked elsewhere.

review: Approve

[lp:~vishvananda/nova/lp692317]

471. By Vish Ishaya on 2010-12-22

merged trunk and fixed conflicts

[Ed Leafe (ed-leafe)]

Reviewed and approved.

review: Approve

[Jesse Andrews (anotherjesse)]

lgtm - Agree with Devin.

review: Approve

=== modified file 'nova/api/ec2/__init__.py'
--- nova/api/ec2/__init__.py	2010-12-22 21:17:30 +0000
+++ nova/api/ec2/__init__.py	2010-12-22 21:54:20 +0000
@@ -37,6 +37,9 @@
 
 
 FLAGS = flags.FLAGS
+flags.DEFINE_boolean('use_forwarded_for', False,
+                     'Treat X-Forwarded-For as the canonical remote address. '
+                     'Only enable this if you have a sanitizing proxy.')
 flags.DEFINE_boolean('use_lockout', False,
                      'Whether or not to use lockout middleware.')
 flags.DEFINE_integer('lockout_attempts', 5,
@@ -144,9 +147,12 @@
             raise webob.exc.HTTPForbidden()
 
         # Authenticated!
+        remote_address = req.remote_addr
+        if FLAGS.use_forwarded_for:
+            remote_address = req.headers.get('X-Forwarded-For', remote_address)
         ctxt = context.RequestContext(user=user,
                                       project=project,
-                                      remote_address=req.remote_addr)
+                                      remote_address=remote_address)
         req.environ['ec2.context'] = ctxt
         return self.application
 

=== modified file 'nova/api/ec2/metadatarequesthandler.py'
--- nova/api/ec2/metadatarequesthandler.py	2010-12-22 20:59:53 +0000
+++ nova/api/ec2/metadatarequesthandler.py	2010-12-22 21:54:20 +0000
@@ -23,9 +23,13 @@
 import webob.dec
 import webob.exc
 
+from nova import flags
 from nova.api.ec2 import cloud
 
 
+FLAGS = flags.FLAGS
+
+
 class MetadataRequestHandler(object):
     """Serve metadata from the EC2 API."""
 
@@ -63,10 +67,13 @@
     @webob.dec.wsgify
     def __call__(self, req):
         cc = cloud.CloudController()
-        meta_data = cc.get_metadata(req.remote_addr)
+        remote_address = req.remote_addr
+        if FLAGS.use_forwarded_for:
+            remote_address = req.headers.get('X-Forwarded-For', remote_address)
+        meta_data = cc.get_metadata(remote_address)
         if meta_data is None:
             logging.error(_('Failed to get metadata for ip: %s') %
-                          req.remote_addr)
+                          remote_address)
             raise webob.exc.HTTPNotFound()
         data = self.lookup(req.path_info, meta_data)
         if data is None: