Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1lHyPO-0007yf-3F for pgsql-hackers@arkaria.postgresql.org; Fri, 05 Mar 2021 00:33:34 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1lHyPL-0001ey-KV for pgsql-hackers@arkaria.postgresql.org; Fri, 05 Mar 2021 00:33:31 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1lHyPL-0001eq-7T for pgsql-hackers@lists.postgresql.org; Fri, 05 Mar 2021 00:33:31 +0000 Received: from mail-wr1-x435.google.com ([2a00:1450:4864:20::435]) by makus.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.92) (envelope-from ) id 1lHyPE-00012e-5n for pgsql-hackers@lists.postgresql.org; Fri, 05 Mar 2021 00:33:29 +0000 Received: by mail-wr1-x435.google.com with SMTP id u14so204847wri.3 for ; Thu, 04 Mar 2021 16:33:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ongres.com; s=gsuite; h=subject:to:cc:references:from:autocrypt:message-id:date:user-agent :mime-version:in-reply-to:content-transfer-encoding:content-language; bh=xsc5KPjUyyfp8iOuWnLJRJu96+UrQ5CL8bA8sSjMrKg=; b=RHe3Yf+HkkOQslUPLnRSgaP737vX26xdAxhVMXMU0Z1oQxz7qP4dv1w3KNBG+obsK1 3HYhDUKe0WN6J6+u2vglAQx+tl760aJ/warkMYhGpO4wCBbhn0nOgf6vlU/B7qmec2a4 oWdobSBgvSn/wWBO044nlLQv/i7Oy7Z4C+c5Y= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:autocrypt :message-id:date:user-agent:mime-version:in-reply-to :content-transfer-encoding:content-language; bh=xsc5KPjUyyfp8iOuWnLJRJu96+UrQ5CL8bA8sSjMrKg=; b=RZ4fYY9MSdq+QqhYWRhCF9qcenyDTcd54MygIkf10ILK+zWAV6FrOCjkIBd71UNNK4 N7+cTNUIyvvYFHg+cQm0dqFoFlTfn+C9HNLJucocK8DR6PLNxAH0Yg6yJJRC2Bf5VV+C AgBS1Z2tFvSzsbCvalAf34jwx5NPD/bDnjFRaxcDhOwYBixuCDpjPM021X/r2mwqH6RJ wWLfJNV9stKf4qJclDh08H2mJXwCJKgOkt3zNCOvq0AA+9fB1LjzRsYsB0LSL5h/GHwn By1tbusTw6plRF3MgE+CFf+a4bAEBjkK9DJOuyQaFWP/4xs131Lh3dnkmOYgg8zOuJjO +/Nw== X-Gm-Message-State: AOAM530IlAKuD9dwv+QaTp0VwETBZSQavY7ZYX0RbLh3hiCgKBZDHWHf Am+TR8XLEuoM4LVhtyAuN00IQg== X-Google-Smtp-Source: ABdhPJxJDTF3FYa7R9qKK2EKKdtZkYYoKX22A/mX/3pIm11YADhpHsOKs2OOWOUrk5bPz3rhz8mx7w== X-Received: by 2002:a5d:4c84:: with SMTP id z4mr6780031wrs.382.1614904402501; Thu, 04 Mar 2021 16:33:22 -0800 (PST) Received: from [10.40.3.40] (185.red-88-13-206.dynamicip.rima-tde.net. [88.13.206.185]) by smtp.gmail.com with ESMTPSA id z2sm1799792wrm.0.2021.03.04.16.33.21 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 04 Mar 2021 16:33:22 -0800 (PST) Subject: Re: PROXY protocol support To: Jacob Champion , "magnus@hagander.net" Cc: "pgsql-hackers@lists.postgresql.org" , =?UTF-8?Q?Fabr=c3=adzio_Mello?= References: <955367547640a1e24a72d0e79236f49ec7f0dd21.camel@vmware.com> From: =?UTF-8?B?w4FsdmFybyBIZXJuw6FuZGV6?= Autocrypt: addr=aht@ongres.com; keydata= mQINBF8HXQQBEACnRGsBas+BUNQkdN0O0qqfjL/G78gxAI2/6pTLsvXOmA0a6A+o16HynaBc PYgWeMrPj3fAlHQ4dyw2CF++LKRmr0xx04GaSi3bijCutRiyFFpdvl2VVRWlYmQhrfS4dVRl 2cHn+umoj9DOf0DpPYLyB/tHZIaBz1TU/69/7qD3G4NaAI2uGCji2pBNI1TEhOGXPE7HHGxJ k4Paf4Dby3VVeufcsTPa006kXj/aEObinpE41Yl/UgeQbnnPazHPXrFyfWpPqw6+kz7Tb+19 sOGJJAJplVmyqZ2Mewf1RtGOsBD8JABpdzLtv+FxKumnMcEYHLFgD6EQQQZiygg/wUQdXZll mvvxlI5VKjxHPnfPvqM44vhWSVPZicH4lWHHXPipesan+7Qg5lVjTnJZHpA6qJtddlNESFKf XHm7hzRgOyFuFwU2MABVjQv1noMJqOtM+SaSprEOwt4azanK/CUYQtjNKvAqxOv+YDQ6mWnF +Ly97BqSu/xufPzriEL7Qz/tY4Hj4nZAxtud+txhO8LCvu4NsXZUbiuMYgKzxmG9fUFkEAyL btBvveH0vzH0wO10lVq0MNeVWTREfRQ8bLjxj5h0pCz65x6+bdtpO0pQXmV1w0hFvwxobRHt JubEKLiDPktJ5jHVsa+JqP34SxHm6e9TKG2EQJVlz03RU7g4tQARAQABtDZBbHZhcm8gSGVy bmFuZGV6IChPbkdyZXMgR1BHIGFjY291bnQpIDxhaHRAb25ncmVzLmNvbT6JAk4EEwEKADgW IQTZ+rL52ABbxJPBTt4qF9KKhgviwwUCXwddBAIbAwULCQgHAgYVCgkICwIEFgIDAQIeAQIX gAAKCRAqF9KKhgviw7WED/44JVShqBCxbSRceu6TOR/H391tAvfyHsAV9vplA7qaqabppqC8 rWL7t6Ngs53473TgPD+fUDo2gS/8c+TKmJGaGVnbXmFBrEB941nJ2r9Y97NtDXs3j7N7Ed4o nr7p01S8Q3BTIWb5tUYa+EkUFOMozPfN3OKStWPhonXADuDv6lZhmw6XkaZ5UHaf4Oj3HGeM 0KyKWzcVzs47d3Gvi6xjeKOK3VjGNrLKeqO/Ebs8m/WpFSc73s4EbiX9141rcTpHBKzETToE wC85hXYNcVF+Is9SFBAbiC05gA4f+4IZK9W+C4o4cRWOlSCE2imgD375JKStaFi158HGL/uG 8sH1ttnG1vjLUQFE694qHOUXTMUjpyiJPsZLf98LTXSawI35tFV0JwBnwPCYvIn7Bavame17 fpszGQraXKqQKhBB+rAaHkiDTeYnFlR5St13yhbwwR7JfuHZJ4LvKbCbTxgWhNHH97k+6p9v cYo4cvcqgbzWG8TPDCZVR4syqfdDlpYS0YCjv2p/JkJ/rjMoopqroGYHOsNa4bltGri0e2Ms L72DQ4qDDqat9QQlgUIUeHB7wYlVTqy1s3z0etAHNCfV86LjcBIbx9ZIx4ztQsCkVCaKFAcX HZqBlo/3O4Xo9ULWYT5SCH7XXfXADxblsSRqTDAACWf/86EpwDMVHMOl6LkCDQRfB10EARAA uWfs9X2szukOUjFRCuwJgkVKByY8j2i4C4b4/aQF1dJqjo5Ucf16HzDv7LJJgVIEA0XTjuon 1EelvdIcFR1cjO2b1j8k/tUc8eG0SCr/DfhbYBHllFLTT3CMNuwqqxPJ1/8HlNWrrZreloli /wKu5Mq2XKYkvGj/jWnUpW/nzRQJK+uQYNgNsSdcEeQUFcj0NCs3nRNsz/Av9lfMbcKL3ndE vYIid9KL3cT65tuwO6/x6dgTsT84tdDqqOCCuu2bfltXP4wFtXVGvTC43UpMhEO2VDNCiM19 iihwsXJoG6dHgbh8ozINbMrmZyS68h+ITuiaFc1a7JrlXdxnMedGoIsQX0jKbYuNQEP66ovg 3gGq5TGJ+/2TvytcVHqu0mHV382z5/2duaYyTzlvTaMu9snBW5ACBn1WVguzSn1RiTBvvbd2 kKTKtFXMkwK8EGp/0OEXAoBbSIiIeAUjAFs038YxRj24IIEI4TGNXfZwCLVDS+51EnNwI9YJ fOW5F5l1KiKbHDPsLDj1XytHWaX2jGcNYnFIPVbH1ctj9us7uhttlvJ+F3hBsr1+BfFsCZeu +UbpTF67QUxXlbo8FJbDxYQ/WPG5tClBNAXYkaUsrcR3Oe/DYLrdvWbx2P3FKVZZUit+BAxs +JhhgPaaMA9GOnagyPSteX5nvEfu0hPmtgMAEQEAAYkCNgQYAQoAIBYhBNn6svnYAFvEk8FO 3ioX0oqGC+LDBQJfB10EAhsMAAoJECoX0oqGC+LDiBYP/ivrzautlV1odKBYmhWC5uRPazp5 7Q+Z5q8ak6UkSes9+P8laJRyEcxlGm95BJKiYNq8V9L2HTiLJ1OS+QpDW+xDBVpPoQ6S8Scs Tp3YDIze4MPEk22gaWvXAmfr8KACFlDO4GPKTNarN2CL9zoVL8A16O8vIUoPnaH+Qaq3mgy9 y0HlSPO+Vyy0W1zaxhLg9iG+c0jXNe+NrIZMzgZ6xMlxhUdIRFdsS9somXQbidlu53hSqf1/ oGv53Xcv0N1O/2rxgXm6eMypl9MzSEVo62VEphxH2rGKzT7/xKB8HgxIwb9P4Zc9N2JI0GOk vSliuLlmZplSJoqLl2uXsbz+uo5FLkMGrzHH3gNxjHYDX42rbRx1dkcXNfSMizKXY+N9ICy5 +6cx/z4Dj6gSucmVYKySRNdlXQ11/mklV/DoJ1bED6nKyqGBbCDuVGpjvaaBpVJutnPtN6M1 PHSlduJgSI1xQvOc5OiwME2gxiVnXRNYXjdh4DXMjagg1W9GvJnbgSxsKmmEPL2/XaFJRnKK NvktDmXISoacIVqyx4nu+X33e212iAltBrZbSGN1Ehx81FP7LmNuV0H/SYAEyogGS5RFlfAn zrHPa5TQtrzsrc3UuCmxy7/lPImx1n4bdpD/mTZUWmYHrtmRHpl/VFCi1jrOTpr6f1SAusdA ycqrESCJ Message-ID: Date: Fri, 5 Mar 2021 01:33:21 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Content-Language: en-US List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk On 5/3/21 0:21, Jacob Champion wrote: > On Thu, 2021-03-04 at 21:45 +0100, Magnus Hagander wrote: >> On Thu, Mar 4, 2021 at 9:07 PM Jacob Champion w= rote: >>> Idle thought I had while setting up a local test rig: Are there any >>> compelling cases for allowing PROXY packets to arrive over Unix >>> sockets? (By which I mean, the proxy is running on the same machine a= s >>> Postgres, and connects to it using the .s.PGSQL socket file instead o= f >>> TCP.) Are there cases where you want some other software to interact >>> with the TCP stack instead of Postgres, but it'd still be nice to hav= e >>> the original connection information available? >> I'm uncertain what that usecase would be for something like haproxy, >> tbh. It can't do connection pooling, so adding it on the same machine >> as postgres itself wouldn't really add anything, I think? > Yeah, I wasn't thinking HAproxy so much as some unspecified software > appliance that's performing Some Task before allowing a TCP client to > speak to Postgres. But it'd be better to hear from someone that has an > actual use case, instead of me spitballing. =C2=A0=C2=A0=C2=A0 Here's a use case: Envoy's Postgres filter (see [1], [= 2]). Right now is able to capture protocol-level metrics and send them to a metrics collector (eg. Prometheus) while proxying the traffic. More capabilities are being added as of today, and will eventually manage HBA too. It would greatly benefit from this proposal, since it proxies the traffic with, obviously, its IP, not the client's. It may be used (we do) locally fronting Postgres, via UDS (so it can be easily trusted). =C2=A0=C2=A0=C2=A0 =C3=81lvaro [1] https://www.envoyproxy.io/docs/envoy/latest/configuration/listeners/netwo= rk_filters/postgres_proxy_filter [2] https://www.cncf.io/blog/2020/08/13/envoy-1-15-introduces-a-new-postgres-= extension-with-monitoring-support/ --=20 Alvaro Hernandez ----------- OnGres