client-proxy: WARN "invalid host" spam from unroutable bare-IP Host requests (external probes)
维护者通常 2 天内回复
评估
调研方向
该改动应放在 packages/shared/pkg/proxy/handler.go 中 handler() 的 ErrInvalidHost 分支里，该分支使用 host.go 中的 isLocalRequestHost 以及路由头检查。请先阅读这些辅助函数，然后为 Host 只是裸 IP、且没有 E2b-Sandbox-Id/E2b-Sandbox-Port 头的情况添加单元测试。完成标准是：该情况以 Debug 级别记录日志，格式错误的域名 Host 仍以 Warn 级别记录日志，并且 400 响应保持不变。开 PR 之前请先与维护者确认方向。
由索引模型根据 Issue 内容生成。
描述
Summary
client-proxy logs WARN "invalid host" for every inbound request whose Host is a bare IP address with no sandbox routing headers. On any proxy with a public endpoint these arrive continuously from external scanners, health probes, and stale clients still pointed at an old node IP, producing ~1 line/second of WARN noise that drowns real warnings.
Observed (client-proxy):
WARN invalid host {"service":"client-proxy","host":"118.196.30.209"}
WARN invalid host {"service":"client-proxy","host":"118.196.30.209"}
... (repeats every ~1s)
Why these are expected, not warnings
packages/shared/pkg/proxy/handler.go rejects the request with ErrInvalidHost and returns 400, which is correct. But a bare-IP Host cannot encode sandbox routing ({port}-{sandboxID}.{domain}) — as isLocalRequestHost in host.go documents, header-based routing is the only mechanism that can work for an IP host. So an IP Host that also carries no routing headers (E2b-Sandbox-Id / E2b-Sandbox-Port) is, by construction, unroutable. Rejecting it is the designed behavior; logging it at WARN on every hit just turns routine external traffic into log spam.
(Header-based routing for IP hosts — #2581 — is unaffected: an IP host with routing headers routes fine and never reaches this branch.)
Proposal
In the ErrInvalidHost branch of handler(), log at Debug when the host is a raw IP / localhost and no routing headers are present (isLocalRequestHost(r.Host) && !hasRoutingHeaders(r.Header)), and keep Warn for a genuinely suspect invalid host (a malformed domain host), which is rare and worth visibility. Status code stays 400 in both cases — this only changes log level, not behavior.
Environment
Reproduced on client-proxy main; the proxy sits behind a public ingress, so any internet host hitting the raw IP triggers it. Same code path in api (OpenAPI validator logs the same raw-IP / requests as 404 no matching operation), but the client-proxy WARN is the loudest.
Happy to send the PR (small, with a unit test) if the direction is acceptable.
- 主要语言
- Go
- 星标
- 1.8k
- 派生
- 503
- PR 合并指标
- 30 天内没有已合并 PR
环境准备
在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
e2b-dev/runtime 的其他 Issue
-
orchestrator: NFS-cache "cache path is not set" WARN logged on every build/launch instead of once可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 2 天内回复
-
api: autoPause default is declared in the spec and in a Go constant with no test keeping them in sync可能已有人在做 @AdaAibaby 于 4 天前认领。 未关闭
难度 2/5 1-3 小时 新手友好度 84/100
维护者通常 2 天内回复
-
难度 2/5 1-3 小时 新手友好度 68/100
维护者通常 2 天内回复
-
[Bug]: flock() on a mounted volume hangs forever (mount is missing `nolock`)可能已有人在做 @AdaAibaby 于 56 天前认领。 未关闭
难度 2/5 1-3 小时 新手友好度 88/100
维护者通常 2 天内回复
-
sandbox cache: StartRemoving state transition not broadcast, all allocations see stale Running state可能重新可做 关联的 PR 已关闭且未合并。 未关闭
难度 2/5 1-3 小时 新手友好度 86/100
维护者通常 2 天内回复
相似的 Issue
-
fix(scan): validate and normalize output format in validate-contract可能已有人在做 @WKr1shna 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 1 天内回复
-
bug good first issue help wanted
难度 2/5 1-3 小时 新手友好度 70/100
-
Won't Fix
难度 2/5 1-3 小时 新手友好度 62/100
microsoft/TypeScript#65107 · 1 条评论 ·
维护者通常 1 天内回复
-
难度 1/5 1 小时以内 新手友好度 78/100
argoproj/argo-workflows#17397 ·
维护者通常 1 天内回复