Add option to skip adding X-Forwarded-Proto header.

Author: rygwdn

README.md

@@ -185,6 +185,7 @@ Settings in this part is immutable, you have to redeploy HAProxy service to make
 |MONITOR_URI| |the exact URI which we want to intercept to return HAProxy's health status instead of forwarding the request.See: http://cbonte.github.io/haproxy-dconv/configuration-1.5.html#4-monitor-uri. Possible value: `/ping`|
 |OPTION|redispatch|comma-separated list of HAProxy `option` entries to the `default` section.|
 |RSYSLOG_DESTINATION|127.0.0.1|the rsyslog destination to where HAProxy logs are sent|
+|SKIP_FORWARDED_PROTO||If set to any value, HAProxy will not add an X-Forwarded- headers. This can be used when combining HAProxy with another load balancer|
 |SSL_BIND_CIPHERS| |explicitly set which SSL ciphers will be used for the SSL server. This sets the HAProxy `ssl-default-bind-ciphers` configuration setting.|
 |SSL_BIND_OPTIONS|no-sslv3|explicitly set which SSL bind options will be used for the SSL server. This sets the HAProxy `ssl-default-bind-options` configuration setting. The default will allow only TLSv1.0+ to be used on the SSL server.|
 |STATS_AUTH|stats:stats|username and password required to access the Haproxy stats.|

haproxy/config.py

@@ -53,6 +53,7 @@ def parse_extra_frontend_settings(envvars):
 MONITOR_URI = os.getenv("MONITOR_URI")
 OPTION = os.getenv("OPTION", "redispatch, httplog, dontlognull, forwardfor")
 RSYSLOG_DESTINATION = os.getenv("RSYSLOG_DESTINATION", "127.0.0.1")
+SKIP_FORWARDED_PROTO = os.getenv("SKIP_FORWARDED_PROTO")
 SSL_BIND_CIPHERS = os.getenv("SSL_BIND_CIPHERS")
 SSL_BIND_OPTIONS = os.getenv("SSL_BIND_OPTIONS")
 STATS_AUTH = os.getenv("STATS_AUTH", "stats:stats")

haproxy/helper/frontend_helper.py

@@ -1,6 +1,6 @@
 from collections import OrderedDict
 
-from haproxy.config import EXTRA_BIND_SETTINGS, EXTRA_FRONTEND_SETTINGS, MONITOR_URI, MONITOR_PORT, MAXCONN
+from haproxy.config import EXTRA_BIND_SETTINGS, EXTRA_FRONTEND_SETTINGS, MONITOR_URI, MONITOR_PORT, MAXCONN, SKIP_FORWARDED_PROTO
 
 
 def check_require_default_route(routes, routes_added):
@@ -95,11 +95,12 @@ def config_common_part(port, ssl_bind_string, vhosts):
     bind_string, ssl = get_bind_string(port, ssl_bind_string, vhosts)
     frontend_section.append("bind :%s" % bind_string)
 
-    # add x-forwarded-porto header
-    if ssl:
-        frontend_section.append("reqadd X-Forwarded-Proto:\ https")
-    else:
-        frontend_section.append("reqadd X-Forwarded-Proto:\ http")
+    # add x-forwarded-porto header if not skipped
+    if not SKIP_FORWARDED_PROTO:
+        if ssl:
+            frontend_section.append("reqadd X-Forwarded-Proto:\ https")
+        else:
+            frontend_section.append("reqadd X-Forwarded-Proto:\ http")
 
     # add maxconn
     frontend_section.append("maxconn %s" % MAXCONN)
@@ -135,8 +136,13 @@ def get_bind_string(port, ssl_bind_string, vhosts):
 def config_default_frontend(ssl_bind_string):
     cfg = OrderedDict()
     monitor_uri_configured = False
-    frontend = [("bind :80 %s" % EXTRA_BIND_SETTINGS.get('80', "")).strip(),
-                "reqadd X-Forwarded-Proto:\ http", "maxconn %s" % MAXCONN]
+    frontend = [("bind :80 %s" % EXTRA_BIND_SETTINGS.get('80', "")).strip()]
+
+    # add x-forwarded-porto header if not skipped
+    if not SKIP_FORWARDED_PROTO:
+        frontend.append("reqadd X-Forwarded-Proto:\ http")
+
+    frontend.append("maxconn %s" % MAXCONN)
 
     if MONITOR_URI and MONITOR_PORT == '80':
         frontend.append("monitor-uri %s" % MONITOR_URI)
@@ -149,8 +155,13 @@ def config_default_frontend(ssl_bind_string):
     cfg["frontend default_port_80"] = frontend
 
     if ssl_bind_string:
-        ssl_frontend = [("bind :443 %s %s" % (ssl_bind_string, EXTRA_BIND_SETTINGS.get('443', ""))).strip(),
-                        "reqadd X-Forwarded-Proto:\ https", "maxconn %s" % MAXCONN]
+        ssl_frontend = [("bind :443 %s %s" % (ssl_bind_string, EXTRA_BIND_SETTINGS.get('443', ""))).strip()]
+
+        # add x-forwarded-porto header if not skipped
+        if not SKIP_FORWARDED_PROTO:
+            ssl_frontend.append("reqadd X-Forwarded-Proto:\ https")
+
+        ssl_frontend.append("maxconn %s" % MAXCONN)
 
         if MONITOR_URI and (MONITOR_PORT == '443'):
             ssl_frontend.append("monitor-uri %s" % MONITOR_URI)

tests/unit/helper/test_frontend_helper.py

@@ -17,13 +17,15 @@ def setUp(self):
         frontend_helper.EXTRA_BIND_SETTINGS = {"8888": "name http", "4443": "accept-proxy"}
         frontend_helper.MAXCONN = "55555"
         frontend_helper.EXTRA_FRONTEND_SETTINGS = {}
+        frontend_helper.SKIP_FORWARDED_PROTO = None
 
     def tearDown(self):
         frontend_helper.MONITOR_PORT = self.monitor_port
         frontend_helper.MONITOR_URI = self.monitor_uri
         frontend_helper.EXTRA_BIND_SETTINGS = self.extra_bind_settings
         frontend_helper.MAXCONN = self.maxconn
         frontend_helper.EXTRA_FRONTEND_SETTINGS = {}
+        frontend_helper.SKIP_FORWARDED_PROTO = None
 
     def test_config_frontend_with_virtual_host_without_monitoring_uri_added(self):
         vhosts = [{'service_alias': 'web-a', 'path': '', 'host': 'a.com', 'scheme': 'http', 'port': '80'}]
@@ -185,6 +187,27 @@ def test_config_common_part_with_extra_frontend_sttings(self, mock_get_bind_stri
         self.assertFalse(monitor_uri_configured)
         frontend_helper.EXTRA_FRONTEND_SETTINGS = {}
 
+    @mock.patch("haproxy.helper.frontend_helper.get_bind_string")
+    def test_config_common_part_without_forwarded_headers(self, mock_get_bind_string):
+        mock_get_bind_string.return_value = ("80", False)
+        frontend_helper.SKIP_FORWARDED_PROTO = 'true'
+        frontend_section, monitor_uri_configured = config_common_part("80", "ssl crt /certs/", [])
+        self.assertEqual(["bind :80",
+                          "maxconn 55555",
+                          "acl is_websocket hdr(Upgrade) -i WebSocket"],
+                         frontend_section)
+
+    @mock.patch("haproxy.helper.frontend_helper.get_bind_string")
+    def test_config_common_part_without_forwarded_headers_with_ssl(self, mock_get_bind_string):
+        mock_get_bind_string.return_value = ("9999 ssl crt /certs/", True)
+        frontend_helper.SKIP_FORWARDED_PROTO = 'true'
+        frontend_section, monitor_uri_configured = config_common_part("9999", "ssl crt /certs/", [])
+        self.assertEqual(["bind :9999 ssl crt /certs/",
+                          'maxconn 55555',
+                          "monitor-uri %s" % frontend_helper.MONITOR_URI,
+                          "acl is_websocket hdr(Upgrade) -i WebSocket"],
+                         frontend_section)
+
     def test_get_bind_string(self):
         vhosts = [{'service_alias': 'web-a', 'path': '', 'host': 'a.com', 'scheme': 'http', 'port': '80'},
                   {'service_alias': 'web-b', 'path': '', 'host': 'a.com', 'scheme': 'http', 'port': '8888'},
@@ -277,6 +300,21 @@ def test_config_default_front(self):
                                         'default_backend default_service'])]), cfg)
         self.assertTrue(monitor_uri_configured)
 
+        frontend_helper.SKIP_FORWARDED_PROTO = 'true'
+        cfg, monitor_uri_configured = config_default_frontend("ssl crt /certs/")
+        self.assertEqual(OrderedDict([('frontend default_port_80',
+                                       ['bind :80',
+                                        'maxconn 55555',
+                                        'reqadd header1 value1',
+                                        'default_backend default_service']),
+                                      ('frontend default_port_443',
+                                       ['bind :443 ssl crt /certs/ accept-proxy',
+                                        'maxconn 55555',
+                                        'monitor-uri /ping',
+                                        'reqadd header2 value2',
+                                        'default_backend default_service'])]), cfg)
+        self.assertTrue(monitor_uri_configured)
+
     def test_config_common_part_with_monitor_uri(self):
         self.assertEqual(OrderedDict(), config_monitor_frontend(True))
         self.assertEqual(OrderedDict([('frontend monitor', ['bind :9999', 'monitor-uri /ping'])]),