From 8ea9eb3f4fc9b7efbdefa39fe6483a3d402b2b44 Mon Sep 17 00:00:00 2001 From: Boshi Lian Date: Sun, 11 May 2025 02:20:16 -0700 Subject: [PATCH] feat: add proxy-read-header-timeout flag for PROXY protocol support (#586) fix: update go-proxyproto and golang.org/x/net dependencies --- cmd/sshpiperd/main.go | 12 +++++++++++- e2e/testplugin/testgetmetaplugin/main.go | 4 +--- go.mod | 4 ++-- go.sum | 8 ++++---- 4 files changed, 18 insertions(+), 10 deletions(-) diff --git a/cmd/sshpiperd/main.go b/cmd/sshpiperd/main.go index cd99d75e..8e01392a 100644 --- a/cmd/sshpiperd/main.go +++ b/cmd/sshpiperd/main.go @@ -184,6 +184,12 @@ func main() { Usage: "allowed proxy addresses, only connections from these ip ranges are allowed to send a proxy header based on the PROXY protocol, empty will disable the PROXY protocol support", EnvVars: []string{"SSHPIPERD_ALLOWED_PROXY_ADDRESSES"}, }, + &cli.DurationFlag{ + Name: "proxy-read-header-timeout", + Value: 200 * time.Millisecond, + Usage: "timeout for reading the PROXY protocol header, only used when --allowed-proxy-addresses is set", + EnvVars: []string{"SSHPIPERD_PROXY_READ_HEADER_TIMEOUT"}, + }, &cli.StringSliceFlag{ Name: "allowed-downstream-keyexchange-algos", Value: cli.NewStringSlice(), @@ -242,7 +248,11 @@ func main() { return err } - d.lis = &proxyproto.Listener{Listener: d.lis, Policy: proxypolicy} + d.lis = &proxyproto.Listener{ + Listener: d.lis, + Policy: proxypolicy, + ReadHeaderTimeout: ctx.Duration("proxy-read-header-timeout"), + } } var plugins []*plugin.GrpcPlugin diff --git a/e2e/testplugin/testgetmetaplugin/main.go b/e2e/testplugin/testgetmetaplugin/main.go index 6a411086..649c8e9f 100644 --- a/e2e/testplugin/testgetmetaplugin/main.go +++ b/e2e/testplugin/testgetmetaplugin/main.go @@ -11,14 +11,12 @@ import ( func main() { libplugin.CreateAndRunPluginTemplate(&libplugin.PluginTemplate{ - Name: "getmeta", + Name: "getmeta", CreateConfig: func(c *cli.Context) (*libplugin.SshPiperPluginConfig, error) { - return &libplugin.SshPiperPluginConfig{ PasswordCallback: func(conn libplugin.ConnMetadata, password []byte) (*libplugin.Upstream, error) { - target := conn.GetMeta("targetaddr") host, port, err := libplugin.SplitHostPortForSSH(target) diff --git a/go.mod b/go.mod index a87f9672..fb873e12 100644 --- a/go.mod +++ b/go.mod @@ -11,7 +11,7 @@ require ( github.com/docker/docker v28.1.1+incompatible github.com/google/uuid v1.6.0 github.com/patrickmn/go-cache v2.1.0+incompatible - github.com/pires/go-proxyproto v0.6.2 + github.com/pires/go-proxyproto v0.8.1 github.com/sirupsen/logrus v1.9.3 github.com/tg123/go-htpasswd v1.2.4 github.com/tg123/jobobject v0.1.0 @@ -82,7 +82,7 @@ require ( github.com/spf13/pflag v1.0.5 // indirect github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 // indirect golang.org/x/mod v0.21.0 // indirect - golang.org/x/net v0.38.0 // indirect + golang.org/x/net v0.39.0 // indirect golang.org/x/oauth2 v0.27.0 // indirect golang.org/x/sys v0.33.0 // indirect golang.org/x/term v0.32.0 diff --git a/go.sum b/go.sum index 79cf8d65..c6776af2 100644 --- a/go.sum +++ b/go.sum @@ -111,8 +111,8 @@ github.com/opencontainers/image-spec v1.0.2 h1:9yCKha/T5XdGtO0q9Q9a6T5NUCsTn/DrB github.com/opencontainers/image-spec v1.0.2/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0= github.com/patrickmn/go-cache v2.1.0+incompatible h1:HRMgzkcYKYpi3C8ajMPV8OFXaaRUnok+kx1WdO15EQc= github.com/patrickmn/go-cache v2.1.0+incompatible/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ= -github.com/pires/go-proxyproto v0.6.2 h1:KAZ7UteSOt6urjme6ZldyFm4wDe/z0ZUP0Yv0Dos0d8= -github.com/pires/go-proxyproto v0.6.2/go.mod h1:Odh9VFOZJCf9G8cLW5o435Xf1J95Jw9Gw5rnCjcwzAY= +github.com/pires/go-proxyproto v0.8.1 h1:9KEixbdJfhrbtjpz/ZwCdWDD2Xem0NZ38qMYaASJgp0= +github.com/pires/go-proxyproto v0.8.1/go.mod h1:ZKAAyp3cgy5Y5Mo4n9AlScrkCZwUy0g3Jf+slqQVcuU= github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= @@ -200,8 +200,8 @@ golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk= golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44= golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM= -golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8= -golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8= +golang.org/x/net v0.39.0 h1:ZCu7HMWDxpXpaiKdhzIfaltL9Lp31x/3fCP11bc6/fY= +golang.org/x/net v0.39.0/go.mod h1:X7NRbYVEA+ewNkCNyJ513WmMdQ3BineSwVtN2zD/d+E= golang.org/x/oauth2 v0.27.0 h1:da9Vo7/tDv5RH/7nZDz1eMGS/q1Vv1N/7FCrBhI9I3M= golang.org/x/oauth2 v0.27.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=