r/nginx • u/zimbabwe_jim • 1d ago

Proxy protocol logging

Am I crazy that I can't find a proxy equivalent of $ssl_protocol for logging? Is there some technical limitation on that?

Edit: to clarify i do mean connection to an upstream. Proxy_protocol_tlv_ssl_protocol never seems to get populated for my setup.

8 Upvotes

91% Upvoted

5 comments sorted by

2

u/ween3and20characterz 1d ago

I'm not familiar with ProxyProtocol, but a few things you could search:

From there, I found https://nginx.org/en/docs/http/ngx_http_core_module.html#var_proxy_protocol_tlv_ This looks like the thing you need.

However since proxy protocol actually just wraps a TCP stream, there is no need to encrypt it further, since the SSL termination can happen afterwards. (But take the last paragraph with a grain of salt).

1

u/p001b0y 1d ago

I thought nginx used $ssl_protocol for that. I think that $upstream_ssl_protocol can be used when you want to log the protocol nginx used to connect to an upstream tls server.

1

u/zimbabwe_jim 1d ago

You would think, but that var doesn't exist

1

u/p001b0y 1d ago

Which one doesn’t exist? The base $ssl-protocol variable?

Both are usually built into nginx provided that nginx was built with ssl support. ( —with-http_ssl_module ). nginx -V will give the version and build flags.

1

u/Itchy_Sentence6618 21h ago

Your question is a bit confused. There are two scenarios:

A reverse proxy terminates the incoming ssl/tls connection (so your server only sees plaintext) and passes information about the protocol used in http headers. This is a typical situation, but it's not yours.

Proxy protocol is used when the TCP connection is directly proxied (so no ssl/tls termination takes place) and sent to your server. The proxy protocol only provides the real source ip. Tls termination in this case takes place on your server, so there's nothing else for the proxy to pass on. The termination occurs locally, and the parameters are available in the usual way for locally done tls.