Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow specifically accessing the proxy source address #14

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

euank
Copy link

@euank euank commented May 20, 2020

This distinguishing the case where a source address could not be
determined, i.e. because the proxy header could not be read.

I think this PR makes sense in some cases. For my use-case, we have a proxy connection (which should always have the proxy header), and we want to know the ip of the remote client.

Our code naively looks like so:

conn, err := proxyListener.Accept()
if err != nil {
  return err
}
addr := conn.RemoteAddr()
....

This code, unfortunately, sometimes gets the proxy's address instead of the remote client's address (i.e. in cases where the system's under load and the proxy server has issues writing the header).

This is because the RemoteAddr() call chooses to return the underlying connection's address in some cases:

go-proxyproto/protocol.go

Lines 164 to 170 in f0b8253

func (p *Conn) RemoteAddr() net.Addr {
p.checkPrefixOnce()
if p.srcAddr != nil && !p.useConnAddr {
return p.srcAddr
}
return p.conn.RemoteAddr()
}

Basically, checkPrefixOnce may error out, and if it does I want to know, but that error doesn't get bubbled up from RemoteAddr or Accept.

One alternative solution we could probably take is the following:

conn, err := proxyListener.Accept()
if err != nil {
  return err
}
zeroBytes := []byte{}
if _, err := conn.Read(zeroBytes); err != nil {
   // error reading proxy header
   return err
}
addr := conn.RemoteAddr()

This isn't tested, but I think that would also solve the problem I'm facing (since Read reads the header, and also does bubble up errors it encounters).

However, it seems inelegant compared to having a more explicit method to distinguish whether the connection is proxied or not.

This distinguishing the case where a source address could not be
determined, i.e. because the proxy header could not be read.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant