open-vault/helper/proxyutil/proxyutil.go
Rémi Lapeyre e89bbd51d9
Add support for PROXY protocol v2 in TCP listener (#13540)
* Add support for PROXY protocol v2 in TCP listener

I did not find tests for this so I added one trying to cover different
configurations to make sure I did not break something. As far as I know,
the behavior should be exactly the same as before except for one thing
when proxy_protocol_behavior is set to "deny_unauthorized", unauthorized
requests were previously silently reject because of https://github.com/armon/go-proxyproto/blob/7e956b284f0a/protocol.go#L81-L84
but it will now be logged.

Also fixes https://github.com/hashicorp/vault/issues/9462 by adding
support for `PROXY UNKNOWN` for PROXY protocol v1.

Closes https://github.com/hashicorp/vault/issues/3807

* Add changelog
2022-03-08 12:13:00 -05:00

81 lines
2.1 KiB
Go

package proxyutil
import (
"errors"
"fmt"
"net"
"sync"
"time"
"github.com/hashicorp/go-secure-stdlib/parseutil"
sockaddr "github.com/hashicorp/go-sockaddr"
proxyproto "github.com/pires/go-proxyproto"
)
// ProxyProtoConfig contains configuration for the PROXY protocol
type ProxyProtoConfig struct {
sync.RWMutex
Behavior string
AuthorizedAddrs []*sockaddr.SockAddrMarshaler `json:"authorized_addrs"`
}
func (p *ProxyProtoConfig) SetAuthorizedAddrs(addrs interface{}) error {
aa, err := parseutil.ParseAddrs(addrs)
if err != nil {
return err
}
p.AuthorizedAddrs = aa
return nil
}
// WrapInProxyProto wraps the given listener in the PROXY protocol. If behavior
// is "use_if_authorized" or "deny_if_unauthorized" it also configures a
// SourceCheck based on the given ProxyProtoConfig. In an error case it returns
// the original listener and the error.
func WrapInProxyProto(listener net.Listener, config *ProxyProtoConfig) (net.Listener, error) {
config.Lock()
defer config.Unlock()
var newLn *proxyproto.Listener
switch config.Behavior {
case "use_always":
newLn = &proxyproto.Listener{
Listener: listener,
ReadHeaderTimeout: 10 * time.Second,
}
case "allow_authorized", "deny_unauthorized":
newLn = &proxyproto.Listener{
Listener: listener,
ReadHeaderTimeout: 10 * time.Second,
Policy: func(addr net.Addr) (proxyproto.Policy, error) {
config.RLock()
defer config.RUnlock()
sa, err := sockaddr.NewSockAddr(addr.String())
if err != nil {
return proxyproto.REJECT, fmt.Errorf("error parsing remote address: %w", err)
}
for _, authorizedAddr := range config.AuthorizedAddrs {
if authorizedAddr.Contains(sa) {
return proxyproto.USE, nil
}
}
if config.Behavior == "allow_authorized" {
return proxyproto.IGNORE, nil
}
return proxyproto.REJECT, errors.New(`upstream connection not trusted proxy_protocol_behavior is "deny_unauthorized"`)
},
}
default:
return listener, fmt.Errorf("unknown behavior type for proxy proto config")
}
return newLn, nil
}