Merge pull request from GHSA-4w53-6jvp-gg52

* feat: Add support for allowed proxy addresses This commit adds support for allowed proxy addresses, which allows only connections from these IP ranges to send a proxy header based on the PROXY protocol. If the allowed proxy addresses are empty, the PROXY protocol support is disabled. * Update cmd/sshpiperd/main.go Co-authored-by: Peter G <[email protected]> --------- Co-authored-by: Peter G <[email protected]>
tg123 · May 9, 2024 · 70fb830 · 70fb830
1 parent eff7d1a
commit 70fb830
Showing 1 changed file with 16 additions and 1 deletion.
diff --git a/cmd/sshpiperd/main.go b/cmd/sshpiperd/main.go
@@ -160,6 +160,11 @@ func main() {
 				Usage:   "filter out [email protected] which cause client side warnings",
 				EnvVars: []string{"SSHPIPERD_DROP_HOSTKEYS_MESSAGE"},
 			},
+			&cli.StringSliceFlag{
+				Name:  "allowed-proxy-addresses",
+				Value: cli.NewStringSlice(),
+				Usage: "allowed proxy addresses, only connections from these ip ranges are allowed to send a proxy header based on the PROXY protocol, empty will disable the PROXY protocol support",
+			},
 		},
 		Action: func(ctx *cli.Context) error {
 			level, err := log.ParseLevel(ctx.String("log-level"))
@@ -185,7 +190,17 @@ func main() {
 			}
 
 			quit := make(chan error)
-			d.lis = &proxyproto.Listener{Listener: d.lis}
+
+			allowedproxyaddresses := ctx.StringSlice("allowed-proxy-addresses")
+
+			if len(allowedproxyaddresses) > 0 {
+				proxypolicy, err := proxyproto.LaxWhiteListPolicy(allowedproxyaddresses)
+				if err != nil {
+					return err
+				}
+
+				d.lis = &proxyproto.Listener{Listener: d.lis, Policy: proxypolicy}
+			}
 
 			var plugins []*plugin.GrpcPlugin