ngx_http_proxy_connect_create_peer randomly chooses ipv6 address on ipv4-only host

[zmedico]

Ⅰ. Issue Description

It appears that the ngx_http_proxy_connect_create_peer randomly chooses ipv6 address on ipv4-only host.

Ⅱ. Describe what happened

Running nginx (built with ipv6 support) on an ipv4 only host, I see random failures like these:

2020/04/07 22:15:45 [crit] 12#12: *32 bind(10.10.176.1) failed (22: Invalid argument) while connecting to upstream, client: 10.10.176.4, server: , request: "CONNECT www.google.com:443 HT
TP/1.1", host: "www.google.com:443"                                                                                                                                                           
2020/04/07 22:20:42 [crit] 12#12: *35 bind(10.10.176.1) failed (22: Invalid argument) while connecting to upstream, client: 10.10.176.4, server: , request: "CONNECT www.google.com:443 HT
TP/1.1", host: "www.google.com:443"

It is apparently triggered by the ipv6 address seen here:

$ host www.google.com
www.google.com has address 172.217.11.164
www.google.com has IPv6 address 2607:f8b0:4007:802::2004

If I build nginx with ipv6 support disabled, then it suppresses the problem.

Ⅲ. Describe what you expected to happen

I expect the ngx_http_proxy_connect_create_peer function to choose an DNS result of the same family as the address specified by my proxy_connect_bind setting, however instead it appears to choose a random address/family with this code:

i = ngx_random() % ur->naddrs;  /* i<-0 for ur->naddrs == 1 */

Ⅳ. How to reproduce it (as minimally and precisely as possible)

1. Build nginx with ipv6 support enabled
2. Use proxy_connect_bind to select a ipv4 address
3. Use HTTPS_PROXY with curl https://www.google.com

Ⅴ. Anything else we need to know?

Ⅵ. Environment:

1. Tengine/Nginx/OpenResty version (use sbin/nginx -v):

nginx version: nginx/1.16.1

2. Which patch do you use?

proxy_connect_rewrite_101504.patch

[bkda]

Same issue, I'm curious about this, and I got this error randomly, sometimes I got 200 OK response.

proxy_connect: connection error while connecting to upstream, client: 172.17.0.1, server: localhost

[bkda]

@zmedico I have solved this by adding resolver 192.168.65.1 ipv6=off; , actually you can choose another nameserver, I got this from /etc/resolv.conf in my container.

server {
listen *:80;
listen *:443;
server_name localhost;
resolver 192.168.65.1 ipv6=off;
resolver_timeout 30s;

[chobits]

Has reproduced this issue, let me check, i got the similar error log as following :

2020/06/26 16:28:50 [crit] 87280#0: *6 bind(127.0.0.1) failed (47: Address family not supported by protocol family) 
while connecting to upstream, client: 127.0.0.1, server: localhost, request: "CONNECT www.google.com:443 HTTP/1.1", 
host: "www.google.com:443"

For macOS bind manpage: https://developer.apple.com/library/archive/documentation/System/Conceptual/ManPages_iPhoneOS/man2/bind.2.html

 [EAFNOSUPPORT]     address is not valid for the address family of socket.

[chobits]

For nginx proxy module, proxy_bind has the same problem. And it does not auto-select IPv4/IPv6 address.

[chobits]

Hi all,

I think the easy way to fix this issue is to disable ipv6 for resolver directive as #147 (comment) says.

resolver <address> ipv6=off;

Trying to fix this at the code level is a little bit complicated, which will create a tight coupling between resolver and proxy_connect_bind. Also note that this issue will occur for resolver and proxy_bind directives in nginx core.

[chobits]

Hi

Still there? I am closing this issue, if you still have this issue, please reopen it!

BTW, I added this issue into FAQ of this project. See https://github.com/chobits/ngx_http_proxy_connect_module/wiki/FAQ#how-to-solve-failure-of-proxy_connect_bind-ipv4-with-backend-server-ipv6-address.

[zmedico]

Hi

Still there? I am closing this issue, if you still have this issue, please reopen it!

BTW, I added this issue into FAQ of this project. See https://github.com/chobits/ngx_http_proxy_connect_module/wiki/FAQ#how-to-solve-failure-of-proxy_connect_bind-ipv4-with-backend-server-ipv6-address.

Thanks! I can confirm that this solves the problem for me.