Reject non-proxied connections when proxy protocol is enabled532-proxy-protocol-require

This will help to prevent misconfigurations.

Changelog: fixed

1 files changed, 5 insertions, 0 deletions

diff --git a/internal/sshd/sshd.go b/internal/sshd/sshd.go
index 19fa661..d765faf 100644
--- a/internal/sshd/sshd.go
+++ b/internal/sshd/sshd.go
@@ -94,6 +94,7 @@ func (s *Server) listen(ctx context.Context) error {
 	if s.Config.Server.ProxyProtocol {
 		sshListener = &proxyproto.Listener{
 			Listener:          sshListener,
+			Policy:            unconditionalRequirePolicy,
 			ReadHeaderTimeout: ProxyHeaderTimeout,
 		}
 
@@ -185,3 +186,7 @@ func (s *Server) handleConn(ctx context.Context, nconn net.Conn) {
 
 	ctxlog.Info("server: handleConn: done")
 }
+
+func unconditionalRequirePolicy(_ net.Addr) (proxyproto.Policy, error) {
+	return proxyproto.REQUIRE, nil
+}