Re: HAProxy and proxy protocol support

I have direct experience with HAProxy's PROXY protocols (v1 & v2) and can
help with the implementation if you point me to where the best place to
implement the protocol handler would be, and how to pass the necessary
values onward. Both versions of the protocol are quite easy to handle, with
v2 allowing for some additional parameter passing flexibility. That being
said, I believe another approach would be to make changes on the HAProxy
side, assuming there is a signaling capability somewhere in the protocols
used in the postfix conversation. I don't recall all the details of SMTP
but of course this alternative would only work if the conversations are not
enclosed in TLS and/or (I'm not remembering all the details of SMTP) there
is an opportunity to pass information prior to any SMTP level encryption
(e.g. encode them in the initial EHLO?). If TLS then HAProxy is probably
terminating the TLS anyway?? In that case it's possible HAProxy's config
language gives enough utilities to modify the initial protocol steps to
pass the additional information.  If you need help studying theseissues
reach out to me directly.

On Mon, Jun 10, 2024 at 6:41 AM Pascal Véron <[email protected]> wrote:

> Thank for your response,
>
> If you are interested, I can propose my help at least for testing and
> reporting
>
> Cordialement,
> Pascal Véron
> VEZIM SARL
>
> Le 10/06/2024 à 14:17, Sam Varshavchik a écrit :
> > Pascal Véron writes:
> >
> >> « HTML content follows
> >> »Hello,
> >>
> >> We installed 2 Courier servers in different datacenter behind a load
> >> balancer provided by our hosting provider (OVHCloud).
> >> This load balancer are using HAproxy technology and proxy protocol.
> >>
> >> If we use load balancer without proxy protocol, all works well for
> >> clients. SMTP, IMAP and POP connexions are fully fonctionnals. But
> >> there a problem we can't solve. Courier server receive only load
> >> balancer's IP instead of real origin IP (which is the one we want to
> >> have for logs, fail2ban, blacklists check...)
> >>
> >> HAProxy provide some proxy protocol (v1, v2, v2-ssl...) to transmit
> >> origin IP, but if we use proxy protocol on load balancer, it does not
> >> work
> >>
> >> > telnet [IP_LOAD_BALANCER] 587
> >> Trying [IP_LOAD_BALANCER]...
> >> Connected to [IP_LOAD_BALANCER].
> >> Escape character is '^]'.
> >> 220 [NAME_LOAD_BALANCER] ESMTP
> >> 502 ESMTP command error
> >> ...write in mail.log
> >>
> >> Jun 10 10:19:28  [NAME_LOAD_BALANCER]:
> >> error,relay=::ffff:10.110.97.193,port=29832,msg="502 ESMTP command
> >> error",cmd: PROXY TCP4 [REAL_IP_ORIGIN] [IP_LOAD_BALANCER] 56590 587
> >>
> >> Same with pop
> >>
> >> > telnet [IP_LOAD_BALANCER] 110
> >> Trying [IP_LOAD_BALANCER]...
> >> Connected to [IP_LOAD_BALANCER].
> >> Escape character is '^]'.
> >> +OK Hello there.
> >> -ERR Invalid command.
> >>
> >> So sadly as it stands we cannot use this system.
> >>
> >> So my question is : do you think this could be an interesting option
> >> to add to Courier or not ?
> >>
> >> <URL:
> https://github.com/haproxy/haproxy/blob/master/doc/proxy-protocol.txt>
> https://github.com/haproxy/haproxy/blob/master/doc/proxy-protocol.txt
> >>
> >> <URL:
> https://www.haproxy.com/blog/use-the-proxy-protocol-to-preserve-a-clients-ip-address
> >
> https://www.haproxy.com/blog/use-the-proxy-protocol-to-preserve-a-clients-ip-address
> >>
> >
> > At least version 1 looks simple enough to handle, however I don't use
> > HAProxy myself, so this would be a hit or miss proposition, as far as
> > testing goes.
> >
> >
> >
> >
> > _______________________________________________
> > courier-users mailing list
> > [email protected]
> > Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users
>
>
> _______________________________________________
> courier-users mailing list
> [email protected]
> Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users
>

_______________________________________________
courier-users mailing list
[email protected]
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users