Hello, I would be interested to have Proxy Protocol implemented in httpd. Nginx 1.5.2 and haproxy 1.5 already have support for it. The read feature would be a good start. This would allow apache to get the client IP when being used behind an AWS ELB with apache httpd terminating SSL. http://www.haproxy.org/download/1.5/doc/proxy-protocol.txt https://wiki.bedis.eu/nginx/nginx_proxy_protocol_patch http://trac.nginx.org/nginx/changeset/3a72b1805c52c84a5567dcfa4562f44722bede40/nginx Thank you, Etienne Grignon
There is my implementation (for Apache 2.2 and 2.4): The source code (beta) is Hosted in Github and licensed under Apache 2.0 License. Module for Apache 2.4: http://goo.gl/ThoZXN Module for Apache 2.2: http://goo.gl/pxsCVm Original Article: http://wp.me/p19O7G-na
I have implemented a similar module under testing for appache 2.4, following ngix's patch. I am curious why your code didn't put source ip from proxy protocol line into c->client_ip and c->client_addr (your code use c->notes to store client_ip)? You threw away destination_ip from protocol line now. Do you have plan to use it, which my current effort to integrate it with apache mod_proxy?
Someone posted a basic implementation for this in apache today, which is roughly the same as I have done. So thr solution is correct so far. Posted one supported only IPV4 for logging ip address. But it put in lot of security check of source ip addresses.
please ignore or delete this comment.
(In reply to ywu from comment #2) > I have implemented a similar module under testing for appache 2.4, following > ngix's patch. I am curious why your code didn't put source ip from proxy > protocol line into c->client_ip and c->client_addr (your code use c->notes > to store client_ip)? You threw away destination_ip from protocol line now. > Do you have plan to use it, which my current effort to integrate it with > apache mod_proxy? Yes, I dont touch c->client_ip in 2.4 module, I use r->useragent_ip (that is not available in connection_filter, until post_read) because... I read the change in API (http://httpd.apache.org/docs/2.4/developer/new_api_2_4.html), that say (about c->remote_ip): >> 1) When you require the IP address of the user agent, which might be connected directly to the server, or might optionally be separated from the server by a transparent load balancer or proxy, use request_rec->useragent_ip and request_rec->useragent_addr. >> 2) When you require the IP address of the client that is connected directly to the server, which might be the useragent or might be the load balancer or proxy itself, use conn_rec->client_ip and conn_rec->client_addr. This seems that usage of c->client_ip is not the good way for PROXY protocol.
An implementation of the HA Proxy protocol is available in Apache since 2.4.30. Changelog entry: *) mod_remoteip: Add support for PROXY protocol (code donated by Cloudzilla). Add ability for PROXY protocol processing to be optional to donated code. See also: http://www.haproxy.org/download/1.5/doc/proxy-protocol.txt [Cloudzilla/roadrunner2@GitHub, Jim Jagielski, Daniel Ruggeri]