Proxy protocol

[ywc689]

No description provided.

[ywc689]

	toa	uoa (ipo)	uoa (opp)	proxy protocol (v1)	proxy protocol (v2)
FNAT44	√	√	√	√	√
FNAT66	√	×	√	√	√
FNAT64	√	×	√	√	√
TCP	√	×	×	√	√
UDP	×	√	√	×	√

	toa	uoa (ipo mode)	uoa (opp mode)	proxy protocol (v1 & v2)
configuration switch	always on	global, default off	global, default on	per-service, toa/uoa mutal exclusive
where client address resides	tcp option	ipv4 option	private ip protocol	tcp/udp beginnig payload
standardization	private standard	private implementation	private implementation	defacto standard
application intrusiveness	transparent	transparent (only fnat44 supported)	transparent when uoa.ko installed	intrusive
client address resolution intrusiveness	transparent for fnat44/fnat66; intrusive for fnat64	intrusive	intrusive	intrusive
client source address resolution	support	support	support	support
client destination address resolution	not support	not support	not support	support
kernel module requirement on realserver	toa.ko, not compulsory when client addresses aren't concerned	uoa.ko	uoa.ko	no kernel module required
load balancer cascading	not support	not support	not support	support
retransmission	support	fixed times, default 3	fixed times, default 3	support for tcp, not support for udp
underlay network supports	good	bad	medium	good
client address loss cases	when no enough tcp option room in first ack seg	general udp packet loss	general udp packet loss	no loss for tcp, general udp packet loss for udp
well-known application supports	-	-	-	haproxy, nginx, envoy, ...
intrusive application server examples	fnat64	udp_serv	udp_serv	tcp_server, udp_server, official sample code

[ytwang0320]

If DPVS receives invalid proxy_protocol data, should DPVS terminate the connection or reconstruct the proxy_protocol data?

[ywc689]

Yes, we did. If the proxy protocol data is invalid in the original packets, ppinfo.datalen is set to zero in proxy_proto_parse, and then the following proxy_proto_insert will add a new one later.

But fragile proxy protocol data may not removed if not recognized. But I think it's reasonable to pass the unknown data to backends in the case.