1VMOD_PROXY(3)                                                    VMOD_PROXY(3)
2
3
4

NAME

6       vmod_proxy - Varnish Module to extract TLV attributes from PROXYv2
7

SYNOPSIS

9          import proxy [as name] [from "path"]
10
11          STRING alpn()
12
13          STRING authority()
14
15          BOOL is_ssl()
16
17          BOOL client_has_cert_sess()
18
19          BOOL client_has_cert_conn()
20
21          INT ssl_verify_result()
22
23          STRING ssl_version()
24
25          STRING client_cert_cn()
26
27          STRING ssl_cipher()
28
29          STRING cert_sign()
30
31          STRING cert_key()
32

DESCRIPTION

34       vmod_proxy  contains  functions  to  extract  proxy-protocol-v2 TLV at‐
35       tributes                as                 described                 in
36       https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt.
37
38   STRING alpn()
39       Extract ALPN attribute.
40
41       Example:
42
43          set req.http.alpn = proxy.alpn();
44
45   STRING authority()
46       Extract authority attribute. This corresponds to SNI from a TLS connec‐
47       tion.
48
49       Example:
50
51          set req.http.authority = proxy.authority();
52
53   BOOL is_ssl()
54       Report if proxy-protocol-v2 has SSL TLV.
55
56       Example:
57
58          if (proxy.is_ssl()) {
59                  set req.http.ssl-version = proxy.ssl_version();
60          }
61
62   BOOL client_has_cert_sess()
63       Report if the client provided a certificate at least once over the  TLS
64       session this connection belongs to.
65
66   BOOL client_has_cert_conn()
67       Report  if  the  client provided a certificate over the current connec‐
68       tion.
69
70   INT ssl_verify_result()
71       Report the SSL_get_verify_result from a TLS session. It only matters if
72       client_has_cert_sess()  is  true.  Per  default,  value  is  set  to  0
73       (X509_V_OK).
74
75       Example:
76
77          if (proxy.client_has_cert_sess() && proxy.ssl_verify_result() == 0) {
78                  set req.http.ssl-verify = "ok";
79          }
80
81   STRING ssl_version()
82       Extract SSL version attribute.
83
84       Example:
85
86          set req.http.ssl-version = proxy.ssl_version();
87
88   STRING client_cert_cn()
89       Extract the common name attribute of the client certificate's.
90
91       Example::
92              set req.http.cert-cn = proxy.client_cert_cn();
93
94   STRING ssl_cipher()
95       Extract the SSL cipher attribute.
96
97       Example:
98
99          set req.http.ssl-cipher = proxy.ssl_cipher();
100
101   STRING cert_sign()
102       Extract the certificate signature algorithm attribute.
103
104       Example:
105
106          set req.http.cert-sign = proxy.cert_sign();
107
108   STRING cert_key()
109       Extract the certificate key algorithm attribute.
110
111       Example:
112
113          set req.http.cert-key = proxy.cert_key();
114

SEE ALSO

116       • varnishd(1)
117
118       • vsl(7)
119

121          Copyright (c) 2018 GANDI SAS
122          All rights reserved.
123
124          Author: Emmanuel Hocdet <manu@gandi.net>
125
126          SPDX-License-Identifier: BSD-2-Clause
127
128          Redistribution and use in source and binary forms, with or without
129          modification, are permitted provided that the following conditions
130          are met:
131          1. Redistributions of source code must retain the above copyright
132             notice, this list of conditions and the following disclaimer.
133          2. Redistributions in binary form must reproduce the above copyright
134             notice, this list of conditions and the following disclaimer in the
135             documentation and/or other materials provided with the distribution.
136
137          THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
138          ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
139          IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
140          ARE DISCLAIMED.  IN NO EVENT SHALL AUTHOR OR CONTRIBUTORS BE LIABLE
141          FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
142          DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
143          OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
144          HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
145          LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
146          OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
147          SUCH DAMAGE.
148
149
150
151
152                                                                 VMOD_PROXY(3)
Impressum