plugin/proxyproto: Apply an explicitly configured default policy evenwhen no allow list is present. (#8278)

* plugin/proxyproto: Apply an explicitly configured default policy even when no allow list is present.

This PR fix the issue where explicitly configured default reject policy
is ignoreed when no allo list is present

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

* golint fix

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

---------

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

plugin/proxyproto/setup.go

@@ -25,6 +25,7 @@ func setup(c *caddy.Controller) error {
 	var (
 		allowedIPNets              []*net.IPNet
 		policy                     = proxyproto.IGNORE
+		defaultSet                 bool
 		sessionTrackingTTL         time.Duration
 		sessionTrackingMaxSessions int
 	)
@@ -44,6 +45,7 @@ func setup(c *caddy.Controller) error {
 					allowedIPNets = append(allowedIPNets, ipnet)
 				}
 			case "default":
+				defaultSet = true
 				v := c.RemainingArgs()
 				if len(v) != 1 {
 					return plugin.Error("proxyproto", c.ArgErr())
@@ -84,6 +86,9 @@ func setup(c *caddy.Controller) error {
 	}
 	config.ProxyProtoConnPolicy = func(connPolicyOptions proxyproto.ConnPolicyOptions) (proxyproto.Policy, error) {
 		if len(allowedIPNets) == 0 {
+			if defaultSet {
+				return policy, nil
+			}
 			return proxyproto.USE, nil
 		}
 		h, _, _ := net.SplitHostPort(connPolicyOptions.Upstream.String())

plugin/proxyproto/setup_test.go

@@ -1,12 +1,15 @@
 package proxyproto
 
 import (
+	"net"
 	"strings"
 	"testing"
 	"time"
 
 	"github.com/coredns/caddy"
 	"github.com/coredns/coredns/core/dnsserver"
+
+	proxyprotoLib "github.com/pires/go-proxyproto"
 )
 
 func TestSetup(t *testing.T) {
@@ -84,3 +87,32 @@ func TestSetup(t *testing.T) {
 		}
 	}
 }
+
+func TestDefaultPolicyWithoutAllow(t *testing.T) {
+	c := caddy.NewTestController(
+		"dns",
+		"proxyproto {\ndefault reject\n}",
+	)
+
+	if err := setup(c); err != nil {
+		t.Fatal(err)
+	}
+
+	cfg := dnsserver.GetConfig(c)
+
+	policy, err := cfg.ProxyProtoConnPolicy(
+		proxyprotoLib.ConnPolicyOptions{
+			Upstream: &net.TCPAddr{
+				IP:   net.ParseIP("192.0.2.1"),
+				Port: 53,
+			},
+		},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if policy != proxyprotoLib.REJECT {
+		t.Fatalf("Expected REJECT, got %v", policy)
+	}
+}