[MEDIUM] add the "except" keyword to the "forwardfor" option
Patch from Bryan Germann for 1.2.17.
In some circumstances, it is useful not to add the X-Forwarded-For
header, for instance when the client is another reverse-proxy or
stunnel running on the same machine and which already adds it. This
patch adds the "except" keyword to the "forwardfor" option, allowing
to specify an address or network which will not be added to this
header.
diff --git a/doc/haproxy-en.txt b/doc/haproxy-en.txt
index dbe78f5..eecc6c3 100644
--- a/doc/haproxy-en.txt
+++ b/doc/haproxy-en.txt
@@ -2142,7 +2142,12 @@
Also, the 'forwardfor' option creates an HTTP 'X-Forwarded-For' header which
contains the client's IP address. This is useful to let the final web server
-know what the client address was (eg for statistics on domains).
+know what the client address was (eg for statistics on domains). Starting with
+version 1.3.8, it is possible to specify the "except" keyword followed by a
+source IP address or network for which no header will be added. This is very
+useful when another reverse-proxy which already adds the header runs on the
+same machine or in a known DMZ, the most common case being the local use of
+stunnel on the same system.
Last, the 'httpclose' option removes any 'Connection' header both ways, and
adds a 'Connection: close' header in each direction. This makes it easier to
@@ -2155,7 +2160,7 @@
log global
option httplog
option dontlognull
- option forwardfor
+ option forwardfor except 127.0.0.1/8
option httpclose
Note that some HTTP servers do not necessarily close the connections when they
diff --git a/doc/haproxy-fr.txt b/doc/haproxy-fr.txt
index 7f6d231..7a2faf5 100644
--- a/doc/haproxy-fr.txt
+++ b/doc/haproxy-fr.txt
@@ -2223,7 +2223,12 @@
De plus, l'option 'forwardfor' ajoute l'adresse IP du client dans un champ
'X-Forwarded-For' de la requête, ce qui permet à un serveur web final de
-connaître l'adresse IP du client initial.
+connaître l'adresse IP du client initial. Depuis la version 1.3.8, il est
+possible de préciser le mot-clé "except" suivi d'une adresse ou un réseau
+IP source pour lequel l'entête ne sera pas ajouté. C'est très pratique dans le
+cas où un autre reverse-proxy ajoutant déjà l'entête est installé sur la même
+machine ou dans une DMZ connue. Le cas le plus fréquent est lié à l'utilisation
+de stunnel en local.
Enfin, l'option 'httpclose' apparue dans la version 1.1.28/1.2.1 supprime tout
en-tête de type 'Connection:' et ajoute 'Connection: close' dans les deux sens.
@@ -2237,7 +2242,7 @@
log global
option httplog
option dontlognull
- option forwardfor
+ option forwardfor except 127.0.0.1/8
option httpclose
Notons que certains serveurs HTTP ne referment pas nécessairement la session