TLS and Connection information through headers

[hkolk]

In our setup, we are terminating TLS traffic on Fabio. This means that Fabio is the main/only place where we know which protocol was used.

My suggestion is to add Info headers to the backend request, to facilitate logging within the application.

Current concept:

Fabio-Tls-Version: TLS12
Fabio-Tls-Cipher: 0xcca9
Fabio-Http-Protocol: h2

Because these are not really universal, I prefer to prefix them with Fabio-. The ID used for the cipher is from the IANA list:
https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml
https://golang.org/src/crypto/tls/cipher_suites.go#L368

For enabling/disabling these headers, I propose the proxy.header.info.enabled as a boolean, defaulting to true.

Later on, we can add additional informational headers, such as what Cloudflare has done with the CF-0RTT-Unique header for TLS1.3

I have the commits for this on my cloned branch. I'll create a pull request in a couple of days based on the input from this issue

[magiconair]

Since these are not fabio but protocol specific headers I'd prefer to drop the Fabio- prefix. Just use Tls-Version, Tls-Cipher and Http-Proto since the X-Forwarded-Proto also doesn't spell out Protocol. In general, I prefer the header names to be configurable to provide mechanisms for avoiding conflicts with existing setups. Disabling the header could then be achieved by setting them to empty values. However, then three parameters would have to be configured to fully disable them.

I'm reluctant for a general info.disabled flag since info is too general. All the X-Forwarded-* and X-Real* headers also contain information. What qualifies a header as an info header?

Opinions welcome.

[magiconair]

@hkolk What if we add the fields to the Forwarded header instead of introducing new headers? It is already provided and contains information about the connection. We can just add some fields, e.g. tlsver, tlscipher and httpproto?

[magiconair]

@hkolk I've pushed a change which adds the fields to the Forwarded header as described. Could you check whether this works for you? If possible, I'd like to merge this to next release this week.

[magiconair]

Example:

Forwarded: for=1.2.3.4; proto=https; httpproto=http/1.1; tlsver=tls10; tlscipher=0xc023

[taemon1337]

Don't forget the TLS client authentication information like Common Name