Enable PROXY protocol for specific CIDRs in HAProxy #711
Conversation
Mrizwanshaik
force-pushed
the
CFN-4684
branch
from
12a92c0
to
0620360
Compare
Co-authored-by: Rizwan <m.rizwan.shaik@sap.com>
Mrizwanshaik
force-pushed
the
CFN-4684
branch
from
bcf58bf
to
156e328
Compare
Co-Authored-by: Alexander Lais <alexander.lais@sap.com> Co-Authored-by: Daria Anton <daria.anton@sap.com>
Dariquest
changed the title
There was a problem hiding this comment.
LGTM. The description, or commit message, could be improved.
@Dariquest received some feedback already on this. This PR os not about IPv6, but about conditional Proxy Protocol handling. It benefits dual-stack roll-out on AWS, but is not the only possible use.
Removed the IPv6 and adjusted the description. Thanks! |
|
|
||
| // Requests without Proxy Protocol Header should succeed | ||
| expectTestServer200(http.Get("http://127.0.0.1:11000")) | ||
| }) | ||
| }) | ||
| }) | ||
|
|
There was a problem hiding this comment.
It might make sense to have an edge test case with empty except_proxy_cidr and check that the call without proxy will be successful.
There was a problem hiding this comment.
an empty except_proxy_cidrs is equivalent to the property being off.
|
Hi @Dariquest , everything fine now. The only minor thing, you might want to add this sentence to spec |
Done, thanks! |
This PR introduces a new property expect_proxy_cidrs, which accepts a list of CIDR ranges for which to expect the PROXY protocol. This property allows selective enablement of PROXY protocol based on the source IP address.
Expect_proxy_cidrs is mutually exclusive with the accept_proxy, which enables PROXY protocol for all connections, and will lead to validation failure if both are set to true.