sending proxy protocol

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
2 messages Options
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

sending proxy protocol

Marc Boschma
I’ve been trying to work out if Squid can inject a proxy protocol to down stream destinations… hopefully proxy protocol version 2 [1].

The scenario is as follows:

Server — CONNECT request + out of bound request ID in HTTP header —> ELB on 3128 added proxy protocol v1 with Server’s IP details —> SQUID extracts proxy protocol v1 to get Server’s IP details, extracts request ID, processes CONNECT request, injects proxy-protocol v2 in front of CONNECT TLS stream with either PP2_TYPE_NETNS TLV populated with request ID or better yet a custom TLV with the same info —> Reverse Proxy that accepts proxy-protocol v2.

The main aim of the game is to:
* be able to log as much detail as each hop to allow for correlation of logs through the infrastructure. Especially since the TLS is end to end between Server and Reverse Proxy.
* give the Reverse Proxy as much detail about the origin of the request.

I’ve been able to find that SQUID can accept the proxy protocol from the ELB… I’m curious as to whether or not the proxy protocol and TLV (NETNS or another) can be set?

Regards,

Marc


[1] https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt
_______________________________________________
squid-users mailing list
[hidden email]
http://lists.squid-cache.org/listinfo/squid-users
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: sending proxy protocol

Amos Jeffries
Administrator
On 30/06/17 10:18, Marc Boschma wrote:
> I’ve been trying to work out if Squid can inject a proxy protocol to down stream destinations… hopefully proxy protocol version 2 [1].
>

At present Squid can only receive PROXYv1/2 protocol.

The infrastructure is now in place to add it relatively easily if you
want to develop a patch.

PS. If you want to sponsor development instead of writing it yourself I
am available for that at present.

Amos
_______________________________________________
squid-users mailing list
[hidden email]
http://lists.squid-cache.org/listinfo/squid-users
Loading...