diff --git a/src/ssl_sock.c b/src/ssl_sock.c index 3d1e4440b..41b967e1f 100644 --- a/src/ssl_sock.c +++ b/src/ssl_sock.c @@ -6588,6 +6588,23 @@ static int srv_parse_no_force_tlsv12(char **args, int *cur_arg, struct proxy *px #endif } +/* parse the "no-send-proxy-v2-ssl" server keyword */ +static int srv_parse_no_send_proxy_ssl(char **args, int *cur_arg, struct proxy *px, struct server *newsrv, char **err) +{ + newsrv->pp_opts &= ~SRV_PP_V2; + newsrv->pp_opts &= ~SRV_PP_V2_SSL; + return 0; +} + +/* parse the "no-send-proxy-v2-ssl-cn" server keyword */ +static int srv_parse_no_send_proxy_cn(char **args, int *cur_arg, struct proxy *px, struct server *newsrv, char **err) +{ + newsrv->pp_opts &= ~SRV_PP_V2; + newsrv->pp_opts &= ~SRV_PP_V2_SSL; + newsrv->pp_opts &= ~SRV_PP_V2_SSL_CN; + return 0; +} + /* parse the "no-ssl" server keyword */ static int srv_parse_no_ssl(char **args, int *cur_arg, struct proxy *px, struct server *newsrv, char **err) { @@ -7481,6 +7498,8 @@ static struct srv_kw_list srv_kws = { "SSL", { }, { { "no-force-tlsv10", srv_parse_no_force_tlsv10, 0, 1 }, /* do not force TLSv10 */ { "no-force-tlsv11", srv_parse_no_force_tlsv11, 0, 1 }, /* do not force TLSv11 */ { "no-force-tlsv12", srv_parse_no_force_tlsv12, 0, 1 }, /* do not force TLSv12 */ + { "no-send-proxy-v2-ssl", srv_parse_no_send_proxy_ssl, 0, 1 }, /* do not send PROXY protocol header v2 with SSL info */ + { "no-send-proxy-v2-ssl-cn", srv_parse_no_send_proxy_cn, 0, 1 }, /* do not send PROXY protocol header v2 with CN */ { "no-ssl", srv_parse_no_ssl, 0, 1 }, /* disable SSL processing */ { "no-ssl-reuse", srv_parse_no_ssl_reuse, 0, 1 }, /* disable session reuse */ { "no-sslv3", srv_parse_no_sslv3, 0, 1 }, /* disable SSLv3 */ @@ -7488,8 +7507,8 @@ static struct srv_kw_list srv_kws = { "SSL", { }, { { "no-tlsv11", srv_parse_no_tlsv11, 0, 1 }, /* disable TLSv11 */ { "no-tlsv12", srv_parse_no_tlsv12, 0, 1 }, /* disable TLSv12 */ { "no-tls-tickets", srv_parse_no_tls_tickets, 0, 1 }, /* disable session resumption tickets */ - { "send-proxy-v2-ssl", srv_parse_send_proxy_ssl, 0, 0 }, /* send PROXY protocol header v2 with SSL info */ - { "send-proxy-v2-ssl-cn", srv_parse_send_proxy_cn, 0, 0 }, /* send PROXY protocol header v2 with CN */ + { "send-proxy-v2-ssl", srv_parse_send_proxy_ssl, 0, 1 }, /* send PROXY protocol header v2 with SSL info */ + { "send-proxy-v2-ssl-cn", srv_parse_send_proxy_cn, 0, 1 }, /* send PROXY protocol header v2 with CN */ { "sni", srv_parse_sni, 1, 0 }, /* send SNI extension */ { "ssl", srv_parse_ssl, 0, 1 }, /* enable SSL processing */ { "ssl-reuse", srv_parse_ssl_reuse, 0, 1 }, /* enable session reuse */