[PR] [fix][proxy] Fix Proxy Protocol forwarding for UNKNOWN and IPv6 [pulsar]

["Denovo1998 (via GitHub)" <gi...@apache.org>]

Denovo1998 opened a new pull request, #26999:
URL: https://github.com/apache/pulsar/pull/26999

   ### Motivation
   
   When `haProxyProtocolEnabled` is enabled, valid V1 `UNKNOWN` and V2 `LOCAL`/`UNKNOWN` headers are decoded without source or destination addresses. The proxy dereferences these null addresses when forwarding the header, causing the backend connection to close and client subscriptions to fail.
   
   IPv6 clients without an incoming Proxy Protocol header also fail to connect because the proxy always constructs a `TCP4` header, which Netty rejects for IPv6 addresses.
   
   These issues predate #26811 and were identified while reviewing its Proxy Protocol forwarding path.
   
   ### Modifications
   
   - Forward addressless headers as `PROXY UNKNOWN\r\n` without accessing their null address fields.
   - Select `TCP4` or `TCP6` according to the client socket address when generating a header.
   - Add client/proxy/broker tests for V1 UNKNOWN, V2 LOCAL/UNKNOWN, TCP4, TCP6, and V2 headers containing TLVs.
   - Add an IPv6 fallback test that activates the backend handler and decodes the generated header with Netty.
   
   ### Verifying this change
   
   - [x] Make sure that the change passes the CI checks.
   
   This change added tests and can be verified as follows:
   
   - On the unpatched code, four of the seven added scenarios fail: the three addressless-header cases and the IPv6 fallback case. All seven pass with the fix.
   - All 20 tests in the three related test classes passed locally with retries disabled.
   - `quickCheck` passed locally.
   - The IPv6 fallback test uses an `EmbeddedChannel` with IPv6 endpoints because the test JVM forces the IPv4 stack; it does not open an IPv6 socket.
   
   ```bash
   ./gradlew :pulsar-proxy:test \
     --tests org.apache.pulsar.proxy.server.ProxyEnableHAProxyProtocolTest \
     --tests org.apache.pulsar.proxy.server.DirectProxyHandlerAuthTest \
     --tests org.apache.pulsar.proxy.server.ProxyConnectionTest \
     quickCheck \
     --max-workers=1 \
     -PtestMaxParallelForks=1 \
     -PtestRetryCount=0 \
     -PtestFailFast=false
   ```
   
   ### Does this pull request potentially affect one of the following parts:
   
   <!-- DO NOT REMOVE THIS SECTION. CHECK THE PROPER BOX ONLY. -->
   
   *If the box was checked, please highlight the changes*
   
   - [ ] Dependencies (add or upgrade a dependency)
   - [ ] The public API
   - [ ] The schema
   - [ ] The default values of configurations
   - [ ] The threading model
   - [x] The binary protocol (HAProxy Proxy Protocol header generation)
   - [ ] The REST endpoints
   - [ ] The admin CLI options
   - [ ] The metrics
   - [ ] Anything that affects deployment
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [fix][proxy] Fix Proxy Protocol forwarding for UNKNOWN and IPv6 [pulsar]

["lhotari (via GitHub)" <gi...@apache.org>]

lhotari merged PR #26999:
URL: https://github.com/apache/pulsar/pull/26999


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org