Host vitals: Public IP address

[mikermcneil]

Goal

As a user in Fleet, I want to see the primary, public IP. e.g. that might mean the single (non-link-local, non-loopback) address from the most active interface, or it could be deduced by Fleet using IP associated with the HTTP and the request x-forwarded-for header.

• Bonus: Better yet, implement this in such a way that it is exposed as an osquery table so that it can be used for labels, policies, scheduling, and more. (Why? If laptop is opened in a geography where there may be increased risk, admins want awareness. Also, there may be legal/HR use cases that involve knowing if a device is near a high human risk event, e.g. a natural disaster in a city)

• Bonus (consider splitting into separate issue): Alternatively, as a user in Fleet, I want to additionally see all available IP addresses associated with the host on the host details page and host vitals API.

How?

• TODO

[mikermcneil]

This (or something similar that gets the true, public IP) is a prerequisite for #1416

[mikermcneil]

Some discussion about how to maybe achieve this and challenges w/ x-forwarded-for

mikermcneil 2 hours ago
Is this (goofy IP address) a known issue in Fleet?
My first thought is that this is probably showing me my local IP address on my home router rather than my public IP. The public IP seems more useful most of the time and a better default, though I can see why users might want to be able to use osquery to glean both.

Using a public IP in host vitals by default would also mean IP geolocation and even including a map widget in the UI would become easy.

What are your thoughts on changing this in a major release of Fleet? (or finding some backwards compatible way of doing it?) (edited)
2 files

Zach Wasserman:date: 2 hours ago
This is the IP we get from osquery, so yeah it's your IP on your local network.

mikermcneil 2 hours ago
So osquery won't give us a public IP?

Benjamin Edwards 2 hours ago
We can get public IP from http requests on the server. Though not 100% guarantee, it’s generally pretty safe. Though if hosts are being VPN they’ll all look like they’re in the same place. Using something like MaxMind to do IP to Geo lookup

Zach Wasserman:date: 2 hours ago
Ben's right. We might want to store a public_ip along with what we currently store which could be called local IP. This could also be accessed through the curl table in osquery if it made a network request to a public server, but users may not like their hosts doing that.

Benjamin Edwards 1 hour ago
I thought about curl table but decided capturing public ip from server might be better, even if it’s a little less reliable
💯
1

Zach Wasserman:date: 1 hour ago
I think in most cases the Fleet server would see the same IP as the server that would be hit for the curl table.

Benjamin Edwards 1 hour ago
Generally yes I think it’s safe to assume

Benjamin Edwards 1 hour ago
I keep qualifying my statements with best case scenarios because we have to rely on the integrity of X headers in the http requests

Benjamin Edwards 1 hour ago
Like X-Forwarded-For or something similar

Zach Wasserman:date: 1 hour ago
That makes sense. Well-behaving load balancers will include the X-Forwarded-For
:party_gopher:
1

Benjamin Edwards 1 hour ago
Key phrase being well-behaved
😅
1

mikermcneil:walking: 14 minutes ago
Not sure if the same considerations apply or if our golang server has stronger conventions, but this reminds me of the trustProxy setting in Express/Sails, which folks occasionally seem to need to customize quite a lot. Doug from Express finally just made it a configurable function
In the Sails docs, we have a trustProxy: true default that we recommend for folks on a basic prod environment, like a PaaS or something simple. For folks with multiple tiers of LBs and/or custom proxy stuff, they sometimes have to use the escape hatch
FWIW as a data point: I think we added the setting in 2016, deliberately minimized the config surface, and then in 2019 or so someone finally had a valid use case and added the escape hatch to Express's more flexible options

[mikermcneil]

@edwardsb ^my notes about x-forwarded-for

[mikermcneil]

One solution: Host vitals just uses the curl table and asks an api "what's my public ip?"