1. Steven Feltner reveller – IRC sfeltner@godaddy.com
Apache Traffic Server Euro Tour Proxy Protocol to Forwarded Header
Steven Feltner
reveller – IRC
May 9, 2018

2. Infrastructure Stack

3. Forwarded HTTP Header X-Forwarded-For: X-Forwarded-By:
X-Forwarded class of headers was an attempt to solve that problem, but has issues
X-Forwarded-For:
X-Forwarded-By:
X-Forwarded-Proto:
In 2014, the Forwarded: header was introduced in RFC-7239 which is an attempt to standardize the propagation of original connection information
Walt Karas submitted a PR for support of Forwarded: header which has been approved, but not yet merged into 8.0

4. Forwarded HTTP Header
Fields available in the Forwarded: header
"by" identifies the user-agent facing interface of the proxy.
"for" identifies the node making the request to the proxy.
“host" is the host request header field as received by the proxy.
“proto" indicates what protocol was used to make the request.
Forwarded: for= ;proto=http;by=
In ATS, configure with:
CONFIG proxy.config.http.insert_forwarded STRING

5. Configuring the Forwarded HTTP Header in ATS
In records.config, configure with:
CONFIG proxy.config.http.insert_forwarded STRING
for Client IP address
by=ip Proxy IP address
by=unknown The literal string ``unknown``
by=servername Proxy server name
by=uuid Server UUID prefixed with ``_``
proto Protocol of incoming request
host The host specified in the incoming request
connection=compact Connection with basic transaction codes.
connection=std Connection with detailed transaction codes.
connection=full Full user agent connection <protocol_tags>`

6. Protocol agnostic – works for either HTTP or HTTPS
PROXY Protocol
Protocol agnostic – works for either HTTP or HTTPS
Does not require architectural changes
NATing of firewalls has no impact
Scalable

7. PROXY Protocol Source IP and port Destination IP and port HAProxy
As out infrastructures become more complex, more and more layers are piled in the stack
As a request is relayed through the stack via TCP connections, we lose the original TCP connection parameters
Source IP and port
Destination IP and port
The PROXY Protocol was written by HAProxy as “a convenient way to safely transport connection information such as a client's address across multiple layers of NAT or TCP proxies”
Many packages have already adopted the PROXY Protocol
HAProxy
AWS ELB
nginx
varnish
httpd

8. Why not Proxy Protocol In and Out
Proxy Protocol has been adopted on many, but not all platforms
Forwarded: header is an IETF standard
In the current (to be approved and merged) PR, PROXY protocol v1 is being consumed on ingress into ATS, the remote address/port are being set internally.
While building the response headers, add_forwarded_field_to_request() picks up the remote address set internally

9. it is not widely accepted yet
What’s Next
The current implementation is for PROXY Protocol v1
There is a v2 (binary implementation)
it is not widely accepted yet
If there is enough interest, we can implement v2
We could also implement PROXY Protocol on egress from ATS to present the PROXY header to origin servers, but it would require some bit of work
Hook into ip_allow.config to control ”trusted sources”