Changeset 418 in code

Timestamp:

Sep 7, 2020, 7:28:24 PM (5 years ago)

Author:

contact

Message:

Add support for the PROXY protocol

IPs whitelisted in accept-proxy-ip can now use the PROXY protocol to
indicate the original source/destination addresses.

Closes: ​https://todo.sr.ht/~emersion/soju/81

Location:

trunk

Files:

• cmd/soju/main.go (modified) (5 diffs)
• go.mod (modified) (1 diff)
• go.sum (modified) (1 diff)

trunk/cmd/soju/main.go

@@ -9 +9 @@
         "net/url"
         "strings"
+
+        "github.com/pires/go-proxyproto"
 
         "git.sr.ht/~emersion/soju"
@@ -86 +88 @@
                                 log.Fatalf("failed to start TLS listener on %q: %v", listen, err)
                         }
+                        ln = proxyProtoListener(ln, srv)
                         go func() {
                                 log.Fatal(srv.Serve(ln))
@@ -98 +101 @@
                                 log.Fatalf("failed to start listener on %q: %v", listen, err)
                         }
+                        ln = proxyProtoListener(ln, srv)
                         go func() {
                                 log.Fatal(srv.Serve(ln))
@@ -139 +143 @@
                                 log.Fatalf("failed to start listener on %q: %v", listen, err)
                         }
+                        ln = proxyProtoListener(ln, srv)
                         go func() {
                                 log.Fatal(srv.Identd.Serve(ln))
@@ -150 +155 @@
         log.Fatal(srv.Run())
 }
+
+func proxyProtoListener(ln net.Listener, srv *soju.Server) net.Listener {
+        return &proxyproto.Listener{
+                Listener: ln,
+                Policy: func(upstream net.Addr) (proxyproto.Policy, error) {
+                        tcpAddr, ok := upstream.(*net.TCPAddr)
+                        if !ok {
+                                return proxyproto.IGNORE, nil
+                        }
+                        if srv.AcceptProxyIPs.Contains(tcpAddr.IP) {
+                                return proxyproto.USE, nil
+                        }
+                        return proxyproto.IGNORE, nil
+                },
+        }
+}

trunk/go.mod

@@ -8 +8 @@
         github.com/klauspost/compress v1.10.11 // indirect
         github.com/mattn/go-sqlite3 v1.14.1
+        github.com/pires/go-proxyproto v0.1.3
         golang.org/x/crypto v0.0.0-20200820211705-5c72a883971a
         golang.org/x/sys v0.0.0-20200824131525-c12d262b63d8 // indirect

trunk/go.sum

@@ -51 +51 @@
 github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742 h1:Esafd1046DLDQ0W1YjYsBW+p8U2u7vzgW2SQVmlNazg=
 github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/pires/go-proxyproto v0.1.3 h1:2XEuhsQluSNA5QIQkiUv8PfgZ51sNYIQkq/yFquiSQM=
+github.com/pires/go-proxyproto v0.1.3/go.mod h1:Odh9VFOZJCf9G8cLW5o435Xf1J95Jw9Gw5rnCjcwzAY=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=