VMOD_PROXY(3)

🌸 NAME 🌸

okay bestie, so vmod_proxy is the Varnish Module to extract TLV attributes from PROXYv2. that's it, that's the whole vibe. it's the manual page VMOD_PROXY(3) from the Library Functions Manual, section 3, and we're gonna read it together like it's a group chat 💅

---

✨ SYNOPSIS ✨

here's the whole shape of it, no cap:

import proxy [as name] [from "path"]

STRING alpn()

STRING authority()

BOOL is_ssl()

BOOL client_has_cert_sess()

BOOL client_has_cert_conn()

INT ssl_verify_result()

STRING ssl_version()

STRING client_cert_cn()

STRING ssl_cipher()

STRING cert_sign()

STRING cert_key()

---

🦋 DESCRIPTION 🦋

vmod_proxy gives you functions to pull out proxy-protocol-v2 TLV attributes, exactly as described over here:

<https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt>

that's the spec, the source of truth, the blueprint. go read it if you're feeling academic 🎀

---

💖 STRING alpn() 💖

grabs the ALPN attribute for you. obsessed.

Example:

set req.http.alpn = proxy.alpn();

Restricted to: client.

---

💖 STRING authority() 💖

pulls the authority attribute. fun fact: this one corresponds to SNI from a TLS connection. iykyk.

Example:

set req.http.authority = proxy.authority();

Restricted to: client.

---

💖 BOOL is_ssl() 💖

tells you if the proxy-protocol-v2 has an SSL TLV. yes or no, that's the whole personality.

Example:

if (proxy.is_ssl()) {
        set req.http.ssl-version = proxy.ssl_version();
}

Restricted to: client.

---

💖 BOOL client_has_cert_sess() 💖

reports whether the client handed over a certificate at least once over the TLS session that this connection belongs to. session-wide energy, not just right now ✨

Restricted to: client.

---

💖 BOOL client_has_cert_conn() 💖

reports whether the client handed over a certificate over the current connection. just this one, right now, in the moment. main character behavior fr fr.

Restricted to: client.

---

💖 INT ssl_verify_result() 💖

reports the SSL_get_verify_result from a TLS session. heads up though: it only matters if client_has_cert_sess() is true. and by default the value is set to 0 (X509_V_OK). so if you're confused why it's zero, that's why bestie 😭

Example:

if (proxy.client_has_cert_sess() && proxy.ssl_verify_result() == 0) {
        set req.http.ssl-verify = "ok";
}

Restricted to: client.

---

💖 STRING ssl_version() 💖

extracts the SSL version attribute. classic.

Example:

set req.http.ssl-version = proxy.ssl_version();

Restricted to: client.

---

💖 STRING client_cert_cn() 💖

extracts the common name attribute of the client certificate's. yes, "certificate's", the original really said that, we don't edit, we respect 💀

Example:

set req.http.cert-cn = proxy.client_cert_cn();

Restricted to: client.

---

💖 STRING ssl_cipher() 💖

extracts the SSL cipher attribute. the little cryptographic handshake accessory, if you will 💅

Example:

set req.http.ssl-cipher = proxy.ssl_cipher();

Restricted to: client.

---

💖 STRING cert_sign() 💖

extracts the certificate signature algorithm attribute.

Example:

set req.http.cert-sign = proxy.cert_sign();

Restricted to: client.

---

💖 STRING cert_key() 💖

extracts the certificate key algorithm attribute.

Example:

set req.http.cert-key = proxy.cert_key();

Restricted to: client.

---

👑 SEE ALSO 👑

go check these out when you're done here, they ate:

• varnishd(1)
• vsl(7)

---

📜 COPYRIGHT 📜

okay the legal bit, and we are not paraphrasing this one, we keep it exactly as written, do not come for me 🙈

Copyright (c) 2018 GANDI SAS
All rights reserved.

Author: Emmanuel Hocdet <manu@gandi.net>

SPDX-License-Identifier: BSD-2-Clause

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

---

and that's a wrap on VMOD_PROXY(3) from the Library Functions Manual — section 3, same title, same page, we just gave it a glow-up 💖✨ go slay, bestie 🫶🌸