proxyproto

Jul 9, 2026

Changes in this version

+ var DefaultPolicy = REQUIRE

+ var MaxV2HeaderSize uint16 = 4096

+ var V1AcceptIPv4InTCP6 = false

type ConnPolicyFunc

+ func MustPolicyFromRanges(ranges []string, matched, unmatched Policy) ConnPolicyFunc

+ func PolicyFromRanges(ranges []string, matched, unmatched Policy) (ConnPolicyFunc, error)

+ func TrustProxyHeaderFromRanges(trusted []string) (ConnPolicyFunc, error)

type Header

+ func ParseUDPDatagram(datagram []byte) (*Header, []byte, error)

+ func (header *Header) FormatUDPDatagram(payload []byte) ([]byte, error)

Jul 1, 2026

Changes in this version

type Header

+ func ReadHeaderTimeout(conn net.Conn, reader *bufio.Reader, timeout time.Duration) (*Header, error)

Feb 6, 2026

Changes in this version

+ func WithBufferSize(length int) func(*Conn)

type Listener

+ ReadBufferSize int

Jan 24, 2026

Changes in this version

type PP2Type

+ const PP2_SUBTYPE_SSL_CLIENT_CERT

Jan 20, 2026

Changes in this version

type ConnPolicyFunc

+ func ConnLaxWhiteListPolicy(allowed []string) (ConnPolicyFunc, error)

+ func ConnMustLaxWhiteListPolicy(allowed []string) ConnPolicyFunc

+ func ConnMustStrictWhiteListPolicy(allowed []string) ConnPolicyFunc

+ func ConnSkipProxyHeaderForCIDR(skipHeaderCIDR *net.IPNet, def Policy) ConnPolicyFunc

+ func ConnStrictWhiteListPolicy(allowed []string) (ConnPolicyFunc, error)

+ func TrustProxyHeaderFrom(trustedIPs ...net.IP) ConnPolicyFunc

type PP2Type

+ const PP2_SUBTYPE_SSL_GROUP

+ const PP2_SUBTYPE_SSL_SIG_SCHEME

Oct 8, 2024

Changes in this version

+ var ErrInvalidUpstream = fmt.Errorf("proxyproto: upstream connection address not trusted for PROXY information")

+ func SetReadHeaderTimeout(t time.Duration) func(*Conn)

+ type ConnPolicyFunc func(connPolicyOptions ConnPolicyOptions) (Policy, error)

+ func IgnoreProxyHeaderNotOnInterface(allowedIP net.IP) ConnPolicyFunc

+ type ConnPolicyOptions struct

+ Downstream net.Addr

+ Upstream net.Addr

type Listener

+ ConnPolicy ConnPolicyFunc

Mar 15, 2023

Changes in this version

type Policy

+ const SKIP

type PolicyFunc

+ func SkipProxyHeaderForCIDR(skipHeaderCIDR *net.IPNet, def Policy) PolicyFunc

Sep 8, 2021

Changes in this version

+ var DefaultReadHeaderTimeout = 200 * time.Millisecond

Apr 22, 2021 GO-2022-0233

  GO-2022-0233: Resource exhaustion in github.com/pires/go-proxyproto

Changes in this version

type Listener

+ ReadHeaderTimeout time.Duration

Mar 4, 2021 GO-2022-0233

  GO-2022-0233: Resource exhaustion in github.com/pires/go-proxyproto

Changes in this version

+ var ErrCantReadVersion1Header = errors.New("proxyproto: can't read version 1 header")

+ var ErrVersion1HeaderTooLong = errors.New("proxyproto: version 1 header must be 107 bytes or less")

type Conn

+ func (p *Conn) ReadFrom(r io.Reader) (int64, error)

+ func (p *Conn) WriteTo(w io.Writer) (int64, error)

type PP2Type

+ const PP2_TYPE_UNIQUE_ID

Jan 28, 2021 GO-2022-0233

  GO-2022-0233: Resource exhaustion in github.com/pires/go-proxyproto

Jan 20, 2021 GO-2022-0233

  GO-2022-0233: Resource exhaustion in github.com/pires/go-proxyproto

Jan 18, 2021 GO-2022-0233

  GO-2022-0233: Resource exhaustion in github.com/pires/go-proxyproto

Changes in this version

+ var ErrLineMustEndWithCrlf = errors.New("proxyproto: header is invalid, must end with \\r\\n")

Dec 9, 2020 GO-2022-0233

  GO-2022-0233: Resource exhaustion in github.com/pires/go-proxyproto

Changes in this version

type Conn

+ func (p *Conn) Raw() net.Conn

Nov 9, 2020 GO-2022-0233

  GO-2022-0233: Resource exhaustion in github.com/pires/go-proxyproto

Changes in this version

type Conn

+ func (p *Conn) ProxyHeader() *Header

Oct 30, 2020 GO-2022-0233

  GO-2022-0233: Resource exhaustion in github.com/pires/go-proxyproto

Changes in this version

type Conn

+ func (p *Conn) TCPConn() (conn *net.TCPConn, ok bool)

+ func (p *Conn) UDPConn() (conn *net.UDPConn, ok bool)

+ func (p *Conn) UnixConn() (conn *net.UnixConn, ok bool)

Oct 28, 2020 GO-2022-0233

  GO-2022-0233: Resource exhaustion in github.com/pires/go-proxyproto

Changes in this version

type Header

+ DestinationAddr net.Addr

+ SourceAddr net.Addr

+ func (header *Header) IPs() (sourceIP, destIP net.IP, ok bool)

+ func (header *Header) Ports() (sourcePort, destPort int, ok bool)

+ func (header *Header) TCPAddrs() (sourceAddr, destAddr *net.TCPAddr, ok bool)

+ func (header *Header) UDPAddrs() (sourceAddr, destAddr *net.UDPAddr, ok bool)

+ func (header *Header) UnixAddrs() (sourceAddr, destAddr *net.UnixAddr, ok bool)

Oct 2, 2020 GO-2022-0233

  GO-2022-0233: Resource exhaustion in github.com/pires/go-proxyproto

Changes in this version

+ func JoinTLVs(tlvs []TLV) ([]byte, error)

type Header

+ func HeaderProxyFromAddrs(version byte, sourceAddr, destAddr net.Addr) *Header

+ func (header *Header) SetTLVs(tlvs []TLV) error

May 8, 2020 GO-2022-0233

  GO-2022-0233: Resource exhaustion in github.com/pires/go-proxyproto

Changes in this version

+ const CRLF

+ const LOCAL

+ const PP2_SUBTYPE_SSL_CIPHER

+ const PP2_SUBTYPE_SSL_CN

+ const PP2_SUBTYPE_SSL_KEY_ALG

+ const PP2_SUBTYPE_SSL_SIG_ALG

+ const PP2_SUBTYPE_SSL_VERSION

+ const PP2_TYPE_ALPN

+ const PP2_TYPE_AUTHORITY

+ const PP2_TYPE_CRC32C

+ const PP2_TYPE_MAX_CUSTOM

+ const PP2_TYPE_MAX_EXPERIMENT

+ const PP2_TYPE_MAX_FUTURE

+ const PP2_TYPE_MIN_CUSTOM

+ const PP2_TYPE_MIN_EXPERIMENT

+ const PP2_TYPE_MIN_FUTURE

+ const PP2_TYPE_NETNS

+ const PP2_TYPE_NOOP

+ const PP2_TYPE_SSL

+ const PROXY

+ const SEPARATOR

+ const TCPv4

+ const TCPv6

+ const UDPv4

+ const UDPv6

+ const UNSPEC

+ const UnixDatagram

+ const UnixStream

+ var ErrCantReadAddressFamilyAndProtocol = errors.New("Can't read address family or protocol")

+ var ErrCantReadLength = errors.New("Can't read length")

+ var ErrCantReadProtocolVersionAndCommand = errors.New("Can't read proxy protocol version and command")

+ var ErrCantResolveDestinationUnixAddress = errors.New("Can't resolve destination Unix address")

+ var ErrCantResolveSourceUnixAddress = errors.New("Can't resolve source Unix address")

+ var ErrIncompatibleTLV = errors.New("Incompatible TLV type")

+ var ErrInvalidAddress = errors.New("Invalid address")

+ var ErrInvalidLength = errors.New("Invalid length")

+ var ErrInvalidPortNumber = errors.New("Invalid port number")

+ var ErrMalformedTLV = errors.New("Malformed TLV Value")

+ var ErrNoProxyProtocol = errors.New("Proxy protocol signature not present")

+ var ErrSuperfluousProxyHeader = errors.New("Upstream connection sent PROXY header but isn't allowed to send one")

+ var ErrTruncatedTLV = errors.New("Truncated TLV")

+ var ErrUnknownProxyProtocolVersion = errors.New("Unknown proxy protocol version")

+ var ErrUnsupportedAddressFamilyAndProtocol = errors.New("Unsupported address family and protocol")

+ var ErrUnsupportedProtocolVersionAndCommand = errors.New("Unsupported proxy protocol version and command")

+ var SIGV1 = []byte

+ var SIGV2 = []byte

+ func ValidateHeader(v Validator) func(*Conn)

+ func WithPolicy(p Policy) func(*Conn)

+ type AddressFamilyAndProtocol byte

+ func (ap AddressFamilyAndProtocol) IsDatagram() bool

+ func (ap AddressFamilyAndProtocol) IsIPv4() bool

+ func (ap AddressFamilyAndProtocol) IsIPv6() bool

+ func (ap AddressFamilyAndProtocol) IsStream() bool

+ func (ap AddressFamilyAndProtocol) IsUnix() bool

+ func (ap AddressFamilyAndProtocol) IsUnspec() bool

+ type Conn struct

+ ProxyHeaderPolicy Policy

+ Validate Validator

+ func NewConn(conn net.Conn, opts ...func(*Conn)) *Conn

+ func (p *Conn) Close() error

+ func (p *Conn) LocalAddr() net.Addr

+ func (p *Conn) Read(b []byte) (int, error)

+ func (p *Conn) RemoteAddr() net.Addr

+ func (p *Conn) SetDeadline(t time.Time) error

+ func (p *Conn) SetReadDeadline(t time.Time) error

+ func (p *Conn) SetWriteDeadline(t time.Time) error

+ func (p *Conn) Write(b []byte) (int, error)

+ type Header struct

+ Command ProtocolVersionAndCommand

+ DestinationAddress net.IP

+ DestinationPort uint16

+ SourceAddress net.IP

+ SourcePort uint16

+ TransportProtocol AddressFamilyAndProtocol

+ Version byte

+ func Read(reader *bufio.Reader) (*Header, error)

+ func ReadTimeout(reader *bufio.Reader, timeout time.Duration) (*Header, error)

+ func (header *Header) EqualTo(otherHeader *Header) bool

+ func (header *Header) EqualsTo(otherHeader *Header) bool

+ func (header *Header) Format() ([]byte, error)

+ func (header *Header) LocalAddr() net.Addr

+ func (header *Header) RemoteAddr() net.Addr

+ func (header *Header) TLVs() ([]TLV, error)

+ func (header *Header) WriteTo(w io.Writer) (int64, error)

+ type Listener struct

+ Listener net.Listener

+ Policy PolicyFunc

+ ValidateHeader Validator

+ func (p *Listener) Accept() (net.Conn, error)

+ func (p *Listener) Addr() net.Addr

+ func (p *Listener) Close() error

+ type PP2Type byte

+ func (p PP2Type) App() bool

+ func (p PP2Type) Experiment() bool

+ func (p PP2Type) Future() bool

+ func (p PP2Type) Registered() bool

+ func (p PP2Type) Spec() bool

+ type Policy int

+ const IGNORE

+ const REJECT

+ const REQUIRE

+ const USE

+ type PolicyFunc func(upstream net.Addr) (Policy, error)

+ func LaxWhiteListPolicy(allowed []string) (PolicyFunc, error)

+ func MustLaxWhiteListPolicy(allowed []string) PolicyFunc

+ func MustStrictWhiteListPolicy(allowed []string) PolicyFunc

+ func StrictWhiteListPolicy(allowed []string) (PolicyFunc, error)

+ type ProtocolVersionAndCommand byte

+ func (pvc ProtocolVersionAndCommand) IsLocal() bool

+ func (pvc ProtocolVersionAndCommand) IsProxy() bool

+ func (pvc ProtocolVersionAndCommand) IsUnspec() bool

+ type TLV struct

+ Length int

+ Type PP2Type

+ Value []byte

+ func SplitTLVs(raw []byte) ([]TLV, error)

+ type Validator func(*Header) error