From 5131b8f9444bfb8c9689d15d77a68bcaf521ba3e Mon Sep 17 00:00:00 2001
From: Yong Tang <yong.tang.github@outlook.com>
Date: Mon, 13 Jul 2026 17:34:30 -0700
Subject: [PATCH] plugin/proxyproto: Apply an explicitly configured default
 policy evenwhen no allow list is present. (#8278)

* plugin/proxyproto: Apply an explicitly configured default policy even when no allow list is present.

This PR fix the issue where explicitly configured default reject policy
is ignoreed when no allo list is present

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

* golint fix

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

---------

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
---
 plugin/proxyproto/setup.go      |  5 +++++
 plugin/proxyproto/setup_test.go | 32 ++++++++++++++++++++++++++++++++
 2 files changed, 37 insertions(+)

diff --git a/plugin/proxyproto/setup.go b/plugin/proxyproto/setup.go
index fd4a3a7bb..58ce598e9 100644
--- a/plugin/proxyproto/setup.go
+++ b/plugin/proxyproto/setup.go
@@ -25,6 +25,7 @@ func setup(c *caddy.Controller) error {
 	var (
 		allowedIPNets              []*net.IPNet
 		policy                     = proxyproto.IGNORE
+		defaultSet                 bool
 		sessionTrackingTTL         time.Duration
 		sessionTrackingMaxSessions int
 	)
@@ -44,6 +45,7 @@ func setup(c *caddy.Controller) error {
 					allowedIPNets = append(allowedIPNets, ipnet)
 				}
 			case "default":
+				defaultSet = true
 				v := c.RemainingArgs()
 				if len(v) != 1 {
 					return plugin.Error("proxyproto", c.ArgErr())
@@ -84,6 +86,9 @@ func setup(c *caddy.Controller) error {
 	}
 	config.ProxyProtoConnPolicy = func(connPolicyOptions proxyproto.ConnPolicyOptions) (proxyproto.Policy, error) {
 		if len(allowedIPNets) == 0 {
+			if defaultSet {
+				return policy, nil
+			}
 			return proxyproto.USE, nil
 		}
 		h, _, _ := net.SplitHostPort(connPolicyOptions.Upstream.String())
diff --git a/plugin/proxyproto/setup_test.go b/plugin/proxyproto/setup_test.go
index 455748534..154c01055 100644
--- a/plugin/proxyproto/setup_test.go
+++ b/plugin/proxyproto/setup_test.go
@@ -1,12 +1,15 @@
 package proxyproto
 
 import (
+	"net"
 	"strings"
 	"testing"
 	"time"
 
 	"github.com/coredns/caddy"
 	"github.com/coredns/coredns/core/dnsserver"
+
+	proxyprotoLib "github.com/pires/go-proxyproto"
 )
 
 func TestSetup(t *testing.T) {
@@ -84,3 +87,32 @@ func TestSetup(t *testing.T) {
 		}
 	}
 }
+
+func TestDefaultPolicyWithoutAllow(t *testing.T) {
+	c := caddy.NewTestController(
+		"dns",
+		"proxyproto {\ndefault reject\n}",
+	)
+
+	if err := setup(c); err != nil {
+		t.Fatal(err)
+	}
+
+	cfg := dnsserver.GetConfig(c)
+
+	policy, err := cfg.ProxyProtoConnPolicy(
+		proxyprotoLib.ConnPolicyOptions{
+			Upstream: &net.TCPAddr{
+				IP:   net.ParseIP("192.0.2.1"),
+				Port: 53,
+			},
+		},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if policy != proxyprotoLib.REJECT {
+		t.Fatalf("Expected REJECT, got %v", policy)
+	}
+}