Ticket #287: nginx-1.13.6.2-listen-transparent.patch

bundle/nginx-1.13.6/src/core/ngx_connection.c

@@ -501 +501 @@
             }
 #endif
 
+#if (NGX_HAVE_TRANSPARENT_PROXY && __linux)
+            /* Don't need to set on FreeBSD or OSX */
+
+            if (ls[i].transparent && !ngx_test_config) {
+
+                int transparent = 1;
+
+                switch (ls[i].sockaddr->sa_family) {
+
+                case AF_INET:
+
+                    if (setsockopt(s, IPPROTO_IP, IP_TRANSPARENT,
+                                   (const void *) &transparent, sizeof(int)) == -1)
+                    {
+                        ngx_log_error(NGX_LOG_EMERG, log, ngx_socket_errno,
+                                      "setsockopt(IP_TRANSPARENT) %V failed",
+                                      &ls[i].addr_text);
+                        return NGX_ERROR;
+                    }
+
+                    break;
+
+#if (NGX_HAVE_INET6)
+
+                case AF_INET6:
+
+                    if (setsockopt(s, IPPROTO_IPV6, IPV6_TRANSPARENT,
+                                   (const void *) &transparent, sizeof(int)) == -1)
+                    {
+                        ngx_log_error(NGX_LOG_EMERG, log, ngx_socket_errno,
+                                      "setsockopt(IPV6_TRANSPARENT) %V failed",
+                                      &ls[i].addr_text);
+                        return NGX_ERROR;
+                    }
+
+                    break;
+
+#endif /* NGX_HAVE_INET6 */
+
+                }
+            }
+#endif /* NGX_HAVE_TRANSPARENT_PROXY */
+
 #if (NGX_HAVE_INET6 && defined IPV6_V6ONLY)
 
             if (ls[i].sockaddr->sa_family == AF_INET6) {

bundle/nginx-1.13.6/src/core/ngx_connection.h

@@ -71 +71 @@
 #endif
     unsigned            reuseport:1;
     unsigned            add_reuseport:1;
+
+#if (NGX_HAVE_TRANSPARENT_PROXY)
+    unsigned            transparent:1;
+#endif
     unsigned            keepalive:2;
 
     unsigned            deferred_accept:1;

bundle/nginx-1.13.6/src/event/ngx_event_accept.c

@@ -232 +232 @@
         c->local_sockaddr = ls->sockaddr;
         c->local_socklen = ls->socklen;
 
+#if (NGX_HAVE_TRANSPARENT_PROXY)
+        if (ls->transparent) {
+            c->local_sockaddr = NULL;
+            c->local_socklen = 0;
+        }
+#endif
+
 #if (NGX_HAVE_UNIX_DOMAIN)
         if (c->sockaddr->sa_family == AF_UNIX) {
             c->tcp_nopush = NGX_TCP_NOPUSH_DISABLED;

bundle/nginx-1.13.6/src/http/ngx_http.c

@@ -1776 +1776 @@
     ls->reuseport = addr->opt.reuseport;
 #endif
 
+#if (NGX_HAVE_TRANSPARENT_PROXY)
+    ls->transparent = addr->opt.transparent;
+#endif
+
     return ls;
 }
 

bundle/nginx-1.13.6/src/http/ngx_http_core_module.c

@@ -3952 +3952 @@
             continue;
         }
 
+        if (ngx_strcmp(value[n].data, "transparent") == 0) {
+#if (NGX_HAVE_TRANSPARENT_PROXY)
+            lsopt.transparent = 1;
+            continue;
+#else
+            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+                               "transparent is not supported "
+                               "on this platform");
+            return NGX_CONF_ERROR;
+#endif
+        }
+
         if (ngx_strcmp(value[n].data, "ssl") == 0) {
 #if (NGX_HTTP_SSL)
             lsopt.ssl = 1;

bundle/nginx-1.13.6/src/http/ngx_http_core_module.h

@@ -79 +79 @@
 #endif
     unsigned                   deferred_accept:1;
     unsigned                   reuseport:1;
+#if (NGX_HAVE_TRANSPARENT_PROXY)
+    unsigned                   transparent:1;
+#endif
     unsigned                   so_keepalive:2;
     unsigned                   proxy_protocol:1;
 

bundle/nginx-1.13.6/src/http/ngx_http_request.c

@@ -226 +226 @@
 
     port = c->listening->servers;
 
-    if (port->naddrs > 1) {
+    if (port->naddrs > 1
+#if (NGX_HAVE_TRANSPARENT_PROXY)
+        || c->listening->transparent
+#endif
+    ) {
 
         /*
          * there are several addresses on this port and one of them

bundle/nginx-1.13.6/src/stream/ngx_stream.c

@@ -513 +513 @@
 #if (NGX_HAVE_REUSEPORT)
             ls->reuseport = addr[i].opt.reuseport;
 #endif
+#if (NGX_HAVE_TRANSPARENT_PROXY)
+            ls->transparent = addr[i].opt.transparent;
+#endif
 
             stport = ngx_palloc(cf->pool, sizeof(ngx_stream_port_t));
             if (stport == NULL) {

bundle/nginx-1.13.6/src/stream/ngx_stream_core_module.c

@@ -732 +732 @@
             continue;
         }
 
+        if (ngx_strcmp(value[i].data, "transparent") == 0) {
+#if (NGX_HAVE_TRANSPARENT_PROXY)
+            ls->transparent = 1;
+            continue;
+#else
+            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+                               "transparent is not supported "
+                               "on this platform");
+            return NGX_CONF_ERROR;
+#endif
+        }
+
         if (ngx_strcmp(value[i].data, "ssl") == 0) {
 #if (NGX_STREAM_SSL)
             ls->ssl = 1;

bundle/nginx-1.13.6/src/stream/ngx_stream.h

@@ -55 +55 @@
     unsigned                       ipv6only:1;
 #endif
     unsigned                       reuseport:1;
+#if (NGX_HAVE_TRANSPARENT_PROXY)
+    unsigned                       transparent:1;
+#endif
     unsigned                       so_keepalive:2;
     unsigned                       proxy_protocol:1;
 #if (NGX_HAVE_KEEPALIVE_TUNABLE)

bundle/nginx-1.13.6/src/stream/ngx_stream_handler.c

@@ -42 +42 @@
 
     port = c->listening->servers;
 
-    if (port->naddrs > 1) {
+    if (port->naddrs > 1
+#if (NGX_HAVE_TRANSPARENT_PROXY)
+        || c->listening->transparent
+#endif
+    ) {
 
         /*
          * There are several addresses on this port and one of them