CERBERUS/nginx
1
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2026-08-04 14:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Core: reject mixed address families in PROXY v1

Browse source 
PROXY protocol v1 requires the source and destination addresses to use
the same protocol family.  The realip modules can replace the remote
address with one from a different family than the accepted socket local
address, which previously produced an invalid TCP4 or TCP6 header.

Emit a PROXY UNKNOWN header when the address families differ.

Closes: https://github.com/nginx/nginx/issues/1609
This commit is contained in:
solim 2026-07-29 00:29:52 +09:00
parent 33eedb5ae6
commit 20dd49b743
1 changed files with 5 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/core/ngx_proxy_protocol.c
View file

@ -291,6 +291,11 @@ ngx_proxy_protocol_write(ngx_connection_t *c, u_char *buf, u_char *last)
return NULL;
}
if (c->sockaddr->sa_family != c->local_sockaddr->sa_family) {
return ngx_cpymem(buf, "PROXY UNKNOWN" CRLF,
sizeof("PROXY UNKNOWN" CRLF) - 1);
}
switch (c->sockaddr->sa_family) {
case AF_INET: