Fix PROXY protocol v2 cache lookup by client IP instead of connection addresses

Store SSL state keyed by upstream client IP from PROXY header, not by
the full connection address pair. This fixes cache misses when there's
a mismatch between actual TCP connection addresses (IPv6 on dualstack
listener) and the original client IP from the PROXY protocol header.

Changes:
- Cache now stores by client host IP as primary key
- Fallback lookup by full address pair for actual connections
- Extract client host from remoteAddr in GetProxyProtoSSL
- Add logging to identify cache hits/misses

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: speruri

proxylistener/proxylistener.go

@@ -13,9 +13,17 @@ import (
 )
 
 // proxySSLCache is a global, thread-safe cache of SSL information from PROXY protocol v2 TLVs.
-// Keys are strings in the format "remoteAddr|localAddr", values are bools indicating SSL/TLS presence.
+// Keys are strings in the format "sourceIP:port" (upstream/original client), values are bools indicating SSL/TLS presence.
 var proxySSLCache sync.Map
 
+// Extract host from address string (handles both "host:port" and "[::1]:port" formats)
+func extractHost(addr string) string {
+	if host, _, err := net.SplitHostPort(addr); err == nil {
+		return host
+	}
+	return addr
+}
+
 const (
 	defaultReadHeaderTimeout = time.Second // 10s seems too long https://github.com/pires/go-proxyproto/blob/5c8010d2392f09ce18169631c024aceae758335a/protocol.go#L28
 	defaultReadBufferSize    = 256         // https://github.com/pires/go-proxyproto/blob/5c8010d2392f09ce18169631c024aceae758335a/protocol.go#L21
@@ -119,8 +127,18 @@ func (tl *tlvExtractorListener) Accept() (net.Conn, error) {
 					log.Printf("[tlvExtractorListener] TLV[%d]: Type=%d, Len=%d", i, tlv.Type, len(tlv.Value))
 				}
 				ssl := hasTLVSSL(tlvs)
+
+				// Get the upstream client address from PROXY protocol header
+				// This is the original client IP that we want to preserve
+				if header.SourceAddr != nil {
+					upstreamClientKey := header.SourceAddr.String()
+					log.Printf("[tlvExtractorListener] Storing SSL=%v for upstream client %s", ssl, upstreamClientKey)
+					proxySSLCache.Store(upstreamClientKey, ssl)
+				}
+
+				// Also store using actual connection addresses as fallback
 				key := conn.RemoteAddr().String() + "|" + conn.LocalAddr().String()
-				log.Printf("[tlvExtractorListener] Storing SSL=%v for key=%s", ssl, key)
+				log.Printf("[tlvExtractorListener] Storing SSL=%v for actual conn key=%s (fallback)", ssl, key)
 				proxySSLCache.Store(key, ssl)
 			}
 		} else {
@@ -155,6 +173,9 @@ func (c *tlvCacheCleanupConn) Write(b []byte) (int, error) {
 }
 
 func (c *tlvCacheCleanupConn) Close() error {
+	// Clean up both cache keys if they were stored
+	// Note: We don't clean up by host-only key because multiple connections
+	// from the same client may be active simultaneously
 	key := c.conn.RemoteAddr().String() + "|" + c.conn.LocalAddr().String()
 	proxySSLCache.Delete(key)
 	return c.conn.Close()
@@ -193,15 +214,31 @@ func hasTLVSSL(tlvs []proxyproto.TLV) bool {
 	return false
 }
 
-// GetProxyProtoSSL retrieves the SSL/TLS state for a given connection
+// GetProxyProtoSSL retrieves the SSL/TLS state for a given upstream client address
 // Returns (ssl, ok) where ssl is true if the connection had SSL TLV data
 // and ok is true if the lookup was successful
 func GetProxyProtoSSL(remoteAddr, localAddr string) (bool, bool) {
+	// First try to look up by upstream client IP from X-Forwarded-For or PROXY protocol
+	// Extract just the host part (without port)
+	clientHost := extractHost(remoteAddr)
+	if val, ok := proxySSLCache.Load(clientHost); ok {
+		ssl, ok := val.(bool)
+		if ok {
+			log.Printf("[GetProxyProtoSSL] Found SSL=%v for client %s (by host)", ssl, clientHost)
+			return ssl, ok
+		}
+	}
+
+	// Fallback: try the full address pair (for actual connection matches)
 	key := remoteAddr + "|" + localAddr
-	val, ok := proxySSLCache.Load(key)
-	if !ok {
-		return false, false
+	if val, ok := proxySSLCache.Load(key); ok {
+		ssl, ok := val.(bool)
+		if ok {
+			log.Printf("[GetProxyProtoSSL] Found SSL=%v for key %s (fallback)", ssl, key)
+			return ssl, ok
+		}
 	}
-	ssl, ok := val.(bool)
-	return ssl, ok
+
+	log.Printf("[GetProxyProtoSSL] NOT found: client=%s remoteAddr=%s localAddr=%s", clientHost, remoteAddr, localAddr)
+	return false, false
 }