經過http tunnel鏈接mysql

時間 2020-03-30

標籤經過 http tunnel 鏈接 mysql 欄目 HTTP/TCP 简体版

原文原文鏈接

背景

(1) 公司爲了下降工做效率, 鏈接mysql必須經過特定的代理才能鏈接
(2) 產線這個模式能夠理解, 可是測試環境你也搞個這個,那我就要哭了
(3) 在公司用wifi能夠鏈接,可是在家沒法直接鏈接mysql,只能經過垃圾的網頁版mysql進行數據庫操做
(4) 能夠經過網頁訪問docker的權限,並無任何服務器權限

解決方案

(1) nginx的stream實現tcp流量轉發
(2) nginx的http proxy connect實現http tunnel
(3) Navicat Premium的http tunnel實現

方案一php
- 在/etc/nginx/nginx.conf的第一行加上mysql
```
load_module /usr/lib64/nginx/modules/ngx_stream_module.so;
```
  這裏modules的路徑能夠經過nginx -V的--modules-path看到nginx
```
stream {
    server {
        listen     443;
        proxy_pass stream_backend;
    }
}
```
- 到這這進行不下去了, 此方案行不通
  一、由於nginx的stream是基於tcp/ip的第4層,因此沒有http中header的host參數,也就沒有基於server_name的配置
  二、服務器主機也只會轉發http和https流量到docker,stream在host的nginx沒配置轉發,因此tcp流量根本過不來c++

方案二git

在/etc/nginx/nginx.conf的第一行加上github

load_module /usr/lib64/nginx/modules/ngx_http_proxy_connect_module.so;

nginx -s reloadsql

> ```nginx: [emerg] dlopen() "/usr/lib64/nginx/modules/ngx_http_proxy_connect_module.so" failed (/usr/lib64/nginx/modules/ngx_http_proxy_connect_module.so: cannot open shared object file: No such file or directory) in /etc/nginx/nginx.conf```

又要開始折騰了, 沒有ngx_http_proxy_connect_module, google了一把, ngx_http_proxy_connect_module

至關於從新編譯nginx, 有幾個坑, 不過意外發現有個go的開源庫,專門編譯nginx,恰好我是go開發,go的庫nginx-build, 可是下面說的跟這個庫不要緊, 只是打個go的廣告^_^docker

(1) 選定對應的nginx源碼zip,更改nginx的version, nginx -v
(2) ./configure的編譯參數, 須要提早nginx -V複製以前的啓動參數下來
(3) 執行path的時候須要看`https://github.com/chobits/ngx_http_proxy_connect_module`的說明,哪一個版本用哪一個patch

$ git clone https://github.com/chobits/ngx_http_proxy_connect_module.git /root/ngx_http_proxy_connect_module
$ wget http://nginx.org/download/nginx-1.12.2.tar.gz
$ tar -xzvf nginx-1.12.2.tar.gz
$ cd nginx-1.12.2/
$ patch -p1 < /root/ngx_http_proxy_connect_module/patch/proxy_connect.patch
$ ./configure --add-module=/root/ngx_http_proxy_connect_module ·後面接上nginx -V裏面的configure arguments·
$ make && make install
$ cp /root/ngx_http_proxy_connect_module

執行過程數據庫

$ ./configure --add-dynamic-module=/root/ngx_http_proxy_connect_module --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx --user=nginx --group=nginx --with-file-aio --with-ipv6 --with-http_auth_request_module --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_addition_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic --with-http_geoip_module=dynamic --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_slice_module --with-http_stub_status_module --with-http_perl_module=dynamic --with-mail=dynamic --with-mail_ssl_module --with-pcre --with-pcre-jit --with-stream=dynamic --with-stream_ssl_module --with-google_perftools_module --with-debug --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic' --with-ld-opt='-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-E'

出現各類錯誤,各類google,最終服務器

yum -y install redhat-rpm-config.noarch
yum -y install libxslt-devel 
yum -y install perl-devel perl-ExtUtils-Embed 
yum -y install gd-devel
yum -y install geoip-devel
yum -y install gperftools-devel

最後編譯只出現warning類的報錯纔算成功

+ using system PCRE library
      + using system OpenSSL library
      + using system zlib library
      nginx path prefix: "/usr/share/nginx"
      nginx binary file: "/usr/sbin/nginx"
      nginx modules path: "/usr/lib64/nginx/modules"
      nginx configuration prefix: "/etc/nginx"
      nginx configuration file: "/etc/nginx/nginx.conf"
      nginx pid file: "/run/nginx.pid"
      nginx error log file: "/var/log/nginx/error.log"
      nginx http access log file: "/var/log/nginx/access.log"
      nginx http client request body temporary files: "/var/lib/nginx/tmp/client_body"
      nginx http proxy temporary files: "/var/lib/nginx/tmp/proxy"
      nginx http fastcgi temporary files: "/var/lib/nginx/tmp/fastcgi"
      nginx http uwsgi temporary files: "/var/lib/nginx/tmp/uwsgi"
      nginx http scgi temporary files: "/var/lib/nginx/tmp/scgi"

    ./configure: warning: the "--with-ipv6" option is deprecated

ls /usr/lib64/nginx/modules 就會發現ngx_http_proxy_connect_module.so文件已經生成了, /usr/lib64/nginx/modules是modules路徑, nginx -V能夠看到--modules-path

開始配置nginx

stream {
    server {
         listen 443;
         server_name t1.test.example.com;

         proxy_connect;
         proxy_connect_allow            443;
         proxy_connect_connect_timeout  10s;
         proxy_connect_read_timeout     10s;
         proxy_connect_send_timeout     10s;

         proxy_pass http://$http_host;
   }
}

尷尬的發現到這裏又作下不去了,只能轉發http的流量,沒法利用http的tunnel改成tcp流量,到此結束

方案三

前面都死在半路上, 不甘心啊.
意外發現Navicat Premium的鏈接配置居然有個http tunnel,驚喜啊, google了一下,原來是利用php訪問mysql,而後再把數據轉發回來
對於一個php小白, 只會go和c++, 只能google下, 一通胡搞
執行過程

(1) 複製Navicat Premium目錄下的`/Applications/Navicat Premium.app/Contents/Resources/ntunnel_mysql.php`到docker的nginx的靜態文件目錄www下, 這樣nginx能夠訪問到
(2) 安裝php-fpm, yum install -y php-fpm, 安裝完成後運行php-fpm & .
(3) 配置nginx

server {
    listen      80;
    server_name t1.test.example.com;
    root        /etc/nginx/www;
    access_log  /var/log/nginx/access.log  main;
    error_log   /var/log/nginx/error.log;

    location /ntunnel_mysql.php {
        fastcgi_pass 127.0.0.1:9000;
        include fastcgi_params;
        fastcgi_param  SCRIPT_FILENAME /etc/nginx/www/ntunnel_mysql.php;
    }
}