恶意代码中的docker私有注册表（v2）的HTTP响应格式错误 [英] malformed HTTP response with docker private registry (v2) behind an nginx proxy
问题描述
我在CentOS 7框上设置了一个Docker私人注册表（v2），其官方说明如下： https ：//docs.docker.com/registry/deploying/
I have setup a Docker private registry (v2) on a CentOS 7 box following their offical documentation: https://docs.docker.com/registry/deploying/
我在Fedora 21框上运行docker 1.6.0。
I am running docker 1.6.0 on a Fedora 21 box.
注册表正在端口5000上运行，并且正在使用由受信任的CA签名的SSL密钥。我将docker-registry.example.com的DNS记录设置为服务器的内部IP。运行'docker pull docker-registry.example.com:5000/tag/image'，它按预期工作。
The registry is running on port 5000, and is using an SSL key signed by a trusted CA. I set a DNS record for 'docker-registry.example.com' to be the internal IP of the server. Running 'docker pull docker-registry.example.com:5000/tag/image', it works as expected.
我设置了一个运行nginx版本的nginx服务器：nginx / 1.8.0，并为'nginx-proxy.example.com'设置了一个指向nginx的dns记录服务器，并设置一个站点。这是配置：
I setup an nginx server, running nginx version: nginx/1.8.0, and setup a dns record for 'nginx-proxy.example.com' pointing to the nginx server, and setup a site. Here is the config:
server {
listen 443 ssl;
server_name nginx-proxy.example.com;
add_header Docker-Distribution-Api-Version: registry/2.0 always;
ssl on;
ssl_certificate /etc/ssl/certs/cert.crt;
ssl_certificate_key /etc/ssl/certs/key.key;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Original-URI $request_uri;
proxy_set_header Docker-Distribution-Api-Version registry/2.0;
location / {
proxy_pass http://docker-registry.example.com:5000;
}
}
当我尝试运行'docker pull nginx-proxy .example.com / tag / image'我收到以下错误：
When I try to run 'docker pull nginx-proxy.example.com/tag/image' I get the following error:
FATA[0001] Error response from daemon: v1 ping attempt failed with error: Get https://nginx-proxy.example.com/v1/_ping: malformed HTTP response "\x15\x03\x01\x00\x02\x02"
我的问题是双重的。
- 为什么docker客户端寻找/ v1_ / ping？
- 为什么我看到'畸形的http响应'
如果我运行'curl -v nginx-proxy.example.com/v2'，我看到： / p>
If I run 'curl -v nginx-proxy.example.com/v2' I see:
[root@alex amerenda] $ curl -v https://nginx-proxy.example.com/v2/
* Hostname was NOT found in DNS cache
* Trying 10.1.43.165...
* Connected to nginx-proxy.example.com (10.1.43.165) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
* SSL connection using TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
* Server certificate:
* subject: CN=*.example.com,O="example, Inc.",L=New York,ST=New York,C=US
* start date: Sep 15 00:00:00 2014 GMT
* expire date: Sep 15 23:59:59 2015 GMT
* common name: *.example.com
* issuer: CN=GeoTrust SSL CA - G2,O=GeoTrust Inc.,C=US
> GET /v2/ HTTP/1.1
> User-Agent: curl/7.37.0
> Host: nginx-proxy.example.com
> Accept: */*
> \x15\x03\x01\x00\x02\x02
如果我'curl -v docker-registry.example.com'我得到一个200 OK响应。所以nginx必须对此负责。有没有人知道为什么会发生这种情况？这是驱使我疯了！
If I do 'curl -v docker-registry.example.com' I get a 200 OK response. So nginx has to be responsible for this. Does anyone have an idea why this is happening? It is driving me insane!
推荐答案
proxy_pass http://docker-registry.example.com:5000;
您使用纯HTTP传递请求（即没有https）
you are passing the request with plain HTTP (i.e. no https)
\x15\x03\x01\x00\x02\x02
\x15\x03\x01\x00\x02\x02
而您正在收到SSL响应。所以看起来你必须使用https：//而不是http：//来访问端口5000.你甚至知道你正在使用SSL：
And you are getting a SSL response back. So it looks like you must use https:// and not http:// to access port 5000. And you even know that you are using SSL:
注册表在端口5000上运行，并且正在使用由受信任的CA签名的SSL密钥...
The registry is running on port 5000, and is using an SSL key signed by a trusted CA...
从那里：请使用为example.com保留的名称，不要在您的示例中使用不属于您的域名。
Apart from that: please use the names reserved for examples like example.com and don't use domain names in your example which don't belong to you.
这篇关于恶意代码中的docker私有注册表（v2）的HTTP响应格式错误的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
