Add support for HA PROXY v1 #22
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Closed
|
this looks great, thanks... I'll merge tomorrow after I tried it somehow |
| (* basically it looks like: | ||
| * PROXY TCP4 SOURCEIP DESTIP SRCPORT DESTPORT\r\n *) | ||
| let own_sockaddr = getsockname socket in | ||
| let peer_sockaddr = getpeername socket in |
There was a problem hiding this comment.
they should both be Unix.getXname...
Resolves hannesm#6 This commit adds a flag (`--haproxy1`) which causes tlstunnel to send connection details to the destination upon connection. This is useful if running `nginx`, `Varnish` or similar behind `tlstunnel` in order to obtain the IP of the client. Example of a TCP/IPv4 connection from 127.0.0.1:39837 to 127.0.0.1:4433: ``` PROXY TCP4 127.0.0.1 127.0.0.1 39837 4433 ``` Relevant `nginx` documentation on how to use the PROXY protocol: https://www.nginx.com/resources/admin-guide/proxy-protocol/
|
Example usage for testing: Run netcat listener: connect using tlsclient: |
| let header = String.concat " " | ||
| [ "PROXY" ; protocol_string ; peer_addr ; own_addr ; peer_port ; own_port ] | ||
| in | ||
| header ^ "\r\n" |
There was a problem hiding this comment.
this could be folded into the above String.concat
There was a problem hiding this comment.
you could:
String.concat " "
[ "PROXY" ; protocol_string ; peer_addr ; own_addr ; peer_port ; own_port ^ "\r\n" ]
I'm undecided which is more readable...
There was a problem hiding this comment.
Ah, right.
I'm fine with both, feel free to change it.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Resolves #6
This commit adds a flag (
--haproxy1) which causes tlstunnel to sendconnection details to the destination upon connection.
This is useful if running
nginx,Varnishor similar behindtlstunnelin orderto obtain the IP of the client.
Example of a TCP/IPv4 connection from 127.0.0.1:39837 to 127.0.0.1:4433:
Relevant
nginxdocumentation on how to use the PROXY protocol: https://www.nginx.com/resources/admin-guide/proxy-protocol/