Documentation
¶
Overview ¶
Package egress sends a runner's checked requests to outside services. It resolves each host for every connection, refuses the request when any address of the answer is denied, and dials only an address that passed that check, over TLS with the host's name. It follows no redirect and bounds each request in time and its response body in size.
A *Client is the runner's server.Outbound provider.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Denied ¶
Denied reports whether a is on the base list of addresses no app may reach: unspecified, loopback, private, link-local, multicast, shared (CGNAT), documentation, benchmarking, reserved and broadcast addresses, and the IPv6 ranges that carry IPv4 addresses (IPv4-compatible, IPv4-translated, NAT64, Teredo, 6to4). Cloud metadata addresses, such as 169.254.169.254 and fd00:ec2::254, fall in these ranges. An IPv4-mapped IPv6 address is checked as its IPv4 address, an address with a zone without it, and the zero Addr is denied.
Types ¶
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client sends requests to outside services. It is safe for concurrent use.
func (*Client) CloseIdleConnections ¶
func (c *Client) CloseIdleConnections()
CloseIdleConnections closes the connections c keeps open for later requests, so that the next request to each host resolves and checks it again.
func (*Client) Do ¶
Do sends req, an https request to port 443, and returns the response as the service sent it: a redirect is not followed. The whole request, until the response body is closed, has runnerproto.OutboundDeadline, and the body yields at most runnerproto.MaxOutboundBody bytes. A refusal or failure, of Do or of a read of the body, is an *errs.Error with an E-OUT code.
type Options ¶
type Options struct {
// Deny reports more addresses no app may reach, beyond those Denied reports. It gets an
// IPv4-mapped IPv6 address as its IPv4 address, and an address without its zone. It is
// asked when a connection is made: a connection already open keeps the peer it was checked
// for, so a caller that changes what Deny refuses calls Client.CloseIdleConnections.
Deny func(netip.Addr) bool
// Resolver resolves hosts; nil is net.DefaultResolver.
Resolver Resolver
// DialContext connects to an address that passed the check, as "ip:443". It exists for
// tests; nil is a net.Dialer that checks the address again just before it connects.
DialContext func(ctx context.Context, network, address string) (net.Conn, error)
// RootCAs are the certificate authorities a service's certificate must chain to. It exists
// for tests; nil is the system's roots.
RootCAs *x509.CertPool
}
Options configure a Client.
Source Files