sniproxy
sniproxy copied to clipboard
proxy_protocol reports IPv4 on IPv6 listeners as IPv6
I just reported a bug with Apache with seems to choke on this, but it probably should be fixed at the source (that is, in sniproxy
).
Basically sniproxy
will emit PROXY-protocol lines such as this when receiving an IPv4 connection on a socket bound to IPv6:
PROXY TCP6 ::ffff:1.1.1.1 ::ffff:172.21.0.3 49122 80
Instead of reporting it as TCP4 to the backend it will instead send an IPv4-mapped IPv6 address. While this is valid in theory, it doesn't appear to be faithful implementation of the spec (why would there be an TCP4 type otherwise?) and at least Apache's mod_remoteip chokes on it. It may also be part of the reason why sniproxy doesn't work with caddy-proxyprotocol
.
Either way, I'll add the usual thank you when reporting a bug as sniproxy
is a very useful piece of software and saves me from having to learn haproxy. :slightly_smiling_face:
BTW, the workaround for the issue with Apache is to force separate IPv4 and IPv6 listen ports:
listener 0.0.0.0:80 {
protocol http
fallback http:80 proxy
}
listener [::]:80 {
protocol http
ipv6_v6only yes
fallback http:80 proxy
}
listener 0.0.0.0:443 {
protocol tls
fallback http:443 proxy
}
listener [::]:443 {
protocol tls
ipv6_v6only yes
fallback http:443 proxy
}