Skip to content

Add support for PP2_SUBTYPE_SSL_GROUP #12921

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
maskit merged 1 commit into from
Mar 3, 2026
Merged

Add support for PP2_SUBTYPE_SSL_GROUP #12921

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions doc/admin-guide/logging/formatting.en.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -536,6 +536,8 @@ pptc Proxy Protocol The TLS cipher from Proxy Protocol context from the LB
TLS Cipher to the |TS|
pptv Proxy Protocol The TLS version from Proxy Protocol context from the LB
TLS version to the |TS|
pptg Proxy Protocol The TLS group from Proxy Protocol context from the LB
TLS group to the |TS|
===== ============== ==========================================================

.. note::
Expand Down
2 changes: 2 additions & 0 deletions include/iocore/net/ProxyProtocol.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,6 +54,7 @@ constexpr uint8_t PP2_SUBTYPE_SSL_CN = 0x22;
constexpr uint8_t PP2_SUBTYPE_SSL_CIPHER = 0x23;
constexpr uint8_t PP2_SUBTYPE_SSL_SIG_ALG = 0x24;
constexpr uint8_t PP2_SUBTYPE_SSL_KEY_ALG = 0x25;
constexpr uint8_t PP2_SUBTYPE_SSL_GROUP = 0x26;
constexpr uint8_t PP2_TYPE_NETNS = 0x30;

class ProxyProtocol
Expand Down Expand Up @@ -88,6 +89,7 @@ class ProxyProtocol
std::optional<std::string_view> get_tlv(const uint8_t tlvCode) const;
std::optional<std::string_view> get_tlv_ssl_version() const;
std::optional<std::string_view> get_tlv_ssl_cipher() const;
std::optional<std::string_view> get_tlv_ssl_group() const;

ProxyProtocolVersion version = ProxyProtocolVersion::UNDEFINED;
uint16_t ip_family = AF_UNSPEC;
Expand Down
1 change: 1 addition & 0 deletions include/proxy/logging/LogAccess.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -272,6 +272,7 @@ class LogAccess
int marshal_proxy_protocol_authority(char *); // STR
int marshal_proxy_protocol_tls_cipher(char *); // STR
int marshal_proxy_protocol_tls_version(char *); // STR
int marshal_proxy_protocol_tls_group(char *); // STR

// named fields from within a http header
//
Expand Down
6 changes: 6 additions & 0 deletions src/iocore/net/ProxyProtocol.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -625,6 +625,12 @@ ProxyProtocol::get_tlv_ssl_cipher() const
return this->_get_tlv_ssl_subtype(PP2_SUBTYPE_SSL_CIPHER);
}

std::optional<std::string_view>
ProxyProtocol::get_tlv_ssl_group() const
{
return this->_get_tlv_ssl_subtype(PP2_SUBTYPE_SSL_GROUP);
}

int
ProxyProtocol::set_additional_data(std::string_view data)
{
Expand Down
6 changes: 4 additions & 2 deletions src/iocore/net/unit_tests/test_ProxyProtocol.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -303,15 +303,16 @@ TEST_CASE("PROXY Protocol v2 Parser", "[ProxyProtocol][ProxyProtocolv2]")
0x55, 0x49, 0x54, 0x0A, ///<
0x21, ///< version & command
0x11, ///< protocol & family
0x00, 0x2B, ///< len
0x00, 0x32, ///< len
0xC0, 0x00, 0x02, 0x01, ///< src_addr
0xC6, 0x33, 0x64, 0x01, ///< dst_addr
0xC3, 0x50, ///< src_port
0x01, 0xBB, ///< dst_port
0x01, 0x00, 0x02, 0x68, 0x32, /// PP2_TYPE_ALPN (h2)
0x02, 0x00, 0x03, 0x61, 0x62, 0x63, /// PP2_TYPE_AUTHORITY (abc)
0x20, 0x00, 0x11, 0x01, 0x00, 0x00, 0x00, 0x00, /// PP2_TYPE_SSL (client=0x01, verify=0)
0x20, 0x00, 0x18, 0x01, 0x00, 0x00, 0x00, 0x00, /// PP2_TYPE_SSL (client=0x01, verify=0)
0x23, 0x00, 0x03, 0x58, 0x59, 0x5A, /// PP2_SUBTYPE_SSL_CIPHER (XYZ)
0x26, 0x00, 0x04, 0x58, 0x31, 0x32, 0x33, /// PP2_SUBTYPE_SSL_GROUP(X123)
0x21, 0x00, 0x03, 0x54, 0x4C, 0x53, /// PP2_SUBTYPE_SSL_VERSION (TLS)
};

Expand All @@ -332,6 +333,7 @@ TEST_CASE("PROXY Protocol v2 Parser", "[ProxyProtocol][ProxyProtocolv2]")
CHECK(pp_info.tlv[PP2_TYPE_AUTHORITY] == "abc");

CHECK(pp_info.get_tlv_ssl_cipher() == "XYZ");
CHECK(pp_info.get_tlv_ssl_group() == "X123");
CHECK(pp_info.get_tlv_ssl_version() == "TLS");
}

Expand Down
5 changes: 5 additions & 0 deletions src/proxy/logging/Log.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1048,6 +1048,11 @@ Log::init_fields()
global_field_list.add(field, false);
field_symbol_hash.emplace("pptv", field);

field = new LogField("proxy_protocol_tls_group", "pptg", LogField::STRING, &LogAccess::marshal_proxy_protocol_tls_group,
&LogAccess::unmarshal_str);
global_field_list.add(field, false);
field_symbol_hash.emplace("pptg", field);

field = new LogField("version_build_number", "vbn", LogField::STRING, &LogAccess::marshal_version_build_number,
&LogAccess::unmarshal_str);
global_field_list.add(field, false);
Expand Down
21 changes: 21 additions & 0 deletions src/proxy/logging/LogAccess.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1751,6 +1751,27 @@ LogAccess::marshal_proxy_protocol_tls_version(char *buf)
return len;
}

int
LogAccess::marshal_proxy_protocol_tls_group(char *buf)
{
int len = INK_MIN_ALIGN;

if (m_http_sm) {
if (auto group = m_http_sm->t_state.pp_info.get_tlv_ssl_group(); group) {
len = padded_length(group->size() + 1);
if (buf) {
marshal_mem(buf, group->data(), group->size(), len);
}
} else {
if (buf) {
// This prints the default value ("-")
marshal_mem(buf, nullptr, 0, len);
}
}
}
return len;
}

/*-------------------------------------------------------------------------
-------------------------------------------------------------------------*/
int
Expand Down