Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Received-SPF: pass (nike.apache.org: domain of zhangzzh@gmail.com designates
 74.125.82.44 as permitted sender)
MIME-Version: 1.0
Date: Fri, 22 Aug 2014 10:46:39 -0700
Message-ID: 
 <CAJ1fRq7FM47ZgCk=Hr+T7PPedG71Sx6K1GouiF9uC76W4Sj38g@mail.gmail.com>
From: Zhang Zhang <zhangzzh@gmail.com>
To: users@httpd.apache.org
Content-Type: multipart/alternative; boundary=047d7bfd029e5dc86205013b6b93
Subject: [users@httpd] Support for Proxy Protocol

--047d7bfd029e5dc86205013b6b93
Content-Type: text/plain; charset=UTF-8

Hi,

I have a problem that I don't know how to resolve. It is very appreciated
if anyone could share some thought on how to resolve it.

Scenario:
I have an ELB setup in AMS cloud, there are two apache servers (2.4.4)
behind the ELB, act as gateway, the apache servers is listing to port 443
which is a HTTPS port, ELB is setup with TCP/SSL, when a request comes in
to ELB, ELB will forward it to apache servers, and apache servers will
forward it to down stream servers with proxypass directive.

Issue:
There is an issue in this setup, the ELB is stopping the down stream server
to get source IP address of the request, what apache server can see is the
message is coming from ip addresses of ELB instances, not the actual
sender's ip address. I can not change the ELB to use HTTP/HTTPS and take
advantage of the "X-Forward-" headers, because the special mutual
authentication I need for the apache instances. The ELB of AWS support a
TCP protocol called "Proxy Protocol v1" which is able to forward the source
ip address to apache.

Proxy Protocol:
Proxy Protocol is a protocol for TCP/SSL load balancer to carry source IP
address information and forward to down stream servers, the message with a
HTTP GET request would looks like:

    PROXY TCP4 192.168.0.1 192.168.0.11 56324 443\r\n
    GET / HTTP/1.1\r\n
    Host: 192.168.0.11\r\n
    \r\n

Basically this protocol add a new line after the TCP headers and before the
body.
For HTTPS it is more complex, I imagine the message for HTTPS would looks
like:

    PROXY TCP4 192.168.0.1 192.168.0.11 56324 443\r\n
    <Encrypted binary>

Here is the link to the protocol:

http://www.haproxy.org/download/1.5/doc/proxy-protocol.txt

Question:

Obviously this new line before the request body will cause SSL and
other module fail, how we going to support this "Proxy Protocol" ?


Thanks

JJ

--047d7bfd029e5dc86205013b6b93
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi,=C2=A0<div><br></div><div>I have a problem that I don&#=
39;t know how to resolve. It is very appreciated if anyone could share some=
 thought on how to resolve it.</div><div><br></div><div>Scenario:</div><div=
>I have an ELB setup in AMS cloud, there are two apache servers (2.4.4) beh=
ind the ELB, act as gateway, the apache servers is listing to port 443 whic=
h is a HTTPS port, ELB is setup with TCP/SSL, when a request comes in to EL=
B, ELB will forward it to apache servers, and apache servers will forward i=
t to down stream servers with proxypass directive.=C2=A0</div>
<div><br></div><div>Issue:</div><div>There is an issue in this setup, the E=
LB is stopping the down stream server to get source IP address of the reque=
st, what apache server can see is the message is coming from ip addresses o=
f ELB instances, not the actual sender&#39;s ip address. I can not change t=
he ELB to use HTTP/HTTPS and take advantage of the &quot;X-Forward-&quot; h=
eaders, because the special mutual authentication I need for the apache ins=
tances. The ELB of AWS support a TCP protocol called &quot;Proxy Protocol v=
1&quot; which is able to forward the source ip address to apache.</div>
<div><br></div><div>Proxy Protocol:</div><div>Proxy Protocol is a protocol =
for TCP/SSL load balancer to carry source IP address information and forwar=
d to down stream servers, the message with a HTTP GET request would looks l=
ike:</div>
<div><pre style=3D"color:rgb(0,0,0);word-wrap:break-word;white-space:pre-wr=
ap">    PROXY TCP4 192.168.0.1 192.168.0.11 56324 443\r\n
    GET / HTTP/1.1\r\n
    Host: 192.168.0.11\r\n
    \r\n</pre></div><div>Basically this protocol add a new line after the T=
CP headers and before the body.</div><div>For HTTPS it is more complex, I i=
magine the message for HTTPS would looks like:</div><div><pre style=3D"colo=
r:rgb(0,0,0);word-wrap:break-word;white-space:pre-wrap">
    PROXY TCP4 192.168.0.1 192.168.0.11 56324 443\r\n
    &lt;Encrypted binary&gt;</pre><pre style=3D"color:rgb(0,0,0);word-wrap:=
break-word;white-space:pre-wrap">Here is the link to the protocol:</pre><pr=
e style=3D"word-wrap:break-word"><font color=3D"#000000"><span style=3D"whi=
te-space:pre-wrap"><a href=3D"http://www.haproxy.org/download/1.5/doc/proxy=
-protocol.txt">http://www.haproxy.org/download/1.5/doc/proxy-protocol.txt</=
a><br>
</span></font></pre><pre style=3D"word-wrap:break-word"><span style=3D"font=
-family:arial;white-space:normal">Question:</span><br></pre><pre style=3D"w=
ord-wrap:break-word"><font face=3D"arial"><span style=3D"white-space:normal=
">Obviously this new line before the request body will cause SSL and other =
module fail, how we going to support this &quot;Proxy Protocol&quot; ?</spa=
n></font></pre>
<pre style=3D"word-wrap:break-word"><font face=3D"arial"><span style=3D"whi=
te-space:normal"><br></span></font></pre><pre style=3D"word-wrap:break-word=
">Thanks</pre><pre style=3D"word-wrap:break-word">JJ</pre></div></div>

--047d7bfd029e5dc86205013b6b93--