Alist with http3

[mengguyi]

我通过手动编译 nginx 使 nginx 支持 http3
但当我为 alist 配置好了 http3 之后却导致访问时出现 400 Bad Request: missing required Host header
操作系统是 Debian 12
下面是我编译 nginx 的步骤和 nginx 配置文件

apt install build-essential libpcre3-dev libssl-dev zlib1g-dev libxml2-dev libxslt1-dev libgd-dev libgeoip-dev libperl-dev
wget https://nginx.org/download/nginx-1.25.1.tar.gz
tar -zxvf nginx-1.25.1.tar.gz
cd nginx-1.25.1
./configure --with-cc-opt='-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -fPIC -Wdate-time -D_FORTIFY_SOURCE=2' --with-ld-opt='-Wl,-z,relro -Wl,-z,now -fPIC' --prefix=/usr/share/nginx --conf-path=/etc/nginx/nginx.conf --http-log-path=/var/log/nginx/access.log --error-log-path=stderr --lock-path=/var/lock/nginx.lock --pid-path=/run/nginx.pid --modules-path=/usr/lib/nginx/modules --http-client-body-temp-path=/var/lib/nginx/body --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-proxy-temp-path=/var/lib/nginx/proxy --http-scgi-temp-path=/var/lib/nginx/scgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-compat --with-debug --with-pcre-jit --with-http_ssl_module --with-http_stub_status_module --with-http_realip_module --with-http_auth_request_module --with-http_v2_module --with-http_dav_module --with-http_slice_module --with-threads --with-http_addition_module --with-http_flv_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_mp4_module --with-http_random_index_module --with-http_secure_link_module --with-http_sub_module --with-mail_ssl_module --with-stream_ssl_module --with-stream_ssl_preread_module --with-stream_realip_module --with-http_geoip_module=dynamic --with-http_image_filter_module=dynamic --with-http_perl_module=dynamic --with-http_xslt_module=dynamic --with-mail=dynamic --with-stream=dynamic --with-stream_geoip_module=dynamic --with-http_v3_module
make
make install

mkdir -p /var/lib/nginx
mkdir -p /var/lib/nginx/body
mkdir -p /var/lib/nginx/fastcgi
mkdir -p /var/lib/nginx/proxy
mkdir -p /var/lib/nginx/scgi
mkdir -p /var/lib/nginx/uwsgi

把下面代码写入 /usr/lib/systemd/system/nginx.service

[Unit]
Description=A high performance web server and a reverse proxy server
Documentation=man:nginx(8)
After=network-online.target remote-fs.target nss-lookup.target
Wants=network-online.target

[Service]
Type=forking
PIDFile=/run/nginx.pid
ExecStartPre=/usr/sbin/nginx -t -q -g 'daemon on; master_process on;'
ExecStart=/usr/sbin/nginx -g 'daemon on; master_process on;'
ExecReload=/usr/sbin/nginx -g 'daemon on; master_process on;' -s reload
ExecStop=-/sbin/start-stop-daemon --quiet --stop --retry QUIT/5 --pidfile /run/nginx.pid
TimeoutStopSec=5
KillMode=mixed

[Install]
WantedBy=multi-user.target

启动 nginx
systemctl start nginx

nginx 配置文件

upstream alist {
  server unix:/opt/alist/data/socket/alist.socket fail_timeout=0;
}

log_format alist_ssl_access '$remote_addr - $remote_user [$time_local] "$request_method $server_protocol" $status $body_bytes_sent "$http_user_agent"';

## Redirects all HTTP traffic to the HTTPS host
server {
  listen 0.0.0.0:80;
  listen [::]:80;
  server_name drive.mengguyi.com;
  server_tokens off; ## Don't show the nginx version number, a security best practice
  return 301 https://$http_host$request_uri;
  access_log  /var/log/nginx/alist_access.log alist_ssl_access;
  error_log   /var/log/nginx/alist_error.log;
}

## HTTPS host
server {
  listen 0.0.0.0:443 ssl http2;
  listen [::]:443 ssl http2;
  listen 0.0.0.0:443 quic;
  listen [::]:443 quic;
  add_header Alt-Svc 'h3=":443"; ma=86400';
  server_name drive.mengguyi.com;
  server_tokens off; ## Don't show the nginx version number, a security best practice

  ## Strong SSL Security
  ## https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html & https://cipherli.st/
  ssl_certificate /etc/nginx/cert/mengguyi.com.pem;
  ssl_certificate_key /etc/nginx/cert/mengguyi.com.key;

  ssl_session_timeout 1d;
  ssl_session_cache shared:SSL:10m;
  ssl_session_tickets off;

  # These settings are in line with the modern settings from https://ssl-config.mozilla.org/
  # and are supported by all still-supported browsers since 2019. If you have specific needs
  # for older settings, please consult the intermediate settings there.
  ssl_protocols TLSv1.3;
  ssl_prefer_server_ciphers off;

  real_ip_header X-Real-IP; ## X-Real-IP or X-Forwarded-For or proxy_protocol
  real_ip_recursive off;    ## If you enable 'on'
  ## If you have a trusted IP address, uncomment it and set it
  # set_real_ip_from YOUR_TRUSTED_ADDRESS; ## Replace this with something like 192.168.1.0/24

  access_log  /var/log/nginx/alist_access.log alist_ssl_access;
  error_log   /var/log/nginx/alist_error.log;

  location / {
    client_max_body_size 0;
    gzip off;

    proxy_read_timeout      300;
    proxy_connect_timeout   300;
    proxy_redirect          off;

    proxy_http_version 1.1;

    proxy_set_header    Host                $http_host;
    proxy_set_header    X-Real-IP           $remote_addr;
    proxy_set_header    X-Forwarded-Ssl     on;
    proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
    proxy_set_header    X-Forwarded-Proto   $scheme;
    proxy_set_header    Upgrade             $http_upgrade;

    proxy_pass http://alist;
  }
  error_page 404 /404.html;
  error_page 422 /422.html;
  error_page 500 /500.html;
  error_page 502 /502.html;
  error_page 503 /503.html;
  location ~ ^/(404|422|500|502|503)\.html$ {
    root /opt/www-data/general-pages;
    internal;
  }
}

但我访问 alist 的网址时却得到

[DLYSY]

之前的解释是错的（避免误导已删除），我现在已经解决这个问题，我来简单分析解决方法吧

为什么产生这个问题？

一般来说反向代理都会有这样的语句：

proxy_set_header Host $http_host

h3不再使用请求标头Host，而是转而使用:authority（注意冒号不能省），而nginx的反向代理向后端发送的是http/1.1，nginx在在收到h3请求时，由于不存在$http_host，所以上面的语句会将Host设置为空，所以后端无法正常识别代理流量，就会导致错误。

怎么解决？

知道问题原理就好办了，既然h3没有Host，我们就从:authority加上，不过还要考虑h2、h1.1等情况，所以我们可以把原来的改写为：

map $http3 $mapd_host{
    default $http_host;
    "h3" $http_:authority;
}
proxy_set_header Host $mapd_host;

这样走h3时使用:authority，其他情况使用host，就可以解决该问题。