Kyle Isom
1ad9a1a43b
New internal/proxyproto package implements PROXY protocol parsing and writing without buffering past the header boundary (reads exact byte counts so the connection is correctly positioned for SNI extraction). Parser: auto-detects v1 (text) and v2 (binary) by first byte. Parses TCP4/TCP6 for both versions plus v2 LOCAL command. Enforces max header sizes and read deadlines. Writer: generates v2 binary headers for IPv4 and IPv6 with PROXY command. Server integration: - Receive: when listener.ProxyProtocol is true, parses PROXY header before firewall check. Real client IP from header is used for firewall evaluation and logging. Malformed headers cause RST. - Send: when route.SendProxyProtocol is true, writes PROXY v2 header to backend before forwarding the ClientHello bytes. Tests cover v1/v2 parsing, malformed rejection, timeout, round-trip write+parse, and five server integration tests: receive with valid header, receive with garbage, send verification, send-disabled verification, and firewall evaluation using the real client IP. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
390 lines
9.6 KiB
Go
390 lines
9.6 KiB
Go
package proxyproto
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/binary"
|
|
"net"
|
|
"net/netip"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
// pipeWithDeadline returns a net.Conn pair where the reader side supports deadlines.
|
|
func pipeWithDeadline(t *testing.T) (reader net.Conn, writer net.Conn) {
|
|
t.Helper()
|
|
ln, err := net.Listen("tcp", "127.0.0.1:0")
|
|
if err != nil {
|
|
t.Fatalf("listen: %v", err)
|
|
}
|
|
t.Cleanup(func() { ln.Close() })
|
|
|
|
ch := make(chan net.Conn, 1)
|
|
go func() {
|
|
c, err := ln.Accept()
|
|
if err != nil {
|
|
return
|
|
}
|
|
ch <- c
|
|
}()
|
|
|
|
w, err := net.Dial("tcp", ln.Addr().String())
|
|
if err != nil {
|
|
t.Fatalf("dial: %v", err)
|
|
}
|
|
t.Cleanup(func() { w.Close() })
|
|
|
|
r := <-ch
|
|
t.Cleanup(func() { r.Close() })
|
|
return r, w
|
|
}
|
|
|
|
func TestParseV1TCP4(t *testing.T) {
|
|
reader, writer := pipeWithDeadline(t)
|
|
|
|
go func() {
|
|
writer.Write([]byte("PROXY TCP4 192.168.1.1 10.0.0.1 56324 443\r\n"))
|
|
}()
|
|
|
|
hdr, err := Parse(reader, time.Now().Add(5*time.Second))
|
|
if err != nil {
|
|
t.Fatalf("Parse: %v", err)
|
|
}
|
|
|
|
if hdr.Version != 1 {
|
|
t.Fatalf("version = %d, want 1", hdr.Version)
|
|
}
|
|
if hdr.Command != CommandProxy {
|
|
t.Fatalf("command = %d, want CommandProxy", hdr.Command)
|
|
}
|
|
if got := hdr.SrcAddr.String(); got != "192.168.1.1:56324" {
|
|
t.Fatalf("src = %s, want 192.168.1.1:56324", got)
|
|
}
|
|
if got := hdr.DstAddr.String(); got != "10.0.0.1:443" {
|
|
t.Fatalf("dst = %s, want 10.0.0.1:443", got)
|
|
}
|
|
}
|
|
|
|
func TestParseV1TCP6(t *testing.T) {
|
|
reader, writer := pipeWithDeadline(t)
|
|
|
|
go func() {
|
|
writer.Write([]byte("PROXY TCP6 2001:db8::1 2001:db8::2 56324 8443\r\n"))
|
|
}()
|
|
|
|
hdr, err := Parse(reader, time.Now().Add(5*time.Second))
|
|
if err != nil {
|
|
t.Fatalf("Parse: %v", err)
|
|
}
|
|
|
|
if hdr.Version != 1 {
|
|
t.Fatalf("version = %d, want 1", hdr.Version)
|
|
}
|
|
wantSrc := "[2001:db8::1]:56324"
|
|
if got := hdr.SrcAddr.String(); got != wantSrc {
|
|
t.Fatalf("src = %s, want %s", got, wantSrc)
|
|
}
|
|
}
|
|
|
|
func TestParseV2TCP4(t *testing.T) {
|
|
reader, writer := pipeWithDeadline(t)
|
|
|
|
go func() {
|
|
var buf []byte
|
|
buf = append(buf, v2Signature[:]...)
|
|
buf = append(buf, 0x21) // version 2, PROXY command
|
|
buf = append(buf, 0x11) // AF_INET, STREAM
|
|
buf = binary.BigEndian.AppendUint16(buf, 12)
|
|
buf = append(buf, 192, 168, 1, 100) // src IP
|
|
buf = append(buf, 10, 0, 0, 1) // dst IP
|
|
buf = binary.BigEndian.AppendUint16(buf, 12345)
|
|
buf = binary.BigEndian.AppendUint16(buf, 443)
|
|
writer.Write(buf)
|
|
}()
|
|
|
|
hdr, err := Parse(reader, time.Now().Add(5*time.Second))
|
|
if err != nil {
|
|
t.Fatalf("Parse: %v", err)
|
|
}
|
|
|
|
if hdr.Version != 2 {
|
|
t.Fatalf("version = %d, want 2", hdr.Version)
|
|
}
|
|
if hdr.Command != CommandProxy {
|
|
t.Fatalf("command = %d, want CommandProxy", hdr.Command)
|
|
}
|
|
if got := hdr.SrcAddr.String(); got != "192.168.1.100:12345" {
|
|
t.Fatalf("src = %s, want 192.168.1.100:12345", got)
|
|
}
|
|
if got := hdr.DstAddr.String(); got != "10.0.0.1:443" {
|
|
t.Fatalf("dst = %s, want 10.0.0.1:443", got)
|
|
}
|
|
}
|
|
|
|
func TestParseV2TCP6(t *testing.T) {
|
|
reader, writer := pipeWithDeadline(t)
|
|
|
|
go func() {
|
|
var buf []byte
|
|
buf = append(buf, v2Signature[:]...)
|
|
buf = append(buf, 0x21) // version 2, PROXY command
|
|
buf = append(buf, 0x21) // AF_INET6, STREAM
|
|
buf = binary.BigEndian.AppendUint16(buf, 36)
|
|
// src: 2001:db8::1
|
|
src := netip.MustParseAddr("2001:db8::1").As16()
|
|
buf = append(buf, src[:]...)
|
|
// dst: 2001:db8::2
|
|
dst := netip.MustParseAddr("2001:db8::2").As16()
|
|
buf = append(buf, dst[:]...)
|
|
buf = binary.BigEndian.AppendUint16(buf, 56324)
|
|
buf = binary.BigEndian.AppendUint16(buf, 8443)
|
|
writer.Write(buf)
|
|
}()
|
|
|
|
hdr, err := Parse(reader, time.Now().Add(5*time.Second))
|
|
if err != nil {
|
|
t.Fatalf("Parse: %v", err)
|
|
}
|
|
|
|
if hdr.Version != 2 {
|
|
t.Fatalf("version = %d, want 2", hdr.Version)
|
|
}
|
|
wantSrc := "[2001:db8::1]:56324"
|
|
if got := hdr.SrcAddr.String(); got != wantSrc {
|
|
t.Fatalf("src = %s, want %s", got, wantSrc)
|
|
}
|
|
}
|
|
|
|
func TestParseV2Local(t *testing.T) {
|
|
reader, writer := pipeWithDeadline(t)
|
|
|
|
go func() {
|
|
var buf []byte
|
|
buf = append(buf, v2Signature[:]...)
|
|
buf = append(buf, 0x20) // version 2, LOCAL command
|
|
buf = append(buf, 0x00) // unspec family, unspec protocol
|
|
buf = binary.BigEndian.AppendUint16(buf, 0)
|
|
writer.Write(buf)
|
|
}()
|
|
|
|
hdr, err := Parse(reader, time.Now().Add(5*time.Second))
|
|
if err != nil {
|
|
t.Fatalf("Parse: %v", err)
|
|
}
|
|
|
|
if hdr.Version != 2 {
|
|
t.Fatalf("version = %d, want 2", hdr.Version)
|
|
}
|
|
if hdr.Command != CommandLocal {
|
|
t.Fatalf("command = %d, want CommandLocal", hdr.Command)
|
|
}
|
|
}
|
|
|
|
func TestParseV1Malformed(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
data string
|
|
}{
|
|
{"wrong prefix", "XROXY TCP4 1.2.3.4 5.6.7.8 1 2\r\n"},
|
|
{"missing fields", "PROXY TCP4 1.2.3.4\r\n"},
|
|
{"bad protocol", "PROXY UDP4 1.2.3.4 5.6.7.8 1 2\r\n"},
|
|
{"bad src IP", "PROXY TCP4 not-an-ip 5.6.7.8 1 2\r\n"},
|
|
{"bad src port", "PROXY TCP4 1.2.3.4 5.6.7.8 notport 2\r\n"},
|
|
{"missing CRLF", "PROXY TCP4 1.2.3.4 5.6.7.8 1 2\n"},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
reader, writer := pipeWithDeadline(t)
|
|
go func() {
|
|
writer.Write([]byte(tt.data))
|
|
}()
|
|
_, err := Parse(reader, time.Now().Add(2*time.Second))
|
|
if err == nil {
|
|
t.Fatal("expected error")
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestParseV2Malformed(t *testing.T) {
|
|
t.Run("bad signature", func(t *testing.T) {
|
|
reader, writer := pipeWithDeadline(t)
|
|
go func() {
|
|
bad := make([]byte, v2HeaderLen)
|
|
bad[0] = v2Signature[0] // first byte matches but rest doesn't
|
|
writer.Write(bad)
|
|
}()
|
|
_, err := Parse(reader, time.Now().Add(2*time.Second))
|
|
if err == nil {
|
|
t.Fatal("expected error for bad signature")
|
|
}
|
|
})
|
|
|
|
t.Run("bad version", func(t *testing.T) {
|
|
reader, writer := pipeWithDeadline(t)
|
|
go func() {
|
|
var buf []byte
|
|
buf = append(buf, v2Signature[:]...)
|
|
buf = append(buf, 0x31) // version 3, PROXY command
|
|
buf = append(buf, 0x11)
|
|
buf = binary.BigEndian.AppendUint16(buf, 0)
|
|
writer.Write(buf)
|
|
}()
|
|
_, err := Parse(reader, time.Now().Add(2*time.Second))
|
|
if err == nil {
|
|
t.Fatal("expected error for bad version")
|
|
}
|
|
})
|
|
|
|
t.Run("truncated address", func(t *testing.T) {
|
|
reader, writer := pipeWithDeadline(t)
|
|
go func() {
|
|
var buf []byte
|
|
buf = append(buf, v2Signature[:]...)
|
|
buf = append(buf, 0x21) // version 2, PROXY
|
|
buf = append(buf, 0x11) // AF_INET, STREAM
|
|
buf = binary.BigEndian.AppendUint16(buf, 12)
|
|
buf = append(buf, 1, 2, 3) // only 3 bytes, need 12
|
|
writer.Write(buf)
|
|
writer.Close()
|
|
}()
|
|
_, err := Parse(reader, time.Now().Add(2*time.Second))
|
|
if err == nil {
|
|
t.Fatal("expected error for truncated address")
|
|
}
|
|
})
|
|
|
|
t.Run("unsupported family", func(t *testing.T) {
|
|
reader, writer := pipeWithDeadline(t)
|
|
go func() {
|
|
var buf []byte
|
|
buf = append(buf, v2Signature[:]...)
|
|
buf = append(buf, 0x21) // version 2, PROXY
|
|
buf = append(buf, 0x31) // AF_UNIX (3), STREAM
|
|
buf = binary.BigEndian.AppendUint16(buf, 0)
|
|
writer.Write(buf)
|
|
}()
|
|
_, err := Parse(reader, time.Now().Add(2*time.Second))
|
|
if err == nil {
|
|
t.Fatal("expected error for unsupported family")
|
|
}
|
|
})
|
|
}
|
|
|
|
func TestParseTimeout(t *testing.T) {
|
|
reader, _ := pipeWithDeadline(t)
|
|
|
|
// No data sent — should hit deadline.
|
|
_, err := Parse(reader, time.Now().Add(100*time.Millisecond))
|
|
if err == nil {
|
|
t.Fatal("expected timeout error")
|
|
}
|
|
}
|
|
|
|
func TestWriteV2IPv4(t *testing.T) {
|
|
src := netip.MustParseAddrPort("192.168.1.1:56324")
|
|
dst := netip.MustParseAddrPort("10.0.0.1:443")
|
|
|
|
var buf bytes.Buffer
|
|
if err := WriteV2(&buf, src, dst); err != nil {
|
|
t.Fatalf("WriteV2: %v", err)
|
|
}
|
|
|
|
b := buf.Bytes()
|
|
// Signature (12) + ver/cmd (1) + fam (1) + len (2) + 4+4+2+2 = 28
|
|
if len(b) != 28 {
|
|
t.Fatalf("wrote %d bytes, want 28", len(b))
|
|
}
|
|
// Verify signature.
|
|
if [12]byte(b[:12]) != v2Signature {
|
|
t.Fatal("bad signature")
|
|
}
|
|
if b[12] != 0x21 {
|
|
t.Fatalf("ver/cmd = 0x%02x, want 0x21", b[12])
|
|
}
|
|
if b[13] != 0x11 {
|
|
t.Fatalf("fam/proto = 0x%02x, want 0x11", b[13])
|
|
}
|
|
}
|
|
|
|
func TestWriteV2IPv6(t *testing.T) {
|
|
src := netip.MustParseAddrPort("[2001:db8::1]:56324")
|
|
dst := netip.MustParseAddrPort("[2001:db8::2]:443")
|
|
|
|
var buf bytes.Buffer
|
|
if err := WriteV2(&buf, src, dst); err != nil {
|
|
t.Fatalf("WriteV2: %v", err)
|
|
}
|
|
|
|
b := buf.Bytes()
|
|
// Signature (12) + ver/cmd (1) + fam (1) + len (2) + 16+16+2+2 = 52
|
|
if len(b) != 52 {
|
|
t.Fatalf("wrote %d bytes, want 52", len(b))
|
|
}
|
|
if b[13] != 0x21 {
|
|
t.Fatalf("fam/proto = 0x%02x, want 0x21", b[13])
|
|
}
|
|
}
|
|
|
|
func TestRoundTripV2IPv4(t *testing.T) {
|
|
src := netip.MustParseAddrPort("203.0.113.50:12345")
|
|
dst := netip.MustParseAddrPort("198.51.100.1:443")
|
|
|
|
reader, writer := pipeWithDeadline(t)
|
|
|
|
go func() {
|
|
WriteV2(writer, src, dst)
|
|
}()
|
|
|
|
hdr, err := Parse(reader, time.Now().Add(5*time.Second))
|
|
if err != nil {
|
|
t.Fatalf("Parse: %v", err)
|
|
}
|
|
|
|
if hdr.Version != 2 {
|
|
t.Fatalf("version = %d, want 2", hdr.Version)
|
|
}
|
|
if hdr.Command != CommandProxy {
|
|
t.Fatalf("command = %d, want CommandProxy", hdr.Command)
|
|
}
|
|
if hdr.SrcAddr != src {
|
|
t.Fatalf("src = %s, want %s", hdr.SrcAddr, src)
|
|
}
|
|
if hdr.DstAddr != dst {
|
|
t.Fatalf("dst = %s, want %s", hdr.DstAddr, dst)
|
|
}
|
|
}
|
|
|
|
func TestRoundTripV2IPv6(t *testing.T) {
|
|
src := netip.MustParseAddrPort("[2001:db8:cafe::1]:40000")
|
|
dst := netip.MustParseAddrPort("[2001:db8:beef::2]:8443")
|
|
|
|
reader, writer := pipeWithDeadline(t)
|
|
|
|
go func() {
|
|
WriteV2(writer, src, dst)
|
|
}()
|
|
|
|
hdr, err := Parse(reader, time.Now().Add(5*time.Second))
|
|
if err != nil {
|
|
t.Fatalf("Parse: %v", err)
|
|
}
|
|
|
|
if hdr.SrcAddr != src {
|
|
t.Fatalf("src = %s, want %s", hdr.SrcAddr, src)
|
|
}
|
|
if hdr.DstAddr != dst {
|
|
t.Fatalf("dst = %s, want %s", hdr.DstAddr, dst)
|
|
}
|
|
}
|
|
|
|
func TestParseGarbageFirstByte(t *testing.T) {
|
|
reader, writer := pipeWithDeadline(t)
|
|
go func() {
|
|
writer.Write([]byte{0xFF, 0x00, 0x01})
|
|
}()
|
|
_, err := Parse(reader, time.Now().Add(2*time.Second))
|
|
if err == nil {
|
|
t.Fatal("expected error for garbage first byte")
|
|
}
|
|
}
|