「nginx」カテゴリーアーカイブ

nginx http/3を動かす

NginxでHTTP/3を動かしてみます。HTTP/3はQUICというプロトコルに基づいているようです。詳しくは理解していないので追々学んでいきたいと思います。まずは、ローカルで動かしてどのようなデータやり取りが行われているのかwiresharkで覗くところから。

Dockerコンテナでビルドします。gistでレシピが公開されているのでそれに倣います。

ビルドすると以下のエラーとなってしまいました。

#13 58.57 auto/configure: error: invalid option "--with-http_quic_module"

1	#13 58.57 auto/configure: error: invalid option "--with-http_quic_module"

どうも上記のオプションは--with-http_v3_moduleに統合された？ようなので削除します。

参考：　https://hg.nginx.org/nginx-quic/rev/33226ac61076

最終的に以下のようにしました。

FROM nginx:1.21.4 AS build
WORKDIR /src
RUN apt-get update && \
apt-get install -y git gcc make g++ cmake perl libunwind-dev golang && \
git clone https://boringssl.googlesource.com/boringssl && \
mkdir boringssl/build && \
cd boringssl/build && \
cmake .. && \
make
RUN apt-get install -y mercurial libperl-dev libpcre3-dev zlib1g-dev libxslt1-dev libgd-ocaml-dev libgeoip-dev && \
hg clone https://hg.nginx.org/nginx-quic   && \
hg clone http://hg.nginx.org/njs -r "0.6.2" && \
cd nginx-quic && \
hg update quic && \
auto/configure `nginx -V 2>&1 | sed "s/ \-\-/ \\\ \n\t--/g" | grep "\-\-" | grep -ve opt= -e param= -e build=` \
--build=nginx-quic --with-debug  \
--with-http_v3_module --with-stream_quic_module \
--with-cc-opt="-I/src/boringssl/include" --with-ld-opt="-L/src/boringssl/build/ssl -L/src/boringssl/build/crypto" && \
make
FROM nginx:1.21.4
COPY nginx.conf /etc/nginx/nginx.conf
RUN mkdir -p /certs
# https://letsencrypt.org/docs/certificates-for-localhost/
COPY localhost.crt /certs/localhost.crt
COPY localhost.key /certs/localhost.key
COPY --from=build /src/nginx-quic/objs/nginx /usr/sbin
RUN /usr/sbin/nginx -V
EXPOSE 10443

FROM nginx:1.21.4 AS build

WORKDIR /src

RUN apt-get update && \

apt-get install -y git gcc make g++ cmake perl libunwind-dev golang && \

git clone https://boringssl.googlesource.com/boringssl && \

mkdir boringssl/build && \

cd boringssl/build && \

cmake .. && \

make

RUN apt-get install -y mercurial libperl-dev libpcre3-dev zlib1g-dev libxslt1-dev libgd-ocaml-dev libgeoip-dev && \

hg clone https://hg.nginx.org/nginx-quic && \

hg clone http://hg.nginx.org/njs -r "0.6.2" && \

cd nginx-quic && \

hg update quic && \

auto/configure `nginx -V 2>&1 | sed "s/ \-\-/ \\\ \n\t--/g" | grep "\-\-" | grep -ve opt= -e param= -e build=` \

--build=nginx-quic --with-debug \

--with-http_v3_module --with-stream_quic_module \

--with-cc-opt="-I/src/boringssl/include" --with-ld-opt="-L/src/boringssl/build/ssl -L/src/boringssl/build/crypto" && \

make

FROM nginx:1.21.4

COPY nginx.conf /etc/nginx/nginx.conf

RUN mkdir -p /certs

# https://letsencrypt.org/docs/certificates-for-localhost/

COPY localhost.crt /certs/localhost.crt

COPY localhost.key /certs/localhost.key

COPY --from=build /src/nginx-quic/objs/nginx /usr/sbin

RUN /usr/sbin/nginx -V

EXPOSE 10443

nginx.conf

user  nginx;
worker_processes  1;
events {
worker_connections 1024;
}
error_log  /var/log/nginx/error.log notice;
pid        /var/run/nginx.pid;
http {
include mime.types;
default_type application/octet-stream;
sendfile on;
log_format quic '$remote_addr - $remote_user [$time_local] '
'"$request" $status $body_bytes_sent '
'"$http_referer" "$http_user_agent" "$http3"';
root /usr/share/nginx/html;
access_log /var/log/nginx/access.log quic;
server {
# for better compatibility it's recommended
# to use the same port for quic and https
listen 10443 http3 reuseport;
listen 10443 ssl http2;
ssl_certificate /certs/localhost.crt;
ssl_certificate_key /certs/localhost.key;
ssl_protocols TLSv1.3;
location / {
# required for browsers to direct them into quic port
add_header Alt-Svc 'h3=":10443";h3-29=":10443"; ma=86400';
}
}
}

user nginx;

worker_processes 1;

events {

worker_connections 1024;

}

error_log /var/log/nginx/error.log notice;

pid /var/run/nginx.pid;

http {

include mime.types;

default_type application/octet-stream;

sendfile on;

log_format quic '$remote_addr - $remote_user [$time_local] '

'"$request" $status $body_bytes_sent '

'"$http_referer" "$http_user_agent" "$http3"';

root /usr/share/nginx/html;

access_log /var/log/nginx/access.log quic;

server {

# for better compatibility it's recommended

# to use the same port for quic and https

listen 10443 http3 reuseport;

listen 10443 ssl http2;

ssl_certificate /certs/localhost.crt;

ssl_certificate_key /certs/localhost.key;

ssl_protocols TLSv1.3;

location / {

# required for browsers to direct them into quic port

add_header Alt-Svc 'h3=":10443";h3-29=":10443"; ma=86400';

}

ビルドしてコンテナ起動します。

$ openssl req -x509 -out localhost.crt -keyout localhost.key   -newkey rsa:2048 -nodes -sha256   -subj '/CN=localhost' -extensions EXT -config <( \
printf "[dn]\nCN=localhost\n[req]\ndistinguished_name = dn\n[EXT]\nsubjectAltName=DNS:localhost\nkeyUsage=digitalSignature\nextendedKeyUsage=serverAuth")
$ docker build -t nginx-http3 .
$ docker run -it -p 10443:10443 -p 10443:10443/udp --rm --name http3 nginx-http3:latest
/docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration
/docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/
/docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh
10-listen-on-ipv6-by-default.sh: info: Getting the checksum of /etc/nginx/conf.d/default.conf
10-listen-on-ipv6-by-default.sh: info: Enabled listen on IPv6 in /etc/nginx/conf.d/default.conf
/docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh
/docker-entrypoint.sh: Launching /docker-entrypoint.d/30-tune-worker-processes.sh
/docker-entrypoint.sh: Configuration complete; ready for start up
2021/12/16 15:25:28 [notice] 1#1: using the "epoll" event method
2021/12/16 15:25:28 [notice] 1#1: nginx/1.21.4 (nginx-quic)
2021/12/16 15:25:28 [notice] 1#1: built by gcc 10.2.1 20210110 (Debian 10.2.1-6) 
2021/12/16 15:25:28 [notice] 1#1: OS: Linux 5.10.47-linuxkit
2021/12/16 15:25:28 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 1048576:1048576
2021/12/16 15:25:28 [notice] 1#1: start worker processes
2021/12/16 15:25:28 [notice] 1#1: start worker process 31

$ openssl req -x509 -out localhost.crt -keyout localhost.key -newkey rsa:2048 -nodes -sha256 -subj '/CN=localhost' -extensions EXT -config <( \

printf "[dn]\nCN=localhost\n[req]\ndistinguished_name = dn\n[EXT]\nsubjectAltName=DNS:localhost\nkeyUsage=digitalSignature\nextendedKeyUsage=serverAuth")

$ docker build -t nginx-http3 .

$ docker run -it -p 10443:10443 -p 10443:10443/udp --rm --name http3 nginx-http3:latest

/docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration

/docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/

/docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh

10-listen-on-ipv6-by-default.sh: info: Getting the checksum of /etc/nginx/conf.d/default.conf

10-listen-on-ipv6-by-default.sh: info: Enabled listen on IPv6 in /etc/nginx/conf.d/default.conf

/docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh

/docker-entrypoint.sh: Launching /docker-entrypoint.d/30-tune-worker-processes.sh

/docker-entrypoint.sh: Configuration complete; ready for start up

2021/12/16 15:25:28 [notice] 1#1: using the "epoll" event method

2021/12/16 15:25:28 [notice] 1#1: nginx/1.21.4 (nginx-quic)

2021/12/16 15:25:28 [notice] 1#1: built by gcc 10.2.1 20210110 (Debian 10.2.1-6)

2021/12/16 15:25:28 [notice] 1#1: OS: Linux 5.10.47-linuxkit

2021/12/16 15:25:28 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 1048576:1048576

2021/12/16 15:25:28 [notice] 1#1: start worker processes

2021/12/16 15:25:28 [notice] 1#1: start worker process 31

curlでアクセスしてみます。

$ docker run -it --rm ymuski/curl-http3 curl -k -IL https://192.168.3.5:10443 --http3
HTTP/3 200
server: nginx/1.21.4
date: Thu, 16 Dec 2021 15:20:57 GMT
content-type: text/html
content-length: 615
last-modified: Tue, 02 Nov 2021 14:49:22 GMT
etag: "61814ff2-267"
alt-svc: h3=":10443";h3-29=":10443"; ma=86400
accept-ranges: bytes

$ docker run -it --rm ymuski/curl-http3 curl -k -IL https://192.168.3.5:10443 --http3

HTTP/3 200

server: nginx/1.21.4

date: Thu, 16 Dec 2021 15:20:57 GMT

content-type: text/html

content-length: 615

last-modified: Tue, 02 Nov 2021 14:49:22 GMT

etag: "61814ff2-267"

alt-svc: h3=":10443";h3-29=":10443"; ma=86400

accept-ranges: bytes

172.17.0.1 - - [16/Dec/2021:15:37:53 +0000] "HEAD / HTTP/3.0" 200 149 "-" "curl/7.76.1-DEV" "h3"

1	172.17.0.1 - - [16/Dec/2021:15:37:53 +0000] "HEAD / HTTP/3.0" 200 149 "-" "curl/7.76.1-DEV" "h3"

RFC9000 https://www.rfc-editor.org/rfc/rfc9000.html

参考

nginxプロキシでアップストリームのヘッダを消す

コメントを残す

この記事は【2020年12月6日】と作成から2年以上経っているため、記事の内容が古い可能性があります。最新の情報を合わせてご確認されることを推奨いたします。

nginxプロキシでアップストリームサーバが返す一部のレスポンスヘッダを消したい。

アップストリーム側で出力しているヘッダがあり、nginxプロキシ側でも同様にadd_headerでヘッダを出力している場合にヘッダが重複してしまう。例えばmattermostのdocker版では、一部のページでX-Frame-Optionsが重複して出力されてしまう？ようだが、どのページかは言及されていない。ただパッと見た限りではloginページくらいか？ブラウザはエラーにはならないが、できれば取り除きたい。

https://github.com/mattermost/mattermost-docker/issues/468

$ curl -s -D- -o /dev/null -L http://localhost:8090/
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 05 Dec 2020 13:43:39 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 3091
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: no-cache, max-age=31556926, public
Content-Security-Policy: frame-ancestors 'self'; script-src 'self' cdn.rudderlabs.com
Last-Modified: Sat, 05 Dec 2020 12:22:43 GMT
X-Frame-Options: SAMEORIGIN
X-Ratelimit-Limit: 101
X-Ratelimit-Remaining: 100
X-Ratelimit-Reset: 1
X-Request-Id: 9aj5r69r8bbn5mjotwgf7xkg9w
X-Version-Id: 5.29.0.5.29.1.af2700671330c5f425f496fdaf9d92ab.false
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block

$ curl -s -D- -o /dev/null -L http://localhost:8090/

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 05 Dec 2020 13:43:39 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 3091

Connection: keep-alive

Accept-Ranges: bytes

Cache-Control: no-cache, max-age=31556926, public

Content-Security-Policy: frame-ancestors 'self'; script-src 'self' cdn.rudderlabs.com

Last-Modified: Sat, 05 Dec 2020 12:22:43 GMT

X-Frame-Options: SAMEORIGIN

X-Ratelimit-Limit: 101

X-Ratelimit-Remaining: 100

X-Ratelimit-Reset: 1

X-Request-Id: 9aj5r69r8bbn5mjotwgf7xkg9w

X-Version-Id: 5.29.0.5.29.1.af2700671330c5f425f496fdaf9d92ab.false

X-Frame-Options: SAMEORIGIN

X-Content-Type-Options: nosniff

X-XSS-Protection: 1; mode=block

ソースを調査するかぎりでは、ソース内に直書きされているので管理画面で削除するといったことはできなさそうだった。

https://github.com/mattermost/mattermost-server/blob/3099128bbd4faa1cdcf716182e2cc43c294badfd/web/handlers.go#L171

mattermostのdocker版は、nginxコンテナでsecurity.confというファイルが読み込まれるようになっている。その中で以下の３つのヘッダがレスポンスヘッダに追加される。X-Frame-Options SAMEORIGIN;が追加されていることが分かる。

server_tokens off;
add_header X-Frame-Options SAMEORIGIN;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";

server_tokens off;

add_header X-Frame-Options SAMEORIGIN;

add_header X-Content-Type-Options nosniff;

add_header X-XSS-Protection "1; mode=block";

proxy_hide_header

このディレクティブは、ngx_http_proxy_moduleというモジュールで使えるものだが、デフォルトで組み込まれているモジュールのため使用できる。以下のように指定する。

proxy_hide_header X-Frame-Options;

1	proxy_hide_header X-Frame-Options;

以下をconfに設定して反映してみよう。

nginxコンテナのconfをコピーしてきて、

docker cp mattermost-docker_web_1:/etc/nginx/conf.d/mattermost.conf .

1	docker cp mattermost-docker_web_1:/etc/nginx/conf.d/mattermost.conf .

以下のように編集する。オリジナルのconfとの差は以下のとおり。

$ diff -u mattermost.conf.org mattermost.conf
--- mattermost.conf.org 2020-12-05 21:31:56.000000000 +0900
+++ mattermost.conf 2020-12-05 22:05:41.000000000 +0900
@@ -7,6 +7,8 @@
listen 80;
location ~ /api/v[0-9]+/(users/)?websocket$ {
+        proxy_hide_header X-Frame-Options;
+
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
client_max_body_size 50M;
@@ -22,6 +24,7 @@
}
location / {
+        proxy_hide_header X-Frame-Options;
gzip on;
client_max_body_size 50M;

$ diff -u mattermost.conf.org mattermost.conf

--- mattermost.conf.org 2020-12-05 21:31:56.000000000 +0900

+++ mattermost.conf 2020-12-05 22:05:41.000000000 +0900

@@ -7,6 +7,8 @@

listen 80;

location ~ /api/v[0-9]+/(users/)?websocket$ {

+ proxy_hide_header X-Frame-Options;

proxy_set_header Upgrade $http_upgrade;

proxy_set_header Connection "upgrade";

client_max_body_size 50M;

@@ -22,6 +24,7 @@

}

location / {

+ proxy_hide_header X-Frame-Options;

gzip on;

client_max_body_size 50M;

編集したconfを反映する。

$ docker cp mattermost.conf mattermost-docker_web_1:/etc/nginx/conf.d/mattermost.conf
$ docker exec -it mattermost-docker_web_1 chown root:root /etc/nginx/conf.d/mattermost.conf
$ docker-compose exec web nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
$ docker-compose kill -s SIGHUP web
Killing mattermost-docker_web_1 ... done

$ docker cp mattermost.conf mattermost-docker_web_1:/etc/nginx/conf.d/mattermost.conf

$ docker exec -it mattermost-docker_web_1 chown root:root /etc/nginx/conf.d/mattermost.conf

$ docker-compose exec web nginx -t

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok

nginx: configuration file /etc/nginx/nginx.conf test is successful

$ docker-compose kill -s SIGHUP web

Killing mattermost-docker_web_1 ... done

ページにアクセスしてみると重複は解消されている。

$ curl -s -D- -o /dev/null -L http://localhost:8090/
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 05 Dec 2020 13:47:36 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 3091
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: no-cache, max-age=31556926, public
Content-Security-Policy: frame-ancestors 'self'; script-src 'self' cdn.rudderlabs.com
Last-Modified: Sat, 05 Dec 2020 12:22:43 GMT
X-Ratelimit-Limit: 101
X-Ratelimit-Remaining: 100
X-Ratelimit-Reset: 1
X-Request-Id: h3jan8rdtidtpqy7kfojb8wyna
X-Version-Id: 5.29.0.5.29.1.af2700671330c5f425f496fdaf9d92ab.false
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block

$ curl -s -D- -o /dev/null -L http://localhost:8090/

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 05 Dec 2020 13:47:36 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 3091

Connection: keep-alive

Accept-Ranges: bytes

Cache-Control: no-cache, max-age=31556926, public

Content-Security-Policy: frame-ancestors 'self'; script-src 'self' cdn.rudderlabs.com

Last-Modified: Sat, 05 Dec 2020 12:22:43 GMT

X-Ratelimit-Limit: 101

X-Ratelimit-Remaining: 100

X-Ratelimit-Reset: 1

X-Request-Id: h3jan8rdtidtpqy7kfojb8wyna

X-Version-Id: 5.29.0.5.29.1.af2700671330c5f425f496fdaf9d92ab.false

X-Frame-Options: SAMEORIGIN

X-Content-Type-Options: nosniff

X-XSS-Protection: 1; mode=block

他のアプローチとして、headers-more-nginx-moduleというモジュールがあるが、これは別途組み込みが必要なようだ。

https://www.nginx.com/resources/wiki/modules/headers_more/

デバッグライフ

プログラミングや日常の記録など

「nginx」カテゴリーアーカイブ

nginx http/3を動かす

参考

nginxプロキシでアップストリームのヘッダを消す

proxy_hide_header

参考リンク