Re: HAProxy and proxy protocol support

Sam Varshavchik <[email protected]> Mon, 10 Jun 2024 22:09:31 -0400
Newsgroups	gmane.mail.imap.courier.general
Message-ID	<[email protected]>
Andrew Athan writes:

> »I have direct experience with HAProxy's PROXY protocols (v1 & v2) and can  
> help with the implementation if you point me to where the best place to  
> implement the protocol handler would be, and how to pass the necessary values  
> onward. Both versions of the protocol are quite easy to handle, with v2  
> allowing for some additional parameter passing flexibility. That being said,  
> I believe another approach would be to make changes on the HAProxy side,  
> assuming there is a signaling capability somewhere in the protocols used in  
> the postfix conversation. I don't recall all the details of SMTP but of  
> course this alternative would only work if the conversations are not enclosed  
> in TLS and/or (I'm not remembering all the details of SMTP) there is an  
> opportunity to pass information prior to any SMTP level encryption (e.g.  
> encode them in the initial EHLO?).

No, there is no standardized mechanism in SMTP for passing along the origin  
PI of a proxies connection. Nor there is one for IMAP or POP3, either.

I did some manual testing today, I uploaded builds of courier and courier- 
imap packages to https://www.courier-mta.org/download.html, dated today. I  
have no way of knowing whether this would work or not with the real HAProxy.

At the same time this removes the code for mostly deprecated and unused  
identd protocol. couriertcpd's --noidentlookup option is removed and  
replaced with -haproxy. Building and installing this version using the  
documneted update process, or building and installing updated rpm or deb  
packages will remove the TCPDOPTS setting from the esmtpd, imap, and pop3d  
configuration file (since --noidentlookup is a default option and it no  
longer exists) and reset it to the default one. Adding an "-haproxy" option  
to TCPDOPTS, per the updated documentation in the couriertcpd man page,  
enables HAProxy. All connections must either be HAProxy or not. Now that I  
talked this out, I'll do some more work and make it possible to selectively  
enable HAProxy based on the connecting IP address, so this isn't going to be  
the final way of enabling it, so this'll change.

As far as the code changes, the relevant code is in tcpd.c which, after  
accepting each connection on the listening socket it forks, and runs the  
server.

One possible complication here will be the necessity of reading the HAProxy  
header before forking off a new process, this means that the next connection  
cannot be accepted until then. This is currently unavoidable because it's  
the parent process that keeps track of each active connection and its IP  
address, to enforce rate limiting on connections from the same IP address or  
netblock. The parent process needs to know the connecting IP address. I  
would not expect to be any delays here, HAProxy should be prompt it pushing  
out the header. We'll see.

_______________________________________________
courier-users mailing list
[email protected]
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users
signature.asc (application/pgp-signature, 228 B)