Bump to v0.4.2. Add new site type 'webserver_basic', add mitigations for HTTPOXY attacks.

nollieheel · Earth Ugat
1 parent 0975ffb2
Showing 9 changed files with 101 additions and 17 deletions
CHANGELOG.md
README.md
attributes/default.rb
metadata.rb
recipes/nginx_configure.rb
templates/default/inc_type_basic.erb
templates/default/inc_type_webserver.erb
templates/default/inc_type_webserver_basic.erb
templates/default/inc_type_wordpress.erb
--- a/CHANGELOG.md
View file @1794df1
+++ b/CHANGELOG.md
View file @1794df1
+## 0.4.2 - 2016-09-09
+### Security
+- Add proxy and fastcgi directives to prevent HTTPOXY attacks as described [here](https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/ "Mitigate HTTPOXY with Nginx")
+
+### Added
+- Add more appropriate keywords for virtual site types
+- Add a new site type `webserver_basic` with a customizable template
+
 # 0.4.1
 Add attribute to customize listen options for virtual host
--- a/README.md
View file @1794df1
+++ b/README.md
View file @1794df1
@@ -2,7 +2,7 @@
 Installs PHP5-FPM, Nginx, Postfix, and MariaDB client on a server. Also sets up webserver configs for all virtual servers, including TLS and basic auth.
-Can also auto-generate config files for certain site types, such as Wordpress, etc. (right now it's: `wordpress`, `basic`, and `webserver`).
+Can also auto-generate config files for certain site types, such as Wordpress, etc. (right now it's: `wordpress`, `basic_php`, `webserver_basic`, and `webserver_ws`).
 ## Supported Platforms
--- a/attributes/default.rb
View file @1794df1
+++ b/attributes/default.rb
View file @1794df1
@@ -150,12 +150,14 @@ default['cfe-nginx-php-fpm']['nginx']['sites'] = [
     # Each type element of this array is a hash containing different attributes.
     #
     # Mandatory attributes are:
-    #   :type => One of: 'basic' (basic PHP site)
+    #   :type => One of: 'basic_php' (basic PHP site)
     #                    'wordpress' (standard Wordpress site)
-    #                    'webserver' (proxy webserver)
+    #                    'webserver_ws' (proxy webserver with websocket)
+    #                    'webserver_basic' (proxy generic webserver)
     #   :upstream_servers => An array containing upstream server endpoints.
     #                        Unix socket example: ['/var/run/php-fpm.sock']
     #                        Tcp port example: ['127.0.0.1:9000']
+    #                        (This is optional for type 'webserver_basic')
     #
     # Optional attributes are:
     #   :subpath => A string of the form: 'news/blog'.
@@ -179,15 +181,28 @@ default['cfe-nginx-php-fpm']['nginx']['sites'] = [
     #                  or not. Default: false
     #
     # Unique attributes for each type are indicated below:
-    #   Basic PHP Site (:type => 'basic'):
+    #   Basic PHP Site (:type => 'basic_php'):
     #     :fastcgi_intercept_errors => Optional. Default: false
     #   Standard Wordpress Site (:type => 'wordpress'):
     #     :fastcgi_intercept_errors => Optional. Default: false
     #     :loginpage_statements => An array of strings to be put on the
     #                              config for the /wp-login.php
     #                              and /wp-admin pages. Default: []
-    #   Proxy Webserver (:type => 'webserver'):
+    #   Proxy Websocket Webserver (:type => 'webserver_ws'):
     #     (none)
+    #   Proxy Generic Webserver (:type => 'webserver_basic'):
+    #     :source => The name of the config template.
+    #                Default is 'inc_type_webserver_basic.erb'.
+    #     :cookbook => The name of the cookbook where the template
+    #                  will be taken from. Default is this cookbook.
+    #                  In combination with the :source attribute above,
+    #                  any custom template in a wrapper cookbook can be
+    #                  used. A template file 'inc_type_webserver_basic.erb'
+    #                  exists as an example.
+    #     :custom_params => A hash that will be passed into the template
+    #                       (along with the optional attributes mentioned
+    #                       above) as the variable called cparams.
+    #                       Default: {}
     #
     #:types => []
   #}
--- a/metadata.rb
View file @1794df1
+++ b/metadata.rb
View file @1794df1
@@ -4,7 +4,7 @@ maintainer_email 'sysadmin@chromedia.com'
 license          'Apache License'
 description      'Simplifies setup of Nginx+PHP-FPM in Chromedia.'
 long_description IO.read(File.join(File.dirname(__FILE__), 'README.md'))
-version          '0.4.1'
+version          '0.4.2'
 {
   'openssl' => '4.4.0',
--- a/recipes/nginx_configure.rb
View file @1794df1
+++ b/recipes/nginx_configure.rb
View file @1794df1
@@ -179,25 +179,27 @@ node[cb]['nginx']['sites'].each do |site|
       :log_static     => stype_logstatic
     }
-    site_upstreams.push( {
-      :name    => stype_ups,
-      :servers => stype[:upstream_servers] || []
-    } )
+    if stype[:upstream_servers] && stype[:upstream_servers].length > 0
+      site_upstreams.push( {
+        :name    => stype_ups,
+        :servers => stype[:upstream_servers] || []
+      } )
+    end
     case stype[:type]
     # BASIC PHP SITE
-    when 'basic'
+    when 'basic', 'basic_php'
       vars[:index] = site_index
       vars[:fastcgi_intercept_errors] = 
         stype.has_key?(:fastcgi_intercept_errors) ?
         stype[:fastcgi_intercept_errors] : false
-      template "#{inc_dir}/inc_type_basic_#{site_sname}" do
+      template "#{inc_dir}/type_basic_php_#{site_sname}" do
         source 'inc_type_basic.erb'
         mode   0644
         variables vars
       end
-      site_includes.push("#{inc_dir}/inc_type_basic_#{site_sname}")
+      site_includes.push("#{inc_dir}/type_basic_php_#{site_sname}")
     # STANDARD WORDPRESS SITE
     when 'wordpress'
@@ -214,9 +216,9 @@ node[cb]['nginx']['sites'].each do |site|
       end
       site_includes.push("#{inc_dir}/inc_type_wordpress_#{site_sname}")
-    # REVERSE PROXY WEBSERVER
-    when 'webserver'
-      template "#{inc_dir}/inc_type_webserver_#{site_sname}" do
+    # REVERSE PROXY WEBSERVER WITH WEBSOCKET
+    when 'webserver', 'webserver_ws'
+      template "#{inc_dir}/inc_type_webserver_ws_#{site_sname}" do
         source 'inc_type_webserver.erb'
         mode   0644
         variables vars
@@ -225,7 +227,19 @@ node[cb]['nginx']['sites'].each do |site|
                     "    default upgrade;\n"\
                     "    ''      close;\n"\
                     "}")
-      site_includes.push("#{inc_dir}/inc_type_webserver_#{site_sname}")
+      site_includes.push("#{inc_dir}/inc_type_webserver_ws_#{site_sname}")
+
+    # GENERIC REVERSE PROXY WEBSERVER
+    when 'webserver_basic'
+      vars[:cparams] = stype[:custom_params] || {}
+
+      template "#{inc_dir}/inc_type_webserver_basic_#{site_sname}" do
+        source    stype[:source] || 'inc_type_webserver_basic.erb'
+        cookbook  stype[:cookbook] || cookbook_name
+        mode      0644
+        variables vars
+      end
+      site_includes.push("#{inc_dir}/inc_type_webserver_basic_#{site_sname}")
     else
       Chef::Log.error("Unknown site type: #{stype[:type]}")
--- a/templates/default/inc_type_basic.erb
View file @1794df1
+++ b/templates/default/inc_type_basic.erb
View file @1794df1
@@ -36,6 +36,9 @@ location ~ ^/<%= @subpath %>.+\.php(/|$) {
     include fastcgi_params;
     fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+    # https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/
+    fastcgi_param HTTP_PROXY "";
+
     fastcgi_pass <%= @upstream_name %>;
 }
--- a/templates/default/inc_type_webserver.erb
View file @1794df1
+++ b/templates/default/inc_type_webserver.erb
View file @1794df1
@@ -22,8 +22,13 @@ location ~* ^/<%= @subpath %>.+\.(<%= @static_types.join('|') %>)$ {
 <% end -%>
 location ~ ^/<%= @subpath %> {
+    proxy_redirect off;
     proxy_pass http://<%= @upstream_name %>;
     proxy_http_version 1.1;
+
+    # https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/
+    proxy_set_header Proxy "";
+
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection $connection_upgrade;
     proxy_set_header X-Real-IP $remote_addr;
--- a/templates/default/inc_type_webserver_basic.erb 0 → 100644
View file @1794df1
+++ b/templates/default/inc_type_webserver_basic.erb 0 → 100644
View file @1794df1
+# Generated by Chef
+<% -%>
+<% # This is an example template. Use this as a guide for your wrapper.-%>
+<% # It expects a :cparams hash with the following keys:-%>
+<% #   :proxy_host-%>
+<% #   :proxy_port-%>
+
+<% if @static_types -%>
+# Send expires headers and (probably?) turn off 404 error logging.
+location ~* ^/<%= @subpath %>.+\.(<%= @static_types.join('|') %>)$ {
+    expires max;
+<%   unless @log_static -%>
+    log_not_found off;
+    access_log off;
+<%   end -%>
+}
+
+<% end -%>
+location ~ ^/<%= @subpath %> {
+    proxy_redirect off;
+    proxy_pass http://<%= @cparams[:proxy_host] %>:<%= @cparams[:proxy_port] %>;
+    proxy_set_header Connection "";
+
+    proxy_http_version 1.1;
+    proxy_pass_request_headers on;
+
+    # https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/
+    proxy_set_header Proxy "";
+
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header Host $http_host;
+}
--- a/templates/default/inc_type_wordpress.erb
View file @1794df1
+++ b/templates/default/inc_type_wordpress.erb
View file @1794df1
@@ -46,6 +46,9 @@ location ~ ^/<%= @subpath %>(wp-admin|wp-login\.php) {
         include fastcgi_params;
         fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+        # https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/
+        fastcgi_param HTTP_PROXY "";
+
         fastcgi_pass <%= @upstream_name %>;
     }
 }
@@ -65,6 +68,9 @@ location ~ ^/<%= @subpath %>.+\.php(/|$) {
     include fastcgi_params;
     fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+    # https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/
+    fastcgi_param HTTP_PROXY "";
+
     fastcgi_pass <%= @upstream_name %>;
 }