Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-95375

Proxy Protocol Version 2 Conversion and Feasibility of Patch Support

Linking RHIVOS CVEs to...Migration: Automation ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • Icon: Story Story
    • Resolution: Won't Do
    • Icon: Undefined Undefined
    • None
    • rhel-8.10
    • nginx
    • Critical
    • rhel-stacks-web-servers
    • ssg_core_services
    • None
    • False
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • Unspecified
    • Unspecified
    • Unspecified
    • None

      Hello Team,
       
      I am writing regarding case #04090820.

      1) Customer Environment Details:
      The current setup is as follows:
      Web Browser <==> Nginx Load Balancer (v1.24) <==> TCP Stream <==> Upstream Hosts

      2) Issue:
      The environment is configured to use a TCP stream with proxy_protocol on. However, the upstream servers are receiving traffic with Proxy Protocol version 1, which they are unable to parse, resulting in the rejection of incoming requests.

      3) Reproduction Attempt:
      I attempted to reproduce the issue and successfully observed Proxy Protocol V2 with Nginx version 1.24 using the following test setup:

      Browser (Normal HTTP Request) → HAProxy (PPv2 Request) → Nginx_1 → Nginx_2

      4) Our Clarification to the Customer:
      We have explained that Nginx cannot enforce a conversion from Proxy Protocol v1 to v2 for incoming requests. The protocol version used is determined by the originating sender (e.g., a load balancer or proxy). Nginx must match the incoming version to interpret and process the request headers correctly.

      5) Customer's current request:
      When this patch https://github.com/dedok/nginx-stream-proxy-protocol-v2/blob/main/stream-proxy-protocol-v2-release-1.19.8.patch helps to do the conversion of V1 to V2 protocol to the upstream servers, will we get any such update from Red Hat to serve that case ??

      Hence, I want to know if providing a patch like this is possible for us, or if this is a valid request to open an RFE?

              luhliari@redhat.com Lubos Uhliarik
              rhn-support-vepatil Vedantika Patil
              Lubos Uhliarik Lubos Uhliarik
              Iveta Kyralova Iveta Kyralova
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated:
                Resolved: