pires / go-proxyproto

95%

main: 97%

LAST BUILD ON BRANCH refuse

branch: refuse

CHANGE BRANCH

x

Reset

• refuse
• 4in6
• add-azure-support
• add-trust-proxy-header-from
• am/fix_read_deadline
• bugfix/fix-godoc-default-text
• bugfix/reset_conn_read_deadline_after_successful_header
• bump-buf-size
• client-cert
• cm-fix-v1-tcp6-ipv4-addr
• complete_pr36
• conn-header
• default-timeout
• dependabot/go_modules/golang.org/x/net-0.17.0
• dependabot/go_modules/golang.org/x/net-0.23.0
• dependabot/go_modules/golang.org/x/net-0.36.0
• dependabot/go_modules/golang.org/x/net-0.38.0
• dependabot/go_modules/golang.org/x/net-0.55.0
• doc/license
• dynamic-buffer-size
• error-prefix
• feat
• feat/go_1.24
• feat/keep_listening_when_upstream_not_trusted
• feature/bump_coveralls
• feature/go_1.15
• feature/issue-69
• feature/issue-69-tests
• feature/proxy_unknown
• fix-test-len
• fix-v1-command
• fix/go_1.20_lint
• fmt
• gcp-tlv-parser
• gofmt
• h2
• h2-conn-context
• h2-err-server-closed
• header-addr
• header-from-addrs
• header-set-tlv
• large-tlv
• lax-parse-ssl-tlv
• local-port-fix
• main
• marshal-pp2ssl
• master
• misconfigured-tls-integration-error
• mmt/avoid_read_buffer
• mmt/dont_use_read_buffer
• multireader-buf-truncation
• nil-panic-test
• no-buffer
• nuke-tlv-length
• patch-1
• peteski22/dont-error-listener-on-invalid-upstream
• pires/auto_release
• pires/examples/tls
• pires/feat/bump_go
• pires/feat/client_provided__buffer_size
• pires/feat/dinamically_grow_header_buffer
• pires/feat/go_1.26
• pires/feat/linter_modernize
• pires/feat/replace_policyfunc_with_connpolicyfunc
• pires/feat/spec_3.4
• pires/feat/wrap_errors
• pires/fix/4in6
• pires/fix/buffer_header_only
• pires/fix/duplicated_ci_checks
• pires/fix/emersion-h2-conn-context
• pires/fix/http2_nil_connctx_panics
• pires/fix/misc
• pires/fix/readme
• pires/fix/readme_coveralls_badge
• pires/fix/respect_deadlines
• pires/fix/test_local
• pires/fix/tests_cleanup
• pires/pr_2_rework
• pr-to-pires-upstream
• pr_4
• prepare_release
• proxy_handling_policy
• rawmethod
• read_header_timeout
• readerfrom-writerto
• refs/tags/0.1.0
• refs/tags/0.1.1
• refs/tags/0.1.2
• refs/tags/0.2.0
• refs/tags/0.3.0
• refs/tags/v0.0.0-alpha
• refs/tags/v0.1.3
• refs/tags/v0.2.0
• refs/tags/v0.3.0
• refs/tags/v0.3.1
• refs/tags/v0.3.2
• refs/tags/v0.3.3
• refs/tags/v0.4.0
• refs/tags/v0.4.1
• refs/tags/v0.4.2
• refs/tags/v0.5.0
• refs/tags/v0.6.0
• refs/tags/v0.6.1
• refs/tags/v0.7.0
• refs/tags/v0.8.0
• refs/tags/v0.8.1
• refs/tags/v0.9.0
• refs/tags/v0.9.1
• refs/tags/v0.9.2
• skip-header
• ssl-cipher
• staticcheck
• steven-tlvs
• tests/dedupe-protocol-test
• tino
• tlv-unique-id
• typed-constants
• unexport-internal
• unnecessary-limited-reader
• unspec-zero-length
• update-package-comment
• v1-format-mismatch
• v4mappedv6

Build # 10334356689

Build Type

Pull #114

github

Committed by drakkan

Commit Message

policy: add REFUSE

in strict whitelist policies we want to refuse a connection from a not
allowed upstream address whether the proxy header is set or not set.

Before this change if the upstream address is not allowed:

1) if the policy returns REJECT, the connection is allowed if no proxy
   header is sent
2) if the policy returns REQUIRE, the connection is allowed if a proxy
   header is set, even if the upstream address is not allowed to set it.

The new REFUSE policy can be returned for not allowed addresses so that
the connection is always refused.

Pull Request Pull Request #114: policy: add REFUSE

Coverage Stats

3 of 3 new or added lines in 2 files covered. (100.0%)

877 of 922 relevant lines covered (95.12%)

52.47 hits per line