packages/net/nginx/patches/400-nginx-1.4.x_proxy_proto...

Index: nginx-1.4.7/auto/modules
===================================================================
--- nginx-1.4.7.orig/auto/modules
+++ nginx-1.4.7/auto/modules
@@ -297,6 +297,10 @@ if [ $HTTP_SSL = YES ]; then
     HTTP_SRCS="$HTTP_SRCS $HTTP_SSL_SRCS"
 fi
 
+if [ $PROXY_PROTOCOL = YES ]; then
+    have=NGX_PROXY_PROTOCOL . auto/have
+fi
+
 if [ $HTTP_PROXY = YES ]; then
     have=NGX_HTTP_X_FORWARDED_FOR . auto/have
     #USE_MD5=YES
Index: nginx-1.4.7/auto/options
===================================================================
--- nginx-1.4.7.orig/auto/options
+++ nginx-1.4.7/auto/options
@@ -47,6 +47,8 @@ USE_THREADS=NO
 NGX_FILE_AIO=NO
 NGX_IPV6=NO
 
+PROXY_PROTOCOL=NO
+
 HTTP=YES
 
 NGX_HTTP_LOG_PATH=
@@ -192,6 +194,8 @@ do
         --with-file-aio)                 NGX_FILE_AIO=YES           ;;
         --with-ipv6)                     NGX_IPV6=YES               ;;
 
+        --with-proxy-protocol)           PROXY_PROTOCOL=YES         ;;
+
         --without-http)                  HTTP=NO                    ;;
         --without-http-cache)            HTTP_CACHE=NO              ;;
 
@@ -350,6 +354,8 @@ cat << END
   --with-file-aio                    enable file AIO support
   --with-ipv6                        enable IPv6 support
 
+  --with-proxy-protocol              enable proxy protocol support
+
   --with-http_ssl_module             enable ngx_http_ssl_module
   --with-http_spdy_module            enable ngx_http_spdy_module
   --with-http_realip_module          enable ngx_http_realip_module
Index: nginx-1.4.7/auto/sources
===================================================================
--- nginx-1.4.7.orig/auto/sources
+++ nginx-1.4.7/auto/sources
@@ -36,7 +36,8 @@ CORE_DEPS="src/core/nginx.h \
            src/core/ngx_conf_file.h \
            src/core/ngx_resolver.h \
            src/core/ngx_open_file_cache.h \
-           src/core/ngx_crypt.h"
+           src/core/ngx_crypt.h \
+           src/core/ngx_proxy_protocol.h"
 
 
 CORE_SRCS="src/core/nginx.c \
@@ -67,7 +68,8 @@ CORE_SRCS="src/core/nginx.c \
            src/core/ngx_conf_file.c \
            src/core/ngx_resolver.c \
            src/core/ngx_open_file_cache.c \
-           src/core/ngx_crypt.c"
+           src/core/ngx_crypt.c \
+           src/core/ngx_proxy_protocol.c"
 
 
 REGEX_MODULE=ngx_regex_module
Index: nginx-1.4.7/src/core/ngx_connection.h
===================================================================
--- nginx-1.4.7.orig/src/core/ngx_connection.h
+++ nginx-1.4.7/src/core/ngx_connection.h
@@ -63,6 +63,10 @@ struct ngx_listening_s {
     unsigned            shared:1;    /* shared between threads or processes */
     unsigned            addr_ntop:1;
 
+#if (NGX_PROXY_PROTOCOL)
+    unsigned            accept_proxy_protocol:2; /* proxy_protocol flag */
+#endif
+
 #if (NGX_HAVE_INET6 && defined IPV6_V6ONLY)
     unsigned            ipv6only:1;
 #endif
@@ -148,6 +152,10 @@ struct ngx_connection_s {
 
     ngx_uint_t          requests;
 
+#if (NGX_PROXY_PROTOCOL)
+    ngx_uint_t          proxy_protocol;
+#endif
+
     unsigned            buffered:8;
 
     unsigned            log_error:3;     /* ngx_connection_log_error_e */
Index: nginx-1.4.7/src/core/ngx_core.h
===================================================================
--- nginx-1.4.7.orig/src/core/ngx_core.h
+++ nginx-1.4.7/src/core/ngx_core.h
@@ -77,6 +77,9 @@ typedef void (*ngx_connection_handler_pt
 #include <ngx_open_file_cache.h>
 #include <ngx_os.h>
 #include <ngx_connection.h>
+#if (NGX_PROXY_PROTOCOL)
+#include <ngx_proxy_protocol.h>
+#endif
 
 
 #define LF     (u_char) 10
Index: nginx-1.4.7/src/core/ngx_proxy_protocol.c
===================================================================
--- /dev/null
+++ nginx-1.4.7/src/core/ngx_proxy_protocol.c
@@ -0,0 +1,430 @@
+
+/*
+ * Copyright (C) Baptiste Assmann
+ * Copyright (C) Exceliance
+ */
+
+
+#include <ngx_config.h>
+#include <ngx_core.h>
+#include <ngx_event.h>
+
+#if (NGX_PROXY_PROTOCOL)
+
+int
+ngx_recv_proxy_protocol(ngx_connection_t *c, u_char *buf, ssize_t n)
+{
+    u_char *end, *p, *t;
+    size_t len;
+    ssize_t s;
+    int step = 0;
+    ngx_proxy_protocol_t pp;
+
+    ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0, "processing proxy protocol");
+
+    /* 16 is the minimal length of the proxy protocol string */
+    if (n < 18) {
+        step = 1;
+        goto fail;
+    }
+
+    s = n;
+    end = memchr(buf, '\n', n);
+    if (end == NULL) {
+        step = 2;
+        goto fail;
+    }
+
+    p = buf;
+    if (memcmp(p, "PROXY ", 6) != 0) {
+        ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
+            "incorrect proxy protocol header string");
+        step = 3;
+        goto fail;
+    }
+    p += 6;
+    s -= 6;
+    if (s <= 0) {
+        step = 4;
+        goto fail;
+    }
+
+    ngx_memzero(&pp, sizeof(ngx_proxy_protocol_t));
+
+    if (memcmp(p, "TCP4 ", 5) == 0) {
+        struct sockaddr_in *sin_src;
+        struct sockaddr_in *sin_dst;
+
+        pp.pp_proto = NGX_PP_PROTO_TCP4;
+        pp.pp_src3.ss_family = AF_INET;
+        pp.pp_dst3.ss_family = AF_INET;
+        sin_src = (struct sockaddr_in *) &pp.pp_src3;
+        sin_dst = (struct sockaddr_in *) &pp.pp_dst3;
+
+        p += 5;
+        s -= 5;
+        if (s <= 0) {
+            step = 5;
+            goto fail;
+        }
+
+        /* l3 source address */
+        if ( (t = (u_char *)memchr(p, ' ', s)) == NULL ) {
+            step = 6;
+            goto fail;
+        }
+        len = t - p;
+        if ((sin_src->sin_addr.s_addr = ngx_inet_addr(p, len)) == INADDR_NONE) {
+            step = 7;
+            goto fail;
+        }
+        pp.pp_src3_text.data = ngx_pcalloc(c->pool, len + 1);
+        ngx_memcpy(pp.pp_src3_text.data, p, len);
+        pp.pp_src3_text.len = len;
+
+        p += (len + 1);
+        s -= (len + 1);
+        if (s <= 0) {
+            step = 8;
+            goto fail;
+        }
+
+        /* l3 destination address */
+        if ( (t = (u_char *)memchr(p, ' ', s)) == NULL ) {
+            step = 9;
+            goto fail;
+        }
+        len = t - p;
+        if ((sin_dst->sin_addr.s_addr = ngx_inet_addr(p, len)) == INADDR_NONE) {
+            step = 10;
+            goto fail;
+        }
+// FIXME pointer shift ???
+        pp.pp_dst3_text.data = ngx_pcalloc(c->pool, len + 1);
+        ngx_memcpy(pp.pp_dst3_text.data, p, len);
+        pp.pp_dst3_text.len = len;
+
+        p += (len + 1);
+        s -= (len + 1);
+        if (s <= 0) {
+            step = 11;
+            goto fail;
+        }
+
+        /* l4 source port */
+        if ( (t = (u_char *)memchr(p, ' ', s)) == NULL ) {
+            step = 12;
+            goto fail;
+        }
+        len = t - p;
+        pp.pp_src4 = ngx_atoi(p, len);
+        if ((pp.pp_src4 < 1024)
+                || (pp.pp_src4 > 65535)) {
+            step = 13;
+            goto fail;
+        }
+        sin_src->sin_port = htons(pp.pp_src4);
+
+        p += (len + 1);
+        s -= (len + 1);
+        if (s <= 0) {
+            step = 14;
+            goto fail;
+        }
+
+        /* l4 destination port */
+        if ( (t = (u_char *)memchr(p, '\r', s)) == NULL ) {
+            step = 15;
+            goto fail;
+        }
+        len = t - p;
+        pp.pp_dst4 = ngx_atoi(p, len);
+        if (pp.pp_dst4 > 65535) {
+            step = 16;
+            goto fail;
+        }
+        sin_dst->sin_port = htons(pp.pp_dst4);
+
+        if (p[len + 1] != '\n') {
+            step = 17;
+            goto fail;
+        }
+
+        p += (len + 2);
+        s -= (len + 2);
+
+
+        /* if we managed to get there, then we can safely replace the
+         * information in the connection structure
+         */
+
+        /* updating connection with source information provided by proxy protocol */
+        if (pp.pp_src3_text.len > c->addr_text.len) {
+            ngx_pfree(c->pool, c->addr_text.data);
+            c->addr_text.data = ngx_pcalloc(c->pool, pp.pp_src3_text.len);
+        } else {
+            ngx_memzero(c->addr_text.data, c->addr_text.len);
+        }
+        ngx_memcpy(c->addr_text.data, pp.pp_src3_text.data, pp.pp_src3_text.len);
+        c->addr_text.len = pp.pp_src3_text.len;
+
+        ngx_pfree(c->pool, c->sockaddr);
+        c->socklen = NGX_SOCKADDRLEN;
+        c->sockaddr = ngx_pcalloc(c->pool, c->socklen);
+        ngx_memcpy(c->sockaddr, sin_src, c->socklen);
+
+        if (c->sockaddr->sa_family != AF_INET) {
+            ngx_pfree(c->pool, c->sockaddr);
+            c->socklen = NGX_SOCKADDRLEN;
+            c->sockaddr = ngx_pcalloc(c->pool, c->socklen);
+        } else {
+            ngx_memzero(c->sockaddr, sizeof(struct sockaddr_in));
+            c->socklen = NGX_SOCKADDRLEN;
+        }
+        ngx_memcpy(c->sockaddr, sin_src, c->socklen);
+
+        /* updating connection with destination information provided by proxy protocol */
+        ngx_pfree(c->pool, c->local_sockaddr);
+        c->local_sockaddr = ngx_pcalloc(c->pool, NGX_SOCKADDRLEN);
+        ngx_memcpy(c->local_sockaddr, sin_dst, NGX_SOCKADDRLEN);
+
+    }
+
+#if (NGX_HAVE_INET6)
+
+     else if (memcmp(p, "TCP6 ", 5) == 0) {
+
+        struct sockaddr_in6 *sin6_src;
+        struct sockaddr_in6 *sin6_dst;
+
+        pp.pp_proto = NGX_PP_PROTO_TCP6;
+        pp.pp_src3.ss_family = AF_INET6;
+        pp.pp_dst3.ss_family = AF_INET6;
+        sin6_src = (struct sockaddr_in6 *) &pp.pp_src3;
+        sin6_dst = (struct sockaddr_in6 *) &pp.pp_dst3;
+
+        p += 5;
+        s -= 5;
+        if (s <= 0) {
+            step = 18;
+            goto fail;
+        }
+
+        /* l3 source address */
+        if ( (t = (u_char *)memchr(p, ' ', s)) == NULL ) {
+            step = 19;
+            goto fail;
+        }
+        len = t - p;
+        if (ngx_inet6_addr(p, len, sin6_src->sin6_addr.s6_addr) != NGX_OK) {
+            step = 20;
+            goto fail;
+        }
+        pp.pp_src3_text.data = ngx_pcalloc(c->pool, len + 1);
+        ngx_memcpy(pp.pp_src3_text.data, p, len);
+        pp.pp_src3_text.len = len;
+
+        p += (len + 1);
+        s -= (len + 1);
+        if (s <= 0) {
+            step = 21;
+            goto fail;
+        }
+
+        /* l3 destination address */
+        if ( (t = (u_char *)memchr(p, ' ', s)) == NULL ) {
+            step = 22;
+            goto fail;
+        }
+        len = t - p;
+        if (ngx_inet6_addr(p, len, sin6_dst->sin6_addr.s6_addr) != NGX_OK) {
+            step = 23;
+            goto fail;
+        }
+        pp.pp_dst3_text.data = ngx_pcalloc(c->pool, len + 1);
+        ngx_memcpy(pp.pp_dst3_text.data, p, len);
+        pp.pp_dst3_text.len = len;
+
+        p += (len + 1);
+        s -= (len + 1);
+        if (s <= 0) {
+            step = 24;
+            goto fail;
+        }
+
+        /* l4 source port */
+        if ( (t = (u_char *)memchr(p, ' ', s)) == NULL ) {
+            step = 25;
+            goto fail;
+        }
+        len = t - p;
+        pp.pp_src4 = ngx_atoi(p, len);
+        if ((pp.pp_src4 < 1024)
+                || (pp.pp_src4 > 65535)) {
+            step = 26;
+            goto fail;
+        }
+        sin6_src->sin6_port = htons(pp.pp_src4);
+
+        p += (len + 1);
+        s -= (len + 1);
+        if (s <= 0) {
+            step = 27;
+            goto fail;
+        }
+
+        /* l4 destination port */
+        if ( (t = (u_char *)memchr(p, '\r', s)) == NULL ) {
+            step = 28;
+            goto fail;
+        }
+        len = t - p;
+        pp.pp_dst4 = ngx_atoi(p, len);
+        if (pp.pp_dst4 > 65535) {
+            step = 29;
+            goto fail;
+        }
+        sin6_dst->sin6_port = htons(pp.pp_dst4);
+
+        if (p[len + 1] != '\n') {
+            step = 30;
+            goto fail;
+        }
+
+        p += (len + 2);
+        s -= (len + 2);
+
+        /* if we managed to get there, then we can safely replace the
+         * information in the connection structure
+         */
+
+        /* updating connection with source provided by proxy protocol */
+        if (pp.pp_src3_text.len > c->addr_text.len) {
+            ngx_pfree(c->pool, c->addr_text.data);
+            c->addr_text.data = ngx_pcalloc(c->pool, pp.pp_src3_text.len);
+        } else {
+            ngx_memzero(c->addr_text.data, c->addr_text.len);
+        }
+        ngx_memcpy(c->addr_text.data, pp.pp_src3_text.data, pp.pp_src3_text.len);
+        c->addr_text.len = pp.pp_src3_text.len;
+
+        ngx_pfree(c->pool, c->sockaddr);
+        c->socklen = NGX_SOCKADDRLEN;
+        c->sockaddr = ngx_pcalloc(c->pool, c->socklen);
+        ngx_memcpy(c->sockaddr, sin6_src, c->socklen);
+
+        /* updating connection with destination provided by proxy protocol */
+        if (c->sockaddr->sa_family != AF_INET6) {
+            ngx_pfree(c->pool, c->local_sockaddr);
+            c->local_sockaddr = ngx_pcalloc(c->pool, NGX_SOCKADDRLEN);
+        } else {
+            ngx_memzero(c->sockaddr, sizeof(struct sockaddr_in6));
+            c->socklen = NGX_SOCKADDRLEN;
+        }
+//        ngx_memcpy(c->local_sockaddr, sin6_dst, NGX_SOCKADDRLEN);
+//FIXME must be finished here
+
+    }
+
+#endif
+
+    else {
+        step = 31;
+        goto fail;
+    }
+
+    ngx_print_proxy_protocol(&pp, c->log);
+
+    ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
+            "proxy_protocol, asking to remove %z chars",
+            end + 1 - buf);
+
+    return (end + 1 - buf);
+
+fail:
+    ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
+            "proxy_protocol error at step: %d", step);
+
+    return 0;
+
+}
+
+
+void
+ngx_print_proxy_protocol(ngx_proxy_protocol_t *p, ngx_log_t *log)
+{
+    switch (p->pp_proto) {
+        case NGX_PP_PROTO_TCP4:
+           ngx_log_debug0(NGX_LOG_DEBUG_EVENT, log, 0,
+               "proxy_protocol, proto: TCP4");
+        break;
+        case NGX_PP_PROTO_TCP6:
+           ngx_log_debug0(NGX_LOG_DEBUG_EVENT, log, 0,
+               "proxy_protocol, proto: TCP6");
+       break;
+   }
+
+    ngx_log_debug1(NGX_LOG_DEBUG_EVENT, log, 0,
+       "proxy_protocol, string length: %d", ngx_proxy_protocol_string_length(p));
+    ngx_log_debug2(NGX_LOG_DEBUG_EVENT, log, 0,
+       "proxy_protocol, src3: %s, %d", p->pp_src3_text.data, p->pp_src3_text.len);
+    ngx_log_debug2(NGX_LOG_DEBUG_EVENT, log, 0,
+       "proxy_protocol, dst3: %s, %d", p->pp_dst3_text.data, p->pp_dst3_text.len);
+    ngx_log_debug1(NGX_LOG_DEBUG_EVENT, log, 0,
+       "proxy_protocol, src4: %d", p->pp_src4);
+    ngx_log_debug1(NGX_LOG_DEBUG_EVENT, log, 0,
+       "proxy_protocol, dst4: %d", p->pp_dst4);
+}
+
+
+int
+ngx_proxy_protocol_string_length(ngx_proxy_protocol_t *p)
+{
+    int len = 0;
+
+    /* 'PROXY ' */
+    len += (sizeof("PROXY ") - 1);
+
+    /* protocol version (TCP4 or TCP6) + space */
+    len += (sizeof("TCP0 ") - 1);
+
+    /* src3 + space */
+    len += p->pp_src3_text.len;
+    len += 1;
+
+    /* dst3 + space */
+    len += p->pp_dst3_text.len;
+    len += 1;
+
+    /* src4 */
+    if (p->pp_src4 < 10000)
+        /* 4 digits + 1 space */
+        len += (sizeof("0000 ") - 1);
+    else
+        /* 5 digits + 1 space */
+        len += (sizeof("00000 ") - 1);
+
+    /* dst4 */
+    if (p->pp_dst4 >= 10000)
+        /* 5 digits */
+        len += (sizeof("00000 ") - 1);
+    else if (p->pp_dst4 >= 1000)
+        /* 4 digits */
+        len += (sizeof("0000 ") - 1);
+    else if (p->pp_dst4 >= 100)
+        /* 3 digits */
+        len += (sizeof("000 ") - 1);
+    else if (p->pp_dst4 >= 10)
+        /* 2 digits */
+        len += (sizeof("00 ") - 1);
+    else
+        /* 1 digit */
+        len += (sizeof("0 ") - 1);
+
+    /* CRLF */
+    len += (sizeof(CRLF) - 1);
+
+    return len - 1;
+}
+
+#endif
Index: nginx-1.4.7/src/core/ngx_proxy_protocol.h
===================================================================
--- /dev/null
+++ nginx-1.4.7/src/core/ngx_proxy_protocol.h
@@ -0,0 +1,45 @@
+
+/*
+ * Copyright (C) Baptiste Assmann
+ * Copyright (C) Exceliance
+ */
+
+
+#ifndef _NGX_PROXY_PROTOCOL_H_INCLUDED_
+#define _NGX_PROXY_PROTOCOL_H_INCLUDED_
+
+
+#include <ngx_config.h>
+#include <ngx_core.h>
+
+
+#if (NGX_PROXY_PROTOCOL)
+
+typedef struct ngx_proxy_protocol_s ngx_proxy_protocol_t;
+
+typedef enum {
+    NGX_PP_PROTO_TCP4 = 1,
+    NGX_PP_PROTO_TCP6
+} ngx_pp_proto;
+
+
+struct ngx_proxy_protocol_s {
+    unsigned int	    pp_proto;	/* proxy protocol related information */
+    struct sockaddr_storage pp_src3;
+    ngx_str_t		    pp_src3_text;
+    struct sockaddr_storage pp_dst3;
+    ngx_str_t		    pp_dst3_text;
+    unsigned int	    pp_src4;
+    unsigned int	    pp_dst4;
+};
+
+
+int  ngx_recv_proxy_protocol(ngx_connection_t *, u_char *, ssize_t);
+void ngx_print_proxy_protocol(ngx_proxy_protocol_t *, ngx_log_t *);
+int  ngx_proxy_protocol_string_length(ngx_proxy_protocol_t *);
+
+
+#endif
+
+#endif /* _NGX_CONNECTION_H_INCLUDED_ */
+
Index: nginx-1.4.7/src/http/modules/ngx_http_proxy_module.c
===================================================================
--- nginx-1.4.7.orig/src/http/modules/ngx_http_proxy_module.c
+++ nginx-1.4.7/src/http/modules/ngx_http_proxy_module.c
@@ -8,7 +8,9 @@
 #include <ngx_config.h>
 #include <ngx_core.h>
 #include <ngx_http.h>
-
+#if (NGX_PROXY_PROTOCOL)
+#include <ngx_proxy_protocol.h>
+#endif
 
 typedef struct ngx_http_proxy_rewrite_s  ngx_http_proxy_rewrite_t;
 
@@ -365,6 +367,17 @@ static ngx_command_t  ngx_http_proxy_com
       offsetof(ngx_http_proxy_loc_conf_t, upstream.busy_buffers_size_conf),
       NULL },
 
+#if (NGX_PROXY_PROTOCOL)
+
+    { ngx_string("send_proxy_protocol"),
+      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_FLAG,
+      ngx_conf_set_flag_slot,
+      NGX_HTTP_LOC_CONF_OFFSET,
+      offsetof(ngx_http_proxy_loc_conf_t, upstream.send_proxy_protocol),
+      NULL },
+
+#endif
+
 #if (NGX_HTTP_CACHE)
 
     { ngx_string("proxy_cache"),
@@ -2420,6 +2433,11 @@ ngx_http_proxy_create_loc_conf(ngx_conf_
     conf->upstream.pass_headers = NGX_CONF_UNSET_PTR;
 
     conf->upstream.intercept_errors = NGX_CONF_UNSET;
+
+#if (NGX_PROXY_PROTOCOL)
+    conf->upstream.send_proxy_protocol = NGX_CONF_UNSET;
+#endif
+
 #if (NGX_HTTP_SSL)
     conf->upstream.ssl_session_reuse = NGX_CONF_UNSET;
 #endif
@@ -2695,6 +2713,11 @@ ngx_http_proxy_merge_loc_conf(ngx_conf_t
     ngx_conf_merge_value(conf->upstream.intercept_errors,
                               prev->upstream.intercept_errors, 0);
 
+#if (NGX_PROXY_PROTOCOL)
+    ngx_conf_merge_value(conf->upstream.send_proxy_protocol,
+                              prev->upstream.send_proxy_protocol, 0);
+#endif
+
 #if (NGX_HTTP_SSL)
     ngx_conf_merge_value(conf->upstream.ssl_session_reuse,
                               prev->upstream.ssl_session_reuse, 1);
Index: nginx-1.4.7/src/http/ngx_http.c
===================================================================
--- nginx-1.4.7.orig/src/http/ngx_http.c
+++ nginx-1.4.7/src/http/ngx_http.c
@@ -1228,6 +1228,9 @@ ngx_http_add_addresses(ngx_conf_t *cf, n
 #if (NGX_HTTP_SPDY)
     ngx_uint_t             spdy;
 #endif
+#if (NGX_PROXY_PROTOCOL)
+    ngx_uint_t             accept_proxy_protocol;
+#endif
 
     /*
      * we cannot compare whole sockaddr struct's as kernel
@@ -1283,6 +1286,10 @@ ngx_http_add_addresses(ngx_conf_t *cf, n
 #if (NGX_HTTP_SPDY)
         spdy = lsopt->spdy || addr[i].opt.spdy;
 #endif
+#if (NGX_PROXY_PROTOCOL)
+        accept_proxy_protocol = lsopt->accept_proxy_protocol
+                                || addr[i].opt.accept_proxy_protocol;
+#endif
 
         if (lsopt->set) {
 
@@ -1316,6 +1323,9 @@ ngx_http_add_addresses(ngx_conf_t *cf, n
 #if (NGX_HTTP_SPDY)
         addr[i].opt.spdy = spdy;
 #endif
+#if (NGX_PROXY_PROTOCOL)
+        addr[i].opt.accept_proxy_protocol = accept_proxy_protocol;
+#endif
 
         return NGX_OK;
     }
@@ -1762,6 +1772,11 @@ ngx_http_add_listening(ngx_conf_t *cf, n
     ls->pool_size = cscf->connection_pool_size;
     ls->post_accept_timeout = cscf->client_header_timeout;
 
+#if (NGX_PROXY_PROTOCOL)
+// CLEANUP:    ls->accept_proxy_protocol = cscf->accept_proxy_protocol;
+    ls->accept_proxy_protocol = addr->opt.accept_proxy_protocol;
+#endif
+
     clcf = cscf->ctx->loc_conf[ngx_http_core_module.ctx_index];
 
     ls->logp = clcf->error_log;
@@ -1840,6 +1855,9 @@ ngx_http_add_addrs(ngx_conf_t *cf, ngx_h
 #if (NGX_HTTP_SPDY)
         addrs[i].conf.spdy = addr[i].opt.spdy;
 #endif
+#if (NGX_PROXY_PROTOCOL)
+        addrs[i].conf.accept_proxy_protocol = addr[i].opt.accept_proxy_protocol;
+#endif
 
         if (addr[i].hash.buckets == NULL
             && (addr[i].wc_head == NULL
@@ -1904,6 +1922,9 @@ ngx_http_add_addrs6(ngx_conf_t *cf, ngx_
 #if (NGX_HTTP_SPDY)
         addrs6[i].conf.spdy = addr[i].opt.spdy;
 #endif
+#if (NGX_PROXY_PROTOCOL)
+        addrs6[i].conf.accept_proxy_protocol = addr[i].opt.accept_proxy_protocol;
+#endif
 
         if (addr[i].hash.buckets == NULL
             && (addr[i].wc_head == NULL
Index: nginx-1.4.7/src/http/ngx_http_core_module.c
===================================================================
--- nginx-1.4.7.orig/src/http/ngx_http_core_module.c
+++ nginx-1.4.7/src/http/ngx_http_core_module.c
@@ -4090,6 +4090,15 @@ ngx_http_core_listen(ngx_conf_t *cf, ngx
             continue;
         }
 
+#if (NGX_PROXY_PROTOCOL)
+        if (ngx_strncmp(value[n].data, "accept_proxy_protocol=on", 24) == 0) {
+            lsopt.accept_proxy_protocol = 1;
+            lsopt.set = 1;
+            lsopt.bind = 1;
+            continue;
+        }
+#endif
+
         if (ngx_strncmp(value[n].data, "ipv6only=o", 10) == 0) {
 #if (NGX_HAVE_INET6 && defined IPV6_V6ONLY)
             struct sockaddr  *sa;
Index: nginx-1.4.7/src/http/ngx_http_core_module.h
===================================================================
--- nginx-1.4.7.orig/src/http/ngx_http_core_module.h
+++ nginx-1.4.7/src/http/ngx_http_core_module.h
@@ -78,6 +78,11 @@ typedef struct {
 #if (NGX_HTTP_SPDY)
     unsigned                   spdy:1;
 #endif
+
+#if (NGX_PROXY_PROTOCOL)
+    unsigned                   accept_proxy_protocol:2;
+#endif
+
 #if (NGX_HAVE_INET6 && defined IPV6_V6ONLY)
     unsigned                   ipv6only:1;
 #endif
@@ -234,6 +239,10 @@ struct ngx_http_addr_conf_s {
 
     ngx_http_virtual_names_t  *virtual_names;
 
+#if (NGX_PROXY_PROTOCOL)
+    ngx_flag_t                  accept_proxy_protocol;
+#endif
+
 #if (NGX_HTTP_SSL)
     unsigned                   ssl:1;
 #endif
Index: nginx-1.4.7/src/http/ngx_http_request.c
===================================================================
--- nginx-1.4.7.orig/src/http/ngx_http_request.c
+++ nginx-1.4.7/src/http/ngx_http_request.c
@@ -63,6 +63,9 @@ static void ngx_http_ssl_handshake(ngx_e
 static void ngx_http_ssl_handshake_handler(ngx_connection_t *c);
 #endif
 
+#if (NGX_PROXY_PROTOCOL)
+static void ngx_http_proxy_protocol(ngx_event_t *rev);
+#endif
 
 static char *ngx_http_client_errors[] = {
 
@@ -343,6 +346,14 @@ ngx_http_init_connection(ngx_connection_
     }
 #endif
 
+#if (NGX_PROXY_PROTOCOL)
+    {
+        if (hc->addr_conf->accept_proxy_protocol) {
+            rev->handler = ngx_http_proxy_protocol;
+        }
+    }
+#endif
+
     if (rev->ready) {
         /* the deferred accept(), rtsig, aio, iocp */
 
@@ -364,7 +375,6 @@ ngx_http_init_connection(ngx_connection_
     }
 }
 
-
 static void
 ngx_http_wait_request_handler(ngx_event_t *rev)
 {
@@ -469,6 +479,12 @@ ngx_http_wait_request_handler(ngx_event_
     }
 
     rev->handler = ngx_http_process_request_line;
+
+#if (NGX_PROXY_PROTOCOL)
+    if (hc->addr_conf->accept_proxy_protocol)
+        rev->handler = ngx_http_proxy_protocol;
+#endif
+
     ngx_http_process_request_line(rev);
 }
 
@@ -582,6 +598,67 @@ ngx_http_create_request(ngx_connection_t
     return r;
 }
 
+#if (NGX_PROXY_PROTOCOL)
+
+static void
+ngx_http_proxy_protocol(ngx_event_t *rev)
+{
+    ssize_t                n;
+    size_t                 size = 1024;
+    u_char                 tmpbuf[size];
+    ngx_connection_t      *c;
+    ngx_http_connection_t *hc;
+
+    c = rev->data;
+    hc = c->data;
+    rev->handler = ngx_http_wait_request_handler;
+
+#if (NGX_HTTP_SPDY)
+    {
+        if (hc->addr_conf->spdy) {
+            rev->handler = ngx_http_spdy_init;
+        }
+    }
+#endif
+
+#if (NGX_HTTP_SSL)
+    {
+        if (hc->addr_conf->ssl) {
+            rev->handler = ngx_http_ssl_handshake;
+        }
+    }
+#endif
+
+    n = recv(c->fd, tmpbuf, size, MSG_PEEK);
+
+    if ((n <= 0) && (c->listening)
+            && (hc->addr_conf->accept_proxy_protocol)
+	    && (!c->proxy_protocol)) {
+        ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0, "ngx_http_proxy_protocol: pp required but not found");
+        return;
+    }
+    if ((n > 0) && (c->listening)
+            && (hc->addr_conf->accept_proxy_protocol)
+	    && (!c->proxy_protocol)) {
+        ssize_t m;
+        if (!(m = ngx_recv_proxy_protocol(c, tmpbuf, n))) {
+            ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0, "ngx_http_proxy_protocol: pp required but not found");
+            ngx_http_close_connection(c);
+            return;
+        }
+        ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0, "ngx_http_proxy_protocol: pp required and found");
+
+        c->proxy_protocol = 1;
+
+        /* strip the proxy protocol string from the buffer */
+        recv(c->fd, tmpbuf, m, 0);
+    }
+
+    rev->handler(rev);
+}
+
+#endif
+
 
 #if (NGX_HTTP_SSL)
 
Index: nginx-1.4.7/src/http/ngx_http_upstream.c
===================================================================
--- nginx-1.4.7.orig/src/http/ngx_http_upstream.c
+++ nginx-1.4.7/src/http/ngx_http_upstream.c
@@ -31,6 +31,10 @@ static ngx_int_t ngx_http_upstream_reini
     ngx_http_upstream_t *u);
 static void ngx_http_upstream_send_request(ngx_http_request_t *r,
     ngx_http_upstream_t *u);
+#if (NGX_PROXY_PROTOCOL)
+static void ngx_http_upstream_send_proxy_protocol(ngx_http_request_t *r,
+    ngx_http_upstream_t *u);
+#endif
 static void ngx_http_upstream_send_request_handler(ngx_http_request_t *r,
     ngx_http_upstream_t *u);
 static void ngx_http_upstream_process_header(ngx_http_request_t *r,
@@ -1255,6 +1259,13 @@ ngx_http_upstream_connect(ngx_http_reque
 
     u->request_sent = 0;
 
+#if (NGX_PROXY_PROTOCOL)
+    if (u->conf->send_proxy_protocol && !(u->ssl && c->ssl == NULL)) {
+        ngx_http_upstream_send_proxy_protocol(r, u);
+	return;
+    }
+#endif
+
     if (rc == NGX_AGAIN) {
         ngx_add_timer(c->write, u->conf->connect_timeout);
         return;
@@ -1498,6 +1509,228 @@ ngx_http_upstream_send_request(ngx_http_
 }
 
 
+#if (NGX_PROXY_PROTOCOL)
+
+static void
+ngx_http_upstream_send_proxy_protocol(ngx_http_request_t *r, ngx_http_upstream_t *u)
+{
+    size_t                   len;
+    ngx_int_t                rc;
+    ngx_connection_t        *uc;
+    ngx_connection_t        *cc;
+    ngx_chain_t             *pp_string;
+    ngx_proxy_protocol_t     pp;
+    ngx_buf_t               *b;
+    char                     port[6];
+    u_char                  *addr;
+    struct sockaddr_storage  sa_src;
+    struct sockaddr_storage  sa_dst;
+    socklen_t                addrlen = NGX_SOCKADDRLEN;
+    struct sockaddr_in      *sin_src;
+    struct sockaddr_in      *sin_dst;
+
+#if (NGX_HAVE_INET6)
+
+    struct sockaddr_in6     *sin6_src;
+    struct sockaddr_in6     *sin6_dst;
+
+#endif
+
+
+    uc = u->peer.connection;
+    cc = r->connection;
+
+    if ( !(u->conf->send_proxy_protocol) ) {
+        return;
+    }
+
+    ngx_log_debug0(NGX_LOG_DEBUG_HTTP, uc->log, 0,
+                   "http upstream send proxy protocol");
+
+    if (!u->request_sent && ngx_http_upstream_test_connect(uc) != NGX_OK) {
+        ngx_http_upstream_next(r, u, NGX_HTTP_UPSTREAM_FT_ERROR);
+        return;
+    }
+
+    uc->log->action = "sending proxy protocol to upstream";
+
+    len = 0;
+
+    if (r->connection->proxy_protocol) {
+        ngx_log_debug0(NGX_LOG_DEBUG_HTTP, uc->log, 0,
+                   "PP: got proxy-protocol from client connection");
+
+        switch (cc->sockaddr->sa_family) {
+
+#if (NGX_HAVE_INET6)
+
+            case AF_INET6:
+
+                pp.pp_proto = NGX_PP_PROTO_TCP6;
+                sin6_dst = (struct sockaddr_in6 *) cc->local_sockaddr;
+                sin6_src = (struct sockaddr_in6 *) cc->sockaddr;
+
+                break;
+
+#endif
+
+            default:
+                pp.pp_proto = NGX_PP_PROTO_TCP4;
+                sin_dst = (struct sockaddr_in *) cc->local_sockaddr;
+                sin_src = (struct sockaddr_in *) cc->sockaddr;
+
+        }
+
+    } else {
+
+        ngx_log_debug0(NGX_LOG_DEBUG_HTTP, uc->log, 0,
+                   "PP: collecting information from socket fd");
+
+        getsockname(cc->fd, (struct sockaddr *) &sa_dst, &addrlen);
+
+        switch (sa_dst.ss_family) {
+
+#if (NGX_HAVE_INET6)
+
+            case AF_INET6:
+
+                pp.pp_proto = NGX_PP_PROTO_TCP6;
+                sin6_dst = (struct sockaddr_in6 *) &sa_dst;
+
+                getpeername(cc->fd, (struct sockaddr *) &sa_src, &addrlen);
+                sin6_src = (struct sockaddr_in6 *) &sa_src;
+
+                break;
+
+#endif
+
+            default:
+
+                pp.pp_proto = NGX_PP_PROTO_TCP4;
+                sin_dst = (struct sockaddr_in *) &sa_dst;
+                getpeername(cc->fd, (struct sockaddr *) &sa_src, &addrlen);
+                sin_src = (struct sockaddr_in *) &sa_src;
+        }
+
+
+    }
+
+    switch (pp.pp_proto) {
+
+#if (NGX_HAVE_INET6)
+
+        case NGX_PP_PROTO_TCP6:
+
+            /* dst3 and dst4 */
+            addr = ngx_pcalloc(r->pool, NGX_INET6_ADDRSTRLEN);
+            ngx_inet_ntop(AF_INET6, &sin6_dst->sin6_addr, addr, NGX_INET6_ADDRSTRLEN);
+            pp.pp_dst3_text.data = ngx_pcalloc(r->pool, NGX_INET6_ADDRSTRLEN);
+            pp.pp_dst3_text.len = ngx_strlen(addr);
+            ngx_memcpy(pp.pp_dst3_text.data, addr, pp.pp_dst3_text.len);
+            pp.pp_dst4 = htons(sin6_dst->sin6_port);
+
+            ngx_memzero(addr, NGX_INET6_ADDRSTRLEN);
+
+            /* src3 and src4 */
+            ngx_inet_ntop(AF_INET6, &sin6_src->sin6_addr, addr, NGX_INET6_ADDRSTRLEN);
+            pp.pp_src3_text.data = ngx_pcalloc(r->pool, NGX_INET6_ADDRSTRLEN);
+            pp.pp_src3_text.len = ngx_strlen(addr);
+            ngx_memcpy(pp.pp_src3_text.data, addr, pp.pp_src3_text.len);
+            pp.pp_src4 = htons(sin6_src->sin6_port);
+
+        break;
+
+#endif
+
+        default:
+
+            /* dst3 and dst4 */
+            addr = ngx_pcalloc(r->pool, NGX_INET_ADDRSTRLEN);
+            ngx_inet_ntop(AF_INET, &sin_dst->sin_addr, addr, NGX_INET_ADDRSTRLEN);
+            pp.pp_dst3_text.data = ngx_pcalloc(r->pool, NGX_INET_ADDRSTRLEN);
+            pp.pp_dst3_text.len = ngx_strlen(addr);
+            ngx_memcpy(pp.pp_dst3_text.data, addr, pp.pp_dst3_text.len);
+            pp.pp_dst4 = htons(sin_dst->sin_port);
+
+            ngx_memzero(addr, NGX_INET_ADDRSTRLEN);
+
+            /* src3 and src4 */
+            ngx_inet_ntop(AF_INET, &sin_src->sin_addr, addr, NGX_INET_ADDRSTRLEN);
+            pp.pp_src3_text.data = ngx_pcalloc(r->pool, NGX_INET_ADDRSTRLEN);
+            pp.pp_src3_text.len = ngx_strlen(addr);
+            ngx_memcpy(pp.pp_src3_text.data, addr, pp.pp_src3_text.len);
+            pp.pp_src4 = htons(sin_src->sin_port);
+
+    }
+
+    len += ngx_proxy_protocol_string_length(&pp);
+
+    ngx_print_proxy_protocol(&pp, uc->log);
+
+    b = ngx_create_temp_buf(uc->pool, len);
+    if (b == NULL) {
+        return;
+    }
+
+    pp_string = ngx_alloc_chain_link(uc->pool);
+    if (pp_string == NULL) {
+        return;
+    }
+
+    pp_string->buf = b;
+    pp_string->next = NULL;
+
+    b->last = ngx_cpymem(b->last, "PROXY ", sizeof("PROXY ") - 1);
+
+    switch (pp.pp_proto) {
+        case NGX_PP_PROTO_TCP4:
+            b->last = ngx_cpymem(b->last, "TCP4 ", sizeof("TCP4 ") - 1);
+        break;
+        case NGX_PP_PROTO_TCP6:
+            b->last = ngx_cpymem(b->last, "TCP6 ", sizeof("TCP6 ") - 1);
+        break;
+    }
+
+    /* src3 */
+    b->last = ngx_cpymem(b->last, pp.pp_src3_text.data, pp.pp_src3_text.len);
+    b->last = ngx_cpymem(b->last, " ", 1);
+
+    /* dst3 */
+    b->last = ngx_cpymem(b->last, pp.pp_dst3_text.data, pp.pp_dst3_text.len);
+    b->last = ngx_cpymem(b->last, " ", 1);
+
+    /* src4 */
+    ngx_memzero(port, 6);
+    sprintf(port,"%d", pp.pp_src4);
+    b->last = ngx_cpymem(b->last, port, strlen(port));
+    b->last = ngx_cpymem(b->last, " ", 1);
+
+    /* dst4 */
+    ngx_memzero(port, 6);
+    sprintf(port,"%d", pp.pp_dst4);
+    b->last = ngx_cpymem(b->last, port, strlen(port));
+
+    /* CRLF */
+    b->last = ngx_cpymem(b->last, CRLF, sizeof(CRLF) - 1);
+
+    ngx_log_debug3(NGX_LOG_DEBUG_HTTP, uc->log, 0,
+            "http upstream send proxy protocol: %d -%*s-",
+            ngx_proxy_protocol_string_length(&pp),
+            ngx_proxy_protocol_string_length(&pp) - 2,
+            b->start);
+
+    rc = ngx_output_chain(&u->output, pp_string);
+
+    if (rc == NGX_ERROR) {
+        ngx_http_upstream_next(r, u, NGX_HTTP_UPSTREAM_FT_ERROR);
+        return;
+    }
+
+}
+
+#endif
+
+
 static void
 ngx_http_upstream_send_request_handler(ngx_http_request_t *r,
     ngx_http_upstream_t *u)
Index: nginx-1.4.7/src/http/ngx_http_upstream.h
===================================================================
--- nginx-1.4.7.orig/src/http/ngx_http_upstream.h
+++ nginx-1.4.7/src/http/ngx_http_upstream.h
@@ -188,6 +188,10 @@ typedef struct {
     unsigned                         intercept_404:1;
     unsigned                         change_buffering:1;
 
+#if (NGX_PROXY_PROTOCOL)
+    ngx_flag_t                       send_proxy_protocol;
+#endif
+
 #if (NGX_HTTP_SSL)
     ngx_ssl_t                       *ssl;
     ngx_flag_t                       ssl_session_reuse;
Index: nginx-1.4.7/auto/cc/gcc
===================================================================
--- nginx-1.4.7.orig/auto/cc/gcc
+++ nginx-1.4.7/auto/cc/gcc
@@ -168,7 +168,7 @@ esac
 
 
 # stop on warning
-CFLAGS="$CFLAGS -Werror"
+CFLAGS="$CFLAGS"
 
 # debug
 CFLAGS="$CFLAGS -g"
Index: nginx-1.4.7/auto/cc/icc
===================================================================
--- nginx-1.4.7.orig/auto/cc/icc
+++ nginx-1.4.7/auto/cc/icc
@@ -115,7 +115,7 @@ case "$NGX_ICC_VER" in
 esac
 
 # stop on warning
-CFLAGS="$CFLAGS -Werror"
+CFLAGS="$CFLAGS "
 
 # debug
 CFLAGS="$CFLAGS -g"