nic-6443 opened a new pull request, #13700:
URL: https://github.com/apache/apisix/pull/13700
### Description
A stream port can accept the PROXY protocol (`proxy_protocol`) and send it
on to the upstream (`proxy_protocol_to_upstream`), but the two don't compose
into "pass the client address through". `ngx_proxy_protocol_write()` builds the
outbound header from `c->sockaddr` — the directly connected peer — and never
looks at `c->proxy_protocol`. So with a load balancer in front, the upstream is
told the load balancer's address and the client's is lost. The stream
`$remote_addr`, the access log and address matching such as `ip-restriction`
see the load balancer for the same reason.
nginx's answer is `ngx_stream_realip_module`, but there was no way to
configure it: `set_real_ip_from` is only rendered into the `http` block.
This adds `nginx_config.stream.real_ip_from`, mirroring the existing
`nginx_config.http.real_ip_from`:
```yaml
apisix:
proxy_mode: http&stream
stream_proxy:
tcp:
- addr: 9100
proxy_protocol: true
proxy_protocol_to_upstream: true
nginx_config:
stream:
real_ip_from:
- 192.168.1.0/24
```
On a connection from a trusted address that carries an inbound PROXY
protocol header, the module writes the header's address into `c->sockaddr`, so
the rebuilt outbound header — and every stream-side consumer of the client
address — carries the client. The directly connected address stays available as
`$realip_remote_addr`.
The option is empty by default, so nothing changes for existing
configurations. It only takes effect on ports that accept the PROXY protocol,
and only for peers it matches.
**This depends on a runtime built with `--with-stream_realip_module`**,
which is why it is a draft: `set_real_ip_from` is an unknown directive on
current runtimes. Kept in draft until a runtime carrying the module is released
and `.requirements` is bumped to it.
### Tests
`t/cli/test_stream_proxy_protocol.sh` grows four cases. Two cover rendering
(nothing trusted by default; one `set_real_ip_from` per entry). Two are end to
end against a PROXY-protocol-aware stream upstream that echoes the address it
was handed, so they assert on the header APISIX actually rebuilds rather than
on `nginx.conf`: with the peer trusted the upstream sees the client address,
and without it the upstream sees the direct peer and the peer's claim is
ignored.
### Checklist
- [x] I have explained the need for this PR and the problem it solves
- [x] I have explained the changes or the new features added to this PR
- [x] I have added tests corresponding to this change
- [x] I have updated the documentation to reflect this change
- [x] I have verified that this change is backward compatible
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
