Apply PROXY protocol wrapper to insecure listener when both are enabled

When both EnableProxyProtocol and InsecureAddress are configured, the
insecure listener (HTTP) was created without the PROXY protocol wrapper.
This caused 400 Bad Request errors when NLB sent PROXY protocol v2 headers
to the HTTP target port.

Now both the main (HTTPS) and insecure (HTTP) listeners get wrapped with
the PROXY protocol handler when EnableProxyProtocol is true.

This fixes HTTP->HTTPS redirects when NLB PROXY protocol v2 is enabled.

Signed-off-by: speruri <surya.srikar.peruri@zalando.de>

Author: speruri

skipper.go

@@ -1544,12 +1544,20 @@ func listenAndServeQuit(
 			log.Infof("Insecure listener on %v", o.InsecureAddress)
 
 			go func() {
-				l, err := listen(o, o.InsecureAddress, mtr)
+				insecureL, err := listen(o, o.InsecureAddress, mtr)
 				if err != nil {
 					log.Errorf("Failed to start insecure listener on %s: %v", o.InsecureAddress, err)
 				}
 
-				if err := srv.Serve(l); err != http.ErrServerClosed {
+				if o.EnableProxyProtocol {
+					insecureL, err = proxyListener(insecureL, o)
+					if err != nil {
+						log.Errorf("Failed to start proxy listener for insecure address: %v", err)
+						return
+					}
+				}
+
+				if err := srv.Serve(insecureL); err != http.ErrServerClosed {
 					log.Errorf("Insecure listener serve failed: %v", err)
 				}
 			}()