Page MenuHomePhabricator

Web proxies are resolved to internal IPs outside of WMCS network
Closed, ResolvedPublic

Description

urbanecm@notebook  ~
$ host wmcz-stats-turnilo.wmcloud.org 8.8.8.8
Using domain server:
Name: 8.8.8.8
Address: 8.8.8.8#53
Aliases:

wmcz-stats-turnilo.wmcloud.org has address 172.16.6.36
urbanecm@notebook  ~
$

I created wmcz-stats-turnilo.wmcloud.org from horizon, and it resolves to an internal IP from outside of WMCS network, which...kinda ruins its purpose.

The private IP matches the instance that should be behind the proxy.

The proxy itself seems to work:

urbanecm@titanium  ~
$ curl -k -H 'Host: wmcz-stats-turnilo.wmcloud.org' -I https://185.15.56.49
HTTP/2 200
server: nginx/1.13.6
date: Tue, 06 Apr 2021 22:30:34 GMT
content-type: text/html; charset=utf-8
content-length: 338
strict-transport-security: max-age=31622400
x-clacks-overhead: GNU Terry Pratchett

urbanecm@titanium  ~
$

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

Reproducible:

$ dig T279486.wmcloud.org @ns0.openstack.eqiad1.wikimediacloud.org +short
172.16.3.219
$ dig T279486.wmcloud.org @8.8.8.8 +short
172.16.3.219

172.16.3.219 is the internal ip of the instance I pointed the proxy at.

https://gerrit.wikimedia.org/r/c/openstack/horizon/wmf-proxy-dashboard/+/609859/1/wikimediaproxydashboard/views.py#b240 looks possibly suspect as it appears to conflate proxy external IP with backend internal IP but it's from July, might be it didn't get rolled out until recently?

Change 677415 had a related patch set uploaded (by Andrew Bogott; author: Andrew Bogott):

[openstack/horizon/wmf-proxy-dashboard@main] Fix the front-end IP in the proxy dns entry

https://gerrit.wikimedia.org/r/677415

Change 677415 merged by Andrew Bogott:

[openstack/horizon/wmf-proxy-dashboard@main] Fix the front-end IP in the proxy dns entry

https://gerrit.wikimedia.org/r/677415

Change 677646 had a related patch set uploaded (by Andrew Bogott; author: Andrew Bogott):

[openstack/horizon/deploy@main] Update wmf-proxy-dashboard submodule

https://gerrit.wikimedia.org/r/677646

Change 677646 merged by Andrew Bogott:

[openstack/horizon/deploy@main] Update wmf-proxy-dashboard submodule

https://gerrit.wikimedia.org/r/677646

Andrew claimed this task.