proxyproto

package
v1.15.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 21, 2026 License: Apache-2.0 Imports: 10 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func NewTLVListener added in v1.15.0

func NewTLVListener(l net.Listener, connPolicy proxyproto.ConnPolicyFunc) net.Listener

NewTLVListener wraps l with a proxyproto.Listener using connPolicy, and makes accepted connections surface the PPv2 TLV vector via RemoteAddr. The TLVs ride on the address only to cross the miekg/dns boundary; the proxyproto plugin reads them back and publishes them as request metadata.

Types

type Addr

type Addr struct {
	// contains filtered or unexported fields
}

func AddrFromConn added in v1.15.0

func AddrFromConn(conn net.Conn) *Addr

AddrFromConn returns an *Addr carrying the connection's PPv2 TLVs, or nil if none are available. It first checks whether RemoteAddr already yields an *Addr (our tlvConn's RemoteAddr is promoted through wrappers such as *tls.Conn and the connection-limiting conn, which all delegate RemoteAddr), then falls back to unwrapping to a *proxyproto.Conn. Transports that do not use RemoteAddr as the capture path (e.g. DoH) call this to recover the TLVs.

func NewAddr added in v1.15.0

func NewAddr(underlying, real net.Addr, rawTLVs []byte) *Addr

NewAddr returns an Addr whose Network reflects underlying, whose String reflects real (the PROXY-reported client), and that carries the raw PPv2 TLV vector (may be nil).

func (*Addr) Network

func (a *Addr) Network() string

func (*Addr) RawTLVs added in v1.15.0

func (a *Addr) RawTLVs() []byte

RawTLVs returns the raw PPv2 TLV vector carried with this address, or nil.

func (*Addr) String

func (a *Addr) String() string

func (*Addr) Unwrap added in v1.15.0

func (a *Addr) Unwrap() net.Addr

Unwrap returns the underlying real client address (a *net.TCPAddr or *net.UDPAddr). Callers that classify by concrete transport/family type — e.g. request.Proto and request.Family — unwrap through this so an Addr is treated as its real transport rather than an unknown net.Addr.

type PacketConn

type PacketConn struct {
	net.PacketConn
	ConnPolicy        proxyproto.ConnPolicyFunc
	ValidateHeader    proxyproto.Validator
	ReadHeaderTimeout time.Duration

	// UDPSessionTrackingTTL enables per-remote-address session state for UDP
	// when set to a positive duration. A header-only datagram (valid PPv2
	// header with or without payload) causes the parsed source address to be
	// cached for this duration. Subsequent datagrams from the same remote
	// address that carry no PPv2 header are assigned the cached source
	// address. The TTL is refreshed on every matching packet. A zero or
	// negative value disables session tracking entirely.
	UDPSessionTrackingTTL time.Duration

	// UDPSessionTrackingMaxSessions is the maximum number of concurrent UDP
	// sessions held in the LRU cache. Zero or negative means use the default
	// (udpSessionMaxEntries). Has no effect unless UDPSessionTrackingTTL is
	// positive.
	UDPSessionTrackingMaxSessions int

	// CaptureTLVs populates Addr.rawTLVs from the PPv2 header when set. Opt-in,
	// so connections without it skip the extra TLV processing.
	CaptureTLVs bool
	// contains filtered or unexported fields
}

PacketConn wraps a net.PacketConn and strips PROXY Protocol v2 headers from incoming UDP datagrams.

When UDPSessionTrackingTTL is greater than zero the connection implements Cloudflare Spectrum's PPv2-over-UDP behavior: the PROXY header arrives in the very first datagram of a session (which may carries an empty payload) while all subsequent datagrams carry real DNS payload without any header. The real source address parsed from the first datagram is cached keyed by the Spectrum-side remote address and applied to every headerless datagram that arrives from the same remote address within UDPSessionTrackingTTL.

The session cache is a fixed-capacity LRU (capped at udpSessionMaxEntries) so that memory usage is bounded regardless of the number of distinct remote addresses seen.

func (*PacketConn) ReadFrom

func (c *PacketConn) ReadFrom(p []byte) (n int, addr net.Addr, err error)

func (*PacketConn) WriteTo

func (c *PacketConn) WriteTo(p []byte, addr net.Addr) (n int, err error)

type TLVListener added in v1.15.0

type TLVListener struct {
	// contains filtered or unexported fields
}

TLVListener is a net.Listener whose connections surface PPv2 TLVs via RemoteAddr. Construct one with NewTLVListener.

func (*TLVListener) Accept added in v1.15.0

func (l *TLVListener) Accept() (net.Conn, error)

Accept returns a connection whose RemoteAddr is a *Addr carrying the PPv2 TLVs, when the accepted connection is a *proxyproto.Conn with a header.

func (*TLVListener) Addr added in v1.15.0

func (l *TLVListener) Addr() net.Addr

func (*TLVListener) Close added in v1.15.0

func (l *TLVListener) Close() error

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL