Skip to content

Commit e1831c4

Browse files
c0va23traefiker
c0va23
authored and
traefiker
committed
Add support proxyprotocol v2
1 parent 4ec90c5 commit e1831c4

File tree

6 files changed

+78
-16
lines changed

6 files changed

+78
-16
lines changed

‎docs/content/routing/entrypoints.md

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -128,7 +128,11 @@ entryPoints:
128128

129129
## ProxyProtocol
130130

131-
Traefik supports [ProxyProtocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt).
131+
Traefik supports [ProxyProtocol](https://www.haproxy.org/download/2.0/doc/proxy-protocol.txt) version 1 and 2.
132+
133+
If proxyprotocol header parsing is enabled for the entry point, this entry point can accept connections with or without proxyprotocol headers.
134+
135+
If the proxyprotocol header is passed, then the version is determined automatically.
132136

133137
??? example "Enabling Proxy Protocol with Trusted IPs"
134138

‎go.mod

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ require (
1616
github.com/VividCortex/gohistogram v1.0.0 // indirect
1717
github.com/abbot/go-http-auth v0.0.0-00010101000000-000000000000
1818
github.com/abronan/valkeyrie v0.0.0-20190802193736-ed4c4a229894
19-
github.com/armon/go-proxyproto v0.0.0-20190211145416-68259f75880e
19+
github.com/c0va23/go-proxyprotocol v0.9.1
2020
github.com/cenkalti/backoff/v3 v3.0.0
2121
github.com/containerd/continuity v0.0.0-20190426062206-aaeac12a7ffc // indirect
2222
github.com/containous/alice v0.0.0-20181107144136-d83ebdd94cbd

‎go.sum

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -71,15 +71,15 @@ github.com/aliyun/alibaba-cloud-sdk-go v0.0.0-20190808125512-07798873deee/go.mod
7171
github.com/aliyun/aliyun-oss-go-sdk v0.0.0-20190307165228-86c17b95fcd5/go.mod h1:T/Aws4fEfogEE9v+HPhhw+CntffsBHJ8nXQCwKr0/g8=
7272
github.com/apache/thrift v0.12.0 h1:pODnxUFNcjP9UTLZGTdeh+j16A8lJbRvD3rOtrk/7bs=
7373
github.com/apache/thrift v0.12.0/go.mod h1:cp2SuWMxlEZw2r+iP2GNCdIi4C1qmUzdZFSVb+bacwQ=
74-
github.com/armon/go-proxyproto v0.0.0-20190211145416-68259f75880e h1:h0gP0hBU6DsA5IQduhLWGOEfIUKzJS5hhXQBSgHuF/g=
75-
github.com/armon/go-proxyproto v0.0.0-20190211145416-68259f75880e/go.mod h1:QmP9hvJ91BbJmGVGSbutW19IC0Q9phDCLGaomwTJbgU=
7674
github.com/aws/aws-sdk-go v1.16.23/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
7775
github.com/aws/aws-sdk-go v1.23.0 h1:ilfJN/vJtFo1XDFxB2YMBYGeOvGZl6Qow17oyD4+Z9A=
7876
github.com/aws/aws-sdk-go v1.23.0/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
7977
github.com/baiyubin/aliyun-sts-go-sdk v0.0.0-20180326062324-cfa1a18b161f/go.mod h1:AuiFmCCPBSrqvVMvuqFuk0qogytodnVFVSN5CeJB8Gc=
8078
github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
8179
github.com/beorn7/perks v1.0.0 h1:HWo1m869IqiPhD389kmkxeTalrjNbbJTC8LXupb+sl0=
8280
github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
81+
github.com/c0va23/go-proxyprotocol v0.9.1 h1:5BCkp0fDJOhzzH1lhjUgHhmZz9VvRMMif1U2D31hb34=
82+
github.com/c0va23/go-proxyprotocol v0.9.1/go.mod h1:TNjUV+llvk8TvWJxlPYAeAYZgSzT/iicNr3nWBWX320=
8383
github.com/cenkalti/backoff/v3 v3.0.0 h1:ske+9nBpD9qZsTBoF41nW5L+AIuFBKMeze18XQ3eG1c=
8484
github.com/cenkalti/backoff/v3 v3.0.0/go.mod h1:cIeZDE3IrqwwJl6VUwCN6trj1oXrTS4rc0ij+ULvLYs=
8585
github.com/census-instrumentation/opencensus-proto v0.2.0 h1:LzQXZOgg4CQfE6bFvXGM30YZL1WW/M337pXml+GrcZ4=
@@ -203,6 +203,7 @@ github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfU
203203
github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903 h1:LbsanbbD6LieFkXbj9YNNBupiGHJgFeLpO0j0Fza1h8=
204204
github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
205205
github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
206+
github.com/golang/mock v1.2.0 h1:28o5sBqPkBsMGnC6b4MvE2TzSr5/AT4c/1fLqVGIwlk=
206207
github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
207208
github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
208209
github.com/golang/protobuf v1.3.1 h1:YF8+flBXS5eO826T4nzqPrxfhQThhXl0YzfuUPu4SBg=

‎integration/proxy_protocol_test.go

Lines changed: 55 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,34 @@ func (s *ProxyProtocolSuite) TestProxyProtocolTrusted(c *check.C) {
2121
gatewayIP := s.composeProject.Container(c, "haproxy").NetworkSettings.Gateway
2222
haproxyIP := s.composeProject.Container(c, "haproxy").NetworkSettings.IPAddress
2323
whoamiIP := s.composeProject.Container(c, "whoami").NetworkSettings.IPAddress
24+
25+
file := s.adaptFile(c, "fixtures/proxy-protocol/with.toml", struct {
26+
HaproxyIP string
27+
WhoamiIP string
28+
}{HaproxyIP: haproxyIP, WhoamiIP: whoamiIP})
29+
defer os.Remove(file)
30+
31+
cmd, display := s.traefikCmd(withConfigFile(file))
32+
defer display(c)
33+
err := cmd.Start()
34+
c.Assert(err, checker.IsNil)
35+
defer cmd.Process.Kill()
36+
37+
err = try.GetRequest("http://"+haproxyIP+"/whoami", 500*time.Millisecond,
38+
try.StatusCodeIs(http.StatusOK),
39+
try.BodyContains("X-Forwarded-For: "+gatewayIP))
40+
c.Assert(err, checker.IsNil)
41+
}
42+
43+
func (s *ProxyProtocolSuite) TestProxyProtocolV2Trusted(c *check.C) {
44+
gatewayIP := s.composeProject.Container(c, "haproxy").NetworkSettings.Gateway
45+
haproxyIP := s.composeProject.Container(c, "haproxy").NetworkSettings.IPAddress
46+
whoamiIP := s.composeProject.Container(c, "whoami").NetworkSettings.IPAddress
47+
2448
file := s.adaptFile(c, "fixtures/proxy-protocol/with.toml", struct {
2549
HaproxyIP string
2650
WhoamiIP string
27-
}{haproxyIP, whoamiIP})
51+
}{HaproxyIP: haproxyIP, WhoamiIP: whoamiIP})
2852
defer os.Remove(file)
2953

3054
cmd, display := s.traefikCmd(withConfigFile(file))
@@ -33,18 +57,42 @@ func (s *ProxyProtocolSuite) TestProxyProtocolTrusted(c *check.C) {
3357
c.Assert(err, checker.IsNil)
3458
defer cmd.Process.Kill()
3559

36-
err = try.GetRequest("http://"+haproxyIP+"/whoami", 500*time.Millisecond, try.StatusCodeIs(http.StatusOK), try.BodyContains("X-Forwarded-For: "+gatewayIP))
37-
display(c)
60+
err = try.GetRequest("http://"+haproxyIP+":81/whoami", 500*time.Millisecond,
61+
try.StatusCodeIs(http.StatusOK),
62+
try.BodyContains("X-Forwarded-For: "+gatewayIP))
3863
c.Assert(err, checker.IsNil)
3964
}
4065

4166
func (s *ProxyProtocolSuite) TestProxyProtocolNotTrusted(c *check.C) {
4267
haproxyIP := s.composeProject.Container(c, "haproxy").NetworkSettings.IPAddress
4368
whoamiIP := s.composeProject.Container(c, "whoami").NetworkSettings.IPAddress
69+
70+
file := s.adaptFile(c, "fixtures/proxy-protocol/without.toml", struct {
71+
HaproxyIP string
72+
WhoamiIP string
73+
}{HaproxyIP: haproxyIP, WhoamiIP: whoamiIP})
74+
defer os.Remove(file)
75+
76+
cmd, display := s.traefikCmd(withConfigFile(file))
77+
defer display(c)
78+
err := cmd.Start()
79+
c.Assert(err, checker.IsNil)
80+
defer cmd.Process.Kill()
81+
82+
err = try.GetRequest("http://"+haproxyIP+"/whoami", 500*time.Millisecond,
83+
try.StatusCodeIs(http.StatusOK),
84+
try.BodyContains("X-Forwarded-For: "+haproxyIP))
85+
c.Assert(err, checker.IsNil)
86+
}
87+
88+
func (s *ProxyProtocolSuite) TestProxyProtocolV2NotTrusted(c *check.C) {
89+
haproxyIP := s.composeProject.Container(c, "haproxy").NetworkSettings.IPAddress
90+
whoamiIP := s.composeProject.Container(c, "whoami").NetworkSettings.IPAddress
91+
4492
file := s.adaptFile(c, "fixtures/proxy-protocol/without.toml", struct {
4593
HaproxyIP string
4694
WhoamiIP string
47-
}{haproxyIP, whoamiIP})
95+
}{HaproxyIP: haproxyIP, WhoamiIP: whoamiIP})
4896
defer os.Remove(file)
4997

5098
cmd, display := s.traefikCmd(withConfigFile(file))
@@ -53,7 +101,8 @@ func (s *ProxyProtocolSuite) TestProxyProtocolNotTrusted(c *check.C) {
53101
c.Assert(err, checker.IsNil)
54102
defer cmd.Process.Kill()
55103

56-
err = try.GetRequest("http://"+haproxyIP+"/whoami", 500*time.Millisecond, try.StatusCodeIs(http.StatusOK), try.BodyContains("X-Forwarded-For: "+haproxyIP))
57-
display(c)
104+
err = try.GetRequest("http://"+haproxyIP+":81/whoami", 500*time.Millisecond,
105+
try.StatusCodeIs(http.StatusOK),
106+
try.BodyContains("X-Forwarded-For: "+haproxyIP))
58107
c.Assert(err, checker.IsNil)
59108
}

‎integration/resources/haproxy/haproxy.cfg

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,15 @@ frontend TestServerTest
1616
mode tcp
1717
default_backend TestServerNodes
1818

19+
frontend TestServerTestV2
20+
bind 0.0.0.0:81
21+
mode tcp
22+
default_backend TestServerNodesV2
23+
1924
backend TestServerNodes
2025
mode tcp
21-
server TestServer01 172.17.0.1:8000 send-proxy
26+
server TestServer01 172.17.0.1:8000 send-proxy
27+
28+
backend TestServerNodesV2
29+
mode tcp
30+
server TestServer01 172.17.0.1:8000 send-proxy-v2

‎pkg/server/server_entrypoint_tcp.go

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ import (
88
"sync"
99
"time"
1010

11-
"github.com/armon/go-proxyproto"
11+
proxyprotocol "github.com/c0va23/go-proxyprotocol"
1212
"github.com/containous/traefik/v2/pkg/config/static"
1313
"github.com/containous/traefik/v2/pkg/ip"
1414
"github.com/containous/traefik/v2/pkg/log"
@@ -240,10 +240,9 @@ func buildProxyProtocolListener(ctx context.Context, entryPoint *static.EntryPoi
240240

241241
log.FromContext(ctx).Infof("Enabling ProxyProtocol for trusted IPs %v", entryPoint.ProxyProtocol.TrustedIPs)
242242

243-
return &proxyproto.Listener{
244-
Listener: listener,
245-
SourceCheck: sourceCheck,
246-
}, nil
243+
return proxyprotocol.NewDefaultListener(listener).
244+
WithSourceChecker(sourceCheck).
245+
WithLogger(log.FromContext(ctx)), nil
247246
}
248247

249248
func buildListener(ctx context.Context, entryPoint *static.EntryPoint) (net.Listener, error) {

0 commit comments

Comments
 (0)