Skip to content

feat: support passing proxy_protocol to reality backend#2693

Open
aJC7737 wants to merge 1 commit intoMetaCubeX:Alphafrom
aJC7737:Alpha
Open

feat: support passing proxy_protocol to reality backend#2693
aJC7737 wants to merge 1 commit intoMetaCubeX:Alphafrom
aJC7737:Alpha

Conversation

@aJC7737
Copy link
Copy Markdown

@aJC7737 aJC7737 commented Apr 12, 2026

TL;DR: This change adds proxy-protocol support to Reality inbound so backends (for example NGINX) can see the original client source address.

What This PR Adds

  1. New Reality inbound option: proxy-protocol

    • 0: disabled (default)
    • 1: send PROXY protocol v1 header
    • 2: send PROXY protocol v2 header
  2. PROXY header forwarding for Reality backend connections

    • Adds ProxyProtocol to Reality runtime config.
    • Validates allowed values (0/1/2).
    • When enabled, writes the PROXY header immediately after dialing the Reality backend and before normal payload forwarding.
  3. Source/destination address propagation

    • Captures inbound connection remote/local TCP addresses.
    • Passes them through context so generated PROXY headers contain:
      • original client source address/port
      • inbound listener destination address/port
  4. PROXY protocol encoding support

    • Implements dedicated builders for:
      • PROXY v1 (text format)
      • PROXY v2 (binary format)
  5. Documentation updates

    • Adds reality-config.proxy-protocol examples in config documentation.

Tests

Added/updated unit tests covering:

  • disabled mode (proxy-protocol = 0, no header emitted)
  • v1 header generation/writing
  • v2 header generation/writing
  • missing address context error path
  • invalid version error path

Scope

  • Inbound Reality listener path only.
  • No outbound behavior changes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant