X-Forwarded-For Header Not Working Properly with Proxy Protocol Enabled

[4406arthur]

Environment

• Platform: Kubernetes
• Kong Chart Version: 0.12.0
• Configuration:
• Default HTTP port: 8000
• Proxy Protocol enabled port: 8080

Problem Statement

When running Kong Gateway with both a standard HTTP port (8000) and a Proxy Protocol enabled port (8080), the X-Forwarded-For header handling needs improvement to work correctly in both scenarios.

Currently, the $upstream_x_forwarded_for variable is set uniformly without considering the presence of $proxy_protocol_addr, which causes inconsistent behavior when requests come through the Proxy Protocol enabled port.

Current Behavior

The current implementation in kong/runloop/handler.lua doesn't handle the Proxy Protocol case specifically, leading to potentially incorrect client IP propagation.

Default nginx configuration:

proxy_set_header      X-Forwarded-For    $upstream_x_forwarded_for;

Proposed Solution

Implement a failover mechanism that prioritizes proxy_protocol_addr when available. Here's the proposed logic change:

-- X-Forwarded-* Headers
if var.proxy_protocol_addr then
  var.upstream_x_forwarded_for = var.proxy_protocol_addr
else
  local http_x_forwarded_for = get_header("x_forwarded_for", ctx)
    if http_x_forwarded_for then
      var.upstream_x_forwarded_for = http_x_forwarded_for .. ", " ..
                                realip_remote_addr
    else
      var.upstream_x_forwarded_for = var.remote_addr
    end
end

Expected Behavior

1. When a request comes through the Proxy Protocol enabled port:

• Use proxy_protocol_addr as the X-Forwarded-For value

2. When a request comes through the standard port (8000):

• Fall back to the existing X-Forwarded-For header logic

Additional Context

This change would improve the accuracy of client IP tracking when using mixed port configurations, especially in environments where Proxy Protocol is used for certain traffic patterns.

Related Links

• Current Implementation

Tags

enhancement proxy-protocol x-forwarded-for networking

[Oyami-Srk]

Wouldn't the RealIP module replace the remote_addr with the original client address even if the proxy protocol is in use?
Reference: https://docs.nginx.com/nginx/admin-guide/load-balancer/using-proxy-protocol/

Could you please submit a PR for that? We'd appreciate it!

[4406arthur]

Yes, I would like to assist with the implementation. However, I am not entirely confident that this proposed solution makes sense and believe it requires review by an expert.

[Oyami-Srk]

@chronolaw Would you happen to have a minute to look at this? I think remote_addr will represent the true client address under the proxy protocol.

[4406arthur]

hi @Oyami-Srk, I did not find a way make the lua plugin can access the ngx_http_core_module embbedded var proxy_protocol_addr
https://docs.konghq.com/gateway/latest/plugin-development/pdk/kong.nginx/
https://github.com/Kong/lua-kong-nginx-module

have any idea ?