mirror of
https://github.com/coredns/coredns.git
synced 2026-10-16 23:35:43 -04:00
3909cc187c
The proxyproto plugin parsed PROXY protocol v2 headers only to recover the real client address; the TLV vector was discarded, so downstream plugins had no way to read values such as the AWS VPC endpoint ID, SSL client CN, or vendor-specific custom TLVs. Add an opt-in `tlv_metadata` option. When set, the connection's raw PPv2 TLV vector is captured and the plugin, acting as a metadata.Provider, publishes it under the `proxyproto/tlv` label as a hex-encoded string. Consumers decode and split it with proxyproto.SplitTLVs. The option is off by default, so existing deployments skip the extra per-connection processing and behave exactly as before. PROXY protocol v1 connections, which carry no TLVs, are unaffected. Capture spans all transports: dns:// (UDP and TCP), tls:// (DoT), https:// (DoH), grpc://, quic:// (DoQ), and https3:// (DoH3). QUIC-based transports require udp_session_tracking, since the PPv2 header arrives as a standalone first datagram ahead of the QUIC handshake. Includes unit tests for capture, the metadata provider (direct and through the real metadata chain), v1 compatibility, and option parsing, plus README and man page updates. Fixes #8633 Signed-off-by: Mekias Yohannes <mekias@amazon.com> Co-authored-by: Mekias Yohannes <mekias@amazon.com>
51 lines
1.4 KiB
Go
51 lines
1.4 KiB
Go
package proxyproto
|
|
|
|
import (
|
|
"context"
|
|
"encoding/hex"
|
|
|
|
"github.com/coredns/coredns/plugin"
|
|
"github.com/coredns/coredns/plugin/metadata"
|
|
cproxyproto "github.com/coredns/coredns/plugin/pkg/proxyproto"
|
|
"github.com/coredns/coredns/request"
|
|
|
|
"github.com/miekg/dns"
|
|
)
|
|
|
|
// handler is a pass-through plugin that implements metadata.Provider to expose
|
|
// the PPv2 TLV vector captured by the listener. It is only added to the chain
|
|
// when the tlv_metadata option is set.
|
|
type handler struct {
|
|
Next plugin.Handler
|
|
}
|
|
|
|
// Name implements plugin.Handler.
|
|
func (h handler) Name() string { return "proxyproto" }
|
|
|
|
// ServeDNS implements plugin.Handler; it only passes the request on.
|
|
func (h handler) ServeDNS(ctx context.Context, w dns.ResponseWriter, r *dns.Msg) (int, error) {
|
|
return plugin.NextOrFailure(h.Name(), h.Next, ctx, w, r)
|
|
}
|
|
|
|
// Metadata implements metadata.Provider. It publishes the raw PPv2 TLV vector
|
|
// as the "proxyproto/tlv" label, hex-encoded, when the current request carries
|
|
// TLVs. Consumers decode the hex and split it with proxyproto.SplitTLVs.
|
|
func (h handler) Metadata(ctx context.Context, state request.Request) context.Context {
|
|
a, ok := state.W.RemoteAddr().(*cproxyproto.Addr)
|
|
if !ok {
|
|
return ctx
|
|
}
|
|
raw := a.RawTLVs()
|
|
if len(raw) == 0 {
|
|
return ctx
|
|
}
|
|
v := hex.EncodeToString(raw)
|
|
metadata.SetValueFunc(ctx, "proxyproto/tlv", func() string { return v })
|
|
return ctx
|
|
}
|
|
|
|
var (
|
|
_ plugin.Handler = handler{}
|
|
_ metadata.Provider = handler{}
|
|
)
|