Re: relayd: receive the PROXY protocol (v1 and v2) on listeners

On Mon, 20 Jul 2026 10:01:13 +0200,
Romain FABBRI <[email protected]> wrote:
> 
> 3) UDP.
> 
> Right -- and rather than refuse it, I implemented it.  On a UDP relay
> the header shares the datagram with the payload, as the spec requires,
> so relay_udp_server() parses it in place, adopts the advertised source
> and strips it before the payload is handled.  The TCP and UDP paths
> share one parse function.  I checked it end to end: a datagram carrying
> a v1 header plus a DNS query reaches the backend stripped of the header,
> and "log connection" shows the advertised source.
> 
> Tested on -current and on 7.9-release: no new warnings, and relayd -n
> accepts a proxy-protocol listener while still rejecting a transparent
> forward.  A small unit harness covers v1/v2 (TCP and UDP families),
> IPv6, LOCAL, bad input, a partial header (consumed, socket left empty)
> and a byte-by-byte trickle.  The regress tests (v1, v2, and a from-rule
> filter) pass in copy and splice mode, and I checked by hand that a TLS
> listener reads the header first and then completes the handshake.
> 
> The revised diff (code + regress tests) is here:
> https://codeberg.org/cybercloud/openbsd-relayd-proxyproto/src/branch/main/patches/current/0001-relayd-proxy-protocol-receive.patch
> 

I used diff from commit fd4fadca6e9c4932847a7deb888f432f4dd6f9e8

I stop only in UDP point, I do not say that this is only one here, but I
give up and stop doing review after this.

So, UDP, two points:

1. Your new logic literally replaces destination address and that replaced
   address is used by sendto(), what means that upstream will reply directly
   to the client, not to the relayd proxy.

2. I think that forward to nat lookup will fail on differnet address
   families, because pxdst is actually ignored.

-- 
wbr, Kirill