-
-
Notifications
You must be signed in to change notification settings - Fork 81
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
UDP Proxy Protocol not functioning #269
Comments
cc/ @WeidiDeng |
I think the layer4 proxy handler just does not intend to support proxy protocol with udp. |
Is there a plan to fix this bug? |
@erroltuparker can you try |
hi @WeidiDeng, i just tried it and still the same errors Application endpoint
Caddy Layer4
|
@erroltuparker How do you deploy DnsServer using docker? I'll need to test it locally to figure out what's wrong. |
@WeidiDeng Can the following example be used for testing?
|
@WeidiDeng as im using unraid its basically this run command (cleaned up some of the extra bits)
As its on an actual network, all the ports are available to caddy. Then I have Technitium configured as below Then the caddyfile as configured below
|
It's actually upstream's bug, i.e. https://github.com/mastercactapus/proxyprotocol. When writing a proxyprotocol header, for udp, the local address is The upstream library can't handle this case, and it will write an invalid proxy protocol header. And, this header will parse successfully by this library, even though the type is wrong. This library can only handle tcp address for v1 proxy protocol caddy core already uses another proxyprotocol library (better maintained and more commonly used), I'll check if that one is working successfully and use that instead the current one. But that will be a big refactor. update: the new library doesn't support proxyprotocol for network other than tcp either. |
@erroltuparker can you try |
@WeidiDeng still the same issue but please see the results between proxy_protocol v1 and proxy_protocol v2 note: 192.168.86.5 is caddy proxy_protocol v2
proxy_protocol v1
|
proxy_protocol v1 can not be fixed, both upstream library doesn't support this use case. Only tcp is supported. I think nginx can extract the exact address using this type of syscall. This requires rewriting packet connection handling to get the exact local address. For golang this local address is https://pkg.go.dev/golang.org/x/[email protected]/ipv4#PacketConn.ReadFrom https://pkg.go.dev/golang.org/x/[email protected]/ipv6#PacketConn.ReadFrom I won't have time to work on this for now. |
@erroltuparker can you try No need to test v1 since it isn't supported by upstream at all. |
Hi @WeidiDeng, still same errors. (btw, thanks for looking into this) |
Hello @WeidiDeng, I tried your build and it seems to work nicely with my Technitium deployment. Testing on port 54 and Podman: # allow access to host's 538 (UDP-PROXY port exposed by Technitium)
podman run --rm --net pasta:-U,538 -v ./Caddyfile:/etc/caddy/Caddyfile -p 54:54/udp caddy-l4:udp-pp Caddyfile
Tested command:
@erroltuparker it seems that Technitium only logs error. The original requesting IPs shows up as expected in Query Logs so please check that too. This is amazing development! It seems like we are on track towards HTTP3/QUIC with accurate IPs. |
Hello @skedastically @WeidiDeng,
root@C20240207094726:~# journalctl -u caddy --no-pager |
@lxhao61 It should be fixed now. |
Hi @WeidiDeng , The aforementioned BUG has been fixed, but another obvious BUG and an uncertain BUG were discovered through the following example tests.
BUG:
|
Hi All,
It appears that there is some issue with the proxy protocol implemented for UDP as my server recieves this response when trying to proxy.
But when I use nginx, it works fine. I did raise this with the provider and they also confirmed my findings
TechnitiumSoftware/DnsServer#1107
TCP works fine for proxying as I'm also utilizing that, but I would like to cover both sides of it.
The thing I see on the caddy side when this is run is the below errors.
This is what I have set up for the block
And this is what I set up with nginx to confirm that it was its definitely an issue with caddy-l4
The text was updated successfully, but these errors were encountered: