Nginx ssl_preread无法处理SOCKS 5代理协议

Question

我正在尝试在Nginx 1.17的同一端口上运行SSL和非SSL(在我的例子中是SOCKS 5代理)协议。根据Nginx document的说法，这在SSH上工作得很好。但它对Socks代理不起作用，而且超时。我认为问题出在ssl_preread on上，因为当我删除它并将所有流量转发到上游的socks时，它可以正常工作。Nginx在使用ssl_preread时处理Socks 5代理有问题吗？

stream {
    upstream socks {
        server 127.0.0.1:1080; #SOCKS 5 proxy server
    }

    upstream https {
        server 127.0.0.1:8443;
    }

    map $ssl_preread_protocol $upstream {
        default socks;
        "TLSv1.2" https;
        "TLSv1.3" https;
        "TLSv1.1" https;
        "TLSv1.0" https;
    }

    server {
        listen 443;
        proxy_pass $upstream;
        ssl_preread on;
    }
}

Answer 1

我认为您必须将标头升级和连接传递到代理服务器，请参阅https://nginx.org/en/docs/http/websocket.html

  ...
  map $http_upgrade $connection_upgrade {
      default upgrade;
      ''      close;
  }

  server {
     listen 443;
     proxy_pass $upstream;
     ssl_preread on;
     proxy_http_version 1.1;
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection $connection_upgrade;
  }
  ...