From 01f85cf755204f4296b2687b7e19ee1032930d7c Mon Sep 17 00:00:00 2001 From: Nirmal Khanal Date: Thu, 23 Jul 2026 10:55:07 +0300 Subject: [PATCH] Fix parent negotiation after sending PROXY protocol header After 'parent ha' sends the PROXY v1 header, continue negotiating the real parent protocol (SOCKS5/CONNECT/etc.) instead of returning early. 'ha' used alone still sends the header and relays plain TCP. --- doc/html/howtoe.html | 13 ++++++++----- doc/html/howtor.html | 14 +++++++++----- doc/html/man5/3proxy.cfg.5.html | 13 +++++++++---- man/3proxy.cfg.5 | 13 ++++++++++--- src/redirect.c | 2 +- 5 files changed, 37 insertions(+), 18 deletions(-) diff --git a/doc/html/howtoe.html b/doc/html/howtoe.html index ad60364..6bc6fa9 100644 --- a/doc/html/howtoe.html +++ b/doc/html/howtoe.html @@ -1472,16 +1472,19 @@ socks -H -p1080

Sending PROXY protocol header to parent proxy:
Use the ha parent type to send a PROXY protocol v1 header to - the parent proxy. This must be the last parent in the chain: + the parent proxy. Place ha before the parent that should receive + the header; after the header is sent, parent protocol negotiation continues: 

 allow *
-parent 1000 ha
+parent 1000 ha 0.0.0.0 0
 parent 1000 socks5 parent.example.com 1080
-socks
+proxy

- This configuration sends the client IP information to the SOCKS5 parent proxy - via the PROXY protocol. + This configuration connects to the SOCKS5 parent, sends the PROXY protocol + header with the original client IP, then performs SOCKS5 negotiation before + relaying the client payload. The parent should use -H to accept + the header (for example socks -H).

  • How to set TCP maximum segment size (MSS)

    diff --git a/doc/html/howtor.html b/doc/html/howtor.html index a9d2c32..97113e8 100644 --- a/doc/html/howtor.html +++ b/doc/html/howtor.html @@ -1531,16 +1531,20 @@ socks -H -p1080

    Отправка заголовка PROXY протокола родительскому прокси:
    Используйте тип родительского прокси ha для отправки заголовка - PROXY протокола v1 родительскому прокси. Это должен быть последний родитель в цепочке: + PROXY протокола v1 родительскому прокси. Укажите ha перед родителем, + который должен получить заголовок; после отправки заголовка продолжается + хендшейк протокола родителя: 

     allow *
-parent 1000 ha
+parent 1000 ha 0.0.0.0 0
 parent 1000 socks5 parent.example.com 1080
-socks
+proxy

    - Эта конфигурация отправляет информацию об IP-адресе клиента SOCKS5 родительскому - прокси через PROXY протокол. + Эта конфигурация подключается к SOCKS5 родителю, отправляет PROXY заголовок + с исходным IP клиента, затем выполняет SOCKS5-хендшейк и только после этого + передаёт полезную нагрузку. Родитель должен использовать -H + (например socks -H).

  • Как установить максимальный размер сегмента TCP (MSS)

    diff --git a/doc/html/man5/3proxy.cfg.5.html b/doc/html/man5/3proxy.cfg.5.html index 847c159..dc18074 100644 --- a/doc/html/man5/3proxy.cfg.5.html +++ b/doc/html/man5/3proxy.cfg.5.html @@ -759,10 +759,15 @@ useful). Never use this option unless you know exactly you need it.
    admin     redirect request to local ´admin´ service (with -s parameter).
    -ha     send HAProxy PROXY protocol v1 header to parent -proxy. Must be the last in the proxy chain. Useful for -passing client IP information to the parent proxy. Example: -parent 1000 ha
    +ha send HAProxy PROXY protocol v1 header to the next +parent proxy (or to the destination if ha is used +alone). Place ha before the parent that should +receive the header; after the header is sent, negotiation +of that parent protocol continues (SOCKS, CONNECT, etc.). +Useful for passing client IP information to the parent +proxy. Example:
    +parent 1000 ha 0.0.0.0 0
    +parent 1000 socks5 parent.example.com 1080
    Use "+" proxy only with fakeresolve option
    Any parent type above can be suffixed with s (e.g. diff --git a/man/3proxy.cfg.5 b/man/3proxy.cfg.5 index 5d9ec0f..672e4c6 100644 --- a/man/3proxy.cfg.5 +++ b/man/3proxy.cfg.5 @@ -828,9 +828,16 @@ unless you know exactly you need it. .br \fBadmin\fR redirect request to local \'admin\' service (with -s parameter). .br -\fBha\fR send HAProxy PROXY protocol v1 header to parent proxy. Must be the last -in the proxy chain. Useful for passing client IP information to the parent proxy. -Example: parent 1000 ha +\fBha\fR send HAProxy PROXY protocol v1 header to the next parent proxy (or to +the destination if \fBha\fR is used alone). Place \fBha\fR before the parent +that should receive the header; after the header is sent, negotiation of that +parent protocol continues (SOCKS, CONNECT, etc.). Useful for passing client IP +information to the parent proxy. +Example: +.br + parent 1000 ha 0.0.0.0 0 +.br + parent 1000 socks5 parent.example.com 1080 .br Use "+" proxy only with \fBfakeresolve\fR option .br diff --git a/src/redirect.c b/src/redirect.c index 2fb967b..a796bae 100644 --- a/src/redirect.c +++ b/src/redirect.c @@ -375,7 +375,7 @@ int handleredirect(struct clientparam * param, struct ace * acentry){ ntohs(*SAPORT(¶m->sincl)) ); if(socksend(param, param->remsock, (unsigned char *)buf, len, conf.timeouts[CHAIN_TO])!=len) return 39; - return 0; + if(cur->type == R_HA) return 0; } } else {