nginx如何端口復用

nginx-1.15.2 版本新增了$ssl_preread_protocol?變量,通過該變量可以使用?stream?反向代理時預先判斷連接是否為ssl/tls協議或者為非ssl/tls協議,從而實現同一個端口來轉發不同的業務。

nginx如何端口復用

stream_ssl_preread模塊檢查初始ClientHello在SSL或TLS連接消息,并且提取其可用于管理連接幾個值。$ssl_preread_protocol版本1.15.2中添加的變量從消息client_version字段中捕獲最新的SSL / TLS版本號ClientHello。如果消息中supported_versions存在擴展名ClientHello,則變量設置為TLSv1.2/TLSv1.3。

實例:在一臺反向代理服務器上運行nginx,并監聽443端口,后端有兩組服務,一個為HTTPS(開啟TLS1.2/1.3)網站服務,另一個為SSH?服務,我們要實現這兩組服務運行在同一個端口上(配置的443端口)–入口請求由Nginx自動區分。

為簡便,我這時直接使用?docker環境

nginx 版本

# docker exec -it nginx nginx -V nginx version: nginx/1.15.10 built by gcc 8.2.0 (Alpine 8.2.0) built with OpenSSL 1.1.1b  26 Feb 2019 ...<省略若干行>...

目錄文件

 # tree ./nginx-with-L4-reuse/./nginx-with-L4-reuse/ ├── config│   └── nginx │       ├── conf.d │       │   └── default.conf │       ├── fastcgi.conf │       ├── fastcgi_params │       ├── mime.types │       └── nginx.conf └── docker-compose.yaml  3 directories, 6 files

docker-compose.yaml

# docker-compose.yaml version: "2.4" services:   nginx:     container_name: nginx     image: nginx:alpine     network_mode: host     volumes:       - ./config/nginx:/etc/nginx/:ro     ports:       - "443:443"     restart: always

nginx.conf

user  nginx; worker_processes  2;  error_log  /var/log/nginx/error.log warn; pid        /var/run/nginx.pid;   events {     worker_connections  1024; }  stream {     log_format stream '{"@access_time":"$time_iso8601",'         '"clientip":"$remote_addr",'         '"pid":$pid,'         '"pro":"$protocol",'         '"ssl_pro": "$ssl_preread_protocol"',         '"pro":"$protocol",'         '"stus":$status,'         '"sent":$bytes_sent,'         '"recv":$bytes_received,'         '"sess_time":$session_time,'         '"up_addr":"$upstream_addr",'         '"up_sent":$upstream_bytes_sent,'         '"up_recv":$upstream_bytes_received,'         '"up_conn_time":$upstream_connect_time,'         '"up_resp_time":"$upstream_first_byte_time",'         '"up_sess_time":$upstream_session_time}';      upstream ssh {         server 192.168.50.212:22;     }      upstream web {         server 192.168.50.215:443;     }      map $ssl_preread_protocol $upstream {         default ssh;         "TLSv1.2" web;         "TLSv1.3" web;     }      # SSH and SSL on the same port     server {         listen 443;          proxy_pass $upstream;         ssl_preread on;         access_log /var/log/nginx/stream_443.log stream;     } }

$ssl_preread_protocol?實現IP層實現了不同業務配置,在某種需求上很有意義–雖然存在功能限制。然而Tengine-2.3.0已經實現的IP層基于域名轉發,或許這一特性會引入到Nginx。

更多Nginx相關技術文章,請訪問Nginx使用教程欄目進行學習!?

? 版權聲明
THE END
喜歡就支持一下吧
點贊12 分享