v1.0.1
Security
Upgrade if you run with EnableProxyProtocol behind a proxy.
-
The
PROXYcommand comes first in a session, and a later one gets a503
reply. A proxy writes its header before it passes on anything of the
client, so aPROXYcommand that comes after a command comes from the
client behind the proxy.handlePROXYtook every one of them. Each wrotePeer.Addrand ran the
ConnectionCheckeragain, so a client behind the proxy could take the
address of another one. Every checker of the session readsPeer.Addr.This changes behavior. A client that sends
PROXYtwice gets a503
for the second one, where it got a greeting before.
The v2 line carries the same fix in v2.4.0.
Fixed
- The CI workflow runs for the
v1branch. The triggers namedmaster, so no
workflow ran for a push to the branch or for a pull request against it.