|
|
@@ -0,0 +1,148 @@
|
|
|
+<!DOCTYPE html>
|
|
|
+<html prefix="og: http://ogp.me/ns# article: http://ogp.me/ns/article# " vocab="http://ogp.me/ns" lang="en">
|
|
|
+<head>
|
|
|
+<meta charset="utf-8">
|
|
|
+<meta name="viewport" content="width=device-width">
|
|
|
+<title>Cloudflare Shenanigans | Pleasant Programmer</title>
|
|
|
+<link href="../assets/css/rst.css" rel="stylesheet" type="text/css">
|
|
|
+<link href="../assets/css/code.css" rel="stylesheet" type="text/css">
|
|
|
+<link href="../assets/css/theme.css" rel="stylesheet" type="text/css">
|
|
|
+<link href="../assets/css/custom.css" rel="stylesheet" type="text/css">
|
|
|
+<link rel="alternate" type="application/rss+xml" title="RSS" href="../rss.xml">
|
|
|
+<link rel="canonical" href="http://pleasantprogrammer.com/posts/cloudflare-shenanigans.html">
|
|
|
+<script type="text/javascript" src="//use.typekit.net/iwm5axp.js"></script><script type="text/javascript">try{Typekit.load();}catch(e){}</script><!--[if lt IE 9]><script src="../assets/js/html5.js"></script><![endif]--><meta name="author" content="Thomas Dy">
|
|
|
+<link rel="prev" href="tiddlywiki-in-the-sky-or-tiddlyweb-for-tw5.html" title="TiddlyWiki in the Sky (or TiddlyWeb for TW5)" type="text/html">
|
|
|
+<meta property="og:site_name" content="Pleasant Programmer">
|
|
|
+<meta property="og:title" content="Cloudflare Shenanigans">
|
|
|
+<meta property="og:url" content="http://pleasantprogrammer.com/posts/cloudflare-shenanigans.html">
|
|
|
+<meta property="og:description" content="An old client of ours managed to convince a telco to zero-rate the data for their app. In order to whitelist it though, we needed to use plain HTTP for domain whitelisting. For HTTPS, they can only wh">
|
|
|
+<meta property="og:type" content="article">
|
|
|
+<meta property="article:published_time" content="2015-12-25T14:13:26+08:00">
|
|
|
+<meta property="article:tag" content="cloudflare">
|
|
|
+<meta property="article:tag" content="sysadmin">
|
|
|
+</head>
|
|
|
+<body>
|
|
|
+<a href="#content" class="sr-only sr-only-focusable">Skip to main content</a>
|
|
|
+
|
|
|
+ <header id="header" role="banner"><div class="thomas">
|
|
|
+ <img src="../assets/img/thomas.gif" alt="DJ THOMAS IN DA HAUS"><img src="../assets/img/thomas.png" alt="Pleasant Programmer">
|
|
|
+</div>
|
|
|
+
|
|
|
+ <h1 id="brand"><a href="http://pleasantprogrammer.com/" title="Pleasant Programmer" rel="home">
|
|
|
+
|
|
|
+ <span id="blog-title">Pleasant Programmer</span>
|
|
|
+ </a></h1>
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+ <nav id="menu" role="navigation"><ul>
|
|
|
+<li class="twitter"><a href="http://twitter.com/pleasantprog">@pleasantprog</a></li>
|
|
|
+ <li><a href="../archive.html">Archives</a></li>
|
|
|
+ <li><a href="../categories/index.html">Tags</a></li>
|
|
|
+ <li><a href="../rss.xml">RSS</a></li>
|
|
|
+
|
|
|
+
|
|
|
+ </ul></nav></header><div id="container">
|
|
|
+ <main id="content" role="main"><article class="post-text h-entry hentry postpage" itemscope="itemscope" itemtype="http://schema.org/Article"><header><h1 class="p-name entry-title" itemprop="headline name"><a href="#" class="u-url">Cloudflare Shenanigans</a></h1>
|
|
|
+
|
|
|
+ <small>
|
|
|
+ <span class="dateline">Posted: <a href="#" rel="bookmark"><time class="published dt-published" datetime="2015-12-25T14:13:26+08:00" itemprop="datePublished" title="2015-12-25 14:13">2015-12-25 14:13</time></a></span>
|
|
|
+ |
|
|
|
+ More posts about
|
|
|
+
|
|
|
+ <a class="tag p-category" href="../categories/cloudflare.html" rel="tag">cloudflare</a>
|
|
|
+ <a class="tag p-category" href="../categories/sysadmin.html" rel="tag">sysadmin</a>
|
|
|
+
|
|
|
+ </small>
|
|
|
+
|
|
|
+
|
|
|
+ </header><div class="e-content entry-content" itemprop="articleBody text">
|
|
|
+ <div>
|
|
|
+<p>An old client of ours managed to convince a telco to zero-rate the data for their app. In order to whitelist it though, we needed to use plain HTTP for domain whitelisting. For HTTPS, they can only whitelist by IP address. Like any good developer, we were using HTTPS. Also, like any good developer, we put our server behind Cloudflare.</p>
|
|
|
+<p>Now the problem is that Cloudflare can put you behind <a href="https://www.cloudflare.com/ips/">any IP they own</a>, which is a huge range. There's no guarantee that the IP we have now is going to be the same later on. So we did the reasonable thing and asked them to whitelist all of the Cloudflare IPs. And the telco agreed! We were in total disbelief when that happened. But hey, if life gives you free internet, you take it.</p>
|
|
|
+<p>We never actually empirically tested whether other sites hosted on Cloudflare were also actually zero-rated. But I like to think that we saved a lot of people on their data costs from browsing Reddit and 4chan. But alas, good things must come to an end.</p>
|
|
|
+<p>A few months after we started beta testing the app, Cloudflare added more IPs to their range. Unfortunately, our server got moved to those new IPs which were not whitelisted yet. Apparently, the telco whitelisting process was incredibly convoluted and time consuming. Our client didn't want to bother asking them to whitelist more IPs. We also tried asking Cloudflare to move us back to the original IP range, but they could only do that if we were in their enterprise tier. We couldn't really afford that, so we looked for other options.</p>
|
|
|
+<p>Since Cloudflare was essentially just a giant reverse proxy, theoretically there should be no distinction between one IP address from another. The specific IP we get is probably just for load balancing. So we tried accessing the IPs in the range directly and just setting the Host header and it worked! But we get SSL errors because the IP itself doesn't have its own certificate.</p>
|
|
|
+<p>After more testing, we figured out that you could actually use any Cloudflare backed domain so long as we properly set the Host header. We just needed to find one still in the old range. Coincidentally, 4chan.org was. Which led to this wonderful commit</p>
|
|
|
+<pre class="code literal-block">commit 123456789abcdef
|
|
|
+Author: ~~~~~~
|
|
|
+Date: ~~~~~~
|
|
|
+
|
|
|
+ 4chan hack
|
|
|
+
|
|
|
+<span class="gh">diff --git a/src/com/client/common/Util.java b/src/com/client/common/Util.java</span>
|
|
|
+<span class="gd">--- a/src/com/client/common/Util.java</span>
|
|
|
+<span class="gi">+++ b/src/com/client/common/Util.java</span>
|
|
|
+<span class="gu">@@ -210,7 +210,8 @@ public class Util {</span>
|
|
|
+ }
|
|
|
+
|
|
|
+ public static String getServerAddress(Context context) {
|
|
|
+<span class="gd">- String address = "https://backend.client.com";</span>
|
|
|
+<span class="gi">+ // String address = "https://backend.client.com";</span>
|
|
|
+<span class="gi">+ String address = "https://4chan.org";</span>
|
|
|
+ if(!isDebug(context)) return address;
|
|
|
+ try {
|
|
|
+<span class="gh">diff --git a/src/com/client/common/logging/APIClient.java b/src/com/client/common/logging/APIClient.java</span>
|
|
|
+<span class="gd">--- a/src/com/client/common/logging/APIClient.java</span>
|
|
|
+<span class="gi">+++ b/src/com/client/common/logging/APIClient.java</span>
|
|
|
+<span class="gu">@@ -101,6 +101,7 @@ public class APIClient {</span>
|
|
|
+ private HttpResponse postInternal(String url, List<NameValuePair> data, boolean forRegistration) throws ClientProtocolException, IOException {
|
|
|
+ HttpPost request = new HttpPost(Util.getServerAddress(mContext)+"/api/"+url);
|
|
|
+ request.setHeader("X-API-VERSION", apiVersion);
|
|
|
+<span class="gi">+ request.setHeader("Host", "backend.client.com");</span>
|
|
|
+
|
|
|
+ if(data == null) {
|
|
|
+ data = new ArrayList<NameValuePair>();
|
|
|
+</pre>
|
|
|
+
|
|
|
+
|
|
|
+<p>Eventually, we did decide to just abandon Cloudflare for the server. We probably weren't going to be the target of a DDOS or anything. This also allowed us to do more secure things like pinning the server certificate in the application itself. Clearly, this is what we should have just done in the first place, but at the time we just wanted a stopgap solution.</p>
|
|
|
+<p>I just still find it funny we were making people's phones go to 4chan.org everyday for more than a year.</p>
|
|
|
+</div>
|
|
|
+ </div>
|
|
|
+ <aside class="postpromonav"><nav><ul class="pager clearfix">
|
|
|
+<li class="previous">
|
|
|
+ <a href="tiddlywiki-in-the-sky-or-tiddlyweb-for-tw5.html" rel="prev" title="TiddlyWiki in the Sky (or TiddlyWeb for TW5)">← Previous post</a>
|
|
|
+ </li>
|
|
|
+ </ul></nav></aside><section class="comments"><div id="disqus_thread"></div>
|
|
|
+ <script>
|
|
|
+ var disqus_shortname ="pleasantprog",
|
|
|
+ disqus_url="http://pleasantprogrammer.com/posts/cloudflare-shenanigans.html",
|
|
|
+ disqus_title="Cloudflare Shenanigans",
|
|
|
+ disqus_identifier="cache/posts/cloudflare-shenanigans.html",
|
|
|
+ disqus_config = function () {
|
|
|
+ this.language = "en";
|
|
|
+ };
|
|
|
+ (function() {
|
|
|
+ var dsq = document.createElement('script'); dsq.async = true;
|
|
|
+ dsq.src = '//' + disqus_shortname + '.disqus.com/embed.js';
|
|
|
+ (document.getElementsByTagName('head')[0] || document.getElementsByTagName('body')[0]).appendChild(dsq);
|
|
|
+ })();
|
|
|
+ </script><noscript>Please enable JavaScript to view the <a href="//disqus.com/?ref_noscript" rel="nofollow">comments powered by Disqus.</a>
|
|
|
+</noscript>
|
|
|
+ <a href="//disqus.com" class="dsq-brlink" rel="nofollow">Comments powered by <span class="logo-disqus">Disqus</span></a>
|
|
|
+
|
|
|
+
|
|
|
+ </section></article><script>var disqus_shortname="pleasantprog";(function(){var a=document.createElement("script");a.async=true;a.src="//"+disqus_shortname+".disqus.com/count.js";(document.getElementsByTagName("head")[0]||document.getElementsByTagName("body")[0]).appendChild(a)}());</script></main><footer id="footer" role="contentinfo"><p><a rel="license" href="http://creativecommons.org/licenses/by-sa/3.0/deed.en_US"><img alt="CC-BY-SA" style="border-width:0" src="http://i.creativecommons.org/l/by-sa/3.0/80x15.png"></a> © 2015 Thomas Dy - Powered by <a href="http://getnikola.com">Nikola</a></p>
|
|
|
+
|
|
|
+ </footer>
|
|
|
+</div>
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+ <script src="../assets/js/konami.js"></script><script src="http://code.jquery.com/jquery-2.0.3.min.js"></script><script>
|
|
|
+ var easter_egg = new Konami();
|
|
|
+ easter_egg.code = function() {
|
|
|
+ $(".thomas").toggleClass("whoa");
|
|
|
+ $("body").scrollTop(0);
|
|
|
+ }
|
|
|
+ easter_egg.load();
|
|
|
+
|
|
|
+ // love you, thomas!
|
|
|
+ // yours, @_phi + @meggykawsek
|
|
|
+ </script>
|
|
|
+</body>
|
|
|
+</html>
|
