engineering/sshpiper
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request from GHSA-4w53-6jvp-gg52

Browse source 
* feat: Add support for allowed proxy addresses

This commit adds support for allowed proxy addresses, which allows only connections from these IP ranges to send a proxy header based on the PROXY protocol. If the allowed proxy addresses are empty, the PROXY protocol support is disabled.

* Update cmd/sshpiperd/main.go

Co-authored-by: Peter G <97112726+pgibson1-godaddy@users.noreply.github.com>

---------

Co-authored-by: Peter G <97112726+pgibson1-godaddy@users.noreply.github.com>
This commit is contained in:
Boshi Lian 2024-05-09 13:53:36 -07:00 • committed by GitHub
parent eff7d1aca3
commit 70fb830dca
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 16 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

17
cmd/sshpiperd/main.go
View file

@ -160,6 +160,11 @@ func main() {
Usage: "filter out hostkeys-00@openssh.com which cause client side warnings",
EnvVars: []string{"SSHPIPERD_DROP_HOSTKEYS_MESSAGE"},
},
&cli.StringSliceFlag{
Name: "allowed-proxy-addresses",
Value: cli.NewStringSlice(),
Usage: "allowed proxy addresses, only connections from these ip ranges are allowed to send a proxy header based on the PROXY protocol, empty will disable the PROXY protocol support",
},
},
Action: func(ctx *cli.Context) error {
level, err := log.ParseLevel(ctx.String("log-level"))
@ -185,7 +190,17 @@ func main() {
}
quit := make(chan error)
d.lis = &proxyproto.Listener{Listener: d.lis}
allowedproxyaddresses := ctx.StringSlice("allowed-proxy-addresses")
if len(allowedproxyaddresses) > 0 {
proxypolicy, err := proxyproto.LaxWhiteListPolicy(allowedproxyaddresses)
if err != nil {
return err
}
d.lis = &proxyproto.Listener{Listener: d.lis, Policy: proxypolicy}
}
var plugins []*plugin.GrpcPlugin