squid icon indicating copy to clipboard operation
squid copied to clipboard

Refactor PROXY protocol support

Open yadij opened this issue 3 years ago • 2 comments

PROXY protocol is designed to be implemented as a handshake prefix immediately following TCP handshake. When initially added to Squid the ConnStateData logic caused a lot of complications integrating it and there was no PROXY support for non-HTTP protocols. Both of those situations have since changed and we now have a need to promote PROXY protocol handling to a full Server protocol between TcpAcceptor any other Server protocol logic.

Refactor the listening port implementation to pass newly accept(2)'ed client connections to a Pp2Server which handles PROXY protocol then passes connection ownership to other services based on squid.conf port settings.

This results in PROXY protocol support (require-proxy-header) for https_port and ftp_port traffic. However, actual use of the PROXY extension details by those protocols is omitted for now.

yadij avatar Aug 03 '21 01:08 yadij

This is a Draft for now because it still needs testing and some polish. I am also intending to add a Job sending PROXY protocol header to cache_peers.

yadij avatar Aug 03 '21 01:08 yadij

I hope we do not need to work on this PR until the partially overlapping #832 and #835 are in. The former adds (partial) support for PROXY protocol on https_port and the latter is just a prerequisite you requested to be extracted from the former.

This can be done independently of those PR. The overlap is very small.

That old work significantly improves how PROXY protocol (and other port-specific) support is integrated with the rest of Squid code. This PR should be using those improvements.

I do not see any significant improvements in there. Just another re-shuffling of how the bloated ConnStateData does things. This PR is the "significant" step forward in PROXY protocol support we have been needing.

yadij avatar Aug 03 '21 13:08 yadij