Hi,

(first of all, apologies if this issue is already known or it's caused by something in our configuration)

We found a rather interesting issue in Ubuntu 22.04's tinyproxy package (version 1.11.0-1).

We have a setup where tinyproxy is used as a proxy allowing some servers in the internal network to access some pre-approved outside addresses. For this, we have Allow ACL's ("Allow 1.2.3.4", "Allow 1111:2222:3333:4444::42", etc) and a Filter file.

This used to work perfectly with Ubuntu 20.04 (which had Tinyproxy version 1.10.0-4).

I did a Ubuntu release upgrade to 22.04 (and Tinyproxy 1.11.0) and since then, I noticed that some requests to Tinyproxy where failing. The interesting bit was that these failed requests were logged as coming from IPv6 addresses that do not exist in the network.

After some head scratching, it seems like tinyproxy gets confused when it gets requests from both ipv4 and ipv6 hosts. Namely, the first proxied http:// request with different protocol seems to fail because tinyproxy uses incorrect (nonexistent) ipv6 address for ACL checks.

We found this was easily repeatable in our setup by manually running apt update in turn on two different hosts, both which were using tinyproxy to access the repositories; host1 was using ipv4 and host2 was using ipv6. For both hosts, first request got a 403 (and tinyproxy logged "Unauthorized connection from xx:xx"), all others worked.

It should be noted that our ACL's list full IPv4 and IPv6 addresses, we generally don't use masks for ACL's. Since only the last 32 bits of the logged IPv6 address were incorrect, having ACL's with masks would still let these requests thru.