akka-http
akka-http copied to clipboard
akka
Support HAPROXY proxy protocol on the server side
HAProxy defines a TCP-based "proxy protocol" that wraps / prefixes reverse-proxy traffic with metadata from the original client.
See http://www.haproxy.org/download/1.8/doc/proxy-protocol.txt.
Akka HTTP lacks proxy protocol support. There already was a demand in spray/spray#846. It's impossible to implement anti-flood scenarios in case of plain tcp connections when there is no way to determine real client ip via HTTP headers passed from reverse proxy.
Here's a previous discussion on the mailing list: https://groups.google.com/d/msg/akka-user/TdrTq_3ebK8/31vj4MzPCAAJ
prior netty art http://netty.io/4.1/api/io/netty/handler/codec/haproxy/HAProxyMessage.html
👍 this would be really helpful so we don't have to unreliably guess the IP from the XFF header.
We principally use AWS ELBs for routing traffic. They support the proxy protocol for passing on the user's IP address to applications behind the ELB. As an alternative they also add an X-Forwarded-For header - but it is hard to correctly identify the user IP correctly without knowing all possible addresses of ELB hosts that it can pass through.
Ah, sorry, I just didn't understand what this ticket was about. Thanks for the clarification.
Ah HA Proxy protocol, that makes sense now. Thanks for explaining, I also was wondering what was meant in the ticket title :)
Thanks @jrudolph.
If you have some pointers as to how to approach this or anything in akka-http that is a similar pattern then I'm open to having a bash at putting together a PR to address this. Unlikely to happen immediately due to other commitments though.
Can we simply parse the haproxy line and add it to the request as a header? Something like this?
cc: @jrudolph @sihil
Support for this would be great. Right now our logs are littered with
Illegal request, responding with status '501 Not Implemented': Unsupported HTTP method: PROXY
entries, I'm not aware of a way to tell ELBs to only use XFF and not PROXY protocol (via kube at least).
I'm not aware of a way to tell ELBs to only use XFF and not PROXY protocol (via kube at least).
I've got no recent experience but it sounds unlikely that there's no way to turn it off. There are so many different HTTP backend implementations and by far not all of them support the proxy protocol.
That said, we would welcome a PR that adds the capability. @kchaitanya1195's work looks promising but I'd prefer to keep it out of the HTTP parser (because it's not related to HTTP). If it would be something more general it would also work with HTTP2 etc.
I'm not aware of a way to tell ELBs to only use XFF and not PROXY protocol (via kube at least).
I've got no recent experience but it sounds unlikely that there's no way to turn it off. There are so many different HTTP backend implementations and by far not all of them support the proxy protocol.
That said, we would welcome a PR that adds the capability. @kchaitanya1195's work looks promising but I'd prefer to keep it out of the HTTP parser (because it's not related to HTTP). If it would be something more general it would also work with HTTP2 etc.
@jrudolph can you provide some pointers where would you start with an implementation? I'd like to give it a try but don't want to explore the whole codebase upfront.
