mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-11-28 06:11:32 +01:00
Code Issues Projects Releases Wiki Activity

MINOR: connection: add proxy-v2-options authority

Browse Source 
This patch add option PP2_TYPE_AUTHORITY to proxy protocol v2 when a TLS
connection was negotiated. In this case, authority corresponds to the sni.
This commit is contained in:
Emmanuel Hocdet 2018-02-01 18:29:59 +01:00 committed by Willy Tarreau
parent fa8d0f1875
commit 253c3b7516
6 changed files with 28 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
doc/configuration.txt
View File

@ -11724,7 +11724,9 @@ proxy-v2-options <option>[,<option>]*
2 when "send-proxy-v2" is used. Options available are "ssl" (see also
send-proxy-v2-ssl), "cert-cn" (see also "send-proxy-v2-ssl-cn"), "ssl-cipher":
name of the used cipher, "cert-sig": signature algorithm of the used
certificate, "cert-key": key algorithm of the used certificate).
certificate, "cert-key": key algorithm of the used certificate), "authority":
host name value passed by the client (only sni from a tls connection is
supported).
send-proxy-v2-ssl
The "send-proxy-v2-ssl" parameter enforces use of the PROXY protocol version

1
include/proto/ssl_sock.h
View File

@ -50,6 +50,7 @@ void ssl_sock_free_srv_ctx(struct server *srv);
void ssl_sock_free_all_ctx(struct bind_conf *bind_conf);
int ssl_sock_load_ca(struct bind_conf *bind_conf);
void ssl_sock_free_ca(struct bind_conf *bind_conf);
const char *ssl_sock_get_sni(struct connection *conn);
const char *ssl_sock_get_cert_sig(struct connection *conn);
const char *ssl_sock_get_cipher_name(struct connection *conn);
const char *ssl_sock_get_proto_version(struct connection *conn);

1
include/types/server.h
View File

@ -151,6 +151,7 @@ enum srv_initaddr {
#define SRV_PP_V2_SSL_KEY_ALG 0x0010 /* proxy protocol version 2 with cert key algorithm */
#define SRV_PP_V2_SSL_SIG_ALG 0x0020 /* proxy protocol version 2 with cert signature algorithm */
#define SRV_PP_V2_SSL_CIPHER 0x0040 /* proxy protocol version 2 with cipher used */
#define SRV_PP_V2_AUTHORITY 0x0080 /* proxy protocol version 2 with authority */
/* function which act on servers need to return various errors */
#define SRV_STATUS_OK 0 /* everything is OK. */

9
src/connection.c
View File

@ -1044,6 +1044,15 @@ int make_proxy_line_v2(char *buf, int buf_len, struct server *srv, struct connec
}
#ifdef USE_OPENSSL
if (srv->pp_opts & SRV_PP_V2_AUTHORITY) {
value = ssl_sock_get_sni(remote);
if (value) {
if ((buf_len - ret) < sizeof(struct tlv))
return 0;
ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_AUTHORITY, strlen(value), value);
}
}
if (srv->pp_opts & SRV_PP_V2_SSL) {
struct tlv_ssl *tlv;
int ssl_tlv_len = 0;

2
src/server.c
View File

@ -526,6 +526,8 @@ static int srv_parse_proxy_v2_options(char **args, int *cur_arg,
} else if (!strcmp(p, "ssl-cipher")) {
newsrv->pp_opts |= SRV_PP_V2_SSL;
newsrv->pp_opts |= SRV_PP_V2_SSL_CIPHER;
} else if (!strcmp(p, "authority")) {
newsrv->pp_opts |= SRV_PP_V2_AUTHORITY;
} else
goto fail;
}

12
src/ssl_sock.c
View File

@ -5783,6 +5783,18 @@ const char *ssl_sock_get_cert_sig(struct connection *conn)
return OBJ_nid2sn(OBJ_obj2nid(algorithm));
}
/* used for ppv2 authority */
const char *ssl_sock_get_sni(struct connection *conn)
{
#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
if (!ssl_sock_is_ssl(conn))
return NULL;
return SSL_get_servername(conn->xprt_ctx, TLSEXT_NAMETYPE_host_name);
#else
return 0;
#endif
}
/* used for logging/ppv2, may be changed for a sample fetch later */
const char *ssl_sock_get_cipher_name(struct connection *conn)
{