Remote address is @ when binding to UNIX domain socket

[Exagone313]

What happened?

When using bind to a UNIX domain socket, $_SERVER['REMOTE_ADDR'] is @, which breaks many applications expecting an IP address in this field.

Steps to reproduce:

Caddyfile:

{
	log {
		output stderr
		level DEBUG
	}

	auto_https off
}

http:// {
	log {
		output stderr
		level DEBUG
	}

	bind unix//mnt/caddy.sock|0222
	root /mnt

	php_server
}

index.php:

<?=$_SERVER['REMOTE_ADDR'] . "\n";

Start FrankenPHP, e.g. with Podman (Docker should work too, or adapt bind and root paths in Caddyfile if using host build):

podman run -d --name frankenphp --rm -v "${PWD}":/mnt docker.io/dunglas/frankenphp:1.12-php8.4-trixie frankenphp run --config /mnt/Caddyfile

Request the socket:

curl --unix-socket caddy.sock http://localhost/

Response:

@

(To remove the container, run podman rm -f frankenphp)

This @ comes from Go's internals, see this issue for more information. In our case, request.RemoteAddr is @ here:

frankenphp/cgi.go

Line 53 in 64bb386

ip = request.RemoteAddr

Proposed solution: for this special case, set remote address to 127.0.0.1 or ::1... But feels wrong to hardcode this value.

Alternative solution: don't bind to a UNIX domain socket with FrankenPHP...

Build Type

Docker (Debian Trixie)

Worker Mode

No

Operating System

GNU/Linux

CPU Architecture

x86_64

PHP configuration

phpinfo() output

defaults

Relevant log output

Relevant log output

{"level":"debug","ts":1780220477.5129018,"logger":"http.handlers.rewrite","msg":"rewrote request","request":{"remote_ip":"@","remote_port":"","client_ip":"@","proto":"HTTP/1.1","method":"GET","host":"localhost","uri":"/index.php","headers":{"User-Agent":["curl/8.20.0"],"Accept":["*/*"]}},"method":"GET","uri":"/index.php"}
{"level":"info","ts":1780220477.5133996,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"@","remote_port":"","client_ip":"@","proto":"HTTP/1.1","method":"GET","host":"localhost","uri":"/","headers":{"User-Agent":["curl/8.20.0"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.00064167,"size":2,"status":200,"resp_headers":{"Server":["FrankenPHP Caddy"],"X-Powered-By":["PHP/8.4.21"],"Content-Type":["text/html; charset=UTF-8"]}}

[Exagone313]

Something that I didn't add in this issue: I'm planning to use this behind an HTTP reverse proxy. So the real external IP address will not be directly available in REMOTE_ADDR (it is available in the X-Forwarded-For header, though, but not at the transport layer).

The idea is to experiment unix domain sockets as a solution to let multiple users expose services securely to the reverse proxy as ports are not reserved to a single user (of course there are other solutions based on network namespaces or other virtual networking).

[dunglas]

This looks intended to me. Go, and so Caddy and FrankenPHP, as well as ss, netstat etc return @ in for the IP address when using UNIX sockets.

This a feature. Returning 127.0.0.1 would prevent detecting a socket is used, and will create an inconsistency with how Caddy+FPM works.

IMHO, apps not supporting @ should be updated, instead of modifying this (quite rare but standard) behavior.

[Exagone313]

@dunglas Are you aware if another SAPI could set REMOTE_ADDR to another value than an IP address?

[Exagone313]

You might be right, if using php-fpm with Caddy, when Caddy listens to a UNIX domain socket, it should have the same behavior that I'm dealing with. I'll verify it later.

https://github.com/caddyserver/caddy/blob/0e8eb41b87ab60803d48cb2a183face3f4e4248e/modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go#L348

To be noted, with nginx, you pass the REMOTE_ADDR variable so you are in a position to read HTTP headers to extract the external IP address and pass it to php-fpm. This just wasn't built for in Caddy.

https://github.com/nginx/nginx/blob/d44205284fa41662da803b796d6056fc1e59b1f3/conf/fastcgi_params#L18

EDIT: You can edit variables with env too in Caddy. FrankenPHP has env too but maybe only for _ENV? Need to make more tests I guess.