diff options
| author | Roman Arutyunyan <arut@nginx.com> | 2025-05-20 15:33:20 +0400 |
|---|---|---|
| committer | Roman Arutyunyan <arut@nginx.com> | 2025-05-25 22:16:04 +0400 |
| commit | d76e3d301644cfc6a2d914976b6098eb98b9e5b9 (patch) | |
| tree | b3aa4ef70b07d641e9c5b6d0693bb121b389ba7d /auto | |
| parent | 6a134dfd4888fc3850d22294687cfb3940994c69 (diff) | |
| download | nginx-tunnel.tar.gz nginx-tunnel.tar.bz2 | |
HTTP CONNECT proxy.tunnel
HTTP CONNECT method is now supported in HTTP/1 connections. It's disabled
in all currently existing standard modules. A new variable $port is added
that contains the port passed by client in HTTP CONNECT. The $host
variable contains the host part.
A new module ngx_http_tunnel module is added which establishes a tunnel
to a backend. It supports the newly added HTTP CONNECT method and can be
used to set up an HTTP CONNECT proxy.
As recommended by RFC 9110, proxy target should be restricted to ensure
safe proxying:
: Proxies that support CONNECT SHOULD restrict its use to a limited set
: of known ports or a configurable list of safe request targets.
Example config:
server {
listen 8000;
resolver dns.example.com;
map $port $tun_port {
80 1;
443 1;
}
map $host $tun_host {
hostnames;
example.com 1;
*.example.org 1;
}
map $tun_port$tun_host $tun {
11 $host:$port;
}
location / {
tunnel_pass $tun;
}
}
Request:
$ curl -px 127.0.0.1:8000 http://example.com
Diffstat (limited to '')
| -rw-r--r-- | auto/modules | 11 | ||||
| -rw-r--r-- | auto/options | 2 |
2 files changed, 13 insertions, 0 deletions
diff --git a/auto/modules b/auto/modules index 38b3aba78..a473656e5 100644 --- a/auto/modules +++ b/auto/modules @@ -781,6 +781,17 @@ if [ $HTTP = YES ]; then . auto/module fi + if [ $HTTP_TUNNEL = YES ]; then + ngx_module_name=ngx_http_tunnel_module + ngx_module_incs= + ngx_module_deps= + ngx_module_srcs=src/http/modules/ngx_http_tunnel_module.c + ngx_module_libs= + ngx_module_link=$HTTP_TUNNEL + + . auto/module + fi + if [ $HTTP_PERL != NO ]; then ngx_module_name=ngx_http_perl_module ngx_module_incs=src/http/modules/perl diff --git a/auto/options b/auto/options index 6a6e990a0..8c09433f9 100644 --- a/auto/options +++ b/auto/options @@ -89,6 +89,7 @@ HTTP_FASTCGI=YES HTTP_UWSGI=YES HTTP_SCGI=YES HTTP_GRPC=YES +HTTP_TUNNEL=YES HTTP_PERL=NO HTTP_MEMCACHED=YES HTTP_LIMIT_CONN=YES @@ -279,6 +280,7 @@ $0: warning: the \"--with-ipv6\" option is deprecated" --without-http_uwsgi_module) HTTP_UWSGI=NO ;; --without-http_scgi_module) HTTP_SCGI=NO ;; --without-http_grpc_module) HTTP_GRPC=NO ;; + --without-http_tunnel_module) HTTP_TUNNEL=NO ;; --without-http_memcached_module) HTTP_MEMCACHED=NO ;; --without-http_limit_conn_module) HTTP_LIMIT_CONN=NO ;; --without-http_limit_req_module) HTTP_LIMIT_REQ=NO ;; |