mboruta1
commented
2 years ago I would like to push a fix for this myself, but wanted to run it by you (@renecannao) before writing any additional code.
The issue has a description of what I am trying to achieve, but in short I would like users to be able to access ProxySQL's web interface via an arbitrary URL (useful when the service is sitting behind a reverse proxy).
The current code has the URLs it supports hardcoded (e.g. /stats), which means it only successfully returns the stats page if the requested URL it receives is /stats. If we are exposing the web interface via a reverse proxy at, say, myhostname.com/proxysql, the reverse proxy would need to re-write the user's URLs such that the /proxysql prefix is omitted. This works with the exception of user authentication, which requires that the URI specified in the Authorization request (digest) matches the URL requested by the user. One cannot re-write the requested URL without re-writing the URI, and one cannot re-write the URI without breaking authentication (see section 4.2 of the relevant RFC, modification of this header's contents is forbidden). Thus a different solution is needed.
I propose the following changes:
- add an additional parameter to ProxySQL called something like
web_prefixthat will indicate the base URL used by connecting clients. This is similar to the following config params for popular services:- nginx's root variable
- apache's alias directive
- rabitmq's path_prefix option
- update all links to use relative URLs. This allows us to avoid needing to use
sprintfto generate the resulting html. Should the interface be expanded to support sub pages, e.g.stats/test, the URL parsing code will need to be updated. I do not see this happening any time soon, however. - Change the home page from
/to/home, with users requesting/being redirected to/home
The changes to ProxySQL_HTTP_Server.cpp would look something like the following, with USER_SPECIFIED_PREFIX containing the value of web_prefix.
What do you think? Can I proceed or am I missing something?
diff --git a/lib/ProxySQL_HTTP_Server.cpp b/lib/ProxySQL_HTTP_Server.cpp
index b1140784..dd8b0c9b 100644
--- a/lib/ProxySQL_HTTP_Server.cpp
+++ b/lib/ProxySQL_HTTP_Server.cpp
@@ -115,7 +115,7 @@ static char *generate_home() {
string html = "";
html.append("<div class=\"menu\" style=\"height: auto;\">\n");
html.append("<span style=\"float: left; width: 50%;\">\n");
- html.append("<div style=\"margin-top: 15px;\"><a href=\"/\""); html.append(style2); html.append("Home</a>\n");
+ html.append("<div style=\"margin-top: 15px;\"><a href=\"home\""); html.append(style2); html.append("Home</a>\n");
html.append("<a href=stats?metric=system"); html.append(style2); html.append("System</a>\n");
html.append("<a href=stats?metric=mysql"); html.append(style2); html.append("MySQL</a>\n");
html.append("<a href=stats?metric=cache"); html.append(style2); html.append("Query Cache</a></div>\n");
@@ -257,7 +257,7 @@ static char *generate_buttons(char *base) {
char *s = NULL;
string html = "<div class=\"menu\" style=\"height: auto;\"><span style=\"float: left; width: 100%;\">\n";
html.append("<div style=\"margin-top: 15px;\">");
- html.append("<a href=\"/\""); html.append(style2); html.append("Home</a>\n");
+ html.append("<a href=\"home\""); html.append(style2); html.append("Home</a>\n");
html.append("<a href=stats?metric=system"); html.append(style2); html.append("System</a>\n");
html.append("<a href=stats?metric=mysql"); html.append(style2); html.append("MySQL</a>\n");
html.append("<a href=stats?metric=cache"); html.append(style2); html.append("Query Cache</a>\n");
@@ -362,7 +362,7 @@ void ProxySQL_HTTP_Server::print_version() {
fprintf(stderr,"Standard ProxySQL HTTP Server Handler rev. %s -- %s -- %s\n", PROXYSQL_HTTP_SERVER_VERSION, __FILE__, __TIMESTAMP__);
}
-#define EMPTY_PAGE "<html><head><title>File not found</title></head><body>File not found<br/><a href=\"/\">Go back home</a></body></html>"
+#define EMPTY_PAGE "<html><head><title>File not found</title></head><body>File not found<br/><a href=\"home\">Go back home</a></body></html>"
int ProxySQL_HTTP_Server::handler(void *cls, struct MHD_Connection *connection, const char *url, const char *method, const char *version, const char *upload_data, size_t *upload_data_size, void **ptr) {
@@ -370,6 +370,8 @@ int ProxySQL_HTTP_Server::handler(void *cls, struct MHD_Connection *connection,
int ret;
char *username;
char *password = NULL;
const char *realm = "Access to ProxySQL status page";
@@ -381,6 +383,7 @@ int ProxySQL_HTTP_Server::handler(void *cls, struct MHD_Connection *connection,
MHD_destroy_response(response);
return ret;
}
{
int default_hostgroup = -1;
char *default_schema = NULL;
@@ -391,6 +394,7 @@ int ProxySQL_HTTP_Server::handler(void *cls, struct MHD_Connection *connection,
int max_connections;
void *sha1_pass = NULL;
password=GloMyAuth->lookup(username, USERNAME_FRONTEND, &_ret_use_ssl, &default_hostgroup, &default_schema, &schema_locked, &transaction_persistent, &fast_forward, &max_connections, &sha1_pass, NULL);
if (default_schema) { // unused
free(default_schema);
}
@@ -413,18 +417,22 @@ int ProxySQL_HTTP_Server::handler(void *cls, struct MHD_Connection *connection,
}
}
ret = MHD_digest_auth_check(connection, realm, username, password, 300);
free(username);
free(password);
if ( (ret == MHD_INVALID_NONCE) || (ret == MHD_NO) ) {
response = MHD_create_response_from_buffer(strlen(DENIED), (void *)DENIED, MHD_RESPMEM_PERSISTENT);
if (NULL == response)
ret = MHD_queue_auth_fail_response(connection, realm, OPAQUE, response, (ret == MHD_INVALID_NONCE) ? MHD_YES : MHD_NO);
MHD_destroy_response(response);
return ret;
}
@@ -448,7 +456,7 @@ int ProxySQL_HTTP_Server::handler(void *cls, struct MHD_Connection *connection,
if (0 != strcmp (method, "GET"))
return MHD_NO; /* unexpected method */
- if (strcmp(url,"/stats")==0) {
+ if (strcmp(url,"USER_SPECIFIED_PREFIX/stats")==0) {
valmetric = (char *)MHD_lookup_connection_value (connection, MHD_GET_ARGUMENT_KIND, (char *)"metric");
interval_s = (char *)MHD_lookup_connection_value (connection, MHD_GET_ARGUMENT_KIND, (char *)"interval");
if (valmetric == NULL) {
@@ -800,25 +808,26 @@ int ProxySQL_HTTP_Server::handler(void *cls, struct MHD_Connection *connection,
}
}
- if (strcmp(url,"/Chart.bundle.js")==0) {
+ if (strcmp(url,"USER_SPECIFIED_PREFIX/Chart.bundle.js")==0) {
response = MHD_create_response_from_buffer(strlen(Chart_bundle_js_c), Chart_bundle_js_c, MHD_RESPMEM_PERSISTENT);
ret = MHD_queue_response (connection, MHD_HTTP_OK, response);
MHD_destroy_response (response);
return ret;
}
- if (strcmp(url,"/font-awesome.min.css")==0) {
+ if (strcmp(url,"USER_SPECIFIED_PREFIX/font-awesome.min.css")==0) {
response = MHD_create_response_from_buffer(strlen(font_awesome), font_awesome, MHD_RESPMEM_PERSISTENT);
ret = MHD_queue_response (connection, MHD_HTTP_OK, response);
MHD_destroy_response (response);
return ret;
}
- if (strcmp(url,"/main-bundle.min.css")==0) {
+ if (strcmp(url,"USER_SPECIFIED_PREFIX/main-bundle.min.css")==0) {
response = MHD_create_response_from_buffer(strlen(main_bundle_min_css_c), main_bundle_min_css_c, MHD_RESPMEM_PERSISTENT);
ret = MHD_queue_response (connection, MHD_HTTP_OK, response);
MHD_destroy_response (response);
return ret;
}
- if (strcmp(url,"/")==0) {
+ if (strcmp(url,"USER_SPECIFIED_PREFIX/home")==0) {
+ fprintf(stderr, "Loading home\n");
string *s = generate_header((char *)"ProxySQL Home");
char *home = generate_home();
s->append(home);
@@ -843,9 +852,9 @@ string * ProxySQL_HTTP_Server::generate_header(char *s) {
a->append(s);
a->append("</title>\n");
a->append("<link rel=\"stylesheet\" href=\"https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,400i,600,900|Fira+Mono\"/>\n");
- a->append("<link rel=\"stylesheet\" href=\"/main-bundle.min.css\"/>\n");
- a->append("<link rel=\"stylesheet\" href=\"/font-awesome.min.css\"/>\n");
- a->append("<script src=\"/Chart.bundle.js\"></script>\n</head>\n<body style=\"background-color: white;\">\n");
+ a->append("<link rel=\"stylesheet\" href=\"main-bundle.min.css\"/>\n");
+ a->append("<link rel=\"stylesheet\" href=\"font-awesome.min.css\"/>\n");
+ a->append("<script src=\"Chart.bundle.js\"></script>\n</head>\n<body style=\"background-color: white;\">\n");
a->append("<header class=\"header cf \" role=\"banner\">\n<a class=\"brand\" href=\"http://www.proxysql.com\"><span><strong>Proxy</strong>SQL</span>\n</a>");
return a;
}
renecannao
jaredev
rossifumax
Bug Description
ProxySQL seems to use relative paths for all links in the HTML served via its web interface with the exception of
/(calledHomein the interface). This is problematic when attempting to provide access to the interface via a reverse proxy. Please consider the following example:<haproxy ip>:443<haproxy ip>:443/<service name>, route said request to the corresponding service's web interface that is otherwise inaccessible to end clients (its port and IP are not exposed by the firewall)If said web interface uses relative links, users can click around the interface and their browser will always request URLs starting with
<haproxy ip>:443/<service name>.However, if the web interface contains links with absolute paths, e.g.
/, then, when clicked, the user's browser will connect to paths not prefixed by<service name>, e.g.<haproxy ip>:443:/and thus break the reverse proxy.Proposed Solution
Given that most URL paths are already relative, making ProxySQL's home URL called something like
home.htmlinstead of/(see this), and referenced in a relative fashion, would allow the web service to be easily reverse proxied.ProxySQL Version
proxysql_2.2.2-ubuntu18_amd64.deb retrieved from here
OS Version
Ubuntu 18.04
Steps to Reproduce
Please see the bug description above.
ProxySQL Error Log
Not Applicable