Actually disable TPROXY spoofing when PROXY protocol is used

Also, hide the TPROXY disable warning when TPROXY not used.

diff --git a/src/cache_cf.cc b/src/cache_cf.cc
index 7af208c5b7f8f46f007b1f8a8d46d03103fccd75..3f6ea48f461ba81b6092c5c05178b4f0c3731026 100644 (file)
--- a/src/cache_cf.cc
+++ b/src/cache_cf.cc
@@ -3609,7 +3609,11 @@ parse_port_option(AnyP::PortCfgPointer &s, char *token)
 
     } else if (strcmp(token, "require-proxy-header") == 0) {
         s->flags.proxySurrogate = true;
-        debugs(3, DBG_IMPORTANT, "Disabling TPROXY Spoofing on port " << s->s << " (require-proxy-header enabled)");
+        if (s->flags.tproxyIntercept) {
+            // receiving is still permitted, so we do not unset the TPROXY flag
+            // spoofing access control override takes care of the spoof disable later
+            debugs(3, DBG_IMPORTANT, "Disabling TPROXY Spoofing on port " << s->s << " (require-proxy-header enabled)");
+        }
 
     } else if (strncmp(token, "defaultsite=", 12) == 0) {
         if (!s->flags.accelSurrogate) {

diff --git a/src/client_side.cc b/src/client_side.cc
index 75312e4377477ef36496f734b434ee8869ade209..a322090b7dae74fdc20638db5fea05fed9a438ed 100644 (file)
--- a/src/client_side.cc
+++ b/src/client_side.cc
@@ -2696,7 +2696,8 @@ clientProcessRequest(ConnStateData *conn, HttpParser *hp, ClientSocketContext *c
     if (http->clientConnection != NULL) {
         request->flags.intercepted = ((http->clientConnection->flags & COMM_INTERCEPTION) != 0);
         request->flags.interceptTproxy = ((http->clientConnection->flags & COMM_TRANSPARENT) != 0 ) ;
-        if (request->flags.interceptTproxy) {
+        static const bool proxyProtocolPort = (conn->port != NULL) ? conn->port->flags.proxySurrogate : false;
+        if (request->flags.interceptTproxy && !proxyProtocolPort) {
             if (Config.accessList.spoof_client_ip) {
                 ACLFilledChecklist *checklist = clientAclChecklistCreate(Config.accessList.spoof_client_ip, http);
                 request->flags.spoofClientIp = (checklist->fastCheck() == ACCESS_ALLOWED);