code: func (c *connectionWrapper) Read(b []byte) (int, error) {
  	// handshake already took place, forward upstream:
  	if c.upstreamReader != nil {
  		return c.upstreamReader.Read(b)
  	}
  	// inspect the client's hello message and see if it's a teleport
  	// proxy connecting?
  	buff := make([]byte, MaxVersionStringBytes)
  	n, err := c.Conn.Read(buff)
  	if err != nil {
  		// EOF happens quite often, don't pollute the logs with EOF
  		if err != io.EOF {
  			log.Error(err)
  		}
  		return n, err
  	}
  	// chop off extra unused bytes at the end of the buffer:
  	buff = buff[:n]
  	var skip = 0
  
  	// are we reading from a Teleport proxy?
  	if bytes.HasPrefix(buff, []byte(ProxyHelloSignature)) {
  		// the JSON paylaod ends with a binary zero:
  		payloadBoundary := bytes.IndexByte(buff, 0x00)
  		if payloadBoundary > 0 {
  			var hp HandshakePayload
  			payload := buff[len(ProxyHelloSignature):payloadBoundary]
  			if err = json.Unmarshal(payload, &hp); err != nil {
  				log.Error(err)
  			} else {
  				ca, err := utils.ParseAddr(hp.ClientAddr)
  				if err != nil {
  					log.Error(err)
  				} else {
  					// replace proxy's client addr with a real client address
  					// we just got from the custom payload:
  					c.clientAddr = ca
  				}
  			}
  			skip = payloadBoundary + 1
  		}
  	}
  	c.upstreamReader = io.MultiReader(bytes.NewBuffer(buff[skip:]), c.Conn)
  	return c.upstreamReader.Read(b)
  }
docs: // Read implements io.Read() part of net.Connection which allows us
  // peek at the beginning of SSH handshake (that's why we're wrapping the connection)