Mercurial > prosody-modules

annotate mod_net_proxy/mod_net_proxy.lua @ 6531:2d17c39ede4d

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_muc_mav: Fix README.md
author Marvin W <hg@larma.de>
date Mon, 04 May 2026 23:44:15 +0200
parents 9d3e6d2f25c7
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
2930
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
1 -- mod_net_proxy.lua
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
2 -- Copyright (C) 2018 Pascal Mathis <mail@pascalmathis.com>
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
3 --
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
4 -- Implementation of PROXY protocol versions 1 and 2
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
5 -- Specifications: https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
6
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
7 module:set_global();
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
8
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
9 -- Imports
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
10 local softreq = require "util.dependencies".softreq;
4944
9d65eb3fcb15 mod_net_proxy: Fix for bitop with Lua 5.4
moparisthebest <admin@moparisthebest.com>
parents: 3562
diff changeset
11 local bit = assert(softreq "bit" or softreq "bit32" or softreq "util.bitcompat", "No bit module found. See https://prosody.im/doc/depends#bitop");
2930
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
12 local hex = require "util.hex";
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
13 local ip = require "util.ip";
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
14 local net = require "util.net";
2961
33227efa2cdc mod_net_proxy: Automatically listen on all mapped ports if proxy_ports was not configured
Pascal Mathis <mail@pascalmathis.com>
parents: 2935
diff changeset
15 local set = require "util.set";
2930
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
16 local portmanager = require "core.portmanager";
6213
49fad071e644 mod_net_proxy: Use safer util.format for generating description string (thanks tom)
Matthew Wild <mwild1@gmail.com>
parents: 4944
diff changeset
17 local fmt = require "util.format".format;
6348
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
18 local basic_resolver = require "net.resolvers.basic";
2930
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
19
2931
e79b9a55aa2e mod_net_proxy: Fixed backwards compatibility to Prosody 0.10
Pascal Mathis <mail@pascalmathis.com>
parents: 2930
diff changeset
20 -- Backwards Compatibility
e79b9a55aa2e mod_net_proxy: Fixed backwards compatibility to Prosody 0.10
Pascal Mathis <mail@pascalmathis.com>
parents: 2930
diff changeset
21 local function net_ntop_bc(input)
e79b9a55aa2e mod_net_proxy: Fixed backwards compatibility to Prosody 0.10
Pascal Mathis <mail@pascalmathis.com>
parents: 2930
diff changeset
22 if input:len() == 4 then
e79b9a55aa2e mod_net_proxy: Fixed backwards compatibility to Prosody 0.10
Pascal Mathis <mail@pascalmathis.com>
parents: 2930
diff changeset
23 return string.format("%d.%d.%d.%d", input:byte(1, 4));
e79b9a55aa2e mod_net_proxy: Fixed backwards compatibility to Prosody 0.10
Pascal Mathis <mail@pascalmathis.com>
parents: 2930
diff changeset
24 elseif input:len() == 16 then
e79b9a55aa2e mod_net_proxy: Fixed backwards compatibility to Prosody 0.10
Pascal Mathis <mail@pascalmathis.com>
parents: 2930
diff changeset
25 local octets = { nil, nil, nil, nil, nil, nil, nil, nil };
e79b9a55aa2e mod_net_proxy: Fixed backwards compatibility to Prosody 0.10
Pascal Mathis <mail@pascalmathis.com>
parents: 2930
diff changeset
26
e79b9a55aa2e mod_net_proxy: Fixed backwards compatibility to Prosody 0.10
Pascal Mathis <mail@pascalmathis.com>
parents: 2930
diff changeset
27 -- Convert received bytes into IPv6 address and skip leading zeroes for each group
e79b9a55aa2e mod_net_proxy: Fixed backwards compatibility to Prosody 0.10
Pascal Mathis <mail@pascalmathis.com>
parents: 2930
diff changeset
28 for index = 1, 8 do
2935
7319fd5dbc89 mod_net_proxy: Fixed luacheck warnings
Pascal Mathis <mail@pascalmathis.com>
parents: 2931
diff changeset
29 local high, low = input:byte(index * 2 - 1, index * 2);
2931
e79b9a55aa2e mod_net_proxy: Fixed backwards compatibility to Prosody 0.10
Pascal Mathis <mail@pascalmathis.com>
parents: 2930
diff changeset
30 octets[index] = string.format("%x", high * 256 + low);
e79b9a55aa2e mod_net_proxy: Fixed backwards compatibility to Prosody 0.10
Pascal Mathis <mail@pascalmathis.com>
parents: 2930
diff changeset
31 end
e79b9a55aa2e mod_net_proxy: Fixed backwards compatibility to Prosody 0.10
Pascal Mathis <mail@pascalmathis.com>
parents: 2930
diff changeset
32 local address = table.concat(octets, ":", 1, 8);
e79b9a55aa2e mod_net_proxy: Fixed backwards compatibility to Prosody 0.10
Pascal Mathis <mail@pascalmathis.com>
parents: 2930
diff changeset
33
e79b9a55aa2e mod_net_proxy: Fixed backwards compatibility to Prosody 0.10
Pascal Mathis <mail@pascalmathis.com>
parents: 2930
diff changeset
34 -- Search for the longest sequence of zeroes
e79b9a55aa2e mod_net_proxy: Fixed backwards compatibility to Prosody 0.10
Pascal Mathis <mail@pascalmathis.com>
parents: 2930
diff changeset
35 local token;
e79b9a55aa2e mod_net_proxy: Fixed backwards compatibility to Prosody 0.10
Pascal Mathis <mail@pascalmathis.com>
parents: 2930
diff changeset
36 local length = (address:match("^0:[0:]+()") or 1) - 1;
e79b9a55aa2e mod_net_proxy: Fixed backwards compatibility to Prosody 0.10
Pascal Mathis <mail@pascalmathis.com>
parents: 2930
diff changeset
37 for s in address:gmatch(":0:[0:]+") do
e79b9a55aa2e mod_net_proxy: Fixed backwards compatibility to Prosody 0.10
Pascal Mathis <mail@pascalmathis.com>
parents: 2930
diff changeset
38 if length < #s then
e79b9a55aa2e mod_net_proxy: Fixed backwards compatibility to Prosody 0.10
Pascal Mathis <mail@pascalmathis.com>
parents: 2930
diff changeset
39 length, token = #s, s;
e79b9a55aa2e mod_net_proxy: Fixed backwards compatibility to Prosody 0.10
Pascal Mathis <mail@pascalmathis.com>
parents: 2930
diff changeset
40 end
e79b9a55aa2e mod_net_proxy: Fixed backwards compatibility to Prosody 0.10
Pascal Mathis <mail@pascalmathis.com>
parents: 2930
diff changeset
41 end
e79b9a55aa2e mod_net_proxy: Fixed backwards compatibility to Prosody 0.10
Pascal Mathis <mail@pascalmathis.com>
parents: 2930
diff changeset
42
e79b9a55aa2e mod_net_proxy: Fixed backwards compatibility to Prosody 0.10
Pascal Mathis <mail@pascalmathis.com>
parents: 2930
diff changeset
43 -- Return the shortened IPv6 address
e79b9a55aa2e mod_net_proxy: Fixed backwards compatibility to Prosody 0.10
Pascal Mathis <mail@pascalmathis.com>
parents: 2930
diff changeset
44 return address:gsub(token or "^0:[0:]+", "::", 1);
e79b9a55aa2e mod_net_proxy: Fixed backwards compatibility to Prosody 0.10
Pascal Mathis <mail@pascalmathis.com>
parents: 2930
diff changeset
45 end
e79b9a55aa2e mod_net_proxy: Fixed backwards compatibility to Prosody 0.10
Pascal Mathis <mail@pascalmathis.com>
parents: 2930
diff changeset
46 end
e79b9a55aa2e mod_net_proxy: Fixed backwards compatibility to Prosody 0.10
Pascal Mathis <mail@pascalmathis.com>
parents: 2930
diff changeset
47
e79b9a55aa2e mod_net_proxy: Fixed backwards compatibility to Prosody 0.10
Pascal Mathis <mail@pascalmathis.com>
parents: 2930
diff changeset
48 local net_ntop = net.ntop or net_ntop_bc
e79b9a55aa2e mod_net_proxy: Fixed backwards compatibility to Prosody 0.10
Pascal Mathis <mail@pascalmathis.com>
parents: 2930
diff changeset
49
2930
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
50 -- Utility Functions
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
51 local function _table_invert(input)
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
52 local output = {};
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
53 for key, value in pairs(input) do
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
54 output[value] = key;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
55 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
56 return output;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
57 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
58
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
59 -- Constants
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
60 local ADDR_FAMILY = { UNSPEC = 0x0, INET = 0x1, INET6 = 0x2, UNIX = 0x3 };
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
61 local ADDR_FAMILY_STR = _table_invert(ADDR_FAMILY);
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
62 local TRANSPORT = { UNSPEC = 0x0, STREAM = 0x1, DGRAM = 0x2 };
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
63 local TRANSPORT_STR = _table_invert(TRANSPORT);
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
64
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
65 local PROTO_MAX_HEADER_LENGTH = 256;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
66 local PROTO_HANDLERS = {
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
67 PROXYv1 = { signature = hex.from("50524F5859"), callback = nil },
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
68 PROXYv2 = { signature = hex.from("0D0A0D0A000D0A515549540A"), callback = nil }
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
69 };
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
70 local PROTO_HANDLER_STATUS = { SUCCESS = 0, POSTPONE = 1, FAILURE = 2 };
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
71
2963
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
72 -- Configuration Variables
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
73 local config_mappings = module:get_option("proxy_port_mappings", {});
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
74 local config_ports = module:get_option_set("proxy_ports", {});
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
75 local config_trusted_proxies = module:get_option_set("proxy_trusted_proxies", {"127.0.0.1", "::1"});
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
76
2930
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
77 -- Persistent In-Memory Storage
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
78 local sessions = {};
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
79 local mappings = {};
2963
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
80 local trusted_networks = set.new();
2930
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
81
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
82 -- Proxy Data Methods
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
83 local proxy_data_mt = {}; proxy_data_mt.__index = proxy_data_mt;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
84
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
85 function proxy_data_mt:describe()
6213
49fad071e644 mod_net_proxy: Use safer util.format for generating description string (thanks tom)
Matthew Wild <mwild1@gmail.com>
parents: 4944
diff changeset
86 return fmt("proto=%s/%s src=%s:%d dst=%s:%d",
2930
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
87 self:addr_family_str(), self:transport_str(), self:src_addr(), self:src_port(), self:dst_addr(), self:dst_port());
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
88 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
89
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
90 function proxy_data_mt:addr_family_str()
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
91 return ADDR_FAMILY_STR[self._addr_family] or ADDR_FAMILY_STR[ADDR_FAMILY.UNSPEC];
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
92 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
93
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
94 function proxy_data_mt:transport_str()
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
95 return TRANSPORT_STR[self._transport] or TRANSPORT_STR[TRANSPORT.UNSPEC];
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
96 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
97
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
98 function proxy_data_mt:version()
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
99 return self._version;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
100 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
101
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
102 function proxy_data_mt:addr_family()
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
103 return self._addr_family;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
104 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
105
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
106 function proxy_data_mt:transport()
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
107 return self._transport;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
108 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
109
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
110 function proxy_data_mt:src_addr()
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
111 return self._src_addr;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
112 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
113
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
114 function proxy_data_mt:src_port()
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
115 return self._src_port;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
116 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
117
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
118 function proxy_data_mt:dst_addr()
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
119 return self._dst_addr;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
120 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
121
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
122 function proxy_data_mt:dst_port()
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
123 return self._dst_port;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
124 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
125
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
126 -- Protocol Handler Functions
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
127 PROTO_HANDLERS["PROXYv1"].callback = function(conn, session)
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
128 local addr_family_mappings = { TCP4 = ADDR_FAMILY.INET, TCP6 = ADDR_FAMILY.INET6 };
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
129
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
130 -- Postpone processing if CRLF (PROXYv1 header terminator) does not exist within buffer
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
131 if session.buffer:find("\r\n") == nil then
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
132 return PROTO_HANDLER_STATUS.POSTPONE, nil;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
133 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
134
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
135 -- Declare header pattern and match current buffer against pattern
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
136 local header_pattern = "^PROXY (%S+) (%S+) (%S+) (%d+) (%d+)\r\n";
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
137 local addr_family, src_addr, dst_addr, src_port, dst_port = session.buffer:match(header_pattern);
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
138 src_port, dst_port = tonumber(src_port), tonumber(dst_port);
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
139
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
140 -- Ensure that header was successfully parsed and contains a valid address family
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
141 if addr_family == nil or src_addr == nil or dst_addr == nil or src_port == nil or dst_port == nil then
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
142 module:log("warn", "Received unparseable PROXYv1 header from %s", conn:ip());
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
143 return PROTO_HANDLER_STATUS.FAILURE, nil;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
144 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
145 if addr_family_mappings[addr_family] == nil then
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
146 module:log("warn", "Received invalid PROXYv1 address family from %s: %s", conn:ip(), addr_family);
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
147 return PROTO_HANDLER_STATUS.FAILURE, nil;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
148 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
149
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
150 -- Ensure that received source and destination ports are within 1 and 65535 (0xFFFF)
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
151 if src_port <= 0 or src_port >= 0xFFFF then
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
152 module:log("warn", "Received invalid PROXYv1 source port from %s: %d", conn:ip(), src_port);
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
153 return PROTO_HANDLER_STATUS.FAILURE, nil;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
154 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
155 if dst_port <= 0 or dst_port >= 0xFFFF then
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
156 module:log("warn", "Received invalid PROXYv1 destination port from %s: %d", conn:ip(), dst_port);
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
157 return PROTO_HANDLER_STATUS.FAILURE, nil;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
158 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
159
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
160 -- Ensure that received source and destination address can be parsed
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
161 local _, err = ip.new_ip(src_addr);
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
162 if err ~= nil then
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
163 module:log("warn", "Received unparseable PROXYv1 source address from %s: %s", conn:ip(), src_addr);
2975
7eb6fa9b03fd mod_net_proxy: Added missing return when detecting unparseable PROXYv1 source address
Pascal Mathis <mail@pascalmathis.com>
parents: 2963
diff changeset
164 return PROTO_HANDLER_STATUS.FAILURE, nil;
2930
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
165 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
166 _, err = ip.new_ip(dst_addr);
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
167 if err ~= nil then
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
168 module:log("warn", "Received unparseable PROXYv1 destination address from %s: %s", conn:ip(), dst_addr);
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
169 return PROTO_HANDLER_STATUS.FAILURE, nil;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
170 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
171
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
172 -- Strip parsed header from session buffer and build proxy data
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
173 session.buffer = session.buffer:gsub(header_pattern, "");
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
174
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
175 local proxy_data = {
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
176 _version = 1,
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
177 _addr_family = addr_family, _transport = TRANSPORT.STREAM,
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
178 _src_addr = src_addr, _src_port = src_port,
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
179 _dst_addr = dst_addr, _dst_port = dst_port
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
180 };
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
181 setmetatable(proxy_data, proxy_data_mt);
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
182
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
183 -- Return successful response with gathered proxy data
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
184 return PROTO_HANDLER_STATUS.SUCCESS, proxy_data;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
185 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
186
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
187 PROTO_HANDLERS["PROXYv2"].callback = function(conn, session)
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
188 -- Postpone processing if less than 16 bytes are available
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
189 if #session.buffer < 16 then
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
190 return PROTO_HANDLER_STATUS.POSTPONE, nil;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
191 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
192
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
193 -- Parse first 16 bytes of protocol header
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
194 local version = bit.rshift(bit.band(session.buffer:byte(13), 0xF0), 4);
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
195 local command = bit.band(session.buffer:byte(13), 0x0F);
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
196 local addr_family = bit.rshift(bit.band(session.buffer:byte(14), 0xF0), 4);
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
197 local transport = bit.band(session.buffer:byte(14), 0x0F);
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
198 local length = bit.bor(session.buffer:byte(16), bit.lshift(session.buffer:byte(15), 8));
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
199
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
200 -- Postpone processing if less than 16+<length> bytes are available
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
201 if #session.buffer < 16 + length then
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
202 return PROTO_HANDLER_STATUS.POSTPONE, nil;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
203 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
204
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
205 -- Ensure that version number is correct
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
206 if version ~= 0x2 then
2962
6b01600b9c02 mod_net_proxy: Adjusted log level of errors triggered by remote connections to 'warn'
Pascal Mathis <mail@pascalmathis.com>
parents: 2961
diff changeset
207 module:log("warn", "Received unsupported PROXYv2 version from %s: %d", conn:ip(), version);
2930
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
208 return PROTO_HANDLER_STATUS.FAILURE, nil;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
209 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
210
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
211 local payload = session.buffer:sub(17);
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
212 if command == 0x0 then
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
213 -- Gather source/destination addresses and ports from local socket
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
214 local src_addr, src_port = conn:socket():getpeername();
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
215 local dst_addr, dst_port = conn:socket():getsockname();
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
216
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
217 -- Build proxy data based on real connection information
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
218 local proxy_data = {
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
219 _version = version,
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
220 _addr_family = addr_family, _transport = transport,
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
221 _src_addr = src_addr, _src_port = src_port,
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
222 _dst_addr = dst_addr, _dst_port = dst_port
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
223 };
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
224 setmetatable(proxy_data, proxy_data_mt);
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
225
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
226 -- Return successful response with gathered proxy data
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
227 return PROTO_HANDLER_STATUS.SUCCESS, proxy_data;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
228 elseif command == 0x1 then
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
229 local offset = 1;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
230 local src_addr, src_port, dst_addr, dst_port;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
231
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
232 -- Verify transport protocol is either STREAM or DGRAM
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
233 if transport ~= TRANSPORT.STREAM and transport ~= TRANSPORT.DGRAM then
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
234 module:log("warn", "Received unsupported PROXYv2 transport from %s: 0x%02X", conn:ip(), transport);
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
235 return PROTO_HANDLER_STATUS.FAILURE, nil;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
236 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
237
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
238 -- Parse source and destination addresses
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
239 if addr_family == ADDR_FAMILY.INET then
2931
e79b9a55aa2e mod_net_proxy: Fixed backwards compatibility to Prosody 0.10
Pascal Mathis <mail@pascalmathis.com>
parents: 2930
diff changeset
240 src_addr = net_ntop(payload:sub(offset, offset + 3)); offset = offset + 4;
e79b9a55aa2e mod_net_proxy: Fixed backwards compatibility to Prosody 0.10
Pascal Mathis <mail@pascalmathis.com>
parents: 2930
diff changeset
241 dst_addr = net_ntop(payload:sub(offset, offset + 3)); offset = offset + 4;
2930
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
242 elseif addr_family == ADDR_FAMILY.INET6 then
2931
e79b9a55aa2e mod_net_proxy: Fixed backwards compatibility to Prosody 0.10
Pascal Mathis <mail@pascalmathis.com>
parents: 2930
diff changeset
243 src_addr = net_ntop(payload:sub(offset, offset + 15)); offset = offset + 16;
e79b9a55aa2e mod_net_proxy: Fixed backwards compatibility to Prosody 0.10
Pascal Mathis <mail@pascalmathis.com>
parents: 2930
diff changeset
244 dst_addr = net_ntop(payload:sub(offset, offset + 15)); offset = offset + 16;
2930
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
245 elseif addr_family == ADDR_FAMILY.UNIX then
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
246 src_addr = payload:sub(offset, offset + 107); offset = offset + 108;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
247 dst_addr = payload:sub(offset, offset + 107); offset = offset + 108;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
248 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
249
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
250 -- Parse source and destination ports
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
251 if addr_family == ADDR_FAMILY.INET or addr_family == ADDR_FAMILY.INET6 then
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
252 src_port = bit.bor(payload:byte(offset + 1), bit.lshift(payload:byte(offset), 8)); offset = offset + 2;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
253 -- luacheck: ignore 311
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
254 dst_port = bit.bor(payload:byte(offset + 1), bit.lshift(payload:byte(offset), 8)); offset = offset + 2;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
255 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
256
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
257 -- Strip parsed header from session buffer and build proxy data
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
258 session.buffer = session.buffer:sub(17 + length);
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
259
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
260 local proxy_data = {
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
261 _version = version,
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
262 _addr_family = addr_family, _transport = transport,
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
263 _src_addr = src_addr, _src_port = src_port,
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
264 _dst_addr = dst_addr, _dst_port = dst_port
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
265 };
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
266 setmetatable(proxy_data, proxy_data_mt);
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
267
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
268 -- Return successful response with gathered proxy data
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
269 return PROTO_HANDLER_STATUS.SUCCESS, proxy_data;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
270 else
2962
6b01600b9c02 mod_net_proxy: Adjusted log level of errors triggered by remote connections to 'warn'
Pascal Mathis <mail@pascalmathis.com>
parents: 2961
diff changeset
271 module:log("warn", "Received unsupported PROXYv2 command from %s: 0x%02X", conn:ip(), command);
2930
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
272 return PROTO_HANDLER_STATUS.FAILURE, nil;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
273 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
274 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
275
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
276 -- Wrap an existing connection with the provided proxy data. This will override several methods of the 'conn' object to
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
277 -- return the proxied source instead of the source which initiated the TCP connection. Afterwards, the listener of the
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
278 -- connection gets set according to the globally defined port<>service mappings and the methods 'onconnect' and
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
279 -- 'onincoming' are being called manually with the current session buffer.
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
280 local function wrap_proxy_connection(conn, session, proxy_data)
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
281 -- Override and add functions of 'conn' object when source information has been collected
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
282 conn.proxyip, conn.proxyport = conn.ip, conn.port;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
283 if proxy_data:src_addr() ~= nil and proxy_data:src_port() ~= nil then
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
284 conn.ip = function()
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
285 return proxy_data:src_addr();
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
286 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
287 conn.port = function()
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
288 return proxy_data:src_port();
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
289 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
290 conn.clientport = conn.port;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
291 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
292
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
293 -- Attempt to find service by processing port<>service mappings
3562
b33b2fbdc713 mod_net_proxy: Ensure port numbers are coerced into numbers
Kim Alvefur <zash@zash.se>
parents: 2997
diff changeset
294 local mapping = mappings[tonumber(conn:serverport())];
2930
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
295 if mapping == nil then
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
296 conn:close();
2962
6b01600b9c02 mod_net_proxy: Adjusted log level of errors triggered by remote connections to 'warn'
Pascal Mathis <mail@pascalmathis.com>
parents: 2961
diff changeset
297 module:log("warn", "Connection %s@%s terminated: Could not find mapping for port %d",
2930
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
298 conn:ip(), conn:proxyip(), conn:serverport());
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
299 return;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
300 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
301
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
302 if mapping.service == nil then
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
303 local service = portmanager.get_service(mapping.service_name);
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
304
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
305 if service ~= nil then
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
306 mapping.service = service;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
307 else
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
308 conn:close();
2962
6b01600b9c02 mod_net_proxy: Adjusted log level of errors triggered by remote connections to 'warn'
Pascal Mathis <mail@pascalmathis.com>
parents: 2961
diff changeset
309 module:log("warn", "Connection %s@%s terminated: Could not process mapping for unknown service %s",
2930
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
310 conn:ip(), conn:proxyip(), mapping.service_name);
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
311 return;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
312 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
313 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
314
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
315 -- Pass connection to actual service listener and simulate onconnect/onincoming callbacks
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
316 local service_listener = mapping.service.listener;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
317
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
318 module:log("info", "Passing proxied connection %s:%d to service %s", conn:ip(), conn:port(), mapping.service_name);
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
319 conn:setlistener(service_listener);
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
320 if service_listener.onconnect then
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
321 service_listener.onconnect(conn);
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
322 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
323 return service_listener.onincoming(conn, session.buffer);
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
324 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
325
2963
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
326 local function is_trusted_proxy(conn)
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
327 -- If no trusted proxies were configured, trust any incoming connection
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
328 -- While this may seem insecure, the module defaults to only trusting 127.0.0.1 and ::1
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
329 if trusted_networks:empty() then
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
330 return true;
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
331 end
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
332
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
333 -- Iterate through all trusted proxies and check for match against connected IP address
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
334 local conn_ip = ip.new_ip(conn:ip());
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
335 for trusted_network in trusted_networks:items() do
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
336 if ip.match(trusted_network.ip, conn_ip, trusted_network.cidr) then
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
337 return true;
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
338 end
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
339 end
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
340
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
341 -- Connection does not match any trusted proxy
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
342 return false;
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
343 end
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
344
2930
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
345 -- Network Listener Methods
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
346 local listener = {};
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
347
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
348 function listener.onconnect(conn)
2997
97b30fec709c mod_net_proxy: Fixed errors when connection with nil ip is being processed
Pascal Mathis <mail@pascalmathis.com>
parents: 2975
diff changeset
349 -- Silently drop connections with an IP address of <nil>, which can happen when the socket was closed before the
97b30fec709c mod_net_proxy: Fixed errors when connection with nil ip is being processed
Pascal Mathis <mail@pascalmathis.com>
parents: 2975
diff changeset
350 -- responsible net.server backend was able to grab the IP address of the connecting client.
97b30fec709c mod_net_proxy: Fixed errors when connection with nil ip is being processed
Pascal Mathis <mail@pascalmathis.com>
parents: 2975
diff changeset
351 if conn:ip() == nil then
97b30fec709c mod_net_proxy: Fixed errors when connection with nil ip is being processed
Pascal Mathis <mail@pascalmathis.com>
parents: 2975
diff changeset
352 conn:close();
97b30fec709c mod_net_proxy: Fixed errors when connection with nil ip is being processed
Pascal Mathis <mail@pascalmathis.com>
parents: 2975
diff changeset
353 return;
97b30fec709c mod_net_proxy: Fixed errors when connection with nil ip is being processed
Pascal Mathis <mail@pascalmathis.com>
parents: 2975
diff changeset
354 end
97b30fec709c mod_net_proxy: Fixed errors when connection with nil ip is being processed
Pascal Mathis <mail@pascalmathis.com>
parents: 2975
diff changeset
355
2963
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
356 -- Check if connection is coming from a trusted proxy
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
357 if not is_trusted_proxy(conn) then
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
358 conn:close();
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
359 module:log("warn", "Dropped connection from untrusted proxy: %s", conn:ip());
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
360 return;
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
361 end
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
362
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
363 -- Initialize session variables
2930
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
364 sessions[conn] = {
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
365 handler = nil;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
366 buffer = nil;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
367 };
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
368 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
369
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
370 function listener.onincoming(conn, data)
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
371 -- Abort processing if no data has been received
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
372 if not data then
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
373 return;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
374 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
375
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
376 -- Lookup session for connection and append received data to buffer
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
377 local session = sessions[conn];
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
378 session.buffer = session.buffer and session.buffer .. data or data;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
379
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
380 -- Attempt to determine protocol handler if not done previously
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
381 if session.handler == nil then
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
382 -- Match current session buffer against all known protocol signatures to determine protocol handler
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
383 for handler_name, handler in pairs(PROTO_HANDLERS) do
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
384 if session.buffer:find("^" .. handler.signature) ~= nil then
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
385 session.handler = handler.callback;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
386 module:log("debug", "Detected %s connection from %s:%d", handler_name, conn:ip(), conn:port());
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
387 break;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
388 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
389 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
390
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
391 -- Decide between waiting for a complete header signature or terminating the connection when no handler has been found
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
392 if session.handler == nil then
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
393 -- Terminate connection if buffer size has exceeded tolerable maximum size
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
394 if #session.buffer > PROTO_MAX_HEADER_LENGTH then
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
395 conn:close();
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
396 module:log("warn", "Connection %s:%d terminated: No valid PROXY header within %d bytes",
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
397 conn:ip(), conn:port(), PROTO_MAX_HEADER_LENGTH);
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
398 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
399
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
400 -- Skip further processing without a valid protocol handler
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
401 module:log("debug", "No valid header signature detected from %s:%d, waiting for more data...",
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
402 conn:ip(), conn:port());
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
403 return;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
404 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
405 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
406
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
407 -- Execute proxy protocol handler and process response
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
408 local response, proxy_data = session.handler(conn, session);
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
409 if response == PROTO_HANDLER_STATUS.SUCCESS then
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
410 module:log("info", "Received PROXY header from %s: %s", conn:ip(), proxy_data:describe());
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
411 return wrap_proxy_connection(conn, session, proxy_data);
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
412 elseif response == PROTO_HANDLER_STATUS.POSTPONE then
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
413 module:log("debug", "Postponed parsing of incomplete PROXY header received from %s", conn:ip());
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
414 return;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
415 elseif response == PROTO_HANDLER_STATUS.FAILURE then
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
416 conn:close();
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
417 module:log("warn", "Connection %s terminated: Could not process PROXY header from client, " +
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
418 "see previous log messages.", conn:ip());
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
419 return;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
420 else
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
421 -- This code should be never reached, but is included for completeness
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
422 conn:close();
2962
6b01600b9c02 mod_net_proxy: Adjusted log level of errors triggered by remote connections to 'warn'
Pascal Mathis <mail@pascalmathis.com>
parents: 2961
diff changeset
423 module:log("warn", "Connection terminated: Received invalid protocol handler response with code %d", response);
2930
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
424 return;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
425 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
426 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
427
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
428 function listener.ondisconnect(conn)
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
429 sessions[conn] = nil;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
430 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
431
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
432 listener.ondetach = listener.ondisconnect;
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
433
2963
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
434 -- Parse trusted proxies which can either contain single hosts or networks
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
435 if not config_trusted_proxies:empty() then
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
436 for trusted_proxy in config_trusted_proxies:items() do
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
437 local network = {};
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
438 network.ip, network.cidr = ip.parse_cidr(trusted_proxy);
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
439 trusted_networks:add(network);
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
440 end
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
441 else
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
442 module:log("warn", "No trusted proxies configured, all connections will be accepted - this might be dangerous");
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
443 end
504bb330e910 mod_net_proxy: Added proxy_trusted_proxies for whitelisting incoming connections
Pascal Mathis <mail@pascalmathis.com>
parents: 2962
diff changeset
444
2961
33227efa2cdc mod_net_proxy: Automatically listen on all mapped ports if proxy_ports was not configured
Pascal Mathis <mail@pascalmathis.com>
parents: 2935
diff changeset
445 -- Process all configured port mappings and generate a list of mapped ports
33227efa2cdc mod_net_proxy: Automatically listen on all mapped ports if proxy_ports was not configured
Pascal Mathis <mail@pascalmathis.com>
parents: 2935
diff changeset
446 local mapped_ports = {};
33227efa2cdc mod_net_proxy: Automatically listen on all mapped ports if proxy_ports was not configured
Pascal Mathis <mail@pascalmathis.com>
parents: 2935
diff changeset
447 for port, mapping in pairs(config_mappings) do
3562
b33b2fbdc713 mod_net_proxy: Ensure port numbers are coerced into numbers
Kim Alvefur <zash@zash.se>
parents: 2997
diff changeset
448 port = tonumber(port);
2961
33227efa2cdc mod_net_proxy: Automatically listen on all mapped ports if proxy_ports was not configured
Pascal Mathis <mail@pascalmathis.com>
parents: 2935
diff changeset
449 table.insert(mapped_ports, port);
33227efa2cdc mod_net_proxy: Automatically listen on all mapped ports if proxy_ports was not configured
Pascal Mathis <mail@pascalmathis.com>
parents: 2935
diff changeset
450 mappings[port] = {
33227efa2cdc mod_net_proxy: Automatically listen on all mapped ports if proxy_ports was not configured
Pascal Mathis <mail@pascalmathis.com>
parents: 2935
diff changeset
451 service_name = mapping,
33227efa2cdc mod_net_proxy: Automatically listen on all mapped ports if proxy_ports was not configured
Pascal Mathis <mail@pascalmathis.com>
parents: 2935
diff changeset
452 service = nil,
33227efa2cdc mod_net_proxy: Automatically listen on all mapped ports if proxy_ports was not configured
Pascal Mathis <mail@pascalmathis.com>
parents: 2935
diff changeset
453 };
33227efa2cdc mod_net_proxy: Automatically listen on all mapped ports if proxy_ports was not configured
Pascal Mathis <mail@pascalmathis.com>
parents: 2935
diff changeset
454 end
33227efa2cdc mod_net_proxy: Automatically listen on all mapped ports if proxy_ports was not configured
Pascal Mathis <mail@pascalmathis.com>
parents: 2935
diff changeset
455
33227efa2cdc mod_net_proxy: Automatically listen on all mapped ports if proxy_ports was not configured
Pascal Mathis <mail@pascalmathis.com>
parents: 2935
diff changeset
456 -- Log error message when user manually specifies ports without configuring the necessary port mappings
33227efa2cdc mod_net_proxy: Automatically listen on all mapped ports if proxy_ports was not configured
Pascal Mathis <mail@pascalmathis.com>
parents: 2935
diff changeset
457 if not config_ports:empty() then
33227efa2cdc mod_net_proxy: Automatically listen on all mapped ports if proxy_ports was not configured
Pascal Mathis <mail@pascalmathis.com>
parents: 2935
diff changeset
458 local missing_ports = config_ports - set.new(mapped_ports);
33227efa2cdc mod_net_proxy: Automatically listen on all mapped ports if proxy_ports was not configured
Pascal Mathis <mail@pascalmathis.com>
parents: 2935
diff changeset
459 if not missing_ports:empty() then
33227efa2cdc mod_net_proxy: Automatically listen on all mapped ports if proxy_ports was not configured
Pascal Mathis <mail@pascalmathis.com>
parents: 2935
diff changeset
460 module:log("error", "Missing port<>service mappings for these ports: %s", tostring(missing_ports));
2930
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
461 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
462 end
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
463
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
464 -- Register the previously declared network listener
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
465 module:provides("net", {
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
466 name = "proxy";
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
467 listener = listener;
2961
33227efa2cdc mod_net_proxy: Automatically listen on all mapped ports if proxy_ports was not configured
Pascal Mathis <mail@pascalmathis.com>
parents: 2935
diff changeset
468 default_ports = mapped_ports;
2930
9a62780e7ee2 mod_net_proxy: New module implementing PROXY protocol versions 1 and 2
Pascal Mathis <mail@pascalmathis.com>
parents:
diff changeset
469 });
6348
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
470
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
471 function module.add_host(module)
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
472 local proxy_out = module:get_option("proxy_out", "");
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
473
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
474 local proxy_secure = module:get_option("proxy_secure", false);
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
475 local proxy_secure_in = proxy_secure or module:get_option("proxy_secure_in", false);
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
476 local proxy_secure_out = proxy_secure or module:get_option("proxy_secure_out", false);
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
477
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
478 if proxy_out ~= "" then
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
479 -- this redirects outgoing s2s connections to a static host:port
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
480 local host, port = proxy_out[1] or proxy_out, tonumber(proxy_out[2]) or 15270;
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
481 module:log("debug", "proxy_out: '%s:%d' proxy_secure_out: %s proxy_secure_in: %s", host, port, proxy_secure_out, proxy_secure_in);
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
482 module:hook("s2sout-pre-connect", function (event)
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
483 local session = event.session;
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
484
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
485 module:log("debug", "proxy_out redirect for '%s'", session.to_host);
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
486
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
487 if proxy_secure_out then
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
488 -- mark it secure so we will offer SASL EXTERNAL auth
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
489 session.secure = true;
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
490 end
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
491
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
492 event.resolver = basic_resolver.new(host, port, "tcp");
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
493 end);
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
494 else
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
495 module:log("debug", "proxy_secure_in: %s", proxy_secure_in);
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
496 end
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
497
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
498 if proxy_secure_in then
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
499 -- this hook marks incoming s2s as secure so we offer SASL EXTERNAL auth
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
500 module:hook("s2s-stream-features", function(event)
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
501 local session = event.origin;
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
502 -- check that proxyip isn't nil to make sure the connection was handled by this module
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
503 if session.conn.proxyip and session.type == "s2sin_unauthed" then
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
504 module:log("debug", "proxy_in for '%s' marked secure with validated cert", session.from_host);
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
505 session.secure = true;
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
506 session.cert_chain_status = "valid";
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
507 session.cert_identity_status = "valid";
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
508 end
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
509 end, 9000);
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
510 end
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
511
9d3e6d2f25c7 mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
moparisthebest <admin@moparisthebest.com>
parents: 6213
diff changeset
512 end