Open ntninja opened 5 years ago
BTW, the workaround for the issue with Apache is to force separate IPv4 and IPv6 listen ports:
listener 0.0.0.0:80 {
protocol http
fallback http:80 proxy
}
listener [::]:80 {
protocol http
ipv6_v6only yes
fallback http:80 proxy
}
listener 0.0.0.0:443 {
protocol tls
fallback http:443 proxy
}
listener [::]:443 {
protocol tls
ipv6_v6only yes
fallback http:443 proxy
}
I just reported a bug with Apache with seems to choke on this, but it probably should be fixed at the source (that is, in
sniproxy
).Basically
sniproxy
will emit PROXY-protocol lines such as this when receiving an IPv4 connection on a socket bound to IPv6:Instead of reporting it as TCP4 to the backend it will instead send an IPv4-mapped IPv6 address. While this is valid in theory, it doesn't appear to be faithful implementation of the spec (why would there be an TCP4 type otherwise?) and at least Apache's mod_remoteip chokes on it. It may also be part of the reason why sniproxy doesn't work with
caddy-proxyprotocol
.Either way, I'll add the usual thank you when reporting a bug as
sniproxy
is a very useful piece of software and saves me from having to learn haproxy. :slightly_smiling_face: