]> git.kaiwu.me - nginx.git/commit
Core: PROXY protocol v2 write support
authorSergey Kandaurov <pluknet@nginx.com>
Mon, 10 Aug 2026 14:10:44 +0000 (18:10 +0400)
committerSergey Kandaurov <s.kandaurov@f5.com>
Tue, 11 Aug 2026 19:39:53 +0000 (23:39 +0400)
commitcfb1d173268c767c734cc42c66bffad9cf2d3095
treeb8a225198af3258bca7ef3c8341203328101f62b
parent49181eb14a86c19a79122626673609bd41c00d63
Core: PROXY protocol v2 write support

Add ngx_proxy_protocol_v2_write() that writes the fixed 16-byte
PPv2 header and address block, and appends a list of TLVs.

An address block is written using IPv4/IPv6 mixed-family promotion:
the highest family present on either side (IPv6 > IPv4) is used for
the header, and the other address is promoted into it.  Both v4-mapped
addresses are demoted to IPv4.

When PROXY protocol v2 is configured and the downstream connection
is SSL, standard PROXY protocol v2 TLVs are populated:

    PP2_TYPE_ALPN              from SSL_get0_alpn_selected()
    PP2_TYPE_AUTHORITY         from SSL_get_servername()
    PP2_SUBTYPE_SSL_VERSION    from SSL_get_version()
    PP2_SUBTYPE_SSL_CIPHER     from SSL_get_cipher_name()
    PP2_SUBTYPE_SSL_CN         from client cert subject CN
    PP2_SUBTYPE_SSL_SIG_ALG    from server certificate
    PP2_SUBTYPE_SSL_KEY_ALG    from server certificate

The CRC32c TLV is written last and covers the entire header in place.

Co-authored-by: Vadim Zhestikov <v.zhestikov@f5.com>
src/core/ngx_proxy_protocol.c
src/core/ngx_proxy_protocol.h
src/event/ngx_event_openssl.h