reverse_proxy: use http1 for outbound tls requests with placeholder that are likely websockets (#7296)

WeidiDeng committed Oct 10, 2025 at 00:36 UTC 2ec28bca43e5269511f8d9c1656244dd84acdad9

3 files changed +18

modules/caddyhttp/reverseproxy/hosts.go

@@ -281,3 +281,7 @@ const proxyProtocolInfoVarKey = "reverse_proxy.proxy_protocol_info"

281 type ProxyProtocolInfo struct {

282 AddrPort netip.AddrPort

283 }

284 +

285 +// tlsH1OnlyVarKey is the key used that indicates the connection will use h1 only for TLS.

286 +// https://github.com/caddyserver/caddy/issues/7292

287 +const tlsH1OnlyVarKey = "reverse_proxy.tls_h1_only"

modules/caddyhttp/reverseproxy/httptransport.go

@@ -409,6 +409,14 @@ func (h *HTTPTransport) NewTransport(caddyCtx caddy.Context) (*http.Transport, e

409 repl := ctx.Value(caddy.ReplacerCtxKey).(*caddy.Replacer)

410 tlsConfig := rt.TLSClientConfig.Clone()

411 tlsConfig.ServerName = repl.ReplaceAll(tlsConfig.ServerName, "")

412 +

413 + // h1 only

414 + if caddyhttp.GetVar(ctx, tlsH1OnlyVarKey) == true {

415 + // stdlib does this

416 + // https://github.com/golang/go/blob/4837fbe4145cd47b43eed66fee9eed9c2b988316/src/net/http/transport.go#L1701

417 + tlsConfig.NextProtos = nil

418 + }

419 +

420 tlsConn := tls.Client(conn, tlsConfig)

421

422 // complete the handshake before returning the connection

modules/caddyhttp/reverseproxy/reverseproxy.go

@@ -726,6 +726,12 @@ func (h Handler) prepareRequest(req *http.Request, repl *caddy.Replacer) (*http.

726 proxyProtocolInfo := ProxyProtocolInfo{AddrPort: addrPort}

727 caddyhttp.SetVar(req.Context(), proxyProtocolInfoVarKey, proxyProtocolInfo)

728

729 + // some of the outbound requests require h1 (e.g. websocket)

730 + // https://github.com/golang/go/blob/4837fbe4145cd47b43eed66fee9eed9c2b988316/src/net/http/request.go#L1579

731 + if isWebsocket(req) {

732 + caddyhttp.SetVar(req.Context(), tlsH1OnlyVarKey, true)

733 + }

734 +

735 // Add the supported X-Forwarded-* headers

736 err = h.addForwardedHeaders(req)

737 if err != nil {